From 0a53d662d746155be91489281ca0270d47486159 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ramon=20R=C3=BCttimann?= Date: Thu, 29 Oct 2020 11:40:40 +0100 Subject: [PATCH 001/478] Fix order of extra_binds Extra bind mounts have the order :. When copying the example from the documentation, the kubelet was not coming up anymore because it tried to mount `/host/dev` to `/dev`. Output from `docker inspect` on the kubelet container: ``` { "Type": "bind", "Source": "/host/dev", "Destination": "/dev", "Mode": "", "RW": true, "Propagation": "rprivate" }, ``` This commit fixes the order of the paths in the documentation. --- .../latest/en/config-options/services/services-extras/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rke/latest/en/config-options/services/services-extras/_index.md b/content/rke/latest/en/config-options/services/services-extras/_index.md index 57f623800ab..e6f9a55a5c9 100644 --- a/content/rke/latest/en/config-options/services/services-extras/_index.md +++ b/content/rke/latest/en/config-options/services/services-extras/_index.md @@ -34,7 +34,7 @@ Additional volume binds can be added to services using the `extra_binds` argumen services: kubelet: extra_binds: - - "/host/dev:/dev" + - "/dev:/host/dev" - "/usr/libexec/kubernetes/kubelet-plugins:/usr/libexec/kubernetes/kubelet-plugins:z" ``` From 2de9a165cb8a4cedf5722e1e4a6d69a378d3129b Mon Sep 17 00:00:00 2001 From: Ryan Gibbons Date: Mon, 24 May 2021 19:15:36 -0500 Subject: [PATCH 002/478] Updating example of "Customizing your Ingress" This is a bit deceiving in the current form has the path for cert-manager has changed. Other changes include: * the changing the value to more identifiable suggestion * Adding ingress.tls.source to secret which has the template skip the setting of Issuer for the ingress, allowing ClusterIssuer to take effect. --- .../install-rancher-on-k8s/chart-options/_index.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/chart-options/_index.md b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/chart-options/_index.md index 68bdf90f03e..9ee59ac0aef 100644 --- a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/chart-options/_index.md +++ b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/chart-options/_index.md @@ -128,7 +128,8 @@ To customize or use a different ingress with Rancher server you can set your own Example on setting a custom certificate issuer: ```plain ---set ingress.extraAnnotations.'certmanager\.k8s\.io/cluster-issuer'=ca-key-pair +--set ingress.tls.source=secret +--set ingress.extraAnnotations.'cert-manager\.io/cluster-issuer'=issuer-name ``` Example on setting a static proxy header with `ingress.configurationSnippet`. This value is parsed like a template so variables can be used. From 13310002ce19ad9ecc633585f6a6dafc300da96c Mon Sep 17 00:00:00 2001 From: John Wood Date: Thu, 1 Jul 2021 14:02:15 +0100 Subject: [PATCH 003/478] Update _index.md Documentation doesn't reflect new-user experience - took me ages to find out how to add a new cluster following the supposed "quick-start" guide!! --- .../deployment/quickstart-manual-setup/_index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/rancher/v2.5/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md b/content/rancher/v2.5/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md index 83e895694ff..4a8bddcd236 100644 --- a/content/rancher/v2.5/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md +++ b/content/rancher/v2.5/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md @@ -74,6 +74,8 @@ Welcome to Rancher! You are now able to create your first Kubernetes cluster. In this task, you can use the versatile **Custom** option. This option lets you add _any_ Linux host (cloud-hosted VM, on-prem VM, or bare-metal) to be used in a cluster. +0. (If you are presented with "Cluster Dashboard", click the "Cluster Manager" button, then from the "local" dropdown, select "Global") + 1. From the **Clusters** page, click **Add Cluster**. 2. Choose **Existing Nodes**. From b66a1bd519bea149a854d1f396e64d0a336e3f31 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Fri, 8 Oct 2021 09:33:38 -0700 Subject: [PATCH 004/478] Dockershim update --- .../rancher/v2.6/en/faq/dockershim/_index.md | 44 +++++++++++++++++++ .../en/installation/requirements/_index.md | 10 +---- .../requirements/dockershim/_index.md | 44 +++++++++++++++++++ .../resources/k8s-tutorials/ha-RKE/_index.md | 2 + 4 files changed, 91 insertions(+), 9 deletions(-) create mode 100644 content/rancher/v2.6/en/faq/dockershim/_index.md create mode 100644 content/rancher/v2.6/en/installation/requirements/dockershim/_index.md diff --git a/content/rancher/v2.6/en/faq/dockershim/_index.md b/content/rancher/v2.6/en/faq/dockershim/_index.md new file mode 100644 index 00000000000..691d23d2785 --- /dev/null +++ b/content/rancher/v2.6/en/faq/dockershim/_index.md @@ -0,0 +1,44 @@ +--- +title: Dockershim +weight: 300 +--- + +The Dockershim is the CRI compliant layer between the Kubelet and the Docker daemon. As part of the Kubernetes 1.20 release, the [deprecation of the in-tree Dockershim was announced](https://kubernetes.io/blog/2020/12/02/dont-panic-kubernetes-and-docker/). For more information on the deprecation and its timelines, see the [Kubernetes Dockershim Deprecation FAQ](https://kubernetes.io/blog/2020/12/02/dockershim-faq/#when-will-dockershim-be-removed). + +RKE clusters now support the external Dockershim to continue leveraging Docker as the CRI runtime. We now implement the upstream open source community Dockershim announced by [Mirantis and Docker](https://www.mirantis.com/blog/mirantis-to-take-over-support-of-kubernetes-dockershim-2/) to ensure RKE clusters can continue to leverage Docker. + +This new component that replaces the old Dockershim, called `cri-dockerd`, will need to enabled using the option listed below. Note that to use this option will require at least Kubernetes 1.21. + +``` +enable_cri_dockerd: true +``` + +For users looking to use another container runtime, Rancher has the edge-focused K3s and datacenter-focused RKE2 Kubernetes distributions that use containerd as the default runtime. Imported RKE2 and K3s Kubernetes clusters can then be upgraded and managed through Rancher going forward. + +### FAQ + +
+ +Q. Do I have to upgrade Rancher to get Rancher’s support of the upstream Dockershim? + +A The upstream support of Dockershim begins for RKE in Kubernetes 1.21. You will need to be on a version of Rancher that supports RKE 1.21. See our support matrix for details. + +
+ +Q. I am currently on RKE with Kubernetes 1.20. Do I need to upgrade to RKE with Kubernetes 1.21 sooner to avoid being out of support for Dockershim? + +A. The version of Dockershim in RKE with Kubernetes 1.20 will continue to work and it is not deprecated until a later release. For information on the timeline, see the [Kubernetes Dockershim Deprecation FAQ](https://kubernetes.io/blog/2020/12/02/dockershim-faq/#when-will-dockershim-be-removed). It will only emit a warning of its future deprecation, which Rancher has mitigated in RKE with Kubernetes 1.21. You can plan your upgrade to 1.21 as you would normally. + +
+ +Q: What are my other options if I don’t want to depend on the Dockershim? + +A: You can use a runtime like containerd with Kubernetes that does not require Dockershim support. RKE2 or K3s are two options for doing this. + +
+ +Q: If I am already using RKE1 and want to switch to RKE2, what are my migration options? + +A: Rancher is exploring the possibility of an in-place upgrade path. Alternatively you can always migrate workloads from one cluster to another using kubectl. + +
diff --git a/content/rancher/v2.6/en/installation/requirements/_index.md b/content/rancher/v2.6/en/installation/requirements/_index.md index 6ca43607b08..697ebb8890c 100644 --- a/content/rancher/v2.6/en/installation/requirements/_index.md +++ b/content/rancher/v2.6/en/installation/requirements/_index.md @@ -174,12 +174,4 @@ To operate properly, Rancher requires a number of ports to be open on Rancher no # Dockershim Support -In Kubernetes v1.20, the dockershim became deprecated, and Docker became deprecated as a container runtime for Kubernetes. Dockershim was built into Kubernetes as a type of adapter that allowed Kubernetes to manage Docker containers. It was necessary because the Docker Daemon was not compliant with the CRI (Container Runtime Interface) that was created for Kubernetes. The dockershim is still included in the kubelet in Kubernetes v1.20. - -Rancher plans to implement the [upstream open source community Dockershim announced by Mirantis and Docker](https://www.mirantis.com/blog/mirantis-to-take-over-support-of-kubernetes-dockershim-2/) to ensure RKE clusters can continue to leverage Docker as their container runtime. Users of RKE will be able to continue upgrading and building new RKE clusters leveraging Docker as the runtime and install method. - -For users looking to use another container runtime, Rancher has the edge-focused K3s and datacenter-focused RKE2 Kubernetes distributions that use containerd as the default runtime. Imported RKE2 and K3s Kubernetes clusters can then be upgraded and managed through Rancher going forward. - -For more information on the deprecation of Docker as a container runtime for Kubernetes, see the [official Kubernetes blog post](https://kubernetes.io/blog/2020/12/02/dont-panic-kubernetes-and-docker/) and the [official blog post from Mirantis.](https://www.mirantis.com/blog/mirantis-to-take-over-support-of-kubernetes-dockershim-2/) - -The dockershim deprecation schedule is tracked by the upstream Kubernetes community in [Kubernetes Enhancement Proposal (KEP) 1985.](https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/1985-remove-dockershim) \ No newline at end of file +For more information on Dockershim support, refer to [this page]({{}}/rancher/v2.6/en/installation/requirements/dockershim/). diff --git a/content/rancher/v2.6/en/installation/requirements/dockershim/_index.md b/content/rancher/v2.6/en/installation/requirements/dockershim/_index.md new file mode 100644 index 00000000000..691d23d2785 --- /dev/null +++ b/content/rancher/v2.6/en/installation/requirements/dockershim/_index.md @@ -0,0 +1,44 @@ +--- +title: Dockershim +weight: 300 +--- + +The Dockershim is the CRI compliant layer between the Kubelet and the Docker daemon. As part of the Kubernetes 1.20 release, the [deprecation of the in-tree Dockershim was announced](https://kubernetes.io/blog/2020/12/02/dont-panic-kubernetes-and-docker/). For more information on the deprecation and its timelines, see the [Kubernetes Dockershim Deprecation FAQ](https://kubernetes.io/blog/2020/12/02/dockershim-faq/#when-will-dockershim-be-removed). + +RKE clusters now support the external Dockershim to continue leveraging Docker as the CRI runtime. We now implement the upstream open source community Dockershim announced by [Mirantis and Docker](https://www.mirantis.com/blog/mirantis-to-take-over-support-of-kubernetes-dockershim-2/) to ensure RKE clusters can continue to leverage Docker. + +This new component that replaces the old Dockershim, called `cri-dockerd`, will need to enabled using the option listed below. Note that to use this option will require at least Kubernetes 1.21. + +``` +enable_cri_dockerd: true +``` + +For users looking to use another container runtime, Rancher has the edge-focused K3s and datacenter-focused RKE2 Kubernetes distributions that use containerd as the default runtime. Imported RKE2 and K3s Kubernetes clusters can then be upgraded and managed through Rancher going forward. + +### FAQ + +
+ +Q. Do I have to upgrade Rancher to get Rancher’s support of the upstream Dockershim? + +A The upstream support of Dockershim begins for RKE in Kubernetes 1.21. You will need to be on a version of Rancher that supports RKE 1.21. See our support matrix for details. + +
+ +Q. I am currently on RKE with Kubernetes 1.20. Do I need to upgrade to RKE with Kubernetes 1.21 sooner to avoid being out of support for Dockershim? + +A. The version of Dockershim in RKE with Kubernetes 1.20 will continue to work and it is not deprecated until a later release. For information on the timeline, see the [Kubernetes Dockershim Deprecation FAQ](https://kubernetes.io/blog/2020/12/02/dockershim-faq/#when-will-dockershim-be-removed). It will only emit a warning of its future deprecation, which Rancher has mitigated in RKE with Kubernetes 1.21. You can plan your upgrade to 1.21 as you would normally. + +
+ +Q: What are my other options if I don’t want to depend on the Dockershim? + +A: You can use a runtime like containerd with Kubernetes that does not require Dockershim support. RKE2 or K3s are two options for doing this. + +
+ +Q: If I am already using RKE1 and want to switch to RKE2, what are my migration options? + +A: Rancher is exploring the possibility of an in-place upgrade path. Alternatively you can always migrate workloads from one cluster to another using kubectl. + +
diff --git a/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-RKE/_index.md b/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-RKE/_index.md index 0b0a0692187..dcd2d29eb33 100644 --- a/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-RKE/_index.md +++ b/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-RKE/_index.md @@ -80,6 +80,8 @@ ingress: > Please see the [RKE Documentation]({{}}/rke/latest/en/config-options/) for the full list of options and capabilities. > > For tuning your etcd cluster for larger Rancher installations, see the [etcd settings guide]({{}}/rancher/v2.6/en/installation/resources/advanced/etcd/). +> +> For more information regarding Dockershim support, refer to [this page]({{}}/rancher/v2.6/en/installation/requirements/dockershim/) ### 2. Run RKE From 74ed84b483e92abe7fe750200079640c65622495 Mon Sep 17 00:00:00 2001 From: Colleen Murphy Date: Tue, 5 Oct 2021 13:41:11 -0700 Subject: [PATCH 005/478] Add security advice for cloud metadata --- content/rancher/v2.5/en/security/_index.md | 5 +++++ content/rancher/v2.5/en/security/best-practices/_index.md | 8 ++++++++ content/rancher/v2.6/en/security/_index.md | 5 +++++ content/rancher/v2.6/en/security/best-practices/_index.md | 8 ++++++++ 4 files changed, 26 insertions(+) create mode 100644 content/rancher/v2.5/en/security/best-practices/_index.md create mode 100644 content/rancher/v2.6/en/security/best-practices/_index.md diff --git a/content/rancher/v2.5/en/security/_index.md b/content/rancher/v2.5/en/security/_index.md index 72707dc1ff6..a6505193c90 100644 --- a/content/rancher/v2.5/en/security/_index.md +++ b/content/rancher/v2.5/en/security/_index.md @@ -33,6 +33,7 @@ On this page, we provide security-related documentation along with resources to - [The CIS Benchmark and self-assessment](#the-cis-benchmark-and-self-assessment) - [Third-party penetration test reports](#third-party-penetration-test-reports) - [Rancher CVEs and resolutions](#rancher-cves-and-resolutions) +- [Kubernetes Security Best Practices](#kubernetes-security-best-practices) ### Running a CIS Security Scan on a Kubernetes Cluster @@ -86,3 +87,7 @@ Results: ### Rancher CVEs and Resolutions Rancher is committed to informing the community of security issues in our products. For the list of CVEs (Common Vulnerabilities and Exposures) for issues we have resolved, refer to [this page.](./cve) + +### Kubernetes Security Best Practices + +For recommendations on securing your Kubernetes cluster, refer to the [Best Practices](./best-practices) guide. diff --git a/content/rancher/v2.5/en/security/best-practices/_index.md b/content/rancher/v2.5/en/security/best-practices/_index.md new file mode 100644 index 00000000000..1b207551e35 --- /dev/null +++ b/content/rancher/v2.5/en/security/best-practices/_index.md @@ -0,0 +1,8 @@ +--- +title: Kubernetes Security Best Practices +weight: 5 +--- + +# Restricting cloud metadata API access + +Cloud providers such as AWS, Azure, or GCP often expose metadata services locally to instances. By default, this endpoint is accessible by pods running on a cloud instance, including pods in hosted Kubernetes providers such as EKS, AKS or GKE, and can contain cloud credentials for that node, provisioning data such as kubelet credentials, or other sensitive data. To mitigate this risk when running on a cloud platform, follow the [Kubernetes security recommendations](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/#restricting-cloud-metadata-api-access): limit permissions given to instance credentials, use network policies to restrict pod access to the metadata API, and avoid using provisioning data to deliver secrets. diff --git a/content/rancher/v2.6/en/security/_index.md b/content/rancher/v2.6/en/security/_index.md index 916ef9284ff..e2b641dd4d7 100644 --- a/content/rancher/v2.6/en/security/_index.md +++ b/content/rancher/v2.6/en/security/_index.md @@ -30,6 +30,7 @@ On this page, we provide security-related documentation along with resources to - [The CIS Benchmark and self-assessment](#the-cis-benchmark-and-self-assessment) - [Third-party penetration test reports](#third-party-penetration-test-reports) - [Rancher CVEs and resolutions](#rancher-cves-and-resolutions) +- [Kubernetes Security Best Practices](#kubernetes-security-best-practices) ### Running a CIS Security Scan on a Kubernetes Cluster @@ -83,3 +84,7 @@ Results: ### Rancher CVEs and Resolutions Rancher is committed to informing the community of security issues in our products. For the list of CVEs (Common Vulnerabilities and Exposures) for issues we have resolved, refer to [this page.](./cve) + +### Kubernetes Security Best Practices + +For recommendations on securing your Kubernetes cluster, refer to the [Best Practices](./best-practices) guide. diff --git a/content/rancher/v2.6/en/security/best-practices/_index.md b/content/rancher/v2.6/en/security/best-practices/_index.md new file mode 100644 index 00000000000..1b207551e35 --- /dev/null +++ b/content/rancher/v2.6/en/security/best-practices/_index.md @@ -0,0 +1,8 @@ +--- +title: Kubernetes Security Best Practices +weight: 5 +--- + +# Restricting cloud metadata API access + +Cloud providers such as AWS, Azure, or GCP often expose metadata services locally to instances. By default, this endpoint is accessible by pods running on a cloud instance, including pods in hosted Kubernetes providers such as EKS, AKS or GKE, and can contain cloud credentials for that node, provisioning data such as kubelet credentials, or other sensitive data. To mitigate this risk when running on a cloud platform, follow the [Kubernetes security recommendations](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/#restricting-cloud-metadata-api-access): limit permissions given to instance credentials, use network policies to restrict pod access to the metadata API, and avoid using provisioning data to deliver secrets. From 09d9d7ab16ca2a4507830307efa47df5d7614da0 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 5 Nov 2021 11:27:36 -0400 Subject: [PATCH 006/478] Updated note verbiage for Fleet pipelines in 2.5, 2.6 --- content/rancher/v2.5/en/pipelines/_index.md | 4 +++- content/rancher/v2.6/en/pipelines/_index.md | 7 ++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.5/en/pipelines/_index.md b/content/rancher/v2.5/en/pipelines/_index.md index a47fdaf7577..8c7ac545a87 100644 --- a/content/rancher/v2.5/en/pipelines/_index.md +++ b/content/rancher/v2.5/en/pipelines/_index.md @@ -6,7 +6,9 @@ aliases: - /rancher/v2.x/en/pipelines/ --- -> As of Rancher v2.5, Git-based deployment pipelines are now recommended to be handled with Rancher Continuous Delivery powered by [Fleet,]({{}}/rancher/v2.5/en/deploy-across-clusters/fleet) available in Cluster Explorer. +> As of Rancher v2.5, Git-based deployment pipelines are now deprecated. We recommend handling pipelines with Rancher Continuous Delivery powered by [Fleet]({{}}/rancher/v2.5/en/deploy-across-clusters/fleet), available in Cluster Explorer. +> +>**Notice:** Fleet does not replace Rancher pipelines; the distinction is that Rancher pipelines are now powered by Fleet. Rancher's pipeline provides a simple CI/CD experience. Use it to automatically checkout code, run builds or scripts, publish Docker images or catalog applications, and deploy the updated software to users. diff --git a/content/rancher/v2.6/en/pipelines/_index.md b/content/rancher/v2.6/en/pipelines/_index.md index ebf82d30aaf..5c9a2e868d7 100644 --- a/content/rancher/v2.6/en/pipelines/_index.md +++ b/content/rancher/v2.6/en/pipelines/_index.md @@ -3,7 +3,12 @@ title: Pipelines weight: 10 --- -> As of Rancher v2.5, Git-based deployment pipelines are now deprecated. We recommend handling pipelines with Rancher Continuous Delivery powered by [Fleet.](https://fleet.rancher.io/) To get to Fleet in Rancher, click ☰ > Continuous Delivery. Note that pipelines in Kubernetes 1.21+ are no longer supported. +> As of Rancher v2.5, Git-based deployment pipelines are now deprecated. We recommend handling pipelines with Rancher Continuous Delivery powered by [Fleet]({{}}/rancher/v2.6/en/deploy-across-clusters/fleet). To get to Fleet in Rancher, click ☰ > Continuous Delivery. +> +>**Notice:** +> +> - Pipelines in Kubernetes 1.21+ are no longer supported. +> - Fleet does not replace Rancher pipelines; the distinction is that Rancher pipelines are now powered by Fleet. Rancher's pipeline provides a simple CI/CD experience. Use it to automatically checkout code, run builds or scripts, publish Docker images or catalog applications, and deploy the updated software to users. From 4e7ee212e9d2ba68254d3a379bc363ddc1779af6 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 8 Nov 2021 12:38:15 -0500 Subject: [PATCH 007/478] Added note to assist navigation to Clusters page in 2.5 --- .../deployment/quickstart-manual-setup/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md b/content/rancher/v2.5/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md index 4a8bddcd236..5cff5ac057b 100644 --- a/content/rancher/v2.5/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md +++ b/content/rancher/v2.5/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md @@ -74,7 +74,7 @@ Welcome to Rancher! You are now able to create your first Kubernetes cluster. In this task, you can use the versatile **Custom** option. This option lets you add _any_ Linux host (cloud-hosted VM, on-prem VM, or bare-metal) to be used in a cluster. -0. (If you are presented with "Cluster Dashboard", click the "Cluster Manager" button, then from the "local" dropdown, select "Global") +**Note:** You create the cluster on the Clusters page. If you are on the Cluster Dashboard, navigate to the Clusters page by clicking the **Cluster Manager** button in the upper-right of the UI. If your dropdown is set to **local**, select **Global**. 1. From the **Clusters** page, click **Add Cluster**. From d71b8c65b1d01b1c7ec6dce1ecf28446f13279c5 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 8 Nov 2021 18:23:04 -0500 Subject: [PATCH 008/478] Removed pipeline banner from layouts --- layouts/_default/list.html | 5 ----- 1 file changed, 5 deletions(-) diff --git a/layouts/_default/list.html b/layouts/_default/list.html index e370b7cb515..7da558dd82a 100644 --- a/layouts/_default/list.html +++ b/layouts/_default/list.html @@ -30,11 +30,6 @@ We are transitioning to versioned documentation. The v2.x docs will no longer be maintained. Rancher v2.6 docs • Rancher v2.5 docs • Rancher v2.0-2.4 docs {{end}} - {{ if in .Dir "/pipelines" }} -
- As of Rancher v2.5, Git-based deployment pipelines are now recommended to be handled with Rancher Continuous Delivery powered by Fleet, available in the Rancher UI by clicking ☰ > Continuous Delivery. -
- {{end}} {{ if in .Dir "/multi-cluster-apps" }}
As of Rancher v2.5, multi-cluster apps are deprecated. We now recommend using Fleet for deploying apps across clusters. It is available in the Rancher UI by clicking ☰ > Continuous Delivery. From 9a1485d8ab5ac51085f29a7612ea4bb61d347410 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Tue, 9 Nov 2021 21:53:01 -0700 Subject: [PATCH 009/478] Add beginner-friendly context to air gap K3s install steps Clarify air gap K3s install steps Use bulleted list for K3s air gap prerequisites Update content/k3s/latest/en/installation/airgap/_index.md Co-authored-by: Jen Travinski Update content/k3s/latest/en/installation/airgap/_index.md Co-authored-by: Jen Travinski Update content/k3s/latest/en/installation/airgap/_index.md Co-authored-by: Jen Travinski Update content/k3s/latest/en/installation/airgap/_index.md Co-authored-by: Jen Travinski Update content/k3s/latest/en/installation/airgap/_index.md Co-authored-by: Jen Travinski --- .../k3s/latest/en/installation/airgap/_index.md | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/content/k3s/latest/en/installation/airgap/_index.md b/content/k3s/latest/en/installation/airgap/_index.md index 91d37c00830..6693a261bf9 100644 --- a/content/k3s/latest/en/installation/airgap/_index.md +++ b/content/k3s/latest/en/installation/airgap/_index.md @@ -3,7 +3,7 @@ title: "Air-Gap Install" weight: 60 --- -You can install K3s in an air-gapped environment using two different methods. You can either deploy a private registry and mirror docker.io or you can manually deploy images such as for small clusters. +You can install K3s in an air-gapped environment using two different methods. An air-gapped environment is any environment that is not directly connected to the Internet. You can either deploy a private registry and mirror docker.io, or you can manually deploy images such as for small clusters. # Private Registry Method @@ -39,22 +39,23 @@ Follow the steps in the next section to install K3s. # Install K3s -Only after you have completed either the [Private Registry Method](#private-registry-method) or the [Manually Deploy Images Method](#manually-deploy-images-method) above should you install K3s. +### Prerequisites -Obtain the K3s binary from the [releases](https://github.com/rancher/k3s/releases) page, matching the same version used to get the airgap images. -Obtain the K3s install script at https://get.k3s.io +- Before installing K3s, complete the the [Private Registry Method](#private-registry-method) or the [Manually Deploy Images Method](#manually-deploy-images-method) above to prepopulate the images that K3s needs to install. +- Download the K3s binary from the [releases](https://github.com/rancher/k3s/releases) page, matching the same version used to get the airgap images. Place the binary in `/usr/local/bin` on each air-gapped node and ensure it is executable. +- Download the K3s install script at https://get.k3s.io. Place the install script anywhere on each air-gapped node, and name it `install.sh`. -Place the binary in `/usr/local/bin` on each node and ensure it is executable. -Place the install script anywhere on each node, and name it `install.sh`. +When running the K3s script with the `INSTALL_K3S_SKIP_DOWNLOAD` environment variable, K3s will use the local version of the script and binary. -### Install Options +### Installing K3s in an Air-Gapped Environment + You can install K3s on one or more servers as described below. {{% tabs %}} {{% tab "Single Server Configuration" %}} -To install K3s on a single server simply do the following on the server node. +To install K3s on a single server, simply do the following on the server node: ``` INSTALL_K3S_SKIP_DOWNLOAD=true ./install.sh From 7cb5d34ff84608cb24bb5a1ad1279cf268b4d5d5 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 10 Nov 2021 17:55:38 -0500 Subject: [PATCH 010/478] Added new section for ACE support with K3s/RKE2 registered clusters --- .../registered-clusters/_index.md | 42 +++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md index 7bfa2eff0cb..0a3f3b831dc 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md @@ -12,6 +12,7 @@ The control that Rancher has to manage a registered cluster depends on the type - [Management Capabilities for Registered Clusters](#management-capabilities-for-registered-clusters) - [Configuring K3s Cluster Upgrades](#configuring-k3s-cluster-upgrades) - [Debug Logging and Troubleshooting for Registered K3s Clusters](#debug-logging-and-troubleshooting-for-registered-k3s-clusters) +- [ACE Support for RKE2 and K3s Clusters](#ace-support-for-rke2-and-k3s-clusters) - [Annotating Registered Clusters](#annotating-registered-clusters) # Prerequisites @@ -147,8 +148,49 @@ If the cluster becomes stuck in upgrading, restart the `system-upgrade-controlle To prevent issues when upgrading, the [Kubernetes upgrade best practices](https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/) should be followed. +# ACE Support for RKE2 and K3s Clusters +_Available as of v2.6.3_ +**Authorized Cluster Endpoint** (ACE) support has been added for registered RKE2 and K3s clusters. This support includes manual steps you will perform on the downstream cluster to enable the ACE. For additional information on the ACE, click [here]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/ace/). + +> **Notice:** +> +> - The following steps will work on both RKE2 and K3s clusters registered in v2.6.x as well as those registered (or imported) from a previous version of Rancher with an upgrade to v2.6.x. +> +> - These steps will alter the configuration of the downstream RKE2 and K3s clusters and deploy the `kube-api-authn-webhook`. If a future implementation of ACE requires an update to the `kube-api-authn-webhook`, then this would also have to be done manually. For more information on this webhook, click [here]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/ace/#about-the-kube-api-auth-authentication-webhook). + +###### **Manual steps to be taken on the downstream cluster to enable ACE:** + +1. Create a file at `/var/lib/rancher/{rke2,k3s}/kube-api-authn-webhook.yaml` with the following contents: + + apiVersion: v1 + kind: Config + clusters: + - name: Default + cluster: + insecure-skip-tls-verify: true + server: http://127.0.0.1:6440/v1/authenticate + users: + - name: Default + user: + insecure-skip-tls-verify: true + current-context: webhook + contexts: + - name: webhook + context: + user: Default + cluster: Default + +1. Add the following to the config file (or create one if it doesn’t exist); note that the default location is `/etc/rancher/{rke2,k3s}/config.yaml`: + + kube-apiserver-arg: + - authentication-token-webhook-config-file=/var/lib/rancher/{rke2,k3s}/kube-api-authn-webhook.yaml + +1. Finally, run the following commands: + + - `sudo systemctl stop {rke2,k3s}-server` + - `sudo systemctl start {rke2,k3s}-server` # Annotating Registered Clusters From a46cdf749b5cf2512a03fdf37b9ef51208d7e0cd Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 10 Nov 2021 18:04:39 -0500 Subject: [PATCH 011/478] Added link to new section in ACE architecture page --- .../v2.6/en/overview/architecture-recommendations/_index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md b/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md index b679b3a3f72..c0a22064086 100644 --- a/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md +++ b/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md @@ -109,3 +109,5 @@ For more best practices for downstream clusters, refer to the [production checkl If you are using an [authorized cluster endpoint,]({{}}/rancher/v2.6/en/overview/architecture/#4-authorized-cluster-endpoint) we recommend creating an FQDN pointing to a load balancer which balances traffic across your nodes with the `controlplane` role. If you are using private CA signed certificates on the load balancer, you have to supply the CA certificate, which will be included in the generated kubeconfig file to validate the certificate chain. See the documentation on [kubeconfig files]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/kubectl/) and [API keys]({{}}/rancher/v2.6/en/user-settings/api-keys/#creating-an-api-key) for more information. + +As of Rancher v2.6.3, ACE support is available for registered RKE2 and K3s clusters. To view the manual steps to perform on the downstream cluster to enable the ACE, click [here]({{}}/v2.6/en/cluster-provisioning/registered-clusters/#ace-support-for-rke2-and-k3s-clusters). From d9a5d4a5aa11c650033a085f4a3ca04463f6c884 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 10 Nov 2021 18:17:01 -0500 Subject: [PATCH 012/478] Updated ACE verbiage for new support in 2.6.3 --- content/rancher/v2.6/en/overview/architecture/_index.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/overview/architecture/_index.md b/content/rancher/v2.6/en/overview/architecture/_index.md index 1e70eccdd6c..62946c0ff6e 100644 --- a/content/rancher/v2.6/en/overview/architecture/_index.md +++ b/content/rancher/v2.6/en/overview/architecture/_index.md @@ -103,11 +103,13 @@ If the cluster agent (also called `cattle-cluster-agent`) is not available, one The `cattle-node-agent` is deployed using a [DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) resource to make sure it runs on every node in a Rancher-launched Kubernetes cluster. It is used to interact with the nodes when performing cluster operations. Examples of cluster operations include upgrading the Kubernetes version and creating or restoring etcd snapshots. -### 4. Authorized Cluster Endpoint +### 4. Authorized Cluster Endpoint (ACE) An authorized cluster endpoint allows users to connect to the Kubernetes API server of a downstream cluster without having to route their requests through the Rancher authentication proxy. -> The authorized cluster endpoint only works on Rancher-launched Kubernetes clusters. In other words, it only works in clusters where Rancher [used RKE]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters) to provision the cluster. It is not available for registered clusters, or for clusters in a hosted Kubernetes provider, such as Amazon's EKS. +> The authorized cluster endpoint only works on Rancher-launched Kubernetes clusters. In other words, it only works in clusters where Rancher [used RKE]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters) to provision the cluster. The ACE is not available for clusters in a hosted Kubernetes provider, such as Amazon's EKS. + +> The [ACE is available for registered RKE2 and K3s clusters]({{}}/rancher/v2.6/en/cluster-provisioning/registered-clusters/#ace-support-for-rke2-and-k3s-clusters) as of Rancher v2.6.3. There are two main reasons why a user might need the authorized cluster endpoint: From 216a4d0482b00c1b7ce62afe58fb3be128661e01 Mon Sep 17 00:00:00 2001 From: dkeightley <20566450+dkeightley@users.noreply.github.com> Date: Thu, 11 Nov 2021 01:58:55 +0000 Subject: [PATCH 013/478] Update k3s HA install to cover changes with the token --- .../k3s/latest/en/installation/ha/_index.md | 30 +++++++++++++++---- 1 file changed, 25 insertions(+), 5 deletions(-) diff --git a/content/k3s/latest/en/installation/ha/_index.md b/content/k3s/latest/en/installation/ha/_index.md index 00c082d2ac5..4c9b3e564dd 100644 --- a/content/k3s/latest/en/installation/ha/_index.md +++ b/content/k3s/latest/en/installation/ha/_index.md @@ -33,12 +33,13 @@ You will first need to create an external datastore for the cluster. See the [Cl ### 2. Launch Server Nodes K3s requires two or more server nodes for this HA configuration. See the [Installation Requirements]({{}}/k3s/latest/en/installation/installation-requirements/) guide for minimum machine requirements. -When running the `k3s server` command on these nodes, you must set the `datastore-endpoint` parameter so that K3s knows how to connect to the external datastore. +When running the `k3s server` command on these nodes, you must set the `datastore-endpoint` parameter so that K3s knows how to connect to the external datastore. The `token` parameter can also be used to set a deterministic token when adding nodes, when empty this token will be generated automatically for further use. -For example, a command like the following could be used to install the K3s server with a MySQL database as the external datastore: +For example, a command like the following could be used to install the K3s server with a MySQL database as the external datastore and [set a token]({{}}/k3s/latest/en/installation/install-options/server-config/#cluster-options}}): -``` +```bash curl -sfL https://get.k3s.io | sh -s - server \ + --token=SECRET \ --datastore-endpoint="mysql://username:password@tcp(hostname:3306)/database-name" ``` @@ -62,12 +63,31 @@ Agent nodes need a URL to register against. This can be the IP or hostname of an This endpoint can also be used for accessing the Kubernetes API. So you can, for example, modify your [kubeconfig](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) file to point to it instead of a specific node. To avoid certificate errors in such a configuration, you should install the server with the `--tls-san YOUR_IP_OR_HOSTNAME_HERE` option. This option adds an additional hostname or IP as a Subject Alternative Name in the TLS cert, and it can be specified multiple times if you would like to access via both the IP and the hostname. -### 4. Optional: Join Agent Nodes +### 4. Options: Join Additional Server Nodes + +The same example command in Step 2 can be used to join additional server nodes, where the token from the first node needs to be used. + +If the first server node was started without the `--token` CLI flag or `K3S_TOKEN` variable, the token value can be retrieved from any server already joined to the cluster: +```bash +cat /var/lib/rancher/k3s/server/token +``` + +Additional server nodes can then be added [using the token]({{}}/k3s/latest/en/installation/install-options/server-config/#cluster-options}}): + +```bash +curl -sfL https://get.k3s.io | sh -s - server \ + --token=SECRET \ + --datastore-endpoint="mysql://username:password@tcp(hostname:3306)/database-name" +``` + +> **Note:** Ensure that you retain a copy of this token as it is required when restoring from backup and adding nodes. Previously, K3s did not enforce the use of a token when using external SQL datastores. + +### 5. Optional: Join Agent Nodes Because K3s server nodes are schedulable by default, the minimum number of nodes for an HA K3s server cluster is two server nodes and zero agent nodes. To add nodes designated to run your apps and services, join agent nodes to your cluster. Joining agent nodes in an HA cluster is the same as joining agent nodes in a single server cluster. You just need to specify the URL the agent should register to and the token it should use. -``` +```bash K3S_TOKEN=SECRET k3s agent --server https://fixed-registration-address:6443 ``` From 06f5c0f71d625d240fa3e7afc1ef46cc4bf1c817 Mon Sep 17 00:00:00 2001 From: dkeightley <20566450+dkeightley@users.noreply.github.com> Date: Fri, 12 Nov 2021 08:52:17 +1300 Subject: [PATCH 014/478] Update content/k3s/latest/en/installation/ha/_index.md Co-authored-by: Jen Travinski --- content/k3s/latest/en/installation/ha/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/k3s/latest/en/installation/ha/_index.md b/content/k3s/latest/en/installation/ha/_index.md index 4c9b3e564dd..0fe32453f4f 100644 --- a/content/k3s/latest/en/installation/ha/_index.md +++ b/content/k3s/latest/en/installation/ha/_index.md @@ -33,7 +33,7 @@ You will first need to create an external datastore for the cluster. See the [Cl ### 2. Launch Server Nodes K3s requires two or more server nodes for this HA configuration. See the [Installation Requirements]({{}}/k3s/latest/en/installation/installation-requirements/) guide for minimum machine requirements. -When running the `k3s server` command on these nodes, you must set the `datastore-endpoint` parameter so that K3s knows how to connect to the external datastore. The `token` parameter can also be used to set a deterministic token when adding nodes, when empty this token will be generated automatically for further use. +When running the `k3s server` command on these nodes, you must set the `datastore-endpoint` parameter so that K3s knows how to connect to the external datastore. The `token` parameter can also be used to set a deterministic token when adding nodes. When empty, this token will be generated automatically for further use. For example, a command like the following could be used to install the K3s server with a MySQL database as the external datastore and [set a token]({{}}/k3s/latest/en/installation/install-options/server-config/#cluster-options}}): From 3e73b9d705d89964db9f07c49b35e80c59d50185 Mon Sep 17 00:00:00 2001 From: dkeightley <20566450+dkeightley@users.noreply.github.com> Date: Thu, 11 Nov 2021 19:54:17 +0000 Subject: [PATCH 015/478] Fix typo --- content/k3s/latest/en/installation/ha/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/k3s/latest/en/installation/ha/_index.md b/content/k3s/latest/en/installation/ha/_index.md index 0fe32453f4f..92886efbe56 100644 --- a/content/k3s/latest/en/installation/ha/_index.md +++ b/content/k3s/latest/en/installation/ha/_index.md @@ -63,7 +63,7 @@ Agent nodes need a URL to register against. This can be the IP or hostname of an This endpoint can also be used for accessing the Kubernetes API. So you can, for example, modify your [kubeconfig](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) file to point to it instead of a specific node. To avoid certificate errors in such a configuration, you should install the server with the `--tls-san YOUR_IP_OR_HOSTNAME_HERE` option. This option adds an additional hostname or IP as a Subject Alternative Name in the TLS cert, and it can be specified multiple times if you would like to access via both the IP and the hostname. -### 4. Options: Join Additional Server Nodes +### 4. Optional: Join Additional Server Nodes The same example command in Step 2 can be used to join additional server nodes, where the token from the first node needs to be used. From 5d3bb143ad23afb6929f0ed764504ba511030b7d Mon Sep 17 00:00:00 2001 From: Johan Kok Date: Sun, 14 Nov 2021 08:16:33 +0100 Subject: [PATCH 016/478] Updated link to Github repo for klipper-lb The klipper-lb repo was moved from github.com/rancher to github.com/k3s-io, updating the link to reflect this. > NOTE: this repository has been recently (2020-11-18) moved out of the github.com/rancher org to github.com/k3s-io supporting the acceptance of K3s as a CNCF sandbox project. --- content/k3s/latest/en/networking/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/k3s/latest/en/networking/_index.md b/content/k3s/latest/en/networking/_index.md index 49ed55deb46..2dff22e927d 100644 --- a/content/k3s/latest/en/networking/_index.md +++ b/content/k3s/latest/en/networking/_index.md @@ -42,7 +42,7 @@ To migrate from an older Traefik v1 instance please refer to the [Traefik docume # Service Load Balancer -Any service load balancer (LB) can be leveraged in your Kubernetes cluster. K3s provides a load balancer known as [Klipper Load Balancer](https://github.com/rancher/klipper-lb) that uses available host ports. +Any service load balancer (LB) can be leveraged in your Kubernetes cluster. K3s provides a load balancer known as [Klipper Load Balancer](https://github.com/k3s-io/klipper-lb) that uses available host ports. Upstream Kubernetes allows a Service of type LoadBalancer to be created, but doesn't include the implementation of the LB. Some LB services require a cloud provider such as Amazon EC2 or Microsoft Azure. By contrast, the K3s service LB makes it possible to use an LB service without a cloud provider. From 30a04e05a3ba7838f14463548ac01fa00cf97fa0 Mon Sep 17 00:00:00 2001 From: Jen Travinski Date: Mon, 15 Nov 2021 09:17:54 -0500 Subject: [PATCH 017/478] Update content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md Co-authored-by: Billy Tat --- .../v2.6/en/cluster-provisioning/registered-clusters/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md index 0a3f3b831dc..ee19218c369 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md @@ -152,7 +152,7 @@ To prevent issues when upgrading, the [Kubernetes upgrade best practices](https: _Available as of v2.6.3_ -**Authorized Cluster Endpoint** (ACE) support has been added for registered RKE2 and K3s clusters. This support includes manual steps you will perform on the downstream cluster to enable the ACE. For additional information on the ACE, click [here]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/ace/). +Authorized Cluster Endpoint (ACE) support has been added for registered RKE2 and K3s clusters. This support includes manual steps you will perform on the downstream cluster to enable the ACE. For additional information on the ACE, click [here]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/ace/). > **Notice:** > From efe58b223f04e0b6dfb8ae46a7acaa1e87aa5336 Mon Sep 17 00:00:00 2001 From: Jen Travinski Date: Mon, 15 Nov 2021 09:18:15 -0500 Subject: [PATCH 018/478] Update content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md Co-authored-by: Billy Tat --- .../v2.6/en/cluster-provisioning/registered-clusters/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md index ee19218c369..0f2a367fca1 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md @@ -148,7 +148,7 @@ If the cluster becomes stuck in upgrading, restart the `system-upgrade-controlle To prevent issues when upgrading, the [Kubernetes upgrade best practices](https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/) should be followed. -# ACE Support for RKE2 and K3s Clusters +# Authorized Cluster Endpoint Support for RKE2 and K3s Clusters _Available as of v2.6.3_ From 2775dc4aa29a5fea6515197f1eb1acc90644cc46 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 15 Nov 2021 09:28:00 -0500 Subject: [PATCH 019/478] Updating per feedback --- .../en/cluster-provisioning/registered-clusters/_index.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md index 0a3f3b831dc..b65e5a68e8d 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md @@ -12,7 +12,7 @@ The control that Rancher has to manage a registered cluster depends on the type - [Management Capabilities for Registered Clusters](#management-capabilities-for-registered-clusters) - [Configuring K3s Cluster Upgrades](#configuring-k3s-cluster-upgrades) - [Debug Logging and Troubleshooting for Registered K3s Clusters](#debug-logging-and-troubleshooting-for-registered-k3s-clusters) -- [ACE Support for RKE2 and K3s Clusters](#ace-support-for-rke2-and-k3s-clusters) +- [Authorized Cluster Endpoint Support for RKE2 and K3s Clusters](#authorized-cluster-endpoint-support-for-rke2-and-k3s-clusters) - [Annotating Registered Clusters](#annotating-registered-clusters) # Prerequisites @@ -154,7 +154,7 @@ _Available as of v2.6.3_ **Authorized Cluster Endpoint** (ACE) support has been added for registered RKE2 and K3s clusters. This support includes manual steps you will perform on the downstream cluster to enable the ACE. For additional information on the ACE, click [here]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/ace/). -> **Notice:** +> **Note:** > > - The following steps will work on both RKE2 and K3s clusters registered in v2.6.x as well as those registered (or imported) from a previous version of Rancher with an upgrade to v2.6.x. > @@ -189,8 +189,8 @@ _Available as of v2.6.3_ 1. Finally, run the following commands: - - `sudo systemctl stop {rke2,k3s}-server` - - `sudo systemctl start {rke2,k3s}-server` + sudo systemctl stop {rke2,k3s}-server + sudo systemctl start {rke2,k3s}-server # Annotating Registered Clusters From 2fd998b3f482c548c2a68fb8f08133c360729807 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 15 Nov 2021 09:48:44 -0500 Subject: [PATCH 020/478] Clarified acronym 'ACE' --- .../v2.6/en/overview/architecture-recommendations/_index.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md b/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md index c0a22064086..2b027ab2437 100644 --- a/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md +++ b/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md @@ -104,10 +104,10 @@ Because no additional workloads will be deployed on the Rancher server cluster, For more best practices for downstream clusters, refer to the [production checklist]({{}}/rancher/v2.6/en/cluster-provisioning/production) or our [best practices guide.]({{}}/rancher/v2.6/en/best-practices/) -# Architecture for an Authorized Cluster Endpoint +# Architecture for an Authorized Cluster Endpoint (ACE) -If you are using an [authorized cluster endpoint,]({{}}/rancher/v2.6/en/overview/architecture/#4-authorized-cluster-endpoint) we recommend creating an FQDN pointing to a load balancer which balances traffic across your nodes with the `controlplane` role. +If you are using an [authorized cluster endpoint (ACE),]({{}}/rancher/v2.6/en/overview/architecture/#4-authorized-cluster-endpoint) we recommend creating an FQDN pointing to a load balancer which balances traffic across your nodes with the `controlplane` role. If you are using private CA signed certificates on the load balancer, you have to supply the CA certificate, which will be included in the generated kubeconfig file to validate the certificate chain. See the documentation on [kubeconfig files]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/kubectl/) and [API keys]({{}}/rancher/v2.6/en/user-settings/api-keys/#creating-an-api-key) for more information. -As of Rancher v2.6.3, ACE support is available for registered RKE2 and K3s clusters. To view the manual steps to perform on the downstream cluster to enable the ACE, click [here]({{}}/v2.6/en/cluster-provisioning/registered-clusters/#ace-support-for-rke2-and-k3s-clusters). +As of Rancher v2.6.3, ACE support is available for registered RKE2 and K3s clusters. To view the manual steps to perform on the downstream cluster to enable the ACE, click [here]({{}}/v2.6/en/cluster-provisioning/registered-clusters/#authorized-cluster-endpoint-support-for-rke2-and-k3s-clusters). From 2a97eae6980da2c56fd7ff14cf297b7038796bba Mon Sep 17 00:00:00 2001 From: Nuno do Carmo Date: Mon, 15 Nov 2021 16:06:06 +0100 Subject: [PATCH 021/478] Closes #3662 --- .../single-node-docker/_index.md | 19 +++++++++++++++++++ .../single-node-docker/_index.md | 19 +++++++++++++++++++ .../single-node-docker/_index.md | 19 +++++++++++++++++++ 3 files changed, 57 insertions(+) diff --git a/content/rancher/v2.0-v2.4/en/installation/other-installation-methods/single-node-docker/_index.md b/content/rancher/v2.0-v2.4/en/installation/other-installation-methods/single-node-docker/_index.md index 22dab597f2d..a84b04a70d6 100644 --- a/content/rancher/v2.0-v2.4/en/installation/other-installation-methods/single-node-docker/_index.md +++ b/content/rancher/v2.0-v2.4/en/installation/other-installation-methods/single-node-docker/_index.md @@ -44,6 +44,7 @@ Choose from the following options: - [Option B: Bring Your Own Certificate, Self-signed](#option-b-bring-your-own-certificate-self-signed) - [Option C: Bring Your Own Certificate, Signed by a Recognized CA](#option-c-bring-your-own-certificate-signed-by-a-recognized-ca) - [Option D: Let's Encrypt Certificate](#option-d-let-s-encrypt-certificate) +- [Option E: Localhost tunneling, no Certificate](#option-e-localhost-tunneling-no-certificate) ### Option A: Default Rancher-generated Self-signed Certificate @@ -140,6 +141,24 @@ docker run -d --restart=unless-stopped \ --acme-domain ``` +### Option E: Localhost tunneling, no Certificate + +If you are installing Rancher in a development or testing environment where you have a localhost tunneling solution running (i.e. [ngrok](https://ngrok.com/)), you'll need to avoid generating a Certificate. This installation option doesn't request for a certificate. + +Log into your host machine, and run the Docker command below. + +- Use the `--no-cacerts` as argument to the container to disable the default CA certificate generated by Rancher. + +Privileged access is [required.](#privileged-access-for-rancher) + +```bash +docker run -d --restart=unless-stopped \ + -p 80:80 -p 443:443 \ + --privileged \ + rancher/rancher:latest \ + --no-cacerts +``` + ## Advanced Options When installing Rancher on a single node with Docker, there are several advanced options that can be enabled: diff --git a/content/rancher/v2.5/en/installation/other-installation-methods/single-node-docker/_index.md b/content/rancher/v2.5/en/installation/other-installation-methods/single-node-docker/_index.md index d28ce130fb3..0b860d9d693 100644 --- a/content/rancher/v2.5/en/installation/other-installation-methods/single-node-docker/_index.md +++ b/content/rancher/v2.5/en/installation/other-installation-methods/single-node-docker/_index.md @@ -50,6 +50,7 @@ Choose from the following options: - [Option B: Bring Your Own Certificate, Self-signed](#option-b-bring-your-own-certificate-self-signed) - [Option C: Bring Your Own Certificate, Signed by a Recognized CA](#option-c-bring-your-own-certificate-signed-by-a-recognized-ca) - [Option D: Let's Encrypt Certificate](#option-d-let-s-encrypt-certificate) +- [Option E: Localhost tunneling, no Certificate](#option-e-localhost-tunneling-no-certificate) ### Option A: Default Rancher-generated Self-signed Certificate @@ -156,6 +157,24 @@ docker run -d --restart=unless-stopped \ --acme-domain ``` +### Option E: Localhost tunneling, no Certificate + +If you are installing Rancher in a development or testing environment where you have a localhost tunneling solution running (i.e. [ngrok](https://ngrok.com/)), you'll need to avoid generating a Certificate. This installation option doesn't request for a certificate. + +Log into your host machine, and run the Docker command below. + +- Use the `--no-cacerts` as argument to the container to disable the default CA certificate generated by Rancher. + +Privileged access is [required.](#privileged-access-for-rancher) + +```bash +docker run -d --restart=unless-stopped \ + -p 80:80 -p 443:443 \ + --privileged \ + rancher/rancher:latest \ + --no-cacerts +``` + ## Advanced Options When installing Rancher on a single node with Docker, there are several advanced options that can be enabled: diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md index c047052f024..357069dd0fc 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md @@ -44,6 +44,7 @@ Choose from the following options: - [Option B: Bring Your Own Certificate, Self-signed](#option-b-bring-your-own-certificate-self-signed) - [Option C: Bring Your Own Certificate, Signed by a Recognized CA](#option-c-bring-your-own-certificate-signed-by-a-recognized-ca) - [Option D: Let's Encrypt Certificate](#option-d-let-s-encrypt-certificate) +- [Option E: Localhost tunneling, no Certificate](#option-e-localhost-tunneling-no-certificate) ### Option A: Default Rancher-generated Self-signed Certificate @@ -150,6 +151,24 @@ docker run -d --restart=unless-stopped \ --acme-domain ``` +### Option E: Localhost tunneling, no Certificate + +If you are installing Rancher in a development or testing environment where you have a localhost tunneling solution running (i.e. [ngrok](https://ngrok.com/)), you'll need to avoid generating a Certificate. This installation option doesn't request for a certificate. + +Log into your host machine, and run the Docker command below. + +- Use the `--no-cacerts` as argument to the container to disable the default CA certificate generated by Rancher. + +Privileged access is [required.](#privileged-access-for-rancher) + +```bash +docker run -d --restart=unless-stopped \ + -p 80:80 -p 443:443 \ + --privileged \ + rancher/rancher:latest \ + --no-cacerts +``` + ## Advanced Options When installing Rancher on a single node with Docker, there are several advanced options that can be enabled: From 69a3d6743c5b2094cd7130541cc48668d4fe37f7 Mon Sep 17 00:00:00 2001 From: Nuno do Carmo Date: Mon, 15 Nov 2021 16:54:37 +0100 Subject: [PATCH 022/478] Removed option E from v2.5 and v2.0-4 --- .../single-node-docker/_index.md | 19 ------------------- .../single-node-docker/_index.md | 19 ------------------- 2 files changed, 38 deletions(-) diff --git a/content/rancher/v2.0-v2.4/en/installation/other-installation-methods/single-node-docker/_index.md b/content/rancher/v2.0-v2.4/en/installation/other-installation-methods/single-node-docker/_index.md index a84b04a70d6..22dab597f2d 100644 --- a/content/rancher/v2.0-v2.4/en/installation/other-installation-methods/single-node-docker/_index.md +++ b/content/rancher/v2.0-v2.4/en/installation/other-installation-methods/single-node-docker/_index.md @@ -44,7 +44,6 @@ Choose from the following options: - [Option B: Bring Your Own Certificate, Self-signed](#option-b-bring-your-own-certificate-self-signed) - [Option C: Bring Your Own Certificate, Signed by a Recognized CA](#option-c-bring-your-own-certificate-signed-by-a-recognized-ca) - [Option D: Let's Encrypt Certificate](#option-d-let-s-encrypt-certificate) -- [Option E: Localhost tunneling, no Certificate](#option-e-localhost-tunneling-no-certificate) ### Option A: Default Rancher-generated Self-signed Certificate @@ -141,24 +140,6 @@ docker run -d --restart=unless-stopped \ --acme-domain ``` -### Option E: Localhost tunneling, no Certificate - -If you are installing Rancher in a development or testing environment where you have a localhost tunneling solution running (i.e. [ngrok](https://ngrok.com/)), you'll need to avoid generating a Certificate. This installation option doesn't request for a certificate. - -Log into your host machine, and run the Docker command below. - -- Use the `--no-cacerts` as argument to the container to disable the default CA certificate generated by Rancher. - -Privileged access is [required.](#privileged-access-for-rancher) - -```bash -docker run -d --restart=unless-stopped \ - -p 80:80 -p 443:443 \ - --privileged \ - rancher/rancher:latest \ - --no-cacerts -``` - ## Advanced Options When installing Rancher on a single node with Docker, there are several advanced options that can be enabled: diff --git a/content/rancher/v2.5/en/installation/other-installation-methods/single-node-docker/_index.md b/content/rancher/v2.5/en/installation/other-installation-methods/single-node-docker/_index.md index 0b860d9d693..d28ce130fb3 100644 --- a/content/rancher/v2.5/en/installation/other-installation-methods/single-node-docker/_index.md +++ b/content/rancher/v2.5/en/installation/other-installation-methods/single-node-docker/_index.md @@ -50,7 +50,6 @@ Choose from the following options: - [Option B: Bring Your Own Certificate, Self-signed](#option-b-bring-your-own-certificate-self-signed) - [Option C: Bring Your Own Certificate, Signed by a Recognized CA](#option-c-bring-your-own-certificate-signed-by-a-recognized-ca) - [Option D: Let's Encrypt Certificate](#option-d-let-s-encrypt-certificate) -- [Option E: Localhost tunneling, no Certificate](#option-e-localhost-tunneling-no-certificate) ### Option A: Default Rancher-generated Self-signed Certificate @@ -157,24 +156,6 @@ docker run -d --restart=unless-stopped \ --acme-domain ``` -### Option E: Localhost tunneling, no Certificate - -If you are installing Rancher in a development or testing environment where you have a localhost tunneling solution running (i.e. [ngrok](https://ngrok.com/)), you'll need to avoid generating a Certificate. This installation option doesn't request for a certificate. - -Log into your host machine, and run the Docker command below. - -- Use the `--no-cacerts` as argument to the container to disable the default CA certificate generated by Rancher. - -Privileged access is [required.](#privileged-access-for-rancher) - -```bash -docker run -d --restart=unless-stopped \ - -p 80:80 -p 443:443 \ - --privileged \ - rancher/rancher:latest \ - --no-cacerts -``` - ## Advanced Options When installing Rancher on a single node with Docker, there are several advanced options that can be enabled: From 855ec3b4d1710cd401d6c1c4832951e323b9470d Mon Sep 17 00:00:00 2001 From: Nuno do Carmo Date: Mon, 15 Nov 2021 18:44:56 +0100 Subject: [PATCH 023/478] Option E description updated Co-authored-by: Jen Travinski --- .../other-installation-methods/single-node-docker/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md index 357069dd0fc..86cbdb3409f 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md @@ -153,7 +153,7 @@ docker run -d --restart=unless-stopped \ ### Option E: Localhost tunneling, no Certificate -If you are installing Rancher in a development or testing environment where you have a localhost tunneling solution running (i.e. [ngrok](https://ngrok.com/)), you'll need to avoid generating a Certificate. This installation option doesn't request for a certificate. +If you are installing Rancher in a development or testing environment where you have a localhost tunneling solution running, such as [ngrok](https://ngrok.com/), avoid generating a certificate. This installation option doesn't require a certificate. Log into your host machine, and run the Docker command below. From a1381ebcb2bf1e42c895eac22701cd1927cd71cf Mon Sep 17 00:00:00 2001 From: Nuno do Carmo Date: Mon, 15 Nov 2021 18:48:17 +0100 Subject: [PATCH 024/478] Moved the directions for better context Co-authored-by: Jen Travinski --- .../other-installation-methods/single-node-docker/_index.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md index 86cbdb3409f..4bf7f123324 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md @@ -155,7 +155,9 @@ docker run -d --restart=unless-stopped \ If you are installing Rancher in a development or testing environment where you have a localhost tunneling solution running, such as [ngrok](https://ngrok.com/), avoid generating a certificate. This installation option doesn't require a certificate. -Log into your host machine, and run the Docker command below. +- You will use `--no-cacerts` in the argument to disable the default CA certificate generated by Rancher. Note that privileged access is [required.](#privileged-access-for-rancher). + +Log into your host machine and run the Docker command below: - Use the `--no-cacerts` as argument to the container to disable the default CA certificate generated by Rancher. From b0984c95e8fccf7dd3cdf272b7816c461acfb6a8 Mon Sep 17 00:00:00 2001 From: Daniel Hawton Date: Mon, 15 Nov 2021 15:29:17 -0700 Subject: [PATCH 025/478] Change UI path to secrets and remove references to project scope --- content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md b/content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md index 0663d4f1bc3..57678e2f7e8 100644 --- a/content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md +++ b/content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md @@ -15,13 +15,13 @@ Mounted secrets will be updated automatically unless they are mounted as subpath 1. In the upper left corner, click **☰ > Cluster Management**. 1. Go to the cluster where you want to add a secret and click **Explore**. -1. Click **More Resources > Core > Secrets**. +1. Click **Storage > Secrets**. 1. Click **Create**. 1. Select the type of secret you want to create. 1. Select a **Namespace** for the secret. 1. Enter a **Name** for the secret. - >**Note:** Kubernetes classifies secrets, certificates, and registries all as [secrets](https://kubernetes.io/docs/concepts/configuration/secret/), and no two secrets in a project or namespace can have duplicate names. Therefore, to prevent conflicts, your secret must have a unique name among all secrets within your workspace. + >**Note:** Kubernetes classifies secrets, certificates, and registries all as [secrets](https://kubernetes.io/docs/concepts/configuration/secret/), and no two secrets in a namespace can have duplicate names. Therefore, to prevent conflicts, your secret must have a unique name among all secrets within your workspace. 1. From **Data**, click **Add** to add a key-value pair. Add as many values as you need. @@ -31,12 +31,12 @@ Mounted secrets will be updated automatically unless they are mounted as subpath 1. Click **Save**. -**Result:** Your secret is added to the project or namespace, depending on the scope you chose. You can view the secret in the Rancher UI from the **Resources > Secrets** view. +**Result:** Your secret is added to the namespace you chose. You can view the secret in the Rancher UI from the **Storage > Secrets** view. Mounted secrets will be updated automatically unless they are mounted as subpath volumes. For details on how updated secrets are propagated, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/concepts/configuration/secret/#mounted-secrets-are-updated-automatically) # What's Next? -Now that you have a secret added to the project or namespace, you can add it to a workload that you deploy. +Now that you have a secret added to a namespace, you can add it to a workload that you deploy. For more information on adding secret to a workload, see [Deploying Workloads]({{}}/rancher/v2.6/en/k8s-in-rancher/workloads/deploy-workloads/). From d79c99ee5d1725f579f717dac85fa51c49e523ee Mon Sep 17 00:00:00 2001 From: Jacob Blain Christen Date: Mon, 15 Nov 2021 16:44:30 -0700 Subject: [PATCH 026/478] k3s/installation/airgap: ha fix addresses https://github.com/k3s-io/k3s/issues/2552#issuecomment-969311473 --- content/k3s/latest/en/installation/airgap/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/k3s/latest/en/installation/airgap/_index.md b/content/k3s/latest/en/installation/airgap/_index.md index 91d37c00830..aaf4a79a199 100644 --- a/content/k3s/latest/en/installation/airgap/_index.md +++ b/content/k3s/latest/en/installation/airgap/_index.md @@ -75,13 +75,13 @@ For example, step two of the High Availability with an External DB guide mention ``` curl -sfL https://get.k3s.io | sh -s - server \ - --datastore-endpoint="mysql://username:password@tcp(hostname:3306)/database-name" + --datastore-endpoint='mysql://username:password@tcp(hostname:3306)/database-name' ``` Instead, you would modify such examples like below: ``` -INSTALL_K3S_SKIP_DOWNLOAD=true INSTALL_K3S_EXEC='server --datastore-endpoint="mysql://username:password@tcp(hostname:3306)/database-name"' ./install.sh +INSTALL_K3S_SKIP_DOWNLOAD=true INSTALL_K3S_EXEC='server' K3S_DATASTORE_ENDPOINT='mysql://username:password@tcp(hostname:3306)/database-name' ./install.sh ``` {{% /tab %}} From e1f2ad6411418a53ffa4834fe90bcf5daf4b7d03 Mon Sep 17 00:00:00 2001 From: Daniel Hawton Date: Mon, 15 Nov 2021 17:54:48 -0600 Subject: [PATCH 027/478] Apply suggestions from code review Co-authored-by: Jen Travinski --- content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md b/content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md index 57678e2f7e8..1b0a7c447ec 100644 --- a/content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md +++ b/content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md @@ -15,7 +15,7 @@ Mounted secrets will be updated automatically unless they are mounted as subpath 1. In the upper left corner, click **☰ > Cluster Management**. 1. Go to the cluster where you want to add a secret and click **Explore**. -1. Click **Storage > Secrets**. +1. To navigate to secrets, you may click either **Storage > Secrets** or **More Resources > Core > Secrets**. 1. Click **Create**. 1. Select the type of secret you want to create. 1. Select a **Namespace** for the secret. @@ -31,7 +31,7 @@ Mounted secrets will be updated automatically unless they are mounted as subpath 1. Click **Save**. -**Result:** Your secret is added to the namespace you chose. You can view the secret in the Rancher UI from the **Storage > Secrets** view. +**Result:** Your secret is added to the namespace you chose. You can view the secret in the Rancher UI by clicking either **Storage > Secrets** or **More Resources > Core > Secrets**. Mounted secrets will be updated automatically unless they are mounted as subpath volumes. For details on how updated secrets are propagated, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/concepts/configuration/secret/#mounted-secrets-are-updated-automatically) From b5cb93b6282cc39b712ed2df4f527c4403920aa4 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 15 Nov 2021 16:55:19 -0800 Subject: [PATCH 028/478] Update quickstart navigation step --- .../quickstart-manual-setup/_index.md | 34 +++++++++++-------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/content/rancher/v2.5/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md b/content/rancher/v2.5/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md index 5cff5ac057b..bec8752beeb 100644 --- a/content/rancher/v2.5/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md +++ b/content/rancher/v2.5/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md @@ -46,7 +46,7 @@ To install Rancher on your host, connect to it and then use a shell to install. 1. Log in to your Linux host using your preferred shell, such as PuTTy or a remote Terminal connection. -2. From your shell, enter the following command: +1. From your shell, enter the following command: ``` sudo docker run -d --restart=unless-stopped -p 80:80 -p 443:443 --privileged rancher/rancher @@ -58,13 +58,17 @@ To install Rancher on your host, connect to it and then use a shell to install. Log in to Rancher to begin using the application. After you log in, you'll make some one-time configurations. -1. Open a web browser and enter the IP address of your host: `https://`. +1. Open a web browser and enter the IP address of your host: `https://`. Replace `` with your host IP address. -2. When prompted, create a password for the default `admin` account there cowpoke! +1. When prompted, create a password for the default `admin` account there cowpoke! -3. Set the **Rancher Server URL**. The URL can either be an IP address or a host name. However, each node added to your cluster must be able to connect to this URL.

If you use a hostname in the URL, this hostname must be resolvable by DNS on the nodes you want to add to you cluster. +1. Set the **Default View**. + - If `I want to create or manage multiple clusters` is selected, the Cluster Manager UI is used as the default view. + - If `I'm only going to use the cluster Rancher was installed on` is selected, the Cluster Explorer UI is used as the default view. + +1. Set the **Rancher Server URL**. The URL can either be an IP address or a host name. However, each node added to your cluster must be able to connect to this URL.

If you use a hostname in the URL, this hostname must be resolvable by DNS on the nodes you want to add to you cluster.
@@ -74,29 +78,29 @@ Welcome to Rancher! You are now able to create your first Kubernetes cluster. In this task, you can use the versatile **Custom** option. This option lets you add _any_ Linux host (cloud-hosted VM, on-prem VM, or bare-metal) to be used in a cluster. -**Note:** You create the cluster on the Clusters page. If you are on the Cluster Dashboard, navigate to the Clusters page by clicking the **Cluster Manager** button in the upper-right of the UI. If your dropdown is set to **local**, select **Global**. +1. If you chose `I'm only going to use the cluster Rancher was installed on` when setting the default view, click the **Cluster Manager** button in the upper-right of the UI to access the **Clusters** page. 1. From the **Clusters** page, click **Add Cluster**. -2. Choose **Existing Nodes**. +1. Choose **Existing Nodes**. -3. Enter a **Cluster Name**. +1. Enter a **Cluster Name**. -4. Skip **Member Roles** and **Cluster Options**. We'll tell you about them later. +1. Skip **Member Roles** and **Cluster Options**. We'll tell you about them later. -5. Click **Next**. +1. Click **Next**. -6. From **Node Role**, select _all_ the roles: **etcd**, **Control**, and **Worker**. +1. From **Node Role**, select _all_ the roles: **etcd**, **Control**, and **Worker**. -7. **Optional**: Rancher auto-detects the IP addresses used for Rancher communication and cluster communication. You can override these using `Public Address` and `Internal Address` in the **Node Address** section. +1. **Optional**: Rancher auto-detects the IP addresses used for Rancher communication and cluster communication. You can override these using `Public Address` and `Internal Address` in the **Node Address** section. -8. Skip the **Labels** stuff. It's not important for now. +1. Skip the **Labels** stuff. It's not important for now. -9. Copy the command displayed on screen to your clipboard. +1. Copy the command displayed on screen to your clipboard. -10. Log in to your Linux host using your preferred shell, such as PuTTy or a remote Terminal connection. Run the command copied to your clipboard. +1. Log in to your Linux host using your preferred shell, such as PuTTy or a remote Terminal connection. Run the command copied to your clipboard. -11. When you finish running the command on your Linux host, click **Done**. +1. When you finish running the command on your Linux host, click **Done**. **Result:** From ecd9f73932bd050bc713f4e20f53c4e40738691e Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 16 Nov 2021 10:10:32 -0500 Subject: [PATCH 029/478] Created new section for project-scoped secrets in UI --- .../v2.6/en/k8s-in-rancher/secrets/_index.md | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md b/content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md index 1b0a7c447ec..ff7b9a391df 100644 --- a/content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md +++ b/content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md @@ -11,7 +11,7 @@ When configuring a workload, you'll be able to choose which secrets to include. Mounted secrets will be updated automatically unless they are mounted as subpath volumes. For details on how updated secrets are propagated, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/concepts/configuration/secret/#mounted-secrets-are-updated-automatically) -# Creating Secrets +# Creating Secrets in Namespaces 1. In the upper left corner, click **☰ > Cluster Management**. 1. Go to the cluster where you want to add a secret and click **Explore**. @@ -35,6 +35,23 @@ Mounted secrets will be updated automatically unless they are mounted as subpath Mounted secrets will be updated automatically unless they are mounted as subpath volumes. For details on how updated secrets are propagated, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/concepts/configuration/secret/#mounted-secrets-are-updated-automatically) + +# Creating Secrets in Projects + +Prior to v2.6, secrets were required to be in a project scope. Projects are no longer required, and you may use the namespace scope instead. As a result, the Rancher UI was updated to reflect this new functionality. However, you may still create project-scoped secrets if desired. Note that you have to first enable the `legacy` feature flag and look at a single project to do so. Use the following steps to set up your project-level secret: + +1. In the upper left corner, click **☰ > Global Settings** in the dropdown. +1. Click **Feature Flags**. +1. Go to the `legacy` feature flag and click **Activate**. +1. In the upper left corner, click **☰ > Cluster Management** in the dropdown. +1. Go to the cluster that you created and click **Explore.** +1. Click **Legacy > Projects**. +1. In the top navigation bar, filter to see only one project. +1. In the left navigation bar, click **Secrets**. +1. Click **Add Secret**. + +**Result:** Your secret is added to the individual project you chose. You can view the secret in the Rancher UI by clicking either **Storage > Secrets** or **More Resources > Core > Secrets**. + # What's Next? Now that you have a secret added to a namespace, you can add it to a workload that you deploy. From 5263e25c98f761e1db9e3ec79987b5ee8064ba05 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 16 Nov 2021 11:22:05 -0500 Subject: [PATCH 030/478] Created new section for project-scoped registries in UI --- .../en/k8s-in-rancher/registries/_index.md | 21 +++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/k8s-in-rancher/registries/_index.md b/content/rancher/v2.6/en/k8s-in-rancher/registries/_index.md index c5494e3d61e..12c11dad97d 100644 --- a/content/rancher/v2.6/en/k8s-in-rancher/registries/_index.md +++ b/content/rancher/v2.6/en/k8s-in-rancher/registries/_index.md @@ -14,13 +14,13 @@ Deployments use the Kubernetes registry secret to authenticate with a private Do Currently, deployments pull the private registry credentials automatically only if the workload is created in the Rancher UI and not when it is created via kubectl. -# Creating a Registry +# Creating a Registry in Namespaces >**Prerequisites:** You must have a [private registry](https://docs.docker.com/registry/deploying/) available to use. 1. In the upper left corner, click **☰ > Cluster Management**. 1. Go to the cluster where you want to add a registry and click **Explore**. -1. In the left navigation lick **More Resources > Core > Secrets**. +1. In the left navigation, click either **Storage > Secrets** or **More Resources > Core > Secrets**. 1. Click **Create**. 1. Click **Registry**. 1. Enter a **Name** for the registry. @@ -39,6 +39,23 @@ Currently, deployments pull the private registry credentials automatically only - You can view the secret in the Rancher UI from the **Resources > Registries** view. - Any workload that you create in the Rancher UI will have the credentials to access the registry if the workload is within the registry's scope. +# Creating a Registry in Projects + +>**Prerequisites:** You must have a [private registry](https://docs.docker.com/registry/deploying/) available to use. + +Prior to v2.6, secrets were required to be in a project scope. Projects are no longer required, and you may use the namespace scope instead. As a result, the Rancher UI was updated to reflect this new functionality. However, you may still create a project-scoped registry if desired. Use the following steps to do so: + +1. In the upper left corner, click **☰ > Global Settings** in the dropdown. +1. Click **Feature Flags**. +1. Go to the `legacy` feature flag and click **Activate**. +1. Continue following [steps 1 - 9]({{}}/rancher/v2.6/en/k8s-in-rancher/registries/#creating-a-registry-in-namespaces) above to create and save your project-level registry. Note that in Step 7 above, you will select the project rather than the namespace you want to use. + +**Result:** + +- Your secret is added to the project you chose. +- You can view the secret in the Rancher UI from the **Resources > Registries** view. +- Any workload that you create in the Rancher UI will have the credentials to access the registry if the workload is within the registry's scope. + # Using a Private Registry You can deploy a workload with an image from a private registry through the Rancher UI, or with `kubectl`. From fbba23fb61fe95519a549c6528e37bd51e5d3242 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 16 Nov 2021 11:35:40 -0500 Subject: [PATCH 031/478] Updated link --- content/rancher/v2.6/en/k8s-in-rancher/registries/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/k8s-in-rancher/registries/_index.md b/content/rancher/v2.6/en/k8s-in-rancher/registries/_index.md index 12c11dad97d..c7ff6f37786 100644 --- a/content/rancher/v2.6/en/k8s-in-rancher/registries/_index.md +++ b/content/rancher/v2.6/en/k8s-in-rancher/registries/_index.md @@ -48,7 +48,7 @@ Prior to v2.6, secrets were required to be in a project scope. Projects are no l 1. In the upper left corner, click **☰ > Global Settings** in the dropdown. 1. Click **Feature Flags**. 1. Go to the `legacy` feature flag and click **Activate**. -1. Continue following [steps 1 - 9]({{}}/rancher/v2.6/en/k8s-in-rancher/registries/#creating-a-registry-in-namespaces) above to create and save your project-level registry. Note that in Step 7 above, you will select the project rather than the namespace you want to use. +1. Continue following [steps 1 - 9](#creating-a-registry-in-namespaces) above to create and save your project-level registry. Note that in Step 7 above, you will select the project rather than the namespace you want to use. **Result:** From b8edb209dfe01bd9367396f5b1b0b31e604ced46 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 16 Nov 2021 11:36:53 -0500 Subject: [PATCH 032/478] Added explanation for UI change for project-level secrets --- .../v2.6/en/cluster-admin/projects-and-namespaces/_index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/rancher/v2.6/en/cluster-admin/projects-and-namespaces/_index.md b/content/rancher/v2.6/en/cluster-admin/projects-and-namespaces/_index.md index 71820214033..cd309190b93 100644 --- a/content/rancher/v2.6/en/cluster-admin/projects-and-namespaces/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/projects-and-namespaces/_index.md @@ -8,6 +8,8 @@ A namespace is a Kubernetes concept that allows a virtual cluster within a clust A project is a group of namespaces, and it is a concept introduced by Rancher. Projects allow you to manage multiple namespaces as a group and perform Kubernetes operations in them. You can use projects to support multi-tenancy, so that a team can access a project within a cluster without having access to other projects in the same cluster. +>**Note:** As of Rancher v2.6, projects are de-emphasized on the UI because you don't need them anymore to create secrets exclusively. However, it's still possible to create [secrets in projects]({{}}/rancher/v2.6/en/k8s-in-rancher/secrets/#creating-secrets-in-projects) if desired. + This section describes how projects and namespaces work with Rancher. It covers the following topics: - [About namespaces](#about-namespaces) From ca6010df11029262fa47428e20db0957a5fb5a50 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 16 Nov 2021 15:41:37 -0500 Subject: [PATCH 033/478] Updated directions for registries --- .../en/k8s-in-rancher/registries/_index.md | 24 ++++++++++++++----- 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/content/rancher/v2.6/en/k8s-in-rancher/registries/_index.md b/content/rancher/v2.6/en/k8s-in-rancher/registries/_index.md index c7ff6f37786..ae3a0fd7b35 100644 --- a/content/rancher/v2.6/en/k8s-in-rancher/registries/_index.md +++ b/content/rancher/v2.6/en/k8s-in-rancher/registries/_index.md @@ -28,15 +28,13 @@ Currently, deployments pull the private registry credentials automatically only >**Note:** Kubernetes classifies secrets, certificates, and registries all as [secrets](https://kubernetes.io/docs/concepts/configuration/secret/), and no two secrets in a project or namespace can have duplicate names. Therefore, to prevent conflicts, your registry must have a unique name among all secrets within your workspace. 1. Select a namespace for the registry. - 1. Select the website that hosts your private registry. Then enter credentials that authenticate with the registry. For example, if you use DockerHub, provide your DockerHub username and password. - 1. Click **Save**. **Result:** - Your secret is added to the namespace you chose. -- You can view the secret in the Rancher UI from the **Resources > Registries** view. +- You can view the secret in the Rancher UI by clicking either **Storage > Secrets** or **More Resources > Core > Secrets**. - Any workload that you create in the Rancher UI will have the credentials to access the registry if the workload is within the registry's scope. # Creating a Registry in Projects @@ -48,14 +46,28 @@ Prior to v2.6, secrets were required to be in a project scope. Projects are no l 1. In the upper left corner, click **☰ > Global Settings** in the dropdown. 1. Click **Feature Flags**. 1. Go to the `legacy` feature flag and click **Activate**. -1. Continue following [steps 1 - 9](#creating-a-registry-in-namespaces) above to create and save your project-level registry. Note that in Step 7 above, you will select the project rather than the namespace you want to use. +1. In the upper left corner, click **☰ > Cluster Management**. +1. Go to the cluster where you want to add a registry and click **Explore**. +1. In the left navigation, click either **Storage > Secrets** or **More Resources > Core > Secrets**. +1. Click **Create**. +1. Click **Registry**. +1. In the top navigation bar, filter to see only one project. +1. Enter a **Name** for the registry. + + >**Note:** Kubernetes classifies secrets, certificates, and registries all as [secrets](https://kubernetes.io/docs/concepts/configuration/secret/), and no two secrets in a project or namespace can have duplicate names. Therefore, to prevent conflicts, your registry must have a unique name among all secrets within your workspace. + +1. Select a namespace for the registry. +1. Select the website that hosts your private registry. Then enter credentials that authenticate with the registry. For example, if you use DockerHub, provide your DockerHub username and password. +1. Click **Save**. **Result:** -- Your secret is added to the project you chose. -- You can view the secret in the Rancher UI from the **Resources > Registries** view. +- Your secret is added to the individual project you chose. +- You can view the secret in the Rancher UI by clicking either **Storage > Secrets** or **More Resources > Core > Secrets**. - Any workload that you create in the Rancher UI will have the credentials to access the registry if the workload is within the registry's scope. +>**Note:** Project-scoped registries on the local cluster are only visible when a single project is selected. + # Using a Private Registry You can deploy a workload with an image from a private registry through the Rancher UI, or with `kubectl`. From 68c2bf1d3a6dfbdfda7829da9e02a9d4c8d9bec6 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 16 Nov 2021 15:41:54 -0500 Subject: [PATCH 034/478] Updated directions for secrets --- content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md b/content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md index ff7b9a391df..69a14af98e3 100644 --- a/content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md +++ b/content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md @@ -52,6 +52,8 @@ Prior to v2.6, secrets were required to be in a project scope. Projects are no l **Result:** Your secret is added to the individual project you chose. You can view the secret in the Rancher UI by clicking either **Storage > Secrets** or **More Resources > Core > Secrets**. +>**Note:** Project-scoped secrets on the local cluster are only visible when a single project is selected. + # What's Next? Now that you have a secret added to a namespace, you can add it to a workload that you deploy. From c7978ea97da8e4c00eb75d98b85fae2e6473b6eb Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 16 Nov 2021 15:45:10 -0500 Subject: [PATCH 035/478] Updated wording per feedback --- .../v2.6/en/cluster-admin/projects-and-namespaces/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-admin/projects-and-namespaces/_index.md b/content/rancher/v2.6/en/cluster-admin/projects-and-namespaces/_index.md index cd309190b93..79fc054dc21 100644 --- a/content/rancher/v2.6/en/cluster-admin/projects-and-namespaces/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/projects-and-namespaces/_index.md @@ -8,7 +8,7 @@ A namespace is a Kubernetes concept that allows a virtual cluster within a clust A project is a group of namespaces, and it is a concept introduced by Rancher. Projects allow you to manage multiple namespaces as a group and perform Kubernetes operations in them. You can use projects to support multi-tenancy, so that a team can access a project within a cluster without having access to other projects in the same cluster. ->**Note:** As of Rancher v2.6, projects are de-emphasized on the UI because you don't need them anymore to create secrets exclusively. However, it's still possible to create [secrets in projects]({{}}/rancher/v2.6/en/k8s-in-rancher/secrets/#creating-secrets-in-projects) if desired. +>**Note:** As of Rancher v2.6, projects are de-emphasized on the UI because it is no longer required to create any Kubernetes resources within a project scope. However, resources such as [Secrets]({{}}/rancher/v2.6/en/k8s-in-rancher/secrets/#creating-secrets-in-projects) can still be created in a project scope if the legacy feature flag is enabled. This section describes how projects and namespaces work with Rancher. It covers the following topics: From 8172fe542e887cc8edb5bd986532d038b2f3dae9 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 16 Nov 2021 17:28:35 -0500 Subject: [PATCH 036/478] Added note to redirect to troubleshooting section --- content/rancher/v2.5/en/backups/back-up-rancher/_index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/rancher/v2.5/en/backups/back-up-rancher/_index.md b/content/rancher/v2.5/en/backups/back-up-rancher/_index.md index 51cdf22dfc1..61376329171 100644 --- a/content/rancher/v2.5/en/backups/back-up-rancher/_index.md +++ b/content/rancher/v2.5/en/backups/back-up-rancher/_index.md @@ -28,6 +28,8 @@ Backups are created as .tar.gz files. These files can be pushed to S3 or Minio, 1. Click **Rancher Backups.** 1. Configure the default storage location. For help, refer to the [storage configuration section.](../configuration/storage-config) +>**NOTE:** There is a [known Fleet issue](https://github.com/rancher/backup-restore-operator/issues/164) in Rancher v2.5 that occurs after performing a restoration using the backup-restore-operator. Fleet agents in both the local and downstream Rancher clusters are unable to connect. A temporary workaround may be found [here]({{}}rancher/v2.5/en/deploy-across-clusters/fleet/#troubleshooting). + ### 2. Perform a Backup To perform a backup, a custom resource of type Backup must be created. From e29cd7226f3c198bf080a9605de9aed1fa30fab7 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 16 Nov 2021 17:28:59 -0500 Subject: [PATCH 037/478] Added temp workaround for Fleet issue in Rancher --- .../v2.5/en/deploy-across-clusters/fleet/_index.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md index abea9bad31e..07652cea919 100644 --- a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md +++ b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md @@ -16,6 +16,7 @@ Fleet is a separate project from Rancher, and can be installed on any Kubernetes - [Windows Support](#windows-support) - [GitHub Repository](#github-repository) - [Using Fleet Behind a Proxy](#using-fleet-behind-a-proxy) +- [Troubleshooting](#troubleshooting) - [Documentation](#documentation) # Architecture @@ -44,6 +45,16 @@ _Available as of v2.5.8_ For details on using Fleet behind a proxy, see [this page.](./proxy) +# Troubleshooting + +- **Known Issue:** Fleet in Rancher v2.5 becomes inoperable after a restore using the [backup-restore operator](({{}}rancher/v2.5/en/backups/back-up-rancher/#install-the-rancher-backup-operator)). We will update the community once a permanent solution is in place. +- **Temporary Workaround:**
+ 1. Find the two service account tokens listed in the fleet-controller and the fleet-controller-bootstrap service accounts. These are under the fleet-system Namespace of the local cluster.
+ 2. Remove the non-existent token secret. Doing so allows for only one entry to be present for the service account token secret that actually exists.
+ 3. Delete the fleet-controller Pod in the fleet-system Namespace to reschedule.
+ 4. After the service account token issue is resolved, you can force redeployment of the fleet-agents. In the Rancher UI, go to **☰ > Cluster Management**, click on **Clusters** page, then click **Force Update**.
+ 5. If the fleet-agent bundles remain in a `Modified` state after Step 4, use the command `spec.forceSyncGeneration` for fleet-agent bundle to force re-creation. + # Documentation The Fleet documentation is at [https://fleet.rancher.io/.](https://fleet.rancher.io/) From 5c240e81b0323f329ef93e4a5bb338213de2a746 Mon Sep 17 00:00:00 2001 From: Nuno do Carmo Date: Wed, 17 Nov 2021 09:22:02 +0100 Subject: [PATCH 038/478] Removed `--privileged` references and added command As suggested, the `--privileged` reference was removed from every options and only the description, at the top, remains. In every options, the command's introduction has been rephrased to be more generic. --- .../single-node-docker/_index.md | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md index 4bf7f123324..35b6cb9a5a7 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md @@ -50,9 +50,7 @@ Choose from the following options: If you are installing Rancher in a development or testing environment where identity verification isn't a concern, install Rancher using the self-signed certificate that it generates. This installation option omits the hassle of generating a certificate yourself. -Log into your Linux host, and then run the minimum installation command below. - -Privileged access is [required.](#privileged-access-for-rancher) +Log into your host, and run the command below: ```bash docker run -d --restart=unless-stopped \ @@ -79,7 +77,7 @@ After creating your certificate, run the Docker command below to install Rancher | `` | The path to the private key for your certificate. | | `` | The path to the certificate authority's certificate. | -Privileged access is [required.](#privileged-access-for-rancher) +Log into your host, and run the command below: ```bash docker run -d --restart=unless-stopped \ @@ -111,7 +109,7 @@ After obtaining your certificate, run the Docker command below. | `` | The path to your full certificate chain. | | `` | The path to the private key for your certificate. | -Privileged access is [required.](#privileged-access-for-rancher) +Log into your host, and run the command below: ```bash docker run -d --restart=unless-stopped \ @@ -141,7 +139,7 @@ After you fulfill the prerequisites, you can install Rancher using a Let's Encry | ----------------- | ------------------- | | `` | Your domain address | -Privileged access is [required.](#privileged-access-for-rancher) +Log into your host, and run the command below: ``` docker run -d --restart=unless-stopped \ @@ -155,13 +153,9 @@ docker run -d --restart=unless-stopped \ If you are installing Rancher in a development or testing environment where you have a localhost tunneling solution running, such as [ngrok](https://ngrok.com/), avoid generating a certificate. This installation option doesn't require a certificate. -- You will use `--no-cacerts` in the argument to disable the default CA certificate generated by Rancher. Note that privileged access is [required.](#privileged-access-for-rancher). +- You will use `--no-cacerts` in the argument to disable the default CA certificate generated by Rancher. -Log into your host machine and run the Docker command below: - -- Use the `--no-cacerts` as argument to the container to disable the default CA certificate generated by Rancher. - -Privileged access is [required.](#privileged-access-for-rancher) +Log into your host, and run the command below:: ```bash docker run -d --restart=unless-stopped \ From 9d2e90f5bf44c2515fb0e14ce4df963de735eb98 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 17 Nov 2021 11:27:09 -0500 Subject: [PATCH 039/478] Updated ts comments --- .../en/deploy-across-clusters/fleet/_index.md | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md index 07652cea919..e8fc3a2d78c 100644 --- a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md +++ b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md @@ -47,14 +47,18 @@ For details on using Fleet behind a proxy, see [this page.](./proxy) # Troubleshooting -- **Known Issue:** Fleet in Rancher v2.5 becomes inoperable after a restore using the [backup-restore operator](({{}}rancher/v2.5/en/backups/back-up-rancher/#install-the-rancher-backup-operator)). We will update the community once a permanent solution is in place. -- **Temporary Workaround:**
- 1. Find the two service account tokens listed in the fleet-controller and the fleet-controller-bootstrap service accounts. These are under the fleet-system Namespace of the local cluster.
- 2. Remove the non-existent token secret. Doing so allows for only one entry to be present for the service account token secret that actually exists.
- 3. Delete the fleet-controller Pod in the fleet-system Namespace to reschedule.
- 4. After the service account token issue is resolved, you can force redeployment of the fleet-agents. In the Rancher UI, go to **☰ > Cluster Management**, click on **Clusters** page, then click **Force Update**.
- 5. If the fleet-agent bundles remain in a `Modified` state after Step 4, use the command `spec.forceSyncGeneration` for fleet-agent bundle to force re-creation. +**Known Issue:** +Fleet in Rancher v2.5 becomes inoperable after a restore using the [backup-restore operator]({{}}rancher/v2.5/en/backups/back-up-rancher/#1-install-the-rancher-backup-operator). We will update the community once a permanent solution is in place. + +**Temporary Workaround**: + +1. Find the two service account tokens listed in the fleet-controller and the fleet-controller-bootstrap service accounts. These are under the fleet-system Namespace of the local cluster.
+2. Remove the non-existent token secret. Doing so allows for only one entry to be present for the service account token secret that actually exists.
+3. Delete the fleet-controller Pod in the fleet-system Namespace to reschedule.
+4. After the service account token issue is resolved, you can force redeployment of the fleet-agents. In the Rancher UI, go to **☰ > Cluster Management**, click on **Clusters** page, then click **Force Update**.
+5. If the fleet-agent bundles remain in a `Modified` state after Step 4, use the command `spec.forceSyncGeneration` for fleet-agent bundle to force re-creation. + # Documentation The Fleet documentation is at [https://fleet.rancher.io/.](https://fleet.rancher.io/) From ed2ec2bd308da0edb880243c0660c155d955ae50 Mon Sep 17 00:00:00 2001 From: Jen Travinski Date: Wed, 17 Nov 2021 14:02:03 -0500 Subject: [PATCH 040/478] Update content/rancher/v2.6/en/k8s-in-rancher/registries/_index.md Co-authored-by: Billy Tat --- content/rancher/v2.6/en/k8s-in-rancher/registries/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/k8s-in-rancher/registries/_index.md b/content/rancher/v2.6/en/k8s-in-rancher/registries/_index.md index ae3a0fd7b35..0b075b620d0 100644 --- a/content/rancher/v2.6/en/k8s-in-rancher/registries/_index.md +++ b/content/rancher/v2.6/en/k8s-in-rancher/registries/_index.md @@ -41,7 +41,7 @@ Currently, deployments pull the private registry credentials automatically only >**Prerequisites:** You must have a [private registry](https://docs.docker.com/registry/deploying/) available to use. -Prior to v2.6, secrets were required to be in a project scope. Projects are no longer required, and you may use the namespace scope instead. As a result, the Rancher UI was updated to reflect this new functionality. However, you may still create a project-scoped registry if desired. Use the following steps to do so: +Before v2.6, secrets were required to be in a project scope. Projects are no longer required, and you may use the namespace scope instead. As a result, the Rancher UI was updated to reflect this new functionality. However, you may still create a project-scoped registry if desired. Use the following steps to do so: 1. In the upper left corner, click **☰ > Global Settings** in the dropdown. 1. Click **Feature Flags**. From 0557fce0f1f0b07b925edc7611fd23da7f472e1d Mon Sep 17 00:00:00 2001 From: Jen Travinski Date: Wed, 17 Nov 2021 14:02:14 -0500 Subject: [PATCH 041/478] Update content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md Co-authored-by: Billy Tat --- content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md b/content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md index 69a14af98e3..9c7f74220ea 100644 --- a/content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md +++ b/content/rancher/v2.6/en/k8s-in-rancher/secrets/_index.md @@ -38,7 +38,7 @@ Mounted secrets will be updated automatically unless they are mounted as subpath # Creating Secrets in Projects -Prior to v2.6, secrets were required to be in a project scope. Projects are no longer required, and you may use the namespace scope instead. As a result, the Rancher UI was updated to reflect this new functionality. However, you may still create project-scoped secrets if desired. Note that you have to first enable the `legacy` feature flag and look at a single project to do so. Use the following steps to set up your project-level secret: +Before v2.6, secrets were required to be in a project scope. Projects are no longer required, and you may use the namespace scope instead. As a result, the Rancher UI was updated to reflect this new functionality. However, you may still create project-scoped secrets if desired. Note that you have to first enable the `legacy` feature flag and look at a single project to do so. Use the following steps to set up your project-level secret: 1. In the upper left corner, click **☰ > Global Settings** in the dropdown. 1. Click **Feature Flags**. From da538ed9e7c955fa6b439d2f22e622619d98cd37 Mon Sep 17 00:00:00 2001 From: rancher-max Date: Wed, 17 Nov 2021 12:33:59 -0700 Subject: [PATCH 042/478] Add networkpolicy for metrics-server in hardened k3s --- .../en/security/hardening_guide/_index.md | 20 ++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/content/k3s/latest/en/security/hardening_guide/_index.md b/content/k3s/latest/en/security/hardening_guide/_index.md index 6a66acc02aa..2b2560393c8 100644 --- a/content/k3s/latest/en/security/hardening_guide/_index.md +++ b/content/k3s/latest/en/security/hardening_guide/_index.md @@ -302,11 +302,25 @@ spec: - Ingress ``` -If you are using the default traefik ingress controller with k3s, it will also be blocked by default, so the following network policies must be added to allow traffic to both traefik pods and svclb pods in the kube-system namespace. For version 1.20 and below there is a different label `traefik` used than in 1.21 and above, so remove the one that is not associated with your Kubernetes version. +A few of the packaged components may also need NetworkPolicies applied to allow them to work properly. For example, metrics-server will only work intermittently and the Traefik ingress controller will be blocked by default if not supplying the below policies. For Traefik in k3s version 1.20 and below there is a different `traefik` label used than in 1.21 and above, so remove the one in the below yaml that is not associated with your Kubernetes version. ```yaml apiVersion: networking.k8s.io/v1 kind: NetworkPolicy +metadata: + name: allow-all-metrics-server + namespace: kube-system +spec: + podSelector: + matchLabels: + k8s-app: metrics-server + ingress: + - {} + policyTypes: + - Ingress +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy metadata: name: allow-all-svclbtraefik-ingress namespace: kube-system @@ -319,7 +333,7 @@ spec: policyTypes: - Ingress --- -# 1.20 +# Below is for 1.20 ONLY -- remove if on 1.21 or above apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: @@ -334,7 +348,7 @@ spec: policyTypes: - Ingress --- -# 1.21 +# Below is for 1.21 and above ONLY -- remove if on 1.20 or below apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: From 945cf3b941b64df725acf56b8d3c8a0401536350 Mon Sep 17 00:00:00 2001 From: Max Date: Wed, 17 Nov 2021 12:53:04 -0700 Subject: [PATCH 043/478] Update content/k3s/latest/en/security/hardening_guide/_index.md Co-authored-by: Brad Davidson --- content/k3s/latest/en/security/hardening_guide/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/k3s/latest/en/security/hardening_guide/_index.md b/content/k3s/latest/en/security/hardening_guide/_index.md index 2b2560393c8..90e888a8cd4 100644 --- a/content/k3s/latest/en/security/hardening_guide/_index.md +++ b/content/k3s/latest/en/security/hardening_guide/_index.md @@ -302,7 +302,7 @@ spec: - Ingress ``` -A few of the packaged components may also need NetworkPolicies applied to allow them to work properly. For example, metrics-server will only work intermittently and the Traefik ingress controller will be blocked by default if not supplying the below policies. For Traefik in k3s version 1.20 and below there is a different `traefik` label used than in 1.21 and above, so remove the one in the below yaml that is not associated with your Kubernetes version. +The metrics-server and Traefik ingress controller will be blocked by default if network policies are not created to allow access. Traefik v1 as packaged in K3s version 1.20 and below uses different labels than Traefik v2; ensure that you only use the sample yaml below that is associated with the version of Traefik present on your cluster. ```yaml apiVersion: networking.k8s.io/v1 From 514edd8d67f07c467ffbfd66b44345da9590a66e Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 17 Nov 2021 15:02:14 -0500 Subject: [PATCH 044/478] Added 2nd known issue to TS section for Fleet --- .../v2.5/en/backups/back-up-rancher/_index.md | 2 +- .../en/deploy-across-clusters/fleet/_index.md | 21 ++++++++++++------- 2 files changed, 14 insertions(+), 9 deletions(-) diff --git a/content/rancher/v2.5/en/backups/back-up-rancher/_index.md b/content/rancher/v2.5/en/backups/back-up-rancher/_index.md index 61376329171..aea4c343489 100644 --- a/content/rancher/v2.5/en/backups/back-up-rancher/_index.md +++ b/content/rancher/v2.5/en/backups/back-up-rancher/_index.md @@ -28,7 +28,7 @@ Backups are created as .tar.gz files. These files can be pushed to S3 or Minio, 1. Click **Rancher Backups.** 1. Configure the default storage location. For help, refer to the [storage configuration section.](../configuration/storage-config) ->**NOTE:** There is a [known Fleet issue](https://github.com/rancher/backup-restore-operator/issues/164) in Rancher v2.5 that occurs after performing a restoration using the backup-restore-operator. Fleet agents in both the local and downstream Rancher clusters are unable to connect. A temporary workaround may be found [here]({{}}rancher/v2.5/en/deploy-across-clusters/fleet/#troubleshooting). +>**NOTE:** There are two known issues in Fleet that occur after performing a restoration using the backup-restore-operator: Fleet agents are inoperable and clientSecretName and helmSecretName are not included in Fleet gitrepos. Refer [here]({{}}rancher/v2.5/en/deploy-across-clusters/fleet/#troubleshooting) for workarounds. ### 2. Perform a Backup diff --git a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md index e8fc3a2d78c..96cb5d0611a 100644 --- a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md +++ b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md @@ -46,18 +46,23 @@ _Available as of v2.5.8_ For details on using Fleet behind a proxy, see [this page.](./proxy) # Troubleshooting +--- +* **Known Issue:** Fleet becomes inoperable after a restore using the [backup-restore-operator]({{}}rancher/v2.5/en/backups/back-up-rancher/#1-install-the-rancher-backup-operator). We will update the community once a permanent solution is in place. -**Known Issue:** +* **Temporary Workaround:**
+ 1. Find the two service account tokens listed in the fleet-controller and the fleet-controller-bootstrap service accounts. These are under the fleet-system Namespace of the local cluster.
+ 2. Remove the non-existent token secret. Doing so allows for only one entry to be present for the service account token secret that actually exists.
+ 3. Delete the fleet-controller Pod in the fleet-system Namespace to reschedule.
+ 4. After the service account token issue is resolved, you can force redeployment of the fleet-agents. In the Rancher UI, go to **☰ > Cluster Management**, click on **Clusters** page, then click **Force Update**.
+ 5. If the fleet-agent bundles remain in a `Modified` state after Step 4, use the command `spec.forceSyncGeneration` for the fleet-agent bundle to force re-creation. -Fleet in Rancher v2.5 becomes inoperable after a restore using the [backup-restore operator]({{}}rancher/v2.5/en/backups/back-up-rancher/#1-install-the-rancher-backup-operator). We will update the community once a permanent solution is in place. +--- +* **Known Issue:** clientSecretName and helmSecretName secrets for Fleet gitrepos are not included in the backup nor restore created by the [backup-restore-operator]({{}}rancher/v2.5/en/backups/back-up-rancher/#1-install-the-rancher-backup-operator). We will update the community once a permanent solution is in place. -**Temporary Workaround**: +* **Temporary Workaround:**
+By default, user-defined secrets are not backed up in Fleet. It is necessary to recreate secrets if performing a disaster recovery restore or migration of Rancher into a fresh cluster. To modify resourceSet to include extra resources you want to backup, refer to docs [here](https://github.com/rancher/backup-restore-operator#user-flow). -1. Find the two service account tokens listed in the fleet-controller and the fleet-controller-bootstrap service accounts. These are under the fleet-system Namespace of the local cluster.
-2. Remove the non-existent token secret. Doing so allows for only one entry to be present for the service account token secret that actually exists.
-3. Delete the fleet-controller Pod in the fleet-system Namespace to reschedule.
-4. After the service account token issue is resolved, you can force redeployment of the fleet-agents. In the Rancher UI, go to **☰ > Cluster Management**, click on **Clusters** page, then click **Force Update**.
-5. If the fleet-agent bundles remain in a `Modified` state after Step 4, use the command `spec.forceSyncGeneration` for fleet-agent bundle to force re-creation. +--- # Documentation From bbb14278a7e9f964c8f1af8bfa829757ab990e7a Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 17 Nov 2021 15:26:15 -0500 Subject: [PATCH 045/478] Adding notes for workarounds in 2.5, 2.6 --- content/rancher/v2.5/en/backups/_index.md | 2 ++ content/rancher/v2.6/en/backups/_index.md | 2 ++ .../rancher/v2.6/en/backups/back-up-rancher/_index.md | 2 ++ .../v2.6/en/deploy-across-clusters/fleet/_index.md | 11 +++++++++++ 4 files changed, 17 insertions(+) diff --git a/content/rancher/v2.5/en/backups/_index.md b/content/rancher/v2.5/en/backups/_index.md index 0f765d2d84d..01b07a0db84 100644 --- a/content/rancher/v2.5/en/backups/_index.md +++ b/content/rancher/v2.5/en/backups/_index.md @@ -63,6 +63,8 @@ The Backup and Restore custom resources can be created in the Rancher UI, or by The `rancher-backup` operator can be installed from the Rancher UI, or with the Helm CLI. In both cases, the `rancher-backup` Helm chart is installed on the Kubernetes cluster running the Rancher server. It is a cluster-admin only feature and available only for the **local** cluster. (*If you do not see `rancher-backup` in the Rancher UI, you may have selected the wrong cluster.*) +>**NOTE:** There are two known issues in Fleet that occur after performing a restoration using the backup-restore-operator: Fleet agents are inoperable and clientSecretName and helmSecretName are not included in Fleet gitrepos. Refer [here]({{}}rancher/v2.5/en/deploy-across-clusters/fleet/#troubleshooting) for workarounds. + ### Installing rancher-backup with the Rancher UI 1. In the Rancher UI's Cluster Manager, choose the cluster named **local** diff --git a/content/rancher/v2.6/en/backups/_index.md b/content/rancher/v2.6/en/backups/_index.md index b090f2972b2..9aec8aae77f 100644 --- a/content/rancher/v2.6/en/backups/_index.md +++ b/content/rancher/v2.6/en/backups/_index.md @@ -47,6 +47,8 @@ The Backup and Restore custom resources can be created in the Rancher UI, or by The `rancher-backup` operator can be installed from the Rancher UI, or with the Helm CLI. In both cases, the `rancher-backup` Helm chart is installed on the Kubernetes cluster running the Rancher server. It is a cluster-admin only feature and available only for the **local** cluster. (*If you do not see `rancher-backup` in the Rancher UI, you may have selected the wrong cluster.*) +>**NOTE:** There is a known issue in Fleet that occurs after performing a restoration using the backup-restore-operator: Secrets used for clientSecretName and helmSecretName are not included in Fleet gitrepos. Refer [here]({{}}rancher/v2.6/en/deploy-across-clusters/fleet/#troubleshooting) for a workaround. + ### Installing rancher-backup with the Rancher UI 1. In the upper left corner, click **☰ > Cluster Management**. diff --git a/content/rancher/v2.6/en/backups/back-up-rancher/_index.md b/content/rancher/v2.6/en/backups/back-up-rancher/_index.md index acfe23fc3fb..5364e06c2ba 100644 --- a/content/rancher/v2.6/en/backups/back-up-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/back-up-rancher/_index.md @@ -25,6 +25,8 @@ Backups are created as .tar.gz files. These files can be pushed to S3 or Minio, 1. Configure the default storage location. For help, refer to the [storage configuration section.](../configuration/storage-config) 1. Click **Install**. +>**NOTE:** There is a known issue in Fleet that occurs after performing a restoration using the backup-restore-operator: Secrets used for clientSecretName and helmSecretName are not included in Fleet gitrepos. Refer [here]({{}}rancher/v2.6/en/deploy-across-clusters/fleet/#troubleshooting) for a workaround. + ### 2. Perform a Backup To perform a backup, a custom resource of type Backup must be created. diff --git a/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md b/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md index f9ef3cc818c..c59ee4dbbd1 100644 --- a/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md +++ b/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md @@ -12,6 +12,7 @@ Fleet is a separate project from Rancher, and can be installed on any Kubernetes - [Windows Support](#windows-support) - [GitHub Repository](#github-repository) - [Using Fleet Behind a Proxy](#using-fleet-behind-a-proxy) +- [Troubleshooting](#troubleshooting) - [Documentation](#documentation) # Architecture @@ -36,6 +37,16 @@ The Fleet Helm charts are available [here.](https://github.com/rancher/fleet/rel For details on using Fleet behind a proxy, see [this page.](./proxy) +# Troubleshooting + +--- +* **Known Issue:** clientSecretName and helmSecretName secrets for Fleet gitrepos are not included in the backup nor restore created by the [backup-restore-operator]({{}}rancher/v2.6/en/backups/back-up-rancher/#1-install-the-rancher-backups-operator). We will update the community once a permanent solution is in place. + +* **Temporary Workaround:**
+By default, user-defined secrets are not backed up in Fleet. It is necessary to recreate secrets if performing a disaster recovery restore or migration of Rancher into a fresh cluster. To modify resourceSet to include extra resources you want to backup, refer to docs [here](https://github.com/rancher/backup-restore-operator#user-flow). + +--- + # Documentation The Fleet documentation is at [https://fleet.rancher.io/.](https://fleet.rancher.io/) From 12d8031495a194d834ddbec8bfedf0fad50aa33a Mon Sep 17 00:00:00 2001 From: Nuno do Carmo Date: Thu, 18 Nov 2021 09:08:07 +0100 Subject: [PATCH 046/478] Removed trailing ":" Co-authored-by: Jen Travinski --- .../other-installation-methods/single-node-docker/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md index 35b6cb9a5a7..26ba9770630 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md @@ -155,7 +155,7 @@ If you are installing Rancher in a development or testing environment where you - You will use `--no-cacerts` in the argument to disable the default CA certificate generated by Rancher. -Log into your host, and run the command below:: +Log into your host, and run the command below: ```bash docker run -d --restart=unless-stopped \ From 41158cb7e1c66c1e90790420b6d62fa8b1ebd66d Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Thu, 18 Nov 2021 10:27:17 -0700 Subject: [PATCH 047/478] Clarify that restoring to previous Rancher version needs steps on other page --- content/rancher/v2.6/en/backups/restoring-rancher/_index.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md index 0d9925329a1..7497f13ec30 100644 --- a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md @@ -9,6 +9,7 @@ A restore is performed by creating a Restore custom resource. > > * Follow the instructions from this page for restoring rancher on the same cluster where it was backed up from. In order to migrate rancher to a new cluster, follow the steps to [migrate rancher.]({{}}/rancher/v2.6/en/backups/migrating-rancher) > * While restoring rancher on the same setup, the operator will scale down the rancher deployment when restore starts, and it will scale back up the deployment once restore completes. So Rancher will be unavailable during the restore. +> * If you need to restore Rancher to a previous version after an upgrade, see the [rollback documentation.]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/rollbacks/ ) ### Create the Restore Custom Resource From 1992f644c41881b33f7fc42f84f8955b7f60a477 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 18 Nov 2021 09:32:08 -0800 Subject: [PATCH 048/478] Remove extra space --- content/rancher/v2.6/en/backups/restoring-rancher/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md index 7497f13ec30..1f20f311720 100644 --- a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md @@ -9,7 +9,7 @@ A restore is performed by creating a Restore custom resource. > > * Follow the instructions from this page for restoring rancher on the same cluster where it was backed up from. In order to migrate rancher to a new cluster, follow the steps to [migrate rancher.]({{}}/rancher/v2.6/en/backups/migrating-rancher) > * While restoring rancher on the same setup, the operator will scale down the rancher deployment when restore starts, and it will scale back up the deployment once restore completes. So Rancher will be unavailable during the restore. -> * If you need to restore Rancher to a previous version after an upgrade, see the [rollback documentation.]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/rollbacks/ ) +> * If you need to restore Rancher to a previous version after an upgrade, see the [rollback documentation.]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/rollbacks/) ### Create the Restore Custom Resource From 0879115c95479717a82ec667086f24608faff0d2 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Fri, 19 Nov 2021 11:53:59 -0800 Subject: [PATCH 049/478] Change the recommended number of control plane nodes from 2 to 3 or more --- .../rancher/v2.0-v2.4/en/best-practices/management/_index.md | 4 ++-- content/rancher/v2.0-v2.4/en/overview/concepts/_index.md | 4 ++-- content/rancher/v2.5/en/overview/concepts/_index.md | 4 ++-- content/rancher/v2.6/en/overview/concepts/_index.md | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/content/rancher/v2.0-v2.4/en/best-practices/management/_index.md b/content/rancher/v2.0-v2.4/en/best-practices/management/_index.md index d85e5a22cbf..b95730d55be 100644 --- a/content/rancher/v2.0-v2.4/en/best-practices/management/_index.md +++ b/content/rancher/v2.0-v2.4/en/best-practices/management/_index.md @@ -86,8 +86,8 @@ Run your etcd and control plane nodes on virtual machines where you can scale vC ### Use at Least Three etcd Nodes Provision 3 or 5 etcd nodes. Etcd requires a quorum to determine a leader by the majority of nodes, therefore it is not recommended to have clusters of even numbers. Three etcd nodes is generally sufficient for smaller clusters and five etcd nodes for large clusters. -### Use at Least Two Control Plane Nodes -Provision two or more control plane nodes. Some control plane components, such as the `kube-apiserver`, run in [active-active](https://www.jscape.com/blog/active-active-vs-active-passive-high-availability-cluster) mode and will give you more scalability. Other components such as kube-scheduler and kube-controller run in active-passive mode (leader elect) and give you more fault tolerance. +### Use at Least Three Control Plane Nodes +Provision three or more control plane nodes. Some control plane components, such as the `kube-apiserver`, run in [active-active](https://www.jscape.com/blog/active-active-vs-active-passive-high-availability-cluster) mode and will give you more scalability. Other components such as kube-scheduler and kube-controller run in active-passive mode (leader elect) and give you more fault tolerance. ### Monitor Your Cluster Closely monitor and scale your nodes as needed. You should [enable cluster monitoring]({{}}/rancher/v2.0-v2.4/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/) and use the Prometheus metrics and Grafana visualization options as a starting point. diff --git a/content/rancher/v2.0-v2.4/en/overview/concepts/_index.md b/content/rancher/v2.0-v2.4/en/overview/concepts/_index.md index afac8412a3f..c637928995d 100644 --- a/content/rancher/v2.0-v2.4/en/overview/concepts/_index.md +++ b/content/rancher/v2.0-v2.4/en/overview/concepts/_index.md @@ -52,7 +52,7 @@ Three etcd nodes is generally sufficient for smaller clusters and five etcd node ### Controlplane Nodes -Controlplane nodes run the Kubernetes API server, scheduler, and controller manager. These nodes take care of routine tasks to ensure that your cluster maintains your configuration. Because all cluster data is stored on your etcd nodes, control plane nodes are stateless. You can run control plane on a single node, although two or more nodes are recommended for redundancy. Additionally, a single node can share the control plane and etcd roles. +Controlplane nodes run the Kubernetes API server, scheduler, and controller manager. These nodes take care of routine tasks to ensure that your cluster maintains your configuration. Because all cluster data is stored on your etcd nodes, control plane nodes are stateless. You can run control plane on a single node, although three or more nodes are recommended for redundancy. Additionally, a single node can share the control plane and etcd roles. ### Worker Nodes @@ -69,4 +69,4 @@ For high-availability installations of Rancher, Helm is the tool used to install Helm is the package management tool of choice for Kubernetes. Helm charts provide templating syntax for Kubernetes YAML manifest documents. With Helm we can create configurable deployments instead of just using static files. For more information about creating your own catalog of deployments, check out the docs at [https://helm.sh/](https://helm.sh). -For more information on service accounts and cluster role binding, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) \ No newline at end of file +For more information on service accounts and cluster role binding, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) diff --git a/content/rancher/v2.5/en/overview/concepts/_index.md b/content/rancher/v2.5/en/overview/concepts/_index.md index 4e9d2d89e0d..30d5374875b 100644 --- a/content/rancher/v2.5/en/overview/concepts/_index.md +++ b/content/rancher/v2.5/en/overview/concepts/_index.md @@ -54,7 +54,7 @@ Three etcd nodes is generally sufficient for smaller clusters and five etcd node ### Controlplane Nodes -Controlplane nodes run the Kubernetes API server, scheduler, and controller manager. These nodes take care of routine tasks to ensure that your cluster maintains your configuration. Because all cluster data is stored on your etcd nodes, control plane nodes are stateless. You can run control plane on a single node, although two or more nodes are recommended for redundancy. Additionally, a single node can share the control plane and etcd roles. +Controlplane nodes run the Kubernetes API server, scheduler, and controller manager. These nodes take care of routine tasks to ensure that your cluster maintains your configuration. Because all cluster data is stored on your etcd nodes, control plane nodes are stateless. You can run control plane on a single node, although three or more nodes are recommended for redundancy. Additionally, a single node can share the control plane and etcd roles. ### Worker Nodes @@ -71,4 +71,4 @@ For high-availability installations of Rancher, Helm is the tool used to install Helm is the package management tool of choice for Kubernetes. Helm charts provide templating syntax for Kubernetes YAML manifest documents. With Helm we can create configurable deployments instead of just using static files. For more information about creating your own catalog of deployments, check out the docs at [https://helm.sh/](https://helm.sh). -For more information on service accounts and cluster role binding, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) \ No newline at end of file +For more information on service accounts and cluster role binding, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) diff --git a/content/rancher/v2.6/en/overview/concepts/_index.md b/content/rancher/v2.6/en/overview/concepts/_index.md index 2736a842f2d..5cd01b9460c 100644 --- a/content/rancher/v2.6/en/overview/concepts/_index.md +++ b/content/rancher/v2.6/en/overview/concepts/_index.md @@ -52,7 +52,7 @@ Three etcd nodes is generally sufficient for smaller clusters and five etcd node ### Controlplane Nodes -Controlplane nodes run the Kubernetes API server, scheduler, and controller manager. These nodes take care of routine tasks to ensure that your cluster maintains your configuration. Because all cluster data is stored on your etcd nodes, control plane nodes are stateless. You can run control plane on a single node, although two or more nodes are recommended for redundancy. Additionally, a single node can share the control plane and etcd roles. +Controlplane nodes run the Kubernetes API server, scheduler, and controller manager. These nodes take care of routine tasks to ensure that your cluster maintains your configuration. Because all cluster data is stored on your etcd nodes, control plane nodes are stateless. You can run control plane on a single node, although three or more nodes are recommended for redundancy. Additionally, a single node can share the control plane and etcd roles. ### Worker Nodes From 3728c2892e1e209ff642c7377f003f45e71926e6 Mon Sep 17 00:00:00 2001 From: vrevelas <30143390+vrevelas@users.noreply.github.com> Date: Mon, 22 Nov 2021 14:02:07 +0200 Subject: [PATCH 050/478] Fix image pull error for air-gapped install --- .../air-gap/install-rancher/_index.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/install-rancher/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/install-rancher/_index.md index d2be9a4a1ef..8f15d855e8e 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/install-rancher/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/install-rancher/_index.md @@ -107,7 +107,8 @@ helm template cert-manager ./cert-manager-v1.5.1.tgz --output-dir . \ --namespace cert-manager \ --set image.repository=/quay.io/jetstack/cert-manager-controller \ --set webhook.image.repository=/quay.io/jetstack/cert-manager-webhook \ - --set cainjector.image.repository=/quay.io/jetstack/cert-manager-cainjector + --set cainjector.image.repository=/quay.io/jetstack/cert-manager-cainjector \ + --set startupapicheck.image.repository=/quay.io/jetstack/cert-manager-ctl ``` ### 4. Download the cert-manager CRD From 41e6d9e50882fce7453e96adc7867871cfeb2656 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Mon, 22 Nov 2021 09:29:40 -0700 Subject: [PATCH 051/478] Update requirements for registered clusters --- .../registered-clusters/_index.md | 34 +++++++++++++++++++ .../registered-clusters/_index.md | 8 +++++ 2 files changed, 42 insertions(+) diff --git a/content/rancher/v2.5/en/cluster-provisioning/registered-clusters/_index.md b/content/rancher/v2.5/en/cluster-provisioning/registered-clusters/_index.md index 8791b91df96..22995693f7a 100644 --- a/content/rancher/v2.5/en/cluster-provisioning/registered-clusters/_index.md +++ b/content/rancher/v2.5/en/cluster-provisioning/registered-clusters/_index.md @@ -20,6 +20,17 @@ The control that Rancher has to manage a registered cluster depends on the type # Prerequisites +{{% tabs %}} +{{% tab "v2.5.9+" %}} + +## Kubernetes Node Roles + +Registered RKE Kubernetes clusters must have all three node roles - etcd, controlplane and worker. A cluster with only controlplane components cannot be registered in Rancher. + +For more information on RKE node roles, see the [best practices.]({{}}/rancher/v2.5/en/cluster-provisioning/production/#cluster-architecture) + +## Permissions + If your existing Kubernetes cluster already has a `cluster-admin` role defined, you must have this `cluster-admin` privilege to register the cluster in Rancher. In order to apply the privilege, you need to run: @@ -36,6 +47,29 @@ By default, GKE users are not given this privilege, so you will need to run the If you are registering a K3s cluster, make sure the `cluster.yml` is readable. It is protected by default. For details, refer to [Configuring a K3s cluster to enable importation to Rancher.](#configuring-a-k3s-cluster-to-enable-registration-in-rancher) +{{% /tab %}} +{{% tab "Rancher before v2.5.9" %}} + +## Permissions + +If your existing Kubernetes cluster already has a `cluster-admin` role defined, you must have this `cluster-admin` privilege to register the cluster in Rancher. + +In order to apply the privilege, you need to run: + +```plain +kubectl create clusterrolebinding cluster-admin-binding \ + --clusterrole cluster-admin \ + --user [USER_ACCOUNT] +``` + +before running the `kubectl` command to register the cluster. + +By default, GKE users are not given this privilege, so you will need to run the command before registering GKE clusters. To learn more about role-based access control for GKE, please click [here](https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control). + +If you are registering a K3s cluster, make sure the `cluster.yml` is readable. It is protected by default. For details, refer to [Configuring a K3s cluster to enable importation to Rancher.](#configuring-a-k3s-cluster-to-enable-registration-in-rancher) +{{% /tab %}} +{{% /tabs %}} + # Registering a Cluster 1. From the **Clusters** page, click **Add Cluster**. diff --git a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md index 7bfa2eff0cb..ebc31e09ff2 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md @@ -16,6 +16,14 @@ The control that Rancher has to manage a registered cluster depends on the type # Prerequisites +## Kubernetes Node Roles + +Registered RKE Kubernetes clusters must have all three node roles - etcd, controlplane and worker. A cluster with only controlplane components cannot be registered in Rancher. + +For more information on RKE node roles, see the [best practices.]({{}}/rancher/v2.6/en/cluster-provisioning/production/#cluster-architecture) + +## Permissions + If your existing Kubernetes cluster already has a `cluster-admin` role defined, you must have this `cluster-admin` privilege to register the cluster in Rancher. In order to apply the privilege, you need to run: From 2a294892e36548f0de6141ff75ac933b17918542 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 22 Nov 2021 09:45:42 -0800 Subject: [PATCH 052/478] Apply 3728c289 (author: vrevelas) to Rancher 2.5 --- .../air-gap/install-rancher/_index.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/installation/other-installation-methods/air-gap/install-rancher/_index.md b/content/rancher/v2.5/en/installation/other-installation-methods/air-gap/install-rancher/_index.md index d97e2266801..78daa4f58a0 100644 --- a/content/rancher/v2.5/en/installation/other-installation-methods/air-gap/install-rancher/_index.md +++ b/content/rancher/v2.5/en/installation/other-installation-methods/air-gap/install-rancher/_index.md @@ -115,7 +115,8 @@ helm template cert-manager ./cert-manager-v1.5.1.tgz --output-dir . \ --namespace cert-manager \ --set image.repository=/quay.io/jetstack/cert-manager-controller \ --set webhook.image.repository=/quay.io/jetstack/cert-manager-webhook \ - --set cainjector.image.repository=/quay.io/jetstack/cert-manager-cainjector + --set cainjector.image.repository=/quay.io/jetstack/cert-manager-cainjector \ + --set startupapicheck.image.repository=/quay.io/jetstack/cert-manager-ctl ``` ### 4. Download the cert-manager CRD From d79ecfd2f60b6b659a48f09965fecbb28784fa25 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 23 Nov 2021 09:37:02 -0500 Subject: [PATCH 053/478] Added clarifying note about CP node setup --- .../en/cluster-provisioning/registered-clusters/_index.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md index 20d4d78ca92..54fee0662cd 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md @@ -152,15 +152,17 @@ To prevent issues when upgrading, the [Kubernetes upgrade best practices](https: _Available as of v2.6.3_ -Authorized Cluster Endpoint (ACE) support has been added for registered RKE2 and K3s clusters. This support includes manual steps you will perform on the downstream cluster to enable the ACE. For additional information on the ACE, click [here]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/ace/). +Authorized Cluster Endpoint (ACE) support has been added for registered RKE2 and K3s clusters. This support includes manual steps you will perform on the downstream cluster to enable the ACE. For additional information on the authorized cluster endpoint, click [here]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/ace/). > **Note:** > +> - These steps only need to be performed on the control plane nodes of the downstream cluster. You must configure each control plane node individually. +> > - The following steps will work on both RKE2 and K3s clusters registered in v2.6.x as well as those registered (or imported) from a previous version of Rancher with an upgrade to v2.6.x. > > - These steps will alter the configuration of the downstream RKE2 and K3s clusters and deploy the `kube-api-authn-webhook`. If a future implementation of ACE requires an update to the `kube-api-authn-webhook`, then this would also have to be done manually. For more information on this webhook, click [here]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/ace/#about-the-kube-api-auth-authentication-webhook). -###### **Manual steps to be taken on the downstream cluster to enable ACE:** +###### **Manual steps to be taken on the control plane of each downstream cluster to enable ACE:** 1. Create a file at `/var/lib/rancher/{rke2,k3s}/kube-api-authn-webhook.yaml` with the following contents: From 50a7292b4e29a6d222cd4065f35508f3b05264e8 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 23 Nov 2021 09:54:21 -0500 Subject: [PATCH 054/478] Updated links --- content/rancher/v2.6/en/overview/architecture/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/overview/architecture/_index.md b/content/rancher/v2.6/en/overview/architecture/_index.md index 62946c0ff6e..3fb4384308e 100644 --- a/content/rancher/v2.6/en/overview/architecture/_index.md +++ b/content/rancher/v2.6/en/overview/architecture/_index.md @@ -20,7 +20,7 @@ This section covers the following topics: - [The authentication proxy](#1-the-authentication-proxy) - [Cluster controllers and cluster agents](#2-cluster-controllers-and-cluster-agents) - [Node agents](#3-node-agents) - - [Authorized cluster endpoint](#4-authorized-cluster-endpoint) + - [Authorized cluster endpoint (ACE)](#4-authorized-cluster-endpoint-ace) - [Important files](#important-files) - [Tools for provisioning Kubernetes clusters](#tools-for-provisioning-kubernetes-clusters) - [Rancher server components and source code](#rancher-server-components-and-source-code) @@ -109,7 +109,7 @@ An authorized cluster endpoint allows users to connect to the Kubernetes API ser > The authorized cluster endpoint only works on Rancher-launched Kubernetes clusters. In other words, it only works in clusters where Rancher [used RKE]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters) to provision the cluster. The ACE is not available for clusters in a hosted Kubernetes provider, such as Amazon's EKS. -> The [ACE is available for registered RKE2 and K3s clusters]({{}}/rancher/v2.6/en/cluster-provisioning/registered-clusters/#ace-support-for-rke2-and-k3s-clusters) as of Rancher v2.6.3. +> The [ACE is available for registered RKE2 and K3s clusters]({{}}/v2.6/en/cluster-provisioning/registered-clusters/#authorized-cluster-endpoint-support-for-rke2-and-k3s-clusters) as of Rancher v2.6.3. There are two main reasons why a user might need the authorized cluster endpoint: From 00a81417d423ac64156322531d53b1bb0a22d324 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 23 Nov 2021 09:58:05 -0500 Subject: [PATCH 055/478] Added acronym, updated link --- .../v2.6/en/overview/architecture-recommendations/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md b/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md index 2b027ab2437..e476540c0b4 100644 --- a/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md +++ b/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md @@ -12,7 +12,7 @@ This section covers the following topics: - [Recommended Load Balancer Configuration for Kubernetes Installations](#recommended-load-balancer-configuration-for-kubernetes-installations) - [Environment for Kubernetes Installations](#environment-for-kubernetes-installations) - [Recommended Node Roles for Kubernetes Installations](#recommended-node-roles-for-kubernetes-installations) -- [Architecture for an Authorized Cluster Endpoint](#architecture-for-an-authorized-cluster-endpoint) +- [Architecture for an Authorized Cluster Endpoint (ACE)](#architecture-for-an-authorized-cluster-endpoint-ace) # Separation of Rancher and User Clusters From 94ab27fcb778ade49a90aa20467b412d03f616ab Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 23 Nov 2021 12:42:10 -0500 Subject: [PATCH 056/478] Updated verbiage per feedback --- content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md index 96cb5d0611a..46850edc2ab 100644 --- a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md +++ b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md @@ -54,7 +54,7 @@ For details on using Fleet behind a proxy, see [this page.](./proxy) 2. Remove the non-existent token secret. Doing so allows for only one entry to be present for the service account token secret that actually exists.
3. Delete the fleet-controller Pod in the fleet-system Namespace to reschedule.
4. After the service account token issue is resolved, you can force redeployment of the fleet-agents. In the Rancher UI, go to **☰ > Cluster Management**, click on **Clusters** page, then click **Force Update**.
- 5. If the fleet-agent bundles remain in a `Modified` state after Step 4, use the command `spec.forceSyncGeneration` for the fleet-agent bundle to force re-creation. + 5. If the fleet-agent bundles remain in a `Modified` state after Step 4, update the field `spec.forceSyncGeneration` for the fleet-agent bundle to force re-creation. --- * **Known Issue:** clientSecretName and helmSecretName secrets for Fleet gitrepos are not included in the backup nor restore created by the [backup-restore-operator]({{}}rancher/v2.5/en/backups/back-up-rancher/#1-install-the-rancher-backup-operator). We will update the community once a permanent solution is in place. From 5e7a3dbe465c6cbd8f9ac71c7f6c15ed492a133c Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Tue, 23 Nov 2021 11:48:58 -0700 Subject: [PATCH 057/478] Document command to get RKE2 server logs --- .../kubernetes-components/controlplane/_index.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/content/rancher/v2.6/en/troubleshooting/kubernetes-components/controlplane/_index.md b/content/rancher/v2.6/en/troubleshooting/kubernetes-components/controlplane/_index.md index 201c6e30aaf..e27339cb8b5 100644 --- a/content/rancher/v2.6/en/troubleshooting/kubernetes-components/controlplane/_index.md +++ b/content/rancher/v2.6/en/troubleshooting/kubernetes-components/controlplane/_index.md @@ -37,4 +37,12 @@ The logging of the containers can contain information on what the problem could docker logs kube-apiserver docker logs kube-controller-manager docker logs kube-scheduler +``` + +# RKE2 Server Logging + +If Rancher provisions an RKE2 cluster that can't communicate with Rancher, you can run this command on a server node in the downstream cluster to get the RKE2 server logs: + +``` +journalctl -u rke2-server -f ``` \ No newline at end of file From f2e8769985781b5c1f220d255ec50d91ad4b8e4b Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Tue, 23 Nov 2021 19:11:13 -0700 Subject: [PATCH 058/478] Document how to capture Rancher API calls with browser tools --- content/rancher/v2.5/en/api/_index.md | 14 ++++++++++++++ content/rancher/v2.6/en/api/_index.md | 14 ++++++++++++++ 2 files changed, 28 insertions(+) diff --git a/content/rancher/v2.5/en/api/_index.md b/content/rancher/v2.5/en/api/_index.md index c6c3fdb63e3..a36f5f9fea2 100644 --- a/content/rancher/v2.5/en/api/_index.md +++ b/content/rancher/v2.5/en/api/_index.md @@ -52,3 +52,17 @@ Most collections can be sorted on the server-side by common fields using HTTP qu ## Pagination API responses are paginated with a limit of 100 resources per page by default. This can be changed with the `limit` query parameter, up to a maximum of 1000, e.g. `/v3/pods?limit=1000`. The `pagination` map in collection responses tells you whether or not you have the full result set and has a link to the next page if you do not. + +## Capturing Rancher API Calls + +You can use browser developer tools to capture how the Rancher API is called. For example, you could follow these steps to use the Chrome developer tools to get the API call for provisioning an RKE cluster: + +1. In the Rancher UI, go to **Cluster Management** and click **Create.** +1. Click one of the cluster types. This example uses Digital Ocean. +1. Fill out the form with a cluster name and node template, but don't click **Create**. +1. You will need to open the developer tools before the cluster creation to see the API call being recorded. To open the tools, right-click on the Rancher UI and click **Inspect.** +1. In the developer tools, click the **Network** tab. +1. On the **Network** tab, make sure **Fetch/XHR** is selected. +1. In the Rancher UI, click **Create**. In the developer tools, you should see a new network request with the name `cluster?_replace=true`. +1. Right-click `cluster?_replace=true` and click **Copy > Copy as cURL.** +1. Paste the result into any text editor. You will be able to see the POST request, including the URL it was sent to, all of the headers, and the full body of the request. This command can be used to create a cluster from the command line. Note: The request should be stored in a safe place because it contains credentials. \ No newline at end of file diff --git a/content/rancher/v2.6/en/api/_index.md b/content/rancher/v2.6/en/api/_index.md index 60cf9320914..a69509ca17b 100644 --- a/content/rancher/v2.6/en/api/_index.md +++ b/content/rancher/v2.6/en/api/_index.md @@ -50,3 +50,17 @@ Most collections can be sorted on the server-side by common fields using HTTP qu ## Pagination API responses are paginated with a limit of 100 resources per page by default. This can be changed with the `limit` query parameter, up to a maximum of 1000, e.g. `/v3/pods?limit=1000`. The `pagination` map in collection responses tells you whether or not you have the full result set and has a link to the next page if you do not. + +## Capturing Rancher API Calls + +You can use browser developer tools to capture how the Rancher API is called. For example, you could follow these steps to use the Chrome developer tools to get the API call for provisioning an RKE cluster: + +1. In the Rancher UI, go to **Cluster Management** and click **Create.** +1. Click one of the cluster types. This example uses Digital Ocean. +1. Fill out the form with a cluster name and node template, but don't click **Create**. +1. You will need to open the developer tools before the cluster creation to see the API call being recorded. To open the tools, right-click on the Rancher UI and click **Inspect.** +1. In the developer tools, click the **Network** tab. +1. On the **Network** tab, make sure **Fetch/XHR** is selected. +1. In the Rancher UI, click **Create**. In the developer tools, you should see a new network request with the name `cluster?_replace=true`. +1. Right-click `cluster?_replace=true` and click **Copy > Copy as cURL.** +1. Paste the result into any text editor. You will be able to see the POST request, including the URL it was sent to, all of the headers, and the full body of the request. This command can be used to create a cluster from the command line. Note: The request should be stored in a safe place because it contains credentials. \ No newline at end of file From ab24a95b5c65f1651f9c2f98d3564e3374c4509b Mon Sep 17 00:00:00 2001 From: Frank Klaassen <639906+syphernl@users.noreply.github.com> Date: Wed, 24 Nov 2021 16:25:11 +0100 Subject: [PATCH 059/478] Quickstart: Add HCloud --- .../en/quick-start-guide/deployment/_index.md | 2 + .../deployment/hetzner-cloud-qs/_index.md | 65 +++++++++++++++++++ 2 files changed, 67 insertions(+) create mode 100644 content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/_index.md index f7d4da476aa..b3169225fe4 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/_index.md @@ -9,8 +9,10 @@ Use one of the following guides to deploy and provision Rancher and a Kubernetes - [AWS](./amazon-aws-qs) (uses Terraform) - [Azure](./microsoft-azure-qs) (uses Terraform) - [GCP](./google-gcp-qs) (uses Terraform) +- [Hetzner Cloud](./hetzner-cloud-qs) (uses Terraform) - [Vagrant](./quickstart-vagrant) + If you prefer, the following guide will take you through the same process in individual steps. Use this if you want to run Rancher in a different provider, on prem, or if you would just like to see how easy it is. - [Manual Install](./quickstart-manual-setup) diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md new file mode 100644 index 00000000000..51d0f9331a7 --- /dev/null +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md @@ -0,0 +1,65 @@ +--- +title: Rancher Hetzner Cloud Quick Start Guide +description: Read this step by step Rancher Hetzner Cloud guide to quickly deploy a Rancher Server with a single node cluster attached. +weight: 100 +--- +The following steps will quickly deploy a Rancher Server on Hetzner Cloud with a single node cluster attached. + +## Prerequisites + +>**Note** +>Deploying to Hetzner Cloud will incur charges. + +- [Hetzner Cloud Account](https://www.hetzner.com): You will require an account on Hetzner as this is where the server and cluster will run. +- [Hetzner API Access Key](https://docs.hetzner.cloud/#getting-started): Use these instructions to create a Hetzner Cloud API Key if you don't have one. +- [Terraform](https://www.terraform.io/downloads.html): Used to provision the server and cluster to Hetzner. + + +## Getting Started + +1. Clone [Rancher Quickstart](https://github.com/rancher/quickstart) to a folder using `git clone https://github.com/rancher/quickstart`. + +1. Go into the Hetzner folder containing the terraform files by executing `cd quickstart/hcloud`. + +1. Rename the `terraform.tfvars.example` file to `terraform.tfvars`. + +1. Edit `terraform.tfvars` and customize the following variables: + - `hcloud_token` - Hetzner API access key + - `rancher_server_admin_password` - Admin password for created Rancher server + +1. **Optional:** Modify optional variables within `terraform.tfvars`. +See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Hetzner Quickstart Readme](https://github.com/rancher/quickstart/tree/master/hcloud) for more information. +Suggestions include: + - `prefix` - Prefix for all created resources + - `instance_type` - Instance type, minimum required is `cx22` as `cx11` offers not enough memory. + - `ssh_key_file_name` - Use a specific SSH key instead of `~/.ssh/id_rsa` (public key is assumed to be `${ssh_key_file_name}.pub`) + +1. Run `terraform init`. + +2. To initiate the creation of the environment, run `terraform apply --auto-approve`. Then wait for output similar to the following: + + ``` + Apply complete! Resources: 15 added, 0 changed, 0 destroyed. + + Outputs: + + rancher_node_ip = xx.xx.xx.xx + rancher_server_url = https://rancher.xx.xx.xx.xx.xip.io + workload_node_ip = yy.yy.yy.yy + ``` + +3. Paste the `rancher_server_url` from the output above into the browser. Log in when prompted (default username is `admin`, use the password set in `rancher_server_admin_password`). + +#### Result + +Two Kubernetes clusters are deployed into your Hetzner account, one running Rancher Server and the other ready for experimentation deployments. + +### What's Next? + +Use Rancher to create a deployment. For more information, see [Creating Deployments]({{}}/rancher/v2.6/en/quick-start-guide/workload). + +## Destroying the Environment + +1. From the `quickstart/hcloud` folder, execute `terraform destroy --auto-approve`. + +2. Wait for confirmation that all resources have been destroyed. From f40f06ab425eba0280d2fefa166e9b0616bc2d4a Mon Sep 17 00:00:00 2001 From: Jen Travinski Date: Wed, 24 Nov 2021 14:38:22 -0500 Subject: [PATCH 060/478] Update content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md Co-authored-by: Billy Tat --- content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md index 46850edc2ab..61de588ea67 100644 --- a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md +++ b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md @@ -50,7 +50,7 @@ For details on using Fleet behind a proxy, see [this page.](./proxy) * **Known Issue:** Fleet becomes inoperable after a restore using the [backup-restore-operator]({{}}rancher/v2.5/en/backups/back-up-rancher/#1-install-the-rancher-backup-operator). We will update the community once a permanent solution is in place. * **Temporary Workaround:**
- 1. Find the two service account tokens listed in the fleet-controller and the fleet-controller-bootstrap service accounts. These are under the fleet-system Namespace of the local cluster.
+ 1. Find the two service account tokens listed in the fleet-controller and the fleet-controller-bootstrap service accounts. These are under the fleet-system namespace of the local cluster.
2. Remove the non-existent token secret. Doing so allows for only one entry to be present for the service account token secret that actually exists.
3. Delete the fleet-controller Pod in the fleet-system Namespace to reschedule.
4. After the service account token issue is resolved, you can force redeployment of the fleet-agents. In the Rancher UI, go to **☰ > Cluster Management**, click on **Clusters** page, then click **Force Update**.
From 2631858face9a66ee1bfbef34451c56c8d28be97 Mon Sep 17 00:00:00 2001 From: Jen Travinski Date: Wed, 24 Nov 2021 14:39:14 -0500 Subject: [PATCH 061/478] Update content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md Co-authored-by: Billy Tat --- content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md index 61de588ea67..340c2de633b 100644 --- a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md +++ b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md @@ -52,7 +52,7 @@ For details on using Fleet behind a proxy, see [this page.](./proxy) * **Temporary Workaround:**
1. Find the two service account tokens listed in the fleet-controller and the fleet-controller-bootstrap service accounts. These are under the fleet-system namespace of the local cluster.
2. Remove the non-existent token secret. Doing so allows for only one entry to be present for the service account token secret that actually exists.
- 3. Delete the fleet-controller Pod in the fleet-system Namespace to reschedule.
+ 3. Delete the fleet-controller Pod in the fleet-system namespace to reschedule.
4. After the service account token issue is resolved, you can force redeployment of the fleet-agents. In the Rancher UI, go to **☰ > Cluster Management**, click on **Clusters** page, then click **Force Update**.
5. If the fleet-agent bundles remain in a `Modified` state after Step 4, update the field `spec.forceSyncGeneration` for the fleet-agent bundle to force re-creation. From b977637416e981bcbebdb87555890933882ba8bb Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 29 Nov 2021 18:09:57 -0500 Subject: [PATCH 062/478] Added section for Helm chart dependencies in Fleet for 2.5, 2.6 --- .../rancher/v2.5/en/deploy-across-clusters/fleet/_index.md | 7 +++++++ .../rancher/v2.6/en/deploy-across-clusters/fleet/_index.md | 7 +++++++ 2 files changed, 14 insertions(+) diff --git a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md index 340c2de633b..e747114dfed 100644 --- a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md +++ b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md @@ -16,6 +16,7 @@ Fleet is a separate project from Rancher, and can be installed on any Kubernetes - [Windows Support](#windows-support) - [GitHub Repository](#github-repository) - [Using Fleet Behind a Proxy](#using-fleet-behind-a-proxy) +- [Fleet Helm Chart Dependencies](#fleet-helm-chart-dependencies) - [Troubleshooting](#troubleshooting) - [Documentation](#documentation) @@ -45,6 +46,12 @@ _Available as of v2.5.8_ For details on using Fleet behind a proxy, see [this page.](./proxy) +# Fleet Helm Chart Dependencies + +In order for the Helm chart dependencies in Fleet to deploy successfully, you must run a manual command (as listed below) to let Fleet know where to retrieve them. If you do not do this and proceed to clone your repository and run `helm install`, your installation will fail because the dependencies will be missing. + +The Helm chart in the git repository must include its dependencies in the charts subdirectory. You must either manually run `helm dependencies update` OR run `helm dependencies build` locally, then commit the complete charts directory to your git repository. + # Troubleshooting --- * **Known Issue:** Fleet becomes inoperable after a restore using the [backup-restore-operator]({{}}rancher/v2.5/en/backups/back-up-rancher/#1-install-the-rancher-backup-operator). We will update the community once a permanent solution is in place. diff --git a/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md b/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md index c59ee4dbbd1..b9077d5ebf3 100644 --- a/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md +++ b/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md @@ -12,6 +12,7 @@ Fleet is a separate project from Rancher, and can be installed on any Kubernetes - [Windows Support](#windows-support) - [GitHub Repository](#github-repository) - [Using Fleet Behind a Proxy](#using-fleet-behind-a-proxy) +- [Fleet Helm Chart Dependencies](#fleet-helm-chart-dependencies) - [Troubleshooting](#troubleshooting) - [Documentation](#documentation) @@ -37,6 +38,12 @@ The Fleet Helm charts are available [here.](https://github.com/rancher/fleet/rel For details on using Fleet behind a proxy, see [this page.](./proxy) +# Fleet Helm Chart Dependencies + +In order for the Helm chart dependencies in Fleet to deploy successfully, you must run a manual command (as listed below) to let Fleet know where to retrieve them. If you do not do this and proceed to clone your repository and run `helm install`, your installation will fail because the dependencies will be missing. + +The Helm chart in the git repository must include its dependencies in the charts subdirectory. You must either manually run `helm dependencies update` OR run `helm dependencies build` locally, then commit the complete charts directory to your git repository. + # Troubleshooting --- From 528f80c9fc9ba72863a0c476cc33dccdee5f51d0 Mon Sep 17 00:00:00 2001 From: Flowbird-Joel-Harley <53900583+Flowbird-Joel-Harley@users.noreply.github.com> Date: Tue, 30 Nov 2021 15:17:12 +0000 Subject: [PATCH 063/478] Update _index.md Minor spelling correction from "... because is is installed by default." to "... because it is installed by default". --- content/rancher/v2.5/en/installation/requirements/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/installation/requirements/_index.md b/content/rancher/v2.5/en/installation/requirements/_index.md index 77d8abc2244..5d4113fc217 100644 --- a/content/rancher/v2.5/en/installation/requirements/_index.md +++ b/content/rancher/v2.5/en/installation/requirements/_index.md @@ -176,7 +176,7 @@ Each node in the Kubernetes cluster that Rancher is installed on should run an I The Ingress should be deployed as DaemonSet to ensure your load balancer can successfully route traffic to all nodes. -For RKE, K3s and RancherD installations, you don't have to install the Ingress manually because is is installed by default. +For RKE, K3s and RancherD installations, you don't have to install the Ingress manually because it is installed by default. For hosted Kubernetes clusters (EKS, GKE, AKS) and RKE2 Kubernetes installations, you will need to set up the ingress. From 308d0f3d9158f70a8b126abcf699105e92b29c60 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 30 Nov 2021 10:39:35 -0500 Subject: [PATCH 064/478] Added typo fix for 2.6 --- content/rancher/v2.6/en/installation/requirements/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/requirements/_index.md b/content/rancher/v2.6/en/installation/requirements/_index.md index 9f1c959f73b..0fd9eaa5669 100644 --- a/content/rancher/v2.6/en/installation/requirements/_index.md +++ b/content/rancher/v2.6/en/installation/requirements/_index.md @@ -151,7 +151,7 @@ Each node in the Kubernetes cluster that Rancher is installed on should run an I The Ingress should be deployed as DaemonSet to ensure your load balancer can successfully route traffic to all nodes. -For RKE and K3s installations, you don't have to install the Ingress manually because is is installed by default. +For RKE and K3s installations, you don't have to install the Ingress manually because it is installed by default. For hosted Kubernetes clusters (EKS, GKE, AKS) and RKE2 Kubernetes installations, you will need to set up the ingress. From 91b8fab0edce971552fb741c1a7578c6e7550457 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 30 Nov 2021 11:39:45 -0500 Subject: [PATCH 065/478] Updated per feedback --- .../v2.5/en/deploy-across-clusters/fleet/_index.md | 8 ++++---- .../v2.6/en/deploy-across-clusters/fleet/_index.md | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md index e747114dfed..303f2071bf2 100644 --- a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md +++ b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md @@ -16,7 +16,7 @@ Fleet is a separate project from Rancher, and can be installed on any Kubernetes - [Windows Support](#windows-support) - [GitHub Repository](#github-repository) - [Using Fleet Behind a Proxy](#using-fleet-behind-a-proxy) -- [Fleet Helm Chart Dependencies](#fleet-helm-chart-dependencies) +- [Helm Chart Dependencies](#helm-chart-dependencies) - [Troubleshooting](#troubleshooting) - [Documentation](#documentation) @@ -46,11 +46,11 @@ _Available as of v2.5.8_ For details on using Fleet behind a proxy, see [this page.](./proxy) -# Fleet Helm Chart Dependencies +# Helm Chart Dependencies -In order for the Helm chart dependencies in Fleet to deploy successfully, you must run a manual command (as listed below) to let Fleet know where to retrieve them. If you do not do this and proceed to clone your repository and run `helm install`, your installation will fail because the dependencies will be missing. +In order for Helm charts with dependencies to deploy successfully, you must run a manual command (as listed below), as it is up to the user to fulfill the dependency list. If you do not do this and proceed to clone your repository and run `helm install`, your installation will fail because the dependencies will be missing. -The Helm chart in the git repository must include its dependencies in the charts subdirectory. You must either manually run `helm dependencies update` OR run `helm dependencies build` locally, then commit the complete charts directory to your git repository. +The Helm chart in the git repository must include its dependencies in the charts subdirectory. You must either manually run `helm dependencies update $chart` OR run `helm dependencies build $chart` locally, then commit the complete charts directory to your git repository. Note that you will update your commands with the applicable parameters. # Troubleshooting --- diff --git a/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md b/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md index b9077d5ebf3..f0e80bbb598 100644 --- a/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md +++ b/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md @@ -12,7 +12,7 @@ Fleet is a separate project from Rancher, and can be installed on any Kubernetes - [Windows Support](#windows-support) - [GitHub Repository](#github-repository) - [Using Fleet Behind a Proxy](#using-fleet-behind-a-proxy) -- [Fleet Helm Chart Dependencies](#fleet-helm-chart-dependencies) +- [Helm Chart Dependencies](#helm-chart-dependencies) - [Troubleshooting](#troubleshooting) - [Documentation](#documentation) @@ -38,11 +38,11 @@ The Fleet Helm charts are available [here.](https://github.com/rancher/fleet/rel For details on using Fleet behind a proxy, see [this page.](./proxy) -# Fleet Helm Chart Dependencies +# Helm Chart Dependencies -In order for the Helm chart dependencies in Fleet to deploy successfully, you must run a manual command (as listed below) to let Fleet know where to retrieve them. If you do not do this and proceed to clone your repository and run `helm install`, your installation will fail because the dependencies will be missing. +In order for Helm charts with dependencies to deploy successfully, you must run a manual command (as listed below), as it is up to the user to fulfill the dependency list. If you do not do this and proceed to clone your repository and run `helm install`, your installation will fail because the dependencies will be missing. -The Helm chart in the git repository must include its dependencies in the charts subdirectory. You must either manually run `helm dependencies update` OR run `helm dependencies build` locally, then commit the complete charts directory to your git repository. +The Helm chart in the git repository must include its dependencies in the charts subdirectory. You must either manually run `helm dependencies update $chart` OR run `helm dependencies build $chart` locally, then commit the complete charts directory to your git repository. Note that you will update your commands with the applicable parameters. # Troubleshooting From 30f542db8b7d6ccd4759cc5e6f4773dc82ea4fb1 Mon Sep 17 00:00:00 2001 From: rancher-max Date: Thu, 2 Dec 2021 15:10:05 -0700 Subject: [PATCH 066/478] Add newly available etcd-arg --- .../en/installation/install-options/server-config/_index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/k3s/latest/en/installation/install-options/server-config/_index.md b/content/k3s/latest/en/installation/install-options/server-config/_index.md index 687133583d8..853d2ccb491 100644 --- a/content/k3s/latest/en/installation/install-options/server-config/_index.md +++ b/content/k3s/latest/en/installation/install-options/server-config/_index.md @@ -152,6 +152,7 @@ the agent options are there because the server has the agent process embedded wi | Flag | Description | |------|--------------| +| `--etcd-arg` value | Customized flag for etcd process | | `--kube-apiserver-arg` value | Customized flag for kube-apiserver process | | `--kube-scheduler-arg` value | Customized flag for kube-scheduler process | | `--kube-controller-manager-arg` value | Customized flag for kube-controller-manager process | @@ -234,6 +235,7 @@ OPTIONS: --token-file value (cluster) File containing the cluster-secret/token [$K3S_TOKEN_FILE] --write-kubeconfig value, -o value (client) Write kubeconfig for admin client to this file [$K3S_KUBECONFIG_OUTPUT] --write-kubeconfig-mode value (client) Write kubeconfig with this mode [$K3S_KUBECONFIG_MODE] + --etcd-arg value (flags) Customized flag for etcd process --kube-apiserver-arg value (flags) Customized flag for kube-apiserver process --kube-scheduler-arg value (flags) Customized flag for kube-scheduler process --kube-controller-manager-arg value (flags) Customized flag for kube-controller-manager process From 1fdc61b1e96d4d1c3ff368b3f2b9b4617fe8fdbd Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 2 Dec 2021 16:13:31 -0800 Subject: [PATCH 067/478] Update links from v2.x to v2.0-v2.4 --- .../en/backups/restore/rke-restore/v2.0-v2.1/_index.md | 2 +- .../rancher/v2.0-v2.4/en/helm-charts/creating-apps/_index.md | 2 +- .../v2.0-v2.4/en/installation/resources/tls-secrets/_index.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/content/rancher/v2.0-v2.4/en/backups/restore/rke-restore/v2.0-v2.1/_index.md b/content/rancher/v2.0-v2.4/en/backups/restore/rke-restore/v2.0-v2.1/_index.md index b7026acc4a4..bfc20ae2b48 100644 --- a/content/rancher/v2.0-v2.4/en/backups/restore/rke-restore/v2.0-v2.1/_index.md +++ b/content/rancher/v2.0-v2.4/en/backups/restore/rke-restore/v2.0-v2.1/_index.md @@ -28,7 +28,7 @@ Because of the changes necessary to address [CVE-2018-20321](https://cve.mitre.o 2. After executing the command a `tokens.json` file will be created. Important! Back up this file in a safe place.** You will need it to restore functionality to your clusters after rolling back Rancher. **If you lose this file, you may lose access to your clusters.** -3. Rollback Rancher following the [normal instructions]({{}}/rancher/v2.x/en/upgrades/rollbacks/). +3. Rollback Rancher following the [normal instructions]({{}}/rancher/v2.0-v2.4/en/upgrades/rollbacks/). 4. Once Rancher comes back up, every cluster managed by Rancher (except for Imported clusters) will be in an `Unavailable` state. diff --git a/content/rancher/v2.0-v2.4/en/helm-charts/creating-apps/_index.md b/content/rancher/v2.0-v2.4/en/helm-charts/creating-apps/_index.md index a0928f9373a..73d1f6efe48 100644 --- a/content/rancher/v2.0-v2.4/en/helm-charts/creating-apps/_index.md +++ b/content/rancher/v2.0-v2.4/en/helm-charts/creating-apps/_index.md @@ -128,4 +128,4 @@ This reference contains variables that you can use in `questions.yml` nested und # Tutorial: Example Custom Chart Creation -For a tutorial on adding a custom Helm chart to a custom catalog, refer to [this page.]({{}}/rancher/v2.x/en/catalog/tutorial) +For a tutorial on adding a custom Helm chart to a custom catalog, refer to [this page.]({{}}/rancher/v2.0-v2.4/en/catalog/tutorial) diff --git a/content/rancher/v2.0-v2.4/en/installation/resources/tls-secrets/_index.md b/content/rancher/v2.0-v2.4/en/installation/resources/tls-secrets/_index.md index 40f9c5294d2..3c32084c5e6 100644 --- a/content/rancher/v2.0-v2.4/en/installation/resources/tls-secrets/_index.md +++ b/content/rancher/v2.0-v2.4/en/installation/resources/tls-secrets/_index.md @@ -35,4 +35,4 @@ kubectl -n cattle-system create secret generic tls-ca \ # Updating a Private CA Certificate -Follow the steps on [this page]({{}}/rancher/v2.x/en/installation/resources/update-ca-cert) to update the SSL certificate of the ingress in a Rancher [high availability Kubernetes installation]({{}}/rancher/v2.0-v2.4/en/installation/install-rancher-on-k8s/) or to switch from the default self-signed certificate to a custom certificate. \ No newline at end of file +Follow the steps on [this page]({{}}/rancher/v2.0-v2.4/en/installation/resources/update-ca-cert) to update the SSL certificate of the ingress in a Rancher [high availability Kubernetes installation]({{}}/rancher/v2.0-v2.4/en/installation/install-rancher-on-k8s/) or to switch from the default self-signed certificate to a custom certificate. \ No newline at end of file From 1421e778df1927dc15f2ad876ebf8bce00c29fd0 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 2 Dec 2021 16:15:35 -0800 Subject: [PATCH 068/478] Update links from v2.x to v2.5 --- .../editing-clusters/eks-config-reference/_index.md | 4 ++-- .../gke-config-reference/private-clusters/_index.md | 2 +- content/rancher/v2.5/en/cluster-admin/nodes/_index.md | 10 +++++----- .../rke-clusters/options/_index.md | 2 +- .../resources/k8s-tutorials/ha-rke2/_index.md | 2 +- .../infra-for-rke2-ha/_index.md | 10 +++++----- .../en/installation/resources/tls-secrets/_index.md | 2 +- 7 files changed, 16 insertions(+), 16 deletions(-) diff --git a/content/rancher/v2.5/en/cluster-admin/editing-clusters/eks-config-reference/_index.md b/content/rancher/v2.5/en/cluster-admin/editing-clusters/eks-config-reference/_index.md index bb4e31086c1..0ea3ab8ad80 100644 --- a/content/rancher/v2.5/en/cluster-admin/editing-clusters/eks-config-reference/_index.md +++ b/content/rancher/v2.5/en/cluster-admin/editing-clusters/eks-config-reference/_index.md @@ -16,7 +16,7 @@ Complete each drop-down and field using the information obtained for your IAM po | Setting | Description | | ---------- | -------------------------------------------------------------------------------------------------------------------- | | Region | From the drop-down choose the geographical region in which to build your cluster. | -| Cloud Credentials | Select the cloud credentials that you created for your IAM policy. For more information on creating cloud credentials in Rancher, refer to [this page.]({{}}/rancher/v2.x/en/user-settings/cloud-credentials/) | +| Cloud Credentials | Select the cloud credentials that you created for your IAM policy. For more information on creating cloud credentials in Rancher, refer to [this page.]({{}}/rancher/v2.5/en/user-settings/cloud-credentials/) | ### Service Role @@ -186,7 +186,7 @@ Complete each drop-down and field using the information obtained for your IAM po | Setting | Description | | ---------- | -------------------------------------------------------------------------------------------------------------------- | | Region | From the drop-down choose the geographical region in which to build your cluster. | -| Cloud Credentials | Select the cloud credentials that you created for your IAM policy. For more information on creating cloud credentials in Rancher, refer to [this page.]({{}}/rancher/v2.x/en/user-settings/cloud-credentials/) | +| Cloud Credentials | Select the cloud credentials that you created for your IAM policy. For more information on creating cloud credentials in Rancher, refer to [this page.]({{}}/rancher/v2.5/en/user-settings/cloud-credentials/) | ### Service Role diff --git a/content/rancher/v2.5/en/cluster-admin/editing-clusters/gke-config-reference/private-clusters/_index.md b/content/rancher/v2.5/en/cluster-admin/editing-clusters/gke-config-reference/private-clusters/_index.md index d66fdb087bd..9de7dbf3c1d 100644 --- a/content/rancher/v2.5/en/cluster-admin/editing-clusters/gke-config-reference/private-clusters/_index.md +++ b/content/rancher/v2.5/en/cluster-admin/editing-clusters/gke-config-reference/private-clusters/_index.md @@ -25,7 +25,7 @@ If restricting outgoing internet access is not a concern for your organization, >**Note** >This scenario is not officially supported, but is described for cases in which using the Cloud NAT service is not sufficient. -If restricting both incoming and outgoing traffic to nodes is a requirement, follow the air-gapped installation instructions to set up a private container image [registry](https://rancher.com/docs/rancher/v2.x/en/installation/other-installation-methods/air-gap/) on the VPC where the cluster is going to be, allowing the cluster nodes to access and download the images they need to run the cluster agent. If the control plane endpoint is also private, Rancher will need [direct access](#direct-access) to it. +If restricting both incoming and outgoing traffic to nodes is a requirement, follow the air-gapped installation instructions to set up a private container image [registry](https://rancher.com/docs/rancher/v2.5/en/installation/other-installation-methods/air-gap/) on the VPC where the cluster is going to be, allowing the cluster nodes to access and download the images they need to run the cluster agent. If the control plane endpoint is also private, Rancher will need [direct access](#direct-access) to it. ### Private Control Plane Endpoint diff --git a/content/rancher/v2.5/en/cluster-admin/nodes/_index.md b/content/rancher/v2.5/en/cluster-admin/nodes/_index.md index 514ebc67a18..af48e6fa950 100644 --- a/content/rancher/v2.5/en/cluster-admin/nodes/_index.md +++ b/content/rancher/v2.5/en/cluster-admin/nodes/_index.md @@ -42,11 +42,11 @@ The following table lists which node options are available for each type of clus | [Download Keys](#ssh-into-a-node-hosted-by-an-infrastructure-provider) | ✓ | | | | | Download SSH key in order to SSH into the node. | | [Node Scaling](#scaling-nodes) | ✓ | | | ✓ | | Scale the number of nodes in the node pool up or down. | -[1]: {{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ -[2]: {{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/ -[3]: {{}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/ -[4]: {{}}/rancher/v2.x/en/cluster-provisioning/registered-clusters/ -[5]: {{}}/rancher/v2.x/en/cluster-provisioning/registered-clusters/ +[1]: {{}}/rancher/v2.5/en/cluster-provisioning/rke-clusters/node-pools/ +[2]: {{}}/rancher/v2.5/en/cluster-provisioning/rke-clusters/custom-nodes/ +[3]: {{}}/rancher/v2.5/en/cluster-provisioning/hosted-kubernetes-clusters/ +[4]: {{}}/rancher/v2.5/en/cluster-provisioning/registered-clusters/ +[5]: {{}}/rancher/v2.5/en/cluster-provisioning/registered-clusters/ \* Delete option accessible via View API diff --git a/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/options/_index.md b/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/options/_index.md index 662af99a33d..63b3bfddcbd 100644 --- a/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/options/_index.md +++ b/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/options/_index.md @@ -158,7 +158,7 @@ Option to enable or disable [recurring etcd snapshots]({{}}/rke/latest/ _Available as of v2.5.6_ -Option to set environment variables for [rancher agents]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/rancher-agents/). The environment variables can be set using key value pairs. If rancher agent requires use of proxy to communicate with Rancher server, `HTTP_PROXY`, `HTTPS_PROXY` and `NO_PROXY` environment variables can be set using agent environment variables. +Option to set environment variables for [rancher agents]({{}}/rancher/v2.5/en/cluster-provisioning/rke-clusters/rancher-agents/). The environment variables can be set using key value pairs. If rancher agent requires use of proxy to communicate with Rancher server, `HTTP_PROXY`, `HTTPS_PROXY` and `NO_PROXY` environment variables can be set using agent environment variables. # Cluster Config File diff --git a/content/rancher/v2.5/en/installation/resources/k8s-tutorials/ha-rke2/_index.md b/content/rancher/v2.5/en/installation/resources/k8s-tutorials/ha-rke2/_index.md index 64d7472dbdd..788a80c1e4a 100644 --- a/content/rancher/v2.5/en/installation/resources/k8s-tutorials/ha-rke2/_index.md +++ b/content/rancher/v2.5/en/installation/resources/k8s-tutorials/ha-rke2/_index.md @@ -8,7 +8,7 @@ aliases: --- _Tested on v2.5.6_ -This section describes how to install a Kubernetes cluster according to the [best practices for the Rancher server environment.]({{}}/rancher/v2.x/en/overview/architecture-recommendations/#environment-for-kubernetes-installations) +This section describes how to install a Kubernetes cluster according to the [best practices for the Rancher server environment.]({{}}/rancher/v2.5/en/overview/architecture-recommendations/#environment-for-kubernetes-installations) # Prerequisites diff --git a/content/rancher/v2.5/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-rke2-ha/_index.md b/content/rancher/v2.5/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-rke2-ha/_index.md index ac26cf28e2a..0f4d80d55c1 100644 --- a/content/rancher/v2.5/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-rke2-ha/_index.md +++ b/content/rancher/v2.5/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-rke2-ha/_index.md @@ -19,9 +19,9 @@ To install the Rancher management server on a high-availability RKE2 cluster, we ### 1. Set up Linux Nodes -Make sure that your nodes fulfill the general installation requirements for [OS, container runtime, hardware, and networking.]({{}}/rancher/v2.x/en/installation/requirements/) +Make sure that your nodes fulfill the general installation requirements for [OS, container runtime, hardware, and networking.]({{}}/rancher/v2.5/en/installation/requirements/) -For an example of one way to set up Linux nodes, refer to this [tutorial]({{}}/rancher/v2.x/en/installation/options/ec2-node) for setting up nodes as instances in Amazon EC2. +For an example of one way to set up Linux nodes, refer to this [tutorial]({{}}/rancher/v2.5/en/installation/options/ec2-node) for setting up nodes as instances in Amazon EC2. ### 2. Set up the Load Balancer @@ -34,11 +34,11 @@ When Rancher is installed (also in a later step), the Rancher system creates an For your implementation, consider if you want or need to use a Layer-4 or Layer-7 load balancer: - **A layer-4 load balancer** is the simpler of the two choices, in which you are forwarding TCP traffic to your nodes. We recommend configuring your load balancer as a Layer 4 balancer, forwarding traffic to ports TCP/80 and TCP/443 to the Rancher management cluster nodes. The Ingress controller on the cluster will redirect HTTP traffic to HTTPS and terminate SSL/TLS on port TCP/443. The Ingress controller will forward traffic to port TCP/80 to the Ingress pod in the Rancher deployment. -- **A layer-7 load balancer** is a bit more complicated but can offer features that you may want. For instance, a layer-7 load balancer is capable of handling TLS termination at the load balancer, as opposed to Rancher doing TLS termination itself. This can be beneficial if you want to centralize your TLS termination in your infrastructure. Layer-7 load balancing also offers the capability for your load balancer to make decisions based on HTTP attributes such as cookies, etc. that a layer-4 load balancer is not able to concern itself with. If you decide to terminate the SSL/TLS traffic on a layer-7 load balancer, you will need to use the `--set tls=external` option when installing Rancher in a later step. For more information, refer to the [Rancher Helm chart options.]({{}}/rancher/v2.x/en/installation/options/chart-options/#external-tls-termination) +- **A layer-7 load balancer** is a bit more complicated but can offer features that you may want. For instance, a layer-7 load balancer is capable of handling TLS termination at the load balancer, as opposed to Rancher doing TLS termination itself. This can be beneficial if you want to centralize your TLS termination in your infrastructure. Layer-7 load balancing also offers the capability for your load balancer to make decisions based on HTTP attributes such as cookies, etc. that a layer-4 load balancer is not able to concern itself with. If you decide to terminate the SSL/TLS traffic on a layer-7 load balancer, you will need to use the `--set tls=external` option when installing Rancher in a later step. For more information, refer to the [Rancher Helm chart options.]({{}}/rancher/v2.5/en/installation/options/chart-options/#external-tls-termination) -For an example showing how to set up an NGINX load balancer, refer to [this page.]({{}}/rancher/v2.x/en/installation/options/nginx/) +For an example showing how to set up an NGINX load balancer, refer to [this page.]({{}}/rancher/v2.5/en/installation/options/nginx/) -For a how-to guide for setting up an Amazon ELB Network Load Balancer, refer to [this page.]({{}}/rancher/v2.x/en/installation/options/nlb/) +For a how-to guide for setting up an Amazon ELB Network Load Balancer, refer to [this page.]({{}}/rancher/v2.5/en/installation/options/nlb/) > **Important:** > Do not use this load balancer (i.e, the `local` cluster Ingress) to load balance applications other than Rancher following installation. Sharing this Ingress with other applications may result in websocket errors to Rancher following Ingress configuration reloads for other apps. We recommend dedicating the `local` cluster to Rancher and no other applications. diff --git a/content/rancher/v2.5/en/installation/resources/tls-secrets/_index.md b/content/rancher/v2.5/en/installation/resources/tls-secrets/_index.md index 850856ff865..9878109b8b6 100644 --- a/content/rancher/v2.5/en/installation/resources/tls-secrets/_index.md +++ b/content/rancher/v2.5/en/installation/resources/tls-secrets/_index.md @@ -38,4 +38,4 @@ kubectl -n cattle-system create secret generic tls-ca \ # Updating a Private CA Certificate -Follow the steps on [this page]({{}}/rancher/v2.x/en/installation/resources/update-ca-cert) to update the SSL certificate of the ingress in a Rancher [high availability Kubernetes installation]({{}}/rancher/v2.5/en/installation/install-rancher-on-k8s/) or to switch from the default self-signed certificate to a custom certificate. \ No newline at end of file +Follow the steps on [this page]({{}}/rancher/v2.5/en/installation/resources/update-ca-cert) to update the SSL certificate of the ingress in a Rancher [high availability Kubernetes installation]({{}}/rancher/v2.5/en/installation/install-rancher-on-k8s/) or to switch from the default self-signed certificate to a custom certificate. \ No newline at end of file From cca5ebc7b44d9a43de8fc4d24c40aa8a0db5f771 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 2 Dec 2021 16:17:44 -0800 Subject: [PATCH 069/478] Update links from v2.x to v2.6 --- .../editing-clusters/eks-config-reference/_index.md | 2 +- .../gke-config-reference/private-clusters/_index.md | 2 +- .../editing-clusters/rke-config-reference/_index.md | 2 +- content/rancher/v2.6/en/cluster-admin/nodes/_index.md | 10 +++++----- .../resources/k8s-tutorials/ha-rke2/_index.md | 2 +- .../infra-for-rke2-ha/_index.md | 8 ++++---- .../en/installation/resources/tls-secrets/_index.md | 2 +- 7 files changed, 14 insertions(+), 14 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-admin/editing-clusters/eks-config-reference/_index.md b/content/rancher/v2.6/en/cluster-admin/editing-clusters/eks-config-reference/_index.md index 67d3e46d94f..4eec75f21f7 100644 --- a/content/rancher/v2.6/en/cluster-admin/editing-clusters/eks-config-reference/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/editing-clusters/eks-config-reference/_index.md @@ -11,7 +11,7 @@ Complete each drop-down and field using the information obtained for your IAM po | Setting | Description | | ---------- | -------------------------------------------------------------------------------------------------------------------- | | Region | From the drop-down choose the geographical region in which to build your cluster. | -| Cloud Credentials | Select the cloud credentials that you created for your IAM policy. For more information on creating cloud credentials in Rancher, refer to [this page.]({{}}/rancher/v2.x/en/user-settings/cloud-credentials/) | +| Cloud Credentials | Select the cloud credentials that you created for your IAM policy. For more information on creating cloud credentials in Rancher, refer to [this page.]({{}}/rancher/v2.6/en/user-settings/cloud-credentials/) | ### Service Role diff --git a/content/rancher/v2.6/en/cluster-admin/editing-clusters/gke-config-reference/private-clusters/_index.md b/content/rancher/v2.6/en/cluster-admin/editing-clusters/gke-config-reference/private-clusters/_index.md index cf3b3963f05..95d9bd39bcc 100644 --- a/content/rancher/v2.6/en/cluster-admin/editing-clusters/gke-config-reference/private-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/editing-clusters/gke-config-reference/private-clusters/_index.md @@ -21,7 +21,7 @@ If restricting outgoing internet access is not a concern for your organization, >**Note** >This scenario is not officially supported, but is described for cases in which using the Cloud NAT service is not sufficient. -If restricting both incoming and outgoing traffic to nodes is a requirement, follow the air-gapped installation instructions to set up a private container image [registry](https://rancher.com/docs/rancher/v2.x/en/installation/other-installation-methods/air-gap/) on the VPC where the cluster is going to be, allowing the cluster nodes to access and download the images they need to run the cluster agent. If the control plane endpoint is also private, Rancher will need [direct access](#direct-access) to it. +If restricting both incoming and outgoing traffic to nodes is a requirement, follow the air-gapped installation instructions to set up a private container image [registry](https://rancher.com/docs/rancher/v2.6/en/installation/other-installation-methods/air-gap/) on the VPC where the cluster is going to be, allowing the cluster nodes to access and download the images they need to run the cluster agent. If the control plane endpoint is also private, Rancher will need [direct access](#direct-access) to it. ### Private Control Plane Endpoint diff --git a/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke-config-reference/_index.md b/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke-config-reference/_index.md index 2b530a8db5e..0f0c03d67f2 100644 --- a/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke-config-reference/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke-config-reference/_index.md @@ -189,7 +189,7 @@ Option to enable or disable [recurring etcd snapshots]({{}}/rke/latest/ ### Agent Environment Variables -Option to set environment variables for [rancher agents]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/rancher-agents/). The environment variables can be set using key value pairs. If rancher agent requires use of proxy to communicate with Rancher server, `HTTP_PROXY`, `HTTPS_PROXY` and `NO_PROXY` environment variables can be set using agent environment variables. +Option to set environment variables for [rancher agents]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/rancher-agents/). The environment variables can be set using key value pairs. If rancher agent requires use of proxy to communicate with Rancher server, `HTTP_PROXY`, `HTTPS_PROXY` and `NO_PROXY` environment variables can be set using agent environment variables. ### Updating ingress-nginx diff --git a/content/rancher/v2.6/en/cluster-admin/nodes/_index.md b/content/rancher/v2.6/en/cluster-admin/nodes/_index.md index a60fb2d562a..9f2243cceab 100644 --- a/content/rancher/v2.6/en/cluster-admin/nodes/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/nodes/_index.md @@ -40,11 +40,11 @@ The following table lists which node options are available for each type of clus | [Download Keys](#ssh-into-a-node-hosted-by-an-infrastructure-provider) | ✓ | | | | | Download SSH key in order to SSH into the node. | | [Node Scaling](#scaling-nodes) | ✓ | | | ✓ | | Scale the number of nodes in the node pool up or down. | -[1]: {{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ -[2]: {{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/ -[3]: {{}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/ -[4]: {{}}/rancher/v2.x/en/cluster-provisioning/registered-clusters/ -[5]: {{}}/rancher/v2.x/en/cluster-provisioning/registered-clusters/ +[1]: {{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ +[2]: {{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/custom-nodes/ +[3]: {{}}/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/ +[4]: {{}}/rancher/v2.6/en/cluster-provisioning/registered-clusters/ +[5]: {{}}/rancher/v2.6/en/cluster-provisioning/registered-clusters/ \* Delete option accessible via View API diff --git a/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-rke2/_index.md b/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-rke2/_index.md index 6c72adfaf09..f1a1c52bab1 100644 --- a/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-rke2/_index.md +++ b/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-rke2/_index.md @@ -5,7 +5,7 @@ weight: 2 --- _Tested on v2.5.6_ -This section describes how to install a Kubernetes cluster according to the [best practices for the Rancher server environment.]({{}}/rancher/v2.x/en/overview/architecture-recommendations/#environment-for-kubernetes-installations) +This section describes how to install a Kubernetes cluster according to the [best practices for the Rancher server environment.]({{}}/rancher/v2.6/en/overview/architecture-recommendations/#environment-for-kubernetes-installations) # Prerequisites diff --git a/content/rancher/v2.6/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-rke2-ha/_index.md b/content/rancher/v2.6/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-rke2-ha/_index.md index 82eb68522f7..e03f8ccc868 100644 --- a/content/rancher/v2.6/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-rke2-ha/_index.md +++ b/content/rancher/v2.6/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-rke2-ha/_index.md @@ -17,9 +17,9 @@ To install the Rancher management server on a high-availability RKE2 cluster, we ### 1. Set up Linux Nodes -Make sure that your nodes fulfill the general installation requirements for [OS, container runtime, hardware, and networking.]({{}}/rancher/v2.x/en/installation/requirements/) +Make sure that your nodes fulfill the general installation requirements for [OS, container runtime, hardware, and networking.]({{}}/rancher/v2.6/en/installation/requirements/) -For an example of one way to set up Linux nodes, refer to this [tutorial]({{}}/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/ec2-node) for setting up nodes as instances in Amazon EC2. +For an example of one way to set up Linux nodes, refer to this [tutorial]({{}}/rancher/v2.6/en/installation/resources/k8s-tutorials/infrastructure-tutorials/ec2-node) for setting up nodes as instances in Amazon EC2. ### 2. Set up the Load Balancer @@ -32,11 +32,11 @@ When Rancher is installed (also in a later step), the Rancher system creates an For your implementation, consider if you want or need to use a Layer-4 or Layer-7 load balancer: - **A layer-4 load balancer** is the simpler of the two choices, in which you are forwarding TCP traffic to your nodes. We recommend configuring your load balancer as a Layer 4 balancer, forwarding traffic to ports TCP/80 and TCP/443 to the Rancher management cluster nodes. The Ingress controller on the cluster will redirect HTTP traffic to HTTPS and terminate SSL/TLS on port TCP/443. The Ingress controller will forward traffic to port TCP/80 to the Ingress pod in the Rancher deployment. -- **A layer-7 load balancer** is a bit more complicated but can offer features that you may want. For instance, a layer-7 load balancer is capable of handling TLS termination at the load balancer, as opposed to Rancher doing TLS termination itself. This can be beneficial if you want to centralize your TLS termination in your infrastructure. Layer-7 load balancing also offers the capability for your load balancer to make decisions based on HTTP attributes such as cookies, etc. that a layer-4 load balancer is not able to concern itself with. If you decide to terminate the SSL/TLS traffic on a layer-7 load balancer, you will need to use the `--set tls=external` option when installing Rancher in a later step. For more information, refer to the [Rancher Helm chart options.]({{}}/rancher/v2.x/en/installation/resources/chart-options/#external-tls-termination) +- **A layer-7 load balancer** is a bit more complicated but can offer features that you may want. For instance, a layer-7 load balancer is capable of handling TLS termination at the load balancer, as opposed to Rancher doing TLS termination itself. This can be beneficial if you want to centralize your TLS termination in your infrastructure. Layer-7 load balancing also offers the capability for your load balancer to make decisions based on HTTP attributes such as cookies, etc. that a layer-4 load balancer is not able to concern itself with. If you decide to terminate the SSL/TLS traffic on a layer-7 load balancer, you will need to use the `--set tls=external` option when installing Rancher in a later step. For more information, refer to the [Rancher Helm chart options.]({{}}/rancher/v2.6/en/installation/resources/chart-options/#external-tls-termination) For an example showing how to set up an NGINX load balancer, refer to [this page.]({{}}/rancher/v2.6/en/installation/resources/k8s-tutorials/infrastructure-tutorials/nginx/) -For a how-to guide for setting up an Amazon ELB Network Load Balancer, refer to [this page.]({{}}/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/nlb/) +For a how-to guide for setting up an Amazon ELB Network Load Balancer, refer to [this page.]({{}}/rancher/v2.6/en/installation/resources/k8s-tutorials/infrastructure-tutorials/nlb/) > **Important:** > Do not use this load balancer (i.e, the `local` cluster Ingress) to load balance applications other than Rancher following installation. Sharing this Ingress with other applications may result in websocket errors to Rancher following Ingress configuration reloads for other apps. We recommend dedicating the `local` cluster to Rancher and no other applications. diff --git a/content/rancher/v2.6/en/installation/resources/tls-secrets/_index.md b/content/rancher/v2.6/en/installation/resources/tls-secrets/_index.md index e977c983669..cd11f1e9684 100644 --- a/content/rancher/v2.6/en/installation/resources/tls-secrets/_index.md +++ b/content/rancher/v2.6/en/installation/resources/tls-secrets/_index.md @@ -35,4 +35,4 @@ kubectl -n cattle-system create secret generic tls-ca \ # Updating a Private CA Certificate -Follow the steps on [this page]({{}}/rancher/v2.x/en/installation/resources/update-ca-cert) to update the SSL certificate of the ingress in a Rancher [high availability Kubernetes installation]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/) or to switch from the default self-signed certificate to a custom certificate. \ No newline at end of file +Follow the steps on [this page]({{}}/rancher/v2.6/en/installation/resources/update-ca-cert) to update the SSL certificate of the ingress in a Rancher [high availability Kubernetes installation]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/) or to switch from the default self-signed certificate to a custom certificate. \ No newline at end of file From 7b2e62ad863dec71b071834f82af220b940e584c Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 2 Dec 2021 16:47:31 -0800 Subject: [PATCH 070/478] Add cert info/links for kubelet serving cert --- .../v2.5/en/cluster-admin/certificate-rotation/_index.md | 3 ++- .../v2.6/en/cluster-admin/certificate-rotation/_index.md | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md b/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md index b3f52ad2d3f..37aa93ed56f 100644 --- a/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md +++ b/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md @@ -12,7 +12,8 @@ By default, Kubernetes clusters require certificates and Rancher launched Kubern Certificates can be rotated for the following services: - etcd -- kubelet +- kubelet (node certificate) +- kubelet (serving certificate, if [enabled]({{}}/rke/latest/en/config-options/services/#kubelet-options)) - kube-apiserver - kube-proxy - kube-scheduler diff --git a/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md b/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md index 38eb69b8cb1..8a70bfd34b6 100644 --- a/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md @@ -10,7 +10,8 @@ By default, Kubernetes clusters require certificates and Rancher launched Kubern Certificates can be rotated for the following services: - etcd -- kubelet +- kubelet (node certificate) +- kubelet (serving certificate, if [enabled]({{}}/rke/latest/en/config-options/services/#kubelet-options)) - kube-apiserver - kube-proxy - kube-scheduler From 884052469fce633c42310e073b89045713d90ee2 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 6 Dec 2021 11:45:10 -0500 Subject: [PATCH 071/478] Added more info for CD in 2.5, 2.6 --- .../en/deploy-across-clusters/fleet/_index.md | 19 ++++++++++++++++++- .../en/deploy-across-clusters/fleet/_index.md | 19 ++++++++++++++++++- 2 files changed, 36 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md index 303f2071bf2..0f62de9cc37 100644 --- a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md +++ b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md @@ -26,7 +26,24 @@ For information about how Fleet works, see [this page.](./architecture) # Accessing Fleet in the Rancher UI -Fleet comes preinstalled in Rancher v2.5. To access it, go to the **Cluster Explorer** in the Rancher UI. In the top left dropdown menu, click **Cluster Explorer > Continuous Delivery.** On this page, you can edit Kubernetes resources and cluster groups managed by Fleet. +Fleet comes preinstalled in Rancher v2.5. Users can leverage continuous delivery to deploy their applications to the Kubernetes clusters in the git repository without any manual operation by following **gitops** practice. For additional information on Continuous Delivery and other Fleet troubleshooting tips, refer [here](https://fleet.rancher.io/troubleshooting/). + +Follow the steps below to access Continuous Delivery in the Rancher UI: + +1. Click **Cluster Explorer** in the Rancher UI. + +1. In the top left dropdown menu, click **Cluster Explorer > Continuous Delivery.** + +1. Select your namespace at the top of the menu, noting the following: + - By default,`fleet-default` is selected which includes all downstream clusters that are registered through Rancher. + - You may switch to `fleet-local`, which only contains the `local` cluster, or you may create your own workspace to which you may assign and move clusters. + - You can then manage clusters by clicking on **Clusters** on the left navigation bar. + +1. Click on **Gitrepos** on the left navigation bar to deploy the gitrepo into your clusters in the current workspace. + +1. Select your [git repository](https://fleet.rancher.io/gitrepo-add/) and [target clusters/cluster group](https://fleet.rancher.io/gitrepo-structure/). You can also create the cluster group in the UI by clicking on **Cluster Groups** from the left navigation bar. + +1. Once the gitrepo is deployed, you can monitor the application through the Rancher UI. # Windows Support diff --git a/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md b/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md index f0e80bbb598..806ad0e06f7 100644 --- a/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md +++ b/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md @@ -22,7 +22,24 @@ For information about how Fleet works, see [this page.](./architecture) # Accessing Fleet in the Rancher UI -Fleet comes preinstalled in Rancher. To access it, click **☰ > Continuous Delivery**. +Fleet comes preinstalled in Rancher and is managed by the **Continous Delivery** option in the Rancher UI. For additional information on Continuous Delivery and other Fleet troubleshooting tips, refer [here](https://fleet.rancher.io/troubleshooting/). + +Users can leverage continuous delivery to deploy their applications to the Kubernetes clusters in the git repository without any manual operation by following **gitops** practice. + +Follow the steps below to access Continuous Delivery in the Rancher UI: + +1. Click **☰ > Continuous Delivery**. + +1. Select your namespace at the top of the menu, noting the following: + - By default,`fleet-default` is selected which includes all downstream clusters that are registered through Rancher. + - You may switch to `fleet-local`, which only contains the `local` cluster, or you may create your own workspace to which you may assign and move clusters. + - You can then manage clusters by clicking on **Clusters** on the left navigation bar. + +1. Click on **Gitrepos** on the left navigation bar to deploy the gitrepo into your clusters in the current workspace. + +1. Select your [git repository](https://fleet.rancher.io/gitrepo-add/) and [target clusters/cluster group](https://fleet.rancher.io/gitrepo-structure/). You can also create the cluster group in the UI by clicking on **Cluster Groups** from the left navigation bar. + +1. Once the gitrepo is deployed, you can monitor the application through the Rancher UI. # Windows Support From 7f0a36adff8cba5f0b74d93408b1b82c1af17c82 Mon Sep 17 00:00:00 2001 From: Jen Travinski Date: Tue, 7 Dec 2021 13:10:04 -0500 Subject: [PATCH 072/478] Updated Quickstart docs and Adding Ingresses page for Rancher 2.6 (#3711) * Added step to tell users to add a port * Updated Step 2, exposing the app via an ingress * Added one step to the ingress nav * Updated per feedback * Updated per feedback * Updated results sentence * Update content/rancher/v2.6/en/quick-start-guide/workload/quickstart-deploy-workload-ingress/_index.md Co-authored-by: Billy Tat * Update content/rancher/v2.6/en/quick-start-guide/workload/quickstart-deploy-workload-ingress/_index.md Co-authored-by: Billy Tat * Update content/rancher/v2.6/en/quick-start-guide/workload/quickstart-deploy-workload-ingress/_index.md Co-authored-by: Billy Tat Co-authored-by: Billy Tat --- .../ingress/_index.md | 1 + .../_index.md | 27 ++++++++++--------- 2 files changed, 15 insertions(+), 13 deletions(-) diff --git a/content/rancher/v2.6/en/k8s-in-rancher/load-balancers-and-ingress/ingress/_index.md b/content/rancher/v2.6/en/k8s-in-rancher/load-balancers-and-ingress/ingress/_index.md index 3ca7dc768d4..bb69c198262 100644 --- a/content/rancher/v2.6/en/k8s-in-rancher/load-balancers-and-ingress/ingress/_index.md +++ b/content/rancher/v2.6/en/k8s-in-rancher/load-balancers-and-ingress/ingress/_index.md @@ -14,6 +14,7 @@ Ingresses can be added for workloads to provide load balancing, SSL termination 1. Enter a **Name** for the ingress. 1. Create ingress forwarding **Rules**. For help configuring the rules, refer to [this section.](#ingress-rule-configuration) If any of your ingress rules handle requests for encrypted ports, add a certificate to encrypt/decrypt communications. 1. **Optional:** click **Add Rule** to create additional ingress rules. For example, after you create ingress rules to direct requests for your hostname, you'll likely want to create a default backend to handle 404s. +1. Click **Create** at the bottom right. **Result:** Your ingress is added to the project. The ingress begins enforcing your ingress rules. diff --git a/content/rancher/v2.6/en/quick-start-guide/workload/quickstart-deploy-workload-ingress/_index.md b/content/rancher/v2.6/en/quick-start-guide/workload/quickstart-deploy-workload-ingress/_index.md index fb4ac811514..5be4b866fb9 100644 --- a/content/rancher/v2.6/en/quick-start-guide/workload/quickstart-deploy-workload-ingress/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/workload/quickstart-deploy-workload-ingress/_index.md @@ -13,13 +13,14 @@ You're ready to create your first Kubernetes [workload](https://kubernetes.io/do For this workload, you'll be deploying the application Rancher Hello-World. -1. Click **☰ > Cluster Management**. +1. Click **☰ > Cluster Management**. 1. Go to the cluster that you created and click **Explore**. 1. Click **Workload**. 1. Click **Create**. 1. Click **Deployment**. 1. Enter a **Name** for your workload. 1. From the **Docker Image** field, enter `rancher/hello-world`. This field is case-sensitive. +1. Click **Add Port** and enter `80` in the **Private Container Port** field. Adding a port enables access to the application inside and outside of the cluster. For more information, see [Services]({{}}/rancher/v2.6/en/k8s-in-rancher/workloads/#services). 1. Click **Create**. **Result:** @@ -30,32 +31,32 @@ For this workload, you'll be deploying the application Rancher Hello-World.
### 2. Expose The Application Via An Ingress -Now that the application is up and running it needs to be exposed so that other services can connect. +Now that the application is up and running, it needs to be exposed so that other services can connect. 1. Click **☰ > Cluster Management**. -1. Go to the cluster that you created and click **Explore**. +1. Go to the cluster that you created and click **Explore**. -2. From the main menu of the **Dashboard**, select **Projects**. +1. Click **Service Discovery > Ingresses**. -3. Open the **Default** project. +1. Click **Create.** -4. Click **Resources > Workloads > Load Balancing**. Click on the **Load Balancing** tab. +1. When choosing **Namespace**, ensure it is the same as the one used when you created your deployment. Otherwise, your deployment will not be available when you attempt to select **Target Service**, as in Step 8 below. -5. Click **Add Ingress**. +1. Enter a **Name**, such as **hello**. -6. Enter a name i.e. **hello**. +1. Specify your **Path**, such as `/hello`. -7. In the **Target** field, drop down the list and choose the name that you set for your service. +1. In the **Target Service** field, drop down the list and choose the name that you set for your service. -8. Enter `80` in the **Port** field. +1. In the **Port** field, drop down the list and select `80`. -9. Leave everything else as default and click **Save**. +1. Click **Create** at the bottom right. -**Result:** The application is assigned a `xip.io` address and exposed. It may take a minute or two to populate. +**Result:** The application is assigned a `sslip.io` address and exposed. It may take a minute or two to populate. ### View Your Application -From the **Load Balancing** page, click the target link, which will look something like `hello.default.xxx.xxx.xxx.xxx.xip.io > hello-world`. +From the **Deployments** page, find the **Endpoints** column for your deployment and click on an endpoint. The endpoints available will depend on how you configured the port you added to your deployment. For endpoints where you do not see a randomly assigned port, append the path you specified when creating the ingress to the IP address. For example, if your endpoint looks like `xxx.xxx.xxx.xxx` or `https://xxx.xxx.xxx.xxx` change it to `xxx.xxx.xxx.xxx/hello` or `https://xxx.xxx.xxx.xxx/hello`. Your application will open in a separate window. From 0a14a421bdff677d3d796738578c8c80d4f7c008 Mon Sep 17 00:00:00 2001 From: Jen Travinski Date: Tue, 7 Dec 2021 16:55:02 -0500 Subject: [PATCH 073/478] Added rancher.cattle-system to no-proxy list in 2.5 with explanation (#3718) * Added rancher.cattle-system to no-proxy list in 2.5 with explanation * Updated per feedback --- .../behind-proxy/install-rancher/_index.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.5/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md b/content/rancher/v2.5/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md index fac08ab40c9..6e1de3f1ab6 100644 --- a/content/rancher/v2.5/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md +++ b/content/rancher/v2.5/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md @@ -60,14 +60,16 @@ Create a namespace: kubectl create namespace cattle-system ``` -And install Rancher with Helm. Rancher also needs a proxy configuration so that it can communicate with external application catalogs or retrieve Kubernetes version update metadata: +And install Rancher with Helm. Rancher also needs a proxy configuration so that it can communicate with external application catalogs or retrieve Kubernetes version update metadata. + +Note that `rancher.cattle-system` must be added to the noProxy list (as shown below) so that Fleet can communicate directly to Rancher with Kubernetes service DNS using service discovery. ``` helm upgrade --install rancher rancher-latest/rancher \ --namespace cattle-system \ --set hostname=rancher.example.com \ --set proxy=http://${proxy_host} - --set noProxy=127.0.0.0/8\\,10.0.0.0/8\\,cattle-system.svc\\,172.16.0.0/12\\,192.168.0.0/16\\,.svc\\,.cluster.local + --set noProxy=127.0.0.0/8\\,10.0.0.0/8\\,cattle-system.svc\\,172.16.0.0/12\\,192.168.0.0/16\\,.svc\\,.cluster.local,rancher.cattle-system ``` After waiting for the deployment to finish: From 16bdbc7c6e494cfabc3e8538df5912b7010a038d Mon Sep 17 00:00:00 2001 From: Anton Lindholm Date: Wed, 8 Dec 2021 02:48:58 +0200 Subject: [PATCH 074/478] Add missing steps for recovering from cert expiration (#3712) * Improve instructions on cert expiration Add instructions for deleting the mutating webhook * Update content/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/_index.md Co-authored-by: Caleb Bron Co-authored-by: Caleb Bron --- .../troubleshooting/expired-webhook-certificates/_index.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/_index.md b/content/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/_index.md index 99979410992..59a7bfbcc1f 100644 --- a/content/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/_index.md +++ b/content/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/_index.md @@ -10,6 +10,7 @@ Rancher will advise the community once there is a permanent solution in place fo ##### 1. Users with cluster access, run the following commands: ``` kubectl delete secret -n cattle-system cattle-webhook-tls +kubectl delete mutatingwebhookconfigurations.admissionregistration.k8s.io --ignore-not-found=true rancher.cattle.io kubectl delete pod -n cattle-system -l app=rancher-webhook ``` @@ -17,6 +18,8 @@ kubectl delete pod -n cattle-system -l app=rancher-webhook 1. Delete the `cattle-webhook-tls` secret in the `cattle-system` namespace in the local cluster. -1. Delete the `rancher-webhook` pod in the `cattle-system` namespace in the local cluster. +2. Delete the `rancher.cattle.io` mutating webhook -**Note:** The webhook certificate expiration issue is not specific to `cattle-webhook-tls` as listed in the examples. You will fill in your expired certificate secret accordingly. \ No newline at end of file +3. Delete the `rancher-webhook` pod in the `cattle-system` namespace in the local cluster. + +**Note:** The webhook certificate expiration issue is not specific to `cattle-webhook-tls` as listed in the examples. You will fill in your expired certificate secret accordingly. From e12d2e722442b6b71546d16c7fed297f48d7939c Mon Sep 17 00:00:00 2001 From: Manuel Buil Date: Wed, 8 Dec 2021 16:24:38 +0100 Subject: [PATCH 075/478] Update the flags and variables doc Signed-off-by: Manuel Buil --- .../install-options/how-to-flags/_index.md | 27 ++++++++++++++----- 1 file changed, 21 insertions(+), 6 deletions(-) diff --git a/content/k3s/latest/en/installation/install-options/how-to-flags/_index.md b/content/k3s/latest/en/installation/install-options/how-to-flags/_index.md index 25aa9b43567..d7392feba23 100644 --- a/content/k3s/latest/en/installation/install-options/how-to-flags/_index.md +++ b/content/k3s/latest/en/installation/install-options/how-to-flags/_index.md @@ -27,9 +27,24 @@ If this command is not specified as a server or agent command, it will default t The final systemd command resolves to a combination of this environment variable and script args. To illustrate this, the following commands result in the same behavior of registering a server without flannel: ```bash -curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--no-flannel" sh -s - -curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="server --no-flannel" sh -s - -curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="server" sh -s - --no-flannel -curl -sfL https://get.k3s.io | sh -s - server --no-flannel -curl -sfL https://get.k3s.io | sh -s - --no-flannel -``` \ No newline at end of file +curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--flannel-backend none" sh -s - +curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="server --flannel-backend none" sh -s - +curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="server" sh -s - --flannel-backend none +curl -sfL https://get.k3s.io | sh -s - server --flannel-backend none +curl -sfL https://get.k3s.io | sh -s - --flannel-backend none +``` + +### Example C: CONFIG FILE + +Before installing k3s, you can create a file called `config.yaml` containing fields that match CLI flags. That file needs to be in the path: `/etc/rancher/k3s/config.yaml` for k3s to consume it. + +The fields in the config file drop the starting `--` from the matching CLI flag. For example: + +``` +write-kubeconfig-mode: 644 +token: "secret" +node-ip: 10.0.10.22,2a05:d012:c6f:4655:d73c:c825:a184:1b75 +cluster-cidr: 10.42.0.0/16,2001:cafe:42:0::/56 +service-cidr: 10.43.0.0/16,2001:cafe:42:1::/112 +disable-network-policy: true +``` From 6348522ad6dffbe32da73a15e316ed59173dcc72 Mon Sep 17 00:00:00 2001 From: Tejeev Date: Wed, 8 Dec 2021 10:11:46 -0700 Subject: [PATCH 076/478] This is a common error that makes no sense to users (#3720) --- content/rancher/v2.5/en/faq/technical/_index.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/content/rancher/v2.5/en/faq/technical/_index.md b/content/rancher/v2.5/en/faq/technical/_index.md index f338f2a0180..9ea91ea6d92 100644 --- a/content/rancher/v2.5/en/faq/technical/_index.md +++ b/content/rancher/v2.5/en/faq/technical/_index.md @@ -173,3 +173,8 @@ In Kubernetes v1.13, the `TaintBasedEvictions` feature is enabled by default. Se ### Can I use keyboard shortcuts in the UI? Yes, most parts of the UI can be reached using keyboard shortcuts. For an overview of the available shortcuts, press `?` anywhere in the UI. + + +### What does `Unknown schema for type:` errors followed by something like `catalog.cattle.io.operation` mean when trying to modify an App? + +This error occurs when Kubernetes can not find the CRD mentioned. The vast majority of the time these are a result of missing RBAC permissions. Try with an admin user and if this works, add permissions for the resource mentioned by the error (ie. `Get`, `List`, `Patch` as needed). From bc3925b4fd08b47d7dc77cfa0524e80779ea9a45 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 8 Dec 2021 16:28:29 -0500 Subject: [PATCH 077/478] Added info on K3s bootstrap data, updated style of install notes --- content/k3s/latest/en/upgrades/_index.md | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/content/k3s/latest/en/upgrades/_index.md b/content/k3s/latest/en/upgrades/_index.md index 1b9c86805ad..2b93db7e474 100644 --- a/content/k3s/latest/en/upgrades/_index.md +++ b/content/k3s/latest/en/upgrades/_index.md @@ -9,6 +9,16 @@ This section describes how to upgrade your K3s cluster. [Automated upgrades]({{< baseurl >}}/k3s/latest/en/upgrades/automated/) describes how to perform Kubernetes-native automated upgrades using Rancher's [system-upgrade-controller](https://github.com/rancher/system-upgrade-controller). -> If Traefik is not disabled K3s versions 1.20 and earlier will have installed Traefik v1, while K3s versions 1.21 and later will install Traefik v2 if v1 is not already present. To upgrade Traefik, please refer to the [Traefik documentation](https://doc.traefik.io/traefik/migration/v1-to-v2/) and use the [migration tool](https://github.com/traefik/traefik-migration-tool) to migrate from the older Traefik v1 to Traefik v2. - -> The experimental embedded Dqlite data store was deprecated in K3s v1.19.1. Please note that upgrades from experimental Dqlite to experimental embedded etcd are not supported. If you attempt an upgrade it will not succeed and data will be lost. +> **Important notes on upgrades:** +> +> - **Traefik:** If Traefik is not disabled, K3s versions 1.20 and earlier will install Traefik v1, while K3s versions 1.21 and later will install Traefik v2, if v1 is not already present. To upgrade from the older Traefik v1 to Traefik v2, please refer to the [Traefik documentation](https://doc.traefik.io/traefik/migration/v1-to-v2/) and use the [migration tool](https://github.com/traefik/traefik-migration-tool). +> +> - **Experimental Dqlite:** The experimental embedded Dqlite data store was deprecated in K3s v1.19.1. Please note that upgrades from experimental Dqlite to experimental embedded etcd are not supported. If you attempt an upgrade, it will not succeed, and data will be lost. +> +> - **K3s bootstrap data:** If you are using K3s in an HA configuration with an external SQL datastore, and your server (control-plane) nodes were not started with the `--token` CLI flag, you will no longer be able to add additional K3s servers to the cluster without specifying the token. Ensure that you retain a copy of this token, as it is required when restoring from backup. Previously, K3s did not enforce the use of a token when using external SQL datastores. +> - The affected versions are <= v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1; the patched versions are v1.19.13+k3s1, v1.20.9+k3s1, v1.21.3+k3s1. +> +> - You may retrieve the token value from any server already joined to the cluster as follows: +``` +cat /var/lib/rancher/k3s/server/token +``` From 52e112528c442c1f59d0634caf87a5fa22aefb28 Mon Sep 17 00:00:00 2001 From: dkeightley <20566450+dkeightley@users.noreply.github.com> Date: Thu, 9 Dec 2021 12:45:00 +1300 Subject: [PATCH 078/478] Update image list with awk and sed (#3719) * Update image list with awk and sed Proposing this change to allow the cert-manager images to be extracted without GNU grep (no `-P` flag), for example using default tools on MacOS * Update v2.6 docs --- .../air-gap/populate-private-registry/_index.md | 4 ++-- .../air-gap/populate-private-registry/_index.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/content/rancher/v2.5/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md b/content/rancher/v2.5/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md index d42ee6f04e8..5c152feb541 100644 --- a/content/rancher/v2.5/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md +++ b/content/rancher/v2.5/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md @@ -66,7 +66,7 @@ In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS helm repo add jetstack https://charts.jetstack.io helm repo update helm fetch jetstack/cert-manager --version v1.5.1 - helm template ./cert-manager-.tgz | grep -oP '(?<=image: ").*(?=")' >> ./rancher-images.txt + helm template ./cert-manager-.tgz | awk '$1 ~ /image:/ {print $2}' | sed s/\"//g >> ./rancher-images.txt ``` 2. Sort and unique the images list to remove any overlap between the sources: @@ -237,7 +237,7 @@ The workstation must have Docker 18.02+ in order to support manifests, which are helm repo add jetstack https://charts.jetstack.io helm repo update helm fetch jetstack/cert-manager --version v0.12.0 - helm template ./cert-manager-.tgz | grep -oP '(?<=image: ").*(?=")' >> ./rancher-images.txt + helm template ./cert-manager-.tgz | | awk '$1 ~ /image:/ {print $2}' | sed s/\"//g >> ./rancher-images.txt ``` 2. Sort and unique the images list to remove any overlap between the sources: diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md index 2c27c28bb2c..05b260b3aa5 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md @@ -59,7 +59,7 @@ In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS helm repo add jetstack https://charts.jetstack.io helm repo update helm fetch jetstack/cert-manager --version v1.5.1 - helm template ./cert-manager-.tgz | grep -oP '(?<=image: ").*(?=")' >> ./rancher-images.txt + helm template ./cert-manager-.tgz | awk '$1 ~ /image:/ {print $2}' | sed s/\"//g >> ./rancher-images.txt ``` 2. Sort and unique the images list to remove any overlap between the sources: @@ -230,7 +230,7 @@ The workstation must have Docker 18.02+ in order to support manifests, which are helm repo add jetstack https://charts.jetstack.io helm repo update helm fetch jetstack/cert-manager --version v0.12.0 - helm template ./cert-manager-.tgz | grep -oP '(?<=image: ").*(?=")' >> ./rancher-images.txt + helm template ./cert-manager-.tgz | awk '$1 ~ /image:/ {print $2}' | sed s/\"//g >> ./rancher-images.txt ``` 2. Sort and unique the images list to remove any overlap between the sources: From b1228e8330f9212e95c9b7aeb9bf1ab002b16e40 Mon Sep 17 00:00:00 2001 From: Jen Travinski Date: Wed, 8 Dec 2021 18:47:01 -0500 Subject: [PATCH 079/478] Added notes about project-member ability to delete ns (#3709) * Added note on project member scope * Added note about ability to delete as well as create NS * Added note on project member scope in 2.6 also * Added note about ability to delete as well as create NS in 2.6 * Updated roles and notes in 2.5, 2.6 per feedback * Removing note from page, keeping chart updates per feedback * Added note about deletion ability in 3 pages for 2.5 * Removing note from page, keeping chart updates per feedback in 2.6 * Removed asterisks as they had pertained to a note that was removed in 2.5, 2.6 * Added note about deletion ability in 3 pages for 2.6, updated spacing and note position in 2.5 * Added note about deletion ability in 3 pages for v2.0-v2.4 --- .../en/admin-settings/rbac/cluster-project-roles/_index.md | 4 ++++ .../en/cluster-admin/projects-and-namespaces/_index.md | 3 +++ .../v2.0-v2.4/en/project-admin/project-members/_index.md | 2 ++ .../en/admin-settings/rbac/cluster-project-roles/_index.md | 5 ++++- .../v2.5/en/cluster-admin/projects-and-namespaces/_index.md | 3 +++ content/rancher/v2.5/en/monitoring-alerting/rbac/_index.md | 4 ++-- .../rancher/v2.5/en/project-admin/project-members/_index.md | 2 ++ .../en/admin-settings/rbac/cluster-project-roles/_index.md | 5 ++++- .../v2.6/en/cluster-admin/projects-and-namespaces/_index.md | 3 +++ content/rancher/v2.6/en/monitoring-alerting/rbac/_index.md | 4 ++-- .../rancher/v2.6/en/project-admin/project-members/_index.md | 4 +++- 11 files changed, 32 insertions(+), 7 deletions(-) diff --git a/content/rancher/v2.0-v2.4/en/admin-settings/rbac/cluster-project-roles/_index.md b/content/rancher/v2.0-v2.4/en/admin-settings/rbac/cluster-project-roles/_index.md index 6185daa0bee..6e155df7033 100644 --- a/content/rancher/v2.0-v2.4/en/admin-settings/rbac/cluster-project-roles/_index.md +++ b/content/rancher/v2.0-v2.4/en/admin-settings/rbac/cluster-project-roles/_index.md @@ -84,6 +84,10 @@ _Project roles_ are roles that can be used to grant users access to a project. T These users can manage project-scoped resources like namespaces and workloads, but cannot manage other project members. + >**Note:** + > + >By default, the Rancher role of `project-member` inherits from the `Kubernetes-edit` role, and the `project-owner` role inherits from the `Kubernetes-admin` role. As such, both `project-member` and `project-owner` roles will allow for namespace management, including the ability to create and delete namespaces. + - **Read Only:** These users can view everything in the project but cannot create, update, or delete anything. diff --git a/content/rancher/v2.0-v2.4/en/cluster-admin/projects-and-namespaces/_index.md b/content/rancher/v2.0-v2.4/en/cluster-admin/projects-and-namespaces/_index.md index 9774a89c470..545de58bf84 100644 --- a/content/rancher/v2.0-v2.4/en/cluster-admin/projects-and-namespaces/_index.md +++ b/content/rancher/v2.0-v2.4/en/cluster-admin/projects-and-namespaces/_index.md @@ -162,6 +162,9 @@ By default, your user is added as the project `Owner`. >**Notes on Permissions:** > >- Users assigned the `Owner` or `Member` role for a project automatically inherit the `namespace creation` role. However, this role is a [Kubernetes ClusterRole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole), meaning its scope extends to all projects in the cluster. Therefore, users explicitly assigned the `Owner` or `Member` role for a project can create namespaces in other projects they're assigned to, even with only the `Read Only` role assigned. +> +>- By default, the Rancher role of `project-member` inherits from the `Kubernetes-edit` role, and the `project-owner` role inherits from the `Kubernetes-admin` role. As such, both `project-member` and `project-owner` roles will allow for namespace management, including the ability to create and delete namespaces. +> >- Choose `Custom` to create a custom role on the fly: [Custom Project Roles]({{}}/rancher/v2.0-v2.4/en/admin-settings/rbac/cluster-project-roles/#custom-project-roles). To add members: diff --git a/content/rancher/v2.0-v2.4/en/project-admin/project-members/_index.md b/content/rancher/v2.0-v2.4/en/project-admin/project-members/_index.md index 47f4c7eddfe..a0a4a0922d7 100644 --- a/content/rancher/v2.0-v2.4/en/project-admin/project-members/_index.md +++ b/content/rancher/v2.0-v2.4/en/project-admin/project-members/_index.md @@ -42,6 +42,8 @@ Following project creation, you can add users as project members so that they ca > >- Users assigned the `Owner` or `Member` role for a project automatically inherit the `namespace creation` role. However, this role is a [Kubernetes ClusterRole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole), meaning its scope extends to all projects in the cluster. Therefore, users explicitly assigned the `Owner` or `Member` role for a project can create namespaces in other projects they're assigned to, even with only the `Read Only` role assigned. > + >- By default, the Rancher role of `project-member` inherits from the `Kubernetes-edit` role, and the `project-owner` role inherits from the `Kubernetes-admin` role. As such, both `project-member` and `project-owner` roles will allow for namespace management, including the ability to create and delete namespaces. + > >- For `Custom` roles, you can modify the list of individual roles available for assignment. > > - To add roles to the list, [Add a Custom Role]({{}}/rancher/v2.0-v2.4/en/admin-settings/rbac/default-custom-roles). diff --git a/content/rancher/v2.5/en/admin-settings/rbac/cluster-project-roles/_index.md b/content/rancher/v2.5/en/admin-settings/rbac/cluster-project-roles/_index.md index 6c82e42e726..4996f82ab54 100644 --- a/content/rancher/v2.5/en/admin-settings/rbac/cluster-project-roles/_index.md +++ b/content/rancher/v2.5/en/admin-settings/rbac/cluster-project-roles/_index.md @@ -86,6 +86,10 @@ _Project roles_ are roles that can be used to grant users access to a project. T These users can manage project-scoped resources like namespaces and workloads, but cannot manage other project members. + >**Note:** + > + >By default, the Rancher role of `project-member` inherits from the `Kubernetes-edit` role, and the `project-owner` role inherits from the `Kubernetes-admin` role. As such, both `project-member` and `project-owner` roles will allow for namespace management, including the ability to create and delete namespaces. + - **Read Only:** These users can view everything in the project but cannot create, update, or delete anything. @@ -94,7 +98,6 @@ _Project roles_ are roles that can be used to grant users access to a project. T > >Users assigned the `Owner` or `Member` role for a project automatically inherit the `namespace creation` role. However, this role is a [Kubernetes ClusterRole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole), meaning its scope extends to all projects in the cluster. Therefore, users explicitly assigned the `owner` or `member` role for a project can create namespaces in other projects they're assigned to, even with only the `Read Only` role assigned. - #### Custom Project Roles Rancher lets you assign _custom project roles_ to a standard user instead of the typical `Owner`, `Member`, or `Read Only` roles. These roles can be either a built-in custom project role or one defined by a Rancher administrator. They are convenient for defining narrow or specialized access for a standard user within a project. See the table below for a list of built-in custom project roles. diff --git a/content/rancher/v2.5/en/cluster-admin/projects-and-namespaces/_index.md b/content/rancher/v2.5/en/cluster-admin/projects-and-namespaces/_index.md index 86c6574c224..493331bc93c 100644 --- a/content/rancher/v2.5/en/cluster-admin/projects-and-namespaces/_index.md +++ b/content/rancher/v2.5/en/cluster-admin/projects-and-namespaces/_index.md @@ -156,6 +156,9 @@ By default, your user is added as the project `Owner`. >**Notes on Permissions:** > >- Users assigned the `Owner` or `Member` role for a project automatically inherit the `namespace creation` role. However, this role is a [Kubernetes ClusterRole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole), meaning its scope extends to all projects in the cluster. Therefore, users explicitly assigned the `Owner` or `Member` role for a project can create namespaces in other projects they're assigned to, even with only the `Read Only` role assigned. +> +>- By default, the Rancher role of `project-member` inherits from the `Kubernetes-edit` role, and the `project-owner` role inherits from the `Kubernetes-admin` role. As such, both `project-member` and `project-owner` roles will allow for namespace management, including the ability to create and delete namespaces. +> >- Choose `Custom` to create a custom role on the fly: [Custom Project Roles]({{}}/rancher/v2.5/en/admin-settings/rbac/cluster-project-roles/#custom-project-roles). To add members: diff --git a/content/rancher/v2.5/en/monitoring-alerting/rbac/_index.md b/content/rancher/v2.5/en/monitoring-alerting/rbac/_index.md index 4bc0e009c2a..3260cf8cf95 100644 --- a/content/rancher/v2.5/en/monitoring-alerting/rbac/_index.md +++ b/content/rancher/v2.5/en/monitoring-alerting/rbac/_index.md @@ -128,8 +128,8 @@ The relationship between the default roles deployed by Rancher Cluster Manager ( | --------- | --------- | --------- | --------- | | cluster-owner | cluster-admin | N/A | ClusterRoleBinding | | cluster-member | admin | monitoring-admin | ClusterRoleBinding | -| project-owner | edit | monitoring-admin | RoleBinding within Project namespace | -| project-member | view | monitoring-edit | RoleBinding within Project namespace | +| project-owner | admin | monitoring-admin | RoleBinding within Project namespace | +| project-member | edit | monitoring-edit | RoleBinding within Project namespace | In addition to these default Roles, the following additional Rancher project roles can be applied to members of your Cluster to provide additional access to Monitoring. These Rancher Roles will be tied to ClusterRoles deployed by the Monitoring chart: diff --git a/content/rancher/v2.5/en/project-admin/project-members/_index.md b/content/rancher/v2.5/en/project-admin/project-members/_index.md index a8476db8ec8..45a149e90ea 100644 --- a/content/rancher/v2.5/en/project-admin/project-members/_index.md +++ b/content/rancher/v2.5/en/project-admin/project-members/_index.md @@ -43,6 +43,8 @@ Following project creation, you can add users as project members so that they ca > >- Users assigned the `Owner` or `Member` role for a project automatically inherit the `namespace creation` role. However, this role is a [Kubernetes ClusterRole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole), meaning its scope extends to all projects in the cluster. Therefore, users explicitly assigned the `Owner` or `Member` role for a project can create namespaces in other projects they're assigned to, even with only the `Read Only` role assigned. > + >- By default, the Rancher role of `project-member` inherits from the `Kubernetes-edit` role, and the `project-owner` role inherits from the `Kubernetes-admin` role. As such, both `project-member` and `project-owner` roles will allow for namespace management, including the ability to create and delete namespaces. + > >- For `Custom` roles, you can modify the list of individual roles available for assignment. > > - To add roles to the list, [Add a Custom Role]({{}}/rancher/v2.5/en/admin-settings/rbac/default-custom-roles). diff --git a/content/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/_index.md b/content/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/_index.md index c966d787383..022b08762ce 100644 --- a/content/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/_index.md +++ b/content/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/_index.md @@ -111,6 +111,10 @@ _Project roles_ are roles that can be used to grant users access to a project. T These users can manage project-scoped resources like namespaces and workloads, but cannot manage other project members. + >**Note:** + > + >By default, the Rancher role of `project-member` inherits from the `Kubernetes-edit` role, and the `project-owner` role inherits from the `Kubernetes-admin` role. As such, both `project-member` and `project-owner` roles will allow for namespace management, including the ability to create and delete namespaces. + - **Read Only:** These users can view everything in the project but cannot create, update, or delete anything. @@ -119,7 +123,6 @@ _Project roles_ are roles that can be used to grant users access to a project. T > >Users assigned the `Owner` or `Member` role for a project automatically inherit the `namespace creation` role. However, this role is a [Kubernetes ClusterRole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole), meaning its scope extends to all projects in the cluster. Therefore, users explicitly assigned the `owner` or `member` role for a project can create namespaces in other projects they're assigned to, even with only the `Read Only` role assigned. - #### Custom Project Roles Rancher lets you assign _custom project roles_ to a standard user instead of the typical `Owner`, `Member`, or `Read Only` roles. These roles can be either a built-in custom project role or one defined by a Rancher administrator. They are convenient for defining narrow or specialized access for a standard user within a project. See the table below for a list of built-in custom project roles. diff --git a/content/rancher/v2.6/en/cluster-admin/projects-and-namespaces/_index.md b/content/rancher/v2.6/en/cluster-admin/projects-and-namespaces/_index.md index 79fc054dc21..d1ae03863b4 100644 --- a/content/rancher/v2.6/en/cluster-admin/projects-and-namespaces/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/projects-and-namespaces/_index.md @@ -152,6 +152,9 @@ By default, your user is added as the project `Owner`. >**Notes on Permissions:** > >- Users assigned the `Owner` or `Member` role for a project automatically inherit the `namespace creation` role. However, this role is a [Kubernetes ClusterRole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole), meaning its scope extends to all projects in the cluster. Therefore, users explicitly assigned the `Owner` or `Member` role for a project can create namespaces in other projects they're assigned to, even with only the `Read Only` role assigned. +> +>- By default, the Rancher role of `project-member` inherits from the `Kubernetes-edit` role, and the `project-owner` role inherits from the `Kubernetes-admin` role. As such, both `project-member` and `project-owner` roles will allow for namespace management, including the ability to create and delete namespaces. +> >- Choose `Custom` to create a custom role on the fly: [Custom Project Roles]({{}}/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/#custom-project-roles). To add members: diff --git a/content/rancher/v2.6/en/monitoring-alerting/rbac/_index.md b/content/rancher/v2.6/en/monitoring-alerting/rbac/_index.md index ba487525225..e025b733e64 100644 --- a/content/rancher/v2.6/en/monitoring-alerting/rbac/_index.md +++ b/content/rancher/v2.6/en/monitoring-alerting/rbac/_index.md @@ -124,8 +124,8 @@ The relationship between the default roles deployed by Rancher (i.e. cluster-own | --------- | --------- | --------- | --------- | | cluster-owner | cluster-admin | N/A | ClusterRoleBinding | | cluster-member | admin | monitoring-admin | ClusterRoleBinding | -| project-owner | edit | monitoring-admin | RoleBinding within Project namespace | -| project-member | view | monitoring-edit | RoleBinding within Project namespace | +| project-owner | admin | monitoring-admin | RoleBinding within Project namespace | +| project-member | edit | monitoring-edit | RoleBinding within Project namespace | In addition to these default Roles, the following additional Rancher project roles can be applied to members of your Cluster to provide additional access to Monitoring. These Rancher Roles will be tied to ClusterRoles deployed by the Monitoring chart: diff --git a/content/rancher/v2.6/en/project-admin/project-members/_index.md b/content/rancher/v2.6/en/project-admin/project-members/_index.md index c84e655974f..32708445e60 100644 --- a/content/rancher/v2.6/en/project-admin/project-members/_index.md +++ b/content/rancher/v2.6/en/project-admin/project-members/_index.md @@ -38,7 +38,9 @@ Following project creation, you can add users as project members so that they ca >**Notes:** > - >- Users assigned the `Owner` or `Member` role for a project automatically inherit the `namespace creation` role. However, this role is a [Kubernetes ClusterRole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole), meaning its scope extends to all projects in the cluster. Therefore, users explicitly assigned the `Owner` or `Member` role for a project can create namespaces in other projects they're assigned to, even with only the `Read Only` role assigned. + >- Users assigned the `Owner` or `Member` role for a project automatically inherit the `namespace creation` role. However, this role is a [Kubernetes ClusterRole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole), meaning its scope extends to all projects in the cluster. Therefore, users explicitly assigned the `Owner` or `Member` role for a project can create or delete namespaces in other projects they're assigned to, even with only the `Read Only` role assigned. + > + >- By default, the Rancher role of `project-member` inherits from the `Kubernetes-edit` role, and the `project-owner` role inherits from the `Kubernetes-admin` role. As such, both `project-member` and `project-owner` roles will allow for namespace management, including the ability to create and delete namespaces. > >- For `Custom` roles, you can modify the list of individual roles available for assignment. > From 3a0fd481836f817dd33d7998c6600a9b233897f5 Mon Sep 17 00:00:00 2001 From: Felipe Santos Date: Mon, 16 Nov 2020 16:36:15 -0300 Subject: [PATCH 080/478] Add --rm to busybox container Since it is meant to be just a temporary container. Also, put `$PWD` into double quotes to prevent the expansion of multiple parameters if it has space. --- .../single-node-docker/single-node-upgrades/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md index 7ee1d1f9328..42a5504789d 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md @@ -80,7 +80,7 @@ During upgrade, you create a copy of the data from your current Rancher containe ``` - docker run --volumes-from rancher-data -v $PWD:/backup busybox tar zcvf /backup/rancher-data-backup--.tar.gz /var/lib/rancher + docker run --volumes-from rancher-data -v "$PWD:/backup" --rm busybox tar zcvf /backup/rancher-data-backup--.tar.gz /var/lib/rancher ``` **Step Result:** When you enter this command, a series of commands should run. From e6f0152140a773b1fe8c53afafcd940f8aabb843 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Wed, 8 Dec 2021 16:06:55 -0800 Subject: [PATCH 081/478] Apply 3a0fd481 (author: felipecrs) to Rancher v2.0-v2.4 docs --- .../single-node-docker/single-node-upgrades/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.0-v2.4/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md b/content/rancher/v2.0-v2.4/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md index be69fcd235e..7e7e935097c 100644 --- a/content/rancher/v2.0-v2.4/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md +++ b/content/rancher/v2.0-v2.4/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md @@ -86,7 +86,7 @@ During upgrade, you create a copy of the data from your current Rancher containe ``` - docker run --volumes-from rancher-data -v $PWD:/backup busybox tar zcvf /backup/rancher-data-backup--.tar.gz /var/lib/rancher + docker run --volumes-from rancher-data -v "$PWD:/backup" --rm busybox tar zcvf /backup/rancher-data-backup--.tar.gz /var/lib/rancher ``` **Step Result:** When you enter this command, a series of commands should run. From a109bc5670e29e391c0443b705b1bf6adb3a5c66 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Wed, 8 Dec 2021 16:07:14 -0800 Subject: [PATCH 082/478] Apply 3a0fd481 (author: felipecrs) to Rancher v2.5 docs --- .../single-node-docker/single-node-upgrades/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md b/content/rancher/v2.5/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md index ce5f6c3f6c2..6c55386d77d 100644 --- a/content/rancher/v2.5/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md +++ b/content/rancher/v2.5/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md @@ -87,7 +87,7 @@ During upgrade, you create a copy of the data from your current Rancher containe ``` - docker run --volumes-from rancher-data -v $PWD:/backup busybox tar zcvf /backup/rancher-data-backup--.tar.gz /var/lib/rancher + docker run --volumes-from rancher-data -v "$PWD:/backup" --rm busybox tar zcvf /backup/rancher-data-backup--.tar.gz /var/lib/rancher ``` **Step Result:** When you enter this command, a series of commands should run. From 262925100b5ef75d45efd2aacae09bbc0f21a976 Mon Sep 17 00:00:00 2001 From: Frank <639906+syphernl@users.noreply.github.com> Date: Thu, 9 Dec 2021 08:01:52 +0100 Subject: [PATCH 083/478] Update _index.md --- .../en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md index 51d0f9331a7..f4e2228f244 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md @@ -31,7 +31,7 @@ The following steps will quickly deploy a Rancher Server on Hetzner Cloud with a See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Hetzner Quickstart Readme](https://github.com/rancher/quickstart/tree/master/hcloud) for more information. Suggestions include: - `prefix` - Prefix for all created resources - - `instance_type` - Instance type, minimum required is `cx22` as `cx11` offers not enough memory. + - `instance_type` - Instance type, minimum required is `cx22` - `ssh_key_file_name` - Use a specific SSH key instead of `~/.ssh/id_rsa` (public key is assumed to be `${ssh_key_file_name}.pub`) 1. Run `terraform init`. From 66ba31ade547ae38d2a5813b4820d294fb10add3 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Thu, 9 Dec 2021 12:40:37 -0500 Subject: [PATCH 084/478] Revised per feedback --- content/k3s/latest/en/upgrades/_index.md | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/content/k3s/latest/en/upgrades/_index.md b/content/k3s/latest/en/upgrades/_index.md index 2b93db7e474..fad09759854 100644 --- a/content/k3s/latest/en/upgrades/_index.md +++ b/content/k3s/latest/en/upgrades/_index.md @@ -3,22 +3,22 @@ title: "Upgrades" weight: 25 --- -This section describes how to upgrade your K3s cluster. +### Upgrading your K3s cluster [Upgrade basics]({{< baseurl >}}/k3s/latest/en/upgrades/basic/) describes several techniques for upgrading your cluster manually. It can also be used as a basis for upgrading through third-party Infrastructure-as-Code tools like [Terraform](https://www.terraform.io/). [Automated upgrades]({{< baseurl >}}/k3s/latest/en/upgrades/automated/) describes how to perform Kubernetes-native automated upgrades using Rancher's [system-upgrade-controller](https://github.com/rancher/system-upgrade-controller). -> **Important notes on upgrades:** -> -> - **Traefik:** If Traefik is not disabled, K3s versions 1.20 and earlier will install Traefik v1, while K3s versions 1.21 and later will install Traefik v2, if v1 is not already present. To upgrade from the older Traefik v1 to Traefik v2, please refer to the [Traefik documentation](https://doc.traefik.io/traefik/migration/v1-to-v2/) and use the [migration tool](https://github.com/traefik/traefik-migration-tool). -> -> - **Experimental Dqlite:** The experimental embedded Dqlite data store was deprecated in K3s v1.19.1. Please note that upgrades from experimental Dqlite to experimental embedded etcd are not supported. If you attempt an upgrade, it will not succeed, and data will be lost. -> -> - **K3s bootstrap data:** If you are using K3s in an HA configuration with an external SQL datastore, and your server (control-plane) nodes were not started with the `--token` CLI flag, you will no longer be able to add additional K3s servers to the cluster without specifying the token. Ensure that you retain a copy of this token, as it is required when restoring from backup. Previously, K3s did not enforce the use of a token when using external SQL datastores. -> - The affected versions are <= v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1; the patched versions are v1.19.13+k3s1, v1.20.9+k3s1, v1.21.3+k3s1. -> -> - You may retrieve the token value from any server already joined to the cluster as follows: +### Version-specific caveats + +- **Traefik:** If Traefik is not disabled, K3s versions 1.20 and earlier will install Traefik v1, while K3s versions 1.21 and later will install Traefik v2, if v1 is not already present. To upgrade from the older Traefik v1 to Traefik v2, please refer to the [Traefik documentation](https://doc.traefik.io/traefik/migration/v1-to-v2/) and use the [migration tool](https://github.com/traefik/traefik-migration-tool). + +- **K3s bootstrap data:** If you are using K3s in an HA configuration with an external SQL datastore, and your server (control-plane) nodes were not started with the `--token` CLI flag, you will no longer be able to add additional K3s servers to the cluster without specifying the token. Ensure that you retain a copy of this token, as it is required when restoring from backup. Previously, K3s did not enforce the use of a token when using external SQL datastores. + - The affected versions are <= v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1; the patched versions are v1.19.13+k3s1, v1.20.9+k3s1, v1.21.3+k3s1. + + - You may retrieve the token value from any server already joined to the cluster as follows: ``` cat /var/lib/rancher/k3s/server/token ``` + +- **Experimental Dqlite:** The experimental embedded Dqlite data store was deprecated in K3s v1.19.1. Please note that upgrades from experimental Dqlite to experimental embedded etcd are not supported. If you attempt an upgrade, it will not succeed, and data will be lost. From ee88b613e0a32fb837ea849d193051d1706e6f59 Mon Sep 17 00:00:00 2001 From: Manuel Buil Date: Wed, 8 Dec 2021 16:15:32 +0100 Subject: [PATCH 085/478] Add config flags that must be shared across server nodes Signed-off-by: Manuel Buil --- content/k3s/latest/en/installation/ha-embedded/_index.md | 6 ++++++ content/k3s/latest/en/installation/ha/_index.md | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/content/k3s/latest/en/installation/ha-embedded/_index.md b/content/k3s/latest/en/installation/ha-embedded/_index.md index f8fe7d2ebea..9526a67c61e 100644 --- a/content/k3s/latest/en/installation/ha-embedded/_index.md +++ b/content/k3s/latest/en/installation/ha-embedded/_index.md @@ -23,3 +23,9 @@ K3S_TOKEN=SECRET k3s server --server https://:6443 ``` Now you have a highly available control plane. Joining additional worker nodes to the cluster follows the same procedure as a single server cluster. + +There are a few config flags that must be the same in all server nodes: + +* Network related flags: `--cluster-dns`, `--cluster-domain`, `--cluster-cidr`, `--service-cidr` +* Flags controlling the deployment of certain components: `--disable-helm-controller`, `--disable-kube-proxy`, `--disable-network-policy` and any component passed to `--disable` +* Feature related flags: `--secrets-encryption` diff --git a/content/k3s/latest/en/installation/ha/_index.md b/content/k3s/latest/en/installation/ha/_index.md index 92886efbe56..a7bc5491eac 100644 --- a/content/k3s/latest/en/installation/ha/_index.md +++ b/content/k3s/latest/en/installation/ha/_index.md @@ -80,6 +80,12 @@ curl -sfL https://get.k3s.io | sh -s - server \ --datastore-endpoint="mysql://username:password@tcp(hostname:3306)/database-name" ``` +There are a few config flags that must be the same in all server nodes: + +* Network related flags: `--cluster-dns`, `--cluster-domain`, `--cluster-cidr`, `--service-cidr` +* Flags controlling the deployment of certain components: `--disable-helm-controller`, `--disable-kube-proxy`, `--disable-network-policy` and any component passed to `--disable` +* Feature related flags: `--secrets-encryption` + > **Note:** Ensure that you retain a copy of this token as it is required when restoring from backup and adding nodes. Previously, K3s did not enforce the use of a token when using external SQL datastores. ### 5. Optional: Join Agent Nodes From 22a1b8b9528c4ae0595d2622932d2d672796ae65 Mon Sep 17 00:00:00 2001 From: Frank <639906+syphernl@users.noreply.github.com> Date: Thu, 9 Dec 2021 19:41:39 +0100 Subject: [PATCH 086/478] Update _index.md --- .../en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md index f4e2228f244..f0fc2c964a3 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md @@ -31,7 +31,7 @@ The following steps will quickly deploy a Rancher Server on Hetzner Cloud with a See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Hetzner Quickstart Readme](https://github.com/rancher/quickstart/tree/master/hcloud) for more information. Suggestions include: - `prefix` - Prefix for all created resources - - `instance_type` - Instance type, minimum required is `cx22` + - `instance_type` - Instance type, minimum required is `cx21` - `ssh_key_file_name` - Use a specific SSH key instead of `~/.ssh/id_rsa` (public key is assumed to be `${ssh_key_file_name}.pub`) 1. Run `terraform init`. From 62724132c8e3880f8745f19a123de244c90369ca Mon Sep 17 00:00:00 2001 From: Derek Nola Date: Thu, 9 Dec 2021 10:54:24 -0800 Subject: [PATCH 087/478] Update install command for etcdctl Signed-off-by: Derek Nola --- content/k3s/latest/en/advanced/_index.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/content/k3s/latest/en/advanced/_index.md b/content/k3s/latest/en/advanced/_index.md index 494650ebf82..6743da6cfc6 100644 --- a/content/k3s/latest/en/advanced/_index.md +++ b/content/k3s/latest/en/advanced/_index.md @@ -126,9 +126,8 @@ etcdctl provides a CLI for etcd. If you would like to use etcdctl after installing K3s with embedded etcd, install etcdctl using the [official documentation.](https://etcd.io/docs/latest/install/) ``` -$ VERSION="v3.5.0" -$ curl -L https://github.com/etcd-io/etcd/releases/download/${VERSION}/etcd-${VERSION}-linux-amd64.tar.gz --output etcdctl-${VERSION}-linux-amd64.tar.gz -$ sudo tar -zxvf etcdctl-${VERSION}-linux-amd64.tar.gz -C /usr/local/bin +$ VERSION="v3.5.0" curl -L https://github.com/etcd-io/etcd/releases/download/${VERSION}/etcd-${VERSION}-linux-amd64.tar.gz --output etcdctl-linux-amd64.tar.gz +$ sudo tar -zxvf etcdctl-linux-amd64.tar.gz --strip-components=1 -C /usr/local/bin etcd-v3.5.0-linux-amd64/etcdctl ``` Then start using etcdctl commands with the appropriate K3s flags: From 200579854e6a923c5838a088f15611f7dbf52020 Mon Sep 17 00:00:00 2001 From: Derek Nola Date: Thu, 9 Dec 2021 13:22:28 -0800 Subject: [PATCH 088/478] PostgreSQL typo fix Signed-off-by: Derek Nola --- content/k3s/latest/en/installation/datastore/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/k3s/latest/en/installation/datastore/_index.md b/content/k3s/latest/en/installation/datastore/_index.md index 059d73e16fe..b5476b42f35 100644 --- a/content/k3s/latest/en/installation/datastore/_index.md +++ b/content/k3s/latest/en/installation/datastore/_index.md @@ -23,7 +23,7 @@ If you wish to use an external datastore such as PostgreSQL, MySQL, or etcd you CLI Flag | Environment Variable | Description ------------|-------------|------------------ - `--datastore-endpoint` | `K3S_DATASTORE_ENDPOINT` | Specify a PostgresSQL, MySQL, or etcd connection string. This is a string used to describe the connection to the datastore. The structure of this string is specific to each backend and is detailed below. + `--datastore-endpoint` | `K3S_DATASTORE_ENDPOINT` | Specify a PostgreSQL, MySQL, or etcd connection string. This is a string used to describe the connection to the datastore. The structure of this string is specific to each backend and is detailed below. `--datastore-cafile` | `K3S_DATASTORE_CAFILE` | TLS Certificate Authority (CA) file used to help secure communication with the datastore. If your datastore serves requests over TLS using a certificate signed by a custom certificate authority, you can specify that CA using this parameter so that the K3s client can properly verify the certificate. | | `--datastore-certfile` | `K3S_DATASTORE_CERTFILE` | TLS certificate file used for client certificate based authentication to your datastore. To use this feature, your datastore must be configured to support client certificate based authentication. If you specify this parameter, you must also specify the `datastore-keyfile` parameter. | | `--datastore-keyfile` | `K3S_DATASTORE_KEYFILE` | TLS key file used for client certificate based authentication to your datastore. See the previous `datastore-certfile` parameter for more details. | @@ -81,7 +81,7 @@ The above assumes a typical three node etcd cluster. The parameter can accept on {{% /tab %}} {{% /tabs %}} -
Based on the above, the following example command could be used to launch a server instance that connects to a PostgresSQL database named k3s: +
Based on the above, the following example command could be used to launch a server instance that connects to a PostgreSQL database named k3s: ``` K3S_DATASTORE_ENDPOINT='postgres://username:password@hostname:5432/k3s' k3s server ``` From de1df25b7e40cfc0b4410e01d479710df1606780 Mon Sep 17 00:00:00 2001 From: Derek Nola Date: Thu, 9 Dec 2021 14:04:05 -0800 Subject: [PATCH 089/478] Initial secrets-encrypt guides Signed-off-by: Derek Nola --- content/k3s/latest/en/advanced/_index.md | 39 ---- .../en/security/secrets_encryption/_index.md | 195 ++++++++++++++++++ 2 files changed, 195 insertions(+), 39 deletions(-) create mode 100644 content/k3s/latest/en/security/secrets_encryption/_index.md diff --git a/content/k3s/latest/en/advanced/_index.md b/content/k3s/latest/en/advanced/_index.md index 494650ebf82..bed44cebd97 100644 --- a/content/k3s/latest/en/advanced/_index.md +++ b/content/k3s/latest/en/advanced/_index.md @@ -13,7 +13,6 @@ This section contains advanced information describing the different ways you can - [Using Docker as the container runtime](#using-docker-as-the-container-runtime) - [Using etcdctl](#using-etcdctl) - [Configuring containerd](#configuring-containerd) -- [Secrets Encryption Config (Experimental)](#secrets-encryption-config-experimental) - [Running K3s with Rootless mode (Experimental)](#running-k3s-with-rootless-mode-experimental) - [Node labels and taints](#node-labels-and-taints) - [Starting the server with the installation script](#starting-the-server-with-the-installation-script) @@ -145,44 +144,6 @@ For advanced customization for this file you can create another file called `con The `config.toml.tmpl` will be treated as a Go template file, and the `config.Node` structure is being passed to the template. [This template](https://github.com/rancher/k3s/blob/master/pkg/agent/templates/templates.go#L16-L32) example on how to use the structure to customize the configuration file. -# Secrets Encryption Config (Experimental) -As of v1.17.4+k3s1, K3s added the experimental feature of enabling secrets encryption at rest by passing the flag `--secrets-encryption` on a server, this flag will do the following automatically: - -- Generate an AES-CBC key -- Generate an encryption config file with the generated key - -``` -{ - "kind": "EncryptionConfiguration", - "apiVersion": "apiserver.config.k8s.io/v1", - "resources": [ - { - "resources": [ - "secrets" - ], - "providers": [ - { - "aescbc": { - "keys": [ - { - "name": "aescbckey", - "secret": "xxxxxxxxxxxxxxxxxxx" - } - ] - } - }, - { - "identity": {} - } - ] - } - ] -} -``` - -- Pass the config to the KubeAPI as encryption-provider-config - -Once enabled any created secret will be encrypted with this key. Note that if you disable encryption then any encrypted secrets will not be readable until you enable encryption again. # Running K3s with Rootless mode (Experimental) diff --git a/content/k3s/latest/en/security/secrets_encryption/_index.md b/content/k3s/latest/en/security/secrets_encryption/_index.md new file mode 100644 index 00000000000..e6f626c7af4 --- /dev/null +++ b/content/k3s/latest/en/security/secrets_encryption/_index.md @@ -0,0 +1,195 @@ +--- +title: Secrets Encryption +weight: 26 +--- + +# Secrets Encryption Config +_Avaliable as of v1.17.4+k3s1_ + +K3s supports enabling secrets encryption at rest by passing the flag `--secrets-encryption` on a server, this flag will do the following automatically: + +- Generate an AES-CBC key +- Generate an encryption config file with the generated key +- Pass the config to the KubeAPI as encryption-provider-config + +Example of the encryption config file: +``` +{ + "kind": "EncryptionConfiguration", + "apiVersion": "apiserver.config.k8s.io/v1", + "resources": [ + { + "resources": [ + "secrets" + ], + "providers": [ + { + "aescbc": { + "keys": [ + { + "name": "aescbckey", + "secret": "xxxxxxxxxxxxxxxxxxx" + } + ] + } + }, + { + "identity": {} + } + ] + } + ] +} +``` + + +## Secrets Encryption Tool +_Avaliable as of v1.21.8+k3s1_ + +K3s contains a utility tool `secrets-encrypt`, which enable automatic control over: + +- Disabling/Enabling secrets encryption +- Adding new encryption keys +- Rotating and deleting encryption keys +- Reencrypting secrets + +>**Warning** Failure to follow proper procedure for rotating encryption keys can leave your cluster permanently corrupted. Proceed with caution. + +### Single-Server Encryption Key Rotation +To rotate secrets encryption keys on a single-node cluster: + +- Start the K3s server with the flag `--secrets-encryption` + +>**Note** Starting K3s without encryption and enabling it at a later time is currently *not* supported. + +1. Prepare + + ``` + k3s secrets-encrypt prepare + ``` + +2. Kill and restart the K3s server with same arguments +3. Rotate + + ``` + k3s secrets-encrypt rotate + ``` + +4. Kill and restart the K3s server with same arguments +5. Reencrypt + + ``` + k3s secrets-encrypt reencrypt + ``` + +### High-Availability Encryption Key Rotation +The steps are the same for both embedded DB and external DB clusters. + +To rotate secrets encryption keys on HA setups: + +>**Note** While not required, it is recommended that you pick one server node from which to run the `secrets-encrypt` commands. + +- Start up 3 K3s servers, all with the `--secrets-encrytion` flag. For brevity, the servers will be referred to as S1, S2, S3. + +1. Prepare on S1 + + ``` + k3s secrets-encrypt prepare + ``` + +2. Kill and restart S1 with same arguments +3. Once S1 is up, kill and restart the S2 and S3 + +4. Rotate on S1 + + ``` + k3s secrets-encrypt rotate + ``` + +5. Kill and restart S1 with same arguments +6. Once S1 is up, kill and restart the S2 and S3 + +7. Reencrypt on S1 + + ``` + k3s secrets-encrypt reencrypt + ``` + +8. Kill and restart S1 with same arguments +9. Once S1 is up, kill and restart the S2 and S3 + +### Single-Server Secrets Encryption Disable/Enable +After launching a server with `--secrets-encryption` flag, secrets encryption can be disabled. + +To disable secrets encryption on a single-node cluster: + +1. Disable + + ``` + k3s secrets-encrypt disable + ``` + +2. Kill and restart the K3s server with same arguments + +3. Reencrypt with flags + + ``` + k3s secrets-encrypt reencrypt --force --skip + ``` + +To re-enable secrets encryption on a single node cluster: + +1. Enable + + ``` + k3s secrets-encrypt enable + ``` + +2. Kill and restart the K3s server with same arguments + +3. Reencrypt with flags + + ``` + k3s secrets-encrypt reencrypt --force --skip + ``` + +### High-Avaliability Secrets Encryption Disable/Enable +After launching a HA cluster with `--secrets-encryption` flags, secrets encryption can be disabled. +>**Note** While not required, it is recommended that you pick one server node from which to run the `secrets-encrypt` commands. + +For brevity, the three servers used in this guide will be referred to as S1, S2, S3. + +To disable secrets encryption on a HA cluster: + +1. Disable on S1 + + ``` + k3s secrets-encrypt disable + ``` + +2. Kill and restart S1 with same arguments +3. Once S1 is up, kill and restart the S2 and S3 + + +4. Reencrypt with flags on S1 + + ``` + k3s secrets-encrypt reencrypt --force --skip + ``` + +To re-enable secrets encryption on a HA cluster: + +1. Enable on S1 + + ``` + k3s secrets-encrypt enable + ``` + +2. Kill and restart S1 with same arguments +3. Once S1 is up, kill and restart the S2 and S3 + +4. Reencrypt with flags on S1 + + ``` + k3s secrets-encrypt reencrypt --force --skip + ``` \ No newline at end of file From 92aea7cfd080fdc0628d5efe9500cfb684f5bd85 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Thu, 9 Dec 2021 17:28:59 -0500 Subject: [PATCH 090/478] Corrected links --- content/rancher/v2.5/en/backups/back-up-rancher/_index.md | 4 ++-- .../rancher/v2.5/en/deploy-across-clusters/fleet/_index.md | 4 ++-- .../rancher/v2.6/en/deploy-across-clusters/fleet/_index.md | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/content/rancher/v2.5/en/backups/back-up-rancher/_index.md b/content/rancher/v2.5/en/backups/back-up-rancher/_index.md index aea4c343489..ea006b8343e 100644 --- a/content/rancher/v2.5/en/backups/back-up-rancher/_index.md +++ b/content/rancher/v2.5/en/backups/back-up-rancher/_index.md @@ -7,7 +7,7 @@ aliases: - /rancher/v2.x/en/backups/v2.5/back-up-rancher/ --- -In this section, you'll learn how to back up Rancher running on any Kubernetes cluster. To backup Rancher installed with Docker, refer the instructions for [single node backups]({{}}/rancher/v2.5/en/backups/v2.5/docker-installs/docker-backups) +In this section, you'll learn how to back up Rancher running on any Kubernetes cluster. To backup Rancher installed with Docker, refer to the instructions for [single node backups]({{}}/rancher/v2.5/en/backups/v2.5/docker-installs/docker-backups). The backup-restore operator needs to be installed in the local cluster, and only backs up the Rancher app. The backup and restore operations are performed only in the local Kubernetes cluster. @@ -28,7 +28,7 @@ Backups are created as .tar.gz files. These files can be pushed to S3 or Minio, 1. Click **Rancher Backups.** 1. Configure the default storage location. For help, refer to the [storage configuration section.](../configuration/storage-config) ->**NOTE:** There are two known issues in Fleet that occur after performing a restoration using the backup-restore-operator: Fleet agents are inoperable and clientSecretName and helmSecretName are not included in Fleet gitrepos. Refer [here]({{}}rancher/v2.5/en/deploy-across-clusters/fleet/#troubleshooting) for workarounds. +>**NOTE:** There are two known issues in Fleet that occur after performing a restoration using the backup-restore-operator: Fleet agents are inoperable and clientSecretName and helmSecretName are not included in Fleet gitrepos. Refer [here]({{}}/rancher/v2.5/en/deploy-across-clusters/fleet/#troubleshooting) for workarounds. ### 2. Perform a Backup diff --git a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md index 0f62de9cc37..9774589340a 100644 --- a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md +++ b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md @@ -71,7 +71,7 @@ The Helm chart in the git repository must include its dependencies in the charts # Troubleshooting --- -* **Known Issue:** Fleet becomes inoperable after a restore using the [backup-restore-operator]({{}}rancher/v2.5/en/backups/back-up-rancher/#1-install-the-rancher-backup-operator). We will update the community once a permanent solution is in place. +* **Known Issue:** Fleet becomes inoperable after a restore using the [backup-restore-operator]({{}}/rancher/v2.5/en/backups/back-up-rancher/#1-install-the-rancher-backup-operator). We will update the community once a permanent solution is in place. * **Temporary Workaround:**
1. Find the two service account tokens listed in the fleet-controller and the fleet-controller-bootstrap service accounts. These are under the fleet-system namespace of the local cluster.
@@ -81,7 +81,7 @@ The Helm chart in the git repository must include its dependencies in the charts 5. If the fleet-agent bundles remain in a `Modified` state after Step 4, update the field `spec.forceSyncGeneration` for the fleet-agent bundle to force re-creation. --- -* **Known Issue:** clientSecretName and helmSecretName secrets for Fleet gitrepos are not included in the backup nor restore created by the [backup-restore-operator]({{}}rancher/v2.5/en/backups/back-up-rancher/#1-install-the-rancher-backup-operator). We will update the community once a permanent solution is in place. +* **Known Issue:** clientSecretName and helmSecretName secrets for Fleet gitrepos are not included in the backup nor restore created by the [backup-restore-operator]({{}}/rancher/v2.5/en/backups/back-up-rancher/#1-install-the-rancher-backup-operator). We will update the community once a permanent solution is in place. * **Temporary Workaround:**
By default, user-defined secrets are not backed up in Fleet. It is necessary to recreate secrets if performing a disaster recovery restore or migration of Rancher into a fresh cluster. To modify resourceSet to include extra resources you want to backup, refer to docs [here](https://github.com/rancher/backup-restore-operator#user-flow). diff --git a/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md b/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md index 806ad0e06f7..1b129ee97f0 100644 --- a/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md +++ b/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md @@ -64,7 +64,7 @@ The Helm chart in the git repository must include its dependencies in the charts # Troubleshooting --- -* **Known Issue:** clientSecretName and helmSecretName secrets for Fleet gitrepos are not included in the backup nor restore created by the [backup-restore-operator]({{}}rancher/v2.6/en/backups/back-up-rancher/#1-install-the-rancher-backups-operator). We will update the community once a permanent solution is in place. +* **Known Issue:** clientSecretName and helmSecretName secrets for Fleet gitrepos are not included in the backup nor restore created by the [backup-restore-operator]({{}}/rancher/v2.6/en/backups/back-up-rancher/#1-install-the-rancher-backups-operator). We will update the community once a permanent solution is in place. * **Temporary Workaround:**
By default, user-defined secrets are not backed up in Fleet. It is necessary to recreate secrets if performing a disaster recovery restore or migration of Rancher into a fresh cluster. To modify resourceSet to include extra resources you want to backup, refer to docs [here](https://github.com/rancher/backup-restore-operator#user-flow). From 7a195a89c198bdcbc6803af5003bede1dc3287e9 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 9 Dec 2021 14:51:15 -0800 Subject: [PATCH 091/478] Add page alias - fixes 404 --- content/rancher/v2.0-v2.4/en/best-practices/management/_index.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/rancher/v2.0-v2.4/en/best-practices/management/_index.md b/content/rancher/v2.0-v2.4/en/best-practices/management/_index.md index b95730d55be..5e23755f729 100644 --- a/content/rancher/v2.0-v2.4/en/best-practices/management/_index.md +++ b/content/rancher/v2.0-v2.4/en/best-practices/management/_index.md @@ -4,6 +4,7 @@ weight: 101 aliases: - /rancher/v2.0-v2.4/en/best-practices/management - /rancher/v2.0-v2.4/en/best-practices/v2.0-v2.4/management + - /rancher/v2.x/en/best-practices/management/ - /rancher/v2.x/en/best-practices/v2.0-v2.4/management/ --- From 6fd2b960e43fc43fb329be27021def2bea1bff89 Mon Sep 17 00:00:00 2001 From: Manuel Buil Date: Fri, 10 Dec 2021 13:47:02 +0100 Subject: [PATCH 092/478] Add security warning Signed-off-by: Manuel Buil --- .../latest/en/installation/installation-requirements/_index.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/k3s/latest/en/installation/installation-requirements/_index.md b/content/k3s/latest/en/installation/installation-requirements/_index.md index 1b5d14825de..3daee8b3ccc 100644 --- a/content/k3s/latest/en/installation/installation-requirements/_index.md +++ b/content/k3s/latest/en/installation/installation-requirements/_index.md @@ -51,6 +51,7 @@ If you wish to utilize the metrics server, you will need to open port 10250 on e If you plan on achieving high availability with embedded etcd, server nodes must be accessible to each other on ports 2379 and 2380. > **Important:** The VXLAN port on nodes should not be exposed to the world as it opens up your cluster network to be accessed by anyone. Run your nodes behind a firewall/security group that disables access to port 8472. +> **Warning:** Flannel relies on the [Bridge CNI plugin](https://www.cni.dev/plugins/current/main/bridge/) to create a L2 network that switches traffic. Rogue pods with NET_RAW capabilities can abuse that L2 network to launch attacks such as [ARP spoofing](https://static.sched.com/hosted_files/kccncna19/72/ARP%20DNS%20spoof.pdf). Therefore, as documented in the [kubernetes docs](https://kubernetes.io/docs/concepts/security/pod-security-standards/), please set a restricted profile that disables NET_RAW on non-trustable pods.
Inbound Rules for K3s Server Nodes
From e9a4a29a13bd9d47ab113e43cca2fe16bb6249b1 Mon Sep 17 00:00:00 2001 From: Vasili Date: Sat, 11 Dec 2021 00:01:20 +0200 Subject: [PATCH 093/478] Improve grammar --- .../v2.6/en/overview/architecture-recommendations/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md b/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md index b679b3a3f72..282ae413971 100644 --- a/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md +++ b/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md @@ -32,7 +32,7 @@ We don't recommend installing Rancher in a single Docker container, because if t ### K3s Kubernetes Cluster Installations -One option for the underlying Kubernetes cluster is to use K3s Kubernetes. K3s Rancher's CNCF certified Kubernetes distribution. It is easy to install, with half the memory of Kubernetes, all in a binary less than 100 MB. One main advantage of this K3s architecture is that it allows an external datastore to hold the cluster data, allowing the K3s server nodes to be treated as ephemeral. +One option for the underlying Kubernetes cluster is to use K3s Kubernetes. K3s is Rancher's CNCF certified Kubernetes distribution. It is easy to install and uses half the memory of Kubernetes, all in a binary of less than 100 MB. Another advantage of K3s is that it allows an external datastore to hold the cluster data, allowing the K3s server nodes to be treated as ephemeral.
Architecture of a K3s Kubernetes Cluster Running the Rancher Management Server
![Architecture of a K3s Kubernetes Cluster Running the Rancher Management Server]({{}}/img/rancher/k3s-server-storage.svg) From d6871c51beaf89f7107a66dbe4c844c2e80c723d Mon Sep 17 00:00:00 2001 From: Derek Nola Date: Fri, 10 Dec 2021 15:19:10 -0800 Subject: [PATCH 094/478] Status info Signed-off-by: Derek Nola --- .../en/security/secrets_encryption/_index.md | 44 ++++++++++++++++++- 1 file changed, 43 insertions(+), 1 deletion(-) diff --git a/content/k3s/latest/en/security/secrets_encryption/_index.md b/content/k3s/latest/en/security/secrets_encryption/_index.md index e6f626c7af4..9259e4931a9 100644 --- a/content/k3s/latest/en/security/secrets_encryption/_index.md +++ b/content/k3s/latest/en/security/secrets_encryption/_index.md @@ -192,4 +192,46 @@ To re-enable secrets encryption on a HA cluster: ``` k3s secrets-encrypt reencrypt --force --skip - ``` \ No newline at end of file + ``` + + +### Secrets Encryption Status +The secrets-encrypt tool includes a `status` command that displays information about the current status of secrets encryption on the node. + +An example of the command on a single-server node: +``` +$ k3s secrets-encrypt status +Encryption Status: Enabled +Current Rotation Stage: start +Server Encryption Hashes: All hashes match + +Active Key Type Name +------ -------- ---- + * AES-CBC aescbckey + +``` + +Another example on HA cluster, after rotating the keys, but before restarting the servers: +``` +$ k3s secrets-encrypt status +Encryption Status: Enabled +Current Rotation Stage: rotate +Server Encryption Hashes: hash does not match between node-1 and node-2 + +Active Key Type Name +------ -------- ---- + * AES-CBC aescbckey-2021-12-10T22:54:38Z + AES-CBC aescbckey + +``` + +Details on each section are as followed: + +- __Encryption Status__: Displayed whether secrets encryption is disabled or enabled on the node +- __Current Rotation Stage__: Indicates the current rotation stage on the node. + Stages are: `start`, `prepare`, `rotate`, `reencrypt_request`, `reencrypt_active`, `reencrypt_finished` +- __Server Encryption Hashes__: Useful for HA clusters, this indicates whether all server are on the same stage with their local files. This can be used to identify whether a restart of servers is required before proceeding to the next stage. In the HA example above, node-1 and node-2 different hashes, indicating that they currently do not have the same encryption configuration. Restarting the servers will sync up their configuration. +- __Key Table__: Summarizes information about the secrets encryption keys found on the node. + * __Active__: The "*" indicates which, if any, of the keys are currently used for secrets encryption. An active key is used by kubernetes to encrypt any new secrets. + * __Key Type__: All keys using this tool are `AES-CBC` type. See more info [here.](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#providers) + * __Name__: Name of the encryption key. \ No newline at end of file From 6c713a745a98610141079fbb783c14bafc21c4ee Mon Sep 17 00:00:00 2001 From: Derek Nola Date: Fri, 10 Dec 2021 15:20:54 -0800 Subject: [PATCH 095/478] Use version Signed-off-by: Derek Nola --- content/k3s/latest/en/advanced/_index.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/content/k3s/latest/en/advanced/_index.md b/content/k3s/latest/en/advanced/_index.md index 6743da6cfc6..860a56a7d94 100644 --- a/content/k3s/latest/en/advanced/_index.md +++ b/content/k3s/latest/en/advanced/_index.md @@ -126,8 +126,9 @@ etcdctl provides a CLI for etcd. If you would like to use etcdctl after installing K3s with embedded etcd, install etcdctl using the [official documentation.](https://etcd.io/docs/latest/install/) ``` -$ VERSION="v3.5.0" curl -L https://github.com/etcd-io/etcd/releases/download/${VERSION}/etcd-${VERSION}-linux-amd64.tar.gz --output etcdctl-linux-amd64.tar.gz -$ sudo tar -zxvf etcdctl-linux-amd64.tar.gz --strip-components=1 -C /usr/local/bin etcd-v3.5.0-linux-amd64/etcdctl +$ VERSION="v3.5.0" +$ curl -L https://github.com/etcd-io/etcd/releases/download/${VERSION}/etcd-${VERSION}-linux-amd64.tar.gz --output etcdctl-linux-amd64.tar.gz +$ sudo tar -zxvf etcdctl-linux-amd64.tar.gz --strip-components=1 -C /usr/local/bin etcd-${VERSION}-linux-amd64/etcdctl ``` Then start using etcdctl commands with the appropriate K3s flags: From 33165e0bf7fde6c98ba4c9cac0973e3c0e1fdd27 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Fri, 10 Dec 2021 16:35:38 -0800 Subject: [PATCH 096/478] Apply PR #3734 (d161b505) to Rancher v2.5 docs --- .../v2.5/en/overview/architecture-recommendations/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.5/en/overview/architecture-recommendations/_index.md b/content/rancher/v2.5/en/overview/architecture-recommendations/_index.md index a2aa6faf9f5..25029e83663 100644 --- a/content/rancher/v2.5/en/overview/architecture-recommendations/_index.md +++ b/content/rancher/v2.5/en/overview/architecture-recommendations/_index.md @@ -34,7 +34,7 @@ We don't recommend installing Rancher in a single Docker container, because if t ### K3s Kubernetes Cluster Installations -One option for the underlying Kubernetes cluster is to use K3s Kubernetes. K3s Rancher's CNCF certified Kubernetes distribution. It is easy to install, with half the memory of Kubernetes, all in a binary less than 100 MB. One main advantage of this K3s architecture is that it allows an external datastore to hold the cluster data, allowing the K3s server nodes to be treated as ephemeral. +One option for the underlying Kubernetes cluster is to use K3s Kubernetes. K3s is Rancher's CNCF certified Kubernetes distribution. It is easy to install and uses half the memory of Kubernetes, all in a binary of less than 100 MB. Another advantage of K3s is that it allows an external datastore to hold the cluster data, allowing the K3s server nodes to be treated as ephemeral.
Architecture of a K3s Kubernetes Cluster Running the Rancher Management Server
![Architecture of a K3s Kubernetes Cluster Running the Rancher Management Server]({{}}/img/rancher/k3s-server-storage.svg) @@ -110,4 +110,4 @@ For more best practices for downstream clusters, refer to the [production checkl If you are using an [authorized cluster endpoint,]({{}}/rancher/v2.5/en/overview/architecture/#4-authorized-cluster-endpoint) we recommend creating an FQDN pointing to a load balancer which balances traffic across your nodes with the `controlplane` role. -If you are using private CA signed certificates on the load balancer, you have to supply the CA certificate, which will be included in the generated kubeconfig file to validate the certificate chain. See the documentation on [kubeconfig files]({{}}/rancher/v2.5/en/k8s-in-rancher/kubeconfig/) and [API keys]({{}}/rancher/v2.5/en/user-settings/api-keys/#creating-an-api-key) for more information. \ No newline at end of file +If you are using private CA signed certificates on the load balancer, you have to supply the CA certificate, which will be included in the generated kubeconfig file to validate the certificate chain. See the documentation on [kubeconfig files]({{}}/rancher/v2.5/en/k8s-in-rancher/kubeconfig/) and [API keys]({{}}/rancher/v2.5/en/user-settings/api-keys/#creating-an-api-key) for more information. From 1aa26583deae490479a791034961ff10ec7a9bd7 Mon Sep 17 00:00:00 2001 From: Bastian Hofmann Date: Mon, 13 Dec 2021 17:18:40 +0100 Subject: [PATCH 097/478] Update vagrant quickstart IP The IPs were changed in https://github.com/rancher/quickstart/pull/191 to support the latest VirtualBox version on Mac Signed-off-by: Bastian Hofmann --- .../quick-start-guide/deployment/quickstart-vagrant/_index.md | 2 +- .../quick-start-guide/deployment/quickstart-vagrant/_index.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.5/en/quick-start-guide/deployment/quickstart-vagrant/_index.md b/content/rancher/v2.5/en/quick-start-guide/deployment/quickstart-vagrant/_index.md index b175645408d..d959a0e5db0 100644 --- a/content/rancher/v2.5/en/quick-start-guide/deployment/quickstart-vagrant/_index.md +++ b/content/rancher/v2.5/en/quick-start-guide/deployment/quickstart-vagrant/_index.md @@ -32,7 +32,7 @@ The following steps quickly deploy a Rancher Server with a single node cluster a 4. To initiate the creation of the environment run, `vagrant up --provider=virtualbox`. -5. Once provisioning finishes, go to `https://172.22.101.101` in the browser. The default user/password is `admin/admin`. +5. Once provisioning finishes, go to `https://192.168.56.101` in the browser. The default user/password is `admin/admin`. **Result:** Rancher Server and your Kubernetes cluster is installed on VirtualBox. diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-vagrant/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-vagrant/_index.md index 3f22066b26a..0eb0d0ef169 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-vagrant/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-vagrant/_index.md @@ -30,7 +30,7 @@ The following steps quickly deploy a Rancher Server with a single node cluster a 4. To initiate the creation of the environment run, `vagrant up --provider=virtualbox`. -5. Once provisioning finishes, go to `https://172.22.101.101` in the browser. The default user/password is `admin/admin`. +5. Once provisioning finishes, go to `https://192.168.56.101` in the browser. The default user/password is `admin/admin`. **Result:** Rancher Server and your Kubernetes cluster is installed on VirtualBox. From 1be00a06284d08e5866ff53ecf9077d3313ebac0 Mon Sep 17 00:00:00 2001 From: Derek Nola Date: Mon, 13 Dec 2021 11:30:37 -0800 Subject: [PATCH 098/478] Review changes Signed-off-by: Derek Nola --- .../en/security/secrets_encryption/_index.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/content/k3s/latest/en/security/secrets_encryption/_index.md b/content/k3s/latest/en/security/secrets_encryption/_index.md index 9259e4931a9..0de4ce9b3d0 100644 --- a/content/k3s/latest/en/security/secrets_encryption/_index.md +++ b/content/k3s/latest/en/security/secrets_encryption/_index.md @@ -4,9 +4,9 @@ weight: 26 --- # Secrets Encryption Config -_Avaliable as of v1.17.4+k3s1_ +_Available as of v1.17.4+k3s1_ -K3s supports enabling secrets encryption at rest by passing the flag `--secrets-encryption` on a server, this flag will do the following automatically: +K3s supports enabling secrets encryption at rest by passing the flag `--secrets-encryption` on a server; this flag will do the following automatically: - Generate an AES-CBC key - Generate an encryption config file with the generated key @@ -44,9 +44,9 @@ Example of the encryption config file: ## Secrets Encryption Tool -_Avaliable as of v1.21.8+k3s1_ +_Available as of v1.21.8+k3s1_ -K3s contains a utility tool `secrets-encrypt`, which enable automatic control over: +K3s contains a utility tool `secrets-encrypt`, which enables automatic control over the following: - Disabling/Enabling secrets encryption - Adding new encryption keys @@ -89,7 +89,7 @@ To rotate secrets encryption keys on HA setups: >**Note** While not required, it is recommended that you pick one server node from which to run the `secrets-encrypt` commands. -- Start up 3 K3s servers, all with the `--secrets-encrytion` flag. For brevity, the servers will be referred to as S1, S2, S3. +- Start up all three K3s servers with the `--secrets-encryption` flag. For brevity, the servers will be referred to as S1, S2, S3. 1. Prepare on S1 @@ -153,7 +153,7 @@ To re-enable secrets encryption on a single node cluster: k3s secrets-encrypt reencrypt --force --skip ``` -### High-Avaliability Secrets Encryption Disable/Enable +### High-Availability Secrets Encryption Disable/Enable After launching a HA cluster with `--secrets-encryption` flags, secrets encryption can be disabled. >**Note** While not required, it is recommended that you pick one server node from which to run the `secrets-encrypt` commands. @@ -225,13 +225,13 @@ Active Key Type Name ``` -Details on each section are as followed: +Details on each section are as follows: - __Encryption Status__: Displayed whether secrets encryption is disabled or enabled on the node - __Current Rotation Stage__: Indicates the current rotation stage on the node. Stages are: `start`, `prepare`, `rotate`, `reencrypt_request`, `reencrypt_active`, `reencrypt_finished` -- __Server Encryption Hashes__: Useful for HA clusters, this indicates whether all server are on the same stage with their local files. This can be used to identify whether a restart of servers is required before proceeding to the next stage. In the HA example above, node-1 and node-2 different hashes, indicating that they currently do not have the same encryption configuration. Restarting the servers will sync up their configuration. +- __Server Encryption Hashes__: Useful for HA clusters, this indicates whether all servers are on the same stage with their local files. This can be used to identify whether a restart of servers is required before proceeding to the next stage. In the HA example above, node-1 and node-2 have different hashes, indicating that they currently do not have the same encryption configuration. Restarting the servers will sync up their configuration. - __Key Table__: Summarizes information about the secrets encryption keys found on the node. - * __Active__: The "*" indicates which, if any, of the keys are currently used for secrets encryption. An active key is used by kubernetes to encrypt any new secrets. + * __Active__: The "*" indicates which, if any, of the keys are currently used for secrets encryption. An active key is used by Kubernetes to encrypt any new secrets. * __Key Type__: All keys using this tool are `AES-CBC` type. See more info [here.](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#providers) * __Name__: Name of the encryption key. \ No newline at end of file From b0e10e74ad1114f29b0a99060b1f6fe13ff4ecf0 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 13 Dec 2021 16:45:41 -0500 Subject: [PATCH 099/478] Added note and command about nm-cloud-setup in RHEL --- content/rke/latest/en/os/_index.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/content/rke/latest/en/os/_index.md b/content/rke/latest/en/os/_index.md index c1e1dc79db8..08855564c8e 100644 --- a/content/rke/latest/en/os/_index.md +++ b/content/rke/latest/en/os/_index.md @@ -148,6 +148,13 @@ https://kubic.opensuse.org/blog/2021-02-08-MicroOS-Kubic-Rancher-RKE/ If using Red Hat Enterprise Linux, Oracle Linux or CentOS, you cannot use the `root` user as [SSH user]({{}}/rke/latest/en/config-options/nodes/#ssh-user) due to [Bugzilla 1527565](https://bugzilla.redhat.com/show_bug.cgi?id=1527565). Please follow the instructions below how to setup Docker correctly, based on the way you installed Docker on the node. +>**Note:** In RHEL 8.4, two extra services are included on the NetworkManager: `nm-cloud-setup.service` and `nm-cloud-setup.timer`. These services add a routing table that interferes with the CNI plugin's configuration. If these services are enabled, you must disable them using the command below, and then reboot the node to restore connectivity: +> +> ``` + systemctl disable nm-cloud-setup.service nm-cloud-setup.timer + reboot + ``` + #### Using upstream Docker If you are using upstream Docker, the package name is `docker-ce` or `docker-ee`. You can check the installed package by executing: From c9ce0f5dcc9909c58410886af2f2642031364ffd Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 13 Dec 2021 16:56:08 -0500 Subject: [PATCH 100/478] Added note and command about nm-cloud-setup in RHEL for 2.5, 2.6 --- .../en/cluster-provisioning/node-requirements/_index.md | 7 +++++++ .../en/cluster-provisioning/node-requirements/_index.md | 7 +++++++ 2 files changed, 14 insertions(+) diff --git a/content/rancher/v2.5/en/cluster-provisioning/node-requirements/_index.md b/content/rancher/v2.5/en/cluster-provisioning/node-requirements/_index.md index 54e83ca885d..3daf9c0cb8f 100644 --- a/content/rancher/v2.5/en/cluster-provisioning/node-requirements/_index.md +++ b/content/rancher/v2.5/en/cluster-provisioning/node-requirements/_index.md @@ -32,6 +32,13 @@ For information on how to install Docker, refer to the official [Docker document Some distributions of Linux derived from RHEL, including Oracle Linux, may have default firewall rules that block communication with Helm. We recommend disabling firewalld. For Kubernetes 1.19, firewalld must be turned off. +>**Note:** In RHEL 8.4, two extra services are included on the NetworkManager: `nm-cloud-setup.service` and `nm-cloud-setup.timer`. These services add a routing table that interferes with the CNI plugin's configuration. If these services are enabled, you must disable them using the command below, and then reboot the node to restore connectivity: +> +> ``` + systemctl disable nm-cloud-setup.service nm-cloud-setup.timer + reboot + ``` + ### SUSE Linux Nodes SUSE Linux may have a firewall that blocks all ports by default. In that situation, follow [these steps]({{}}/rancher/v2.5/en/installation/requirements/ports/#opening-suse-linux-ports) to open the ports needed for adding a host to a custom cluster. diff --git a/content/rancher/v2.6/en/cluster-provisioning/node-requirements/_index.md b/content/rancher/v2.6/en/cluster-provisioning/node-requirements/_index.md index bd24c9adeb8..519e8c31077 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/node-requirements/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/node-requirements/_index.md @@ -30,6 +30,13 @@ For information on how to install Docker, refer to the official [Docker document Some distributions of Linux derived from RHEL, including Oracle Linux, may have default firewall rules that block communication with Helm. We recommend disabling firewalld. For Kubernetes 1.19, firewalld must be turned off. +>**Note:** In RHEL 8.4, two extra services are included on the NetworkManager: `nm-cloud-setup.service` and `nm-cloud-setup.timer`. These services add a routing table that interferes with the CNI plugin's configuration. If these services are enabled, you must disable them using the command below, and then reboot the node to restore connectivity: +> +> ``` + systemctl disable nm-cloud-setup.service nm-cloud-setup.timer + reboot + ``` + ### SUSE Linux Nodes SUSE Linux may have a firewall that blocks all ports by default. In that situation, follow [these steps]({{}}/rancher/v2.6/en/installation/requirements/ports/#opening-suse-linux-ports) to open the ports needed for adding a host to a custom cluster. From 694ac8cab05057aff71af6fb350a49ebb2e893d9 Mon Sep 17 00:00:00 2001 From: Jen Travinski Date: Mon, 13 Dec 2021 19:30:30 -0500 Subject: [PATCH 101/478] Documented Ping Identity Entity ID Field (#3739) * Added description for Entity ID field in 2.0-2.4 * Added description for Entity ID field in 2.5 * Added description for Entity ID field in 2.6 --- .../en/admin-settings/authentication/ping-federate/_index.md | 2 ++ .../en/admin-settings/authentication/ping-federate/_index.md | 2 ++ .../en/admin-settings/authentication/ping-federate/_index.md | 2 ++ 3 files changed, 6 insertions(+) diff --git a/content/rancher/v2.0-v2.4/en/admin-settings/authentication/ping-federate/_index.md b/content/rancher/v2.0-v2.4/en/admin-settings/authentication/ping-federate/_index.md index e9a43d062f2..987ab8e966a 100644 --- a/content/rancher/v2.0-v2.4/en/admin-settings/authentication/ping-federate/_index.md +++ b/content/rancher/v2.0-v2.4/en/admin-settings/authentication/ping-federate/_index.md @@ -29,6 +29,8 @@ Note that these URLs will not return valid data until the authentication configu 1. **Groups Field**: Make entries for managing group memberships (example: `memberOf`). + 1. **Entity ID Field** (optional): The published, protocol-dependent, unique identifier of your partner. This ID defines your organization as the entity operating the server for SAML 2.0 transactions. This ID may have been obtained out-of-band or via a SAML metadata file. + 1. **Rancher API Host**: Enter the URL for your Rancher Server. 1. **Private Key** and **Certificate**: This is a key-certificate pair to create a secure shell between Rancher and your IdP. diff --git a/content/rancher/v2.5/en/admin-settings/authentication/ping-federate/_index.md b/content/rancher/v2.5/en/admin-settings/authentication/ping-federate/_index.md index 87abce2b877..525717bb7b9 100644 --- a/content/rancher/v2.5/en/admin-settings/authentication/ping-federate/_index.md +++ b/content/rancher/v2.5/en/admin-settings/authentication/ping-federate/_index.md @@ -30,6 +30,8 @@ Note that these URLs will not return valid data until the authentication configu 1. **Groups Field**: Make entries for managing group memberships (example: `memberOf`). + 1. **Entity ID Field** (optional): The published, protocol-dependent, unique identifier of your partner. This ID defines your organization as the entity operating the server for SAML 2.0 transactions. This ID may have been obtained out-of-band or via a SAML metadata file. + 1. **Rancher API Host**: Enter the URL for your Rancher Server. 1. **Private Key** and **Certificate**: This is a key-certificate pair to create a secure shell between Rancher and your IdP. diff --git a/content/rancher/v2.6/en/admin-settings/authentication/ping-federate/_index.md b/content/rancher/v2.6/en/admin-settings/authentication/ping-federate/_index.md index 5040d63561b..484b0a1610c 100644 --- a/content/rancher/v2.6/en/admin-settings/authentication/ping-federate/_index.md +++ b/content/rancher/v2.6/en/admin-settings/authentication/ping-federate/_index.md @@ -27,6 +27,8 @@ Note that these URLs will not return valid data until the authentication configu 1. **Groups Field**: Make entries for managing group memberships (example: `memberOf`). + 1. **Entity ID Field** (optional): The published, protocol-dependent, unique identifier of your partner. This ID defines your organization as the entity operating the server for SAML 2.0 transactions. This ID may have been obtained out-of-band or via a SAML metadata file. + 1. **Rancher API Host**: Enter the URL for your Rancher Server. 1. **Private Key** and **Certificate**: This is a key-certificate pair to create a secure shell between Rancher and your IdP. From f5faf7af1d9b2ca1036a277e3f9cfb5f4102225d Mon Sep 17 00:00:00 2001 From: Manuel Buil Date: Tue, 14 Dec 2021 20:14:46 +0100 Subject: [PATCH 102/478] Add more information about tokens Signed-off-by: Manuel Buil --- content/k3s/latest/en/advanced/_index.md | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/content/k3s/latest/en/advanced/_index.md b/content/k3s/latest/en/advanced/_index.md index 860a56a7d94..233398295ab 100644 --- a/content/k3s/latest/en/advanced/_index.md +++ b/content/k3s/latest/en/advanced/_index.md @@ -25,6 +25,7 @@ This section contains advanced information describing the different ways you can - [Additional preparation for (Red Hat/CentOS) Enterprise Linux](#additional-preparation-for-red-hat-centos-enterprise-linux) - [Enabling Lazy Pulling of eStargz (Experimental)](#enabling-lazy-pulling-of-estargz-experimental) - [Additional Logging Sources](#additional-logging-sources) +- [Server and agent tokens](#Server-and-agent-tokens) # Certificate Rotation @@ -479,4 +480,14 @@ helm repo add rancher-charts https://charts.rancher.io helm repo update helm install --create-namespace -n cattle-logging-system rancher-logging-crd rancher-charts/rancher-logging-crd helm install --create-namespace -n cattle-logging-system rancher-logging --set additionalLoggingSources.k3s.enabled=true rancher-charts/rancher-logging -``` \ No newline at end of file +``` + +# Server and agent tokens + +En k3s existen dos tipos de tokens: K3S_TOKEN y K3S_AGENT_TOKEN, cuyo uso es distinto. + +K3S_TOKEN: Define la clave que el servidor require para poder acceder a los recursos HTTP, los cuales son solicitados por otros servidores para incorporarse a un cluster de alta disponibilidad. Si no se define K3S_AGENT_TOKEN, los agentes tambien utilizan esta clave. Es importante saber que esta clave tambien es utilizada para generar la clave de encriptado para contenido importante en la base de datos. + +K3S_AGENT_TOKEN: Define la clave que el servidor solicita a los agentes para acceder a los recursos HTTP necesarios para incorporarse al cluster. Si no se define, se utiliza K3S_TOKEN para agente y servidor. Es recomendable definir esta variable para evitar que los agentes puedan generar la clave de encriptado mencionada anteriormente. + +Cuando no se ha definido ningun K3S_TOKEN, el servidor k3s genera uno aleatoriamente. El resultado es parte del contenido de `/var/lib/rancher/k3s/server/token`, por ejemplo `K1070878408e06a827960208f84ed18b65fa10f27864e71a57d9e053c4caff8504b::server:df54383b5659b9280aa1e73e60ef78fc`, donde `K1070878408e06a827960208f84ed18b65fa10f27864e71a57d9e053c4caff8504b` es el hash del CA, `server` es el usuario y `df54383b5659b9280aa1e73e60ef78fc` es la clave que seria reemplazada por K3S_TOKEN. From a9e381d5adbc56d8cb4f837360f79e732c7168d3 Mon Sep 17 00:00:00 2001 From: Alexander Date: Tue, 14 Dec 2021 14:49:44 -0800 Subject: [PATCH 103/478] Fix spelling issue --- .../v2.5/en/k8s-in-rancher/workloads/deploy-workloads/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/k8s-in-rancher/workloads/deploy-workloads/_index.md b/content/rancher/v2.5/en/k8s-in-rancher/workloads/deploy-workloads/_index.md index c27ebdcc9e6..567d8f9994c 100644 --- a/content/rancher/v2.5/en/k8s-in-rancher/workloads/deploy-workloads/_index.md +++ b/content/rancher/v2.5/en/k8s-in-rancher/workloads/deploy-workloads/_index.md @@ -16,7 +16,7 @@ Deploy a workload to run an application in one or more containers. 1. Enter a **Name** for the workload. -1. Select a [workload type]({{}}/rancher/v2.5/en/k8s-in-rancher/workloads/). The workload defaults to a scalable deployment, by can change the workload type by clicking **More options.** +1. Select a [workload type]({{}}/rancher/v2.5/en/k8s-in-rancher/workloads/). The workload defaults to a scalable deployment, but can change the workload type by clicking **More options.** 1. From the **Docker Image** field, enter the name of the Docker image that you want to deploy to the project, optionally prefacing it with the registry host (e.g. `quay.io`, `registry.gitlab.com`, etc.). During deployment, Rancher pulls this image from the specified public or private registry. If no registry host is provided, Rancher will pull the image from [Docker Hub](https://hub.docker.com/explore/). Enter the name exactly as it appears in the registry server, including any required path, and optionally including the desired tag (e.g. `registry.gitlab.com/user/path/image:tag`). If no tag is provided, the `latest` tag will be automatically used. From cfeae950a30f05a301843f5dcd02257b25a0162f Mon Sep 17 00:00:00 2001 From: Derek Nola Date: Wed, 15 Dec 2021 09:00:19 -0800 Subject: [PATCH 104/478] Added missing colons Signed-off-by: Derek Nola --- .../k3s/latest/en/security/secrets_encryption/_index.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/k3s/latest/en/security/secrets_encryption/_index.md b/content/k3s/latest/en/security/secrets_encryption/_index.md index 0de4ce9b3d0..b91bc4d081a 100644 --- a/content/k3s/latest/en/security/secrets_encryption/_index.md +++ b/content/k3s/latest/en/security/secrets_encryption/_index.md @@ -53,14 +53,14 @@ K3s contains a utility tool `secrets-encrypt`, which enables automatic control o - Rotating and deleting encryption keys - Reencrypting secrets ->**Warning** Failure to follow proper procedure for rotating encryption keys can leave your cluster permanently corrupted. Proceed with caution. +>**Warning:** Failure to follow proper procedure for rotating encryption keys can leave your cluster permanently corrupted. Proceed with caution. ### Single-Server Encryption Key Rotation To rotate secrets encryption keys on a single-node cluster: - Start the K3s server with the flag `--secrets-encryption` ->**Note** Starting K3s without encryption and enabling it at a later time is currently *not* supported. +>**Note:** Starting K3s without encryption and enabling it at a later time is currently *not* supported. 1. Prepare @@ -87,7 +87,7 @@ The steps are the same for both embedded DB and external DB clusters. To rotate secrets encryption keys on HA setups: ->**Note** While not required, it is recommended that you pick one server node from which to run the `secrets-encrypt` commands. +>**Note:** While not required, it is recommended that you pick one server node from which to run the `secrets-encrypt` commands. - Start up all three K3s servers with the `--secrets-encryption` flag. For brevity, the servers will be referred to as S1, S2, S3. @@ -155,7 +155,7 @@ To re-enable secrets encryption on a single node cluster: ### High-Availability Secrets Encryption Disable/Enable After launching a HA cluster with `--secrets-encryption` flags, secrets encryption can be disabled. ->**Note** While not required, it is recommended that you pick one server node from which to run the `secrets-encrypt` commands. +>**Note:** While not required, it is recommended that you pick one server node from which to run the `secrets-encrypt` commands. For brevity, the three servers used in this guide will be referred to as S1, S2, S3. From e99d2626e366e9a86e15d53f27d0051f843f1f35 Mon Sep 17 00:00:00 2001 From: Jen Travinski Date: Thu, 16 Dec 2021 13:00:43 -0500 Subject: [PATCH 105/478] Added notes for changes related to k8s 1.22 in rancher-backup app (#3733) * Updated markdown for note in 2.5, 2.6 * Added new note on v1.22 CRD issue * Added Rancher app version note and K8s version note * Added Rancher app version note, K8s version note, added link to v1.22issue * Added link to v1.22 issue * Updated link * Updated link * Updating links * Fixing broken link * Revised 2.6 note per feedback * Revised 2.5 note per feedback --- .../v2.5/en/backups/back-up-rancher/_index.md | 4 ++- .../en/backups/migrating-rancher/_index.md | 25 +++++++-------- content/rancher/v2.6/en/backups/_index.md | 2 ++ .../v2.6/en/backups/back-up-rancher/_index.md | 8 ++++- .../en/backups/migrating-rancher/_index.md | 32 +++++++++++-------- 5 files changed, 43 insertions(+), 28 deletions(-) diff --git a/content/rancher/v2.5/en/backups/back-up-rancher/_index.md b/content/rancher/v2.5/en/backups/back-up-rancher/_index.md index 51cdf22dfc1..4da253421c4 100644 --- a/content/rancher/v2.5/en/backups/back-up-rancher/_index.md +++ b/content/rancher/v2.5/en/backups/back-up-rancher/_index.md @@ -11,7 +11,9 @@ In this section, you'll learn how to back up Rancher running on any Kubernetes c The backup-restore operator needs to be installed in the local cluster, and only backs up the Rancher app. The backup and restore operations are performed only in the local Kubernetes cluster. -> When restoring a backup into a new Rancher setup, the version of the new setup should be the same as the one where the backup is made. +Note that the rancher-backup operator version 1.x.x is for Rancher v2.5.x. + +> When restoring a backup into a new Rancher setup, the version of the new setup should be the same as the one where the backup is made. The Kubernetes version should also be considered when restoring a backup, since the supported apiVersion in the cluster and in the backup file could be different. ### Prerequisites diff --git a/content/rancher/v2.5/en/backups/migrating-rancher/_index.md b/content/rancher/v2.5/en/backups/migrating-rancher/_index.md index 1fc70aee590..e8084657e17 100644 --- a/content/rancher/v2.5/en/backups/migrating-rancher/_index.md +++ b/content/rancher/v2.5/en/backups/migrating-rancher/_index.md @@ -70,20 +70,19 @@ spec: endpoint: s3.us-west-2.amazonaws.com ``` -> **Important:** The field `encryptionConfigSecretName` must be set only if your backup was created with encryption enabled. Provide the name of the Secret containing the encryption config file. If you only have the encryption config file, but don't have a secret created with it in this cluster, use the following steps to create the secret: -1. The encryption configuration file must be named `encryption-provider-config.yaml`, and the `--from-file` flag must be used to create this secret. So save your `EncryptionConfiguration` in a file called `encryption-provider-config.yaml` and run this command: +>**Important:** The field `encryptionConfigSecretName` must be set only if your backup was created with encryption enabled. Provide the name of the Secret containing the encryption config file. If you only have the encryption config file, but don't have a secret created with it in this cluster, use the following steps to create the secret: -``` -kubectl create secret generic encryptionconfig \ - --from-file=./encryption-provider-config.yaml \ - -n cattle-resources-system -``` - -Then apply the resource: - -``` -kubectl apply -f migrationResource.yaml -``` +1. The encryption configuration file must be named `encryption-provider-config.yaml`, and the `--from-file` flag must be used to create this secret. So save your `EncryptionConfiguration` in a file called `encryption-provider-config.yaml` and run this command: + ``` + kubectl create secret generic encryptionconfig \ + --from-file=./encryption-provider-config.yaml \ + -n cattle-resources-system + ``` + +1. Then apply the resource: + ``` + kubectl apply -f migrationResource.yaml + ``` ### 3. Install cert-manager diff --git a/content/rancher/v2.6/en/backups/_index.md b/content/rancher/v2.6/en/backups/_index.md index b090f2972b2..3abd52d742e 100644 --- a/content/rancher/v2.6/en/backups/_index.md +++ b/content/rancher/v2.6/en/backups/_index.md @@ -43,6 +43,8 @@ When a Restore custom resource is created, the operator accesses the backup .tar The Backup and Restore custom resources can be created in the Rancher UI, or by using `kubectl apply`. +>**Note:** Refer [here]({{}}/rancher/v2.6/en/backups/migrating-rancher/#2-restore-from-backup-using-a-restore-custom-resource) for help on restoring an existing backup file into a v1.22 cluster in Rancher v2.6.3. + # Installing the rancher-backup Operator The `rancher-backup` operator can be installed from the Rancher UI, or with the Helm CLI. In both cases, the `rancher-backup` Helm chart is installed on the Kubernetes cluster running the Rancher server. It is a cluster-admin only feature and available only for the **local** cluster. (*If you do not see `rancher-backup` in the Rancher UI, you may have selected the wrong cluster.*) diff --git a/content/rancher/v2.6/en/backups/back-up-rancher/_index.md b/content/rancher/v2.6/en/backups/back-up-rancher/_index.md index acfe23fc3fb..ad495fa6874 100644 --- a/content/rancher/v2.6/en/backups/back-up-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/back-up-rancher/_index.md @@ -5,12 +5,18 @@ weight: 1 In this section, you'll learn how to back up Rancher running on any Kubernetes cluster. To backup Rancher installed with Docker, refer the instructions for [single node backups]({{}}/rancher/v2.6/en/backups/docker-installs/docker-backups) -The backup-restore operator needs to be installed in the local cluster, and only backs up the Rancher app. The backup and restore operations are performed only in the local Kubernetes cluster. +The backup-restore operator needs to be installed in the local cluster, and only backs up the Rancher app. The backup and restore operations are performed only in the local Kubernetes cluster. + +Note that the rancher-backup operator version 2.x.x is for Rancher v2.6.x. + +> When restoring a backup into a new Rancher setup, the version of the new setup should be the same as the one where the backup is made. The Kubernetes version should also be considered when restoring a backup, since the supported apiVersion in the cluster and in the backup file could be different. ### Prerequisites The Rancher version must be v2.5.0 and up. +Refer [here]({{}}/rancher/v2.6/en/backups/migrating-rancher/#2-restore-from-backup-using-a-restore-custom-resource) for help on restoring an existing backup file into a v1.22 cluster in Rancher v2.6.3. + ### 1. Install the Rancher Backups operator The backup storage location is an operator-level setting, so it needs to be configured when the Rancher Backups application is installed or upgraded. diff --git a/content/rancher/v2.6/en/backups/migrating-rancher/_index.md b/content/rancher/v2.6/en/backups/migrating-rancher/_index.md index 0154b6b1bd7..605d917fea0 100644 --- a/content/rancher/v2.6/en/backups/migrating-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/migrating-rancher/_index.md @@ -29,6 +29,13 @@ helm install rancher-backup rancher-charts/rancher-backup -n cattle-resources-sy ### 2. Restore from backup using a Restore custom resource +>**Important:** Kubernetes v1.22, available as an experimental feature of v2.6.3, does not support restoring from backup files containing CRDs with the apiVersion `apiextensions.k8s.io/v1beta1`. In v1.22, the default `resourceSet` in the rancher-backup app is updated to collect only CRDs that use `apiextensions.k8s.io/v1`. There are currently two ways to work around this issue: +> +1. Update the default `resourceSet` to collect the CRDs with the apiVersion v1. +1. Update the default `resourceSet` and the client to use the new APIs internally, with `apiextensions.k8s.io/v1` as the replacement. +> +> - Note that when making or restoring backups for v1.22, the Rancher version and the local cluster's Kubernetes version should be the same. The Kubernetes version should be considered when restoring a backup since the supported apiVersion in the cluster and in the backup file could be different. + If you are using an S3 store as the backup source, and need to use your S3 credentials for restore, create a secret in this cluster using your S3 credentials. The Secret data must have two keys, `accessKey` and `secretKey` containing the s3 credentials like this: ```yaml @@ -68,20 +75,19 @@ spec: endpoint: s3.us-west-2.amazonaws.com ``` -> **Important:** The field `encryptionConfigSecretName` must be set only if your backup was created with encryption enabled. Provide the name of the Secret containing the encryption config file. If you only have the encryption config file, but don't have a secret created with it in this cluster, use the following steps to create the secret: -1. The encryption configuration file must be named `encryption-provider-config.yaml`, and the `--from-file` flag must be used to create this secret. So save your `EncryptionConfiguration` in a file called `encryption-provider-config.yaml` and run this command: +>**Important:** The field `encryptionConfigSecretName` must be set only if your backup was created with encryption enabled. Provide the name of the Secret containing the encryption config file. If you only have the encryption config file, but don't have a secret created with it in this cluster, use the following steps to create the secret: -``` -kubectl create secret generic encryptionconfig \ - --from-file=./encryption-provider-config.yaml \ - -n cattle-resources-system -``` - -Then apply the resource: - -``` -kubectl apply -f migrationResource.yaml -``` +1. The encryption configuration file must be named `encryption-provider-config.yaml`, and the `--from-file` flag must be used to create this secret. So save your `EncryptionConfiguration` in a file called `encryption-provider-config.yaml` and run this command: + ``` + kubectl create secret generic encryptionconfig \ + --from-file=./encryption-provider-config.yaml \ + -n cattle-resources-system + ``` + +1. Then apply the resource: + ``` + kubectl apply -f migrationResource.yaml + ``` ### 3. Install cert-manager From e216da10e6151eb0faa2f3f481d8a9908cb1b3ae Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Thu, 16 Dec 2021 17:48:43 -0500 Subject: [PATCH 106/478] Added note about V2 CPU usage in 2.5 --- .../rancher/v2.5/en/monitoring-alerting/configuration/_index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/rancher/v2.5/en/monitoring-alerting/configuration/_index.md b/content/rancher/v2.5/en/monitoring-alerting/configuration/_index.md index e56978fbb98..350c18172f2 100644 --- a/content/rancher/v2.5/en/monitoring-alerting/configuration/_index.md +++ b/content/rancher/v2.5/en/monitoring-alerting/configuration/_index.md @@ -15,6 +15,8 @@ For information on configuring custom scrape targets and rules for Prometheus, p The resource requests and limits for the monitoring application can be configured when installing `rancher-monitoring`. For more information about the default limits, see [this page.](./helm-chart-options/#configuring-resource-limits-and-requests) +>**Warning:** On an idle cluster, Monitoring V2 has significantly higher CPU usage (up to 70%) as compared to Monitoring V1. + # Prometheus Configuration It is usually not necessary to directly edit the Prometheus custom resource. From 684b6c4048afdafa7caea6cc96494c24686e2efa Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Thu, 16 Dec 2021 17:49:12 -0500 Subject: [PATCH 107/478] Added note about V2 CPU usage in 2.6 --- .../rancher/v2.6/en/monitoring-alerting/configuration/_index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/rancher/v2.6/en/monitoring-alerting/configuration/_index.md b/content/rancher/v2.6/en/monitoring-alerting/configuration/_index.md index 078bf7f31e4..e8204151ee9 100644 --- a/content/rancher/v2.6/en/monitoring-alerting/configuration/_index.md +++ b/content/rancher/v2.6/en/monitoring-alerting/configuration/_index.md @@ -11,6 +11,8 @@ For information on configuring custom scrape targets and rules for Prometheus, p The resource requests and limits for the monitoring application can be configured when installing `rancher-monitoring`. For more information about the default limits, see [this page.](./helm-chart-options/#configuring-resource-limits-and-requests) +>**Warning:** On an idle cluster, Monitoring V2 has significantly higher CPU usage (up to 70%) as compared to Monitoring V1. + # Prometheus Configuration It is usually not necessary to directly edit the Prometheus custom resource. From eadfd19b5e98870b6c628c8fd884ebe3406e42c7 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 17 Dec 2021 13:11:20 -0500 Subject: [PATCH 108/478] Added section for adding private CA in 2.5 --- content/rancher/v2.5/en/helm-charts/_index.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/content/rancher/v2.5/en/helm-charts/_index.md b/content/rancher/v2.5/en/helm-charts/_index.md index e5e6ba7853e..b24451e3ff5 100644 --- a/content/rancher/v2.5/en/helm-charts/_index.md +++ b/content/rancher/v2.5/en/helm-charts/_index.md @@ -50,6 +50,20 @@ From the left sidebar select _"Repositories"_. These items represent helm repositories, and can be either traditional helm endpoints which have an index.yaml, or git repositories which will be cloned and can point to a specific branch. In order to use custom charts, simply add your repository here and they will become available in the Charts tab under the name of the repository. +To add a private CA for Helm Chart repositories: + +- **HTTP-based chart repositories**: You must add a base64 encoded copy of the CA certificate in DER format to the spec.caBundle field of the chart repo, such as `openssl x509 -outform der -in ca.pem | base64 -w0`. Click `Edit YAML` for the chart repo and set, as in the following example:
+ ``` + [...] + spec: + caBundle: + MIIFXzCCA0egAwIBAgIUWNy8WrvSkgNzV0zdWRP79j9cVcEwDQYJKoZIhvcNAQELBQAwPzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQKDAtNeU9yZywgSW5jLjENMAsGA1UEAwwEcm9vdDAeFw0yMTEyMTQwODMyMTdaFw0yNDEwMDMwODMyMT + ... + nDxZ/tNXt/WPJr/PgEB3hQdInDWYMg7vGO0Oz00G5kWg0sJ0ZTSoA10ZwdjIdGEeKlj1NlPyAqpQ+uDnmx6DW+zqfYtLnc/g6GuLLVPamraqN+gyU8CHwAWPNjZonFN9Vpg0PIk1I2zuOc4EHifoTAXSpnjfzfyAxCaZsnTptimlPFJJqAMj+FfDArGmr4= + [...] + ``` + +- **Git-based chart repositories**: It is not currently possible to add a private CA. For git-based chart repositories with a certificate signed by a private CA, you must disable TLS verification. Click `Edit YAML` for the chart repo, and add the key/value pair: `spec.insecureSkipTLSVerify: true`. ### Helm Compatibility From bbafbcf4151cee3ccb9461d7f78503f9888c481b Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 17 Dec 2021 13:11:35 -0500 Subject: [PATCH 109/478] Added section for adding private CA in 2.6 --- content/rancher/v2.6/en/helm-charts/_index.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/content/rancher/v2.6/en/helm-charts/_index.md b/content/rancher/v2.6/en/helm-charts/_index.md index f61e0c2ecfe..490d99c340c 100644 --- a/content/rancher/v2.6/en/helm-charts/_index.md +++ b/content/rancher/v2.6/en/helm-charts/_index.md @@ -25,6 +25,20 @@ From the left sidebar select _"Repositories"_. These items represent helm repositories, and can be either traditional helm endpoints which have an index.yaml, or git repositories which will be cloned and can point to a specific branch. In order to use custom charts, simply add your repository here and they will become available in the Charts tab under the name of the repository. +To add a private CA for Helm Chart repositories: + +- **HTTP-based chart repositories**: You must add a base64 encoded copy of the CA certificate in DER format to the spec.caBundle field of the chart repo, such as `openssl x509 -outform der -in ca.pem | base64 -w0`. Click `Edit YAML` for the chart repo and set, as in the following example:
+ ``` + [...] + spec: + caBundle: + MIIFXzCCA0egAwIBAgIUWNy8WrvSkgNzV0zdWRP79j9cVcEwDQYJKoZIhvcNAQELBQAwPzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQKDAtNeU9yZywgSW5jLjENMAsGA1UEAwwEcm9vdDAeFw0yMTEyMTQwODMyMTdaFw0yNDEwMDMwODMyMT + ... + nDxZ/tNXt/WPJr/PgEB3hQdInDWYMg7vGO0Oz00G5kWg0sJ0ZTSoA10ZwdjIdGEeKlj1NlPyAqpQ+uDnmx6DW+zqfYtLnc/g6GuLLVPamraqN+gyU8CHwAWPNjZonFN9Vpg0PIk1I2zuOc4EHifoTAXSpnjfzfyAxCaZsnTptimlPFJJqAMj+FfDArGmr4= + [...] + ``` + +- **Git-based chart repositories**: It is not currently possible to add a private CA. For git-based chart repositories with a certificate signed by a private CA, you must disable TLS verification. Click `Edit YAML` for the chart repo, and add the key/value pair: `spec.insecureSkipTLSVerify: true`. ### Helm Compatibility From 197aa68f49672cae88023dfde8327be9b3afca6b Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 17 Dec 2021 15:07:34 -0500 Subject: [PATCH 110/478] Updated per feedback in 2.6 --- content/rancher/v2.6/en/helm-charts/_index.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/content/rancher/v2.6/en/helm-charts/_index.md b/content/rancher/v2.6/en/helm-charts/_index.md index 490d99c340c..c7e1f5b1ae8 100644 --- a/content/rancher/v2.6/en/helm-charts/_index.md +++ b/content/rancher/v2.6/en/helm-charts/_index.md @@ -27,18 +27,24 @@ These items represent helm repositories, and can be either traditional helm endp To add a private CA for Helm Chart repositories: -- **HTTP-based chart repositories**: You must add a base64 encoded copy of the CA certificate in DER format to the spec.caBundle field of the chart repo, such as `openssl x509 -outform der -in ca.pem | base64 -w0`. Click `Edit YAML` for the chart repo and set, as in the following example:
+- **HTTP-based chart repositories**: You must add a base64 encoded copy of the CA certificate in DER format to the spec.caBundle field of the chart repo, such as `openssl x509 -outform der -in ca.pem | base64 -w0`. Click **Edit YAML** for the chart repo and set, as in the following example:
``` [...] spec: - caBundle: + caBundle: MIIFXzCCA0egAwIBAgIUWNy8WrvSkgNzV0zdWRP79j9cVcEwDQYJKoZIhvcNAQELBQAwPzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQKDAtNeU9yZywgSW5jLjENMAsGA1UEAwwEcm9vdDAeFw0yMTEyMTQwODMyMTdaFw0yNDEwMDMwODMyMT ... nDxZ/tNXt/WPJr/PgEB3hQdInDWYMg7vGO0Oz00G5kWg0sJ0ZTSoA10ZwdjIdGEeKlj1NlPyAqpQ+uDnmx6DW+zqfYtLnc/g6GuLLVPamraqN+gyU8CHwAWPNjZonFN9Vpg0PIk1I2zuOc4EHifoTAXSpnjfzfyAxCaZsnTptimlPFJJqAMj+FfDArGmr4= [...] ``` -- **Git-based chart repositories**: It is not currently possible to add a private CA. For git-based chart repositories with a certificate signed by a private CA, you must disable TLS verification. Click `Edit YAML` for the chart repo, and add the key/value pair: `spec.insecureSkipTLSVerify: true`. +- **Git-based chart repositories**: It is not currently possible to add a private CA. For git-based chart repositories with a certificate signed by a private CA, you must disable TLS verification. Click **Edit YAML** for the chart repo, and add the key/value pair as follows: + ``` + [...] + spec: + insecureSkipTLSVerify: true + [...] + ``` ### Helm Compatibility From 847f9962516fd5524240345d46a93dadb78ba06a Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 17 Dec 2021 15:07:50 -0500 Subject: [PATCH 111/478] Updated per feedback in 2.5 --- content/rancher/v2.5/en/helm-charts/_index.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/content/rancher/v2.5/en/helm-charts/_index.md b/content/rancher/v2.5/en/helm-charts/_index.md index b24451e3ff5..256d0e29fef 100644 --- a/content/rancher/v2.5/en/helm-charts/_index.md +++ b/content/rancher/v2.5/en/helm-charts/_index.md @@ -52,18 +52,24 @@ These items represent helm repositories, and can be either traditional helm endp To add a private CA for Helm Chart repositories: -- **HTTP-based chart repositories**: You must add a base64 encoded copy of the CA certificate in DER format to the spec.caBundle field of the chart repo, such as `openssl x509 -outform der -in ca.pem | base64 -w0`. Click `Edit YAML` for the chart repo and set, as in the following example:
+- **HTTP-based chart repositories**: You must add a base64 encoded copy of the CA certificate in DER format to the spec.caBundle field of the chart repo, such as `openssl x509 -outform der -in ca.pem | base64 -w0`. Click **Edit YAML** for the chart repo and set, as in the following example:
``` [...] spec: - caBundle: + caBundle: MIIFXzCCA0egAwIBAgIUWNy8WrvSkgNzV0zdWRP79j9cVcEwDQYJKoZIhvcNAQELBQAwPzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQKDAtNeU9yZywgSW5jLjENMAsGA1UEAwwEcm9vdDAeFw0yMTEyMTQwODMyMTdaFw0yNDEwMDMwODMyMT ... nDxZ/tNXt/WPJr/PgEB3hQdInDWYMg7vGO0Oz00G5kWg0sJ0ZTSoA10ZwdjIdGEeKlj1NlPyAqpQ+uDnmx6DW+zqfYtLnc/g6GuLLVPamraqN+gyU8CHwAWPNjZonFN9Vpg0PIk1I2zuOc4EHifoTAXSpnjfzfyAxCaZsnTptimlPFJJqAMj+FfDArGmr4= [...] ``` -- **Git-based chart repositories**: It is not currently possible to add a private CA. For git-based chart repositories with a certificate signed by a private CA, you must disable TLS verification. Click `Edit YAML` for the chart repo, and add the key/value pair: `spec.insecureSkipTLSVerify: true`. +- **Git-based chart repositories**: It is not currently possible to add a private CA. For git-based chart repositories with a certificate signed by a private CA, you must disable TLS verification. Click **Edit YAML** for the chart repo, and add the key/value pair as follows: + ``` + [...] + spec: + insecureSkipTLSVerify: true + [...] + ``` ### Helm Compatibility From e840dce8ab691e7fd036e6b45524cfd4fb7d7f28 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Fri, 17 Dec 2021 16:39:25 -0800 Subject: [PATCH 112/478] Add note on disableSameOriginCheck (#3746) --- content/rancher/v2.6/en/helm-charts/_index.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/content/rancher/v2.6/en/helm-charts/_index.md b/content/rancher/v2.6/en/helm-charts/_index.md index f61e0c2ecfe..7d7fcecb773 100644 --- a/content/rancher/v2.6/en/helm-charts/_index.md +++ b/content/rancher/v2.6/en/helm-charts/_index.md @@ -25,6 +25,18 @@ From the left sidebar select _"Repositories"_. These items represent helm repositories, and can be either traditional helm endpoints which have an index.yaml, or git repositories which will be cloned and can point to a specific branch. In order to use custom charts, simply add your repository here and they will become available in the Charts tab under the name of the repository. +> **Note:** Helm chart repositories with authentication +> +> As of Rancher v2.6.3, a new value `disableSameOriginCheck` has been added to the Repo.Spec. This allows users to bypass the same origin checks, sending the repository Authentication information as a Basic Auth Header with all API calls. This is not recommended but can be used as a temporary solution in cases of non-standard Helm chart repositories such as those that have redirects to a different origin URL. +> +> To use this feature for an existing Helm chart repository, click **⋮ > Edit YAML**. On the `spec` portion of the YAML file, add `disableSameOriginCheck` and set it to `true`. +> +> ```yaml +[...] +spec: + disableSameOriginCheck: true +[...] +``` ### Helm Compatibility From b1e9149cdd56d64d78a70b030997a5ca42121141 Mon Sep 17 00:00:00 2001 From: Manuel Buil Date: Thu, 16 Dec 2021 10:48:45 +0100 Subject: [PATCH 113/478] Add token explanation Signed-off-by: Manuel Buil --- content/k3s/latest/en/advanced/_index.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/content/k3s/latest/en/advanced/_index.md b/content/k3s/latest/en/advanced/_index.md index 233398295ab..1053f57809d 100644 --- a/content/k3s/latest/en/advanced/_index.md +++ b/content/k3s/latest/en/advanced/_index.md @@ -25,7 +25,7 @@ This section contains advanced information describing the different ways you can - [Additional preparation for (Red Hat/CentOS) Enterprise Linux](#additional-preparation-for-red-hat-centos-enterprise-linux) - [Enabling Lazy Pulling of eStargz (Experimental)](#enabling-lazy-pulling-of-estargz-experimental) - [Additional Logging Sources](#additional-logging-sources) -- [Server and agent tokens](#Server-and-agent-tokens) +- [Server and agent tokens](#server-and-agent-tokens) # Certificate Rotation @@ -484,10 +484,10 @@ helm install --create-namespace -n cattle-logging-system rancher-logging --set a # Server and agent tokens -En k3s existen dos tipos de tokens: K3S_TOKEN y K3S_AGENT_TOKEN, cuyo uso es distinto. +In K3s, there are two types of tokens: K3S_TOKEN and K3S_AGENT_TOKEN. -K3S_TOKEN: Define la clave que el servidor require para poder acceder a los recursos HTTP, los cuales son solicitados por otros servidores para incorporarse a un cluster de alta disponibilidad. Si no se define K3S_AGENT_TOKEN, los agentes tambien utilizan esta clave. Es importante saber que esta clave tambien es utilizada para generar la clave de encriptado para contenido importante en la base de datos. +K3S_TOKEN: Defines the key required by the server to offer the HTTP config resources. These resources are requested by the other servers before joining the K3s HA cluster. If the K3S_AGENT_TOKEN is not defined, the agents use this token as well to access the required HTTP resources to join the cluster. Note that this token is also used to generate the encryption key for important content in the database (e.g., bootstrap data). -K3S_AGENT_TOKEN: Define la clave que el servidor solicita a los agentes para acceder a los recursos HTTP necesarios para incorporarse al cluster. Si no se define, se utiliza K3S_TOKEN para agente y servidor. Es recomendable definir esta variable para evitar que los agentes puedan generar la clave de encriptado mencionada anteriormente. +K3S_AGENT_TOKEN: Optional. Defines the key required by the server to offer HTTP config resources to the agents. If not defined, agents will require K3S_TOKEN. Defining K3S_AGENT_TOKEN is encouraged to avoid agents having to know K3S_TOKEN, which is also used to encrypt data. -Cuando no se ha definido ningun K3S_TOKEN, el servidor k3s genera uno aleatoriamente. El resultado es parte del contenido de `/var/lib/rancher/k3s/server/token`, por ejemplo `K1070878408e06a827960208f84ed18b65fa10f27864e71a57d9e053c4caff8504b::server:df54383b5659b9280aa1e73e60ef78fc`, donde `K1070878408e06a827960208f84ed18b65fa10f27864e71a57d9e053c4caff8504b` es el hash del CA, `server` es el usuario y `df54383b5659b9280aa1e73e60ef78fc` es la clave que seria reemplazada por K3S_TOKEN. +If no K3S_TOKEN is defined, the first K3s server will generate a random one. The result is part of the content in `/var/lib/rancher/k3s/server/token`. For example, `K1070878408e06a827960208f84ed18b65fa10f27864e71a57d9e053c4caff8504b::server:df54383b5659b9280aa1e73e60ef78fc`, where `df54383b5659b9280aa1e73e60ef78fc` is the K3S_TOKEN. From d9c7504cd3388d462a2e54f51ebb56813402d519 Mon Sep 17 00:00:00 2001 From: Jen Travinski Date: Mon, 20 Dec 2021 13:41:45 -0500 Subject: [PATCH 114/478] Added Rancher vSphere section in 2.6 docs (#3748) * Updated header size to match page headers * Added Rancher on vSphere section in 2.6 --- .../rke-clusters/windows-clusters/_index.md | 2 +- .../rke-clusters/windows-clusters/_index.md | 26 +++++++++++++++++++ 2 files changed, 27 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md b/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md index 37ff393eded..16bf34656c1 100644 --- a/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md +++ b/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md @@ -85,7 +85,7 @@ If you are configuring DHCP options sets for an AWS virtual private cloud, note > Some Linux operating systems accept multiple domain names separated by spaces. However, other Linux operating systems and Windows treat the value as a single domain, which results in unexpected behavior. If your DHCP options set is associated with a VPC that has instances with multiple operating systems, specify only one domain name. -#### Rancher on vSphere with ESXi 6.7u2 and above +### Rancher on vSphere with ESXi 6.7u2 and above If you are using Rancher on VMware vSphere with ESXi 6.7u2 or later with Red Hat Enterprise Linux 8.3, CentOS 8.3, or SUSE Enterprise Linux 15 SP2 or later, it is necessary to disable the `vmxnet3` virtual network adapter hardware offloading feature. Failure to do so will result in all network connections between pods on different cluster nodes to fail with timeout errors. All connections from Windows pods to critical services running on Linux nodes, such as CoreDNS, will fail as well. It is also possible that external connections may fail. This issue is the result of Linux distributions enabling the hardware offloading feature in `vmxnet3` and a bug in the `vmxnet3` hardware offloading feature that results in the discarding of packets for guest overlay traffic. To address this issue, it is necessary disable the `vmxnet3` hardware offloading feature. This setting does not survive reboot, so it is necessary to disable on every boot. The recommended course of action is to create a systemd unit file at `/etc/systemd/system/disable_hw_offloading.service`, which disables the `vmxnet3` hardware offloading feature on boot. A sample systemd unit file which disables the `vmxnet3` hardware offloading feature is as follows. Note that `` must be customized to the host `vmxnet3` network interface, e.g., `ens192`: diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md index 1d5b9d4b072..0e4f17f8abc 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md @@ -85,6 +85,32 @@ If you are configuring DHCP options sets for an AWS virtual private cloud, note > Some Linux operating systems accept multiple domain names separated by spaces. However, other Linux operating systems and Windows treat the value as a single domain, which results in unexpected behavior. If your DHCP options set is associated with a VPC that has instances with multiple operating systems, specify only one domain name. +### Rancher on vSphere with ESXi 6.7u2 and above + +If you are using Rancher on VMware vSphere with ESXi 6.7u2 or later with Red Hat Enterprise Linux 8.3, CentOS 8.3, or SUSE Enterprise Linux 15 SP2 or later, it is necessary to disable the `vmxnet3` virtual network adapter hardware offloading feature. Failure to do so will result in all network connections between pods on different cluster nodes to fail with timeout errors. All connections from Windows pods to critical services running on Linux nodes, such as CoreDNS, will fail as well. It is also possible that external connections may fail. This issue is the result of Linux distributions enabling the hardware offloading feature in `vmxnet3` and a bug in the `vmxnet3` hardware offloading feature that results in the discarding of packets for guest overlay traffic. To address this issue, it is necessary disable the `vmxnet3` hardware offloading feature. This setting does not survive reboot, so it is necessary to disable on every boot. The recommended course of action is to create a systemd unit file at `/etc/systemd/system/disable_hw_offloading.service`, which disables the `vmxnet3` hardware offloading feature on boot. A sample systemd unit file which disables the `vmxnet3` hardware offloading feature is as follows. Note that `` must be customized to the host `vmxnet3` network interface, e.g., `ens192`: + +``` +[Unit] +Description=Disable vmxnet3 hardware offloading feature + +[Service] +Type=oneshot +ExecStart=ethtool -K tx-udp_tnl-segmentation off +ExecStart=ethtool -K tx-udp_tnl-csum-segmentation off +StandardOutput=journal + +[Install] +WantedBy=multi-user.target +``` +Then set the appropriate permissions on the systemd unit file: +``` +chmod 0644 /etc/systemd/system/disable_hw_offloading.service +``` +Finally, enable the systemd service: +``` +systemctl enable disable_hw_offloading.service +``` + ### Architecture Requirements The Kubernetes cluster management nodes (`etcd` and `controlplane`) must be run on Linux nodes. From b22975b94775071d9deeb7b7be84e2936accefd5 Mon Sep 17 00:00:00 2001 From: Zadkiel Date: Mon, 20 Dec 2021 19:55:42 +0100 Subject: [PATCH 115/478] fix(thoubleshooting-dns): remove duplicated kubectl get (#3747) * fix(thoubleshooting-dns): remove duplicated kubectl get * Update _index.md * Update _index.md --- content/rancher/v2.0-v2.4/en/troubleshooting/dns/_index.md | 2 +- content/rancher/v2.5/en/troubleshooting/dns/_index.md | 2 +- content/rancher/v2.6/en/troubleshooting/dns/_index.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/content/rancher/v2.0-v2.4/en/troubleshooting/dns/_index.md b/content/rancher/v2.0-v2.4/en/troubleshooting/dns/_index.md index 48a98a37919..169b5d84104 100644 --- a/content/rancher/v2.0-v2.4/en/troubleshooting/dns/_index.md +++ b/content/rancher/v2.0-v2.4/en/troubleshooting/dns/_index.md @@ -158,7 +158,7 @@ kubectl run -i --restart=Never --rm test-${RANDOM} --image=ubuntu --overrides='{ Enabling query logging can be done by enabling the [log plugin](https://coredns.io/plugins/log/) in the Corefile configuration in the configmap `coredns`. You can do so by using `kubectl -n kube-system edit configmap coredns` or use the command below to replace the configuration in place: ``` -kubectl get configmap -n kube-system coredns -o json | kubectl get configmap -n kube-system coredns -o json | sed -e 's_loadbalance_log\\n loadbalance_g' | kubectl apply -f - +kubectl get configmap -n kube-system coredns -o json | sed -e 's_loadbalance_log\\n loadbalance_g' | kubectl apply -f - ``` All queries will now be logged and can be checked using the command in [Check CoreDNS logging](#check-coredns-logging). diff --git a/content/rancher/v2.5/en/troubleshooting/dns/_index.md b/content/rancher/v2.5/en/troubleshooting/dns/_index.md index 99274794206..3822399c32f 100644 --- a/content/rancher/v2.5/en/troubleshooting/dns/_index.md +++ b/content/rancher/v2.5/en/troubleshooting/dns/_index.md @@ -160,7 +160,7 @@ kubectl run -i --restart=Never --rm test-${RANDOM} --image=ubuntu --overrides='{ Enabling query logging can be done by enabling the [log plugin](https://coredns.io/plugins/log/) in the Corefile configuration in the configmap `coredns`. You can do so by using `kubectl -n kube-system edit configmap coredns` or use the command below to replace the configuration in place: ``` -kubectl get configmap -n kube-system coredns -o json | kubectl get configmap -n kube-system coredns -o json | sed -e 's_loadbalance_log\\n loadbalance_g' | kubectl apply -f - +kubectl get configmap -n kube-system coredns -o json | sed -e 's_loadbalance_log\\n loadbalance_g' | kubectl apply -f - ``` All queries will now be logged and can be checked using the command in [Check CoreDNS logging](#check-coredns-logging). diff --git a/content/rancher/v2.6/en/troubleshooting/dns/_index.md b/content/rancher/v2.6/en/troubleshooting/dns/_index.md index e9a181fc4e8..a1292df3e32 100644 --- a/content/rancher/v2.6/en/troubleshooting/dns/_index.md +++ b/content/rancher/v2.6/en/troubleshooting/dns/_index.md @@ -158,7 +158,7 @@ kubectl run -i --restart=Never --rm test-${RANDOM} --image=ubuntu --overrides='{ Enabling query logging can be done by enabling the [log plugin](https://coredns.io/plugins/log/) in the Corefile configuration in the configmap `coredns`. You can do so by using `kubectl -n kube-system edit configmap coredns` or use the command below to replace the configuration in place: ``` -kubectl get configmap -n kube-system coredns -o json | kubectl get configmap -n kube-system coredns -o json | sed -e 's_loadbalance_log\\n loadbalance_g' | kubectl apply -f - +kubectl get configmap -n kube-system coredns -o json | sed -e 's_loadbalance_log\\n loadbalance_g' | kubectl apply -f - ``` All queries will now be logged and can be checked using the command in [Check CoreDNS logging](#check-coredns-logging). From b895dc3c583a2462bb52e55f31e9937fa7b00a86 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 20 Dec 2021 11:05:30 -0800 Subject: [PATCH 116/478] Legacy app upgrade note (#3749) --- content/rancher/v2.6/en/helm-charts/_index.md | 22 +++++++++---------- 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/content/rancher/v2.6/en/helm-charts/_index.md b/content/rancher/v2.6/en/helm-charts/_index.md index 7d7fcecb773..68e52a68d9a 100644 --- a/content/rancher/v2.6/en/helm-charts/_index.md +++ b/content/rancher/v2.6/en/helm-charts/_index.md @@ -25,18 +25,6 @@ From the left sidebar select _"Repositories"_. These items represent helm repositories, and can be either traditional helm endpoints which have an index.yaml, or git repositories which will be cloned and can point to a specific branch. In order to use custom charts, simply add your repository here and they will become available in the Charts tab under the name of the repository. -> **Note:** Helm chart repositories with authentication -> -> As of Rancher v2.6.3, a new value `disableSameOriginCheck` has been added to the Repo.Spec. This allows users to bypass the same origin checks, sending the repository Authentication information as a Basic Auth Header with all API calls. This is not recommended but can be used as a temporary solution in cases of non-standard Helm chart repositories such as those that have redirects to a different origin URL. -> -> To use this feature for an existing Helm chart repository, click **⋮ > Edit YAML**. On the `spec` portion of the YAML file, add `disableSameOriginCheck` and set it to `true`. -> -> ```yaml -[...] -spec: - disableSameOriginCheck: true -[...] -``` ### Helm Compatibility @@ -58,3 +46,13 @@ Most Rancher tools have additional pages located in the toolbar below the _"Apps > * use the default upgrade option ( i.e do not use _"--force"_ option ) > * uninstall the existing chart and install the upgraded chart > * delete the resources with immutable fields from the cluster before performing the _"--force"_ upgrade + +#### Changes in Rancher v2.6.3 + +The upgrade button has been removed for legacy apps from the **Apps & Marketplace > Installed Apps** page. + +If you have a legacy app installed and want to upgrade it: + +- The legacy [feature flag]({{}}/rancher/v2.6/en/installation/resources/feature-flags/) must be turned on (if it's not turned on automatically because of having a legacy app before upgrading) +- You can upgrade the app from cluster explorer, from the left nav section **Legacy > Project > Apps** +- For multi-cluster apps, you can go to **≡ > Multi-cluster Apps** and upgrade the app from there \ No newline at end of file From 3f50f33ca3bf06d0a0dbad3a2c7a7d648029bfe6 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 21 Dec 2021 10:49:43 -0500 Subject: [PATCH 117/478] Updated note with workaround for 2.5 --- .../rancher/v2.5/en/monitoring-alerting/configuration/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/monitoring-alerting/configuration/_index.md b/content/rancher/v2.5/en/monitoring-alerting/configuration/_index.md index 350c18172f2..2d7867cbc4c 100644 --- a/content/rancher/v2.5/en/monitoring-alerting/configuration/_index.md +++ b/content/rancher/v2.5/en/monitoring-alerting/configuration/_index.md @@ -15,7 +15,7 @@ For information on configuring custom scrape targets and rules for Prometheus, p The resource requests and limits for the monitoring application can be configured when installing `rancher-monitoring`. For more information about the default limits, see [this page.](./helm-chart-options/#configuring-resource-limits-and-requests) ->**Warning:** On an idle cluster, Monitoring V2 has significantly higher CPU usage (up to 70%) as compared to Monitoring V1. +>**Note:** On an idle cluster, Monitoring V2 has significantly higher CPU usage (up to 70%) as compared to Monitoring V1. To improve performance and achieve similar results as in Monitoring V1, turn off the Prometheus adapter. # Prometheus Configuration From 0b136bd4b2a81727f095b0212482a4e53fbd8142 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 21 Dec 2021 10:49:59 -0500 Subject: [PATCH 118/478] Updated note with workaround for 2.6 --- .../rancher/v2.6/en/monitoring-alerting/configuration/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/monitoring-alerting/configuration/_index.md b/content/rancher/v2.6/en/monitoring-alerting/configuration/_index.md index e8204151ee9..876031fb4d7 100644 --- a/content/rancher/v2.6/en/monitoring-alerting/configuration/_index.md +++ b/content/rancher/v2.6/en/monitoring-alerting/configuration/_index.md @@ -11,7 +11,7 @@ For information on configuring custom scrape targets and rules for Prometheus, p The resource requests and limits for the monitoring application can be configured when installing `rancher-monitoring`. For more information about the default limits, see [this page.](./helm-chart-options/#configuring-resource-limits-and-requests) ->**Warning:** On an idle cluster, Monitoring V2 has significantly higher CPU usage (up to 70%) as compared to Monitoring V1. +>**Note:** On an idle cluster, Monitoring V2 has significantly higher CPU usage (up to 70%) as compared to Monitoring V1. To improve performance and achieve similar results as in Monitoring V1, turn off the Prometheus adapter. # Prometheus Configuration From 4066de9d55628380c63dfc939f61435def3df091 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 21 Dec 2021 12:41:31 -0500 Subject: [PATCH 119/478] Updated revision --- .../v2.5/en/k8s-in-rancher/workloads/deploy-workloads/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/k8s-in-rancher/workloads/deploy-workloads/_index.md b/content/rancher/v2.5/en/k8s-in-rancher/workloads/deploy-workloads/_index.md index 567d8f9994c..4d90d3f5db1 100644 --- a/content/rancher/v2.5/en/k8s-in-rancher/workloads/deploy-workloads/_index.md +++ b/content/rancher/v2.5/en/k8s-in-rancher/workloads/deploy-workloads/_index.md @@ -16,7 +16,7 @@ Deploy a workload to run an application in one or more containers. 1. Enter a **Name** for the workload. -1. Select a [workload type]({{}}/rancher/v2.5/en/k8s-in-rancher/workloads/). The workload defaults to a scalable deployment, but can change the workload type by clicking **More options.** +1. Select a [workload type]({{}}/rancher/v2.5/en/k8s-in-rancher/workloads/). The workload defaults to a scalable deployment, but you can change the workload type by clicking **More options.** 1. From the **Docker Image** field, enter the name of the Docker image that you want to deploy to the project, optionally prefacing it with the registry host (e.g. `quay.io`, `registry.gitlab.com`, etc.). During deployment, Rancher pulls this image from the specified public or private registry. If no registry host is provided, Rancher will pull the image from [Docker Hub](https://hub.docker.com/explore/). Enter the name exactly as it appears in the registry server, including any required path, and optionally including the desired tag (e.g. `registry.gitlab.com/user/path/image:tag`). If no tag is provided, the `latest` tag will be automatically used. From f1c894ea4ba70b7ee060c4f9aed30899d85f0dcc Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 21 Dec 2021 12:57:05 -0500 Subject: [PATCH 120/478] Fixed typo in 2.0-2.4 docs --- .../en/k8s-in-rancher/workloads/deploy-workloads/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.0-v2.4/en/k8s-in-rancher/workloads/deploy-workloads/_index.md b/content/rancher/v2.0-v2.4/en/k8s-in-rancher/workloads/deploy-workloads/_index.md index 95a39db870d..249bd6e59d9 100644 --- a/content/rancher/v2.0-v2.4/en/k8s-in-rancher/workloads/deploy-workloads/_index.md +++ b/content/rancher/v2.0-v2.4/en/k8s-in-rancher/workloads/deploy-workloads/_index.md @@ -15,7 +15,7 @@ Deploy a workload to run an application in one or more containers. 1. Enter a **Name** for the workload. -1. Select a [workload type]({{}}/rancher/v2.0-v2.4/en/k8s-in-rancher/workloads/). The workload defaults to a scalable deployment, by can change the workload type by clicking **More options.** +1. Select a [workload type]({{}}/rancher/v2.0-v2.4/en/k8s-in-rancher/workloads/). The workload defaults to a scalable deployment, but you can change the workload type by clicking **More options.** 1. From the **Docker Image** field, enter the name of the Docker image that you want to deploy to the project, optionally prefacing it with the registry host (e.g. `quay.io`, `registry.gitlab.com`, etc.). During deployment, Rancher pulls this image from the specified public or private registry. If no registry host is provided, Rancher will pull the image from [Docker Hub](https://hub.docker.com/explore/). Enter the name exactly as it appears in the registry server, including any required path, and optionally including the desired tag (e.g. `registry.gitlab.com/user/path/image:tag`). If no tag is provided, the `latest` tag will be automatically used. From a6d38d26a0fb67ec5c6f67d4468fe7e272765dde Mon Sep 17 00:00:00 2001 From: David Noland Date: Tue, 21 Dec 2021 17:05:06 -0800 Subject: [PATCH 121/478] Changing "Docker" registry reference to "container" --- .../v2.6/en/admin-settings/config-private-registry/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/admin-settings/config-private-registry/_index.md b/content/rancher/v2.6/en/admin-settings/config-private-registry/_index.md index 16690af8bd3..cd36201d114 100644 --- a/content/rancher/v2.6/en/admin-settings/config-private-registry/_index.md +++ b/content/rancher/v2.6/en/admin-settings/config-private-registry/_index.md @@ -3,7 +3,7 @@ title: Configuring a Global Default Private Registry weight: 40 --- -You might want to use a private Docker registry to share your custom base images within your organization. With a private registry, you can keep a private, consistent, and centralized source of truth for the container images that are used in your clusters. +You might want to use a private container registry to share your custom base images within your organization. With a private registry, you can keep a private, consistent, and centralized source of truth for the container images that are used in your clusters. There are two main ways to set up private registries in Rancher: by setting up the global default registry through the **Settings** tab in the global view, and by setting up a private registry in the advanced options in the cluster-level settings. The global default registry is intended to be used for air-gapped setups, for registries that do not require credentials. The cluster-level private registry is intended to be used in all setups in which the private registry requires credentials. @@ -35,4 +35,4 @@ You can follow these steps to configure a private registry when you create a clu **Result:** The new cluster will be able to pull images from the private registry. -The private registry cannot be configured after the cluster is created. \ No newline at end of file +The private registry cannot be configured after the cluster is created. From 21a54371a10f9f01d9914b92d3d390f2e35e3085 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 22 Dec 2021 17:19:14 +0000 Subject: [PATCH 122/478] Reworded note on resource quota for 2.0-2.4 --- .../v2.0-v2.4/en/project-admin/resource-quotas/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.0-v2.4/en/project-admin/resource-quotas/_index.md b/content/rancher/v2.0-v2.4/en/project-admin/resource-quotas/_index.md index 6cac538d8f9..af27d4b3457 100644 --- a/content/rancher/v2.0-v2.4/en/project-admin/resource-quotas/_index.md +++ b/content/rancher/v2.0-v2.4/en/project-admin/resource-quotas/_index.md @@ -45,4 +45,4 @@ Edit [resource quotas]({{}}/rancher/v2.0-v2.4/en/k8s-in-rancher/project 1. Click **Create**. -**Result:** The resource quota is applied to your project and namespaces. When you add more namespaces in the future, Rancher validates that the project can accommodate the namespace. If the project can't allocate the resources, Rancher won't let you save your changes. +**Result:** The resource quota is applied to your project and namespaces. When you add more namespaces in the future, Rancher validates that the project can accommodate the namespace. If the project can't allocate the resources, you may still create namespaces, but they will be given a resource quota of 0. Subsequently, Rancher will not allow you to create any resources restricted by this quota. From 5b04f41329209860c4d4b258f9b7cc879f047632 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 22 Dec 2021 17:25:50 +0000 Subject: [PATCH 123/478] Reworded note on resource quota for 2.5 --- content/rancher/v2.5/en/project-admin/resource-quotas/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/project-admin/resource-quotas/_index.md b/content/rancher/v2.5/en/project-admin/resource-quotas/_index.md index 77f54f689cc..5bd7f0ae075 100644 --- a/content/rancher/v2.5/en/project-admin/resource-quotas/_index.md +++ b/content/rancher/v2.5/en/project-admin/resource-quotas/_index.md @@ -42,4 +42,4 @@ Edit [resource quotas]({{}}/rancher/v2.5/en/cluster-admin/projects-and- 1. Click **Create**. -**Result:** The resource quota is applied to your project and namespaces. When you add more namespaces in the future, Rancher validates that the project can accommodate the namespace. If the project can't allocate the resources, Rancher won't let you save your changes. +**Result:** The resource quota is applied to your project and namespaces. When you add more namespaces in the future, Rancher validates that the project can accommodate the namespace. If the project can't allocate the resources, you may still create namespaces, but they will be given a resource quota of 0. Subsequently, Rancher will not allow you to create any resources restricted by this quota. From b00f8980a657ceadcae344c35f3b6deccb8910cd Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 22 Dec 2021 17:27:22 +0000 Subject: [PATCH 124/478] Reworded note on resource quota for 2.6 --- content/rancher/v2.6/en/project-admin/resource-quotas/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/project-admin/resource-quotas/_index.md b/content/rancher/v2.6/en/project-admin/resource-quotas/_index.md index 7b4239b9bdd..75e1aea6b90 100644 --- a/content/rancher/v2.6/en/project-admin/resource-quotas/_index.md +++ b/content/rancher/v2.6/en/project-admin/resource-quotas/_index.md @@ -38,4 +38,4 @@ Edit resource quotas when: 1. Click **Create**. -**Result:** The resource quota is applied to your project and namespaces. When you add more namespaces in the future, Rancher validates that the project can accommodate the namespace. If the project can't allocate the resources, Rancher won't let you save your changes. +**Result:** The resource quota is applied to your project and namespaces. When you add more namespaces in the future, Rancher validates that the project can accommodate the namespace. If the project can't allocate the resources, you may still create namespaces, but they will be given a resource quota of 0. Subsequently, Rancher will not allow you to create any resources restricted by this quota. From d408f60c5d26dcf1256bb98c50eb3d1bc90688d0 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Thu, 23 Dec 2021 18:50:25 +0000 Subject: [PATCH 125/478] Added new section for charts versioning scheme in 2.6 --- content/rancher/v2.6/en/helm-charts/_index.md | 50 +++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/content/rancher/v2.6/en/helm-charts/_index.md b/content/rancher/v2.6/en/helm-charts/_index.md index 68e52a68d9a..a41c062340f 100644 --- a/content/rancher/v2.6/en/helm-charts/_index.md +++ b/content/rancher/v2.6/en/helm-charts/_index.md @@ -5,6 +5,56 @@ weight: 11 In this section, you'll learn how to manage Helm chart repositories and applications in Rancher. Helm chart repositories are managed using **Apps & Marketplace**. It uses a catalog-like system to import bundles of charts from repositories and then uses those charts to either deploy custom Helm applications or Rancher's tools such as Monitoring or Istio. Rancher tools come as pre-loaded repositories which deploy as standalone Helm charts. Any additional repositories are only added to the current cluster. +### Changes in Rancher v2.6 + +Starting in Rancher v2.6.0, a new versioning scheme for Rancher feature charts was implemented for Monitoring. The changes are centered around the major version of the charts and the +up annotation for upstream charts, where applicable. + +**Major Version:** The major version of the charts is tied to Rancher minor versions. When you upgrade to a new Rancher minor version, you should ensure that all of your **Apps & Marketplace** charts are also upgraded to the correct release line for the chart. + +>**Note:** Any major versions that are less than the ones mentioned in the table below are meant for 2.5 and below only. For example, you are advised to not use <100.x.x versions of Monitoring in 2.6.x+. + +**Feature Charts for Monitoring V2:** + +| **Name** | **Starting Major Version** | +| ---------------- | ------------------ | +| rancher-vsphere-csi | 100.0.0 | +| rancher-vsphere-cpi | 100.0.0 | +| Logging V2 | 100.0.0+up3.12.0 | +| Monitoring V2 | 100.0.0+up16.6.0 | +| gke-operator | 100.0.0+up1.1.1 | +| aks-operator | 100.0.0+up1.0.1 | +| eks-operator | 100.0.0+up1.1.1 | +| rancher-backup | 2.0.0 | +| rancher-alerting-drivers | 100.0.0 | +| rancher-prom2teams | 100.0.0+up0.2.0 | +| rancher-sachet | 100.0.0 | +| rancher-cis-benchmark | 2.0.0 | +| fleet | 100.0.0+up0.3.6 | +| longhorn | 100.0.0+up1.1.2 | +| rancher-gatekeeper | 100.0.0+up3.5.1 | +| rancher-istio | 100.0.0+up1.10.4 | +| rancher-kiali-server | 100.0.0+up1.35.0 | +| rancher-tracing | 100.0.0 | +| rancher-pushprox | 100.0.0 | +| rancher-prometheus-adapter | 100.0.0+up2.14.0 | +| rancher-grafana | 100.0.0+up6.11.0 | +| rancher-windows-exporter | 100.0.0 | +| rancher-node-exporter | 100.0.0+up1.18.1 | +| rancher-kube-state-metrics | 100.0.0+up3.2.0 | +| rancher-wins-upgrader | 100.0.0+up0.0.1 | +| system-upgrade-controller | 100.0.0+up0.3.0 | +| rancher-webhook | 1.0.0+up0.2.0 | +| external-ip-webhook | 100.0.0+up1.0.0 | +| rancher-sriov | 100.0.0+up0.1.0 | + +
+**Charts based on upstream:** For charts that are based on upstreams, the +up annotation should inform you of what upstream version the Rancher chart is tracking. Check the upstream version compatibility with Rancher during upgrades also. + +- As an example, `100.x.x+up16.6.0` for Monitoring tracks upstream kube-prometheus-stack `16.6.0` with some Rancher patches added to it + +- On upgrades, ensure that you are not downgrading the version of the chart that you are using. For example, if you are using a version of Monitoring > `16.6.0` in Rancher 2.5, you should not upgrade to `100.x.x+up16.6.0`. Instead, you should upgrade to the appropriate version in the next release. + + ### Charts From the top-left menu select _"Apps & Marketplace"_ and you will be taken to the Charts page. From 206d5e977f43c481018faf3100eb244cc9ac7cb2 Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Thu, 30 Dec 2021 09:57:29 +0100 Subject: [PATCH 126/478] Restructure v2.6 security docs Signed-off-by: Guilherme Macedo --- content/rancher/v2.6/en/security/_index.md | 2 +- .../v2.6/en/security/best-practices/_index.md | 32 +- .../v2.6/en/security/cis-scans/_index.md | 289 ++ .../cis-scans/configuration/_index.md | 98 + .../cis-scans/custom-benchmark/_index.md | 84 + .../v2.6/en/security/cis-scans/rbac/_index.md | 50 + .../cis-scans/skipped-tests/_index.md | 54 + .../rancher/v2.6/en/security/cve/_index.md | 6 +- .../en/security/hardening-guides/_index.md | 7 + .../rancher-2.5/1.5-benchmark-2.5/_index.md | 2265 ----------- .../rancher-2.5/1.5-hardening-2.5/_index.md | 720 ---- .../rancher-2.5/1.6-benchmark-2.5/_index.md | 3317 ----------------- .../rancher-2.5/1.6-hardening-2.5/_index.md | 570 --- .../v2.6/en/security/rancher-2.5/_index.md | 55 - .../v2.6/en/security/security-scan/_index.md | 6 - 15 files changed, 616 insertions(+), 6939 deletions(-) create mode 100644 content/rancher/v2.6/en/security/cis-scans/_index.md create mode 100644 content/rancher/v2.6/en/security/cis-scans/configuration/_index.md create mode 100644 content/rancher/v2.6/en/security/cis-scans/custom-benchmark/_index.md create mode 100644 content/rancher/v2.6/en/security/cis-scans/rbac/_index.md create mode 100644 content/rancher/v2.6/en/security/cis-scans/skipped-tests/_index.md create mode 100644 content/rancher/v2.6/en/security/hardening-guides/_index.md delete mode 100644 content/rancher/v2.6/en/security/rancher-2.5/1.5-benchmark-2.5/_index.md delete mode 100644 content/rancher/v2.6/en/security/rancher-2.5/1.5-hardening-2.5/_index.md delete mode 100644 content/rancher/v2.6/en/security/rancher-2.5/1.6-benchmark-2.5/_index.md delete mode 100644 content/rancher/v2.6/en/security/rancher-2.5/1.6-hardening-2.5/_index.md delete mode 100644 content/rancher/v2.6/en/security/rancher-2.5/_index.md delete mode 100644 content/rancher/v2.6/en/security/security-scan/_index.md diff --git a/content/rancher/v2.6/en/security/_index.md b/content/rancher/v2.6/en/security/_index.md index 871203d2102..5780e27a265 100644 --- a/content/rancher/v2.6/en/security/_index.md +++ b/content/rancher/v2.6/en/security/_index.md @@ -11,7 +11,7 @@ weight: 20

Reporting process

-

Please submit possible security issues by emailing security@rancher.com

+

Please submit possible security issues by emailing security@rancher.com .

Announcements

diff --git a/content/rancher/v2.6/en/security/best-practices/_index.md b/content/rancher/v2.6/en/security/best-practices/_index.md index 1b207551e35..bb31bfca47c 100644 --- a/content/rancher/v2.6/en/security/best-practices/_index.md +++ b/content/rancher/v2.6/en/security/best-practices/_index.md @@ -1,8 +1,36 @@ --- -title: Kubernetes Security Best Practices +title: Security Best Practices weight: 5 --- -# Restricting cloud metadata API access +### Restricting cloud metadata API access Cloud providers such as AWS, Azure, or GCP often expose metadata services locally to instances. By default, this endpoint is accessible by pods running on a cloud instance, including pods in hosted Kubernetes providers such as EKS, AKS or GKE, and can contain cloud credentials for that node, provisioning data such as kubelet credentials, or other sensitive data. To mitigate this risk when running on a cloud platform, follow the [Kubernetes security recommendations](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/#restricting-cloud-metadata-api-access): limit permissions given to instance credentials, use network policies to restrict pod access to the metadata API, and avoid using provisioning data to deliver secrets. + +Below is an example of a global network policy (`GlobalNetworkPolicy`) using Calico to restrict access to cloud metadata API. + +``` +apiVersion: projectcalico.org/v3 +kind: GlobalNetworkPolicy +metadata: + name: allow-all-egress-except-metadata-api +spec: + selector: all() + egress: + - action: Deny + protocol: TCP + destination: + nets: + - 169.254.169.254/32 + - action: Allow + destination: + nets: + - 0.0.0.0/0 +``` +A similar policy can be created with Canal and Weave. For the list of approved CNI (Container Network Interface) providers in Rancher, please consult this [list]({{}}/rancher/v2.6/en/faq/networking/cni-providers). + +Removing unnecessary packages and using reduced base images is also a good defense in depth strategy to reduce the attack surface against possible abuses of the cloud metadata API. As well as following the principle of least privilege and using instances profiles and roles with the least amount of required permissions for the services to fully function. + +It is advised to consult your cloud provider's security best practices for further recommendations and specific details on how to restrict access to cloud instance metadata API. + +Further references: MITRE ATT&CK knowledge base on - [Unsecured Credentials: Cloud Instance Metadata API](https://attack.mitre.org/techniques/T1552/005/). diff --git a/content/rancher/v2.6/en/security/cis-scans/_index.md b/content/rancher/v2.6/en/security/cis-scans/_index.md new file mode 100644 index 00000000000..17aa5a5a3b1 --- /dev/null +++ b/content/rancher/v2.6/en/security/cis-scans/_index.md @@ -0,0 +1,289 @@ +--- +title: CIS Scans +weight: 17 +--- + +Rancher can run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark. The CIS scans can run on any Kubernetes cluster, including hosted Kubernetes providers such as EKS, AKS, and GKE. + +The `rancher-cis-benchmark` app leverages kube-bench, an open-source tool from Aqua Security, to check clusters for CIS Kubernetes Benchmark compliance. Also, to generate a cluster-wide report, the application utilizes Sonobuoy for report aggregation. + +- [About the CIS Benchmark](#about-the-cis-benchmark) +- [About the Generated Report](#about-the-generated-report) +- [Test Profiles](#test-profiles) +- [About Skipped and Not Applicable Tests](#about-skipped-and-not-applicable-tests) +- [Roles-based Access Control](./rbac) +- [Configuration](./configuration) +- [How-to Guides](#how-to-guides) + - [Installing CIS Benchmark](#installing-cis-benchmark) + - [Uninstalling CIS Benchmark](#uninstalling-cis-benchmark) + - [Running a Scan](#running-a-scan) + - [Running a Scan Periodically on a Schedule](#running-a-scan-periodically-on-a-schedule) + - [Skipping Tests](#skipping-tests) + - [Viewing Reports](#viewing-reports) + - [Enabling Alerting for rancher-cis-benchmark](#enabling-alerting-for-rancher-cis-benchmark) + - [Configuring Alerts for a Periodic Scan on a Schedule](#configuring-alerts-for-a-periodic-scan-on-a-schedule) + - [Creating a Custom Benchmark Version for Running a Cluster Scan](#creating-a-custom-benchmark-version-for-running-a-cluster-scan) + + +# About the CIS Benchmark + +The Center for Internet Security is a 501(c\)(3) non-profit organization, formed in October 2000, with a mission to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace". The organization is headquartered in East Greenbush, New York, with members including large corporations, government agencies, and academic institutions. + +CIS Benchmarks are best practices for the secure configuration of a target system. CIS Benchmarks are developed through the generous volunteer efforts of subject matter experts, technology vendors, public and private community members, and the CIS Benchmark Development team. + +The official Benchmark documents are available through the CIS website. The sign-up form to access the documents is +here. + +# About the Generated Report + +Each scan generates a report can be viewed in the Rancher UI and can be downloaded in CSV format. + +By default, the CIS Benchmark v1.6 is used. + +The Benchmark version is included in the generated report. + +The Benchmark provides recommendations of two types: Automated and Manual. Recommendations marked as Manual in the Benchmark are not included in the generated report. + +Some tests are designated as "Not Applicable." These tests will not be run on any CIS scan because of the way that Rancher provisions RKE clusters. For information on how test results can be audited, and why some tests are designated to be not applicable, refer to Rancher's self-assessment guide for the corresponding Kubernetes version. + +The report contains the following information: + +| Column in Report | Description | +|------------------|-------------| +| `id` | The ID number of the CIS Benchmark. | +| `description` | The description of the CIS Benchmark test. | +| `remediation` | What needs to be fixed in order to pass the test. | +| `state` | Indicates if the test passed, failed, was skipped, or was not applicable. | +| `node_type` | The node role, which affects which tests are run on the node. Master tests are run on controlplane nodes, etcd tests are run on etcd nodes, and node tests are run on the worker nodes. | +| `audit` | This is the audit check that `kube-bench` runs for this test. | +| `audit_config` | Any configuration applicable to the audit script. | +| `test_info` | Test-related info as reported by `kube-bench`, if any. | +| `commands` | Test-related commands as reported by `kube-bench`, if any. | +| `config_commands` | Test-related configuration data as reported by `kube-bench`, if any. | +| `actual_value` | The test's actual value, present if reported by `kube-bench`. | +| `expected_result` | The test's expected result, present if reported by `kube-bench`. | + +Refer to the table in the cluster hardening guide for information on which versions of Kubernetes, the Benchmark, Rancher, and our cluster hardening guide correspond to each other. Also refer to the hardening guide for configuration files of CIS-compliant clusters and information on remediating failed tests. + +# Test Profiles + +The following profiles are available: + +- Generic CIS 1.5 +- Generic CIS 1.6 +- RKE permissive 1.5 +- RKE hardened 1.5 +- RKE permissive 1.6 +- RKE hardened 1.6 +- EKS +- GKE +- RKE2 permissive 1.5 +- RKE2 permissive 1.5 + +You also have the ability to customize a profile by saving a set of tests to skip. + +All profiles will have a set of not applicable tests that will be skipped during the CIS scan. These tests are not applicable based on how a RKE cluster manages Kubernetes. + +There are two types of RKE cluster scan profiles: + +- **Permissive:** This profile has a set of tests that have been will be skipped as these tests will fail on a default RKE Kubernetes cluster. Besides the list of skipped tests, the profile will also not run the not applicable tests. +- **Hardened:** This profile will not skip any tests, except for the non-applicable tests. + +The EKS and GKE cluster scan profiles are based on CIS Benchmark versions that are specific to those types of clusters. + +In order to pass the "Hardened" profile, you will need to follow the steps on the hardening guide and use the `cluster.yml` defined in the hardening guide to provision a hardened cluster. + +The default profile and the supported CIS benchmark version depends on the type of cluster that will be scanned: + +The `rancher-cis-benchmark` supports the CIS 1.6 Benchmark version. + +- For RKE Kubernetes clusters, the RKE Permissive 1.6 profile is the default. +- EKS and GKE have their own CIS Benchmarks published by `kube-bench`. The corresponding test profiles are used by default for those clusters. +- For RKE2 Kubernetes clusters, the RKE2 Permissive 1.5 profile is the default. +- For cluster types other than RKE, RKE2, EKS and GKE, the Generic CIS 1.5 profile will be used by default. + +# About Skipped and Not Applicable Tests + +For a list of skipped and not applicable tests, refer to this page. + +For now, only user-defined skipped tests are marked as skipped in the generated report. + +Any skipped tests that are defined as being skipped by one of the default profiles are marked as not applicable. + +# Roles-based Access Control + +For information about permissions, refer to this page. + +# Configuration + +For more information about configuring the custom resources for the scans, profiles, and benchmark versions, refer to this page. + +# How-to Guides + +- [Installing rancher-cis-benchmark](#installing-rancher-cis-benchmark) +- [Uninstalling rancher-cis-benchmark](#uninstalling-rancher-cis-benchmark) +- [Running a Scan](#running-a-scan) +- [Running a Scan Periodically on a Schedule](#running-a-scan-periodically-on-a-schedule) +- [Skipping Tests](#skipping-tests) +- [Viewing Reports](#viewing-reports) +- [Enabling Alerting for rancher-cis-benchmark](#enabling-alerting-for-rancher-cis-benchmark) +- [Configuring Alerts for a Periodic Scan on a Schedule](#configuring-alerts-for-a-periodic-scan-on-a-schedule) +- [Creating a Custom Benchmark Version for Running a Cluster Scan](#creating-a-custom-benchmark-version-for-running-a-cluster-scan) +### Installing CIS Benchmark + +1. In the upper left corner, click **☰ > Cluster Management**. +1. On the **Clusters** page, go to the cluster where you want to install CIS Benchmark and click **Explore**. +1. In the left navigation bar, click **Apps & Marketplace > Charts**. +1. Click **CIS Benchmark** +1. Click **Install**. + +**Result:** The CIS scan application is deployed on the Kubernetes cluster. + +### Uninstalling CIS Benchmark + +1. From the **Cluster Dashboard,** go to the left navigation bar and click **Apps & Marketplace > Installed Apps**. +1. Go to the `cis-operator-system` namespace and check the boxes next to `rancher-cis-benchmark-crd` and `rancher-cis-benchmark`. +1. Click **Delete** and confirm **Delete**. + +**Result:** The `rancher-cis-benchmark` application is uninstalled. + +### Running a Scan + +When a ClusterScan custom resource is created, it launches a new CIS scan on the cluster for the chosen ClusterScanProfile. + +Note: There is currently a limitation of running only one CIS scan at a time for a cluster. If you create multiple ClusterScan custom resources, they will be run one after the other by the operator, and until one scan finishes, the rest of the ClusterScan custom resources will be in the "Pending" state. + +To run a scan, + +1. In the upper left corner, click **☰ > Cluster Management**. +1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**. +1. Click **CIS Benchmark > Scan**. +1. Click **Create**. +1. Choose a cluster scan profile. The profile determines which CIS Benchmark version will be used and which tests will be performed. If you choose the Default profile, then the CIS Operator will choose a profile applicable to the type of Kubernetes cluster it is installed on. +1. Click **Create**. + +**Result:** A report is generated with the scan results. To see the results, click the name of the scan that appears. +### Running a Scan Periodically on a Schedule + +To run a ClusterScan on a schedule, + +1. In the upper left corner, click **☰ > Cluster Management**. +1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**. +1. Click **CIS Benchmark > Scan**. +1. Choose a cluster scan profile. The profile determines which CIS Benchmark version will be used and which tests will be performed. If you choose the Default profile, then the CIS Operator will choose a profile applicable to the type of Kubernetes cluster it is installed on. +1. Choose the option **Run scan on a schedule**. +1. Enter a valid cron schedule expression in the field **Schedule**. +1. Choose a **Retention** count, which indicates the number of reports maintained for this recurring scan. By default this count is 3. When this retention limit is reached, older reports will get purged. +1. Click **Create**. + +**Result:** The scan runs and reschedules to run according to the cron schedule provided. The **Next Scan** value indicates the next time this scan will run again. + +A report is generated with the scan results every time the scan runs. To see the latest results, click the name of the scan that appears. + +You can also see the previous reports by choosing the report from the **Reports** dropdown on the scan detail page. + +### Skipping Tests + +CIS scans can be run using test profiles with user-defined skips. + +To skip tests, you will create a custom CIS scan profile. A profile contains the configuration for the CIS scan, which includes the benchmark versions to use and any specific tests to skip in that benchmark. + +1. In the upper left corner, click **☰ > Cluster Management**. +1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**. +1. Click **CIS Benchmark > Profile**. +1. From here, you can create a profile in multiple ways. To make a new profile, click **Create** and fill out the form in the UI. To make a new profile based on an existing profile, go to the existing profile and click **⋮ Clone**. If you are filling out the form, add the tests to skip using the test IDs, using the relevant CIS Benchmark as a reference. If you are creating the new test profile as YAML, you will add the IDs of the tests to skip in the `skipTests` directive. You will also give the profile a name: + + ```yaml + apiVersion: cis.cattle.io/v1 + kind: ClusterScanProfile + metadata: + annotations: + meta.helm.sh/release-name: clusterscan-operator + meta.helm.sh/release-namespace: cis-operator-system + labels: + app.kubernetes.io/managed-by: Helm + name: "" + spec: + benchmarkVersion: cis-1.5 + skipTests: + - "1.1.20" + - "1.1.21" + ``` +1. Click **Create**. + +**Result:** A new CIS scan profile is created. + +When you [run a scan](#running-a-scan) that uses this profile, the defined tests will be skipped during the scan. The skipped tests will be marked in the generated report as `Skip`. + +### Viewing Reports + +To view the generated CIS scan reports, + +1. In the upper left corner, click **☰ > Cluster Management**. +1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**. +1. Click **CIS Benchmark > Scan**. +1. The **Scans** page will show the generated reports. To see a detailed report, go to a scan report and click the name. + +One can download the report from the Scans list or from the scan detail page. + +### Enabling Alerting for rancher-cis-benchmark + +Alerts can be configured to be sent out for a scan that runs on a schedule. + +> **Prerequisite:** +> +> Before enabling alerts for `rancher-cis-benchmark`, make sure to install the `rancher-monitoring` application and configure the Receivers and Routes. For more information, see [this section.]({{}}/rancher/v2.6/en/monitoring-alerting/configuration) +> +> While configuring the routes for `rancher-cis-benchmark` alerts, you can specify the matching using the key-value pair `job: rancher-cis-scan`. An example route configuration is [here.]({{}}/rancher/v2.6/en/monitoring-alerting/configuration/receiver/#example-route-config-for-cis-scan-alerts) + +While installing or upgrading the `rancher-cis-benchmark` Helm chart, set the following flag to `true` in the `values.yaml`: + +```yaml +alerts: + enabled: true +``` + +### Configuring Alerts for a Periodic Scan on a Schedule + +It is possible to run a ClusterScan on a schedule. + +A scheduled scan can also specify if you should receive alerts when the scan completes. + +Alerts are supported only for a scan that runs on a schedule. + +The CIS Benchmark application supports two types of alerts: + +- Alert on scan completion: This alert is sent out when the scan run finishes. The alert includes details including the ClusterScan's name and the ClusterScanProfile name. +- Alert on scan failure: This alert is sent out if there are some test failures in the scan run or if the scan is in a `Fail` state. + +> **Prerequisite:** +> +> Before enabling alerts for `rancher-cis-benchmark`, make sure to install the `rancher-monitoring` application and configure the Receivers and Routes. For more information, see [this section.]({{}}/rancher/v2.6/en/monitoring-alerting/configuration) +> +> While configuring the routes for `rancher-cis-benchmark` alerts, you can specify the matching using the key-value pair `job: rancher-cis-scan`. An example route configuration is [here.]({{}}/rancher/v2.6/en/monitoring-alerting/configuration/receiver/#example-route-config-for-cis-scan-alerts) + +To configure alerts for a scan that runs on a schedule, + +1. Please enable alerts on the `rancher-cis-benchmark` application (#enabling-alerting-for-rancher-cis-benchmark) +1. In the upper left corner, click **☰ > Cluster Management**. +1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**. +1. Click **CIS Benchmark > Scan**. +1. Click **Create**. +1. Choose a cluster scan profile. The profile determines which CIS Benchmark version will be used and which tests will be performed. If you choose the Default profile, then the CIS Operator will choose a profile applicable to the type of Kubernetes cluster it is installed on. +1. Choose the option **Run scan on a schedule**. +1. Enter a valid [cron schedule expression](https://en.wikipedia.org/wiki/Cron#CRON_expression) in the field **Schedule**. +1. Check the boxes next to the Alert types under **Alerting**. +1. Optional: Choose a **Retention Count**, which indicates the number of reports maintained for this recurring scan. By default this count is 3. When this retention limit is reached, older reports will get purged. +1. Click **Create**. + +**Result:** The scan runs and reschedules to run according to the cron schedule provided. Alerts are sent out when the scan finishes if routes and receiver are configured under `rancher-monitoring` application. + +A report is generated with the scan results every time the scan runs. To see the latest results, click the name of the scan that appears. + +### Creating a Custom Benchmark Version for Running a Cluster Scan + +There could be some Kubernetes cluster setups that require custom configurations of the Benchmark tests. For example, the path to the Kubernetes config files or certs might be different than the standard location where the upstream CIS Benchmarks look for them. + +It is now possible to create a custom Benchmark Version for running a cluster scan using the `rancher-cis-benchmark` application. + +For details, see [this page.](./custom-benchmark) diff --git a/content/rancher/v2.6/en/security/cis-scans/configuration/_index.md b/content/rancher/v2.6/en/security/cis-scans/configuration/_index.md new file mode 100644 index 00000000000..26df1932e25 --- /dev/null +++ b/content/rancher/v2.6/en/security/cis-scans/configuration/_index.md @@ -0,0 +1,98 @@ +--- +title: Configuration +weight: 3 +--- + +This configuration reference is intended to help you manage the custom resources created by the `rancher-cis-benchmark` application. These resources are used for performing CIS scans on a cluster, skipping tests, setting the test profile that will be used during a scan, and other customization. + +To configure the custom resources, go to the **Cluster Dashboard** To configure the CIS scans, + +1. In the upper left corner, click **☰ > Cluster Management**. +1. On the **Clusters** page, go to the cluster where you want to configure CIS scans and click **Explore**. +1. In the left navigation bar, click **CIS Benchmark**. + +### Scans + +A scan is created to trigger a CIS scan on the cluster based on the defined profile. A report is created after the scan is completed. + +When configuring a scan, you need to define the name of the scan profile that will be used with the `scanProfileName` directive. + +An example ClusterScan custom resource is below: + +```yaml +apiVersion: cis.cattle.io/v1 +kind: ClusterScan +metadata: + name: rke-cis +spec: + scanProfileName: rke-profile-hardened +``` + +### Profiles + +A profile contains the configuration for the CIS scan, which includes the benchmark version to use and any specific tests to skip in that benchmark. + +> By default, a few ClusterScanProfiles are installed as part of the `rancher-cis-benchmark` chart. If a user edits these default benchmarks or profiles, the next chart update will reset them back. So it is advisable for users to not edit the default ClusterScanProfiles. + +Users can clone the ClusterScanProfiles to create custom profiles. + +Skipped tests are listed under the `skipTests` directive. + +When you create a new profile, you will also need to give it a name. + +An example `ClusterScanProfile` is below: + +```yaml +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + annotations: + meta.helm.sh/release-name: clusterscan-operator + meta.helm.sh/release-namespace: cis-operator-system + labels: + app.kubernetes.io/managed-by: Helm + name: "" +spec: + benchmarkVersion: cis-1.5 + skipTests: + - "1.1.20" + - "1.1.21" +``` + +### Benchmark Versions + +A benchmark version is the name of benchmark to run using `kube-bench`, as well as the valid configuration parameters for that benchmark. + +A `ClusterScanBenchmark` defines the CIS `BenchmarkVersion` name and test configurations. The `BenchmarkVersion` name is a parameter provided to the `kube-bench` tool. + +By default, a few `BenchmarkVersion` names and test configurations are packaged as part of the CIS scan application. When this feature is enabled, these default BenchmarkVersions will be automatically installed and available for users to create a ClusterScanProfile. + +> If the default BenchmarkVersions are edited, the next chart update will reset them back. Therefore we don't recommend editing the default ClusterScanBenchmarks. + +A ClusterScanBenchmark consists of the fields: + +- `ClusterProvider`: This is the cluster provider name for which this benchmark is applicable. For example: RKE, EKS, GKE, etc. Leave it empty if this benchmark can be run on any cluster type. +- `MinKubernetesVersion`: Specifies the cluster's minimum kubernetes version necessary to run this benchmark. Leave it empty if there is no dependency on a particular Kubernetes version. +- `MaxKubernetesVersion`: Specifies the cluster's maximum Kubernetes version necessary to run this benchmark. Leave it empty if there is no dependency on a particular k8s version. + +An example `ClusterScanBenchmark` is below: + +```yaml +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + annotations: + meta.helm.sh/release-name: clusterscan-operator + meta.helm.sh/release-namespace: cis-operator-system + creationTimestamp: "2020-08-28T18:18:07Z" + generation: 1 + labels: + app.kubernetes.io/managed-by: Helm + name: cis-1.5 + resourceVersion: "203878" + selfLink: /apis/cis.cattle.io/v1/clusterscanbenchmarks/cis-1.5 + uid: 309e543e-9102-4091-be91-08d7af7fb7a7 +spec: + clusterProvider: "" + minKubernetesVersion: 1.15.0 +``` \ No newline at end of file diff --git a/content/rancher/v2.6/en/security/cis-scans/custom-benchmark/_index.md b/content/rancher/v2.6/en/security/cis-scans/custom-benchmark/_index.md new file mode 100644 index 00000000000..36f70ccaa55 --- /dev/null +++ b/content/rancher/v2.6/en/security/cis-scans/custom-benchmark/_index.md @@ -0,0 +1,84 @@ +--- +title: Creating a Custom Benchmark Version for Running a Cluster Scan +weight: 4 +--- + +Each Benchmark Version defines a set of test configuration files that define the CIS tests to be run by the kube-bench tool. +The `rancher-cis-benchmark` application installs a few default Benchmark Versions which are listed under CIS Benchmark application menu. + +But there could be some Kubernetes cluster setups that require custom configurations of the Benchmark tests. For example, the path to the Kubernetes config files or certs might be different than the standard location where the upstream CIS Benchmarks look for them. + +It is now possible to create a custom Benchmark Version for running a cluster scan using the `rancher-cis-benchmark` application. + +When a cluster scan is run, you need to select a Profile which points to a specific Benchmark Version. + +Follow all the steps below to add a custom Benchmark Version and run a scan using it. + +1. [Prepare the Custom Benchmark Version ConfigMap](#1-prepare-the-custom-benchmark-version-configmap) +2. [Add a Custom Benchmark Version to a Cluster](#2-add-a-custom-benchmark-version-to-a-cluster) +3. [Create a New Profile for the Custom Benchmark Version](#3-create-a-new-profile-for-the-custom-benchmark-version) +4. [Run a Scan Using the Custom Benchmark Version](#4-run-a-scan-using-the-custom-benchmark-version) + +### 1. Prepare the Custom Benchmark Version ConfigMap + +To create a custom benchmark version, first you need to create a ConfigMap containing the benchmark version's config files and upload it to your Kubernetes cluster where you want to run the scan. + +To prepare a custom benchmark version ConfigMap, suppose we want to add a custom Benchmark Version named `foo`. + +1. Create a directory named `foo` and inside this directory, place all the config YAML files that the kube-bench tool looks for. For example, here are the config YAML files for a Generic CIS 1.5 Benchmark Version https://github.com/aquasecurity/kube-bench/tree/master/cfg/cis-1.5 +1. Place the complete `config.yaml` file, which includes all the components that should be tested. +1. Add the Benchmark version name to the `target_mapping` section of the `config.yaml`: + + ```yaml + target_mapping: + "foo": + - "master" + - "node" + - "controlplane" + - "etcd" + - "policies" + ``` +1. Upload this directory to your Kubernetes Cluster by creating a ConfigMap: + + ```yaml + kubectl create configmap -n foo --from-file= + ``` + +### 2. Add a Custom Benchmark Version to a Cluster + +1. In the upper left corner, click **☰ > Cluster Management**. +1. On the **Clusters** page, go to the cluster where you want to add a custom benchmark and click **Explore**. +1. In the left navigation bar, click **CIS Benchmark > Benchmark Version**. +1. Click **Create**. +1. Enter the **Name** and a description for your custom benchmark version. +1. Choose the cluster provider that your benchmark version applies to. +1. Choose the ConfigMap you have uploaded from the dropdown. +1. Add the minimum and maximum Kubernetes version limits applicable, if any. +1. Click **Create**. + +### 3. Create a New Profile for the Custom Benchmark Version + +To run a scan using your custom benchmark version, you need to add a new Profile pointing to this benchmark version. + +1. In the upper left corner, click **☰ > Cluster Management**. +1. On the **Clusters** page, go to the cluster where you want to add a custom benchmark and click **Explore**. +1. In the left navigation bar, click **CIS Benchmark > Profile**. +1. Click **Create**. +1. Provide a **Name** and description. In this example, we name it `foo-profile`. +1. Choose the Benchmark Version from the dropdown. +1. Click **Create**. + +### 4. Run a Scan Using the Custom Benchmark Version + +Once the Profile pointing to your custom benchmark version `foo` has been created, you can create a new Scan to run the custom test configs in the Benchmark Version. + +To run a scan, + +1. In the upper left corner, click **☰ > Cluster Management**. +1. On the **Clusters** page, go to the cluster where you want to add a custom benchmark and click **Explore**. +1. In the left navigation bar, click **CIS Benchmark > Scan**. +1. Click **Create**. +1. Choose the new cluster scan profile. +1. Click **Create**. + +**Result:** A report is generated with the scan results. To see the results, click the name of the scan that appears. diff --git a/content/rancher/v2.6/en/security/cis-scans/rbac/_index.md b/content/rancher/v2.6/en/security/cis-scans/rbac/_index.md new file mode 100644 index 00000000000..ad2b47bff2c --- /dev/null +++ b/content/rancher/v2.6/en/security/cis-scans/rbac/_index.md @@ -0,0 +1,50 @@ +--- +title: Roles-based Access Control +shortTitle: RBAC +weight: 3 +--- + +This section describes the permissions required to use the rancher-cis-benchmark App. + +The rancher-cis-benchmark is a cluster-admin only feature by default. + +However, the `rancher-cis-benchmark` chart installs these two default `ClusterRoles`: + +- cis-admin +- cis-view + +In Rancher, only cluster owners and global administrators have `cis-admin` access by default. + +Note: If you were using the `cis-edit` role added in Rancher v2.5 setup, it has now been removed since +Rancher v2.5.2 because it essentially is same as `cis-admin`. If you happen to create any clusterrolebindings +for `cis-edit`, please update them to use `cis-admin` ClusterRole instead. + +# Cluster-Admin Access + +Rancher CIS Scans is a cluster-admin only feature by default. +This means only the Rancher global admins, and the cluster’s cluster-owner can: + +- Install/Uninstall the rancher-cis-benchmark App +- See the navigation links for CIS Benchmark CRDs - ClusterScanBenchmarks, ClusterScanProfiles, ClusterScans +- List the default ClusterScanBenchmarks and ClusterScanProfiles +- Create/Edit/Delete new ClusterScanProfiles +- Create/Edit/Delete a new ClusterScan to run the CIS scan on the cluster +- View and Download the ClusterScanReport created after the ClusterScan is complete + + +# Summary of Default Permissions for Kubernetes Default Roles + +The rancher-cis-benchmark creates three `ClusterRoles` and adds the CIS Benchmark CRD access to the following default K8s `ClusterRoles`: + +| ClusterRole created by chart | Default K8s ClusterRole | Permissions given with Role +| ------------------------------| ---------------------------| ---------------------------| +| `cis-admin` | `admin`| Ability to CRUD clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR +| `cis-view` | `view `| Ability to List(R) clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR + + +By default only cluster-owner role will have ability to manage and use `rancher-cis-benchmark` feature. + +The other Rancher roles (cluster-member, project-owner, project-member) do not have any default permissions to manage and use rancher-cis-benchmark resources. + +But if a cluster-owner wants to delegate access to other users, they can do so by creating ClusterRoleBindings between these users and the above CIS ClusterRoles manually. +There is no automatic role aggregation supported for the `rancher-cis-benchmark` ClusterRoles. diff --git a/content/rancher/v2.6/en/security/cis-scans/skipped-tests/_index.md b/content/rancher/v2.6/en/security/cis-scans/skipped-tests/_index.md new file mode 100644 index 00000000000..f2b125c0262 --- /dev/null +++ b/content/rancher/v2.6/en/security/cis-scans/skipped-tests/_index.md @@ -0,0 +1,54 @@ +--- +title: Skipped and Not Applicable Tests +weight: 3 +--- + +This section lists the tests that are skipped in the permissive test profile for RKE. + +> All the tests that are skipped and not applicable on this page will be counted as Not Applicable in the v2.5 generated report. The skipped test count will only mention the user-defined skipped tests. This allows user-skipped tests to be distinguished from the tests that are skipped by default in the RKE permissive test profile. + +# CIS Benchmark v1.5 + +### CIS Benchmark v1.5 Skipped Tests + +| Number | Description | Reason for Skipping | +| ---------- | ------------- | --------- | +| 1.1.12 | Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) | A system service account is required for etcd data directory ownership. Refer to Rancher's hardening guide for more details on how to configure this ownership. | +| 1.2.6 | Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers. | +| 1.2.16 | Ensure that the admission control plugin PodSecurityPolicy is set (Automated) | Enabling Pod Security Policy can cause applications to unexpectedly fail. | +| 1.2.33 | Ensure that the --encryption-provider-config argument is set as appropriate (Manual) | Enabling encryption changes how data can be recovered as data is encrypted. | +| 1.2.34 | Ensure that encryption providers are appropriately configured (Manual) | Enabling encryption changes how data can be recovered as data is encrypted. | +| 4.2.6 | Ensure that the --protect-kernel-defaults argument is set to true (Automated) | System level configurations are required before provisioning the cluster in order for this argument to be set to true. | +| 4.2.10 | Ensure that the--tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers. | +| 5.1.5 | Ensure that default service accounts are not actively used. (Automated) | Kubernetes provides default service accounts to be used. | +| 5.2.2 | Minimize the admission of containers wishing to share the host process ID namespace (Automated) | Enabling Pod Security Policy can cause applications to unexpectedly fail. | +| 5.2.3 | Minimize the admission of containers wishing to share the host IPC namespace (Automated) | Enabling Pod Security Policy can cause applications to unexpectedly fail. | +| 5.2.4 | Minimize the admission of containers wishing to share the host network namespace (Automated) | Enabling Pod Security Policy can cause applications to unexpectedly fail. | +| 5.2.5 | Minimize the admission of containers with allowPrivilegeEscalation (Automated) | Enabling Pod Security Policy can cause applications to unexpectedly fail. | +| 5.3.2 | Ensure that all Namespaces have Network Policies defined (Automated) | Enabling Network Policies can prevent certain applications from communicating with each other. | +| 5.6.4 | The default namespace should not be used (Automated) | Kubernetes provides a default namespace. | + +### CIS Benchmark v1.5 Not Applicable Tests + +| Number | Description | Reason for being not applicable | +| ---------- | ------------- | --------- | +| 1.1.1 | Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. All configuration is passed in as arguments at container run time. | +| 1.1.2 | Ensure that the API server pod specification file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. All configuration is passed in as arguments at container run time. | +| 1.1.3 | Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time. | +| 1.1.4 | Ensure that the controller manager pod specification file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time. | +| 1.1.5 | Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time. | +| 1.1.6 | Ensure that the scheduler pod specification file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time. | +| 1.1.7 | Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time. | +| 1.1.8 | Ensure that the etcd pod specification file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time. | +| 1.1.13 | Ensure that the admin.conf file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. | +| 1.1.14 | Ensure that the admin.conf file ownership is set to root:root (Automated) | Clusters provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. | +| 1.1.15 | Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time. | +| 1.1.16 | Ensure that the scheduler.conf file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time. | +| 1.1.17 | Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time. | +| 1.1.18 | Ensure that the controller-manager.conf file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time. | +| 1.3.6 | Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) | Clusters provisioned by RKE handles certificate rotation directly through RKE. | +| 4.1.1 | Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time. | +| 4.1.2 | Ensure that the kubelet service file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time. | +| 4.1.9 | Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. All configuration is passed in as arguments at container run time. | +| 4.1.10 | Ensure that the kubelet configuration file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. All configuration is passed in as arguments at container run time. | +| 4.2.12 | Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) | Clusters provisioned by RKE handles certificate rotation directly through RKE. | \ No newline at end of file diff --git a/content/rancher/v2.6/en/security/cve/_index.md b/content/rancher/v2.6/en/security/cve/_index.md index b97cf1a59c5..174acb15bf0 100644 --- a/content/rancher/v2.6/en/security/cve/_index.md +++ b/content/rancher/v2.6/en/security/cve/_index.md @@ -1,9 +1,9 @@ --- -title: Rancher CVEs and Resolutions +title: Security Advisories and CVEs weight: 300 --- -Rancher is committed to informing the community of security issues in our products. Rancher will publish CVEs (Common Vulnerabilities and Exposures) for issues we have resolved. +Rancher is committed to informing the community of security issues in our products. Rancher will publish security advisories and CVEs (Common Vulnerabilities and Exposures) for issues we have resolved. New security advisories are also published in Rancher's GitHub [security page](https://github.com/rancher/rancher/security/advisories). | ID | Description | Date | Resolution | |----|-------------|------|------------| @@ -18,4 +18,4 @@ Rancher is committed to informing the community of security issues in our produc | [CVE-2019-12274](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12274) | Nodes using the built-in node drivers using a file path option allows the machine to read arbitrary files including sensitive ones from inside the Rancher server container. | 5 Jun 2019 | [Rancher v2.2.4](https://github.com/rancher/rancher/releases/tag/v2.2.4), [Rancher v2.1.10](https://github.com/rancher/rancher/releases/tag/v2.1.10) and [Rancher v2.0.15](https://github.com/rancher/rancher/releases/tag/v2.0.15) | | [CVE-2019-11202](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11202) | The default admin, that is shipped with Rancher, will be re-created upon restart of Rancher despite being explicitly deleted. | 16 Apr 2019 | [Rancher v2.2.2](https://github.com/rancher/rancher/releases/tag/v2.2.2), [Rancher v2.1.9](https://github.com/rancher/rancher/releases/tag/v2.1.9) and [Rancher v2.0.14](https://github.com/rancher/rancher/releases/tag/v2.0.14) | | [CVE-2019-6287](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6287) | Project members continue to get access to namespaces from projects that they were removed from if they were added to more than one project. | 29 Jan 2019 | [Rancher v2.1.6](https://github.com/rancher/rancher/releases/tag/v2.1.6) and [Rancher v2.0.11](https://github.com/rancher/rancher/releases/tag/v2.0.11) | -| [CVE-2018-20321](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20321) | Any project member with access to the `default` namespace can mount the `netes-default` service account in a pod and then use that pod to execute administrative privileged commands against the Kubernetes cluster. | 29 Jan 2019 | [Rancher v2.1.6](https://github.com/rancher/rancher/releases/tag/v2.1.6) and [Rancher v2.0.11](https://github.com/rancher/rancher/releases/tag/v2.0.11) - Rolling back from these versions or greater have specific [instructions]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/rollbacks). | \ No newline at end of file +| [CVE-2018-20321](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20321) | Any project member with access to the `default` namespace can mount the `netes-default` service account in a pod and then use that pod to execute administrative privileged commands against the Kubernetes cluster. | 29 Jan 2019 | [Rancher v2.1.6](https://github.com/rancher/rancher/releases/tag/v2.1.6) and [Rancher v2.0.11](https://github.com/rancher/rancher/releases/tag/v2.0.11) - Rolling back from these versions or greater have specific [instructions]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/rollbacks). | diff --git a/content/rancher/v2.6/en/security/hardening-guides/_index.md b/content/rancher/v2.6/en/security/hardening-guides/_index.md new file mode 100644 index 00000000000..e6a16445fc1 --- /dev/null +++ b/content/rancher/v2.6/en/security/hardening-guides/_index.md @@ -0,0 +1,7 @@ +--- +title: Self-Assessment and Hardening Guides for Rancher v2.6 +shortTitle: Rancher v2.6 Guides +weight: 1 +--- + +Rancher v2.6 hardening guides are currently being updated. For the time being, please consult Rancher v2.5 [self-assessment and hardening guides]({{}}/rancher/v2.5/en/security/rancher-2.5) for more information. diff --git a/content/rancher/v2.6/en/security/rancher-2.5/1.5-benchmark-2.5/_index.md b/content/rancher/v2.6/en/security/rancher-2.5/1.5-benchmark-2.5/_index.md deleted file mode 100644 index 463446b78a0..00000000000 --- a/content/rancher/v2.6/en/security/rancher-2.5/1.5-benchmark-2.5/_index.md +++ /dev/null @@ -1,2265 +0,0 @@ ---- -title: CIS 1.5 Benchmark - Self-Assessment Guide - Rancher v2.5 -weight: 201 ---- - -### CIS v1.5 Kubernetes Benchmark - Rancher v2.5 with Kubernetes v1.15 - -[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.5/Rancher_1.5_Benchmark_Assessment.pdf) - -#### Overview - -This document is a companion to the Rancher v2.5 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark. - -This guide corresponds to specific versions of the hardening guide, Rancher, CIS Benchmark, and Kubernetes: - -Hardening Guide Version | Rancher Version | CIS Benchmark Version | Kubernetes Version ----------------------------|----------|---------|------- -Hardening Guide with CIS 1.5 Benchmark | Rancher v2.5 | CIS v1.5| Kubernetes v1.15 - -Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply and will have a result of `Not Applicable`. This guide will walk through the various controls and provide updated example commands to audit compliance in Rancher-created clusters. - -This document is to be used by Rancher operators, security teams, auditors and decision makers. - -For more detail about each audit, including rationales and remediations for failing tests, you can refer to the corresponding section of the CIS Kubernetes Benchmark v1.5. You can download the benchmark after logging in to [CISecurity.org]( https://www.cisecurity.org/benchmark/kubernetes/). - -#### Testing controls methodology - -Rancher and RKE install Kubernetes services via Docker containers. Configuration is defined by arguments passed to the container at the time of initialization, not via configuration files. - -Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher Labs are provided for testing. -When performing the tests, you will need access to the Docker command line on the hosts of all three RKE roles. The commands also make use of the the [jq](https://stedolan.github.io/jq/) and [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) (with valid config) tools to and are required in the testing and evaluation of test results. - -> NOTE: only scored tests are covered in this guide. - -### Controls - ---- -## 1 Master Node Security Configuration -### 1.1 Master Node Configuration Files - -#### 1.1.1 Ensure that the API server pod specification file permissions are set to `644` or more restrictive (Scored) - -**Result:** Not Applicable - -**Remediation:** -RKE doesn’t require or maintain a configuration file for the API server. All configuration is passed in as arguments at container run time. - -#### 1.1.2 Ensure that the API server pod specification file ownership is set to `root:root` (Scored) - -**Result:** Not Applicable - -**Remediation:** -RKE doesn’t require or maintain a configuration file for the API server. All configuration is passed in as arguments at container run time. - -#### 1.1.3 Ensure that the controller manager pod specification file permissions are set to `644` or more restrictive (Scored) - -**Result:** Not Applicable - -**Remediation:** -RKE doesn’t require or maintain a configuration file for the controller manager. All configuration is passed in as arguments at container run time. - -#### 1.1.4 Ensure that the controller manager pod specification file ownership is set to `root:root` (Scored) - -**Result:** Not Applicable - -**Remediation:** -RKE doesn’t require or maintain a configuration file for the controller manager. All configuration is passed in as arguments at container run time. - -#### 1.1.5 Ensure that the scheduler pod specification file permissions are set to `644` or more restrictive (Scored) - -**Result:** Not Applicable - -**Remediation:** -RKE doesn’t require or maintain a configuration file for the scheduler. All configuration is passed in as arguments at container run time. - -#### 1.1.6 Ensure that the scheduler pod specification file ownership is set to `root:root` (Scored) - -**Result:** Not Applicable - -**Remediation:** -RKE doesn’t require or maintain a configuration file for the scheduler. All configuration is passed in as arguments at container run time. - -#### 1.1.7 Ensure that the etcd pod specification file permissions are set to `644` or more restrictive (Scored) - -**Result:** Not Applicable - -**Remediation:** -RKE doesn’t require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time. - -#### 1.1.8 Ensure that the etcd pod specification file ownership is set to `root:root` (Scored) - -**Result:** Not Applicable - -**Remediation:** -RKE doesn’t require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time. - -#### 1.1.11 Ensure that the etcd data directory permissions are set to `700` or more restrictive (Scored) - -**Result:** PASS - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument `--data-dir`, -from the below command: - -``` bash -ps -ef | grep etcd -``` - -Run the below command (based on the etcd data directory found above). For example, - -``` bash -chmod 700 /var/lib/etcd -``` - -**Audit Script:** 1.1.11.sh - -``` -#!/bin/bash -e - -etcd_bin=${1} - -test_dir=$(ps -ef | grep ${etcd_bin} | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%') - -docker inspect etcd | jq -r '.[].HostConfig.Binds[]' | grep "${test_dir}" | cut -d ":" -f 1 | xargs stat -c %a -``` - -**Audit Execution:** - -``` -./1.1.11.sh etcd -``` - -**Expected result**: - -``` -'700' is equal to '700' -``` - -#### 1.1.12 Ensure that the etcd data directory ownership is set to `etcd:etcd` (Scored) - -**Result:** PASS - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument `--data-dir`, -from the below command: - -``` bash -ps -ef | grep etcd -``` - -Run the below command (based on the etcd data directory found above). -For example, -``` bash -chown etcd:etcd /var/lib/etcd -``` - -**Audit Script:** 1.1.12.sh - -``` -#!/bin/bash -e - -etcd_bin=${1} - -test_dir=$(ps -ef | grep ${etcd_bin} | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%') - -docker inspect etcd | jq -r '.[].HostConfig.Binds[]' | grep "${test_dir}" | cut -d ":" -f 1 | xargs stat -c %U:%G -``` - -**Audit Execution:** - -``` -./1.1.12.sh etcd -``` - -**Expected result**: - -``` -'etcd:etcd' is present -``` - -#### 1.1.13 Ensure that the `admin.conf` file permissions are set to `644` or more restrictive (Scored) - -**Result:** Not Applicable - -**Remediation:** -RKE does not store the kubernetes default kubeconfig credentials file on the nodes. It’s presented to user where RKE is run. -We recommend that this `kube_config_cluster.yml` file be kept in secure store. - -#### 1.1.14 Ensure that the admin.conf file ownership is set to `root:root` (Scored) - -**Result:** Not Applicable - -**Remediation:** -RKE does not store the kubernetes default kubeconfig credentials file on the nodes. It’s presented to user where RKE is run. -We recommend that this `kube_config_cluster.yml` file be kept in secure store. - -#### 1.1.15 Ensure that the `scheduler.conf` file permissions are set to `644` or more restrictive (Scored) - -**Result:** Not Applicable - -**Remediation:** -RKE doesn’t require or maintain a configuration file for the scheduler. All configuration is passed in as arguments at container run time. - -#### 1.1.16 Ensure that the `scheduler.conf` file ownership is set to `root:root` (Scored) - -**Result:** Not Applicable - -**Remediation:** -RKE doesn’t require or maintain a configuration file for the scheduler. All configuration is passed in as arguments at container run time. - -#### 1.1.17 Ensure that the `controller-manager.conf` file permissions are set to `644` or more restrictive (Scored) - -**Result:** Not Applicable - -**Remediation:** -RKE doesn’t require or maintain a configuration file for the controller manager. All configuration is passed in as arguments at container run time. - -#### 1.1.18 Ensure that the `controller-manager.conf` file ownership is set to `root:root` (Scored) - -**Result:** Not Applicable - -**Remediation:** -RKE doesn’t require or maintain a configuration file for the controller manager. All configuration is passed in as arguments at container run time. - -#### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to `root:root` (Scored) - -**Result:** PASS - -**Remediation:** -Run the below command (based on the file location on your system) on the master node. -For example, - -``` bash -chown -R root:root /etc/kubernetes/ssl -``` - -**Audit:** - -``` -stat -c %U:%G /etc/kubernetes/ssl -``` - -**Expected result**: - -``` -'root:root' is present -``` - -#### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to `644` or more restrictive (Scored) - -**Result:** PASS - -**Remediation:** -Run the below command (based on the file location on your system) on the master node. -For example, - -``` bash -chmod -R 644 /etc/kubernetes/ssl -``` - -**Audit Script:** check_files_permissions.sh - -``` -#!/usr/bin/env bash - -# This script is used to ensure the file permissions are set to 644 or -# more restrictive for all files in a given directory or a wildcard -# selection of files -# -# inputs: -# $1 = /full/path/to/directory or /path/to/fileswithpattern -# ex: !(*key).pem -# -# $2 (optional) = permission (ex: 600) -# -# outputs: -# true/false - -# Turn on "extended glob" for use of '!' in wildcard -shopt -s extglob - -# Turn off history to avoid surprises when using '!' -set -H - -USER_INPUT=$1 - -if [[ "${USER_INPUT}" == "" ]]; then - echo "false" - exit -fi - - -if [[ -d ${USER_INPUT} ]]; then - PATTERN="${USER_INPUT}/*" -else - PATTERN="${USER_INPUT}" -fi - -PERMISSION="" -if [[ "$2" != "" ]]; then - PERMISSION=$2 -fi - -FILES_PERMISSIONS=$(stat -c %n\ %a ${PATTERN}) - -while read -r fileInfo; do - p=$(echo ${fileInfo} | cut -d' ' -f2) - - if [[ "${PERMISSION}" != "" ]]; then - if [[ "$p" != "${PERMISSION}" ]]; then - echo "false" - exit - fi - else - if [[ "$p" != "644" && "$p" != "640" && "$p" != "600" ]]; then - echo "false" - exit - fi - fi -done <<< "${FILES_PERMISSIONS}" - - -echo "true" -exit -``` - -**Audit Execution:** - -``` -./check_files_permissions.sh '/etc/kubernetes/ssl/*.pem' -``` - -**Expected result**: - -``` -'true' is present -``` - -#### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to `600` (Scored) - -**Result:** PASS - -**Remediation:** -Run the below command (based on the file location on your system) on the master node. -For example, - -``` bash -chmod -R 600 /etc/kubernetes/ssl/certs/serverca -``` - -**Audit Script:** 1.1.21.sh - -``` -#!/bin/bash -e -check_dir=${1:-/etc/kubernetes/ssl} - -for file in $(find ${check_dir} -name "*key.pem"); do - file_permission=$(stat -c %a ${file}) - if [[ "${file_permission}" == "600" ]]; then - continue - else - echo "FAIL: ${file} ${file_permission}" - exit 1 - fi -done - -echo "pass" -``` - -**Audit Execution:** - -``` -./1.1.21.sh /etc/kubernetes/ssl -``` - -**Expected result**: - -``` -'pass' is present -``` - -### 1.2 API Server - -#### 1.2.2 Ensure that the `--basic-auth-file` argument is not set (Scored) - -**Result:** PASS - -**Remediation:** -Follow the documentation and configure alternate mechanisms for authentication. Then, -edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and remove the `--basic-auth-file=` parameter. - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'--basic-auth-file' is not present -``` - -#### 1.2.3 Ensure that the `--token-auth-file` parameter is not set (Scored) - -**Result:** PASS - -**Remediation:** -Follow the documentation and configure alternate mechanisms for authentication. Then, -edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and remove the `--token-auth-file=` parameter. - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'--token-auth-file' is not present -``` - -#### 1.2.4 Ensure that the `--kubelet-https` argument is set to true (Scored) - -**Result:** PASS - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and remove the `--kubelet-https` parameter. - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'--kubelet-https' is present OR '--kubelet-https' is not present -``` - -#### 1.2.5 Ensure that the `--kubelet-client-certificate` and `--kubelet-client-key` arguments are set as appropriate (Scored) - -**Result:** PASS - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the -apiserver and kubelets. Then, edit API server pod specification file -`/etc/kubernetes/manifests/kube-apiserver.yaml` on the master node and set the -kubelet client certificate and key parameters as below. - -``` bash ---kubelet-client-certificate= ---kubelet-client-key= -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present -``` - -#### 1.2.6 Ensure that the `--kubelet-certificate-authority` argument is set as appropriate (Scored) - -**Result:** PASS - -**Remediation:** -Follow the Kubernetes documentation and setup the TLS connection between -the apiserver and kubelets. Then, edit the API server pod specification file -`/etc/kubernetes/manifests/kube-apiserver.yaml` on the master node and set the -`--kubelet-certificate-authority` parameter to the path to the cert file for the certificate authority. -`--kubelet-certificate-authority=` - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'--kubelet-certificate-authority' is present -``` - -#### 1.2.7 Ensure that the `--authorization-mode` argument is not set to `AlwaysAllow` (Scored) - -**Result:** PASS - -**Remediation:** -Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and set the `--authorization-mode` parameter to values other than `AlwaysAllow`. -One such example could be as below. - -``` bash ---authorization-mode=RBAC -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'Node,RBAC' not have 'AlwaysAllow' -``` - -#### 1.2.8 Ensure that the `--authorization-mode` argument includes `Node` (Scored) - -**Result:** PASS - -**Remediation:** -Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and set the `--authorization-mode` parameter to a value that includes `Node`. - -``` bash ---authorization-mode=Node,RBAC -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'Node,RBAC' has 'Node' -``` - -#### 1.2.9 Ensure that the `--authorization-mode` argument includes `RBAC` (Scored) - -**Result:** PASS - -**Remediation:** -Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and set the `--authorization-mode` parameter to a value that includes RBAC, -for example: - -``` bash ---authorization-mode=Node,RBAC -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'Node,RBAC' has 'RBAC' -``` - -#### 1.2.11 Ensure that the admission control plugin `AlwaysAdmit` is not set (Scored) - -**Result:** PASS - -**Remediation:** -Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and either remove the `--enable-admission-plugins` parameter, or set it to a -value that does not include `AlwaysAdmit`. - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present -``` - -#### 1.2.14 Ensure that the admission control plugin `ServiceAccount` is set (Scored) - -**Result:** PASS - -**Remediation:** -Follow the documentation and create ServiceAccount objects as per your environment. -Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and ensure that the `--disable-admission-plugins` parameter is set to a -value that does not include `ServiceAccount`. - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' has 'ServiceAccount' OR '--enable-admission-plugins' is not present -``` - -#### 1.2.15 Ensure that the admission control plugin `NamespaceLifecycle` is set (Scored) - -**Result:** PASS - -**Remediation:** -Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and set the `--disable-admission-plugins` parameter to -ensure it does not include `NamespaceLifecycle`. - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present -``` - -#### 1.2.16 Ensure that the admission control plugin `PodSecurityPolicy` is set (Scored) - -**Result:** PASS - -**Remediation:** -Follow the documentation and create Pod Security Policy objects as per your environment. -Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and set the `--enable-admission-plugins` parameter to a -value that includes `PodSecurityPolicy`: - -``` bash ---enable-admission-plugins=...,PodSecurityPolicy,... -``` - -Then restart the API Server. - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' has 'PodSecurityPolicy' -``` - -#### 1.2.17 Ensure that the admission control plugin `NodeRestriction` is set (Scored) - -**Result:** PASS - -**Remediation:** -Follow the Kubernetes documentation and configure `NodeRestriction` plug-in on kubelets. -Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and set the `--enable-admission-plugins` parameter to a -value that includes `NodeRestriction`. - -``` bash ---enable-admission-plugins=...,NodeRestriction,... -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' has 'NodeRestriction' -``` - -#### 1.2.18 Ensure that the `--insecure-bind-address` argument is not set (Scored) - -**Result:** PASS - -**Remediation:** -Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and remove the `--insecure-bind-address` parameter. - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'--insecure-bind-address' is not present -``` - -#### 1.2.19 Ensure that the `--insecure-port` argument is set to `0` (Scored) - -**Result:** PASS - -**Remediation:** -Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and set the below parameter. - -``` bash ---insecure-port=0 -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'0' is equal to '0' -``` - -#### 1.2.20 Ensure that the `--secure-port` argument is not set to `0` (Scored) - -**Result:** PASS - -**Remediation:** -Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and either remove the `--secure-port` parameter or -set it to a different **(non-zero)** desired port. - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -6443 is greater than 0 OR '--secure-port' is not present -``` - -#### 1.2.21 Ensure that the `--profiling` argument is set to `false` (Scored) - -**Result:** PASS - -**Remediation:** -Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and set the below parameter. - -``` bash ---profiling=false -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'false' is equal to 'false' -``` - -#### 1.2.22 Ensure that the `--audit-log-path` argument is set (Scored) - -**Result:** PASS - -**Remediation:** -Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and set the `--audit-log-path` parameter to a suitable path and -file where you would like audit logs to be written, for example: - -``` bash ---audit-log-path=/var/log/apiserver/audit.log -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'--audit-log-path' is present -``` - -#### 1.2.23 Ensure that the `--audit-log-maxage` argument is set to `30` or as appropriate (Scored) - -**Result:** PASS - -**Remediation:** -Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and set the `--audit-log-maxage` parameter to `30` or as an appropriate number of days: - -``` bash ---audit-log-maxage=30 -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -30 is greater or equal to 30 -``` - -#### 1.2.24 Ensure that the `--audit-log-maxbackup` argument is set to `10` or as appropriate (Scored) - -**Result:** PASS - -**Remediation:** -Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and set the `--audit-log-maxbackup` parameter to `10` or to an appropriate -value. - -``` bash ---audit-log-maxbackup=10 -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -10 is greater or equal to 10 -``` - -#### 1.2.25 Ensure that the `--audit-log-maxsize` argument is set to `100` or as appropriate (Scored) - -**Result:** PASS - -**Remediation:** -Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and set the `--audit-log-maxsize` parameter to an appropriate size in **MB**. -For example, to set it as `100` **MB**: - -``` bash ---audit-log-maxsize=100 -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -100 is greater or equal to 100 -``` - -#### 1.2.26 Ensure that the `--request-timeout` argument is set as appropriate (Scored) - -**Result:** PASS - -**Remediation:** -Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -and set the below parameter as appropriate and if needed. -For example, - -``` bash ---request-timeout=300s -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'--request-timeout' is not present OR '--request-timeout' is present -``` - -#### 1.2.27 Ensure that the `--service-account-lookup` argument is set to `true` (Scored) - -**Result:** PASS - -**Remediation:** -Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and set the below parameter. - -``` bash ---service-account-lookup=true -``` - -Alternatively, you can delete the `--service-account-lookup` parameter from this file so -that the default takes effect. - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'--service-account-lookup' is not present OR 'true' is equal to 'true' -``` - -#### 1.2.28 Ensure that the `--service-account-key-file` argument is set as appropriate (Scored) - -**Result:** PASS - -**Remediation:** -Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and set the `--service-account-key-file` parameter -to the public key file for service accounts: - -``` bash ---service-account-key-file= -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'--service-account-key-file' is present -``` - -#### 1.2.29 Ensure that the `--etcd-certfile` and `--etcd-keyfile` arguments are set as appropriate (Scored) - -**Result:** PASS - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and set the **etcd** certificate and **key** file parameters. - -``` bash ---etcd-certfile= ---etcd-keyfile= -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'--etcd-certfile' is present AND '--etcd-keyfile' is present -``` - -#### 1.2.30 Ensure that the `--tls-cert-file` and `--tls-private-key-file` arguments are set as appropriate (Scored) - -**Result:** PASS - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and set the TLS certificate and private key file parameters. - -``` bash ---tls-cert-file= ---tls-private-key-file= -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -#### 1.2.31 Ensure that the `--client-ca-file` argument is set as appropriate (Scored) - -**Result:** PASS - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and set the client certificate authority file. - -``` bash ---client-ca-file= -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'--client-ca-file' is present -``` - -#### 1.2.32 Ensure that the `--etcd-cafile` argument is set as appropriate (Scored) - -**Result:** PASS - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and set the etcd certificate authority file parameter. - -``` bash ---etcd-cafile= -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'--etcd-cafile' is present -``` - -#### 1.2.33 Ensure that the `--encryption-provider-config` argument is set as appropriate (Scored) - -**Result:** PASS - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` -on the master node and set the `--encryption-provider-config` parameter to the path of that file: - -``` bash ---encryption-provider-config= -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected result**: - -``` -'--encryption-provider-config' is present -``` - -#### 1.2.34 Ensure that encryption providers are appropriately configured (Scored) - -**Result:** PASS - -**Remediation:** -Follow the Kubernetes documentation and configure a `EncryptionConfig` file. -In this file, choose **aescbc**, **kms** or **secretbox** as the encryption provider. - -**Audit Script:** 1.2.34.sh - -``` -#!/bin/bash -e - -check_file=${1} - -grep -q -E 'aescbc|kms|secretbox' ${check_file} -if [ $? -eq 0 ]; then - echo "--pass" - exit 0 -else - echo "fail: encryption provider found in ${check_file}" - exit 1 -fi -``` - -**Audit Execution:** - -``` -./1.2.34.sh /etc/kubernetes/ssl/encryption.yaml -``` - -**Expected result**: - -``` -'--pass' is present -``` - -### 1.3 Controller Manager - -#### 1.3.1 Ensure that the `--terminated-pod-gc-threshold` argument is set as appropriate (Scored) - -**Result:** PASS - -**Remediation:** -Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/kube-controller-manager.yaml` -on the master node and set the `--terminated-pod-gc-threshold` to an appropriate threshold, -for example: - -``` bash ---terminated-pod-gc-threshold=10 -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected result**: - -``` -'--terminated-pod-gc-threshold' is present -``` - -#### 1.3.2 Ensure that the `--profiling` argument is set to false (Scored) - -**Result:** PASS - -**Remediation:** -Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/kube-controller-manager.yaml` -on the master node and set the below parameter. - -``` bash ---profiling=false -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected result**: - -``` -'false' is equal to 'false' -``` - -#### 1.3.3 Ensure that the `--use-service-account-credentials` argument is set to `true` (Scored) - -**Result:** PASS - -**Remediation:** -Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/kube-controller-manager.yaml` -on the master node to set the below parameter. - -``` bash ---use-service-account-credentials=true -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected result**: - -``` -'true' is not equal to 'false' -``` - -#### 1.3.4 Ensure that the `--service-account-private-key-file` argument is set as appropriate (Scored) - -**Result:** PASS - -**Remediation:** -Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/kube-controller-manager.yaml` -on the master node and set the `--service-account-private-key-file` parameter -to the private key file for service accounts. - -``` bash ---service-account-private-key-file= -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected result**: - -``` -'--service-account-private-key-file' is present -``` - -#### 1.3.5 Ensure that the `--root-ca-file` argument is set as appropriate (Scored) - -**Result:** PASS - -**Remediation:** -Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/kube-controller-manager.yaml` -on the master node and set the `--root-ca-file` parameter to the certificate bundle file`. - -``` bash ---root-ca-file= -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected result**: - -``` -'--root-ca-file' is present -``` - -#### 1.3.6 Ensure that the `RotateKubeletServerCertificate` argument is set to `true` (Scored) - -**Result:** PASS - -**Remediation:** -Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/kube-controller-manager.yaml` -on the master node and set the `--feature-gates` parameter to include `RotateKubeletServerCertificate=true`. - -``` bash ---feature-gates=RotateKubeletServerCertificate=true -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected result**: - -``` -'RotateKubeletServerCertificate=true' is equal to 'RotateKubeletServerCertificate=true' -``` - -#### 1.3.7 Ensure that the `--bind-address argument` is set to `127.0.0.1` (Scored) - -**Result:** PASS - -**Remediation:** -Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/kube-controller-manager.yaml` -on the master node and ensure the correct value for the `--bind-address` parameter. - -**Audit:** - -``` -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected result**: - -``` -'--bind-address' is present OR '--bind-address' is not present -``` - -### 1.4 Scheduler - -#### 1.4.1 Ensure that the `--profiling` argument is set to `false` (Scored) - -**Result:** PASS - -**Remediation:** -Edit the Scheduler pod specification file `/etc/kubernetes/manifests/kube-scheduler.yaml` file -on the master node and set the below parameter. - -``` bash ---profiling=false -``` - -**Audit:** - -``` -/bin/ps -ef | grep kube-scheduler | grep -v grep -``` - -**Expected result**: - -``` -'false' is equal to 'false' -``` - -#### 1.4.2 Ensure that the `--bind-address` argument is set to `127.0.0.1` (Scored) - -**Result:** PASS - -**Remediation:** -Edit the Scheduler pod specification file `/etc/kubernetes/manifests/kube-scheduler.yaml` -on the master node and ensure the correct value for the `--bind-address` parameter. - -**Audit:** - -``` -/bin/ps -ef | grep kube-scheduler | grep -v grep -``` - -**Expected result**: - -``` -'--bind-address' is present OR '--bind-address' is not present -``` - -## 2 Etcd Node Configuration -### 2 Etcd Node Configuration Files - -#### 2.1 Ensure that the `--cert-file` and `--key-file` arguments are set as appropriate (Scored) - -**Result:** PASS - -**Remediation:** -Follow the etcd service documentation and configure TLS encryption. -Then, edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml` -on the master node and set the below parameters. - -``` bash ---cert-file= ---key-file= -``` - -**Audit:** - -``` -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected result**: - -``` -'--cert-file' is present AND '--key-file' is present -``` - -#### 2.2 Ensure that the `--client-cert-auth` argument is set to `true` (Scored) - -**Result:** PASS - -**Remediation:** -Edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml` on the master -node and set the below parameter. - -``` bash ---client-cert-auth="true" -``` - -**Audit:** - -``` -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected result**: - -``` -'true' is equal to 'true' -``` - -#### 2.3 Ensure that the `--auto-tls` argument is not set to `true` (Scored) - -**Result:** PASS - -**Remediation:** -Edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml` on the master -node and either remove the `--auto-tls` parameter or set it to `false`. - -``` bash - --auto-tls=false -``` - -**Audit:** - -``` -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected result**: - -``` -'--auto-tls' is not present OR '--auto-tls' is not present -``` - -#### 2.4 Ensure that the `--peer-cert-file` and `--peer-key-file` arguments are set as appropriate (Scored) - -**Result:** PASS - -**Remediation:** -Follow the etcd service documentation and configure peer TLS encryption as appropriate -for your etcd cluster. Then, edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml` on the -master node and set the below parameters. - -``` bash ---peer-client-file= ---peer-key-file= -``` - -**Audit:** - -``` -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected result**: - -``` -'--peer-cert-file' is present AND '--peer-key-file' is present -``` - -#### 2.5 Ensure that the `--peer-client-cert-auth` argument is set to `true` (Scored) - -**Result:** PASS - -**Remediation:** -Edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml` on the master -node and set the below parameter. - -``` bash ---peer-client-cert-auth=true -``` - -**Audit:** - -``` -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected result**: - -``` -'true' is equal to 'true' -``` - -#### 2.6 Ensure that the `--peer-auto-tls` argument is not set to `true` (Scored) - -**Result:** PASS - -**Remediation:** -Edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml` on the master -node and either remove the `--peer-auto-tls` parameter or set it to `false`. - -``` bash ---peer-auto-tls=false -``` - -**Audit:** - -``` -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected result**: - -``` -'--peer-auto-tls' is not present OR '--peer-auto-tls' is present -``` - -## 3 Control Plane Configuration -### 3.2 Logging - -#### 3.2.1 Ensure that a minimal audit policy is created (Scored) - -**Result:** PASS - -**Remediation:** -Create an audit policy file for your cluster. - -**Audit Script:** 3.2.1.sh - -``` -#!/bin/bash -e - -api_server_bin=${1} - -/bin/ps -ef | /bin/grep ${api_server_bin} | /bin/grep -v ${0} | /bin/grep -v grep -``` - -**Audit Execution:** - -``` -./3.2.1.sh kube-apiserver -``` - -**Expected result**: - -``` -'--audit-policy-file' is present -``` - -## 4 Worker Node Security Configuration -### 4.1 Worker Node Configuration Files - -#### 4.1.1 Ensure that the kubelet service file permissions are set to `644` or more restrictive (Scored) - -**Result:** Not Applicable - -**Remediation:** -RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time. - -#### 4.1.2 Ensure that the kubelet service file ownership is set to `root:root` (Scored) - -**Result:** Not Applicable - -**Remediation:** -RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time. - -#### 4.1.3 Ensure that the proxy kubeconfig file permissions are set to `644` or more restrictive (Scored) - -**Result:** PASS - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, - -``` bash -chmod 644 /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml -``` - -**Audit:** - -``` -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %a /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' -``` - -**Expected result**: - -``` -'644' is present OR '640' is present OR '600' is equal to '600' OR '444' is present OR '440' is present OR '400' is present OR '000' is present -``` - -#### 4.1.4 Ensure that the proxy kubeconfig file ownership is set to `root:root` (Scored) - -**Result:** PASS - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, - -``` bash -chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml -``` - -**Audit:** - -``` -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' -``` - -**Expected result**: - -``` -'root:root' is present -``` - -#### 4.1.5 Ensure that the kubelet.conf file permissions are set to `644` or more restrictive (Scored) - -**Result:** PASS - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, - -``` bash -chmod 644 /etc/kubernetes/ssl/kubecfg-kube-node.yaml -``` - -**Audit:** - -``` -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %a /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' -``` - -**Expected result**: - -``` -'644' is present OR '640' is present OR '600' is equal to '600' OR '444' is present OR '440' is present OR '400' is present OR '000' is present -``` - -#### 4.1.6 Ensure that the kubelet.conf file ownership is set to `root:root` (Scored) - -**Result:** PASS - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, - -``` bash -chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml -``` - -**Audit:** - -``` -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' -``` - -**Expected result**: - -``` -'root:root' is equal to 'root:root' -``` - -#### 4.1.7 Ensure that the certificate authorities file permissions are set to `644` or more restrictive (Scored) - -**Result:** PASS - -**Remediation:** -Run the following command to modify the file permissions of the - -``` bash ---client-ca-file chmod 644 -``` - -**Audit:** - -``` -stat -c %a /etc/kubernetes/ssl/kube-ca.pem -``` - -**Expected result**: - -``` -'644' is equal to '644' OR '640' is present OR '600' is present -``` - -#### 4.1.8 Ensure that the client certificate authorities file ownership is set to `root:root` (Scored) - -**Result:** PASS - -**Remediation:** -Run the following command to modify the ownership of the `--client-ca-file`. - -``` bash -chown root:root -``` - -**Audit:** - -``` -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kube-ca.pem; then stat -c %U:%G /etc/kubernetes/ssl/kube-ca.pem; fi' -``` - -**Expected result**: - -``` -'root:root' is equal to 'root:root' -``` - -#### 4.1.9 Ensure that the kubelet configuration file has permissions set to `644` or more restrictive (Scored) - -**Result:** Not Applicable - -**Remediation:** -RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time. - -#### 4.1.10 Ensure that the kubelet configuration file ownership is set to `root:root` (Scored) - -**Result:** Not Applicable - -**Remediation:** -RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time. - -### 4.2 Kubelet - -#### 4.2.1 Ensure that the `--anonymous-auth argument` is set to false (Scored) - -**Result:** PASS - -**Remediation:** -If using a Kubelet config file, edit the file to set authentication: `anonymous`: enabled to -`false`. -If using executable arguments, edit the kubelet service file -`/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` on each worker node and -set the below parameter in `KUBELET_SYSTEM_PODS_ARGS` variable. - -``` bash ---anonymous-auth=false -``` - -Based on your system, restart the kubelet service. For example: - -``` bash -systemctl daemon-reload -systemctl restart kubelet.service -``` - -**Audit:** - -``` -/bin/ps -fC kubelet -``` - -**Audit Config:** - -``` -/bin/cat /var/lib/kubelet/config.yaml -``` - -**Expected result**: - -``` -'false' is equal to 'false' -``` - -#### 4.2.2 Ensure that the `--authorization-mode` argument is not set to `AlwaysAllow` (Scored) - -**Result:** PASS - -**Remediation:** -If using a Kubelet config file, edit the file to set authorization: `mode` to `Webhook`. If -using executable arguments, edit the kubelet service file -`/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` on each worker node and -set the below parameter in `KUBELET_AUTHZ_ARGS` variable. - -``` bash ---authorization-mode=Webhook -``` - -Based on your system, restart the kubelet service. For example: - -``` bash -systemctl daemon-reload -systemctl restart kubelet.service -``` - -**Audit:** - -``` -/bin/ps -fC kubelet -``` - -**Audit Config:** - -``` -/bin/cat /var/lib/kubelet/config.yaml -``` - -**Expected result**: - -``` -'Webhook' not have 'AlwaysAllow' -``` - -#### 4.2.3 Ensure that the `--client-ca-file` argument is set as appropriate (Scored) - -**Result:** PASS - -**Remediation:** -If using a Kubelet config file, edit the file to set authentication: `x509`: `clientCAFile` to -the location of the client CA file. -If using command line arguments, edit the kubelet service file -`/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` on each worker node and -set the below parameter in `KUBELET_AUTHZ_ARGS` variable. - -``` bash ---client-ca-file= -``` - -Based on your system, restart the kubelet service. For example: - -``` bash -systemctl daemon-reload -systemctl restart kubelet.service -``` - -**Audit:** - -``` -/bin/ps -fC kubelet -``` - -**Audit Config:** - -``` -/bin/cat /var/lib/kubelet/config.yaml -``` - -**Expected result**: - -``` -'--client-ca-file' is present -``` - -#### 4.2.4 Ensure that the `--read-only-port` argument is set to `0` (Scored) - -**Result:** PASS - -**Remediation:** -If using a Kubelet config file, edit the file to set `readOnlyPort` to `0`. -If using command line arguments, edit the kubelet service file -`/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` on each worker node and -set the below parameter in `KUBELET_SYSTEM_PODS_ARGS` variable. - -``` bash ---read-only-port=0 -``` - -Based on your system, restart the kubelet service. For example: - -``` bash -systemctl daemon-reload -systemctl restart kubelet.service -``` - -**Audit:** - -``` -/bin/ps -fC kubelet -``` - -**Audit Config:** - -``` -/bin/cat /var/lib/kubelet/config.yaml -``` - -**Expected result**: - -``` -'0' is equal to '0' -``` - -#### 4.2.5 Ensure that the `--streaming-connection-idle-timeout` argument is not set to `0` (Scored) - -**Result:** PASS - -**Remediation:** -If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a -value other than `0`. -If using command line arguments, edit the kubelet service file -`/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` on each worker node and -set the below parameter in `KUBELET_SYSTEM_PODS_ARGS` variable. - -``` bash ---streaming-connection-idle-timeout=5m -``` - -Based on your system, restart the kubelet service. For example: - -``` bash -systemctl daemon-reload -systemctl restart kubelet.service -``` - -**Audit:** - -``` -/bin/ps -fC kubelet -``` - -**Audit Config:** - -``` -/bin/cat /var/lib/kubelet/config.yaml -``` - -**Expected result**: - -``` -'30m' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present -``` - -#### 4.2.6 Ensure that the ```--protect-kernel-defaults``` argument is set to `true` (Scored) - -**Result:** PASS - -**Remediation:** -If using a Kubelet config file, edit the file to set `protectKernelDefaults`: `true`. -If using command line arguments, edit the kubelet service file -`/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` on each worker node and -set the below parameter in `KUBELET_SYSTEM_PODS_ARGS` variable. - -``` bash ---protect-kernel-defaults=true -``` - -Based on your system, restart the kubelet service. For example: - -``` bash -systemctl daemon-reload -systemctl restart kubelet.service -``` - -**Audit:** - -``` -/bin/ps -fC kubelet -``` - -**Audit Config:** - -``` -/bin/cat /var/lib/kubelet/config.yaml -``` - -**Expected result**: - -``` -'true' is equal to 'true' -``` - -#### 4.2.7 Ensure that the `--make-iptables-util-chains` argument is set to `true` (Scored) - -**Result:** PASS - -**Remediation:** -If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains`: `true`. -If using command line arguments, edit the kubelet service file -`/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` on each worker node and -remove the `--make-iptables-util-chains` argument from the -`KUBELET_SYSTEM_PODS_ARGS` variable. -Based on your system, restart the kubelet service. For example: - -```bash -systemctl daemon-reload -systemctl restart kubelet.service -``` - -**Audit:** - -``` -/bin/ps -fC kubelet -``` - -**Audit Config:** - -``` -/bin/cat /var/lib/kubelet/config.yaml -``` - -**Expected result**: - -``` -'true' is equal to 'true' OR '--make-iptables-util-chains' is not present -``` - -#### 4.2.10 Ensure that the `--tls-cert-file` and `--tls-private-key-file` arguments are set as appropriate (Scored) - -**Result:** Not Applicable - -**Remediation:** -RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time. - -#### 4.2.11 Ensure that the `--rotate-certificates` argument is not set to `false` (Scored) - -**Result:** PASS - -**Remediation:** -If using a Kubelet config file, edit the file to add the line `rotateCertificates`: `true` or -remove it altogether to use the default value. -If using command line arguments, edit the kubelet service file -`/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` on each worker node and -remove `--rotate-certificates=false` argument from the `KUBELET_CERTIFICATE_ARGS` -variable. -Based on your system, restart the kubelet service. For example: - -``` bash -systemctl daemon-reload -systemctl restart kubelet.service -``` - -**Audit:** - -``` -/bin/ps -fC kubelet -``` - -**Audit Config:** - -``` -/bin/cat /var/lib/kubelet/config.yaml -``` - -**Expected result**: - -``` -'--rotate-certificates' is present OR '--rotate-certificates' is not present -``` - -#### 4.2.12 Ensure that the `RotateKubeletServerCertificate` argument is set to `true` (Scored) - -**Result:** PASS - -**Remediation:** -Edit the kubelet service file `/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` -on each worker node and set the below parameter in `KUBELET_CERTIFICATE_ARGS` variable. - -``` bash ---feature-gates=RotateKubeletServerCertificate=true -``` - -Based on your system, restart the kubelet service. For example: - -``` bash -systemctl daemon-reload -systemctl restart kubelet.service -``` - -**Audit:** - -``` -/bin/ps -fC kubelet -``` - -**Audit Config:** - -``` -/bin/cat /var/lib/kubelet/config.yaml -``` - -**Expected result**: - -``` -'true' is equal to 'true' -``` - -## 5 Kubernetes Policies -### 5.1 RBAC and Service Accounts - -#### 5.1.5 Ensure that default service accounts are not actively used. (Scored) - -**Result:** PASS - -**Remediation:** -Create explicit service accounts wherever a Kubernetes workload requires specific access -to the Kubernetes API server. -Modify the configuration of each default service account to include this value - -``` bash -automountServiceAccountToken: false -``` - -**Audit Script:** 5.1.5.sh - -``` -#!/bin/bash - -export KUBECONFIG=${KUBECONFIG:-/root/.kube/config} - -kubectl version > /dev/null -if [ $? -ne 0 ]; then - echo "fail: kubectl failed" - exit 1 -fi - -accounts="$(kubectl --kubeconfig=${KUBECONFIG} get serviceaccounts -A -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true)) | "fail \(.metadata.name) \(.metadata.namespace)"')" - -if [[ "${accounts}" != "" ]]; then - echo "fail: automountServiceAccountToken not false for accounts: ${accounts}" - exit 1 -fi - -default_binding="$(kubectl get rolebindings,clusterrolebindings -A -o json | jq -r '.items[] | select(.subjects[].kind=="ServiceAccount" and .subjects[].name=="default" and .metadata.name=="default").metadata.uid' | wc -l)" - -if [[ "${default_binding}" -gt 0 ]]; then - echo "fail: default service accounts have non default bindings" - exit 1 -fi - -echo "--pass" -exit 0 -``` - -**Audit Execution:** - -``` -./5.1.5.sh -``` - -**Expected result**: - -``` -'--pass' is present -``` - -### 5.2 Pod Security Policies - -#### 5.2.2 Minimize the admission of containers wishing to share the host process ID namespace (Scored) - -**Result:** PASS - -**Remediation:** -Create a PSP as described in the Kubernetes documentation, ensuring that the -`.spec.hostPID` field is omitted or set to `false`. - -**Audit:** - -``` -kubectl --kubeconfig=/root/.kube/config get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or (.spec.hostPID == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected result**: - -``` -1 is greater than 0 -``` - -#### 5.2.3 Minimize the admission of containers wishing to share the host IPC namespace (Scored) - -**Result:** PASS - -**Remediation:** -Create a PSP as described in the Kubernetes documentation, ensuring that the -`.spec.hostIPC` field is omitted or set to `false`. - -**Audit:** - -``` -kubectl --kubeconfig=/root/.kube/config get psp -o json | jq .items[] | jq -r 'select((.spec.hostIPC == null) or (.spec.hostIPC == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected result**: - -``` -1 is greater than 0 -``` - -#### 5.2.4 Minimize the admission of containers wishing to share the host network namespace (Scored) - -**Result:** PASS - -**Remediation:** -Create a PSP as described in the Kubernetes documentation, ensuring that the -`.spec.hostNetwork` field is omitted or set to `false`. - -**Audit:** - -``` -kubectl --kubeconfig=/root/.kube/config get psp -o json | jq .items[] | jq -r 'select((.spec.hostNetwork == null) or (.spec.hostNetwork == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected result**: - -``` -1 is greater than 0 -``` - -#### 5.2.5 Minimize the admission of containers with `allowPrivilegeEscalation` (Scored) - -**Result:** PASS - -**Remediation:** -Create a PSP as described in the Kubernetes documentation, ensuring that the -`.spec.allowPrivilegeEscalation` field is omitted or set to `false`. - -**Audit:** - -``` -kubectl --kubeconfig=/root/.kube/config get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected result**: - -``` -1 is greater than 0 -``` - -### 5.3 Network Policies and CNI - -#### 5.3.2 Ensure that all Namespaces have Network Policies defined (Scored) - -**Result:** PASS - -**Remediation:** -Follow the documentation and create `NetworkPolicy` objects as you need them. - -**Audit Script:** 5.3.2.sh - -``` -#!/bin/bash -e - -export KUBECONFIG=${KUBECONFIG:-"/root/.kube/config"} - -kubectl version > /dev/null -if [ $? -ne 0 ]; then - echo "fail: kubectl failed" - exit 1 -fi - -for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do - policy_count=$(kubectl get networkpolicy -n ${namespace} -o json | jq '.items | length') - if [ ${policy_count} -eq 0 ]; then - echo "fail: ${namespace}" - exit 1 - fi -done - -echo "pass" -``` - -**Audit Execution:** - -``` -./5.3.2.sh -``` - -**Expected result**: - -``` -'pass' is present -``` - -### 5.6 General Policies - -#### 5.6.4 The default namespace should not be used (Scored) - -**Result:** PASS - -**Remediation:** -Ensure that namespaces are created to allow for appropriate segregation of Kubernetes -resources and that all new resources are created in a specific namespace. - -**Audit Script:** 5.6.4.sh - -``` -#!/bin/bash -e - -export KUBECONFIG=${KUBECONFIG:-/root/.kube/config} - -kubectl version > /dev/null -if [[ $? -gt 0 ]]; then - echo "fail: kubectl failed" - exit 1 -fi - -default_resources=$(kubectl get all -o json | jq --compact-output '.items[] | select((.kind == "Service") and (.metadata.name == "kubernetes") and (.metadata.namespace == "default") | not)' | wc -l) - -echo "--count=${default_resources}" -``` - -**Audit Execution:** - -``` -./5.6.4.sh -``` - -**Expected result**: - -``` -'0' is equal to '0' -``` diff --git a/content/rancher/v2.6/en/security/rancher-2.5/1.5-hardening-2.5/_index.md b/content/rancher/v2.6/en/security/rancher-2.5/1.5-hardening-2.5/_index.md deleted file mode 100644 index 7f64bbbc6a9..00000000000 --- a/content/rancher/v2.6/en/security/rancher-2.5/1.5-hardening-2.5/_index.md +++ /dev/null @@ -1,720 +0,0 @@ ---- -title: Hardening Guide with CIS 1.5 Benchmark -weight: 200 ---- - -This document provides prescriptive guidance for hardening a production installation of a RKE cluster to be used with Rancher v2.5. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Information Security (CIS). - -> This hardening guide describes how to secure the nodes in your cluster, and it is recommended to follow this guide before installing Kubernetes. - -This hardening guide is intended to be used for RKE clusters and associated with specific versions of the CIS Kubernetes Benchmark, Kubernetes, and Rancher: - - Rancher Version | CIS Benchmark Version | Kubernetes Version -----------------|-----------------------|------------------ - Rancher v2.5 | Benchmark v1.5 | Kubernetes 1.15 - -[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.5/Rancher_Hardening_Guide_CIS_1.5.pdf) - -### Overview - -This document provides prescriptive guidance for hardening a RKE cluster to be used for installing Rancher v2.5 with Kubernetes v1.15 or provisioning a RKE cluster with Kubernetes 1.15 to be used within Rancher v2.5. It outlines the configurations required to address Kubernetes benchmark controls from the Center for Information Security (CIS). - -For more detail about evaluating a hardened cluster against the official CIS benchmark, refer to the [CIS 1.5 Benchmark - Self-Assessment Guide - Rancher v2.5]({{< baseurl >}}/rancher/v2.6/en/security/rancher-2.5/1.5-benchmark-2.5/). - -#### Known Issues - -- Rancher **exec shell** and **view logs** for pods are **not** functional in a CIS 1.5 hardened setup when only public IP is provided when registering custom nodes. This functionality requires a private IP to be provided when registering the custom nodes. -- When setting the `default_pod_security_policy_template_id:` to `restricted` Rancher creates **RoleBindings** and **ClusterRoleBindings** on the default service accounts. The CIS 1.5 5.1.5 check requires the default service accounts have no roles or cluster roles bound to it apart from the defaults. In addition the default service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments. - -### Configure Kernel Runtime Parameters - -The following `sysctl` configuration is recommended for all nodes type in the cluster. Set the following parameters in `/etc/sysctl.d/90-kubelet.conf`: - -``` -vm.overcommit_memory=1 -vm.panic_on_oom=0 -kernel.panic=10 -kernel.panic_on_oops=1 -kernel.keys.root_maxbytes=25000000 -``` - -Run `sysctl -p /etc/sysctl.d/90-kubelet.conf` to enable the settings. - -### Configure `etcd` user and group -A user account and group for the **etcd** service is required to be setup before installing RKE. The **uid** and **gid** for the **etcd** user will be used in the RKE **config.yml** to set the proper permissions for files and directories during installation time. - -#### create `etcd` user and group -To create the **etcd** group run the following console commands. - -The commands below use `52034` for **uid** and **gid** are for example purposes. Any valid unused **uid** or **gid** could also be used in lieu of `52034`. - -``` -groupadd --gid 52034 etcd -useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd -``` - -Update the RKE **config.yml** with the **uid** and **gid** of the **etcd** user: - -``` yaml -services: - etcd: - gid: 52034 - uid: 52034 -``` - -#### Set `automountServiceAccountToken` to `false` for `default` service accounts -Kubernetes provides a default service account which is used by cluster workloads where no specific service account is assigned to the pod. Where access to the Kubernetes API from a pod is required, a specific service account should be created for that pod, and rights granted to that service account. The default service account should be configured such that it does not provide a service account token and does not have any explicit rights assignments. - -For each namespace including **default** and **kube-system** on a standard RKE install the **default** service account must include this value: - -``` -automountServiceAccountToken: false -``` - -Save the following yaml to a file called `account_update.yaml` - -``` yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: default -automountServiceAccountToken: false -``` - -Create a bash script file called `account_update.sh`. Be sure to `chmod +x account_update.sh` so the script has execute permissions. - -``` -#!/bin/bash -e - -for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do - kubectl patch serviceaccount default -n ${namespace} -p "$(cat account_update.yaml)" -done -``` - -### Ensure that all Namespaces have Network Policies defined - -Running different applications on the same Kubernetes cluster creates a risk of one -compromised application attacking a neighboring application. Network segmentation is -important to ensure that containers can communicate only with those they are supposed -to. A network policy is a specification of how selections of pods are allowed to -communicate with each other and other network endpoints. - -Network Policies are namespace scoped. When a network policy is introduced to a given -namespace, all traffic not allowed by the policy is denied. However, if there are no network -policies in a namespace all traffic will be allowed into and out of the pods in that -namespace. To enforce network policies, a CNI (container network interface) plugin must be enabled. -This guide uses [canal](https://github.com/projectcalico/canal) to provide the policy enforcement. -Additional information about CNI providers can be found -[here](https://rancher.com/blog/2019/2019-03-21-comparing-kubernetes-cni-providers-flannel-calico-canal-and-weave/) - -Once a CNI provider is enabled on a cluster a default network policy can be applied. For reference purposes a -**permissive** example is provide below. If you want to allow all traffic to all pods in a namespace -(even if policies are added that cause some pods to be treated as “isolated”), -you can create a policy that explicitly allows all traffic in that namespace. Save the following `yaml` as -`default-allow-all.yaml`. Additional [documentation](https://kubernetes.io/docs/concepts/services-networking/network-policies/) -about network policies can be found on the Kubernetes site. - -> This `NetworkPolicy` is not recommended for production use - -``` yaml ---- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: default-allow-all -spec: - podSelector: {} - ingress: - - {} - egress: - - {} - policyTypes: - - Ingress - - Egress -``` - -Create a bash script file called `apply_networkPolicy_to_all_ns.sh`. Be sure to -`chmod +x apply_networkPolicy_to_all_ns.sh` so the script has execute permissions. - -``` -#!/bin/bash -e - -for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do - kubectl apply -f default-allow-all.yaml -n ${namespace} -done -``` -Execute this script to apply the `default-allow-all.yaml` the **permissive** `NetworkPolicy` to all namespaces. - -### Reference Hardened RKE `cluster.yml` configuration - -The reference `cluster.yml` is used by the RKE CLI that provides the configuration needed to achieve a hardened install -of Rancher Kubernetes Engine (RKE). Install [documentation](https://rancher.com/docs/rke/latest/en/installation/) is -provided with additional details about the configuration items. This reference `cluster.yml` does not include the required **nodes** directive which will vary depending on your environment. Documentation for node configuration can be found here: https://rancher.com/docs/rke/latest/en/config-options/nodes - - -``` yaml -# If you intend to deploy Kubernetes in an air-gapped environment, -# please consult the documentation on how to configure custom RKE images. -kubernetes_version: "v1.15.9-rancher1-1" -enable_network_policy: true -default_pod_security_policy_template_id: "restricted" -# the nodes directive is required and will vary depending on your environment -# documentation for node configuration can be found here: -# https://rancher.com/docs/rke/latest/en/config-options/nodes -nodes: -services: - etcd: - uid: 52034 - gid: 52034 - kube-api: - pod_security_policy: true - secrets_encryption_config: - enabled: true - audit_log: - enabled: true - admission_configuration: - event_rate_limit: - enabled: true - kube-controller: - extra_args: - feature-gates: "RotateKubeletServerCertificate=true" - scheduler: - image: "" - extra_args: {} - extra_binds: [] - extra_env: [] - kubelet: - generate_serving_certificate: true - extra_args: - feature-gates: "RotateKubeletServerCertificate=true" - protect-kernel-defaults: "true" - tls-cipher-suites: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256" - extra_binds: [] - extra_env: [] - cluster_domain: "" - infra_container_image: "" - cluster_dns_server: "" - fail_swap_on: false - kubeproxy: - image: "" - extra_args: {} - extra_binds: [] - extra_env: [] -network: - plugin: "" - options: {} - mtu: 0 - node_selector: {} -authentication: - strategy: "" - sans: [] - webhook: null -addons: | - --- - apiVersion: v1 - kind: Namespace - metadata: - name: ingress-nginx - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: Role - metadata: - name: default-psp-role - namespace: ingress-nginx - rules: - - apiGroups: - - extensions - resourceNames: - - default-psp - resources: - - podsecuritypolicies - verbs: - - use - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: RoleBinding - metadata: - name: default-psp-rolebinding - namespace: ingress-nginx - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: default-psp-role - subjects: - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:serviceaccounts - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:authenticated - --- - apiVersion: v1 - kind: Namespace - metadata: - name: cattle-system - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: Role - metadata: - name: default-psp-role - namespace: cattle-system - rules: - - apiGroups: - - extensions - resourceNames: - - default-psp - resources: - - podsecuritypolicies - verbs: - - use - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: RoleBinding - metadata: - name: default-psp-rolebinding - namespace: cattle-system - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: default-psp-role - subjects: - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:serviceaccounts - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:authenticated - --- - apiVersion: policy/v1beta1 - kind: PodSecurityPolicy - metadata: - name: restricted - spec: - requiredDropCapabilities: - - NET_RAW - privileged: false - allowPrivilegeEscalation: false - defaultAllowPrivilegeEscalation: false - fsGroup: - rule: RunAsAny - runAsUser: - rule: MustRunAsNonRoot - seLinux: - rule: RunAsAny - supplementalGroups: - rule: RunAsAny - volumes: - - emptyDir - - secret - - persistentVolumeClaim - - downwardAPI - - configMap - - projected - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: ClusterRole - metadata: - name: psp:restricted - rules: - - apiGroups: - - extensions - resourceNames: - - restricted - resources: - - podsecuritypolicies - verbs: - - use - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: ClusterRoleBinding - metadata: - name: psp:restricted - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: psp:restricted - subjects: - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:serviceaccounts - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:authenticated - --- - apiVersion: v1 - kind: ServiceAccount - metadata: - name: tiller - namespace: kube-system - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: ClusterRoleBinding - metadata: - name: tiller - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cluster-admin - subjects: - - kind: ServiceAccount - name: tiller - namespace: kube-system - -addons_include: [] -system_images: - etcd: "" - alpine: "" - nginx_proxy: "" - cert_downloader: "" - kubernetes_services_sidecar: "" - kubedns: "" - dnsmasq: "" - kubedns_sidecar: "" - kubedns_autoscaler: "" - coredns: "" - coredns_autoscaler: "" - kubernetes: "" - flannel: "" - flannel_cni: "" - calico_node: "" - calico_cni: "" - calico_controllers: "" - calico_ctl: "" - calico_flexvol: "" - canal_node: "" - canal_cni: "" - canal_flannel: "" - canal_flexvol: "" - weave_node: "" - weave_cni: "" - pod_infra_container: "" - ingress: "" - ingress_backend: "" - metrics_server: "" - windows_pod_infra_container: "" -ssh_key_path: "" -ssh_cert_path: "" -ssh_agent_auth: false -authorization: - mode: "" - options: {} -ignore_docker_version: false -private_registries: [] -ingress: - provider: "" - options: {} - node_selector: {} - extra_args: {} - dns_policy: "" - extra_envs: [] - extra_volumes: [] - extra_volume_mounts: [] -cluster_name: "" -prefix_path: "" -addon_job_timeout: 0 -bastion_host: - address: "" - port: "" - user: "" - ssh_key: "" - ssh_key_path: "" - ssh_cert: "" - ssh_cert_path: "" -monitoring: - provider: "" - options: {} - node_selector: {} -restore: - restore: false - snapshot_name: "" -dns: null -``` - -### Reference Hardened RKE Template configuration - -The reference RKE Template provides the configuration needed to achieve a hardened install of Kubenetes. -RKE Templates are used to provision Kubernetes and define Rancher settings. Follow the Rancher -[documentaion](https://rancher.com/docs/rancher/v2.6/en/installation) for additional installation and RKE Template details. - -``` yaml -# -# Cluster Config -# -default_pod_security_policy_template_id: restricted -docker_root_dir: /var/lib/docker -enable_cluster_alerting: false -enable_cluster_monitoring: false -enable_network_policy: true -# -# Rancher Config -# -rancher_kubernetes_engine_config: - addon_job_timeout: 30 - addons: |- - --- - apiVersion: v1 - kind: Namespace - metadata: - name: ingress-nginx - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: Role - metadata: - name: default-psp-role - namespace: ingress-nginx - rules: - - apiGroups: - - extensions - resourceNames: - - default-psp - resources: - - podsecuritypolicies - verbs: - - use - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: RoleBinding - metadata: - name: default-psp-rolebinding - namespace: ingress-nginx - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: default-psp-role - subjects: - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:serviceaccounts - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:authenticated - --- - apiVersion: v1 - kind: Namespace - metadata: - name: cattle-system - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: Role - metadata: - name: default-psp-role - namespace: cattle-system - rules: - - apiGroups: - - extensions - resourceNames: - - default-psp - resources: - - podsecuritypolicies - verbs: - - use - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: RoleBinding - metadata: - name: default-psp-rolebinding - namespace: cattle-system - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: default-psp-role - subjects: - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:serviceaccounts - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:authenticated - --- - apiVersion: policy/v1beta1 - kind: PodSecurityPolicy - metadata: - name: restricted - spec: - requiredDropCapabilities: - - NET_RAW - privileged: false - allowPrivilegeEscalation: false - defaultAllowPrivilegeEscalation: false - fsGroup: - rule: RunAsAny - runAsUser: - rule: MustRunAsNonRoot - seLinux: - rule: RunAsAny - supplementalGroups: - rule: RunAsAny - volumes: - - emptyDir - - secret - - persistentVolumeClaim - - downwardAPI - - configMap - - projected - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: ClusterRole - metadata: - name: psp:restricted - rules: - - apiGroups: - - extensions - resourceNames: - - restricted - resources: - - podsecuritypolicies - verbs: - - use - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: ClusterRoleBinding - metadata: - name: psp:restricted - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: psp:restricted - subjects: - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:serviceaccounts - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:authenticated - --- - apiVersion: v1 - kind: ServiceAccount - metadata: - name: tiller - namespace: kube-system - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: ClusterRoleBinding - metadata: - name: tiller - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cluster-admin - subjects: - - kind: ServiceAccount - name: tiller - namespace: kube-system - ignore_docker_version: true - kubernetes_version: v1.15.9-rancher1-1 -# -# If you are using calico on AWS -# -# network: -# plugin: calico -# calico_network_provider: -# cloud_provider: aws -# -# # To specify flannel interface -# -# network: -# plugin: flannel -# flannel_network_provider: -# iface: eth1 -# -# # To specify flannel interface for canal plugin -# -# network: -# plugin: canal -# canal_network_provider: -# iface: eth1 -# - network: - mtu: 0 - plugin: canal -# -# services: -# kube-api: -# service_cluster_ip_range: 10.43.0.0/16 -# kube-controller: -# cluster_cidr: 10.42.0.0/16 -# service_cluster_ip_range: 10.43.0.0/16 -# kubelet: -# cluster_domain: cluster.local -# cluster_dns_server: 10.43.0.10 -# - services: - etcd: - backup_config: - enabled: false - interval_hours: 12 - retention: 6 - safe_timestamp: false - creation: 12h - extra_args: - election-timeout: '5000' - heartbeat-interval: '500' - gid: 52034 - retention: 72h - snapshot: false - uid: 52034 - kube_api: - always_pull_images: false - audit_log: - enabled: true - event_rate_limit: - enabled: true - pod_security_policy: true - secrets_encryption_config: - enabled: true - service_node_port_range: 30000-32767 - kube_controller: - extra_args: - address: 127.0.0.1 - feature-gates: RotateKubeletServerCertificate=true - profiling: 'false' - terminated-pod-gc-threshold: '1000' - kubelet: - extra_args: - anonymous-auth: 'false' - event-qps: '0' - feature-gates: RotateKubeletServerCertificate=true - make-iptables-util-chains: 'true' - protect-kernel-defaults: 'true' - streaming-connection-idle-timeout: 1800s - tls-cipher-suites: >- - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 - fail_swap_on: false - generate_serving_certificate: true - scheduler: - extra_args: - address: 127.0.0.1 - profiling: 'false' - ssh_agent_auth: false -windows_prefered_cluster: false -``` - -### Hardened Reference Ubuntu 18.04 LTS **cloud-config**: - -The reference **cloud-config** is generally used in cloud infrastructure environments to allow for -configuration management of compute instances. The reference config configures Ubuntu operating system level settings -needed before installing kubernetes. - -``` yaml -#cloud-config -packages: - - curl - - jq -runcmd: - - sysctl -w vm.overcommit_memory=1 - - sysctl -w kernel.panic=10 - - sysctl -w kernel.panic_on_oops=1 - - curl https://releases.rancher.com/install-docker/18.09.sh | sh - - usermod -aG docker ubuntu - - return=1; while [ $return != 0 ]; do sleep 2; docker ps; return=$?; done - - addgroup --gid 52034 etcd - - useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd -write_files: - - path: /etc/sysctl.d/kubelet.conf - owner: root:root - permissions: "0644" - content: | - vm.overcommit_memory=1 - kernel.panic=10 - kernel.panic_on_oops=1 -``` diff --git a/content/rancher/v2.6/en/security/rancher-2.5/1.6-benchmark-2.5/_index.md b/content/rancher/v2.6/en/security/rancher-2.5/1.6-benchmark-2.5/_index.md deleted file mode 100644 index d7803779eb6..00000000000 --- a/content/rancher/v2.6/en/security/rancher-2.5/1.6-benchmark-2.5/_index.md +++ /dev/null @@ -1,3317 +0,0 @@ ---- -title: CIS 1.6 Benchmark - Self-Assessment Guide - Rancher v2.5.4 -weight: 101 ---- - -### CIS 1.6 Kubernetes Benchmark - Rancher v2.5.4 with Kubernetes v1.18 - -[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.5/Rancher_1.6_Benchmark_Assessment.pdf) - -#### Overview - -This document is a companion to the Rancher v2.5.4 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark. - -This guide corresponds to specific versions of the hardening guide, Rancher, CIS Benchmark, and Kubernetes: - -Hardening Guide Version | Rancher Version | CIS Benchmark Version | Kubernetes Version ----------------------------|----------|---------|------- -Hardening Guide with CIS 1.6 Benchmark | Rancher v2.5.4 | CIS 1.6| Kubernetes v1.18 - -Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply and will have a result of `Not Applicable`. This guide will walk through the various controls and provide updated example commands to audit compliance in Rancher-created clusters. - -This document is to be used by Rancher operators, security teams, auditors and decision makers. - -For more detail about each audit, including rationales and remediations for failing tests, you can refer to the corresponding section of the CIS Kubernetes Benchmark 1.6. You can download the benchmark after logging in to [CISecurity.org]( https://www.cisecurity.org/benchmark/kubernetes/). - -#### Testing controls methodology - -Rancher and RKE install Kubernetes services via Docker containers. Configuration is defined by arguments passed to the container at the time of initialization, not via configuration files. - -Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher Labs are provided for testing. -When performing the tests, you will need access to the Docker command line on the hosts of all three RKE roles. The commands also make use of the the [jq](https://stedolan.github.io/jq/) and [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) (with valid config) tools to and are required in the testing and evaluation of test results. - -### Controls - -## 1.1 Etcd Node Configuration Files -### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) - -**Result:** pass - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the below command: -ps -ef | grep etcd Run the below command (based on the etcd data directory found above). For example, -chmod 700 /var/lib/etcd - - -**Audit:** - -```bash -stat -c %a /node/var/lib/etcd -``` - -**Expected Result**: - -```console -'700' is equal to '700' -``` - -**Returned Value**: - -```console -700 - -``` -### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) - -**Result:** pass - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the below command: -ps -ef | grep etcd -Run the below command (based on the etcd data directory found above). -For example, chown etcd:etcd /var/lib/etcd - -A system service account is required for etcd data directory ownership. -Refer to Rancher's hardening guide for more details on how to configure this ownership. - - -**Audit:** - -```bash -stat -c %U:%G /node/var/lib/etcd -``` - -**Expected Result**: - -```console -'etcd:etcd' is present -``` - -**Returned Value**: - -```console -etcd:etcd - -``` -### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the master node. -For example, -chown -R root:root /etc/kubernetes/pki/ - - -**Audit:** - -```bash -check_files_owner_in_dir.sh /node/etc/kubernetes/ssl -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Audit Script:** -```bash -#!/usr/bin/env bash - -# This script is used to ensure the owner is set to root:root for -# the given directory and all the files in it -# -# inputs: -# $1 = /full/path/to/directory -# -# outputs: -# true/false - -INPUT_DIR=$1 - -if [[ "${INPUT_DIR}" == "" ]]; then - echo "false" - exit -fi - -if [[ $(stat -c %U:%G ${INPUT_DIR}) != "root:root" ]]; then - echo "false" - exit -fi - -statInfoLines=$(stat -c "%n %U:%G" ${INPUT_DIR}/*) -while read -r statInfoLine; do - f=$(echo ${statInfoLine} | cut -d' ' -f1) - p=$(echo ${statInfoLine} | cut -d' ' -f2) - - if [[ $(basename "$f" .pem) == "kube-etcd-"* ]]; then - if [[ "$p" != "root:root" && "$p" != "etcd:etcd" ]]; then - echo "false" - exit - fi - else - if [[ "$p" != "root:root" ]]; then - echo "false" - exit - fi - fi -done <<< "${statInfoLines}" - - -echo "true" -exit - -``` -**Returned Value**: - -```console -true - -``` -### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Automated) - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the master node. -For example, -chmod -R 644 /etc/kubernetes/pki/*.crt - - -**Audit:** - -```bash -check_files_permissions.sh /node/etc/kubernetes/ssl/!(*key).pem -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Audit Script:** -```bash -#!/usr/bin/env bash - -# This script is used to ensure the file permissions are set to 644 or -# more restrictive for all files in a given directory or a wildcard -# selection of files -# -# inputs: -# $1 = /full/path/to/directory or /path/to/fileswithpattern -# ex: !(*key).pem -# -# $2 (optional) = permission (ex: 600) -# -# outputs: -# true/false - -# Turn on "extended glob" for use of '!' in wildcard -shopt -s extglob - -# Turn off history to avoid surprises when using '!' -set -H - -USER_INPUT=$1 - -if [[ "${USER_INPUT}" == "" ]]; then - echo "false" - exit -fi - - -if [[ -d ${USER_INPUT} ]]; then - PATTERN="${USER_INPUT}/*" -else - PATTERN="${USER_INPUT}" -fi - -PERMISSION="" -if [[ "$2" != "" ]]; then - PERMISSION=$2 -fi - -FILES_PERMISSIONS=$(stat -c %n\ %a ${PATTERN}) - -while read -r fileInfo; do - p=$(echo ${fileInfo} | cut -d' ' -f2) - - if [[ "${PERMISSION}" != "" ]]; then - if [[ "$p" != "${PERMISSION}" ]]; then - echo "false" - exit - fi - else - if [[ "$p" != "644" && "$p" != "640" && "$p" != "600" ]]; then - echo "false" - exit - fi - fi -done <<< "${FILES_PERMISSIONS}" - - -echo "true" -exit - -``` -**Returned Value**: - -```console -true - -``` -### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated) - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the master node. -For example, -chmod -R 600 /etc/kubernetes/ssl/*key.pem - - -**Audit:** - -```bash -check_files_permissions.sh /node/etc/kubernetes/ssl/*key.pem 600 -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Audit Script:** -```bash -#!/usr/bin/env bash - -# This script is used to ensure the file permissions are set to 644 or -# more restrictive for all files in a given directory or a wildcard -# selection of files -# -# inputs: -# $1 = /full/path/to/directory or /path/to/fileswithpattern -# ex: !(*key).pem -# -# $2 (optional) = permission (ex: 600) -# -# outputs: -# true/false - -# Turn on "extended glob" for use of '!' in wildcard -shopt -s extglob - -# Turn off history to avoid surprises when using '!' -set -H - -USER_INPUT=$1 - -if [[ "${USER_INPUT}" == "" ]]; then - echo "false" - exit -fi - - -if [[ -d ${USER_INPUT} ]]; then - PATTERN="${USER_INPUT}/*" -else - PATTERN="${USER_INPUT}" -fi - -PERMISSION="" -if [[ "$2" != "" ]]; then - PERMISSION=$2 -fi - -FILES_PERMISSIONS=$(stat -c %n\ %a ${PATTERN}) - -while read -r fileInfo; do - p=$(echo ${fileInfo} | cut -d' ' -f2) - - if [[ "${PERMISSION}" != "" ]]; then - if [[ "$p" != "${PERMISSION}" ]]; then - echo "false" - exit - fi - else - if [[ "$p" != "644" && "$p" != "640" && "$p" != "600" ]]; then - echo "false" - exit - fi - fi -done <<< "${FILES_PERMISSIONS}" - - -echo "true" -exit - -``` -**Returned Value**: - -```console -true - -``` -### 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) - -**Result:** notApplicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. -All configuration is passed in as arguments at container run time. - - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/kubernetes/manifests/kube-apiserver.yaml; then stat -c permissions=%a /etc/kubernetes/manifests/kube-apiserver.yaml; fi' -``` - - -### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) - -**Result:** notApplicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. -All configuration is passed in as arguments at container run time. - - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/kubernetes/manifests/kube-apiserver.yaml; then stat -c %U:%G /etc/kubernetes/manifests/kube-apiserver.yaml; fi' -``` - - -### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated) - -**Result:** notApplicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/kubernetes/manifests/kube-controller-manager.yaml; then stat -c permissions=%a /etc/kubernetes/manifests/kube-controller-manager.yaml; fi' -``` - - -### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) - -**Result:** notApplicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/kubernetes/manifests/kube-controller-manager.yaml; then stat -c %U:%G /etc/kubernetes/manifests/kube-controller-manager.yaml; fi' -``` - - -### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated) - -**Result:** notApplicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/kubernetes/manifests/kube-scheduler.yaml; then stat -c permissions=%a /etc/kubernetes/manifests/kube-scheduler.yaml; fi' -``` - - -### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) - -**Result:** notApplicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/kubernetes/manifests/kube-scheduler.yaml; then stat -c %U:%G /etc/kubernetes/manifests/kube-scheduler.yaml; fi' -``` - - -### 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated) - -**Result:** notApplicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. -All configuration is passed in as arguments at container run time. - - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/kubernetes/manifests/etcd.yaml; then stat -c permissions=%a /etc/kubernetes/manifests/etcd.yaml; fi' -``` - - -### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) - -**Result:** notApplicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. -All configuration is passed in as arguments at container run time. - - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/kubernetes/manifests/etcd.yaml; then stat -c %U:%G /etc/kubernetes/manifests/etcd.yaml; fi' -``` - - -### 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Manual) - -**Result:** warn - -**Remediation:** -Run the below command (based on the file location on your system) on the master node. -For example, -chmod 644 - - -**Audit:** - -```bash -stat -c permissions=%a -``` - - -### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual) - -**Result:** warn - -**Remediation:** -Run the below command (based on the file location on your system) on the master node. -For example, -chown root:root - - -**Audit:** - -```bash -stat -c %U:%G -``` - - -### 1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Automated) - -**Result:** notApplicable - -**Remediation:** -Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. - - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c permissions=%a /etc/kubernetes/admin.conf; fi' -``` - - -### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) - -**Result:** notApplicable - -**Remediation:** -Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. - - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c %U:%G /etc/kubernetes/admin.conf; fi' -``` - - -### 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated) - -**Result:** notApplicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - - -**Audit:** - -```bash -/bin/sh -c 'if test -e scheduler; then stat -c permissions=%a scheduler; fi' -``` - - -### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) - -**Result:** notApplicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - - -**Audit:** - -```bash -/bin/sh -c 'if test -e scheduler; then stat -c %U:%G scheduler; fi' -``` - - -### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated) - -**Result:** notApplicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - - -**Audit:** - -```bash -/bin/sh -c 'if test -e controllermanager; then stat -c permissions=%a controllermanager; fi' -``` - - -### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) - -**Result:** notApplicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - - -**Audit:** - -```bash -/bin/sh -c 'if test -e controllermanager; then stat -c %U:%G controllermanager; fi' -``` - - -## 1.2 API Server -### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the below parameter. ---anonymous-auth=false - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'false' is equal to 'false' -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.2 Ensure that the --basic-auth-file argument is not set (Automated) - -**Result:** pass - -**Remediation:** -Follow the documentation and configure alternate mechanisms for authentication. Then, -edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and remove the --basic-auth-file= parameter. - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--basic-auth-file' is not present -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.3 Ensure that the --token-auth-file parameter is not set (Automated) - -**Result:** pass - -**Remediation:** -Follow the documentation and configure alternate mechanisms for authentication. Then, -edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and remove the --token-auth-file= parameter. - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--token-auth-file' is not present -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and remove the --kubelet-https parameter. - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-https' is not present OR '--kubelet-https' is not present -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the -apiserver and kubelets. Then, edit API server pod specification file -/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the -kubelet client certificate and key parameters as below. ---kubelet-client-certificate= ---kubelet-client-key= - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and setup the TLS connection between -the apiserver and kubelets. Then, edit the API server pod specification file -/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the ---kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. ---kubelet-certificate-authority= - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-certificate-authority' is present -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --authorization-mode parameter to values other than AlwaysAllow. -One such example could be as below. ---authorization-mode=RBAC - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console - 'Node,RBAC' not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --authorization-mode parameter to a value that includes Node. ---authorization-mode=Node,RBAC - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'Node,RBAC' has 'Node' -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --authorization-mode parameter to a value that includes RBAC, -for example: ---authorization-mode=Node,RBAC - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'Node,RBAC' has 'RBAC' -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Automated) - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set the desired limits in a configuration file. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -and set the below parameters. ---enable-admission-plugins=...,EventRateLimit,... ---admission-control-config-file= - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' has 'EventRateLimit' -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and either remove the --enable-admission-plugins parameter, or set it to a -value that does not include AlwaysAdmit. - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console - 'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --enable-admission-plugins parameter to include -AlwaysPullImages. ---enable-admission-plugins=...,AlwaysPullImages,... - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - - -### 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --enable-admission-plugins parameter to include -SecurityContextDeny, unless PodSecurityPolicy is already in place. ---enable-admission-plugins=...,SecurityContextDeny,... - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - - -### 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) - -**Result:** pass - -**Remediation:** -Follow the documentation and create ServiceAccount objects as per your environment. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and ensure that the --disable-admission-plugins parameter is set to a -value that does not include ServiceAccount. - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is not present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --disable-admission-plugins parameter to -ensure it does not include NamespaceLifecycle. - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is not present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set (Automated) - -**Result:** pass - -**Remediation:** -Follow the documentation and create Pod Security Policy objects as per your environment. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --enable-admission-plugins parameter to a -value that includes PodSecurityPolicy: ---enable-admission-plugins=...,PodSecurityPolicy,... -Then restart the API Server. - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' has 'PodSecurityPolicy' -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.17 Ensure that the admission control plugin NodeRestriction is set (Automated) - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --enable-admission-plugins parameter to a -value that includes NodeRestriction. ---enable-admission-plugins=...,NodeRestriction,... - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' has 'NodeRestriction' -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.18 Ensure that the --insecure-bind-address argument is not set (Automated) - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and remove the --insecure-bind-address parameter. - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--insecure-bind-address' is not present -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.19 Ensure that the --insecure-port argument is set to 0 (Automated) - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the below parameter. ---insecure-port=0 - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'0' is equal to '0' -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.20 Ensure that the --secure-port argument is not set to 0 (Automated) - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and either remove the --secure-port parameter or -set it to a different (non-zero) desired port. - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -6443 is greater than 0 OR '--secure-port' is not present -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.21 Ensure that the --profiling argument is set to false (Automated) - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the below parameter. ---profiling=false - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'false' is equal to 'false' -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.22 Ensure that the --audit-log-path argument is set (Automated) - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --audit-log-path parameter to a suitable path and -file where you would like audit logs to be written, for example: ---audit-log-path=/var/log/apiserver/audit.log - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-path' is present -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --audit-log-maxage parameter to 30 or as an appropriate number of days: ---audit-log-maxage=30 - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -30 is greater or equal to 30 -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --audit-log-maxbackup parameter to 10 or to an appropriate -value. ---audit-log-maxbackup=10 - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -10 is greater or equal to 10 -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --audit-log-maxsize parameter to an appropriate size in MB. -For example, to set it as 100 MB: ---audit-log-maxsize=100 - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -100 is greater or equal to 100 -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.26 Ensure that the --request-timeout argument is set as appropriate (Automated) - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -and set the below parameter as appropriate and if needed. -For example, ---request-timeout=300s - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--request-timeout' is not present OR '--request-timeout' is not present -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.27 Ensure that the --service-account-lookup argument is set to true (Automated) - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the below parameter. ---service-account-lookup=true -Alternatively, you can delete the --service-account-lookup parameter from this file so -that the default takes effect. - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-lookup' is not present OR 'true' is equal to 'true' -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.28 Ensure that the --service-account-key-file argument is set as appropriate (Automated) - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --service-account-key-file parameter -to the public key file for service accounts: ---service-account-key-file= - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-key-file' is present -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the etcd certificate and key file parameters. ---etcd-certfile= ---etcd-keyfile= - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--etcd-certfile' is present AND '--etcd-keyfile' is present -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the TLS certificate and private key file parameters. ---tls-cert-file= ---tls-private-key-file= - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.31 Ensure that the --client-ca-file argument is set as appropriate (Automated) - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the client certificate authority file. ---client-ca-file= - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.32 Ensure that the --etcd-cafile argument is set as appropriate (Automated) - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the etcd certificate authority file parameter. ---etcd-cafile= - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--etcd-cafile' is present -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate (Automated) - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --encryption-provider-config parameter to the path of that file: --encryption-provider-config= - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--encryption-provider-config' is present -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 1.2.34 Ensure that encryption providers are appropriately configured (Automated) - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -In this file, choose aescbc, kms or secretbox as the encryption provider. - - -**Audit:** - -```bash -check_encryption_provider_config.sh aescbc kms secretbox -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Audit Script:** -```bash -#!/usr/bin/env bash - -# This script is used to check the encrption provider config is set to aesbc -# -# outputs: -# true/false - -# TODO: Figure out the file location from the kube-apiserver commandline args -ENCRYPTION_CONFIG_FILE="/node/etc/kubernetes/ssl/encryption.yaml" - -if [[ ! -f "${ENCRYPTION_CONFIG_FILE}" ]]; then - echo "false" - exit -fi - -for provider in "$@" -do - if grep "$provider" "${ENCRYPTION_CONFIG_FILE}"; then - echo "true" - exit - fi -done - -echo "false" -exit - -``` -**Returned Value**: - -```console - - aescbc: -true - -``` -### 1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated) - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the below parameter. ---tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM -_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM -_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM -_SHA384 - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - - -## 1.3 Controller Manager -### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Automated) - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the master node and set the --terminated-pod-gc-threshold to an appropriate threshold, -for example: ---terminated-pod-gc-threshold=10 - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--terminated-pod-gc-threshold' is present -``` - -**Returned Value**: - -```console -root 4788 4773 4 16:16 ? 00:00:09 kube-controller-manager --configure-cloud-routes=false --cloud-provider= --service-cluster-ip-range=10.43.0.0/16 --v=2 --pod-eviction-timeout=5m0s --leader-elect=true --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --profiling=false --node-monitor-grace-period=40s --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --address=0.0.0.0 --allow-untagged-cloud=true --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --enable-hostpath-provisioner=false --terminated-pod-gc-threshold=1000 --feature-gates=RotateKubeletServerCertificate=true --use-service-account-credentials=true - -``` -### 1.3.2 Ensure that the --profiling argument is set to false (Automated) - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the master node and set the below parameter. ---profiling=false - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'false' is equal to 'false' -``` - -**Returned Value**: - -```console -root 4788 4773 4 16:16 ? 00:00:09 kube-controller-manager --configure-cloud-routes=false --cloud-provider= --service-cluster-ip-range=10.43.0.0/16 --v=2 --pod-eviction-timeout=5m0s --leader-elect=true --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --profiling=false --node-monitor-grace-period=40s --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --address=0.0.0.0 --allow-untagged-cloud=true --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --enable-hostpath-provisioner=false --terminated-pod-gc-threshold=1000 --feature-gates=RotateKubeletServerCertificate=true --use-service-account-credentials=true - -``` -### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the master node to set the below parameter. ---use-service-account-credentials=true - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'true' is not equal to 'false' -``` - -**Returned Value**: - -```console -root 4788 4773 4 16:16 ? 00:00:09 kube-controller-manager --configure-cloud-routes=false --cloud-provider= --service-cluster-ip-range=10.43.0.0/16 --v=2 --pod-eviction-timeout=5m0s --leader-elect=true --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --profiling=false --node-monitor-grace-period=40s --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --address=0.0.0.0 --allow-untagged-cloud=true --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --enable-hostpath-provisioner=false --terminated-pod-gc-threshold=1000 --feature-gates=RotateKubeletServerCertificate=true --use-service-account-credentials=true - -``` -### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the master node and set the --service-account-private-key-file parameter -to the private key file for service accounts. ---service-account-private-key-file= - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-private-key-file' is present -``` - -**Returned Value**: - -```console -root 4788 4773 4 16:16 ? 00:00:09 kube-controller-manager --configure-cloud-routes=false --cloud-provider= --service-cluster-ip-range=10.43.0.0/16 --v=2 --pod-eviction-timeout=5m0s --leader-elect=true --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --profiling=false --node-monitor-grace-period=40s --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --address=0.0.0.0 --allow-untagged-cloud=true --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --enable-hostpath-provisioner=false --terminated-pod-gc-threshold=1000 --feature-gates=RotateKubeletServerCertificate=true --use-service-account-credentials=true - -``` -### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the master node and set the --root-ca-file parameter to the certificate bundle file`. ---root-ca-file= - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--root-ca-file' is present -``` - -**Returned Value**: - -```console -root 4788 4773 4 16:16 ? 00:00:09 kube-controller-manager --configure-cloud-routes=false --cloud-provider= --service-cluster-ip-range=10.43.0.0/16 --v=2 --pod-eviction-timeout=5m0s --leader-elect=true --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --profiling=false --node-monitor-grace-period=40s --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --address=0.0.0.0 --allow-untagged-cloud=true --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --enable-hostpath-provisioner=false --terminated-pod-gc-threshold=1000 --feature-gates=RotateKubeletServerCertificate=true --use-service-account-credentials=true - -``` -### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) - -**Result:** notApplicable - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the master node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. ---feature-gates=RotateKubeletServerCertificate=true - -Cluster provisioned by RKE handles certificate rotation directly through RKE. - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - - -### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the master node and ensure the correct value for the --bind-address parameter - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--bind-address' is not present OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -root 4788 4773 4 16:16 ? 00:00:09 kube-controller-manager --configure-cloud-routes=false --cloud-provider= --service-cluster-ip-range=10.43.0.0/16 --v=2 --pod-eviction-timeout=5m0s --leader-elect=true --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --profiling=false --node-monitor-grace-period=40s --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --address=0.0.0.0 --allow-untagged-cloud=true --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --enable-hostpath-provisioner=false --terminated-pod-gc-threshold=1000 --feature-gates=RotateKubeletServerCertificate=true --use-service-account-credentials=true - -``` -## 1.4 Scheduler -### 1.4.1 Ensure that the --profiling argument is set to false (Automated) - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file -on the master node and set the below parameter. ---profiling=false - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-scheduler | grep -v grep -``` - -**Expected Result**: - -```console -'false' is equal to 'false' -``` - -**Returned Value**: - -```console -root 4947 4930 1 16:16 ? 00:00:02 kube-scheduler --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --leader-elect=true --profiling=false --v=2 --address=0.0.0.0 - -``` -### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml -on the master node and ensure the correct value for the --bind-address parameter - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-scheduler | grep -v grep -``` - -**Expected Result**: - -```console -'--bind-address' is not present OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -root 4947 4930 1 16:16 ? 00:00:02 kube-scheduler --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --leader-elect=true --profiling=false --v=2 --address=0.0.0.0 - -``` -## 2 Etcd Node Configuration Files -### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) - -**Result:** pass - -**Remediation:** -Follow the etcd service documentation and configure TLS encryption. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml -on the master node and set the below parameters. ---cert-file= ---key-file= - - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--cert-file' is present AND '--key-file' is present -``` - -**Returned Value**: - -```console -etcd 4318 4301 6 16:15 ? 00:00:14 /usr/local/bin/etcd --listen-peer-urls=https://0.0.0.0:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225.pem --advertise-client-urls=https://192.168.1.225:2379,https://192.168.1.225:4001 --election-timeout=5000 --data-dir=/var/lib/rancher/etcd/ --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225.pem --enable-v2=true --initial-cluster=etcd-cis-aio-0=https://192.168.1.225:2380 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --client-cert-auth=true --heartbeat-interval=500 --initial-cluster-token=etcd-cluster-1 --name=etcd-cis-aio-0 --listen-client-urls=https://0.0.0.0:2379 --peer-key-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225-key.pem --peer-client-cert-auth=true --initial-advertise-peer-urls=https://192.168.1.225:2380 --initial-cluster-state=new --key-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225-key.pem -root 4366 4349 0 16:15 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=192.168.1.225:2379 --retention=72h --creation=12h -root 4643 4626 23 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User -root 14998 14985 0 16:19 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json - -``` -### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and set the below parameter. ---client-cert-auth="true" - - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--client-cert-auth' is present OR 'true' is equal to 'true' -``` - -**Returned Value**: - -```console -etcd 4318 4301 6 16:15 ? 00:00:14 /usr/local/bin/etcd --listen-peer-urls=https://0.0.0.0:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225.pem --advertise-client-urls=https://192.168.1.225:2379,https://192.168.1.225:4001 --election-timeout=5000 --data-dir=/var/lib/rancher/etcd/ --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225.pem --enable-v2=true --initial-cluster=etcd-cis-aio-0=https://192.168.1.225:2380 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --client-cert-auth=true --heartbeat-interval=500 --initial-cluster-token=etcd-cluster-1 --name=etcd-cis-aio-0 --listen-client-urls=https://0.0.0.0:2379 --peer-key-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225-key.pem --peer-client-cert-auth=true --initial-advertise-peer-urls=https://192.168.1.225:2380 --initial-cluster-state=new --key-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225-key.pem -root 4366 4349 0 16:15 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=192.168.1.225:2379 --retention=72h --creation=12h -root 4643 4626 23 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User -root 14998 14985 0 16:19 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json - -``` -### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and either remove the --auto-tls parameter or set it to false. - --auto-tls=false - - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--auto-tls' is not present OR '--auto-tls' is not present -``` - -**Returned Value**: - -```console -etcd 4318 4301 6 16:15 ? 00:00:14 /usr/local/bin/etcd --listen-peer-urls=https://0.0.0.0:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225.pem --advertise-client-urls=https://192.168.1.225:2379,https://192.168.1.225:4001 --election-timeout=5000 --data-dir=/var/lib/rancher/etcd/ --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225.pem --enable-v2=true --initial-cluster=etcd-cis-aio-0=https://192.168.1.225:2380 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --client-cert-auth=true --heartbeat-interval=500 --initial-cluster-token=etcd-cluster-1 --name=etcd-cis-aio-0 --listen-client-urls=https://0.0.0.0:2379 --peer-key-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225-key.pem --peer-client-cert-auth=true --initial-advertise-peer-urls=https://192.168.1.225:2380 --initial-cluster-state=new --key-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225-key.pem -root 4366 4349 0 16:15 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=192.168.1.225:2379 --retention=72h --creation=12h -root 4643 4626 23 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User -root 14998 14985 0 16:19 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json - -``` -### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) - -**Result:** pass - -**Remediation:** -Follow the etcd service documentation and configure peer TLS encryption as appropriate -for your etcd cluster. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the -master node and set the below parameters. ---peer-client-file= ---peer-key-file= - - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--peer-cert-file' is present AND '--peer-key-file' is present -``` - -**Returned Value**: - -```console -etcd 4318 4301 6 16:15 ? 00:00:14 /usr/local/bin/etcd --listen-peer-urls=https://0.0.0.0:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225.pem --advertise-client-urls=https://192.168.1.225:2379,https://192.168.1.225:4001 --election-timeout=5000 --data-dir=/var/lib/rancher/etcd/ --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225.pem --enable-v2=true --initial-cluster=etcd-cis-aio-0=https://192.168.1.225:2380 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --client-cert-auth=true --heartbeat-interval=500 --initial-cluster-token=etcd-cluster-1 --name=etcd-cis-aio-0 --listen-client-urls=https://0.0.0.0:2379 --peer-key-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225-key.pem --peer-client-cert-auth=true --initial-advertise-peer-urls=https://192.168.1.225:2380 --initial-cluster-state=new --key-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225-key.pem -root 4366 4349 0 16:15 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=192.168.1.225:2379 --retention=72h --creation=12h -root 4643 4626 23 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User -root 14998 14985 0 16:19 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json - -``` -### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and set the below parameter. ---peer-client-cert-auth=true - - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--peer-client-cert-auth' is present OR 'true' is equal to 'true' -``` - -**Returned Value**: - -```console -etcd 4318 4301 6 16:15 ? 00:00:14 /usr/local/bin/etcd --listen-peer-urls=https://0.0.0.0:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225.pem --advertise-client-urls=https://192.168.1.225:2379,https://192.168.1.225:4001 --election-timeout=5000 --data-dir=/var/lib/rancher/etcd/ --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225.pem --enable-v2=true --initial-cluster=etcd-cis-aio-0=https://192.168.1.225:2380 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --client-cert-auth=true --heartbeat-interval=500 --initial-cluster-token=etcd-cluster-1 --name=etcd-cis-aio-0 --listen-client-urls=https://0.0.0.0:2379 --peer-key-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225-key.pem --peer-client-cert-auth=true --initial-advertise-peer-urls=https://192.168.1.225:2380 --initial-cluster-state=new --key-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225-key.pem -root 4366 4349 0 16:15 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=192.168.1.225:2379 --retention=72h --creation=12h -root 4643 4626 23 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User -root 14998 14985 0 16:19 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json - -``` -### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and either remove the --peer-auto-tls parameter or set it to false. ---peer-auto-tls=false - - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--peer-auto-tls' is not present OR '--peer-auto-tls' is present -``` - -**Returned Value**: - -```console -etcd 4318 4301 6 16:15 ? 00:00:14 /usr/local/bin/etcd --listen-peer-urls=https://0.0.0.0:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225.pem --advertise-client-urls=https://192.168.1.225:2379,https://192.168.1.225:4001 --election-timeout=5000 --data-dir=/var/lib/rancher/etcd/ --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225.pem --enable-v2=true --initial-cluster=etcd-cis-aio-0=https://192.168.1.225:2380 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --client-cert-auth=true --heartbeat-interval=500 --initial-cluster-token=etcd-cluster-1 --name=etcd-cis-aio-0 --listen-client-urls=https://0.0.0.0:2379 --peer-key-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225-key.pem --peer-client-cert-auth=true --initial-advertise-peer-urls=https://192.168.1.225:2380 --initial-cluster-state=new --key-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225-key.pem -root 4366 4349 0 16:15 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=192.168.1.225:2379 --retention=72h --creation=12h -root 4643 4626 23 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User -root 14998 14985 0 16:19 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json - -``` -### 2.7 Ensure that a unique Certificate Authority is used for etcd (Automated) - -**Result:** pass - -**Remediation:** -[Manual test] -Follow the etcd documentation and create a dedicated certificate authority setup for the -etcd service. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the -master node and set the below parameter. ---trusted-ca-file= - - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--trusted-ca-file' is present -``` - -**Returned Value**: - -```console -etcd 4318 4301 6 16:15 ? 00:00:14 /usr/local/bin/etcd --listen-peer-urls=https://0.0.0.0:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225.pem --advertise-client-urls=https://192.168.1.225:2379,https://192.168.1.225:4001 --election-timeout=5000 --data-dir=/var/lib/rancher/etcd/ --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225.pem --enable-v2=true --initial-cluster=etcd-cis-aio-0=https://192.168.1.225:2380 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --client-cert-auth=true --heartbeat-interval=500 --initial-cluster-token=etcd-cluster-1 --name=etcd-cis-aio-0 --listen-client-urls=https://0.0.0.0:2379 --peer-key-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225-key.pem --peer-client-cert-auth=true --initial-advertise-peer-urls=https://192.168.1.225:2380 --initial-cluster-state=new --key-file=/etc/kubernetes/ssl/kube-etcd-192-168-1-225-key.pem -root 4366 4349 0 16:15 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=192.168.1.225:2379 --retention=72h --creation=12h -root 4643 4626 23 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User -root 14998 14985 0 16:19 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json - -``` -## 3.1 Authentication and Authorization -### 3.1.1 Client certificate authentication should not be used for users (Manual) - -**Result:** warn - -**Remediation:** -Alternative mechanisms provided by Kubernetes such as the use of OIDC should be -implemented in place of client certificates. - - -**Audit:** - -```bash - -``` - - -## 3.2 Logging -### 3.2.1 Ensure that a minimal audit policy is created (Automated) - -**Result:** pass - -**Remediation:** -Create an audit policy file for your cluster. - - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-policy-file' is present -``` - -**Returned Value**: - -```console -root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authorization-mode=Node,RBAC --audit-log-maxsize=100 --audit-log-format=json --requestheader-allowed-names=kube-apiserver-proxy-client --cloud-provider= --etcd-prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --allow-privileged=true --service-account-lookup=true --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-policy-file=/etc/kubernetes/audit-policy.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --storage-backend=etcd3 --anonymous-auth=false --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --advertise-address=192.168.1.225 --audit-log-maxage=30 --etcd-servers=https://192.168.1.225:2379 --runtime-config=policy/v1beta1/podsecuritypolicy=true --bind-address=0.0.0.0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --insecure-port=0 --requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-extra-headers-prefix=X-Remote-Extra- --profiling=false --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User - -``` -### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) - -**Result:** warn - -**Remediation:** -Consider modification of the audit policy in use on the cluster to include these items, at a -minimum. - - -**Audit:** - -```bash - -``` - - -## 4.1 Worker Node Configuration Files -### 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated) - -**Result:** notApplicable - -**Remediation:** -Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. -All configuration is passed in as arguments at container run time. - - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; then stat -c permissions=%a /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; fi' -``` - - -### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) - -**Result:** notApplicable - -**Remediation:** -Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. -All configuration is passed in as arguments at container run time. - - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; then stat -c %U:%G /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; fi' -``` - - -### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Automated) - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 $proykubeconfig - - -**Audit:** - -```bash -/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %a /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' -``` - -**Expected Result**: - -```console -'644' is present OR '640' is present OR '600' is equal to '600' OR '444' is present OR '440' is present OR '400' is present OR '000' is present -``` - -**Returned Value**: - -```console -600 - -``` -### 4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root (Automated) - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml - - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is not present OR '/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml' is not present -``` - -### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated) - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /etc/kubernetes/ssl/kubecfg-kube-node.yaml - - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c permissions=%a /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' -``` - -**Expected Result**: - -```console -'permissions' is not present -``` - -### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml - - -**Audit:** - -```bash -/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root - -``` -### 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Automated) - -**Result:** pass - -**Remediation:** -Run the following command to modify the file permissions of the ---client-ca-file chmod 644 - - -**Audit:** - -```bash -check_cafile_permissions.sh -``` - -**Expected Result**: - -```console -'permissions' is not present -``` - -**Audit Script:** -```bash -#!/usr/bin/env bash - -CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') -if test -z $CAFILE; then CAFILE=$kubeletcafile; fi -if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi - -``` -### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Automated) - -**Result:** pass - -**Remediation:** -Run the following command to modify the ownership of the --client-ca-file. -chown root:root - - -**Audit:** - -```bash -check_cafile_ownership.sh -``` - -**Expected Result**: - -```console -'root:root' is not present -``` - -**Audit Script:** -```bash -#!/usr/bin/env bash - -CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') -if test -z $CAFILE; then CAFILE=$kubeletcafile; fi -if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi - -``` -### 4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated) - -**Result:** notApplicable - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chmod 644 /var/lib/kubelet/config.yaml - -Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. -All configuration is passed in as arguments at container run time. - - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then stat -c permissions=%a /var/lib/kubelet/config.yaml; fi' -``` - - -### 4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root (Automated) - -**Result:** notApplicable - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chown root:root /var/lib/kubelet/config.yaml - -Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. -All configuration is passed in as arguments at container run time. - - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then stat -c %U:%G /var/lib/kubelet/config.yaml; fi' -``` - - -## 4.2 Kubelet -### 4.2.1 Ensure that the anonymous-auth argument is set to false (Automated) - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to -false. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---anonymous-auth=false -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Expected Result**: - -```console -'' is not present -``` - -### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set authorization: mode to Webhook. If -using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---authorization-mode=Webhook -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Expected Result**: - -```console -'' is not present -``` - -### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set authentication: x509: clientCAFile to -the location of the client CA file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---client-ca-file= -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Expected Result**: - -```console -'' is not present -``` - -### 4.2.4 Ensure that the --read-only-port argument is set to 0 (Automated) - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set readOnlyPort to 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---read-only-port=0 -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Expected Result**: - -```console -'' is not present OR '' is not present -``` - -### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Automated) - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set streamingConnectionIdleTimeout to a -value other than 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---streaming-connection-idle-timeout=5m -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Expected Result**: - -```console -'30m' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD -root 5103 5086 7 16:16 ? 00:00:12 kubelet --resolv-conf=/etc/resolv.conf --read-only-port=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --make-iptables-util-chains=true --streaming-connection-idle-timeout=30m --cluster-dns=10.43.0.10 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-192-168-1-225-key.pem --address=0.0.0.0 --cni-bin-dir=/opt/cni/bin --anonymous-auth=false --protect-kernel-defaults=true --cloud-provider= --hostname-override=cis-aio-0 --fail-swap-on=false --cgroups-per-qos=True --authentication-token-webhook=true --event-qps=0 --v=2 --pod-infra-container-image=rancher/pause:3.1 --authorization-mode=Webhook --network-plugin=cni --cluster-domain=cluster.local --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cni-conf-dir=/etc/cni/net.d --root-dir=/var/lib/kubelet --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-192-168-1-225.pem --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf - -``` -### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set protectKernelDefaults: true. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---protect-kernel-defaults=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Expected Result**: - -```console -'' is not present -``` - -### 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated) - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set makeIPTablesUtilChains: true. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove the --make-iptables-util-chains argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Expected Result**: - -```console -'' is not present OR '' is not present -``` - -### 4.2.8 Ensure that the --hostname-override argument is not set (Manual) - -**Result:** notApplicable - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and remove the --hostname-override argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -Clusters provisioned by RKE set the --hostname-override to avoid any hostname configuration errors - - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - - -### 4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Automated) - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set eventRecordQPS: to an appropriate level. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Expected Result**: - -```console -'' is not present -``` - -### 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set tlsCertFile to the location -of the certificate file to use to identify this Kubelet, and tlsPrivateKeyFile -to the location of the corresponding private key file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameters in KUBELET_CERTIFICATE_ARGS variable. ---tls-cert-file= ---tls-private-key-file= -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Expected Result**: - -```console -'' is not present AND '' is not present -``` - -### 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated) - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to add the line rotateCertificates: true or -remove it altogether to use the default value. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS -variable. -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Expected Result**: - -```console -'--rotate-certificates' is not present OR '--rotate-certificates' is not present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD -root 5103 5086 6 16:16 ? 00:00:12 kubelet --resolv-conf=/etc/resolv.conf --read-only-port=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --make-iptables-util-chains=true --streaming-connection-idle-timeout=30m --cluster-dns=10.43.0.10 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-192-168-1-225-key.pem --address=0.0.0.0 --cni-bin-dir=/opt/cni/bin --anonymous-auth=false --protect-kernel-defaults=true --cloud-provider= --hostname-override=cis-aio-0 --fail-swap-on=false --cgroups-per-qos=True --authentication-token-webhook=true --event-qps=0 --v=2 --pod-infra-container-image=rancher/pause:3.1 --authorization-mode=Webhook --network-plugin=cni --cluster-domain=cluster.local --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cni-conf-dir=/etc/cni/net.d --root-dir=/var/lib/kubelet --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-192-168-1-225.pem --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf - -``` -### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Automated) - -**Result:** notApplicable - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. ---feature-gates=RotateKubeletServerCertificate=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -Clusters provisioned by RKE handles certificate rotation directly through RKE. - - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - - -### 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Automated) - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set TLSCipherSuites: to -TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -or to a subset of these values. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the --tls-cipher-suites parameter as follows, or to a subset of these values. ---tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Expected Result**: - -```console -'' is not present -``` - -## 5.1 RBAC and Service Accounts -### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) - -**Result:** warn - -**Remediation:** -Identify all clusterrolebindings to the cluster-admin role. Check if they are used and -if they need this role or if they could use a role with fewer privileges. -Where possible, first bind users to a lower privileged role and then remove the -clusterrolebinding to the cluster-admin role : -kubectl delete clusterrolebinding [name] - - -**Audit:** - -```bash - -``` - - -### 5.1.2 Minimize access to secrets (Manual) - -**Result:** warn - -**Remediation:** -Where possible, remove get, list and watch access to secret objects in the cluster. - - -**Audit:** - -```bash - -``` - - -### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) - -**Result:** warn - -**Remediation:** -Where possible replace any use of wildcards in clusterroles and roles with specific -objects or actions. - - -**Audit:** - -```bash - -``` - - -### 5.1.4 Minimize access to create pods (Manual) - -**Result:** warn - -**Remediation:** -Where possible, remove create access to pod objects in the cluster. - - -**Audit:** - -```bash - -``` - - -### 5.1.5 Ensure that default service accounts are not actively used. (Automated) - -**Result:** pass - -**Remediation:** -Create explicit service accounts wherever a Kubernetes workload requires specific access -to the Kubernetes API server. -Modify the configuration of each default service account to include this value -automountServiceAccountToken: false - - -**Audit:** - -```bash -check_for_default_sa.sh -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Audit Script:** -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -count_sa=$(kubectl get serviceaccounts --all-namespaces -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true))' | jq .metadata.namespace | wc -l) -if [[ ${count_sa} -gt 0 ]]; then - echo "false" - exit -fi - -for ns in $(kubectl get ns --no-headers -o custom-columns=":metadata.name") -do - for result in $(kubectl get clusterrolebinding,rolebinding -n $ns -o json | jq -r '.items[] | select((.subjects[].kind=="ServiceAccount" and .subjects[].name=="default") or (.subjects[].kind=="Group" and .subjects[].name=="system:serviceaccounts"))' | jq -r '"\(.roleRef.kind),\(.roleRef.name)"') - do - read kind name <<<$(IFS=","; echo $result) - resource_count=$(kubectl get $kind $name -n $ns -o json | jq -r '.rules[] | select(.resources[] != "podsecuritypolicies")' | wc -l) - if [[ ${resource_count} -gt 0 ]]; then - echo "false" - exit - fi - done -done - - -echo "true" -``` -**Returned Value**: - -```console -true - -``` -### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) - -**Result:** warn - -**Remediation:** -Modify the definition of pods and service accounts which do not need to mount service -account tokens to disable it. - - -**Audit:** - -```bash - -``` - - -## 5.2 Pod Security Policies -### 5.2.1 Minimize the admission of privileged containers (Manual) - -**Result:** warn - -**Remediation:** -Create a PSP as described in the Kubernetes documentation, ensuring that -the .spec.privileged field is omitted or set to false. - - -**Audit:** - -```bash - -``` - - -### 5.2.2 Minimize the admission of containers wishing to share the host process ID namespace (Automated) - -**Result:** pass - -**Remediation:** -Create a PSP as described in the Kubernetes documentation, ensuring that the -.spec.hostPID field is omitted or set to false. - - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or (.spec.hostPID == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -1 is greater than 0 -``` - -**Returned Value**: - -```console ---count=1 - -``` -### 5.2.3 Minimize the admission of containers wishing to share the host IPC namespace (Automated) - -**Result:** pass - -**Remediation:** -Create a PSP as described in the Kubernetes documentation, ensuring that the -.spec.hostIPC field is omitted or set to false. - - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostIPC == null) or (.spec.hostIPC == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -1 is greater than 0 -``` - -**Returned Value**: - -```console ---count=1 - -``` -### 5.2.4 Minimize the admission of containers wishing to share the host network namespace (Automated) - -**Result:** pass - -**Remediation:** -Create a PSP as described in the Kubernetes documentation, ensuring that the -.spec.hostNetwork field is omitted or set to false. - - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostNetwork == null) or (.spec.hostNetwork == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -1 is greater than 0 -``` - -**Returned Value**: - -```console ---count=1 - -``` -### 5.2.5 Minimize the admission of containers with allowPrivilegeEscalation (Automated) - -**Result:** pass - -**Remediation:** -Create a PSP as described in the Kubernetes documentation, ensuring that the -.spec.allowPrivilegeEscalation field is omitted or set to false. - - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -1 is greater than 0 -``` - -**Returned Value**: - -```console ---count=1 - -``` -### 5.2.6 Minimize the admission of root containers (Manual) - -**Result:** warn - -**Remediation:** -Create a PSP as described in the Kubernetes documentation, ensuring that the -.spec.runAsUser.rule is set to either MustRunAsNonRoot or MustRunAs with the range of -UIDs not including 0. - - -**Audit:** - -```bash - -``` - - -### 5.2.7 Minimize the admission of containers with the NET_RAW capability (Manual) - -**Result:** warn - -**Remediation:** -Create a PSP as described in the Kubernetes documentation, ensuring that the -.spec.requiredDropCapabilities is set to include either NET_RAW or ALL. - - -**Audit:** - -```bash - -``` - - -### 5.2.8 Minimize the admission of containers with added capabilities (Manual) - -**Result:** warn - -**Remediation:** -Ensure that allowedCapabilities is not present in PSPs for the cluster unless -it is set to an empty array. - - -**Audit:** - -```bash - -``` - - -### 5.2.9 Minimize the admission of containers with capabilities assigned (Manual) - -**Result:** warn - -**Remediation:** -Review the use of capabilites in applications runnning on your cluster. Where a namespace -contains applicaions which do not require any Linux capabities to operate consider adding -a PSP which forbids the admission of containers which do not drop all capabilities. - - -**Audit:** - -```bash - -``` - - -## 5.3 Network Policies and CNI -### 5.3.1 Ensure that the CNI in use supports Network Policies (Manual) - -**Result:** warn - -**Remediation:** -If the CNI plugin in use does not support network policies, consideration should be given to -making use of a different plugin, or finding an alternate mechanism for restricting traffic -in the Kubernetes cluster. - - -**Audit:** - -```bash - -``` - - -### 5.3.2 Ensure that all Namespaces have Network Policies defined (Automated) - -**Result:** pass - -**Remediation:** -Follow the documentation and create NetworkPolicy objects as you need them. - - -**Audit:** - -```bash -check_for_network_policies.sh -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Audit Script:** -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -for namespace in $(kubectl get namespaces --all-namespaces -o json | jq -r '.items[].metadata.name'); do - policy_count=$(kubectl get networkpolicy -n ${namespace} -o json | jq '.items | length') - if [[ ${policy_count} -eq 0 ]]; then - echo "false" - exit - fi -done - -echo "true" - -``` -**Returned Value**: - -```console -true - -``` -## 5.4 Secrets Management -### 5.4.1 Prefer using secrets as files over secrets as environment variables (Manual) - -**Result:** warn - -**Remediation:** -if possible, rewrite application code to read secrets from mounted secret files, rather than -from environment variables. - - -**Audit:** - -```bash - -``` - - -### 5.4.2 Consider external secret storage (Manual) - -**Result:** warn - -**Remediation:** -Refer to the secrets management options offered by your cloud provider or a third-party -secrets management solution. - - -**Audit:** - -```bash - -``` - - -## 5.5 Extensible Admission Control -### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and setup image provenance. - - -**Audit:** - -```bash - -``` - - -## 5.7 General Policies -### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) - -**Result:** warn - -**Remediation:** -Follow the documentation and create namespaces for objects in your deployment as you need -them. - - -**Audit:** - -```bash - -``` - - -### 5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions (Manual) - -**Result:** warn - -**Remediation:** -Seccomp is an alpha feature currently. By default, all alpha features are disabled. So, you -would need to enable alpha features in the apiserver by passing "--feature- -gates=AllAlpha=true" argument. -Edit the /etc/kubernetes/apiserver file on the master node and set the KUBE_API_ARGS -parameter to "--feature-gates=AllAlpha=true" -KUBE_API_ARGS="--feature-gates=AllAlpha=true" -Based on your system, restart the kube-apiserver service. For example: -systemctl restart kube-apiserver.service -Use annotations to enable the docker/default seccomp profile in your pod definitions. An -example is as below: -apiVersion: v1 -kind: Pod -metadata: - name: trustworthy-pod - annotations: - seccomp.security.alpha.kubernetes.io/pod: docker/default -spec: - containers: - - name: trustworthy-container - image: sotrustworthy:latest - - -**Audit:** - -```bash - -``` - - -### 5.7.3 Apply Security Context to Your Pods and Containers (Manual) - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and apply security contexts to your pods. For a -suggested list of security contexts, you may refer to the CIS Security Benchmark for Docker -Containers. - - -**Audit:** - -```bash - -``` - - -### 5.7.4 The default namespace should not be used (Automated) - -**Result:** pass - -**Remediation:** -Ensure that namespaces are created to allow for appropriate segregation of Kubernetes -resources and that all new resources are created in a specific namespace. - - -**Audit:** - -```bash -check_for_default_ns.sh -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Audit Script:** -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -count=$(kubectl get all -n default -o json | jq .items[] | jq -r 'select((.metadata.name!="kubernetes"))' | jq .metadata.name | wc -l) -if [[ ${count} -gt 0 ]]; then - echo "false" - exit -fi - -echo "true" - - -``` -**Returned Value**: - -```console -true - -``` diff --git a/content/rancher/v2.6/en/security/rancher-2.5/1.6-hardening-2.5/_index.md b/content/rancher/v2.6/en/security/rancher-2.5/1.6-hardening-2.5/_index.md deleted file mode 100644 index 78f2763e57c..00000000000 --- a/content/rancher/v2.6/en/security/rancher-2.5/1.6-hardening-2.5/_index.md +++ /dev/null @@ -1,570 +0,0 @@ ---- -title: Hardening Guide with CIS 1.6 Benchmark -weight: 100 ---- - -This document provides prescriptive guidance for hardening a production installation of a RKE cluster to be used with Rancher v2.5.4. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Information Security (CIS). - -> This hardening guide describes how to secure the nodes in your cluster, and it is recommended to follow this guide before installing Kubernetes. - -This hardening guide is intended to be used for RKE clusters and associated with specific versions of the CIS Kubernetes Benchmark, Kubernetes, and Rancher: - - Rancher Version | CIS Benchmark Version | Kubernetes Version -----------------|-----------------------|------------------ - Rancher v2.5.4 | Benchmark 1.6 | Kubernetes v1.18 - -[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.5/Rancher_Hardening_Guide_CIS_1.6.pdf) - -### Overview - -This document provides prescriptive guidance for hardening a RKE cluster to be used for installing Rancher v2.5.4 with Kubernetes v1.18 or provisioning a RKE cluster with Kubernetes v1.18 to be used within Rancher v2.5.4. It outlines the configurations required to address Kubernetes benchmark controls from the Center for Information Security (CIS). - -For more detail about evaluating a hardened cluster against the official CIS benchmark, refer to the [CIS 1.6 Benchmark - Self-Assessment Guide - Rancher v2.5.4]({{< baseurl >}}/rancher/v2.6/en/security/rancher-2.5/1.6-benchmark-2.5/). - -#### Known Issues - -- Rancher **exec shell** and **view logs** for pods are **not** functional in a CIS 1.6 hardened setup when only public IP is provided when registering custom nodes. This functionality requires a private IP to be provided when registering the custom nodes. -- When setting the `default_pod_security_policy_template_id:` to `restricted` Rancher creates **RoleBindings** and **ClusterRoleBindings** on the default service accounts. The CIS 1.6 5.1.5 check requires the default service accounts have no roles or cluster roles bound to it apart from the defaults. In addition the default service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments. - -Migration Rancher from 2.4 to 2.5. Addons were removed in HG 2.5, and therefore namespaces on migration may be not created on the downstream clusters. Pod may fail to run because of missing namesapce like ingress-nginx, cattle-system. - -### Configure Kernel Runtime Parameters - -The following `sysctl` configuration is recommended for all nodes type in the cluster. Set the following parameters in `/etc/sysctl.d/90-kubelet.conf`: - -```ini -vm.overcommit_memory=1 -vm.panic_on_oom=0 -kernel.panic=10 -kernel.panic_on_oops=1 -kernel.keys.root_maxbytes=25000000 -``` - -Run `sysctl -p /etc/sysctl.d/90-kubelet.conf` to enable the settings. - -### Configure `etcd` user and group -A user account and group for the **etcd** service is required to be setup before installing RKE. The **uid** and **gid** for the **etcd** user will be used in the RKE **config.yml** to set the proper permissions for files and directories during installation time. - -#### create `etcd` user and group -To create the **etcd** group run the following console commands. - -The commands below use `52034` for **uid** and **gid** are for example purposes. Any valid unused **uid** or **gid** could also be used in lieu of `52034`. - -```bash -groupadd --gid 52034 etcd -useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd -``` - -Update the RKE **config.yml** with the **uid** and **gid** of the **etcd** user: - -```yaml -services: - etcd: - gid: 52034 - uid: 52034 -``` - -#### Set `automountServiceAccountToken` to `false` for `default` service accounts -Kubernetes provides a default service account which is used by cluster workloads where no specific service account is assigned to the pod. Where access to the Kubernetes API from a pod is required, a specific service account should be created for that pod, and rights granted to that service account. The default service account should be configured such that it does not provide a service account token and does not have any explicit rights assignments. - -For each namespace including **default** and **kube-system** on a standard RKE install the **default** service account must include this value: - -```yaml -automountServiceAccountToken: false -``` - -Save the following yaml to a file called `account_update.yaml` - -```yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: default -automountServiceAccountToken: false -``` - -Create a bash script file called `account_update.sh`. Be sure to `chmod +x account_update.sh` so the script has execute permissions. - -```bash -#!/bin/bash -e - -for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do - kubectl patch serviceaccount default -n ${namespace} -p "$(cat account_update.yaml)" -done -``` - -### Ensure that all Namespaces have Network Policies defined - -Running different applications on the same Kubernetes cluster creates a risk of one -compromised application attacking a neighboring application. Network segmentation is -important to ensure that containers can communicate only with those they are supposed -to. A network policy is a specification of how selections of pods are allowed to -communicate with each other and other network endpoints. - -Network Policies are namespace scoped. When a network policy is introduced to a given -namespace, all traffic not allowed by the policy is denied. However, if there are no network -policies in a namespace all traffic will be allowed into and out of the pods in that -namespace. To enforce network policies, a CNI (container network interface) plugin must be enabled. -This guide uses [canal](https://github.com/projectcalico/canal) to provide the policy enforcement. -Additional information about CNI providers can be found -[here](https://rancher.com/blog/2019/2019-03-21-comparing-kubernetes-cni-providers-flannel-calico-canal-and-weave/) - -Once a CNI provider is enabled on a cluster a default network policy can be applied. For reference purposes a -**permissive** example is provide below. If you want to allow all traffic to all pods in a namespace -(even if policies are added that cause some pods to be treated as “isolated”), -you can create a policy that explicitly allows all traffic in that namespace. Save the following `yaml` as -`default-allow-all.yaml`. Additional [documentation](https://kubernetes.io/docs/concepts/services-networking/network-policies/) -about network policies can be found on the Kubernetes site. - -> This `NetworkPolicy` is not recommended for production use - -```yaml ---- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: default-allow-all -spec: - podSelector: {} - ingress: - - {} - egress: - - {} - policyTypes: - - Ingress - - Egress -``` - -Create a bash script file called `apply_networkPolicy_to_all_ns.sh`. Be sure to -`chmod +x apply_networkPolicy_to_all_ns.sh` so the script has execute permissions. - -```bash -#!/bin/bash -e - -for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do - kubectl apply -f default-allow-all.yaml -n ${namespace} -done -``` - -Execute this script to apply the `default-allow-all.yaml` the **permissive** `NetworkPolicy` to all namespaces. - -### Reference Hardened RKE `cluster.yml` configuration - -The reference `cluster.yml` is used by the RKE CLI that provides the configuration needed to achieve a hardened install -of Rancher Kubernetes Engine (RKE). Install [documentation](https://rancher.com/docs/rke/latest/en/installation/) is -provided with additional details about the configuration items. This reference `cluster.yml` does not include the required **nodes** directive which will vary depending on your environment. Documentation for node configuration can be found here: https://rancher.com/docs/rke/latest/en/config-options/nodes - - -```yaml -# If you intend to deploy Kubernetes in an air-gapped environment, -# please consult the documentation on how to configure custom RKE images. -# https://rancher.com/docs/rke/latest/en/installation/ - -# the nodes directive is required and will vary depending on your environment -# documentation for node configuration can be found here: -# https://rancher.com/docs/rke/latest/en/config-options/nodes -nodes: [] -services: - etcd: - image: "" - extra_args: {} - extra_binds: [] - extra_env: [] - win_extra_args: {} - win_extra_binds: [] - win_extra_env: [] - external_urls: [] - ca_cert: "" - cert: "" - key: "" - path: "" - uid: 52034 - gid: 52034 - snapshot: false - retention: "" - creation: "" - backup_config: null - kube-api: - image: "" - extra_args: {} - extra_binds: [] - extra_env: [] - win_extra_args: {} - win_extra_binds: [] - win_extra_env: [] - service_cluster_ip_range: "" - service_node_port_range: "" - pod_security_policy: true - always_pull_images: false - secrets_encryption_config: - enabled: true - custom_config: null - audit_log: - enabled: true - configuration: null - admission_configuration: null - event_rate_limit: - enabled: true - configuration: null - kube-controller: - image: "" - extra_args: - feature-gates: RotateKubeletServerCertificate=true - extra_binds: [] - extra_env: [] - win_extra_args: {} - win_extra_binds: [] - win_extra_env: [] - cluster_cidr: "" - service_cluster_ip_range: "" - scheduler: - image: "" - extra_args: {} - extra_binds: [] - extra_env: [] - win_extra_args: {} - win_extra_binds: [] - win_extra_env: [] - kubelet: - image: "" - extra_args: - feature-gates: RotateKubeletServerCertificate=true - protect-kernel-defaults: "true" - tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 - extra_binds: [] - extra_env: [] - win_extra_args: {} - win_extra_binds: [] - win_extra_env: [] - cluster_domain: cluster.local - infra_container_image: "" - cluster_dns_server: "" - fail_swap_on: false - generate_serving_certificate: true - kubeproxy: - image: "" - extra_args: {} - extra_binds: [] - extra_env: [] - win_extra_args: {} - win_extra_binds: [] - win_extra_env: [] -network: - plugin: "" - options: {} - mtu: 0 - node_selector: {} - update_strategy: null -authentication: - strategy: "" - sans: [] - webhook: null -addons: | - apiVersion: policy/v1beta1 - kind: PodSecurityPolicy - metadata: - name: restricted - spec: - requiredDropCapabilities: - - NET_RAW - privileged: false - allowPrivilegeEscalation: false - defaultAllowPrivilegeEscalation: false - fsGroup: - rule: RunAsAny - runAsUser: - rule: MustRunAsNonRoot - seLinux: - rule: RunAsAny - supplementalGroups: - rule: RunAsAny - volumes: - - emptyDir - - secret - - persistentVolumeClaim - - downwardAPI - - configMap - - projected - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: ClusterRole - metadata: - name: psp:restricted - rules: - - apiGroups: - - extensions - resourceNames: - - restricted - resources: - - podsecuritypolicies - verbs: - - use - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: ClusterRoleBinding - metadata: - name: psp:restricted - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: psp:restricted - subjects: - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:serviceaccounts - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:authenticated - --- - apiVersion: networking.k8s.io/v1 - kind: NetworkPolicy - metadata: - name: default-allow-all - spec: - podSelector: {} - ingress: - - {} - egress: - - {} - policyTypes: - - Ingress - - Egress - --- - apiVersion: v1 - kind: ServiceAccount - metadata: - name: default - automountServiceAccountToken: false -addons_include: [] -system_images: - etcd: "" - alpine: "" - nginx_proxy: "" - cert_downloader: "" - kubernetes_services_sidecar: "" - kubedns: "" - dnsmasq: "" - kubedns_sidecar: "" - kubedns_autoscaler: "" - coredns: "" - coredns_autoscaler: "" - nodelocal: "" - kubernetes: "" - flannel: "" - flannel_cni: "" - calico_node: "" - calico_cni: "" - calico_controllers: "" - calico_ctl: "" - calico_flexvol: "" - canal_node: "" - canal_cni: "" - canal_controllers: "" - canal_flannel: "" - canal_flexvol: "" - weave_node: "" - weave_cni: "" - pod_infra_container: "" - ingress: "" - ingress_backend: "" - metrics_server: "" - windows_pod_infra_container: "" -ssh_key_path: "" -ssh_cert_path: "" -ssh_agent_auth: false -authorization: - mode: "" - options: {} -ignore_docker_version: false -kubernetes_version: v1.18.12-rancher1-1 -private_registries: [] -ingress: - provider: "" - options: {} - node_selector: {} - extra_args: {} - dns_policy: "" - extra_envs: [] - extra_volumes: [] - extra_volume_mounts: [] - update_strategy: null - http_port: 0 - https_port: 0 - network_mode: "" -cluster_name: -cloud_provider: - name: "" -prefix_path: "" -win_prefix_path: "" -addon_job_timeout: 0 -bastion_host: - address: "" - port: "" - user: "" - ssh_key: "" - ssh_key_path: "" - ssh_cert: "" - ssh_cert_path: "" -monitoring: - provider: "" - options: {} - node_selector: {} - update_strategy: null - replicas: null -restore: - restore: false - snapshot_name: "" -dns: null -upgrade_strategy: - max_unavailable_worker: "" - max_unavailable_controlplane: "" - drain: null - node_drain_input: null -``` - -### Reference Hardened RKE Template configuration - -The reference RKE Template provides the configuration needed to achieve a hardened install of Kubenetes. -RKE Templates are used to provision Kubernetes and define Rancher settings. Follow the Rancher -[documentaion](https://rancher.com/docs/rancher/v2.6/en/installation) for additional installation and RKE Template details. - -```yaml -# -# Cluster Config -# -default_pod_security_policy_template_id: restricted -docker_root_dir: /var/lib/docker -enable_cluster_alerting: false -enable_cluster_monitoring: false -enable_network_policy: true -# -# Rancher Config -# -rancher_kubernetes_engine_config: - addon_job_timeout: 45 - ignore_docker_version: true - kubernetes_version: v1.18.12-rancher1-1 -# -# If you are using calico on AWS -# -# network: -# plugin: calico -# calico_network_provider: -# cloud_provider: aws -# -# # To specify flannel interface -# -# network: -# plugin: flannel -# flannel_network_provider: -# iface: eth1 -# -# # To specify flannel interface for canal plugin -# -# network: -# plugin: canal -# canal_network_provider: -# iface: eth1 -# - network: - mtu: 0 - plugin: canal - rotate_encryption_key: false -# -# services: -# kube-api: -# service_cluster_ip_range: 10.43.0.0/16 -# kube-controller: -# cluster_cidr: 10.42.0.0/16 -# service_cluster_ip_range: 10.43.0.0/16 -# kubelet: -# cluster_domain: cluster.local -# cluster_dns_server: 10.43.0.10 -# - services: - etcd: - backup_config: - enabled: false - interval_hours: 12 - retention: 6 - safe_timestamp: false - creation: 12h - extra_args: - election-timeout: '5000' - heartbeat-interval: '500' - gid: 52034 - retention: 72h - snapshot: false - uid: 52034 - kube_api: - always_pull_images: false - audit_log: - enabled: true - event_rate_limit: - enabled: true - pod_security_policy: true - secrets_encryption_config: - enabled: true - service_node_port_range: 30000-32767 - kube_controller: - extra_args: - feature-gates: RotateKubeletServerCertificate=true - kubelet: - extra_args: - feature-gates: RotateKubeletServerCertificate=true - protect-kernel-defaults: 'true' - tls-cipher-suites: >- - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 - fail_swap_on: false - generate_serving_certificate: true - ssh_agent_auth: false - upgrade_strategy: - max_unavailable_controlplane: '1' - max_unavailable_worker: 10% -windows_prefered_cluster: false -``` - -### Hardened Reference Ubuntu 20.04 LTS **cloud-config**: - -The reference **cloud-config** is generally used in cloud infrastructure environments to allow for -configuration management of compute instances. The reference config configures Ubuntu operating system level settings -needed before installing kubernetes. - -```yaml -#cloud-config -apt: - sources: - docker.list: - source: deb [arch=amd64] http://download.docker.com/linux/ubuntu $RELEASE stable - keyid: 9DC858229FC7DD38854AE2D88D81803C0EBFCD88 -system_info: - default_user: - groups: - - docker -write_files: -- path: "/etc/apt/preferences.d/docker" - owner: root:root - permissions: '0600' - content: | - Package: docker-ce - Pin: version 5:19* - Pin-Priority: 800 -- path: "/etc/sysctl.d/90-kubelet.conf" - owner: root:root - permissions: '0644' - content: | - vm.overcommit_memory=1 - vm.panic_on_oom=0 - kernel.panic=10 - kernel.panic_on_oops=1 - kernel.keys.root_maxbytes=25000000 -package_update: true -packages: -- docker-ce -- docker-ce-cli -- containerd.io -runcmd: -- sysctl -p /etc/sysctl.d/90-kubelet.conf -- groupadd --gid 52034 etcd -- useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd -``` diff --git a/content/rancher/v2.6/en/security/rancher-2.5/_index.md b/content/rancher/v2.6/en/security/rancher-2.5/_index.md deleted file mode 100644 index 7282a7d813a..00000000000 --- a/content/rancher/v2.6/en/security/rancher-2.5/_index.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Self-Assessment and Hardening Guides for Rancher v2.5 -shortTitle: Rancher v2.5 Guides -weight: 1 ---- - -Rancher v2.5 introduced the capability to deploy Rancher on any Kubernetes cluster. For that reason, we now provide separate security hardening guides for Rancher deployments on each of Rancher's Kubernetes distributions. - -- [Rancher Kubernetes Distributions](#rancher-kubernetes-distributions) -- [Hardening Guides and Benchmark Versions](#hardening-guides-and-benchmark-versions) - - [RKE Guides](#rke-guides) - - [RKE2 Guides](#rke2-guides) - - [K3s Guides](#k3s) -- [Rancher with SELinux](#rancher-with-selinux) - -# Rancher Kubernetes Distributions - -Rancher has the following Kubernetes distributions: - -- [**RKE,**]({{}}/rke/latest/en/) Rancher Kubernetes Engine, is a CNCF-certified Kubernetes distribution that runs entirely within Docker containers. -- [**K3s,**]({{}}/k3s/latest/en/) is a fully conformant, lightweight Kubernetes distribution. It is easy to install, with half the memory of upstream Kubernetes, all in a binary of less than 100 MB. -- [**RKE2**](https://docs.rke2.io/) is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector. - -To harden a Kubernetes cluster outside of Rancher's distributions, refer to your Kubernetes provider docs. - -# Hardening Guides and Benchmark Versions - -These guides have been tested along with the Rancher v2.5 release. Each self-assessment guide is accompanied with a hardening guide and tested on a specific Kubernetes version and CIS benchmark version. If a CIS benchmark has not been validated for your Kubernetes version, you can choose to use the existing guides until a newer version is added. - -### RKE Guides - -Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides ----|---|---|--- -Kubernetes v1.15+ | CIS v1.5 | [Link](./1.5-benchmark-2.5) | [Link](./1.5-hardening-2.5) -Kubernetes v1.18+ | CIS v1.6 | [Link](./1.6-benchmark-2.5) | [Link](./1.6-hardening-2.5) - -### RKE2 Guides - -Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides ----|---|---|--- -Kubernetes v1.18 | CIS v1.5 | [Link](https://docs.rke2.io/security/cis_self_assessment15/) | [Link](https://docs.rke2.io/security/hardening_guide/) -Kubernetes v1.20 | CIS v1.6 | [Link](https://docs.rke2.io/security/cis_self_assessment16/) | [Link](https://docs.rke2.io/security/hardening_guide/) - -### K3s Guides - -Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guide ----|---|---|--- -Kubernetes v1.17, v1.18, & v1.19 | CIS v1.5 | [Link]({{}}/k3s/latest/en/security/self_assessment/) | [Link]({{}}/k3s/latest/en/security/hardening_guide/) - - -# Rancher with SELinux - -[Security-Enhanced Linux (SELinux)](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) is a security enhancement to Linux. After being historically used by government agencies, SELinux is now industry standard and is enabled by default on CentOS 7 and 8. - -To use Rancher with SELinux, we recommend installing the `rancher-selinux` RPM according to the instructions on [this page.]({{}}/rancher/v2.6/en/security/selinux/#installing-the-rancher-selinux-rpm) diff --git a/content/rancher/v2.6/en/security/security-scan/_index.md b/content/rancher/v2.6/en/security/security-scan/_index.md deleted file mode 100644 index c5a3cdb21d4..00000000000 --- a/content/rancher/v2.6/en/security/security-scan/_index.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -title: Security Scans -weight: 299 ---- - -The documentation about CIS security scans has moved [here.]({{}}/rancher/v2.6/en/cis-scans) From f673e6586aec8a74ec26d2c5c897a7c166765702 Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Thu, 30 Dec 2021 09:57:46 +0100 Subject: [PATCH 127/478] Restructure v2.6 security docs Signed-off-by: Guilherme Macedo --- content/rancher/v2.6/en/cis-scans/_index.md | 289 ------------------ .../v2.6/en/cis-scans/configuration/_index.md | 98 ------ .../en/cis-scans/custom-benchmark/_index.md | 84 ----- .../rancher/v2.6/en/cis-scans/rbac/_index.md | 50 --- .../v2.6/en/cis-scans/skipped-tests/_index.md | 54 ---- 5 files changed, 575 deletions(-) delete mode 100644 content/rancher/v2.6/en/cis-scans/_index.md delete mode 100644 content/rancher/v2.6/en/cis-scans/configuration/_index.md delete mode 100644 content/rancher/v2.6/en/cis-scans/custom-benchmark/_index.md delete mode 100644 content/rancher/v2.6/en/cis-scans/rbac/_index.md delete mode 100644 content/rancher/v2.6/en/cis-scans/skipped-tests/_index.md diff --git a/content/rancher/v2.6/en/cis-scans/_index.md b/content/rancher/v2.6/en/cis-scans/_index.md deleted file mode 100644 index 17aa5a5a3b1..00000000000 --- a/content/rancher/v2.6/en/cis-scans/_index.md +++ /dev/null @@ -1,289 +0,0 @@ ---- -title: CIS Scans -weight: 17 ---- - -Rancher can run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark. The CIS scans can run on any Kubernetes cluster, including hosted Kubernetes providers such as EKS, AKS, and GKE. - -The `rancher-cis-benchmark` app leverages kube-bench, an open-source tool from Aqua Security, to check clusters for CIS Kubernetes Benchmark compliance. Also, to generate a cluster-wide report, the application utilizes Sonobuoy for report aggregation. - -- [About the CIS Benchmark](#about-the-cis-benchmark) -- [About the Generated Report](#about-the-generated-report) -- [Test Profiles](#test-profiles) -- [About Skipped and Not Applicable Tests](#about-skipped-and-not-applicable-tests) -- [Roles-based Access Control](./rbac) -- [Configuration](./configuration) -- [How-to Guides](#how-to-guides) - - [Installing CIS Benchmark](#installing-cis-benchmark) - - [Uninstalling CIS Benchmark](#uninstalling-cis-benchmark) - - [Running a Scan](#running-a-scan) - - [Running a Scan Periodically on a Schedule](#running-a-scan-periodically-on-a-schedule) - - [Skipping Tests](#skipping-tests) - - [Viewing Reports](#viewing-reports) - - [Enabling Alerting for rancher-cis-benchmark](#enabling-alerting-for-rancher-cis-benchmark) - - [Configuring Alerts for a Periodic Scan on a Schedule](#configuring-alerts-for-a-periodic-scan-on-a-schedule) - - [Creating a Custom Benchmark Version for Running a Cluster Scan](#creating-a-custom-benchmark-version-for-running-a-cluster-scan) - - -# About the CIS Benchmark - -The Center for Internet Security is a 501(c\)(3) non-profit organization, formed in October 2000, with a mission to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace". The organization is headquartered in East Greenbush, New York, with members including large corporations, government agencies, and academic institutions. - -CIS Benchmarks are best practices for the secure configuration of a target system. CIS Benchmarks are developed through the generous volunteer efforts of subject matter experts, technology vendors, public and private community members, and the CIS Benchmark Development team. - -The official Benchmark documents are available through the CIS website. The sign-up form to access the documents is -here. - -# About the Generated Report - -Each scan generates a report can be viewed in the Rancher UI and can be downloaded in CSV format. - -By default, the CIS Benchmark v1.6 is used. - -The Benchmark version is included in the generated report. - -The Benchmark provides recommendations of two types: Automated and Manual. Recommendations marked as Manual in the Benchmark are not included in the generated report. - -Some tests are designated as "Not Applicable." These tests will not be run on any CIS scan because of the way that Rancher provisions RKE clusters. For information on how test results can be audited, and why some tests are designated to be not applicable, refer to Rancher's self-assessment guide for the corresponding Kubernetes version. - -The report contains the following information: - -| Column in Report | Description | -|------------------|-------------| -| `id` | The ID number of the CIS Benchmark. | -| `description` | The description of the CIS Benchmark test. | -| `remediation` | What needs to be fixed in order to pass the test. | -| `state` | Indicates if the test passed, failed, was skipped, or was not applicable. | -| `node_type` | The node role, which affects which tests are run on the node. Master tests are run on controlplane nodes, etcd tests are run on etcd nodes, and node tests are run on the worker nodes. | -| `audit` | This is the audit check that `kube-bench` runs for this test. | -| `audit_config` | Any configuration applicable to the audit script. | -| `test_info` | Test-related info as reported by `kube-bench`, if any. | -| `commands` | Test-related commands as reported by `kube-bench`, if any. | -| `config_commands` | Test-related configuration data as reported by `kube-bench`, if any. | -| `actual_value` | The test's actual value, present if reported by `kube-bench`. | -| `expected_result` | The test's expected result, present if reported by `kube-bench`. | - -Refer to the table in the cluster hardening guide for information on which versions of Kubernetes, the Benchmark, Rancher, and our cluster hardening guide correspond to each other. Also refer to the hardening guide for configuration files of CIS-compliant clusters and information on remediating failed tests. - -# Test Profiles - -The following profiles are available: - -- Generic CIS 1.5 -- Generic CIS 1.6 -- RKE permissive 1.5 -- RKE hardened 1.5 -- RKE permissive 1.6 -- RKE hardened 1.6 -- EKS -- GKE -- RKE2 permissive 1.5 -- RKE2 permissive 1.5 - -You also have the ability to customize a profile by saving a set of tests to skip. - -All profiles will have a set of not applicable tests that will be skipped during the CIS scan. These tests are not applicable based on how a RKE cluster manages Kubernetes. - -There are two types of RKE cluster scan profiles: - -- **Permissive:** This profile has a set of tests that have been will be skipped as these tests will fail on a default RKE Kubernetes cluster. Besides the list of skipped tests, the profile will also not run the not applicable tests. -- **Hardened:** This profile will not skip any tests, except for the non-applicable tests. - -The EKS and GKE cluster scan profiles are based on CIS Benchmark versions that are specific to those types of clusters. - -In order to pass the "Hardened" profile, you will need to follow the steps on the hardening guide and use the `cluster.yml` defined in the hardening guide to provision a hardened cluster. - -The default profile and the supported CIS benchmark version depends on the type of cluster that will be scanned: - -The `rancher-cis-benchmark` supports the CIS 1.6 Benchmark version. - -- For RKE Kubernetes clusters, the RKE Permissive 1.6 profile is the default. -- EKS and GKE have their own CIS Benchmarks published by `kube-bench`. The corresponding test profiles are used by default for those clusters. -- For RKE2 Kubernetes clusters, the RKE2 Permissive 1.5 profile is the default. -- For cluster types other than RKE, RKE2, EKS and GKE, the Generic CIS 1.5 profile will be used by default. - -# About Skipped and Not Applicable Tests - -For a list of skipped and not applicable tests, refer to this page. - -For now, only user-defined skipped tests are marked as skipped in the generated report. - -Any skipped tests that are defined as being skipped by one of the default profiles are marked as not applicable. - -# Roles-based Access Control - -For information about permissions, refer to this page. - -# Configuration - -For more information about configuring the custom resources for the scans, profiles, and benchmark versions, refer to this page. - -# How-to Guides - -- [Installing rancher-cis-benchmark](#installing-rancher-cis-benchmark) -- [Uninstalling rancher-cis-benchmark](#uninstalling-rancher-cis-benchmark) -- [Running a Scan](#running-a-scan) -- [Running a Scan Periodically on a Schedule](#running-a-scan-periodically-on-a-schedule) -- [Skipping Tests](#skipping-tests) -- [Viewing Reports](#viewing-reports) -- [Enabling Alerting for rancher-cis-benchmark](#enabling-alerting-for-rancher-cis-benchmark) -- [Configuring Alerts for a Periodic Scan on a Schedule](#configuring-alerts-for-a-periodic-scan-on-a-schedule) -- [Creating a Custom Benchmark Version for Running a Cluster Scan](#creating-a-custom-benchmark-version-for-running-a-cluster-scan) -### Installing CIS Benchmark - -1. In the upper left corner, click **☰ > Cluster Management**. -1. On the **Clusters** page, go to the cluster where you want to install CIS Benchmark and click **Explore**. -1. In the left navigation bar, click **Apps & Marketplace > Charts**. -1. Click **CIS Benchmark** -1. Click **Install**. - -**Result:** The CIS scan application is deployed on the Kubernetes cluster. - -### Uninstalling CIS Benchmark - -1. From the **Cluster Dashboard,** go to the left navigation bar and click **Apps & Marketplace > Installed Apps**. -1. Go to the `cis-operator-system` namespace and check the boxes next to `rancher-cis-benchmark-crd` and `rancher-cis-benchmark`. -1. Click **Delete** and confirm **Delete**. - -**Result:** The `rancher-cis-benchmark` application is uninstalled. - -### Running a Scan - -When a ClusterScan custom resource is created, it launches a new CIS scan on the cluster for the chosen ClusterScanProfile. - -Note: There is currently a limitation of running only one CIS scan at a time for a cluster. If you create multiple ClusterScan custom resources, they will be run one after the other by the operator, and until one scan finishes, the rest of the ClusterScan custom resources will be in the "Pending" state. - -To run a scan, - -1. In the upper left corner, click **☰ > Cluster Management**. -1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**. -1. Click **CIS Benchmark > Scan**. -1. Click **Create**. -1. Choose a cluster scan profile. The profile determines which CIS Benchmark version will be used and which tests will be performed. If you choose the Default profile, then the CIS Operator will choose a profile applicable to the type of Kubernetes cluster it is installed on. -1. Click **Create**. - -**Result:** A report is generated with the scan results. To see the results, click the name of the scan that appears. -### Running a Scan Periodically on a Schedule - -To run a ClusterScan on a schedule, - -1. In the upper left corner, click **☰ > Cluster Management**. -1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**. -1. Click **CIS Benchmark > Scan**. -1. Choose a cluster scan profile. The profile determines which CIS Benchmark version will be used and which tests will be performed. If you choose the Default profile, then the CIS Operator will choose a profile applicable to the type of Kubernetes cluster it is installed on. -1. Choose the option **Run scan on a schedule**. -1. Enter a valid cron schedule expression in the field **Schedule**. -1. Choose a **Retention** count, which indicates the number of reports maintained for this recurring scan. By default this count is 3. When this retention limit is reached, older reports will get purged. -1. Click **Create**. - -**Result:** The scan runs and reschedules to run according to the cron schedule provided. The **Next Scan** value indicates the next time this scan will run again. - -A report is generated with the scan results every time the scan runs. To see the latest results, click the name of the scan that appears. - -You can also see the previous reports by choosing the report from the **Reports** dropdown on the scan detail page. - -### Skipping Tests - -CIS scans can be run using test profiles with user-defined skips. - -To skip tests, you will create a custom CIS scan profile. A profile contains the configuration for the CIS scan, which includes the benchmark versions to use and any specific tests to skip in that benchmark. - -1. In the upper left corner, click **☰ > Cluster Management**. -1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**. -1. Click **CIS Benchmark > Profile**. -1. From here, you can create a profile in multiple ways. To make a new profile, click **Create** and fill out the form in the UI. To make a new profile based on an existing profile, go to the existing profile and click **⋮ Clone**. If you are filling out the form, add the tests to skip using the test IDs, using the relevant CIS Benchmark as a reference. If you are creating the new test profile as YAML, you will add the IDs of the tests to skip in the `skipTests` directive. You will also give the profile a name: - - ```yaml - apiVersion: cis.cattle.io/v1 - kind: ClusterScanProfile - metadata: - annotations: - meta.helm.sh/release-name: clusterscan-operator - meta.helm.sh/release-namespace: cis-operator-system - labels: - app.kubernetes.io/managed-by: Helm - name: "" - spec: - benchmarkVersion: cis-1.5 - skipTests: - - "1.1.20" - - "1.1.21" - ``` -1. Click **Create**. - -**Result:** A new CIS scan profile is created. - -When you [run a scan](#running-a-scan) that uses this profile, the defined tests will be skipped during the scan. The skipped tests will be marked in the generated report as `Skip`. - -### Viewing Reports - -To view the generated CIS scan reports, - -1. In the upper left corner, click **☰ > Cluster Management**. -1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**. -1. Click **CIS Benchmark > Scan**. -1. The **Scans** page will show the generated reports. To see a detailed report, go to a scan report and click the name. - -One can download the report from the Scans list or from the scan detail page. - -### Enabling Alerting for rancher-cis-benchmark - -Alerts can be configured to be sent out for a scan that runs on a schedule. - -> **Prerequisite:** -> -> Before enabling alerts for `rancher-cis-benchmark`, make sure to install the `rancher-monitoring` application and configure the Receivers and Routes. For more information, see [this section.]({{}}/rancher/v2.6/en/monitoring-alerting/configuration) -> -> While configuring the routes for `rancher-cis-benchmark` alerts, you can specify the matching using the key-value pair `job: rancher-cis-scan`. An example route configuration is [here.]({{}}/rancher/v2.6/en/monitoring-alerting/configuration/receiver/#example-route-config-for-cis-scan-alerts) - -While installing or upgrading the `rancher-cis-benchmark` Helm chart, set the following flag to `true` in the `values.yaml`: - -```yaml -alerts: - enabled: true -``` - -### Configuring Alerts for a Periodic Scan on a Schedule - -It is possible to run a ClusterScan on a schedule. - -A scheduled scan can also specify if you should receive alerts when the scan completes. - -Alerts are supported only for a scan that runs on a schedule. - -The CIS Benchmark application supports two types of alerts: - -- Alert on scan completion: This alert is sent out when the scan run finishes. The alert includes details including the ClusterScan's name and the ClusterScanProfile name. -- Alert on scan failure: This alert is sent out if there are some test failures in the scan run or if the scan is in a `Fail` state. - -> **Prerequisite:** -> -> Before enabling alerts for `rancher-cis-benchmark`, make sure to install the `rancher-monitoring` application and configure the Receivers and Routes. For more information, see [this section.]({{}}/rancher/v2.6/en/monitoring-alerting/configuration) -> -> While configuring the routes for `rancher-cis-benchmark` alerts, you can specify the matching using the key-value pair `job: rancher-cis-scan`. An example route configuration is [here.]({{}}/rancher/v2.6/en/monitoring-alerting/configuration/receiver/#example-route-config-for-cis-scan-alerts) - -To configure alerts for a scan that runs on a schedule, - -1. Please enable alerts on the `rancher-cis-benchmark` application (#enabling-alerting-for-rancher-cis-benchmark) -1. In the upper left corner, click **☰ > Cluster Management**. -1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**. -1. Click **CIS Benchmark > Scan**. -1. Click **Create**. -1. Choose a cluster scan profile. The profile determines which CIS Benchmark version will be used and which tests will be performed. If you choose the Default profile, then the CIS Operator will choose a profile applicable to the type of Kubernetes cluster it is installed on. -1. Choose the option **Run scan on a schedule**. -1. Enter a valid [cron schedule expression](https://en.wikipedia.org/wiki/Cron#CRON_expression) in the field **Schedule**. -1. Check the boxes next to the Alert types under **Alerting**. -1. Optional: Choose a **Retention Count**, which indicates the number of reports maintained for this recurring scan. By default this count is 3. When this retention limit is reached, older reports will get purged. -1. Click **Create**. - -**Result:** The scan runs and reschedules to run according to the cron schedule provided. Alerts are sent out when the scan finishes if routes and receiver are configured under `rancher-monitoring` application. - -A report is generated with the scan results every time the scan runs. To see the latest results, click the name of the scan that appears. - -### Creating a Custom Benchmark Version for Running a Cluster Scan - -There could be some Kubernetes cluster setups that require custom configurations of the Benchmark tests. For example, the path to the Kubernetes config files or certs might be different than the standard location where the upstream CIS Benchmarks look for them. - -It is now possible to create a custom Benchmark Version for running a cluster scan using the `rancher-cis-benchmark` application. - -For details, see [this page.](./custom-benchmark) diff --git a/content/rancher/v2.6/en/cis-scans/configuration/_index.md b/content/rancher/v2.6/en/cis-scans/configuration/_index.md deleted file mode 100644 index 26df1932e25..00000000000 --- a/content/rancher/v2.6/en/cis-scans/configuration/_index.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: Configuration -weight: 3 ---- - -This configuration reference is intended to help you manage the custom resources created by the `rancher-cis-benchmark` application. These resources are used for performing CIS scans on a cluster, skipping tests, setting the test profile that will be used during a scan, and other customization. - -To configure the custom resources, go to the **Cluster Dashboard** To configure the CIS scans, - -1. In the upper left corner, click **☰ > Cluster Management**. -1. On the **Clusters** page, go to the cluster where you want to configure CIS scans and click **Explore**. -1. In the left navigation bar, click **CIS Benchmark**. - -### Scans - -A scan is created to trigger a CIS scan on the cluster based on the defined profile. A report is created after the scan is completed. - -When configuring a scan, you need to define the name of the scan profile that will be used with the `scanProfileName` directive. - -An example ClusterScan custom resource is below: - -```yaml -apiVersion: cis.cattle.io/v1 -kind: ClusterScan -metadata: - name: rke-cis -spec: - scanProfileName: rke-profile-hardened -``` - -### Profiles - -A profile contains the configuration for the CIS scan, which includes the benchmark version to use and any specific tests to skip in that benchmark. - -> By default, a few ClusterScanProfiles are installed as part of the `rancher-cis-benchmark` chart. If a user edits these default benchmarks or profiles, the next chart update will reset them back. So it is advisable for users to not edit the default ClusterScanProfiles. - -Users can clone the ClusterScanProfiles to create custom profiles. - -Skipped tests are listed under the `skipTests` directive. - -When you create a new profile, you will also need to give it a name. - -An example `ClusterScanProfile` is below: - -```yaml -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - annotations: - meta.helm.sh/release-name: clusterscan-operator - meta.helm.sh/release-namespace: cis-operator-system - labels: - app.kubernetes.io/managed-by: Helm - name: "" -spec: - benchmarkVersion: cis-1.5 - skipTests: - - "1.1.20" - - "1.1.21" -``` - -### Benchmark Versions - -A benchmark version is the name of benchmark to run using `kube-bench`, as well as the valid configuration parameters for that benchmark. - -A `ClusterScanBenchmark` defines the CIS `BenchmarkVersion` name and test configurations. The `BenchmarkVersion` name is a parameter provided to the `kube-bench` tool. - -By default, a few `BenchmarkVersion` names and test configurations are packaged as part of the CIS scan application. When this feature is enabled, these default BenchmarkVersions will be automatically installed and available for users to create a ClusterScanProfile. - -> If the default BenchmarkVersions are edited, the next chart update will reset them back. Therefore we don't recommend editing the default ClusterScanBenchmarks. - -A ClusterScanBenchmark consists of the fields: - -- `ClusterProvider`: This is the cluster provider name for which this benchmark is applicable. For example: RKE, EKS, GKE, etc. Leave it empty if this benchmark can be run on any cluster type. -- `MinKubernetesVersion`: Specifies the cluster's minimum kubernetes version necessary to run this benchmark. Leave it empty if there is no dependency on a particular Kubernetes version. -- `MaxKubernetesVersion`: Specifies the cluster's maximum Kubernetes version necessary to run this benchmark. Leave it empty if there is no dependency on a particular k8s version. - -An example `ClusterScanBenchmark` is below: - -```yaml -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - annotations: - meta.helm.sh/release-name: clusterscan-operator - meta.helm.sh/release-namespace: cis-operator-system - creationTimestamp: "2020-08-28T18:18:07Z" - generation: 1 - labels: - app.kubernetes.io/managed-by: Helm - name: cis-1.5 - resourceVersion: "203878" - selfLink: /apis/cis.cattle.io/v1/clusterscanbenchmarks/cis-1.5 - uid: 309e543e-9102-4091-be91-08d7af7fb7a7 -spec: - clusterProvider: "" - minKubernetesVersion: 1.15.0 -``` \ No newline at end of file diff --git a/content/rancher/v2.6/en/cis-scans/custom-benchmark/_index.md b/content/rancher/v2.6/en/cis-scans/custom-benchmark/_index.md deleted file mode 100644 index 36f70ccaa55..00000000000 --- a/content/rancher/v2.6/en/cis-scans/custom-benchmark/_index.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: Creating a Custom Benchmark Version for Running a Cluster Scan -weight: 4 ---- - -Each Benchmark Version defines a set of test configuration files that define the CIS tests to be run by the kube-bench tool. -The `rancher-cis-benchmark` application installs a few default Benchmark Versions which are listed under CIS Benchmark application menu. - -But there could be some Kubernetes cluster setups that require custom configurations of the Benchmark tests. For example, the path to the Kubernetes config files or certs might be different than the standard location where the upstream CIS Benchmarks look for them. - -It is now possible to create a custom Benchmark Version for running a cluster scan using the `rancher-cis-benchmark` application. - -When a cluster scan is run, you need to select a Profile which points to a specific Benchmark Version. - -Follow all the steps below to add a custom Benchmark Version and run a scan using it. - -1. [Prepare the Custom Benchmark Version ConfigMap](#1-prepare-the-custom-benchmark-version-configmap) -2. [Add a Custom Benchmark Version to a Cluster](#2-add-a-custom-benchmark-version-to-a-cluster) -3. [Create a New Profile for the Custom Benchmark Version](#3-create-a-new-profile-for-the-custom-benchmark-version) -4. [Run a Scan Using the Custom Benchmark Version](#4-run-a-scan-using-the-custom-benchmark-version) - -### 1. Prepare the Custom Benchmark Version ConfigMap - -To create a custom benchmark version, first you need to create a ConfigMap containing the benchmark version's config files and upload it to your Kubernetes cluster where you want to run the scan. - -To prepare a custom benchmark version ConfigMap, suppose we want to add a custom Benchmark Version named `foo`. - -1. Create a directory named `foo` and inside this directory, place all the config YAML files that the kube-bench tool looks for. For example, here are the config YAML files for a Generic CIS 1.5 Benchmark Version https://github.com/aquasecurity/kube-bench/tree/master/cfg/cis-1.5 -1. Place the complete `config.yaml` file, which includes all the components that should be tested. -1. Add the Benchmark version name to the `target_mapping` section of the `config.yaml`: - - ```yaml - target_mapping: - "foo": - - "master" - - "node" - - "controlplane" - - "etcd" - - "policies" - ``` -1. Upload this directory to your Kubernetes Cluster by creating a ConfigMap: - - ```yaml - kubectl create configmap -n foo --from-file= - ``` - -### 2. Add a Custom Benchmark Version to a Cluster - -1. In the upper left corner, click **☰ > Cluster Management**. -1. On the **Clusters** page, go to the cluster where you want to add a custom benchmark and click **Explore**. -1. In the left navigation bar, click **CIS Benchmark > Benchmark Version**. -1. Click **Create**. -1. Enter the **Name** and a description for your custom benchmark version. -1. Choose the cluster provider that your benchmark version applies to. -1. Choose the ConfigMap you have uploaded from the dropdown. -1. Add the minimum and maximum Kubernetes version limits applicable, if any. -1. Click **Create**. - -### 3. Create a New Profile for the Custom Benchmark Version - -To run a scan using your custom benchmark version, you need to add a new Profile pointing to this benchmark version. - -1. In the upper left corner, click **☰ > Cluster Management**. -1. On the **Clusters** page, go to the cluster where you want to add a custom benchmark and click **Explore**. -1. In the left navigation bar, click **CIS Benchmark > Profile**. -1. Click **Create**. -1. Provide a **Name** and description. In this example, we name it `foo-profile`. -1. Choose the Benchmark Version from the dropdown. -1. Click **Create**. - -### 4. Run a Scan Using the Custom Benchmark Version - -Once the Profile pointing to your custom benchmark version `foo` has been created, you can create a new Scan to run the custom test configs in the Benchmark Version. - -To run a scan, - -1. In the upper left corner, click **☰ > Cluster Management**. -1. On the **Clusters** page, go to the cluster where you want to add a custom benchmark and click **Explore**. -1. In the left navigation bar, click **CIS Benchmark > Scan**. -1. Click **Create**. -1. Choose the new cluster scan profile. -1. Click **Create**. - -**Result:** A report is generated with the scan results. To see the results, click the name of the scan that appears. diff --git a/content/rancher/v2.6/en/cis-scans/rbac/_index.md b/content/rancher/v2.6/en/cis-scans/rbac/_index.md deleted file mode 100644 index ad2b47bff2c..00000000000 --- a/content/rancher/v2.6/en/cis-scans/rbac/_index.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Roles-based Access Control -shortTitle: RBAC -weight: 3 ---- - -This section describes the permissions required to use the rancher-cis-benchmark App. - -The rancher-cis-benchmark is a cluster-admin only feature by default. - -However, the `rancher-cis-benchmark` chart installs these two default `ClusterRoles`: - -- cis-admin -- cis-view - -In Rancher, only cluster owners and global administrators have `cis-admin` access by default. - -Note: If you were using the `cis-edit` role added in Rancher v2.5 setup, it has now been removed since -Rancher v2.5.2 because it essentially is same as `cis-admin`. If you happen to create any clusterrolebindings -for `cis-edit`, please update them to use `cis-admin` ClusterRole instead. - -# Cluster-Admin Access - -Rancher CIS Scans is a cluster-admin only feature by default. -This means only the Rancher global admins, and the cluster’s cluster-owner can: - -- Install/Uninstall the rancher-cis-benchmark App -- See the navigation links for CIS Benchmark CRDs - ClusterScanBenchmarks, ClusterScanProfiles, ClusterScans -- List the default ClusterScanBenchmarks and ClusterScanProfiles -- Create/Edit/Delete new ClusterScanProfiles -- Create/Edit/Delete a new ClusterScan to run the CIS scan on the cluster -- View and Download the ClusterScanReport created after the ClusterScan is complete - - -# Summary of Default Permissions for Kubernetes Default Roles - -The rancher-cis-benchmark creates three `ClusterRoles` and adds the CIS Benchmark CRD access to the following default K8s `ClusterRoles`: - -| ClusterRole created by chart | Default K8s ClusterRole | Permissions given with Role -| ------------------------------| ---------------------------| ---------------------------| -| `cis-admin` | `admin`| Ability to CRUD clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR -| `cis-view` | `view `| Ability to List(R) clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR - - -By default only cluster-owner role will have ability to manage and use `rancher-cis-benchmark` feature. - -The other Rancher roles (cluster-member, project-owner, project-member) do not have any default permissions to manage and use rancher-cis-benchmark resources. - -But if a cluster-owner wants to delegate access to other users, they can do so by creating ClusterRoleBindings between these users and the above CIS ClusterRoles manually. -There is no automatic role aggregation supported for the `rancher-cis-benchmark` ClusterRoles. diff --git a/content/rancher/v2.6/en/cis-scans/skipped-tests/_index.md b/content/rancher/v2.6/en/cis-scans/skipped-tests/_index.md deleted file mode 100644 index f2b125c0262..00000000000 --- a/content/rancher/v2.6/en/cis-scans/skipped-tests/_index.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Skipped and Not Applicable Tests -weight: 3 ---- - -This section lists the tests that are skipped in the permissive test profile for RKE. - -> All the tests that are skipped and not applicable on this page will be counted as Not Applicable in the v2.5 generated report. The skipped test count will only mention the user-defined skipped tests. This allows user-skipped tests to be distinguished from the tests that are skipped by default in the RKE permissive test profile. - -# CIS Benchmark v1.5 - -### CIS Benchmark v1.5 Skipped Tests - -| Number | Description | Reason for Skipping | -| ---------- | ------------- | --------- | -| 1.1.12 | Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) | A system service account is required for etcd data directory ownership. Refer to Rancher's hardening guide for more details on how to configure this ownership. | -| 1.2.6 | Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers. | -| 1.2.16 | Ensure that the admission control plugin PodSecurityPolicy is set (Automated) | Enabling Pod Security Policy can cause applications to unexpectedly fail. | -| 1.2.33 | Ensure that the --encryption-provider-config argument is set as appropriate (Manual) | Enabling encryption changes how data can be recovered as data is encrypted. | -| 1.2.34 | Ensure that encryption providers are appropriately configured (Manual) | Enabling encryption changes how data can be recovered as data is encrypted. | -| 4.2.6 | Ensure that the --protect-kernel-defaults argument is set to true (Automated) | System level configurations are required before provisioning the cluster in order for this argument to be set to true. | -| 4.2.10 | Ensure that the--tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers. | -| 5.1.5 | Ensure that default service accounts are not actively used. (Automated) | Kubernetes provides default service accounts to be used. | -| 5.2.2 | Minimize the admission of containers wishing to share the host process ID namespace (Automated) | Enabling Pod Security Policy can cause applications to unexpectedly fail. | -| 5.2.3 | Minimize the admission of containers wishing to share the host IPC namespace (Automated) | Enabling Pod Security Policy can cause applications to unexpectedly fail. | -| 5.2.4 | Minimize the admission of containers wishing to share the host network namespace (Automated) | Enabling Pod Security Policy can cause applications to unexpectedly fail. | -| 5.2.5 | Minimize the admission of containers with allowPrivilegeEscalation (Automated) | Enabling Pod Security Policy can cause applications to unexpectedly fail. | -| 5.3.2 | Ensure that all Namespaces have Network Policies defined (Automated) | Enabling Network Policies can prevent certain applications from communicating with each other. | -| 5.6.4 | The default namespace should not be used (Automated) | Kubernetes provides a default namespace. | - -### CIS Benchmark v1.5 Not Applicable Tests - -| Number | Description | Reason for being not applicable | -| ---------- | ------------- | --------- | -| 1.1.1 | Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. All configuration is passed in as arguments at container run time. | -| 1.1.2 | Ensure that the API server pod specification file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. All configuration is passed in as arguments at container run time. | -| 1.1.3 | Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time. | -| 1.1.4 | Ensure that the controller manager pod specification file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time. | -| 1.1.5 | Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time. | -| 1.1.6 | Ensure that the scheduler pod specification file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time. | -| 1.1.7 | Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time. | -| 1.1.8 | Ensure that the etcd pod specification file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time. | -| 1.1.13 | Ensure that the admin.conf file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. | -| 1.1.14 | Ensure that the admin.conf file ownership is set to root:root (Automated) | Clusters provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. | -| 1.1.15 | Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time. | -| 1.1.16 | Ensure that the scheduler.conf file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time. | -| 1.1.17 | Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time. | -| 1.1.18 | Ensure that the controller-manager.conf file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time. | -| 1.3.6 | Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) | Clusters provisioned by RKE handles certificate rotation directly through RKE. | -| 4.1.1 | Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time. | -| 4.1.2 | Ensure that the kubelet service file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time. | -| 4.1.9 | Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. All configuration is passed in as arguments at container run time. | -| 4.1.10 | Ensure that the kubelet configuration file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. All configuration is passed in as arguments at container run time. | -| 4.2.12 | Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) | Clusters provisioned by RKE handles certificate rotation directly through RKE. | \ No newline at end of file From e4db809dfa7300f76619e1c3e67179bf3a2cc03b Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Thu, 30 Dec 2021 10:17:06 +0100 Subject: [PATCH 128/478] Update _index.md Remove dead links to old Rancher blog --- content/rancher/v2.6/en/best-practices/_index.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/content/rancher/v2.6/en/best-practices/_index.md b/content/rancher/v2.6/en/best-practices/_index.md index 4a9912da47b..37310b8fdd9 100644 --- a/content/rancher/v2.6/en/best-practices/_index.md +++ b/content/rancher/v2.6/en/best-practices/_index.md @@ -12,9 +12,7 @@ Use the navigation bar on the left to find the current best practices for managi For more guidance on best practices, you can consult these resources: - [Security]({{}}/rancher/v2.6/en/security/) -- [Rancher Blog](https://rancher.com/blog/) - - [Articles about best practices on the Rancher blog](https://rancher.com/tags/best-practices/) - - [101 More Security Best Practices for Kubernetes](https://rancher.com/blog/2019/2019-01-17-101-more-kubernetes-security-best-practices/) +- [Rancher Blog](https://www.suse.com/c/rancherblog/) - [Rancher Forum](https://forums.rancher.com/) - [Rancher Users Slack](https://slack.rancher.io/) - [Rancher Labs YouTube Channel - Online Meetups, Demos, Training, and Webinars](https://www.youtube.com/channel/UCh5Xtp82q8wjijP8npkVTBA/featured) From f9e5509c9e74008a561efc5b3e1720aac4dda3fb Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Thu, 30 Dec 2021 14:15:02 +0100 Subject: [PATCH 129/478] Restructure v2.6 security docs Signed-off-by: Guilherme Macedo --- content/rancher/v2.6/en/cis-scans/_index.md | 6 ++++ content/rancher/v2.6/en/security/_index.md | 22 +++++++------- .../v2.6/en/security/best-practices/_index.md | 30 ++++++++++++++++--- 3 files changed, 43 insertions(+), 15 deletions(-) create mode 100644 content/rancher/v2.6/en/cis-scans/_index.md diff --git a/content/rancher/v2.6/en/cis-scans/_index.md b/content/rancher/v2.6/en/cis-scans/_index.md new file mode 100644 index 00000000000..c11624ba466 --- /dev/null +++ b/content/rancher/v2.6/en/cis-scans/_index.md @@ -0,0 +1,6 @@ +--- +title: CIS Scans +weight: 17 +--- + +The CIS scans documentation is now part of the [Security > CIS Scans]({{}}/rancher/v2.6/en/security/cis-scans) section. diff --git a/content/rancher/v2.6/en/security/_index.md b/content/rancher/v2.6/en/security/_index.md index 5780e27a265..f936f7d9461 100644 --- a/content/rancher/v2.6/en/security/_index.md +++ b/content/rancher/v2.6/en/security/_index.md @@ -20,25 +20,25 @@ weight: 20 -Security is at the heart of all Rancher features. From integrating with all the popular authentication tools and services, to an enterprise grade [RBAC capability,]({{}}/rancher/v2.6/en/admin-settings/rbac) Rancher makes your Kubernetes clusters even more secure. +Security is at the heart of all Rancher features. From integrating with all the popular authentication tools and services, to an enterprise grade [RBAC capability]({{}}/rancher/v2.6/en/admin-settings/rbac), Rancher makes your Kubernetes clusters even more secure. -On this page, we provide security-related documentation along with resources to help you secure your Rancher installation and your downstream Kubernetes clusters: +On this page, we provide security related documentation along with resources to help you secure your Rancher installation and your downstream Kubernetes clusters: - [Running a CIS security scan on a Kubernetes cluster](#running-a-cis-security-scan-on-a-kubernetes-cluster) - [SELinux RPM](#selinux-rpm) - [Guide to hardening Rancher installations](#rancher-hardening-guide) - [The CIS Benchmark and self-assessment](#the-cis-benchmark-and-self-assessment) - [Third-party penetration test reports](#third-party-penetration-test-reports) -- [Rancher CVEs and resolutions](#rancher-cves-and-resolutions) +- [Rancher Security Advisories and CVEs](#rancher-security-advisories-and-cves) - [Kubernetes Security Best Practices](#kubernetes-security-best-practices) ### Running a CIS Security Scan on a Kubernetes Cluster -Rancher leverages [kube-bench](https://github.com/aquasecurity/kube-bench) to run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS (Center for Internet Security) Kubernetes Benchmark. +Rancher leverages [kube-bench](https://github.com/aquasecurity/kube-bench) to run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the [CIS](https://www.cisecurity.org/cis-benchmarks/) (Center for Internet Security) Kubernetes Benchmark. The CIS Kubernetes Benchmark is a reference document that can be used to establish a secure configuration baseline for Kubernetes. -The Center for Internet Security (CIS) is a 501(c\)(3) non-profit organization, formed in October 2000, with a mission to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace." +The Center for Internet Security (CIS) is a 501(c\)(3) non-profit organization, formed in October 2000, with a mission to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace". CIS Benchmarks are best practices for the secure configuration of a target system. CIS Benchmarks are developed through the generous volunteer efforts of subject matter experts, technology vendors, public and private community members, and the CIS Benchmark Development team. @@ -46,13 +46,13 @@ The Benchmark provides recommendations of two types: Automated and Manual. We ru When Rancher runs a CIS security scan on a cluster, it generates a report showing the results of each test, including a summary with the number of passed, skipped and failed tests. The report also includes remediation steps for any failed tests. -For details, refer to the section on [security scans.]({{}}/rancher/v2.6/en/cis-scans) +For details, refer to the section on [security scans.]({{}}/rancher/v2.6/en/security/cis-scans/) ### SELinux RPM [Security-Enhanced Linux (SELinux)](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) is a security enhancement to Linux. After being historically used by government agencies, SELinux is now industry standard and is enabled by default on CentOS 7 and 8. -We provide two RPMs (Red Hat packages) that enable Rancher products to function properly on SELinux-enforcing hosts: `rancher-selinux` and `rke2-selinux`. For details, see [this page.]({{}}/rancher/v2.6/en/security/selinux) +We provide two RPMs (Red Hat packages) that enable Rancher products to function properly on SELinux-enforcing hosts: `rancher-selinux` and `rke2-selinux`. For details, see [this page]({{}}/rancher/v2.6/en/security/selinux). ### Rancher Hardening Guide @@ -78,13 +78,13 @@ Rancher periodically hires third parties to perform security audits and penetrat Results: -- [Cure53 Pen Test - 7/2019](https://releases.rancher.com/documents/security/pen-tests/2019/RAN-01-cure53-report.final.pdf) -- [Untamed Theory Pen Test- 3/2019](https://releases.rancher.com/documents/security/pen-tests/2019/UntamedTheory-Rancher_SecurityAssessment-20190712_v5.pdf) +- [Cure53 Pen Test - July 2019](https://releases.rancher.com/documents/security/pen-tests/2019/RAN-01-cure53-report.final.pdf) +- [Untamed Theory Pen Test- March 2019](https://releases.rancher.com/documents/security/pen-tests/2019/UntamedTheory-Rancher_SecurityAssessment-20190712_v5.pdf) -### Rancher CVEs and Resolutions +### Rancher Security Advisories and CVEs Rancher is committed to informing the community of security issues in our products. For the list of CVEs (Common Vulnerabilities and Exposures) for issues we have resolved, refer to [this page.](./cve) ### Kubernetes Security Best Practices -For recommendations on securing your Kubernetes cluster, refer to the [Best Practices](./best-practices) guide. +For recommendations on securing your Kubernetes cluster, refer to the [Kubernetes Security Best Practices](./best-practices) guide. diff --git a/content/rancher/v2.6/en/security/best-practices/_index.md b/content/rancher/v2.6/en/security/best-practices/_index.md index bb31bfca47c..706d8ed71ec 100644 --- a/content/rancher/v2.6/en/security/best-practices/_index.md +++ b/content/rancher/v2.6/en/security/best-practices/_index.md @@ -1,13 +1,32 @@ --- -title: Security Best Practices +title: Kubernetes Security Best Practices weight: 5 --- ### Restricting cloud metadata API access -Cloud providers such as AWS, Azure, or GCP often expose metadata services locally to instances. By default, this endpoint is accessible by pods running on a cloud instance, including pods in hosted Kubernetes providers such as EKS, AKS or GKE, and can contain cloud credentials for that node, provisioning data such as kubelet credentials, or other sensitive data. To mitigate this risk when running on a cloud platform, follow the [Kubernetes security recommendations](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/#restricting-cloud-metadata-api-access): limit permissions given to instance credentials, use network policies to restrict pod access to the metadata API, and avoid using provisioning data to deliver secrets. +Cloud providers such as AWS, Azure, DigitalOcean or GCP often expose metadata services locally to instances. By default, this endpoint is accessible by pods running on a cloud instance, including pods in hosted Kubernetes providers such as EKS, AKS, DigitalOcean Kubernetes or GKE, and can contain cloud credentials for that node, provisioning data such as kubelet credentials, or other sensitive data. To mitigate this risk when running on a cloud platform, follow the [Kubernetes security recommendations](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/#restricting-cloud-metadata-api-access): limit permissions given to instance credentials, use network policies to restrict pod access to the metadata API, and avoid using provisioning data to deliver secrets. -Below is an example of a global network policy (`GlobalNetworkPolicy`) using Calico to restrict access to cloud metadata API. +Below is an example of a network policy for Kubernetes to restrict access to cloud metadata API, but allowing access to everything else `0.0.0.0/0`. + +``` +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-all-egress-except-metadata-api +spec: + podSelector: {} + policyTypes: + - Egress + egress: + - to: + - ipBlock: + cidr: 0.0.0.0/0 + except: + - 169.254.169.254/32 +``` + +A similar global network policy (`GlobalNetworkPolicy`) can be created using Calico. ``` apiVersion: projectcalico.org/v3 @@ -27,7 +46,10 @@ spec: nets: - 0.0.0.0/0 ``` -A similar policy can be created with Canal and Weave. For the list of approved CNI (Container Network Interface) providers in Rancher, please consult this [list]({{}}/rancher/v2.6/en/faq/networking/cni-providers). + +Identical policies can be created with Canal and Weave. For the list of approved CNI (Container Network Interface) providers in Rancher, please consult this [list]({{}}/rancher/v2.6/en/faq/networking/cni-providers). + +The provided policies are just examples and must be tailored to your security needs and environment, since they may conflict with other network policies in place in your cluster. Removing unnecessary packages and using reduced base images is also a good defense in depth strategy to reduce the attack surface against possible abuses of the cloud metadata API. As well as following the principle of least privilege and using instances profiles and roles with the least amount of required permissions for the services to fully function. From 929ecf3fdbb6ddb7d38917aa4f3f1b9a42e6616b Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Thu, 30 Dec 2021 17:17:02 +0100 Subject: [PATCH 130/478] Add aliases for removed pages Signed-off-by: Guilherme Macedo --- content/rancher/v2.6/en/cis-scans/_index.md | 5 +++++ content/rancher/v2.6/en/security/cis-scans/_index.md | 2 ++ content/rancher/v2.6/en/security/hardening-guides/_index.md | 6 ++++++ 3 files changed, 13 insertions(+) diff --git a/content/rancher/v2.6/en/cis-scans/_index.md b/content/rancher/v2.6/en/cis-scans/_index.md index c11624ba466..a2e267612ce 100644 --- a/content/rancher/v2.6/en/cis-scans/_index.md +++ b/content/rancher/v2.6/en/cis-scans/_index.md @@ -1,6 +1,11 @@ --- title: CIS Scans weight: 17 +aliases: + - /rancher/v2.6/en/cis-scans/configuration/ + - /rancher/v2.6/en/cis-scans/custom-benchmark/ + - /rancher/v2.6/en/cis-scans/rbac/ + - /rancher/v2.6/en/cis-scans/skipped-tests/ --- The CIS scans documentation is now part of the [Security > CIS Scans]({{}}/rancher/v2.6/en/security/cis-scans) section. diff --git a/content/rancher/v2.6/en/security/cis-scans/_index.md b/content/rancher/v2.6/en/security/cis-scans/_index.md index 17aa5a5a3b1..88da06fb74e 100644 --- a/content/rancher/v2.6/en/security/cis-scans/_index.md +++ b/content/rancher/v2.6/en/security/cis-scans/_index.md @@ -1,6 +1,8 @@ --- title: CIS Scans weight: 17 +aliases: + - /rancher/v2.6/en/security/security-scan/ --- Rancher can run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark. The CIS scans can run on any Kubernetes cluster, including hosted Kubernetes providers such as EKS, AKS, and GKE. diff --git a/content/rancher/v2.6/en/security/hardening-guides/_index.md b/content/rancher/v2.6/en/security/hardening-guides/_index.md index e6a16445fc1..509aad121c5 100644 --- a/content/rancher/v2.6/en/security/hardening-guides/_index.md +++ b/content/rancher/v2.6/en/security/hardening-guides/_index.md @@ -2,6 +2,12 @@ title: Self-Assessment and Hardening Guides for Rancher v2.6 shortTitle: Rancher v2.6 Guides weight: 1 +aliases: + - /rancher/v2.6/en/security/rancher-2.5/ + - /rancher/v2.6/en/security/rancher-2.5/1.5-hardening-2.5/ + - /rancher/v2.6/en/security/rancher-2.5/1.5-benchmark-2.5/ + - /rancher/v2.6/en/security/rancher-2.5/1.6-hardening-2.5/ + - /rancher/v2.6/en/security/rancher-2.5/1.6-benchmark-2.5/ --- Rancher v2.6 hardening guides are currently being updated. For the time being, please consult Rancher v2.5 [self-assessment and hardening guides]({{}}/rancher/v2.5/en/security/rancher-2.5) for more information. From 0d63881fdba515324c081e8a2a2a138e5bcac173 Mon Sep 17 00:00:00 2001 From: Rushad Date: Thu, 30 Dec 2021 12:11:31 -0500 Subject: [PATCH 131/478] Update _index.md --- .../resources/advanced/helm2/helm-rancher/_index.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.0-v2.4/en/installation/resources/advanced/helm2/helm-rancher/_index.md b/content/rancher/v2.0-v2.4/en/installation/resources/advanced/helm2/helm-rancher/_index.md index 985141b076a..952cd721134 100644 --- a/content/rancher/v2.0-v2.4/en/installation/resources/advanced/helm2/helm-rancher/_index.md +++ b/content/rancher/v2.0-v2.4/en/installation/resources/advanced/helm2/helm-rancher/_index.md @@ -131,7 +131,7 @@ deployment "rancher" successfully rolled out This option uses `cert-manager` to automatically request and renew [Let's Encrypt](https://letsencrypt.org/) certificates. This is a free service that provides you with a valid certificate as Let's Encrypt is a trusted CA. This configuration uses HTTP validation (`HTTP-01`) so the load balancer must have a public DNS record and be accessible from the internet. -- Set `hostname` to the public DNS record, set `ingress.tls.source` to `letsEncrypt` and `letsEncrypt.email` to the email address used for communication about your certificate (for example, expiry notices) +- Set `hostname` to the public DNS record, set `ingress.tls.source` to `letsEncrypt`, `letsEncrypt.email` to the email address used for communication about your certificate (for example, expiry notices), and `letsEncrypt.ingress.class` to whatever your ingress controlller is (`traefik`, `nginx`, `haproxy`). - If you are installing an alpha version, Helm requires adding the `--devel` option to the command. ``` @@ -140,7 +140,8 @@ helm install rancher-/rancher \ --namespace cattle-system \ --set hostname=rancher.my.org \ --set ingress.tls.source=letsEncrypt \ - --set letsEncrypt.email=me@example.org + --set letsEncrypt.email=me@example.org \ + --set letsEncrypt.ingress.class=nginx ``` Wait for Rancher to be rolled out: From 558c5919ce5e0e431900e90228706ffcd3522dbb Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Thu, 30 Dec 2021 23:20:56 +0100 Subject: [PATCH 132/478] Update _index.md --- .../v2.6/en/security/best-practices/_index.md | 46 ------------------- 1 file changed, 46 deletions(-) diff --git a/content/rancher/v2.6/en/security/best-practices/_index.md b/content/rancher/v2.6/en/security/best-practices/_index.md index 706d8ed71ec..4dc70b3d510 100644 --- a/content/rancher/v2.6/en/security/best-practices/_index.md +++ b/content/rancher/v2.6/en/security/best-practices/_index.md @@ -7,52 +7,6 @@ weight: 5 Cloud providers such as AWS, Azure, DigitalOcean or GCP often expose metadata services locally to instances. By default, this endpoint is accessible by pods running on a cloud instance, including pods in hosted Kubernetes providers such as EKS, AKS, DigitalOcean Kubernetes or GKE, and can contain cloud credentials for that node, provisioning data such as kubelet credentials, or other sensitive data. To mitigate this risk when running on a cloud platform, follow the [Kubernetes security recommendations](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/#restricting-cloud-metadata-api-access): limit permissions given to instance credentials, use network policies to restrict pod access to the metadata API, and avoid using provisioning data to deliver secrets. -Below is an example of a network policy for Kubernetes to restrict access to cloud metadata API, but allowing access to everything else `0.0.0.0/0`. - -``` -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: allow-all-egress-except-metadata-api -spec: - podSelector: {} - policyTypes: - - Egress - egress: - - to: - - ipBlock: - cidr: 0.0.0.0/0 - except: - - 169.254.169.254/32 -``` - -A similar global network policy (`GlobalNetworkPolicy`) can be created using Calico. - -``` -apiVersion: projectcalico.org/v3 -kind: GlobalNetworkPolicy -metadata: - name: allow-all-egress-except-metadata-api -spec: - selector: all() - egress: - - action: Deny - protocol: TCP - destination: - nets: - - 169.254.169.254/32 - - action: Allow - destination: - nets: - - 0.0.0.0/0 -``` - -Identical policies can be created with Canal and Weave. For the list of approved CNI (Container Network Interface) providers in Rancher, please consult this [list]({{}}/rancher/v2.6/en/faq/networking/cni-providers). - -The provided policies are just examples and must be tailored to your security needs and environment, since they may conflict with other network policies in place in your cluster. - -Removing unnecessary packages and using reduced base images is also a good defense in depth strategy to reduce the attack surface against possible abuses of the cloud metadata API. As well as following the principle of least privilege and using instances profiles and roles with the least amount of required permissions for the services to fully function. - It is advised to consult your cloud provider's security best practices for further recommendations and specific details on how to restrict access to cloud instance metadata API. Further references: MITRE ATT&CK knowledge base on - [Unsecured Credentials: Cloud Instance Metadata API](https://attack.mitre.org/techniques/T1552/005/). From a34a8d9f6d890c1e50c31b24935a57b33fad7eea Mon Sep 17 00:00:00 2001 From: Omripresent Date: Fri, 31 Dec 2021 08:51:27 -0500 Subject: [PATCH 133/478] Update _index.md Corrected etcd recovery documentation link --- content/k3s/latest/en/backup-restore/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/k3s/latest/en/backup-restore/_index.md b/content/k3s/latest/en/backup-restore/_index.md index 27252dbb6fb..8e9569e2948 100644 --- a/content/k3s/latest/en/backup-restore/_index.md +++ b/content/k3s/latest/en/backup-restore/_index.md @@ -18,7 +18,7 @@ For details on taking database snapshots and restoring your database from them, - [Official MySQL documentation](https://dev.mysql.com/doc/refman/8.0/en/replication-snapshot-method.html) - [Official PostgreSQL documentation](https://www.postgresql.org/docs/8.3/backup-dump.html) -- [Official etcd documentation](https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/recovery.md) +- [Official etcd documentation](https://etcd.io/docs/latest/op-guide/recovery/) # Backup and Restore with Embedded etcd Datastore (Experimental) From 23381cc6683af4af7782c7cc9fc2d442d7f495dd Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Sat, 1 Jan 2022 14:42:23 +0100 Subject: [PATCH 134/478] Restore CIS docs to its original place Signed-off-by: Guilherme Macedo --- content/rancher/v2.6/en/cis-scans/_index.md | 290 ++++++++++++++++- .../v2.6/en/cis-scans/configuration/_index.md | 98 ++++++ .../en/cis-scans/custom-benchmark/_index.md | 84 +++++ .../rancher/v2.6/en/cis-scans/rbac/_index.md | 50 +++ .../v2.6/en/cis-scans/skipped-tests/_index.md | 54 ++++ .../v2.6/en/security/cis-scans/_index.md | 291 ------------------ .../v2.6/en/security/security-scan/_index.md | 6 + 7 files changed, 576 insertions(+), 297 deletions(-) create mode 100644 content/rancher/v2.6/en/cis-scans/configuration/_index.md create mode 100644 content/rancher/v2.6/en/cis-scans/custom-benchmark/_index.md create mode 100644 content/rancher/v2.6/en/cis-scans/rbac/_index.md create mode 100644 content/rancher/v2.6/en/cis-scans/skipped-tests/_index.md delete mode 100644 content/rancher/v2.6/en/security/cis-scans/_index.md create mode 100644 content/rancher/v2.6/en/security/security-scan/_index.md diff --git a/content/rancher/v2.6/en/cis-scans/_index.md b/content/rancher/v2.6/en/cis-scans/_index.md index a2e267612ce..17aa5a5a3b1 100644 --- a/content/rancher/v2.6/en/cis-scans/_index.md +++ b/content/rancher/v2.6/en/cis-scans/_index.md @@ -1,11 +1,289 @@ --- title: CIS Scans weight: 17 -aliases: - - /rancher/v2.6/en/cis-scans/configuration/ - - /rancher/v2.6/en/cis-scans/custom-benchmark/ - - /rancher/v2.6/en/cis-scans/rbac/ - - /rancher/v2.6/en/cis-scans/skipped-tests/ --- -The CIS scans documentation is now part of the [Security > CIS Scans]({{}}/rancher/v2.6/en/security/cis-scans) section. +Rancher can run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark. The CIS scans can run on any Kubernetes cluster, including hosted Kubernetes providers such as EKS, AKS, and GKE. + +The `rancher-cis-benchmark` app leverages kube-bench, an open-source tool from Aqua Security, to check clusters for CIS Kubernetes Benchmark compliance. Also, to generate a cluster-wide report, the application utilizes Sonobuoy for report aggregation. + +- [About the CIS Benchmark](#about-the-cis-benchmark) +- [About the Generated Report](#about-the-generated-report) +- [Test Profiles](#test-profiles) +- [About Skipped and Not Applicable Tests](#about-skipped-and-not-applicable-tests) +- [Roles-based Access Control](./rbac) +- [Configuration](./configuration) +- [How-to Guides](#how-to-guides) + - [Installing CIS Benchmark](#installing-cis-benchmark) + - [Uninstalling CIS Benchmark](#uninstalling-cis-benchmark) + - [Running a Scan](#running-a-scan) + - [Running a Scan Periodically on a Schedule](#running-a-scan-periodically-on-a-schedule) + - [Skipping Tests](#skipping-tests) + - [Viewing Reports](#viewing-reports) + - [Enabling Alerting for rancher-cis-benchmark](#enabling-alerting-for-rancher-cis-benchmark) + - [Configuring Alerts for a Periodic Scan on a Schedule](#configuring-alerts-for-a-periodic-scan-on-a-schedule) + - [Creating a Custom Benchmark Version for Running a Cluster Scan](#creating-a-custom-benchmark-version-for-running-a-cluster-scan) + + +# About the CIS Benchmark + +The Center for Internet Security is a 501(c\)(3) non-profit organization, formed in October 2000, with a mission to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace". The organization is headquartered in East Greenbush, New York, with members including large corporations, government agencies, and academic institutions. + +CIS Benchmarks are best practices for the secure configuration of a target system. CIS Benchmarks are developed through the generous volunteer efforts of subject matter experts, technology vendors, public and private community members, and the CIS Benchmark Development team. + +The official Benchmark documents are available through the CIS website. The sign-up form to access the documents is +here. + +# About the Generated Report + +Each scan generates a report can be viewed in the Rancher UI and can be downloaded in CSV format. + +By default, the CIS Benchmark v1.6 is used. + +The Benchmark version is included in the generated report. + +The Benchmark provides recommendations of two types: Automated and Manual. Recommendations marked as Manual in the Benchmark are not included in the generated report. + +Some tests are designated as "Not Applicable." These tests will not be run on any CIS scan because of the way that Rancher provisions RKE clusters. For information on how test results can be audited, and why some tests are designated to be not applicable, refer to Rancher's self-assessment guide for the corresponding Kubernetes version. + +The report contains the following information: + +| Column in Report | Description | +|------------------|-------------| +| `id` | The ID number of the CIS Benchmark. | +| `description` | The description of the CIS Benchmark test. | +| `remediation` | What needs to be fixed in order to pass the test. | +| `state` | Indicates if the test passed, failed, was skipped, or was not applicable. | +| `node_type` | The node role, which affects which tests are run on the node. Master tests are run on controlplane nodes, etcd tests are run on etcd nodes, and node tests are run on the worker nodes. | +| `audit` | This is the audit check that `kube-bench` runs for this test. | +| `audit_config` | Any configuration applicable to the audit script. | +| `test_info` | Test-related info as reported by `kube-bench`, if any. | +| `commands` | Test-related commands as reported by `kube-bench`, if any. | +| `config_commands` | Test-related configuration data as reported by `kube-bench`, if any. | +| `actual_value` | The test's actual value, present if reported by `kube-bench`. | +| `expected_result` | The test's expected result, present if reported by `kube-bench`. | + +Refer to the table in the cluster hardening guide for information on which versions of Kubernetes, the Benchmark, Rancher, and our cluster hardening guide correspond to each other. Also refer to the hardening guide for configuration files of CIS-compliant clusters and information on remediating failed tests. + +# Test Profiles + +The following profiles are available: + +- Generic CIS 1.5 +- Generic CIS 1.6 +- RKE permissive 1.5 +- RKE hardened 1.5 +- RKE permissive 1.6 +- RKE hardened 1.6 +- EKS +- GKE +- RKE2 permissive 1.5 +- RKE2 permissive 1.5 + +You also have the ability to customize a profile by saving a set of tests to skip. + +All profiles will have a set of not applicable tests that will be skipped during the CIS scan. These tests are not applicable based on how a RKE cluster manages Kubernetes. + +There are two types of RKE cluster scan profiles: + +- **Permissive:** This profile has a set of tests that have been will be skipped as these tests will fail on a default RKE Kubernetes cluster. Besides the list of skipped tests, the profile will also not run the not applicable tests. +- **Hardened:** This profile will not skip any tests, except for the non-applicable tests. + +The EKS and GKE cluster scan profiles are based on CIS Benchmark versions that are specific to those types of clusters. + +In order to pass the "Hardened" profile, you will need to follow the steps on the hardening guide and use the `cluster.yml` defined in the hardening guide to provision a hardened cluster. + +The default profile and the supported CIS benchmark version depends on the type of cluster that will be scanned: + +The `rancher-cis-benchmark` supports the CIS 1.6 Benchmark version. + +- For RKE Kubernetes clusters, the RKE Permissive 1.6 profile is the default. +- EKS and GKE have their own CIS Benchmarks published by `kube-bench`. The corresponding test profiles are used by default for those clusters. +- For RKE2 Kubernetes clusters, the RKE2 Permissive 1.5 profile is the default. +- For cluster types other than RKE, RKE2, EKS and GKE, the Generic CIS 1.5 profile will be used by default. + +# About Skipped and Not Applicable Tests + +For a list of skipped and not applicable tests, refer to this page. + +For now, only user-defined skipped tests are marked as skipped in the generated report. + +Any skipped tests that are defined as being skipped by one of the default profiles are marked as not applicable. + +# Roles-based Access Control + +For information about permissions, refer to this page. + +# Configuration + +For more information about configuring the custom resources for the scans, profiles, and benchmark versions, refer to this page. + +# How-to Guides + +- [Installing rancher-cis-benchmark](#installing-rancher-cis-benchmark) +- [Uninstalling rancher-cis-benchmark](#uninstalling-rancher-cis-benchmark) +- [Running a Scan](#running-a-scan) +- [Running a Scan Periodically on a Schedule](#running-a-scan-periodically-on-a-schedule) +- [Skipping Tests](#skipping-tests) +- [Viewing Reports](#viewing-reports) +- [Enabling Alerting for rancher-cis-benchmark](#enabling-alerting-for-rancher-cis-benchmark) +- [Configuring Alerts for a Periodic Scan on a Schedule](#configuring-alerts-for-a-periodic-scan-on-a-schedule) +- [Creating a Custom Benchmark Version for Running a Cluster Scan](#creating-a-custom-benchmark-version-for-running-a-cluster-scan) +### Installing CIS Benchmark + +1. In the upper left corner, click **☰ > Cluster Management**. +1. On the **Clusters** page, go to the cluster where you want to install CIS Benchmark and click **Explore**. +1. In the left navigation bar, click **Apps & Marketplace > Charts**. +1. Click **CIS Benchmark** +1. Click **Install**. + +**Result:** The CIS scan application is deployed on the Kubernetes cluster. + +### Uninstalling CIS Benchmark + +1. From the **Cluster Dashboard,** go to the left navigation bar and click **Apps & Marketplace > Installed Apps**. +1. Go to the `cis-operator-system` namespace and check the boxes next to `rancher-cis-benchmark-crd` and `rancher-cis-benchmark`. +1. Click **Delete** and confirm **Delete**. + +**Result:** The `rancher-cis-benchmark` application is uninstalled. + +### Running a Scan + +When a ClusterScan custom resource is created, it launches a new CIS scan on the cluster for the chosen ClusterScanProfile. + +Note: There is currently a limitation of running only one CIS scan at a time for a cluster. If you create multiple ClusterScan custom resources, they will be run one after the other by the operator, and until one scan finishes, the rest of the ClusterScan custom resources will be in the "Pending" state. + +To run a scan, + +1. In the upper left corner, click **☰ > Cluster Management**. +1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**. +1. Click **CIS Benchmark > Scan**. +1. Click **Create**. +1. Choose a cluster scan profile. The profile determines which CIS Benchmark version will be used and which tests will be performed. If you choose the Default profile, then the CIS Operator will choose a profile applicable to the type of Kubernetes cluster it is installed on. +1. Click **Create**. + +**Result:** A report is generated with the scan results. To see the results, click the name of the scan that appears. +### Running a Scan Periodically on a Schedule + +To run a ClusterScan on a schedule, + +1. In the upper left corner, click **☰ > Cluster Management**. +1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**. +1. Click **CIS Benchmark > Scan**. +1. Choose a cluster scan profile. The profile determines which CIS Benchmark version will be used and which tests will be performed. If you choose the Default profile, then the CIS Operator will choose a profile applicable to the type of Kubernetes cluster it is installed on. +1. Choose the option **Run scan on a schedule**. +1. Enter a valid cron schedule expression in the field **Schedule**. +1. Choose a **Retention** count, which indicates the number of reports maintained for this recurring scan. By default this count is 3. When this retention limit is reached, older reports will get purged. +1. Click **Create**. + +**Result:** The scan runs and reschedules to run according to the cron schedule provided. The **Next Scan** value indicates the next time this scan will run again. + +A report is generated with the scan results every time the scan runs. To see the latest results, click the name of the scan that appears. + +You can also see the previous reports by choosing the report from the **Reports** dropdown on the scan detail page. + +### Skipping Tests + +CIS scans can be run using test profiles with user-defined skips. + +To skip tests, you will create a custom CIS scan profile. A profile contains the configuration for the CIS scan, which includes the benchmark versions to use and any specific tests to skip in that benchmark. + +1. In the upper left corner, click **☰ > Cluster Management**. +1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**. +1. Click **CIS Benchmark > Profile**. +1. From here, you can create a profile in multiple ways. To make a new profile, click **Create** and fill out the form in the UI. To make a new profile based on an existing profile, go to the existing profile and click **⋮ Clone**. If you are filling out the form, add the tests to skip using the test IDs, using the relevant CIS Benchmark as a reference. If you are creating the new test profile as YAML, you will add the IDs of the tests to skip in the `skipTests` directive. You will also give the profile a name: + + ```yaml + apiVersion: cis.cattle.io/v1 + kind: ClusterScanProfile + metadata: + annotations: + meta.helm.sh/release-name: clusterscan-operator + meta.helm.sh/release-namespace: cis-operator-system + labels: + app.kubernetes.io/managed-by: Helm + name: "" + spec: + benchmarkVersion: cis-1.5 + skipTests: + - "1.1.20" + - "1.1.21" + ``` +1. Click **Create**. + +**Result:** A new CIS scan profile is created. + +When you [run a scan](#running-a-scan) that uses this profile, the defined tests will be skipped during the scan. The skipped tests will be marked in the generated report as `Skip`. + +### Viewing Reports + +To view the generated CIS scan reports, + +1. In the upper left corner, click **☰ > Cluster Management**. +1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**. +1. Click **CIS Benchmark > Scan**. +1. The **Scans** page will show the generated reports. To see a detailed report, go to a scan report and click the name. + +One can download the report from the Scans list or from the scan detail page. + +### Enabling Alerting for rancher-cis-benchmark + +Alerts can be configured to be sent out for a scan that runs on a schedule. + +> **Prerequisite:** +> +> Before enabling alerts for `rancher-cis-benchmark`, make sure to install the `rancher-monitoring` application and configure the Receivers and Routes. For more information, see [this section.]({{}}/rancher/v2.6/en/monitoring-alerting/configuration) +> +> While configuring the routes for `rancher-cis-benchmark` alerts, you can specify the matching using the key-value pair `job: rancher-cis-scan`. An example route configuration is [here.]({{}}/rancher/v2.6/en/monitoring-alerting/configuration/receiver/#example-route-config-for-cis-scan-alerts) + +While installing or upgrading the `rancher-cis-benchmark` Helm chart, set the following flag to `true` in the `values.yaml`: + +```yaml +alerts: + enabled: true +``` + +### Configuring Alerts for a Periodic Scan on a Schedule + +It is possible to run a ClusterScan on a schedule. + +A scheduled scan can also specify if you should receive alerts when the scan completes. + +Alerts are supported only for a scan that runs on a schedule. + +The CIS Benchmark application supports two types of alerts: + +- Alert on scan completion: This alert is sent out when the scan run finishes. The alert includes details including the ClusterScan's name and the ClusterScanProfile name. +- Alert on scan failure: This alert is sent out if there are some test failures in the scan run or if the scan is in a `Fail` state. + +> **Prerequisite:** +> +> Before enabling alerts for `rancher-cis-benchmark`, make sure to install the `rancher-monitoring` application and configure the Receivers and Routes. For more information, see [this section.]({{}}/rancher/v2.6/en/monitoring-alerting/configuration) +> +> While configuring the routes for `rancher-cis-benchmark` alerts, you can specify the matching using the key-value pair `job: rancher-cis-scan`. An example route configuration is [here.]({{}}/rancher/v2.6/en/monitoring-alerting/configuration/receiver/#example-route-config-for-cis-scan-alerts) + +To configure alerts for a scan that runs on a schedule, + +1. Please enable alerts on the `rancher-cis-benchmark` application (#enabling-alerting-for-rancher-cis-benchmark) +1. In the upper left corner, click **☰ > Cluster Management**. +1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**. +1. Click **CIS Benchmark > Scan**. +1. Click **Create**. +1. Choose a cluster scan profile. The profile determines which CIS Benchmark version will be used and which tests will be performed. If you choose the Default profile, then the CIS Operator will choose a profile applicable to the type of Kubernetes cluster it is installed on. +1. Choose the option **Run scan on a schedule**. +1. Enter a valid [cron schedule expression](https://en.wikipedia.org/wiki/Cron#CRON_expression) in the field **Schedule**. +1. Check the boxes next to the Alert types under **Alerting**. +1. Optional: Choose a **Retention Count**, which indicates the number of reports maintained for this recurring scan. By default this count is 3. When this retention limit is reached, older reports will get purged. +1. Click **Create**. + +**Result:** The scan runs and reschedules to run according to the cron schedule provided. Alerts are sent out when the scan finishes if routes and receiver are configured under `rancher-monitoring` application. + +A report is generated with the scan results every time the scan runs. To see the latest results, click the name of the scan that appears. + +### Creating a Custom Benchmark Version for Running a Cluster Scan + +There could be some Kubernetes cluster setups that require custom configurations of the Benchmark tests. For example, the path to the Kubernetes config files or certs might be different than the standard location where the upstream CIS Benchmarks look for them. + +It is now possible to create a custom Benchmark Version for running a cluster scan using the `rancher-cis-benchmark` application. + +For details, see [this page.](./custom-benchmark) diff --git a/content/rancher/v2.6/en/cis-scans/configuration/_index.md b/content/rancher/v2.6/en/cis-scans/configuration/_index.md new file mode 100644 index 00000000000..26df1932e25 --- /dev/null +++ b/content/rancher/v2.6/en/cis-scans/configuration/_index.md @@ -0,0 +1,98 @@ +--- +title: Configuration +weight: 3 +--- + +This configuration reference is intended to help you manage the custom resources created by the `rancher-cis-benchmark` application. These resources are used for performing CIS scans on a cluster, skipping tests, setting the test profile that will be used during a scan, and other customization. + +To configure the custom resources, go to the **Cluster Dashboard** To configure the CIS scans, + +1. In the upper left corner, click **☰ > Cluster Management**. +1. On the **Clusters** page, go to the cluster where you want to configure CIS scans and click **Explore**. +1. In the left navigation bar, click **CIS Benchmark**. + +### Scans + +A scan is created to trigger a CIS scan on the cluster based on the defined profile. A report is created after the scan is completed. + +When configuring a scan, you need to define the name of the scan profile that will be used with the `scanProfileName` directive. + +An example ClusterScan custom resource is below: + +```yaml +apiVersion: cis.cattle.io/v1 +kind: ClusterScan +metadata: + name: rke-cis +spec: + scanProfileName: rke-profile-hardened +``` + +### Profiles + +A profile contains the configuration for the CIS scan, which includes the benchmark version to use and any specific tests to skip in that benchmark. + +> By default, a few ClusterScanProfiles are installed as part of the `rancher-cis-benchmark` chart. If a user edits these default benchmarks or profiles, the next chart update will reset them back. So it is advisable for users to not edit the default ClusterScanProfiles. + +Users can clone the ClusterScanProfiles to create custom profiles. + +Skipped tests are listed under the `skipTests` directive. + +When you create a new profile, you will also need to give it a name. + +An example `ClusterScanProfile` is below: + +```yaml +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + annotations: + meta.helm.sh/release-name: clusterscan-operator + meta.helm.sh/release-namespace: cis-operator-system + labels: + app.kubernetes.io/managed-by: Helm + name: "" +spec: + benchmarkVersion: cis-1.5 + skipTests: + - "1.1.20" + - "1.1.21" +``` + +### Benchmark Versions + +A benchmark version is the name of benchmark to run using `kube-bench`, as well as the valid configuration parameters for that benchmark. + +A `ClusterScanBenchmark` defines the CIS `BenchmarkVersion` name and test configurations. The `BenchmarkVersion` name is a parameter provided to the `kube-bench` tool. + +By default, a few `BenchmarkVersion` names and test configurations are packaged as part of the CIS scan application. When this feature is enabled, these default BenchmarkVersions will be automatically installed and available for users to create a ClusterScanProfile. + +> If the default BenchmarkVersions are edited, the next chart update will reset them back. Therefore we don't recommend editing the default ClusterScanBenchmarks. + +A ClusterScanBenchmark consists of the fields: + +- `ClusterProvider`: This is the cluster provider name for which this benchmark is applicable. For example: RKE, EKS, GKE, etc. Leave it empty if this benchmark can be run on any cluster type. +- `MinKubernetesVersion`: Specifies the cluster's minimum kubernetes version necessary to run this benchmark. Leave it empty if there is no dependency on a particular Kubernetes version. +- `MaxKubernetesVersion`: Specifies the cluster's maximum Kubernetes version necessary to run this benchmark. Leave it empty if there is no dependency on a particular k8s version. + +An example `ClusterScanBenchmark` is below: + +```yaml +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + annotations: + meta.helm.sh/release-name: clusterscan-operator + meta.helm.sh/release-namespace: cis-operator-system + creationTimestamp: "2020-08-28T18:18:07Z" + generation: 1 + labels: + app.kubernetes.io/managed-by: Helm + name: cis-1.5 + resourceVersion: "203878" + selfLink: /apis/cis.cattle.io/v1/clusterscanbenchmarks/cis-1.5 + uid: 309e543e-9102-4091-be91-08d7af7fb7a7 +spec: + clusterProvider: "" + minKubernetesVersion: 1.15.0 +``` \ No newline at end of file diff --git a/content/rancher/v2.6/en/cis-scans/custom-benchmark/_index.md b/content/rancher/v2.6/en/cis-scans/custom-benchmark/_index.md new file mode 100644 index 00000000000..36f70ccaa55 --- /dev/null +++ b/content/rancher/v2.6/en/cis-scans/custom-benchmark/_index.md @@ -0,0 +1,84 @@ +--- +title: Creating a Custom Benchmark Version for Running a Cluster Scan +weight: 4 +--- + +Each Benchmark Version defines a set of test configuration files that define the CIS tests to be run by the kube-bench tool. +The `rancher-cis-benchmark` application installs a few default Benchmark Versions which are listed under CIS Benchmark application menu. + +But there could be some Kubernetes cluster setups that require custom configurations of the Benchmark tests. For example, the path to the Kubernetes config files or certs might be different than the standard location where the upstream CIS Benchmarks look for them. + +It is now possible to create a custom Benchmark Version for running a cluster scan using the `rancher-cis-benchmark` application. + +When a cluster scan is run, you need to select a Profile which points to a specific Benchmark Version. + +Follow all the steps below to add a custom Benchmark Version and run a scan using it. + +1. [Prepare the Custom Benchmark Version ConfigMap](#1-prepare-the-custom-benchmark-version-configmap) +2. [Add a Custom Benchmark Version to a Cluster](#2-add-a-custom-benchmark-version-to-a-cluster) +3. [Create a New Profile for the Custom Benchmark Version](#3-create-a-new-profile-for-the-custom-benchmark-version) +4. [Run a Scan Using the Custom Benchmark Version](#4-run-a-scan-using-the-custom-benchmark-version) + +### 1. Prepare the Custom Benchmark Version ConfigMap + +To create a custom benchmark version, first you need to create a ConfigMap containing the benchmark version's config files and upload it to your Kubernetes cluster where you want to run the scan. + +To prepare a custom benchmark version ConfigMap, suppose we want to add a custom Benchmark Version named `foo`. + +1. Create a directory named `foo` and inside this directory, place all the config YAML files that the kube-bench tool looks for. For example, here are the config YAML files for a Generic CIS 1.5 Benchmark Version https://github.com/aquasecurity/kube-bench/tree/master/cfg/cis-1.5 +1. Place the complete `config.yaml` file, which includes all the components that should be tested. +1. Add the Benchmark version name to the `target_mapping` section of the `config.yaml`: + + ```yaml + target_mapping: + "foo": + - "master" + - "node" + - "controlplane" + - "etcd" + - "policies" + ``` +1. Upload this directory to your Kubernetes Cluster by creating a ConfigMap: + + ```yaml + kubectl create configmap -n foo --from-file= + ``` + +### 2. Add a Custom Benchmark Version to a Cluster + +1. In the upper left corner, click **☰ > Cluster Management**. +1. On the **Clusters** page, go to the cluster where you want to add a custom benchmark and click **Explore**. +1. In the left navigation bar, click **CIS Benchmark > Benchmark Version**. +1. Click **Create**. +1. Enter the **Name** and a description for your custom benchmark version. +1. Choose the cluster provider that your benchmark version applies to. +1. Choose the ConfigMap you have uploaded from the dropdown. +1. Add the minimum and maximum Kubernetes version limits applicable, if any. +1. Click **Create**. + +### 3. Create a New Profile for the Custom Benchmark Version + +To run a scan using your custom benchmark version, you need to add a new Profile pointing to this benchmark version. + +1. In the upper left corner, click **☰ > Cluster Management**. +1. On the **Clusters** page, go to the cluster where you want to add a custom benchmark and click **Explore**. +1. In the left navigation bar, click **CIS Benchmark > Profile**. +1. Click **Create**. +1. Provide a **Name** and description. In this example, we name it `foo-profile`. +1. Choose the Benchmark Version from the dropdown. +1. Click **Create**. + +### 4. Run a Scan Using the Custom Benchmark Version + +Once the Profile pointing to your custom benchmark version `foo` has been created, you can create a new Scan to run the custom test configs in the Benchmark Version. + +To run a scan, + +1. In the upper left corner, click **☰ > Cluster Management**. +1. On the **Clusters** page, go to the cluster where you want to add a custom benchmark and click **Explore**. +1. In the left navigation bar, click **CIS Benchmark > Scan**. +1. Click **Create**. +1. Choose the new cluster scan profile. +1. Click **Create**. + +**Result:** A report is generated with the scan results. To see the results, click the name of the scan that appears. diff --git a/content/rancher/v2.6/en/cis-scans/rbac/_index.md b/content/rancher/v2.6/en/cis-scans/rbac/_index.md new file mode 100644 index 00000000000..ad2b47bff2c --- /dev/null +++ b/content/rancher/v2.6/en/cis-scans/rbac/_index.md @@ -0,0 +1,50 @@ +--- +title: Roles-based Access Control +shortTitle: RBAC +weight: 3 +--- + +This section describes the permissions required to use the rancher-cis-benchmark App. + +The rancher-cis-benchmark is a cluster-admin only feature by default. + +However, the `rancher-cis-benchmark` chart installs these two default `ClusterRoles`: + +- cis-admin +- cis-view + +In Rancher, only cluster owners and global administrators have `cis-admin` access by default. + +Note: If you were using the `cis-edit` role added in Rancher v2.5 setup, it has now been removed since +Rancher v2.5.2 because it essentially is same as `cis-admin`. If you happen to create any clusterrolebindings +for `cis-edit`, please update them to use `cis-admin` ClusterRole instead. + +# Cluster-Admin Access + +Rancher CIS Scans is a cluster-admin only feature by default. +This means only the Rancher global admins, and the cluster’s cluster-owner can: + +- Install/Uninstall the rancher-cis-benchmark App +- See the navigation links for CIS Benchmark CRDs - ClusterScanBenchmarks, ClusterScanProfiles, ClusterScans +- List the default ClusterScanBenchmarks and ClusterScanProfiles +- Create/Edit/Delete new ClusterScanProfiles +- Create/Edit/Delete a new ClusterScan to run the CIS scan on the cluster +- View and Download the ClusterScanReport created after the ClusterScan is complete + + +# Summary of Default Permissions for Kubernetes Default Roles + +The rancher-cis-benchmark creates three `ClusterRoles` and adds the CIS Benchmark CRD access to the following default K8s `ClusterRoles`: + +| ClusterRole created by chart | Default K8s ClusterRole | Permissions given with Role +| ------------------------------| ---------------------------| ---------------------------| +| `cis-admin` | `admin`| Ability to CRUD clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR +| `cis-view` | `view `| Ability to List(R) clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR + + +By default only cluster-owner role will have ability to manage and use `rancher-cis-benchmark` feature. + +The other Rancher roles (cluster-member, project-owner, project-member) do not have any default permissions to manage and use rancher-cis-benchmark resources. + +But if a cluster-owner wants to delegate access to other users, they can do so by creating ClusterRoleBindings between these users and the above CIS ClusterRoles manually. +There is no automatic role aggregation supported for the `rancher-cis-benchmark` ClusterRoles. diff --git a/content/rancher/v2.6/en/cis-scans/skipped-tests/_index.md b/content/rancher/v2.6/en/cis-scans/skipped-tests/_index.md new file mode 100644 index 00000000000..f2b125c0262 --- /dev/null +++ b/content/rancher/v2.6/en/cis-scans/skipped-tests/_index.md @@ -0,0 +1,54 @@ +--- +title: Skipped and Not Applicable Tests +weight: 3 +--- + +This section lists the tests that are skipped in the permissive test profile for RKE. + +> All the tests that are skipped and not applicable on this page will be counted as Not Applicable in the v2.5 generated report. The skipped test count will only mention the user-defined skipped tests. This allows user-skipped tests to be distinguished from the tests that are skipped by default in the RKE permissive test profile. + +# CIS Benchmark v1.5 + +### CIS Benchmark v1.5 Skipped Tests + +| Number | Description | Reason for Skipping | +| ---------- | ------------- | --------- | +| 1.1.12 | Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) | A system service account is required for etcd data directory ownership. Refer to Rancher's hardening guide for more details on how to configure this ownership. | +| 1.2.6 | Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers. | +| 1.2.16 | Ensure that the admission control plugin PodSecurityPolicy is set (Automated) | Enabling Pod Security Policy can cause applications to unexpectedly fail. | +| 1.2.33 | Ensure that the --encryption-provider-config argument is set as appropriate (Manual) | Enabling encryption changes how data can be recovered as data is encrypted. | +| 1.2.34 | Ensure that encryption providers are appropriately configured (Manual) | Enabling encryption changes how data can be recovered as data is encrypted. | +| 4.2.6 | Ensure that the --protect-kernel-defaults argument is set to true (Automated) | System level configurations are required before provisioning the cluster in order for this argument to be set to true. | +| 4.2.10 | Ensure that the--tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers. | +| 5.1.5 | Ensure that default service accounts are not actively used. (Automated) | Kubernetes provides default service accounts to be used. | +| 5.2.2 | Minimize the admission of containers wishing to share the host process ID namespace (Automated) | Enabling Pod Security Policy can cause applications to unexpectedly fail. | +| 5.2.3 | Minimize the admission of containers wishing to share the host IPC namespace (Automated) | Enabling Pod Security Policy can cause applications to unexpectedly fail. | +| 5.2.4 | Minimize the admission of containers wishing to share the host network namespace (Automated) | Enabling Pod Security Policy can cause applications to unexpectedly fail. | +| 5.2.5 | Minimize the admission of containers with allowPrivilegeEscalation (Automated) | Enabling Pod Security Policy can cause applications to unexpectedly fail. | +| 5.3.2 | Ensure that all Namespaces have Network Policies defined (Automated) | Enabling Network Policies can prevent certain applications from communicating with each other. | +| 5.6.4 | The default namespace should not be used (Automated) | Kubernetes provides a default namespace. | + +### CIS Benchmark v1.5 Not Applicable Tests + +| Number | Description | Reason for being not applicable | +| ---------- | ------------- | --------- | +| 1.1.1 | Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. All configuration is passed in as arguments at container run time. | +| 1.1.2 | Ensure that the API server pod specification file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. All configuration is passed in as arguments at container run time. | +| 1.1.3 | Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time. | +| 1.1.4 | Ensure that the controller manager pod specification file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time. | +| 1.1.5 | Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time. | +| 1.1.6 | Ensure that the scheduler pod specification file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time. | +| 1.1.7 | Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time. | +| 1.1.8 | Ensure that the etcd pod specification file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time. | +| 1.1.13 | Ensure that the admin.conf file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. | +| 1.1.14 | Ensure that the admin.conf file ownership is set to root:root (Automated) | Clusters provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. | +| 1.1.15 | Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time. | +| 1.1.16 | Ensure that the scheduler.conf file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time. | +| 1.1.17 | Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time. | +| 1.1.18 | Ensure that the controller-manager.conf file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time. | +| 1.3.6 | Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) | Clusters provisioned by RKE handles certificate rotation directly through RKE. | +| 4.1.1 | Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time. | +| 4.1.2 | Ensure that the kubelet service file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time. | +| 4.1.9 | Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. All configuration is passed in as arguments at container run time. | +| 4.1.10 | Ensure that the kubelet configuration file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. All configuration is passed in as arguments at container run time. | +| 4.2.12 | Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) | Clusters provisioned by RKE handles certificate rotation directly through RKE. | \ No newline at end of file diff --git a/content/rancher/v2.6/en/security/cis-scans/_index.md b/content/rancher/v2.6/en/security/cis-scans/_index.md deleted file mode 100644 index 88da06fb74e..00000000000 --- a/content/rancher/v2.6/en/security/cis-scans/_index.md +++ /dev/null @@ -1,291 +0,0 @@ ---- -title: CIS Scans -weight: 17 -aliases: - - /rancher/v2.6/en/security/security-scan/ ---- - -Rancher can run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark. The CIS scans can run on any Kubernetes cluster, including hosted Kubernetes providers such as EKS, AKS, and GKE. - -The `rancher-cis-benchmark` app leverages kube-bench, an open-source tool from Aqua Security, to check clusters for CIS Kubernetes Benchmark compliance. Also, to generate a cluster-wide report, the application utilizes Sonobuoy for report aggregation. - -- [About the CIS Benchmark](#about-the-cis-benchmark) -- [About the Generated Report](#about-the-generated-report) -- [Test Profiles](#test-profiles) -- [About Skipped and Not Applicable Tests](#about-skipped-and-not-applicable-tests) -- [Roles-based Access Control](./rbac) -- [Configuration](./configuration) -- [How-to Guides](#how-to-guides) - - [Installing CIS Benchmark](#installing-cis-benchmark) - - [Uninstalling CIS Benchmark](#uninstalling-cis-benchmark) - - [Running a Scan](#running-a-scan) - - [Running a Scan Periodically on a Schedule](#running-a-scan-periodically-on-a-schedule) - - [Skipping Tests](#skipping-tests) - - [Viewing Reports](#viewing-reports) - - [Enabling Alerting for rancher-cis-benchmark](#enabling-alerting-for-rancher-cis-benchmark) - - [Configuring Alerts for a Periodic Scan on a Schedule](#configuring-alerts-for-a-periodic-scan-on-a-schedule) - - [Creating a Custom Benchmark Version for Running a Cluster Scan](#creating-a-custom-benchmark-version-for-running-a-cluster-scan) - - -# About the CIS Benchmark - -The Center for Internet Security is a 501(c\)(3) non-profit organization, formed in October 2000, with a mission to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace". The organization is headquartered in East Greenbush, New York, with members including large corporations, government agencies, and academic institutions. - -CIS Benchmarks are best practices for the secure configuration of a target system. CIS Benchmarks are developed through the generous volunteer efforts of subject matter experts, technology vendors, public and private community members, and the CIS Benchmark Development team. - -The official Benchmark documents are available through the CIS website. The sign-up form to access the documents is -here. - -# About the Generated Report - -Each scan generates a report can be viewed in the Rancher UI and can be downloaded in CSV format. - -By default, the CIS Benchmark v1.6 is used. - -The Benchmark version is included in the generated report. - -The Benchmark provides recommendations of two types: Automated and Manual. Recommendations marked as Manual in the Benchmark are not included in the generated report. - -Some tests are designated as "Not Applicable." These tests will not be run on any CIS scan because of the way that Rancher provisions RKE clusters. For information on how test results can be audited, and why some tests are designated to be not applicable, refer to Rancher's self-assessment guide for the corresponding Kubernetes version. - -The report contains the following information: - -| Column in Report | Description | -|------------------|-------------| -| `id` | The ID number of the CIS Benchmark. | -| `description` | The description of the CIS Benchmark test. | -| `remediation` | What needs to be fixed in order to pass the test. | -| `state` | Indicates if the test passed, failed, was skipped, or was not applicable. | -| `node_type` | The node role, which affects which tests are run on the node. Master tests are run on controlplane nodes, etcd tests are run on etcd nodes, and node tests are run on the worker nodes. | -| `audit` | This is the audit check that `kube-bench` runs for this test. | -| `audit_config` | Any configuration applicable to the audit script. | -| `test_info` | Test-related info as reported by `kube-bench`, if any. | -| `commands` | Test-related commands as reported by `kube-bench`, if any. | -| `config_commands` | Test-related configuration data as reported by `kube-bench`, if any. | -| `actual_value` | The test's actual value, present if reported by `kube-bench`. | -| `expected_result` | The test's expected result, present if reported by `kube-bench`. | - -Refer to the table in the cluster hardening guide for information on which versions of Kubernetes, the Benchmark, Rancher, and our cluster hardening guide correspond to each other. Also refer to the hardening guide for configuration files of CIS-compliant clusters and information on remediating failed tests. - -# Test Profiles - -The following profiles are available: - -- Generic CIS 1.5 -- Generic CIS 1.6 -- RKE permissive 1.5 -- RKE hardened 1.5 -- RKE permissive 1.6 -- RKE hardened 1.6 -- EKS -- GKE -- RKE2 permissive 1.5 -- RKE2 permissive 1.5 - -You also have the ability to customize a profile by saving a set of tests to skip. - -All profiles will have a set of not applicable tests that will be skipped during the CIS scan. These tests are not applicable based on how a RKE cluster manages Kubernetes. - -There are two types of RKE cluster scan profiles: - -- **Permissive:** This profile has a set of tests that have been will be skipped as these tests will fail on a default RKE Kubernetes cluster. Besides the list of skipped tests, the profile will also not run the not applicable tests. -- **Hardened:** This profile will not skip any tests, except for the non-applicable tests. - -The EKS and GKE cluster scan profiles are based on CIS Benchmark versions that are specific to those types of clusters. - -In order to pass the "Hardened" profile, you will need to follow the steps on the hardening guide and use the `cluster.yml` defined in the hardening guide to provision a hardened cluster. - -The default profile and the supported CIS benchmark version depends on the type of cluster that will be scanned: - -The `rancher-cis-benchmark` supports the CIS 1.6 Benchmark version. - -- For RKE Kubernetes clusters, the RKE Permissive 1.6 profile is the default. -- EKS and GKE have their own CIS Benchmarks published by `kube-bench`. The corresponding test profiles are used by default for those clusters. -- For RKE2 Kubernetes clusters, the RKE2 Permissive 1.5 profile is the default. -- For cluster types other than RKE, RKE2, EKS and GKE, the Generic CIS 1.5 profile will be used by default. - -# About Skipped and Not Applicable Tests - -For a list of skipped and not applicable tests, refer to this page. - -For now, only user-defined skipped tests are marked as skipped in the generated report. - -Any skipped tests that are defined as being skipped by one of the default profiles are marked as not applicable. - -# Roles-based Access Control - -For information about permissions, refer to this page. - -# Configuration - -For more information about configuring the custom resources for the scans, profiles, and benchmark versions, refer to this page. - -# How-to Guides - -- [Installing rancher-cis-benchmark](#installing-rancher-cis-benchmark) -- [Uninstalling rancher-cis-benchmark](#uninstalling-rancher-cis-benchmark) -- [Running a Scan](#running-a-scan) -- [Running a Scan Periodically on a Schedule](#running-a-scan-periodically-on-a-schedule) -- [Skipping Tests](#skipping-tests) -- [Viewing Reports](#viewing-reports) -- [Enabling Alerting for rancher-cis-benchmark](#enabling-alerting-for-rancher-cis-benchmark) -- [Configuring Alerts for a Periodic Scan on a Schedule](#configuring-alerts-for-a-periodic-scan-on-a-schedule) -- [Creating a Custom Benchmark Version for Running a Cluster Scan](#creating-a-custom-benchmark-version-for-running-a-cluster-scan) -### Installing CIS Benchmark - -1. In the upper left corner, click **☰ > Cluster Management**. -1. On the **Clusters** page, go to the cluster where you want to install CIS Benchmark and click **Explore**. -1. In the left navigation bar, click **Apps & Marketplace > Charts**. -1. Click **CIS Benchmark** -1. Click **Install**. - -**Result:** The CIS scan application is deployed on the Kubernetes cluster. - -### Uninstalling CIS Benchmark - -1. From the **Cluster Dashboard,** go to the left navigation bar and click **Apps & Marketplace > Installed Apps**. -1. Go to the `cis-operator-system` namespace and check the boxes next to `rancher-cis-benchmark-crd` and `rancher-cis-benchmark`. -1. Click **Delete** and confirm **Delete**. - -**Result:** The `rancher-cis-benchmark` application is uninstalled. - -### Running a Scan - -When a ClusterScan custom resource is created, it launches a new CIS scan on the cluster for the chosen ClusterScanProfile. - -Note: There is currently a limitation of running only one CIS scan at a time for a cluster. If you create multiple ClusterScan custom resources, they will be run one after the other by the operator, and until one scan finishes, the rest of the ClusterScan custom resources will be in the "Pending" state. - -To run a scan, - -1. In the upper left corner, click **☰ > Cluster Management**. -1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**. -1. Click **CIS Benchmark > Scan**. -1. Click **Create**. -1. Choose a cluster scan profile. The profile determines which CIS Benchmark version will be used and which tests will be performed. If you choose the Default profile, then the CIS Operator will choose a profile applicable to the type of Kubernetes cluster it is installed on. -1. Click **Create**. - -**Result:** A report is generated with the scan results. To see the results, click the name of the scan that appears. -### Running a Scan Periodically on a Schedule - -To run a ClusterScan on a schedule, - -1. In the upper left corner, click **☰ > Cluster Management**. -1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**. -1. Click **CIS Benchmark > Scan**. -1. Choose a cluster scan profile. The profile determines which CIS Benchmark version will be used and which tests will be performed. If you choose the Default profile, then the CIS Operator will choose a profile applicable to the type of Kubernetes cluster it is installed on. -1. Choose the option **Run scan on a schedule**. -1. Enter a valid cron schedule expression in the field **Schedule**. -1. Choose a **Retention** count, which indicates the number of reports maintained for this recurring scan. By default this count is 3. When this retention limit is reached, older reports will get purged. -1. Click **Create**. - -**Result:** The scan runs and reschedules to run according to the cron schedule provided. The **Next Scan** value indicates the next time this scan will run again. - -A report is generated with the scan results every time the scan runs. To see the latest results, click the name of the scan that appears. - -You can also see the previous reports by choosing the report from the **Reports** dropdown on the scan detail page. - -### Skipping Tests - -CIS scans can be run using test profiles with user-defined skips. - -To skip tests, you will create a custom CIS scan profile. A profile contains the configuration for the CIS scan, which includes the benchmark versions to use and any specific tests to skip in that benchmark. - -1. In the upper left corner, click **☰ > Cluster Management**. -1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**. -1. Click **CIS Benchmark > Profile**. -1. From here, you can create a profile in multiple ways. To make a new profile, click **Create** and fill out the form in the UI. To make a new profile based on an existing profile, go to the existing profile and click **⋮ Clone**. If you are filling out the form, add the tests to skip using the test IDs, using the relevant CIS Benchmark as a reference. If you are creating the new test profile as YAML, you will add the IDs of the tests to skip in the `skipTests` directive. You will also give the profile a name: - - ```yaml - apiVersion: cis.cattle.io/v1 - kind: ClusterScanProfile - metadata: - annotations: - meta.helm.sh/release-name: clusterscan-operator - meta.helm.sh/release-namespace: cis-operator-system - labels: - app.kubernetes.io/managed-by: Helm - name: "" - spec: - benchmarkVersion: cis-1.5 - skipTests: - - "1.1.20" - - "1.1.21" - ``` -1. Click **Create**. - -**Result:** A new CIS scan profile is created. - -When you [run a scan](#running-a-scan) that uses this profile, the defined tests will be skipped during the scan. The skipped tests will be marked in the generated report as `Skip`. - -### Viewing Reports - -To view the generated CIS scan reports, - -1. In the upper left corner, click **☰ > Cluster Management**. -1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**. -1. Click **CIS Benchmark > Scan**. -1. The **Scans** page will show the generated reports. To see a detailed report, go to a scan report and click the name. - -One can download the report from the Scans list or from the scan detail page. - -### Enabling Alerting for rancher-cis-benchmark - -Alerts can be configured to be sent out for a scan that runs on a schedule. - -> **Prerequisite:** -> -> Before enabling alerts for `rancher-cis-benchmark`, make sure to install the `rancher-monitoring` application and configure the Receivers and Routes. For more information, see [this section.]({{}}/rancher/v2.6/en/monitoring-alerting/configuration) -> -> While configuring the routes for `rancher-cis-benchmark` alerts, you can specify the matching using the key-value pair `job: rancher-cis-scan`. An example route configuration is [here.]({{}}/rancher/v2.6/en/monitoring-alerting/configuration/receiver/#example-route-config-for-cis-scan-alerts) - -While installing or upgrading the `rancher-cis-benchmark` Helm chart, set the following flag to `true` in the `values.yaml`: - -```yaml -alerts: - enabled: true -``` - -### Configuring Alerts for a Periodic Scan on a Schedule - -It is possible to run a ClusterScan on a schedule. - -A scheduled scan can also specify if you should receive alerts when the scan completes. - -Alerts are supported only for a scan that runs on a schedule. - -The CIS Benchmark application supports two types of alerts: - -- Alert on scan completion: This alert is sent out when the scan run finishes. The alert includes details including the ClusterScan's name and the ClusterScanProfile name. -- Alert on scan failure: This alert is sent out if there are some test failures in the scan run or if the scan is in a `Fail` state. - -> **Prerequisite:** -> -> Before enabling alerts for `rancher-cis-benchmark`, make sure to install the `rancher-monitoring` application and configure the Receivers and Routes. For more information, see [this section.]({{}}/rancher/v2.6/en/monitoring-alerting/configuration) -> -> While configuring the routes for `rancher-cis-benchmark` alerts, you can specify the matching using the key-value pair `job: rancher-cis-scan`. An example route configuration is [here.]({{}}/rancher/v2.6/en/monitoring-alerting/configuration/receiver/#example-route-config-for-cis-scan-alerts) - -To configure alerts for a scan that runs on a schedule, - -1. Please enable alerts on the `rancher-cis-benchmark` application (#enabling-alerting-for-rancher-cis-benchmark) -1. In the upper left corner, click **☰ > Cluster Management**. -1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**. -1. Click **CIS Benchmark > Scan**. -1. Click **Create**. -1. Choose a cluster scan profile. The profile determines which CIS Benchmark version will be used and which tests will be performed. If you choose the Default profile, then the CIS Operator will choose a profile applicable to the type of Kubernetes cluster it is installed on. -1. Choose the option **Run scan on a schedule**. -1. Enter a valid [cron schedule expression](https://en.wikipedia.org/wiki/Cron#CRON_expression) in the field **Schedule**. -1. Check the boxes next to the Alert types under **Alerting**. -1. Optional: Choose a **Retention Count**, which indicates the number of reports maintained for this recurring scan. By default this count is 3. When this retention limit is reached, older reports will get purged. -1. Click **Create**. - -**Result:** The scan runs and reschedules to run according to the cron schedule provided. Alerts are sent out when the scan finishes if routes and receiver are configured under `rancher-monitoring` application. - -A report is generated with the scan results every time the scan runs. To see the latest results, click the name of the scan that appears. - -### Creating a Custom Benchmark Version for Running a Cluster Scan - -There could be some Kubernetes cluster setups that require custom configurations of the Benchmark tests. For example, the path to the Kubernetes config files or certs might be different than the standard location where the upstream CIS Benchmarks look for them. - -It is now possible to create a custom Benchmark Version for running a cluster scan using the `rancher-cis-benchmark` application. - -For details, see [this page.](./custom-benchmark) diff --git a/content/rancher/v2.6/en/security/security-scan/_index.md b/content/rancher/v2.6/en/security/security-scan/_index.md new file mode 100644 index 00000000000..c5a3cdb21d4 --- /dev/null +++ b/content/rancher/v2.6/en/security/security-scan/_index.md @@ -0,0 +1,6 @@ +--- +title: Security Scans +weight: 299 +--- + +The documentation about CIS security scans has moved [here.]({{}}/rancher/v2.6/en/cis-scans) From 80ffb7f8d880af1b04975116d7917dcee94da4bc Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Sat, 1 Jan 2022 14:46:33 +0100 Subject: [PATCH 135/478] Restore CIS docs to its original place Signed-off-by: Guilherme Macedo --- content/rancher/v2.6/en/security/_index.md | 2 +- .../cis-scans/configuration/_index.md | 98 ------------------- .../cis-scans/custom-benchmark/_index.md | 84 ---------------- .../v2.6/en/security/cis-scans/rbac/_index.md | 50 ---------- .../cis-scans/skipped-tests/_index.md | 54 ---------- 5 files changed, 1 insertion(+), 287 deletions(-) delete mode 100644 content/rancher/v2.6/en/security/cis-scans/configuration/_index.md delete mode 100644 content/rancher/v2.6/en/security/cis-scans/custom-benchmark/_index.md delete mode 100644 content/rancher/v2.6/en/security/cis-scans/rbac/_index.md delete mode 100644 content/rancher/v2.6/en/security/cis-scans/skipped-tests/_index.md diff --git a/content/rancher/v2.6/en/security/_index.md b/content/rancher/v2.6/en/security/_index.md index f936f7d9461..1f121f11ed2 100644 --- a/content/rancher/v2.6/en/security/_index.md +++ b/content/rancher/v2.6/en/security/_index.md @@ -46,7 +46,7 @@ The Benchmark provides recommendations of two types: Automated and Manual. We ru When Rancher runs a CIS security scan on a cluster, it generates a report showing the results of each test, including a summary with the number of passed, skipped and failed tests. The report also includes remediation steps for any failed tests. -For details, refer to the section on [security scans.]({{}}/rancher/v2.6/en/security/cis-scans/) +For details, refer to the section on [security scans]({{}}/rancher/v2.6/en/cis-scans). ### SELinux RPM diff --git a/content/rancher/v2.6/en/security/cis-scans/configuration/_index.md b/content/rancher/v2.6/en/security/cis-scans/configuration/_index.md deleted file mode 100644 index 26df1932e25..00000000000 --- a/content/rancher/v2.6/en/security/cis-scans/configuration/_index.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: Configuration -weight: 3 ---- - -This configuration reference is intended to help you manage the custom resources created by the `rancher-cis-benchmark` application. These resources are used for performing CIS scans on a cluster, skipping tests, setting the test profile that will be used during a scan, and other customization. - -To configure the custom resources, go to the **Cluster Dashboard** To configure the CIS scans, - -1. In the upper left corner, click **☰ > Cluster Management**. -1. On the **Clusters** page, go to the cluster where you want to configure CIS scans and click **Explore**. -1. In the left navigation bar, click **CIS Benchmark**. - -### Scans - -A scan is created to trigger a CIS scan on the cluster based on the defined profile. A report is created after the scan is completed. - -When configuring a scan, you need to define the name of the scan profile that will be used with the `scanProfileName` directive. - -An example ClusterScan custom resource is below: - -```yaml -apiVersion: cis.cattle.io/v1 -kind: ClusterScan -metadata: - name: rke-cis -spec: - scanProfileName: rke-profile-hardened -``` - -### Profiles - -A profile contains the configuration for the CIS scan, which includes the benchmark version to use and any specific tests to skip in that benchmark. - -> By default, a few ClusterScanProfiles are installed as part of the `rancher-cis-benchmark` chart. If a user edits these default benchmarks or profiles, the next chart update will reset them back. So it is advisable for users to not edit the default ClusterScanProfiles. - -Users can clone the ClusterScanProfiles to create custom profiles. - -Skipped tests are listed under the `skipTests` directive. - -When you create a new profile, you will also need to give it a name. - -An example `ClusterScanProfile` is below: - -```yaml -apiVersion: cis.cattle.io/v1 -kind: ClusterScanProfile -metadata: - annotations: - meta.helm.sh/release-name: clusterscan-operator - meta.helm.sh/release-namespace: cis-operator-system - labels: - app.kubernetes.io/managed-by: Helm - name: "" -spec: - benchmarkVersion: cis-1.5 - skipTests: - - "1.1.20" - - "1.1.21" -``` - -### Benchmark Versions - -A benchmark version is the name of benchmark to run using `kube-bench`, as well as the valid configuration parameters for that benchmark. - -A `ClusterScanBenchmark` defines the CIS `BenchmarkVersion` name and test configurations. The `BenchmarkVersion` name is a parameter provided to the `kube-bench` tool. - -By default, a few `BenchmarkVersion` names and test configurations are packaged as part of the CIS scan application. When this feature is enabled, these default BenchmarkVersions will be automatically installed and available for users to create a ClusterScanProfile. - -> If the default BenchmarkVersions are edited, the next chart update will reset them back. Therefore we don't recommend editing the default ClusterScanBenchmarks. - -A ClusterScanBenchmark consists of the fields: - -- `ClusterProvider`: This is the cluster provider name for which this benchmark is applicable. For example: RKE, EKS, GKE, etc. Leave it empty if this benchmark can be run on any cluster type. -- `MinKubernetesVersion`: Specifies the cluster's minimum kubernetes version necessary to run this benchmark. Leave it empty if there is no dependency on a particular Kubernetes version. -- `MaxKubernetesVersion`: Specifies the cluster's maximum Kubernetes version necessary to run this benchmark. Leave it empty if there is no dependency on a particular k8s version. - -An example `ClusterScanBenchmark` is below: - -```yaml -apiVersion: cis.cattle.io/v1 -kind: ClusterScanBenchmark -metadata: - annotations: - meta.helm.sh/release-name: clusterscan-operator - meta.helm.sh/release-namespace: cis-operator-system - creationTimestamp: "2020-08-28T18:18:07Z" - generation: 1 - labels: - app.kubernetes.io/managed-by: Helm - name: cis-1.5 - resourceVersion: "203878" - selfLink: /apis/cis.cattle.io/v1/clusterscanbenchmarks/cis-1.5 - uid: 309e543e-9102-4091-be91-08d7af7fb7a7 -spec: - clusterProvider: "" - minKubernetesVersion: 1.15.0 -``` \ No newline at end of file diff --git a/content/rancher/v2.6/en/security/cis-scans/custom-benchmark/_index.md b/content/rancher/v2.6/en/security/cis-scans/custom-benchmark/_index.md deleted file mode 100644 index 36f70ccaa55..00000000000 --- a/content/rancher/v2.6/en/security/cis-scans/custom-benchmark/_index.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: Creating a Custom Benchmark Version for Running a Cluster Scan -weight: 4 ---- - -Each Benchmark Version defines a set of test configuration files that define the CIS tests to be run by the kube-bench tool. -The `rancher-cis-benchmark` application installs a few default Benchmark Versions which are listed under CIS Benchmark application menu. - -But there could be some Kubernetes cluster setups that require custom configurations of the Benchmark tests. For example, the path to the Kubernetes config files or certs might be different than the standard location where the upstream CIS Benchmarks look for them. - -It is now possible to create a custom Benchmark Version for running a cluster scan using the `rancher-cis-benchmark` application. - -When a cluster scan is run, you need to select a Profile which points to a specific Benchmark Version. - -Follow all the steps below to add a custom Benchmark Version and run a scan using it. - -1. [Prepare the Custom Benchmark Version ConfigMap](#1-prepare-the-custom-benchmark-version-configmap) -2. [Add a Custom Benchmark Version to a Cluster](#2-add-a-custom-benchmark-version-to-a-cluster) -3. [Create a New Profile for the Custom Benchmark Version](#3-create-a-new-profile-for-the-custom-benchmark-version) -4. [Run a Scan Using the Custom Benchmark Version](#4-run-a-scan-using-the-custom-benchmark-version) - -### 1. Prepare the Custom Benchmark Version ConfigMap - -To create a custom benchmark version, first you need to create a ConfigMap containing the benchmark version's config files and upload it to your Kubernetes cluster where you want to run the scan. - -To prepare a custom benchmark version ConfigMap, suppose we want to add a custom Benchmark Version named `foo`. - -1. Create a directory named `foo` and inside this directory, place all the config YAML files that the kube-bench tool looks for. For example, here are the config YAML files for a Generic CIS 1.5 Benchmark Version https://github.com/aquasecurity/kube-bench/tree/master/cfg/cis-1.5 -1. Place the complete `config.yaml` file, which includes all the components that should be tested. -1. Add the Benchmark version name to the `target_mapping` section of the `config.yaml`: - - ```yaml - target_mapping: - "foo": - - "master" - - "node" - - "controlplane" - - "etcd" - - "policies" - ``` -1. Upload this directory to your Kubernetes Cluster by creating a ConfigMap: - - ```yaml - kubectl create configmap -n foo --from-file= - ``` - -### 2. Add a Custom Benchmark Version to a Cluster - -1. In the upper left corner, click **☰ > Cluster Management**. -1. On the **Clusters** page, go to the cluster where you want to add a custom benchmark and click **Explore**. -1. In the left navigation bar, click **CIS Benchmark > Benchmark Version**. -1. Click **Create**. -1. Enter the **Name** and a description for your custom benchmark version. -1. Choose the cluster provider that your benchmark version applies to. -1. Choose the ConfigMap you have uploaded from the dropdown. -1. Add the minimum and maximum Kubernetes version limits applicable, if any. -1. Click **Create**. - -### 3. Create a New Profile for the Custom Benchmark Version - -To run a scan using your custom benchmark version, you need to add a new Profile pointing to this benchmark version. - -1. In the upper left corner, click **☰ > Cluster Management**. -1. On the **Clusters** page, go to the cluster where you want to add a custom benchmark and click **Explore**. -1. In the left navigation bar, click **CIS Benchmark > Profile**. -1. Click **Create**. -1. Provide a **Name** and description. In this example, we name it `foo-profile`. -1. Choose the Benchmark Version from the dropdown. -1. Click **Create**. - -### 4. Run a Scan Using the Custom Benchmark Version - -Once the Profile pointing to your custom benchmark version `foo` has been created, you can create a new Scan to run the custom test configs in the Benchmark Version. - -To run a scan, - -1. In the upper left corner, click **☰ > Cluster Management**. -1. On the **Clusters** page, go to the cluster where you want to add a custom benchmark and click **Explore**. -1. In the left navigation bar, click **CIS Benchmark > Scan**. -1. Click **Create**. -1. Choose the new cluster scan profile. -1. Click **Create**. - -**Result:** A report is generated with the scan results. To see the results, click the name of the scan that appears. diff --git a/content/rancher/v2.6/en/security/cis-scans/rbac/_index.md b/content/rancher/v2.6/en/security/cis-scans/rbac/_index.md deleted file mode 100644 index ad2b47bff2c..00000000000 --- a/content/rancher/v2.6/en/security/cis-scans/rbac/_index.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Roles-based Access Control -shortTitle: RBAC -weight: 3 ---- - -This section describes the permissions required to use the rancher-cis-benchmark App. - -The rancher-cis-benchmark is a cluster-admin only feature by default. - -However, the `rancher-cis-benchmark` chart installs these two default `ClusterRoles`: - -- cis-admin -- cis-view - -In Rancher, only cluster owners and global administrators have `cis-admin` access by default. - -Note: If you were using the `cis-edit` role added in Rancher v2.5 setup, it has now been removed since -Rancher v2.5.2 because it essentially is same as `cis-admin`. If you happen to create any clusterrolebindings -for `cis-edit`, please update them to use `cis-admin` ClusterRole instead. - -# Cluster-Admin Access - -Rancher CIS Scans is a cluster-admin only feature by default. -This means only the Rancher global admins, and the cluster’s cluster-owner can: - -- Install/Uninstall the rancher-cis-benchmark App -- See the navigation links for CIS Benchmark CRDs - ClusterScanBenchmarks, ClusterScanProfiles, ClusterScans -- List the default ClusterScanBenchmarks and ClusterScanProfiles -- Create/Edit/Delete new ClusterScanProfiles -- Create/Edit/Delete a new ClusterScan to run the CIS scan on the cluster -- View and Download the ClusterScanReport created after the ClusterScan is complete - - -# Summary of Default Permissions for Kubernetes Default Roles - -The rancher-cis-benchmark creates three `ClusterRoles` and adds the CIS Benchmark CRD access to the following default K8s `ClusterRoles`: - -| ClusterRole created by chart | Default K8s ClusterRole | Permissions given with Role -| ------------------------------| ---------------------------| ---------------------------| -| `cis-admin` | `admin`| Ability to CRUD clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR -| `cis-view` | `view `| Ability to List(R) clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR - - -By default only cluster-owner role will have ability to manage and use `rancher-cis-benchmark` feature. - -The other Rancher roles (cluster-member, project-owner, project-member) do not have any default permissions to manage and use rancher-cis-benchmark resources. - -But if a cluster-owner wants to delegate access to other users, they can do so by creating ClusterRoleBindings between these users and the above CIS ClusterRoles manually. -There is no automatic role aggregation supported for the `rancher-cis-benchmark` ClusterRoles. diff --git a/content/rancher/v2.6/en/security/cis-scans/skipped-tests/_index.md b/content/rancher/v2.6/en/security/cis-scans/skipped-tests/_index.md deleted file mode 100644 index f2b125c0262..00000000000 --- a/content/rancher/v2.6/en/security/cis-scans/skipped-tests/_index.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Skipped and Not Applicable Tests -weight: 3 ---- - -This section lists the tests that are skipped in the permissive test profile for RKE. - -> All the tests that are skipped and not applicable on this page will be counted as Not Applicable in the v2.5 generated report. The skipped test count will only mention the user-defined skipped tests. This allows user-skipped tests to be distinguished from the tests that are skipped by default in the RKE permissive test profile. - -# CIS Benchmark v1.5 - -### CIS Benchmark v1.5 Skipped Tests - -| Number | Description | Reason for Skipping | -| ---------- | ------------- | --------- | -| 1.1.12 | Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) | A system service account is required for etcd data directory ownership. Refer to Rancher's hardening guide for more details on how to configure this ownership. | -| 1.2.6 | Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers. | -| 1.2.16 | Ensure that the admission control plugin PodSecurityPolicy is set (Automated) | Enabling Pod Security Policy can cause applications to unexpectedly fail. | -| 1.2.33 | Ensure that the --encryption-provider-config argument is set as appropriate (Manual) | Enabling encryption changes how data can be recovered as data is encrypted. | -| 1.2.34 | Ensure that encryption providers are appropriately configured (Manual) | Enabling encryption changes how data can be recovered as data is encrypted. | -| 4.2.6 | Ensure that the --protect-kernel-defaults argument is set to true (Automated) | System level configurations are required before provisioning the cluster in order for this argument to be set to true. | -| 4.2.10 | Ensure that the--tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers. | -| 5.1.5 | Ensure that default service accounts are not actively used. (Automated) | Kubernetes provides default service accounts to be used. | -| 5.2.2 | Minimize the admission of containers wishing to share the host process ID namespace (Automated) | Enabling Pod Security Policy can cause applications to unexpectedly fail. | -| 5.2.3 | Minimize the admission of containers wishing to share the host IPC namespace (Automated) | Enabling Pod Security Policy can cause applications to unexpectedly fail. | -| 5.2.4 | Minimize the admission of containers wishing to share the host network namespace (Automated) | Enabling Pod Security Policy can cause applications to unexpectedly fail. | -| 5.2.5 | Minimize the admission of containers with allowPrivilegeEscalation (Automated) | Enabling Pod Security Policy can cause applications to unexpectedly fail. | -| 5.3.2 | Ensure that all Namespaces have Network Policies defined (Automated) | Enabling Network Policies can prevent certain applications from communicating with each other. | -| 5.6.4 | The default namespace should not be used (Automated) | Kubernetes provides a default namespace. | - -### CIS Benchmark v1.5 Not Applicable Tests - -| Number | Description | Reason for being not applicable | -| ---------- | ------------- | --------- | -| 1.1.1 | Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. All configuration is passed in as arguments at container run time. | -| 1.1.2 | Ensure that the API server pod specification file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. All configuration is passed in as arguments at container run time. | -| 1.1.3 | Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time. | -| 1.1.4 | Ensure that the controller manager pod specification file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time. | -| 1.1.5 | Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time. | -| 1.1.6 | Ensure that the scheduler pod specification file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time. | -| 1.1.7 | Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time. | -| 1.1.8 | Ensure that the etcd pod specification file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time. | -| 1.1.13 | Ensure that the admin.conf file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. | -| 1.1.14 | Ensure that the admin.conf file ownership is set to root:root (Automated) | Clusters provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. | -| 1.1.15 | Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time. | -| 1.1.16 | Ensure that the scheduler.conf file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time. | -| 1.1.17 | Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time. | -| 1.1.18 | Ensure that the controller-manager.conf file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time. | -| 1.3.6 | Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) | Clusters provisioned by RKE handles certificate rotation directly through RKE. | -| 4.1.1 | Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time. | -| 4.1.2 | Ensure that the kubelet service file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time. | -| 4.1.9 | Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Automated) | Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. All configuration is passed in as arguments at container run time. | -| 4.1.10 | Ensure that the kubelet configuration file ownership is set to root:root (Automated) | Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. All configuration is passed in as arguments at container run time. | -| 4.2.12 | Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) | Clusters provisioned by RKE handles certificate rotation directly through RKE. | \ No newline at end of file From 65a4eca58bd73f9c01232b85a5eae9f8c77e7853 Mon Sep 17 00:00:00 2001 From: Ansil H Date: Mon, 3 Jan 2022 12:35:15 +0530 Subject: [PATCH 136/478] Update _index.md Rancher 2.6 dashboard is not showing the API endpoint URL. Add the API URL to the doc until this gets fixed in the dashboard. --- content/rancher/v2.6/en/api/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/api/_index.md b/content/rancher/v2.6/en/api/_index.md index a69509ca17b..a4b56bd9478 100644 --- a/content/rancher/v2.6/en/api/_index.md +++ b/content/rancher/v2.6/en/api/_index.md @@ -5,7 +5,7 @@ weight: 24 ## How to use the API -The API has its own user interface accessible from a web browser. This is an easy way to see resources, perform actions, and see the equivalent cURL or HTTP request & response. To access it, click on your user avatar in the upper right corner. Under **API & Keys**, you can find the URL endpoint as well as create [API keys]({{}}/rancher/v2.6/en/user-settings/api-keys/). +The API has its own user interface accessible from a web browser. This is an easy way to see resources, perform actions, and see the equivalent cURL or HTTP request & response. To access it, click on your user avatar in the upper right corner. Under **API & Keys**, you can find the URL endpoint (`https:///v3`) as well as create [API keys]({{}}/rancher/v2.6/en/user-settings/api-keys/). ## Authentication @@ -63,4 +63,4 @@ You can use browser developer tools to capture how the Rancher API is called. Fo 1. On the **Network** tab, make sure **Fetch/XHR** is selected. 1. In the Rancher UI, click **Create**. In the developer tools, you should see a new network request with the name `cluster?_replace=true`. 1. Right-click `cluster?_replace=true` and click **Copy > Copy as cURL.** -1. Paste the result into any text editor. You will be able to see the POST request, including the URL it was sent to, all of the headers, and the full body of the request. This command can be used to create a cluster from the command line. Note: The request should be stored in a safe place because it contains credentials. \ No newline at end of file +1. Paste the result into any text editor. You will be able to see the POST request, including the URL it was sent to, all of the headers, and the full body of the request. This command can be used to create a cluster from the command line. Note: The request should be stored in a safe place because it contains credentials. From 8a131408bd15cdaa10469cc0bfa04b4f8537df74 Mon Sep 17 00:00:00 2001 From: Bastian Hofmann Date: Mon, 3 Jan 2022 13:18:11 +0100 Subject: [PATCH 137/478] Update quickstart docs * SSH keys are auto-generated (https://github.com/rancher/quickstart/pull/86) * Add documentation for missing variables * Rancher is installed in a K3s cluster * Align docs of different providers Fixes https://github.com/rancher/quickstart/issues/192 Signed-off-by: Bastian Hofmann --- .../deployment/amazon-aws-qs/_index.md | 26 ++-- .../deployment/digital-ocean-qs/_index.md | 24 ++- .../deployment/google-gcp-qs/_index.md | 137 ++++++++-------- .../deployment/microsoft-azure-qs/_index.md | 147 +++++++++--------- .../deployment/amazon-aws-qs/_index.md | 24 +-- .../deployment/digital-ocean-qs/_index.md | 24 +-- .../deployment/google-gcp-qs/_index.md | 135 ++++++++-------- .../deployment/hetzner-cloud-qs/_index.md | 23 +-- .../deployment/microsoft-azure-qs/_index.md | 145 ++++++++--------- 9 files changed, 345 insertions(+), 340 deletions(-) diff --git a/content/rancher/v2.5/en/quick-start-guide/deployment/amazon-aws-qs/_index.md b/content/rancher/v2.5/en/quick-start-guide/deployment/amazon-aws-qs/_index.md index c5f189a9542..6446beae767 100644 --- a/content/rancher/v2.5/en/quick-start-guide/deployment/amazon-aws-qs/_index.md +++ b/content/rancher/v2.5/en/quick-start-guide/deployment/amazon-aws-qs/_index.md @@ -2,10 +2,8 @@ title: Rancher AWS Quick Start Guide description: Read this step by step Rancher AWS guide to quickly deploy a Rancher Server with a single node cluster attached. weight: 100 -aliases: - - /rancher/v2.x/en/quick-start-guide/deployment/amazon-aws-qs/ --- -The following steps will quickly deploy a Rancher Server on AWS with a single node cluster attached. +The following steps will quickly deploy a Rancher server on AWS in a single-node K3s Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. ## Prerequisites @@ -21,25 +19,26 @@ The following steps will quickly deploy a Rancher Server on AWS with a single no 1. Clone [Rancher Quickstart](https://github.com/rancher/quickstart) to a folder using `git clone https://github.com/rancher/quickstart`. -1. Go into the AWS folder containing the terraform files by executing `cd quickstart/aws`. +2. Go into the AWS folder containing the terraform files by executing `cd quickstart/aws`. -1. Rename the `terraform.tfvars.example` file to `terraform.tfvars`. +3. Rename the `terraform.tfvars.example` file to `terraform.tfvars`. -1. Edit `terraform.tfvars` and customize the following variables: - - `aws_access_key` - Amazon AWS Access Key +4. Edit `terraform.tfvars` and customize the following variables: + - `aws_access_key` - Amazon AWS Access Key - `aws_secret_key` - Amazon AWS Secret Key - `rancher_server_admin_password` - Admin password for created Rancher server -1. **Optional:** Modify optional variables within `terraform.tfvars`. +5. **Optional:** Modify optional variables within `terraform.tfvars`. See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [AWS Quickstart Readme](https://github.com/rancher/quickstart/tree/master/aws) for more information. Suggestions include: - - `aws_region` - Amazon AWS region, choose the closest instead of the default + - `aws_region` - Amazon AWS region, choose the closest instead of the default (`us-east-1`) - `prefix` - Prefix for all created resources - `instance_type` - EC2 instance size used, minimum is `t3a.medium` but `t3a.large` or `t3a.xlarge` could be used if within budget + - `add_windows_node` - If true, an additional Windows worker node is added to the workload cluster -1. Run `terraform init`. +6. Run `terraform init`. -1. To initiate the creation of the environment, run `terraform apply --auto-approve`. Then wait for output similar to the following: +7. To initiate the creation of the environment, run `terraform apply --auto-approve`. Then wait for output similar to the following: ``` Apply complete! Resources: 16 added, 0 changed, 0 destroyed. @@ -51,11 +50,12 @@ Suggestions include: workload_node_ip = yy.yy.yy.yy ``` -1. Paste the `rancher_server_url` from the output above into the browser. Log in when prompted (default username is `admin`, use the password set in `rancher_server_admin_password`). +8. Paste the `rancher_server_url` from the output above into the browser. Log in when prompted (default username is `admin`, use the password set in `rancher_server_admin_password`). +9. ssh to the Rancher Server using the `id_rsa` key generated in `quickstart/aws`. #### Result -Two Kubernetes clusters are deployed into your AWS account, one running Rancher Server and the other ready for experimentation deployments. Please note that while this setup is a great way to explore Rancher functionality, a production setup should follow our high availability setup guidelines. +Two Kubernetes clusters are deployed into your AWS account, one running Rancher Server and the other ready for experimentation deployments. Please note that while this setup is a great way to explore Rancher functionality, a production setup should follow our high availability setup guidelines. SSH keys for the VMs are auto-generated and stored in the module directory. ### What's Next? diff --git a/content/rancher/v2.5/en/quick-start-guide/deployment/digital-ocean-qs/_index.md b/content/rancher/v2.5/en/quick-start-guide/deployment/digital-ocean-qs/_index.md index 2e3e94777df..ecaa80e2f85 100644 --- a/content/rancher/v2.5/en/quick-start-guide/deployment/digital-ocean-qs/_index.md +++ b/content/rancher/v2.5/en/quick-start-guide/deployment/digital-ocean-qs/_index.md @@ -2,10 +2,8 @@ title: Rancher DigitalOcean Quick Start Guide description: Read this step by step Rancher DigitalOcean guide to quickly deploy a Rancher Server with a single node cluster attached. weight: 100 -aliases: - - /rancher/v2.x/en/quick-start-guide/deployment/digital-ocean-qs/ --- -The following steps will quickly deploy a Rancher Server on DigitalOcean with a single node cluster attached. +The following steps will quickly deploy a Rancher server on DigitalOcean in a single-node K3s Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. ## Prerequisites @@ -21,25 +19,24 @@ The following steps will quickly deploy a Rancher Server on DigitalOcean with a 1. Clone [Rancher Quickstart](https://github.com/rancher/quickstart) to a folder using `git clone https://github.com/rancher/quickstart`. -1. Go into the DigitalOcean folder containing the terraform files by executing `cd quickstart/do`. +2. Go into the DigitalOcean folder containing the terraform files by executing `cd quickstart/do`. -1. Rename the `terraform.tfvars.example` file to `terraform.tfvars`. +3. Rename the `terraform.tfvars.example` file to `terraform.tfvars`. -1. Edit `terraform.tfvars` and customize the following variables: +4. Edit `terraform.tfvars` and customize the following variables: - `do_token` - DigitalOcean access key - `rancher_server_admin_password` - Admin password for created Rancher server -1. **Optional:** Modify optional variables within `terraform.tfvars`. +5. **Optional:** Modify optional variables within `terraform.tfvars`. See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [DO Quickstart Readme](https://github.com/rancher/quickstart/tree/master/do) for more information. Suggestions include: - - `do_region` - DigitalOcean region, choose the closest instead of the default + - `do_region` - DigitalOcean region, choose the closest instead of the default (`nyc1`) - `prefix` - Prefix for all created resources - `droplet_size` - Droplet size used, minimum is `s-2vcpu-4gb` but `s-4vcpu-8gb` could be used if within budget - - `ssh_key_file_name` - Use a specific SSH key instead of `~/.ssh/id_rsa` (public key is assumed to be `${ssh_key_file_name}.pub`) -1. Run `terraform init`. +6. Run `terraform init`. -1. To initiate the creation of the environment, run `terraform apply --auto-approve`. Then wait for output similar to the following: +7. To initiate the creation of the environment, run `terraform apply --auto-approve`. Then wait for output similar to the following: ``` Apply complete! Resources: 15 added, 0 changed, 0 destroyed. @@ -51,11 +48,12 @@ Suggestions include: workload_node_ip = yy.yy.yy.yy ``` -1. Paste the `rancher_server_url` from the output above into the browser. Log in when prompted (default username is `admin`, use the password set in `rancher_server_admin_password`). +8. Paste the `rancher_server_url` from the output above into the browser. Log in when prompted (default username is `admin`, use the password set in `rancher_server_admin_password`). +9. ssh to the Rancher Server using the `id_rsa` key generated in `quickstart/do`. #### Result -Two Kubernetes clusters are deployed into your DigitalOcean account, one running Rancher Server and the other ready for experimentation deployments. +Two Kubernetes clusters are deployed into your DigitalOcean account, one running Rancher Server and the other ready for experimentation deployments. Please note that while this setup is a great way to explore Rancher functionality, a production setup should follow our high availability setup guidelines. SSH keys for the VMs are auto-generated and stored in the module directory. ### What's Next? diff --git a/content/rancher/v2.5/en/quick-start-guide/deployment/google-gcp-qs/_index.md b/content/rancher/v2.5/en/quick-start-guide/deployment/google-gcp-qs/_index.md index 48eaec3b4ba..f24fa0574bb 100644 --- a/content/rancher/v2.5/en/quick-start-guide/deployment/google-gcp-qs/_index.md +++ b/content/rancher/v2.5/en/quick-start-guide/deployment/google-gcp-qs/_index.md @@ -1,69 +1,68 @@ ---- -title: Rancher GCP Quick Start Guide -description: Read this step by step Rancher GCP guide to quickly deploy a Rancher Server with a single node cluster attached. -weight: 100 -aliases: - - /rancher/v2.x/en/quick-start-guide/deployment/google-gcp-qs/ ---- -The following steps will quickly deploy a Rancher server on GCP in a single-node RKE Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. - -## Prerequisites - ->**Note** ->Deploying to Google GCP will incur charges. - -- [Google GCP Account](https://console.cloud.google.com/): A Google GCP Account is required to create resources for deploying Rancher and Kubernetes. -- [Google GCP Project](https://cloud.google.com/appengine/docs/standard/nodejs/building-app/creating-project): Use this link to follow a tutorial to create a GCP Project if you don't have one yet. -- [Google GCP Service Account](https://cloud.google.com/iam/docs/creating-managing-service-account-keys): Use this link and follow instructions to create a GCP service account and token file. -- [Terraform](https://www.terraform.io/downloads.html): Used to provision the server and cluster in Google GCP. - - -## Getting Started - -1. Clone [Rancher Quickstart](https://github.com/rancher/quickstart) to a folder using `git clone https://github.com/rancher/quickstart`. - -1. Go into the GCP folder containing the terraform files by executing `cd quickstart/gcp`. - -1. Rename the `terraform.tfvars.example` file to `terraform.tfvars`. - -1. Edit `terraform.tfvars` and customize the following variables: - - `gcp_account_json` - GCP service account file path and file name - - `rancher_server_admin_password` - Admin password for created Rancher server - -1. **Optional:** Modify optional variables within `terraform.tfvars`. -See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [GCP Quickstart Readme](https://github.com/rancher/quickstart/tree/master/gcp) for more information. -Suggestions include: - - `gcp_region` - Google GCP region, choose the closest instead of the default - - `prefix` - Prefix for all created resources - - `machine_type` - Compute instance size used, minimum is `n1-standard-1` but `n1-standard-2` or `n1-standard-4` could be used if within budget - - `ssh_key_file_name` - Use a specific SSH key instead of `~/.ssh/id_rsa` (public key is assumed to be `${ssh_key_file_name}.pub`) - -1. Run `terraform init`. - -1. To initiate the creation of the environment, run `terraform apply --auto-approve`. Then wait for output similar to the following: - - ``` - Apply complete! Resources: 16 added, 0 changed, 0 destroyed. - - Outputs: - - rancher_node_ip = xx.xx.xx.xx - rancher_server_url = https://rancher.xx.xx.xx.xx.sslip.io - workload_node_ip = yy.yy.yy.yy - ``` - -1. Paste the `rancher_server_url` from the output above into the browser. Log in when prompted (default username is `admin`, use the password set in `rancher_server_admin_password`). - -#### Result - -Two Kubernetes clusters are deployed into your GCP account, one running Rancher Server and the other ready for experimentation deployments. - -### What's Next? - -Use Rancher to create a deployment. For more information, see [Creating Deployments]({{< baseurl >}}/rancher/v2.5/en/quick-start-guide/workload). - -## Destroying the Environment - -1. From the `quickstart/gcp` folder, execute `terraform destroy --auto-approve`. - -2. Wait for confirmation that all resources have been destroyed. +--- +title: Rancher GCP Quick Start Guide +description: Read this step by step Rancher GCP guide to quickly deploy a Rancher Server with a single node cluster attached. +weight: 100 +--- +The following steps will quickly deploy a Rancher server on GCP in a single-node K3s Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. + +## Prerequisites + +>**Note** +>Deploying to Google GCP will incur charges. + +- [Google GCP Account](https://console.cloud.google.com/): A Google GCP Account is required to create resources for deploying Rancher and Kubernetes. +- [Google GCP Project](https://cloud.google.com/appengine/docs/standard/nodejs/building-app/creating-project): Use this link to follow a tutorial to create a GCP Project if you don't have one yet. +- [Google GCP Service Account](https://cloud.google.com/iam/docs/creating-managing-service-account-keys): Use this link and follow instructions to create a GCP service account and token file. +- [Terraform](https://www.terraform.io/downloads.html): Used to provision the server and cluster in Google GCP. + + +## Getting Started + +1. Clone [Rancher Quickstart](https://github.com/rancher/quickstart) to a folder using `git clone https://github.com/rancher/quickstart`. + +2. Go into the GCP folder containing the terraform files by executing `cd quickstart/gcp`. + +3. Rename the `terraform.tfvars.example` file to `terraform.tfvars`. + +4. Edit `terraform.tfvars` and customize the following variables: + - `gcp_account_json` - GCP service account file path and file name + - `rancher_server_admin_password` - Admin password for created Rancher server + +5. **Optional:** Modify optional variables within `terraform.tfvars`. +See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [GCP Quickstart Readme](https://github.com/rancher/quickstart/tree/master/gcp) for more information. +Suggestions include: + - `gcp_region` - Google GCP region, choose the closest instead of the default (`us-east4`) + - `gcp_zone` - Google GCP zone, choose the closest instead of the default (`us-east4-a`) + - `prefix` - Prefix for all created resources + - `machine_type` - Compute instance size used, minimum is `n1-standard-1` but `n1-standard-2` or `n1-standard-4` could be used if within budget + +6. Run `terraform init`. + +7. To initiate the creation of the environment, run `terraform apply --auto-approve`. Then wait for output similar to the following: + + ``` + Apply complete! Resources: 16 added, 0 changed, 0 destroyed. + + Outputs: + + rancher_node_ip = xx.xx.xx.xx + rancher_server_url = https://rancher.xx.xx.xx.xx.sslip.io + workload_node_ip = yy.yy.yy.yy + ``` + +8. Paste the `rancher_server_url` from the output above into the browser. Log in when prompted (default username is `admin`, use the password set in `rancher_server_admin_password`). +9. ssh to the Rancher Server using the `id_rsa` key generated in `quickstart/gcp`. + +#### Result + +Two Kubernetes clusters are deployed into your GCP account, one running Rancher Server and the other ready for experimentation deployments. Please note that while this setup is a great way to explore Rancher functionality, a production setup should follow our high availability setup guidelines. SSH keys for the VMs are auto-generated and stored in the module directory. + +### What's Next? + +Use Rancher to create a deployment. For more information, see [Creating Deployments]({{< baseurl >}}/rancher/v2.5/en/quick-start-guide/workload). + +## Destroying the Environment + +1. From the `quickstart/gcp` folder, execute `terraform destroy --auto-approve`. + +2. Wait for confirmation that all resources have been destroyed. diff --git a/content/rancher/v2.5/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md b/content/rancher/v2.5/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md index a77fede6147..4e397c24fed 100644 --- a/content/rancher/v2.5/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md +++ b/content/rancher/v2.5/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md @@ -1,73 +1,74 @@ ---- -title: Rancher Azure Quick Start Guide -description: Read this step by step Rancher Azure guide to quickly deploy a Rancher Server with a single node cluster attached. -weight: 100 -aliases: - - /rancher/v2.x/en/quick-start-guide/deployment/microsoft-azure-qs/ ---- - -The following steps will quickly deploy a Rancher server on Azure in a single-node RKE Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. - -## Prerequisites - ->**Note** ->Deploying to Microsoft Azure will incur charges. - -- [Microsoft Azure Account](https://azure.microsoft.com/en-us/free/): A Microsoft Azure Account is required to create resources for deploying Rancher and Kubernetes. -- [Microsoft Azure Subscription](https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/create-subscription#create-a-subscription-in-the-azure-portal): Use this link to follow a tutorial to create a Microsoft Azure subscription if you don't have one yet. -- [Micsoroft Azure Tenant](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-create-new-tenant): Use this link and follow instructions to create a Microsoft Azure tenant. -- [Microsoft Azure Client ID/Secret](https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal): Use this link and follow instructions to create a Microsoft Azure client and secret. -- [Terraform](https://www.terraform.io/downloads.html): Used to provision the server and cluster in Microsoft Azure. - - -## Getting Started - -1. Clone [Rancher Quickstart](https://github.com/rancher/quickstart) to a folder using `git clone https://github.com/rancher/quickstart`. - -1. Go into the Azure folder containing the terraform files by executing `cd quickstart/azure`. - -1. Rename the `terraform.tfvars.example` file to `terraform.tfvars`. - -1. Edit `terraform.tfvars` and customize the following variables: - - `azure_subscription_id` - Microsoft Azure Subscription ID - - `azure_client_id` - Microsoft Azure Client ID - - `azure_client_secret` - Microsoft Azure Client Secret - - `azure_tenant_id` - Microsoft Azure Tenant ID - - `rancher_server_admin_password` - Admin password for created Rancher server - -2. **Optional:** Modify optional variables within `terraform.tfvars`. -See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Azure Quickstart Readme](https://github.com/rancher/quickstart/tree/master/azure) for more information. -Suggestions include: - - `azure_location` - Microsoft Azure region, choose the closest instead of the default - - `prefix` - Prefix for all created resources - - `instance_type` - Compute instance size used, minimum is `Standard_DS2_v2` but `Standard_DS2_v3` or `Standard_DS3_v2` could be used if within budget - -1. Run `terraform init`. - -1. To initiate the creation of the environment, run `terraform apply --auto-approve`. Then wait for output similar to the following: - - ``` - Apply complete! Resources: 16 added, 0 changed, 0 destroyed. - - Outputs: - - rancher_node_ip = xx.xx.xx.xx - rancher_server_url = https://rancher.xx.xx.xx.xx.sslip.io - workload_node_ip = yy.yy.yy.yy - ``` - -1. Paste the `rancher_server_url` from the output above into the browser. Log in when prompted (default username is `admin`, use the password set in `rancher_server_admin_password`). -2. ssh to the Rancher Server using the `id_rsa` key generated in `quickstart/azure`. -#### Result - -Two Kubernetes clusters are deployed into your Azure account, one running Rancher Server and the other ready for experimentation deployments. - -### What's Next? - -Use Rancher to create a deployment. For more information, see [Creating Deployments]({{< baseurl >}}/rancher/v2.5/en/quick-start-guide/workload). - -## Destroying the Environment - -1. From the `quickstart/azure` folder, execute `terraform destroy --auto-approve`. - -2. Wait for confirmation that all resources have been destroyed. +--- +title: Rancher Azure Quick Start Guide +description: Read this step by step Rancher Azure guide to quickly deploy a Rancher Server with a single node cluster attached. +weight: 100 +--- + +The following steps will quickly deploy a Rancher server on Azure in a single-node K3s Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. + +## Prerequisites + +>**Note** +>Deploying to Microsoft Azure will incur charges. + +- [Microsoft Azure Account](https://azure.microsoft.com/en-us/free/): A Microsoft Azure Account is required to create resources for deploying Rancher and Kubernetes. +- [Microsoft Azure Subscription](https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/create-subscription#create-a-subscription-in-the-azure-portal): Use this link to follow a tutorial to create a Microsoft Azure subscription if you don't have one yet. +- [Micsoroft Azure Tenant](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-create-new-tenant): Use this link and follow instructions to create a Microsoft Azure tenant. +- [Microsoft Azure Client ID/Secret](https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal): Use this link and follow instructions to create a Microsoft Azure client and secret. +- [Terraform](https://www.terraform.io/downloads.html): Used to provision the server and cluster in Microsoft Azure. + + +## Getting Started + +1. Clone [Rancher Quickstart](https://github.com/rancher/quickstart) to a folder using `git clone https://github.com/rancher/quickstart`. + +2. Go into the Azure folder containing the terraform files by executing `cd quickstart/azure`. + +3. Rename the `terraform.tfvars.example` file to `terraform.tfvars`. + +4. Edit `terraform.tfvars` and customize the following variables: + - `azure_subscription_id` - Microsoft Azure Subscription ID + - `azure_client_id` - Microsoft Azure Client ID + - `azure_client_secret` - Microsoft Azure Client Secret + - `azure_tenant_id` - Microsoft Azure Tenant ID + - `rancher_server_admin_password` - Admin password for created Rancher server + +5. **Optional:** Modify optional variables within `terraform.tfvars`. +See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Azure Quickstart Readme](https://github.com/rancher/quickstart/tree/master/azure) for more information. +Suggestions include: + - `azure_location` - Microsoft Azure region, choose the closest instead of the default (`East US`) + - `prefix` - Prefix for all created resources + - `instance_type` - Compute instance size used, minimum is `Standard_DS2_v2` but `Standard_DS2_v3` or `Standard_DS3_v2` could be used if within budget + - `add_windows_node` - If true, an additional Windows worker node is added to the workload cluster + - `windows_admin_password` - The admin password of the windows worker node + +6. Run `terraform init`. + +7. To initiate the creation of the environment, run `terraform apply --auto-approve`. Then wait for output similar to the following: + + ``` + Apply complete! Resources: 16 added, 0 changed, 0 destroyed. + + Outputs: + + rancher_node_ip = xx.xx.xx.xx + rancher_server_url = https://rancher.xx.xx.xx.xx.sslip.io + workload_node_ip = yy.yy.yy.yy + ``` + +8. Paste the `rancher_server_url` from the output above into the browser. Log in when prompted (default username is `admin`, use the password set in `rancher_server_admin_password`). +9. ssh to the Rancher Server using the `id_rsa` key generated in `quickstart/azure`. + +#### Result + +Two Kubernetes clusters are deployed into your Azure account, one running Rancher Server and the other ready for experimentation deployments. Please note that while this setup is a great way to explore Rancher functionality, a production setup should follow our high availability setup guidelines. SSH keys for the VMs are auto-generated and stored in the module directory. + +### What's Next? + +Use Rancher to create a deployment. For more information, see [Creating Deployments]({{< baseurl >}}/rancher/v2.5/en/quick-start-guide/workload). + +## Destroying the Environment + +1. From the `quickstart/azure` folder, execute `terraform destroy --auto-approve`. + +2. Wait for confirmation that all resources have been destroyed. diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs/_index.md index 1a0bc66ec49..12861fb8575 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs/_index.md @@ -3,7 +3,7 @@ title: Rancher AWS Quick Start Guide description: Read this step by step Rancher AWS guide to quickly deploy a Rancher Server with a single node cluster attached. weight: 100 --- -The following steps will quickly deploy a Rancher Server on AWS with a single node cluster attached. +The following steps will quickly deploy a Rancher server on AWS in a single-node K3s Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. ## Prerequisites @@ -19,25 +19,26 @@ The following steps will quickly deploy a Rancher Server on AWS with a single no 1. Clone [Rancher Quickstart](https://github.com/rancher/quickstart) to a folder using `git clone https://github.com/rancher/quickstart`. -1. Go into the AWS folder containing the terraform files by executing `cd quickstart/aws`. +2. Go into the AWS folder containing the terraform files by executing `cd quickstart/aws`. -1. Rename the `terraform.tfvars.example` file to `terraform.tfvars`. +3. Rename the `terraform.tfvars.example` file to `terraform.tfvars`. -1. Edit `terraform.tfvars` and customize the following variables: +4. Edit `terraform.tfvars` and customize the following variables: - `aws_access_key` - Amazon AWS Access Key - `aws_secret_key` - Amazon AWS Secret Key - `rancher_server_admin_password` - Admin password for created Rancher server -1. **Optional:** Modify optional variables within `terraform.tfvars`. +5. **Optional:** Modify optional variables within `terraform.tfvars`. See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [AWS Quickstart Readme](https://github.com/rancher/quickstart/tree/master/aws) for more information. Suggestions include: - - `aws_region` - Amazon AWS region, choose the closest instead of the default + - `aws_region` - Amazon AWS region, choose the closest instead of the default (`us-east-1`) - `prefix` - Prefix for all created resources - `instance_type` - EC2 instance size used, minimum is `t3a.medium` but `t3a.large` or `t3a.xlarge` could be used if within budget + - `add_windows_node` - If true, an additional Windows worker node is added to the workload cluster -1. Run `terraform init`. +6. Run `terraform init`. -1. To initiate the creation of the environment, run `terraform apply --auto-approve`. Then wait for output similar to the following: +7. To initiate the creation of the environment, run `terraform apply --auto-approve`. Then wait for output similar to the following: ``` Apply complete! Resources: 16 added, 0 changed, 0 destroyed. @@ -45,15 +46,16 @@ Suggestions include: Outputs: rancher_node_ip = xx.xx.xx.xx - rancher_server_url = https://rancher.xx.xx.xx.xx.xip.io + rancher_server_url = https://rancher.xx.xx.xx.xx.sslip.io workload_node_ip = yy.yy.yy.yy ``` -1. Paste the `rancher_server_url` from the output above into the browser. Log in when prompted (default username is `admin`, use the password set in `rancher_server_admin_password`). +8. Paste the `rancher_server_url` from the output above into the browser. Log in when prompted (default username is `admin`, use the password set in `rancher_server_admin_password`). +9. ssh to the Rancher Server using the `id_rsa` key generated in `quickstart/aws`. #### Result -Two Kubernetes clusters are deployed into your AWS account, one running Rancher Server and the other ready for experimentation deployments. Please note that while this setup is a great way to explore Rancher functionality, a production setup should follow our high availability setup guidelines. +Two Kubernetes clusters are deployed into your AWS account, one running Rancher Server and the other ready for experimentation deployments. Please note that while this setup is a great way to explore Rancher functionality, a production setup should follow our high availability setup guidelines. SSH keys for the VMs are auto-generated and stored in the module directory. ### What's Next? diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/digital-ocean-qs/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/digital-ocean-qs/_index.md index 02384c1b601..b4a4a79dd5c 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/digital-ocean-qs/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/digital-ocean-qs/_index.md @@ -3,7 +3,7 @@ title: Rancher DigitalOcean Quick Start Guide description: Read this step by step Rancher DigitalOcean guide to quickly deploy a Rancher Server with a single node cluster attached. weight: 100 --- -The following steps will quickly deploy a Rancher Server on DigitalOcean with a single node cluster attached. +The following steps will quickly deploy a Rancher server on DigitalOcean in a single-node K3s Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. ## Prerequisites @@ -19,25 +19,24 @@ The following steps will quickly deploy a Rancher Server on DigitalOcean with a 1. Clone [Rancher Quickstart](https://github.com/rancher/quickstart) to a folder using `git clone https://github.com/rancher/quickstart`. -1. Go into the DigitalOcean folder containing the terraform files by executing `cd quickstart/do`. +2. Go into the DigitalOcean folder containing the terraform files by executing `cd quickstart/do`. -1. Rename the `terraform.tfvars.example` file to `terraform.tfvars`. +3. Rename the `terraform.tfvars.example` file to `terraform.tfvars`. -1. Edit `terraform.tfvars` and customize the following variables: +4. Edit `terraform.tfvars` and customize the following variables: - `do_token` - DigitalOcean access key - `rancher_server_admin_password` - Admin password for created Rancher server -1. **Optional:** Modify optional variables within `terraform.tfvars`. +5. **Optional:** Modify optional variables within `terraform.tfvars`. See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [DO Quickstart Readme](https://github.com/rancher/quickstart/tree/master/do) for more information. Suggestions include: - - `do_region` - DigitalOcean region, choose the closest instead of the default + - `do_region` - DigitalOcean region, choose the closest instead of the default (`nyc1`) - `prefix` - Prefix for all created resources - `droplet_size` - Droplet size used, minimum is `s-2vcpu-4gb` but `s-4vcpu-8gb` could be used if within budget - - `ssh_key_file_name` - Use a specific SSH key instead of `~/.ssh/id_rsa` (public key is assumed to be `${ssh_key_file_name}.pub`) -1. Run `terraform init`. +6. Run `terraform init`. -1. To initiate the creation of the environment, run `terraform apply --auto-approve`. Then wait for output similar to the following: +7. To initiate the creation of the environment, run `terraform apply --auto-approve`. Then wait for output similar to the following: ``` Apply complete! Resources: 15 added, 0 changed, 0 destroyed. @@ -45,15 +44,16 @@ Suggestions include: Outputs: rancher_node_ip = xx.xx.xx.xx - rancher_server_url = https://rancher.xx.xx.xx.xx.xip.io + rancher_server_url = https://rancher.xx.xx.xx.xx.sslip.io workload_node_ip = yy.yy.yy.yy ``` -1. Paste the `rancher_server_url` from the output above into the browser. Log in when prompted (default username is `admin`, use the password set in `rancher_server_admin_password`). +8. Paste the `rancher_server_url` from the output above into the browser. Log in when prompted (default username is `admin`, use the password set in `rancher_server_admin_password`). +9. ssh to the Rancher Server using the `id_rsa` key generated in `quickstart/do`. #### Result -Two Kubernetes clusters are deployed into your DigitalOcean account, one running Rancher Server and the other ready for experimentation deployments. +Two Kubernetes clusters are deployed into your DigitalOcean account, one running Rancher Server and the other ready for experimentation deployments. Please note that while this setup is a great way to explore Rancher functionality, a production setup should follow our high availability setup guidelines. SSH keys for the VMs are auto-generated and stored in the module directory. ### What's Next? diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/google-gcp-qs/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/google-gcp-qs/_index.md index fe13ba86aca..b6e27447feb 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/google-gcp-qs/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/google-gcp-qs/_index.md @@ -1,67 +1,68 @@ ---- -title: Rancher GCP Quick Start Guide -description: Read this step by step Rancher GCP guide to quickly deploy a Rancher Server with a single node cluster attached. -weight: 100 ---- -The following steps will quickly deploy a Rancher server on GCP in a single-node RKE Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. - -## Prerequisites - ->**Note** ->Deploying to Google GCP will incur charges. - -- [Google GCP Account](https://console.cloud.google.com/): A Google GCP Account is required to create resources for deploying Rancher and Kubernetes. -- [Google GCP Project](https://cloud.google.com/appengine/docs/standard/nodejs/building-app/creating-project): Use this link to follow a tutorial to create a GCP Project if you don't have one yet. -- [Google GCP Service Account](https://cloud.google.com/iam/docs/creating-managing-service-account-keys): Use this link and follow instructions to create a GCP service account and token file. -- [Terraform](https://www.terraform.io/downloads.html): Used to provision the server and cluster in Google GCP. - - -## Getting Started - -1. Clone [Rancher Quickstart](https://github.com/rancher/quickstart) to a folder using `git clone https://github.com/rancher/quickstart`. - -1. Go into the GCP folder containing the terraform files by executing `cd quickstart/gcp`. - -1. Rename the `terraform.tfvars.example` file to `terraform.tfvars`. - -1. Edit `terraform.tfvars` and customize the following variables: - - `gcp_account_json` - GCP service account file path and file name - - `rancher_server_admin_password` - Admin password for created Rancher server - -1. **Optional:** Modify optional variables within `terraform.tfvars`. -See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [GCP Quickstart Readme](https://github.com/rancher/quickstart/tree/master/gcp) for more information. -Suggestions include: - - `gcp_region` - Google GCP region, choose the closest instead of the default - - `prefix` - Prefix for all created resources - - `machine_type` - Compute instance size used, minimum is `n1-standard-1` but `n1-standard-2` or `n1-standard-4` could be used if within budget - - `ssh_key_file_name` - Use a specific SSH key instead of `~/.ssh/id_rsa` (public key is assumed to be `${ssh_key_file_name}.pub`) - -1. Run `terraform init`. - -1. To initiate the creation of the environment, run `terraform apply --auto-approve`. Then wait for output similar to the following: - - ``` - Apply complete! Resources: 16 added, 0 changed, 0 destroyed. - - Outputs: - - rancher_node_ip = xx.xx.xx.xx - rancher_server_url = https://rancher.xx.xx.xx.xx.xip.io - workload_node_ip = yy.yy.yy.yy - ``` - -1. Paste the `rancher_server_url` from the output above into the browser. Log in when prompted (default username is `admin`, use the password set in `rancher_server_admin_password`). - -#### Result - -Two Kubernetes clusters are deployed into your GCP account, one running Rancher Server and the other ready for experimentation deployments. - -### What's Next? - -Use Rancher to create a deployment. For more information, see [Creating Deployments]({{< baseurl >}}/rancher/v2.6/en/quick-start-guide/workload). - -## Destroying the Environment - -1. From the `quickstart/gcp` folder, execute `terraform destroy --auto-approve`. - -2. Wait for confirmation that all resources have been destroyed. +--- +title: Rancher GCP Quick Start Guide +description: Read this step by step Rancher GCP guide to quickly deploy a Rancher Server with a single node cluster attached. +weight: 100 +--- +The following steps will quickly deploy a Rancher server on GCP in a single-node K3s Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. + +## Prerequisites + +>**Note** +>Deploying to Google GCP will incur charges. + +- [Google GCP Account](https://console.cloud.google.com/): A Google GCP Account is required to create resources for deploying Rancher and Kubernetes. +- [Google GCP Project](https://cloud.google.com/appengine/docs/standard/nodejs/building-app/creating-project): Use this link to follow a tutorial to create a GCP Project if you don't have one yet. +- [Google GCP Service Account](https://cloud.google.com/iam/docs/creating-managing-service-account-keys): Use this link and follow instructions to create a GCP service account and token file. +- [Terraform](https://www.terraform.io/downloads.html): Used to provision the server and cluster in Google GCP. + + +## Getting Started + +1. Clone [Rancher Quickstart](https://github.com/rancher/quickstart) to a folder using `git clone https://github.com/rancher/quickstart`. + +2. Go into the GCP folder containing the terraform files by executing `cd quickstart/gcp`. + +3. Rename the `terraform.tfvars.example` file to `terraform.tfvars`. + +4. Edit `terraform.tfvars` and customize the following variables: + - `gcp_account_json` - GCP service account file path and file name + - `rancher_server_admin_password` - Admin password for created Rancher server + +5. **Optional:** Modify optional variables within `terraform.tfvars`. +See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [GCP Quickstart Readme](https://github.com/rancher/quickstart/tree/master/gcp) for more information. +Suggestions include: + - `gcp_region` - Google GCP region, choose the closest instead of the default (`us-east4`) + - `gcp_zone` - Google GCP zone, choose the closest instead of the default (`us-east4-a`) + - `prefix` - Prefix for all created resources + - `machine_type` - Compute instance size used, minimum is `n1-standard-1` but `n1-standard-2` or `n1-standard-4` could be used if within budget + +6. Run `terraform init`. + +7. To initiate the creation of the environment, run `terraform apply --auto-approve`. Then wait for output similar to the following: + + ``` + Apply complete! Resources: 16 added, 0 changed, 0 destroyed. + + Outputs: + + rancher_node_ip = xx.xx.xx.xx + rancher_server_url = https://rancher.xx.xx.xx.xx.sslip.io + workload_node_ip = yy.yy.yy.yy + ``` + +8. Paste the `rancher_server_url` from the output above into the browser. Log in when prompted (default username is `admin`, use the password set in `rancher_server_admin_password`). +9. ssh to the Rancher Server using the `id_rsa` key generated in `quickstart/gcp`. + +#### Result + +Two Kubernetes clusters are deployed into your GCP account, one running Rancher Server and the other ready for experimentation deployments. Please note that while this setup is a great way to explore Rancher functionality, a production setup should follow our high availability setup guidelines. SSH keys for the VMs are auto-generated and stored in the module directory. + +### What's Next? + +Use Rancher to create a deployment. For more information, see [Creating Deployments]({{< baseurl >}}/rancher/v2.6/en/quick-start-guide/workload). + +## Destroying the Environment + +1. From the `quickstart/gcp` folder, execute `terraform destroy --auto-approve`. + +2. Wait for confirmation that all resources have been destroyed. diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md index f0fc2c964a3..4ffbac48031 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md @@ -3,7 +3,7 @@ title: Rancher Hetzner Cloud Quick Start Guide description: Read this step by step Rancher Hetzner Cloud guide to quickly deploy a Rancher Server with a single node cluster attached. weight: 100 --- -The following steps will quickly deploy a Rancher Server on Hetzner Cloud with a single node cluster attached. +The following steps will quickly deploy a Rancher server on Hetzner Cloud in a single-node K3s Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. ## Prerequisites @@ -19,24 +19,24 @@ The following steps will quickly deploy a Rancher Server on Hetzner Cloud with a 1. Clone [Rancher Quickstart](https://github.com/rancher/quickstart) to a folder using `git clone https://github.com/rancher/quickstart`. -1. Go into the Hetzner folder containing the terraform files by executing `cd quickstart/hcloud`. +2. Go into the Hetzner folder containing the terraform files by executing `cd quickstart/hcloud`. -1. Rename the `terraform.tfvars.example` file to `terraform.tfvars`. +3. Rename the `terraform.tfvars.example` file to `terraform.tfvars`. -1. Edit `terraform.tfvars` and customize the following variables: +4. Edit `terraform.tfvars` and customize the following variables: - `hcloud_token` - Hetzner API access key - `rancher_server_admin_password` - Admin password for created Rancher server -1. **Optional:** Modify optional variables within `terraform.tfvars`. +5. **Optional:** Modify optional variables within `terraform.tfvars`. See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Hetzner Quickstart Readme](https://github.com/rancher/quickstart/tree/master/hcloud) for more information. Suggestions include: - `prefix` - Prefix for all created resources - `instance_type` - Instance type, minimum required is `cx21` - - `ssh_key_file_name` - Use a specific SSH key instead of `~/.ssh/id_rsa` (public key is assumed to be `${ssh_key_file_name}.pub`) + - `hcloud_location` - Hetzner Cloud location, choose the closest instead of the default (`fsn1`) -1. Run `terraform init`. +6. Run `terraform init`. -2. To initiate the creation of the environment, run `terraform apply --auto-approve`. Then wait for output similar to the following: +7. To initiate the creation of the environment, run `terraform apply --auto-approve`. Then wait for output similar to the following: ``` Apply complete! Resources: 15 added, 0 changed, 0 destroyed. @@ -44,15 +44,16 @@ Suggestions include: Outputs: rancher_node_ip = xx.xx.xx.xx - rancher_server_url = https://rancher.xx.xx.xx.xx.xip.io + rancher_server_url = https://rancher.xx.xx.xx.xx.sslip.io workload_node_ip = yy.yy.yy.yy ``` -3. Paste the `rancher_server_url` from the output above into the browser. Log in when prompted (default username is `admin`, use the password set in `rancher_server_admin_password`). +8. Paste the `rancher_server_url` from the output above into the browser. Log in when prompted (default username is `admin`, use the password set in `rancher_server_admin_password`). +9. ssh to the Rancher Server using the `id_rsa` key generated in `quickstart/hcloud`. #### Result -Two Kubernetes clusters are deployed into your Hetzner account, one running Rancher Server and the other ready for experimentation deployments. +Two Kubernetes clusters are deployed into your Hetzner account, one running Rancher Server and the other ready for experimentation deployments. Please note that while this setup is a great way to explore Rancher functionality, a production setup should follow our high availability setup guidelines. SSH keys for the VMs are auto-generated and stored in the module directory. ### What's Next? diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md index c3d758f9ccf..98d283756d9 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md @@ -1,71 +1,74 @@ ---- -title: Rancher Azure Quick Start Guide -description: Read this step by step Rancher Azure guide to quickly deploy a Rancher Server with a single node cluster attached. -weight: 100 ---- - -The following steps will quickly deploy a Rancher server on Azure in a single-node RKE Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. - -## Prerequisites - ->**Note** ->Deploying to Microsoft Azure will incur charges. - -- [Microsoft Azure Account](https://azure.microsoft.com/en-us/free/): A Microsoft Azure Account is required to create resources for deploying Rancher and Kubernetes. -- [Microsoft Azure Subscription](https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/create-subscription#create-a-subscription-in-the-azure-portal): Use this link to follow a tutorial to create a Microsoft Azure subscription if you don't have one yet. -- [Micsoroft Azure Tenant](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-create-new-tenant): Use this link and follow instructions to create a Microsoft Azure tenant. -- [Microsoft Azure Client ID/Secret](https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal): Use this link and follow instructions to create a Microsoft Azure client and secret. -- [Terraform](https://www.terraform.io/downloads.html): Used to provision the server and cluster in Microsoft Azure. - - -## Getting Started - -1. Clone [Rancher Quickstart](https://github.com/rancher/quickstart) to a folder using `git clone https://github.com/rancher/quickstart`. - -1. Go into the Azure folder containing the terraform files by executing `cd quickstart/azure`. - -1. Rename the `terraform.tfvars.example` file to `terraform.tfvars`. - -1. Edit `terraform.tfvars` and customize the following variables: - - `azure_subscription_id` - Microsoft Azure Subscription ID - - `azure_client_id` - Microsoft Azure Client ID - - `azure_client_secret` - Microsoft Azure Client Secret - - `azure_tenant_id` - Microsoft Azure Tenant ID - - `rancher_server_admin_password` - Admin password for created Rancher server - -2. **Optional:** Modify optional variables within `terraform.tfvars`. -See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Azure Quickstart Readme](https://github.com/rancher/quickstart/tree/master/azure) for more information. -Suggestions include: - - `azure_location` - Microsoft Azure region, choose the closest instead of the default - - `prefix` - Prefix for all created resources - - `instance_type` - Compute instance size used, minimum is `Standard_DS2_v2` but `Standard_DS2_v3` or `Standard_DS3_v2` could be used if within budget - -1. Run `terraform init`. - -1. To initiate the creation of the environment, run `terraform apply --auto-approve`. Then wait for output similar to the following: - - ``` - Apply complete! Resources: 16 added, 0 changed, 0 destroyed. - - Outputs: - - rancher_node_ip = xx.xx.xx.xx - rancher_server_url = https://rancher.xx.xx.xx.xx.xip.io - workload_node_ip = yy.yy.yy.yy - ``` - -1. Paste the `rancher_server_url` from the output above into the browser. Log in when prompted (default username is `admin`, use the password set in `rancher_server_admin_password`). -2. ssh to the Rancher Server using the `id_rsa` key generated in `quickstart/azure`. -#### Result - -Two Kubernetes clusters are deployed into your Azure account, one running Rancher Server and the other ready for experimentation deployments. - -### What's Next? - -Use Rancher to create a deployment. For more information, see [Creating Deployments]({{< baseurl >}}/rancher/v2.6/en/quick-start-guide/workload). - -## Destroying the Environment - -1. From the `quickstart/azure` folder, execute `terraform destroy --auto-approve`. - -2. Wait for confirmation that all resources have been destroyed. +--- +title: Rancher Azure Quick Start Guide +description: Read this step by step Rancher Azure guide to quickly deploy a Rancher Server with a single node cluster attached. +weight: 100 +--- + +The following steps will quickly deploy a Rancher server on Azure in a single-node K3s Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. + +## Prerequisites + +>**Note** +>Deploying to Microsoft Azure will incur charges. + +- [Microsoft Azure Account](https://azure.microsoft.com/en-us/free/): A Microsoft Azure Account is required to create resources for deploying Rancher and Kubernetes. +- [Microsoft Azure Subscription](https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/create-subscription#create-a-subscription-in-the-azure-portal): Use this link to follow a tutorial to create a Microsoft Azure subscription if you don't have one yet. +- [Micsoroft Azure Tenant](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-create-new-tenant): Use this link and follow instructions to create a Microsoft Azure tenant. +- [Microsoft Azure Client ID/Secret](https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal): Use this link and follow instructions to create a Microsoft Azure client and secret. +- [Terraform](https://www.terraform.io/downloads.html): Used to provision the server and cluster in Microsoft Azure. + + +## Getting Started + +1. Clone [Rancher Quickstart](https://github.com/rancher/quickstart) to a folder using `git clone https://github.com/rancher/quickstart`. + +2. Go into the Azure folder containing the terraform files by executing `cd quickstart/azure`. + +3. Rename the `terraform.tfvars.example` file to `terraform.tfvars`. + +4. Edit `terraform.tfvars` and customize the following variables: + - `azure_subscription_id` - Microsoft Azure Subscription ID + - `azure_client_id` - Microsoft Azure Client ID + - `azure_client_secret` - Microsoft Azure Client Secret + - `azure_tenant_id` - Microsoft Azure Tenant ID + - `rancher_server_admin_password` - Admin password for created Rancher server + +5. **Optional:** Modify optional variables within `terraform.tfvars`. +See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Azure Quickstart Readme](https://github.com/rancher/quickstart/tree/master/azure) for more information. +Suggestions include: + - `azure_location` - Microsoft Azure region, choose the closest instead of the default (`East US`) + - `prefix` - Prefix for all created resources + - `instance_type` - Compute instance size used, minimum is `Standard_DS2_v2` but `Standard_DS2_v3` or `Standard_DS3_v2` could be used if within budget + - `add_windows_node` - If true, an additional Windows worker node is added to the workload cluster + - `windows_admin_password` - The admin password of the windows worker node + +6. Run `terraform init`. + +7. To initiate the creation of the environment, run `terraform apply --auto-approve`. Then wait for output similar to the following: + + ``` + Apply complete! Resources: 16 added, 0 changed, 0 destroyed. + + Outputs: + + rancher_node_ip = xx.xx.xx.xx + rancher_server_url = https://rancher.xx.xx.xx.xx.sslip.io + workload_node_ip = yy.yy.yy.yy + ``` + +8. Paste the `rancher_server_url` from the output above into the browser. Log in when prompted (default username is `admin`, use the password set in `rancher_server_admin_password`). +9. ssh to the Rancher Server using the `id_rsa` key generated in `quickstart/azure`. + +#### Result + +Two Kubernetes clusters are deployed into your Azure account, one running Rancher Server and the other ready for experimentation deployments. Please note that while this setup is a great way to explore Rancher functionality, a production setup should follow our high availability setup guidelines. SSH keys for the VMs are auto-generated and stored in the module directory. + +### What's Next? + +Use Rancher to create a deployment. For more information, see [Creating Deployments]({{< baseurl >}}/rancher/v2.6/en/quick-start-guide/workload). + +## Destroying the Environment + +1. From the `quickstart/azure` folder, execute `terraform destroy --auto-approve`. + +2. Wait for confirmation that all resources have been destroyed. From c2681fac482eb25d4f120077bf868d4deb455ab8 Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Mon, 3 Jan 2022 13:22:00 +0100 Subject: [PATCH 138/478] Fix link Signed-off-by: Guilherme Macedo --- content/rancher/v2.6/en/security/hardening-guides/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/security/hardening-guides/_index.md b/content/rancher/v2.6/en/security/hardening-guides/_index.md index 509aad121c5..a3635419be5 100644 --- a/content/rancher/v2.6/en/security/hardening-guides/_index.md +++ b/content/rancher/v2.6/en/security/hardening-guides/_index.md @@ -10,4 +10,4 @@ aliases: - /rancher/v2.6/en/security/rancher-2.5/1.6-benchmark-2.5/ --- -Rancher v2.6 hardening guides are currently being updated. For the time being, please consult Rancher v2.5 [self-assessment and hardening guides]({{}}/rancher/v2.5/en/security/rancher-2.5) for more information. +Rancher v2.6 hardening guides are currently being updated. For the time being, please consult [Rancher v2.5 self-assessment and hardening guides]({{}}/rancher/v2.5/en/security/rancher-2.5) for more information. From 530a35802a8fa37933526fd4a9b331e17127d1ad Mon Sep 17 00:00:00 2001 From: Derek Nola Date: Mon, 3 Jan 2022 14:58:16 -0800 Subject: [PATCH 139/478] Duplicate note warning HA K3s about not enabling secrets later Signed-off-by: Derek Nola --- content/k3s/latest/en/security/secrets_encryption/_index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/k3s/latest/en/security/secrets_encryption/_index.md b/content/k3s/latest/en/security/secrets_encryption/_index.md index b91bc4d081a..c7a23d4f90c 100644 --- a/content/k3s/latest/en/security/secrets_encryption/_index.md +++ b/content/k3s/latest/en/security/secrets_encryption/_index.md @@ -87,6 +87,8 @@ The steps are the same for both embedded DB and external DB clusters. To rotate secrets encryption keys on HA setups: +>**Note:** Starting K3s without encryption and enabling it at a later time is currently *not* supported. + >**Note:** While not required, it is recommended that you pick one server node from which to run the `secrets-encrypt` commands. - Start up all three K3s servers with the `--secrets-encryption` flag. For brevity, the servers will be referred to as S1, S2, S3. From dd8a1960803f97690143afc0e9d7c5fa82a6f689 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 3 Jan 2022 15:21:23 -0800 Subject: [PATCH 140/478] Add note on disableSameOriginCheck --- content/rancher/v2.6/en/helm-charts/_index.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/content/rancher/v2.6/en/helm-charts/_index.md b/content/rancher/v2.6/en/helm-charts/_index.md index 68e52a68d9a..6ae40370bae 100644 --- a/content/rancher/v2.6/en/helm-charts/_index.md +++ b/content/rancher/v2.6/en/helm-charts/_index.md @@ -25,6 +25,18 @@ From the left sidebar select _"Repositories"_. These items represent helm repositories, and can be either traditional helm endpoints which have an index.yaml, or git repositories which will be cloned and can point to a specific branch. In order to use custom charts, simply add your repository here and they will become available in the Charts tab under the name of the repository. +> **Note:** Helm chart repositories with authentication +> +> As of Rancher v2.6.3, a new value `disableSameOriginCheck` has been added to the Repo.Spec. This allows users to bypass the same origin checks, sending the repository Authentication information as a Basic Auth Header with all API calls. This is not recommended but can be used as a temporary solution in cases of non-standard Helm chart repositories such as those that have redirects to a different origin URL. +> +> To use this feature for an existing Helm chart repository, click **⋮ > Edit YAML**. On the `spec` portion of the YAML file, add `disableSameOriginCheck` and set it to `true`. +> +> ```yaml +[...] +spec: + disableSameOriginCheck: true +[...] +``` ### Helm Compatibility From 1f1dfe1a02dc9c688974e16280059689b50dd2c9 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 3 Jan 2022 16:21:48 -0800 Subject: [PATCH 141/478] Add note on disableSameOriginCheck --- content/rancher/v2.5/en/helm-charts/_index.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/content/rancher/v2.5/en/helm-charts/_index.md b/content/rancher/v2.5/en/helm-charts/_index.md index e5e6ba7853e..8ca0ff4450f 100644 --- a/content/rancher/v2.5/en/helm-charts/_index.md +++ b/content/rancher/v2.5/en/helm-charts/_index.md @@ -50,6 +50,18 @@ From the left sidebar select _"Repositories"_. These items represent helm repositories, and can be either traditional helm endpoints which have an index.yaml, or git repositories which will be cloned and can point to a specific branch. In order to use custom charts, simply add your repository here and they will become available in the Charts tab under the name of the repository. +> **Note:** Helm chart repositories with authentication +> +> As of Rancher v2.5.12, a new value `disableSameOriginCheck` has been added to the Repo.Spec. This allows users to bypass the same origin checks, sending the repository Authentication information as a Basic Auth Header with all API calls. This is not recommended but can be used as a temporary solution in cases of non-standard Helm chart repositories such as those that have redirects to a different origin URL. +> +> To use this feature for an existing Helm chart repository, click **⋮ > Edit YAML**. On the `spec` portion of the YAML file, add `disableSameOriginCheck` and set it to `true`. +> +> ```yaml +[...] +spec: + disableSameOriginCheck: true +[...] +``` ### Helm Compatibility From 1142f69b7c5a8d3448b9025d3bee69f22b9ced6f Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 3 Jan 2022 16:35:13 -0800 Subject: [PATCH 142/478] Apply PR #3754 (a6d38d26) to Rancher v2.0-v2.4 and v2.5 docs --- .../en/admin-settings/config-private-registry/_index.md | 2 +- .../v2.5/en/admin-settings/config-private-registry/_index.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.0-v2.4/en/admin-settings/config-private-registry/_index.md b/content/rancher/v2.0-v2.4/en/admin-settings/config-private-registry/_index.md index d258e527c23..09779408bb8 100644 --- a/content/rancher/v2.0-v2.4/en/admin-settings/config-private-registry/_index.md +++ b/content/rancher/v2.0-v2.4/en/admin-settings/config-private-registry/_index.md @@ -4,7 +4,7 @@ weight: 400 aliases: --- -You might want to use a private Docker registry to share your custom base images within your organization. With a private registry, you can keep a private, consistent, and centralized source of truth for the Docker images that are used in your clusters. +You might want to use a private container registry to share your custom base images within your organization. With a private registry, you can keep a private, consistent, and centralized source of truth for the container images that are used in your clusters. There are two main ways to set up private registries in Rancher: by setting up the global default registry through the **Settings** tab in the global view, and by setting up a private registry in the advanced options in the cluster-level settings. The global default registry is intended to be used for air-gapped setups, for registries that do not require credentials. The cluster-level private registry is intended to be used in all setups in which the private registry requires credentials. diff --git a/content/rancher/v2.5/en/admin-settings/config-private-registry/_index.md b/content/rancher/v2.5/en/admin-settings/config-private-registry/_index.md index 378d84aea5f..d9b05763201 100644 --- a/content/rancher/v2.5/en/admin-settings/config-private-registry/_index.md +++ b/content/rancher/v2.5/en/admin-settings/config-private-registry/_index.md @@ -5,7 +5,7 @@ aliases: - /rancher/v2.x/en/admin-settings/config-private-registry/ --- -You might want to use a private Docker registry to share your custom base images within your organization. With a private registry, you can keep a private, consistent, and centralized source of truth for the Docker images that are used in your clusters. +You might want to use a private container registry to share your custom base images within your organization. With a private registry, you can keep a private, consistent, and centralized source of truth for the container images that are used in your clusters. There are two main ways to set up private registries in Rancher: by setting up the global default registry through the **Settings** tab in the global view, and by setting up a private registry in the advanced options in the cluster-level settings. The global default registry is intended to be used for air-gapped setups, for registries that do not require credentials. The cluster-level private registry is intended to be used in all setups in which the private registry requires credentials. From 95983c3e38eeb703c91b1f645c732e69bd5f5083 Mon Sep 17 00:00:00 2001 From: Flowbird-Joel-Harley <53900583+Flowbird-Joel-Harley@users.noreply.github.com> Date: Tue, 4 Jan 2022 14:28:01 +0000 Subject: [PATCH 143/478] Update _index.md Updated the sentence to make it easier to understand. --- .../best-practices/rancher-server/rancher-in-vsphere/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/best-practices/rancher-server/rancher-in-vsphere/_index.md b/content/rancher/v2.6/en/best-practices/rancher-server/rancher-in-vsphere/_index.md index 48d5459b691..6436cc92da9 100644 --- a/content/rancher/v2.6/en/best-practices/rancher-server/rancher-in-vsphere/_index.md +++ b/content/rancher/v2.6/en/best-practices/rancher-server/rancher-in-vsphere/_index.md @@ -50,7 +50,7 @@ https://rancher.com/docs/rancher/v2.6/en/installation/requirements/ ### Leverage VM Templates to Construct the Environment -To facilitate consistency across the deployed Virtual Machines across the environment, consider the use of "Golden Images" in the form of VM templates. Packer can be used to accomplish this, adding greater customisation options. +To facilitate the consistency of Virtual Machines deployed across the environment, consider the use of "Golden Images" in the form of VM templates. Packer can be used to accomplish this, adding greater customisation options. ### Leverage DRS Anti-Affinity Rules (Where Possible) to Separate Rancher Cluster Nodes Across ESXi Hosts From 9e46ab07bdbfe4757837f79f453a14551220f8e4 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 4 Jan 2022 10:29:13 -0500 Subject: [PATCH 144/478] Added note for 2.5 also --- .../best-practices/rancher-server/rancher-in-vsphere/_index.md | 2 +- .../best-practices/rancher-server/rancher-in-vsphere/_index.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.5/en/best-practices/rancher-server/rancher-in-vsphere/_index.md b/content/rancher/v2.5/en/best-practices/rancher-server/rancher-in-vsphere/_index.md index 9b987726412..d3db6045085 100644 --- a/content/rancher/v2.5/en/best-practices/rancher-server/rancher-in-vsphere/_index.md +++ b/content/rancher/v2.5/en/best-practices/rancher-server/rancher-in-vsphere/_index.md @@ -53,7 +53,7 @@ https://rancher.com/docs/rancher/v2.5/en/installation/requirements/ ### Leverage VM Templates to Construct the Environment -To facilitate consistency across the deployed Virtual Machines across the environment, consider the use of "Golden Images" in the form of VM templates. Packer can be used to accomplish this, adding greater customisation options. +To facilitate the consistency of Virtual Machines deployed across the environment, consider the use of "Golden Images" in the form of VM templates. Packer can be used to accomplish this, adding greater customization options. ### Leverage DRS Anti-Affinity Rules (Where Possible) to Separate Rancher Cluster Nodes Across ESXi Hosts diff --git a/content/rancher/v2.6/en/best-practices/rancher-server/rancher-in-vsphere/_index.md b/content/rancher/v2.6/en/best-practices/rancher-server/rancher-in-vsphere/_index.md index 6436cc92da9..207ab8accb2 100644 --- a/content/rancher/v2.6/en/best-practices/rancher-server/rancher-in-vsphere/_index.md +++ b/content/rancher/v2.6/en/best-practices/rancher-server/rancher-in-vsphere/_index.md @@ -50,7 +50,7 @@ https://rancher.com/docs/rancher/v2.6/en/installation/requirements/ ### Leverage VM Templates to Construct the Environment -To facilitate the consistency of Virtual Machines deployed across the environment, consider the use of "Golden Images" in the form of VM templates. Packer can be used to accomplish this, adding greater customisation options. +To facilitate the consistency of Virtual Machines deployed across the environment, consider the use of "Golden Images" in the form of VM templates. Packer can be used to accomplish this, adding greater customization options. ### Leverage DRS Anti-Affinity Rules (Where Possible) to Separate Rancher Cluster Nodes Across ESXi Hosts From f4bc78ee0c174e39598c006a8f7cd0ad37255260 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 4 Jan 2022 10:59:41 -0500 Subject: [PATCH 145/478] Grouped notes together as bullet points --- .../k3s/latest/en/security/secrets_encryption/_index.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/content/k3s/latest/en/security/secrets_encryption/_index.md b/content/k3s/latest/en/security/secrets_encryption/_index.md index c7a23d4f90c..a7491e2fb63 100644 --- a/content/k3s/latest/en/security/secrets_encryption/_index.md +++ b/content/k3s/latest/en/security/secrets_encryption/_index.md @@ -87,9 +87,11 @@ The steps are the same for both embedded DB and external DB clusters. To rotate secrets encryption keys on HA setups: ->**Note:** Starting K3s without encryption and enabling it at a later time is currently *not* supported. - ->**Note:** While not required, it is recommended that you pick one server node from which to run the `secrets-encrypt` commands. +>**Notes:** +> +> - Starting K3s without encryption and enabling it at a later time is currently *not* supported. +> +> - While not required, it is recommended that you pick one server node from which to run the `secrets-encrypt` commands. - Start up all three K3s servers with the `--secrets-encryption` flag. For brevity, the servers will be referred to as S1, S2, S3. From e9d7bbbe1061a40bda483506b4fcbc15e7802435 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 4 Jan 2022 18:00:05 +0000 Subject: [PATCH 146/478] Updated chart and removed monitoring-specific verbiage --- content/rancher/v2.6/en/helm-charts/_index.md | 48 +++++++------------ 1 file changed, 17 insertions(+), 31 deletions(-) diff --git a/content/rancher/v2.6/en/helm-charts/_index.md b/content/rancher/v2.6/en/helm-charts/_index.md index a41c062340f..c9bb859a5bc 100644 --- a/content/rancher/v2.6/en/helm-charts/_index.md +++ b/content/rancher/v2.6/en/helm-charts/_index.md @@ -7,50 +7,36 @@ In this section, you'll learn how to manage Helm chart repositories and applicat ### Changes in Rancher v2.6 -Starting in Rancher v2.6.0, a new versioning scheme for Rancher feature charts was implemented for Monitoring. The changes are centered around the major version of the charts and the +up annotation for upstream charts, where applicable. +Starting in Rancher v2.6.0, a new versioning scheme for Rancher feature charts was implemented. The changes are centered around the major version of the charts and the +up annotation for upstream charts, where applicable. **Major Version:** The major version of the charts is tied to Rancher minor versions. When you upgrade to a new Rancher minor version, you should ensure that all of your **Apps & Marketplace** charts are also upgraded to the correct release line for the chart. >**Note:** Any major versions that are less than the ones mentioned in the table below are meant for 2.5 and below only. For example, you are advised to not use <100.x.x versions of Monitoring in 2.6.x+. -**Feature Charts for Monitoring V2:** +**Feature Charts:** | **Name** | **Starting Major Version** | | ---------------- | ------------------ | -| rancher-vsphere-csi | 100.0.0 | -| rancher-vsphere-cpi | 100.0.0 | -| Logging V2 | 100.0.0+up3.12.0 | -| Monitoring V2 | 100.0.0+up16.6.0 | -| gke-operator | 100.0.0+up1.1.1 | -| aks-operator | 100.0.0+up1.0.1 | -| eks-operator | 100.0.0+up1.1.1 | -| rancher-backup | 2.0.0 | -| rancher-alerting-drivers | 100.0.0 | -| rancher-prom2teams | 100.0.0+up0.2.0 | -| rancher-sachet | 100.0.0 | -| rancher-cis-benchmark | 2.0.0 | -| fleet | 100.0.0+up0.3.6 | -| longhorn | 100.0.0+up1.1.2 | -| rancher-gatekeeper | 100.0.0+up3.5.1 | -| rancher-istio | 100.0.0+up1.10.4 | -| rancher-kiali-server | 100.0.0+up1.35.0 | -| rancher-tracing | 100.0.0 | -| rancher-pushprox | 100.0.0 | -| rancher-prometheus-adapter | 100.0.0+up2.14.0 | -| rancher-grafana | 100.0.0+up6.11.0 | -| rancher-windows-exporter | 100.0.0 | -| rancher-node-exporter | 100.0.0+up1.18.1 | -| rancher-kube-state-metrics | 100.0.0+up3.2.0 | +| rancher-alerting-drivers | 100.0.0 | +| rancher-cis-benchmark | 2.0.0 | +| external-ip-webhook | 100.0.0+up1.0.0 | +| harvester-cloud-provider | 100.0.0+up0.1.8 | +| harvester-csi-driver | 100.0.0+up0.1.9 | +| rancher-istio | 100.0.0+up1.10.4 | +| rancher-logging | 100.0.0+up3.12.0 | +| rancher-longhorn | 100.0.0+up1.1.2 | +| rancher-monitoring | 100.0.0+up16.6.0 | +| rancher-gatekeeper | 100.0.0+up3.5.1 | +| rancher-backups | 2.0.0 | | rancher-wins-upgrader | 100.0.0+up0.0.1 | -| system-upgrade-controller | 100.0.0+up0.3.0 | -| rancher-webhook | 1.0.0+up0.2.0 | -| external-ip-webhook | 100.0.0+up1.0.0 | -| rancher-sriov | 100.0.0+up0.1.0 | +| rancher-sriov (experimental) | 100.0.0+up0.1.0 | +| rancher-vsphere-cpi | 100.0.0 | +| rancher-vsphere-csi | 100.0.0 |
**Charts based on upstream:** For charts that are based on upstreams, the +up annotation should inform you of what upstream version the Rancher chart is tracking. Check the upstream version compatibility with Rancher during upgrades also. -- As an example, `100.x.x+up16.6.0` for Monitoring tracks upstream kube-prometheus-stack `16.6.0` with some Rancher patches added to it +- As an example, `100.x.x+up16.6.0` for Monitoring tracks upstream kube-prometheus-stack `16.6.0` with some Rancher patches added to it. - On upgrades, ensure that you are not downgrading the version of the chart that you are using. For example, if you are using a version of Monitoring > `16.6.0` in Rancher 2.5, you should not upgrade to `100.x.x+up16.6.0`. Instead, you should upgrade to the appropriate version in the next release. From e9ec9eaa9b650ae8d8d5cde698e7504888976682 Mon Sep 17 00:00:00 2001 From: Bastian Hofmann Date: Thu, 6 Jan 2022 09:47:16 +0100 Subject: [PATCH 147/478] Apply suggestions from code review Co-authored-by: Billy Tat --- .../en/quick-start-guide/deployment/amazon-aws-qs/_index.md | 4 ++-- .../quick-start-guide/deployment/digital-ocean-qs/_index.md | 2 +- .../en/quick-start-guide/deployment/google-gcp-qs/_index.md | 2 +- .../quick-start-guide/deployment/microsoft-azure-qs/_index.md | 2 +- .../en/quick-start-guide/deployment/amazon-aws-qs/_index.md | 2 +- .../quick-start-guide/deployment/digital-ocean-qs/_index.md | 2 +- .../en/quick-start-guide/deployment/google-gcp-qs/_index.md | 2 +- .../quick-start-guide/deployment/hetzner-cloud-qs/_index.md | 2 +- .../quick-start-guide/deployment/microsoft-azure-qs/_index.md | 2 +- 9 files changed, 10 insertions(+), 10 deletions(-) diff --git a/content/rancher/v2.5/en/quick-start-guide/deployment/amazon-aws-qs/_index.md b/content/rancher/v2.5/en/quick-start-guide/deployment/amazon-aws-qs/_index.md index 6446beae767..76eb149c8dc 100644 --- a/content/rancher/v2.5/en/quick-start-guide/deployment/amazon-aws-qs/_index.md +++ b/content/rancher/v2.5/en/quick-start-guide/deployment/amazon-aws-qs/_index.md @@ -1,6 +1,6 @@ --- title: Rancher AWS Quick Start Guide -description: Read this step by step Rancher AWS guide to quickly deploy a Rancher Server with a single node cluster attached. +description: Read this step by step Rancher AWS guide to quickly deploy a Rancher server with a single-node downstream Kubernetes cluster attached. weight: 100 --- The following steps will quickly deploy a Rancher server on AWS in a single-node K3s Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. @@ -51,7 +51,7 @@ Suggestions include: ``` 8. Paste the `rancher_server_url` from the output above into the browser. Log in when prompted (default username is `admin`, use the password set in `rancher_server_admin_password`). -9. ssh to the Rancher Server using the `id_rsa` key generated in `quickstart/aws`. +9. ssh to the Rancher server using the `id_rsa` key generated in `quickstart/aws`. #### Result diff --git a/content/rancher/v2.5/en/quick-start-guide/deployment/digital-ocean-qs/_index.md b/content/rancher/v2.5/en/quick-start-guide/deployment/digital-ocean-qs/_index.md index ecaa80e2f85..9e52022696c 100644 --- a/content/rancher/v2.5/en/quick-start-guide/deployment/digital-ocean-qs/_index.md +++ b/content/rancher/v2.5/en/quick-start-guide/deployment/digital-ocean-qs/_index.md @@ -1,6 +1,6 @@ --- title: Rancher DigitalOcean Quick Start Guide -description: Read this step by step Rancher DigitalOcean guide to quickly deploy a Rancher Server with a single node cluster attached. +description: Read this step by step Rancher DigitalOcean guide to quickly deploy a Rancher server with a single-node downstream Kubernetes cluster attached. weight: 100 --- The following steps will quickly deploy a Rancher server on DigitalOcean in a single-node K3s Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. diff --git a/content/rancher/v2.5/en/quick-start-guide/deployment/google-gcp-qs/_index.md b/content/rancher/v2.5/en/quick-start-guide/deployment/google-gcp-qs/_index.md index f24fa0574bb..5fbeb77edb8 100644 --- a/content/rancher/v2.5/en/quick-start-guide/deployment/google-gcp-qs/_index.md +++ b/content/rancher/v2.5/en/quick-start-guide/deployment/google-gcp-qs/_index.md @@ -1,6 +1,6 @@ --- title: Rancher GCP Quick Start Guide -description: Read this step by step Rancher GCP guide to quickly deploy a Rancher Server with a single node cluster attached. +description: Read this step by step Rancher GCP guide to quickly deploy a Rancher server with a single-node downstream Kubernetes cluster attached. weight: 100 --- The following steps will quickly deploy a Rancher server on GCP in a single-node K3s Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. diff --git a/content/rancher/v2.5/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md b/content/rancher/v2.5/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md index 4e397c24fed..fae660c2511 100644 --- a/content/rancher/v2.5/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md +++ b/content/rancher/v2.5/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md @@ -1,6 +1,6 @@ --- title: Rancher Azure Quick Start Guide -description: Read this step by step Rancher Azure guide to quickly deploy a Rancher Server with a single node cluster attached. +description: Read this step by step Rancher Azure guide to quickly deploy a Rancher server with a single-node downstream Kubernetes cluster attached. weight: 100 --- diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs/_index.md index 12861fb8575..faa98f548a5 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs/_index.md @@ -1,6 +1,6 @@ --- title: Rancher AWS Quick Start Guide -description: Read this step by step Rancher AWS guide to quickly deploy a Rancher Server with a single node cluster attached. +description: Read this step by step Rancher AWS guide to quickly deploy a Rancher server with a single-node downstream Kubernetes cluster attached. weight: 100 --- The following steps will quickly deploy a Rancher server on AWS in a single-node K3s Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/digital-ocean-qs/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/digital-ocean-qs/_index.md index b4a4a79dd5c..1fa897d157f 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/digital-ocean-qs/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/digital-ocean-qs/_index.md @@ -1,6 +1,6 @@ --- title: Rancher DigitalOcean Quick Start Guide -description: Read this step by step Rancher DigitalOcean guide to quickly deploy a Rancher Server with a single node cluster attached. +description: Read this step by step Rancher DigitalOcean guide to quickly deploy a Rancher server with a single-node downstream Kubernetes cluster attached. weight: 100 --- The following steps will quickly deploy a Rancher server on DigitalOcean in a single-node K3s Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/google-gcp-qs/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/google-gcp-qs/_index.md index b6e27447feb..7cbd4667640 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/google-gcp-qs/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/google-gcp-qs/_index.md @@ -1,6 +1,6 @@ --- title: Rancher GCP Quick Start Guide -description: Read this step by step Rancher GCP guide to quickly deploy a Rancher Server with a single node cluster attached. +description: Read this step by step Rancher GCP guide to quickly deploy a Rancher server with a single-node downstream Kubernetes cluster attached. weight: 100 --- The following steps will quickly deploy a Rancher server on GCP in a single-node K3s Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md index 4ffbac48031..1e37d2d23f2 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md @@ -1,6 +1,6 @@ --- title: Rancher Hetzner Cloud Quick Start Guide -description: Read this step by step Rancher Hetzner Cloud guide to quickly deploy a Rancher Server with a single node cluster attached. +description: Read this step by step Rancher Hetzner Cloud guide to quickly deploy a Rancher server with a single-node downstream Kubernetes cluster attached. weight: 100 --- The following steps will quickly deploy a Rancher server on Hetzner Cloud in a single-node K3s Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md index 98d283756d9..a0033fe5ca5 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md @@ -1,6 +1,6 @@ --- title: Rancher Azure Quick Start Guide -description: Read this step by step Rancher Azure guide to quickly deploy a Rancher Server with a single node cluster attached. +description: Read this step by step Rancher Azure guide to quickly deploy a Rancher server with a single-node downstream Kubernetes cluster attached. weight: 100 --- From ca7333b3003fccab399c93075f79538a0706372a Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Thu, 6 Jan 2022 18:26:48 +0000 Subject: [PATCH 148/478] Revised Monitoring V2 page in 2.5 --- .../how-monitoring-works/_index.md | 193 ++++++++---------- 1 file changed, 90 insertions(+), 103 deletions(-) diff --git a/content/rancher/v2.5/en/monitoring-alerting/how-monitoring-works/_index.md b/content/rancher/v2.5/en/monitoring-alerting/how-monitoring-works/_index.md index 6445df9e75a..f5b3cc0fe3f 100644 --- a/content/rancher/v2.5/en/monitoring-alerting/how-monitoring-works/_index.md +++ b/content/rancher/v2.5/en/monitoring-alerting/how-monitoring-works/_index.md @@ -11,52 +11,64 @@ weight: 1 # 1. Architecture Overview -This diagram shows how data flows through the Monitoring V2 application: +_**The following steps describe how data flows through the Monitoring V2 application:**_ -{{% row %}} -{{% column %}} +**1.** **ServiceMonitors and PodMonitors** declaratively specify targets, such as Services and Pods, that need to be monitored. -![How data flows through the monitoring application]({{}}/img/rancher/monitoring-v2-architecture-overview.svg) +- Targets are scraped on a recurring schedule based on the configured Prometheus scrape interval, and the metrics that are scraped are stored into the Prometheus Time Series Database (TSDB). +- In order to perform the scrape, ServiceMonitors and PodMonitors are defined with label selectors that determine which Services or Pods should be scraped and endpoints that determine how the scrape should happen on the given target, e.g., scrape/metrics in TCP 10252, proxying through IP addr x.x.x.x. +- Out of the box, Monitoring V2 comes with certain pre-configured exporters that are deployed based on the type of Kubernetes cluster that it is deployed on. + - Certain internal Kubernetes components are scraped via a proxy deployed as part of Monitoring V2 called **PushProx**. The Kubernetes components that expose metrics to Prometheus through PushProx are the following: `kube-controller-manager`, `kube-scheduler`, `etcd`, and `kube-proxy`. + - For each PushProx exporter, we deploy one PushProx client onto all target nodes. For example, a PushProx client is deployed onto all controlplane nodes for kube-controller-manager, all etcd nodes for kube-etcd, and all nodes for kubelet. + + - We deploy exactly one PushProx proxy per exporter. The process for exporting metrics is as follows: -{{% /column %}} -{{% column %}} + 1. The PushProx Client establishes an outbound connection with the PushProx Proxy. + 1. The client then polls the proxy for scrape requests that have come into the proxy. + 1. When the proxy receives a scrape request from Prometheus, the client sees it as a result of the poll. + 1. The client scrapes the internal component. + 1. The internal component responds by pushing metrics back to the proxy. + +
+
Process for Exporting Metrics with PushProx:
-1. Rules define what Prometheus metrics or time series database queries should result in alerts being fired. -2. ServiceMonitors and PodMonitors declaratively specify how services and pods should be monitored. They use labels to scrape metrics from pods. -3. Prometheus Operator observes ServiceMonitors, PodMonitors and PrometheusRules being created. -4. When the Prometheus configuration resources are created, Prometheus Operator calls the Prometheus API to sync the new configuration. -5. Recording Rules are not directly used for alerting. They create new time series of precomputed queries. These new time series data can then be queried to generate alerts. -6. Prometheus scrapes all targets in the scrape configuration on a recurring schedule based on the scrape interval, storing the results in its time series database.Depending on the Kubernetes master component and Kubernetes distribution, the metrics from a certain Kubernetes component could be directly exposed to Prometheus, proxied through PushProx, or not available. For details, see Scraping and Exposing Metrics. -7. Prometheus evaluates the alerting rules against the time series database. It fires alerts to Alertmanager whenever an alerting rule evaluates to a positive number. -8. Alertmanager uses routes to group, label and filter the fired alerts to translate them into useful notifications. -9. Alertmanager uses the Receiver configuration to send notifications to Slack, PagerDuty, SMS, or other types of receivers. + ![Process for Exporting Metrics with PushProx]({{}}/img/rancher/pushprox-process.svg) -{{% /column %}} -{{% /row %}} + For more information, see [Scraping and Exposing Metrics](#5-scraping-and-exposing-metrics). +**2.** **PrometheusRules** allow users to define rules for what metrics or time series database queries should result in alerts being fired. Rules are evaluated on an interval. +- **Recording rules** create a new time series based on existing series that have been collected. They are frequently used to precompute complex queries. +- **Alerting rules** run a particular query and fire an alert from Prometheus if the query evaluates to a non-zero value. + +**3.** **Prometheus Operator** observes ServiceMonitors, PodMonitors, and PrometheusRules being created. When the Prometheus configuration resources are created, Prometheus Operator calls the Prometheus API to sync the new configuration. + +**4.** Once Prometheus determines that an alert needs to be fired, alerts are forwarded to **Alertmanager**. + +- Alerts contain labels that come from the PromQL query itself and additional labels and annotations that can be provided as part of specifying the initial PrometheusRule. +- Before receiving any alerts, Alertmanager will use the **routes** and **receivers** specified in its configuration to form a routing tree on which all incoming alerts are evaluated. Each node of the routing tree can specify additional grouping, labeling, and filtering that needs to happen based on the labels attached to the Prometheus alert. A node on the routing tree (usually a leaf node) can also specify that an alert that reaches it needs to be sent out to a configured Receiver, e.g., Slack, PagerDuty, SMS, etc. Note that Alertmanager will send an alert first to **alertingDriver**, then alertingDriver will send or forward alert to the proper destination. +- Routes and receivers are also stored in the Kubernetes API via the Alertmanager Secret. When the Secret is updated, Alertmanager is also updated automatically. Note that routing occurs via labels only (not via annotations, etc.). + +
How data flows through the monitoring application:
# 2. How Prometheus Works -### 2.1. Storing Time Series Data +### Storing Time Series Data After collecting metrics from exporters, Prometheus stores the time series in a local on-disk time series database. Prometheus optionally integrates with remote systems, but `rancher-monitoring` uses local storage for the time series database. -The database can then be queried using PromQL, the query language for Prometheus. Grafana dashboards use PromQL queries to generate data visualizations. +Once stored, users can query this TSDB using PromQL, the query language for Prometheus. -### 2.2. Querying the Time Series Database +PromQL queries can be visualized in one of two ways: -The PromQL query language is the primary tool to query Prometheus for time series data. +1. By supplying the query in Prometheus's Graph UI, which will show a simple graphical view of the data. +1. By creating a Grafana Dashboard that contains the PromQL query and additional formatting directives that label axes, add units, change colors, use alternative visualizations, etc. -In Grafana, you can right-click a CPU utilization and click Inspect. This opens a panel that shows the [raw query results.](https://grafana.com/docs/grafana/latest/panels/inspect-panel/#inspect-raw-query-results)The raw results demonstrate how each dashboard is powered by PromQL queries. +### Defining Rules for Prometheus -### 2.3. Defining Rules for when Alerts Should be Fired - -Rules define the conditions for Prometheus to fire alerts. When PrometheusRule custom resources are created or updated, the Prometheus Operator observes the change and calls the Prometheus API to synchronize the rule configuration with the Alerting Rules and Recording Rules in Prometheus. - -When you define a Rule (which is declared within a RuleGroup in a PrometheusRule resource), the [spec of the Rule itself](https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/api.md#rule) contains labels that are used by Alertmanager to figure out which Route should receive this Alert. For example, an Alert with the label `team: front-end` will be sent to all Routes that match on that label. +Rules define queries that Prometheus needs to execute on a regular `evaluationInterval` to perform certain actions, such as firing an alert (alerting rules) or precomputing a query based on others existing in its TSDB (recording rules). These rules are encoded in PrometheusRules custom resources. When PrometheusRule custom resources are created or updated, the Prometheus Operator observes the change and calls the Prometheus API to synchronize the set of rules that Prometheus is currently evaluating on a regular interval. A PrometheusRule allows you to define one or more RuleGroups. Each RuleGroup consists of a set of Rule objects that can each represent either an alerting or a recording rule with the following fields: @@ -65,7 +77,9 @@ A PrometheusRule allows you to define one or more RuleGroups. Each RuleGroup con - Labels that should be attached to the alert or record that identify it (e.g. cluster name or severity) - Annotations that encode any additional important pieces of information that need to be displayed on the notification for an alert (e.g. summary, description, message, runbook URL, etc.). This field is not required for recording rules. -### 2.4. Firing Alerts +On evaluating a [rule](https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#rule), Prometheus will execute the provided PromQL query, add additional provided labels (or annotations - only for alerting rules), and execute the appropriate action for the rule. For example, an Alerting Rule that adds `team: front-end` as a label to the provided PromQL query will append that label to the fired alert, which will allow Alertmanager to forward the alert to the correct Receiver. + +### Alerting and Recording Rules Prometheus doesn't maintain the state of whether alerts are active. It fires alerts repetitively at every evaluation interval, relying on Alertmanager to group and filter the alerts into meaningful notifications. @@ -90,14 +104,18 @@ The Alertmanager handles alerts sent by client applications such as the Promethe - Silencing and inhibition of alerts - Tracking alerts that fire over time - Sending out the status of whether an alert is currently firing, or if it is resolved + +### Alerts Forwarded by alertingDrivers + +When alertingDrivers are installed, this creates a `Service` that can be used as the receiver's URL for Teams or SMS, based on the alertingDriver's configuration. The URL in the Receiver points to the alertingDrivers; so the Alertmanager sends alert first to alertingDriver, then alertingDriver forwards or sends alert to the proper destination. -### 3.1. Routing Alerts to Receivers +### Routing Alerts to Receivers Alertmanager coordinates where alerts are sent. It allows you to group alerts based on labels and fire them based on whether certain labels are matched. One top-level route accepts all alerts. From there, Alertmanager continues routing alerts to receivers based on whether they match the conditions of the next route. -While the Rancher UI forms only allow editing a routing tree that is two levels deep, you can configure more deeply nested routing structures by editing the Alertmanager custom resource YAML. +While the Rancher UI forms only allow editing a routing tree that is two levels deep, you can configure more deeply nested routing structures by editing the Alertmanager Secret. -### 3.2. Configuring Multiple Receivers +### Configuring Multiple Receivers By editing the forms in the Rancher UI, you can set up a Receiver resource with all the information Alertmanager needs to send alerts to your notification system. @@ -105,124 +123,93 @@ By editing custom YAML in the Alertmanager or Receiver configuration, you can al # 4. Monitoring V2 Specific Components -Prometheus Operator introduces a set of [Custom Resource Definitions](https://github.com/prometheus-operator/prometheus-operator#customresourcedefinitions) that allow users to deploy and manage Prometheus and Alertmanager instances by creating and modifying those custom resources on a cluster. +Prometheus Operator introduces a set of [Custom Resource Definitions](https://github.com/prometheus-operator/prometheus-operator#customresourcedefinitions) that allow users to deploy and manage Prometheus and Alertmanager instances by creating and modifying those custom resources on a cluster. Prometheus Operator will automatically update your Prometheus configuration based on the live state of the resources and configuration options that are edited in the Rancher UI. -### 4.1. Resources Deployed by Default +### Resources Deployed by Default By default, a set of resources curated by the [kube-prometheus](https://github.com/prometheus-operator/kube-prometheus) project are deployed onto your cluster as part of installing the Rancher Monitoring Application to set up a basic Monitoring/Alerting stack. The resources that get deployed onto your cluster to support this solution can be found in the [`rancher-monitoring`](https://github.com/rancher/charts/tree/main/charts/rancher-monitoring) Helm chart, which closely tracks the upstream [kube-prometheus-stack](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack) Helm chart maintained by the Prometheus community with certain changes tracked in the [CHANGELOG.md](https://github.com/rancher/charts/blob/main/charts/rancher-monitoring/CHANGELOG.md). -There are also certain special types of ConfigMaps and Secrets such as those corresponding to Grafana Dashboards, Grafana Datasources, and Alertmanager Configs that will automatically update your Prometheus configuration via sidecar proxies that observe the live state of those resources within your cluster. +### Default Exporters -### 4.2. PushProx +Monitoring V2 deploys three default exporters that provide additional metrics for Prometheus to store: -PushProx enhances the security of the monitoring application, allowing it to be installed on hardened Kubernetes clusters. +1. `node-exporter`: exposes hardware and OS metrics for Linux hosts. For more information on `node-exporter`, refer to the [upstream documentation.](https://prometheus.io/docs/guides/node-exporter/) -To expose Kubernetes metrics, PushProxes use a client proxy model to expose specific ports within default Kubernetes components. Node exporters expose metrics to PushProx through an outbound connection. +1. `windows-exporter`: exposes hardware and OS metrics for Windows hosts (only deployed on Windows clusters). -The proxy allows `rancher-monitoring` to scrape metrics from processes on the hostNetwork, such as the `kube-api-server`, without opening up node ports to inbound connections. +1. [kube-state-metrics](https://github.com/kubernetes/kube-state-metrics): expose additional metrics that track the state of resources contained in the Kubernetes API (e.g. pods, workloads, etc.). -PushProx is a DaemonSet that listens for clients that seek to register. Once registered, it proxies scrape requests through the established connection. Then the client executes the request to etcd. +ServiceMonitors and PodMonitors will scrape these exporters, as defined [here](#defining-what-metrics-are-scraped). Prometheus stores these metrics, and you can query the results via either Prometheus's UI or Grafana. -All of the default ServiceMonitors, such as `rancher-monitoring-kube-controller-manager`, are configured to hit the metrics endpoint of the client using this proxy. +See [architecture](#1-architecture-overview) section for more information on recording rules, alerting rules, and Alertmanager. -For more details about how PushProx works, refer to [Scraping Metrics with PushProx.](#5-5-scraping-metrics-with-pushprox) - - -### 4.3. Default Exporters - -`rancher-monitoring` deploys two exporters to expose metrics to prometheus: `node-exporter` and `windows-exporter`. Both are deployed as DaemonSets. - -`node-exporter` exports container, pod and node metrics for CPU and memory from each Linux node. `windows-exporter` does the same, but for Windows nodes. - -For more information on `node-exporter`, refer to the [upstream documentation.](https://prometheus.io/docs/guides/node-exporter/) - -[kube-state-metrics](https://github.com/kubernetes/kube-state-metrics) is also useful because it exports metrics for Kubernetes components. - -### 4.4. Components Exposed in the Rancher UI +### Components Exposed in the Rancher UI When the monitoring application is installed, you will be able to edit the following components in the Rancher UI: | Component | Type of Component | Purpose and Common Use Cases for Editing | |--------------|------------------------|---------------------------| -| ServiceMonitor | Custom resource | Set up targets to scrape custom metrics from. Automatically updates the scrape configuration in the Prometheus custom resource. | -| PodMonitor | Custom resource | Set up targets to scrape custom metrics from. Automatically updates the scrape configuration in the Prometheus custom resource. | -| Receiver | Configuration block (part of Alertmanager) | Set up a notification system to receive alerts. Automatically updates the Alertmanager custom resource. | -| Route | Configuration block (part of Alertmanager) | Add identifying information to make alerts more meaningful and direct them to individual teams. Automatically updates the Alertmanager custom resource. | -| PrometheusRule | Custom resource | For more advanced use cases, you may want to define what Prometheus metrics or time series database queries should result in alerts being fired. Automatically updates the Prometheus custom resource. | -| Alertmanager | Custom resource | Edit this custom resource only if you need more advanced configuration options beyond what the Rancher UI exposes in the Routes and Receivers sections. For example, you might want to edit this resource to add a routing tree with more than two levels. | -| Prometheus | Custom resource | Edit this custom resource only if you need more advanced configuration beyond what can be configured using ServiceMonitors, PodMonitors, or [Rancher monitoring Helm chart options.](../configuration/helm-chart-options) | +| ServiceMonitor | Custom resource | Sets up Kubernetes Services to scrape custom metrics from. Automatically updates the scrape configuration in the Prometheus custom resource. | +| PodMonitor | Custom resource | Sets up Kubernetes Pods to scrape custom metrics from. Automatically updates the scrape configuration in the Prometheus custom resource. | +| Receiver | Configuration block (part of Alertmanager) | Modifies information on where to send an alert (e.g. Slack, PagerDuty, etc.) and any necessary information to send the alert (e.g. TLS certs, proxy URLs, etc.). Automatically updates the Alertmanager custom resource. | +| Route | Configuration block (part of Alertmanager) | Modifies the routing tree that is used to filter, label, and group alerts based on labels and send them to the appropriate Receiver. Automatically updates the Alertmanager custom resource. | +| PrometheusRule | Custom resource | Defines additional queries that need to trigger alerts or define materialized views of existing series that are within Prometheus's TSDB. Automatically updates the Prometheus custom resource. | + +### How PushProx Works + +PushProx allows Prometheus to scrape metrics across a network boundary, which prevents users from having to expose metrics ports for internal Kubernetes components on each node in a Kubernetes cluster. + +Since the metrics for Kubernetes components are generally exposed on the host network of nodes in the cluster, PushProx deploys a DaemonSet of clients that sit on the hostNetwork of each node and make an outbound connection to a single proxy that is sitting on the Kubernetes API. Prometheus can then be configured to proxy scrape requests through the proxy to each client, which allows it to scrape metrics from the internal Kubernetes components without requiring any inbound node ports to be open. + +For more details about how PushProx works, refer to [Scraping Metrics with PushProx](#scraping-metrics-with-pushprox). # 5. Scraping and Exposing Metrics -### 5.1. Defining what Metrics are Scraped +### Defining what Metrics are Scraped -ServiceMonitors define targets that are intended for Prometheus to scrape. The [Prometheus custom resource tells](https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/design.md#prometheus) Prometheus which ServiceMonitors it should use to find out where to scrape metrics from. +ServiceMonitors and PodMonitors define targets that are intended for Prometheus to scrape. The [Prometheus custom resource](https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/design.md#prometheus) tells Prometheus which ServiceMonitors or PodMonitors it should use to find out where to scrape metrics from. -The Prometheus Operator observes the ServiceMonitors. When it observes that ServiceMonitors are created or updated, it calls the Prometheus API to update the scrape configuration in the Prometheus custom resource and keep it in sync with the scrape configuration in the ServiceMonitors. This scrape configuration tells Prometheus which endpoints to scrape metrics from and how it will label the metrics from those endpoints. +The Prometheus Operator observes the ServiceMonitors and PodMonitors. When it observes that they are created or updated, it calls the Prometheus API to update the scrape configuration in the Prometheus custom resource and keep it in sync with the scrape configuration in the ServiceMonitors or PodMonitors. This scrape configuration tells Prometheus which endpoints to scrape metrics from and how it will label the metrics from those endpoints. Prometheus scrapes all of the metrics defined in its scrape configuration at every `scrape_interval`, which is one minute by default. The scrape configuration can be viewed as part of the Prometheus custom resource that is exposed in the Rancher UI. -### 5.2. How the Prometheus Operator Sets up Metrics Scraping +### How the Prometheus Operator Sets up Metrics Scraping The Prometheus Deployment or StatefulSet scrapes metrics, and the configuration of Prometheus is controlled by the Prometheus custom resources. The Prometheus Operator watches for Prometheus and Alertmanager resources, and when they are created, the Prometheus Operator creates a Deployment or StatefulSet for Prometheus or Alertmanager with the user-defined configuration. -
How the Prometheus Operator Sets up Metrics Scraping
+When the Prometheus Operator observes ServiceMonitors, PodMonitors, and PrometheusRules being created, it knows that the scrape configuration needs to be updated in Prometheus. It updates Prometheus by first updating the configuration and rules files in the volumes of Prometheus's Deployment or StatefulSet. Then it calls the Prometheus API to sync the new configuration, resulting in the Prometheus Deployment or StatefulSet to be modified in place. -![How the Prometheus Operator sets up metrics scraping]({{}}/img/rancher/set-up-scraping.svg) - -When the Prometheus Operator observes ServiceMonitors, PodMonitors and PrometheusRules being created, it knows that the scrape configuration needs to be updated in Prometheus. It updates Prometheus by first updating the configuration and rules files in the volumes of Prometheus's Deployment or StatefulSet. Then it calls the Prometheus API to sync the new configuration, resulting in the Prometheus Deployment or StatefulSet to be modified in place. - -![How the Prometheus Operator Updates Scrape Configuration]({{}}/img/rancher/update-scrape-config.svg) - -### 5.3. How Kubernetes Component Metrics are Exposed +### How Kubernetes Component Metrics are Exposed Prometheus scrapes metrics from deployments known as [exporters,](https://prometheus.io/docs/instrumenting/exporters/) which export the time series data in a format that Prometheus can ingest. In Prometheus, time series consist of streams of timestamped values belonging to the same metric and the same set of labeled dimensions. -To allow monitoring to be installed on hardened Kubernetes clusters, `rancher-monitoring` application proxies the communication between Prometheus and the exporter through PushProx for some Kubernetes master components. +### Scraping Metrics with PushProx -### 5.4. Scraping Metrics without PushProx +Certain internal Kubernetes components are scraped via a proxy deployed as part of Monitoring V2 called PushProx. For detailed information on PushProx, refer [here](#pushprox) and to the above [architecture](#1-architecture-overview) section. -The Kubernetes components that directly expose metrics to Prometheus are the following: +### Scraping Metrics -- kubelet -- ingress-nginx* +The following Kubernetes components are directly scraped by Prometheus: + +- kubelet* +- ingress-nginx** - coreDns/kubeDns - kube-api-server -\* For RKE and RKE2 clusters, ingress-nginx is deployed by default and treated as an internal Kubernetes component. +\* You can optionally use hardenedKubelet.enabled to use a PushProx, but that is not the default. -### 5.5. Scraping Metrics with PushProx +** For RKE and RKE2 clusters, ingress-nginx is deployed by default and treated as an internal Kubernetes component. -The purpose of this architecture is to allow us to scrape internal Kubernetes components without exposing those ports to inbound requests. As a result, Prometheus can scrape metrics across a network boundary. -The Kubernetes components that expose metrics to Prometheus through PushProx are the following: +### Scraping Metrics Based on Kubernetes Distribution -- kube-controller-manager -- kube-scheduler -- etcd -- kube-proxy - -For each PushProx exporter, we deploy one PushProx client onto all target nodes. For example, a PushProx client is deployed onto all controlplane nodes for kube-controller-manager, all etcd nodes for kube-etcd, and all nodes for kubelet. We deploy exactly one PushProx proxy per exporter. - -The process for exporting metrics is as follows: - -1. The PushProx Client establishes an outbound connection with the PushProx Proxy. -2. The client then polls the proxy for scrape requests that have come into the proxy. -3. When the proxy receives a scrape request from Prometheus, the client sees it as a result of the poll. -4. The client scrapes the internal component. -5. The internal component responds by pushing metrics back to the proxy. - -
Process for Exporting Metrics with PushProx
- -![Process for Exporting Metrics with PushProx]({{}}/img/rancher/pushprox-process.svg) - -Metrics are scraped differently based on the Kubernetes distribution. For help with terminology, see Terminology(#terminology). For details, see the table below: +Metrics are scraped differently based on the Kubernetes distribution. For help with terminology, refer [here](#terminology). For details, see the table below:
How Metrics are Exposed to Prometheus
@@ -239,7 +226,7 @@ Metrics are scraped differently based on the Kubernetes distribution. For help w \* For RKE and RKE2 clusters, ingress-nginx is deployed by default and treated as an internal Kubernetes component. -### 5.6. Terminology +### Terminology - **kube-scheduler:** The internal Kubernetes component that uses information in the pod spec to decide on which node to run a pod. - **kube-controller-manager:** The internal Kubernetes component that is responsible for node management (detecting if a node fails), pod replication and endpoint creation. From 52dd354f7b873bc5f004728ea5997c9214a65df4 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Thu, 6 Jan 2022 18:27:07 +0000 Subject: [PATCH 149/478] Revised Monitoring V2 page in 2.6 --- .../how-monitoring-works/_index.md | 205 ++++++++---------- 1 file changed, 91 insertions(+), 114 deletions(-) diff --git a/content/rancher/v2.6/en/monitoring-alerting/how-monitoring-works/_index.md b/content/rancher/v2.6/en/monitoring-alerting/how-monitoring-works/_index.md index 9e7690d7de3..86f60a39ef7 100644 --- a/content/rancher/v2.6/en/monitoring-alerting/how-monitoring-works/_index.md +++ b/content/rancher/v2.6/en/monitoring-alerting/how-monitoring-works/_index.md @@ -8,56 +8,68 @@ weight: 1 3. [How Alertmanager Works](#3-how-alertmanager-works) 4. [Monitoring V2 Specific Components](#4-monitoring-v2-specific-components) 5. [Scraping and Exposing Metrics](#5-scraping-and-exposing-metrics) -6. [Monitoring on RKE2 Clusters](#6-monitoring-on-rke2-clusters) # 1. Architecture Overview -This diagram shows how data flows through the Monitoring V2 application: +_**The following steps describe how data flows through the Monitoring V2 application:**_ -{{% row %}} -{{% column %}} +**1.** **ServiceMonitors and PodMonitors** declaratively specify targets, such as Services and Pods, that need to be monitored. -![How data flows through the monitoring application]({{}}/img/rancher/monitoring-v2-architecture-overview.svg) +- Targets are scraped on a recurring schedule based on the configured Prometheus scrape interval, and the metrics that are scraped are stored into the Prometheus Time Series Database (TSDB). +- In order to perform the scrape, ServiceMonitors and PodMonitors are defined with label selectors that determine which Services or Pods should be scraped and endpoints that determine how the scrape should happen on the given target, e.g., scrape/metrics in TCP 10252, proxying through IP addr x.x.x.x. +- Out of the box, Monitoring V2 comes with certain pre-configured exporters that are deployed based on the type of Kubernetes cluster that it is deployed on. + - Certain internal Kubernetes components are scraped via a proxy deployed as part of Monitoring V2 called **PushProx**. The Kubernetes components that expose metrics to Prometheus through PushProx are the following: + `kube-controller-manager`, `kube-scheduler`, `etcd`, and `kube-proxy`. + - For each PushProx exporter, we deploy one PushProx client onto all target nodes. For example, a PushProx client is deployed onto all controlplane nodes for kube-controller-manager, all etcd nodes for kube-etcd, and all nodes for kubelet. + + - We deploy exactly one PushProx proxy per exporter. The process for exporting metrics is as follows: -{{% /column %}} -{{% column %}} + 1. The PushProx Client establishes an outbound connection with the PushProx Proxy. + 1. The client then polls the proxy for scrape requests that have come into the proxy. + 1. When the proxy receives a scrape request from Prometheus, the client sees it as a result of the poll. + 1. The client scrapes the internal component. + 1. The internal component responds by pushing metrics back to the proxy. + +
+
Process for Exporting Metrics with PushProx:
-1. Rules define what Prometheus metrics or time series database queries should result in alerts being fired. -2. ServiceMonitors and PodMonitors declaratively specify how services and pods should be monitored. They use labels to scrape metrics from pods. -3. Prometheus Operator observes ServiceMonitors, PodMonitors and PrometheusRules being created. -4. When the Prometheus configuration resources are created, Prometheus Operator calls the Prometheus API to sync the new configuration. -5. Recording Rules are not directly used for alerting. They create new time series of precomputed queries. These new time series data can then be queried to generate alerts. -6. Prometheus scrapes all targets in the scrape configuration on a recurring schedule based on the scrape interval, storing the results in its time series database.Depending on the Kubernetes master component and Kubernetes distribution, the metrics from a certain Kubernetes component could be directly exposed to Prometheus, proxied through PushProx, or not available. For details, see Scraping and Exposing Metrics. -7. Prometheus evaluates the alerting rules against the time series database. It fires alerts to Alertmanager whenever an alerting rule evaluates to a positive number. -8. Alertmanager uses routes to group, label and filter the fired alerts to translate them into useful notifications. -9. Alertmanager uses the Receiver configuration to send notifications to Slack, PagerDuty, SMS, or other types of receivers. + ![Process for Exporting Metrics with PushProx]({{}}/img/rancher/pushprox-process.svg) -{{% /column %}} -{{% /row %}} + For more information, see [Scraping and Exposing Metrics](#5-scraping-and-exposing-metrics). +**2.** **PrometheusRules** allow users to define rules for what metrics or time series database queries should result in alerts being fired. Rules are evaluated on an interval. +- **Recording rules** create a new time series based on existing series that have been collected. They are frequently used to precompute complex queries. +- **Alerting rules** run a particular query and fire an alert from Prometheus if the query evaluates to a non-zero value. + +**3.** **Prometheus Operator** observes ServiceMonitors, PodMonitors, and PrometheusRules being created. When the Prometheus configuration resources are created, Prometheus Operator calls the Prometheus API to sync the new configuration. + +**4.** Once Prometheus determines that an alert needs to be fired, alerts are forwarded to **Alertmanager**. + +- Alerts contain labels that come from the PromQL query itself and additional labels and annotations that can be provided as part of specifying the initial PrometheusRule. +- Before receiving any alerts, Alertmanager will use the **routes** and **receivers** specified in its configuration to form a routing tree on which all incoming alerts are evaluated. Each node of the routing tree can specify additional grouping, labeling, and filtering that needs to happen based on the labels attached to the Prometheus alert. A node on the routing tree (usually a leaf node) can also specify that an alert that reaches it needs to be sent out to a configured Receiver, e.g., Slack, PagerDuty, SMS, etc. Note that Alertmanager will send an alert first to **alertingDriver**, then alertingDriver will send or forward alert to the proper destination. +- Routes and receivers are also stored in the Kubernetes API via the Alertmanager Secret. When the Secret is updated, Alertmanager is also updated automatically. Note that routing occurs via labels only (not via annotations, etc.). + +
How data flows through the monitoring application:
# 2. How Prometheus Works -### 2.1. Storing Time Series Data +### Storing Time Series Data After collecting metrics from exporters, Prometheus stores the time series in a local on-disk time series database. Prometheus optionally integrates with remote systems, but `rancher-monitoring` uses local storage for the time series database. -The database can then be queried using PromQL, the query language for Prometheus. Grafana dashboards use PromQL queries to generate data visualizations. +Once stored, users can query this TSDB using PromQL, the query language for Prometheus. -### 2.2. Querying the Time Series Database +PromQL queries can be visualized in one of two ways: -The PromQL query language is the primary tool to query Prometheus for time series data. +1. By supplying the query in Prometheus's Graph UI, which will show a simple graphical view of the data. +1. By creating a Grafana Dashboard that contains the PromQL query and additional formatting directives that label axes, add units, change colors, use alternative visualizations, etc. -In Grafana, you can right-click a CPU utilization and click Inspect. This opens a panel that shows the [raw query results.](https://grafana.com/docs/grafana/latest/panels/inspect-panel/#inspect-raw-query-results)The raw results demonstrate how each dashboard is powered by PromQL queries. +### Defining Rules for Prometheus -### 2.3. Defining Rules for when Alerts Should be Fired - -Rules define the conditions for Prometheus to fire alerts. When PrometheusRule custom resources are created or updated, the Prometheus Operator observes the change and calls the Prometheus API to synchronize the rule configuration with the Alerting Rules and Recording Rules in Prometheus. - -When you define a Rule (which is declared within a RuleGroup in a PrometheusRule resource), the [spec of the Rule itself](https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/api.md#rule) contains labels that are used by Alertmanager to figure out which Route should receive this Alert. For example, an Alert with the label `team: front-end` will be sent to all Routes that match on that label. +Rules define queries that Prometheus needs to execute on a regular `evaluationInterval` to perform certain actions, such as firing an alert (alerting rules) or precomputing a query based on others existing in its TSDB (recording rules). These rules are encoded in PrometheusRules custom resources. When PrometheusRule custom resources are created or updated, the Prometheus Operator observes the change and calls the Prometheus API to synchronize the set of rules that Prometheus is currently evaluating on a regular interval. A PrometheusRule allows you to define one or more RuleGroups. Each RuleGroup consists of a set of Rule objects that can each represent either an alerting or a recording rule with the following fields: @@ -66,7 +78,9 @@ A PrometheusRule allows you to define one or more RuleGroups. Each RuleGroup con - Labels that should be attached to the alert or record that identify it (e.g. cluster name or severity) - Annotations that encode any additional important pieces of information that need to be displayed on the notification for an alert (e.g. summary, description, message, runbook URL, etc.). This field is not required for recording rules. -### 2.4. Firing Alerts +On evaluating a [rule](https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#rule), Prometheus will execute the provided PromQL query, add additional provided labels (or annotations - only for alerting rules), and execute the appropriate action for the rule. For example, an Alerting Rule that adds `team: front-end` as a label to the provided PromQL query will append that label to the fired alert, which will allow Alertmanager to forward the alert to the correct Receiver. + +### Alerting and Recording Rules Prometheus doesn't maintain the state of whether alerts are active. It fires alerts repetitively at every evaluation interval, relying on Alertmanager to group and filter the alerts into meaningful notifications. @@ -91,14 +105,18 @@ The Alertmanager handles alerts sent by client applications such as the Promethe - Silencing and inhibition of alerts - Tracking alerts that fire over time - Sending out the status of whether an alert is currently firing, or if it is resolved + +### Alerts Forwarded by alertingDrivers + +When alertingDrivers are installed, this creates a `Service` that can be used as the receiver's URL for Teams or SMS, based on the alertingDriver's configuration. The URL in the Receiver points to the alertingDrivers; so the Alertmanager sends alert first to alertingDriver, then alertingDriver forwards or sends alert to the proper destination. -### 3.1. Routing Alerts to Receivers +### Routing Alerts to Receivers Alertmanager coordinates where alerts are sent. It allows you to group alerts based on labels and fire them based on whether certain labels are matched. One top-level route accepts all alerts. From there, Alertmanager continues routing alerts to receivers based on whether they match the conditions of the next route. -While the Rancher UI forms only allow editing a routing tree that is two levels deep, you can configure more deeply nested routing structures by editing the Alertmanager custom resource YAML. +While the Rancher UI forms only allow editing a routing tree that is two levels deep, you can configure more deeply nested routing structures by editing the Alertmanager Secret. -### 3.2. Configuring Multiple Receivers +### Configuring Multiple Receivers By editing the forms in the Rancher UI, you can set up a Receiver resource with all the information Alertmanager needs to send alerts to your notification system. @@ -106,124 +124,93 @@ By editing custom YAML in the Alertmanager or Receiver configuration, you can al # 4. Monitoring V2 Specific Components -Prometheus Operator introduces a set of [Custom Resource Definitions](https://github.com/prometheus-operator/prometheus-operator#customresourcedefinitions) that allow users to deploy and manage Prometheus and Alertmanager instances by creating and modifying those custom resources on a cluster. +Prometheus Operator introduces a set of [Custom Resource Definitions](https://github.com/prometheus-operator/prometheus-operator#customresourcedefinitions) that allow users to deploy and manage Prometheus and Alertmanager instances by creating and modifying those custom resources on a cluster. Prometheus Operator will automatically update your Prometheus configuration based on the live state of the resources and configuration options that are edited in the Rancher UI. -### 4.1. Resources Deployed by Default +### Resources Deployed by Default By default, a set of resources curated by the [kube-prometheus](https://github.com/prometheus-operator/kube-prometheus) project are deployed onto your cluster as part of installing the Rancher Monitoring Application to set up a basic Monitoring/Alerting stack. The resources that get deployed onto your cluster to support this solution can be found in the [`rancher-monitoring`](https://github.com/rancher/charts/tree/main/charts/rancher-monitoring) Helm chart, which closely tracks the upstream [kube-prometheus-stack](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack) Helm chart maintained by the Prometheus community with certain changes tracked in the [CHANGELOG.md](https://github.com/rancher/charts/blob/main/charts/rancher-monitoring/CHANGELOG.md). -There are also certain special types of ConfigMaps and Secrets such as those corresponding to Grafana Dashboards, Grafana Datasources, and Alertmanager Configs that will automatically update your Prometheus configuration via sidecar proxies that observe the live state of those resources within your cluster. +### Default Exporters -### 4.2. PushProx +Monitoring V2 deploys three default exporters that provide additional metrics for Prometheus to store: -PushProx enhances the security of the monitoring application, allowing it to be installed on hardened Kubernetes clusters. +1. `node-exporter`: exposes hardware and OS metrics for Linux hosts. For more information on `node-exporter`, refer to the [upstream documentation.](https://prometheus.io/docs/guides/node-exporter/) -To expose Kubernetes metrics, PushProxes use a client proxy model to expose specific ports within default Kubernetes components. Node exporters expose metrics to PushProx through an outbound connection. +1. `windows-exporter`: exposes hardware and OS metrics for Windows hosts (only deployed on Windows clusters). -The proxy allows `rancher-monitoring` to scrape metrics from processes on the hostNetwork, such as the `kube-api-server`, without opening up node ports to inbound connections. +1. [kube-state-metrics](https://github.com/kubernetes/kube-state-metrics): expose additional metrics that track the state of resources contained in the Kubernetes API (e.g. pods, workloads, etc.). -PushProx is a DaemonSet that listens for clients that seek to register. Once registered, it proxies scrape requests through the established connection. Then the client executes the request to etcd. +ServiceMonitors and PodMonitors will scrape these exporters, as defined [here](#defining-what-metrics-are-scraped). Prometheus stores these metrics, and you can query the results via either Prometheus's UI or Grafana. -All of the default ServiceMonitors, such as `rancher-monitoring-kube-controller-manager`, are configured to hit the metrics endpoint of the client using this proxy. +See [architecture](#1-architecture-overview) section for more information on recording rules, alerting rules, and Alertmanager. -For more details about how PushProx works, refer to [Scraping Metrics with PushProx.](#5-5-scraping-metrics-with-pushprox) - - -### 4.3. Default Exporters - -`rancher-monitoring` deploys two exporters to expose metrics to prometheus: `node-exporter` and `windows-exporter`. Both are deployed as DaemonSets. - -`node-exporter` exports container, pod and node metrics for CPU and memory from each Linux node. `windows-exporter` does the same, but for Windows nodes. - -For more information on `node-exporter`, refer to the [upstream documentation.](https://prometheus.io/docs/guides/node-exporter/) - -[kube-state-metrics](https://github.com/kubernetes/kube-state-metrics) is also useful because it exports metrics for Kubernetes components. - -# 4.4. Components Exposed in the Rancher UI +### Components Exposed in the Rancher UI When the monitoring application is installed, you will be able to edit the following components in the Rancher UI: | Component | Type of Component | Purpose and Common Use Cases for Editing | |--------------|------------------------|---------------------------| -| ServiceMonitor | Custom resource | Set up targets to scrape custom metrics from. Automatically updates the scrape configuration in the Prometheus custom resource. | -| PodMonitor | Custom resource | Set up targets to scrape custom metrics from. Automatically updates the scrape configuration in the Prometheus custom resource. | -| Receiver | Configuration block (part of Alertmanager) | Set up a notification system to receive alerts. Automatically updates the Alertmanager custom resource. | -| Route | Configuration block (part of Alertmanager) | Add identifying information to make alerts more meaningful and direct them to individual teams. Automatically updates the Alertmanager custom resource. | -| PrometheusRule | Custom resource | For more advanced use cases, you may want to define what Prometheus metrics or time series database queries should result in alerts being fired. Automatically updates the Prometheus custom resource. | -| Alertmanager | Custom resource | Edit this custom resource only if you need more advanced configuration options beyond what the Rancher UI exposes in the Routes and Receivers sections. For example, you might want to edit this resource to add a routing tree with more than two levels. | -| Prometheus | Custom resource | Edit this custom resource only if you need more advanced configuration beyond what can be configured using ServiceMonitors, PodMonitors, or [Rancher monitoring Helm chart options.](../configuration/helm-chart-options) | +| ServiceMonitor | Custom resource | Sets up Kubernetes Services to scrape custom metrics from. Automatically updates the scrape configuration in the Prometheus custom resource. | +| PodMonitor | Custom resource | Sets up Kubernetes Pods to scrape custom metrics from. Automatically updates the scrape configuration in the Prometheus custom resource. | +| Receiver | Configuration block (part of Alertmanager) | Modifies information on where to send an alert (e.g. Slack, PagerDuty, etc.) and any necessary information to send the alert (e.g. TLS certs, proxy URLs, etc.). Automatically updates the Alertmanager custom resource. | +| Route | Configuration block (part of Alertmanager) | Modifies the routing tree that is used to filter, label, and group alerts based on labels and send them to the appropriate Receiver. Automatically updates the Alertmanager custom resource. | +| PrometheusRule | Custom resource | Defines additional queries that need to trigger alerts or define materialized views of existing series that are within Prometheus's TSDB. Automatically updates the Prometheus custom resource. | + +### How PushProx Works + +PushProx allows Prometheus to scrape metrics across a network boundary, which prevents users from having to expose metrics ports for internal Kubernetes components on each node in a Kubernetes cluster. + +Since the metrics for Kubernetes components are generally exposed on the host network of nodes in the cluster, PushProx deploys a DaemonSet of clients that sit on the hostNetwork of each node and make an outbound connection to a single proxy that is sitting on the Kubernetes API. Prometheus can then be configured to proxy scrape requests through the proxy to each client, which allows it to scrape metrics from the internal Kubernetes components without requiring any inbound node ports to be open. + +For more details about how PushProx works, refer to [Scraping Metrics with PushProx](#scraping-metrics-with-pushprox). # 5. Scraping and Exposing Metrics -### 5.1. Defining what Metrics are Scraped +### Defining what Metrics are Scraped -ServiceMonitors define targets that are intended for Prometheus to scrape. The [Prometheus custom resource tells](https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/design.md#prometheus) Prometheus which ServiceMonitors it should use to find out where to scrape metrics from. +ServiceMonitors and PodMonitors define targets that are intended for Prometheus to scrape. The [Prometheus custom resource](https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/design.md#prometheus) tells Prometheus which ServiceMonitors or PodMonitors it should use to find out where to scrape metrics from. -The Prometheus Operator observes the ServiceMonitors. When it observes that ServiceMonitors are created or updated, it calls the Prometheus API to update the scrape configuration in the Prometheus custom resource and keep it in sync with the scrape configuration in the ServiceMonitors. This scrape configuration tells Prometheus which endpoints to scrape metrics from and how it will label the metrics from those endpoints. +The Prometheus Operator observes the ServiceMonitors and PodMonitors. When it observes that they are created or updated, it calls the Prometheus API to update the scrape configuration in the Prometheus custom resource and keep it in sync with the scrape configuration in the ServiceMonitors or PodMonitors. This scrape configuration tells Prometheus which endpoints to scrape metrics from and how it will label the metrics from those endpoints. Prometheus scrapes all of the metrics defined in its scrape configuration at every `scrape_interval`, which is one minute by default. The scrape configuration can be viewed as part of the Prometheus custom resource that is exposed in the Rancher UI. -### 5.2. How the Prometheus Operator Sets up Metrics Scraping +### How the Prometheus Operator Sets up Metrics Scraping The Prometheus Deployment or StatefulSet scrapes metrics, and the configuration of Prometheus is controlled by the Prometheus custom resources. The Prometheus Operator watches for Prometheus and Alertmanager resources, and when they are created, the Prometheus Operator creates a Deployment or StatefulSet for Prometheus or Alertmanager with the user-defined configuration. -
How the Prometheus Operator Sets up Metrics Scraping
+When the Prometheus Operator observes ServiceMonitors, PodMonitors, and PrometheusRules being created, it knows that the scrape configuration needs to be updated in Prometheus. It updates Prometheus by first updating the configuration and rules files in the volumes of Prometheus's Deployment or StatefulSet. Then it calls the Prometheus API to sync the new configuration, resulting in the Prometheus Deployment or StatefulSet to be modified in place. -![How the Prometheus Operator sets up metrics scraping]({{}}/img/rancher/set-up-scraping.svg) - -When the Prometheus Operator observes ServiceMonitors, PodMonitors and PrometheusRules being created, it knows that the scrape configuration needs to be updated in Prometheus. It updates Prometheus by first updating the configuration and rules files in the volumes of Prometheus's Deployment or StatefulSet. Then it calls the Prometheus API to sync the new configuration, resulting in the Prometheus Deployment or StatefulSet to be modified in place. - -![How the Prometheus Operator Updates Scrape Configuration]({{}}/img/rancher/update-scrape-config.svg) - -### 5.3. How Kubernetes Component Metrics are Exposed +### How Kubernetes Component Metrics are Exposed Prometheus scrapes metrics from deployments known as [exporters,](https://prometheus.io/docs/instrumenting/exporters/) which export the time series data in a format that Prometheus can ingest. In Prometheus, time series consist of streams of timestamped values belonging to the same metric and the same set of labeled dimensions. -To allow monitoring to be installed on hardened Kubernetes clusters, `rancher-monitoring` application proxies the communication between Prometheus and the exporter through PushProx for some Kubernetes master components. +### Scraping Metrics with PushProx -### 5.4. Scraping Metrics without PushProx +Certain internal Kubernetes components are scraped via a proxy deployed as part of Monitoring V2 called PushProx. For detailed information on PushProx, refer [here](#pushprox) and to the above [architecture](#1-architecture-overview) section. -The Kubernetes components that directly expose metrics to Prometheus are the following: +### Scraping Metrics -- kubelet -- ingress-nginx* +The following Kubernetes components are directly scraped by Prometheus: + +- kubelet* +- ingress-nginx** - coreDns/kubeDns - kube-api-server -\* For RKE and RKE2 clusters, ingress-nginx is deployed by default and treated as an internal Kubernetes component. +\* You can optionally use hardenedKubelet.enabled to use a PushProx, but that is not the default. -### 5.5. Scraping Metrics with PushProx +** For RKE and RKE2 clusters, ingress-nginx is deployed by default and treated as an internal Kubernetes component. -The purpose of this architecture is to allow us to scrape internal Kubernetes components without exposing those ports to inbound requests. As a result, Prometheus can scrape metrics across a network boundary. -The Kubernetes components that expose metrics to Prometheus through PushProx are the following: +### Scraping Metrics Based on Kubernetes Distribution -- kube-controller-manager -- kube-scheduler -- etcd -- kube-proxy - -For each PushProx exporter, we deploy one PushProx client onto all target nodes. For example, a PushProx client is deployed onto all controlplane nodes for kube-controller-manager, all etcd nodes for kube-etcd, and all nodes for kubelet. We deploy exactly one PushProx proxy per exporter. - -The process for exporting metrics is as follows: - -1. The PushProx Client establishes an outbound connection with the PushProx Proxy. -2. The client then polls the proxy for scrape requests that have come into the proxy. -3. When the proxy receives a scrape request from Prometheus, the client sees it as a result of the poll. -4. The client scrapes the internal component. -5. The internal component responds by pushing metrics back to the proxy. - -
Process for Exporting Metrics with PushProx
- -![Process for Exporting Metrics with PushProx]({{}}/img/rancher/pushprox-process.svg) - -Metrics are scraped differently based on the Kubernetes distribution. For help with terminology, see Terminology(#terminology). For details, see the table below: +Metrics are scraped differently based on the Kubernetes distribution. For help with terminology, refer [here](#terminology). For details, see the table below:
How Metrics are Exposed to Prometheus
@@ -240,7 +227,7 @@ Metrics are scraped differently based on the Kubernetes distribution. For help w \* For RKE and RKE2 clusters, ingress-nginx is deployed by default and treated as an internal Kubernetes component. -### 5.6. Terminology +### Terminology - **kube-scheduler:** The internal Kubernetes component that uses information in the pod spec to decide on which node to run a pod. - **kube-controller-manager:** The internal Kubernetes component that is responsible for node management (detecting if a node fails), pod replication and endpoint creation. @@ -250,13 +237,3 @@ Metrics are scraped differently based on the Kubernetes distribution. For help w - **ingress-nginx:** An Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer. - **coreDns/kubeDns:** The internal Kubernetes component responsible for DNS. - **kube-api-server:** The main internal Kubernetes component that is responsible for exposing APIs for the other master components. - -# 6. Monitoring on RKE2 Clusters - -Rancher v2.6 introduced the ability to provision new Kubernetes clusters with [RKE2,](https://docs.rke2.io/) which is Rancher's fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector. To allow Monitoring V2 to be installed on RKE2 Kubernetes clusters, the `rkeIngressNginx` and `rke2IngressNginx` sub-charts were introduced to scrape metrics from the `ingress-nginx` Deployment/DaemonSet in RKE and RKE2 clusters respectively. - -The PushProx pod needs to run on the same nodes as the `ingress-nginx` pod. - -When the RKE2 cluster's Kubernetes version is <= 1.20, the workload type of `ingress-nginx` is a Deployment. The `pushprox-ingress-nginx-client` is deployed as a Deployment, and the Rancher UI sets the Helm chart value `rke2IngressNginx.deployment.enabled=true`. - -For Kubernetes >= 1.21, the workload type of `ingress-nginx` is a DaemonSet. The `pushprox-ingress-nginx-client` is deployed as a DaemonSet, which is the default behavior. \ No newline at end of file From 3bc443bdd750c9f6d7dad292e5c857a9757744dc Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Thu, 6 Jan 2022 21:40:15 +0000 Subject: [PATCH 150/478] Updated table based on feedback --- content/rancher/v2.6/en/helm-charts/_index.md | 34 +++++++++---------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/content/rancher/v2.6/en/helm-charts/_index.md b/content/rancher/v2.6/en/helm-charts/_index.md index c9bb859a5bc..bf42cde74fb 100644 --- a/content/rancher/v2.6/en/helm-charts/_index.md +++ b/content/rancher/v2.6/en/helm-charts/_index.md @@ -15,23 +15,23 @@ Starting in Rancher v2.6.0, a new versioning scheme for Rancher feature charts w **Feature Charts:** -| **Name** | **Starting Major Version** | -| ---------------- | ------------------ | -| rancher-alerting-drivers | 100.0.0 | -| rancher-cis-benchmark | 2.0.0 | -| external-ip-webhook | 100.0.0+up1.0.0 | -| harvester-cloud-provider | 100.0.0+up0.1.8 | -| harvester-csi-driver | 100.0.0+up0.1.9 | -| rancher-istio | 100.0.0+up1.10.4 | -| rancher-logging | 100.0.0+up3.12.0 | -| rancher-longhorn | 100.0.0+up1.1.2 | -| rancher-monitoring | 100.0.0+up16.6.0 | -| rancher-gatekeeper | 100.0.0+up3.5.1 | -| rancher-backups | 2.0.0 | -| rancher-wins-upgrader | 100.0.0+up0.0.1 | -| rancher-sriov (experimental) | 100.0.0+up0.1.0 | -| rancher-vsphere-cpi | 100.0.0 | -| rancher-vsphere-csi | 100.0.0 | +| **Name** | **Supported Minimum Version** | **Supported Maximum Version** | +| ---------------- | ------------ | ------------ | +| rancher-alerting-drivers | 100.0.0 | 100.0.1 | +| rancher-cis-benchmark | 2.0.0 | 2.0.2 | +| external-ip-webhook | 100.0.0+up1.0.0 | 100.0.1+up1.0.1 | +| harvester-cloud-provider | 100.0.0+up0.1.8 | 100.0.0+up0.1.8 | +| harvester-csi-driver | 100.0.0+up0.1.9 | 100.0.0+up0.1.9 | +| rancher-istio | 100.0.0+up1.10.4 | 100.1.0+up1.11.4 | +| rancher-logging | 100.0.0+up3.12.0 | 100.0.1+up3.15.0 | +| rancher-longhorn | 100.0.0+up1.1.2 | 100.1.1+up1.2.3 | +| rancher-monitoring | 100.0.0+up16.6.0 | 100.1.0+up19.0.3 +| rancher-gatekeeper | 100.0.0+up3.5.1 | 100.0.1+up3.6.0 | +| rancher-backups | 2.0.0 | 2.1.0 | +| rancher-wins-upgrader | 100.0.0+up0.0.1 | 100.0.0+up0.0.1 | +| rancher-sriov (experimental) | 100.0.0+up0.1.0 | 100.0.1+up0.1.0 | +| rancher-vsphere-cpi | 100.0.0 | 100.1.0+up1.0.100 +| rancher-vsphere-csi | 100.0.0 | 100.1.0+up2.3.0 |
**Charts based on upstream:** For charts that are based on upstreams, the +up annotation should inform you of what upstream version the Rancher chart is tracking. Check the upstream version compatibility with Rancher during upgrades also. From 73557d78e36a28e366f6a10fe36dfa21a3406e7b Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Thu, 6 Jan 2022 22:25:07 +0000 Subject: [PATCH 151/478] Updated per feedback --- .../how-monitoring-works/_index.md | 20 +++++++++---------- .../how-monitoring-works/_index.md | 20 +++++++++---------- 2 files changed, 20 insertions(+), 20 deletions(-) diff --git a/content/rancher/v2.5/en/monitoring-alerting/how-monitoring-works/_index.md b/content/rancher/v2.5/en/monitoring-alerting/how-monitoring-works/_index.md index f5b3cc0fe3f..9c9edb6a4ed 100644 --- a/content/rancher/v2.5/en/monitoring-alerting/how-monitoring-works/_index.md +++ b/content/rancher/v2.5/en/monitoring-alerting/how-monitoring-works/_index.md @@ -13,7 +13,7 @@ weight: 1 _**The following steps describe how data flows through the Monitoring V2 application:**_ -**1.** **ServiceMonitors and PodMonitors** declaratively specify targets, such as Services and Pods, that need to be monitored. +**1. ServiceMonitors and PodMonitors** declaratively specify targets, such as Services and Pods, that need to be monitored. - Targets are scraped on a recurring schedule based on the configured Prometheus scrape interval, and the metrics that are scraped are stored into the Prometheus Time Series Database (TSDB). - In order to perform the scrape, ServiceMonitors and PodMonitors are defined with label selectors that determine which Services or Pods should be scraped and endpoints that determine how the scrape should happen on the given target, e.g., scrape/metrics in TCP 10252, proxying through IP addr x.x.x.x. @@ -37,12 +37,12 @@ _**The following steps describe how data flows through the Monitoring V2 applica For more information, see [Scraping and Exposing Metrics](#5-scraping-and-exposing-metrics). -**2.** **PrometheusRules** allow users to define rules for what metrics or time series database queries should result in alerts being fired. Rules are evaluated on an interval. +**2. PrometheusRules** allow users to define rules for what metrics or time series database queries should result in alerts being fired. Rules are evaluated on an interval. - **Recording rules** create a new time series based on existing series that have been collected. They are frequently used to precompute complex queries. - **Alerting rules** run a particular query and fire an alert from Prometheus if the query evaluates to a non-zero value. -**3.** **Prometheus Operator** observes ServiceMonitors, PodMonitors, and PrometheusRules being created. When the Prometheus configuration resources are created, Prometheus Operator calls the Prometheus API to sync the new configuration. +**3. Prometheus Operator** observes ServiceMonitors, PodMonitors, and PrometheusRules being created. When the Prometheus configuration resources are created, Prometheus Operator calls the Prometheus API to sync the new configuration. **4.** Once Prometheus determines that an alert needs to be fired, alerts are forwarded to **Alertmanager**. @@ -123,7 +123,7 @@ By editing custom YAML in the Alertmanager or Receiver configuration, you can al # 4. Monitoring V2 Specific Components -Prometheus Operator introduces a set of [Custom Resource Definitions](https://github.com/prometheus-operator/prometheus-operator#customresourcedefinitions) that allow users to deploy and manage Prometheus and Alertmanager instances by creating and modifying those custom resources on a cluster. +Prometheus Operator introduces a set of [Custom Resource Definitions](https://github.com/prometheus-operator/prometheus-operator#customresourcedefinitions) that allow users to deploy and manage Prometheus and Alertmanager instances by creating and modifying those custom resources on a cluster. Prometheus Operator will automatically update your Prometheus configuration based on the live state of the resources and configuration options that are edited in the Rancher UI. @@ -137,15 +137,15 @@ The resources that get deployed onto your cluster to support this solution can b Monitoring V2 deploys three default exporters that provide additional metrics for Prometheus to store: -1. `node-exporter`: exposes hardware and OS metrics for Linux hosts. For more information on `node-exporter`, refer to the [upstream documentation.](https://prometheus.io/docs/guides/node-exporter/) +1. `node-exporter`: exposes hardware and OS metrics for Linux hosts. For more information on `node-exporter`, refer to the [upstream documentation](https://prometheus.io/docs/guides/node-exporter/). -1. `windows-exporter`: exposes hardware and OS metrics for Windows hosts (only deployed on Windows clusters). +1. `windows-exporter`: exposes hardware and OS metrics for Windows hosts (only deployed on Windows clusters). For more information on `windows-exporter`, refer to the [upstream documentation](https://github.com/prometheus-community/windows_exporter). -1. [kube-state-metrics](https://github.com/kubernetes/kube-state-metrics): expose additional metrics that track the state of resources contained in the Kubernetes API (e.g. pods, workloads, etc.). +1. `kube-state-metrics`: expose additional metrics that track the state of resources contained in the Kubernetes API (e.g., pods, workloads, etc.). For more information on `kube-state-metrics`, refer to the [upstream documentation](https://github.com/kubernetes/kube-state-metrics/tree/master/docs). ServiceMonitors and PodMonitors will scrape these exporters, as defined [here](#defining-what-metrics-are-scraped). Prometheus stores these metrics, and you can query the results via either Prometheus's UI or Grafana. -See [architecture](#1-architecture-overview) section for more information on recording rules, alerting rules, and Alertmanager. +See the [architecture](#1-architecture-overview) section for more information on recording rules, alerting rules, and Alertmanager. ### Components Exposed in the Rancher UI @@ -155,7 +155,7 @@ When the monitoring application is installed, you will be able to edit the follo |--------------|------------------------|---------------------------| | ServiceMonitor | Custom resource | Sets up Kubernetes Services to scrape custom metrics from. Automatically updates the scrape configuration in the Prometheus custom resource. | | PodMonitor | Custom resource | Sets up Kubernetes Pods to scrape custom metrics from. Automatically updates the scrape configuration in the Prometheus custom resource. | -| Receiver | Configuration block (part of Alertmanager) | Modifies information on where to send an alert (e.g. Slack, PagerDuty, etc.) and any necessary information to send the alert (e.g. TLS certs, proxy URLs, etc.). Automatically updates the Alertmanager custom resource. | +| Receiver | Configuration block (part of Alertmanager) | Modifies information on where to send an alert (e.g., Slack, PagerDuty, etc.) and any necessary information to send the alert (e.g., TLS certs, proxy URLs, etc.). Automatically updates the Alertmanager custom resource. | | Route | Configuration block (part of Alertmanager) | Modifies the routing tree that is used to filter, label, and group alerts based on labels and send them to the appropriate Receiver. Automatically updates the Alertmanager custom resource. | | PrometheusRule | Custom resource | Defines additional queries that need to trigger alerts or define materialized views of existing series that are within Prometheus's TSDB. Automatically updates the Prometheus custom resource. | @@ -202,7 +202,7 @@ The following Kubernetes components are directly scraped by Prometheus: - coreDns/kubeDns - kube-api-server -\* You can optionally use hardenedKubelet.enabled to use a PushProx, but that is not the default. +\* You can optionally use `hardenedKubelet.enabled` to use a PushProx, but that is not the default. ** For RKE and RKE2 clusters, ingress-nginx is deployed by default and treated as an internal Kubernetes component. diff --git a/content/rancher/v2.6/en/monitoring-alerting/how-monitoring-works/_index.md b/content/rancher/v2.6/en/monitoring-alerting/how-monitoring-works/_index.md index 86f60a39ef7..61c8a9c2c36 100644 --- a/content/rancher/v2.6/en/monitoring-alerting/how-monitoring-works/_index.md +++ b/content/rancher/v2.6/en/monitoring-alerting/how-monitoring-works/_index.md @@ -13,7 +13,7 @@ weight: 1 _**The following steps describe how data flows through the Monitoring V2 application:**_ -**1.** **ServiceMonitors and PodMonitors** declaratively specify targets, such as Services and Pods, that need to be monitored. +**1. ServiceMonitors and PodMonitors** declaratively specify targets, such as Services and Pods, that need to be monitored. - Targets are scraped on a recurring schedule based on the configured Prometheus scrape interval, and the metrics that are scraped are stored into the Prometheus Time Series Database (TSDB). - In order to perform the scrape, ServiceMonitors and PodMonitors are defined with label selectors that determine which Services or Pods should be scraped and endpoints that determine how the scrape should happen on the given target, e.g., scrape/metrics in TCP 10252, proxying through IP addr x.x.x.x. @@ -38,12 +38,12 @@ _**The following steps describe how data flows through the Monitoring V2 applica For more information, see [Scraping and Exposing Metrics](#5-scraping-and-exposing-metrics). -**2.** **PrometheusRules** allow users to define rules for what metrics or time series database queries should result in alerts being fired. Rules are evaluated on an interval. +**2. PrometheusRules** allow users to define rules for what metrics or time series database queries should result in alerts being fired. Rules are evaluated on an interval. - **Recording rules** create a new time series based on existing series that have been collected. They are frequently used to precompute complex queries. - **Alerting rules** run a particular query and fire an alert from Prometheus if the query evaluates to a non-zero value. -**3.** **Prometheus Operator** observes ServiceMonitors, PodMonitors, and PrometheusRules being created. When the Prometheus configuration resources are created, Prometheus Operator calls the Prometheus API to sync the new configuration. +**3. Prometheus Operator** observes ServiceMonitors, PodMonitors, and PrometheusRules being created. When the Prometheus configuration resources are created, Prometheus Operator calls the Prometheus API to sync the new configuration. **4.** Once Prometheus determines that an alert needs to be fired, alerts are forwarded to **Alertmanager**. @@ -124,7 +124,7 @@ By editing custom YAML in the Alertmanager or Receiver configuration, you can al # 4. Monitoring V2 Specific Components -Prometheus Operator introduces a set of [Custom Resource Definitions](https://github.com/prometheus-operator/prometheus-operator#customresourcedefinitions) that allow users to deploy and manage Prometheus and Alertmanager instances by creating and modifying those custom resources on a cluster. +Prometheus Operator introduces a set of [Custom Resource Definitions](https://github.com/prometheus-operator/prometheus-operator#customresourcedefinitions) that allow users to deploy and manage Prometheus and Alertmanager instances by creating and modifying those custom resources on a cluster. Prometheus Operator will automatically update your Prometheus configuration based on the live state of the resources and configuration options that are edited in the Rancher UI. @@ -138,15 +138,15 @@ The resources that get deployed onto your cluster to support this solution can b Monitoring V2 deploys three default exporters that provide additional metrics for Prometheus to store: -1. `node-exporter`: exposes hardware and OS metrics for Linux hosts. For more information on `node-exporter`, refer to the [upstream documentation.](https://prometheus.io/docs/guides/node-exporter/) +1. `node-exporter`: exposes hardware and OS metrics for Linux hosts. For more information on `node-exporter`, refer to the [upstream documentation](https://prometheus.io/docs/guides/node-exporter/). -1. `windows-exporter`: exposes hardware and OS metrics for Windows hosts (only deployed on Windows clusters). +1. `windows-exporter`: exposes hardware and OS metrics for Windows hosts (only deployed on Windows clusters). For more information on `windows-exporter`, refer to the [upstream documentation](https://github.com/prometheus-community/windows_exporter). -1. [kube-state-metrics](https://github.com/kubernetes/kube-state-metrics): expose additional metrics that track the state of resources contained in the Kubernetes API (e.g. pods, workloads, etc.). +1. `kube-state-metrics`: expose additional metrics that track the state of resources contained in the Kubernetes API (e.g., pods, workloads, etc.). For more information on `kube-state-metrics`, refer to the [upstream documentation](https://github.com/kubernetes/kube-state-metrics/tree/master/docs). ServiceMonitors and PodMonitors will scrape these exporters, as defined [here](#defining-what-metrics-are-scraped). Prometheus stores these metrics, and you can query the results via either Prometheus's UI or Grafana. -See [architecture](#1-architecture-overview) section for more information on recording rules, alerting rules, and Alertmanager. +See the [architecture](#1-architecture-overview) section for more information on recording rules, alerting rules, and Alertmanager. ### Components Exposed in the Rancher UI @@ -156,7 +156,7 @@ When the monitoring application is installed, you will be able to edit the follo |--------------|------------------------|---------------------------| | ServiceMonitor | Custom resource | Sets up Kubernetes Services to scrape custom metrics from. Automatically updates the scrape configuration in the Prometheus custom resource. | | PodMonitor | Custom resource | Sets up Kubernetes Pods to scrape custom metrics from. Automatically updates the scrape configuration in the Prometheus custom resource. | -| Receiver | Configuration block (part of Alertmanager) | Modifies information on where to send an alert (e.g. Slack, PagerDuty, etc.) and any necessary information to send the alert (e.g. TLS certs, proxy URLs, etc.). Automatically updates the Alertmanager custom resource. | +| Receiver | Configuration block (part of Alertmanager) | Modifies information on where to send an alert (e.g., Slack, PagerDuty, etc.) and any necessary information to send the alert (e.g., TLS certs, proxy URLs, etc.). Automatically updates the Alertmanager custom resource. | | Route | Configuration block (part of Alertmanager) | Modifies the routing tree that is used to filter, label, and group alerts based on labels and send them to the appropriate Receiver. Automatically updates the Alertmanager custom resource. | | PrometheusRule | Custom resource | Defines additional queries that need to trigger alerts or define materialized views of existing series that are within Prometheus's TSDB. Automatically updates the Prometheus custom resource. | @@ -203,7 +203,7 @@ The following Kubernetes components are directly scraped by Prometheus: - coreDns/kubeDns - kube-api-server -\* You can optionally use hardenedKubelet.enabled to use a PushProx, but that is not the default. +\* You can optionally use `hardenedKubelet.enabled` to use a PushProx, but that is not the default. ** For RKE and RKE2 clusters, ingress-nginx is deployed by default and treated as an internal Kubernetes component. From f0a694e10936c745f75019f0b35a89262ea8bd00 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 7 Jan 2022 16:57:23 +0000 Subject: [PATCH 152/478] Added note on mixed OS clusters --- .../rke-clusters/windows-clusters/_index.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md index 0e4f17f8abc..59f9a1c75ed 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md @@ -28,7 +28,7 @@ This guide covers the following topics: - [Configuration for Storage Classes in Azure](#configuration-for-storage-classes-in-azure) - # Changes in Rancher v2.6 +# Changes in Rancher v2.6 _Tech Preview_ @@ -43,6 +43,8 @@ The RKE2 provisioning tech preview also includes installing RKE2 on Windows clus Windows Support for RKE2 Custom Clusters requires choosing Calico as the CNI. +>**Important:** Rancher will allow Windows workload pods to deploy on both Windows and Linux worker nodes by default. When creating mixed clusters in RKE2, you must taint the Linux node to ensure Windows workloads will only be deployed to Windows nodes. Refer [here]({{}}/rancher/v2.6/en/logging/taints-tolerations/) for more information on taints and tolerations in Rancher. + # Requirements for Windows Clusters The general node requirements for networking, operating systems, and Docker are the same as the node requirements for a [Rancher installation]({{}}/rancher/v2.6/en/installation/requirements/). From dca72c4775d22aaf7be472815f206956d2c06eb3 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 7 Jan 2022 22:42:41 +0000 Subject: [PATCH 153/478] Updated sections based on feedback --- .../how-monitoring-works/_index.md | 60 +++++++++++------- .../how-monitoring-works/_index.md | 61 ++++++++++++------- 2 files changed, 78 insertions(+), 43 deletions(-) diff --git a/content/rancher/v2.5/en/monitoring-alerting/how-monitoring-works/_index.md b/content/rancher/v2.5/en/monitoring-alerting/how-monitoring-works/_index.md index 9c9edb6a4ed..30b19cdbc66 100644 --- a/content/rancher/v2.5/en/monitoring-alerting/how-monitoring-works/_index.md +++ b/content/rancher/v2.5/en/monitoring-alerting/how-monitoring-works/_index.md @@ -11,43 +11,57 @@ weight: 1 # 1. Architecture Overview -_**The following steps describe how data flows through the Monitoring V2 application:**_ +_**The following sections describe how data flows through the Monitoring V2 application:**_ -**1. ServiceMonitors and PodMonitors** declaratively specify targets, such as Services and Pods, that need to be monitored. +### Prometheus Operator + +Prometheus Operator observes ServiceMonitors, PodMonitors, and PrometheusRules being created. When the Prometheus configuration resources are created, Prometheus Operator calls the Prometheus API to sync the new configuration. As the diagram at the end of this section shows, the Prometheus Operator acts as the intermediary between Prometheus and Kubernetes, calling the Prometheus API to synchronize Prometheus with the monitoring-related resources in Kubernetes. + +### ServiceMonitors and PodMonitors + +ServiceMonitors and PodMonitors declaratively specify targets, such as Services and Pods, that need to be monitored. - Targets are scraped on a recurring schedule based on the configured Prometheus scrape interval, and the metrics that are scraped are stored into the Prometheus Time Series Database (TSDB). + - In order to perform the scrape, ServiceMonitors and PodMonitors are defined with label selectors that determine which Services or Pods should be scraped and endpoints that determine how the scrape should happen on the given target, e.g., scrape/metrics in TCP 10252, proxying through IP addr x.x.x.x. -- Out of the box, Monitoring V2 comes with certain pre-configured exporters that are deployed based on the type of Kubernetes cluster that it is deployed on. - - Certain internal Kubernetes components are scraped via a proxy deployed as part of Monitoring V2 called **PushProx**. The Kubernetes components that expose metrics to Prometheus through PushProx are the following: `kube-controller-manager`, `kube-scheduler`, `etcd`, and `kube-proxy`. - - For each PushProx exporter, we deploy one PushProx client onto all target nodes. For example, a PushProx client is deployed onto all controlplane nodes for kube-controller-manager, all etcd nodes for kube-etcd, and all nodes for kubelet. + +- Out of the box, Monitoring V2 comes with certain pre-configured exporters that are deployed based on the type of Kubernetes cluster that it is deployed on. For more information, see [Scraping and Exposing Metrics](#5-scraping-and-exposing-metrics). + +### How PushProx Works + +- Certain internal Kubernetes components are scraped via a proxy deployed as part of Monitoring V2 called **PushProx**. The Kubernetes components that expose metrics to Prometheus through PushProx are the following: +`kube-controller-manager`, `kube-scheduler`, `etcd`, and `kube-proxy`. + +- For each PushProx exporter, we deploy one PushProx client onto all target nodes. For example, a PushProx client is deployed onto all controlplane nodes for kube-controller-manager, all etcd nodes for kube-etcd, and all nodes for kubelet. - - We deploy exactly one PushProx proxy per exporter. The process for exporting metrics is as follows: +- We deploy exactly one PushProx proxy per exporter. The process for exporting metrics is as follows: - 1. The PushProx Client establishes an outbound connection with the PushProx Proxy. - 1. The client then polls the proxy for scrape requests that have come into the proxy. - 1. When the proxy receives a scrape request from Prometheus, the client sees it as a result of the poll. - 1. The client scrapes the internal component. - 1. The internal component responds by pushing metrics back to the proxy. +1. The PushProx Client establishes an outbound connection with the PushProx Proxy. +1. The client then polls the proxy for scrape requests that have come into the proxy. +1. When the proxy receives a scrape request from Prometheus, the client sees it as a result of the poll. +1. The client scrapes the internal component. +1. The internal component responds by pushing metrics back to the proxy. -
-
Process for Exporting Metrics with PushProx:
+

Process for Exporting Metrics with PushProx:
- ![Process for Exporting Metrics with PushProx]({{}}/img/rancher/pushprox-process.svg) +![Process for Exporting Metrics with PushProx]({{}}/img/rancher/pushprox-process.svg) - For more information, see [Scraping and Exposing Metrics](#5-scraping-and-exposing-metrics). +### PrometheusRules -**2. PrometheusRules** allow users to define rules for what metrics or time series database queries should result in alerts being fired. Rules are evaluated on an interval. +PrometheusRules allow users to define rules for what metrics or time series database queries should result in alerts being fired. Rules are evaluated on an interval. - **Recording rules** create a new time series based on existing series that have been collected. They are frequently used to precompute complex queries. - **Alerting rules** run a particular query and fire an alert from Prometheus if the query evaluates to a non-zero value. -**3. Prometheus Operator** observes ServiceMonitors, PodMonitors, and PrometheusRules being created. When the Prometheus configuration resources are created, Prometheus Operator calls the Prometheus API to sync the new configuration. +### Alert Routing -**4.** Once Prometheus determines that an alert needs to be fired, alerts are forwarded to **Alertmanager**. +Once Prometheus determines that an alert needs to be fired, alerts are forwarded to **Alertmanager**. - Alerts contain labels that come from the PromQL query itself and additional labels and annotations that can be provided as part of specifying the initial PrometheusRule. + - Before receiving any alerts, Alertmanager will use the **routes** and **receivers** specified in its configuration to form a routing tree on which all incoming alerts are evaluated. Each node of the routing tree can specify additional grouping, labeling, and filtering that needs to happen based on the labels attached to the Prometheus alert. A node on the routing tree (usually a leaf node) can also specify that an alert that reaches it needs to be sent out to a configured Receiver, e.g., Slack, PagerDuty, SMS, etc. Note that Alertmanager will send an alert first to **alertingDriver**, then alertingDriver will send or forward alert to the proper destination. + - Routes and receivers are also stored in the Kubernetes API via the Alertmanager Secret. When the Secret is updated, Alertmanager is also updated automatically. Note that routing occurs via labels only (not via annotations, etc.).
How data flows through the monitoring application:
@@ -94,6 +108,7 @@ Alerting rules are more commonly used. Whenever an alerting rule evaluates to a The Rule file adds labels and annotations to alerts before firing them, depending on the use case: - Labels indicate information that identifies the alert and could affect the routing of the alert. For example, if when sending an alert about a certain container, the container ID could be used as a label. + - Annotations denote information that doesn't affect where an alert is routed, for example, a runbook or an error message. # 3. How Alertmanager Works @@ -101,8 +116,11 @@ The Rule file adds labels and annotations to alerts before firing them, dependin The Alertmanager handles alerts sent by client applications such as the Prometheus server. It takes care of the following tasks: - Deduplicating, grouping, and routing alerts to the correct receiver integration such as email, PagerDuty, or OpsGenie + - Silencing and inhibition of alerts + - Tracking alerts that fire over time + - Sending out the status of whether an alert is currently firing, or if it is resolved ### Alerts Forwarded by alertingDrivers @@ -159,13 +177,13 @@ When the monitoring application is installed, you will be able to edit the follo | Route | Configuration block (part of Alertmanager) | Modifies the routing tree that is used to filter, label, and group alerts based on labels and send them to the appropriate Receiver. Automatically updates the Alertmanager custom resource. | | PrometheusRule | Custom resource | Defines additional queries that need to trigger alerts or define materialized views of existing series that are within Prometheus's TSDB. Automatically updates the Prometheus custom resource. | -### How PushProx Works +### PushProx PushProx allows Prometheus to scrape metrics across a network boundary, which prevents users from having to expose metrics ports for internal Kubernetes components on each node in a Kubernetes cluster. Since the metrics for Kubernetes components are generally exposed on the host network of nodes in the cluster, PushProx deploys a DaemonSet of clients that sit on the hostNetwork of each node and make an outbound connection to a single proxy that is sitting on the Kubernetes API. Prometheus can then be configured to proxy scrape requests through the proxy to each client, which allows it to scrape metrics from the internal Kubernetes components without requiring any inbound node ports to be open. -For more details about how PushProx works, refer to [Scraping Metrics with PushProx](#scraping-metrics-with-pushprox). +Refer to [Scraping Metrics with PushProx](#scraping-metrics-with-pushprox) for more. # 5. Scraping and Exposing Metrics @@ -191,7 +209,7 @@ Prometheus scrapes metrics from deployments known as [exporters,](https://promet ### Scraping Metrics with PushProx -Certain internal Kubernetes components are scraped via a proxy deployed as part of Monitoring V2 called PushProx. For detailed information on PushProx, refer [here](#pushprox) and to the above [architecture](#1-architecture-overview) section. +Certain internal Kubernetes components are scraped via a proxy deployed as part of Monitoring V2 called PushProx. For detailed information on PushProx, refer [here](#how-pushprox-works) and to the above [architecture](#1-architecture-overview) section. ### Scraping Metrics diff --git a/content/rancher/v2.6/en/monitoring-alerting/how-monitoring-works/_index.md b/content/rancher/v2.6/en/monitoring-alerting/how-monitoring-works/_index.md index 61c8a9c2c36..30b19cdbc66 100644 --- a/content/rancher/v2.6/en/monitoring-alerting/how-monitoring-works/_index.md +++ b/content/rancher/v2.6/en/monitoring-alerting/how-monitoring-works/_index.md @@ -11,44 +11,57 @@ weight: 1 # 1. Architecture Overview -_**The following steps describe how data flows through the Monitoring V2 application:**_ +_**The following sections describe how data flows through the Monitoring V2 application:**_ -**1. ServiceMonitors and PodMonitors** declaratively specify targets, such as Services and Pods, that need to be monitored. +### Prometheus Operator + +Prometheus Operator observes ServiceMonitors, PodMonitors, and PrometheusRules being created. When the Prometheus configuration resources are created, Prometheus Operator calls the Prometheus API to sync the new configuration. As the diagram at the end of this section shows, the Prometheus Operator acts as the intermediary between Prometheus and Kubernetes, calling the Prometheus API to synchronize Prometheus with the monitoring-related resources in Kubernetes. + +### ServiceMonitors and PodMonitors + +ServiceMonitors and PodMonitors declaratively specify targets, such as Services and Pods, that need to be monitored. - Targets are scraped on a recurring schedule based on the configured Prometheus scrape interval, and the metrics that are scraped are stored into the Prometheus Time Series Database (TSDB). + - In order to perform the scrape, ServiceMonitors and PodMonitors are defined with label selectors that determine which Services or Pods should be scraped and endpoints that determine how the scrape should happen on the given target, e.g., scrape/metrics in TCP 10252, proxying through IP addr x.x.x.x. -- Out of the box, Monitoring V2 comes with certain pre-configured exporters that are deployed based on the type of Kubernetes cluster that it is deployed on. - - Certain internal Kubernetes components are scraped via a proxy deployed as part of Monitoring V2 called **PushProx**. The Kubernetes components that expose metrics to Prometheus through PushProx are the following: - `kube-controller-manager`, `kube-scheduler`, `etcd`, and `kube-proxy`. - - For each PushProx exporter, we deploy one PushProx client onto all target nodes. For example, a PushProx client is deployed onto all controlplane nodes for kube-controller-manager, all etcd nodes for kube-etcd, and all nodes for kubelet. + +- Out of the box, Monitoring V2 comes with certain pre-configured exporters that are deployed based on the type of Kubernetes cluster that it is deployed on. For more information, see [Scraping and Exposing Metrics](#5-scraping-and-exposing-metrics). + +### How PushProx Works + +- Certain internal Kubernetes components are scraped via a proxy deployed as part of Monitoring V2 called **PushProx**. The Kubernetes components that expose metrics to Prometheus through PushProx are the following: +`kube-controller-manager`, `kube-scheduler`, `etcd`, and `kube-proxy`. + +- For each PushProx exporter, we deploy one PushProx client onto all target nodes. For example, a PushProx client is deployed onto all controlplane nodes for kube-controller-manager, all etcd nodes for kube-etcd, and all nodes for kubelet. - - We deploy exactly one PushProx proxy per exporter. The process for exporting metrics is as follows: +- We deploy exactly one PushProx proxy per exporter. The process for exporting metrics is as follows: - 1. The PushProx Client establishes an outbound connection with the PushProx Proxy. - 1. The client then polls the proxy for scrape requests that have come into the proxy. - 1. When the proxy receives a scrape request from Prometheus, the client sees it as a result of the poll. - 1. The client scrapes the internal component. - 1. The internal component responds by pushing metrics back to the proxy. +1. The PushProx Client establishes an outbound connection with the PushProx Proxy. +1. The client then polls the proxy for scrape requests that have come into the proxy. +1. When the proxy receives a scrape request from Prometheus, the client sees it as a result of the poll. +1. The client scrapes the internal component. +1. The internal component responds by pushing metrics back to the proxy. -
-
Process for Exporting Metrics with PushProx:
+

Process for Exporting Metrics with PushProx:
- ![Process for Exporting Metrics with PushProx]({{}}/img/rancher/pushprox-process.svg) +![Process for Exporting Metrics with PushProx]({{}}/img/rancher/pushprox-process.svg) - For more information, see [Scraping and Exposing Metrics](#5-scraping-and-exposing-metrics). +### PrometheusRules -**2. PrometheusRules** allow users to define rules for what metrics or time series database queries should result in alerts being fired. Rules are evaluated on an interval. +PrometheusRules allow users to define rules for what metrics or time series database queries should result in alerts being fired. Rules are evaluated on an interval. - **Recording rules** create a new time series based on existing series that have been collected. They are frequently used to precompute complex queries. - **Alerting rules** run a particular query and fire an alert from Prometheus if the query evaluates to a non-zero value. -**3. Prometheus Operator** observes ServiceMonitors, PodMonitors, and PrometheusRules being created. When the Prometheus configuration resources are created, Prometheus Operator calls the Prometheus API to sync the new configuration. +### Alert Routing -**4.** Once Prometheus determines that an alert needs to be fired, alerts are forwarded to **Alertmanager**. +Once Prometheus determines that an alert needs to be fired, alerts are forwarded to **Alertmanager**. - Alerts contain labels that come from the PromQL query itself and additional labels and annotations that can be provided as part of specifying the initial PrometheusRule. + - Before receiving any alerts, Alertmanager will use the **routes** and **receivers** specified in its configuration to form a routing tree on which all incoming alerts are evaluated. Each node of the routing tree can specify additional grouping, labeling, and filtering that needs to happen based on the labels attached to the Prometheus alert. A node on the routing tree (usually a leaf node) can also specify that an alert that reaches it needs to be sent out to a configured Receiver, e.g., Slack, PagerDuty, SMS, etc. Note that Alertmanager will send an alert first to **alertingDriver**, then alertingDriver will send or forward alert to the proper destination. + - Routes and receivers are also stored in the Kubernetes API via the Alertmanager Secret. When the Secret is updated, Alertmanager is also updated automatically. Note that routing occurs via labels only (not via annotations, etc.).
How data flows through the monitoring application:
@@ -95,6 +108,7 @@ Alerting rules are more commonly used. Whenever an alerting rule evaluates to a The Rule file adds labels and annotations to alerts before firing them, depending on the use case: - Labels indicate information that identifies the alert and could affect the routing of the alert. For example, if when sending an alert about a certain container, the container ID could be used as a label. + - Annotations denote information that doesn't affect where an alert is routed, for example, a runbook or an error message. # 3. How Alertmanager Works @@ -102,8 +116,11 @@ The Rule file adds labels and annotations to alerts before firing them, dependin The Alertmanager handles alerts sent by client applications such as the Prometheus server. It takes care of the following tasks: - Deduplicating, grouping, and routing alerts to the correct receiver integration such as email, PagerDuty, or OpsGenie + - Silencing and inhibition of alerts + - Tracking alerts that fire over time + - Sending out the status of whether an alert is currently firing, or if it is resolved ### Alerts Forwarded by alertingDrivers @@ -160,13 +177,13 @@ When the monitoring application is installed, you will be able to edit the follo | Route | Configuration block (part of Alertmanager) | Modifies the routing tree that is used to filter, label, and group alerts based on labels and send them to the appropriate Receiver. Automatically updates the Alertmanager custom resource. | | PrometheusRule | Custom resource | Defines additional queries that need to trigger alerts or define materialized views of existing series that are within Prometheus's TSDB. Automatically updates the Prometheus custom resource. | -### How PushProx Works +### PushProx PushProx allows Prometheus to scrape metrics across a network boundary, which prevents users from having to expose metrics ports for internal Kubernetes components on each node in a Kubernetes cluster. Since the metrics for Kubernetes components are generally exposed on the host network of nodes in the cluster, PushProx deploys a DaemonSet of clients that sit on the hostNetwork of each node and make an outbound connection to a single proxy that is sitting on the Kubernetes API. Prometheus can then be configured to proxy scrape requests through the proxy to each client, which allows it to scrape metrics from the internal Kubernetes components without requiring any inbound node ports to be open. -For more details about how PushProx works, refer to [Scraping Metrics with PushProx](#scraping-metrics-with-pushprox). +Refer to [Scraping Metrics with PushProx](#scraping-metrics-with-pushprox) for more. # 5. Scraping and Exposing Metrics @@ -192,7 +209,7 @@ Prometheus scrapes metrics from deployments known as [exporters,](https://promet ### Scraping Metrics with PushProx -Certain internal Kubernetes components are scraped via a proxy deployed as part of Monitoring V2 called PushProx. For detailed information on PushProx, refer [here](#pushprox) and to the above [architecture](#1-architecture-overview) section. +Certain internal Kubernetes components are scraped via a proxy deployed as part of Monitoring V2 called PushProx. For detailed information on PushProx, refer [here](#how-pushprox-works) and to the above [architecture](#1-architecture-overview) section. ### Scraping Metrics From 17fbfa4c7c92dd3536d922577ee2415e80d4d50f Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 10 Jan 2022 15:14:20 -0500 Subject: [PATCH 154/478] Updated markdown to avoid line break --- content/rancher/v2.6/en/helm-charts/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/helm-charts/_index.md b/content/rancher/v2.6/en/helm-charts/_index.md index 6ae40370bae..87f6667f382 100644 --- a/content/rancher/v2.6/en/helm-charts/_index.md +++ b/content/rancher/v2.6/en/helm-charts/_index.md @@ -29,7 +29,7 @@ These items represent helm repositories, and can be either traditional helm endp > > As of Rancher v2.6.3, a new value `disableSameOriginCheck` has been added to the Repo.Spec. This allows users to bypass the same origin checks, sending the repository Authentication information as a Basic Auth Header with all API calls. This is not recommended but can be used as a temporary solution in cases of non-standard Helm chart repositories such as those that have redirects to a different origin URL. > -> To use this feature for an existing Helm chart repository, click **⋮ > Edit YAML**. On the `spec` portion of the YAML file, add `disableSameOriginCheck` and set it to `true`. +> To use this feature for an existing Helm chart repository, click on ⋮ > Edit YAML. On the `spec` portion of the YAML file, add `disableSameOriginCheck` and set it to `true`. > > ```yaml [...] From 9ff5b2a046d6cb487360c4fc7adae482e95d4943 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 10 Jan 2022 15:18:08 -0500 Subject: [PATCH 155/478] Updated phrase --- content/rancher/v2.6/en/helm-charts/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/helm-charts/_index.md b/content/rancher/v2.6/en/helm-charts/_index.md index 87f6667f382..bbc402a0683 100644 --- a/content/rancher/v2.6/en/helm-charts/_index.md +++ b/content/rancher/v2.6/en/helm-charts/_index.md @@ -29,7 +29,7 @@ These items represent helm repositories, and can be either traditional helm endp > > As of Rancher v2.6.3, a new value `disableSameOriginCheck` has been added to the Repo.Spec. This allows users to bypass the same origin checks, sending the repository Authentication information as a Basic Auth Header with all API calls. This is not recommended but can be used as a temporary solution in cases of non-standard Helm chart repositories such as those that have redirects to a different origin URL. > -> To use this feature for an existing Helm chart repository, click on ⋮ > Edit YAML. On the `spec` portion of the YAML file, add `disableSameOriginCheck` and set it to `true`. +> To use this feature for an existing Helm chart repository, click ⋮ > Edit YAML. On the `spec` portion of the YAML file, add `disableSameOriginCheck` and set it to `true`. > > ```yaml [...] From 7a11358efca02deaed4015b827a86567b829478a Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 10 Jan 2022 15:24:44 -0500 Subject: [PATCH 156/478] Updated markdown to avoid line break --- content/rancher/v2.5/en/helm-charts/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/helm-charts/_index.md b/content/rancher/v2.5/en/helm-charts/_index.md index 8ca0ff4450f..9dc759f7e3b 100644 --- a/content/rancher/v2.5/en/helm-charts/_index.md +++ b/content/rancher/v2.5/en/helm-charts/_index.md @@ -54,7 +54,7 @@ These items represent helm repositories, and can be either traditional helm endp > > As of Rancher v2.5.12, a new value `disableSameOriginCheck` has been added to the Repo.Spec. This allows users to bypass the same origin checks, sending the repository Authentication information as a Basic Auth Header with all API calls. This is not recommended but can be used as a temporary solution in cases of non-standard Helm chart repositories such as those that have redirects to a different origin URL. > -> To use this feature for an existing Helm chart repository, click **⋮ > Edit YAML**. On the `spec` portion of the YAML file, add `disableSameOriginCheck` and set it to `true`. +> To use this feature for an existing Helm chart repository, click ⋮ > Edit YAML. On the `spec` portion of the YAML file, add `disableSameOriginCheck` and set it to `true`. > > ```yaml [...] From 6bf52ac4236435628d79db2bffc6f105a650f35d Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 10 Jan 2022 22:15:59 +0000 Subject: [PATCH 157/478] Alphabetized table --- content/rancher/v2.6/en/helm-charts/_index.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/content/rancher/v2.6/en/helm-charts/_index.md b/content/rancher/v2.6/en/helm-charts/_index.md index bf42cde74fb..09ceebc7c98 100644 --- a/content/rancher/v2.6/en/helm-charts/_index.md +++ b/content/rancher/v2.6/en/helm-charts/_index.md @@ -17,23 +17,23 @@ Starting in Rancher v2.6.0, a new versioning scheme for Rancher feature charts w | **Name** | **Supported Minimum Version** | **Supported Maximum Version** | | ---------------- | ------------ | ------------ | -| rancher-alerting-drivers | 100.0.0 | 100.0.1 | -| rancher-cis-benchmark | 2.0.0 | 2.0.2 | | external-ip-webhook | 100.0.0+up1.0.0 | 100.0.1+up1.0.1 | | harvester-cloud-provider | 100.0.0+up0.1.8 | 100.0.0+up0.1.8 | | harvester-csi-driver | 100.0.0+up0.1.9 | 100.0.0+up0.1.9 | +| rancher-alerting-drivers | 100.0.0 | 100.0.1 | +| rancher-backups | 2.0.0 | 2.1.0 | +| rancher-cis-benchmark | 2.0.0 | 2.0.2 | +| rancher-gatekeeper | 100.0.0+up3.5.1 | 100.0.1+up3.6.0 | | rancher-istio | 100.0.0+up1.10.4 | 100.1.0+up1.11.4 | | rancher-logging | 100.0.0+up3.12.0 | 100.0.1+up3.15.0 | | rancher-longhorn | 100.0.0+up1.1.2 | 100.1.1+up1.2.3 | | rancher-monitoring | 100.0.0+up16.6.0 | 100.1.0+up19.0.3 -| rancher-gatekeeper | 100.0.0+up3.5.1 | 100.0.1+up3.6.0 | -| rancher-backups | 2.0.0 | 2.1.0 | -| rancher-wins-upgrader | 100.0.0+up0.0.1 | 100.0.0+up0.0.1 | -| rancher-sriov (experimental) | 100.0.0+up0.1.0 | 100.0.1+up0.1.0 | +| rancher-sriov (experimental) | 100.0.0+up0.1.0 | 100.0.1+up0.1.0 | | rancher-vsphere-cpi | 100.0.0 | 100.1.0+up1.0.100 | rancher-vsphere-csi | 100.0.0 | 100.1.0+up2.3.0 | +| rancher-wins-upgrader | 100.0.0+up0.0.1 | 100.0.0+up0.0.1 | -
+
**Charts based on upstream:** For charts that are based on upstreams, the +up annotation should inform you of what upstream version the Rancher chart is tracking. Check the upstream version compatibility with Rancher during upgrades also. - As an example, `100.x.x+up16.6.0` for Monitoring tracks upstream kube-prometheus-stack `16.6.0` with some Rancher patches added to it. From 31895c8403e2435b3f6c744c72813b79072c5978 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 11 Jan 2022 15:53:20 +0000 Subject: [PATCH 158/478] Updated command for 2.0 - 2.4 --- .../installation/install-rancher-on-k8s/chart-options/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.0-v2.4/en/installation/install-rancher-on-k8s/chart-options/_index.md b/content/rancher/v2.0-v2.4/en/installation/install-rancher-on-k8s/chart-options/_index.md index ff6631bef9a..f027000a6cb 100644 --- a/content/rancher/v2.0-v2.4/en/installation/install-rancher-on-k8s/chart-options/_index.md +++ b/content/rancher/v2.0-v2.4/en/installation/install-rancher-on-k8s/chart-options/_index.md @@ -126,7 +126,7 @@ To customize or use a different ingress with Rancher server you can set your own Example on setting a custom certificate issuer: ```plain ---set ingress.extraAnnotations.'certmanager\.k8s\.io/cluster-issuer'=ca-key-pair +--set ingress.extraAnnotations.'cert-manager\.io/cluster-issuer'=issuer-name ``` Example on setting a static proxy header with `ingress.configurationSnippet`. This value is parsed like a template so variables can be used. From 322b9b65610e4f6abb9809a1d5e37dce0197452d Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 11 Jan 2022 15:53:35 +0000 Subject: [PATCH 159/478] Updated command for 2.6 --- .../installation/install-rancher-on-k8s/chart-options/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/_index.md index 9ce31bc66f9..4436fcfe473 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/_index.md @@ -137,7 +137,7 @@ To customize or use a different ingress with Rancher server you can set your own Example on setting a custom certificate issuer: ```plain ---set ingress.extraAnnotations.'certmanager\.k8s\.io/cluster-issuer'=ca-key-pair +--set ingress.extraAnnotations.'cert-manager\.io/cluster-issuer'=issuer-name ``` Example on setting a static proxy header with `ingress.configurationSnippet`. This value is parsed like a template so variables can be used. From 385563f867bfff0358abcce19c68146d446768f2 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 11 Jan 2022 15:55:58 +0000 Subject: [PATCH 160/478] Removed command setting ingress.tls.source to secret --- .../installation/install-rancher-on-k8s/chart-options/_index.md | 1 - 1 file changed, 1 deletion(-) diff --git a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/chart-options/_index.md b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/chart-options/_index.md index 56b1ccd7514..e1572af146b 100644 --- a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/chart-options/_index.md +++ b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/chart-options/_index.md @@ -124,7 +124,6 @@ To customize or use a different ingress with Rancher server you can set your own Example on setting a custom certificate issuer: ```plain ---set ingress.tls.source=secret --set ingress.extraAnnotations.'cert-manager\.io/cluster-issuer'=issuer-name ``` From c055a1e55acd28b3a3e7981b87b44be565b71ae6 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 12 Jan 2022 15:52:40 -0500 Subject: [PATCH 161/478] Adding notes for migrating rancher caveats --- .../v2.6/en/backups/migrating-rancher/_index.md | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/backups/migrating-rancher/_index.md b/content/rancher/v2.6/en/backups/migrating-rancher/_index.md index 605d917fea0..1597884c790 100644 --- a/content/rancher/v2.6/en/backups/migrating-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/migrating-rancher/_index.md @@ -11,6 +11,8 @@ These instructions assume you have [created a backup](../back-up-rancher) and yo It is required to use the same hostname that was set as the server URL in the first cluster. +>**Note:** To change the Rancher URL for migration, you'll need to update the agents on the downstream cluster using the [`cluster-agent-tool`](https://github.com/rancherlabs/support-tools/tree/master/cluster-agent-tool). If not done, downstream clusters will show as unavailable in the cluster management page of the UI, and you won't be able to click inside the cluster or go to Cluster Explore. + Rancher version must be v2.5.0 and up Rancher can be installed on any Kubernetes cluster, including hosted Kubernetes clusters such as Amazon EKS clusters. For help installing Kubernetes, refer to the documentation of the Kubernetes distribution. One of Rancher's Kubernetes distributions may also be used: @@ -36,7 +38,10 @@ helm install rancher-backup rancher-charts/rancher-backup -n cattle-resources-sy > > - Note that when making or restoring backups for v1.22, the Rancher version and the local cluster's Kubernetes version should be the same. The Kubernetes version should be considered when restoring a backup since the supported apiVersion in the cluster and in the backup file could be different. -If you are using an S3 store as the backup source, and need to use your S3 credentials for restore, create a secret in this cluster using your S3 credentials. The Secret data must have two keys, `accessKey` and `secretKey` containing the s3 credentials like this: +If you are using an S3 store as the backup source and need to use your S3 credentials for restore, create a secret in this cluster using your S3 credentials. The Secret data must have two keys - `accessKey` and `secretKey` - that contain the s3 credentials. + +>**Warning:** The values `accessKey` and `secretKey` in the example below must be base64-encoded first when creating the object directly. If not encoded first, the pasted values will cause errors when you are attempting to backup or restore. + ```yaml apiVersion: v1 @@ -49,7 +54,7 @@ stringData: secretKey: ``` -This secret can be created in any namespace, with the above example it will get created in the default namespace +This secret can be created in any namespace, with the above example it will get created in the default namespace. In the Restore custom resource, `prune` must be set to false. @@ -89,6 +94,12 @@ spec: kubectl apply -f migrationResource.yaml ``` +>**EKS Cluster security group caveats:** +> +>- During restore or migration, you must regenerate your kubeconfig or API tokens. +> +>- You must also configure the HTTPS 443 connectivity between the Rancher Server and the downstream clusters during a restore. + ### 3. Install cert-manager Follow the steps to [install cert-manager]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/#5-install-cert-manager) in the documentation about installing cert-manager on Kubernetes. From c1ffaf19b586df69c6975b7926382594bc6e17fd Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 12 Jan 2022 17:54:22 -0500 Subject: [PATCH 162/478] Revised per feedback in Slack --- .../en/backups/migrating-rancher/_index.md | 19 +++++-------------- 1 file changed, 5 insertions(+), 14 deletions(-) diff --git a/content/rancher/v2.6/en/backups/migrating-rancher/_index.md b/content/rancher/v2.6/en/backups/migrating-rancher/_index.md index 1597884c790..4b0a9869b62 100644 --- a/content/rancher/v2.6/en/backups/migrating-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/migrating-rancher/_index.md @@ -9,9 +9,7 @@ If you are migrating Rancher to a new Kubernetes cluster, you don't need to inst These instructions assume you have [created a backup](../back-up-rancher) and you have already installed a new Kubernetes cluster where Rancher will be deployed. -It is required to use the same hostname that was set as the server URL in the first cluster. - ->**Note:** To change the Rancher URL for migration, you'll need to update the agents on the downstream cluster using the [`cluster-agent-tool`](https://github.com/rancherlabs/support-tools/tree/master/cluster-agent-tool). If not done, downstream clusters will show as unavailable in the cluster management page of the UI, and you won't be able to click inside the cluster or go to Cluster Explore. +>**Warning:** It is required to use the same hostname that was set as the server URL in the first cluster. If not done, downstream clusters will show as unavailable in the cluster management page of the UI, and you won't be able to click inside the cluster or on the cluster's Explore button. Rancher version must be v2.5.0 and up @@ -38,10 +36,9 @@ helm install rancher-backup rancher-charts/rancher-backup -n cattle-resources-sy > > - Note that when making or restoring backups for v1.22, the Rancher version and the local cluster's Kubernetes version should be the same. The Kubernetes version should be considered when restoring a backup since the supported apiVersion in the cluster and in the backup file could be different. -If you are using an S3 store as the backup source and need to use your S3 credentials for restore, create a secret in this cluster using your S3 credentials. The Secret data must have two keys - `accessKey` and `secretKey` - that contain the s3 credentials. - ->**Warning:** The values `accessKey` and `secretKey` in the example below must be base64-encoded first when creating the object directly. If not encoded first, the pasted values will cause errors when you are attempting to backup or restore. +If you are using an S3 store as the backup source and need to use your S3 credentials for restore, create a secret in this cluster using your S3 credentials. The Secret data must have two keys - `accessKey` and `secretKey` - that contain the S3 credentials. +**Warning:** The values `accessKey` and `secretKey` in the example below must be base64-encoded first when creating the object directly. If not encoded first, the pasted values will cause errors when you are attempting to backup or restore. ```yaml apiVersion: v1 @@ -54,7 +51,7 @@ stringData: secretKey: ``` -This secret can be created in any namespace, with the above example it will get created in the default namespace. +This secret can be created in any namespace; with the above example, it will get created in the default namespace. In the Restore custom resource, `prune` must be set to false. @@ -92,13 +89,7 @@ spec: 1. Then apply the resource: ``` kubectl apply -f migrationResource.yaml - ``` - ->**EKS Cluster security group caveats:** -> ->- During restore or migration, you must regenerate your kubeconfig or API tokens. -> ->- You must also configure the HTTPS 443 connectivity between the Rancher Server and the downstream clusters during a restore. + ``` ### 3. Install cert-manager From ec12cfa6280b406cd2e4f290f75af6dc275d9802 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 12 Jan 2022 18:14:59 -0500 Subject: [PATCH 163/478] Removed extra space --- content/rancher/v2.6/en/backups/migrating-rancher/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/backups/migrating-rancher/_index.md b/content/rancher/v2.6/en/backups/migrating-rancher/_index.md index 4b0a9869b62..74d45de2d91 100644 --- a/content/rancher/v2.6/en/backups/migrating-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/migrating-rancher/_index.md @@ -89,7 +89,7 @@ spec: 1. Then apply the resource: ``` kubectl apply -f migrationResource.yaml - ``` + ``` ### 3. Install cert-manager From 351792a7c0c1f90fe47b00208fa6e17acfe7c095 Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Thu, 13 Jan 2022 16:05:15 +0100 Subject: [PATCH 164/478] Update Node version Signed-off-by: Guilherme Macedo --- Dockerfile.build | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile.build b/Dockerfile.build index 614b1980fc8..a50a0e1e472 100644 --- a/Dockerfile.build +++ b/Dockerfile.build @@ -1,4 +1,4 @@ -FROM node:8-alpine +FROM node:16-alpine RUN apk update && apk add py-pygments bash git asciidoc gcompat && rm -rf /var/cache/apk/* From b505968a9385cca1f7b2504ee9d6f7ac766d17ee Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 13 Jan 2022 16:17:37 -0800 Subject: [PATCH 165/478] Move section placement and add missing header --- .../eks/permissions/_index.md | 105 +++++++++--------- .../eks/permissions/_index.md | 105 +++++++++--------- 2 files changed, 110 insertions(+), 100 deletions(-) diff --git a/content/rancher/v2.5/en/cluster-provisioning/hosted-kubernetes-clusters/eks/permissions/_index.md b/content/rancher/v2.5/en/cluster-provisioning/hosted-kubernetes-clusters/eks/permissions/_index.md index 0567e110d02..521046e6e86 100644 --- a/content/rancher/v2.5/en/cluster-provisioning/hosted-kubernetes-clusters/eks/permissions/_index.md +++ b/content/rancher/v2.5/en/cluster-provisioning/hosted-kubernetes-clusters/eks/permissions/_index.md @@ -123,31 +123,6 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b ### Service Role Permissions -Rancher will create a service role with the following trust policy: - -```json -{ - "Version": "2012-10-17", - "Statement": [ - { - "Action": "sts:AssumeRole", - "Principal": { - "Service": "eks.amazonaws.com" - }, - "Effect": "Allow", - "Sid": "" - } - ] -} -``` - -This role will also have two role policy attachments with the following policies ARNs: - -``` -arn:aws:iam::aws:policy/AmazonEKSClusterPolicy -arn:aws:iam::aws:policy/AmazonEKSServicePolicy -``` - Permissions required for Rancher to create service role on users behalf during the EKS cluster creation process. ```json @@ -182,36 +157,66 @@ Permissions required for Rancher to create service role on users behalf during t } ``` +When an EKS cluster is created, Rancher will create a service role with the following trust policy: + +```json +{ + "Version": "2012-10-17", + "Statement": [ + { + "Action": "sts:AssumeRole", + "Principal": { + "Service": "eks.amazonaws.com" + }, + "Effect": "Allow", + "Sid": "" + } + ] +} +``` + +This role will also have two role policy attachments with the following policies ARNs: + +``` +arn:aws:iam::aws:policy/AmazonEKSClusterPolicy +arn:aws:iam::aws:policy/AmazonEKSServicePolicy +``` + ### VPC Permissions Permissions required for Rancher to create VPC and associated resources. ```json { - "Sid": "VPCPermissions", - "Effect": "Allow", - "Action": [ - "ec2:ReplaceRoute", - "ec2:ModifyVpcAttribute", - "ec2:ModifySubnetAttribute", - "ec2:DisassociateRouteTable", - "ec2:DetachInternetGateway", - "ec2:DescribeVpcs", - "ec2:DeleteVpc", - "ec2:DeleteTags", - "ec2:DeleteSubnet", - "ec2:DeleteRouteTable", - "ec2:DeleteRoute", - "ec2:DeleteInternetGateway", - "ec2:CreateVpc", - "ec2:CreateSubnet", - "ec2:CreateSecurityGroup", - "ec2:CreateRouteTable", - "ec2:CreateRoute", - "ec2:CreateInternetGateway", - "ec2:AttachInternetGateway", - "ec2:AssociateRouteTable" - ], - "Resource": "*" + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "VPCPermissions", + "Effect": "Allow", + "Action": [ + "ec2:ReplaceRoute", + "ec2:ModifyVpcAttribute", + "ec2:ModifySubnetAttribute", + "ec2:DisassociateRouteTable", + "ec2:DetachInternetGateway", + "ec2:DescribeVpcs", + "ec2:DeleteVpc", + "ec2:DeleteTags", + "ec2:DeleteSubnet", + "ec2:DeleteRouteTable", + "ec2:DeleteRoute", + "ec2:DeleteInternetGateway", + "ec2:CreateVpc", + "ec2:CreateSubnet", + "ec2:CreateSecurityGroup", + "ec2:CreateRouteTable", + "ec2:CreateRoute", + "ec2:CreateInternetGateway", + "ec2:AttachInternetGateway", + "ec2:AssociateRouteTable" + ], + "Resource": "*" + } + ] } ``` \ No newline at end of file diff --git a/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/eks/permissions/_index.md b/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/eks/permissions/_index.md index 0567e110d02..521046e6e86 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/eks/permissions/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/eks/permissions/_index.md @@ -123,31 +123,6 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b ### Service Role Permissions -Rancher will create a service role with the following trust policy: - -```json -{ - "Version": "2012-10-17", - "Statement": [ - { - "Action": "sts:AssumeRole", - "Principal": { - "Service": "eks.amazonaws.com" - }, - "Effect": "Allow", - "Sid": "" - } - ] -} -``` - -This role will also have two role policy attachments with the following policies ARNs: - -``` -arn:aws:iam::aws:policy/AmazonEKSClusterPolicy -arn:aws:iam::aws:policy/AmazonEKSServicePolicy -``` - Permissions required for Rancher to create service role on users behalf during the EKS cluster creation process. ```json @@ -182,36 +157,66 @@ Permissions required for Rancher to create service role on users behalf during t } ``` +When an EKS cluster is created, Rancher will create a service role with the following trust policy: + +```json +{ + "Version": "2012-10-17", + "Statement": [ + { + "Action": "sts:AssumeRole", + "Principal": { + "Service": "eks.amazonaws.com" + }, + "Effect": "Allow", + "Sid": "" + } + ] +} +``` + +This role will also have two role policy attachments with the following policies ARNs: + +``` +arn:aws:iam::aws:policy/AmazonEKSClusterPolicy +arn:aws:iam::aws:policy/AmazonEKSServicePolicy +``` + ### VPC Permissions Permissions required for Rancher to create VPC and associated resources. ```json { - "Sid": "VPCPermissions", - "Effect": "Allow", - "Action": [ - "ec2:ReplaceRoute", - "ec2:ModifyVpcAttribute", - "ec2:ModifySubnetAttribute", - "ec2:DisassociateRouteTable", - "ec2:DetachInternetGateway", - "ec2:DescribeVpcs", - "ec2:DeleteVpc", - "ec2:DeleteTags", - "ec2:DeleteSubnet", - "ec2:DeleteRouteTable", - "ec2:DeleteRoute", - "ec2:DeleteInternetGateway", - "ec2:CreateVpc", - "ec2:CreateSubnet", - "ec2:CreateSecurityGroup", - "ec2:CreateRouteTable", - "ec2:CreateRoute", - "ec2:CreateInternetGateway", - "ec2:AttachInternetGateway", - "ec2:AssociateRouteTable" - ], - "Resource": "*" + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "VPCPermissions", + "Effect": "Allow", + "Action": [ + "ec2:ReplaceRoute", + "ec2:ModifyVpcAttribute", + "ec2:ModifySubnetAttribute", + "ec2:DisassociateRouteTable", + "ec2:DetachInternetGateway", + "ec2:DescribeVpcs", + "ec2:DeleteVpc", + "ec2:DeleteTags", + "ec2:DeleteSubnet", + "ec2:DeleteRouteTable", + "ec2:DeleteRoute", + "ec2:DeleteInternetGateway", + "ec2:CreateVpc", + "ec2:CreateSubnet", + "ec2:CreateSecurityGroup", + "ec2:CreateRouteTable", + "ec2:CreateRoute", + "ec2:CreateInternetGateway", + "ec2:AttachInternetGateway", + "ec2:AssociateRouteTable" + ], + "Resource": "*" + } + ] } ``` \ No newline at end of file From 4026e8c74ddbac1a9a23236542a144f51a3da36c Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 14 Jan 2022 15:25:22 -0500 Subject: [PATCH 166/478] Added additional step for ACE enablement --- .../en/cluster-provisioning/registered-clusters/_index.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md index 0891f46df79..fc6c44e175c 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md @@ -168,7 +168,7 @@ Authorized Cluster Endpoint (ACE) support has been added for registered RKE2 and > > - The following steps will work on both RKE2 and K3s clusters registered in v2.6.x as well as those registered (or imported) from a previous version of Rancher with an upgrade to v2.6.x. > -> - These steps will alter the configuration of the downstream RKE2 and K3s clusters and deploy the `kube-api-authn-webhook`. If a future implementation of ACE requires an update to the `kube-api-authn-webhook`, then this would also have to be done manually. For more information on this webhook, click [here]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/ace/#about-the-kube-api-auth-authentication-webhook). +> - These steps will alter the configuration of the downstream RKE2 and K3s clusters and deploy the `kube-api-authn-webhook`. If a future implementation of the ACE requires an update to the `kube-api-authn-webhook`, then this would also have to be done manually. For more information on this webhook, click [here]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/ace/#about-the-kube-api-auth-authentication-webhook). ###### **Manual steps to be taken on the control plane of each downstream cluster to enable ACE:** @@ -197,11 +197,15 @@ Authorized Cluster Endpoint (ACE) support has been added for registered RKE2 and kube-apiserver-arg: - authentication-token-webhook-config-file=/var/lib/rancher/{rke2,k3s}/kube-api-authn-webhook.yaml -1. Finally, run the following commands: +1. Run the following commands: sudo systemctl stop {rke2,k3s}-server sudo systemctl start {rke2,k3s}-server +1. Finally, you **must** go back to the Rancher UI and edit the imported cluster there to complete the ACE enablement. Click on **⋮ > Edit Config**, then click the **Networking** tab under Cluster Configuration. Finally, click the **Enabled** button for **Authorized Endpoint**. Once the ACE is enabled, you then have the option of entering a fully qualified domain name (FQDN) and certificate information. + + >**Note:** The FQDN field is optional, and if one is entered, it should point to the downstream cluster. Certificate information is only needed if there is a load balancer in front of the downstream cluster that is using an untrusted certificate. If you have a valid certificate, make no changes to the CA Certificates field. + # Annotating Registered Clusters For all types of registered Kubernetes clusters except for K3s Kubernetes clusters, Rancher doesn't have any information about how the cluster is provisioned or configured. From c11c320316d0488f0958a6c97fa9f65eb06646fd Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 14 Jan 2022 21:38:27 +0000 Subject: [PATCH 167/478] Added section for imported EKS cluster parameters; also added managed node group prereq for imported EKS clusters --- .../registered-clusters/_index.md | 34 +++++++++++++++++-- 1 file changed, 32 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md index 0891f46df79..6c3c8b0d4f8 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md @@ -17,13 +17,13 @@ The control that Rancher has to manage a registered cluster depends on the type # Prerequisites -## Kubernetes Node Roles +### Kubernetes Node Roles Registered RKE Kubernetes clusters must have all three node roles - etcd, controlplane and worker. A cluster with only controlplane components cannot be registered in Rancher. For more information on RKE node roles, see the [best practices.]({{}}/rancher/v2.6/en/cluster-provisioning/production/#cluster-architecture) -## Permissions +### Permissions If your existing Kubernetes cluster already has a `cluster-admin` role defined, you must have this `cluster-admin` privilege to register the cluster in Rancher. @@ -41,6 +41,10 @@ By default, GKE users are not given this privilege, so you will need to run the If you are registering a K3s cluster, make sure the `cluster.yml` is readable. It is protected by default. For details, refer to [Configuring a K3s cluster to enable importation to Rancher.](#configuring-a-k3s-cluster-to-enable-registration-in-rancher) +### EKS Clusters + +EKS clusters must have at least one managed node group to be imported into Rancher or provisioned from Rancher successfully. + # Registering a Cluster 1. Click **☰ > Cluster Management**. @@ -82,6 +86,32 @@ The option can also be specified using the environment variable `K3S_KUBECONFIG_ $ curl -sfL https://get.k3s.io | K3S_KUBECONFIG_MODE="644" sh -s - ``` +### Configuring an Imported EKS Cluster with Terraform + +You should define **only** the minimum fields that Rancher requires when importing an EKS cluster with Terraform. This is important as Rancher will overwrite what was in the EKS cluster with any config that the user has provided, whether that config is valid or not. + +The minimum config fields required by Rancher to import EKS clusters with Terraform using `eks_config_v2` are as follows: + +- cloud_credential_id +- name +- region +- imported (this field should always be set to `true` for imported clusters) + +Example YAML configuration for imported EKS clusters: + +``` +resource "rancher2_cluster" "my-eks-to-import" { + name = "my-eks-to-import" + description = "Terraform EKS Cluster" + eks_config_v2 { + cloud_credential_id = rancher2_cloud_credential.aws.id + name = var.aws_eks_name + region = var.aws_region + imported = true + } +} +``` + # Management Capabilities for Registered Clusters The control that Rancher has to manage a registered cluster depends on the type of cluster. From 568b0b064130f31d14a927a247ad17f2a740224f Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 14 Jan 2022 21:49:49 +0000 Subject: [PATCH 168/478] Added section for imported EKS cluster parameters; also added managed node group prereq for imported EKS clusters for 2.5 --- .../registered-clusters/_index.md | 41 +++++++++++++++++-- 1 file changed, 38 insertions(+), 3 deletions(-) diff --git a/content/rancher/v2.5/en/cluster-provisioning/registered-clusters/_index.md b/content/rancher/v2.5/en/cluster-provisioning/registered-clusters/_index.md index 22995693f7a..faa23bcce86 100644 --- a/content/rancher/v2.5/en/cluster-provisioning/registered-clusters/_index.md +++ b/content/rancher/v2.5/en/cluster-provisioning/registered-clusters/_index.md @@ -23,13 +23,13 @@ The control that Rancher has to manage a registered cluster depends on the type {{% tabs %}} {{% tab "v2.5.9+" %}} -## Kubernetes Node Roles +### Kubernetes Node Roles Registered RKE Kubernetes clusters must have all three node roles - etcd, controlplane and worker. A cluster with only controlplane components cannot be registered in Rancher. For more information on RKE node roles, see the [best practices.]({{}}/rancher/v2.5/en/cluster-provisioning/production/#cluster-architecture) -## Permissions +### Permissions If your existing Kubernetes cluster already has a `cluster-admin` role defined, you must have this `cluster-admin` privilege to register the cluster in Rancher. @@ -47,10 +47,14 @@ By default, GKE users are not given this privilege, so you will need to run the If you are registering a K3s cluster, make sure the `cluster.yml` is readable. It is protected by default. For details, refer to [Configuring a K3s cluster to enable importation to Rancher.](#configuring-a-k3s-cluster-to-enable-registration-in-rancher) +### EKS Clusters + +EKS clusters must have at least one managed node group to be imported into Rancher or provisioned from Rancher successfully. + {{% /tab %}} {{% tab "Rancher before v2.5.9" %}} -## Permissions +### Permissions If your existing Kubernetes cluster already has a `cluster-admin` role defined, you must have this `cluster-admin` privilege to register the cluster in Rancher. @@ -67,6 +71,11 @@ before running the `kubectl` command to register the cluster. By default, GKE users are not given this privilege, so you will need to run the command before registering GKE clusters. To learn more about role-based access control for GKE, please click [here](https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control). If you are registering a K3s cluster, make sure the `cluster.yml` is readable. It is protected by default. For details, refer to [Configuring a K3s cluster to enable importation to Rancher.](#configuring-a-k3s-cluster-to-enable-registration-in-rancher) + +### EKS Clusters + +EKS clusters must have at least one managed node group to be imported into Rancher or provisioned from Rancher successfully. + {{% /tab %}} {{% /tabs %}} @@ -110,6 +119,32 @@ The option can also be specified using the environment variable `K3S_KUBECONFIG_ $ curl -sfL https://get.k3s.io | K3S_KUBECONFIG_MODE="644" sh -s - ``` +### Configuring an Imported EKS Cluster with Terraform + +You should define **only** the minimum fields that Rancher requires when importing an EKS cluster with Terraform. This is important as Rancher will overwrite what was in the EKS cluster with any config that the user has provided, whether that config is valid or not. + +The minimum config fields required by Rancher to import EKS clusters with Terraform using `eks_config_v2` are as follows: + +- cloud_credential_id +- name +- region +- imported (this field should always be set to `true` for imported clusters) + +Example YAML configuration for imported EKS clusters: + +``` +resource "rancher2_cluster" "my-eks-to-import" { + name = "my-eks-to-import" + description = "Terraform EKS Cluster" + eks_config_v2 { + cloud_credential_id = rancher2_cloud_credential.aws.id + name = var.aws_eks_name + region = var.aws_region + imported = true + } +} +``` + # Management Capabilities for Registered Clusters The control that Rancher has to manage a registered cluster depends on the type of cluster. From 7bc771f5f469138a1359ef474ecabf10bdc0906b Mon Sep 17 00:00:00 2001 From: Ray Terrill Date: Fri, 14 Jan 2022 15:25:02 -0800 Subject: [PATCH 169/478] Update minimum permissions doc to include DescribeRegions --- .../hosted-kubernetes-clusters/eks/permissions/_index.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/cluster-provisioning/hosted-kubernetes-clusters/eks/permissions/_index.md b/content/rancher/v2.5/en/cluster-provisioning/hosted-kubernetes-clusters/eks/permissions/_index.md index 521046e6e86..8f4539e1c6f 100644 --- a/content/rancher/v2.5/en/cluster-provisioning/hosted-kubernetes-clusters/eks/permissions/_index.md +++ b/content/rancher/v2.5/en/cluster-provisioning/hosted-kubernetes-clusters/eks/permissions/_index.md @@ -24,6 +24,7 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b "ec2:RunInstances", "ec2:RevokeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", + "ec2:DescribeRegions", "ec2:DescribeVpcs", "ec2:DescribeTags", "ec2:DescribeSubnets", @@ -219,4 +220,4 @@ Permissions required for Rancher to create VPC and associated resources. } ] } -``` \ No newline at end of file +``` From e54ac0b0a1400251d4a7699403aee07ad903e080 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 17 Jan 2022 20:54:19 -0800 Subject: [PATCH 170/478] Apply 7bc771f5 (author: rayterrill) to Rancher 2.6 docs Update minimum permissions doc to include DescribeRegions --- .../hosted-kubernetes-clusters/eks/permissions/_index.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/eks/permissions/_index.md b/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/eks/permissions/_index.md index 521046e6e86..8f4539e1c6f 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/eks/permissions/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/eks/permissions/_index.md @@ -24,6 +24,7 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b "ec2:RunInstances", "ec2:RevokeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", + "ec2:DescribeRegions", "ec2:DescribeVpcs", "ec2:DescribeTags", "ec2:DescribeSubnets", @@ -219,4 +220,4 @@ Permissions required for Rancher to create VPC and associated resources. } ] } -``` \ No newline at end of file +``` From ef0613fcf04fec7a6a43f06a4628f36277428d42 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 18 Jan 2022 17:34:12 +0000 Subject: [PATCH 171/478] Added new way to deploy Rancher in AWS with listing --- .../deployment/amazon-aws-qs/_index.md | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs/_index.md index faa98f548a5..6b08a4e531a 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs/_index.md @@ -53,16 +53,20 @@ Suggestions include: 8. Paste the `rancher_server_url` from the output above into the browser. Log in when prompted (default username is `admin`, use the password set in `rancher_server_admin_password`). 9. ssh to the Rancher Server using the `id_rsa` key generated in `quickstart/aws`. -#### Result +##### Result Two Kubernetes clusters are deployed into your AWS account, one running Rancher Server and the other ready for experimentation deployments. Please note that while this setup is a great way to explore Rancher functionality, a production setup should follow our high availability setup guidelines. SSH keys for the VMs are auto-generated and stored in the module directory. -### What's Next? - -Use Rancher to create a deployment. For more information, see [Creating Deployments]({{}}/rancher/v2.6/en/quick-start-guide/workload). - ## Destroying the Environment 1. From the `quickstart/aws` folder, execute `terraform destroy --auto-approve`. 2. Wait for confirmation that all resources have been destroyed. + +# Deploying Rancher using AWS Marketplace + +There is now an additional way for you to deploy the Rancher server in AWS by using Amazon EKS. To learn more, see our [Amazon Marketplace listing](https://aws.amazon.com/marketplace/pp/prodview-2yzbnvagmi4as). + +# What's Next? + +Use Rancher to create a deployment. For more information, see [Creating Deployments]({{}}/rancher/v2.6/en/quick-start-guide/workload). From 303323a5dc5275cc01b03fab93e5f7a09bebc81e Mon Sep 17 00:00:00 2001 From: the-it-jaeger <61639149+the-it-jaeger@users.noreply.github.com> Date: Tue, 18 Jan 2022 16:02:49 -0500 Subject: [PATCH 172/478] Update _index.md The branch name listed when installing with `--set privateCA=true` should match everything else. --- .../v2.6/en/installation/install-rancher-on-k8s/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md index 11b5f6c2def..5f9e50cc198 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md @@ -234,7 +234,7 @@ helm install rancher rancher-/rancher \ If you are using a Private CA signed certificate , add `--set privateCA=true` to the command: ``` -helm install rancher rancher-latest/rancher \ +helm install rancher rancher-/rancher \ --namespace cattle-system \ --set hostname=rancher.my.org \ --set bootstrapPassword=admin \ From 845b63914015a915f2f3a219564d7f21d9eee071 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 18 Jan 2022 21:08:07 +0000 Subject: [PATCH 173/478] Updated directions for upgrading workloads --- .../en/k8s-in-rancher/workloads/upgrade-workloads/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/k8s-in-rancher/workloads/upgrade-workloads/_index.md b/content/rancher/v2.6/en/k8s-in-rancher/workloads/upgrade-workloads/_index.md index be8c09f7792..f6804adb2ea 100644 --- a/content/rancher/v2.6/en/k8s-in-rancher/workloads/upgrade-workloads/_index.md +++ b/content/rancher/v2.6/en/k8s-in-rancher/workloads/upgrade-workloads/_index.md @@ -16,6 +16,6 @@ When a new version of an application image is released on Docker Hub, you can up These options control how the upgrade rolls out to containers that are currently running. For example, for scalable deployments, you can choose whether you want to stop old pods before deploying new ones, or vice versa, as well as the upgrade batch size. -1. Click **Upgrade**. +1. Click **Save**. **Result:** The workload begins upgrading its containers, per your specifications. Note that scaling up the deployment or updating the upgrade/scaling policy won't result in the pods recreation. From bf959a22705651e95d6962dcc7686241d910253c Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Tue, 18 Jan 2022 21:29:14 -0800 Subject: [PATCH 174/478] Apply 303323a5 (author: the-it-jaeger) to Rancher v2.0-v2.4 and v2.5 docs The branch name listed when installing with should match everything else. --- .../v2.0-v2.4/en/installation/install-rancher-on-k8s/_index.md | 2 +- .../v2.5/en/installation/install-rancher-on-k8s/_index.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.0-v2.4/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.0-v2.4/en/installation/install-rancher-on-k8s/_index.md index 98c8db4a6e8..b98a08e0085 100644 --- a/content/rancher/v2.0-v2.4/en/installation/install-rancher-on-k8s/_index.md +++ b/content/rancher/v2.0-v2.4/en/installation/install-rancher-on-k8s/_index.md @@ -231,7 +231,7 @@ helm install rancher rancher-/rancher \ If you are using a Private CA signed certificate , add `--set privateCA=true` to the command: ``` -helm install rancher rancher-latest/rancher \ +helm install rancher rancher-/rancher \ --namespace cattle-system \ --set hostname=rancher.my.org \ --set ingress.tls.source=secret \ diff --git a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md index 94497592e86..cd3d7cef001 100644 --- a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md +++ b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md @@ -245,7 +245,7 @@ helm install rancher rancher-/rancher \ If you are using a Private CA signed certificate , add `--set privateCA=true` to the command: ``` -helm install rancher rancher-latest/rancher \ +helm install rancher rancher-/rancher \ --namespace cattle-system \ --set hostname=rancher.my.org \ --set ingress.tls.source=secret \ From 72223b7e2102009c52c7f8ed40050839398eb335 Mon Sep 17 00:00:00 2001 From: Wataru Sekiguchi Date: Wed, 19 Jan 2022 17:39:55 +0900 Subject: [PATCH 175/478] Update _index.md Fix a typo. --- .../configuration/servicemonitor-podmonitor/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/monitoring-alerting/configuration/servicemonitor-podmonitor/_index.md b/content/rancher/v2.5/en/monitoring-alerting/configuration/servicemonitor-podmonitor/_index.md index 79f3da27930..39ddfd2b5a0 100644 --- a/content/rancher/v2.5/en/monitoring-alerting/configuration/servicemonitor-podmonitor/_index.md +++ b/content/rancher/v2.5/en/monitoring-alerting/configuration/servicemonitor-podmonitor/_index.md @@ -26,6 +26,6 @@ For more information about how ServiceMonitors work, refer to the [Prometheus Op This pseudo-CRD maps to a section of the Prometheus custom resource configuration. It declaratively specifies how group of pods should be monitored. -When a PodMonitor is created, the Prometheus Operator updates the Prometheus scrape configuration to include the PodMonitor configuration. Then Prometheus begins scraping metrics from the endpoint defined in the ServiceMonitor. +When a PodMonitor is created, the Prometheus Operator updates the Prometheus scrape configuration to include the PodMonitor configuration. Then Prometheus begins scraping metrics from the endpoint defined in the PodMonitor. Any Pods in your cluster that match the labels located within the PodMonitor `selector` field will be monitored based on the `podMetricsEndpoints` specified on the PodMonitor. For more information on what fields can be specified, please look at the [spec](https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/api.md#podmonitorspec) provided by Prometheus Operator. From 26b3ad4e45534ed1e7dfa756cc907effc8defc1a Mon Sep 17 00:00:00 2001 From: Manuel Buil Date: Wed, 19 Jan 2022 14:02:19 +0100 Subject: [PATCH 176/478] Update network docs Signed-off-by: Manuel Buil --- .../en/faq/networking/cni-providers/_index.md | 46 +++++++++++------- static/img/rancher/cilium-logo.png | Bin 0 -> 13971 bytes 2 files changed, 29 insertions(+), 17 deletions(-) create mode 100644 static/img/rancher/cilium-logo.png diff --git a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md index 498e63ad5f1..fc24cba8085 100644 --- a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md +++ b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md @@ -16,7 +16,7 @@ For more information visit [CNI GitHub project](https://github.com/containernetw ### What Network Models are Used in CNI? -CNI network providers implement their network fabric using either an encapsulated network model such as Virtual Extensible Lan ([VXLAN](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#vxlan)) or an unencapsulated network model such as Border Gateway Protocol ([BGP](https://en.wikipedia.org/wiki/Border_Gateway_Protocol)). +CNI network providers implement their network fabric using either an encapsulated network model such as Virtual Extensible Lan ([VXLAN](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#vxlan)) or an unencapsulated network model such as Border Gateway Protocol ([BGP](https://en.wikipedia.org/wiki/Border_Gateway_Protocol)). #### What is an Encapsulated Network? @@ -26,7 +26,7 @@ In simple terms, this network model generates a kind of network bridge extended This network model is used when an extended L2 bridge is preferred. This network model is sensitive to L3 network latencies of the Kubernetes workers. If datacenters are in distinct geolocations, be sure to have low latencies between them to avoid eventual network segmentation. -CNI network providers using this network model include Flannel, Canal, and Weave. +CNI network providers using this network model include Flannel, Canal, Weave or Cilium. Calico by default is not using this model but it could be configured. ![Encapsulated Network]({{}}/img/rancher/encapsulated-network.png) @@ -38,13 +38,13 @@ In simple terms, this network model generates a kind of network router extended This network model is used when a routed L3 network is preferred. This mode dynamically updates routes at the OS level for Kubernetes workers. It's less sensitive to latency. -CNI network providers using this network model include Calico and Romana. +CNI network providers using this network model include Calico. Cilium can also be configured with this model although it is not the default mode. ![Unencapsulated Network]({{}}/img/rancher/unencapsulated-network.png) ### What CNI Providers are Provided by Rancher? -Out-of-the-box, Rancher provides the following CNI network providers for Kubernetes clusters: Canal, Flannel, Calico and Weave. You can choose your CNI network provider when you create new Kubernetes clusters from Rancher. +Out-of-the-box, Rancher provides the following CNI network providers for RKE Kubernetes clusters: Canal, Flannel and Weave. For RKE2 Kubernetes clusters: Canal, Calico and Cilium. You can choose your CNI network provider when you create new Kubernetes clusters from Rancher. #### Canal @@ -64,23 +64,25 @@ For more information, see the [Canal GitHub Page.](https://github.com/projectcal ![Flannel Logo]({{}}/img/rancher/flannel-logo.png) -Flannel is a simple and easy way to configure L3 network fabric designed for Kubernetes. Flannel runs a single binary agent named flanneld on each host, which is responsible for allocating a subnet lease to each host out of a larger, preconfigured address space. Flannel uses either the Kubernetes API or etcd directly to store the network configuration, the allocated subnets, and any auxiliary data (such as the host's public IP). Packets are forwarded using one of several backend mechanisms, with the default encapsulation being [VXLAN](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#vxlan). +Flannel is a simple and easy way to configure L3 network fabric designed for Kubernetes. Flannel runs a single binary agent named flanneld on each host, which is responsible for allocating a subnet lease to each host out of a larger, preconfigured address space. Flannel uses either the Kubernetes API or etcd directly to store the network configuration, the allocated subnets, and any auxiliary data (such as the host's public IP). Packets are forwarded using one of several backend mechanisms, with the default encapsulation being [VXLAN](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#vxlan). -Encapsulated traffic is unencrypted by default. Therefore, flannel provides an experimental backend for encryption, [IPSec](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#ipsec), which makes use of [strongSwan](https://www.strongswan.org/) to establish encrypted IPSec tunnels between Kubernetes workers. +Encapsulated traffic is unencrypted by default. Flannel provides two solutions for encryption: +* [IPSec](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#ipsec), which makes use of [strongSwan](https://www.strongswan.org/) to establish encrypted IPSec tunnels between Kubernetes workers. It is considered experimental +* [Wireguard](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#wireguard), which is a more performing alternative to strongswan Kubernetes workers should open UDP port `8472` (VXLAN) and TCP port `9099` (healthcheck). See [the port requirements for user clusters]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/#networking-requirements) for more details. ![Flannel Diagram]({{}}/img/rancher/flannel-diagram.png) -For more information, see the [Flannel GitHub Page](https://github.com/coreos/flannel). +For more information, see the [Flannel GitHub Page](https://github.com/flannel-io/flannel). #### Calico ![Calico Logo]({{}}/img/rancher/calico-logo.png) -Calico enables networking and network policy in Kubernetes clusters across the cloud. Calico uses a pure, unencapsulated IP network fabric and policy engine to provide networking for your Kubernetes workloads. Workloads are able to communicate over both cloud infrastructure and on-prem using BGP. +Calico enables networking and network policy in Kubernetes clusters across the cloud. By default, Calico uses a pure, unencapsulated IP network fabric and policy engine to provide networking for your Kubernetes workloads. Workloads are able to communicate over both cloud infrastructure and on-prem using BGP. -Calico also provides a stateless IP-in-IP encapsulation mode that can be used, if necessary. Calico also offers policy isolation, allowing you to secure and govern your Kubernetes workloads using advanced ingress and egress policies. +Calico also provides a stateless IP-in-IP or VXLAN encapsulation mode that can be used, if necessary. Calico also offers policy isolation, allowing you to secure and govern your Kubernetes workloads using advanced ingress and egress policies. Kubernetes workers should open TCP port `179` (BGP). See [the port requirements for user clusters]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/#networking-requirements) for more details. @@ -110,9 +112,9 @@ The following table summarizes the different features available for each CNI net | Provider | Network Model | Route Distribution | Network Policies | Mesh | External Datastore | Encryption | Ingress/Egress Policies | | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | -| Canal | Encapsulated (VXLAN) | No | Yes | No | K8S API | No | Yes | -| Flannel | Encapsulated (VXLAN) | No | No | No | K8S API | No | No | -| Calico | Encapsulated (VXLAN,IPIP) OR Unencapsulated | Yes | Yes | Yes | Etcd and K8S API | No | Yes | +| Canal | Encapsulated (VXLAN) | No | Yes | No | K8S API | Yes | Yes | +| Flannel | Encapsulated (VXLAN) | No | No | No | K8S API | Yes | No | +| Calico | Encapsulated (VXLAN,IPIP) OR Unencapsulated | Yes | Yes | Yes | Etcd and K8S API | Yes | Yes | | Weave | Encapsulated | Yes | Yes | Yes | No | Yes | Yes | - Network Model: Encapsulated or unencapsulated. For more information, see [What Network Models are Used in CNI?](#what-network-models-are-used-in-cni) @@ -129,16 +131,26 @@ The following table summarizes the different features available for each CNI net - Ingress/Egress Policies: This feature allows you to manage routing control for both Kubernetes and non-Kubernetes communications. + +### Cilium + +![Cilium Logo]({{}}/img/rancher/cilium-logo.png) + +Cilium enables networking and network policies (L3, L4 and L7) in Kubernetes. Cilium by default uses eBPF technologies to route packets inside the node and vxlan to send packets to other nodes, unencapsulated techniques can also be configured. + +Cilium recommends kernel versions greater than 5.2 to be able to leverage the full potential of eBPF. Kubernetes workers should open TCP port `8472` for VXLAN and TCP port `4140` for health checks. Besides ICMP 8/0 must be enabled for health checks too. Fro more information check [Cilium System Requirements](https://docs.cilium.io/en/latest/operations/system_requirements/#firewall-requirements) + #### CNI Community Popularity -The following table summarizes different GitHub metrics to give you an idea of each project's popularity and activity. This data was collected in January 2020. +The following table summarizes different GitHub metrics to give you an idea of each project's popularity and activity. This data was collected in January 2022. | Provider | Project | Stars | Forks | Contributors | | ---- | ---- | ---- | ---- | ---- | -| Canal | https://github.com/projectcalico/canal | 614 | 89 | 19 | -| flannel | https://github.com/coreos/flannel | 4977 | 1.4k | 140 | -| Calico | https://github.com/projectcalico/calico | 1534 | 429 | 135 | -| Weave | https://github.com/weaveworks/weave/ | 5737 | 559 | 73 | +| Canal | https://github.com/projectcalico/canal | 679 | 100 | 21 | +| flannel | https://github.com/flannel-io/flannel | 7k | 2.5k | 185 | +| Calico | https://github.com/projectcalico/calico | 3.1k | 741 | 224 | +| Weave | https://github.com/weaveworks/weave/ | 6.2k | 635 | 84 | +| Cilium | https://github.com/cilium/cilium | 10.6k | 1.3k | 352 |
diff --git a/static/img/rancher/cilium-logo.png b/static/img/rancher/cilium-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..681a0b3c530e7049adda19da7249ff9f9de74075 GIT binary patch literal 13971 zcmV;EHf+g>P)p54 z#~yUNM#!1U z3QPdhBcgem*EXf^vWq5bwM*wr>1(LxSqjYP{_^tj0U_rT)t5#{6sZ!~h4ov`k4a}` z)g7t$T2T^!sUR5`3ZEm_15;NE7ydJrSuUSjXMgs~68qoYDAsQ4myfpumg)n*&I>tT zm1U-aRH3qs5n~&jV~S)HGa{mkgYY}sCJCIJw##y;9?(U0npem#eVJ4l-1i+ zZ2t+{F-hwhn)$7Zd_Gp}et&CU(rTIRGkw1rIdbGcMI9*)pbU*`qN6><0#vp#fSH9o zHx)sxdWWfkjQUR3!Ug9TWy1~QtS^q9D}ZQdz-O=Z(suyWwsm8C{uTIAor)J!7aTgG ztqK^kJtl4EIa>`#MRJI1@>G>z6E1Q-$^`61M`ro`v*mJDQfL%Z|LdjU_JuQiEcM>F zapOuARQf1}Q2lIZEYH<3DMx6g5igpH8}7yhxRMH7UtezmnC=jxvWGU-SpR;M0Z7+S zA6P`@>SY)U*{PSjKXLE*R=qz8+yP=|UQ82ZXtIZyML*@@n6#s>TqRHX#OPo)GMW)Nn`yZ*KZo?2b;TWC|QKE%ClM+DUh>p7Kqx(6QX#|;|4Vi*v zjvJRuwEpjF=L(=1%0+p-grR&u>&gI$0~uKto%=ghjI%^>6r#(ejDl_|-aM)-tg9vI zFqCQ(e^$~SW)A*KRnCxZ17OMnc6x<1btn@Y+dIRIYi&e7kym_4UZ*QE-`${s2 zKwvA*ha$`+n#&Bhiow~h_T~8i*z04QkC{Ud*pY2E76p@%z6X8D=k>H%VlvPl2UI$1ra?qGyz@ zrz4!I9FuZ57->#46>l>KC#jO#avKPXn?$kk$M>9Xxy%!$jQg0&?_>Go1XfLlWl!EW z%913LA5;);4UKa*jO@}is{a!RVAW_tH9;9Sb>seqMQPB{dC=ipqszj6lYM6VryIo! z3c3@=LVllUDDy7(R$W5_fXDw%8SCM1Rr>%1CfG51Wo2a;dHT*PZcC@rI++9`1~3C7 zdYy!#5tAKs*v^CqXbLe+r?8Q-5~slPDR;KnBZC{cO1X^_hOheC*h9CQqbBUoebWFFT`q7sg3#&t7m%*L?d{tFd9&yT>VA&V!@7G^d zYkmG|i4Pp2U)0MAo&hNrpP~-y{yVfyw~qBye}V~KfTc6o@EF4?MWfDBvhCXd(gIC3 ziX$x+A!FkFx95L;cc=J1Q;KPwJH>fQ8?> zhK59f-m>nWj07h1UGSs8P6H84aL$c*j8W$qbyJD!086!h?Q37txye;CA2}bKkWGbV z;BvU5il8IjQLT>D>0AKOThPG;1hhC1;S+YzOGkv z=)3rBPrp`z3@EZm9~?s+o-=@I032I)80)B1h6VsorKa7?H5OE=D^*KM4I`dH>oj1I zyTs19?e_WBo~PUUblbW+FOxaIn{bC%Kknbx6#Ivp&zJa3a!o48R}xL%-mRl#$FUWi zaB|KY#osqxQrq`(#~AIlbJ6&|hN(Pj16ZFl)GBHX4J)G~^W-GStGx}}u@&e*vv=mq z3#ZvXJASL(^Zpw9_=&a9*4RDpj^8tl`Rx3@)?JRZz*5c~3z}3JI>qeo zv!LAM{TD{~giH5xm#2WU-~YrZ0WVI(nEW$wkT+hzwZI&IQ>o<{k?}Yy6%q0mRS-9{V{kqNltIEs9xXJKEZZW za~j3DT9fyg)t9)c&Mqe32cPd-H^vejX4wBN3?n}zp7V|?#}nXG5fEis)OWhgE1hF3 ztZ5fm>d>fBqXsBMa=Il-q2J9c{2^V@jr$LXcIIF@gk_74o90;E|BwL>Wu@bUg&bg= zSmVC;aLc^)-u%NF`-WTRTB1(^Y&eGi3NPyOyn{Z~{>2YdE`WN4(v;p~LwV7X0__;j zUdQ%USQ208WoY^2oJYau)9i)6yk)Y(G88auqb$V!#xA4FKLcQ`zj&h07lU)1t5Fk` zbD}Z(iP?Pr3v@gXPWTX4)7@Ba?|rV*qUOwFBmx%7OcY=oW36#n3)@pKF1H#Q>ctK| zR8vzkkeJ#T@cj%6s->6LS^s*Zg!oflQrHF4G2ZNnJ{MLktnL^uI?fjCs}1)FdKf0C zpJk5;S!MsSv6f@%kZlkklzA8ya)3jBM?gu~>{lyBTP+Q~!KrV9i7m`w9a_JcJQa;Y z`ofwZV2I_SSz5JWzSaHS8W$8UD-jU&u)tziEAw4gAJ$#-%}Z^GW8BFkjCY8&QM z=W1QOD@qGu0)b7q4^k<*ig(nf*jp~0V1350k?1ddE&wd7vD-Yo>;kJ{s!vdT4791d zEUsN-8ZPbtLhURx`yFV10`*;JTX1Eo{l@Qa^8@I88KBliulK(9{`%kFW?#8vmTv$i zFowe%)z#GlkU4Zf69pvl{W!1!6;wx&e4D$@-073;4{sYq{2~z?RZ{jj?PDyN^Im0t z0w(m9Ig>0w?8HH*bBuU{5|qXRnu;|}D#DkN%#U{nThmS3j=x@JaiDmg2ZfZa-e1G` zOKSre4cqP~uk`^0I(ILOfXO4(2MJ-~tdWW@Lg#*xzwP%(K^w@tL*H*U4EY z2ykqaC;s-Eo6ol!>-lqrzCU{2dFKs`utaeS29&eTQM!X_K|Ef#S>m1CapN2d!+b9E zXTkKoCn5NmN{|#7A(ZvQ@c%nkTx5wU4e+7nQ5gZFub^bCZYl`=>t*=w0fsl+oy*sO z2x*-HnZOe%J?C29D6lFuOkkCL*Zhf=a1Is*Lz?9+hM_)US*x-yDqRygG6hUbA)L@# z>;-B8hxxz#;wFna-&}j2H*Y;sr###gvj6wok(;a;GpC6;FAS;CLC3+Lm`@yy4VH6_ zE~meV-`QpO8JM`3$OM?LJII0weVbR8*I0fNRvBv2xaC2>63pj&e=*8#Ynm)7=Tq#Iny7M%3Q#o7z-!GnU$-qo@F~C<_TUE_muE(Qx@byiDD>iORsISC4R*e zLw%UM$`EdoIp;zE6z4n5hU$ZlR-dQlV7shU8M>ZNVqi?^^0rC73Jf@=x)_zSMm8od z=lT_nn#D*%G!HxXUSm1tjtZG4c#+aCY_h+x0_Ykh6~l|7`2FFZTx&_j$vsJ@E(D*a z6TUwVzd0@FGu!BLd}r4IGuH`VGD*qIy<#cKql?E8A+u8I6H$@#a{(Zq3r_gwERcj{ z*j~S(#%`+Tg-$r0!y4C4b&?ZPrwC3}_=?O#gV{@>{=@?6;!9fWLy*wroN=mnOBjgF z*~u8HhkYl@fBx&0_FUMHaHoDqlC{VrH8cu~D;Ef$ISv0k0nZtf`65gNv+H~vSnAzd z&u8=}hE<5!`h1<>q%)D92f!+hp}cJ>Z4^rvxB3#sp90wHa$SCuO9nD^X%9@yN^$PW zyS858X-aG*fv>t?Ez{O;$~pbq!w8;qIci*zDGQyNZmhw^h%fHchoa-oFab?QoAjL7 zcHe>t7EP(hnCkR;K7#X@tI}m4xek>9)=TYU`o!bH2%D78=vo;w7huZO%(C425VjV< z$^DkS5Hnk+p>xieFfN~Wf|jayX0hjlf88DdjJV$4{Bnie3gs{Yh~EMIsgMA?k&Y&o zP0|`QX{)S!mo%&volDH#KxnVB+n`F`bz`-~0>{hS`6~)sK(Xa5-1^=&AFLW>q0S{7 z|4BH8@|f5B>@!b9u@?6o%W}mkgZ3NdSTaUB9@2bKAj@JX7l6axdDBHAIIwDR0UigI zc3_Ez2#(Ilb@ok~?M7(Lez5%((o6*eRP`w6vKJZUgHP7-@&KCzcG*jK=gc7sJi>CD zFP-4KAuxwYhQMb#R^ZFYD2M$&gsqs@IwER3nM#ATK1aKUan^kioFIa-(!!$$+UK*W+kd3%;5#(@{@n=^eaT_CkSoyf2k_>> z=f_1~?1k&bSgxsK9BMWl!#mru&z{2$xj}1Yqff+r8}^@{i=l3+ETUTCt1^BoYCk4P z%;K~_u4zF?D?0^^o`gBr*r}l97|be*%?{| z>-_rsu@-{kkLe6Z#C9rV`QMKkW6z&5S@f+=;mBnopeA9TAG61Vrs)HxQd1%UtXI$F z(boC(Nn(KT1@!eS)uC*frNMy{x9aE-Is-%lwH=6l@S@%;-mzQ1cabC-e1H5z>r|y2Fj0+e_oEBO`=UQ!!h5k~r>Lk175Q64zY7&@ zx8^BI0T0olp1Aq~OXANxGGxe*JQY{O(4Pu1R3(pN3biIm71smPhh;1uvz;)jt;v3= z>t;rSicSKv0K?CJ`{pffT{+XaCn1zCBVei!N55PQ%<_9+m_HJ8CTF2)*W3lQf2^vp zm)6yZ`~D2h6$MlSf`Nf-P~uF-2t{$fUNJf_cNeCj^JOcOWpkxhWLdJJoa0lS4_h@w zqw`;G1D0AT-m$B`G2ilZC^3(>#;>3=-?2b%&BjZ`Ogpl~EyIQlGn2_=9tr8WQj#Yw z7;o|5sFpBLHUAp}E)Qtc_KRc2S&jba@1;Z{F@QMezGU=GvnN?Pj*S&Y%Y&&xa`RnueTeZlvs#x4%11# z0KoG^DPZNKN%lXfm^SJ^xlVeu-?t(xwxPCGOh#L}$KXgETY$f|aJ?JR=dn2&Z>!UBQeU7*fEY&{dVp-{wu>APwvDU1qKH>8{@Er?D!5t1d zJ`8y=YfYuCq>@H%6)@`Ar_vDh1$i z>r{K&lHdLr+Vzv_#0abx!uckm$DxdHmw3MHIkL;duxhIWk3~GhWM# zL5Zd!DC3kQD+zHp{!a9@o&x6JnWx&PIf?I_Nn@9B+f@5fG(QCyLBhPxXr7D8O&@3M zT{hdr3KvzTKvaFqSSU!~!s7^(M(FV7s0QmfE#&t`I>|f^L1!NngrHhoJIOv-$wzgk z1c|_9qcqQAry|oZ)!eolK|&C~gc5=?Zx!f77?9MfoO4h=u-{XuRDR3^ug+w>q5rRo zUX=rhbyq7kj(WA!wDHb-HK$2EJ$Ae=1q8?NC`6ul=bUp6o^!i6*FhLl zg)y`+pTYx!1`Ub=hYB<44D5~lNYJP%1zpqWjEJF+YE|vDsNb2-AA=87LjZ+Z*W2tq zny_SL^jJ$4?TP+W@H&35y)$Zzg$ZZjm_Gt0E+sk4GO@m1MHWyQxr|yAoNIlI2tLlU zdXygztMd>(-LYLJBWR)@u}AEnTeddY-}&iu?Y8p1CTnUv-@(WVOq!=%ybyOztaXa& zc%|I$WCt;mX#Q~d)(O(Nnr_5nz`P&^DXiyA~Tf<APr zvNAL59YnZ6;@srZrcbr+equTS4YckIsCKiUasdTkqU+Ih;eE@#W~;HuXA+J=WHktP z3>UVR<(IV-ciC-me*UoxiT)BJEeMXd;3PkS6LTP#fFWmza~)hXa{;i^J{LTjNu!^)bTFSg<)0B)i|5|r z6HwtiS4kfFn61g{_Zlbd7o;4D;e=1H7j^oKdVAZ!W{a9L&)hW=z%+ZNuE%4pT|F%v zgW>YO{JUmrT2sB~puYzlTtY-t9CUh;-G3{Xsdt>J%^EIG=SvO?zfn;A14s~8O!hhA zm}aRWb@V7=zQa1)jSWrqnkC=!*oL$W10nnDXUyFJVgmQOAlpLCBD~*q-A^3TDFilH zwVC{~^LG6@X)76)zEcz}SKd3FuoD3j`MkS_HE{x%xOF^}h|9r2_l4V7$Ic|9JNd93 z6!b}xtbgVl?`kGTCziSJBVzt)`~c%soP9J#4*r*&*ZVo zIy^JDrGsB*1vu#S^$lV<%X3+Z*RhF4r{+obySp4myoi&IwOrU>KYT1>%62i%Hs>R` zrjBPVYVO?6#FzTsFPiPv+4Z7daSA5@BT3_d^l1k40^sZ@8*3-^-Bnww-Ddff{gWUv zmJ)UqchQEXbM}nO#N$9QwKf|`Am%#Ca)N5k z&$mM?t$;iAIo8x*$?rFIB0EuF_xF5Bh-&; zqfh!&)q`Z>s_ZiWcNt+qbi{Xx|J8BnM$3)dhCBQD!f2KRC%3EzqYYd*$**d)J$pD9wxF1Yj`?MOn)8 zsagUXvfkpG8+{YeL+8#nGNXs_V(-^UeW-}70HS9AtOJOta~__}O^MjL(B9Pk6d%d4 zjWuN=OLYqDCA7^QPlGAF)t3{6<5+9xJ{svMtfos+u^E*{qYbh8(vp%Er* z-8bE3o!x>&;QB|DiD(4a%`fx(E9RXK(Jg864`NV*2!;+4*E23_=V#-0Wv~y46~+{M9xOoRGu-I zJh^hUcxShN17w0X8KF|jK0%*FhrESz;5|^b*qz^OvLt|6i#aut^cud!9G@lI8PrjiiP`=cZT0r{BZ9BQ36{-)An~>dTHeAa>@D{9Uv05l=hTM{gftAj zv5ArXCvp0J#Z8G=-)L{Rdbj0c9u^#(vd=;0jrXP4-!`>BY0sSACi;J$LZFaTJZGI; zZS-()1&7-()TSUd0Z>VCwC=2V4Uj64`$|!5mqaO-gD~?QQ#oyyG>CxulxRdKWek8; zC~IK0BEQpy-yw&VPi`Uv6gNs3b*GKj{K&ib9TJ}@%%9R|cen4eFKnJG8^xT~%*U$E z4y+yW#|}4xOy2T4Gs^gGA$s$^dubIm+VlJ-fAi8c-hbSg4yjBI?h`d@zP@?8ucA;1xp?%LgYtSira=nf*3_komwwOdppTw z{JGGY%s3`aCI6!|b1Y0YHb@-TkGZ?8&!Rfc`#f^rD8NS&*-LQj?|VU-+k1=TxeQr4 zM0Mm%&}bYo$vkz+xxuAq_OMETH&Od}$J%w$_j_8CkA?i^j=q1Z{Rw+|;|wthJxLzX zan`dXriQ1lGP2ZQ%17pix{o6p5N2WhA6{ePBR45qQU8fyuZQ3CWCLMh`ne?XL|yDy zkk+J9%qNTZ07S=todyx9q*W~Qoip=tFMr24=bJm^vVbr06QjZo-mjv0Jz-ec>X?C- zN&uI0x>J%EfTi47ncS7pER$J4F)247fz z2#WcgS|K==WvWvjM$M}!{*DuYpm`xIwU-BFy?w)iO>WwS6D>PMMxv=1fAcfdeqg^H z*0hG{qNzKML-Dheh(axvYAJ)E;eaav5l*a@o!8PC*FU?#VUt}w9yoUOhzd9(YIe79 z=@x%_1|z#>d)CGE;syT%F7#MZ#)6}X-{DmIhH3V~zxcrySFQcg8LhVFhi9hGoa5UU z9VHB>j8X1M_IET%cV4&G)0c#F%jOQYn&5!V=KMBy@T^6_bvO8C7tOpv)W>?ME*7H% zI9BdY<>ACC)qYAcKHjx(k`Ib^`OWt<@yTK84|TWrYoDme<0J>xDQ~fF{ce*?E#AT; zhwl}cW!^QnTb`XgmUw{8G_p`U0{6;=I>p)v@^MjUT=G~q2(X_C?4I-PNY1+)N z(`F{kLhGNlFf~w{UB+S^a?kADbj22{ermlqH~Id4C{r=xD4{w}5m3=_+(srF`+%F0 zaAv&)*G042LmV=i1lZ^NI(e`;WO` zq3wEiS(p2nuG8_|U)nS0E*8Z^3(mEc04iT5Bdl4n-4c~>POx;@iPxP({|VV{MpK(C z8D3?m%~sbhlVU{Wbh0gfaJK=|(=O)Cu37EL2x4-WtIX{7n?u%7zi$0B-?M+ogL5c5 z?H3*Gg{vO6T+nRu0OPR`VWe$5nCSY*T44TU&&_)lszs@c&@4uj83+Ao#;h@{)G7K) z2e>3MYYMNLyTX<*@(N}IjG1G*gc^ZBDfMWeY>;r|UjIjBsX3J;ZB_e;RU0I>7EH|(!p)+uUU z7M;o(hm7F_YhnrT%?rO{c@+cx$j%qZ3DF;@?@l?45H$P&n7Gi$Zo*wd(K1DwB@Le` z_HZjO2hHqL!kv=X1r64Y*8=<|!B67MUw6h4pL<24ScZEVE+|e;fuo2E#YeR^G)}jd ze)DOIg2n?6Y1{lDW0yJ0w|Vc^YnB{D*dI2&*_5AhKPR{}GPCTv)aW`L{dZkl0V zbN7pZCd~WX#ev3i%)6Lq&-?wlZy&OoFPtYH(`R6U(uAc-aURTUpBx&n90z*VDfq#E zev`H`PV(BQ2{KfsL==|;SXVOa^q~0rYKEXl1aQ?NvhdzR!>iBadB_#uBc}vs{qsq*rj=fxG ze59fS{vT)3R>PajVi9>;l$j zP2bXu`@rdM5&?4zWP}28Bejxh(cWA%lwve|BOUi8=lWExOke2Ep;M}$)nJ3cku~CH zd{=4sKlDFwaxd{tp1ts9P{fb=OkIXuMAOD-P^`l)GL*aCG1nv_Q(d(9Hs1rZ;pSON zgAzQ}kn@N-PwqRs^3KxGyRZJFt%?z-Hjr^Fo@g%6cgmQuF84j-0}&_OO}BWWr5EWj zsTkJ8ZDRn*q-7S|@{lDFJNFo0&g(zVq^&uwf^gR({?iw%$(zx3x!u0?Fb|UZc}3jQ zp}H7d%5%Uue~NYNsblUeJ8HKI=@>i~IHo!y2NR?!l*RTnS2T~^Mrnm#JT z$YO%jEQ6mv|4Cc3&`FfdA}Jqvo;N}D_Eqa1vwW$PZDQW8%g03WByk2zOEx^=FrYX` z6%2tNXk=!Pn_iaDH(fp zc_88(_%3_aWgWgJM1khirWrY#nm3Zpqk2{PF77cYIl^(lq9a47MkKK%2oO2**e5H{ zcG(U0T0U`7_|8UgL3$K^Ubu3Hg~F)-sC_U|$N&v9V`}z?Dj0O4crEutwTMo|+{JmU ztWKw?vXIi~8wlBp08}Tq%1KNTZ+d|P6V;(ITGTPFBv>?g6jax3`8&I5hOcV!BE}DTecNm#()w^Tvpk_xt65PBE`XeuJ_V z*?a;UG^G?3ZOP1n0CaM+%E$DjPuglIP7@PDXNd$O4Clg`V2-ltb$vsly?FgzUKWrs z(KgXB&j9P{I}TV4(^|xY?eAc6+5!az(V8GN3zy-~chXix|0tWOk3(O;9IfJ%)-z@= zu-dGZWEYsg!=5v{gm5Rt+`dfJ^nxh#M7#{x5l$^fO|a zNYjitb`y+%(QVWbXClbgK_yNKrgTnLwT4+0Ksk{!z`sES z{eiGKG{Y(=gMft(@Db(*kE^4_G5I=ETITGS;*Jnj&G|*?MP?2_7liAr1mn zdG4>`q^+ky9x)aN2r5sCQY8SRzmDlknY1-V%0y)jg>0D*2QbWmc5f~kfN8EKBkM-K zrp9^e%q{;PYtq)3fq?UU@Q@*S<*AB_L^@rStb_*734=C3Glh^#-_gv{Z0I=3xtbu% z=I$uHL-7~nbuoS@YQ3f0i+t>iGrD1nDY~uhb;b*A8PADBQ zVgs{2wtX>tCtZe8omw#4LPkRqba65gU+qa-8F09OqKyD5kUc1%m~Da>%6%cAJQJCc z0jj?k{%rndE*Q7p&$HhqZIuBk0T){Ulo{$n$xWUQ%oI>b9#C;vNq16H!|2}$QnS_N z&dQ{%Its0-j^W$BV8{>$P!2FM;9yOj^u$<`mrSR%0F~Ls$55u`ov!-Ccb$sIup89S zj6ma%KrW9dRQWbEI#K%_*k%xbV+8j6+TVg80^@=`KDNjm@lH3k3MZRzy9 z7GgCHWVNu(-fz=1M(%<0Jpt_uiEbT+hVNfM z`yi37*j_d=SuFEwAoYY58uMYjSD<|i+x1eJ2HXY$D9*jJ&Z*sXL^`BpA0 zDm0;!pll@d9CWzFoRH0)VCFzmu84>ST%N92AWfqb4Z%C^4@pLc0`RR3qu#;cK9uxg z4^Nb@PQ%U!(H3zimjRBI%BBUX*tWFueQ^3BJX=bE`$kyIz;yg=l5H z1b?y4C_2L?!%*9q^QV9cd}RQYq8WoTz(`48j8(9$l>v);!TI+}emV5byKufvg1xwO zSTTG*OtTO!AnAU{&7bf9NlD^&uw79MJuX^XCz$!UdGezGrmP85~1p zF8ZFZJDV~TbFrWG`rNt59|6D~gmal&QZ~E}e4%>y|K+g!tps!P;y%I6*j`#bq5%5o z^@Il)1m@d#tzg?3@E^6X4zl09EKx8lxd+}=2ZX9m+6pH+8V>T503ROIiTEaC_^QP znMue26&m$s0F`E0WKWp6^Z>=MeugcuulJ2eB+6wb7S62*`gngb%~_6Kcz-78f%8+i zR@V+KDe=wtlK)@x@jq%|o%a%HZvTDY&yLoRi_9qL037h)`LLr`IrL^ua8pTX=>WyN zUZ7+EenODR3uH`c@;v_}v>u9QD9^t;62>$xpge{-qpMv}ljl0WazF_tkK`vkv(^X8 z*A6Q!4V6ENhn3_*pS;cQ&jr&dIRA8%js-4Fo9h!(V5U+l<3y=}v<-!5Gw`H%DopJM zwC8Ea^nrfIU=C2JAV6{dQ^2KOQc<#j>G@FJKA^LYgmsDos5EnNGCq{n6gUVdHtC)4 zd?@K%O?{|@>+hucz>m5M{nx1d{TGM?p-=8%lHb%!LZm&iRwc<@T3$W?wtts(4d9q| zYKW?4WO5Uu1NK6|PCkK?tkIO`10x|Yiz-ez_nGsdf}=b$Fv<(|q1^W*6Xi)5N=eMk zFjQ!iX9}``;6qis0)9@Os?ZEK`CKo$CO3b@$axVG0QY}zEgtf&x8qJcW2ldM34GQI zE25p|53u5q80vE%6LL;Dq1h0VCkUJB6`K@LjBj!zjGdEm*+AdqrClG4jq>Ef;Q>&r z8~}RIt_W3{+aCaNG_)@SDWJ+wDYEM{yaXwVq2dK!4THyjJZ8Mr%m7y`-F4Ipb#_XmK#!2o= zI|feh7Qv4I0Wn={sMqO47Ujj!p$a4nl~j-oT>m6vhK_{!cMe0P(`**tjG^`%W}gm~ z2#@llvO$E&lUe~6P>ebc`>rxH21oE21=r-|X42N-iNqZO?Z20-N*6>RRjVl8r$eO! zWdpwsl~!UXlVhkfRfK&?xyk49GErV4+J_31MqGwUy9)K5Fjf?GC;?EBMSB!b3Euas z(y5GaZ#++rI;f~SMVnOw6sN!j14`E^H)T$FB3L#sgxr)1s01wmhT-U89VXs+5+BOX zP|VE)Eh?AiJ6FFBmD&^5M=qe!feaOzCUXJBr&p>B^`UT?8;?sorwIp_UW z7(p*YHjpdj+B#G^3{ceMO-Q7@^|5o$DI7dV$9V)mJT9ot+oE--lq||qda(?ZjAke! z2vEZI2Q{rw@P)&&73kD%)=`AJ`y@#G3=}>7e8WsSR)ypJz zStpxyCk0%4G{G78Vi_u;e8mt=9;cM^QC?s!&n+mE`%vz-!^(yagnj&uNt@s{4`EGq zM40UC4>I>)GLhX=ZsFUAii){mH<%aYrC8ZOdDc3PpjFz7=g<^eBf3q5j=>}++J?U~+DGx7SF>_<`q~$A8a11Ia$RtYBoXGbX?6)?` z$t_PMvE=7@CgbnaBY_K%3^kE*VN-cZ08T0Q7{AKUm~)gyc}%2tP$BK3H)$)>#4K~m zLo40Z2c5eQmZghJN~GWc_Q3+XJX{CLV3x^~!-Z~5c_Lai$ZR7Hqe@3sYzpNoDY1M- z3f{6rIr@-aWIESnwi8$^NSKP-Pa!NDI;^BHfyHiY&Aqc-#e+E5AdInHAIhK0Q<}8Z zWhlOmy-Futp3FG*uglmfqQEXxhYFZ1!wjPG5MeWrMPWZ%lS17*8D+8$gx}Th`vUkp5170i z-nVCN4sZ02vp)0z?7zf_7;VcAQb@{8UZ|-Nm2#p*MKM%VKONL4Uoi~TNn3{}%8e6RNwO7< zEE@=)$?u;4Fs7&^R2@Ju0}wPAich_;{U09X1^1Kp9|sl8WxPpSarRv}NgROiJEm6I zH>4-QDXl4*kUeZjN7IBxc~Xswt=LQij~rGhuv1a`VN6`I81}Q3lTdiAM>d=Z%cNg{ z{f;i=D=s4$Dxp>nWd@l%Hh>C=@dAUMcTn0BV61KI_v`bErjh} z70xrMk=2m((?eOw1UlJt7!i>NCtWb)+~RT2k#hlL&QNqffr^DZ9AOidPQs|o*$2~%7*hzsx#C?s zsOa3{v6xA4hH|H!bA};gC3O(V6_u8kP{VL006n;!|#eY(o9eQeK2@PA@?7Q z%wedol-o~*g|dG7>QCCLxUTM_IaDeFvYGnOQ0Om}V~W#X%K0>%R7sAHDcZIgY89B; tleQYUdBS%#44hLT_)GrJuf(LS{|{c9U4Am~c;)~A002ovPDHLkV1kP<=pg_A literal 0 HcmV?d00001 From f810b078ec94ce74943e3a9fe22a077a08a8b85c Mon Sep 17 00:00:00 2001 From: Manuel Buil Date: Wed, 19 Jan 2022 14:02:19 +0100 Subject: [PATCH 177/478] Update network docs Signed-off-by: Manuel Buil --- .../en/faq/networking/cni-providers/_index.md | 47 +++++++++++------- static/img/rancher/cilium-logo.png | Bin 0 -> 13971 bytes 2 files changed, 30 insertions(+), 17 deletions(-) create mode 100644 static/img/rancher/cilium-logo.png diff --git a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md index 498e63ad5f1..97bcadd763f 100644 --- a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md +++ b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md @@ -16,7 +16,7 @@ For more information visit [CNI GitHub project](https://github.com/containernetw ### What Network Models are Used in CNI? -CNI network providers implement their network fabric using either an encapsulated network model such as Virtual Extensible Lan ([VXLAN](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#vxlan)) or an unencapsulated network model such as Border Gateway Protocol ([BGP](https://en.wikipedia.org/wiki/Border_Gateway_Protocol)). +CNI network providers implement their network fabric using either an encapsulated network model such as Virtual Extensible Lan ([VXLAN](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#vxlan)) or an unencapsulated network model such as Border Gateway Protocol ([BGP](https://en.wikipedia.org/wiki/Border_Gateway_Protocol)). #### What is an Encapsulated Network? @@ -26,7 +26,7 @@ In simple terms, this network model generates a kind of network bridge extended This network model is used when an extended L2 bridge is preferred. This network model is sensitive to L3 network latencies of the Kubernetes workers. If datacenters are in distinct geolocations, be sure to have low latencies between them to avoid eventual network segmentation. -CNI network providers using this network model include Flannel, Canal, and Weave. +CNI network providers using this network model include Flannel, Canal, Weave or Cilium. Calico by default is not using this model but it could be configured. ![Encapsulated Network]({{}}/img/rancher/encapsulated-network.png) @@ -38,13 +38,13 @@ In simple terms, this network model generates a kind of network router extended This network model is used when a routed L3 network is preferred. This mode dynamically updates routes at the OS level for Kubernetes workers. It's less sensitive to latency. -CNI network providers using this network model include Calico and Romana. +CNI network providers using this network model include Calico. Cilium can also be configured with this model although it is not the default mode. ![Unencapsulated Network]({{}}/img/rancher/unencapsulated-network.png) ### What CNI Providers are Provided by Rancher? -Out-of-the-box, Rancher provides the following CNI network providers for Kubernetes clusters: Canal, Flannel, Calico and Weave. You can choose your CNI network provider when you create new Kubernetes clusters from Rancher. +Out-of-the-box, Rancher provides the following CNI network providers for RKE Kubernetes clusters: Canal, Flannel and Weave. For RKE2 Kubernetes clusters: Canal, Calico and Cilium. You can choose your CNI network provider when you create new Kubernetes clusters from Rancher. #### Canal @@ -64,23 +64,25 @@ For more information, see the [Canal GitHub Page.](https://github.com/projectcal ![Flannel Logo]({{}}/img/rancher/flannel-logo.png) -Flannel is a simple and easy way to configure L3 network fabric designed for Kubernetes. Flannel runs a single binary agent named flanneld on each host, which is responsible for allocating a subnet lease to each host out of a larger, preconfigured address space. Flannel uses either the Kubernetes API or etcd directly to store the network configuration, the allocated subnets, and any auxiliary data (such as the host's public IP). Packets are forwarded using one of several backend mechanisms, with the default encapsulation being [VXLAN](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#vxlan). +Flannel is a simple and easy way to configure L3 network fabric designed for Kubernetes. Flannel runs a single binary agent named flanneld on each host, which is responsible for allocating a subnet lease to each host out of a larger, preconfigured address space. Flannel uses either the Kubernetes API or etcd directly to store the network configuration, the allocated subnets, and any auxiliary data (such as the host's public IP). Packets are forwarded using one of several backend mechanisms, with the default encapsulation being [VXLAN](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#vxlan). -Encapsulated traffic is unencrypted by default. Therefore, flannel provides an experimental backend for encryption, [IPSec](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#ipsec), which makes use of [strongSwan](https://www.strongswan.org/) to establish encrypted IPSec tunnels between Kubernetes workers. +Encapsulated traffic is unencrypted by default. Flannel provides two solutions for encryption: +* [IPSec](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#ipsec), which makes use of [strongSwan](https://www.strongswan.org/) to establish encrypted IPSec tunnels between Kubernetes workers. It is considered experimental +* [Wireguard](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#wireguard), which is a more performing alternative to strongswan Kubernetes workers should open UDP port `8472` (VXLAN) and TCP port `9099` (healthcheck). See [the port requirements for user clusters]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/#networking-requirements) for more details. ![Flannel Diagram]({{}}/img/rancher/flannel-diagram.png) -For more information, see the [Flannel GitHub Page](https://github.com/coreos/flannel). +For more information, see the [Flannel GitHub Page](https://github.com/flannel-io/flannel). #### Calico ![Calico Logo]({{}}/img/rancher/calico-logo.png) -Calico enables networking and network policy in Kubernetes clusters across the cloud. Calico uses a pure, unencapsulated IP network fabric and policy engine to provide networking for your Kubernetes workloads. Workloads are able to communicate over both cloud infrastructure and on-prem using BGP. +Calico enables networking and network policy in Kubernetes clusters across the cloud. By default, Calico uses a pure, unencapsulated IP network fabric and policy engine to provide networking for your Kubernetes workloads. Workloads are able to communicate over both cloud infrastructure and on-prem using BGP. -Calico also provides a stateless IP-in-IP encapsulation mode that can be used, if necessary. Calico also offers policy isolation, allowing you to secure and govern your Kubernetes workloads using advanced ingress and egress policies. +Calico also provides a stateless IP-in-IP or VXLAN encapsulation mode that can be used, if necessary. Calico also offers policy isolation, allowing you to secure and govern your Kubernetes workloads using advanced ingress and egress policies. Kubernetes workers should open TCP port `179` (BGP). See [the port requirements for user clusters]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/#networking-requirements) for more details. @@ -110,10 +112,11 @@ The following table summarizes the different features available for each CNI net | Provider | Network Model | Route Distribution | Network Policies | Mesh | External Datastore | Encryption | Ingress/Egress Policies | | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | -| Canal | Encapsulated (VXLAN) | No | Yes | No | K8S API | No | Yes | -| Flannel | Encapsulated (VXLAN) | No | No | No | K8S API | No | No | -| Calico | Encapsulated (VXLAN,IPIP) OR Unencapsulated | Yes | Yes | Yes | Etcd and K8S API | No | Yes | +| Canal | Encapsulated (VXLAN) | No | Yes | No | K8S API | Yes | Yes | +| Flannel | Encapsulated (VXLAN) | No | No | No | K8S API | Yes | No | +| Calico | Encapsulated (VXLAN,IPIP) OR Unencapsulated | Yes | Yes | Yes | Etcd and K8S API | Yes | Yes | | Weave | Encapsulated | Yes | Yes | Yes | No | Yes | Yes | +| Cilium | Encapsulated (VXLAN) | Yes | Yes | Yes | Etcd and K8S API | Yes | Yes | - Network Model: Encapsulated or unencapsulated. For more information, see [What Network Models are Used in CNI?](#what-network-models-are-used-in-cni) @@ -129,16 +132,26 @@ The following table summarizes the different features available for each CNI net - Ingress/Egress Policies: This feature allows you to manage routing control for both Kubernetes and non-Kubernetes communications. + +### Cilium + +![Cilium Logo]({{}}/img/rancher/cilium-logo.png) + +Cilium enables networking and network policies (L3, L4 and L7) in Kubernetes. Cilium by default uses eBPF technologies to route packets inside the node and vxlan to send packets to other nodes, unencapsulated techniques can also be configured. + +Cilium recommends kernel versions greater than 5.2 to be able to leverage the full potential of eBPF. Kubernetes workers should open TCP port `8472` for VXLAN and TCP port `4140` for health checks. Besides ICMP 8/0 must be enabled for health checks too. Fro more information check [Cilium System Requirements](https://docs.cilium.io/en/latest/operations/system_requirements/#firewall-requirements) + #### CNI Community Popularity -The following table summarizes different GitHub metrics to give you an idea of each project's popularity and activity. This data was collected in January 2020. +The following table summarizes different GitHub metrics to give you an idea of each project's popularity and activity. This data was collected in January 2022. | Provider | Project | Stars | Forks | Contributors | | ---- | ---- | ---- | ---- | ---- | -| Canal | https://github.com/projectcalico/canal | 614 | 89 | 19 | -| flannel | https://github.com/coreos/flannel | 4977 | 1.4k | 140 | -| Calico | https://github.com/projectcalico/calico | 1534 | 429 | 135 | -| Weave | https://github.com/weaveworks/weave/ | 5737 | 559 | 73 | +| Canal | https://github.com/projectcalico/canal | 679 | 100 | 21 | +| flannel | https://github.com/flannel-io/flannel | 7k | 2.5k | 185 | +| Calico | https://github.com/projectcalico/calico | 3.1k | 741 | 224 | +| Weave | https://github.com/weaveworks/weave/ | 6.2k | 635 | 84 | +| Cilium | https://github.com/cilium/cilium | 10.6k | 1.3k | 352 |
diff --git a/static/img/rancher/cilium-logo.png b/static/img/rancher/cilium-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..681a0b3c530e7049adda19da7249ff9f9de74075 GIT binary patch literal 13971 zcmV;EHf+g>P)p54 z#~yUNM#!1U z3QPdhBcgem*EXf^vWq5bwM*wr>1(LxSqjYP{_^tj0U_rT)t5#{6sZ!~h4ov`k4a}` z)g7t$T2T^!sUR5`3ZEm_15;NE7ydJrSuUSjXMgs~68qoYDAsQ4myfpumg)n*&I>tT zm1U-aRH3qs5n~&jV~S)HGa{mkgYY}sCJCIJw##y;9?(U0npem#eVJ4l-1i+ zZ2t+{F-hwhn)$7Zd_Gp}et&CU(rTIRGkw1rIdbGcMI9*)pbU*`qN6><0#vp#fSH9o zHx)sxdWWfkjQUR3!Ug9TWy1~QtS^q9D}ZQdz-O=Z(suyWwsm8C{uTIAor)J!7aTgG ztqK^kJtl4EIa>`#MRJI1@>G>z6E1Q-$^`61M`ro`v*mJDQfL%Z|LdjU_JuQiEcM>F zapOuARQf1}Q2lIZEYH<3DMx6g5igpH8}7yhxRMH7UtezmnC=jxvWGU-SpR;M0Z7+S zA6P`@>SY)U*{PSjKXLE*R=qz8+yP=|UQ82ZXtIZyML*@@n6#s>TqRHX#OPo)GMW)Nn`yZ*KZo?2b;TWC|QKE%ClM+DUh>p7Kqx(6QX#|;|4Vi*v zjvJRuwEpjF=L(=1%0+p-grR&u>&gI$0~uKto%=ghjI%^>6r#(ejDl_|-aM)-tg9vI zFqCQ(e^$~SW)A*KRnCxZ17OMnc6x<1btn@Y+dIRIYi&e7kym_4UZ*QE-`${s2 zKwvA*ha$`+n#&Bhiow~h_T~8i*z04QkC{Ud*pY2E76p@%z6X8D=k>H%VlvPl2UI$1ra?qGyz@ zrz4!I9FuZ57->#46>l>KC#jO#avKPXn?$kk$M>9Xxy%!$jQg0&?_>Go1XfLlWl!EW z%913LA5;);4UKa*jO@}is{a!RVAW_tH9;9Sb>seqMQPB{dC=ipqszj6lYM6VryIo! z3c3@=LVllUDDy7(R$W5_fXDw%8SCM1Rr>%1CfG51Wo2a;dHT*PZcC@rI++9`1~3C7 zdYy!#5tAKs*v^CqXbLe+r?8Q-5~slPDR;KnBZC{cO1X^_hOheC*h9CQqbBUoebWFFT`q7sg3#&t7m%*L?d{tFd9&yT>VA&V!@7G^d zYkmG|i4Pp2U)0MAo&hNrpP~-y{yVfyw~qBye}V~KfTc6o@EF4?MWfDBvhCXd(gIC3 ziX$x+A!FkFx95L;cc=J1Q;KPwJH>fQ8?> zhK59f-m>nWj07h1UGSs8P6H84aL$c*j8W$qbyJD!086!h?Q37txye;CA2}bKkWGbV z;BvU5il8IjQLT>D>0AKOThPG;1hhC1;S+YzOGkv z=)3rBPrp`z3@EZm9~?s+o-=@I032I)80)B1h6VsorKa7?H5OE=D^*KM4I`dH>oj1I zyTs19?e_WBo~PUUblbW+FOxaIn{bC%Kknbx6#Ivp&zJa3a!o48R}xL%-mRl#$FUWi zaB|KY#osqxQrq`(#~AIlbJ6&|hN(Pj16ZFl)GBHX4J)G~^W-GStGx}}u@&e*vv=mq z3#ZvXJASL(^Zpw9_=&a9*4RDpj^8tl`Rx3@)?JRZz*5c~3z}3JI>qeo zv!LAM{TD{~giH5xm#2WU-~YrZ0WVI(nEW$wkT+hzwZI&IQ>o<{k?}Yy6%q0mRS-9{V{kqNltIEs9xXJKEZZW za~j3DT9fyg)t9)c&Mqe32cPd-H^vejX4wBN3?n}zp7V|?#}nXG5fEis)OWhgE1hF3 ztZ5fm>d>fBqXsBMa=Il-q2J9c{2^V@jr$LXcIIF@gk_74o90;E|BwL>Wu@bUg&bg= zSmVC;aLc^)-u%NF`-WTRTB1(^Y&eGi3NPyOyn{Z~{>2YdE`WN4(v;p~LwV7X0__;j zUdQ%USQ208WoY^2oJYau)9i)6yk)Y(G88auqb$V!#xA4FKLcQ`zj&h07lU)1t5Fk` zbD}Z(iP?Pr3v@gXPWTX4)7@Ba?|rV*qUOwFBmx%7OcY=oW36#n3)@pKF1H#Q>ctK| zR8vzkkeJ#T@cj%6s->6LS^s*Zg!oflQrHF4G2ZNnJ{MLktnL^uI?fjCs}1)FdKf0C zpJk5;S!MsSv6f@%kZlkklzA8ya)3jBM?gu~>{lyBTP+Q~!KrV9i7m`w9a_JcJQa;Y z`ofwZV2I_SSz5JWzSaHS8W$8UD-jU&u)tziEAw4gAJ$#-%}Z^GW8BFkjCY8&QM z=W1QOD@qGu0)b7q4^k<*ig(nf*jp~0V1350k?1ddE&wd7vD-Yo>;kJ{s!vdT4791d zEUsN-8ZPbtLhURx`yFV10`*;JTX1Eo{l@Qa^8@I88KBliulK(9{`%kFW?#8vmTv$i zFowe%)z#GlkU4Zf69pvl{W!1!6;wx&e4D$@-073;4{sYq{2~z?RZ{jj?PDyN^Im0t z0w(m9Ig>0w?8HH*bBuU{5|qXRnu;|}D#DkN%#U{nThmS3j=x@JaiDmg2ZfZa-e1G` zOKSre4cqP~uk`^0I(ILOfXO4(2MJ-~tdWW@Lg#*xzwP%(K^w@tL*H*U4EY z2ykqaC;s-Eo6ol!>-lqrzCU{2dFKs`utaeS29&eTQM!X_K|Ef#S>m1CapN2d!+b9E zXTkKoCn5NmN{|#7A(ZvQ@c%nkTx5wU4e+7nQ5gZFub^bCZYl`=>t*=w0fsl+oy*sO z2x*-HnZOe%J?C29D6lFuOkkCL*Zhf=a1Is*Lz?9+hM_)US*x-yDqRygG6hUbA)L@# z>;-B8hxxz#;wFna-&}j2H*Y;sr###gvj6wok(;a;GpC6;FAS;CLC3+Lm`@yy4VH6_ zE~meV-`QpO8JM`3$OM?LJII0weVbR8*I0fNRvBv2xaC2>63pj&e=*8#Ynm)7=Tq#Iny7M%3Q#o7z-!GnU$-qo@F~C<_TUE_muE(Qx@byiDD>iORsISC4R*e zLw%UM$`EdoIp;zE6z4n5hU$ZlR-dQlV7shU8M>ZNVqi?^^0rC73Jf@=x)_zSMm8od z=lT_nn#D*%G!HxXUSm1tjtZG4c#+aCY_h+x0_Ykh6~l|7`2FFZTx&_j$vsJ@E(D*a z6TUwVzd0@FGu!BLd}r4IGuH`VGD*qIy<#cKql?E8A+u8I6H$@#a{(Zq3r_gwERcj{ z*j~S(#%`+Tg-$r0!y4C4b&?ZPrwC3}_=?O#gV{@>{=@?6;!9fWLy*wroN=mnOBjgF z*~u8HhkYl@fBx&0_FUMHaHoDqlC{VrH8cu~D;Ef$ISv0k0nZtf`65gNv+H~vSnAzd z&u8=}hE<5!`h1<>q%)D92f!+hp}cJ>Z4^rvxB3#sp90wHa$SCuO9nD^X%9@yN^$PW zyS858X-aG*fv>t?Ez{O;$~pbq!w8;qIci*zDGQyNZmhw^h%fHchoa-oFab?QoAjL7 zcHe>t7EP(hnCkR;K7#X@tI}m4xek>9)=TYU`o!bH2%D78=vo;w7huZO%(C425VjV< z$^DkS5Hnk+p>xieFfN~Wf|jayX0hjlf88DdjJV$4{Bnie3gs{Yh~EMIsgMA?k&Y&o zP0|`QX{)S!mo%&volDH#KxnVB+n`F`bz`-~0>{hS`6~)sK(Xa5-1^=&AFLW>q0S{7 z|4BH8@|f5B>@!b9u@?6o%W}mkgZ3NdSTaUB9@2bKAj@JX7l6axdDBHAIIwDR0UigI zc3_Ez2#(Ilb@ok~?M7(Lez5%((o6*eRP`w6vKJZUgHP7-@&KCzcG*jK=gc7sJi>CD zFP-4KAuxwYhQMb#R^ZFYD2M$&gsqs@IwER3nM#ATK1aKUan^kioFIa-(!!$$+UK*W+kd3%;5#(@{@n=^eaT_CkSoyf2k_>> z=f_1~?1k&bSgxsK9BMWl!#mru&z{2$xj}1Yqff+r8}^@{i=l3+ETUTCt1^BoYCk4P z%;K~_u4zF?D?0^^o`gBr*r}l97|be*%?{| z>-_rsu@-{kkLe6Z#C9rV`QMKkW6z&5S@f+=;mBnopeA9TAG61Vrs)HxQd1%UtXI$F z(boC(Nn(KT1@!eS)uC*frNMy{x9aE-Is-%lwH=6l@S@%;-mzQ1cabC-e1H5z>r|y2Fj0+e_oEBO`=UQ!!h5k~r>Lk175Q64zY7&@ zx8^BI0T0olp1Aq~OXANxGGxe*JQY{O(4Pu1R3(pN3biIm71smPhh;1uvz;)jt;v3= z>t;rSicSKv0K?CJ`{pffT{+XaCn1zCBVei!N55PQ%<_9+m_HJ8CTF2)*W3lQf2^vp zm)6yZ`~D2h6$MlSf`Nf-P~uF-2t{$fUNJf_cNeCj^JOcOWpkxhWLdJJoa0lS4_h@w zqw`;G1D0AT-m$B`G2ilZC^3(>#;>3=-?2b%&BjZ`Ogpl~EyIQlGn2_=9tr8WQj#Yw z7;o|5sFpBLHUAp}E)Qtc_KRc2S&jba@1;Z{F@QMezGU=GvnN?Pj*S&Y%Y&&xa`RnueTeZlvs#x4%11# z0KoG^DPZNKN%lXfm^SJ^xlVeu-?t(xwxPCGOh#L}$KXgETY$f|aJ?JR=dn2&Z>!UBQeU7*fEY&{dVp-{wu>APwvDU1qKH>8{@Er?D!5t1d zJ`8y=YfYuCq>@H%6)@`Ar_vDh1$i z>r{K&lHdLr+Vzv_#0abx!uckm$DxdHmw3MHIkL;duxhIWk3~GhWM# zL5Zd!DC3kQD+zHp{!a9@o&x6JnWx&PIf?I_Nn@9B+f@5fG(QCyLBhPxXr7D8O&@3M zT{hdr3KvzTKvaFqSSU!~!s7^(M(FV7s0QmfE#&t`I>|f^L1!NngrHhoJIOv-$wzgk z1c|_9qcqQAry|oZ)!eolK|&C~gc5=?Zx!f77?9MfoO4h=u-{XuRDR3^ug+w>q5rRo zUX=rhbyq7kj(WA!wDHb-HK$2EJ$Ae=1q8?NC`6ul=bUp6o^!i6*FhLl zg)y`+pTYx!1`Ub=hYB<44D5~lNYJP%1zpqWjEJF+YE|vDsNb2-AA=87LjZ+Z*W2tq zny_SL^jJ$4?TP+W@H&35y)$Zzg$ZZjm_Gt0E+sk4GO@m1MHWyQxr|yAoNIlI2tLlU zdXygztMd>(-LYLJBWR)@u}AEnTeddY-}&iu?Y8p1CTnUv-@(WVOq!=%ybyOztaXa& zc%|I$WCt;mX#Q~d)(O(Nnr_5nz`P&^DXiyA~Tf<APr zvNAL59YnZ6;@srZrcbr+equTS4YckIsCKiUasdTkqU+Ih;eE@#W~;HuXA+J=WHktP z3>UVR<(IV-ciC-me*UoxiT)BJEeMXd;3PkS6LTP#fFWmza~)hXa{;i^J{LTjNu!^)bTFSg<)0B)i|5|r z6HwtiS4kfFn61g{_Zlbd7o;4D;e=1H7j^oKdVAZ!W{a9L&)hW=z%+ZNuE%4pT|F%v zgW>YO{JUmrT2sB~puYzlTtY-t9CUh;-G3{Xsdt>J%^EIG=SvO?zfn;A14s~8O!hhA zm}aRWb@V7=zQa1)jSWrqnkC=!*oL$W10nnDXUyFJVgmQOAlpLCBD~*q-A^3TDFilH zwVC{~^LG6@X)76)zEcz}SKd3FuoD3j`MkS_HE{x%xOF^}h|9r2_l4V7$Ic|9JNd93 z6!b}xtbgVl?`kGTCziSJBVzt)`~c%soP9J#4*r*&*ZVo zIy^JDrGsB*1vu#S^$lV<%X3+Z*RhF4r{+obySp4myoi&IwOrU>KYT1>%62i%Hs>R` zrjBPVYVO?6#FzTsFPiPv+4Z7daSA5@BT3_d^l1k40^sZ@8*3-^-Bnww-Ddff{gWUv zmJ)UqchQEXbM}nO#N$9QwKf|`Am%#Ca)N5k z&$mM?t$;iAIo8x*$?rFIB0EuF_xF5Bh-&; zqfh!&)q`Z>s_ZiWcNt+qbi{Xx|J8BnM$3)dhCBQD!f2KRC%3EzqYYd*$**d)J$pD9wxF1Yj`?MOn)8 zsagUXvfkpG8+{YeL+8#nGNXs_V(-^UeW-}70HS9AtOJOta~__}O^MjL(B9Pk6d%d4 zjWuN=OLYqDCA7^QPlGAF)t3{6<5+9xJ{svMtfos+u^E*{qYbh8(vp%Er* z-8bE3o!x>&;QB|DiD(4a%`fx(E9RXK(Jg864`NV*2!;+4*E23_=V#-0Wv~y46~+{M9xOoRGu-I zJh^hUcxShN17w0X8KF|jK0%*FhrESz;5|^b*qz^OvLt|6i#aut^cud!9G@lI8PrjiiP`=cZT0r{BZ9BQ36{-)An~>dTHeAa>@D{9Uv05l=hTM{gftAj zv5ArXCvp0J#Z8G=-)L{Rdbj0c9u^#(vd=;0jrXP4-!`>BY0sSACi;J$LZFaTJZGI; zZS-()1&7-()TSUd0Z>VCwC=2V4Uj64`$|!5mqaO-gD~?QQ#oyyG>CxulxRdKWek8; zC~IK0BEQpy-yw&VPi`Uv6gNs3b*GKj{K&ib9TJ}@%%9R|cen4eFKnJG8^xT~%*U$E z4y+yW#|}4xOy2T4Gs^gGA$s$^dubIm+VlJ-fAi8c-hbSg4yjBI?h`d@zP@?8ucA;1xp?%LgYtSira=nf*3_komwwOdppTw z{JGGY%s3`aCI6!|b1Y0YHb@-TkGZ?8&!Rfc`#f^rD8NS&*-LQj?|VU-+k1=TxeQr4 zM0Mm%&}bYo$vkz+xxuAq_OMETH&Od}$J%w$_j_8CkA?i^j=q1Z{Rw+|;|wthJxLzX zan`dXriQ1lGP2ZQ%17pix{o6p5N2WhA6{ePBR45qQU8fyuZQ3CWCLMh`ne?XL|yDy zkk+J9%qNTZ07S=todyx9q*W~Qoip=tFMr24=bJm^vVbr06QjZo-mjv0Jz-ec>X?C- zN&uI0x>J%EfTi47ncS7pER$J4F)247fz z2#WcgS|K==WvWvjM$M}!{*DuYpm`xIwU-BFy?w)iO>WwS6D>PMMxv=1fAcfdeqg^H z*0hG{qNzKML-Dheh(axvYAJ)E;eaav5l*a@o!8PC*FU?#VUt}w9yoUOhzd9(YIe79 z=@x%_1|z#>d)CGE;syT%F7#MZ#)6}X-{DmIhH3V~zxcrySFQcg8LhVFhi9hGoa5UU z9VHB>j8X1M_IET%cV4&G)0c#F%jOQYn&5!V=KMBy@T^6_bvO8C7tOpv)W>?ME*7H% zI9BdY<>ACC)qYAcKHjx(k`Ib^`OWt<@yTK84|TWrYoDme<0J>xDQ~fF{ce*?E#AT; zhwl}cW!^QnTb`XgmUw{8G_p`U0{6;=I>p)v@^MjUT=G~q2(X_C?4I-PNY1+)N z(`F{kLhGNlFf~w{UB+S^a?kADbj22{ermlqH~Id4C{r=xD4{w}5m3=_+(srF`+%F0 zaAv&)*G042LmV=i1lZ^NI(e`;WO` zq3wEiS(p2nuG8_|U)nS0E*8Z^3(mEc04iT5Bdl4n-4c~>POx;@iPxP({|VV{MpK(C z8D3?m%~sbhlVU{Wbh0gfaJK=|(=O)Cu37EL2x4-WtIX{7n?u%7zi$0B-?M+ogL5c5 z?H3*Gg{vO6T+nRu0OPR`VWe$5nCSY*T44TU&&_)lszs@c&@4uj83+Ao#;h@{)G7K) z2e>3MYYMNLyTX<*@(N}IjG1G*gc^ZBDfMWeY>;r|UjIjBsX3J;ZB_e;RU0I>7EH|(!p)+uUU z7M;o(hm7F_YhnrT%?rO{c@+cx$j%qZ3DF;@?@l?45H$P&n7Gi$Zo*wd(K1DwB@Le` z_HZjO2hHqL!kv=X1r64Y*8=<|!B67MUw6h4pL<24ScZEVE+|e;fuo2E#YeR^G)}jd ze)DOIg2n?6Y1{lDW0yJ0w|Vc^YnB{D*dI2&*_5AhKPR{}GPCTv)aW`L{dZkl0V zbN7pZCd~WX#ev3i%)6Lq&-?wlZy&OoFPtYH(`R6U(uAc-aURTUpBx&n90z*VDfq#E zev`H`PV(BQ2{KfsL==|;SXVOa^q~0rYKEXl1aQ?NvhdzR!>iBadB_#uBc}vs{qsq*rj=fxG ze59fS{vT)3R>PajVi9>;l$j zP2bXu`@rdM5&?4zWP}28Bejxh(cWA%lwve|BOUi8=lWExOke2Ep;M}$)nJ3cku~CH zd{=4sKlDFwaxd{tp1ts9P{fb=OkIXuMAOD-P^`l)GL*aCG1nv_Q(d(9Hs1rZ;pSON zgAzQ}kn@N-PwqRs^3KxGyRZJFt%?z-Hjr^Fo@g%6cgmQuF84j-0}&_OO}BWWr5EWj zsTkJ8ZDRn*q-7S|@{lDFJNFo0&g(zVq^&uwf^gR({?iw%$(zx3x!u0?Fb|UZc}3jQ zp}H7d%5%Uue~NYNsblUeJ8HKI=@>i~IHo!y2NR?!l*RTnS2T~^Mrnm#JT z$YO%jEQ6mv|4Cc3&`FfdA}Jqvo;N}D_Eqa1vwW$PZDQW8%g03WByk2zOEx^=FrYX` z6%2tNXk=!Pn_iaDH(fp zc_88(_%3_aWgWgJM1khirWrY#nm3Zpqk2{PF77cYIl^(lq9a47MkKK%2oO2**e5H{ zcG(U0T0U`7_|8UgL3$K^Ubu3Hg~F)-sC_U|$N&v9V`}z?Dj0O4crEutwTMo|+{JmU ztWKw?vXIi~8wlBp08}Tq%1KNTZ+d|P6V;(ITGTPFBv>?g6jax3`8&I5hOcV!BE}DTecNm#()w^Tvpk_xt65PBE`XeuJ_V z*?a;UG^G?3ZOP1n0CaM+%E$DjPuglIP7@PDXNd$O4Clg`V2-ltb$vsly?FgzUKWrs z(KgXB&j9P{I}TV4(^|xY?eAc6+5!az(V8GN3zy-~chXix|0tWOk3(O;9IfJ%)-z@= zu-dGZWEYsg!=5v{gm5Rt+`dfJ^nxh#M7#{x5l$^fO|a zNYjitb`y+%(QVWbXClbgK_yNKrgTnLwT4+0Ksk{!z`sES z{eiGKG{Y(=gMft(@Db(*kE^4_G5I=ETITGS;*Jnj&G|*?MP?2_7liAr1mn zdG4>`q^+ky9x)aN2r5sCQY8SRzmDlknY1-V%0y)jg>0D*2QbWmc5f~kfN8EKBkM-K zrp9^e%q{;PYtq)3fq?UU@Q@*S<*AB_L^@rStb_*734=C3Glh^#-_gv{Z0I=3xtbu% z=I$uHL-7~nbuoS@YQ3f0i+t>iGrD1nDY~uhb;b*A8PADBQ zVgs{2wtX>tCtZe8omw#4LPkRqba65gU+qa-8F09OqKyD5kUc1%m~Da>%6%cAJQJCc z0jj?k{%rndE*Q7p&$HhqZIuBk0T){Ulo{$n$xWUQ%oI>b9#C;vNq16H!|2}$QnS_N z&dQ{%Its0-j^W$BV8{>$P!2FM;9yOj^u$<`mrSR%0F~Ls$55u`ov!-Ccb$sIup89S zj6ma%KrW9dRQWbEI#K%_*k%xbV+8j6+TVg80^@=`KDNjm@lH3k3MZRzy9 z7GgCHWVNu(-fz=1M(%<0Jpt_uiEbT+hVNfM z`yi37*j_d=SuFEwAoYY58uMYjSD<|i+x1eJ2HXY$D9*jJ&Z*sXL^`BpA0 zDm0;!pll@d9CWzFoRH0)VCFzmu84>ST%N92AWfqb4Z%C^4@pLc0`RR3qu#;cK9uxg z4^Nb@PQ%U!(H3zimjRBI%BBUX*tWFueQ^3BJX=bE`$kyIz;yg=l5H z1b?y4C_2L?!%*9q^QV9cd}RQYq8WoTz(`48j8(9$l>v);!TI+}emV5byKufvg1xwO zSTTG*OtTO!AnAU{&7bf9NlD^&uw79MJuX^XCz$!UdGezGrmP85~1p zF8ZFZJDV~TbFrWG`rNt59|6D~gmal&QZ~E}e4%>y|K+g!tps!P;y%I6*j`#bq5%5o z^@Il)1m@d#tzg?3@E^6X4zl09EKx8lxd+}=2ZX9m+6pH+8V>T503ROIiTEaC_^QP znMue26&m$s0F`E0WKWp6^Z>=MeugcuulJ2eB+6wb7S62*`gngb%~_6Kcz-78f%8+i zR@V+KDe=wtlK)@x@jq%|o%a%HZvTDY&yLoRi_9qL037h)`LLr`IrL^ua8pTX=>WyN zUZ7+EenODR3uH`c@;v_}v>u9QD9^t;62>$xpge{-qpMv}ljl0WazF_tkK`vkv(^X8 z*A6Q!4V6ENhn3_*pS;cQ&jr&dIRA8%js-4Fo9h!(V5U+l<3y=}v<-!5Gw`H%DopJM zwC8Ea^nrfIU=C2JAV6{dQ^2KOQc<#j>G@FJKA^LYgmsDos5EnNGCq{n6gUVdHtC)4 zd?@K%O?{|@>+hucz>m5M{nx1d{TGM?p-=8%lHb%!LZm&iRwc<@T3$W?wtts(4d9q| zYKW?4WO5Uu1NK6|PCkK?tkIO`10x|Yiz-ez_nGsdf}=b$Fv<(|q1^W*6Xi)5N=eMk zFjQ!iX9}``;6qis0)9@Os?ZEK`CKo$CO3b@$axVG0QY}zEgtf&x8qJcW2ldM34GQI zE25p|53u5q80vE%6LL;Dq1h0VCkUJB6`K@LjBj!zjGdEm*+AdqrClG4jq>Ef;Q>&r z8~}RIt_W3{+aCaNG_)@SDWJ+wDYEM{yaXwVq2dK!4THyjJZ8Mr%m7y`-F4Ipb#_XmK#!2o= zI|feh7Qv4I0Wn={sMqO47Ujj!p$a4nl~j-oT>m6vhK_{!cMe0P(`**tjG^`%W}gm~ z2#@llvO$E&lUe~6P>ebc`>rxH21oE21=r-|X42N-iNqZO?Z20-N*6>RRjVl8r$eO! zWdpwsl~!UXlVhkfRfK&?xyk49GErV4+J_31MqGwUy9)K5Fjf?GC;?EBMSB!b3Euas z(y5GaZ#++rI;f~SMVnOw6sN!j14`E^H)T$FB3L#sgxr)1s01wmhT-U89VXs+5+BOX zP|VE)Eh?AiJ6FFBmD&^5M=qe!feaOzCUXJBr&p>B^`UT?8;?sorwIp_UW z7(p*YHjpdj+B#G^3{ceMO-Q7@^|5o$DI7dV$9V)mJT9ot+oE--lq||qda(?ZjAke! z2vEZI2Q{rw@P)&&73kD%)=`AJ`y@#G3=}>7e8WsSR)ypJz zStpxyCk0%4G{G78Vi_u;e8mt=9;cM^QC?s!&n+mE`%vz-!^(yagnj&uNt@s{4`EGq zM40UC4>I>)GLhX=ZsFUAii){mH<%aYrC8ZOdDc3PpjFz7=g<^eBf3q5j=>}++J?U~+DGx7SF>_<`q~$A8a11Ia$RtYBoXGbX?6)?` z$t_PMvE=7@CgbnaBY_K%3^kE*VN-cZ08T0Q7{AKUm~)gyc}%2tP$BK3H)$)>#4K~m zLo40Z2c5eQmZghJN~GWc_Q3+XJX{CLV3x^~!-Z~5c_Lai$ZR7Hqe@3sYzpNoDY1M- z3f{6rIr@-aWIESnwi8$^NSKP-Pa!NDI;^BHfyHiY&Aqc-#e+E5AdInHAIhK0Q<}8Z zWhlOmy-Futp3FG*uglmfqQEXxhYFZ1!wjPG5MeWrMPWZ%lS17*8D+8$gx}Th`vUkp5170i z-nVCN4sZ02vp)0z?7zf_7;VcAQb@{8UZ|-Nm2#p*MKM%VKONL4Uoi~TNn3{}%8e6RNwO7< zEE@=)$?u;4Fs7&^R2@Ju0}wPAich_;{U09X1^1Kp9|sl8WxPpSarRv}NgROiJEm6I zH>4-QDXl4*kUeZjN7IBxc~Xswt=LQij~rGhuv1a`VN6`I81}Q3lTdiAM>d=Z%cNg{ z{f;i=D=s4$Dxp>nWd@l%Hh>C=@dAUMcTn0BV61KI_v`bErjh} z70xrMk=2m((?eOw1UlJt7!i>NCtWb)+~RT2k#hlL&QNqffr^DZ9AOidPQs|o*$2~%7*hzsx#C?s zsOa3{v6xA4hH|H!bA};gC3O(V6_u8kP{VL006n;!|#eY(o9eQeK2@PA@?7Q z%wedol-o~*g|dG7>QCCLxUTM_IaDeFvYGnOQ0Om}V~W#X%K0>%R7sAHDcZIgY89B; tleQYUdBS%#44hLT_)GrJuf(LS{|{c9U4Am~c;)~A002ovPDHLkV1kP<=pg_A literal 0 HcmV?d00001 From c15087e7aa3a24e047fc55b497149917017a1378 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 19 Jan 2022 15:45:42 +0000 Subject: [PATCH 178/478] Updated, edited sections for clarity --- .../en/faq/networking/cni-providers/_index.md | 71 +++++++++++-------- 1 file changed, 40 insertions(+), 31 deletions(-) diff --git a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md index fc24cba8085..7894b6c6745 100644 --- a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md +++ b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md @@ -14,11 +14,11 @@ Kubernetes uses CNI as an interface between network providers and Kubernetes pod For more information visit [CNI GitHub project](https://github.com/containernetworking/cni). -### What Network Models are Used in CNI? +## What Network Models are Used in CNI? CNI network providers implement their network fabric using either an encapsulated network model such as Virtual Extensible Lan ([VXLAN](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#vxlan)) or an unencapsulated network model such as Border Gateway Protocol ([BGP](https://en.wikipedia.org/wiki/Border_Gateway_Protocol)). -#### What is an Encapsulated Network? +### What is an Encapsulated Network? This network model provides a logical Layer 2 (L2) network encapsulated over the existing Layer 3 (L3) network topology that spans the Kubernetes cluster nodes. With this model you have an isolated L2 network for containers without needing routing distribution, all at the cost of minimal overhead in terms of processing and increased IP package size, which comes from an IP header generated by overlay encapsulation. Encapsulation information is distributed by UDP ports between Kubernetes workers, interchanging network control plane information about how MAC addresses can be reached. Common encapsulation used in this kind of network model is VXLAN, Internet Protocol Security (IPSec), and IP-in-IP. @@ -26,11 +26,11 @@ In simple terms, this network model generates a kind of network bridge extended This network model is used when an extended L2 bridge is preferred. This network model is sensitive to L3 network latencies of the Kubernetes workers. If datacenters are in distinct geolocations, be sure to have low latencies between them to avoid eventual network segmentation. -CNI network providers using this network model include Flannel, Canal, Weave or Cilium. Calico by default is not using this model but it could be configured. +CNI network providers using this network model include Flannel, Canal, Weave, and Cilium. By default, Calico is not using this model, but it can be configured to do so. ![Encapsulated Network]({{}}/img/rancher/encapsulated-network.png) -#### What is an Unencapsulated Network? +### What is an Unencapsulated Network? This network model provides an L3 network to route packets between containers. This model doesn't generate an isolated l2 network, nor generates overhead. These benefits come at the cost of Kubernetes workers having to manage any route distribution that's needed. Instead of using IP headers for encapsulation, this network model uses a network protocol between Kubernetes workers to distribute routing information to reach pods, such as [BGP](https://en.wikipedia.org/wiki/Border_Gateway_Protocol). @@ -38,13 +38,17 @@ In simple terms, this network model generates a kind of network router extended This network model is used when a routed L3 network is preferred. This mode dynamically updates routes at the OS level for Kubernetes workers. It's less sensitive to latency. -CNI network providers using this network model include Calico. Cilium can also be configured with this model although it is not the default mode. +CNI network providers using this network model include Calico and Cilium. Cilium can also be configured with this model although it is not the default mode. ![Unencapsulated Network]({{}}/img/rancher/unencapsulated-network.png) -### What CNI Providers are Provided by Rancher? +## What CNI Providers are Provided by Rancher? -Out-of-the-box, Rancher provides the following CNI network providers for RKE Kubernetes clusters: Canal, Flannel and Weave. For RKE2 Kubernetes clusters: Canal, Calico and Cilium. You can choose your CNI network provider when you create new Kubernetes clusters from Rancher. +### RKE Kubernetes clusters + +Out-of-the-box, Rancher provides the following CNI network providers for RKE Kubernetes clusters: Canal, Flannel, and Weave. + +You can choose your CNI network provider when you create new Kubernetes clusters from Rancher. #### Canal @@ -67,8 +71,8 @@ For more information, see the [Canal GitHub Page.](https://github.com/projectcal Flannel is a simple and easy way to configure L3 network fabric designed for Kubernetes. Flannel runs a single binary agent named flanneld on each host, which is responsible for allocating a subnet lease to each host out of a larger, preconfigured address space. Flannel uses either the Kubernetes API or etcd directly to store the network configuration, the allocated subnets, and any auxiliary data (such as the host's public IP). Packets are forwarded using one of several backend mechanisms, with the default encapsulation being [VXLAN](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#vxlan). Encapsulated traffic is unencrypted by default. Flannel provides two solutions for encryption: -* [IPSec](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#ipsec), which makes use of [strongSwan](https://www.strongswan.org/) to establish encrypted IPSec tunnels between Kubernetes workers. It is considered experimental -* [Wireguard](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#wireguard), which is a more performing alternative to strongswan +* [IPSec](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#ipsec), which makes use of [strongSwan](https://www.strongswan.org/) to establish encrypted IPSec tunnels between Kubernetes workers. It is an experimental backend for encryption. +* [WireGuard](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#wireguard), which is a more faster-performing alternative to strongSwan. Kubernetes workers should open UDP port `8472` (VXLAN) and TCP port `9099` (healthcheck). See [the port requirements for user clusters]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/#networking-requirements) for more details. @@ -76,6 +80,24 @@ Kubernetes workers should open UDP port `8472` (VXLAN) and TCP port `9099` (heal For more information, see the [Flannel GitHub Page](https://github.com/flannel-io/flannel). +#### Weave + +![Weave Logo]({{}}/img/rancher/weave-logo.png) + +Weave enables networking and network policy in Kubernetes clusters across the cloud. Additionally, it support encrypting traffic between the peers. + +Kubernetes workers should open TCP port `6783` (control port), UDP port `6783` and UDP port `6784` (data ports). See the [port requirements for user clusters]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/#networking-requirements) for more details. + +For more information, see the following pages: + +- [Weave Net Official Site](https://www.weave.works/) + +### RKE2 Kubernetes clusters + +Out-of-the-box, Rancher provides the following CNI network providers for RKE2 Kubernetes clusters: [Canal](#canal) (see above section), Calico, and Cilium. + +You can choose your CNI network provider when you create new Kubernetes clusters from Rancher. + #### Calico ![Calico Logo]({{}}/img/rancher/calico-logo.png) @@ -93,20 +115,15 @@ For more information, see the following pages: - [Project Calico Official Site](https://www.projectcalico.org/) - [Project Calico GitHub Page](https://github.com/projectcalico/calico) +#### Cilium -#### Weave +![Cilium Logo]({{}}/img/rancher/cilium-logo.png) -![Weave Logo]({{}}/img/rancher/weave-logo.png) +Cilium enables networking and network policies (L3, L4 and L7) in Kubernetes. Cilium by default uses eBPF technologies to route packets inside the node and vxlan to send packets to other nodes, unencapsulated techniques can also be configured. -Weave enables networking and network policy in Kubernetes clusters across the cloud. Additionally, it support encrypting traffic between the peers. +Cilium recommends kernel versions greater than 5.2 to be able to leverage the full potential of eBPF. Kubernetes workers should open TCP port `8472` for VXLAN and TCP port `4140` for health checks. Besides ICMP 8/0 must be enabled for health checks too. Fro more information check [Cilium System Requirements](https://docs.cilium.io/en/latest/operations/system_requirements/#firewall-requirements) -Kubernetes workers should open TCP port `6783` (control port), UDP port `6783` and UDP port `6784` (data ports). See the [port requirements for user clusters]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/#networking-requirements) for more details. - -For more information, see the following pages: - -- [Weave Net Official Site](https://www.weave.works/) - -### CNI Features by Provider +## CNI Features by Provider The following table summarizes the different features available for each CNI network provider provided by Rancher. @@ -132,34 +149,26 @@ The following table summarizes the different features available for each CNI net - Ingress/Egress Policies: This feature allows you to manage routing control for both Kubernetes and non-Kubernetes communications. -### Cilium - -![Cilium Logo]({{}}/img/rancher/cilium-logo.png) - -Cilium enables networking and network policies (L3, L4 and L7) in Kubernetes. Cilium by default uses eBPF technologies to route packets inside the node and vxlan to send packets to other nodes, unencapsulated techniques can also be configured. - -Cilium recommends kernel versions greater than 5.2 to be able to leverage the full potential of eBPF. Kubernetes workers should open TCP port `8472` for VXLAN and TCP port `4140` for health checks. Besides ICMP 8/0 must be enabled for health checks too. Fro more information check [Cilium System Requirements](https://docs.cilium.io/en/latest/operations/system_requirements/#firewall-requirements) - -#### CNI Community Popularity +## CNI Community Popularity The following table summarizes different GitHub metrics to give you an idea of each project's popularity and activity. This data was collected in January 2022. | Provider | Project | Stars | Forks | Contributors | | ---- | ---- | ---- | ---- | ---- | | Canal | https://github.com/projectcalico/canal | 679 | 100 | 21 | -| flannel | https://github.com/flannel-io/flannel | 7k | 2.5k | 185 | +| Flannel | https://github.com/flannel-io/flannel | 7k | 2.5k | 185 | | Calico | https://github.com/projectcalico/calico | 3.1k | 741 | 224 | | Weave | https://github.com/weaveworks/weave/ | 6.2k | 635 | 84 | | Cilium | https://github.com/cilium/cilium | 10.6k | 1.3k | 352 |
-### Which CNI Provider Should I Use? +## Which CNI Provider Should I Use? It depends on your project needs. There are many different providers, which each have various features and options. There isn't one provider that meets everyone's needs. Canal is the default CNI network provider. We recommend it for most use cases. It provides encapsulated networking for containers with Flannel, while adding Calico network policies that can provide project/namespace isolation in terms of networking. -### How can I configure a CNI network provider? +## How can I configure a CNI network provider? Please see [Cluster Options]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/options/) on how to configure a network provider for your cluster. For more advanced configuration options, please see how to configure your cluster using a [Config File]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/options/#cluster-config-file) and the options for [Network Plug-ins]({{}}/rke/latest/en/config-options/add-ons/network-plugins/). From 30ca8c2c2b3f72cd612dee46d0cbb481562ceedb Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 19 Jan 2022 15:51:48 +0000 Subject: [PATCH 179/478] Reworded phrasing --- content/rancher/v2.6/en/faq/networking/cni-providers/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md index 701ae0847c4..815bb75a4b7 100644 --- a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md +++ b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md @@ -38,7 +38,7 @@ In simple terms, this network model generates a kind of network router extended This network model is used when a routed L3 network is preferred. This mode dynamically updates routes at the OS level for Kubernetes workers. It's less sensitive to latency. -CNI network providers using this network model include Calico and Cilium. Cilium can also be configured with this model although it is not the default mode. +CNI network providers using this network model include Calico and Cilium. Cilium may be configured with this model although it is not the default mode. ![Unencapsulated Network]({{}}/img/rancher/unencapsulated-network.png) From c3da4c35af1d6a6ac067f813e770c398d9ee747c Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 19 Jan 2022 15:56:20 +0000 Subject: [PATCH 180/478] Edited Cilium section --- .../rancher/v2.6/en/faq/networking/cni-providers/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md index 815bb75a4b7..50dbe3525f9 100644 --- a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md +++ b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md @@ -120,9 +120,9 @@ For more information, see the following pages: ![Cilium Logo]({{}}/img/rancher/cilium-logo.png) -Cilium enables networking and network policies (L3, L4 and L7) in Kubernetes. Cilium by default uses eBPF technologies to route packets inside the node and vxlan to send packets to other nodes, unencapsulated techniques can also be configured. +Cilium enables networking and network policies (L3, L4, and L7) in Kubernetes. By default, Cilium uses eBPF technologies to route packets inside the node and VXLAN to send packets to other nodes. Unencapsulated techniques can also be configured. -Cilium recommends kernel versions greater than 5.2 to be able to leverage the full potential of eBPF. Kubernetes workers should open TCP port `8472` for VXLAN and TCP port `4140` for health checks. Besides ICMP 8/0 must be enabled for health checks too. Fro more information check [Cilium System Requirements](https://docs.cilium.io/en/latest/operations/system_requirements/#firewall-requirements) +Cilium recommends kernel versions greater than 5.2 to be able to leverage the full potential of eBPF. Kubernetes workers should open TCP port `8472` for VXLAN and TCP port `4140` for health checks. In addition, ICMP 8/0 must be enabled for health checks. For more informationm check [Cilium System Requirements](https://docs.cilium.io/en/latest/operations/system_requirements/#firewall-requirements). ## CNI Features by Provider From ada7fe312adb1dbe6a23851a6cbc37508c5e2769 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 19 Jan 2022 15:58:34 +0000 Subject: [PATCH 181/478] Fixed typo --- content/rancher/v2.6/en/faq/networking/cni-providers/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md index 50dbe3525f9..dce89e17c82 100644 --- a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md +++ b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md @@ -122,7 +122,7 @@ For more information, see the following pages: Cilium enables networking and network policies (L3, L4, and L7) in Kubernetes. By default, Cilium uses eBPF technologies to route packets inside the node and VXLAN to send packets to other nodes. Unencapsulated techniques can also be configured. -Cilium recommends kernel versions greater than 5.2 to be able to leverage the full potential of eBPF. Kubernetes workers should open TCP port `8472` for VXLAN and TCP port `4140` for health checks. In addition, ICMP 8/0 must be enabled for health checks. For more informationm check [Cilium System Requirements](https://docs.cilium.io/en/latest/operations/system_requirements/#firewall-requirements). +Cilium recommends kernel versions greater than 5.2 to be able to leverage the full potential of eBPF. Kubernetes workers should open TCP port `8472` for VXLAN and TCP port `4140` for health checks. In addition, ICMP 8/0 must be enabled for health checks. For more information, check [Cilium System Requirements](https://docs.cilium.io/en/latest/operations/system_requirements/#firewall-requirements). ## CNI Features by Provider From 9bbbb8b111db803da039491aba0b971610a15def Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 19 Jan 2022 16:02:26 +0000 Subject: [PATCH 182/478] Updated table --- .../v2.6/en/faq/networking/cni-providers/_index.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md index dce89e17c82..189c4d95a9b 100644 --- a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md +++ b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md @@ -130,11 +130,11 @@ The following table summarizes the different features available for each CNI net | Provider | Network Model | Route Distribution | Network Policies | Mesh | External Datastore | Encryption | Ingress/Egress Policies | | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | -| Canal | Encapsulated (VXLAN) | No | Yes | No | K8S API | Yes | Yes | -| Flannel | Encapsulated (VXLAN) | No | No | No | K8S API | Yes | No | -| Calico | Encapsulated (VXLAN,IPIP) OR Unencapsulated | Yes | Yes | Yes | Etcd and K8S API | Yes | Yes | +| Canal | Encapsulated (VXLAN) | No | Yes | No | K8s API | Yes | Yes | +| Flannel | Encapsulated (VXLAN) | No | No | No | K8s API | Yes | No | +| Calico | Encapsulated (VXLAN,IPIP) OR Unencapsulated | Yes | Yes | Yes | Etcd and K8s API | Yes | Yes | | Weave | Encapsulated | Yes | Yes | Yes | No | Yes | Yes | -| Cilium | Encapsulated (VXLAN) | Yes | Yes | Yes | Etcd and K8S API | Yes | Yes | +| Cilium | Encapsulated (VXLAN) | Yes | Yes | Yes | Etcd and K8s API | Yes | Yes | - Network Model: Encapsulated or unencapsulated. For more information, see [What Network Models are Used in CNI?](#what-network-models-are-used-in-cni) From f2b335d589c4f284873ab21786c9d86f0bd25404 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Wed, 19 Jan 2022 21:00:30 -0800 Subject: [PATCH 183/478] Apply 72223b7e to Rancher 2.6 docs Fix a typo --- .../configuration/servicemonitor-podmonitor/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/monitoring-alerting/configuration/servicemonitor-podmonitor/_index.md b/content/rancher/v2.6/en/monitoring-alerting/configuration/servicemonitor-podmonitor/_index.md index 20dc901da31..d2f848b6e67 100644 --- a/content/rancher/v2.6/en/monitoring-alerting/configuration/servicemonitor-podmonitor/_index.md +++ b/content/rancher/v2.6/en/monitoring-alerting/configuration/servicemonitor-podmonitor/_index.md @@ -26,6 +26,6 @@ For more information about how ServiceMonitors work, refer to the [Prometheus Op This pseudo-CRD maps to a section of the Prometheus custom resource configuration. It declaratively specifies how group of pods should be monitored. -When a PodMonitor is created, the Prometheus Operator updates the Prometheus scrape configuration to include the PodMonitor configuration. Then Prometheus begins scraping metrics from the endpoint defined in the ServiceMonitor. +When a PodMonitor is created, the Prometheus Operator updates the Prometheus scrape configuration to include the PodMonitor configuration. Then Prometheus begins scraping metrics from the endpoint defined in the PodMonitor. Any Pods in your cluster that match the labels located within the PodMonitor `selector` field will be monitored based on the `podMetricsEndpoints` specified on the PodMonitor. For more information on what fields can be specified, please look at the [spec](https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/api.md#podmonitorspec) provided by Prometheus Operator. From 4863fa4f6e0f8a87ad9703463ee71879f6941ec2 Mon Sep 17 00:00:00 2001 From: Ben Healey Date: Thu, 20 Jan 2022 11:00:41 -0500 Subject: [PATCH 184/478] Added Nginx's validating webhook port --- .../rancher/v2.6/en/installation/requirements/ports/_index.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/rancher/v2.6/en/installation/requirements/ports/_index.md b/content/rancher/v2.6/en/installation/requirements/ports/_index.md index 9e724310864..4034e794869 100644 --- a/content/rancher/v2.6/en/installation/requirements/ports/_index.md +++ b/content/rancher/v2.6/en/installation/requirements/ports/_index.md @@ -88,6 +88,7 @@ The following tables break down the port requirements for traffic between the Ra | TCP | 2379 | etcd client requests | | TCP | 2380 | etcd peer communication | | TCP | 6443 | Kubernetes apiserver | +| TCP | 8443 | Nginx Ingress's Validating Webhoook | | UDP | 8472 | Canal/Flannel VXLAN overlay networking | | TCP | 9099 | Canal/Flannel livenessProbe/readinessProbe | | TCP | 10250 | Metrics server communication with all nodes | From 293a04cf776bcee0f2a79a593e9a13b2799a01ce Mon Sep 17 00:00:00 2001 From: Manuel Buil Date: Fri, 21 Jan 2022 12:20:16 +0100 Subject: [PATCH 185/478] Update ports for the different CNIs Signed-off-by: Manuel Buil --- .../v2.6/en/faq/networking/cni-providers/_index.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md index 189c4d95a9b..f4550e1526c 100644 --- a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md +++ b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md @@ -58,7 +58,7 @@ Canal is a CNI network provider that gives you the best of Flannel and Calico. I In Rancher, Canal is the default CNI network provider combined with Flannel and VXLAN encapsulation. -Kubernetes workers should open UDP port `8472` (VXLAN) and TCP port `9099` (healthcheck). For details, refer to [the port requirements for user clusters.]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/) +Kubernetes workers should open UDP port `8472` (VXLAN) and TCP port `9099` (healthcheck). If using Wireguard, you should open UDP ports `51820` and `51821`. For details, refer to [the port requirements for user clusters.]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/) {{< img "/img/rancher/canal-diagram.png" "Canal Diagram">}} @@ -75,7 +75,7 @@ Encapsulated traffic is unencrypted by default. Flannel provides two solutions f * [IPSec](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#ipsec), which makes use of [strongSwan](https://www.strongswan.org/) to establish encrypted IPSec tunnels between Kubernetes workers. It is an experimental backend for encryption. * [WireGuard](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#wireguard), which is a more faster-performing alternative to strongSwan. -Kubernetes workers should open UDP port `8472` (VXLAN) and TCP port `9099` (healthcheck). See [the port requirements for user clusters]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/#networking-requirements) for more details. +Kubernetes workers should open UDP port `8472` (VXLAN). See [the port requirements for user clusters]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/#networking-requirements) for more details. ![Flannel Diagram]({{}}/img/rancher/flannel-diagram.png) @@ -107,7 +107,7 @@ Calico enables networking and network policy in Kubernetes clusters across the c Calico also provides a stateless IP-in-IP or VXLAN encapsulation mode that can be used, if necessary. Calico also offers policy isolation, allowing you to secure and govern your Kubernetes workloads using advanced ingress and egress policies. -Kubernetes workers should open TCP port `179` (BGP). See [the port requirements for user clusters]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/#networking-requirements) for more details. +Kubernetes workers should open TCP port `179` if using BGP or UDP port `4789` if using VXLAN encapsulation. Besides, TCP port `5473` is needed when using Typha. See [the port requirements for user clusters]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/#networking-requirements) for more details. ![Calico Diagram]({{}}/img/rancher/calico-diagram.svg) @@ -122,7 +122,7 @@ For more information, see the following pages: Cilium enables networking and network policies (L3, L4, and L7) in Kubernetes. By default, Cilium uses eBPF technologies to route packets inside the node and VXLAN to send packets to other nodes. Unencapsulated techniques can also be configured. -Cilium recommends kernel versions greater than 5.2 to be able to leverage the full potential of eBPF. Kubernetes workers should open TCP port `8472` for VXLAN and TCP port `4140` for health checks. In addition, ICMP 8/0 must be enabled for health checks. For more information, check [Cilium System Requirements](https://docs.cilium.io/en/latest/operations/system_requirements/#firewall-requirements). +Cilium recommends kernel versions greater than 5.2 to be able to leverage the full potential of eBPF. Kubernetes workers should open TCP port `8472` for VXLAN and TCP port `4240` for health checks. In addition, ICMP 8/0 must be enabled for health checks. For more information, check [Cilium System Requirements](https://docs.cilium.io/en/latest/operations/system_requirements/#firewall-requirements). ## CNI Features by Provider From 0fa9326c308157ced3481f59429ccc6c9685e589 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 21 Jan 2022 14:29:08 +0000 Subject: [PATCH 186/478] Fixed typo --- .../rancher/v2.6/en/installation/requirements/ports/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/requirements/ports/_index.md b/content/rancher/v2.6/en/installation/requirements/ports/_index.md index 4034e794869..a9eaaf1bd81 100644 --- a/content/rancher/v2.6/en/installation/requirements/ports/_index.md +++ b/content/rancher/v2.6/en/installation/requirements/ports/_index.md @@ -88,7 +88,7 @@ The following tables break down the port requirements for traffic between the Ra | TCP | 2379 | etcd client requests | | TCP | 2380 | etcd peer communication | | TCP | 6443 | Kubernetes apiserver | -| TCP | 8443 | Nginx Ingress's Validating Webhoook | +| TCP | 8443 | Nginx Ingress's Validating Webhook | | UDP | 8472 | Canal/Flannel VXLAN overlay networking | | TCP | 9099 | Canal/Flannel livenessProbe/readinessProbe | | TCP | 10250 | Metrics server communication with all nodes | From 424c2f3276964d2d9365419aed34f171f03767ee Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 21 Jan 2022 15:35:46 +0000 Subject: [PATCH 187/478] Added small edits --- .../rancher/v2.6/en/faq/networking/cni-providers/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md index f4550e1526c..718f2e36b24 100644 --- a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md +++ b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md @@ -58,7 +58,7 @@ Canal is a CNI network provider that gives you the best of Flannel and Calico. I In Rancher, Canal is the default CNI network provider combined with Flannel and VXLAN encapsulation. -Kubernetes workers should open UDP port `8472` (VXLAN) and TCP port `9099` (healthcheck). If using Wireguard, you should open UDP ports `51820` and `51821`. For details, refer to [the port requirements for user clusters.]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/) +Kubernetes workers should open UDP port `8472` (VXLAN) and TCP port `9099` (health checks). If using Wireguard, you should open UDP ports `51820` and `51821`. For more details, refer to [the port requirements for user clusters]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/). {{< img "/img/rancher/canal-diagram.png" "Canal Diagram">}} @@ -107,7 +107,7 @@ Calico enables networking and network policy in Kubernetes clusters across the c Calico also provides a stateless IP-in-IP or VXLAN encapsulation mode that can be used, if necessary. Calico also offers policy isolation, allowing you to secure and govern your Kubernetes workloads using advanced ingress and egress policies. -Kubernetes workers should open TCP port `179` if using BGP or UDP port `4789` if using VXLAN encapsulation. Besides, TCP port `5473` is needed when using Typha. See [the port requirements for user clusters]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/#networking-requirements) for more details. +Kubernetes workers should open TCP port `179` if using BGP or UDP port `4789` if using VXLAN encapsulation. In addition, TCP port `5473` is needed when using Typha. See [the port requirements for user clusters]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/#networking-requirements) for more details. ![Calico Diagram]({{}}/img/rancher/calico-diagram.svg) From ee60e0141ccd6ffe98554d1fedbddffc54f883b1 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 21 Jan 2022 18:45:48 +0000 Subject: [PATCH 188/478] Added note about extra binds in K3s --- .../volumes-and-storage/iscsi-volumes/_index.md | 7 +++++-- .../volumes-and-storage/iscsi-volumes/_index.md | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/content/rancher/v2.5/en/cluster-admin/volumes-and-storage/iscsi-volumes/_index.md b/content/rancher/v2.5/en/cluster-admin/volumes-and-storage/iscsi-volumes/_index.md index 1a30d52540d..360995934af 100644 --- a/content/rancher/v2.5/en/cluster-admin/volumes-and-storage/iscsi-volumes/_index.md +++ b/content/rancher/v2.5/en/cluster-admin/volumes-and-storage/iscsi-volumes/_index.md @@ -19,9 +19,12 @@ If you encounter this issue, you can work around it by installing the initiator After installing the initiator tool on your nodes, edit the YAML for your cluster, editing the kubelet configuration to mount the iSCSI binary and configuration, as shown in the sample below. ->**Note:** +>**Notes:** +> +>- Before updating your Kubernetes YAML to mount the iSCSI binary and configuration, make sure either the `open-iscsi` (deb) or `iscsi-initiator-utils` (yum) package is installed on your cluster nodes. If this package isn't installed _before_ the bind mounts are created in your Kubernetes YAML, Docker will automatically create the directories and files on each node and will not allow the package install to succeed.
+>
> ->Before updating your Kubernetes YAML to mount the iSCSI binary and configuration, make sure either the `open-iscsi` (deb) or `iscsi-initiator-utils` (yum) package is installed on your cluster nodes. If this package isn't installed _before_ the bind mounts are created in your Kubernetes YAML, Docker will automatically create the directories and files on each node and will not allow the package install to succeed. +>- The example YAML below does not apply to K3s. Since the K3s kubelet does not run in a container, adding extra binds is not necessary. However, all iSCSI tools must still be installed on your K3s nodes. ``` services: diff --git a/content/rancher/v2.6/en/cluster-admin/volumes-and-storage/iscsi-volumes/_index.md b/content/rancher/v2.6/en/cluster-admin/volumes-and-storage/iscsi-volumes/_index.md index 01d87aabd59..c74e56c5bd5 100644 --- a/content/rancher/v2.6/en/cluster-admin/volumes-and-storage/iscsi-volumes/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/volumes-and-storage/iscsi-volumes/_index.md @@ -17,9 +17,12 @@ If you encounter this issue, you can work around it by installing the initiator After installing the initiator tool on your nodes, edit the YAML for your cluster, editing the kubelet configuration to mount the iSCSI binary and configuration, as shown in the sample below. ->**Note:** +>**Notes:** +> +>- Before updating your Kubernetes YAML to mount the iSCSI binary and configuration, make sure either the `open-iscsi` (deb) or `iscsi-initiator-utils` (yum) package is installed on your cluster nodes. If this package isn't installed _before_ the bind mounts are created in your Kubernetes YAML, Docker will automatically create the directories and files on each node and will not allow the package install to succeed.
+>
> ->Before updating your Kubernetes YAML to mount the iSCSI binary and configuration, make sure either the `open-iscsi` (deb) or `iscsi-initiator-utils` (yum) package is installed on your cluster nodes. If this package isn't installed _before_ the bind mounts are created in your Kubernetes YAML, Docker will automatically create the directories and files on each node and will not allow the package install to succeed. +>- The example YAML below does not apply to K3s. Since the K3s kubelet does not run in a container, adding extra binds is not necessary. However, all iSCSI tools must still be installed on your K3s nodes. ``` services: From be84aba470726b038776d231d15f8abb8b1f47a4 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 21 Jan 2022 19:11:49 +0000 Subject: [PATCH 189/478] Updated note --- .../cluster-admin/volumes-and-storage/iscsi-volumes/_index.md | 2 +- .../cluster-admin/volumes-and-storage/iscsi-volumes/_index.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.5/en/cluster-admin/volumes-and-storage/iscsi-volumes/_index.md b/content/rancher/v2.5/en/cluster-admin/volumes-and-storage/iscsi-volumes/_index.md index 360995934af..deaaaac4fc5 100644 --- a/content/rancher/v2.5/en/cluster-admin/volumes-and-storage/iscsi-volumes/_index.md +++ b/content/rancher/v2.5/en/cluster-admin/volumes-and-storage/iscsi-volumes/_index.md @@ -24,7 +24,7 @@ After installing the initiator tool on your nodes, edit the YAML for your cluste >- Before updating your Kubernetes YAML to mount the iSCSI binary and configuration, make sure either the `open-iscsi` (deb) or `iscsi-initiator-utils` (yum) package is installed on your cluster nodes. If this package isn't installed _before_ the bind mounts are created in your Kubernetes YAML, Docker will automatically create the directories and files on each node and will not allow the package install to succeed.
>
> ->- The example YAML below does not apply to K3s. Since the K3s kubelet does not run in a container, adding extra binds is not necessary. However, all iSCSI tools must still be installed on your K3s nodes. +>- The example YAML below does not apply to K3s, but only to RKE clusters. Since the K3s kubelet does not run in a container, adding extra binds is not necessary. However, all iSCSI tools must still be installed on your K3s nodes. ``` services: diff --git a/content/rancher/v2.6/en/cluster-admin/volumes-and-storage/iscsi-volumes/_index.md b/content/rancher/v2.6/en/cluster-admin/volumes-and-storage/iscsi-volumes/_index.md index c74e56c5bd5..c8a14cb458d 100644 --- a/content/rancher/v2.6/en/cluster-admin/volumes-and-storage/iscsi-volumes/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/volumes-and-storage/iscsi-volumes/_index.md @@ -22,7 +22,7 @@ After installing the initiator tool on your nodes, edit the YAML for your cluste >- Before updating your Kubernetes YAML to mount the iSCSI binary and configuration, make sure either the `open-iscsi` (deb) or `iscsi-initiator-utils` (yum) package is installed on your cluster nodes. If this package isn't installed _before_ the bind mounts are created in your Kubernetes YAML, Docker will automatically create the directories and files on each node and will not allow the package install to succeed.
>
> ->- The example YAML below does not apply to K3s. Since the K3s kubelet does not run in a container, adding extra binds is not necessary. However, all iSCSI tools must still be installed on your K3s nodes. +>- The example YAML below does not apply to K3s, but only to RKE clusters. Since the K3s kubelet does not run in a container, adding extra binds is not necessary. However, all iSCSI tools must still be installed on your K3s nodes. ``` services: From a2289bdbee0c5c969a6ec9c6ab448c21935d3a5e Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 24 Jan 2022 17:51:17 +0000 Subject: [PATCH 190/478] Updated note per feedback to 2.5, 2.6 --- .../en/cluster-provisioning/registered-clusters/_index.md | 4 +++- .../en/cluster-provisioning/registered-clusters/_index.md | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.5/en/cluster-provisioning/registered-clusters/_index.md b/content/rancher/v2.5/en/cluster-provisioning/registered-clusters/_index.md index faa23bcce86..0e1ee65c004 100644 --- a/content/rancher/v2.5/en/cluster-provisioning/registered-clusters/_index.md +++ b/content/rancher/v2.5/en/cluster-provisioning/registered-clusters/_index.md @@ -121,7 +121,9 @@ $ curl -sfL https://get.k3s.io | K3S_KUBECONFIG_MODE="644" sh -s - ### Configuring an Imported EKS Cluster with Terraform -You should define **only** the minimum fields that Rancher requires when importing an EKS cluster with Terraform. This is important as Rancher will overwrite what was in the EKS cluster with any config that the user has provided, whether that config is valid or not. +You should define **only** the minimum fields that Rancher requires when importing an EKS cluster with Terraform. This is important as Rancher will overwrite what was in the EKS cluster with any config that the user has provided. + +>**Warning:** Even a small difference between the current EKS cluster and a user-provided config could have unexpected results. The minimum config fields required by Rancher to import EKS clusters with Terraform using `eks_config_v2` are as follows: diff --git a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md index 6c3c8b0d4f8..eaf3b5adbdb 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md @@ -88,7 +88,9 @@ $ curl -sfL https://get.k3s.io | K3S_KUBECONFIG_MODE="644" sh -s - ### Configuring an Imported EKS Cluster with Terraform -You should define **only** the minimum fields that Rancher requires when importing an EKS cluster with Terraform. This is important as Rancher will overwrite what was in the EKS cluster with any config that the user has provided, whether that config is valid or not. +You should define **only** the minimum fields that Rancher requires when importing an EKS cluster with Terraform. This is important as Rancher will overwrite what was in the EKS cluster with any config that the user has provided. + +>**Warning:** Even a small difference between the current EKS cluster and a user-provided config could have unexpected results. The minimum config fields required by Rancher to import EKS clusters with Terraform using `eks_config_v2` are as follows: From 84816f0d3f23bc9e94e27134a4198042ebcd2520 Mon Sep 17 00:00:00 2001 From: Jen Travinski Date: Mon, 24 Jan 2022 12:56:09 -0500 Subject: [PATCH 191/478] Update content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md Co-authored-by: Donnie Adams --- .../v2.6/en/cluster-provisioning/registered-clusters/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md index fc6c44e175c..48c107f65e9 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md @@ -204,7 +204,7 @@ Authorized Cluster Endpoint (ACE) support has been added for registered RKE2 and 1. Finally, you **must** go back to the Rancher UI and edit the imported cluster there to complete the ACE enablement. Click on **⋮ > Edit Config**, then click the **Networking** tab under Cluster Configuration. Finally, click the **Enabled** button for **Authorized Endpoint**. Once the ACE is enabled, you then have the option of entering a fully qualified domain name (FQDN) and certificate information. - >**Note:** The FQDN field is optional, and if one is entered, it should point to the downstream cluster. Certificate information is only needed if there is a load balancer in front of the downstream cluster that is using an untrusted certificate. If you have a valid certificate, make no changes to the CA Certificates field. + >**Note:** The FQDN field is optional, and if one is entered, it should point to the downstream cluster. Certificate information is only needed if there is a load balancer in front of the downstream cluster that is using an untrusted certificate. If you have a valid certificate, then nothing needs to be added to the CA Certificates field. # Annotating Registered Clusters From b59c66c8c5048f5ccbfff12b8bff457b99b13d05 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 24 Jan 2022 21:32:13 +0000 Subject: [PATCH 192/478] Added notes for air-gapped migration in 2.5 and 2.6 --- .../rancher/v2.5/en/backups/migrating-rancher/_index.md | 8 +++++++- .../rancher/v2.6/en/backups/migrating-rancher/_index.md | 7 ++++++- .../en/config-options/services/services-extras/_index.md | 2 +- 3 files changed, 14 insertions(+), 3 deletions(-) diff --git a/content/rancher/v2.5/en/backups/migrating-rancher/_index.md b/content/rancher/v2.5/en/backups/migrating-rancher/_index.md index e8084657e17..e84fe21de1b 100644 --- a/content/rancher/v2.5/en/backups/migrating-rancher/_index.md +++ b/content/rancher/v2.5/en/backups/migrating-rancher/_index.md @@ -21,13 +21,19 @@ Rancher can be installed on any Kubernetes cluster, including hosted Kubernetes - [K3s Kubernetes installation docs]({{}}/k3s/latest/en/installation/) ### 1. Install the rancher-backup Helm chart -Install version 1.x.x of the rancher-backup chart. +Install version 1.x.x of the rancher-backup chart. The following assumes a connected environment with access to DockerHub: + ``` helm repo add rancher-charts https://charts.rancher.io helm repo update helm install rancher-backup-crd rancher-charts/rancher-backup-crd -n cattle-resources-system --create-namespace --version $CHART_VERSION helm install rancher-backup rancher-charts/rancher-backup -n cattle-resources-system --version $CHART_VERSION ``` +
+For an **air-gapped environment**, use the option below to pull the `backup-restore-operator` image from your private registry when installing the rancher-backup-crd helm chart. +``` +--set image.repository $REGISTRY/rancher/backup-restore-operator +``` ### 2. Restore from backup using a Restore custom resource diff --git a/content/rancher/v2.6/en/backups/migrating-rancher/_index.md b/content/rancher/v2.6/en/backups/migrating-rancher/_index.md index 605d917fea0..74b173930f5 100644 --- a/content/rancher/v2.6/en/backups/migrating-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/migrating-rancher/_index.md @@ -19,13 +19,18 @@ Rancher can be installed on any Kubernetes cluster, including hosted Kubernetes - [K3s Kubernetes installation docs]({{}}/k3s/latest/en/installation/) ### 1. Install the rancher-backup Helm chart -Install version 2.x.x of the rancher-backup chart. +Install version 2.x.x of the rancher-backup chart. The following assumes a connected environment with access to DockerHub: ``` helm repo add rancher-charts https://charts.rancher.io helm repo update helm install rancher-backup-crd rancher-charts/rancher-backup-crd -n cattle-resources-system --create-namespace --version $CHART_VERSION helm install rancher-backup rancher-charts/rancher-backup -n cattle-resources-system --version $CHART_VERSION ``` +
+For an **air-gapped environment**, use the option below to pull the `backup-restore-operator` image from your private registry when installing the rancher-backup-crd helm chart. +``` +--set image.repository $REGISTRY/rancher/backup-restore-operator +``` ### 2. Restore from backup using a Restore custom resource diff --git a/content/rke/latest/en/config-options/services/services-extras/_index.md b/content/rke/latest/en/config-options/services/services-extras/_index.md index 8c86d64de56..9a6d579854a 100644 --- a/content/rke/latest/en/config-options/services/services-extras/_index.md +++ b/content/rke/latest/en/config-options/services/services-extras/_index.md @@ -34,7 +34,7 @@ Additional volume binds can be added to services using the `extra_binds` argumen services: kubelet: extra_binds: - - "/host/dev:/dev" + - "/dev:/host/dev" - "/usr/libexec/kubernetes/kubelet-plugins:/usr/libexec/kubernetes/kubelet-plugins:z" ``` From a5721f7bb58fbe1f2b87021f27a4bef6a508b6e1 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 25 Jan 2022 22:07:38 +0000 Subject: [PATCH 193/478] Updated note for 2.0 - 2.4 --- .../resources/advanced/helm2/helm-rancher/_index.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.0-v2.4/en/installation/resources/advanced/helm2/helm-rancher/_index.md b/content/rancher/v2.0-v2.4/en/installation/resources/advanced/helm2/helm-rancher/_index.md index 952cd721134..dc96db26d41 100644 --- a/content/rancher/v2.0-v2.4/en/installation/resources/advanced/helm2/helm-rancher/_index.md +++ b/content/rancher/v2.0-v2.4/en/installation/resources/advanced/helm2/helm-rancher/_index.md @@ -131,7 +131,12 @@ deployment "rancher" successfully rolled out This option uses `cert-manager` to automatically request and renew [Let's Encrypt](https://letsencrypt.org/) certificates. This is a free service that provides you with a valid certificate as Let's Encrypt is a trusted CA. This configuration uses HTTP validation (`HTTP-01`) so the load balancer must have a public DNS record and be accessible from the internet. -- Set `hostname` to the public DNS record, set `ingress.tls.source` to `letsEncrypt`, `letsEncrypt.email` to the email address used for communication about your certificate (for example, expiry notices), and `letsEncrypt.ingress.class` to whatever your ingress controlller is (`traefik`, `nginx`, `haproxy`). +In the following command, + +- Set `hostname` to the public DNS record that resolves to your load balancer. +- Set `ingress.tls.source` to `letsEncrypt`. +- Set `letsEncrypt.email` to the email address used for communication about your certificate (for example, expiry notices). +- Set `letsEncrypt.ingress.class` to whatever your ingress controller is, e.g., `traefik`, `nginx`, `haproxy`, etc. - If you are installing an alpha version, Helm requires adding the `--devel` option to the command. ``` From bc2b3126432d7b8ee619ebdb6ab4e3bb4989ecb1 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 25 Jan 2022 22:08:05 +0000 Subject: [PATCH 194/478] Updated note, command for 2.5 --- .../v2.5/en/installation/install-rancher-on-k8s/_index.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md index 94497592e86..5726d8c1c38 100644 --- a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md +++ b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md @@ -190,7 +190,7 @@ deployment "rancher" successfully rolled out This option uses `cert-manager` to automatically request and renew [Let's Encrypt](https://letsencrypt.org/) certificates. This is a free service that provides you with a valid certificate as Let's Encrypt is a trusted CA. ->**Note:**: You need to have port 80 open as the HTTP-01 challenge can only be done on port 80. +>**Note:** You need to have port 80 open as the HTTP-01 challenge can only be done on port 80. In the following command, @@ -198,6 +198,7 @@ In the following command, - Set `replicas` to the number of replicas to use for the Rancher Deployment. This defaults to 3; if you have less than 3 nodes in your cluster you should reduce it accordingly. - Set `ingress.tls.source` to `letsEncrypt`. - Set `letsEncrypt.email` to the email address used for communication about your certificate (for example, expiry notices). +- Set `letsEncrypt.ingress.class` to whatever your ingress controller is, e.g., `traefik`, `nginx`, `haproxy`, etc. - To install a specific Rancher version, use the `--version` flag, example: `--version 2.3.6`. - If you are installing an alpha version, Helm requires adding the `--devel` option to the command. @@ -208,6 +209,7 @@ helm install rancher rancher-/rancher \ --set replicas=3 \ --set ingress.tls.source=letsEncrypt \ --set letsEncrypt.email=me@example.org + --set letsEncrypt.ingress.class=nginx ``` Wait for Rancher to be rolled out: From df9a7f5ebeca05119704426b640b619da20038c4 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 25 Jan 2022 22:08:25 +0000 Subject: [PATCH 195/478] Updated note, command for 2.6 --- .../v2.6/en/installation/install-rancher-on-k8s/_index.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md index 11b5f6c2def..ee44ba2ca8e 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md @@ -181,7 +181,7 @@ deployment "rancher" successfully rolled out This option uses `cert-manager` to automatically request and renew [Let's Encrypt](https://letsencrypt.org/) certificates. This is a free service that provides you with a valid certificate as Let's Encrypt is a trusted CA. ->**Note:**: You need to have port 80 open as the HTTP-01 challenge can only be done on port 80. +>**Note:** You need to have port 80 open as the HTTP-01 challenge can only be done on port 80. In the following command, @@ -189,6 +189,7 @@ In the following command, - Set the `bootstrapPassword` to something unique for the `admin` user. - `ingress.tls.source` is set to `letsEncrypt` - `letsEncrypt.email` is set to the email address used for communication about your certificate (for example, expiry notices) +- Set `letsEncrypt.ingress.class` to whatever your ingress controller is, e.g., `traefik`, `nginx`, `haproxy`, etc. - If you are installing an alpha version, Helm requires adding the `--devel` option to the command. ``` @@ -198,6 +199,7 @@ helm install rancher rancher-/rancher \ --set bootstrapPassword=admin \ --set ingress.tls.source=letsEncrypt \ --set letsEncrypt.email=me@example.org + --set letsEncrypt.ingress.class=nginx ``` Wait for Rancher to be rolled out: From 7c7020797a3a0b287272b65de0d09ba9f5664fad Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 25 Jan 2022 22:45:44 +0000 Subject: [PATCH 196/478] Fixed typo --- .../en/installation/install-rancher-on-k8s/upgrades/_index.md | 2 +- .../install-rancher-on-k8s/upgrades/helm2/_index.md | 2 +- .../en/installation/resources/upgrading-cert-manager/_index.md | 2 +- .../upgrading-cert-manager/helm-2-instructions/_index.md | 2 +- .../en/installation/install-rancher-on-k8s/upgrades/_index.md | 2 +- .../install-rancher-on-linux/rancherd-configuration/_index.md | 2 +- .../en/installation/resources/upgrading-cert-manager/_index.md | 2 +- .../upgrading-cert-manager/helm-2-instructions/_index.md | 2 +- .../en/installation/install-rancher-on-k8s/upgrades/_index.md | 2 +- .../en/installation/resources/upgrading-cert-manager/_index.md | 2 +- 10 files changed, 10 insertions(+), 10 deletions(-) diff --git a/content/rancher/v2.0-v2.4/en/installation/install-rancher-on-k8s/upgrades/_index.md b/content/rancher/v2.0-v2.4/en/installation/install-rancher-on-k8s/upgrades/_index.md index e49c62f7d23..cb3cf8b9655 100644 --- a/content/rancher/v2.0-v2.4/en/installation/install-rancher-on-k8s/upgrades/_index.md +++ b/content/rancher/v2.0-v2.4/en/installation/install-rancher-on-k8s/upgrades/_index.md @@ -168,7 +168,7 @@ helm upgrade rancher rancher-/rancher \ ### Option B: Reinstalling Rancher and cert-manager -If you are currently running the cert-manger whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, then you need to reinstall both Rancher and cert-manger due to the API change in cert-manger v0.11. +If you are currently running the cert-manager whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, then you need to reinstall both Rancher and cert-manager due to the API change in cert-manager v0.11. 1. Uninstall Rancher diff --git a/content/rancher/v2.0-v2.4/en/installation/install-rancher-on-k8s/upgrades/helm2/_index.md b/content/rancher/v2.0-v2.4/en/installation/install-rancher-on-k8s/upgrades/helm2/_index.md index 7895c69d7af..e0f9ac2787c 100644 --- a/content/rancher/v2.0-v2.4/en/installation/install-rancher-on-k8s/upgrades/helm2/_index.md +++ b/content/rancher/v2.0-v2.4/en/installation/install-rancher-on-k8s/upgrades/helm2/_index.md @@ -114,7 +114,7 @@ helm upgrade --install rancher rancher-/rancher \ {{% accordion label="Option B: Reinstalling Rancher chart" %}} -If you are currently running the cert-manger whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, then you need to reinstall both Rancher and cert-manger due to the API change in cert-manger v0.11. +If you are currently running the cert-manager whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, then you need to reinstall both Rancher and cert-manager due to the API change in cert-manager v0.11. 1. Uninstall Rancher diff --git a/content/rancher/v2.0-v2.4/en/installation/resources/upgrading-cert-manager/_index.md b/content/rancher/v2.0-v2.4/en/installation/resources/upgrading-cert-manager/_index.md index 4d8266873c8..29d2e411443 100644 --- a/content/rancher/v2.0-v2.4/en/installation/resources/upgrading-cert-manager/_index.md +++ b/content/rancher/v2.0-v2.4/en/installation/resources/upgrading-cert-manager/_index.md @@ -19,7 +19,7 @@ To address these changes, this guide will do two things: 1. Explain the cert-manager API changes and link to cert-manager's official documentation for migrating your data > **Important:** -> If you are currently running the cert-manger whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, you need to reinstall both of them: +> If you are currently running the cert-manager whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, you need to reinstall both of them: > 1. Take a one-time snapshot of your Kubernetes cluster running Rancher server > 2. Uninstall Rancher, cert-manager, and the CustomResourceDefinition for cert-manager diff --git a/content/rancher/v2.0-v2.4/en/installation/resources/upgrading-cert-manager/helm-2-instructions/_index.md b/content/rancher/v2.0-v2.4/en/installation/resources/upgrading-cert-manager/helm-2-instructions/_index.md index aba42eb1959..968cd6d6666 100644 --- a/content/rancher/v2.0-v2.4/en/installation/resources/upgrading-cert-manager/helm-2-instructions/_index.md +++ b/content/rancher/v2.0-v2.4/en/installation/resources/upgrading-cert-manager/helm-2-instructions/_index.md @@ -19,7 +19,7 @@ To address these changes, this guide will do two things: 1. Explain the cert-manager API changes and link to cert-manager's offficial documentation for migrating your data > **Important:** -> If you are currently running the cert-manger whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, you need to reinstall both of them: +> If you are currently running the cert-manager whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, you need to reinstall both of them: > 1. Take a one-time snapshot of your Kubernetes cluster running Rancher server > 2. Uninstall Rancher, cert-manager, and the CustomResourceDefinition for cert-manager diff --git a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/upgrades/_index.md b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/upgrades/_index.md index 49ce4d505fc..8e1acae6ce0 100644 --- a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/upgrades/_index.md +++ b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/upgrades/_index.md @@ -165,7 +165,7 @@ helm upgrade rancher rancher-/rancher \ ### Option B: Reinstalling Rancher and cert-manager -If you are currently running the cert-manger whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, then you need to reinstall both Rancher and cert-manger due to the API change in cert-manger v0.11. +If you are currently running the cert-manager whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, then you need to reinstall both Rancher and cert-manager due to the API change in cert-manager v0.11. 1. Uninstall Rancher diff --git a/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/rancherd-configuration/_index.md b/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/rancherd-configuration/_index.md index 770326f9bd7..0eb1588d87e 100644 --- a/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/rancherd-configuration/_index.md +++ b/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/rancherd-configuration/_index.md @@ -22,7 +22,7 @@ In the RancherD installation instructions, we recommend running three server nod # Certificates for the Rancher Server -Rancherd does not use cert-manger to provision certs. Instead RancherD allows you to bring your own self-signed or trusted certs by storing the .pem files in `/etc/rancher/ssl/`. When doing this you should also set the `publicCA` parameter to `true` in your HelmChartConfig. For more information on the HelmChartConfig, refer to the section about [customizing the RancherD Helm chart.](#customizing-the-rancherd-helm-chart) +Rancherd does not use cert-manager to provision certs. Instead RancherD allows you to bring your own self-signed or trusted certs by storing the .pem files in `/etc/rancher/ssl/`. When doing this you should also set the `publicCA` parameter to `true` in your HelmChartConfig. For more information on the HelmChartConfig, refer to the section about [customizing the RancherD Helm chart.](#customizing-the-rancherd-helm-chart) Private key: `/etc/rancher/ssl/key.pem` diff --git a/content/rancher/v2.5/en/installation/resources/upgrading-cert-manager/_index.md b/content/rancher/v2.5/en/installation/resources/upgrading-cert-manager/_index.md index a3be656b66a..9b557f0ccc7 100644 --- a/content/rancher/v2.5/en/installation/resources/upgrading-cert-manager/_index.md +++ b/content/rancher/v2.5/en/installation/resources/upgrading-cert-manager/_index.md @@ -20,7 +20,7 @@ To address these changes, this guide will do two things: 1. Explain the cert-manager API changes and link to cert-manager's official documentation for migrating your data > **Important:** -> If you are currently running the cert-manger whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, you need to reinstall both of them: +> If you are currently running the cert-manager whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, you need to reinstall both of them: > 1. Take a one-time snapshot of your Kubernetes cluster running Rancher server > 2. Uninstall Rancher, cert-manager, and the CustomResourceDefinition for cert-manager diff --git a/content/rancher/v2.5/en/installation/resources/upgrading-cert-manager/helm-2-instructions/_index.md b/content/rancher/v2.5/en/installation/resources/upgrading-cert-manager/helm-2-instructions/_index.md index 761a2487d26..070dff28f02 100644 --- a/content/rancher/v2.5/en/installation/resources/upgrading-cert-manager/helm-2-instructions/_index.md +++ b/content/rancher/v2.5/en/installation/resources/upgrading-cert-manager/helm-2-instructions/_index.md @@ -18,7 +18,7 @@ To address these changes, this guide will do two things: 1. Explain the cert-manager API changes and link to cert-manager's offficial documentation for migrating your data > **Important:** -> If you are currently running the cert-manger whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, you need to reinstall both of them: +> If you are currently running the cert-manager whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, you need to reinstall both of them: > 1. Take a one-time snapshot of your Kubernetes cluster running Rancher server > 2. Uninstall Rancher, cert-manager, and the CustomResourceDefinition for cert-manager diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md index 562a1d8223b..5c25a7f24b8 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md @@ -148,7 +148,7 @@ helm upgrade rancher rancher-/rancher \ ### Option B: Reinstalling Rancher and cert-manager -If you are currently running the cert-manger whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, then you need to reinstall both Rancher and cert-manger due to the API change in cert-manger v0.11. +If you are currently running the cert-manager whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, then you need to reinstall both Rancher and cert-manager due to the API change in cert-manager v0.11. 1. Uninstall Rancher diff --git a/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md b/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md index da62f1e9deb..3879ab15d1f 100644 --- a/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md +++ b/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md @@ -15,7 +15,7 @@ To address these changes, this guide will do two things: 1. Explain the cert-manager API changes and link to cert-manager's official documentation for migrating your data > **Important:** -> If you are currently running the cert-manger whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, you need to reinstall both of them: +> If you are currently running the cert-manager whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, you need to reinstall both of them: > 1. Take a one-time snapshot of your Kubernetes cluster running Rancher server > 2. Uninstall Rancher, cert-manager, and the CustomResourceDefinition for cert-manager From 0f72acfb373a893c5450c9a4bc5b43bf13a667f1 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 26 Jan 2022 23:31:34 +0000 Subject: [PATCH 197/478] Updated/added RancherD notes to reflect discontinuation --- content/rancher/v2.5/en/installation/_index.md | 6 ++---- .../install-rancher-on-linux/_index.md | 4 +--- .../rancherd-configuration/_index.md | 2 +- .../install-rancher-on-linux/rollbacks/_index.md | 2 +- .../install-rancher-on-linux/upgrades/_index.md | 2 +- content/rancher/v2.5/en/installation/requirements/_index.md | 5 +++-- .../v2.5/en/installation/requirements/ports/_index.md | 2 ++ .../en/installation/resources/choosing-version/_index.md | 2 ++ .../en/installation/resources/installing-docker/_index.md | 2 ++ 9 files changed, 15 insertions(+), 12 deletions(-) diff --git a/content/rancher/v2.5/en/installation/_index.md b/content/rancher/v2.5/en/installation/_index.md index 409e36d4d8e..2b03d98ce62 100644 --- a/content/rancher/v2.5/en/installation/_index.md +++ b/content/rancher/v2.5/en/installation/_index.md @@ -17,7 +17,7 @@ In this section, - **RKE (Rancher Kubernetes Engine)** is a certified Kubernetes distribution and CLI/library which creates and manages a Kubernetes cluster. - **K3s (Lightweight Kubernetes)** is also a fully compliant Kubernetes distribution. It is newer than RKE, easier to use, and more lightweight, with a binary size of less than 100 MB. - **RKE2** is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector. -- **RancherD** is a new tool for installing Rancher, which is available as of Rancher v2.5.4. It is an experimental feature. RancherD is a single binary that first launches an RKE2 Kubernetes cluster, then installs the Rancher server Helm chart on the cluster. +- **RancherD** was an experimental tool for installing Rancher, which was available as of Rancher v2.5.4 but is now deprecated. RancherD is a single binary that first launches an RKE2 Kubernetes cluster, then installs the Rancher server Helm chart on the cluster. # Changes to Installation in Rancher v2.5 @@ -37,9 +37,7 @@ We recommend using Helm, a Kubernetes package manager, to install Rancher on mul ### High-availability Kubernetes Install with RancherD -_Available as of v2.5.4_ - -> This is an experimental feature. +> **Note:** RancherD was an experimental feature and has been deprecated. RancherD is a single binary that first launches an RKE2 Kubernetes cluster, then installs the Rancher server Helm chart on the cluster. diff --git a/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/_index.md b/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/_index.md index 8b3d6e7b472..883e1858a32 100644 --- a/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/_index.md +++ b/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/_index.md @@ -6,9 +6,7 @@ aliases: - /rancher/v2.x/en/installation/install-rancher-on-linux/ --- -_Available as of Rancher v2.5.4_ - -> This is an experimental feature. +> **Note:** RancherD was an experimental feature and has been deprecated. We are excited to introduce a new, simpler way to install Rancher called RancherD. diff --git a/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/rancherd-configuration/_index.md b/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/rancherd-configuration/_index.md index 0eb1588d87e..27d1ea6c041 100644 --- a/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/rancherd-configuration/_index.md +++ b/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/rancherd-configuration/_index.md @@ -6,7 +6,7 @@ aliases: - /rancher/v2.x/en/installation/install-rancher-on-linux/rancherd-configuration/ --- -> RancherD is an experimental feature. +> **Note:** RancherD was an experimental feature and has been deprecated. In RancherD, a server node is defined as a machine (bare-metal or virtual) running the `rancherd server` command. The server runs the Kubernetes API as well as Kubernetes workloads. diff --git a/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/rollbacks/_index.md b/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/rollbacks/_index.md index d9144867731..1228abdb386 100644 --- a/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/rollbacks/_index.md +++ b/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/rollbacks/_index.md @@ -6,6 +6,6 @@ aliases: - /rancher/v2.x/en/installation/install-rancher-on-linux/rollbacks/ --- -> RancherD is an experimental feature. +> **Note:** RancherD was an experimental feature and has been deprecated. To roll back Rancher to a previous version, re-run the installation script with the previous version specified in the `INSTALL_RANCHERD_VERSION` environment variable. \ No newline at end of file diff --git a/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/upgrades/_index.md b/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/upgrades/_index.md index 66f41139153..814a98305e2 100644 --- a/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/upgrades/_index.md +++ b/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/upgrades/_index.md @@ -6,7 +6,7 @@ aliases: - /rancher/v2.x/en/installation/install-rancher-on-linux/upgrades/ --- -> RancherD is an experimental feature. +> **Note:** RancherD was an experimental feature and has been deprecated. When RancherD is upgraded, the Rancher Helm controller and the Fleet pods are upgraded. diff --git a/content/rancher/v2.5/en/installation/requirements/_index.md b/content/rancher/v2.5/en/installation/requirements/_index.md index 5d4113fc217..7a1ec3a12dd 100644 --- a/content/rancher/v2.5/en/installation/requirements/_index.md +++ b/content/rancher/v2.5/en/installation/requirements/_index.md @@ -80,7 +80,7 @@ If you are installing Rancher on a K3s cluster with Alpine Linux, follow [these ### RancherD Specific Requirements -_The RancherD install is available as of v2.5.4. It is an experimental feature._ +> **Note:** The RancherD install became available in v2.5.4 but has been deprecated. It was an experimental feature. At this time, only Linux OSes that leverage systemd are supported. @@ -103,6 +103,7 @@ The Ingress should be deployed as DaemonSet to ensure your load balancer can suc Docker is required for Helm chart installs, and it can be installed by following the steps in the official [Docker documentation.](https://docs.docker.com/) Rancher also provides [scripts]({{}}/rancher/v2.5/en/installation/requirements/installing-docker) to install Docker with one command. Docker is not required for RancherD installs. + # Hardware Requirements The following sections describe the CPU, memory, and disk requirements for the nodes where the Rancher server is installed. @@ -143,7 +144,7 @@ These CPU and memory requirements apply to each host in a [K3s Kubernetes cluste ### RancherD -_RancherD is available as of v2.5.4. It is an experimental feature._ +> **Note:** RancherD was an experimental feature and has been deprecated. These CPU and memory requirements apply to each instance with RancherD installed. Minimum recommendations are outlined here. diff --git a/content/rancher/v2.5/en/installation/requirements/ports/_index.md b/content/rancher/v2.5/en/installation/requirements/ports/_index.md index fb88592b0ca..850818c3d1a 100644 --- a/content/rancher/v2.5/en/installation/requirements/ports/_index.md +++ b/content/rancher/v2.5/en/installation/requirements/ports/_index.md @@ -119,6 +119,8 @@ The following tables break down the port requirements for inbound and outbound t ### Ports for Rancher Server Nodes on RancherD or RKE2 +> **Note:** RancherD was an experimental feature and has been deprecated. + {{% accordion label="Click to expand" %}} The RancherD (or RKE2) server needs port 6443 and 9345 to be accessible by other nodes in the cluster. diff --git a/content/rancher/v2.5/en/installation/resources/choosing-version/_index.md b/content/rancher/v2.5/en/installation/resources/choosing-version/_index.md index 9d7ec763c11..3b368b02ab4 100644 --- a/content/rancher/v2.5/en/installation/resources/choosing-version/_index.md +++ b/content/rancher/v2.5/en/installation/resources/choosing-version/_index.md @@ -14,6 +14,8 @@ For Docker installations of Rancher, which is used for development and testing, The Helm chart version also applies to RancherD installs because RancherD installs the Rancher Helm chart on a Kubernetes cluster. +> **Note:** RancherD was an experimental feature and has been deprecated. + {{% tabs %}} {{% tab "Helm Charts" %}} diff --git a/content/rancher/v2.5/en/installation/resources/installing-docker/_index.md b/content/rancher/v2.5/en/installation/resources/installing-docker/_index.md index ceb75b12645..4bf713c00a0 100644 --- a/content/rancher/v2.5/en/installation/resources/installing-docker/_index.md +++ b/content/rancher/v2.5/en/installation/resources/installing-docker/_index.md @@ -7,6 +7,8 @@ aliases: Docker is required to be installed on nodes where the Rancher server will be installed with Helm or Docker. Docker is not required for RancherD installs. +> **Note:** RancherD was an experimental feature and has been deprecated. + There are a couple of options for installing Docker. One option is to refer to the [official Docker documentation](https://docs.docker.com/install/) about how to install Docker on Linux. The steps will vary based on the Linux distribution. Another option is to use one of Rancher's Docker installation scripts, which are available for most recent versions of Docker. From d4251bf155357e6d5682aa38f0ddc4334ab3129e Mon Sep 17 00:00:00 2001 From: SafPlusPlus Date: Thu, 27 Jan 2022 14:46:27 +0100 Subject: [PATCH 198/478] Switch order of 2 steps in "registring a cluster" In my Rancher 2.6.3 install, when importing an existing RKE2 cluster, I needed to pick the type before entering the name of the new cluster. These 2 steps were documented in a different order. --- .../v2.6/en/cluster-provisioning/registered-clusters/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md index a4a6d96ca66..4d9ab0c2a1f 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md @@ -49,8 +49,8 @@ EKS clusters must have at least one managed node group to be imported into Ranch 1. Click **☰ > Cluster Management**. 1. On the **Clusters** page, **Import Existing**. -1. Enter a **Cluster Name**. 1. Choose the type of cluster. +1. Enter a **Cluster Name**. 4. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user. 5. If it is a generic custom cluster, use **Agent Environment Variables** under **Cluster Options** to set environment variables for [rancher cluster agent]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/rancher-agents/). The environment variables can be set using key value pairs. If rancher agent requires use of proxy to communicate with Rancher server, `HTTP_PROXY`, `HTTPS_PROXY` and `NO_PROXY` environment variables can be set using agent environment variables. 6. Click **Create**. From 737fe27dce8e028c5f5cbb87b9f7bc12bf73698e Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 27 Jan 2022 14:13:48 -0800 Subject: [PATCH 199/478] Add banner to out-of-date doc versions w/ link to latest --- layouts/_default/list.html | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/layouts/_default/list.html b/layouts/_default/list.html index 7da558dd82a..50583bb7514 100644 --- a/layouts/_default/list.html +++ b/layouts/_default/list.html @@ -15,11 +15,11 @@
- +
- + {{ $url := urls.Parse .Permalink }} {{ $path := split $url.Path "/" }} {{ $product := index $path 1 }} @@ -37,10 +37,15 @@ {{end}} {{ if in .Dir "os/v1.x" }}
- RancherOS 1.x is currently in a maintain-only-as-essential mode. It is no longer being actively maintained at a code level other than addressing critical or security fixes. For more information about the support status of RancherOS, see this page. + RancherOS 1.x is currently in a maintain-only-as-essential mode. It is no longer being actively maintained at a code level other than addressing critical or security fixes. For more information about the support status of RancherOS, see this page.
{{end}} - + {{ if or (in .Dir "/v2.0-v2.4") (in .Dir "/v2.5") }} +
+ You are viewing the documentation for an older Rancher release. If you're looking for the documentation for the latest Rancher release, go to this page instead. +
+ {{end}} +
Date: Mon, 31 Jan 2022 16:54:40 +0000 Subject: [PATCH 201/478] Added AWS alternative to TOC --- .../rancher/v2.6/en/quick-start-guide/deployment/_index.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/_index.md index b3169225fe4..c7163b666c5 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/_index.md @@ -5,12 +5,14 @@ weight: 100 Use one of the following guides to deploy and provision Rancher and a Kubernetes cluster in the provider of your choice. -- [DigitalOcean](./digital-ocean-qs) (uses Terraform) - [AWS](./amazon-aws-qs) (uses Terraform) +- [AWS Alternative](./amazon-aws-qs-alternative) (uses Amazon EKS) - [Azure](./microsoft-azure-qs) (uses Terraform) +- [DigitalOcean](./digital-ocean-qs) (uses Terraform) - [GCP](./google-gcp-qs) (uses Terraform) - [Hetzner Cloud](./hetzner-cloud-qs) (uses Terraform) - [Vagrant](./quickstart-vagrant) +- [Equinix Metal](./equinix-metal-qs) If you prefer, the following guide will take you through the same process in individual steps. Use this if you want to run Rancher in a different provider, on prem, or if you would just like to see how easy it is. From 66f3dd64a8d66c5b44418b025c320eb2733838a7 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 31 Jan 2022 16:55:28 +0000 Subject: [PATCH 202/478] Removed AWS alternative from this page; adjusted headers for consistency --- .../deployment/amazon-aws-qs/_index.md | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs/_index.md index 6b08a4e531a..619dd062518 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs/_index.md @@ -57,16 +57,12 @@ Suggestions include: Two Kubernetes clusters are deployed into your AWS account, one running Rancher Server and the other ready for experimentation deployments. Please note that while this setup is a great way to explore Rancher functionality, a production setup should follow our high availability setup guidelines. SSH keys for the VMs are auto-generated and stored in the module directory. +## What's Next? + +Use Rancher to create a deployment. For more information, see [Creating Deployments]({{}}/rancher/v2.6/en/quick-start-guide/workload). + ## Destroying the Environment 1. From the `quickstart/aws` folder, execute `terraform destroy --auto-approve`. 2. Wait for confirmation that all resources have been destroyed. - -# Deploying Rancher using AWS Marketplace - -There is now an additional way for you to deploy the Rancher server in AWS by using Amazon EKS. To learn more, see our [Amazon Marketplace listing](https://aws.amazon.com/marketplace/pp/prodview-2yzbnvagmi4as). - -# What's Next? - -Use Rancher to create a deployment. For more information, see [Creating Deployments]({{}}/rancher/v2.6/en/quick-start-guide/workload). From fde020719ed947d22c14906711df67398b25e37b Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 31 Jan 2022 16:56:13 +0000 Subject: [PATCH 203/478] Updated weight for listing order --- .../en/quick-start-guide/deployment/digital-ocean-qs/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/digital-ocean-qs/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/digital-ocean-qs/_index.md index 1fa897d157f..1ecafe31489 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/digital-ocean-qs/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/digital-ocean-qs/_index.md @@ -1,7 +1,7 @@ --- title: Rancher DigitalOcean Quick Start Guide description: Read this step by step Rancher DigitalOcean guide to quickly deploy a Rancher server with a single-node downstream Kubernetes cluster attached. -weight: 100 +weight: 120 --- The following steps will quickly deploy a Rancher server on DigitalOcean in a single-node K3s Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. From 3bcc2d9d9948420b7a88cc4cf2b8f649ffce129c Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 31 Jan 2022 17:32:36 +0000 Subject: [PATCH 204/478] Updated weight for listing order --- .../en/quick-start-guide/deployment/equinix-metal-qs/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/equinix-metal-qs/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/equinix-metal-qs/_index.md index 0daf725fdbc..3961de9af9b 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/equinix-metal-qs/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/equinix-metal-qs/_index.md @@ -1,6 +1,6 @@ --- title: Rancher Equinix Metal Quick Start -weight: 300 +weight: 250 --- ## This tutorial walks you through the following: From 1734630bc9924da5102774f158f2beaa42c622db Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 31 Jan 2022 17:32:48 +0000 Subject: [PATCH 205/478] Updated weight for listing order --- .../en/quick-start-guide/deployment/google-gcp-qs/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/google-gcp-qs/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/google-gcp-qs/_index.md index 7cbd4667640..cc459c5c5ad 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/google-gcp-qs/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/google-gcp-qs/_index.md @@ -1,7 +1,7 @@ --- title: Rancher GCP Quick Start Guide description: Read this step by step Rancher GCP guide to quickly deploy a Rancher server with a single-node downstream Kubernetes cluster attached. -weight: 100 +weight: 130 --- The following steps will quickly deploy a Rancher server on GCP in a single-node K3s Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. From bf1172a600d526bda2cb4946910b8cf5a3d36bc3 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 31 Jan 2022 17:33:03 +0000 Subject: [PATCH 206/478] Updated weight for listing order --- .../en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md index 1e37d2d23f2..1d388888722 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/hetzner-cloud-qs/_index.md @@ -1,7 +1,7 @@ --- title: Rancher Hetzner Cloud Quick Start Guide description: Read this step by step Rancher Hetzner Cloud guide to quickly deploy a Rancher server with a single-node downstream Kubernetes cluster attached. -weight: 100 +weight: 140 --- The following steps will quickly deploy a Rancher server on Hetzner Cloud in a single-node K3s Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. From bd95776b2ea94e3d2c4d2b48fc1c3403c2452c4b Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 31 Jan 2022 17:33:15 +0000 Subject: [PATCH 207/478] Updated weight for listing order --- .../quick-start-guide/deployment/microsoft-azure-qs/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md index a0033fe5ca5..f774350cbad 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md @@ -1,7 +1,7 @@ --- title: Rancher Azure Quick Start Guide description: Read this step by step Rancher Azure guide to quickly deploy a Rancher server with a single-node downstream Kubernetes cluster attached. -weight: 100 +weight: 115 --- The following steps will quickly deploy a Rancher server on Azure in a single-node K3s Kubernetes cluster, with a single-node downstream Kubernetes cluster attached. From 5311c40876577cdf2ae596f85b8965db70cf7c55 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 31 Jan 2022 17:33:51 +0000 Subject: [PATCH 208/478] Added new page/section for AWS QS using EKS --- .../deployment/amazon-aws-qs-alternative/_index.md | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs-alternative/_index.md diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs-alternative/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs-alternative/_index.md new file mode 100644 index 00000000000..93e04fb4a8a --- /dev/null +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs-alternative/_index.md @@ -0,0 +1,7 @@ +--- +title: Rancher AWS Quick Start Alternative +description: Use Amazon EKS to deploy Rancher server. +weight: 110 +--- + +There is now an alternative way for you to deploy the Rancher server in AWS by using Amazon EKS. To learn more, see our [Amazon Marketplace listing](https://aws.amazon.com/marketplace/pp/prodview-2yzbnvagmi4as). \ No newline at end of file From fc89c0ddc73afc81d5bcd62624029c09f352d624 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 31 Jan 2022 18:18:38 +0000 Subject: [PATCH 209/478] Updated note per feedback --- .../rke-clusters/windows-clusters/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md index 59f9a1c75ed..0374c709e68 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md @@ -43,7 +43,7 @@ The RKE2 provisioning tech preview also includes installing RKE2 on Windows clus Windows Support for RKE2 Custom Clusters requires choosing Calico as the CNI. ->**Important:** Rancher will allow Windows workload pods to deploy on both Windows and Linux worker nodes by default. When creating mixed clusters in RKE2, you must taint the Linux node to ensure Windows workloads will only be deployed to Windows nodes. Refer [here]({{}}/rancher/v2.6/en/logging/taints-tolerations/) for more information on taints and tolerations in Rancher. +>**Important:** Rancher will allow Windows workload pods to deploy on both Windows and Linux worker nodes by default. When creating mixed clusters in RKE2, you must edit the NodeSelector in the chart to direct the pods to be placed onto a compatible Windows node. # Requirements for Windows Clusters From cc8e7782a4be519ddb645a8aec98b44489b54a03 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 31 Jan 2022 20:11:44 +0000 Subject: [PATCH 210/478] Updated name to AWS Marketplace QS --- content/rancher/v2.6/en/quick-start-guide/deployment/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/_index.md index c7163b666c5..fa4236b3a6f 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/_index.md @@ -6,7 +6,7 @@ weight: 100 Use one of the following guides to deploy and provision Rancher and a Kubernetes cluster in the provider of your choice. - [AWS](./amazon-aws-qs) (uses Terraform) -- [AWS Alternative](./amazon-aws-qs-alternative) (uses Amazon EKS) +- [AWS Marketplace](./amazon-aws-marketplace-qs) (uses Amazon EKS) - [Azure](./microsoft-azure-qs) (uses Terraform) - [DigitalOcean](./digital-ocean-qs) (uses Terraform) - [GCP](./google-gcp-qs) (uses Terraform) From 544a0f37dfe046b28a15612a8550cc35b506917f Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 31 Jan 2022 20:12:43 +0000 Subject: [PATCH 211/478] Updated name to AWS Marketplace QS --- .../deployment/amazon-aws-marketplace-qs/_index.md | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-marketplace-qs/_index.md diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-marketplace-qs/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-marketplace-qs/_index.md new file mode 100644 index 00000000000..bac47239b49 --- /dev/null +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-marketplace-qs/_index.md @@ -0,0 +1,7 @@ +--- +title: Rancher AWS Marketplace Quick Start +description: Use Amazon EKS to deploy Rancher server. +weight: 110 +--- + +There is now an additional way for you to deploy the Rancher server in AWS by using Amazon EKS. To learn more, see our [Amazon Marketplace listing](https://aws.amazon.com/marketplace/pp/prodview-2yzbnvagmi4as). \ No newline at end of file From 01149e9fadd32b086e0d8d7cae4b2eb419574289 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 31 Jan 2022 20:13:17 +0000 Subject: [PATCH 212/478] Renamed folder to Marketplace --- .../deployment/amazon-aws-qs-alternative/_index.md | 7 ------- 1 file changed, 7 deletions(-) delete mode 100644 content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs-alternative/_index.md diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs-alternative/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs-alternative/_index.md deleted file mode 100644 index 93e04fb4a8a..00000000000 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/amazon-aws-qs-alternative/_index.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -title: Rancher AWS Quick Start Alternative -description: Use Amazon EKS to deploy Rancher server. -weight: 110 ---- - -There is now an alternative way for you to deploy the Rancher server in AWS by using Amazon EKS. To learn more, see our [Amazon Marketplace listing](https://aws.amazon.com/marketplace/pp/prodview-2yzbnvagmi4as). \ No newline at end of file From 1b113ac1fb659b2a82a31f5acba48904e1a4e4df Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 31 Jan 2022 21:39:13 +0000 Subject: [PATCH 213/478] Added link to upstream docs --- .../rke-clusters/windows-clusters/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md index 0374c709e68..ebd32e5397d 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md @@ -43,7 +43,7 @@ The RKE2 provisioning tech preview also includes installing RKE2 on Windows clus Windows Support for RKE2 Custom Clusters requires choosing Calico as the CNI. ->**Important:** Rancher will allow Windows workload pods to deploy on both Windows and Linux worker nodes by default. When creating mixed clusters in RKE2, you must edit the NodeSelector in the chart to direct the pods to be placed onto a compatible Windows node. +>**Important:** Rancher will allow Windows workload pods to deploy on both Windows and Linux worker nodes by default. When creating mixed clusters in RKE2, you must edit the `nodeSelector` in the chart to direct the pods to be placed onto a compatible Windows node. Refer to the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector) for more information on how to use `nodeSelector` to assign pods to nodes. # Requirements for Windows Clusters From a6ce9554710a7e10853f17bb1ced8b6bff5ac225 Mon Sep 17 00:00:00 2001 From: Alex Miller Date: Mon, 31 Jan 2022 14:22:52 -0500 Subject: [PATCH 214/478] Update default admin password for Vagrant quickstart (v2.6 only) --- .../quick-start-guide/deployment/quickstart-vagrant/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-vagrant/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-vagrant/_index.md index 0eb0d0ef169..86736685e48 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-vagrant/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-vagrant/_index.md @@ -30,7 +30,7 @@ The following steps quickly deploy a Rancher Server with a single node cluster a 4. To initiate the creation of the environment run, `vagrant up --provider=virtualbox`. -5. Once provisioning finishes, go to `https://192.168.56.101` in the browser. The default user/password is `admin/admin`. +5. Once provisioning finishes, go to `https://192.168.56.101` in the browser. The default user/password is `admin/adminPassword`. **Result:** Rancher Server and your Kubernetes cluster is installed on VirtualBox. From bc0bf42c8247b7fc45974b6fe9c163d8ad5a51df Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 1 Feb 2022 16:30:27 +0000 Subject: [PATCH 215/478] Added note for new Rancher behavior in EC2 security groups --- .../node-pools/ec2/ec2-node-template-config/_index.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/ec2-node-template-config/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/ec2-node-template-config/_index.md index 6e3a1b0dc8c..6db019fa0c6 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/ec2-node-template-config/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/ec2-node-template-config/_index.md @@ -34,6 +34,11 @@ Choose the default security group or configure a security group. Please refer to [Amazon EC2 security group when using Node Driver]({{}}/rancher/v2.6/en/installation/requirements/ports/#rancher-aws-ec2-security-group) to see what rules are created in the `rancher-nodes` Security Group. +--- +**_New in v2.6.4_** + +If you provide your own security group for an EC2 instance, please note that Rancher will not modify it. As such, you will be responsible for ensuring that your security group is set to allow the necessary ports for Rancher to provision the instance. For more information on controlling inbound and outbound traffic to EC2 instances with security groups, refer [here](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html#WorkingWithSecurityGroups). + ### Instance Options Configure the instances that will be created. Make sure you configure the correct **SSH User** for the configured AMI. It is possible that a selected region does not support the default instance type. In this scenario you must select an instance type that does exist, otherwise an error will occur stating the requested configuration is not supported. From 87d4ccf5ebe3fa318d2090819040fcb2040b9d68 Mon Sep 17 00:00:00 2001 From: Hayden Date: Tue, 1 Feb 2022 13:55:06 -0500 Subject: [PATCH 216/478] Updated RKE2 and Calico Support for 2.6.4 --- .../rke-clusters/windows-clusters/windows-parity/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/windows-parity/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/windows-parity/_index.md index 1a6e9f9f215..8264e28c28d 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/windows-parity/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/windows-parity/_index.md @@ -11,7 +11,7 @@ The following chart describes the feature parity between Windows and Linux on Ra --- | --- | --- **Distributions** | | RKE | Supported | Supported -RKE2 | Supported | Tenatively Planned For 2.6.x +RKE2 | Supported | In Preview in Rancher 2.6.0, General Availability Planned for Rancher 2.6.4 K3S | Supported | Not Supported EKS | Supported | Not Supported GKE | Supported | Not Supported @@ -38,7 +38,7 @@ Backup/Restore Operator | Supported | Not Supported **CNI / Add-ons** | | Flannel | Supported | Supported Canal | Supported | Not Supported -Calico | Supported | Tentatively Planned for 2.6.x +Calico | Supported | In Preview in Rancher 2.6.0, General Availability Planned for Rancher 2.6.4 Cilium | Supported | Not Supported Multus | Supported | Not Supported Traefik | Supported | Not Supported From 0ee377e41e6e81b44a70348b1097d6df60ef55c9 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 1 Feb 2022 19:49:14 +0000 Subject: [PATCH 217/478] Updated links to private clusters --- .../editing-clusters/gke-config-reference/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-admin/editing-clusters/gke-config-reference/_index.md b/content/rancher/v2.6/en/cluster-admin/editing-clusters/gke-config-reference/_index.md index 30b22867584..b87543a3157 100644 --- a/content/rancher/v2.6/en/cluster-admin/editing-clusters/gke-config-reference/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/editing-clusters/gke-config-reference/_index.md @@ -103,13 +103,13 @@ The address range assigned to the services in the cluster. Must be a valid CIDR _Mutable: no_ -> Warning: private clusters require additional planning and configuration outside of Rancher. Refer to the [private cluster guide]({{< baseurl >}}/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/gke/private-clusters/). +> Warning: private clusters require additional planning and configuration outside of Rancher. Refer to the [private cluster guide]({{< baseurl >}}/rancher/v2.6/en/cluster-admin/editing-clusters/gke-config-reference/private-clusters/). Assign nodes only internal IP addresses. Private cluster nodes cannot access the public internet unless additional networking steps are taken in GCP. ### Enable Private Endpoint -> Warning: private clusters require additional planning and configuration outside of Rancher. Refer to the [private cluster guide]({{< baseurl >}}/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/gke/#private-clusters). +> Warning: private clusters require additional planning and configuration outside of Rancher. Refer to the [private cluster guide]({{< baseurl >}}/rancher/v2.6/en/cluster-admin/editing-clusters/gke-config-reference/private-clusters/). _Mutable: no_ From 1469d0ab44aec370b48013f4eac93d9db78ad0da Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 1 Feb 2022 22:53:32 +0000 Subject: [PATCH 218/478] Added new section for air-gapped local cluster proxy configuration --- .../behind-proxy/launch-kubernetes/_index.md | 23 ++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/launch-kubernetes/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/launch-kubernetes/_index.md index b47128310e9..428bf5bd7f1 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/launch-kubernetes/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/launch-kubernetes/_index.md @@ -7,9 +7,11 @@ Once the infrastructure is ready, you can continue with setting up an RKE cluste ### Installing Docker +#### HTTP proxy + First, you have to install Docker and setup the HTTP proxy on all three Linux nodes. For this perform the following steps on all three nodes. -For convenience export the IP address and port of your proxy into an environment variable and set up the HTTP_PROXY variables for your current shell: +For convenience, export the IP address and port of your proxy into an environment variable and set up the HTTP_PROXY variables for your current shell: ``` export proxy_host="10.0.0.5:8888" @@ -58,6 +60,25 @@ sudo systemctl daemon-reload sudo systemctl restart docker ``` +#### Air-gapped proxy + +_New in v2.6.4_ + +You can now provision node driver clusters from a proxied Rancher environment. Configure apt to use this proxy when installing packages, including the additional rules shown. If you are not using Ubuntu, you have to adapt this step accordingly: + +``` +cat <<'EOF' | sudo tee /etc/apt/apt.conf.d/proxy.conf > /dev/null +Acquire::http::Proxy "http://${proxy_host}/"; +Acquire::https::Proxy "http://${proxy_host}/"; + +acl SSL_ports port 22 +acl SSL_ports port 2376 + +acl Safe_ports port 22 # ssh +acl Safe_ports port 2376 # docker port +EOF +``` + ### Creating the RKE Cluster You need several command line tools on the host where you have SSH access to the Linux nodes to create and interact with the cluster: From 07acc987eeafcd045f4258816ca6446ff4cea2e1 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 1 Feb 2022 22:53:53 +0000 Subject: [PATCH 219/478] Added new section for air-gapped local cluster proxy configuration --- .../single-node-docker/proxy/_index.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/proxy/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/proxy/_index.md index 1ac4a66c017..bb17439c85b 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/proxy/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/proxy/_index.md @@ -40,3 +40,19 @@ docker run -d --restart=unless-stopped \ ``` Privileged access is [required.]({{}}/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/#privileged-access-for-rancher) + +### Air-gapped local cluster proxy configuration + +_New in v2.6.4_ + +You can now provision node driver clusters from an air-gapped cluster configured to use a proxy for outbound connections. + +In addition to setting the default rules for a proxy server as shown above, you will need to add additional rules, shown below, to provision node driver clusters from a proxied Rancher environment. Note that you will configure `/etc/apt/apt.conf.d/proxy.conf` directly: + +``` +acl SSL_ports port 22 +acl SSL_ports port 2376 + +acl Safe_ports port 22 # ssh +acl Safe_ports port 2376 # docker port +``` From a3669dfb3b9f647b40a6a71112bc35a502942502 Mon Sep 17 00:00:00 2001 From: Gavin Date: Wed, 2 Feb 2022 09:58:04 +0100 Subject: [PATCH 220/478] Fix etcd Snapshot cron Expression Unfamiliarity with cron expressions could result in bad configuration. In this case, the expression intended to represent every 5 hours, but instead represented every minute past every 5 hours (i.e. 60 snapshots every 5 hours) --- content/k3s/latest/en/backup-restore/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/k3s/latest/en/backup-restore/_index.md b/content/k3s/latest/en/backup-restore/_index.md index 8e9569e2948..13031a06c35 100644 --- a/content/k3s/latest/en/backup-restore/_index.md +++ b/content/k3s/latest/en/backup-restore/_index.md @@ -57,7 +57,7 @@ These options can be passed in with the command line, or in the [configuration f | Options | Description | | ----------- | --------------- | | `--etcd-disable-snapshots` | Disable automatic etcd snapshots | -| `--etcd-snapshot-schedule-cron` value | Snapshot interval time in cron spec. eg. every 5 hours `* */5 * * *`(default: `0 */12 * * *`) | +| `--etcd-snapshot-schedule-cron` value | Snapshot interval time in cron spec. eg. every 5 hours `0 */5 * * *`(default: `0 */12 * * *`) | | `--etcd-snapshot-retention` value | Number of snapshots to retain (default: 5) | | `--etcd-snapshot-dir` value | Directory to save db snapshots. (Default location: `${data-dir}/db/snapshots`) | | `--cluster-reset` | Forget all peers and become sole member of a new cluster. This can also be set with the environment variable `[$K3S_CLUSTER_RESET]`. From 8b8a6114f40333f28151fa3aae54afef2e506560 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 2 Feb 2022 15:52:00 +0000 Subject: [PATCH 221/478] Removed header --- .../behind-proxy/launch-kubernetes/_index.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/launch-kubernetes/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/launch-kubernetes/_index.md index 428bf5bd7f1..d52fb6b8873 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/launch-kubernetes/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/launch-kubernetes/_index.md @@ -7,8 +7,6 @@ Once the infrastructure is ready, you can continue with setting up an RKE cluste ### Installing Docker -#### HTTP proxy - First, you have to install Docker and setup the HTTP proxy on all three Linux nodes. For this perform the following steps on all three nodes. For convenience, export the IP address and port of your proxy into an environment variable and set up the HTTP_PROXY variables for your current shell: From 10c74f194f6c9d52e13beb8ebd3900a7c8d35a1c Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 2 Feb 2022 15:52:25 +0000 Subject: [PATCH 222/478] Updated new section header and content per feedback --- .../single-node-docker/proxy/_index.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/proxy/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/proxy/_index.md index bb17439c85b..22b8d494aa5 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/proxy/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/proxy/_index.md @@ -41,13 +41,15 @@ docker run -d --restart=unless-stopped \ Privileged access is [required.]({{}}/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/#privileged-access-for-rancher) -### Air-gapped local cluster proxy configuration +### Air-gapped proxy configuration _New in v2.6.4_ You can now provision node driver clusters from an air-gapped cluster configured to use a proxy for outbound connections. -In addition to setting the default rules for a proxy server as shown above, you will need to add additional rules, shown below, to provision node driver clusters from a proxied Rancher environment. Note that you will configure `/etc/apt/apt.conf.d/proxy.conf` directly: +In addition to setting the default rules for a proxy server as shown above, you will need to add additional rules, shown below, to provision node driver clusters from a proxied Rancher environment. Configure apt to use this proxy when installing packages; if you are not using Ubuntu, you have to adapt your configuration accordingly. + +You will configure `/etc/apt/apt.conf.d/proxy.conf` with the following: ``` acl SSL_ports port 22 From 70008298499a38f92f4c29ee03060a3d9f6dfc53 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 2 Feb 2022 16:09:17 +0000 Subject: [PATCH 223/478] Added link to required ports for Rancher server nodes on RKE --- .../node-pools/ec2/ec2-node-template-config/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/ec2-node-template-config/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/ec2-node-template-config/_index.md index 6db019fa0c6..4da61dccaf7 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/ec2-node-template-config/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/ec2-node-template-config/_index.md @@ -37,7 +37,7 @@ Please refer to [Amazon EC2 security group when using Node Driver]({{}} --- **_New in v2.6.4_** -If you provide your own security group for an EC2 instance, please note that Rancher will not modify it. As such, you will be responsible for ensuring that your security group is set to allow the necessary ports for Rancher to provision the instance. For more information on controlling inbound and outbound traffic to EC2 instances with security groups, refer [here](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html#WorkingWithSecurityGroups). +If you provide your own security group for an EC2 instance, please note that Rancher will not modify it. As such, you will be responsible for ensuring that your security group is set to allow the [necessary ports for Rancher to provision the instance]({{}}/rancher/v2.6/en/installation/requirements/ports/#ports-for-rancher-server-nodes-on-rke). For more information on controlling inbound and outbound traffic to EC2 instances with security groups, refer [here](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html#WorkingWithSecurityGroups). ### Instance Options From 5e0f0f967e6adc8bb94cbac71c7afc7b37688752 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 2 Feb 2022 21:49:13 +0000 Subject: [PATCH 224/478] Updated RancherD deprecations notes --- content/rancher/v2.5/en/installation/_index.md | 4 ++-- .../install-rancher-on-linux/_index.md | 2 +- .../install-rancher-on-linux/rancherd-configuration/_index.md | 2 +- .../install-rancher-on-linux/rollbacks/_index.md | 2 +- .../install-rancher-on-linux/upgrades/_index.md | 2 +- content/rancher/v2.5/en/installation/requirements/_index.md | 4 ++-- .../rancher/v2.5/en/installation/requirements/ports/_index.md | 2 +- .../v2.5/en/installation/resources/choosing-version/_index.md | 2 +- .../en/installation/resources/installing-docker/_index.md | 2 +- 9 files changed, 11 insertions(+), 11 deletions(-) diff --git a/content/rancher/v2.5/en/installation/_index.md b/content/rancher/v2.5/en/installation/_index.md index 2b03d98ce62..9f49f7a1b73 100644 --- a/content/rancher/v2.5/en/installation/_index.md +++ b/content/rancher/v2.5/en/installation/_index.md @@ -17,7 +17,7 @@ In this section, - **RKE (Rancher Kubernetes Engine)** is a certified Kubernetes distribution and CLI/library which creates and manages a Kubernetes cluster. - **K3s (Lightweight Kubernetes)** is also a fully compliant Kubernetes distribution. It is newer than RKE, easier to use, and more lightweight, with a binary size of less than 100 MB. - **RKE2** is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector. -- **RancherD** was an experimental tool for installing Rancher, which was available as of Rancher v2.5.4 but is now deprecated. RancherD is a single binary that first launches an RKE2 Kubernetes cluster, then installs the Rancher server Helm chart on the cluster. +- **RancherD** was an experimental tool for installing Rancher; a single binary that first launched an RKE2 Kubernetes cluster, then installed the Rancher server Helm chart on the cluster. It was available as part of Rancher v2.5.4 through v2.5.10 but is now deprecated and not available for recent releases. # Changes to Installation in Rancher v2.5 @@ -37,7 +37,7 @@ We recommend using Helm, a Kubernetes package manager, to install Rancher on mul ### High-availability Kubernetes Install with RancherD -> **Note:** RancherD was an experimental feature and has been deprecated. +> **Note:** RancherD was an experimental feature available as part of Rancher v2.5.4 through v2.5.10 but is now deprecated and not available for recent releases. RancherD is a single binary that first launches an RKE2 Kubernetes cluster, then installs the Rancher server Helm chart on the cluster. diff --git a/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/_index.md b/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/_index.md index 883e1858a32..19c6afd9c62 100644 --- a/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/_index.md +++ b/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/_index.md @@ -6,7 +6,7 @@ aliases: - /rancher/v2.x/en/installation/install-rancher-on-linux/ --- -> **Note:** RancherD was an experimental feature and has been deprecated. +> **Note:** RancherD was an experimental feature available as part of Rancher v2.5.4 through v2.5.10 but is now deprecated and not available for recent releases. We are excited to introduce a new, simpler way to install Rancher called RancherD. diff --git a/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/rancherd-configuration/_index.md b/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/rancherd-configuration/_index.md index 27d1ea6c041..01986082057 100644 --- a/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/rancherd-configuration/_index.md +++ b/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/rancherd-configuration/_index.md @@ -6,7 +6,7 @@ aliases: - /rancher/v2.x/en/installation/install-rancher-on-linux/rancherd-configuration/ --- -> **Note:** RancherD was an experimental feature and has been deprecated. +> **Note:** RancherD was an experimental feature available as part of Rancher v2.5.4 through v2.5.10 but is now deprecated and not available for recent releases. In RancherD, a server node is defined as a machine (bare-metal or virtual) running the `rancherd server` command. The server runs the Kubernetes API as well as Kubernetes workloads. diff --git a/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/rollbacks/_index.md b/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/rollbacks/_index.md index 1228abdb386..01ade576014 100644 --- a/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/rollbacks/_index.md +++ b/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/rollbacks/_index.md @@ -6,6 +6,6 @@ aliases: - /rancher/v2.x/en/installation/install-rancher-on-linux/rollbacks/ --- -> **Note:** RancherD was an experimental feature and has been deprecated. +> **Note:** RancherD was an experimental feature available as part of Rancher v2.5.4 through v2.5.10 but is now deprecated and not available for recent releases. To roll back Rancher to a previous version, re-run the installation script with the previous version specified in the `INSTALL_RANCHERD_VERSION` environment variable. \ No newline at end of file diff --git a/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/upgrades/_index.md b/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/upgrades/_index.md index 814a98305e2..3f63915f6f5 100644 --- a/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/upgrades/_index.md +++ b/content/rancher/v2.5/en/installation/other-installation-methods/install-rancher-on-linux/upgrades/_index.md @@ -6,7 +6,7 @@ aliases: - /rancher/v2.x/en/installation/install-rancher-on-linux/upgrades/ --- -> **Note:** RancherD was an experimental feature and has been deprecated. +> **Note:** RancherD was an experimental feature available as part of Rancher v2.5.4 through v2.5.10 but is now deprecated and not available for recent releases. When RancherD is upgraded, the Rancher Helm controller and the Fleet pods are upgraded. diff --git a/content/rancher/v2.5/en/installation/requirements/_index.md b/content/rancher/v2.5/en/installation/requirements/_index.md index 7a1ec3a12dd..3c8c1dd3f20 100644 --- a/content/rancher/v2.5/en/installation/requirements/_index.md +++ b/content/rancher/v2.5/en/installation/requirements/_index.md @@ -80,7 +80,7 @@ If you are installing Rancher on a K3s cluster with Alpine Linux, follow [these ### RancherD Specific Requirements -> **Note:** The RancherD install became available in v2.5.4 but has been deprecated. It was an experimental feature. +> **Note:** RancherD was an experimental feature available as part of Rancher v2.5.4 through v2.5.10 but is now deprecated and not available for recent releases. At this time, only Linux OSes that leverage systemd are supported. @@ -144,7 +144,7 @@ These CPU and memory requirements apply to each host in a [K3s Kubernetes cluste ### RancherD -> **Note:** RancherD was an experimental feature and has been deprecated. +> **Note:** RancherD was an experimental feature available as part of Rancher v2.5.4 through v2.5.10 but is now deprecated and not available for recent releases. These CPU and memory requirements apply to each instance with RancherD installed. Minimum recommendations are outlined here. diff --git a/content/rancher/v2.5/en/installation/requirements/ports/_index.md b/content/rancher/v2.5/en/installation/requirements/ports/_index.md index 850818c3d1a..af7f109a891 100644 --- a/content/rancher/v2.5/en/installation/requirements/ports/_index.md +++ b/content/rancher/v2.5/en/installation/requirements/ports/_index.md @@ -119,7 +119,7 @@ The following tables break down the port requirements for inbound and outbound t ### Ports for Rancher Server Nodes on RancherD or RKE2 -> **Note:** RancherD was an experimental feature and has been deprecated. +> **Note:** RancherD was an experimental feature available as part of Rancher v2.5.4 through v2.5.10 but is now deprecated and not available for recent releases. {{% accordion label="Click to expand" %}} diff --git a/content/rancher/v2.5/en/installation/resources/choosing-version/_index.md b/content/rancher/v2.5/en/installation/resources/choosing-version/_index.md index 3b368b02ab4..618e8e36c33 100644 --- a/content/rancher/v2.5/en/installation/resources/choosing-version/_index.md +++ b/content/rancher/v2.5/en/installation/resources/choosing-version/_index.md @@ -14,7 +14,7 @@ For Docker installations of Rancher, which is used for development and testing, The Helm chart version also applies to RancherD installs because RancherD installs the Rancher Helm chart on a Kubernetes cluster. -> **Note:** RancherD was an experimental feature and has been deprecated. +> **Note:** RancherD was an experimental feature available as part of Rancher v2.5.4 through v2.5.10 but is now deprecated and not available for recent releases. {{% tabs %}} {{% tab "Helm Charts" %}} diff --git a/content/rancher/v2.5/en/installation/resources/installing-docker/_index.md b/content/rancher/v2.5/en/installation/resources/installing-docker/_index.md index 4bf713c00a0..03bc6bbb795 100644 --- a/content/rancher/v2.5/en/installation/resources/installing-docker/_index.md +++ b/content/rancher/v2.5/en/installation/resources/installing-docker/_index.md @@ -7,7 +7,7 @@ aliases: Docker is required to be installed on nodes where the Rancher server will be installed with Helm or Docker. Docker is not required for RancherD installs. -> **Note:** RancherD was an experimental feature and has been deprecated. +> **Note:** RancherD was an experimental feature available as part of Rancher v2.5.4 through v2.5.10 but is now deprecated and not available for recent releases. There are a couple of options for installing Docker. One option is to refer to the [official Docker documentation](https://docs.docker.com/install/) about how to install Docker on Linux. The steps will vary based on the Linux distribution. From 92371ed7dd323db57858038210c70fad5e3d1023 Mon Sep 17 00:00:00 2001 From: Andrew Garrett Date: Fri, 4 Feb 2022 00:26:45 +1100 Subject: [PATCH 225/478] Add documentation for automatic etcd migration Should help with https://github.com/k3s-io/k3s/issues/1257 --- content/k3s/latest/en/installation/ha-embedded/_index.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/content/k3s/latest/en/installation/ha-embedded/_index.md b/content/k3s/latest/en/installation/ha-embedded/_index.md index 9526a67c61e..9d4a1d85cc6 100644 --- a/content/k3s/latest/en/installation/ha-embedded/_index.md +++ b/content/k3s/latest/en/installation/ha-embedded/_index.md @@ -29,3 +29,6 @@ There are a few config flags that must be the same in all server nodes: * Network related flags: `--cluster-dns`, `--cluster-domain`, `--cluster-cidr`, `--service-cidr` * Flags controlling the deployment of certain components: `--disable-helm-controller`, `--disable-kube-proxy`, `--disable-network-policy` and any component passed to `--disable` * Feature related flags: `--secrets-encryption` + +## Existing clusters +If you have an existing cluster using the default embedded SQLite database, you can convert it to etcd by simply restarting your K3s server with the `--cluster-init` flag. Once you've done that, you'll be able to add additional instances as described above. From dcaf09244c6a40ded5231bf434b1a898146957b8 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 4 Feb 2022 14:56:53 +0000 Subject: [PATCH 226/478] Removed APT language per feedback --- .../behind-proxy/launch-kubernetes/_index.md | 11 +++++------ .../single-node-docker/proxy/_index.md | 6 +++--- 2 files changed, 8 insertions(+), 9 deletions(-) diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/launch-kubernetes/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/launch-kubernetes/_index.md index d52fb6b8873..386a9d1565b 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/launch-kubernetes/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/launch-kubernetes/_index.md @@ -62,19 +62,18 @@ sudo systemctl restart docker _New in v2.6.4_ -You can now provision node driver clusters from a proxied Rancher environment. Configure apt to use this proxy when installing packages, including the additional rules shown. If you are not using Ubuntu, you have to adapt this step accordingly: +You can now provision node driver clusters from an air-gapped cluster configured to use a proxy for outbound connections. + +In addition to setting the default rules for a proxy serverx, you will need to add additional rules, shown below, to provision node driver clusters from a proxied Rancher environment. + +Note that you will configure `/etc/apt/apt.conf.d/proxy.conf` directly: ``` -cat <<'EOF' | sudo tee /etc/apt/apt.conf.d/proxy.conf > /dev/null -Acquire::http::Proxy "http://${proxy_host}/"; -Acquire::https::Proxy "http://${proxy_host}/"; - acl SSL_ports port 22 acl SSL_ports port 2376 acl Safe_ports port 22 # ssh acl Safe_ports port 2376 # docker port -EOF ``` ### Creating the RKE Cluster diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/proxy/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/proxy/_index.md index 22b8d494aa5..a8c4784f6fa 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/proxy/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/proxy/_index.md @@ -45,9 +45,9 @@ Privileged access is [required.]({{}}/rancher/v2.6/en/installation/othe _New in v2.6.4_ -You can now provision node driver clusters from an air-gapped cluster configured to use a proxy for outbound connections. +You can now provision node driver clusters from an air-gapped cluster configured to use a proxy for outbound connections. -In addition to setting the default rules for a proxy server as shown above, you will need to add additional rules, shown below, to provision node driver clusters from a proxied Rancher environment. Configure apt to use this proxy when installing packages; if you are not using Ubuntu, you have to adapt your configuration accordingly. +In addition to setting the default rules for a proxy server as shown above, you will need to add additional rules, shown below, to provision node driver clusters from a proxied Rancher environment. You will configure `/etc/apt/apt.conf.d/proxy.conf` with the following: @@ -57,4 +57,4 @@ acl SSL_ports port 2376 acl Safe_ports port 22 # ssh acl Safe_ports port 2376 # docker port -``` +``` \ No newline at end of file From 0287690a4dcbc964f158fc1ffd3388471c16605d Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 4 Feb 2022 14:58:49 +0000 Subject: [PATCH 227/478] Fixed typo --- .../behind-proxy/launch-kubernetes/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/launch-kubernetes/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/launch-kubernetes/_index.md index 386a9d1565b..9af74298d6b 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/launch-kubernetes/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/launch-kubernetes/_index.md @@ -64,7 +64,7 @@ _New in v2.6.4_ You can now provision node driver clusters from an air-gapped cluster configured to use a proxy for outbound connections. -In addition to setting the default rules for a proxy serverx, you will need to add additional rules, shown below, to provision node driver clusters from a proxied Rancher environment. +In addition to setting the default rules for a proxy server, you will need to add additional rules, shown below, to provision node driver clusters from a proxied Rancher environment. Note that you will configure `/etc/apt/apt.conf.d/proxy.conf` directly: From fd70f78c74c1a0e8b745292c89edc8553fb3ed28 Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Fri, 4 Feb 2022 17:13:07 +0100 Subject: [PATCH 228/478] Document new restricted-noroot PSP Signed-off-by: Guilherme Macedo --- .../pod-security-policies/_index.md | 29 +++++++++---------- 1 file changed, 13 insertions(+), 16 deletions(-) diff --git a/content/rancher/v2.6/en/admin-settings/pod-security-policies/_index.md b/content/rancher/v2.6/en/admin-settings/pod-security-policies/_index.md index 2e0d6d70fc3..9244102623d 100644 --- a/content/rancher/v2.6/en/admin-settings/pod-security-policies/_index.md +++ b/content/rancher/v2.6/en/admin-settings/pod-security-policies/_index.md @@ -9,6 +9,7 @@ If a pod does not meet the conditions specified in the PSP, Kubernetes will not - [How PSPs Work](#how-psps-work) - [Default PSPs](#default-psps) + - [Restricted-NoRoot](#restricted-noroot) - [Restricted](#restricted) - [Unrestricted](#unrestricted) - [Creating PSPs](#creating-psps) @@ -28,18 +29,22 @@ PSPs work through inheritance: Any workloads that are already running in a cluster or project before a PSP is assigned will not be checked if it complies with the PSP. Workloads would need to be cloned or upgraded to see if they pass the PSP. -Read more about Pod Security Policies in the [Kubernetes Documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/). +Read more about Pod Security Policies in the [Kubernetes documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/). # Default PSPs -Rancher ships with two default Pod Security Policies (PSPs): the `restricted` and `unrestricted` policies. +Rancher ships with three default Pod Security Policies (PSPs): the `restricted-noroot`, `restricted` and `unrestricted` policies. -### Restricted +### Restricted-NoRoot This policy is based on the Kubernetes [example restricted policy](https://raw.githubusercontent.com/kubernetes/website/master/content/en/examples/policy/restricted-psp.yaml). It significantly restricts what types of pods can be deployed to a cluster or project. This policy: - Prevents pods from running as a privileged user and prevents escalation of privileges. -- Validates that server-required security mechanisms are in place (such as restricting what volumes can be mounted to only the core volume types and preventing root supplemental groups from being added. +- Validates that server-required security mechanisms are in place, such as restricting what volumes can be mounted to only the core volume types and preventing root supplemental groups from being added. + +### Restricted + +This policy is a relaxed version of the `restricted-noroot` policy, with almost all the restrictions in place, except for the fact that it allows running containers as a privileged user. ### Unrestricted @@ -51,9 +56,9 @@ Using Rancher, you can create a Pod Security Policy using our GUI rather than cr ### Requirements -Rancher can only assign PSPs for clusters that are [launched using RKE.]({{< baseurl >}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/) +Rancher can only assign PSPs for clusters that are [launched using RKE]({{< baseurl >}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/). -You must enable PSPs at the cluster level before you can assign them to a project. This can be configured by [editing the cluster.]({{}}/rancher/v2.6/en/cluster-admin/editing-clusters/) +You must enable PSPs at the cluster level before you can assign them to a project. This can be configured by [editing the cluster]({{}}/rancher/v2.6/en/cluster-admin/editing-clusters/). It is a best practice to set PSP at the cluster level. @@ -63,19 +68,11 @@ We recommend adding PSPs during cluster and project creation instead of adding i 1. In the upper left corner, click **☰ > Cluster Management**. 1. In the left navigation bar, click **Pod Security Policies**. -1. Click **Add policy**. +1. Click **Add Policy**. 1. Name the policy. 1. Complete each section of the form. Refer to the [Kubernetes documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) for more information on what each policy does. 1. Click **Create**. # Configuration -The Kubernetes documentation on PSPs is [here.](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) - - - - - -[1]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems -[2]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces -[3]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#users-and-groups +The Kubernetes documentation on PSPs is [here](https://kubernetes.io/docs/concepts/policy/pod-security-policy/). From 6f176629ff06356f1cb39887466a6f749fcb0262 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 4 Feb 2022 22:20:29 +0000 Subject: [PATCH 229/478] Added note on filepath name per feedback --- .../behind-proxy/launch-kubernetes/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/launch-kubernetes/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/launch-kubernetes/_index.md index 9af74298d6b..41428448b27 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/launch-kubernetes/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/launch-kubernetes/_index.md @@ -66,7 +66,7 @@ You can now provision node driver clusters from an air-gapped cluster configured In addition to setting the default rules for a proxy server, you will need to add additional rules, shown below, to provision node driver clusters from a proxied Rancher environment. -Note that you will configure `/etc/apt/apt.conf.d/proxy.conf` directly: +You will configure your filepath according to your setup, e.g., `/etc/apt/apt.conf.d/proxy.conf`: ``` acl SSL_ports port 22 From 3e3a4219b6b0484d70060d0362894fce5a84befe Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 4 Feb 2022 22:20:50 +0000 Subject: [PATCH 230/478] Added note on filepath name per feedback --- .../single-node-docker/proxy/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/proxy/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/proxy/_index.md index a8c4784f6fa..37d3d2cfc00 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/proxy/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/proxy/_index.md @@ -49,7 +49,7 @@ You can now provision node driver clusters from an air-gapped cluster configured In addition to setting the default rules for a proxy server as shown above, you will need to add additional rules, shown below, to provision node driver clusters from a proxied Rancher environment. -You will configure `/etc/apt/apt.conf.d/proxy.conf` with the following: +You will configure your filepath according to your setup, e.g., `/etc/apt/apt.conf.d/proxy.conf`: ``` acl SSL_ports port 22 From 7825148a4e154889658f58be0f92be2c7d69f012 Mon Sep 17 00:00:00 2001 From: Jonas Feroz <78394280+jonasferoz@users.noreply.github.com> Date: Sun, 6 Feb 2022 02:51:06 -0800 Subject: [PATCH 231/478] Update _index.md Add missing 'to' --- content/rancher/v2.6/en/overview/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/overview/_index.md b/content/rancher/v2.6/en/overview/_index.md index 69002e77d81..22d719374d7 100644 --- a/content/rancher/v2.6/en/overview/_index.md +++ b/content/rancher/v2.6/en/overview/_index.md @@ -38,7 +38,7 @@ The Rancher API server is built on top of an embedded Kubernetes API server and - **Provisioning Kubernetes clusters:** The Rancher API server can [provision Kubernetes]({{}}/rancher/v2.6/en/cluster-provisioning/) on existing nodes, or perform [Kubernetes upgrades.]({{}}/rancher/v2.6/en/cluster-admin/upgrading-kubernetes) - **Catalog management:** Rancher provides the ability to use a [catalog of Helm charts]({{}}/rancher/v2.6/en/helm-charts/) that make it easy to repeatedly deploy applications. -- **Managing projects:** A project is a group of multiple namespaces and access control policies within a cluster. A project is a Rancher concept, not a Kubernetes concept, which allows you manage multiple namespaces as a group and perform Kubernetes operations in them. The Rancher UI provides features for [project administration]({{}}/rancher/v2.6/en/project-admin/) and for [managing applications within projects.]({{}}/rancher/v2.6/en/k8s-in-rancher/) +- **Managing projects:** A project is a group of multiple namespaces and access control policies within a cluster. A project is a Rancher concept, not a Kubernetes concept, which allows you to manage multiple namespaces as a group and perform Kubernetes operations in them. The Rancher UI provides features for [project administration]({{}}/rancher/v2.6/en/project-admin/) and for [managing applications within projects.]({{}}/rancher/v2.6/en/k8s-in-rancher/) - **Pipelines:** Setting up a [pipeline]({{}}/rancher/v2.6/en/project-admin/pipelines/) can help developers deliver new software as quickly and efficiently as possible. Within Rancher, you can configure pipelines for each of your Rancher projects. - **Istio:** Our [integration with Istio]({{}}/rancher/v2.6/en/istio/) is designed so that a Rancher operator, such as an administrator or cluster owner, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing. From 6542d17e5faed5fcc506e26043a777e7c7494cdc Mon Sep 17 00:00:00 2001 From: Toliak Date: Sun, 6 Feb 2022 14:08:48 +0300 Subject: [PATCH 232/478] README Backslash typo fix --- .../v2.6/en/installation/install-rancher-on-k8s/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md index e09784abe2b..5d27916781c 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md @@ -198,7 +198,7 @@ helm install rancher rancher-/rancher \ --set hostname=rancher.my.org \ --set bootstrapPassword=admin \ --set ingress.tls.source=letsEncrypt \ - --set letsEncrypt.email=me@example.org + --set letsEncrypt.email=me@example.org \ --set letsEncrypt.ingress.class=nginx ``` From 0c9bbbee85e3340b8fa1d3cc8a380ee8e3aa029b Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 7 Feb 2022 10:36:20 -0500 Subject: [PATCH 233/478] Fixed typo in 2.0-2.4 and 2.5 also --- content/rancher/v2.0-v2.4/en/overview/_index.md | 2 +- content/rancher/v2.5/en/overview/_index.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.0-v2.4/en/overview/_index.md b/content/rancher/v2.0-v2.4/en/overview/_index.md index b572069fbbb..16d8a5d0590 100644 --- a/content/rancher/v2.0-v2.4/en/overview/_index.md +++ b/content/rancher/v2.0-v2.4/en/overview/_index.md @@ -37,7 +37,7 @@ The Rancher API server is built on top of an embedded Kubernetes API server and - **Provisioning Kubernetes clusters:** The Rancher API server can [provision Kubernetes]({{}}/rancher/v2.0-v2.4/en/cluster-provisioning/) on existing nodes, or perform [Kubernetes upgrades.]({{}}/rancher/v2.0-v2.4/en/cluster-admin/upgrading-kubernetes) - **Catalog management:** Rancher provides the ability to use a [catalog of Helm charts]({{}}/rancher/v2.0-v2.4/en/catalog/) that make it easy to repeatedly deploy applications. -- **Managing projects:** A project is a group of multiple namespaces and access control policies within a cluster. A project is a Rancher concept, not a Kubernetes concept, which allows you manage multiple namespaces as a group and perform Kubernetes operations in them. The Rancher UI provides features for [project administration]({{}}/rancher/v2.0-v2.4/en/project-admin/) and for [managing applications within projects.]({{}}/rancher/v2.0-v2.4/en/k8s-in-rancher/) +- **Managing projects:** A project is a group of multiple namespaces and access control policies within a cluster. A project is a Rancher concept, not a Kubernetes concept, which allows you to manage multiple namespaces as a group and perform Kubernetes operations in them. The Rancher UI provides features for [project administration]({{}}/rancher/v2.0-v2.4/en/project-admin/) and for [managing applications within projects.]({{}}/rancher/v2.0-v2.4/en/k8s-in-rancher/) - **Pipelines:** Setting up a [pipeline]({{}}/rancher/v2.0-v2.4/en/project-admin/pipelines/) can help developers deliver new software as quickly and efficiently as possible. Within Rancher, you can configure pipelines for each of your Rancher projects. - **Istio:** Our [integration with Istio]({{}}/rancher/v2.0-v2.4/en/cluster-admin/tools/istio/) is designed so that a Rancher operator, such as an administrator or cluster owner, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing. diff --git a/content/rancher/v2.5/en/overview/_index.md b/content/rancher/v2.5/en/overview/_index.md index dea44182edd..0bfde58d339 100644 --- a/content/rancher/v2.5/en/overview/_index.md +++ b/content/rancher/v2.5/en/overview/_index.md @@ -39,7 +39,7 @@ The Rancher API server is built on top of an embedded Kubernetes API server and - **Provisioning Kubernetes clusters:** The Rancher API server can [provision Kubernetes]({{}}/rancher/v2.5/en/cluster-provisioning/) on existing nodes, or perform [Kubernetes upgrades.]({{}}/rancher/v2.5/en/cluster-admin/upgrading-kubernetes) - **Catalog management:** Rancher provides the ability to use a [catalog of Helm charts]({{}}/rancher/v2.5/en/catalog/) that make it easy to repeatedly deploy applications. -- **Managing projects:** A project is a group of multiple namespaces and access control policies within a cluster. A project is a Rancher concept, not a Kubernetes concept, which allows you manage multiple namespaces as a group and perform Kubernetes operations in them. The Rancher UI provides features for [project administration]({{}}/rancher/v2.5/en/project-admin/) and for [managing applications within projects.]({{}}/rancher/v2.5/en/k8s-in-rancher/) +- **Managing projects:** A project is a group of multiple namespaces and access control policies within a cluster. A project is a Rancher concept, not a Kubernetes concept, which allows you to manage multiple namespaces as a group and perform Kubernetes operations in them. The Rancher UI provides features for [project administration]({{}}/rancher/v2.5/en/project-admin/) and for [managing applications within projects.]({{}}/rancher/v2.5/en/k8s-in-rancher/) - **Pipelines:** Setting up a [pipeline]({{}}/rancher/v2.5/en/project-admin/pipelines/) can help developers deliver new software as quickly and efficiently as possible. Within Rancher, you can configure pipelines for each of your Rancher projects. - **Istio:** Our [integration with Istio]({{}}/rancher/v2.5/en/istio/) is designed so that a Rancher operator, such as an administrator or cluster owner, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing. From 6dbe16bf5652f65bb917684fd33c610f653bbd64 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 7 Feb 2022 10:53:07 -0500 Subject: [PATCH 234/478] Fixed backslash typo in 2.0-2.4 and 2.5 also --- .../v2.0-v2.4/en/installation/install-rancher-on-k8s/_index.md | 2 +- .../v2.5/en/installation/install-rancher-on-k8s/_index.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.0-v2.4/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.0-v2.4/en/installation/install-rancher-on-k8s/_index.md index b98a08e0085..0e79ce86a0d 100644 --- a/content/rancher/v2.0-v2.4/en/installation/install-rancher-on-k8s/_index.md +++ b/content/rancher/v2.0-v2.4/en/installation/install-rancher-on-k8s/_index.md @@ -196,7 +196,7 @@ helm install rancher rancher-/rancher \ --namespace cattle-system \ --set hostname=rancher.my.org \ --set ingress.tls.source=letsEncrypt \ - --set letsEncrypt.email=me@example.org + --set letsEncrypt.email=me@example.org \ ``` Wait for Rancher to be rolled out: diff --git a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md index 64095efe201..c9b1d6d8c5d 100644 --- a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md +++ b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md @@ -208,7 +208,7 @@ helm install rancher rancher-/rancher \ --set hostname=rancher.my.org \ --set replicas=3 \ --set ingress.tls.source=letsEncrypt \ - --set letsEncrypt.email=me@example.org + --set letsEncrypt.email=me@example.org \ --set letsEncrypt.ingress.class=nginx ``` From 68e519b667318e6ce1ef5c4f50429c98d98da905 Mon Sep 17 00:00:00 2001 From: "Junyeop, Jang" Date: Tue, 8 Feb 2022 17:41:23 +0900 Subject: [PATCH 235/478] yaml not working indent was missing. --- .../en/helm-charts/tutorial/_index.md | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/content/rancher/v2.0-v2.4/en/helm-charts/tutorial/_index.md b/content/rancher/v2.0-v2.4/en/helm-charts/tutorial/_index.md index 5a23d0b7092..09b5c493fc1 100644 --- a/content/rancher/v2.0-v2.4/en/helm-charts/tutorial/_index.md +++ b/content/rancher/v2.0-v2.4/en/helm-charts/tutorial/_index.md @@ -50,20 +50,20 @@ You can fill your custom catalogs with either Helm Charts or Rancher Charts, alt - CMS questions: - variable: persistence.enabled - default: "false" - description: "Enable persistent volume for WordPress" - type: boolean - required: true - label: WordPress Persistent Volume Enabled - show_subquestion_if: true - group: "WordPress Settings" - subquestions: - - variable: persistence.size + default: "false" + description: "Enable persistent volume for WordPress" + type: boolean + required: true + label: WordPress Persistent Volume Enabled + show_subquestion_if: true + group: "WordPress Settings" + subquestions: + - variable: persistence.size default: "10Gi" description: "WordPress Persistent Volume Size" type: string label: WordPress Volume Size - - variable: persistence.storageClass + - variable: persistence.storageClass default: "" description: "If undefined or null, uses the default StorageClass. Default to null" type: storageclass From 90941943f5f896850b9b0c124d0bd8bf5baf32c5 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Tue, 8 Feb 2022 14:25:44 -0700 Subject: [PATCH 236/478] Mention Terraform more prominently in docs --- content/rancher/v2.6/en/cluster-provisioning/_index.md | 7 +++++++ .../hosted-kubernetes-clusters/aks/_index.md | 5 +++++ .../hosted-kubernetes-clusters/eks/_index.md | 7 ++++++- .../hosted-kubernetes-clusters/gke/_index.md | 4 ++++ .../v2.6/en/cluster-provisioning/rke-clusters/_index.md | 4 ++++ 5 files changed, 26 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/_index.md b/content/rancher/v2.6/en/cluster-provisioning/_index.md index 5a33cad88f8..9e9f44c4c87 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/_index.md @@ -20,6 +20,7 @@ This section covers the following topics: - [Launching Kubernetes and Provisioning Nodes in an Infrastructure Provider](#launching-kubernetes-and-provisioning-nodes-in-an-infrastructure-provider) - [Launching Kubernetes on Existing Custom Nodes](#launching-kubernetes-on-existing-custom-nodes) - [Registering Existing Clusters](#registering-existing-clusters) +- [Programmatically Creating Clusters](#programmatically-creating-clusters) @@ -78,3 +79,9 @@ Registering EKS clusters now provides additional benefits. For the most part, re When you delete an EKS cluster that was created in Rancher, the cluster is destroyed. When you delete an EKS cluster that was registered in Rancher, it is disconnected from the Rancher server, but it still exists and you can still access it in the same way you did before it was registered in Rancher. For more information, see [this page.](./registered-clusters) + +# Programmatically Creating Clusters + +The most common way to programmatically deploy Kubernetes clusters through Rancher is by using the Rancher2 Terraform provider. The documentation for creating clusters with Terraform is [here.](https://registry.terraform.io/providers/rancher/rancher2/latest/docs/resources/cluster) + +EKS, GKE, AKS clusters and RKE clusters can be created or imported with Terraform. \ No newline at end of file diff --git a/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/aks/_index.md b/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/aks/_index.md index e3aa18629c8..a0ad8a5c24f 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/aks/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/aks/_index.md @@ -16,6 +16,7 @@ You can use Rancher to create a cluster hosted in Microsoft Azure Kubernetes Ser - [Private Clusters](#private-clusters) - [Minimum AKS Permissions](#minimum-aks-permissions) - [Syncing](#syncing) +- [Programmatically Creating AKS Clusters](#programmatically-creating-aks-clusters) # Prerequisites in Microsoft Azure @@ -152,3 +153,7 @@ For more information about connecting to an AKS private cluster, see the [AKS do The AKS provisioner can synchronize the state of an AKS cluster between Rancher and the provider. For an in-depth technical explanation of how this works, see [Syncing.]({{}}/rancher/v2.6/en/cluster-admin/editing-clusters/syncing) For information on configuring the refresh interval, see [this section.]({{}}/rancher/v2.6/en/cluster-admin/editing-clusters/gke-config-reference/#configuring-the-refresh-interval) + +# Programmatically Creating AKS Clusters + +The most common way to programmatically deploy AKS clusters through Rancher is by using the Rancher2 Terraform provider. The documentation for creating clusters with Terraform is [here.](https://registry.terraform.io/providers/rancher/rancher2/latest/docs/resources/cluster) \ No newline at end of file diff --git a/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md b/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md index 3235e46801c..3f55612fbdd 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md @@ -17,6 +17,7 @@ Amazon EKS provides a managed control plane for your Kubernetes cluster. Amazon - [Minimum EKS Permissions](#minimum-eks-permissions) - [Syncing](#syncing) - [Troubleshooting](#troubleshooting) +- [Programmatically Creating EKS Clusters](#programmatically-creating-eks-clusters) # Prerequisites in Amazon Web Services >**Note** @@ -108,4 +109,8 @@ If your changes were overwritten, it could be due to the way the cluster data is If an unauthorized error is returned while attempting to modify or register the cluster and the cluster was not created with the role or user that your credentials belong to, refer to [Security and Compliance.](#security-and-compliance) -For any issues or troubleshooting details for your Amazon EKS Kubernetes cluster, please see this [documentation](https://docs.aws.amazon.com/eks/latest/userguide/troubleshooting.html). \ No newline at end of file +For any issues or troubleshooting details for your Amazon EKS Kubernetes cluster, please see this [documentation](https://docs.aws.amazon.com/eks/latest/userguide/troubleshooting.html). + +# Programmatically Creating EKS Clusters + +The most common way to programmatically deploy EKS clusters through Rancher is by using the Rancher2 Terraform provider. The documentation for creating clusters with Terraform is [here.](https://registry.terraform.io/providers/rancher/rancher2/latest/docs/resources/cluster) \ No newline at end of file diff --git a/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/gke/_index.md b/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/gke/_index.md index 0f1d1eec0e1..95567faa8c9 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/gke/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/gke/_index.md @@ -10,6 +10,7 @@ weight: 2105 - [Configuration Reference](#configuration-reference) - [Updating Kubernetes Version](#updating-kubernetes-version) - [Syncing](#syncing) +- [Programmatically Creating GKE Clusters](#programmatically-creating-gke-clusters) # Prerequisites @@ -98,3 +99,6 @@ The GKE provisioner can synchronize the state of a GKE cluster between Rancher a For information on configuring the refresh interval, see [this section.]({{}}/rancher/v2.6/en/cluster-admin/editing-clusters/gke-config-reference/#configuring-the-refresh-interval) +# Programmatically Creating GKE Clusters + +The most common way to programmatically deploy GKE clusters through Rancher is by using the Rancher2 Terraform provider. The documentation for creating clusters with Terraform is [here.](https://registry.terraform.io/providers/rancher/rancher2/latest/docs/resources/cluster) \ No newline at end of file diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md index 66fea5d3088..0b5c79028c5 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md @@ -54,3 +54,7 @@ In this scenario, you want to install Kubernetes on bare-metal servers, on-prem If you want to reuse a node from a previous custom cluster, [clean the node]({{}}/rancher/v2.6/en/cluster-admin/cleaning-cluster-nodes/) before using it in a cluster again. If you reuse a node that hasn't been cleaned, cluster provisioning may fail. For more information, refer to the section on [custom nodes.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/custom-nodes/) + +# Programmatically Creating RKE Clusters + +The most common way to programmatically deploy RKE clusters through Rancher is by using the Rancher2 Terraform provider. The documentation for creating clusters with Terraform is [here.](https://registry.terraform.io/providers/rancher/rancher2/latest/docs/resources/cluster) From b87744d3c0c87b755cb333afb05b69e170bb0cb0 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 9 Feb 2022 10:47:09 -0500 Subject: [PATCH 237/478] Added new section to explain in-tree driver deprecation --- content/k3s/latest/en/storage/_index.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/content/k3s/latest/en/storage/_index.md b/content/k3s/latest/en/storage/_index.md index fd0dcba1168..0dfdf265189 100644 --- a/content/k3s/latest/en/storage/_index.md +++ b/content/k3s/latest/en/storage/_index.md @@ -9,6 +9,14 @@ A persistent volume (PV) is a piece of storage in the Kubernetes cluster, while This page describes how to set up persistent storage with a local storage provider, or with [Longhorn.](#setting-up-longhorn) +# What's changed in K3s storage? + +Currently, K3s has removed both the in-tree storage drivers and the in-tree cloud provider. We removed these to achieve a smaller binary size and to avoid dependence on third-party cloud or data center technologies and services, which may not be available in many K3s use cases. We are able to do this because their removal affects neither core Kubernetes functionality nor conformance. + +Both of these have out-of-tree alternatives that work in K3s: [CSI](https://github.com/container-storage-interface/spec/blob/master/spec.md) and [CCM](https://kubernetes.io/docs/tasks/administer-cluster/running-cloud-controller/). + +Additionally, upstream Kubernetes will be migrating from in-tree drivers to CSI soon. For more information on this migration, please refer [here](https://kubernetes.io/blog/2021/12/10/storage-in-tree-to-csi-migration-status-update/). + # Setting up the Local Storage Provider K3s comes with Rancher's Local Path Provisioner and this enables the ability to create persistent volume claims out of the box using local storage on the respective node. Below we cover a simple example. For more information please reference the official documentation [here](https://github.com/rancher/local-path-provisioner/blob/master/README.md#usage). From 91951859ec7057b250a1eb5e4ca9b6bde248dd79 Mon Sep 17 00:00:00 2001 From: David Noland Date: Thu, 10 Feb 2022 13:28:08 -0800 Subject: [PATCH 238/478] Fixed instructions for features flags in helm. --- .../v2.6/en/installation/resources/feature-flags/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md b/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md index a3fac147dad..b1edfa8db7e 100644 --- a/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md +++ b/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md @@ -61,7 +61,7 @@ When you install Rancher, enable the feature you want with a feature flag. The c > **Note:** Values set from the Rancher API will override the value passed in through the command line. -When installing Rancher with a Helm chart, use the `--features` option. In the below example, two features are enabled by passing the feature flag names names in a comma separated list: +When installing Rancher with a Helm chart, use the `--set` option. In the below example, two features are enabled by passing the feature names in a comma separated list: ``` helm install rancher rancher-latest/rancher \ From 83b99c2093d160a81925fc0a8ff9faf2b52a0f0f Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 14 Feb 2022 10:24:29 -0500 Subject: [PATCH 239/478] Added new parameter to 2.5 also per feedback --- .../v2.5/en/installation/resources/feature-flags/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/installation/resources/feature-flags/_index.md b/content/rancher/v2.5/en/installation/resources/feature-flags/_index.md index d134423b4cb..0fda699675f 100644 --- a/content/rancher/v2.5/en/installation/resources/feature-flags/_index.md +++ b/content/rancher/v2.5/en/installation/resources/feature-flags/_index.md @@ -56,7 +56,7 @@ When you install Rancher, enable the feature you want with a feature flag. The c > **Note:** Values set from the Rancher API will override the value passed in through the command line. -When installing Rancher with a Helm chart, use the `--features` option. In the below example, two features are enabled by passing the feature flag names names in a comma separated list: +When installing Rancher with a Helm chart, use the `--set` option. In the below example, two features are enabled by passing the feature flag names names in a comma separated list: ``` helm install rancher-latest/rancher \ From 6dbd33feb06780456ae2b800d19470581d65022b Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 14 Feb 2022 12:25:23 -0500 Subject: [PATCH 240/478] Fixed typos --- .../v2.5/en/installation/resources/feature-flags/_index.md | 2 +- .../v2.6/en/installation/resources/feature-flags/_index.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.5/en/installation/resources/feature-flags/_index.md b/content/rancher/v2.5/en/installation/resources/feature-flags/_index.md index 0fda699675f..879ab361e83 100644 --- a/content/rancher/v2.5/en/installation/resources/feature-flags/_index.md +++ b/content/rancher/v2.5/en/installation/resources/feature-flags/_index.md @@ -56,7 +56,7 @@ When you install Rancher, enable the feature you want with a feature flag. The c > **Note:** Values set from the Rancher API will override the value passed in through the command line. -When installing Rancher with a Helm chart, use the `--set` option. In the below example, two features are enabled by passing the feature flag names names in a comma separated list: +When installing Rancher with a Helm chart, use the `--set` option. In the below example, two features are enabled by passing the feature flag names in a comma separated list: ``` helm install rancher-latest/rancher \ diff --git a/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md b/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md index b1edfa8db7e..8faa5813aa0 100644 --- a/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md +++ b/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md @@ -61,7 +61,7 @@ When you install Rancher, enable the feature you want with a feature flag. The c > **Note:** Values set from the Rancher API will override the value passed in through the command line. -When installing Rancher with a Helm chart, use the `--set` option. In the below example, two features are enabled by passing the feature names in a comma separated list: +When installing Rancher with a Helm chart, use the `--set` option. In the below example, two features are enabled by passing the feature flag names in a comma separated list: ``` helm install rancher rancher-latest/rancher \ From bee41d86d451c3631d3949863b25310422835d1e Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 14 Feb 2022 16:00:17 -0800 Subject: [PATCH 241/478] Update content/rancher/v2.6/en/faq/dockershim/_index.md --- content/rancher/v2.6/en/faq/dockershim/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/faq/dockershim/_index.md b/content/rancher/v2.6/en/faq/dockershim/_index.md index 691d23d2785..c7dc14749db 100644 --- a/content/rancher/v2.6/en/faq/dockershim/_index.md +++ b/content/rancher/v2.6/en/faq/dockershim/_index.md @@ -3,7 +3,7 @@ title: Dockershim weight: 300 --- -The Dockershim is the CRI compliant layer between the Kubelet and the Docker daemon. As part of the Kubernetes 1.20 release, the [deprecation of the in-tree Dockershim was announced](https://kubernetes.io/blog/2020/12/02/dont-panic-kubernetes-and-docker/). For more information on the deprecation and its timelines, see the [Kubernetes Dockershim Deprecation FAQ](https://kubernetes.io/blog/2020/12/02/dockershim-faq/#when-will-dockershim-be-removed). +The Dockershim is the CRI compliant layer between the Kubelet and the Docker daemon. As part of the Kubernetes 1.20 release, the [deprecation of the in-tree Dockershim was announced](https://kubernetes.io/blog/2020/12/02/dont-panic-kubernetes-and-docker/). Removal is currently scheduled for Kubernetes 1.24. For more information on the deprecation and its timelines, see the [Kubernetes Dockershim Deprecation FAQ](https://kubernetes.io/blog/2020/12/02/dockershim-faq/#when-will-dockershim-be-removed). RKE clusters now support the external Dockershim to continue leveraging Docker as the CRI runtime. We now implement the upstream open source community Dockershim announced by [Mirantis and Docker](https://www.mirantis.com/blog/mirantis-to-take-over-support-of-kubernetes-dockershim-2/) to ensure RKE clusters can continue to leverage Docker. From f1197acf19a4441e562b22105d048b77663703f8 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 14 Feb 2022 16:01:49 -0800 Subject: [PATCH 242/478] Apply suggestions from code review --- content/rancher/v2.6/en/faq/dockershim/_index.md | 12 +++++++----- .../installation/requirements/dockershim/_index.md | 6 +++--- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/content/rancher/v2.6/en/faq/dockershim/_index.md b/content/rancher/v2.6/en/faq/dockershim/_index.md index c7dc14749db..a9f79c0bddd 100644 --- a/content/rancher/v2.6/en/faq/dockershim/_index.md +++ b/content/rancher/v2.6/en/faq/dockershim/_index.md @@ -5,15 +5,15 @@ weight: 300 The Dockershim is the CRI compliant layer between the Kubelet and the Docker daemon. As part of the Kubernetes 1.20 release, the [deprecation of the in-tree Dockershim was announced](https://kubernetes.io/blog/2020/12/02/dont-panic-kubernetes-and-docker/). Removal is currently scheduled for Kubernetes 1.24. For more information on the deprecation and its timelines, see the [Kubernetes Dockershim Deprecation FAQ](https://kubernetes.io/blog/2020/12/02/dockershim-faq/#when-will-dockershim-be-removed). -RKE clusters now support the external Dockershim to continue leveraging Docker as the CRI runtime. We now implement the upstream open source community Dockershim announced by [Mirantis and Docker](https://www.mirantis.com/blog/mirantis-to-take-over-support-of-kubernetes-dockershim-2/) to ensure RKE clusters can continue to leverage Docker. +RKE clusters, starting with Kubernetes 1.21, now support the external Dockershim to continue leveraging Docker as the CRI runtime. We now implement the upstream open source community Dockershim announced by [Mirantis and Docker](https://www.mirantis.com/blog/mirantis-to-take-over-support-of-kubernetes-dockershim-2/) to ensure RKE clusters can continue to leverage Docker. -This new component that replaces the old Dockershim, called `cri-dockerd`, will need to enabled using the option listed below. Note that to use this option will require at least Kubernetes 1.21. +To enable the external Dockershim, configure the following option. ``` enable_cri_dockerd: true ``` -For users looking to use another container runtime, Rancher has the edge-focused K3s and datacenter-focused RKE2 Kubernetes distributions that use containerd as the default runtime. Imported RKE2 and K3s Kubernetes clusters can then be upgraded and managed through Rancher going forward. +For users looking to use another container runtime, Rancher has the edge-focused K3s and datacenter-focused RKE2 Kubernetes distributions that use containerd as the default runtime. Imported RKE2 and K3s Kubernetes clusters can then be upgraded and managed through Rancher even after the removal of in-tree Dockershim in Kubernetes 1.24. ### FAQ @@ -21,13 +21,15 @@ For users looking to use another container runtime, Rancher has the edge-focused Q. Do I have to upgrade Rancher to get Rancher’s support of the upstream Dockershim? -A The upstream support of Dockershim begins for RKE in Kubernetes 1.21. You will need to be on a version of Rancher that supports RKE 1.21. See our support matrix for details. +The upstream support of Dockershim begins for RKE in Kubernetes 1.21. You will need to be on Rancher 2.6 or above to have support for RKE with Kubernetes 1.21. See our [support matrix](https://rancher.com/support-maintenance-terms/all-supported-versions/rancher-v2.6.0/) for details.
Q. I am currently on RKE with Kubernetes 1.20. Do I need to upgrade to RKE with Kubernetes 1.21 sooner to avoid being out of support for Dockershim? -A. The version of Dockershim in RKE with Kubernetes 1.20 will continue to work and it is not deprecated until a later release. For information on the timeline, see the [Kubernetes Dockershim Deprecation FAQ](https://kubernetes.io/blog/2020/12/02/dockershim-faq/#when-will-dockershim-be-removed). It will only emit a warning of its future deprecation, which Rancher has mitigated in RKE with Kubernetes 1.21. You can plan your upgrade to 1.21 as you would normally. +A. The version of Dockershim in RKE with Kubernetes 1.20 will continue to work and is not scheduled for removal upstream until Kubernetes 1.24. It will only emit a warning of its future deprecation, which Rancher has mitigated in RKE with Kubernetes 1.21. You can plan your upgrade to Kubernetes 1.21 as you would normally, but should consider enabling the external Dockershim by Kubernetes 1.22. The external Dockershim will need to be enabled before upgrading to Kubernetes 1.24, at which point the existing implementation will be removed. + +For more information on the deprecation and its timeline, see the [Kubernetes Dockershim Deprecation FAQ](https://kubernetes.io/blog/2020/12/02/dockershim-faq/#when-will-dockershim-be-removed).
diff --git a/content/rancher/v2.6/en/installation/requirements/dockershim/_index.md b/content/rancher/v2.6/en/installation/requirements/dockershim/_index.md index 691d23d2785..e4c3490c4b2 100644 --- a/content/rancher/v2.6/en/installation/requirements/dockershim/_index.md +++ b/content/rancher/v2.6/en/installation/requirements/dockershim/_index.md @@ -5,9 +5,9 @@ weight: 300 The Dockershim is the CRI compliant layer between the Kubelet and the Docker daemon. As part of the Kubernetes 1.20 release, the [deprecation of the in-tree Dockershim was announced](https://kubernetes.io/blog/2020/12/02/dont-panic-kubernetes-and-docker/). For more information on the deprecation and its timelines, see the [Kubernetes Dockershim Deprecation FAQ](https://kubernetes.io/blog/2020/12/02/dockershim-faq/#when-will-dockershim-be-removed). -RKE clusters now support the external Dockershim to continue leveraging Docker as the CRI runtime. We now implement the upstream open source community Dockershim announced by [Mirantis and Docker](https://www.mirantis.com/blog/mirantis-to-take-over-support-of-kubernetes-dockershim-2/) to ensure RKE clusters can continue to leverage Docker. +RKE clusters now support the external Dockershim to continue leveraging Docker as the CRI runtime. We now implement the upstream open source community external Dockershim announced by [Mirantis and Docker](https://www.mirantis.com/blog/mirantis-to-take-over-support-of-kubernetes-dockershim-2/) to ensure RKE clusters can continue to leverage Docker. -This new component that replaces the old Dockershim, called `cri-dockerd`, will need to enabled using the option listed below. Note that to use this option will require at least Kubernetes 1.21. +To enable the external Dockershim, configure the following option. ``` enable_cri_dockerd: true @@ -39,6 +39,6 @@ A: You can use a runtime like containerd with Kubernetes that does not require D Q: If I am already using RKE1 and want to switch to RKE2, what are my migration options? -A: Rancher is exploring the possibility of an in-place upgrade path. Alternatively you can always migrate workloads from one cluster to another using kubectl. +A: Today, you can stand up a new cluster and migrate workloads to a new RKE2 cluster that uses containerd. Rancher is exploring the possibility of an in-place upgrade path.
From b068ba7c60b0a8e14dc53b254964941a3a081c71 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 14 Feb 2022 16:14:30 -0800 Subject: [PATCH 243/478] Fix typo --- .../en/installation/resources/feature-flags/_index.md | 2 +- .../v2.5/en/installation/resources/feature-flags/_index.md | 2 +- .../v2.6/en/installation/resources/feature-flags/_index.md | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/content/rancher/v2.0-v2.4/en/installation/resources/feature-flags/_index.md b/content/rancher/v2.0-v2.4/en/installation/resources/feature-flags/_index.md index c235116ee24..3c0c500c5aa 100644 --- a/content/rancher/v2.0-v2.4/en/installation/resources/feature-flags/_index.md +++ b/content/rancher/v2.0-v2.4/en/installation/resources/feature-flags/_index.md @@ -107,7 +107,7 @@ When installing Rancher with Docker, use the `--features` option. In the below e docker run -d -p 80:80 -p 443:443 \ --restart=unless-stopped \ rancher/rancher:rancher-latest \ - --features==true,=true # Available as of v2.3.0 + --features==true,=true # Available as of v2.3.0 ``` {{% /tab %}} diff --git a/content/rancher/v2.5/en/installation/resources/feature-flags/_index.md b/content/rancher/v2.5/en/installation/resources/feature-flags/_index.md index 879ab361e83..b06257e74e4 100644 --- a/content/rancher/v2.5/en/installation/resources/feature-flags/_index.md +++ b/content/rancher/v2.5/en/installation/resources/feature-flags/_index.md @@ -131,7 +131,7 @@ When installing Rancher with Docker, use the `--features` option. In the below e docker run -d -p 80:80 -p 443:443 \ --restart=unless-stopped \ rancher/rancher:rancher-latest \ - --features==true,=true + --features==true,=true ``` diff --git a/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md b/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md index 8faa5813aa0..a1f92902d3d 100644 --- a/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md +++ b/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md @@ -26,12 +26,12 @@ For example, if you install Rancher, then set a feature flag to true with the Ra The following is a list of the feature flags available in Rancher: - `harvester`: This feature flag is available starting in v2.6.1. It is used to manage access to the Virtualization Management page where users can navigate directly to Harvester clusters and access the Harvester UI. For more information, see [this page]({{}}/rancher/v2.6/en/virtualization-admin/#feature-flag/). -- `rke2`: We have introduced the ability to provision RKE2 clusters as tech preview. By default, this feature flag is enabled, which allows users to attempt to provision these type of clusters. +- `rke2`: We have introduced the ability to provision RKE2 clusters as tech preview. By default, this feature flag is enabled, which allows users to attempt to provision these type of clusters. - `fleet`: The previous `fleet` feature flag is now required to be enabled as the Fleet capabilities are leveraged within the new provisioning framework. If you had this feature flag disabled in earlier versions, upon upgrading to Rancher v2.6, the flag will automatically be enabled. See this [page]({{}}/rancher/v2.6/en/deploy-across-clusters/fleet) for more information. - `continuous-delivery`: In Rancher v2.5.x, Fleet came with a GitOps feature that could not be disabled separately from Fleet. In Rancher v2.6, the `continuous-delivery` feature flag was introduced to allow the GitOps feature of Fleet to be disabled. For more information, see [this page.](./continuous-delivery). - `legacy`: There are a set of features from previous versions that are slowly being phased out of Rancher for newer iterations of the feature. This is a mix of deprecated features as well as features that will eventually be moved to newer variations in Rancher. By default, this feature flag is disabled for new installations. If you are upgrading from a previous version, this feature flag would be enabled. - `token-hashing`: Used to enable new token-hashing feature. Once enabled, existing tokens will be hashed and all new tokens will be hashed automatically using the SHA256 algorithm. Once a token is hashed it cannot be undone. Once this feature flag is enabled, it cannot be disabled. See [hashing of tokens]({{}}/rancher/v2.6/en/api/api-tokens) for more information. -- `unsupported-storage-drivers`: This feature [allows unsupported storage drivers.]({{}}/rancher/v2.6/en/installation/resources/feature-flags/enable-not-default-storage-drivers). In other words, it enables types for storage providers and provisioners that are not enabled by default. +- `unsupported-storage-drivers`: This feature [allows unsupported storage drivers.]({{}}/rancher/v2.6/en/installation/resources/feature-flags/enable-not-default-storage-drivers). In other words, it enables types for storage providers and provisioners that are not enabled by default. - `istio-virtual-service-ui`: This feature enables a [UI to create, read, update, and delete Istio virtual services and destination rules,]({{}}/rancher/v2.6/en/installation/resources/feature-flags/istio-virtual-service-ui) which are traffic management features of Istio. - `multi-cluster-management`: Used for multi-cluster provisioning and management of Kubernetes clusters. This feature flag can only be set at install time and not changed afterwards. @@ -102,7 +102,7 @@ When installing Rancher with Docker, use the `--features` option. In the below e docker run -d -p 80:80 -p 443:443 \ --restart=unless-stopped \ rancher/rancher:rancher-latest \ - --features==true,=true + --features==true,=true ``` From 248a8a26b16ee53065f8ca4866c09d7f6a48d084 Mon Sep 17 00:00:00 2001 From: Jiaqi Luo <6218999+jiaqiluo@users.noreply.github.com> Date: Tue, 15 Feb 2022 14:39:26 -0700 Subject: [PATCH 244/478] fix a couple of mistakes around key rotation in rke1 docs --- .../rke/latest/en/config-options/secrets-encryption/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rke/latest/en/config-options/secrets-encryption/_index.md b/content/rke/latest/en/config-options/secrets-encryption/_index.md index 81e24ff9bf9..ff8bab209a6 100644 --- a/content/rke/latest/en/config-options/secrets-encryption/_index.md +++ b/content/rke/latest/en/config-options/secrets-encryption/_index.md @@ -106,14 +106,14 @@ OPTIONS: This command will perform the following actions: - Generate a new random 32-byte encryption key -- Generate a new provider configuration with the new key as the first provider and the second key as the second provider. When the secrets are rewritten, the first key will be used to encrypt the data on the write operation, while the second key (the old key) will be used to decrypt the stored data during the the read operation +- Generate a new provider configuration with the new key as the first provider and the old key as the second provider. When the secrets are rewritten, the first key will be used to encrypt the data on the write operation, while the second key (the old key) will be used to decrypt the stored data during the the read operation - Deploy the new provider configuration to all `controlplane` nodes and restart the `kube-apiserver` - Rewrite all secrets. This process will re-encrypt all the secrets with the new key. - Update the configuration to remove the old key and restart the `kube-apiserver` ### Rotating Keys by Disabling and Re-enabling Encryption in cluster.yml -For a cluster with encryption enabled, you can rotate the encryption keys by updating `cluster.yml`. If you enable and re-enable the data encryption in the `cluster.yml`, RKE will not reuse old keys. Instead, it will generate new keys every time, yielding the same result as a key rotation with the RKE CLI. +For a cluster with encryption enabled, you can rotate the encryption keys by updating `cluster.yml`. If you disable and re-enable the data encryption in the `cluster.yml`, RKE will not reuse old keys. Instead, it will generate new keys every time, yielding the same result as a key rotation with the RKE CLI. # Custom At-Rest Data Encryption Configuration With managed configuration, RKE provides the user with a very simple way to enable and disable encryption with minimal interaction and configuration. However, it doesn't allow for any customization to the configuration. From 91245d5d3ae549bf0f35a3ddaa46b253e1a78516 Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Fri, 21 Jan 2022 11:35:08 +0100 Subject: [PATCH 245/478] Add v2.6 hardening guides Signed-off-by: Guilherme Macedo --- content/rancher/v2.6/en/security/_index.md | 2 +- ...her_v2-6_CIS_v1-6_Benchmark_Assessment.pdf | 14728 ++++++++++++++++ .../1.6-benchmark-2.6/_index.md | 3098 ++++ .../Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf | 7954 +++++++++ .../1.6-hardening-2.6/_index.md | 630 + .../en/security/hardening-guides/_index.md | 56 +- scripts/converters/run_results_to_md.sh | 2 +- scripts/converters/scripts/results_to_md.sh | 52 +- 8 files changed, 26490 insertions(+), 32 deletions(-) create mode 100644 content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf create mode 100644 content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/_index.md create mode 100644 content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf create mode 100644 content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md diff --git a/content/rancher/v2.6/en/security/_index.md b/content/rancher/v2.6/en/security/_index.md index 1f121f11ed2..0cd5e3dcaf4 100644 --- a/content/rancher/v2.6/en/security/_index.md +++ b/content/rancher/v2.6/en/security/_index.md @@ -11,7 +11,7 @@ weight: 20

Reporting process

-

Please submit possible security issues by emailing security@rancher.com .

+

Please submit possible security issues by emailing security-rancher@suse.com .

Announcements

diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf b/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf new file mode 100644 index 00000000000..461c98f592c --- /dev/null +++ b/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf @@ -0,0 +1,14728 @@ +%PDF-1.7 +%🖤 +1 0 obj +<< +/Type /Pages +/Kids [ 6 0 R 8 0 R 50 0 R 106 0 R 156 0 R 206 0 R 258 0 R 298 0 R 303 0 R 307 0 R 309 0 R 311 0 R 315 0 R 330 0 R 364 0 R 389 0 R 427 0 R 446 0 R 486 0 R 499 0 R 502 0 R 505 0 R 508 0 R 510 0 R 513 0 R 515 0 R 518 0 R 521 0 R 523 0 R 526 0 R 528 0 R 531 0 R 534 0 R 536 0 R 539 0 R 541 0 R 544 0 R 546 0 R 549 0 R 552 0 R 556 0 R 558 0 R 561 0 R 564 0 R 566 0 R 569 0 R 571 0 R 574 0 R 577 0 R 579 0 R 582 0 R 584 0 R 587 0 R 590 0 R 592 0 R 595 0 R 597 0 R 600 0 R 603 0 R 605 0 R 608 0 R 610 0 R 613 0 R 616 0 R 618 0 R 621 0 R 623 0 R 626 0 R 629 0 R 631 0 R 634 0 R 636 0 R 639 0 R 645 0 R 669 0 R 672 0 R 675 0 R 679 0 R 682 0 R 685 0 R 688 0 R 690 0 R 694 0 R 696 0 R 699 0 R 701 0 R 704 0 R 706 0 R 709 0 R 711 0 R 713 0 R 716 0 R 718 0 R 721 0 R 723 0 R 726 0 R 728 0 R 731 0 R 733 0 R 735 0 R 737 0 R 740 0 R 742 0 R 745 0 R 749 0 R 758 0 R 766 0 R 768 0 R 773 0 R 778 0 R 784 0 R 788 0 R 792 0 R 798 0 R 802 0 R 805 0 R 809 0 R 811 0 R 835 0 R 847 0 R 850 0 R 854 0 R 857 0 R 859 0 R 875 0 R 883 0 R 885 0 R 887 0 R 889 0 R ] +/Count 129 +>> +endobj +2 0 obj +<< +/Title (CIS v1.6 Benchmark - Self-Assessment Guide - Rancher v2.6) +/Creator (pandoc) +/Producer (WeasyPrint 54.0) +>> +endobj +3 0 obj +<< +/Type /Catalog +/Pages 1 0 R +/Outlines 1051 0 R +/Names << +/Dests << +/Names [ (TOC) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (api-server) [ 502 0 R /XYZ 41.740157 784.430079 0 ] (apply-security-context-to-your-pods-and-containers-manual) [ 887 0 R /XYZ 84.259843 312.591496 0 ] (authentication-and-authorization) [ 735 0 R /XYZ 41.740157 784.430079 0 ] (cb1) [ 311 0 R /XYZ 84.259843 799.370079 0 ] (cb1-1) [ 311 0 R /XYZ 101.433071 797.673057 0 ] (cb101) [ 618 0 R /XYZ 84.259843 372.020079 0 ] (cb101-1) [ 618 0 R /XYZ 101.433071 370.323057 0 ] (cb104) [ 623 0 R /XYZ 84.259843 596.570079 0 ] (cb104-1) [ 623 0 R /XYZ 101.433071 594.873057 0 ] (cb107) [ 626 0 R /XYZ 84.259843 120.770079 0 ] (cb107-1) [ 626 0 R /XYZ 101.433071 119.073057 0 ] (cb11) [ 427 0 R /XYZ 84.259843 380.231993 0 ] (cb11-1) [ 427 0 R /XYZ 101.433071 378.534971 0 ] (cb11-10) [ 427 0 R /XYZ 99.933071 170.117735 0 ] (cb11-11) [ 427 0 R /XYZ 99.933071 151.170714 0 ] (cb11-12) [ 427 0 R /XYZ 99.933071 132.223692 0 ] (cb11-13) [ 427 0 R /XYZ 99.933071 113.276671 0 ] (cb11-14) [ 427 0 R /XYZ 99.933071 94.329649 0 ] (cb11-15) [ 446 0 R /XYZ 99.933071 799.173057 0 ] (cb11-16) [ 446 0 R /XYZ 99.933071 780.226036 0 ] (cb11-17) [ 446 0 R /XYZ 99.933071 761.279014 0 ] (cb11-18) [ 446 0 R /XYZ 99.933071 742.331993 0 ] (cb11-19) [ 446 0 R /XYZ 99.933071 723.384971 0 ] (cb11-2) [ 427 0 R /XYZ 99.933071 359.587950 0 ] (cb11-20) [ 446 0 R /XYZ 99.933071 704.437950 0 ] (cb11-21) [ 446 0 R /XYZ 99.933071 685.490928 0 ] (cb11-22) [ 446 0 R /XYZ 99.933071 666.543907 0 ] (cb11-23) [ 446 0 R /XYZ 99.933071 647.596885 0 ] (cb11-24) [ 446 0 R /XYZ 99.933071 628.649864 0 ] (cb11-25) [ 446 0 R /XYZ 99.933071 609.702842 0 ] (cb11-26) [ 446 0 R /XYZ 99.933071 590.755821 0 ] (cb11-27) [ 446 0 R /XYZ 99.933071 571.808799 0 ] (cb11-28) [ 446 0 R /XYZ 99.933071 552.861778 0 ] (cb11-29) [ 446 0 R /XYZ 99.933071 533.914756 0 ] (cb11-3) [ 427 0 R /XYZ 99.933071 340.640928 0 ] (cb11-30) [ 446 0 R /XYZ 99.933071 514.967735 0 ] (cb11-31) [ 446 0 R /XYZ 99.933071 496.020714 0 ] (cb11-32) [ 446 0 R /XYZ 99.933071 477.073692 0 ] (cb11-33) [ 446 0 R /XYZ 99.933071 458.126671 0 ] (cb11-34) [ 446 0 R /XYZ 99.933071 439.179649 0 ] (cb11-35) [ 446 0 R /XYZ 99.933071 420.232628 0 ] (cb11-36) [ 446 0 R /XYZ 99.933071 401.285606 0 ] (cb11-37) [ 446 0 R /XYZ 99.933071 382.338585 0 ] (cb11-38) [ 446 0 R /XYZ 99.933071 363.391563 0 ] (cb11-39) [ 446 0 R /XYZ 99.933071 344.444542 0 ] (cb11-4) [ 427 0 R /XYZ 99.933071 302.746885 0 ] (cb11-40) [ 446 0 R /XYZ 99.933071 325.497520 0 ] (cb11-41) [ 446 0 R /XYZ 99.933071 306.550499 0 ] (cb11-42) [ 446 0 R /XYZ 99.933071 287.603477 0 ] (cb11-43) [ 446 0 R /XYZ 99.933071 268.656456 0 ] (cb11-44) [ 446 0 R /XYZ 99.933071 249.709434 0 ] (cb11-45) [ 446 0 R /XYZ 99.933071 230.762413 0 ] (cb11-46) [ 446 0 R /XYZ 99.933071 211.815391 0 ] (cb11-47) [ 446 0 R /XYZ 99.933071 192.868370 0 ] (cb11-48) [ 446 0 R /XYZ 99.933071 173.921348 0 ] (cb11-49) [ 446 0 R /XYZ 99.933071 154.974327 0 ] (cb11-5) [ 427 0 R /XYZ 99.933071 264.852842 0 ] (cb11-50) [ 446 0 R /XYZ 99.933071 136.027305 0 ] (cb11-51) [ 446 0 R /XYZ 99.933071 117.080284 0 ] (cb11-52) [ 446 0 R /XYZ 99.933071 98.133262 0 ] (cb11-53) [ 486 0 R /XYZ 99.933071 780.226036 0 ] (cb11-54) [ 486 0 R /XYZ 99.933071 761.279014 0 ] (cb11-55) [ 486 0 R /XYZ 99.933071 742.331993 0 ] (cb11-56) [ 486 0 R /XYZ 99.933071 723.384971 0 ] (cb11-57) [ 486 0 R /XYZ 99.933071 704.437950 0 ] (cb11-58) [ 486 0 R /XYZ 99.933071 685.490928 0 ] (cb11-59) [ 486 0 R /XYZ 99.933071 666.543907 0 ] (cb11-6) [ 427 0 R /XYZ 99.933071 245.905821 0 ] (cb11-60) [ 486 0 R /XYZ 99.933071 647.596885 0 ] (cb11-61) [ 486 0 R /XYZ 99.933071 628.649864 0 ] (cb11-7) [ 427 0 R /XYZ 99.933071 226.958799 0 ] (cb11-8) [ 427 0 R /XYZ 99.933071 208.011778 0 ] (cb11-9) [ 427 0 R /XYZ 99.933071 189.064756 0 ] (cb110) [ 631 0 R /XYZ 84.259843 387.020079 0 ] (cb110-1) [ 631 0 R /XYZ 101.433071 385.323057 0 ] (cb113) [ 636 0 R /XYZ 84.259843 611.570079 0 ] (cb113-1) [ 636 0 R /XYZ 101.433071 609.873057 0 ] (cb116) [ 639 0 R /XYZ 84.259843 169.520079 0 ] (cb116-1) [ 639 0 R /XYZ 101.433071 167.823057 0 ] (cb116-10) [ 645 0 R /XYZ 99.933071 666.543907 0 ] (cb116-11) [ 645 0 R /XYZ 99.933071 647.596885 0 ] (cb116-12) [ 645 0 R /XYZ 99.933071 628.649864 0 ] (cb116-13) [ 645 0 R /XYZ 99.933071 609.702842 0 ] (cb116-14) [ 645 0 R /XYZ 99.933071 590.755821 0 ] (cb116-15) [ 645 0 R /XYZ 99.933071 571.808799 0 ] (cb116-16) [ 645 0 R /XYZ 99.933071 552.861778 0 ] (cb116-17) [ 645 0 R /XYZ 99.933071 533.914756 0 ] (cb116-18) [ 645 0 R /XYZ 99.933071 514.967735 0 ] (cb116-19) [ 645 0 R /XYZ 99.933071 496.020714 0 ] (cb116-2) [ 639 0 R /XYZ 99.933071 148.876036 0 ] (cb116-20) [ 645 0 R /XYZ 99.933071 477.073692 0 ] (cb116-21) [ 645 0 R /XYZ 99.933071 458.126671 0 ] (cb116-22) [ 645 0 R /XYZ 99.933071 439.179649 0 ] (cb116-23) [ 645 0 R /XYZ 99.933071 420.232628 0 ] (cb116-24) [ 645 0 R /XYZ 99.933071 401.285606 0 ] (cb116-25) [ 645 0 R /XYZ 99.933071 382.338585 0 ] (cb116-3) [ 639 0 R /XYZ 99.933071 129.929014 0 ] (cb116-4) [ 639 0 R /XYZ 99.933071 92.034971 0 ] (cb116-5) [ 645 0 R /XYZ 99.933071 799.173057 0 ] (cb116-6) [ 645 0 R /XYZ 99.933071 780.226036 0 ] (cb116-7) [ 645 0 R /XYZ 99.933071 761.279014 0 ] (cb116-8) [ 645 0 R /XYZ 99.933071 742.331993 0 ] (cb116-9) [ 645 0 R /XYZ 99.933071 704.437950 0 ] (cb117) [ 645 0 R /XYZ 84.259843 323.088585 0 ] (cb117-1) [ 645 0 R /XYZ 101.433071 321.391563 0 ] (cb12) [ 486 0 R /XYZ 84.259843 569.399864 0 ] (cb12-1) [ 486 0 R /XYZ 101.433071 567.702842 0 ] (cb120) [ 669 0 R /XYZ 84.259843 655.370079 0 ] (cb120-1) [ 669 0 R /XYZ 101.433071 653.673057 0 ] (cb121) [ 672 0 R /XYZ 84.259843 530.991496 0 ] (cb121-1) [ 672 0 R /XYZ 101.433071 529.294475 0 ] (cb124) [ 675 0 R /XYZ 84.259843 715.370079 0 ] (cb124-1) [ 675 0 R /XYZ 101.433071 713.673057 0 ] (cb127) [ 675 0 R /XYZ 84.259843 157.323057 0 ] (cb127-1) [ 675 0 R /XYZ 101.433071 155.626036 0 ] (cb130) [ 679 0 R /XYZ 84.259843 306.020079 0 ] (cb130-1) [ 679 0 R /XYZ 101.433071 304.323057 0 ] (cb133) [ 682 0 R /XYZ 84.259843 458.270079 0 ] (cb133-1) [ 682 0 R /XYZ 101.433071 456.573057 0 ] (cb136) [ 685 0 R /XYZ 84.259843 433.970079 0 ] (cb136-1) [ 685 0 R /XYZ 101.433071 432.273057 0 ] (cb139) [ 690 0 R /XYZ 84.259843 560.991496 0 ] (cb139-1) [ 690 0 R /XYZ 101.433071 559.294475 0 ] (cb142) [ 690 0 R /XYZ 84.259843 205.444475 0 ] (cb142-1) [ 690 0 R /XYZ 101.433071 203.747453 0 ] (cb145) [ 696 0 R /XYZ 84.259843 509.991496 0 ] (cb145-1) [ 696 0 R /XYZ 101.433071 508.294475 0 ] (cb148) [ 701 0 R /XYZ 84.259843 379.520079 0 ] (cb148-1) [ 701 0 R /XYZ 101.433071 377.823057 0 ] (cb15) [ 486 0 R /XYZ 84.259843 221.352842 0 ] (cb15-1) [ 486 0 R /XYZ 101.433071 219.655821 0 ] (cb151) [ 706 0 R /XYZ 84.259843 248.270079 0 ] (cb151-1) [ 706 0 R /XYZ 101.433071 246.573057 0 ] (cb154) [ 713 0 R /XYZ 84.259843 799.370079 0 ] (cb154-1) [ 713 0 R /XYZ 101.433071 797.673057 0 ] (cb157) [ 718 0 R /XYZ 84.259843 641.570079 0 ] (cb157-1) [ 718 0 R /XYZ 101.433071 639.873057 0 ] (cb160) [ 723 0 R /XYZ 84.259843 492.020079 0 ] (cb160-1) [ 723 0 R /XYZ 101.433071 490.323057 0 ] (cb163) [ 728 0 R /XYZ 84.259843 327.020079 0 ] (cb163-1) [ 728 0 R /XYZ 101.433071 325.323057 0 ] (cb166) [ 737 0 R /XYZ 84.259843 590.991496 0 ] (cb166-1) [ 737 0 R /XYZ 101.433071 589.294475 0 ] (cb169) [ 742 0 R /XYZ 84.259843 238.791496 0 ] (cb169-1) [ 742 0 R /XYZ 101.433071 237.094475 0 ] (cb172) [ 745 0 R /XYZ 84.259843 576.020079 0 ] (cb172-1) [ 745 0 R /XYZ 101.433071 574.323057 0 ] (cb174) [ 745 0 R /XYZ 84.259843 247.079014 0 ] (cb174-1) [ 745 0 R /XYZ 101.433071 245.381993 0 ] (cb176) [ 749 0 R /XYZ 84.259843 641.570079 0 ] (cb176-1) [ 749 0 R /XYZ 101.433071 639.873057 0 ] (cb179) [ 749 0 R /XYZ 84.259843 281.879014 0 ] (cb179-1) [ 749 0 R /XYZ 101.433071 280.181993 0 ] (cb179-2) [ 749 0 R /XYZ 99.933071 261.234971 0 ] (cb179-3) [ 749 0 R /XYZ 99.933071 242.287950 0 ] (cb179-4) [ 749 0 R /XYZ 99.933071 185.446885 0 ] (cb179-5) [ 749 0 R /XYZ 99.933071 166.499864 0 ] (cb18) [ 499 0 R /XYZ 84.259843 569.570079 0 ] (cb18-1) [ 499 0 R /XYZ 101.433071 567.873057 0 ] (cb180) [ 749 0 R /XYZ 84.259843 107.249864 0 ] (cb180-1) [ 749 0 R /XYZ 101.433071 105.552842 0 ] (cb182) [ 758 0 R /XYZ 84.259843 587.270079 0 ] (cb182-1) [ 758 0 R /XYZ 101.433071 585.573057 0 ] (cb182-2) [ 758 0 R /XYZ 99.933071 566.626036 0 ] (cb182-3) [ 758 0 R /XYZ 99.933071 547.679014 0 ] (cb182-4) [ 758 0 R /XYZ 99.933071 490.837950 0 ] (cb182-5) [ 758 0 R /XYZ 99.933071 471.890928 0 ] (cb183) [ 758 0 R /XYZ 84.259843 412.640928 0 ] (cb183-1) [ 758 0 R /XYZ 101.433071 410.943907 0 ] (cb185) [ 768 0 R /XYZ 84.259843 485.991496 0 ] (cb185-1) [ 768 0 R /XYZ 101.433071 484.294475 0 ] (cb186) [ 768 0 R /XYZ 84.259843 425.044475 0 ] (cb186-1) [ 768 0 R /XYZ 101.433071 423.347453 0 ] (cb188) [ 768 0 R /XYZ 84.259843 107.747453 0 ] (cb188-1) [ 768 0 R /XYZ 101.433071 106.050432 0 ] (cb189) [ 773 0 R /XYZ 84.259843 772.370079 0 ] (cb189-1) [ 773 0 R /XYZ 101.433071 770.673057 0 ] (cb191) [ 773 0 R /XYZ 84.259843 455.073057 0 ] (cb191-1) [ 773 0 R /XYZ 101.433071 453.376036 0 ] (cb192) [ 773 0 R /XYZ 84.259843 394.126036 0 ] (cb192-1) [ 773 0 R /XYZ 101.433071 392.429014 0 ] (cb194) [ 778 0 R /XYZ 84.259843 799.370079 0 ] (cb194-1) [ 778 0 R /XYZ 101.433071 797.673057 0 ] (cb195) [ 778 0 R /XYZ 84.259843 738.423057 0 ] (cb195-1) [ 778 0 R /XYZ 101.433071 736.726036 0 ] (cb197) [ 778 0 R /XYZ 84.259843 406.126036 0 ] (cb197-1) [ 778 0 R /XYZ 101.433071 404.429014 0 ] (cb198) [ 778 0 R /XYZ 84.259843 345.179014 0 ] (cb198-1) [ 778 0 R /XYZ 101.433071 343.481993 0 ] (cb2) [ 311 0 R /XYZ 84.259843 617.823057 0 ] (cb2-1) [ 311 0 R /XYZ 101.433071 616.126036 0 ] (cb201) [ 784 0 R /XYZ 84.259843 225.770079 0 ] (cb201-1) [ 784 0 R /XYZ 101.433071 224.073057 0 ] (cb202) [ 784 0 R /XYZ 84.259843 164.823057 0 ] (cb202-1) [ 784 0 R /XYZ 101.433071 163.126036 0 ] (cb204) [ 788 0 R /XYZ 84.259843 581.570079 0 ] (cb204-1) [ 788 0 R /XYZ 101.433071 579.873057 0 ] (cb205) [ 788 0 R /XYZ 84.259843 520.623057 0 ] (cb205-1) [ 788 0 R /XYZ 101.433071 518.926036 0 ] (cb207) [ 792 0 R /XYZ 84.259843 685.370079 0 ] (cb207-1) [ 792 0 R /XYZ 101.433071 683.673057 0 ] (cb208) [ 792 0 R /XYZ 84.259843 624.423057 0 ] (cb208-1) [ 792 0 R /XYZ 101.433071 622.726036 0 ] (cb21) [ 502 0 R /XYZ 84.259843 560.991496 0 ] (cb21-1) [ 502 0 R /XYZ 101.433071 559.294475 0 ] (cb210) [ 792 0 R /XYZ 84.259843 262.126036 0 ] (cb210-1) [ 792 0 R /XYZ 101.433071 260.429014 0 ] (cb211) [ 792 0 R /XYZ 84.259843 201.179014 0 ] (cb211-1) [ 792 0 R /XYZ 101.433071 199.481993 0 ] (cb213) [ 798 0 R /XYZ 84.259843 566.570079 0 ] (cb213-1) [ 798 0 R /XYZ 101.433071 564.873057 0 ] (cb214) [ 798 0 R /XYZ 84.259843 505.623057 0 ] (cb214-1) [ 798 0 R /XYZ 101.433071 503.926036 0 ] (cb217) [ 802 0 R /XYZ 84.259843 333.770079 0 ] (cb217-1) [ 802 0 R /XYZ 101.433071 332.073057 0 ] (cb218) [ 805 0 R /XYZ 84.259843 772.370079 0 ] (cb218-1) [ 805 0 R /XYZ 101.433071 770.673057 0 ] (cb219) [ 805 0 R /XYZ 84.259843 711.423057 0 ] (cb219-1) [ 805 0 R /XYZ 101.433071 709.726036 0 ] (cb221) [ 811 0 R /XYZ 84.259843 726.620079 0 ] (cb221-1) [ 811 0 R /XYZ 101.433071 724.923057 0 ] (cb221-10) [ 811 0 R /XYZ 99.933071 554.399864 0 ] (cb221-11) [ 811 0 R /XYZ 99.933071 535.452842 0 ] (cb221-12) [ 811 0 R /XYZ 99.933071 440.717735 0 ] (cb221-13) [ 811 0 R /XYZ 99.933071 421.770714 0 ] (cb221-14) [ 811 0 R /XYZ 99.933071 402.823692 0 ] (cb221-15) [ 811 0 R /XYZ 99.933071 383.876671 0 ] (cb221-16) [ 811 0 R /XYZ 99.933071 364.929649 0 ] (cb221-17) [ 811 0 R /XYZ 99.933071 345.982628 0 ] (cb221-18) [ 811 0 R /XYZ 99.933071 308.088585 0 ] (cb221-19) [ 811 0 R /XYZ 99.933071 289.141563 0 ] (cb221-2) [ 811 0 R /XYZ 99.933071 705.976036 0 ] (cb221-20) [ 811 0 R /XYZ 99.933071 156.512413 0 ] (cb221-21) [ 811 0 R /XYZ 99.933071 137.565391 0 ] (cb221-22) [ 811 0 R /XYZ 99.933071 118.618370 0 ] (cb221-23) [ 835 0 R /XYZ 99.933071 780.226036 0 ] (cb221-24) [ 835 0 R /XYZ 99.933071 761.279014 0 ] (cb221-25) [ 835 0 R /XYZ 99.933071 742.331993 0 ] (cb221-26) [ 835 0 R /XYZ 99.933071 723.384971 0 ] (cb221-27) [ 835 0 R /XYZ 99.933071 704.437950 0 ] (cb221-28) [ 835 0 R /XYZ 99.933071 685.490928 0 ] (cb221-29) [ 835 0 R /XYZ 99.933071 666.543907 0 ] (cb221-3) [ 811 0 R /XYZ 99.933071 687.029014 0 ] (cb221-30) [ 835 0 R /XYZ 99.933071 647.596885 0 ] (cb221-31) [ 835 0 R /XYZ 99.933071 628.649864 0 ] (cb221-4) [ 811 0 R /XYZ 99.933071 668.081993 0 ] (cb221-5) [ 811 0 R /XYZ 99.933071 649.134971 0 ] (cb221-6) [ 811 0 R /XYZ 99.933071 630.187950 0 ] (cb221-7) [ 811 0 R /XYZ 99.933071 611.240928 0 ] (cb221-8) [ 811 0 R /XYZ 99.933071 592.293907 0 ] (cb221-9) [ 811 0 R /XYZ 99.933071 573.346885 0 ] (cb222) [ 835 0 R /XYZ 84.259843 569.399864 0 ] (cb222-1) [ 835 0 R /XYZ 101.433071 567.702842 0 ] (cb225) [ 847 0 R /XYZ 84.259843 410.391496 0 ] (cb225-1) [ 847 0 R /XYZ 101.433071 408.694475 0 ] (cb228) [ 850 0 R /XYZ 84.259843 772.370079 0 ] (cb228-1) [ 850 0 R /XYZ 101.433071 770.673057 0 ] (cb231) [ 850 0 R /XYZ 84.259843 401.429014 0 ] (cb231-1) [ 850 0 R /XYZ 101.433071 399.731993 0 ] (cb234) [ 854 0 R /XYZ 84.259843 772.370079 0 ] (cb234-1) [ 854 0 R /XYZ 101.433071 770.673057 0 ] (cb237) [ 859 0 R /XYZ 84.259843 385.641496 0 ] (cb237-1) [ 859 0 R /XYZ 101.433071 383.944475 0 ] (cb237-10) [ 859 0 R /XYZ 99.933071 213.421281 0 ] (cb237-11) [ 859 0 R /XYZ 99.933071 194.474260 0 ] (cb237-12) [ 859 0 R /XYZ 99.933071 156.580217 0 ] (cb237-13) [ 859 0 R /XYZ 99.933071 118.686174 0 ] (cb237-14) [ 859 0 R /XYZ 99.933071 99.739152 0 ] (cb237-15) [ 875 0 R /XYZ 99.933071 799.173057 0 ] (cb237-16) [ 875 0 R /XYZ 99.933071 780.226036 0 ] (cb237-17) [ 875 0 R /XYZ 99.933071 761.279014 0 ] (cb237-18) [ 875 0 R /XYZ 99.933071 742.331993 0 ] (cb237-19) [ 875 0 R /XYZ 99.933071 723.384971 0 ] (cb237-2) [ 859 0 R /XYZ 99.933071 364.997453 0 ] (cb237-3) [ 859 0 R /XYZ 99.933071 346.050432 0 ] (cb237-4) [ 859 0 R /XYZ 99.933071 327.103410 0 ] (cb237-5) [ 859 0 R /XYZ 99.933071 308.156389 0 ] (cb237-6) [ 859 0 R /XYZ 99.933071 289.209367 0 ] (cb237-7) [ 859 0 R /XYZ 99.933071 270.262346 0 ] (cb237-8) [ 859 0 R /XYZ 99.933071 251.315324 0 ] (cb237-9) [ 859 0 R /XYZ 99.933071 232.368303 0 ] (cb238) [ 875 0 R /XYZ 84.259843 664.134971 0 ] (cb238-1) [ 875 0 R /XYZ 101.433071 662.437950 0 ] (cb24) [ 505 0 R /XYZ 84.259843 102.020079 0 ] (cb24-1) [ 505 0 R /XYZ 101.433071 100.323057 0 ] (cb241) [ 889 0 R /XYZ 84.259843 711.620079 0 ] (cb241-1) [ 889 0 R /XYZ 101.433071 709.923057 0 ] (cb241-10) [ 889 0 R /XYZ 99.933071 539.399864 0 ] (cb241-11) [ 889 0 R /XYZ 99.933071 520.452842 0 ] (cb241-12) [ 889 0 R /XYZ 99.933071 463.611778 0 ] (cb241-13) [ 889 0 R /XYZ 99.933071 444.664756 0 ] (cb241-14) [ 889 0 R /XYZ 99.933071 425.717735 0 ] (cb241-15) [ 889 0 R /XYZ 99.933071 406.770714 0 ] (cb241-16) [ 889 0 R /XYZ 99.933071 387.823692 0 ] (cb241-17) [ 889 0 R /XYZ 99.933071 368.876671 0 ] (cb241-18) [ 889 0 R /XYZ 99.933071 349.929649 0 ] (cb241-2) [ 889 0 R /XYZ 99.933071 690.976036 0 ] (cb241-3) [ 889 0 R /XYZ 99.933071 672.029014 0 ] (cb241-4) [ 889 0 R /XYZ 99.933071 653.081993 0 ] (cb241-5) [ 889 0 R /XYZ 99.933071 634.134971 0 ] (cb241-6) [ 889 0 R /XYZ 99.933071 615.187950 0 ] (cb241-7) [ 889 0 R /XYZ 99.933071 596.240928 0 ] (cb241-8) [ 889 0 R /XYZ 99.933071 577.293907 0 ] (cb241-9) [ 889 0 R /XYZ 99.933071 558.346885 0 ] (cb242) [ 889 0 R /XYZ 84.259843 290.679649 0 ] (cb242-1) [ 889 0 R /XYZ 101.433071 288.982628 0 ] (cb27) [ 510 0 R /XYZ 84.259843 383.270079 0 ] (cb27-1) [ 510 0 R /XYZ 101.433071 381.573057 0 ] (cb3) [ 315 0 R /XYZ 84.259843 351.620079 0 ] (cb3-1) [ 315 0 R /XYZ 101.433071 349.923057 0 ] (cb3-10) [ 315 0 R /XYZ 99.933071 160.452842 0 ] (cb3-11) [ 315 0 R /XYZ 99.933071 141.505821 0 ] (cb3-12) [ 315 0 R /XYZ 99.933071 122.558799 0 ] (cb3-13) [ 315 0 R /XYZ 99.933071 103.611778 0 ] (cb3-14) [ 330 0 R /XYZ 99.933071 799.173057 0 ] (cb3-15) [ 330 0 R /XYZ 99.933071 780.226036 0 ] (cb3-16) [ 330 0 R /XYZ 99.933071 761.279014 0 ] (cb3-17) [ 330 0 R /XYZ 99.933071 742.331993 0 ] (cb3-18) [ 330 0 R /XYZ 99.933071 723.384971 0 ] (cb3-19) [ 330 0 R /XYZ 99.933071 704.437950 0 ] (cb3-2) [ 315 0 R /XYZ 99.933071 330.976036 0 ] (cb3-20) [ 330 0 R /XYZ 99.933071 685.490928 0 ] (cb3-21) [ 330 0 R /XYZ 99.933071 666.543907 0 ] (cb3-22) [ 330 0 R /XYZ 99.933071 647.596885 0 ] (cb3-23) [ 330 0 R /XYZ 99.933071 628.649864 0 ] (cb3-24) [ 330 0 R /XYZ 99.933071 609.702842 0 ] (cb3-25) [ 330 0 R /XYZ 99.933071 590.755821 0 ] (cb3-26) [ 330 0 R /XYZ 99.933071 571.808799 0 ] (cb3-27) [ 330 0 R /XYZ 99.933071 552.861778 0 ] (cb3-28) [ 330 0 R /XYZ 99.933071 533.914756 0 ] (cb3-29) [ 330 0 R /XYZ 99.933071 514.967735 0 ] (cb3-3) [ 315 0 R /XYZ 99.933071 312.029014 0 ] (cb3-30) [ 330 0 R /XYZ 99.933071 496.020714 0 ] (cb3-31) [ 330 0 R /XYZ 99.933071 477.073692 0 ] (cb3-32) [ 330 0 R /XYZ 99.933071 458.126671 0 ] (cb3-33) [ 330 0 R /XYZ 99.933071 439.179649 0 ] (cb3-34) [ 330 0 R /XYZ 99.933071 420.232628 0 ] (cb3-35) [ 330 0 R /XYZ 99.933071 401.285606 0 ] (cb3-36) [ 330 0 R /XYZ 99.933071 382.338585 0 ] (cb3-37) [ 330 0 R /XYZ 99.933071 363.391563 0 ] (cb3-38) [ 330 0 R /XYZ 99.933071 344.444542 0 ] (cb3-39) [ 330 0 R /XYZ 99.933071 325.497520 0 ] (cb3-4) [ 315 0 R /XYZ 99.933071 274.134971 0 ] (cb3-40) [ 330 0 R /XYZ 99.933071 306.550499 0 ] (cb3-41) [ 330 0 R /XYZ 99.933071 287.603477 0 ] (cb3-42) [ 330 0 R /XYZ 99.933071 268.656456 0 ] (cb3-43) [ 330 0 R /XYZ 99.933071 249.709434 0 ] (cb3-44) [ 330 0 R /XYZ 99.933071 230.762413 0 ] (cb3-5) [ 315 0 R /XYZ 99.933071 255.187950 0 ] (cb3-6) [ 315 0 R /XYZ 99.933071 236.240928 0 ] (cb3-7) [ 315 0 R /XYZ 99.933071 217.293907 0 ] (cb3-8) [ 315 0 R /XYZ 99.933071 198.346885 0 ] (cb3-9) [ 315 0 R /XYZ 99.933071 179.399864 0 ] (cb30) [ 515 0 R /XYZ 84.259843 641.570079 0 ] (cb30-1) [ 515 0 R /XYZ 101.433071 639.873057 0 ] (cb33) [ 518 0 R /XYZ 84.259843 113.270079 0 ] (cb33-1) [ 518 0 R /XYZ 101.433071 111.573057 0 ] (cb36) [ 523 0 R /XYZ 84.259843 334.520079 0 ] (cb36-1) [ 523 0 R /XYZ 101.433071 332.823057 0 ] (cb39) [ 528 0 R /XYZ 84.259843 570.770079 0 ] (cb39-1) [ 528 0 R /XYZ 101.433071 569.073057 0 ] (cb4) [ 330 0 R /XYZ 84.259843 171.512413 0 ] (cb4-1) [ 330 0 R /XYZ 101.433071 169.815391 0 ] (cb42) [ 531 0 R /XYZ 84.259843 120.770079 0 ] (cb42-1) [ 531 0 R /XYZ 101.433071 119.073057 0 ] (cb45) [ 536 0 R /XYZ 84.259843 402.020079 0 ] (cb45-1) [ 536 0 R /XYZ 101.433071 400.323057 0 ] (cb48) [ 541 0 R /XYZ 84.259843 611.570079 0 ] (cb48-1) [ 541 0 R /XYZ 101.433071 609.873057 0 ] (cb51) [ 546 0 R /XYZ 84.259843 799.370079 0 ] (cb51-1) [ 546 0 R /XYZ 101.433071 797.673057 0 ] (cb54) [ 549 0 R /XYZ 84.259843 252.020079 0 ] (cb54-1) [ 549 0 R /XYZ 101.433071 250.323057 0 ] (cb55) [ 552 0 R /XYZ 84.259843 730.370079 0 ] (cb55-1) [ 552 0 R /XYZ 101.433071 728.673057 0 ] (cb56) [ 552 0 R /XYZ 84.259843 503.823057 0 ] (cb56-1) [ 552 0 R /XYZ 101.433071 502.126036 0 ] (cb59) [ 558 0 R /XYZ 84.259843 730.370079 0 ] (cb59-1) [ 558 0 R /XYZ 101.433071 728.673057 0 ] (cb62) [ 561 0 R /XYZ 84.259843 222.020079 0 ] (cb62-1) [ 561 0 R /XYZ 101.433071 220.323057 0 ] (cb65) [ 566 0 R /XYZ 84.259843 353.270079 0 ] (cb65-1) [ 566 0 R /XYZ 101.433071 351.573057 0 ] (cb68) [ 571 0 R /XYZ 84.259843 548.270079 0 ] (cb68-1) [ 571 0 R /XYZ 101.433071 546.573057 0 ] (cb7) [ 364 0 R /XYZ 84.259843 557.270079 0 ] (cb7-1) [ 364 0 R /XYZ 101.433071 555.573057 0 ] (cb7-10) [ 364 0 R /XYZ 99.933071 347.155821 0 ] (cb7-11) [ 364 0 R /XYZ 99.933071 328.208799 0 ] (cb7-12) [ 364 0 R /XYZ 99.933071 309.261778 0 ] (cb7-13) [ 364 0 R /XYZ 99.933071 290.314756 0 ] (cb7-14) [ 364 0 R /XYZ 99.933071 271.367735 0 ] (cb7-15) [ 364 0 R /XYZ 99.933071 252.420714 0 ] (cb7-16) [ 364 0 R /XYZ 99.933071 233.473692 0 ] (cb7-17) [ 364 0 R /XYZ 99.933071 214.526671 0 ] (cb7-18) [ 364 0 R /XYZ 99.933071 195.579649 0 ] (cb7-19) [ 364 0 R /XYZ 99.933071 176.632628 0 ] (cb7-2) [ 364 0 R /XYZ 99.933071 536.626036 0 ] (cb7-20) [ 364 0 R /XYZ 99.933071 157.685606 0 ] (cb7-21) [ 364 0 R /XYZ 99.933071 138.738585 0 ] (cb7-22) [ 364 0 R /XYZ 99.933071 119.791563 0 ] (cb7-23) [ 364 0 R /XYZ 99.933071 100.844542 0 ] (cb7-24) [ 389 0 R /XYZ 99.933071 799.173057 0 ] (cb7-25) [ 389 0 R /XYZ 99.933071 780.226036 0 ] (cb7-26) [ 389 0 R /XYZ 99.933071 761.279014 0 ] (cb7-27) [ 389 0 R /XYZ 99.933071 742.331993 0 ] (cb7-28) [ 389 0 R /XYZ 99.933071 723.384971 0 ] (cb7-29) [ 389 0 R /XYZ 99.933071 704.437950 0 ] (cb7-3) [ 364 0 R /XYZ 99.933071 517.679014 0 ] (cb7-30) [ 389 0 R /XYZ 99.933071 685.490928 0 ] (cb7-31) [ 389 0 R /XYZ 99.933071 666.543907 0 ] (cb7-32) [ 389 0 R /XYZ 99.933071 647.596885 0 ] (cb7-33) [ 389 0 R /XYZ 99.933071 628.649864 0 ] (cb7-34) [ 389 0 R /XYZ 99.933071 609.702842 0 ] (cb7-35) [ 389 0 R /XYZ 99.933071 590.755821 0 ] (cb7-36) [ 389 0 R /XYZ 99.933071 571.808799 0 ] (cb7-37) [ 389 0 R /XYZ 99.933071 552.861778 0 ] (cb7-38) [ 389 0 R /XYZ 99.933071 533.914756 0 ] (cb7-39) [ 389 0 R /XYZ 99.933071 514.967735 0 ] (cb7-4) [ 364 0 R /XYZ 99.933071 479.784971 0 ] (cb7-40) [ 389 0 R /XYZ 99.933071 496.020714 0 ] (cb7-41) [ 389 0 R /XYZ 99.933071 477.073692 0 ] (cb7-42) [ 389 0 R /XYZ 99.933071 458.126671 0 ] (cb7-43) [ 389 0 R /XYZ 99.933071 439.179649 0 ] (cb7-44) [ 389 0 R /XYZ 99.933071 420.232628 0 ] (cb7-45) [ 389 0 R /XYZ 99.933071 401.285606 0 ] (cb7-46) [ 389 0 R /XYZ 99.933071 382.338585 0 ] (cb7-47) [ 389 0 R /XYZ 99.933071 363.391563 0 ] (cb7-48) [ 389 0 R /XYZ 99.933071 344.444542 0 ] (cb7-49) [ 389 0 R /XYZ 99.933071 325.497520 0 ] (cb7-5) [ 364 0 R /XYZ 99.933071 441.890928 0 ] (cb7-50) [ 389 0 R /XYZ 99.933071 306.550499 0 ] (cb7-51) [ 389 0 R /XYZ 99.933071 287.603477 0 ] (cb7-52) [ 389 0 R /XYZ 99.933071 268.656456 0 ] (cb7-53) [ 389 0 R /XYZ 99.933071 230.762413 0 ] (cb7-54) [ 389 0 R /XYZ 99.933071 211.815391 0 ] (cb7-55) [ 389 0 R /XYZ 99.933071 192.868370 0 ] (cb7-56) [ 389 0 R /XYZ 99.933071 173.921348 0 ] (cb7-57) [ 389 0 R /XYZ 99.933071 154.974327 0 ] (cb7-58) [ 389 0 R /XYZ 99.933071 136.027305 0 ] (cb7-59) [ 389 0 R /XYZ 99.933071 117.080284 0 ] (cb7-6) [ 364 0 R /XYZ 99.933071 422.943907 0 ] (cb7-60) [ 427 0 R /XYZ 99.933071 799.173057 0 ] (cb7-61) [ 427 0 R /XYZ 99.933071 780.226036 0 ] (cb7-7) [ 364 0 R /XYZ 99.933071 403.996885 0 ] (cb7-8) [ 364 0 R /XYZ 99.933071 385.049864 0 ] (cb7-9) [ 364 0 R /XYZ 99.933071 366.102842 0 ] (cb71) [ 574 0 R /XYZ 84.259843 98.270079 0 ] (cb71-1) [ 574 0 R /XYZ 101.433071 96.573057 0 ] (cb74) [ 579 0 R /XYZ 84.259843 383.270079 0 ] (cb74-1) [ 579 0 R /XYZ 101.433071 381.573057 0 ] (cb77) [ 584 0 R /XYZ 84.259843 641.570079 0 ] (cb77-1) [ 584 0 R /XYZ 101.433071 639.873057 0 ] (cb8) [ 427 0 R /XYZ 84.259843 720.976036 0 ] (cb8-1) [ 427 0 R /XYZ 101.433071 719.279014 0 ] (cb80) [ 587 0 R /XYZ 84.259843 162.020079 0 ] (cb80-1) [ 587 0 R /XYZ 101.433071 160.323057 0 ] (cb83) [ 592 0 R /XYZ 84.259843 424.520079 0 ] (cb83-1) [ 592 0 R /XYZ 101.433071 422.823057 0 ] (cb86) [ 597 0 R /XYZ 84.259843 611.570079 0 ] (cb86-1) [ 597 0 R /XYZ 101.433071 609.873057 0 ] (cb89) [ 600 0 R /XYZ 84.259843 143.270079 0 ] (cb89-1) [ 600 0 R /XYZ 101.433071 141.573057 0 ] (cb92) [ 605 0 R /XYZ 84.259843 417.020079 0 ] (cb92-1) [ 605 0 R /XYZ 101.433071 415.323057 0 ] (cb95) [ 610 0 R /XYZ 84.259843 611.570079 0 ] (cb95-1) [ 610 0 R /XYZ 101.433071 609.873057 0 ] (cb98) [ 613 0 R /XYZ 84.259843 139.520079 0 ] (cb98-1) [ 613 0 R /XYZ 101.433071 137.823057 0 ] (cis-v1.6-kubernetes-benchmark---rancher-v2.6-with-kubernetes-v1.18-to-v1.21) [ 298 0 R /XYZ 84.259843 782.570079 0 ] (client-certificate-authentication-should-not-be-used-for-users-manual) [ 735 0 R /XYZ 84.259843 682.791496 0 ] (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) [ 885 0 R /XYZ 84.259843 682.791496 0 ] (consider-external-secret-storage-manual) [ 883 0 R /XYZ 84.259843 562.191496 0 ] (contentsbox) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (controller-manager) [ 672 0 R /XYZ 41.740157 784.430079 0 ] (controls) [ 303 0 R /XYZ 84.259843 609.981496 0 ] (create-administrative-boundaries-between-resources-using-namespaces-manual) [ 887 0 R /XYZ 84.259843 718.791496 0 ] (ensure-that-a-minimal-audit-policy-is-created-automated) [ 737 0 R /XYZ 84.259843 718.791496 0 ] (ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated) [ 728 0 R /XYZ 84.259843 499.820079 0 ] (ensure-that-all-namespaces-have-network-policies-defined-automated) [ 859 0 R /XYZ 84.259843 532.191496 0 ] (ensure-that-default-service-accounts-are-not-actively-used.-automated) [ 809 0 R /XYZ 84.259843 185.391496 0 ] (ensure-that-encryption-providers-are-appropriately-configured-automated) [ 639 0 R /XYZ 84.259843 331.070079 0 ] (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) [ 835 0 R /XYZ 84.259843 409.152842 0 ] (ensure-that-the---anonymous-auth-argument-is-set-to-false-automated) [ 502 0 R /XYZ 84.259843 718.791496 0 ] (ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated) [ 592 0 R /XYZ 84.259843 612.320079 0 ] (ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated) [ 597 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated) [ 600 0 R /XYZ 84.259843 331.070079 0 ] (ensure-that-the---audit-log-path-argument-is-set-automated) [ 587 0 R /XYZ 84.259843 349.820079 0 ] (ensure-that-the---authorization-mode-argument-includes-node-automated) [ 531 0 R /XYZ 84.259843 293.570079 0 ] (ensure-that-the---authorization-mode-argument-includes-rbac-automated) [ 536 0 R /XYZ 84.259843 574.820079 0 ] (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated) [ 528 0 R /XYZ 84.259843 743.570079 0 ] (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) [ 768 0 R /XYZ 84.259843 325.547453 0 ] (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) [ 706 0 R /XYZ 84.259843 406.070079 0 ] (ensure-that-the---basic-auth-file-argument-is-not-set-automated) [ 505 0 R /XYZ 84.259843 274.820079 0 ] (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) [ 685 0 R /XYZ 84.259843 591.770079 0 ] (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) [ 690 0 R /XYZ 84.259843 363.244475 0 ] (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) [ 696 0 R /XYZ 84.259843 682.791496 0 ] (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) [ 626 0 R /XYZ 84.259843 293.570079 0 ] (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) [ 773 0 R /XYZ 84.259843 672.873057 0 ] (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) [ 701 0 R /XYZ 84.259843 537.320079 0 ] (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) [ 636 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) [ 631 0 R /XYZ 84.259843 574.820079 0 ] (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) [ 618 0 R /XYZ 84.259843 574.820079 0 ] (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-automated) [ 788 0 R /XYZ 84.259843 198.526036 0 ] (ensure-that-the---hostname-override-argument-is-not-set-manual) [ 788 0 R /XYZ 84.259843 421.126036 0 ] (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) [ 571 0 R /XYZ 84.259843 706.070079 0 ] (ensure-that-the---insecure-port-argument-is-set-to-0-automated) [ 574 0 R /XYZ 84.259843 256.070079 0 ] (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) [ 749 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 745 0 R /XYZ 84.259843 419.879014 0 ] (ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated) [ 523 0 R /XYZ 84.259843 537.320079 0 ] (ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated) [ 518 0 R /XYZ 84.259843 331.070079 0 ] (ensure-that-the---kubelet-https-argument-is-set-to-true-automated) [ 515 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) [ 788 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) [ 723 0 R /XYZ 84.259843 649.820079 0 ] (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) [ 711 0 R /XYZ 84.259843 274.820079 0 ] (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) [ 718 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated) [ 584 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated-1) [ 672 0 R /XYZ 84.259843 145.744475 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated-2) [ 690 0 R /XYZ 84.259843 718.791496 0 ] (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) [ 784 0 R /XYZ 84.259843 443.570079 0 ] (ensure-that-the---read-only-port-argument-is-set-to-0-automated) [ 773 0 R /XYZ 84.259843 294.629014 0 ] (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) [ 605 0 R /XYZ 84.259843 574.820079 0 ] (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) [ 682 0 R /XYZ 84.259843 631.070079 0 ] (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated) [ 798 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) [ 579 0 R /XYZ 84.259843 556.070079 0 ] (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) [ 613 0 R /XYZ 84.259843 312.320079 0 ] (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) [ 610 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) [ 679 0 R /XYZ 84.259843 508.820079 0 ] (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) [ 778 0 R /XYZ 84.259843 638.926036 0 ] (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) [ 672 0 R /XYZ 84.259843 718.791496 0 ] (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) [ 623 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) [ 792 0 R /XYZ 84.259843 524.926036 0 ] (ensure-that-the---token-auth-file-parameter-is-not-set-automated) [ 510 0 R /XYZ 84.259843 556.070079 0 ] (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) [ 675 0 R /XYZ 84.259843 330.123057 0 ] (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) [ 311 0 R /XYZ 84.259843 458.476036 0 ] (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 311 0 R /XYZ 84.259843 579.076036 0 ] (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) [ 544 0 R /XYZ 84.259843 256.070079 0 ] (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) [ 549 0 R /XYZ 84.259843 424.820079 0 ] (ensure-that-the-admission-control-plugin-eventratelimit-is-set-automated) [ 541 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) [ 556 0 R /XYZ 84.259843 199.820079 0 ] (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) [ 566 0 R /XYZ 84.259843 556.070079 0 ] (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) [ 561 0 R /XYZ 84.259843 424.820079 0 ] (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) [ 549 0 R /XYZ 84.259843 213.273057 0 ] (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) [ 552 0 R /XYZ 84.259843 691.623057 0 ] (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) [ 768 0 R /XYZ 84.259843 718.791496 0 ] (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated) [ 645 0 R /XYZ 84.259843 162.841563 0 ] (ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 307 0 R /XYZ 84.259843 532.191496 0 ] (ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 307 0 R /XYZ 84.259843 682.791496 0 ] (ensure-that-the-audit-policy-covers-key-security-concerns-manual) [ 740 0 R /XYZ 84.259843 312.320079 0 ] (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 749 0 R /XYZ 84.259843 443.429014 0 ] (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) [ 758 0 R /XYZ 84.259843 733.820079 0 ] (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) [ 809 0 R /XYZ 84.259843 682.791496 0 ] (ensure-that-the-cni-in-use-supports-network-policies-manual) [ 859 0 R /XYZ 84.259843 682.791496 0 ] (ensure-that-the-container-network-interface-file-ownership-is-set-to-rootroot-manual) [ 311 0 R /XYZ 84.259843 760.623057 0 ] (ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual) [ 309 0 R /XYZ 84.259843 226.970079 0 ] (ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 307 0 R /XYZ 84.259843 245.991496 0 ] (ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 307 0 R /XYZ 84.259843 396.591496 0 ] (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) [ 315 0 R /XYZ 84.259843 648.770079 0 ] (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 315 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) [ 499 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) [ 486 0 R /XYZ 84.259843 409.152842 0 ] (ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 309 0 R /XYZ 84.259843 362.570079 0 ] (ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 309 0 R /XYZ 84.259843 513.170079 0 ] (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) [ 758 0 R /XYZ 84.259843 313.143907 0 ] (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) [ 766 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-automated) [ 802 0 R /XYZ 84.259843 295.023057 0 ] (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) [ 742 0 R /XYZ 84.259843 547.191496 0 ] (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 742 0 R /XYZ 84.259843 682.791496 0 ] (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 364 0 R /XYZ 84.259843 733.820079 0 ] (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) [ 315 0 R /XYZ 84.259843 513.170079 0 ] (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated) [ 427 0 R /XYZ 84.259843 541.781993 0 ] (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-automated) [ 745 0 R /XYZ 84.259843 733.820079 0 ] (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) [ 685 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 309 0 R /XYZ 84.259843 648.770079 0 ] (ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 309 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) [ 311 0 R /XYZ 84.259843 202.276036 0 ] (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 311 0 R /XYZ 84.259843 337.876036 0 ] (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) [ 887 0 R /XYZ 84.259843 598.191496 0 ] (etcd-node-configuration-files) [ 696 0 R /XYZ 41.740157 784.430079 0 ] (extensible-admission-control) [ 885 0 R /XYZ 41.740157 784.430079 0 ] (general-policies) [ 887 0 R /XYZ 41.740157 784.430079 0 ] (header_bottom_text) [ 6 0 R /XYZ 85.009843 392.718898 0 ] (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-automated) [ 742 0 R /XYZ 84.259843 411.591496 0 ] (kubelet) [ 768 0 R /XYZ 41.740157 784.430079 0 ] (logging) [ 737 0 R /XYZ 41.740157 784.430079 0 ] (master-node-configuration-files) [ 307 0 R /XYZ 41.740157 784.430079 0 ] (minimize-access-to-create-pods-manual) [ 809 0 R /XYZ 84.259843 290.991496 0 ] (minimize-access-to-secrets-manual) [ 809 0 R /XYZ 84.259843 517.191496 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) [ 847 0 R /XYZ 84.259843 212.250432 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) [ 850 0 R /XYZ 84.259843 574.229014 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) [ 847 0 R /XYZ 84.259843 583.191496 0 ] (minimize-the-admission-of-containers-with-added-capabilities-manual) [ 854 0 R /XYZ 84.259843 269.081993 0 ] (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) [ 850 0 R /XYZ 84.259843 203.287950 0 ] (minimize-the-admission-of-containers-with-capabilities-assigned-manual) [ 854 0 R /XYZ 84.259843 148.481993 0 ] (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) [ 854 0 R /XYZ 84.259843 404.681993 0 ] (minimize-the-admission-of-privileged-containers-manual) [ 847 0 R /XYZ 84.259843 718.791496 0 ] (minimize-the-admission-of-root-containers-manual) [ 854 0 R /XYZ 84.259843 555.281993 0 ] (minimize-wildcard-use-in-roles-and-clusterroles-manual) [ 809 0 R /XYZ 84.259843 411.591496 0 ] (network-policies-and-cni) [ 859 0 R /XYZ 41.740157 784.430079 0 ] (overview) [ 298 0 R /XYZ 84.259843 700.022079 0 ] (pod-security-policies) [ 847 0 R /XYZ 41.740157 784.430079 0 ] (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) [ 883 0 R /XYZ 84.259843 682.791496 0 ] (rbac-and-service-accounts) [ 809 0 R /XYZ 41.740157 784.430079 0 ] (scheduler) [ 690 0 R /XYZ 41.740157 784.430079 0 ] (secrets-management) [ 883 0 R /XYZ 41.740157 784.430079 0 ] (testing-controls-methodology) [ 298 0 R /XYZ 84.259843 161.276079 0 ] (the-default-namespace-should-not-be-used-automated) [ 887 0 R /XYZ 84.259843 176.991496 0 ] (title-block-header) [ 6 0 R /XYZ 84.259843 502.818898 0 ] (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) [ 802 0 R /XYZ 84.259843 593.570079 0 ] (worker-node-configuration-files) [ 742 0 R /XYZ 41.740157 784.430079 0 ] ] +>> +>> +>> +endobj +4 0 obj +<< +/ExtGState << +/a1.0 << +/ca 1 +>> +/A1.0 << +/CA 1 +>> +>> +/XObject << +>> +/Pattern << +>> +/Shading << +>> +/Font 1072 0 R +>> +endobj +5 0 obj +<< +/Filter /FlateDecode +/Length 2619 +>> +stream +xˎd 602%R7H lLE]zҥx&FHG>g׋bhb˛ۓwCk>Grh TϚ{߿8xNb>LCmJ&D%C)*1{g*%{TUaeR#3jGUFc*{Dv$Bu0D4]̡` ӥJS].tT92]ܘ`K.Ö̈́`iLW`-Ue +[V]-FuEDrofTסVۣ.I +2|S' +T*%R$w-Y%1ӁYkk&?*.ÖQl3[\b HR`@j=X0zVzePХ@[Fprh7M TaK2e,P- +ܚXI, +La,PW[1rJ@\; q +j.@]V UX`*:f,ƦjX`.Qb,aa,Ԛ0c"P] 8X`nxݔ%1,8Jf.y:[X{2`0dp7v?rA[/܍ Gu=Ċ'b) TX]151dp7*"5Ӂ1ua,.Xw c[ץX]`)1 +i Gq䡌ExܕXP]1=T[%5ؒ3d5H)ܕf:pWvƂzd,(1,81fZ JQ] hgƂ*d `Uc,@bXPlє j-H }]h}`"cHZ7c,ê2]IUt2j82 + .1 1[pT BK̙.$ٌt%؂l*c"4jI,5әx "c *M` 0Xb;3A2`fc,h-y Z-Ic|X c,RɌ8t"=6ԛ p.l]&J#'dWoN_~߰c^N,p0;A  ՆX2C?HvO~Qwf39}\{u1Rt|r>}>ق>8x{ʃ=:^ۻm}X|-z#YPEٜ|#|oW(f;&@|~Nnw˟}{?[|?ֶ=#GՉU_KIA}ٳ@6caOogxk=6BY.N1\ lCz#.}9JLv9Exl>9gxc$4Z׉O(obnAo2MAߧp h{5z⨲ P8ٰ'z3,4}_m궝^NVKoPcue nF)ͣDD1a3~5E6f>DFs֣}2eDvMZtw`57Ax9!o)W;/VH uw,YRϷ2yJ<1VkMgsiIc+rZ{؝t[M^0!5q/6gr0-qt'^vyTJ=qLv>:w?#s~,qdp(,!u]8>C"sIsꞑDEgY_yQ\xI4z'#^}8ld87oq<׶3NƩ݅y&NuSme{g8ݛM/iԋaٖNWH>oC]WH hneٝ$s~۷B}ԥfx R`I=O>^78.hҧ]:_̥x\G7gѳ7]+4LrX5vݤm=vIm&b29b6ccY7nt)}+s+塯;"̖t&@ywNVϙK6"+Sjv?5lRVf*)g^8^ m]!P.z}R_Uko~w%7"d LUj&> +endobj +7 0 obj +<< +/Filter /FlateDecode +/Length 3933 +>> +stream +x]KϯsdI686 M$ʀC~=M؏ݝ, #yYb=뎖~ΤcHLtD|tSD{|{p)JamLJq?~nr|(3.9gH oA5o?|ɲ&C-#@41@8Vd#$nhm u&`l06tx(#R}:^%jԝ96lxmsڶ(t8!!ÒXX`ACȎpːt~P9vKm)}s\\HѮ۝OEKOS]sgQRQ=E)zO۩Fw/u)zO{ެMq;E;>bYTMIt⦎)q\ 6P&2y#E=oq+OCh|HQذi}RCZ:{CPCd):vq`!E.BZpn"12E}E +m~*, ,O4d1[:4)Ѐ-mx#Rh+;^4QRb:!4xPb,yR,KH|ž}*MJ%\xo!Rb,l+̘)1xCc)!h2츻Qb`&YL^41SvJ3MLZx^&4Koxyb {Drkx!]2{OVE,3 %%8Mtċa&6Dmcy34&mɄFCdBtV[9ˋgHc"x{߱2/:<L{১Ϋ3ɳNKd3ḽ/pۏ(_{;1?g5lO,nϠk@<{e+T6~ pug06%'_7 |_tUD^n^r2]Ay>L {eE'_ǀ[KNApM㢓@hP>y~Q:o`io?Z,qCb43Ӥs`JpMe`8Y^Asy.g:g4_GFy%Ӝfޯ.c7;?-g&Vaٮ|f|lW~gJy-7xȔv?Z@;n +Y5>]"P"|7N-XQATcxi)Y^sK+ʠkR/-uQ.Eo=͗x/ѥK֧3Oeghj3HR7|Zɝyȵ u֣Q7.8숻Ч |lܚV^Cv_}K~i/& +?~R6KC|Ʃ^󞖩&ۓRPAD&);Zbx|ل_҅On;:wjT֐w9L2K071tݜY5hpCBW v:oyI˞an38]~WVw0;:& +*sٺDI7^5hsJ 073Dsp/чM\àZlü*7*es6?m@V]^lׅL5Jth<Uj.Ju^S}lьrxeC)T?H8T_$VP +~8Pܠ^+,Г68/-ޞ85+V^(K5Ta bo?LJn6x4C:e +s[J{d7Kmb*L&xH1®E]K iR +:L-I-U;3wjv8 <6%<DW4MlKʤ`lי Eý>LpV\'֌{:r9|/X-?s_K]ylj˙ W^r[PiFCD~텽RVA]*A60eHO +FZ |rƗT|"ԯ>%Ő|VHWč|"S0w1K@J&E~8mD9iV]I AN܌ndy6~vz]YP37AM4mrR[E'2Fm3IXi(Z(VLae8mZ)HKJ3"Imx["αkg;e% N+#: 36ZQ>='w6ߋڢaXEKBŠx6{%G"aE/%vO/_C߳s[*=ςz["獟~nz"NcY*RN廌l*KyEV~?M +endstream +endobj +8 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 7 0 R +/Resources 4 0 R +/Annots [ 9 0 R 10 0 R 11 0 R 12 0 R 13 0 R 14 0 R 15 0 R 16 0 R 17 0 R 18 0 R 19 0 R 20 0 R 21 0 R 22 0 R 23 0 R 24 0 R 25 0 R 26 0 R 27 0 R 28 0 R 29 0 R 30 0 R 31 0 R 32 0 R 33 0 R 34 0 R 35 0 R 36 0 R 37 0 R 38 0 R 39 0 R 40 0 R 41 0 R 42 0 R 43 0 R 44 0 R 45 0 R 46 0 R 47 0 R 48 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +9 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 671.061024 504.679134 638.361024 ] +/BS << +/W 0 +>> +/Dest (cis-v1.6-kubernetes-benchmark---rancher-v2.6-with-kubernetes-v1.18-to-v1.21) +>> +endobj +10 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 488.857357 648.111024 496.429134 633.111024 ] +/BS << +/W 0 +>> +/Dest (cis-v1.6-kubernetes-benchmark---rancher-v2.6-with-kubernetes-v1.18-to-v1.21) +>> +endobj +11 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 626.361024 504.679134 593.661024 ] +/BS << +/W 0 +>> +/Dest (controls) +>> +endobj +12 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 488.869808 618.411024 496.429134 603.411024 ] +/BS << +/W 0 +>> +/Dest (controls) +>> +endobj +13 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 581.661024 504.679134 548.961024 ] +/BS << +/W 0 +>> +/Dest (master-node-configuration-files) +>> +endobj +14 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 485.053890 573.711024 496.429134 558.711024 ] +/BS << +/W 0 +>> +/Dest (master-node-configuration-files) +>> +endobj +15 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 548.961024 498.679134 517.761024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +16 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 511.761024 491.179134 496.761024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +17 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 523.761024 498.679134 492.561024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +18 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 458.630306 501.561024 471.154720 486.561024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +19 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 498.561024 498.679134 467.361024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +20 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 461.361024 491.179134 446.361024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +21 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 473.361024 498.679134 442.161024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +22 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 436.161024 491.179134 421.161024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +23 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 448.161024 498.679134 416.961024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +24 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 410.961024 491.179134 395.961024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +25 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 422.961024 498.679134 391.761024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +26 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 458.630306 400.761024 471.154720 385.761024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +27 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 397.761024 498.679134 366.561024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +28 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 360.561024 491.179134 345.561024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +29 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 372.561024 498.679134 341.361024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +30 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 458.630306 350.361024 471.154720 335.361024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +31 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 347.361024 498.679134 316.161024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual) +>> +endobj +32 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 310.161024 491.179134 295.161024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual) +>> +endobj +33 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 322.161024 498.679134 290.961024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-container-network-interface-file-ownership-is-set-to-rootroot-manual) +>> +endobj +34 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 458.630306 299.961024 471.154720 284.961024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-container-network-interface-file-ownership-is-set-to-rootroot-manual) +>> +endobj +35 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 296.961024 498.679134 265.761024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +36 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 274.761024 491.179134 259.761024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +37 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 271.761024 498.679134 240.561024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +38 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 249.561024 491.179134 234.561024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +39 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 246.561024 498.679134 215.361024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +40 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 224.361024 491.179134 209.361024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +41 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 221.361024 498.679134 190.161024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +42 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 199.161024 491.179134 184.161024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +43 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 196.161024 498.679134 164.961024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +44 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 158.961024 491.179134 143.961024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +45 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 170.961024 498.679134 139.761024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +46 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 458.630306 148.761024 471.154720 133.761024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +47 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 145.761024 498.679134 114.561024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) +>> +endobj +48 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 123.561024 491.179134 108.561024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) +>> +endobj +49 0 obj +<< +/Filter /FlateDecode +/Length 4222 +>> +stream +x]K Ud=c rYcfۻ6YCJ31EdH2-5_ cɚH [F )]MɏLN;n?:>.Ͽ~YHtvLgf ΤG%lD49ۘ6Kc`hi%{! +K6ep,R w`<&lx7OeCR ^q p lMB ob G)4)h5F0}c2z"%!tijLG"l&:Fra{nZƯ?y?ǯ3;;뻔a 99CmLM؄nnhy-AP(TmZ_N=]B}ID*ܽ~zAbIw8B?[uNm&yjs{g89Y'k CGGXq(16ps8,}H73 zxi>>X:E_})>nM):E_]l%Wsۊyt;0e յ#gBhBb Aᑨfi +99Mgtl:GPb !9-|`}Z:Xi1# k1 Y-|3e-|SA &`̤r^1`:֙0k1uSMg:DZu)xp)x!cH%5ap1 xʚ<E5a +7x2LWNFcc\û3<˲lr{~Ƽxr^AzNz('2`+^OY0eGSI@8Jȝ";Ao럿[{\dOfǂpu@.J큜 {:iG3A S$}&AgAgr739Eܞ {E( +..l*K=8yy-`i {Ą,=K*yE@9;=# 4ӽQto˲#`E{- xN>eJ|sA"zZr dC䘯aÆmq@v{e s8ӿa=s1tÇ~'G9B'߉"b27LǮ`P n͔G!O]ض:5w Шb vieHNN v.D ] ·7Nx.O m6F|ra壱:VxV0.men-mzQ\Fs7.m<(x[Mؽ0W~b`in=+,tIv 792c.M9":gn^5ͤʗ80]l0C2,>(W*H︌-mUWZi -S[`[| Ϊ[`9;[ձ:+Mϱw>/^mUxp|S'{߫.>aмH=LܯM V?J嫾pK_ܥ +c?vnDK^SWj;.m?(ry_ 1{kW|NK۟;|7Wχ0ӿ[ 5uq?Ҧ/ܕAq1?=p}ZU[rj[=ȃ)5Yuu8\m.87~wP">xf6V݉*u[>7WŇyi`Ki?75U1S;=Ñ_ vֆ^gԡA-r>F8n򺜶7|1';Dګx%/,R{n: O{=Ӛe|{:T޲^ nڗAsXvz/QrK;k[o{_2GW\8Wqߋukl6G;|b,nQr' [; vq/엶OwѾw~%w-ޘ} J ?0],*{oL=/LIK?<տH,ьg hǗWN"zB1{_9$xYm.б~Z^DO2r]O|qe£?;7ɵ a^1_U5hyh N6_y^= $@fat#9w^Ɓ~hX\ y#+$ dLtzX7Y-ɏ s.78:BaI_KN//WP^HjSMOeZN;\z.HfH2 +3ۀۍd#5v`.9렃{:7/'UJsŻVʕJ|-C#Yw9&b*/7FXR57UZTB|4Q9M/cwf WsW2|p,b6aR ;klۖ ' +jOÎj )‹VS_c1^CQ>Mo% gJ:_E'| Mz{(N6BN}C`Eǂ݌0g(u7ʡ^=&Ԛ֩~8 ZsYNmcn䴩Z 1QSmb^(Lh)5]w +Nae8z)֞Q=M=*ՉԣxeRjkD}8fmL+]8}]ƹRmϝ 36|V{Y}yknaX.;8'(bF|Yr%R6KzI /ڽ#_foܖIOs^PKs{;BtG+{njs +endstream +endobj +50 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 49 0 R +/Resources 4 0 R +/Annots [ 51 0 R 52 0 R 53 0 R 54 0 R 55 0 R 56 0 R 57 0 R 58 0 R 59 0 R 60 0 R 61 0 R 62 0 R 63 0 R 64 0 R 65 0 R 66 0 R 67 0 R 68 0 R 69 0 R 70 0 R 71 0 R 72 0 R 73 0 R 74 0 R 75 0 R 76 0 R 77 0 R 78 0 R 79 0 R 80 0 R 81 0 R 82 0 R 83 0 R 84 0 R 85 0 R 86 0 R 87 0 R 88 0 R 89 0 R 90 0 R 91 0 R 92 0 R 93 0 R 94 0 R 95 0 R 96 0 R 97 0 R 98 0 R 99 0 R 100 0 R 101 0 R 102 0 R 103 0 R 104 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +51 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 808.370079 498.679134 777.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +52 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 771.170079 491.179134 756.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +53 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 783.170079 498.679134 751.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated) +>> +endobj +54 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 458.630306 760.970079 471.154720 745.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated) +>> +endobj +55 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 757.970079 498.679134 726.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) +>> +endobj +56 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 720.770079 491.179134 705.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) +>> +endobj +57 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 732.770079 498.679134 701.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) +>> +endobj +58 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 458.630306 710.570079 471.154720 695.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) +>> +endobj +59 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 689.570079 504.679134 656.870079 ] +/BS << +/W 0 +>> +/Dest (api-server) +>> +endobj +60 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 485.690364 681.620079 496.429134 666.620079 ] +/BS << +/W 0 +>> +/Dest (api-server) +>> +endobj +61 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 656.870079 498.679134 625.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---anonymous-auth-argument-is-set-to-false-automated) +>> +endobj +62 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 634.670079 491.179134 619.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---anonymous-auth-argument-is-set-to-false-automated) +>> +endobj +63 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 631.670079 498.679134 600.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---basic-auth-file-argument-is-not-set-automated) +>> +endobj +64 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 609.470079 491.179134 594.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---basic-auth-file-argument-is-not-set-automated) +>> +endobj +65 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 606.470079 498.679134 575.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---token-auth-file-parameter-is-not-set-automated) +>> +endobj +66 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 584.270079 491.179134 569.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---token-auth-file-parameter-is-not-set-automated) +>> +endobj +67 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 581.270079 498.679134 550.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubelet-https-argument-is-set-to-true-automated) +>> +endobj +68 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 559.070079 491.179134 544.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubelet-https-argument-is-set-to-true-automated) +>> +endobj +69 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 556.070079 498.679134 524.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated) +>> +endobj +70 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 518.870079 491.179134 503.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated) +>> +endobj +71 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 530.870079 498.679134 499.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated) +>> +endobj +72 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 458.630306 508.670079 471.154720 493.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated) +>> +endobj +73 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 505.670079 498.679134 474.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated) +>> +endobj +74 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 483.470079 491.179134 468.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated) +>> +endobj +75 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 480.470079 498.679134 449.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-includes-node-automated) +>> +endobj +76 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 458.270079 491.179134 443.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-includes-node-automated) +>> +endobj +77 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 455.270079 498.679134 424.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-includes-rbac-automated) +>> +endobj +78 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 433.070079 491.179134 418.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-includes-rbac-automated) +>> +endobj +79 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 430.070079 498.679134 398.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-eventratelimit-is-set-automated) +>> +endobj +80 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 407.870079 491.179134 392.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-eventratelimit-is-set-automated) +>> +endobj +81 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 404.870079 498.679134 373.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) +>> +endobj +82 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 382.670079 491.179134 367.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) +>> +endobj +83 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 379.670079 498.679134 348.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) +>> +endobj +84 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 357.470079 491.179134 342.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) +>> +endobj +85 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 354.470079 498.679134 323.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) +>> +endobj +86 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 317.270079 491.179134 302.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) +>> +endobj +87 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 329.270079 498.679134 298.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) +>> +endobj +88 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 458.630306 307.070079 471.154720 292.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) +>> +endobj +89 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 304.070079 498.679134 272.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) +>> +endobj +90 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 281.870079 491.179134 266.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) +>> +endobj +91 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 278.870079 498.679134 247.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) +>> +endobj +92 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 256.670079 491.179134 241.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) +>> +endobj +93 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 253.670079 498.679134 222.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) +>> +endobj +94 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 231.470079 491.179134 216.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) +>> +endobj +95 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 228.470079 498.679134 197.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) +>> +endobj +96 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 206.270079 491.179134 191.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) +>> +endobj +97 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 203.270079 498.679134 172.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---insecure-port-argument-is-set-to-0-automated) +>> +endobj +98 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 181.070079 491.179134 166.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---insecure-port-argument-is-set-to-0-automated) +>> +endobj +99 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 178.070079 498.679134 146.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) +>> +endobj +100 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 155.870079 491.179134 140.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) +>> +endobj +101 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 152.870079 498.679134 121.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated) +>> +endobj +102 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 130.670079 491.179134 115.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated) +>> +endobj +103 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 127.670079 498.679134 96.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-path-argument-is-set-automated) +>> +endobj +104 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 105.470079 491.179134 90.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-path-argument-is-set-automated) +>> +endobj +105 0 obj +<< +/Filter /FlateDecode +/Length 4045 +>> +stream +x]K ׯs8"%R!AY &!ȡ2 !?˒(jmӴH*8:s_)R/n1̇ Nl!)d_zL~rF<ÿR"w'Bs `)f@,S +ə,EYb2Aϒ`r΃'G!Ag~`PBt,hB0!#XAaul,-F[*%VS 璛;K;7ms'6Z);"@iZI KR9q4l:I6}R`ѕYY2q'0/] +Vtt!Un_{:8 t$IAn=Qo 8HqYч".#jRh8T!owp#K:ā:;8hkS>txq%E5_vRw?/*$)HG^(x4 )HG~N7{HG>RFWߴXn =FvYw8oӔ+ے&,(<1eM' +fdIT)XvecH`v}dNtٰJ\a]AљaLؖyDg朢ʒ*d"9rb.$g8.3p슢sfˮ: 2bSٲ+ YxG#b%cƥmKu04b,vIF}N.{ˮNc|YL`E|a9:FE*0c1[v%9]=x˥R "bkt`m,ޞ }bj>2܅:}#]uImPࡏLk#TDr[שCCLQTc㦃:Qmzk҈%ݹ.jL80tuCK7DoSe͗OEMHRFW?YQPmK=rTl O׉ +"a?e Wx򔃳ybynm$YDtE\lsC[,;o'GY0sl,>\yU (On]>~Я>$/Q$E^pBwĒs7;~2?_tq_&e  %[$dgor5k E^\dtk)DOFQdtkI5A. "* E@`~o7 `3vlgӭVnX]DhgrpIۙLyUVvEo-)s2sk_mYNɃloo Ci6KSXHce[ +=9uyәomy*2nױf:i.|lo?^Ǘ훤}SQ**se8{ fWN7aFZ,p|Z{6\v= n1r}c:-i>x ϲt|_+l2/|Q=E\yz:oS;jn;7ȿ\8OgB2ri}ӝE5jL`X/7}q ;wwtwQr5.0^瞍z,(3}k_5eO(Jg]sFcm~e.;|Ajq':M~,+ eews-Zlʹ^_+s,LqmO >_o0/˭r0]<.=eyNxD>$']lkeMjXO=!~ox1U{:޳5P=/ԱU|݂#`ڝl`/yr<25f"˹E":/ݐd ^mltF1GG,|]e^9eOu@ϧtBgvjrS簻dUax<v}ƕ@wf֊g_V8_\`tW;uMNE]WǦp"^W,tS?}%7:RkϽNW+pߴ7}}qbv;Iֶe5x=W+bW== TAY R<;NyU]UUI.|h^}2-}{aL Wȴ味\[$Q\>'חO&=k&@I`2'y`^>fd千pf(UYYQ\CVkDsS9^0zX +\BE/ eϰĔ2S(IA|=ę~8vgs7[Hn"ag??9L'0yK"g9OaB}*M*i͕fn ROY6U&%ς7r&%X_^*<J_B\ub0h>`?*Y*"%)q,9+/0/aPU׮-Ax:X>oR w5WJF RyCsW.ߎ+԰~Rh|mNMe4jHƕzCݧ>ZR&ny\+uyqn'\7 +G54ѫq9/SuUYYh \*QK7 Iu!%7yts:a+`*cKw/2vr6汁\1WJjc$CF.%JMtU By w={Ơڸ̭v>krlfDX|%-%Sgj4aɽ>䚭:Ae'֌{:0Os;qn+}_[!W%ՐWX.GeG*J` jBAC,ڈЧY=tV(<賡ff@ިϚ +V~q9=*|krzj" ;:F5BC BDE:Jk#ƪ/UM/St?IҜH-uK5@9v\ldڠ>QCv);l{TfM-Nװ-a8DK!rZy9bH],ђ{"H,j>vNnӤ9`c-7 AW-T>إqXAO +endstream +endobj +106 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 105 0 R +/Resources 4 0 R +/Annots [ 107 0 R 108 0 R 109 0 R 110 0 R 111 0 R 112 0 R 113 0 R 114 0 R 115 0 R 116 0 R 117 0 R 118 0 R 119 0 R 120 0 R 121 0 R 122 0 R 123 0 R 124 0 R 125 0 R 126 0 R 127 0 R 128 0 R 129 0 R 130 0 R 131 0 R 132 0 R 133 0 R 134 0 R 135 0 R 136 0 R 137 0 R 138 0 R 139 0 R 140 0 R 141 0 R 142 0 R 143 0 R 144 0 R 145 0 R 146 0 R 147 0 R 148 0 R 149 0 R 150 0 R 151 0 R 152 0 R 153 0 R 154 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +107 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 808.370079 498.679134 777.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated) +>> +endobj +108 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 786.170079 491.179134 771.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated) +>> +endobj +109 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 783.170079 498.679134 751.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated) +>> +endobj +110 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 760.970079 491.179134 745.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated) +>> +endobj +111 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 757.970079 498.679134 726.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated) +>> +endobj +112 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 735.770079 491.179134 720.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated) +>> +endobj +113 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 732.770079 498.679134 701.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) +>> +endobj +114 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 710.570079 491.179134 695.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) +>> +endobj +115 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 707.570079 498.679134 676.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) +>> +endobj +116 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 685.370079 491.179134 670.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) +>> +endobj +117 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 682.370079 498.679134 651.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) +>> +endobj +118 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 660.170079 491.179134 645.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) +>> +endobj +119 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 657.170079 498.679134 625.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) +>> +endobj +120 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 634.970079 491.179134 619.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) +>> +endobj +121 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 631.970079 498.679134 600.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) +>> +endobj +122 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 609.770079 491.179134 594.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) +>> +endobj +123 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 606.770079 498.679134 575.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) +>> +endobj +124 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 584.570079 491.179134 569.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) +>> +endobj +125 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 581.570079 498.679134 550.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) +>> +endobj +126 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 559.370079 491.179134 544.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) +>> +endobj +127 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 556.370079 498.679134 525.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) +>> +endobj +128 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 534.170079 491.179134 519.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) +>> +endobj +129 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 531.170079 498.679134 499.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-encryption-providers-are-appropriately-configured-automated) +>> +endobj +130 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 508.970079 491.179134 493.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-encryption-providers-are-appropriately-configured-automated) +>> +endobj +131 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 505.970079 498.679134 474.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated) +>> +endobj +132 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 483.770079 491.179134 468.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated) +>> +endobj +133 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 462.770079 504.679134 430.070079 ] +/BS << +/W 0 +>> +/Dest (controller-manager) +>> +endobj +134 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 482.258235 454.820079 496.429134 439.820079 ] +/BS << +/W 0 +>> +/Dest (controller-manager) +>> +endobj +135 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 430.070079 498.679134 398.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) +>> +endobj +136 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 407.870079 491.179134 392.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) +>> +endobj +137 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 404.870079 498.679134 373.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-1) +>> +endobj +138 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 382.670079 491.179134 367.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-1) +>> +endobj +139 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 379.670079 498.679134 348.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) +>> +endobj +140 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 357.470079 491.179134 342.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) +>> +endobj +141 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 354.470079 498.679134 323.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) +>> +endobj +142 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 332.270079 491.179134 317.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) +>> +endobj +143 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 329.270079 498.679134 298.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) +>> +endobj +144 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 307.070079 491.179134 292.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) +>> +endobj +145 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 304.070079 498.679134 272.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) +>> +endobj +146 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 281.870079 491.179134 266.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) +>> +endobj +147 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 278.870079 498.679134 247.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) +>> +endobj +148 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 256.670079 491.179134 241.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) +>> +endobj +149 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 235.670079 504.679134 202.970079 ] +/BS << +/W 0 +>> +/Dest (scheduler) +>> +endobj +150 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.957942 227.720079 496.429134 212.720079 ] +/BS << +/W 0 +>> +/Dest (scheduler) +>> +endobj +151 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 202.970079 498.679134 171.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-2) +>> +endobj +152 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 180.770079 491.179134 165.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-2) +>> +endobj +153 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 177.770079 498.679134 146.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) +>> +endobj +154 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 155.570079 491.179134 140.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) +>> +endobj +155 0 obj +<< +/Filter /FlateDecode +/Length 4449 +>> +stream +x]K|T>$! $0޵sOQG~ͮk3h}]"jGR/rr[烘, +7KTo7VM^ Ju4n2^y/)hTT;?lluiOHVLyx9s N p_I)4Ӎ'n +ÃWhq)T.3Vcg9,y⤮+y|]~ R+\I@vNJuZq/Y9Z__l:8|$?񋙘%/}Ҏ`N=MgWбt r'C'޵5t5U)mD#pp\-L$㏿|eXj `BY/2Zʍd̤j5E2ɸI+0 IgeɁ!5ːjEٯA)?˒`#QI;˓hdHguEGɐVz5KIgv)E:; ǔ"0KiKcGvi#GvL $U +1Gv@J#" PĠAQ*Q0ˑΚ=ˑH51]tze2*)z` rLK'vQ= 8K+ +95lѨAi @3 Hg(Fv!@c?R]: zRbnW5c__' vT +Ζ +owڪ2Iub٦O=TW[G;.Tbjjpac+(yF橾OuJd|RFOvlVxb q8`c8Ki6cVq+q`xͨ־;ڞ̚S"Nѝ;EZQҼt,)St+QO7k)St]]vM h6 /̫xg0.;\\*F˄2xs/"7eΨ:h9\җ^nbx]e޼QmOݏNMfWH(yF$o.?"ahzW՗n+Ku\XF)xZ`WqPϩ^ t>jVp|Tt`V`8Zpl + Wp|X<mf +uשXyEbNѝ f(Zi^Yo:)S(ڧ5)S.E?fxe}`^=k&msF&-܆L +2& b,"!c&m7tFmn llý.:n}#:;utn',}BŤە+}I۽Ka$7E9WnӔݽg끑ӼfW5 Nڠ4MZ,ۼf8[،jʑ.(e⩾ky8:6߂W);&j%aټ6(q+q5yJ+tM1|y<f +uשq;Ew.(zc(פt,)St+QO7k)St]]vI=y g,'eG +\[J d ]ˣZd$@X2t.2tюd5OoX`$&ں,F,K~gUt2m 2P6ˁvHA@0%9 GA5YoE7YdS[#PM rZ3YeǑRh1+xq"1wUGlpQ]0q +&b 8m&qTq;I 85sx3w\r;Rq w;></G xk2ZMj;^&k;`RSH:op5 x&oihOuPӶf5|%}զϝ M9C;8Ih(4R߽?BͿF %'o:T{&&'x"7D?  a h= +r  t [Кu^B nS(jnk' m &{,A#$^&oi>?%&T ,kp2bc&%~ >u ߰nKnXoY⌺(7bK*0K"Y.cpK_z=*)rn~Mo]"|y 3F[| .ʙ3nh':XqSKca$YZA)4gd僲)y_(t ? C{i(dqdqR>7|? E0y%NBL[6SE]+QOE-74RzV:+c8+]YT|Z=o}r +2}oF׀Ͳ;9}ocs7}khjE_c}8 u;ް yxZ~''oC?}nv}/x|Қ7jt!07jUp,yv1}6i 'ߗMV4< ۅc{㌜W>32h +_!m1s$3x_a4{6ǚ5%˴(jإdzB?-O#Mru^')v*|RSu4cɆ^͘Klc2;/A^7-52k}'_C[6UB>9[[['~bCQv^5zlW!z:()0fΩDI;Y>qoz<]ۂ?)@"2{R`}L·W5mU-`S$$s\vEcUM~=0>۫6>s:\NYmcJS׳/_S~"/6֦^)}Jmtkս͇uC|[W'Eum%_)E;Cum#_+q}P{nKͦWy{;b={'?{<_+C^~mâiuMo;%eM7: ɖ+cnyu[{x͡R?.ύm##u!ޖHƆor+#N֣";. ^Ov>4Uxx8\>[hx[ۯ Rɭ%MtI MRjkr+`e׽KULldlCj/o0Pt@&;GigJqgq

$s@ ǩg" >\]J$r>uӡ+G)\9'UJkfE3;"} kXިx:h;Xjzl ;Q򥠴 +jF,<~Kf4TE2 $q< Y.IzNtCc\pzHQ2g]C Kɵ")As*?Wp3U^DH-ɵ6G\纳y\ < pH}&)p)}d ,QQ(p)3ؚ>,$뭸ÏyS?έ@m/~I?q%rPV0_C~BX"i@X"):PN'I+rr*gp/̽) P'hMZ7]yO%Ȇ Ztz;t&EJ͐|?P0;`ۈp{PY>tf+Hv2j`|R_QfzI h.}h6,Q=09yXqOMNFZ@usO + &M E.mӒ[f]K6) +#4d'"YȆqӊwK:o-։"~vFH-zP1eg*isg="]naj>lw1TCjz#W3n,["YgpEVRLo7PVNkuJ[>%'jC.;_^Zr/[P7c +endstream +endobj +156 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 155 0 R +/Resources 4 0 R +/Annots [ 157 0 R 158 0 R 159 0 R 160 0 R 161 0 R 162 0 R 163 0 R 164 0 R 165 0 R 166 0 R 167 0 R 168 0 R 169 0 R 170 0 R 171 0 R 172 0 R 173 0 R 174 0 R 175 0 R 176 0 R 177 0 R 178 0 R 179 0 R 180 0 R 181 0 R 182 0 R 183 0 R 184 0 R 185 0 R 186 0 R 187 0 R 188 0 R 189 0 R 190 0 R 191 0 R 192 0 R 193 0 R 194 0 R 195 0 R 196 0 R 197 0 R 198 0 R 199 0 R 200 0 R 201 0 R 202 0 R 203 0 R 204 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +157 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 790.370079 504.679134 757.670079 ] +/BS << +/W 0 +>> +/Dest (etcd-node-configuration-files) +>> +endobj +158 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.309749 782.420079 496.429134 767.420079 ] +/BS << +/W 0 +>> +/Dest (etcd-node-configuration-files) +>> +endobj +159 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 757.670079 498.679134 726.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) +>> +endobj +160 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 735.470079 491.179134 720.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) +>> +endobj +161 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 732.470079 498.679134 701.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) +>> +endobj +162 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 710.270079 491.179134 695.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) +>> +endobj +163 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 707.270079 498.679134 676.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) +>> +endobj +164 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 685.070079 491.179134 670.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) +>> +endobj +165 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 682.070079 498.679134 650.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) +>> +endobj +166 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 659.870079 491.179134 644.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) +>> +endobj +167 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 656.870079 498.679134 625.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) +>> +endobj +168 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 634.670079 491.179134 619.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) +>> +endobj +169 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 631.670079 498.679134 600.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) +>> +endobj +170 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 609.470079 491.179134 594.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) +>> +endobj +171 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 606.470079 498.679134 575.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated) +>> +endobj +172 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.654720 584.270079 491.179134 569.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated) +>> +endobj +173 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 563.270079 504.679134 530.570079 ] +/BS << +/W 0 +>> +/Dest (authentication-and-authorization) +>> +endobj +174 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.518001 555.320079 496.429134 540.320079 ] +/BS << +/W 0 +>> +/Dest (authentication-and-authorization) +>> +endobj +175 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 530.570079 498.679134 499.370079 ] +/BS << +/W 0 +>> +/Dest (client-certificate-authentication-should-not-be-used-for-users-manual) +>> +endobj +176 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 508.370079 491.179134 493.370079 ] +/BS << +/W 0 +>> +/Dest (client-certificate-authentication-should-not-be-used-for-users-manual) +>> +endobj +177 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 487.370079 504.679134 454.670079 ] +/BS << +/W 0 +>> +/Dest (logging) +>> +endobj +178 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.214534 479.420079 496.429134 464.420079 ] +/BS << +/W 0 +>> +/Dest (logging) +>> +endobj +179 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 454.670079 498.679134 423.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-a-minimal-audit-policy-is-created-automated) +>> +endobj +180 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 432.470079 491.179134 417.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-a-minimal-audit-policy-is-created-automated) +>> +endobj +181 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 429.470079 498.679134 398.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-audit-policy-covers-key-security-concerns-manual) +>> +endobj +182 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 407.270079 491.179134 392.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-audit-policy-covers-key-security-concerns-manual) +>> +endobj +183 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 386.270079 504.679134 353.570079 ] +/BS << +/W 0 +>> +/Dest (worker-node-configuration-files) +>> +endobj +184 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.986019 378.320079 496.429134 363.320079 ] +/BS << +/W 0 +>> +/Dest (worker-node-configuration-files) +>> +endobj +185 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 353.570079 498.679134 322.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +186 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 331.370079 491.179134 316.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +187 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 328.370079 498.679134 297.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) +>> +endobj +188 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 306.170079 491.179134 291.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) +>> +endobj +189 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 303.170079 498.679134 271.970079 ] +/BS << +/W 0 +>> +/Dest (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +190 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 265.970079 491.179134 250.970079 ] +/BS << +/W 0 +>> +/Dest (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +191 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 277.970079 498.679134 246.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-automated) +>> +endobj +192 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 446.105892 255.770079 464.892513 240.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-automated) +>> +endobj +193 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 252.770079 498.679134 221.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +194 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 215.570079 491.179134 200.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +195 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 227.570079 498.679134 196.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +196 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 446.105892 205.370079 464.892513 190.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +197 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 202.370079 498.679134 171.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +198 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 165.170079 491.179134 150.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +199 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 177.170079 498.679134 145.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) +>> +endobj +200 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 446.105892 154.970079 464.892513 139.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) +>> +endobj +201 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 151.970079 498.679134 120.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) +>> +endobj +202 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 114.770079 491.179134 99.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) +>> +endobj +203 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 126.770079 498.679134 95.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) +>> +endobj +204 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 446.105892 104.570079 464.892513 89.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) +>> +endobj +205 0 obj +<< +/Filter /FlateDecode +/Length 4613 +>> +stream +x]M$mEXFY q w;36CU$J힃At(QCR:'3)|vdM$`9dK o'gW'APwrv"_eѤhےCt{gpOl2/'Av6 z4qι-& `Kww8Pfdh򺑦v,OmEtq0?ӝ5Wqp`~pK,$Jh~77'7Յn/ٗ?7g{%0+5M̓0$p|?|8'_.a+ _ +ȧ<[+_)Whl N5w]Srڙ;{c>H &]Px 0;8K +O L`dsy8'a<“YqL*!!(5֩<.;gM +@xSp); ֫<87^7LF3+1!!9ђM̌ٛ>{ +[W|䜭Wp,=(MQyyw9 +,%9G1p^̌ +s6;7 i\JNs"7sW D +9ʣRpgNprB'rl}c-6gݘC.Tu`92D\B>`s\@߮l)b24BY_l +XM tb&W\JPǥb[A+S!q:7L <Щ$ +K}q8u)p-s78ȶ\8ˆC]wvܪꀃ;In+,5f6B8+ +$^! +WBkF>h&BN!:G +WBBWiqG._ԑ&+ rCru0L4T6yC rA"1urHr ԋS5l,6@l25X6kIƓ ufʓ9Ųym܏9)F_{T0KK)6.FS+FZaɀ.hA,L#Y}fC +f'2S& +1  'Y9Ji,e% ̳OLxr29)&KrjAiؕTƓcQC귘n7Edm,4ggc1Aꪄ;,ZU?.*4„JtiRo$j.1a:u}]TJB@oxSK얚{{FGACzkR)t8ՏKꀃ;AЛR"qχ76B8+ +$^! +WBC#^! +W~ ݣ}+D_!P+oL(;_qY;t~kQmY}E3jO3Kd*ΡH!Y*;]?Be!w;E#B=_> x򡇄,x ,7~w!1|x*3gqpM{OhB +$<{.w2c!7p=b  +HECD/$ Ip_;:<W |Mn ɷ[xg,.9Ժ.]eX%೵lk? ZX齖 ?zs%\]y*Vq?x>V\i8]e/m˵Evc!PB(rQk/c1eQ^Ty]a;=Ŧ3.n-v#,P[ܪD .2OX}*sy<;(z:v؅U\I$XܨVEN2ƾ1)'bR-9bŢw{5\hk/eD{sJӓ +/㾬6yn[1qV9oun}VC8#=OS8`VI`e=_>-qWlT]as <5<ۓ1Z(qC]9O=jj,t5no`E[NpF5Bjt"G&1?eSuN~JmVbw_VL:N5pk>'u?>r%|Nb,ugQc=6xho][غ{ mRW7:{Vn tQ/2V<+ڮ7;=}54nJ +Ĥ ZTq=D>喇>u'} 29ޢbfj3Oވ,nwmc"iBdlq^اps(m(Dq}ݭY0YW˪m@҇Ƈ @}[nUe|oHξuw+qW;s6TI${hs\eYڝ絫mWi&[Anqn#>~r큡p +Ġ*[C9' u/`ƭ{f*@e˦TfuBwOrb[.TK%iKn()mDx S7/ko/ix|Py7 qwAx{ʦ?b8kzT5++FM(1WRt*)7zKMv27lvUzyGS*/__ c1z4GUIPW ζfrx0|W +7a8ρug{_x6ju(4,^ @*og?ؐ˺AWm\_&YC `2JoLNP:+Ü N6w qj[_ r*-/\9ׯ@UҞjɗGV" nO.ڗ-dG B3{(y{MrN= +q1+/e2؆.M]˩ʖuJhP ѼTnT l8MHv]^ ԠSu$l|MHӔoRq4WtW~B[lR9M|u$@&7#^N%_O'sE!=ы~9/Ej*J+dKyQRbG#IzhYgp;0\tw@&Jjc$u\RXO˕h X\'SsZWa wo';Jrl;ѫ}+Ll%OUH'm]&}`:ѯ FkN.lƽrZ3C\q|ڝy~/<e hu ˙ _r eb%D@;٥K< 5'Zu$R Cs]p^XecVLSYtGO|A4) +lfqH)%(>ʮ+mB B0ɠ?^9(Ԗ6 +%9/a*7[H +J։ Jk=:6fY4NS+VSt_IҌH-UK@$9vlldЂlݨ9}e(ζg^ތv#a3a+ĥas)wRCHP$FF,o)Eѱ )^0j} Al*y׷,;B< +Sy6K]n:] +endstream +endobj +206 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 205 0 R +/Resources 4 0 R +/Annots [ 207 0 R 208 0 R 209 0 R 210 0 R 211 0 R 212 0 R 213 0 R 214 0 R 215 0 R 216 0 R 217 0 R 218 0 R 219 0 R 220 0 R 221 0 R 222 0 R 223 0 R 224 0 R 225 0 R 226 0 R 227 0 R 228 0 R 229 0 R 230 0 R 231 0 R 232 0 R 233 0 R 234 0 R 235 0 R 236 0 R 237 0 R 238 0 R 239 0 R 240 0 R 241 0 R 242 0 R 243 0 R 244 0 R 245 0 R 246 0 R 247 0 R 248 0 R 249 0 R 250 0 R 251 0 R 252 0 R 253 0 R 254 0 R 255 0 R 256 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +207 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 790.370079 504.679134 757.670079 ] +/BS << +/W 0 +>> +/Dest (kubelet) +>> +endobj +208 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.482112 782.420079 496.429134 767.420079 ] +/BS << +/W 0 +>> +/Dest (kubelet) +>> +endobj +209 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 757.670079 498.679134 726.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) +>> +endobj +210 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 735.470079 491.179134 720.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) +>> +endobj +211 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 732.470079 498.679134 701.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) +>> +endobj +212 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 710.270079 491.179134 695.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) +>> +endobj +213 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 707.270079 498.679134 676.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) +>> +endobj +214 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 685.070079 491.179134 670.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) +>> +endobj +215 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 682.070079 498.679134 650.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---read-only-port-argument-is-set-to-0-automated) +>> +endobj +216 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 659.870079 491.179134 644.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---read-only-port-argument-is-set-to-0-automated) +>> +endobj +217 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 656.870079 498.679134 625.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) +>> +endobj +218 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 634.670079 491.179134 619.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) +>> +endobj +219 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 631.670079 498.679134 600.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) +>> +endobj +220 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 609.470079 491.179134 594.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) +>> +endobj +221 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 606.470079 498.679134 575.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) +>> +endobj +222 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 584.270079 491.179134 569.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) +>> +endobj +223 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 581.270079 498.679134 550.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---hostname-override-argument-is-not-set-manual) +>> +endobj +224 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 559.070079 491.179134 544.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---hostname-override-argument-is-not-set-manual) +>> +endobj +225 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 556.070079 498.679134 524.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-automated) +>> +endobj +226 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 518.870079 491.179134 503.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-automated) +>> +endobj +227 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 530.870079 498.679134 499.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) +>> +endobj +228 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 493.670079 491.179134 478.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) +>> +endobj +229 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 505.670079 498.679134 474.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated) +>> +endobj +230 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 446.105892 483.470079 464.892513 468.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated) +>> +endobj +231 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 480.470079 498.679134 449.270079 ] +/BS << +/W 0 +>> +/Dest (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) +>> +endobj +232 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 443.270079 491.179134 428.270079 ] +/BS << +/W 0 +>> +/Dest (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) +>> +endobj +233 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 455.270079 498.679134 424.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-automated) +>> +endobj +234 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 446.105892 433.070079 464.892513 418.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-automated) +>> +endobj +235 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 412.070079 504.679134 379.370079 ] +/BS << +/W 0 +>> +/Dest (rbac-and-service-accounts) +>> +endobj +236 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 482.198909 404.120079 496.429134 389.120079 ] +/BS << +/W 0 +>> +/Dest (rbac-and-service-accounts) +>> +endobj +237 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 379.370079 498.679134 348.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) +>> +endobj +238 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 357.170079 491.179134 342.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) +>> +endobj +239 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 354.170079 498.679134 322.970079 ] +/BS << +/W 0 +>> +/Dest (minimize-access-to-secrets-manual) +>> +endobj +240 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 446.105892 346.970079 464.892513 331.970079 ] +/BS << +/W 0 +>> +/Dest (minimize-access-to-secrets-manual) +>> +endobj +241 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 328.970079 498.679134 297.770079 ] +/BS << +/W 0 +>> +/Dest (minimize-wildcard-use-in-roles-and-clusterroles-manual) +>> +endobj +242 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 306.770079 491.179134 291.770079 ] +/BS << +/W 0 +>> +/Dest (minimize-wildcard-use-in-roles-and-clusterroles-manual) +>> +endobj +243 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 303.770079 498.679134 272.570079 ] +/BS << +/W 0 +>> +/Dest (minimize-access-to-create-pods-manual) +>> +endobj +244 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 446.105892 296.570079 464.892513 281.570079 ] +/BS << +/W 0 +>> +/Dest (minimize-access-to-create-pods-manual) +>> +endobj +245 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 278.570079 498.679134 247.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-default-service-accounts-are-not-actively-used.-automated) +>> +endobj +246 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 256.370079 491.179134 241.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-default-service-accounts-are-not-actively-used.-automated) +>> +endobj +247 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 253.370079 498.679134 222.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) +>> +endobj +248 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 231.170079 491.179134 216.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) +>> +endobj +249 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 210.170079 504.679134 177.470079 ] +/BS << +/W 0 +>> +/Dest (pod-security-policies) +>> +endobj +250 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.154476 202.220079 496.429134 187.220079 ] +/BS << +/W 0 +>> +/Dest (pod-security-policies) +>> +endobj +251 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 177.470079 498.679134 146.270079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-privileged-containers-manual) +>> +endobj +252 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 155.270079 491.179134 140.270079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-privileged-containers-manual) +>> +endobj +253 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 152.270079 498.679134 121.070079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) +>> +endobj +254 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 130.070079 491.179134 115.070079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) +>> +endobj +255 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 127.070079 498.679134 95.870079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) +>> +endobj +256 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 104.870079 491.179134 89.870079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) +>> +endobj +257 0 obj +<< +/Filter /FlateDecode +/Length 4206 +>> +stream +x]Kـi0 H56!ak#1!?EDQ=ݞ4.UT&I7 Κrr¡9~Ol'F|WKz~Id^9; X%>!eI +iSOAA݀ $M6Cj@vtlI@0ƢF4N ma@DF q| WZ3!xDpF;BS`EBlhPR)bǏl0#y4XyS%1QvOᥖ8)e5GY($TQJ1G@>UBKڧuJ#ƐS*s5nا^ +/?^y!}\)ET9|K(RW +NJ[:.$L-Fa[zXz0^e4lYT*| r}=AJ]8rV]7R}{_[??x2J٢Ԏ5n@|f9v=,շXAǟi`LOEnE3E=St6i)ho;)z虢oT|Fw/u=SLч6V=ߌ[.^kk <4 +EPfL)1V +w0>1 +w0>1)`|b`|b<|0>1A +0>1z0>Ӻ ;f'e|{|:{1g뮂FV&I-Vk&5.M6=+Д[eie +2 l`&Էd o5|\R o/YݴQ^[k롮R92fYl j!Yd9ZkocgUR}{rsg7~Mz㇊N֛̎LT Crhp?lR}{?0f`ڼ~*r{L3Eݤc&E}mG3E=SRg)Fr1C='l혁l?.ח!~Ώ2ޏhH{PҪ}ځ͟ӧdP0"·EvEgiՁti`>TsV4B,~Z͈ Cˑ :G6A"F6t(D#2KtDㄓH7 Z8 +G6 Ax +C5b1r`CV: =叔q$um(%eUkqrt݇ U#*2#Z2yOREN^.ˇϗ+%;?]8(jJo΄do`1oD3A{oeb;Qq`T#?~aDS=1 poeҚ(P>6WxDM= C0,+2:0>96#沴C2Y9>1ahm1&Rp[WɑANJk=B:jzOo>' Xi/D>ave<αy=ҺyOuݙo{ZԷ綈ꗥjWIL<7d"|\{$stn6kKZ[EJ$_*#@VmZpwZ9yZZ'_5wKĿ*dE^#|ׯ#*r~k6zFl/Xm~`8kz|/cL3:>TemuCI֘'J>[PO3fxhW9??;LX\"gvLFlt6lR +l*à:Id_odjXGS. e;p^/7g6֡cXu[ }jz}n`Y'*;sj66UN2\"slдu,ƞP.\uekh5˟er$RU5z]óҾAam$CJۻvrl}.Gkm6?Xv,*3{WMҹtJ3̴7n|y +=+7YW0K*VVdT+mFQ~U;{2iܹwSNȓHu;:e>uGST3vvKqFaO(ʵuYULu^++VuwN^{# Vyu onynz,I>{ZNy. dޅ~j{fv'w=sFO=0^ Ǖm;"Suvs*[#cP=O;W2y5Xއ>wG3l/:y|,6ovt:г-ak4Eol[:j!l_qHL0~ܪ &\.`xO[H$])ǝ&x ^4Z0NcoKPH1>oX>23CM}^"⊏O|}۪f_LE[*7:AY`,L;%P)޼c~y7~#[Lp ?CoO;#ʲLX%֔:< eq]>#Ga&=QFf"b/; ia Gݰ LN@/t:EYf낆뉇0h@܂0`ȴ<,h":70gMBl} + +u,fBb,1O(Zyey5%|}$SB@K.SPzjȖP׾6J(gv_^UtZFm%֝ |AסZ+$f/u>R3cvNT*⍀GIF-U,6(MGim/;be&c YXJha(QWX²}JB +c rbIU + w,VؖaW<%j,3xY1}fRu9| +3V(TZP$uFy]{;L!_3)ƺq%KP60d*~፰ ,i@eXٯ0J9JnOgJ(ʳjCt,b<ڰC#6PC>kKؒtIkKgb'_P%kČəG wFC]336kH 4 LC#OGa'm΀^g"Z +^mK+ZYɩQ91P_OKș5Ls(B\L62kVreOQџ{W6;^-Bήj'+eKf5Rgl۴s +bTpCyW'wQ2Ԩ 8v[K5fl猇%ۑHpNhێD8~-ިsZ|?ZG3 en{:{o&2@OIɝT6c4pH +endstream +endobj +258 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 257 0 R +/Resources 4 0 R +/Annots [ 259 0 R 260 0 R 261 0 R 262 0 R 263 0 R 264 0 R 265 0 R 266 0 R 267 0 R 268 0 R 269 0 R 270 0 R 271 0 R 272 0 R 273 0 R 274 0 R 275 0 R 276 0 R 277 0 R 278 0 R 279 0 R 280 0 R 281 0 R 282 0 R 283 0 R 284 0 R 285 0 R 286 0 R 287 0 R 288 0 R 289 0 R 290 0 R 291 0 R 292 0 R 293 0 R 294 0 R 295 0 R 296 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +259 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 808.370079 498.679134 777.170079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) +>> +endobj +260 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 786.170079 491.179134 771.170079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) +>> +endobj +261 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 783.170079 498.679134 751.970079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) +>> +endobj +262 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 760.970079 491.179134 745.970079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) +>> +endobj +263 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 757.970079 498.679134 726.770079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-root-containers-manual) +>> +endobj +264 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 735.770079 491.179134 720.770079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-root-containers-manual) +>> +endobj +265 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 732.770079 498.679134 701.570079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) +>> +endobj +266 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 710.570079 491.179134 695.570079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) +>> +endobj +267 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 707.570079 498.679134 676.370079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-added-capabilities-manual) +>> +endobj +268 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 685.370079 491.179134 670.370079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-added-capabilities-manual) +>> +endobj +269 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 682.370079 498.679134 651.170079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-capabilities-assigned-manual) +>> +endobj +270 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 660.170079 491.179134 645.170079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-capabilities-assigned-manual) +>> +endobj +271 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 639.170079 504.679134 606.470079 ] +/BS << +/W 0 +>> +/Dest (network-policies-and-cni) +>> +endobj +272 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.142757 631.220079 496.429134 616.220079 ] +/BS << +/W 0 +>> +/Dest (network-policies-and-cni) +>> +endobj +273 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 606.470079 498.679134 575.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-cni-in-use-supports-network-policies-manual) +>> +endobj +274 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 584.270079 491.179134 569.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-cni-in-use-supports-network-policies-manual) +>> +endobj +275 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 581.270079 498.679134 550.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-all-namespaces-have-network-policies-defined-automated) +>> +endobj +276 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 559.070079 491.179134 544.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-all-namespaces-have-network-policies-defined-automated) +>> +endobj +277 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 538.070079 504.679134 505.370079 ] +/BS << +/W 0 +>> +/Dest (secrets-management) +>> +endobj +278 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.070980 530.120079 496.429134 515.120079 ] +/BS << +/W 0 +>> +/Dest (secrets-management) +>> +endobj +279 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 505.370079 498.679134 474.170079 ] +/BS << +/W 0 +>> +/Dest (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) +>> +endobj +280 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 483.170079 491.179134 468.170079 ] +/BS << +/W 0 +>> +/Dest (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) +>> +endobj +281 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 480.170079 498.679134 448.970079 ] +/BS << +/W 0 +>> +/Dest (consider-external-secret-storage-manual) +>> +endobj +282 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 446.105892 472.970079 464.892513 457.970079 ] +/BS << +/W 0 +>> +/Dest (consider-external-secret-storage-manual) +>> +endobj +283 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 436.970079 504.679134 404.270079 ] +/BS << +/W 0 +>> +/Dest (extensible-admission-control) +>> +endobj +284 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 479.138851 429.020079 496.429134 414.020079 ] +/BS << +/W 0 +>> +/Dest (extensible-admission-control) +>> +endobj +285 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 404.270079 498.679134 373.070079 ] +/BS << +/W 0 +>> +/Dest (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) +>> +endobj +286 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 382.070079 491.179134 367.070079 ] +/BS << +/W 0 +>> +/Dest (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) +>> +endobj +287 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 361.070079 504.679134 328.370079 ] +/BS << +/W 0 +>> +/Dest (general-policies) +>> +endobj +288 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.118587 353.120079 496.429134 338.120079 ] +/BS << +/W 0 +>> +/Dest (general-policies) +>> +endobj +289 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 328.370079 498.679134 297.170079 ] +/BS << +/W 0 +>> +/Dest (create-administrative-boundaries-between-resources-using-namespaces-manual) +>> +endobj +290 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 306.170079 491.179134 291.170079 ] +/BS << +/W 0 +>> +/Dest (create-administrative-boundaries-between-resources-using-namespaces-manual) +>> +endobj +291 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 303.170079 498.679134 271.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) +>> +endobj +292 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 280.970079 491.179134 265.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) +>> +endobj +293 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 277.970079 498.679134 246.770079 ] +/BS << +/W 0 +>> +/Dest (apply-security-context-to-your-pods-and-containers-manual) +>> +endobj +294 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 255.770079 491.179134 240.770079 ] +/BS << +/W 0 +>> +/Dest (apply-security-context-to-your-pods-and-containers-manual) +>> +endobj +295 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 95.173228 252.770079 498.679134 221.570079 ] +/BS << +/W 0 +>> +/Dest (the-default-namespace-should-not-be-used-automated) +>> +endobj +296 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 472.392513 230.570079 491.179134 215.570079 ] +/BS << +/W 0 +>> +/Dest (the-default-namespace-should-not-be-used-automated) +>> +endobj +297 0 obj +<< +/Filter /FlateDecode +/Length 4730 +>> +stream +x\[H}_1H"@BJ"!@<$@J<9m3.WUէcw%r ||ᤦ#-E?.zC9ǟg3?SL1*OX,-ay?h| 'L1gƂ>:5\N3&VEm 5LԎ>VC((!<3z +)Ly< Y;׌O砋J3.^;8"bU]L"t1N&]] +J3^9Ӟg|V1֓GlZÊB$<]򠋷0.8mLVSVUV3.DGyg`tQ10 + +.1 01N.@$;Cb L 92Jg4w!aRt1,`kqa:D  u*kx ,j*kSp , X`v2,],ȰuaZ ܵN+k-Τ<fXtNaZ"22 q V&bX&)ǰwMD +8a Zk<27pxe8q&0,@LE. r` ߃g, 3Y@IxNpIGX[Xy!dDex.31,OȨajLx]mbX<äQ0,@~BR^TNa dI% ':aA"g pW9=]l2 P׀eK4I wT pM!I *0,M9 dJ> =Â@,ʃ..:(lsbX t0,d`X`7@ 8JalJ9`U fJpMy <&bͰ{)a3,O\bX5ӎaAKaRє *sE6TiͰ jaA2 ̠ Cc/ S3Se$R*2,2NHIy0)mϰl6͡ω +}P`?]-F0'_<- 燍HlDž!%`?Q-ŨgKn_X:<9qa7.9-F=3?Trce:<9qaHeo^r\>voǾhӑVE>/)LKLŽ^xAH:0wª'%IɐCfzc>\Qzk-HI w#}7?.|_R 8,^ȯ ;__,cp[t!9qb2mxu}o_s/T)~E)[z}^RRCyzUq>Zug9}ZsZ>c~XqYu_ZZKszp;Ϗ+c2-/ 8l˯n*/Lg }ZdKKX;1nD$hZ7 f3ܯ9r.g(q/ޗ96/O_li +j^~BUVZ~&sR-!aA4nhF֫v(4-s6׬X1LsD YE؇-WO2ޯ9:Q{u{fz ˘k_DD|qnik7a]՗.O9ݾ:ȜgW?W ~C Wl P|qC'^>Vs~sUVET݊b/59Uc5$f枘ڮ~>TόvW{Tiv> %6gV;ľc-ROrwW>sϭŊyMLUͼշƭo12&xbQݏXmӼ>YvŢVtn3{I}pnyg;0TG?!՟n?X.9;ev:N^^NɽAEzfo{(-zr9Dlx+1:aǔCYn'q?xz+ﹸv+g[Ο{{D߾9 ԝ ѵ|^uw>s[y;gzq>fO_mdw}$Țl+q̬OA+9J, [o콩d%qWu׉a*Ou>u]_s63`ڨ׃:?ё^k/<KWgVcݻZ;և3S~֏ɚs0N4yr^h:Of郔⁘4[és4G]>/4v^Nߖ>dʏfS~&rRnaP;_?ӟ{+6' ɰA9ζ<|Xw`zAlVyjkM7WL0E{s.;+b|YYus".RwmmzϫNniI.JojDk;Кe]EHa,TmNQLWf.ļ;G/fw֨%ۣudƿS]U=^~k/7>$8zb^!ϼO[[֘J'{Цs%㵍;9Wiu۪&$I(TŶ7mfEU}w~t^u^+9osA[W/p"2M..aQ#ңXo/) lb~g[M[ۣs0?s($UmʋMc>ܓNW7ٰ|un?QTyKyy8X/Ig7]1L=S#dzׯr5*r҈ؼX_[ׯٔ}=<%Td焗 " zO.W^~]BSŇ3]c~MJ:ٸ.oh TuG [+(UQպ@JBܨlqOt9;UE;8L5\8BUomTjJu mJb([Phhy׮:ב!n\I݆lZmeb+dꛞC۟20֤jU(0u),D )\gĉ8Bq(.f% EN–kQFCyY)Y!(<̓>D駗כ +(*mbS{c.n&ˊg[ӗF/-p cTPS?mE] hҚXu +i,Rl5E]ZK4#z镰[֌ת% + /9٩>ՒЂW^19kU]\W0mUOˊN1\}/o}/ş!c*wkRJШt?bx +endstream +endobj +298 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 297 0 R +/Resources 4 0 R +/Annots [ 299 0 R 300 0 R 301 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +299 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 735.770079 409.271317 720.770079 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://releases.rancher.com/documents/security/2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf) +>> +>> +endobj +300 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 351.653153 212.024079 461.230790 197.024079 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://www.cisecurity.org/benchmark/kubernetes/) +>> +>> +endobj +301 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 197.024079 165.615800 182.024079 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://www.cisecurity.org/benchmark/kubernetes/) +>> +>> +endobj +302 0 obj +<< +/Filter /FlateDecode +/Length 3488 +>> +stream +x[K$ ˒H@ N $ Núc# ?%ŞY/>d3"H# gϧ*Wk+ϗw'J{ +?%Rh;!PqXz¯~=}?1]k9t\dX>JɕS6X98l51RGVjXcB j# b +rɃ e(=[\-6W %Z<" ,^s9T-C|x -daeBɃ,xDh +Y]A}x\j5|-ȋ>T %&<()!K<ȒGGxDVF9)XYb,l o!@̐ŗlAN\0 E@ Vr\Z(ks\ +Y0[r[p|/ CB +qrMdP,`adLЖ-} }bz K5ȅ+5 KN ^,, .-, .qp8x K&-,:: +,,`._,,`.QVula|Z ܍ճ ܍!3H0p7&lݘ|c?dka=x,,d."- wCC34ʅڲ *g 7-B‚E" pY-,;DhaABx w7$ . 5yV X +;_$&88R`YX),pXw/‚ ܕiaA.BG reJCgC;YXP< e kԪ%B‚! R }dCd\mQA/GW UBvR[Xw.YX1 laAiG"W#2s l 5BdXQefoa"4jIⱗ:ZXP9;I-,1A 4y0aa#vM9&Pb jRnV j,G Ro ,,,h>;I-,罅-Tԛ-,zZXȣDgFYbaAcȒ<Ȃzd2d-,h9KY-,@zy%P,up75 "3zU{o*lf7Л[+E*杁Jd^@LT5`o^x/1>`I_QeCA̬E6p,9V7zv? ~S6>N{a{;!%rrv)hYvO9go*@ͣꂝ=]NW+ƚGo%^~ +:#鼧#a\;jsǥtݫl}_N3M.t20cļ-:S4@epW{W@{W`zC|\!!O=rPˈp鳯_o +?y?n/E$vi3`on?ܝ\9 z;nomͱ~Ztkn~6[4{__=gNUydM7T"'-C,GSR佉\2T똷lH6n*S|e˩:Rk.p'[0ek\D\cG7]f5{Ywk}VtvL~klGGt=u1f%8{9>)+o}>;m[K~1x} anNr!mnv*O[~9}wyeCC]?MOě7ƌm|_L>˹jٲ|7^\n=onu>0a \,|6qyb.=fB9ݶgl|p:=mI!L{K98w&o#,E<4SCAU ?bcX}爒:H (Q}n!/:_[,y |4)p6<ڤ|wXzol͈X.d|`|oĂi휩bww1J9e_=waohnJSVq }рDulHvy*B*vy{_Y:r^;3(`0+m^a=JncӠ(B$,sNJp[}ZAHlM<"RXoa؂C Vіn+1Iz. {Hc?">Wv$v䨞8 3p~0~^ր<1?[[Գa7 Sc;R6'u,63RBn'9MWK4js9"牝WM.AOyߓXdn-K0"/v8u2+^N?zCbd +β +?>-#lj;djr@<(bdꛆ78k^3L iPtHi&=Ciq&26+`ߚJ^lMA.|VS%]WHM`[ԋLՋMAj4Bx¬z.TzbzѶo&r'@'scBgS79c1М٣䬣R 5*j]öI/ʃ[t A3!Sކ WSKetVJL*WofK4ݹsՠe=zRyA;G=m$ԯacΎyn~zCHO|n᪮F~J7"Ds8&%"\h/3Ta͛[u +xbp%e"qI[g%᲻:)[ +endstream +endobj +303 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 302 0 R +/Resources 4 0 R +/Annots [ 304 0 R 305 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +304 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 739.370079 128.273270 724.370079 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://kubernetes.io/docs/tasks/tools/) +>> +>> +endobj +305 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 345.193925 739.370079 356.281327 724.370079 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://stedolan.github.io/jq/) +>> +>> +endobj +306 0 obj +<< +/Filter /FlateDecode +/Length 3569 +>> +stream +x\M$ 賁%  I`]Aouy.I*xfv=S"UETT*Wjm%]Isq)\R,|=׮_OqpC:VXLR|2X ,`J)ؚłp#@ n5Y,1VU!q td5K`1BK`9BAL2-^ .+-˅C +s!Kj>XYR`0b2dLAX YY" ^,j >XF.lxzE\DlL< +%LdI#xDV[x7y +/A <Ȃɷ fK , 8n-W +B ĖV, %qdaxɃ,,, ,2ܲo޲BLoaqf0fas iatRlawDA@GG ܥ ܅E 0v-,Xz dawc ܍G 9f `(l Iv:Y ރ4" p74?çV.Ԗ-,HP1}&Pqoern$.YXja0!F p7"ؼ !YXsp o.xkηZ-,H]RQ +$1yc瑇ZX‚ ‚ A5m F|RX<a4 2pW¦!V C-,ȕ]+%[X)daA $@Ƀ,\$֮QY(F J,H,,@FZ@m. \0dAhalaAI1hj\ +^(8XXpz N% x-,( U,,@(r5"3x ɶ.x!XXP#dA6haA-,@ZxeY-,MR<#da?Xlbc %(jaA%halS֛‚! 2> Nd yoaA /eY-,hFY֛‚Ɛ%!E1yIS3&erfi֛GU֛|\M dL(`Z{o*lfg5x@oBl5x`/U1ẋ+˚ͧ`o>6_c|'* +bf-2`dc1n~O9byR68)`f +ymV+L^BRCnX օC^k+F X)ͺ;M$ϑ\uzv5crA1 P)kt/8peis5v12z,[_x5y1Y5bP A-YϽ.č Mֆ4YS]bPm*'<4QP6mhPgWS;~//x|0Pv1Cd)ݿ8ߋ}fΗ_9/|Z`5be8ߋ8#tǥw88gxO9o^ ٲ;| yy~߿_-֏ߝ q2>XrߴP/E<>ѧtք&s kKF[Ekщ뾠W#β@6JׯW^wꍿHH+;Z/|xYn<شֿ)v|> /*-M{VZZ^ 9ǩNɇ6\T5[!޲n0m㱝L^6N۵Yb>ik+w.y}ڮd#Q }m/2UjZѦU~\UJ7EV0`s:/FYk+ssYbW^V(!:ODR!iiy:u<R:86Cnm全^&,}wwtɫ]~\MǴύM͠beÑɻr$K/\kniM^5pl5'v>ҖYb>OCml۬a頍OzX'uv'֕Xcݱ;YcNc!MGWOۘ}U.}c_%f+GXDkybUm{cձU-ֻXulU7ĪOZ>wzݨ`h9M}@[ޏHyu&8>sdǭvCq]y0H} +m54k%BƯ.ۧ͌w&ѯSf.nJTᔗa9}aq!sf9t>MaQl8qR/G%LShro˙dkIL:dfHzG[zAw߻_/hRFO69+Wec;s8eޅ,()wA ;7*9Wt$z$G96T'qUX,/'tK{դiTnFJ6c l8_4c2_͚ɺk7$Zg.'Z3UF:om]SiT ڢZE%G<-Yr1׾*xx$/b +i"vi/ZjW\DAETA"0)96KA*I@4̺J]aZ_z=4*)zi]<[rV7a]?+5w!$a yʙ{g9(sOI;\ƌ9b8*xOӯI~Dٙ"N +-a.RMLR: +η-8@8uC֑LޯRH}P8F#+؟Pgԭa^O`5@09Ӎf=N#عV!Rb> +endobj +308 0 obj +<< +/Filter /FlateDecode +/Length 3349 +>> +stream +xK)l@4U|r$P i,VzvZ̪Y&_=Kg'_EȕRsɻ=m5vM %H5x~.r:?릸V8s\)PX,p7HH (jB-{[,@c.`Yb T9 Z9*5Y,. 2W մi eb:łT՜łT=tXP YHXXʵX,p r-X2X,U?؂̕*b DŽjRp%צ@GbA␊bR`[,., H, +[0U, 2t[ȶX.tD J-X Z,(`dh%jK'^bAth;M`bG7b6?lbc` GXPJfXP +l >X,@l~3[,`gtl{ +A,`^~X,Ϙ7ł*%bb` M՘`K%TXPSfXeXћ7y܍dt.Vb +obek=3g莳w <[[E=ɼi3,ɼk +%yw[T ᐑ3K֋sjH_~<}O]?XFy?}ZTjuFokJ{iqxӾژTzDkVics]6^ڬr!w|[Tkł)GL"q_>֮ˤeTo|4;M-VLbͱ^vv[rg uɪꭷV_Lόկ2-=ߝ4:2erstrı/#8c~r8uE/Boh:_ o5^zdɅϐ|sxOLǶ?df鷔/|+g,Tg_gJ3 c;_9c~2mcٟ2~sesy!o_{ZvGkwv0x+~IɷѬ~*jd T2б/̍t;>9?u߮?\eG ?)͝e 7t[xϢtgi㻾ͷ{+RYVCnۇ V!;%7 \hK~7}~һ߽{gλs`ӳmzh-oOA%|9_~~*jܾ'jU~]@o :Y f}^WSkߊyG{ ܷyc5Un{?[-ogL\Zŗ5)mOLԬOQjI8Գ>U< aͱt~eV{?#奥_xs*.uoM\B/LI%C,{UhKWˉ&Gas!c?M+˵cC3zQ8q+ap6(kCHFHӤ4;ѹ9{'4#H򬻸r17+tGᱝtq"ϵ؋iD+º+WF)#vigS;K{Nq|Xy8]x܊5KdnvaO>l>[u~8'q/N[ CAb7]U:OIV^xau'^3YSIv60Ȃ)2 #Z~פAPUq;ˍBSf&k:>ۭBaLILJXNDamť:-ۙv2\:}-eE:ivm˶X` kamXh1LN}t}HV0Rފi_9ZwzhșSc.-dWXctyZNvD1pb6vZwvRk)it\Ge81uݞj(Ys%!KC*&wٱoݳy 2xQs=殃UlwB̗2/)!f)˭>~d gҿbE}biK0m_!4Y!XE_h͞CvO( +endstream +endobj +309 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 308 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +310 0 obj +<< +/Filter /FlateDecode +/Length 3764 +>> +stream +x\ێ}gIV~0`$1NiyT7o];;]! +-VrX,*r?L%E>_ޟ>IRcSX?o +gg9J^L*x?]q~Wn۸7Dwb2)d*PYG*QQEg0R4`Ğ\rTgE89: +`XS+!)*gykUXfa31_T]%LLtCt ,Xl50"P$D.uʪXlN2dfUW9`B&9갣H1):,ц%RnɒtXO1bS(;/iS2\Xqw=qŀ wA!AOq=t4.@g#-Ѹ w]AS4ʸ\2O,[Xٸ@E.3k\7^uHqA"oCqqꊱ%g x5.@66IT]2p$qXD.{Ѹ wm Ҹ w-#QuBk\:l[eO#Y5փ)4x:Z+aS゘Dh{ bfSRbCʧA9h\,ꀅk\*Y䁅׸ y`Aʠq2Sox,p|LQ0ɅY"cVu:4.H BӸg)5.I4. k\ +`h\PdGf ָ.ti\= Ը Sf B, Sk:rdFRE MpS:`Mh\vи6qQuB5.q3k\3x5.oy3i\P, Ӹh$Mָ4qq7,Λ8)PfҸ0(X4e߂p;i,%F9of f༉^rLux70"3&2[loA!!?ӕYNY1ހت^Xp/UR ,WH`dzk +굁"'OU;$̜dۂ3ǨFT[~O:}ܔ'rE|r〉\K&!с땛@D F-m vHey<,  EQEM^0/«F͋[uV楰Rd2,T_jh%NP?K 8#EK<$ayS'PS~EGFe_bwem߼r;ί28K|CEoA%kRTuP*rr_$ؖ@m{1xN2C>;-:f!fQ"/w;GCbӻu߽G.mk_8C8s8A[ږi-]"DZw;m[Ρ]QemGlK-eܶM媍psfi7YF"ʬɍm|L-]vr(,rC@ _TFy4yp֟S _ߑ {f@1rx{_6uAYn[-lW=-,s@y6Տ_̳GoFv氝jR-(YP<0tkL+a.K)pN)\\F\H!N=}Ip^92rwN+d2Nv]5mCr3{wu}㪭--Xhcw.sjmwaZx9TFqvfZTl9<a![襎I/s ;ixN)~ysx.£<_zi8d-eā}=i8T 31}6=0<* Pw˫x-F;=Կ +y#|mj c]{Ϟ $iwڲ/kejW8bPf_Ni9,n#O%\{3e;mo8,GH8/M4-5ai/WZTY. TjNrRl뚱]?<\ +ss$J.'^-JVMK2\r7"[lTI޸q+͓r +wߟBRj64כ4Ҕ5L͕W]*̳|p]J1.i:Yqu'sr*t{nt2$Ou],ӹr q|oU7&w!;gq+];|^{~n =ڍ&RANw86q/OK=kqo;[έE|X^o¾m&Q74oq\K;4[Mu, Æw&˄+Ί=yڌi\Gx*領FH>O]$UGHw@S@)9M/y^ +”FHGneS4̓ ׳׽BmS{>1vӥc6PG=[c)>:IhV+yPn͠-Pt6Y15L6kfYfU+S ϳü*݈a^x+׳% P9QYŹuIMvch{H¡){gmuj&v5Dp!,L'G~Wriw%HXD69tPSWUқN knG-w ^LrT*$Wޖ?DP +endstream +endobj +311 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 310 0 R +/Resources 4 0 R +/Annots [ 312 0 R 313 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +312 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 797.673057 101.433071 778.923057 ] +/BS << +/W 0 +>> +/Dest (cb1-1) +>> +endobj +313 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 616.126036 101.433071 597.376036 ] +/BS << +/W 0 +>> +/Dest (cb2-1) +>> +endobj +314 0 obj +<< +/Filter /FlateDecode +/Length 4096 +>> +stream +x\I$G3Ҥ33"7,2q7[ Ҙ/rx=aSOWEYU/L%E>_ޜޞI_m;I,'\9I%O'w8]?}ٛRw÷b2)d*`YG ++QaEgph,{f%%12 NYbXcA WBRXBUy2Wx.G睉x.yGdbb+&cu/@ƃ,L9iY(UyD/A! +%ų>YCH_Xdxi@@,Uy +kX@D3iX@@[hX@[iX@[.jX@\i5, . T4, `.;5, .=iX@@] +kX@]5, .0p=UdkXt42iX]r6iX]װV5èa| ٲ )@%$ .A]װ}԰b?Va=x4,`ƣ,Ѱ w]ASbhe\.QÂuSyŸ+q -cѰ wHÂ|f kX5pb5,] Aq(4,@~3uU^1aAf K4,:TÂEz/D DDe=*Pa4Uc=Bw5pT4,]I$5,Uװ f6%aA,<|*/ !Td6Jְ yBkXs:@/^ϥ~B8\B'XyJ[tv,}}'mc9n6.6m1d~l.m>|_/zH[eՖ((~!ܥ)$c?T¯ʊmEIO}*o}qxєZ/WJq%8wԂ)}<%2U$\͊dmJ{T6-QC]]z w:JGiQr=uޔ#Lq=vG([ksQ|DNu"|궹{o;tXQ'65%T.ez2n*8ujq(69 v{ty׊ē7uV:/7i[vXpzoSl:<ʝD!([>D9=GL|pr4|>-va`Rrš`K|"tϺazGCޝ6>4SMC߻ewھ'y?[XL ߍm"OLD d\eü7 Ʃ0MtV2((I;w^i\fpȘmg͐!xɄ (}7K{pAn9כ7%{Gٱ2ia@tuKmmNksp\c+{ w%_aBoc8~9ܑ7~[ZfZV"Q@k.iT2Pۨ'(+ʕ"ʑ{|===Qܥd7[ >H=""`xv_E'ߔLyFӳba,{$vGz|:R$ey]wn\BKDc]>dytq+V9eĕ2 P=m>Qg5MuOveCĶ*JWi)ǚcWʦdOw߃M?Do(SwAuO|z ؒp d!bEOMh٥fgJ^_ 6roM?_"SQ}=1!&wĸ~( +R^|_b!A\uQ,nnٟv!֎=o+H8 R]:_X7 ܃{4,%!wNG~L# 0F*G@'~8L˸</_$',U;mo'>$qoZ;.dŋNa=/?.϶{/xͳ[npWb:\~ܑ 7G!󡶙 {;ؔ'yKrHvfJ>/CLΔ.#NAqLXd;1!IE~^MA2rrJ3ͮCwZ J`ZOց٭<^l&r RDž uNz#YNzN h=E YZdхg r&bhƈ[zYR5Ť~j:VJ UU[gQ-(i^-G-Z\{*ϖis~me$n{Ď>j|]"Olc5}n\u&0MN~M r NVzI呂gUuGm$KE/7O$4O߿|5 +endstream +endobj +315 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 314 0 R +/Resources 4 0 R +/Annots [ 316 0 R 317 0 R 318 0 R 319 0 R 320 0 R 321 0 R 322 0 R 323 0 R 324 0 R 325 0 R 326 0 R 327 0 R 328 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +316 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 349.923057 101.433071 331.173057 ] +/BS << +/W 0 +>> +/Dest (cb3-1) +>> +endobj +317 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 330.976036 99.933071 312.226036 ] +/BS << +/W 0 +>> +/Dest (cb3-2) +>> +endobj +318 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 312.029014 99.933071 293.279014 ] +/BS << +/W 0 +>> +/Dest (cb3-3) +>> +endobj +319 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 274.134971 99.933071 255.384971 ] +/BS << +/W 0 +>> +/Dest (cb3-4) +>> +endobj +320 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 255.187950 99.933071 236.437950 ] +/BS << +/W 0 +>> +/Dest (cb3-5) +>> +endobj +321 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 236.240928 99.933071 217.490928 ] +/BS << +/W 0 +>> +/Dest (cb3-6) +>> +endobj +322 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 217.293907 99.933071 198.543907 ] +/BS << +/W 0 +>> +/Dest (cb3-7) +>> +endobj +323 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 198.346885 99.933071 179.596885 ] +/BS << +/W 0 +>> +/Dest (cb3-8) +>> +endobj +324 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 179.399864 99.933071 160.649864 ] +/BS << +/W 0 +>> +/Dest (cb3-9) +>> +endobj +325 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 160.452842 99.933071 141.702842 ] +/BS << +/W 0 +>> +/Dest (cb3-10) +>> +endobj +326 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 141.505821 99.933071 122.755821 ] +/BS << +/W 0 +>> +/Dest (cb3-11) +>> +endobj +327 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 122.558799 99.933071 103.808799 ] +/BS << +/W 0 +>> +/Dest (cb3-12) +>> +endobj +328 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 103.611778 99.933071 84.861778 ] +/BS << +/W 0 +>> +/Dest (cb3-13) +>> +endobj +329 0 obj +<< +/Filter /FlateDecode +/Length 5150 +>> +stream +x]]#7r}ׯ撬`a $pb`y_{vx󐿟SG)]ͮf*VSUl6q'39鷓5)XYjl.pv οJ%J)X鏿;ϖǝ)%zEHL&lPH$H!`R!* n5Bb{R\rHP +)C hO*P' jBrz8oJ"BsDtzhޙ/*-hD&&vibb!k4.Xt j4”FЅ"Y]|Nt蝢2t* hF+dB*fs{Ld5s&`nJEabRhDJ.h]5p"PYV/MF * `55% |Jg |&Ù>)ñ$ :мӀ,t 5$ ]Ҡ ְgaw}aw} PiI[<7p5,`g5,D1F]@Hհ4O@K4,]WZK԰ w]b\B+v^6.ƢaAQ  <װ wSk4jX!а8Ҋ%g p5,66ITZ2HNC5,]aA@aAZFأҠ ea`M#X5)4p:FZ+nSÂg A5,MI)jX !JAÂdQY* pb XB%kX Fd YaAqg `of +YH-%L.!J.b$@'/aAQͬa 䛈%,fR 4pi԰7jL'f8b`U]2^xXHDfj +겁"&\V%3s,0 Ftr^ީvY˟N{>nY)&?q:\Eht1ҩPQ",n$\1m9/n24xlPQuI>pc; A7|8v_'yޯc4]ysڶ*yTP;?]I{;"r? FU,N4$`D-*^')M?x_7B9Fz{hϧZ~'/_t !h.-1ôٲs8bFadj +3<@}%Hn)KOk`4CJh+y@#=ObTOHF[_D}{ȃѰ9ѹp'2qI w/ uO|"~Y@yda B{s,׀%$M*LȈϑ".D ެͱw~<0CGdαE#OEIטW}>[ĀBVαHX%91X^fb8S 93bǩ~niQ㑮I K0I, 펟byYku\fۻcHEtͪm+Yb#Ky[9׋yJеoԥpOG(!x/e|m%y.bA|ϗL<;;?oGܛs1#cZ*<sP\G jQW_gQ@2d +¶d$ZOLQIJA{bI G(d>y=\-9,̠a+9^=R&fY@(X^gr.y얟;96b(}遛(X^Bc"JF(, ƛeBr>Vi~6$l(z: Vs<\-H~:/ZxX?_ u^>x%r(>}d{)S A Z=Oy;&E1s<k!Ҟi+a3<=Ks +s2d[BHfs 1ĥm/cI덻\unu!k->y1̮YWח⟳yR6v +Y2:DifSd# 7q>f/Aq`u Hi$z;rDb|GONGjxŤ i wzwȀd^ynVX}{ފ}FxOpߑh)w'ZhG'Z +#DK~dh<̽{B" VCI%Y"fw<l?'4˼'4V?#5Y7ϱ$ znrN +Ihf=nw6bcy/lƱ8işlD˹H;ze::Yy#~JhwpU"Ex.o{owz.ጎ\?aG+#O} !)nU?0DyKGN=VfՇu:rT` @۱n$cyυ))\W-KW`jzz햶'j0<;%ޟ+Ns{.?eR)Mj5@j^.a5-h|ި)!(o];)]MYD7onU-+Ňg|ܬ`89H^ +/gn#z'ĞHav8 aQ{QU59 $e eoUKq|y_ ] d Tttm;}/+^>͘*g٧V_䇵AEF!{ ocm.Y g#ۦr +:LnXw~s5Z-EV~3Aa/-I6&/g΀c&v)ξ^/'1V,md L ҄_PFCeo9iX)gtb{dk P6^ŦJUg+@vؑ +þb9kic¦unZקa8o,]~QKōTQw2*4Ԛm@RvR +U4c0}59RDVzJIJ mR;k=USrxl飵4/ 6b~G:6 +NC`WR;tN8>_zrӬer{Jy/۔CuUoDlo;i, uXǩ˥_.[nzlS:tPJUO@ǶصY׊j4 mUЦMq34S 50Cۋc/cqj# M0kX~bYӧ56v +藥ZkC'qN>-nSFrS;c:'>S=ǽmhnGO&?̖'ja3^7^sgkM5XzžM]hp[ ѱrIBU.e4.<ĕT.T#.F,]2!FZ׋<,C!i(-w1TAL(h(y}xWc)mJƤ^Je^6C@5CM G-C \st(͝mFml-kS)l[;j/S?=QiQ"z-Q 8S;kX2+eqnkR-۷۶=]#S®C\xVZr58jv<-?pksN#%OynWDZ0MN~XW 0?cOe)Üݭ-U,- B2I(?MKfEde(mO} +endstream +endobj +330 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 329 0 R +/Resources 4 0 R +/Annots [ 331 0 R 332 0 R 333 0 R 334 0 R 335 0 R 336 0 R 337 0 R 338 0 R 339 0 R 340 0 R 341 0 R 342 0 R 343 0 R 344 0 R 345 0 R 346 0 R 347 0 R 348 0 R 349 0 R 350 0 R 351 0 R 352 0 R 353 0 R 354 0 R 355 0 R 356 0 R 357 0 R 358 0 R 359 0 R 360 0 R 361 0 R 362 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +331 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb3-14) +>> +endobj +332 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb3-15) +>> +endobj +333 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb3-16) +>> +endobj +334 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb3-17) +>> +endobj +335 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb3-18) +>> +endobj +336 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb3-19) +>> +endobj +337 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb3-20) +>> +endobj +338 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb3-21) +>> +endobj +339 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb3-22) +>> +endobj +340 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb3-23) +>> +endobj +341 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb3-24) +>> +endobj +342 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb3-25) +>> +endobj +343 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb3-26) +>> +endobj +344 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb3-27) +>> +endobj +345 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb3-28) +>> +endobj +346 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb3-29) +>> +endobj +347 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb3-30) +>> +endobj +348 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb3-31) +>> +endobj +349 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb3-32) +>> +endobj +350 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb3-33) +>> +endobj +351 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb3-34) +>> +endobj +352 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb3-35) +>> +endobj +353 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb3-36) +>> +endobj +354 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb3-37) +>> +endobj +355 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb3-38) +>> +endobj +356 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb3-39) +>> +endobj +357 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb3-40) +>> +endobj +358 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb3-41) +>> +endobj +359 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb3-42) +>> +endobj +360 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb3-43) +>> +endobj +361 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb3-44) +>> +endobj +362 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 169.815391 101.433071 151.065391 ] +/BS << +/W 0 +>> +/Dest (cb4-1) +>> +endobj +363 0 obj +<< +/Filter /FlateDecode +/Length 4499 +>> +stream +x\[$7~_1HqlW&Ey@B@$@ 6= t+w=53}v=*_[ev&"/?~ z G `(ch  z8Y`ϓ(x%+ZK԰ w]Fb\hXHÂ|f #װ wax]հ w7 `!аq%g p5,(lld`HNC5,] EÂܵHÂܵGA^5mFjRh ɂY*pb XB%kX$I˧^l^^ګeP5ւ{-Xo-C]jrs=")hnQ^' ˉ$,^SC h-tWDD7fyl-XUN^z_Xƫ/V#T6-V}Yik݋]{yWeȓǕ,wս,b-MQAݔ"eɨ+lD-m\<x9$E ;nq4SnnZ]u}NnL<`T0Ga<HoΫWH(n-hi)z* w#Zޭn`'M΄ڿEqåan3Hcy>|s|99j m(l;uNOK-dyrv،|} +᧲6!vjee,3S\-Oc쮽q׎VYmԹ gdŋ>y9?2CY߈6M@`&o9d 3Is46G* 4f/x,(ç!Amǔ쎕hv];~rzg^r̋7^7 es{]v/.!~Cp\'42fYkDz84)eLwue"fѷ棬 "yG^Peg:'-uڱSzC._#vZq(hQh.V=~n&%%dHKey/gOsЏK}aE+'/%Hl*uS5(Ҷl̾>xk'A[<ح ~LE.#$7/x9Kњ.3{elˁξ:vF +gz.Gab\_ ivv^ @ZL-a>vu9m~X/Lkkpr连ή聆}{ד2s;,eJSR0vO^SwOZk$h׷'b]ָ,wɆ֧E (紣!ّhs}஺8]Yun֧;/'TK{JJv4*Z!I!]N + ۊftfO&wsbn=]i夦[K ROG4?DN+^U$/|R%M6Ov㯈Sz +IIVLo&Tn'g;ePell4&/P:UpMJn'Qf'o4cG48\Jfg}l=u؆:l%nu,ӱr&&MuCrʢ=r9v|ɩ]^dxbU2nT6`A0Z[;:dڈ{9T9OKɛS(˝4Ӯ.㸷-| y=[ Y޻Ոm& 64k^n#ܙ'+W"fe|jߌ{yq?Γ\nRanSxcHwrYmʈP> +endobj +365 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 555.573057 101.433071 536.823057 ] +/BS << +/W 0 +>> +/Dest (cb7-1) +>> +endobj +366 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 536.626036 99.933071 517.876036 ] +/BS << +/W 0 +>> +/Dest (cb7-2) +>> +endobj +367 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 517.679014 99.933071 498.929014 ] +/BS << +/W 0 +>> +/Dest (cb7-3) +>> +endobj +368 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 479.784971 99.933071 461.034971 ] +/BS << +/W 0 +>> +/Dest (cb7-4) +>> +endobj +369 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 441.890928 99.933071 423.140928 ] +/BS << +/W 0 +>> +/Dest (cb7-5) +>> +endobj +370 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 422.943907 99.933071 404.193907 ] +/BS << +/W 0 +>> +/Dest (cb7-6) +>> +endobj +371 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 403.996885 99.933071 385.246885 ] +/BS << +/W 0 +>> +/Dest (cb7-7) +>> +endobj +372 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 385.049864 99.933071 366.299864 ] +/BS << +/W 0 +>> +/Dest (cb7-8) +>> +endobj +373 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 366.102842 99.933071 347.352842 ] +/BS << +/W 0 +>> +/Dest (cb7-9) +>> +endobj +374 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 347.155821 99.933071 328.405821 ] +/BS << +/W 0 +>> +/Dest (cb7-10) +>> +endobj +375 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 328.208799 99.933071 309.458799 ] +/BS << +/W 0 +>> +/Dest (cb7-11) +>> +endobj +376 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 309.261778 99.933071 290.511778 ] +/BS << +/W 0 +>> +/Dest (cb7-12) +>> +endobj +377 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 290.314756 99.933071 271.564756 ] +/BS << +/W 0 +>> +/Dest (cb7-13) +>> +endobj +378 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 271.367735 99.933071 252.617735 ] +/BS << +/W 0 +>> +/Dest (cb7-14) +>> +endobj +379 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 252.420714 99.933071 233.670714 ] +/BS << +/W 0 +>> +/Dest (cb7-15) +>> +endobj +380 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 233.473692 99.933071 214.723692 ] +/BS << +/W 0 +>> +/Dest (cb7-16) +>> +endobj +381 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 214.526671 99.933071 195.776671 ] +/BS << +/W 0 +>> +/Dest (cb7-17) +>> +endobj +382 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 195.579649 99.933071 176.829649 ] +/BS << +/W 0 +>> +/Dest (cb7-18) +>> +endobj +383 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 176.632628 99.933071 157.882628 ] +/BS << +/W 0 +>> +/Dest (cb7-19) +>> +endobj +384 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 157.685606 99.933071 138.935606 ] +/BS << +/W 0 +>> +/Dest (cb7-20) +>> +endobj +385 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 138.738585 99.933071 119.988585 ] +/BS << +/W 0 +>> +/Dest (cb7-21) +>> +endobj +386 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 119.791563 99.933071 101.041563 ] +/BS << +/W 0 +>> +/Dest (cb7-22) +>> +endobj +387 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 100.844542 99.933071 82.094542 ] +/BS << +/W 0 +>> +/Dest (cb7-23) +>> +endobj +388 0 obj +<< +/Filter /FlateDecode +/Length 4877 +>> +stream +x]]8n}_Q V/` IHIAzN"`69tْ\-EMOuIQ%eZ\Rۯ.֤`Tbu1'Lp%pUL*x}௻˾wzSJ.\L)٠ +X֑ +CTXb) jĞ5䠱{VіUO5p%$,pZE,3y炉31_T^%LLxCx ]BNxЅ)' E*H%;Ee*h+dB*gs[Ld5s&6I0H1)<] EA@k<.?8(x&KN}b]0]l>%ų>YCH_Xdxi@@. UyЅ +kX@D3iX@@[hX@[iX@[.jX@\i5, . T4, `.;5, .=iX@@] +kX@]5, .0p*5,:r4,`.94,`.kXQ5èal ٲ SK>H0p܂6sw}^zQX5B@a*3a +?ŧV5,]1|*ߢhXHÂ|f 3װ wax]հ w7 `!аq%g p5,,lld`HNC5,]LEÂܵHÂܵGA^5mFjRh ɂY*pb XB%kX있*G*RN<,ݱn%K^+?yVf{`>(zG΄G~p]p+$*HӂG-@3-f{o{?c5o-;ٶ*;X>|%~Lu BtVrU@Y !D4=pxgc2/i"B9޺[x붅#ުH cMNr}Lu c:˘DNӳҽqg ].kبEfc2Sz>t/mgωWwϮ_MۘH&ejA!o?(itۅh^N{g4;iWlJ5# >M^{:gqxRj˳#yW .YX^1(: ssOnd^@ 5c"3z !|a\7 x7y\Yq gy1JTa͠5=hjweز#>2f???D]SVHG#Yɶ^i9q`vV2DSGEq&\Lմd{Ylko: y;r Xݖ(=b/yA BDÆ]^i=#𺡣V:(u`ŨV7]?3nks}! H9^B?AKܽ9h#ⳛv{3k?O˄H-xbkKj^_5({9иᅈe^~($s]smGLE+ǂ#^5GS9$2F,Bz871uǷ'E>}aLu@4hZWp6DYW4,73ɳюy)}'t]ݹ͎)E9;䅜St{}xV{}}FHH! Z~[H ϴBpRbb}ohSρc-ڞ}t˽'FUt+gowF" Bf * NѸ:{zYu? +9x Zt@N OO]NXE)It*h*4}dCpf}: 䤢@ &>Zɘ y:0ZuWqy<y"K*7I?'y$W2G h(`b4y# 8] +#YU鐐Uu\\1&9 sAbi{xw}?oجz.p+,'t(cgn32ɏg y_ +W9:v_EO)t $MF۝W-41#Ww}G_/h=#I?n~l6&$B9w˨%239VYۿux+_`bR6>S]>&9hU=/%NlArFvˉYZ%ȾwLx@||ش vI͡p.sQ]mJ}'R\v JM1Ⱦ?C!HEF%5izMwALE_1ѲGQ{}*ZR{j1Vө4]esh:nqC.|j\m&6}V.E B5E8-2qV{)՘QtGvbG%nJˌW%P9d%Btr+I m6^fkw-2M,lJ¿3s[uJVB\nC]"OOKtRĹ[9,xd"-a8 GBu(Du1yMc,5W߼ T/$Ao߲J֩KC2zdI +endstream +endobj +389 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 388 0 R +/Resources 4 0 R +/Annots [ 390 0 R 391 0 R 392 0 R 393 0 R 394 0 R 395 0 R 396 0 R 397 0 R 398 0 R 399 0 R 400 0 R 401 0 R 402 0 R 403 0 R 404 0 R 405 0 R 406 0 R 407 0 R 408 0 R 409 0 R 410 0 R 411 0 R 412 0 R 413 0 R 414 0 R 415 0 R 416 0 R 417 0 R 418 0 R 419 0 R 420 0 R 421 0 R 422 0 R 423 0 R 424 0 R 425 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +390 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb7-24) +>> +endobj +391 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb7-25) +>> +endobj +392 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb7-26) +>> +endobj +393 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb7-27) +>> +endobj +394 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb7-28) +>> +endobj +395 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb7-29) +>> +endobj +396 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb7-30) +>> +endobj +397 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb7-31) +>> +endobj +398 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb7-32) +>> +endobj +399 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb7-33) +>> +endobj +400 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb7-34) +>> +endobj +401 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb7-35) +>> +endobj +402 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb7-36) +>> +endobj +403 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb7-37) +>> +endobj +404 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb7-38) +>> +endobj +405 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb7-39) +>> +endobj +406 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb7-40) +>> +endobj +407 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb7-41) +>> +endobj +408 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb7-42) +>> +endobj +409 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb7-43) +>> +endobj +410 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb7-44) +>> +endobj +411 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb7-45) +>> +endobj +412 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb7-46) +>> +endobj +413 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb7-47) +>> +endobj +414 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb7-48) +>> +endobj +415 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb7-49) +>> +endobj +416 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb7-50) +>> +endobj +417 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb7-51) +>> +endobj +418 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb7-52) +>> +endobj +419 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb7-53) +>> +endobj +420 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb7-54) +>> +endobj +421 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb7-55) +>> +endobj +422 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb7-56) +>> +endobj +423 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb7-57) +>> +endobj +424 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb7-58) +>> +endobj +425 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb7-59) +>> +endobj +426 0 obj +<< +/Filter /FlateDecode +/Length 4516 +>> +stream +x\[$m~_1T*nAlId a󐿟]GG3Mօ"?.j?ɹO/֤`_-I,'\9\%J)^_/gw9o.qWoJޅ? ɤ +e)LJ>D- FH 4`89gc1\ Ia9 9VAL^`"5w&K5]pc!K(iYc0"dHVAiY[ְ>!daw}-h0p׳P Ǫpt`5,@ϓhx%+O%jX.cT^1.ABX4,]*Ұ wY`AD#DjuX pyCа` ߌ0]W-9kX%aH!9 "հ wދkkiʃ,k*>dXx]0km*D஄M b@@,kX3R԰  R> ɂY*pb XB%kXl(åLfCz 1كKdmHBW=ߐOэL=nY'AZ= +/.eB+A~!MRBL>$;u.o!s`Vwiw/[ q[6Ў\ˮ۶^7xM^'~O21DV,m5 UCy2I;i];,{m {(im6lUQS;mTSI,_NU6'Ku;SqOƭXh³^rVjFpNYuZD}dχ:$K5`qOdW5oY>VGpHMV'pϫ*ǽű)%vYaFZsiӹ*96Ҹ縜Ɲ] ~%C n4[ rj/=nQlWo/}&+K'6ZhVWzb}M~f⸳WS YL^j嘴xZv}"q/cιH/G۩E ",9#!aԑǹ4N41&J-FV=:*y޿Ӑ<6jiScɫԕ-}j=<-?6V[n6-{{{.{\{XnmZ4\ڎ]meh]si){G(ׇ +{]qGcdZu_ǥJ˽ ~{$2b.ǣ-&Jꭜ}I~[ѷУ  xYr!@b݆ϯICuQC􎺼m/\a w:~ⰺApwqژF-)ۯmXϝ.8S&'If<=[A8Wk#@,rd+&yKZ>K5)\Uc9J-uޏ")uoZkZxR=r1K_uom۬?2{w=bˡ{xRV,r &ٕcﶛӔqte&CrX驖suޏi$YΙWm܏+iv K|6n8DBϦ=}r\Nf&yj'ՐOemݹ\nS\[8mn1yA`G~]<~GzDbyQPLX1kHp4zz>dwHhhLOvȲY6}>dA? "ȳNt?-DܴۭoOIy I.%a鱸fe:۱N}tvZwfòv]S.Jck~hΕLyJ[wT7IsYϥ{v?l?_b}gmR% qi{[ht%)[unCZ5ym+DYcݓq+Yޚ WbYy.;ىvn=7yM4 vAT9ٚjhtjh%p't(olkii煘!q/WZ9tBKQ4QSWhUG+5k&~nr<͓;{ ^BRJ64ӛ4{T9ҵk6I5bwyAvy z~kVuu;DtlL8 vZ/K~=ɣM*\̷VӜwhEQOrkԂ7N<)7ڦ(:\fLqR8ZJ=Կ̚t%yT]YiE-QOliܝ%{.Zkw*h}mm$ԎjߗRgꠕju%jv<շ#0E^4uJWDZ0MN立 +FyΘjի)@Y +0gV 3JuA_&*[I,K=~f? +endstream +endobj +427 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 426 0 R +/Resources 4 0 R +/Annots [ 428 0 R 429 0 R 430 0 R 431 0 R 432 0 R 433 0 R 434 0 R 435 0 R 436 0 R 437 0 R 438 0 R 439 0 R 440 0 R 441 0 R 442 0 R 443 0 R 444 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +428 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb7-60) +>> +endobj +429 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb7-61) +>> +endobj +430 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 719.279014 101.433071 700.529014 ] +/BS << +/W 0 +>> +/Dest (cb8-1) +>> +endobj +431 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 378.534971 101.433071 359.784971 ] +/BS << +/W 0 +>> +/Dest (cb11-1) +>> +endobj +432 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 359.587950 99.933071 340.837950 ] +/BS << +/W 0 +>> +/Dest (cb11-2) +>> +endobj +433 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 340.640928 99.933071 321.890928 ] +/BS << +/W 0 +>> +/Dest (cb11-3) +>> +endobj +434 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 302.746885 99.933071 283.996885 ] +/BS << +/W 0 +>> +/Dest (cb11-4) +>> +endobj +435 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 264.852842 99.933071 246.102842 ] +/BS << +/W 0 +>> +/Dest (cb11-5) +>> +endobj +436 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 245.905821 99.933071 227.155821 ] +/BS << +/W 0 +>> +/Dest (cb11-6) +>> +endobj +437 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 226.958799 99.933071 208.208799 ] +/BS << +/W 0 +>> +/Dest (cb11-7) +>> +endobj +438 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 208.011778 99.933071 189.261778 ] +/BS << +/W 0 +>> +/Dest (cb11-8) +>> +endobj +439 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 189.064756 99.933071 170.314756 ] +/BS << +/W 0 +>> +/Dest (cb11-9) +>> +endobj +440 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 170.117735 99.933071 151.367735 ] +/BS << +/W 0 +>> +/Dest (cb11-10) +>> +endobj +441 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 151.170714 99.933071 132.420714 ] +/BS << +/W 0 +>> +/Dest (cb11-11) +>> +endobj +442 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 132.223692 99.933071 113.473692 ] +/BS << +/W 0 +>> +/Dest (cb11-12) +>> +endobj +443 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 113.276671 99.933071 94.526671 ] +/BS << +/W 0 +>> +/Dest (cb11-13) +>> +endobj +444 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 94.329649 99.933071 75.579649 ] +/BS << +/W 0 +>> +/Dest (cb11-14) +>> +endobj +445 0 obj +<< +/Filter /FlateDecode +/Length 5005 +>> +stream +x]]8n}_Q V/`0  ]L@4}ӽŝyϡ˖2,WWo%Z"HIvev&"~=v&S)d+1BdR > ]]OeٛRw/b2)d*`YG ++QaEgph,{޲Ƃ}VXj'G[V>9XPÕykU &ӣ\|Qy <#21 Nc Y1t :KpVA4^.ɪ)ñ$ :Ӏ,t 5$ ] ְ`Xx]0km*DL$5,Qװ f6%aA,<|*/\ !Tt 6Jְ yBkXszl &_O?쇯?À6~p0u^kgJC9-"ϟu.;s6eJnhUǸSd'=юvu_3}ѩ꾴k=&?|kc!̰i"A {?(a}{B̍T@֎ݐNHj<2vKӠjxACL"x//W=vW\g*^tV۸֑J'³.}^ckI7,]Au u!א`t"Q3\ +د+O;1 KGx&טw~ga,lLJ,]eՌ(D3>x gK`G`m`}`$٬T$E4k6&z-[!<ͬC I9`UA{҅Lz&-&N0?3`0|/೤hp0EZj?aY&|K&U:LN%_fu޽ y綵/w˜Kq]OtHOjAe^& -{pzK#Ӊd>9uj5:5c+hי&+7̂q~ں@D^(")1UuQ>ѹ0A eY2Ŝ$'@>$:XܡOe&{r61y7_Y#N.fU~ѧʩ5̷xe^/&(!]buGc­dzM*L@LL^nqe4G#)7uڶ#Zew:$pߏd^YvJC2 8c1)˞Mn1ݠ{ tJYݐ[nmr&苳Nw +9fc"/cxbNQԀZ [. r i7MG٠tnuu[-VE[o19k8dy BD7n.'bkwBP,0ʼ^`/ERWƩl;{NJ>C_}vڵDѥ08ڃ2/C[Xʺ"}`Z͓]owޛVGGD9J@4m,e6Cy/p'<lk8gџH*b9h^1(: lZm]q<_;f@%7?׌pd!}c'n\ bEjqϊk0'R 3(zqM#:hjwuز#>2f?ǷTGY*$VHVw9jݹ$̎l>nkHm>*zv5DZMK7!4Yb̘>SwEQN`ìGb乧٘ :li+/POzG鮏]"uCG#t=׎;~bTMlt.fV~Ccm;c1aX[MÛʳqЀ5鱧~1&2G%y3"uu:۝:'ɆuIyV8d?z@g7hcuqim)#x}y H `S״d\JAދ\&ګ6e`A޿94~+z@">+z,o(. +8ݳ92= alP{|mk܇HX=Sy09x_YPP4v#?`D%Zu]ʵeh(Oz;yŸ'wgLu,'\2;3 +?ђuOm*i?ѠCܽsФG#xz{m&c {o7zq}Yls z_ V1"M T,O ^zoq|PeX96;fr[9I#I"+$o;EM+%ĹG gJGpM@ҡ@5CX\.GV:Tm[Lutď->26]ut+iF# f)F.2ûI<ۏY_][nxeôțxXGc"OYQuРuDyf !ݴL93Mw>UFH$vqnaS}nv$<}EFdCKE$凜h_~Ol[x']Bh~z+ڼ34Sze3غ4RKVΡH|v?Ou4Iv$ݲ U=6)NSu;mrXFĨ%v0cU%R?HV^h~9Æb.4d[d:#o9墑OMA珶%GCho1^`),}XF"&1<Ʊ\_VnKG7:*VUB\tU}Va%˙F [kdyR׏9U\7KYG|;YTwg/4*u@Bz;)R5c0+5yCZ,I-7HZ*7Ѳ|S: +m꣙:|\呌:6wv7ķ<\!BRJ6,mҨ)/]\hZRyIɻUkD|םcEzqjeBXm/R^@=v]SY&ju,Oʞh%\#j+r3TW 6]gȱb{ONuĝ8[l~!M_H#b>(4rxkE'2cs2m};4MsȽ,D@b(˝e~N|˗yۊbdIy,ߢtD7˭lXwxM6`_Jr{bh}ؑ}5]pvՋ5ֱi咖C3$^E;̍GmJ>wUJ)\ .Jq5Xf+5 Fj׋]!xܦپ6EWDW_-+}voYxP+W{O7& +x:˸sMo\P:ߣ4h.zB(/UDQ4ji)bKLw^J5hԿ=QQR2hjzsNl+Ycɬb/]JB۶붗7EbLm #sZuJ-?J +0Qd=M>isN^jQ]LWnX(KA f%h"9eTQ7RVrJ֩KC26V +endstream +endobj +446 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 445 0 R +/Resources 4 0 R +/Annots [ 447 0 R 448 0 R 449 0 R 450 0 R 451 0 R 452 0 R 453 0 R 454 0 R 455 0 R 456 0 R 457 0 R 458 0 R 459 0 R 460 0 R 461 0 R 462 0 R 463 0 R 464 0 R 465 0 R 466 0 R 467 0 R 468 0 R 469 0 R 470 0 R 471 0 R 472 0 R 473 0 R 474 0 R 475 0 R 476 0 R 477 0 R 478 0 R 479 0 R 480 0 R 481 0 R 482 0 R 483 0 R 484 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +447 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb11-15) +>> +endobj +448 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb11-16) +>> +endobj +449 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb11-17) +>> +endobj +450 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb11-18) +>> +endobj +451 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb11-19) +>> +endobj +452 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb11-20) +>> +endobj +453 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb11-21) +>> +endobj +454 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb11-22) +>> +endobj +455 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb11-23) +>> +endobj +456 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb11-24) +>> +endobj +457 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb11-25) +>> +endobj +458 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb11-26) +>> +endobj +459 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb11-27) +>> +endobj +460 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb11-28) +>> +endobj +461 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb11-29) +>> +endobj +462 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb11-30) +>> +endobj +463 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb11-31) +>> +endobj +464 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb11-32) +>> +endobj +465 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb11-33) +>> +endobj +466 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb11-34) +>> +endobj +467 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb11-35) +>> +endobj +468 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb11-36) +>> +endobj +469 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb11-37) +>> +endobj +470 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb11-38) +>> +endobj +471 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb11-39) +>> +endobj +472 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb11-40) +>> +endobj +473 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb11-41) +>> +endobj +474 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb11-42) +>> +endobj +475 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb11-43) +>> +endobj +476 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb11-44) +>> +endobj +477 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb11-45) +>> +endobj +478 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb11-46) +>> +endobj +479 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb11-47) +>> +endobj +480 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb11-48) +>> +endobj +481 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb11-49) +>> +endobj +482 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb11-50) +>> +endobj +483 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb11-51) +>> +endobj +484 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb11-52) +>> +endobj +485 0 obj +<< +/Filter /FlateDecode +/Length 4196 +>> +stream +x\K$ s˒HAId 1rm9磪nNWx6NEIuUev&"/?>I_moYN&s8$J&SDKX#$|JK bYaeAݲ +ɱƂ[ e&\0J;sE%\.8WL1dǐ%4^,1[YrxP$ ω4^,) +/CXWVyF4^!JfVy` Z` 죆0j6=,X a3i +Ÿ@+r>WKивq1 p4,]gְoQZw/VÂE4,9@7,LWcK.`kX(lld`HNC5,]aA@aAZFڣ eaඊO#Y5)4p:Z+aSÂೆ ̦5,łOEaA @ʃ,X$֦P$Y{ ,H4,@F`C Y)jX$30kXBD=jMNksI ; PK װo$]ҰbXÂT \E"=2s l 眆CddQeFa"4jIZ㱕:3kX9I5,R<а#vаM9*P` rRnf r,z `Ro& ,4,(6I5,geԛ5,_J5,(dQoSPz3iXP(* i*Po4^,%F7H3Po"WԛI=.dx]dQܠDf3ꉁV{zf`R#e*Ϊ|o0a9}"!!f$,p Fvkьh}zU=)k?O"`W(aX񇪄%}DTSmE"C2SW.CG QWYI(Ī^yuNJRd}vWŏ`3*^]Ho/ ՇB5~]!eyZ>G-`WXص:ƟB B4~e!͋S@|8QM*SIxNW( Ǻ dW(dceNGzD3?ߌm?6&dQV%-GtZRӤʓiOکWXSƹ\ZgvLZָ}+2;} EwMn-%%$?.{4& S]MZm e.қP>ߏuyk8ܳ4SXy~ǂkW92 Xvf8p'jV1oCÚ|#ʈnVw,_dzӜq5g}ı֦W5om^ۆWcψDFZ#'m[e򴣗4Ir9JDYqvhAeɁ)9@Y~:՝Qw3Hs,>㼿ymob5=jMұ,&O,bIzq+.4%6o#o>om b2rg3?lH(aA^yPuC$i>o@(>߳a) +70<(4 5~%Zixi+4uykvTսcHcs]Mt,pWnu4,>;ZQ{$y]E8>6^wM|C =8dKtC*mZTtkg˜f>b}A՗lxyِC9K!M*֝YSo%d Iy;n|T7VoWm%gn$Bf6 Yck ;N\ťKjhՇꗉ"zFwK[V wtcq hYQjm},}AϪs>Myx9aZ>T9nC5zi4 U:5}CB ΟvM^ZvSHn-JU]Ke:xVuR|#ȯ|ۇ,g#}m/: LiNvˠTl4yE_"t OpMJq7&䭒fzÚvRK/^@P'MTxRYt> ǎ39w&b;|#^j`k~n <̧O6`A0X[;:ɷdZĽ~<0)x#9y~β?h ~yڛ\Kغ!ϑL%$ײ4bwyAvy z~kuu;DtI3rŞҽ{qIlRf^niHIe?u<(n ːl#> +endobj +487 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb11-53) +>> +endobj +488 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb11-54) +>> +endobj +489 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb11-55) +>> +endobj +490 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb11-56) +>> +endobj +491 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb11-57) +>> +endobj +492 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb11-58) +>> +endobj +493 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb11-59) +>> +endobj +494 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb11-60) +>> +endobj +495 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb11-61) +>> +endobj +496 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 567.702842 101.433071 548.952842 ] +/BS << +/W 0 +>> +/Dest (cb12-1) +>> +endobj +497 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 219.655821 101.433071 200.905821 ] +/BS << +/W 0 +>> +/Dest (cb15-1) +>> +endobj +498 0 obj +<< +/Filter /FlateDecode +/Length 3467 +>> +stream +x[ێ$ }+S"u?H' qc# C~?ҥ9=LEj&SĻRjNr|8}<ˑJn|r<{좯pvƐ?۵鯿:k_ǟ5?*aK U<]!&CkTUeZ ,F^,`>:!G`dwPM]`]⣷tեbt,tX!K,%[,Le` N5tX] %򖮲 +\nu,.7aEaR6tXj%2K"tȹc]L-]:`[ PN`9%BNjBa'ET'9EF'fjqAbb "xY,.;ҁw}dqA"nG`q7 kꪣZ Z +`vT$.;8dq Z\-.H]=X @ekiҁwc-x(W xWM RVA(C,.HE\9Y\*A%hqA&"(d\9 `qADzDfz,p3?`Ahq̕*bqA jRp%M]g r[\\,z @N% :/ +,X*`+r% 2tXd[\H:-.(X Z\PBA%ajK'yfHr*Z\eLLi4aqGhq$HsLp J n J@JJilqh:" /7X\uf2!DgIlqA`QL hƺ'!;Y,5%73o"7<. +ft]D Ddk,qĀ@{yd@^V<3 H`",<5 +'؀OU;d% + 9,l}zU;)ϒ4F&T7ʵ&"QN)Hlny\=d VLE1WL\*o䣈 _*":֟ BKA,N_?_c?5{܀hʗȷrІk&߮z~ -U/|=L̲U WٮCI[wi[!<7d e"&*K˗m0ز +#xJ؁A~اSmoK i'j78ek+F|\mۮMOV h[Vew<̥KMXd==nrܴou~mFuCgک/Mfe*KuݵYGqwP}7;thuv'쮽^u[r^ڶRgw^|6 +>{-nѱl>ks=[hE#q#:W?re,vKn~*hltg9krc}mݧ" nu.. khv76yZsLt ]X>kXy߂eiRenr(/.}qh ?ΛR-vA1^5 al#}zfz/@Z}F0N49r8tC%ĴpٶJ fбl [ryՕ~wŨ=MFQ2mꃍC-/zƉEjwH_1+*wWd/ s>ReSqᖭ->8J{WY$gÇ$N϶Wihn} X?txǢZWJŢ\uU<,no%znOh-æ/ynj'd{DsjSqAj;-].7[.8T2#lU<~mej/bc} _)9='>+$u48'A,Oogj%?RۻS裴닕Vc'_ũiQ{ωk/O'}M 1?RF[{!ǒXr]Ѹe}4Z?jAvfb=9]xKJL3AYgŞi[!-Mqa4j:L/2ɔJn@C :"c dQoZ0C̚> +Kw$j/g.'Z3G2n e:axClI~k*߄e)~:l+(v[;ąLi.TX]O** /åI⽑Vy#Yv1yj/_(;Jy bn:t7qN5q_U~9^N?68M{} o?(5><u4" n݉םL.;]8" 2 caki{/]qpbxGx9Xq2;7sþ|^X_pexnIiѹC+aQ.։lSrd^:}-7KOt Ll)۴{xF[=A\3꣋j[v*]o. .-)mպYڈi> +endobj +500 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 567.873057 101.433071 549.123057 ] +/BS << +/W 0 +>> +/Dest (cb18-1) +>> +endobj +501 0 obj +<< +/Filter /FlateDecode +/Length 4860 +>> +stream +x][$9~_QHIh9#!@+}_$=ŘIM))VY=>09|t,a +ə/'7_Nov`&9XGhx%.e$.6y$.H + ⓸ )?q,qh:$.H:biHK^oF UXob'd=7`C"` $[p֛`'IaI$qAכQXo""7]u $L8zW ^+((Po *{ +k$qfbek +Vⶁ" '̻O|f ȄiA뚣%WcOp?ONYcl8iI'tk}'~8"24]҂\(̻Yx9ubDy`͈}Y˱YUk.;:kI'~9a vmBm֒Nݪj#; ֛ Y{Zel eHm5˲uCj4u?B Kտt7^51 +}A n-sI_ +BMP/GSR6)BPDQ|CK"5UzG׉o@}6|'I[_'#|3oqkd|_'w'}! u}x?wOȉEdr(oBAMyHg& o(/乽u(y]Nu^em;ϛJ|1OW4r/u~kcXnꥤh5Q4h74zAw'h + ߉&_e%>~7?S +<` T/JQTAR;|Rjoa73MKo42ZR+zL,EВ. %OMmz'r*g{4K9Wpg{.%U߻Vٚ,--3Ү8X]f˵_$+[L6j)#@m9f[Nn[,x+vҞsy2m|ѕWʞQʼq8qδ=Z~/^of8o>~l]~s7i)\Jugޥy.iNe}0Cwm+[p}6dOM:]׮UFmkZL3Oq^Gf)Cx}QK LƁ$gy^,nr2|l2|SMNhJsCt^$kJйR[hҜ˝]=AZaJ|Pa<܋!V% %{)küˍSr3)7=`bqK2kr^!z_RPa`ϒw&ld|.=W|۹ \ag|uSOcX*&N1̶,+nnMvoi }YAJ *zEl,M)9^+<@N\By y*?;4thL),q-,[{yʁئ7LOS}iT+HKDQw +)!XAJ38G3q=s?pQG? +*yKYoJ+_Y&;+x".?2ԡx r'ͮG=M^W淈(0r y~YZ(g@j^t.}Z.u];H9/~ ^W& s<jm-|a^yέG5i@l9o<-i==ѭ6\:^{|:2#q=<۱嫷@n7[\Zо>C +*_gpg܈>gb~:h=v{zOV(/0I1n`CMt^o}< Htק{~{t}1ncl/ݕf ŕcycѻxY@5cywhϛh\ִ+>dplX\!8O|ه]|ub74״Os|[·w9rWި2ݴ:w"׎q7Vwq6i`xcrYltgK(`C('{zd<Ѳ<^q0ájg;wjgsǸJVWP"% ޾<jG諜|q$;p]Abt<8=yn ]퀔fu_qfR[xM]{1WJg6iH#'F=z0á8S(7US<ޝ↝|-s﹩܃zEC w<Bwaw[ڥWo^c 8c+B+:jWWD{|6\-4MVej(!XX3l)kΞխIf>|~OV>N+;Ξ&J +Oʒ.äsE'j'Ώ_,?x҉&|v~OhA=$ A1 E$ 1nRT *ƕp~WCID6?AsX"[1^Mz>d#_M[H}V`˸+VuB&6Tlu }nKZ%P/0P*kTΨTBu?1e#F Yݨsga,@.tr-:R-k*=LiPv }H#ʖk1?'nFx993Sr] + +zʭ^_0,2~-?SRfCS?JxnVzCRh +-m]:پtTBz&ݚJuY'$Uc-uUVre/TTĮBe%nv:UyrW|šǎW{kb~,4Q۵:a3 čF_N*M2^N9e7g3|ߢGY?N7ܺ߹LEXM'4~ҺǍZvՈԕAuB +]m32b d>wlÞm{*oc]8ͥk~M}8*LͲ Ⱦl?Ca #657]d]? &WVFzz}/&2XZJ_zimK+Ro/P-vs MZh'-ےR*-djl[rKM]?*]?*~-FK@shS-e% }*ٶnZ]k5C|LU6)_;ߤT/^tGM:Xc+UB@s{s0Y淐&@]Q r&VP͓t~ ]B0R:i9> +endobj +503 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 559.294475 101.433071 540.544475 ] +/BS << +/W 0 +>> +/Dest (cb21-1) +>> +endobj +504 0 obj +<< +/Filter /FlateDecode +/Length 4946 +>> +stream +x]Y$IR~_+M߇a%h`$]Y|naqdvm+iUf~XvDd*|+9=cpۯ.j^_i8(?V.N^W"8M ~ _~we}5Sh/rv)FVKi+b4>'b b["p9y11I`%a]vD$GF)As<gR6YEt4)Dxy +!$dYi!)YMQbU"ċ@;Y%J"v99'2x*Ŵ'UO6Î"( d gYUFY#Ɣjhw[eŘDdK`dQ1H4.I`b\6NK +'`d?Vi*]jsEdIX` dA ,Y ,Z$,[oA J ĵ)8 , %,\ 씰tݣk}0Xu)HX`i%aZ"%,:NV'+aZmd$,N ale2)) p$$,p]D^k&{ DdqIXz6' , ,$,@D0e[L EdA(alJ9 ǠU̔"Z%t F7k KM ^Dᒄ<$,`HXW4%\iȂ [Di-aA2Ѡ$dAIX\xNQ$,H.L*JXmLH) `B%^$?H63E:Ɍmݷ7?Op?wRV4!60}kб8f)>Ӈ sэDGoEjnI1C>pC#"|m,kWJ>%m˚i 54;Xƒ]>ND1ml6ʈו[4O,ŽC4O^~7~z_);My +h=qem_cq1~Lg8??ϰrtU2_\2:־?oxiJq_4̒t4,?s]Ė& 7szIuV3&P渹\.Mv6h[IWI!҈ B8ϓ}^@m~fc:XEϝm$,[,kU&sm ;ќ(aFͪGxYʯ`I~G6&}e i[V GY$,lo覅 .+]CzYA@:x\jxejVgiA`k훊6^@!rV,ռ+򴵞jjţ+[J +~yc C1C>s}^jcgBP`xF+EYJ:Z!`Υy[=k<ʶ;ozžr{6j)FuJM[l7! K[!&xz[_Yl5Ū]?r^cƃqlyxZdntmaÂYLyڂy9 >W mp ̒yj"KY ,J3,dZ^s;|Z׆Yz-٪DZdWdZfiWv5`e*pl=?D% ct2n,su6mG}^Φ"O/zyQ`[7tp +f+'Gb-v#^oUץ +pvQߨhIjW_G᳙Pu>x~Ddă:Ws^N"fl"V'f{w2n`; 'lC`aŇ8`n,odأqZUm(m ' ֽ>eqn fc/[j8^GYkY+ ef kv٪gD,zYA%2[Lk!zڂ{,8ǯ[93&*]w +޻w3/gGct4KWU_;Y{>V3ݰ'ʓ}^j~{uVwy׏w6q 5սRj]dw1}q.Gd~z˖{lh-=l&T=,7C`jU`/,z{f 1K hl`?d w?w?0OD]T%Mt"6n;LtAa|bxzٯ9YQET",<|>{+?|WIR0'liv^"S'Xz=y=N9y+=JCWx_cr&dab}޿<'ܬkWT--@Is8t~Ok˧~UnݣJeϷ05wFgx!-u{]:C?BʸlMvq̅2ŞsktJ7aӪvU=qCRȫZv^+QZ˝_ƘkH$IWK[u]z^z+ kdK-<]fi|ox߽r#~s(o|==]g:Lz a̲Plr61\o^UuC>0iP*L{عג EN1}6g̴qƺhX646O> JC.=DG}Ǻ-Qq>--}";[i\^gzԝx@O{0dݒoۨo[ܟP1׶<:(ՆM&r^Nޑdr +K9}k5稥%bG=i^߽hUbTfY@DϠd:{5L/[JBdm#5Q:ٸ*7ՅNlsil9 #]+^PUF5eBFe[I .;UF=(NLՐ\kk;t|[Z5WwQ/ЊfjDZ=l$SZ%f7fE]k;/> +} +qe6rR^:ͼ֬4z8CoTBAfR~'K%qzh$ h{[.cY/О@n[P=*T%Y7kd}3VM43wаc[qM}hqW867SjޮOƈ]0B'w}/[:&IS=RX0mfЕV΂5Ali>i^#uEuA{sj;16a9Juv ,{9}k-2jO*m1iu .@SFU0wj)gD-Stꟸ=_DW%ҸhɶssTob$ݨ-NuABLUW-¿gνPuZ՟R ѩih-/V)`EXi>uEJLXY@"lh[V)=aN*A=)H"s) +f*E/~ +endstream +endobj +505 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 504 0 R +/Resources 4 0 R +/Annots [ 506 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +506 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 100.323057 101.433071 81.573057 ] +/BS << +/W 0 +>> +/Dest (cb24-1) +>> +endobj +507 0 obj +<< +/Filter /FlateDecode +/Length 4735 +>> +stream +x]ێq}gK%z`^@6V@ ?NK0z ya2Xd4ZiT1"/̓'#Wo4Stp);|jEap:?!$g]_w&W_W3v׿~a!T *rn8/p)I*Z̠dLTfX +ڮU fIR \TZmu0DY#<K:I.@t>vZҥ{#Ғ-dctXo-&+l1h$"l-+-\D.AbkQnpZ%iEF:Ag`W.:2ŸO8bFmՒc:؂Ηxآ(#h`^80P2$vHQb@!XLr$JCgDVG^ba a:bI\` lA -lK@tK*i ,X.TX0$.\@)I\`)qb ,X:o$.]KK\`"-`h%. *H\@] ##qzu`bTxDExL. VSfnqH\@]CK\ %z]P=tJ\D ӟ0VK\:D]t@ ?_~]^5F򟆃0&$tqc9ZI˕TҠ9Fa0ePoG!F.)l,<30 0׿?.>^_(0]`2~80;ֱm4N.jS46-%-g8PDhyjZ,_s7L8;Ev\P[W0 tn?oߵ HMrFCF4};?xL;i>{\'wozXٙe2,ؘ/z&NZ@&:7ղ*-5kbT&GJ5/&qL2s:–;8^!`D(<Fت7fOSs1Vr<1e=8bͽMh))lXx)靎5Zʺ[i{0kʗe\##Bv1? +YM 6suun4C)@IE~}s:]^~kYFݝW-u;*(B9R2:K:?;T:Uw~K[gg#}%%j9j}|aVoy&M/R}3Oc/ srn}gozZܛ|92"7V3g}Y^}mJ|`ӡv'_hUJ]%m_usbaOC9Ž=\"IR\w魷4XcA_ٵ>,>;+t̨QuY'⧣͡Y}bG{, 8,=KA=nQ(^1 k[m;u#ڦ] wuWƛƞ`!9Qmժ=y[\6㠦y% wzg4uuȘ~顃yNV'0]_Qw#n*]bpwyˣ޺@$gyfޟ0]|Fv%(yu 9~wb~|ѓj'h8tǼqE٭خ yl޵u0x0ڿO/.[\<&vs?X~][HehaU[[\z#n7yn=7` zi;U$;P]<oF-WDo_g.م9o|^g4L~o1wgq&U;Kc?w3(ӧ<]9{Qn}\>UxzHWcx퐮DjKncFqsKyE[0fDZD?ƴ7*~x$ A1 矪E:',7 Oiݠ柩/`~φ󻜍, Sł9^ՠg1/;bfkԦ֌bmU#tkjbCєUXLoN7ݟӚt=jm/}Y.*QEfRt~D F YM00f QIr:At\PRŚ5喯TX^m4Koڌ/&C+UlpcVQUvqAH*W( +mSnGUR| C3xg  +W<MR;N=,e#r_Xjڦtm{騄L%uiiFR6IR ꊘ),OV]B\te2Rno8׼Q`> oFs%UlTjeRJo8N}kY4.Ӝ$V}Go ]q +[­ q;>}2lXǚe4yܘfWsJ]Tm+t )56-o]+GkNӡ'j,o2A{:8Ug|m'S:d8h aSa-d@g +u5NmY6E.mڂI=OdGK [+-'BxԎ~yX;*omRmƞ-NNյAFk9k+,[T'B,+%lf8OQi[ڵRѵWi<oȵpTMY|(|HYuڜUC|LUV)gƎ3*jIk5oy(6܏#"9VքZ4ai_6K'gKJ<@U[6n}=6ǀP9 T-;7 Jޮjz="|2zF +endstream +endobj +508 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 507 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +509 0 obj +<< +/Filter /FlateDecode +/Length 4847 +>> +stream +x]ێ$q}g%x}`^6=H0z oɌm Jite/ADWo4Stt]8|tןX`3__/o^7YWv?*K!('TJ[Aq^Py)I*ڪ̠dLTfX +nU fIR \TZmu0DY#[<:K:I.@t.>vZҥ{#Ғ-dctXo-&+l1$"l-+-]\D.Ab[QnqZ%^iEfAg`W.:2O8bfmՒc:؂xآ(3ha^8P2$vHQbB!XLr $JCgDVG^ba a:bI\` lA -lK@tK*i ,X.TX0$.\@)I\`)qb ,X:o$.]KK\`"-`h%. *H\@]L##qFubbTxDExQA+qwC$ 5N kx h +qr8[@Cg(l1K$.p]9 ZtL^'Ңz\E{$.p]8*+q>H\SK:6II\âH\h芺 Z2 /*ID]X$-qxQC%.]$q*ga-6 @i+i2` +IU#,J$q۔(q \ |%%.IAON₠ p,Q[(dS b ؂ADK҈l\Dɖ$.c=^t,1E]N BXK\1%./.I\3$qAHSE%DN ҅Nk -%.&bXK%)^gF "CE 0MS:Ëm'q?Xlb#`u$qAQaQF`כA₤` "> ơSJ₤#֛$.f Y&x¼Mz3H\8( hJ¼'a vtD$y%.@&"zqK z3]LK\ 7Jk{u񙬌⎁:Vq@{ᭂg@F7 `&VыpPj%n(/1p}iܢCό0-}[sdA؟x {SV4_av5oa24X\mH, ",lln?ll,rc%yEtܓK',"0%oshr@L탖m}4;Iy>V8Bu?v{w=:!0dcf`m)!(ol":f ߘ VX#"Hca +ZG*>]@Ŋ>}GL~75__bݔ5ٗ/rrsR]VDE!E5KpmϦIlRҮfkhjGop?WEwp"]-,=/'5$U@a-Lwl<;Mlk}.Ø.5P2p5xdg2VHӈFIIBM3|W=@΂=D-"!gI#[YMLn9Lg^,:mLR #tt]==PP\00FvUSҸ?5SH=3ǰlywģ'<2#QB/Ϝh #mר؍T WOeT8k΀)a?np[H}tޏa~ 2}.e}ydgCُMŅiEWCy!%X?G>6o9uOW;ggíGy>@#u7;x\C~lvWncnkyqZshϱp{kڀVk'r~|OԵ;<8č|Dm"y:Dǚ9Z3ݪyݫ3;6N\gLe4wĕ'<{<: JmEhT71X-O6i,sʯ8;>ͶO;gZ1;={ָiwv?؋6D eg/\֋2HUa9`mw}C{E=BtznoC_gU)VFK4dz}+eJcRNx%6t_*f5'\Xcvn cmfTyz,G)i8 cC|P]VmWkܦߦj-;Vn870ߝvcިM{KZ+>sCN@cS:΅gsd5?`y"yuHC2ӀҖ[[acឩ:2V[txXiqA(}9M1? hQn0fR`楎=!2'Z['y~]Σ)̲H]cӕӊuLI̖u/mqp=,N^ A?=9<Vxۋ߱O޹TQ~(7ޘUO續jj[\,1m9:s2ϓ $<'yᔓ{zGjGaz.ӡvy-@Ծ7z-1ΘgCԺƗt{A3T*M_֣>rNUmo7@[~7g#q=vŖ!_>bߗ>p>H5X&9Q}-UO"ZߙAwXIߑ&?e@ʦ]LSdvu?vNq|#4S^d94ZCW@p(_x $Տ4oat~Ն_0NB0ܱ g~m-Uy0%yD >z8zů~9 b¢𤘅je ^ KS11&q5l6:R5cW,뭘[]r)| {4bm t[bCom]绰>v5a=j,}ZT]F&u5ej$nAEQ~ޅZT ELWJsmBK{T{ҡncxAH0Gb>Z7f#]ₐuPBoڡ&KU*OULTᚔ' =WMQBO;tav/Bz&ݖJ:t @yźj45(NצS2VnƝ8fo+w|޲cYЏ.6y^ 솁k)|L˟. V;(K_i_%w?nTc Ӹu%=G<)o6mXǞU44?nԳN5n vއ4mq;ԋ-c@Vp16lwסH\qҡ%3dX(. +Sle&ru=OPXk]G͎EWYnŐ!/ƂI=^x܋ɾ6joQFxKl>惕ujeaC Z]g+ X)U٪(]@Mdݒ[^ +-?=QiQ\nx-Z-r#Co)[,s7)ʶuӺmC3{dz6I.{ܹvT'_ GM:Xc7=8,akyJ;"ud ñ*hN;لW(ұb(~ߝ-)Ioa+Ӝ/5ʻyC]^*wYz#JPZ~:Pj$?3o +endstream +endobj +510 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 509 0 R +/Resources 4 0 R +/Annots [ 511 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +511 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 381.573057 101.433071 362.823057 ] +/BS << +/W 0 +>> +/Dest (cb27-1) +>> +endobj +512 0 obj +<< +/Filter /FlateDecode +/Length 4697 +>> +stream +x]M$>H' Inc#sϣZUj{fDziUTX,Q-}VTz!zNjVXbv0¯gVG$ ?hwϧ}rϼ>!Fg=MR1 >xP)M{crz%(`lx0c +f1APA5-UfYR TZmu0D1t$у DQH:yVK88lt [lTZYb5t)xI` 9RIyb;QtQ[SZEl ̢.BKQvHI: lÈt8e-t[?{OO pEq0pLI% a#u>V#5hqJ%#1凙0TN1_O&cz aNoA2Fj_c pJxĭX,5Xw²/C*e @9&v9"CR?W#iDS6LeOZ +K8\PP7ciޓ&er &yƨ󜝷acvqn$y~.Pz3D\3o!Vx;^] ! +2Wj!+Zߧ+ + +:te>*2zjNӗGLN^ѳpW6l mc\ۜU9nj=P=sJ↟2bk<gjs7Gi5Lw90owg܎ 7rϿPti~Ms_C _ s8nė~ދ 較L =.w]Sld?h[Aͽл| TJoAP(^]l6_ :CF<{(~o5_(rQ<ubڈk-Q]D=o*B&m!t_!v\x-7^P$ E&K^g>f-GM;m3oZ?诵Of]\@츠B:CF dvDncۖamjrEr;rJc/<ͦe_[}9_\ ȭs4dbvU!zMt7Z9Zţe>˲l^&-s8nW >J [Ur޶(|Z:w,V@>tg!vY"g Vz~ESQ1t~%"v2p{;2O 5Ԏ?:GCvOqaife29vkut?W-ۻTuKwisJ/[Vw9:7 ֋ѾV˜i?5w'J'cd>s8dndR"y2r\٫u\/WZ!xmĦ; a# ڎƷBĢL [Wpٲ_37Duw=sgV>}s7c+\*o>=;uX5wGcAND^fZ~xAnhCߩn?d,K7x>!-ntlW{or2q:GCcyu,vyn}kig=8,n9Fhۇvc~i!RjnCw9r7w`kʷԾ,Z ά _Md-:j@TE6eӻM~tې^aI [՟//\_z׌[ 'rIS02( uuuKar˕ܤ;5} 7H6 ڷӹ{6ls 6_m?=J0h^iyv<]>R"MzX}^9Rjz7J K890:\./?ľ$KdGcդ6WK` !j:W]aS6CXlmVkR.9]u +m;o /'z(MoM5Ȩ1*%CI]NSf8]!K I,7f|)j՘{RNt hrf(b<}B^NHBi[B VHMETKOYR-<RMN$"wR+wuX;mK{_0J(H.=66]}%*1낺"Npe+TmL\edN7p*v;[/\n,ORFٮV@ +U\iyZicdҌ{9}w9CD|p[&(K2_'>1:Unۙ,8wga6pCUC-k3> +endobj +514 0 obj +<< +/Filter /FlateDecode +/Length 4679 +>> +stream +x][+q~ׯгy)ހ` p`8I:->k#QQCAYP$ Xr Z⬕ Z؂AD*D.` "E d*e" XW%]*EеKЙ(qAXKI/q^q$q̀ΐ1L T%-%.@ 1$ [ J\l*3h ࡱDWK:ҼL$ +CE 0MS:Ëm/q?Xlb#`$qAJIₔ`V`כQ€a "> d @i-qA6 MK`^z3I\zKU9cײ];s7е=KϥFK&pP^-a%_V}3?׶={~'=(i^ێ[?W6!:f/O'6?iFcBa1'l񯟊qys0ꊫ}J,Ҭk%EF1fRnzb`V![Fu/=ձP8bagͻLlXy/92==O)a=Ʀ(ܭbE"'9NBvy{вX!!NoreN*-39*y,7ϼKz|IH}|')gLì|mg&׵͓m=ngn{fA%l~6@(-h`u}&Y{y}= ^ /7IKoS_UOg#r +)WҤr,σ ͷzљXgYm7O<6/2i&(QeQ*6M,K]aj罇V ~C8d]hhCu/Z/FU8l.5P`r&qʪMGḡZѵ˶cc 6u/){ aXC-vvT &W>rNfeeވ{~ \OGf 8G?v?|2=VԾ 1 S*gpg%xcoŧ2ZC[@`dE<ְgo܆J@a=?6Ry> +y8ޏ?ހ[mt]WH~L ɓޓr꬯}ݕfn Ǖ7.Ľ$<Ǣo⽊gͷ8#3yϛ֫7Xlޢm:^ŵeЏ<᪪wO˃?nQ?Uv>-uVnXm;~ٹ]|P;D|a7(y4|ŝc<՛8,(w>jcc.qC9be[rGwD9<G9;F4쿁aGcOhp?7wsFW7P#% ++ ޾<jGW `Hxc[߸OFbv"`GCbe`sX ^ݻ՛5k9~%7uP%O5Jw6iJ#BžW=PwpGjŽ) ?=k|WUS <ޝ⦝Ķs܃z/EC w<Bwiw[ڥwWobܼW7P<|sWOcy;q흻Wwqs~3W7:Ƥ#VBy8) {4b B=TŖ=Ol]>vq{ պY*JNnrfb|RWB7Iwt)M'L*3 *|2\~+N塱I=`(Cwf2I t[ce${9Tܜu1P>|;zo!mܺ!#/fTa6@]lRO+vku'45M; +}AltqC;ԋ-ұ{t|Dxj.2u.<+N]:d Pamd@gi +u C먻ٱ*+ vX0ҼG0}59FM:J[XOrr"TZYn{9}jЂ6#Fi~lSiu. UJզfRZ^-ҿ=QiQ WiZZG8:SX2 0nR)]]Mۺ=͠nH葩Uw{x򮔪pdҘN!C,"RFޜ^H+kp(rNGÿ' +EW Eߓe-6m lu:'ٔ *ۓeC]F^*o9zIF>)_m +endstream +endobj +515 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 514 0 R +/Resources 4 0 R +/Annots [ 516 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +516 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 639.873057 101.433071 621.123057 ] +/BS << +/W 0 +>> +/Dest (cb30-1) +>> +endobj +517 0 obj +<< +/Filter /FlateDecode +/Length 4920 +>> +stream +x][$9R~_Q+MUBF40 +5}v +mG:#/U}hCOe/pKWibL˯5X\U+&K&PBr& 叿粏)%oKfYB A9RsSy%$ 5+@ XVd5+A XC'VCDQ֒xMJd `$NK4y]xsikă,bx'% $^,I/BXWyEy%^ɥhKg\$RO6IDa|xxȃ,xY,J<pZM>ݤHK<Y VAlC8AS% LMJ `"M6(i!&$ 3ZRY/!ibqrEdd%, Y@"b,IX@@[ kV%-ao^BL%aq)z+araJIS K K6z KV+ ,p=EdKXtHGwI a KX[LJ 5QY ,p&Aw$ 5N ,pX%,L%F]@'\; DdJXzJ@2F‚` B LI#s Y)JX$bV‚<1hUy3y<$,NpZRSġ?pIYpT$,+Ad.4dA-a"]𴖰 ȂhP‚h"L$,F. UK3Ȅcaݷ7f_t'8R)5"10 }k,04ʟ"!|O".,E,$_s]XH荼Z@BgDet>pC"tm,kWJ>%+mMi" qw|!($bY>/g3Aaa4^`xwkHvw0>oWg SNmYX #s5R6ܷs}^cφo>~bCʡ;=3mgh8jޘweXZ۹6me}e]cqomCqMUj}BQdim^`bʳ|ϫYُC5c;n<Gڥ2RGyV2+n+ ċ`Vbzm8ReݰdzOy9KޏQY*ky-,c XJ,\E͡DaN<;eNZ] l t>l qE:3*uG}̌RVD:;,\nH6= +_l>/gY~zqŮ%jY'cĶR~ pqsQI(p<O3!GuϫY# j-j6j f+wj|ѫnϵiOIJ'Dz{U/8ߚsCzްb/{Y~*{w6*D=! +pvQߨh"5!?Ǯil>iyx,TEݤѡN{YAY |NVXЬ.-b|b>Ÿ kE0c!P͡ND^d0dWd{PaLJ8`md7 Ϸuf2bQv8V۪6g ֽ>s fc̯[mAm&?s}^:8GYkY; ef> {v٪gD,zYA%2yZL[!zڂ{f}BX9Z(Xcux5Sq>fwgphd^XS{*3᩻9Fx:.żG5O??STnp,a黊\f%~F 5䷪Q~,+ڨwh8.m c=9v[rneZ-+k|.g5K{$GZ-;K[JWy_l=ji}IKX"Yy]cPde)4I>q涱GzhcP꟥uAcn]s>]3[33qۅȁfN>BQ{` &}ȯp&& ̵Զ949 ގzXx(Qo'X6R&Jt!SJ:OV7Wo3 w[Cu>< J4o)!m19 ?/ + 8M^68lr5a^e0!7P9,:P~֯J>=+ĸ?ݱ*ăt{ǫUL^4m_e,bjq~2X]^|rvʡlHڨM(V_7zYzE己7޿]-E';IP u#& +dk'sGƲ6l^2g/FYW-Ԫڈ < DzMΫWFDodn>m!YbD&*6]'u\ummk=iiu]DFLԨlb> E ~lkX ɶvHn͵ +U]S|:ŦxVt4SC$vFՏKr.VٍYogI BkױBjzHlFKgp4+-d7 +רymIe>I>T:VҀe!4Q 3Mc *S[7XuFVӰUuk w9];Nɼfڸvsrh;[ϛm\fx+͎lNF5o'c.@;r= kIv9C#W{7iغ sO)$節vlXco54?n kۻ쵥n]!#fFӌ!-@k;%ƫTe<.ʆUn]:ְMd 1AIo #%un]ie B`|`i! } S2Lr闗5_5"v9h..2jOj+m1iu .@SF U&?wj)+B):\ӎJSWmhZ9:[X2 +4{7-s^2lTnn){ UU[*!:Y:ՙ*z ۏ4pZɺ"Rk%|&ldTKPeH 6TT[RSP +0V-x)Rj!K/)1WWPZ~"P>-'-z0 +endstream +endobj +518 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 517 0 R +/Resources 4 0 R +/Annots [ 519 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +519 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 111.573057 101.433071 92.823057 ] +/BS << +/W 0 +>> +/Dest (cb33-1) +>> +endobj +520 0 obj +<< +/Filter /FlateDecode +/Length 4733 +>> +stream +x]ێ}y I $$L{F0`~NQETmzUK<<,.g/$ F!D$ooR?X]$~*ί'_O?<{R=཰*B%fT+N1FN37,Uf,FKTE4 +fh=vH%!C;NBTyWNy#tqp lQHNgaN[9آ5Eu"  +'$z1"t")aNaDgt +8a#-V 4l1t }hU4ВYآ79P8 +8P&*Ñ +z0T^s4-$tJrDlqL%l1h8. + Ze4lk 4ֈ(9.[#@pa@qup "h.@uu &8 4xW)8.0]es\`F: A 8.0]w19.0]eq + UV( xW8.P`.(lr\:9.@a[qʈ`A8.]}.ңřqVs D9.]g?`FUXԘ9xW(8.] ap8.6H貺8 ZR`D:?H r\#+80p{XlAq\: [fLYSp:aNG xM ' +^3D. +:7r\`8C1p\lJq\lq/07)R$*-oQd # c5Qɏ?fvc +cpgа&@ͻft:* =G 9}8}?| {9+ }k`2?Qa<# _w߶u*ZtGrouR51oߥӥ=|rpai6m|J[OMSKò_qf&W>6E9C$] ?j7'?_ȯoc|2?FWui.]Z>̒?6sӥʠs!vJO2z{;;)rV4n<6 2(ީƔΝyj6tތ`T*4~^+GjveF}3^H,hw^>%ta2cME<Wa?UXGu Hr:IېMz&}di~ YPRLzbEirg sRJ w:(s3Le<;m{P+ %Ȉ]j\(d%:v-<2~&Zm( ""(Z]Gn@Z}3]FF:ݶ},dܬe$m}DUsRAL`SJI I@f?*D4jؙhQwn݇Ws{~wߺoVO8]ؙp8">|`H\on_[Abmڍ}y~-1uf uGϋz/QzSr*NDצ. +q_[E]ws8)9s8HtB(yhU唽j£qetgmE(VPti4#蟊C d9h[A}ͽ3л|w÷kQtO9(|۷յjww9b7C6|ţ7OnГ(ޙh(~핫 4X]zs& +xwwfrljCo.nv_áv#z_xkUJ]m_—eb;;aT.$..U[J}1Ϡ/pi{bzm:&$T,H-]sSUQ4U7Zx+B ^V|ǽ;}T mj9tv:.Ս8LSֆ;e2Szw4y%iE٭خ ylֵ,n7(ΰkJ0ot. pmW6~7[:D*$p\8@zo32k>It f +endstream +endobj +521 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 520 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +522 0 obj +<< +/Filter /FlateDecode +/Length 4760 +>> +stream +x]ێ$q}g"d=^+?u$32+wP^O*#x 2/ +?hbLˏ5/Xdw  Gw va__]g]G_͔7]UCPNP%&Aq^Py=ST0kV`MI*a* AV` J* J+ءR(k:&{Igc2It0hj%].J: [\RZ9ⴵJK1H:[ȓu@.$Aa ElQ^iIhr)Z+t*&zr&:( \uő2`ŏO8 +1 +&EZ9bL`%0% + $0!L6+4h&Ɇ@ &SxhHgau lA `$qm-"qnJZZ…JRVJISb K K6z KV+ ,x5El%.;N#I\`Uw1 8+QI\`&*+q „9HXq8)rwSF 5x l +qr:[@ CgH46%8Nœ[M:&/qui-Q'; DlJ\zJ2F`` R LI#p SL6dyUIZEt ;!k "& % `tJ\lThӰItZh` A Xez%q"4֒pיQhĩ&Xi)ElMH\Ŷ,6u F(qA(#q qARId @)%qAMc%.f zKx!\+y~7RŚ9lJl4ՙxrR|'h9w&GFQ +ZGU~L+}zؙN#8wzR5F g??N͟X(TϿUW6s/C;7|GEn췝uKn)criwt/>Cྟ_O^yE57x|sU~ +t:d CXl⺺e; +,l8GMmC,uzڕ~I궶pZ2 {9dg"Vd(Ѭ + U j7[DTd{^:6{? +Ifx`cv#1rcԓuS먚aDb^PӇBѾ!Gj^ ǷupFh`SN:jl0;mJ#vQ?suI5% +;~нBܝypTX3bψ 2DOy:d϶#MkTf*ceלRQ& &!Oy6WZ!x/rӓuǹ/mvrQKUx<-5V Ӳ q=;"vw7M8]ތ:Oܴ܄!< :hzpΣ?w5u lk~isɥSuiqwyγ!s͏-n8ՙWY9\fLw@^yӡΞD%U\kT79XiO6iiAY#_qvw|m}8cwOܐo/ =Y{g?rxEpyZPo18cawב5cd?|۷]$avr\26{n; v^-zeOBi"c|)ۘ^Ŗ9ؑWOz?b*CmcؿvAo鿜KIΖllѦ|.>KtvsUιmx]w8+c9my1Qv\ʼvj:v9wRe~Vnl&;<s\3e|>ǫs+~+̣sqKu1w(,0 |:F/ ˏ罇Sgߡ6\~w7~>g9Ƅy͞J > o=k^8Y?pઽO9P4 l:&~pr谤 y ۢ49 ^ն1?ghϽ@Ur36/c6[tC&:O;Z,?Wr ̨s_?y7pm\:Y]:MUj3l?^|~o?U>NѯN|WBHW~^Tdu&;5K+~,vp~ }w1 Zb;UGS9)fUն. SK5yoj\9J5~WU巕 Bz+W^^8r)|ɬ +[/l5NBu{47a5w5#niR~sixר*ΨTb8 E~JYݨ;1ga,@\*"[ZsuB-[Tv!~j +06|m!Zk8aajd@T׳ +⾺.Cj:lt oӴG0}1ٗJUK뉱,|ׇ5P5LusjӦFK-h'R"[uZE TC/Պ[GKMӮD׏ߔvKīpT+Ys(|_Jm+IEۮ.ڝmVmJ>̝ΰ *?y'DRij'LE!Cyw㽒H+{pLHM6 t_5U\-)a+ќ?&P= TEF$Ai3BO?F[ +endstream +endobj +523 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 522 0 R +/Resources 4 0 R +/Annots [ 524 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +524 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 332.823057 101.433071 314.073057 ] +/BS << +/W 0 +>> +/Dest (cb36-1) +>> +endobj +525 0 obj +<< +/Filter /FlateDecode +/Length 4730 +>> +stream +x]M$@ $p@9wlvyTd*=l`vZU$U"JTK~>/Z=ĘwOjNXbv0opglN>wY@aə'ϧ}rϼ>!%o;1, !JP)Mʹ!㼠z%$` إ* T0Ud* T0C'VCD Q֒t %у$QH:ti޻(,lqIiI`*I[, +w5at]mw78 A۠+ҠR8.hH\UxPL" i @ƃ*qbyOxrDxp{Dlh$._0ʀ)$xWi*M |%.`#qvH!x |Ru~ ((KpD)J\ l!c$.e4o1<-XOQ0W%7C kQA쀥XK\Xj.I\3Vₐ` XhK: [dK\O:%. (+ B#DWK:r%.U&RЄl;  D#` 9+qA&QaQF`3ǛA₤` <> Cv%.CIGěJ\y(qA"x!0oo -.-p0oI7NoF f ބG/b7.ft]x^ ބg+ +3YsŌ:b@{Z1g@9F0eb*Zi?fp>E&L ~{,o{zd̔ a,m_av5.<ZЎGd#BjFjtFb3aW驞>a>/x`T㯣_{tc7MK]E*l];L7շa^¶o:F\>L7uv^_l(Uzӱ+=}/O}7詎9@Uy  ":t paTA;g卝unx$ЁMH?me_A'[v:hK+]/k_ޜ1_qhxutvkL]&LgWuɨxdde*2ɣh;v9n{?5=7ӌǽkޕi9=! Yh2Cx_ӕy^yZ1>v#m԰O tn$y}Pz3DnVkHl>~$s8$Ip_?GU5.CWOv*|GoFO{ҡ`\$\ҴDlEhw-c~Wʄ[:CtT??阎S27W#2O5CZYHݜ=*9TU3w[;emv }BerpDх!tE)Pz {JeږRԫ| _VuSGWϹ5Zzzmt̽л| Tz$޿dr УmߖW֫>{Ypg/?֫7cq[(Wp(ko]]p߅!b5b@C4Bw9Bmj";FCIL#x]{rw;Z?诵Of][\iY497o$׵#r[rNzcQ\f(; + ocXw9BXw /F[M-~b62/SXA՝uڍ/ɒBVr{Ѻ?~d>+2~ۖƱ}H>mv_áv#_xo(%niܱXA#O#Cr}2dڈr~zjFTvQ]~wP~SgʾOߟ/ᠼDz"|#RP]sQg/3(a\ 08!PO2{v9mQˡGָq)1sqXvݝJDzzc6eȘ~顝u VXvWs?0XW].1iQ2 y+[QHeC#VW~2~yuߍܬY?#?zQ+70ǷǮ}_Jƈサ2es?u/es84̹>u=.jYլZ~cM.u\kH ; ac_{Rw[݃#{∕h_eδߟON߻f-{Im{;ԃE$oEo9ha7twjg!x#KDñv5WW|ӝuЍ/,kj; +fE- +:n xg!8_j잨g Zofܗyk^s8m߱N,C9/?[᪟s3{6Wa1lߟ=L8h_Qzv;B:7DEVacJŮRӻ^U~[~E`*8ߝtCFT]QJ])YqD T-٨R]rDXnjՑ +TlUSfJ:lI˚QT>>@knBx99[gb?\Jq!v8&7@05,' +WyVH7sv<7xI\+X ,.B,/P>n-]{l&e]!2IUuE]g ++S U1kbW<7;]{9 ľr3::f[e/˸^Iبڵ1a3 čFGqoT>I&ӷq3LO:5{Y?>kQ-L֙dq8saBc7+h1m2Z.tTMg ȼtlڂ}=rq8 p/-g$rѶCk ( Slff$?IlCA\쀹ζe7]dU"p'M3{^/d_f@Vjg.d)~~X:2y[ն=NN͵Q&T",. SEV[ &?U+2^q{)TI=Nt|Tlnx[9ЮN՗Uj[I*e=˰> +endobj +527 0 obj +<< +/Filter /FlateDecode +/Length 4810 +>> +stream +x]ێ$9}g%|>-`CwP,>'K:*zӕDvK~/bLIM))VY-~;kEar:X`3_No쓿?yL)y";r*ATM!n1%I3\ C[UT0* KAۭ* 4I* J+ءR("kvӽ3z1$t:Igi%].J:-.)-lqHI:B6IaV:bb.$Aa ElQ^iIR$u :Cr*IM+УH>:[rIgt~$x[ ntH4DA&!LE & +J4`ȧ U:%" +8X [=WHk` H\`-l1d%.`[Z$.[RIK\`paqm$qJI εN ,H=H\`y#qZ^ ޵޵9El%.;NVG+qwVA Ъp%.V&&*&`uaBx8܂4rwSF2^e(1B3V6%8N> tL^'Ҥ<.[xy' xwAQpH\bt]mw78 I#ۤ+ҤR8.hH\QxRL" i @ƓB*qbxOxrJ\:bq tBF:)t]’THx.%.`#q4>):?I\%` l[1[2H\`Jѷ8=-8? ؂HQ0yUIZEt 0k 0": % `t$. H\hӰAtZh` A ez%qFh%jIGQH~PQt4&$.@dI\&:bI\f Fbf )؂O₤aq蔒 ! /y%.HVa)o< $-!-oIo$-&{oF f`^\< rx%0"2MD^x]@|&+#8b@cdf@V~w.V̫3h݇ӗӯ_wϧ~s_}o\\?"SIEgZ>J-=`@:gy]v- "@n]ghI?s~Ss=f-6{ 2KnLܲϲhH3:oNzcCe0Z˔XO)]miD{+TgNS Qs n-+,mgCVDd-l8 oi̥\햿 '1{㶢γ|K^miY,3sGYV[$Ξ9 +߻⻾m؂κJu +;.b]kϐ= (t9i/4#lKz|xENril o<+ؖ~,rP~6[^^b4K5ߧ(*io QNw0ϫ&oj/aRhev=8bɣxg "%K,zƦy\Daz/ڳ)9R7Σ쮇L~􈜷<4\m١ņyY3l]^}y/AϽnk zY$- +W& 2'u/NB} e0m@ϔ$޽*=鱋3\T;NfțkܧV+uiPi=8'r]/ӎ~jLcZӎS:y2J?[sAՉj +J7ᒀPRr1kG5ymx,Ͻ!ԑf!M^XAf% +p|?/Y`]~sU)Jbr,ϝ TڬU.&+[thXd Y&;+8o"YVw*Gh=КfoSeu>®\rYZ(g@jt.tDPѵa?Vƞ~ ^U& sjαVzsÖDFӅ-or2?[眺[Vlwn7*6ܥ#/qGymcWo,oF}N̨c_?Թ;_@+̃y[(7O6Z[HL xFuswh݉3oA-WX[xŀӏ1?s~ +Mt^ȣ8R$ '*BЇ&Ft0KewYE3!\@p+5{5sw{}/q{gswYQ9OZܛ +~`Wu#:K-z0?c5}]y+5\o{rbKYp5Gy-CWv_v"׶qV7qwު`xv,d۞ݒ cD|Es0Ͻ!*^r+Zwi_@Uu􅊃yU;`e޹uߌoT׾"%F+lo]`CNtu3w8_兊5} HV#XC85>c7.퀔gguu8{3z)-{SO +v=[և+JMH.pS~oT=PHQXQnQ97UΩkr=лTܰҔjzymp>x#.ջy;尺-R_D+V%Vv3>"=ѱyz> rzsy;ko7I~x>Q!jAClyyx%#~3toj'+ kȪ@v9)86UwSnWa؜phmx6@d +|F_˫i+2SާjiRk54Jn}z\_mM11g^ע;{V5'Hfx >aUϞ&^ EeIfٱ|!g>cMx\>17cI'|:hEtrĄIA1 E$'oҘҺI-S-_ ?W󻒍O#U|n\ DNb{5E'.W¯Va+qWn+T]uMlأD:߄ukք9 N֎QJw2ԕA z: /T)ИUߵ9 ctDO'1R-jزfJ,hʊ([>|>Imk;ܘi'm/'ԮqrzvVqT /MbqlC +W< +)>]JoVIW!BK۹KP1KG%gҭVeSh_c-uUVSbkbW7;]NʼjM+wP[\aZn"|b~,4QukufHdq魕 4ɤ)s:[x>!7ο+uQ-L֕6A1Fn u:t|M-j^Rʠj{k>ĦBhy]> ^̧MKN 3y-Vᢿ\ƦmH>wE⊓!Z2]F\ⲫ05Vf2 J~r]EFm:jl_t E_0ҴG0}1ٗJUK덱,ү/cQ6ղll rZh.zvز- \_)٪2PTLY-1%qjLѤ?v}T'U&-[F-Ρݝj)k,sW)ȶuӺ2ڞ۠foj&5}g3:HO^ ѱoto,S{pNylWDZI_c"kUs /P}EWT^:9[R-a)ќڬ/kyA^*wYz#EJPZ>I7a +endstream +endobj +528 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 527 0 R +/Resources 4 0 R +/Annots [ 529 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +529 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 569.073057 101.433071 550.323057 ] +/BS << +/W 0 +>> +/Dest (cb39-1) +>> +endobj +530 0 obj +<< +/Filter /FlateDecode +/Length 4907 +>> +stream +x][$9R~_Q+M/ᛄa%h%>5svzfyٙ#YgZЭSK8WiIO1zEM))%VwՊt] G^_~wu}5SJhwOEv +1VKi+B0 ,' 1%1\ C[VX+B KA-+A 4I, K+ȡR"("kvҽ3z1$x:gi%^.J<,.)-dqHId@ ^GR^xpD$, +yIXzJ6E , ,p$,G0% [  ESH6D$aAp*b\@b-ab)bKX$aO!A, M3xɖ.xZKX d7(aA4QW`F, UKǛQ7ы) .$p7JLfqF1c{2P^VA(oĤDd5 +Vb@OQyCCd² x-N9??]~O}y]ɔտB)M Lt;x÷hʟ"!|N".,.I,$gQqϹDuBP=pCV3X)>[Wj L[ikߺ<1oMرT:ESC\=WW_Yv򼵞rzÂolݯ*m+LZPlއӁ՞jVkb,WE)hvnKm{VyXmu c~d~-cyry9 {6ij)FuLM.Gw2,r`/e:)VM}e\căvێ㘪cμ"sV#˷y f>i >W,\"i~!>3KpY +,,ug/3V(Ͱjy!j^2U?UYw,9>꼜%Q-M3;x{XX2sqC^( x~o5> +iDqt>Ylx~lQ#nn3#cyϣެQ.wnF?#t+*:KQ8e Ny9= +w-DT<6uƷ2Oc?JJD9Dzq^O5[eYu^O\߇YkK9VG5;9N߸oɥkO'뼜eｓz$Wy-k;,[11Oٓu^͊2dwP9 vh C>G̞,uzPVyZv~z"O{YAY |"O6ЬYZƓ̬1l竡dmX(P'<l9!r|Ì~b0ݰ]|m#cDZj^,<[(M=Ձݺ76o'NrypN̚G͙fvA= wv޳8etO'뼚eLE$rZH[!zڂ?z:{uYA.hOǑV9]s8 :/gXN4~+ }2c/Jvwkr|m3w麇~` |iт20=qY,ELGqYL~-o泶we#=fƸcJT ris "ՁtSW}䚼e簴(1r;2OncC XMhlCZtG9L/`"Y;Vѓ-w*|AQN VY$ 閃mZEߺѽEom +S\{쵬{?,UNrɰWˆuEg{/U7&U&؈ՋQ|?G})[L6ԩ/^<❥n³]ExVhWɳf~r!.+-oz/t͗ GeIiES|/T$ ]?,)E'| WuBZs#%U dɜ$gQvf4Ć5wI ~Mj|.ZȖKd"jz%ѫI/u7q˓o{{CݖXwlʣMu\uM-k{ڑE/٨MUh ՒmB͓@]w6Mg*rHXni͵ +TUS|Mh]l([?9os"!.J/Үc"%Zn#GSSx勞3TFS>hj&/kO6y$N uHҀ2ur}騄t[馱Cej&fu!a%'*dLˊtm::󚙻kvoCqoovWll4I'v#v +aK!Щ\ |Lqo?_6g39pg}B׿7Q -LdkIrJlˆ 1d{YW0^]u`%uCPݸ452͸;۠| {~=mlJ><γ}K&-\2"xxd.Jl,?񩰹/܈h;6˛2 +V.aҼӴG +S2Lѯ۞cK`YoPk˲gӗFw-hmQcpSUuhpb2ZUKqOѩv|V)ۭ;^ls7GzKFyF^VڶoZ]w+uA|LU6%¿g\g:Hߒ ѱ6j[UE!+Pdϕl3"5W{tLd +:,015UW8 :̩M&|c9=PB1P1No_[Xn>),3 +endstream +endobj +531 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 530 0 R +/Resources 4 0 R +/Annots [ 532 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +532 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 119.073057 101.433071 100.323057 ] +/BS << +/W 0 +>> +/Dest (cb42-1) +>> +endobj +533 0 obj +<< +/Filter /FlateDecode +/Length 4764 +>> +stream +x]ێ}y I $& Ilu9EQg2;V/%XE/93˧R>ޞ0~2`ϟHUޝO;l?ӿyY 1:%Ǐ2z{aUJHͨW1*'b +fXoY<01XN3RQz0Cyi8̐zF%JVC1Z1:iFwN"I8փFZb+V$hp +Qycf) }7V✗IhX[fzeunU/5*AFg +7fyEVpp 計B1. +3KFd-Rl>+v׿o߁OIommoD1 zQܘ~0Lr'qMNcxN=j,ʛ##Bv +Y&ݥv.םCvZc( ""(ru_UVZ/-Sduiy/rhnܤ@VAdJ!dO]6L֕"v4cQu-9a5yi5΃WMۍ}y/M_nEmx>sq:ݔCZj얬/gg!꺗YiehiEՖ3Py}5u7W|\AUe[qy 懲#.ʻ[Gzc w{oMi79u?lYCo!ÈyWw27%rK7uP~.(v6Mv#"enIYugángDLD//FD[/U)k;vFw9z7"M+L(4zsS鹃/E!zGng!tÿ\zwDl^|n1!ǂ̕| m+荷w9zFl5P+ /e.ψZ{`ΡGy۾-WwWfrljC.nv_6lW o޽J [+m Q,uv,x;;aT.$..USJ}1ϠOpi{bzm:&$Ta]V<*biw>멳`n>}g!x_,tAteAR {zɋUsڝ- +SUQ4+pnڵx{UPC V|ǵ;}T mj9tv:.Ս8LSSXz錄hLuey2 [?#3F_ĎesLJ?ykWpL`;l3Ks(ak/vFiϓo v9~7b ~g|I1Xi}S{|kw|N>$(a?uOˊyƝ1yza\ g7k6bbu"_vg!u+{R7]y̵?/mJl +Ot'qgd܌{9pJӜVEpZҋ[/K49!gǕ(l +LF ;,,æ*~Pڌ2+E%RE +mmF +tM+K׊őyi {AJY{89uhTZ6PM l[ɲYy(tȲR6)[ntƁm%_|*miJiD[rW%] ׳5e%#sm"55βef^wmij"]wtQ.UK0QHNpb荳ބ&4rs뱒eD$JښZx EV4E=OEm *͉E$(y<'S@zZ*ژ+B#{6-E,| +endstream +endobj +534 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 533 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +535 0 obj +<< +/Filter /FlateDecode +/Length 4804 +>> +stream +x]ێ$9}gM| $V0CO6+ԋ g-F2qc +o/]¿bv_7V- lBr&-.o?y}5CJhwkVB A9AR +*ULIR Z`$ c0RvJ0M +f䂠 +vh!At/|L&FY;@iIｋ`KJK:[&RAybU ;IEtEQ[WZ%;D]N:ࢵJi=8`ӊ:(4\uYe$-Ip6(Vý*%-u/1E/Qz$q adH"@&B )H<`h-VBu&؂X [ Y ,ؖ ,TX-)%. \$.`\=I\`ARs-S EwXuH\`Aw-i%qwENQ[` J\@]UFFz Ĩ$. 𮉊$. D]5UFnqH\@]CK\ %F]P=tJ\D ßЧVK\:D]tDž~ /$qb8.3J\0 xW[ԒMR8.'q0h`|tE]TQ- 0 +*ID]$-qxPC%.] IUZ Q\; Dl@ MQ``5F`` B  I#p[)J\&b" 8*b]@b-qRCD?p$q̀N!t 0 2t Ȗ.tZK\ lA4(qA4L$.$\-H<3J\*J\n&RЄhl; 0dQ[# b4<݌[2< $[I\8L4R$14$q%7*71mAD!DuAS-8 M$ y(q 7ыKA\.ft]D^\`V+ degW al U ȗH2zq*Z +xV0>KTp3cJ&t Bt_-H6}O_0^OJYrjB|n`!֨9I<Fs~_ȣďmv_t_̽G=Fڢ!7(eO-wfy +xDil2<1Q4KdŸN_/;i ]?|{_/@_?B!nn\OgR,Qè(9uYyi68;G^}ma᷸c§C~spYN \Sڅ]4wi!toUp.Puӽx?JkX.]g +-]ZěCbujIh4Bcy͓y t˚@O?uڡ{]~H$fQ?%c׫ھO dFt^G-z.n^qG<k>gVUV?brq˥޷`wĕ'<o'L-clFB*_qˣ-3S)23޿&˨W+ܐz7قκt ǚ66KF/q: N@}l\x=YWO}u#D*Y~euͦlX.[>Ə-u,kP>syV^ƏxE'-#l3!A{눰6?N~+#t-#cyzƼ*>Iw6,~OKdTV!2%_Ӫ}ljVKjX. -H[l% +u|c{1˂˱~+?2Nu Ӓ%.^uۭzus2r 0GhS9]Ǽ^zK8*FKu6o gtfeaDc<.P{=M1?MhQnfRnV vC&?K }ړ';<ύu><qh"!ƦKS+c˜) ցw%.h`#upO:-n{e +p6MKLAeYz꾻=/†J;EC>Irtd'AJ3>FJ "rSh,669,mOm@hGhG @IEO<>Њo[LfڋC?+uleOD|yA7Qi?.tmyu8UTnE<)濃QtBC7-+h1_Sˮ2^;5vq;‹5mҶ~嗮pWl]mHL}ne33M~򽺋.KtԆپ"˵ E_0if`nd_zK+W[/ci%> +endobj +537 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 400.323057 101.433071 381.573057 ] +/BS << +/W 0 +>> +/Dest (cb45-1) +>> +endobj +538 0 obj +<< +/Filter /FlateDecode +/Length 4669 +>> +stream +x]ێ丑}ϯg# ?X=mbmCwΔ {dVwR$bCLI_~/bL凋S7oU+ +Gw> lBr&uvۼ!%o";r*AT !.1%I3\ CKUT0* KAۥ* 4I* J+ءR("kvG{Igc2It0NK4x]t[\RZ94tl u`%]-]-@WuEy%]KH%T q3 .Z$փ6È|tx咨-*#,l!H:!Fa C%.CIG7 I\qכQd֛X 6YכAD!DuAS-8 M$ yכQXo"S17.ft]D^`VZ+ de+(f anS +܋*9k$1i3^`ZR+1mh OQy!`Ό!_d° Duъٕb|gL?1SV~44!00 v5.z qb$-FԌԠ)閍]fozY~sy"Whq$s:$&.o/_!;Zߗ;* +:t>2zjMӷ;G G'],u+wPǂ|ԃuN@ڃ_B'zN򹎘!ąlwNQڣ:]3w{;E{лVo<yMs'ߊ3 Ԩ f' ^\Po^ 2u$usnz ld}>h[A}|}л }%>dr_> Уm?W>Xӡv'D\hUJ,eܱXAЃuNسE$Ipݭ:zyȼmk#ˍwY|*w tLQM:WVt> ]F)b{,+Jw<򔗂Z=2+BiXjy!kղ~:nvYw42|0 +{ugFuGܽSZD@$1f>0]|;Fv%(:e;Y~#?FQ+<60u$ǡ}Je"#_)D[/{\|^:CK8q)PUJ.7\RϵTD,{ِwnܓzh { ~Zhϕ>HكuN{;{^ˮK,sjYcc}6S4yk8URIOF;3"O{鐸+}"1Tt~%"g+GCѶ~vܰQ{oDO|K`!y'_}˸G+6 o˕Iϱ{ǹjַ{owGzƨ`V|Cطzv ߭=V}9~{|sѝ0k+'is X`!s'zɻyd%#@XM=^s:R~zw:CN~'5z'3VŢdv:[kfvOT]w 7w3˼5f|9u;߱bwGc!'?ȋ:Lw\/o;DXNK/A7:CF[tTd٫#ynWr+h|ɤ?θ2<ݺw츰ņ֚!6^>`!7CJէ~,Zg֊oNsڎ=ƼȎ=/ޝ~򣿢Apџo~_7>Tv | _3n1%o!eǹg_pcQMzqA(W(WDž[Q54i{Yd;U*3~T!߻ӎIجy'qCRh +,.B,/P>n-]{l&e]!2IUuE]g ++S U1kbW:7;]{9 ľr+q_T2mبgr&6vdL )4qQ\Fke 6Ȥveu&ჷ:GY(5~zoKhQ-L֙d 8QaBCXV4yԪF쥤 ]C&6F[3nCxz2oM\Nc닊U8tMW$r6CKUo섩Y633v}+l>;`aD>MGmMxB`xäI觇כ>JUʥ²,㡟9^Aj[=[64ZhAQ&TRNZ&J"-bn8jLѤ=Wj':(-3^l shWZKFAy*V4?wm2[dZ5(=3vuTk0QkNBe"K<\g;Ẅ\ ?1*hmńW(Ҿ5:NxIu +j4czpLÐ.>U1WИR% +endstream +endobj +539 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 538 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +540 0 obj +<< +/Filter /FlateDecode +/Length 4913 +>> +stream +x]Ɏ$WY/öې=a>%-}`rKfR=q֠Օ\ ͒Wo$Bޙˏ1y+_JxHoU +'+  |ʻ/?v2)FTFO>x/,P :F&ȩ`F T0(Uxת3S gTR`u0Dvrt锜\*:i=9o.N98-6 +,l`s:[ӂt(Ndt]tQO6cX]N:%dւI9Y`S:( N'lduj8-8xj3[n-t( -|-;0&%p$L0cd h'x@ h[qh [ f.-: -HqְEq 5"J 48. \)8.`\@rqjp'9.`]m@v  F + xWkdu8i4.:`eR! xWa8.0]X05,ynBq\`(q2 wA!` {M +a +#3V q\`2`X]G3r\69.p*p\'Dw(C܄gqXP- XOQqWE+qW!(}[)r\&B4ocUN<{3K &= % `tp\#lTh + +9A6t゠` A +Xe:q<4֒jNg3BE 0MS:Cmq?Xlb`-7!%&7=QD|D& +9.C'Q7֛エ֛X16jGMqA4"DauASd-8 MsEEqAt֛Xo"g7=]޵Lxz- ^@+Poe ʳ{Kk$vfbek +춁"3+Nw-*8xੑ kLo$~]?K;eq5!_M<&mE,CF،żFFk &bY"I-3zT+X[ma=譯,E<'3ZÁu YfF 3irx fV^pc/ #ͿYF~AQ*(̟-th?Hk¬d~LNyNWt"?r.Vs])kTK9בgsbJ[}Xηdt&T1IlIǨQo2eq O4&1ȳas4w;6_\%?k^?t|]bA~^'݀eO DpަpI:KD_L 6GT!wQjK$0cUu(b  *_]EbKxbD9;}#AجKGi_uyz"ɾ/QU#ʍ:C8sۺ)Z;9c% Ӈ=Noy_\P<s=kaN[m't|;rӸ_x=o>gش1n ޡraF q&󻥣otTxxm#4H/B`րBHw.χ,+yqXk9,i0nqe8̸ٕ6~\Wߺ<˼]wr,ߋ%a8QvLp۰}lSY-iv~նlgߵϵ2׊ ]lhO8Y dAp3[=W$w߯%FgD8Z%OEjHQBl6PWjsuҔxeҖ<<.?̸ZG&,e LMFuca!!Pg|o.::C^+oXvsya{Oy4e|[9'DZȈCD6hf8L4.աX2Gz1"]m1|.ϣaG}Pb8|q"y3nqbS=[-t+$w4"[]r9AOvb{.8\ia-GR;|.!x? + 1h +8z< ܌tʛ3y^yk(O=z:wu[󙖿+y}Z˶;\S^i?,Bv_'<"׎q7Vwq!G3S{tWklۭ;-Q<('=bd>f-Mh:HS!EV *^vR/wu .}l_2&=nM]{l!z;"T%XVU1QXʕP#P] +嗅iTVdw[mbW:nr;-963 TJTo*0B7}I2[+;ѷmqvܜVDNK`H5~q1ߕMg?De Uu!=}I8)'):m:27 --h~\M.2^h[vbUzoC/@CǦ9QK(pUx蛃tkW$(iseC_( +cla&v=oTWЅ47]d] 64.a~q&2HZJ_zimI+R**P-KwsO MZCNZ"[TZE D}l[RKM}ӶډJKW%] ٷ։ƒ>wRٺnxk q-2-]|fsʿ"CHN_&sCMFγW){%}Mh-/Mx"+ʗ٢`t_0[AVP MiO3mGOKEB6MAoBPI  +endstream +endobj +541 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 540 0 R +/Resources 4 0 R +/Annots [ 542 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +542 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 609.873057 101.433071 591.123057 ] +/BS << +/W 0 +>> +/Dest (cb48-1) +>> +endobj +543 0 obj +<< +/Filter /FlateDecode +/Length 4777 +>> +stream +x][$;R~_Q+\_7 J8#0]szWY|vHgkzbVOWF?G2U")<]o\~)8%⢨opW(LN',a +əo7\o?):?I\%` l[1[2H\`J޷=-? OQ0yЫΛ)е qA4a)`/5ELz @Sv$.i $؂"q)xN8ӅNk -%.&bXDWK:Ry%.*J\i&RЄv`&9XGhv3J\#l1H\lf )O₤d @)%qAMC`^f Y&x¼Mf lqpQDlӔy N~$ +϶BZoy<Z7Fξ*{QYae~(}H>\CApχw)htep?$'<}5$ˑw4md24lue\b7aӨe:fTSoGi׸A9oF <?-6a62}jlOy'<XhϐT{~F)؀ў~G +Qq!C8kղ~m< wdCjV{Z+XzJDFdX 1`sy[wlX~Feԃn]bʱq򨷎H<Ǖ ^j43[/K`u/qE78{瑧Zm39hw~Zm(igrtv`K <\QWs'<: Y(Ѿutt<>َCN˼g'-gz=:|KxUN>[7=YN4~+>%;xsyk[-=3'*{wZwO3|@7ygt;; 9}︶/_ OkY/A7?:?cdރ?V\z>Etͽa8ٿ)'zOI n2s~lJD_r[h EY[g'j=G\a u,sb[T{{^^%j-۽/3[m~>;`|˺oôG!UGq׎|XUsR^X"B-?T+2> eBmnØי?׶+wR;3_ (i^͜<>٤Yy kdWǾ)MsY抇P\ׯk>k|糤UlƲ>ǡYrP2_Y\m\kw̮l^}+m`{Xe0iS"ޗEf-+/^hK2gjlMlíпwKz񥭵?O 9m}blajXpk]>_ cN>*-(s 6>mW:UpPb.7m9`lu(y!oW3{S;1%׋/O I)#k~pTt&]:V_7rRQ9eD>Hy/*hE]{QHM8 珪E&l +aJcL +~4&w5[~^-Ȗ'+Z[&=ed+Lq a/x^`x(V1[  U{t~y:߅tu Mk=j(}ڻF5eF&u5ej$nAEMF-?.HҥN.b4F*TgM)6dfi/bsDq)~kknJx8j3..] +*вr8.05,?U9 +פyM RWf/;}cz@SiYwfy騄t[c )2&IR8SXƕ\]Btm2]+}7.mu~}0_(Џ.6v2&솁[ةx[[4??.t:nTc Ӹu!+Y~W<)6m.ֱu m75{MBMіކ^l׎M_GV7l_H\}I ˈ ^(.Y[03WҺ>O|(l]07"_ڮ򢫬% l/44-~xz}&:Q{qikX6“\e[s5_{eܳSeس lQi](]@M~V8Oѥ=Nt|T*m.x[rΡN͗MJ=uݴW ͭR>̝{! ?%cj[ޕʯ +Yhyc%H0YoMx"+XQr&PP9[q% .C*淜r|(G|?/'n9j +endstream +endobj +544 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 543 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +545 0 obj +<< +/Filter /FlateDecode +/Length 4885 +>> +stream +x]َH}g1/$hJ5AiDڹ8^0շ3O lyB`B\o^[ ƯW).$~*ﮯ_/:Ϥ2z{aUJHͨW1*'b +fXoY<01XN3RQz0Cyi8̐zF%JVC1Z1:iAwN"I8փFZb+, s: [ds\H:)9. +  ]Cc/tF>3p\(T;M0%- 0?ٶ`&9hk8.Av3p\lQBq\l~s\lAqAn08tBp\e~S .i8.Z`-nvD[,BV[4Ef݂;q:[T4Dh8.@&"z6%htxF0"2uMD^xG|+81^ ʦ ʳ9=4Yf VM/11Ԧ3X}sbzؘ.?}ߗLY66֖nՐ3`"V@@2j)N)726^97L:/v}DiZzowTbJVkiӽ)ѱFF?lҨ{‰cw{CۍUdD\tT@;[3+O/Rl7+q姿/?O/ nL D_~!ƿVrc~j?UG]`g Т0a&aee2|٫ŏݟTLehMFiɔ.7i~t穩-f?b[gϥֲ 9)` +)aqlP Ȼ߇fVS*RZ.EK[hwV@Aon_=ݘ6+>)sck3ens[fX~,s6,+ƧW˰τIiʨf,>d׿l]oԧ^]pqkm Jz[O7y~Lϓlk z?PEIdsht)<JXƋ'zd;ki55> R<`Xax;:n#Gn/bL;Ll)'x3ʞRӧޚuW:/Eˬb5۴ʾdUJUC.lXӡm'}oCBfyQi~Xa}r~u+5o֛afxSb:crIR@Jf'_tD;t|m%l|ZQj|ʞG?3i٭-Q!26Z9Z2zmn"˨k]CIVMdHRU';?woSAJ5µj*|il"s:m|2ls}޲˞',Ol:n}Mkѳk[Ȋ\A[{uNC=%kLK_;+0}]_Aq:CvyO<4r=j2o֘X5`/Yh=Vlh;q=h'v z~Qhk x:Cv.|p:=:2Hn!m8^mD;! ƕ$j۱]ѝ̠y3qF|'EËk̚k*ߕ5+FL<s:SWMzAݦvzoJb;fK٧Uu-9a5E7&v_ _n'2ztk݈tytv|tt6vk@skO,]i!_AU4&`ӡj' =ݳn|#>_sU5R2) s:TDW]qhH:~8<;sVd#X!oafɟ=t;|3%ͫݛS;v%6uPŽwgtl:]7u3RmX߸\#/Uﴊs:e7)uiTf>Bs:ė]vRL[eǏG9j[Ao}vrwIջ[tѵE'zwꚿ=s:ij7(м=s:ĵWWwkĿs +Bojs:xCf +yŲl"(N[3'nؗboi|ޒc3r'UDvFX )Tq$Ϋ5/!W +%ȯ?(~q17nj~\pLz2zk8(faY6PXZf4?TצVsIYTm+u *UR7#c7nK ֹ{<-Ρla:]]iGTthj*mMZ63vR7Th9h:UgmβtM=h64a~xyy']^$-^I R^doҖn֞.AN]504jSvjliv. YVZ&7UÒ8KLQoGڶRѶeJKd[8zv,d`d]YڜZ.J>NuJ埔 k HDpb ބ&5rw\2#s%mOh-VLx"+^բ`O`RA"ބ)!T=m@BkI/ x +endstream +endobj +546 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 545 0 R +/Resources 4 0 R +/Annots [ 547 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +547 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 797.673057 101.433071 778.923057 ] +/BS << +/W 0 +>> +/Dest (cb51-1) +>> +endobj +548 0 obj +<< +/Filter /FlateDecode +/Length 4735 +>> +stream +x]K丑ȳ~9X=w1  sl5>/( Q*H݅"#BJ*|_rzJ)ஷ/?]¿RbuS7V.N^G"8M ny~q󺎾)`3bQyR +,+ CYbA q[V.'/ 3& 1nYbĂ:((% r B&FY;/O!$,>+-'D^O<䓵Ji=yئyXQ,A, H< Y~$pۘZ nxȃ,| L,* &% LI `\rIBb 'rp* XY X YVȃ,6; ,( a8+a:XpTXS:HX`SIX`6'a”kX.{uF ص. ,p:$,p]kQSA@d%,p]Uw v$,L&%%ak"'A+a!H;7pxe$,p]L2 w!^v V+a  +SJ‚M$,x3IXBOX7AEA8MYX$ě@' N‚śI7ы)Df]L 4HXěl^x}&3EI(@* Us +K14,SVJL(/19STgHX}9z1SlΏ_~{_//( ɘn[c61.3ICB܅Ԁ%FBbJrN6@?#>0gv\P!_ۅev]I{j۴f*Z%GhMk M*h +A'26B},eʭ +H1-~嗿]_2iBa6ꥌ[j_ֲ rrr꼬몗u&C_D]N{[6l>3F1UZEw83-˿~Xef|-7t̨=>4E?(Ot3&1'2ݸi7xbtk{t"?2Uӓ:fȈfYe֬趞dG5uXz?H2ġҧ]!l|ٴfLzkdΝsݜ?I.!ylmFi ;AIvљla [%(|2Wh;su~;ǒ<4s\''R6uƱ̗~Gq{ıy%~ao=`L'h}@ǎViY:Og}1wت2cv@Z4#>+*lwo}ZhO}wB;R{O|_{jeOy6K5}قs;8+Navkg,fmwy1}+>WZa۝ +GOpϓm={E10ecב{;\N^C\Yc*o?h7jOy:Kj$)W7V(chyod>2k,tj8Yd8V2 +I1π^r\6zYA3>Ntvr}F&#EGoǪm{{نRvpPnݛSP<=׽~>idgN{o==>DAmszYDfڮ⮧2o +-W'<Rp}iOK[d:Og՟Y,Y+|Qg'KoD >Y,_n9*c<;Z`vIvMuSƼξ7Oy:򧣛,8 k{ "c~md*k C$&i,\{Ζct4Kge_=;YwZ=q>gc'<5 ;ƵZ>eym=wf cE &hl`e7k?wl'-*u5ip<7ɿ)o|OoI2=nXM߉\˳Y.gmRO!w:gsY57\֯Sמ4Y=UJs6Pe>/^eK,c_vұ&v~2#/Y5uqEi/@ ʙgmYqMsҿ_zb/"b (]˼t9lR>Ԭ2?ɤYek6wGyMѷ[ڪ2W{mc6+J/O;KYV)8MV;,Gy݌sOSԣJ{zeȽ\s>RE$X2AKyRuڜ>*+t('|Ymm +#V+۶4Q7 W$=iyPkreî~9_'zhk[E "pzU'M6\to +: b<30SS?j[+k1HM6k>.Sy[Ogkge"!y3m?]B9CMs4UH6t5>mKbZINrg7̍[yoJ+`E[~vwWB?xC]DmިFx2Ֆ۰m{M]]C-֞mNN_ݵpnz睺J[uZ7Jk-*SXU'QKGig)Y nd9>:K6_2 k7%mmvn{ep]=SիMɇ3RS2!:㉱Q;T +KK,5:s%یH͕0VEM& +F>fղ6sj *_S^+ v)T&vPJ3 +endstream +endobj +549 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 548 0 R +/Resources 4 0 R +/Annots [ 550 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +550 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 250.323057 101.433071 231.573057 ] +/BS << +/W 0 +>> +/Dest (cb54-1) +>> +endobj +551 0 obj +<< +/Filter /FlateDecode +/Length 4726 +>> +stream +x][q~_` @l2y8;džq:ɒTRϜL: zUKX8;7*璢~r*?⢲'>`J3\RVeY\*%ZB,T) +X8JɆ(Qb) b߲%1Y`e|2n*&%0%$e40VkA +<TңijF\ly G py%,]PSA@GLvx3:IXXFV̪F `+%,]wm yIa : xj%,]%pآ%,] A2$,SFtE^Q,aAJg K +d$,+8T‚܅{/DIX#ye+al5`Ui x]m0u*D.M b"@@(JXW%(aA,<|"/*\ !DdKXZWBgB  "P sY)JX$Sx/aA +*U9E^$ R +HX\Je,z % xKX +dRHe\Ȃ [D#aAѠfdQKX\x^S%,>* +%,2A y0!a懒 a$HsDdqKXt3KX3dJXۤ|3IXP4dA'aAQQ,a`<%,(&#ߴ^K7iHu[\|3IXP^7ZPȿCA6>]>u~ ^MrsX-S:ʚwps{~jʛG_M~*8* TY$RRVOⵏ~6(D%hwl Wb)jD(|n |uRM4.tyx,Vݿoƪ[$>| kBSiv;D :>D!eniiǴY|Jn([#k׏k6VqޫMP4!-f(,kv1w9.B!Q 7 Mi<{ *Ҋ'ǓrY)j\SMkn ٧zH#͑hEFyHá7F鵍fۑ#;]@XgM1gۉ62fٶ6[Gr8g֧clt4jYhZiaˎ%κAkjYAK'1dqU-gm;{vsSw z2i}[8v>´sM{}#!M;m_<};{Cs'w>jόc%DZv{U[#;u΢z3Kw/ɿcUlG,bE'"P@FNDvj\m_[˧$‚JT'\sګElm{n2@fR}^u2>P_(WxZ6ͫD?zbz +&ˋe3m\b=4t<5zE7+6M5םP_z)$MGѱKu\:?_L_CgbJ&&]LT/W$O2.Ц6PЪ ^B2u,Q3-FtlVn]z%G wiF [f MCuAs6Ml: ukH,[SMVwcBN dI .;ݚgFgM rHXnn-JTUKe]h&:(%is3!.8oa`8ѱv;9a/rSfщJS yIѩhjtBkJQK0>L]&n\_Ht؂T4:x,ɦ[]'5tD݄@w)-CЗjнh ǎo:e6߈L['luv3Fy[%щn?" + jN}>0v^e9Po˱z3-(Qm.x6GNUkbj2ŹZSKqzL1|V)K6ף%9QǒYE^S(m۷_ݼ AL6%߅Y;vR<Մ&9sOG]'uJ;"mP9 7o` TpjECzLVЀi<{uC_&J8qf:=se/ +endstream +endobj +552 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 551 0 R +/Resources 4 0 R +/Annots [ 553 0 R 554 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +553 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 728.673057 101.433071 709.923057 ] +/BS << +/W 0 +>> +/Dest (cb55-1) +>> +endobj +554 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 502.126036 101.433071 483.376036 ] +/BS << +/W 0 +>> +/Dest (cb56-1) +>> +endobj +555 0 obj +<< +/Filter /FlateDecode +/Length 4753 +>> +stream +x][8~_H|)$Vp$szw@hiၿ$+N3 eG{SKUDC)x޾|wQCp +%+U+ +Gw6 lBr&t?cYG_͐7]MVB A9AR +*.* JI*ADAaZ` $AF)QC5Ncн3z1$t:Igi%].J:-.)-lqHI:B6IaV:bb.I.+:آҒ.H$t*UNVaEa|tx咨-*#,l!H:!FaZ9bL Q[0[T` $0! I$`(RX4PV@>-UőjBXDX[P@ka!+q"qݒJZ % 3k' ,(PJXpwJ\`AXA ֵ ,hRX%$. 𮵨)` ,qq:Z k +xH\YC/q25Q5.@ԅkJ\@]p 5dQb489- X 3V46%8Npš[ :&/qui#.[O8.wAQpj$.p]m%xW$.p] Na$.tE]TQ- $. d<(ġx.{wVUGkò4A0*t]Bw۔,0Q8 +6HC +K\!AA@YP Xɦ(qA0#qA0!}-%. 1I\~ *b]@\{!bK\r$q̀N!, hK: [dK\H:%.  ]WCc/t>3J\9T;M0- 0?y$.MlsDl$.f Fb qARI!ơSJ₤#$.(qA +Mlu qA":؂) &IybI\(q 7ы)ALw]3I:."S/q.Dd+g2g3 +[Ŕ[1g@y$& `&vыYU( +xV0ex>3| ˂=G+f7Mp׿1SV~44!20 }kܾ 1ggd#BjFjtF aWcvŧsGG*oh֣M& RѢ>\ي)Z/ q^~g`( _hvq ,s,nXc-gߣeTڋ)׬}j[w:SM֎Ƈ'urfiorZ/_^~a 1JhD;>Vs0߀.w[ B7Mmi{Y>B Y@]|s6b'ua9+;|ezTݺKbzbe}VR'Bi1*8wzjǵ+Oj9k+l,GCi;'GOR*9ob +_ ==Xt{V($)]^t3cQ/+t̨QM>wXtމ`ugFݙSߛ筈z$Iky>0]|Fv%z~2~yuNߝܬ87;Zx'f7v7 oIϱ{ǹjVa,!Ktixgĭs ~љ5okΙvfvAڙ=zfk'ǟg+so X`!s'zɛyd'+@M=^s:R~zｿO`!t'ىBbQw|ǯ[{fLT:]ofܗy{s:{:Z 9}֧>>ڟau'o/헶>1N/_Hs:Dޏ5rHge=Y3\ߗ>3@q:CNmꔇ޷!J)y';u7rΡfDžS4pZkt{ЃuΆܸ}'q+^";<7y֊AL8bKwG`Fw_7yz>EapNȧs3.diވ|~|aud}dmi QC4uߍLL\go ǻ뗑S37QXr6ݱz"{l~KG)ΣnuvvkGP[vr?8| m+^Ih{Bpks (ܺ9qs3.:0s^1p1P0\L/y~Ir Ƹ~l-~Bisݿ.бbA?&nXe?ko88 v>w WW[ds|5!/ +WH)Ж<U7V#)34?!wTaʿ<#D$7u3| Y}s[N[m߱)m'jھM~AӐOt7%]I5ת}WKoZS+װw{щ_V$5)Mzo"AL4,?RnÐ֕o֩6n]h\\ߕjIBvcA^ՠgq~X|)!l /lw*&tkb5boC盰·N/eM`yOx[K_Ei~QiQUfQJ])Y'< E~JӈtճYojT E,7LZ*|3A:lYQ|\s^:*|&ZBʆC*e늺*VƧr%bkbW7;]]{kwWmb_Cq_rR2mtlԋ3c餉ޮuƄ0B7}eVvurqo]F7g3 ]<̗$bFU0[bAq~ceÄ7+h~ԪF쥤 ]C&6F[62֍b d>wnÞ.m_/R\Ʀ%_YEK (.YY03wR>O|*l]0"_ڦfyE6+ 0iiZ#yMedi*}zcYZ O//ϱ|Qoږek -ZcIc6pS*EQTLYm1\ xQPc&igWeshq8vwdd׮Rj%me^mP3ķTjnU){fLuTkIklP~aR#׹+YgDJZt~l+i_*C%%c ͩU&h|eLː613(-sV?2צ +endstream +endobj +556 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 555 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +557 0 obj +<< +/Filter /FlateDecode +/Length 4659 +>> +stream +x][8~_H|)$HX ‘ f3 4+'$t=CʗsvY "!I\ ̨F3j I\8 ]QbwAKFƒ`QIK\2P Z1!=Mz==QsӷpavS0Y>4,˺˘6OyrR ]zwv溿Wmzao̼QY.ܴZ.Ѽ^Cӥ뿍eS  GerAٜF/#y"Bzu'+"4OrZTG񝑉T4\_%y2mg8}i<ƈh| jEn:Uݨ~Y0ӜK9l8co$٠b| zϚ|>N=',cy@Fq6]cʔy{4Mngfמ,VXWkLjIWW`9fwz0σ`2)ow0}DžldMa6<|c>Ua x_OHcy)쨎 u`z V\l>~WT>2[JQ|5ʞr/r}>֤gy<ZI]zm~ZzvL 3y]=9.Ŷςݝ7_`m}0{>| + 4oq3y߉-ڪ,a|cӸ⻢u㹤PrǑpݿ.t<u?>s.vhɟu_7ߛ,P刹%>\Q*٤EڝT.fՃyu#R,DdQQWѪSz3z0áw穸E)?[KzsSߊ@ѻy;"-E7yG2KOtkX}ȷ|Fzky q'6z|G/Z{ao5_Ɉwy8/߷ wd/P|,áxǯrwu}>\m 8hKz,!t7++޳]ʝe󏿐_Y=Bv}`GCbډ~ܢ6~@۶^]5JX1փyb+J;%Z?{֦N6P{Gl`CD?bvQ!zw`C1C~~WdœٛxSv 9Ptw8@^ĽUrsM}*ľ6 ͛{YqdFeKg|r +x6@K +ᬸ)+;/y0i-Seɿκϭ{-Ӗyۿ4u1-(v\sTZ9?ݴf;{f)ّ| nF:o|= h]େxeKt 9;w؟LI'G +є&~=+dH؃bNžBv1!-SZ70yиr5ߕlmNJ!rzիAOb~ Ot)_O +lwڪNBUĆ=mM盰75k ڥU?JQu2ԕC M̪zPjT IL7jO*|3A,$ ^n([b=PZ7f%Ցį'Ԯqڮ*I9<aho@T᪔'hMYf:$vͥCKG%gҭkͤ]uyLR> +endobj +559 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 728.673057 101.433071 709.923057 ] +/BS << +/W 0 +>> +/Dest (cb59-1) +>> +endobj +560 0 obj +<< +/Filter /FlateDecode +/Length 4867 +>> +stream +x]Y$q~_Q}>0l/ + ؆fj0z _x%3ָ4z2G0"RWoVSzE$]A8|tן`௯7]_/志uUVgbY#B A:0,DySX Mq,a +B c2kV:(˱ J.0,%!R<"5)'<9VǤ ੠91xIx]x$s)k%ǃ,C<XApI[t4F91 `@''O#xZq@`$dqsH`dX,d9,0@m hka-IqX`V*aBLa- SJ`vrX`X5k `9,0]cwAMY`QpX`Fabi 0v9,wu .5h8,]0sw V{ `(#h q|8Y߃ hLh%8Jp̚Z wU$Tƙu - }w  <wx]w78 `B!M( eyI# X $,/`,$P I3rX*rXe&Al; fYĨi9,h9,m~3pX$dAaA^Pa`<)9,H*b-Xߌ$#Yxo ,! +˃,nIo8,:Y ߌ ~= lwz p&"[no/. >㙑vH@oeS o؜M@L,gp`*ɦ $]a=4WKoa)o&Sz:Lu7WDֲ"*L7/I'^m㧡L*+otv|γ2{lKkVt[slg mM@jPFOCj?Lp2 VcӬ.ivl>Ylɡg "\`$droW^#0 mOA`Ve0muQq; +l~y:9]y!p͑D,A$g+c`:ԙ\?/Jko~8PU8n +T?Ak)Z}B[mre:sucy+4{تj$)7V(&bhykd>>Y`iPq26q,dd޻{3z%˱Ib:OgZ3'f 3 Ϸdأ۱jV!,,tSPܘ{Aoq1 Q(cyγYُ[OϬ~+7~뜩,`fWwٜxn=[Ø{2EOy:<Ȥ>َʹYZn2ǹo ~^t|K5Z{㝖Tz' Ħ'<WeYffZ# =,dg`6o9{}xXf6i^{uk]y1o5o͓ucjoK`qqڇrǵMǻ"CNkO&3wy]CHo訴;su"c-;<,m!{uf?suz3}s@\yYAm)ɦBʽ9TJ+驻9iz0;neً6qrYB{ +d E! ͑w nD:=E^`&?w;zJr,]/'J|Y߯={ Z].qhSݵuJ=iTO~ι|9=XZɊM,#@qAijM~ϝBX"K}veq|L+3Xg4knzgeYs/):eE0<^Zv4Kiㆅ]-2Udu^YmWS?TgiO{zN.r}wZa6E|];К^R +uқ*z23͵:[]6Wdm:QP+>v[Ȧe^,\)k657Ȯre=hFvU5rspӓ*wsY9 ȹ74WMv?΍=r̘8ߟ+lRy=msیޣzi-ز.rr}"ocY.|kvf9[k[׻zZa޼xH^YaY2krOGQIG_W}ELpB3(Msuzc 9vȧ[ Bx5m)Of=:!}~r~$<.Ӣ{9mc>&{V΋0g\mZxij9ԐoZ͆m[¡cA<60Ӽ ͥtecǴqn+[*|ƥ!Ytb#̦NDYyܓu$EҰ/鰇}CȲs/oX>\~ΓXp= /οޖy-tvi|嬱0QptY3">謞uUӁW Mҗ ]¥@򱁙/,GԼ j}!"r_ +K +tea:M*+V]7jj* @g:E)s.*YAϷ"I2ûz-CVd"eU-h7 pi.`S5Nvu4Tjt"h]3DjMK + +S|vc`xHVFD&ʡNֶʣtۦ:߉MQujZSݚRTծfRZMmĐnM[LfF'މmR-ǐn\i͵ +TUS|M -P}ʰFd}Znx8Vb'^\`JUfhҩf9*\6vUf#/4}Ci@R!4dMc ꠲R@ǒ52AXOʑ(讓]3R{`ɾaHmm6_L&ӏNֲy@:k&)RR>EyKvs8Mijo}ew<{Z6 [ѓѷēdJlf j;~'˺j ͏k=eZR5U;]@t2f6i2_:7a/MD:Jq8gKM⊊vCE\r0ubA4Փv +JCAlwcӕG1AlƋaNBF臗{@:R|闗瘜kegZӗF-bс{RJ[tZE VZk1T|VՒGY-Stꏣ8+Mn*KVע% 7s裓d%#CcFuvwa {d*{5*=vuWLv8j&C,}JqH~d'LȠ{y^Hnj|$!ML*Ü\eigNːu'2F ((=D4? +endstream +endobj +561 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 560 0 R +/Resources 4 0 R +/Annots [ 562 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +562 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 220.323057 101.433071 201.573057 ] +/BS << +/W 0 +>> +/Dest (cb62-1) +>> +endobj +563 0 obj +<< +/Filter /FlateDecode +/Length 4731 +>> +stream +x]ێ}y I $$L`6:ċRK3k`vZUbQMɳ#w|xtRER_oR?X]$~*']ɟO<R=཰*B%fT+n1FN37,Uf,FKTE4 +fh=vH%!C;NBTyWNy#tqp lQHNgaN[9آ5Eu"  +'$z1"t")aNaDgt +8a#-V 4l1t }hU4ВYآ79P8 +8P&*Ñ +z0T^s4-$tJrDlqL%l1h8. + Ze4lk 4ֈ(9.[#@pa@qup "h.@uu &8 4xW)8.0]es\`F: A 8.0]w19.0]eq UV( xW8.P`.(lr\:9.@a[qʈ`A8.]}.ңřqVs D9.]g?`FUXԘ9xW(8.] ap8.6H貺8 ZR`D:?H r\#+80p{XlAq\: [fLYSp:aNG xM ' +^3D. +:7r\`8C1p\lJq\lqw/0W)R$0Pm}Kܾvpe0어T( ld;w^~Y +CW+ ʋz"Cֽ^h]*YG +XcfcY^`\4:*P 84Y1jec>&u؍wO_/o=kƯ ZIn$w_ۄ௫i2&xB})(y\WVeccӤ<ٜ5rq%зv5q=o#jYYOM}sͻ9,C`Iq}Y^X_pi!*s\J=-wxeM9S$'2DCVuԉ6.l u;矿MmdHM;I(o⎌E|+d%t.ȧ.Cv +Z<qAњ*Zw9ZU^+斈)شӼ9Vnm @2tHh.dvuWѵ3hLh]qWQk +_hJ&B}, Y7ĜS{}cw l4WJzHj97^FwF#5Έwpƾ4h6kNGyT[^:235[W1\>uжH)Mȇ#乧ʹ׸_<׆gto7}uSix}tv~tSkɶK[2G;y^N{gisfٿ&MT[2扴/FD[/U)k;vFw9z7"M+L(4zsS鹃/E!zGng!m]tRHO,Zy"{CXxGw9z7bW_I~x/txF"s=;myumZAǝy Po5_}xTv ~]D9f$vmqob{ߙpH܈lWm+i)úWW\QXx+#ƺ3/Zz[i,P %YOid?+OawVw9j7_%myְ}oc%:}^I\ŭJ9j7w?^|ܶ(|Z:;+#31HVrk4XcAtLåsFY|JNqiwOCUwO;YO+}w;b{]sÓi?^[uӮۧ;ؙhH}T mj9tG-0qnυa:6dm轓Y+老Lb:y y&0?]8N+:_hIz4o{tramN.;DG ggr}GrwsC/&4\,#"9VքKmńg(ⶢ)yz!- +nk&TiN,"A)BRj[ eUqI +endstream +endobj +564 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 563 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +565 0 obj +<< +/Filter /FlateDecode +/Length 4937 +>> +stream +x]K$qׯM|lÇm FW2{ZN+# F2Yc +?]~%8"opW(,N''&ذL .⯗?:jEv 1VKi+[B0 ,bJ b@1(E' V{V&hXC'VCDQD<{gc2It0NKx]xY\RZ94xl Cy`%^,I/BXWyEy%^KH%T q3-.Z$֋mZAAK"8ij#Άjxv[esŘ@"`%0% Z$ 0!, I `](RPĴPVB> -UőjB"DXYP@k!!+aE %xKJ{ ,b* ,FOX@.L)IX`)ab ,P:o$,]KKX`֢ȃ,0` JX@]UFF;V&*&`Z knA]㔑 w!N V{-aܟ0VKX:bD^Ztƅy -/$aQY p%,/FZwIJE$,9,oV0]bwKFxEE IKX0^P ՏM|@mE5S.iG㮟~o ~zѪoѸu3›pF{)kBwAn7-:iOTx SoX^ܣFu8`ٔ:5=^M{r_M"ˑtzw5.Z *_b 3L m~4v(9n(aF͡Ei0LU@a-Lz2<&=4ٚe3K(p7:fXZF0Z J1g*~~P۫,gIښdbPv\1m>\g6$,pgcfM}<{u\m֯\qouī|qd}U27tfgeTy +ڴcY˼tyL[)k]E 6RFEғ.OsY5 xConi~:6]Jsa¹惋 Mnz57j |n8^PWA_;U캨e{'L_P?;>E82w$g~g#'Q}h;~'orB݉Oy ]7@HIr:HHngꮃp1Jauɖ~no[46-"-{)7 W%9T;;yykjy{CC_ݻ'7ޡy~A{y܀[|)̲HAoۦ+;Tq2&;^\TBqbogN}`Թ')nl-Gv\>Yl)uV}/<6G(pz%Es4#ٴ%/џxikiن{%mt8Yl8:#׶E&ݰ127蟈lUIoGոn#O;y1k =8 %-)z/9%aEƓuĢz/t9B'Zʹ/?MToJ*nj|>9V/VwPp΃XJ348u0f}2wO*m8=R8nQ%hOöغ>|gTcgM yZmRWMC'?6K놄AF4lKau:`|\#ίNÄt󢲤0X}Q3 s+UΊW||,$?\??.29zɯ>כ2DsQHׂ KK1y~4 wFıc^|jхgŖ+DˍloWKV D'N6T|fS&:= -iS 3U̵]BFudj$/U& fZX ZT XHV*jMƦxuTa#֏[2lc> A|qfb'^\JUvhҩ|T ST@ +ר_rnXgx瘷O,};|Տ4lݐGOQO;+*MhhNֱu7fkUZR7Ս;]@6tfyb dtl^/mX> Jvp;v|.\2CE\r0u6bA4ճ4徆!Kyt 0ӴGǽ `jF}ƘO|鷗ؼNޮ֖mAN=h5j;JtZE ~ViPeZUK(j)S2jڍҔQnx-Z-r9~wldh~ݨKJM۾A]#Sի]w{Zg:HO΄&TBu ys\>#Rs%cOUA"37Ւom +RA.' sB]"/WP)頴#?Iw +}G +endstream +endobj +566 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 565 0 R +/Resources 4 0 R +/Annots [ 567 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +567 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 351.573057 101.433071 332.823057 ] +/BS << +/W 0 +>> +/Dest (cb65-1) +>> +endobj +568 0 obj +<< +/Filter /FlateDecode +/Length 4714 +>> +stream +x]ێܸ}Kx}X H@lb Hx/-PIEZὶQ9%p1r*af0`90ZF`h0C{e8PzF$PZJVC1¡Judu:5#e9g3F8-V#9l1Vhqfܢr.r\` } 3wat]w7X p\M( 貺(d  -i 0 $ Iq\2~(=r\q\au~ t̘*Sp:TaNޕG x7M8:p\`q FD.J:'pm9. buxqk) -5^ #QfpaSL&B4ochUNtts\XKAq^$w2[0T8.T$glq<] ho゠VNr\kI453238\E 0LS:ۖ,~2tZn B-Zj ʹD [q\M4DԆ˴ DXobnjH.7= 8M$7N ѹ z=ipxF03uMx^x+CZq6b As+2^VHoZ#Aepl*Ja ?ffp>!*8x̙}Ysd7o1!R!a#V}rh%,{$#|F*tKFbKaCTůՃ@X;<`f[4ub'@~4߽9hl|Ű7oћ% +m5v;^ڪF47E=>X|lIGmP-Px:Ku/}̞61P"[Cت]y(k(D/uǻ(Wy5}їengǺń.vc֭Ww?wRZJ>ne>툇ns8= _HWݪCM{_єi>vMvmi@?i6 #jTz"eœwC;⧃;}޿?}c!x[,tAieARnGv]sk- +'~n+R8v-< +ȧ$ 1|GiUˡ{0q)50MJXzzc4uyqyߕ,I;#?xAN-VZߴ +nE؏v]&i̶o=gYcO]/is1],ƞM,uEe79RWx&u׾-c|Yh[iυ6Xo/j<ѭOf79m{;{^s$r 5u'NG~*$nS+vi79W⴯x!^0{Nx zy'A ގ}f 5 xOc!y%^kiaû|es~wMHo5<72_ෆV79:W l;߭g{,?G{/1~#ޜ~7qyzw q%zɫWkf5ژp^~޽^_io} f7ݘp]~aQ~!tg*6!Aԇmyk-5sL]w;}if{ip o0-:*>r9@m5 +xc0駇1nI]Zl"mK$Uc*VuE(,OV(mD\e2RnϭؗW@bo)|^+b-lW+k0BW}yv9X7^N?iNtme{dο]q- [­q;Fq:= ˰i4_*Դ6Z7|mjvY=TAUѶB[۰]i{CxZ82/:a_/)t_ +2T)NdE[(. +clbfd[IidiR]EFK:Sٶ,Iڋ`J>HBEJˍ%i!<^Jå^9"B,j'ZEFj1m+5Y64O. YVJ&7f2q`[Jj[ڶRѶfiSy+ȶpdMY|\HMMIY6Lγ S q35{5OuR!B=Q4crws&4܎#"9VքHz- E\W4E=٢do`BA,DP*>-m!cTlhh36 ?f@ +endstream +endobj +569 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 568 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +570 0 obj +<< +/Filter /FlateDecode +/Length 4760 +>> +stream +x]ێ}gy)ހ$AbavvF0`~NQEjI=;޴N"yxX,Jj}VRHz1O'5/X]dw ;` SH~>O|賙RFOYEv +1UJi+B0 *'41%I3\ C3(E'`U3L$`N.*`6J:tM%ѓ$QH:k'H;-wQlqIiI`DJ1H:[JtNt]Q啖tN.E"QS1KQnrZ%鴞iEfAg`W.:2O8bfmՒc:؂xآ(3hb^80Q2$vHQbD!XLr$JCgDVG^ba a:bI\` lA -lK@tK*i ,X.TX0$.\@)I\`)qb ,X:o$.]KK\`"-`h%. *H\@]L##qFudbTxDEx,.LV&H+7x8e$. !%.P&.(lJ\:c%.@a["qO`I%.p]1|.M:Džy^IBe%.p]g?aE58X%xW$.p] Nap$.6i芺4 Z2`T0HZJ\Xޓx"=h$._0Nʀ)$xWi*˦>D `/H\#M)/qO +:|Ove:B$.c=%k #-n` "SL6D$qAp1ft-"t:H\MXKM^0:M[0U$.R4E\i'[xi-qA4ޠD2+4jIGQH~bWQL4&$.fI\6:bI\f Fbf )O₤nq蔒 ! 0/y%.HVa-0o $-.-p0oIo$-&{oF f` ^ Do1\u $L~W ^;(F amC +܋*1=4YF/F B6P_ct sQy!`͌0-}sdJ9>)+?BNM0 Lp;xͷ303I0%y؈H,|ae9 gӑ"ϱ>R?(Nc`xl&ߜg!-ںdy^V\+uR(0#dcfzem? VNKqvc7fyEil2$RJ͛ub|tRi͇Wo߀7OU|濏g J4-}M㖿-%X& #Ҽ׬wyZM:4-rņR'=Z~)m}Ti;*o=dyAFZ 6nDz| +.8*JdZD:hBuGf iTXOlm϶vii. E>7#70bIT$*aQe0Ok9 B>c1PXlZP d  g[H642 VJNlr;&޲|Unz-_ yre"nЃRe){O[tνaz>l{oc_Y^Ы,PfNS'}O0u~#]ct5c%>1ٯܲl_Zrr#2Òb^zgiz[2O O,Uֽ,'H랽bG>P=sϹZ"?gt2!Z2V_mO_/#cyfiX2>Iw1f߭&7-e B)~]uY•qTs;]8&ߵͭ _ƢÒ3͞lgvcԳRlwYh?미7m z13z +|a>v{')`+ƅ4tZ_TڂryjcHuQCqR_-49 rSw x/ڳ)97vLWzhtrF~xaĶ6ld)8^tr;ryh0"aMQجcp0eN"Eų95r=[*3 +Q|' {Ayd{Ը/-S;78s>`ͯ+=ȫkrv42cخ A(N[vZQ5vŠ +p7-d17\`p]D +8Ȗ,[6yˮ%Y> +tʨ;Er,ϝ ;GR{Ehn#Msoh ;~-h +r+z/tLImsw(_n@!y>"b>4ۈ\yerC&f %և;o7^AwA[8#3幻߉ xC4'-fygT&\I)7}X^|uH#5\T-%5{|oC+<ti|Zc|uns-؝\^fTuswډy}5Q4w_x;}ly~C8P]om?ǓhQ$soHL~-19yekђ_qfR[xϦ{1ć+J᡿T.~'"VՃyu#RxhD8ocWуy;w |V;6TGNWOE] ѻy;ݖWHj  ;B;:.ǣwlnyuOphm~Wݛ*dw ܏}.eE;m<1~͕0_6剬H)7uÝe0R[ )yYnSjX}+Cgv{ꭖ_Y=1T{^7] ǓϯgI~J,2L:w>_ə|Z^n<Œc'hϏ,\4_\MRpjYK*{))cGJk8+bJ"_5W,K1^Mz˿d+_M᧷H}V`˸+VuBw)T]uMlأe|V&tù%|8wk;ܘ QM|rAHW(W mWnGҤ!,2~?SRfAS]JxnVzCRh +-m]:پtTBz&ݚJuY'$Uc-uUVre/TTĮBy%nv:UyrW|šV{k1/l4TFծU a &n4eVvV($Vӏ ?j^>i?Nt}y㼎UTn]!2a6PGMcK +:nLԲF% ևTmqǡ#cҶo-Vo.cٶ$"qIے-.#.BqUe+3}%~r]EFm:jl_tVtI/t_iZ#㾘 `i*}a,'Km˺vjY{:9mj4ׂV=F;ilٖlUiY(*]@M~V%8OѤ?=QQiܲUoVpudd]R"u5!yes)_/;s! *?9c{1jJE!G(vlJ.#"%VׄZ4-l3i_ULΖؤ:@5S49B2Vʲ3IU$+T;g +endstream +endobj +571 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 570 0 R +/Resources 4 0 R +/Annots [ 572 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +572 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 546.573057 101.433071 527.823057 ] +/BS << +/W 0 +>> +/Dest (cb68-1) +>> +endobj +573 0 obj +<< +/Filter /FlateDecode +/Length 4909 +>> +stream +x]]q}_VG @g$dwۆq7:9dd*=d.VIS[go4~ES)x:_~>rRSp +JAQ09|t石)$g?k8O鿖uL)y?e)T *rn +8/p)I*Z̠dLTfX +ڮU fIR \TZmu0DY#贛<:K:'I.@tN>vZҥ{#Ғ-dctXo-&+l1$"l-+-钝\D.AbkQnrZ%鴞iEfAg`W.:2O8bfɳ*%-u/1E/QfДyIDɐD&ډ"ELL`%0MSx* X[y -+`M$q5$.X--X-%.[RK\`A0SI\`6zr$qZp$.`]뼑v-E/qZJZ'V qw1 8+QI\@]I\@]D]05 ynqH\@]CK\L%F]P:c%.@cAX"q'iդc8>Q&¼E/O$qQY x%.OFZҁwIJE$.&@I+@WԥI%.p]В^xRL" i @ƓB*q½' ):?I\%` l[1[2H\`Jѷ<-> ؂HQ0yЫΛ)е qA4k "& )K 4I\lThӰAtZh` A Xez%q<4֒jIG*3CE 0MS:N,~2GHM^nF b-F ͼ $[I\r,qh:$.H:biH˼ތ$O $-!-0oIXo$-&ތ zytx%0"2MD^x]@|&+c^qF1c@UL(p/Us +Hbfbe5[R+1mh OQy!gƐ/2aZF[~:8tUɔ&W&ao˷8]O +3otn/_mr3Ŵz|v29/me˸Y7סlxw6P²l/]cʱsP\ :?Q}5O.Yϟ;%K?0/ b X)݅+*Ut?-ƐkS8=\shin |d$Ehy5cz QQ]"*"|}3Ld2 z!g;vFu@ECsCXoJ{-,žȆr{6$)U^i#c<2ʸ"/˨ +3j +_GqŃvy"Zlle6~/#ز(y5c7!#OR`+=2+4BfsyV+3!P $ǹ`C2V-/=CŅK-?WsCT"0F'ߛv]w42|az'qe~1f:3*uGܭS7[6) UFc<#aq%z~2~yu^;Y~yŮ%j'X逩#_EGXTRVÊp|]U>:au;׶' wy]{Yx"ǚ9Zt4#ȲWG_<;Y=\K˙h OĕNmjph#d2TJy'tuW8Pw.Gl~8xo dž#rwx0qǵ>ne?؋6DǞAZ[=ۂ>5zhAQ&\R-NZE TCj+b/StyO;>**ۭEK@9Sd% vR/il}nZz3 ^ͭJ>̝[! ?%c5`-RV{p,5puFJ0Y/ŖMx"+XSrKzTP9;%!C^* \ݍAiVfN-'ۚ=u +endstream +endobj +574 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 573 0 R +/Resources 4 0 R +/Annots [ 575 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +575 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 96.573057 101.433071 77.823057 ] +/BS << +/W 0 +>> +/Dest (cb71-1) +>> +endobj +576 0 obj +<< +/Filter /FlateDecode +/Length 4722 +>> +stream +x]ێ}y I $& Ilu9EQg0;V/%XP/93˧R>ޞ0~2`ϟHUޝO;l?yY 1:%2z{aUJHͨW1*'b +fXoY<01XN3RQz0Cyi8̐zF%JVC1Z1:iFwN"I8փFZb+~'YdamTӡktj +V# ?:l 9,aq-\k䖏(U&I8}rVGdR>4֏JAՓC}A|>Ǹ%{}x(s[J`Rv9RٰpRX 1UWh]P0ϛˢ;2"o𭐕l]|4e^\wΗٍkhU,8ȓ}yVsJe%b,.64B]G\+76UP r:Rye4uSw~Rvu]HϽ3U#}k"-s8ԺBujBCT̲a4?{ܻņKc_Kg=,w6:U?n/v{Sz dɚ~17+5+v7㯍PssQ3w9*u?h6mf7OWZ}FcՀ#d]GͭϜٶݍ7L +_) +W[ޗp{} W8È9cgوupiO[z70mqEcNGyT[^:235[W1\>uRlɑ;FsOt/UMDKS/|`H\on_[Abmڍ}y~-1uf u#ZI\_)9c'^kSG-RʦnDlwS8)5s8HtB(yhU唽j;s8nE(VPti0s_# ۙhueԫ#ҟguWQΡXxm5$(a?uZv_6s ۹noVς x7l@u +3EF}:=۞}f$fqb>7͔i&caz; Z)Ji)vS9!S}tW'hN֞o{>r6â>\ړA}yy56;;3XmM25+[F*3qӖ +ʜlnKU +w>b_z\CRn,b~ȕTe5jH+>'qhC2nƽ~IIc +endstream +endobj +577 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 576 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +578 0 obj +<< +/Filter /FlateDecode +/Length 4823 +>> +stream +x]]q}_VG @{$FbanƬus◤Z;h`HX<<,R[_~/bL始SS,.{wՊt]d SH}_]̣fJUdCPNP%ʹ)㼠zBST02UA):I3Ș("̰ݪ0A: (%`"Fi7y8K:'I.@tN>vZҥ{#Ғ-dctXo-&+l1Nt]Q啖tN.E"QS1ĭ(7htZOش= +䃠3+DlqVIga Gҁ' 1 +pjI`1DlAK `Q&q˓>I\ 'F#jI\8L&]Q&bwAKF“`Q&IK\2P J:o@ע.B!ЄXK\%.O.I\3$qAH]E ES4%-%.@ D[ J\M,+ 0Bc. WK:R<όD` u4!qڇ'NL~04GH O71&7ID|$'%.CIG7 I\~(qA +ML~f lqQDlAД~ N|$b:Ѹ/o뿁O?Y5:7ΕVt4^K]yKvYuԈr. õ]}6%OIPg)\l-9Q߷s?-gE3xHǷCe/^ NˮypqUҸsƚUH{hfģ'<2{h/9lGs<2]0RYzUF+sfXE0<<RrI|usy1/;hyYs)7bӓy 86'G_.¿B(ysyk-sf<<,kRF:@#u˛Wlhw<~4$*-bej9|OMesP~EUolj36{tAn {'<r﬇ckܴ~V?xm^#kCBۄqNJ_æmdh|K mǬ9qw@ + mU3{?W>k6~+2> ee!As$h+W֕]s "r=2jcΫ }`ҕ6ߝ^&JY抇P_|ȾeNz*M~[~εܖOg1ҖZqPg3|^ϕKh~>q.6ڔ˽ eAG~t?|aWUܰt*v3~*OԝHd6}`㚽9tWyh\|9aɣe +fj$~Dc<.P{b~{ў{CI9,ٻ2mrxk-i߭=%!\\{y|)H{d(;^ 2mBMs#=D:Lv2ϓL4B@PmF[@RFe"jXk@cxw{#zƁٲ{w~D?v}Ud~3ҿ簏ce ]eT̓y 8:&_0cthg² pAaO>}2ӡ8n+)vqˤQmZFŦ5 f9BAp+586t>E{#U>Og3=ϵ>`?M3JG^&̻Ay/e{Q?+/y}XZR?ܼxyzT}_q +m+=c&e{UZ>A|Wg/}i2i IF'3ycsIuLXnڦ1՟z7 U]3nj4=4I-ut>kUkݯ&IHW>0*K6ΎםZr2r܌EISn/:; )*]vSI&',,U+tMd7b:%o*S+BfHD66X"[1^M$8r) {4wڪAB5ܮ U{4\绰>N_Ӛ04vmZ&JZTQMfR5vD Fբ C)0V QKj:AtJiThbϚ)66 " CQ~\ywkkkܘv6ⷋ Bj׹B +Qhr8.QOUg 3U&e45H9߄f/4}c<)t t[汅tp @y,źªWBU5(-N׺Sf^pw.;Fqh-Pfo+w|Fk1C?֛tQm70Bw}[;ɤv%s:û9|e!wZq[ƭ 87rēb*lfhui]ECǍzvՉԍAuӎB}8Mv;V^lm>`ϗa,[X\Ʈ}HE⊓!Z2CF\ra-d@7igil +.0/mQfǢ,bH؎cǛ=wd_{K7(mci#> +endobj +580 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 381.573057 101.433071 362.823057 ] +/BS << +/W 0 +>> +/Dest (cb74-1) +>> +endobj +581 0 obj +<< +/Filter /FlateDecode +/Length 4698 +>> +stream +x]M$>H' Inc#sϣZUj{fDziUTX,Q-}VTz!zNjVXbv0¯gVG$ ?hwϧ}rϼ>!Fg=MR1 >xP)M{crz%(`lx0c +f1APA5-UfYR TZmu0D1t$у DQH:yVK88lt [lTZYb5t)xI` 9RIyb;QtQ[SZEl ̢.BKQvHI: lÈt8e-t[?{OO pEq0pLI% a#u>V#5hqJ%#1凙0TN1_O&cz aNoA2Fj_c pJxĭX,5Xw²/C*e @9&v9"CR?W#iDS6LeOZ +K8\PP7ciޓ&er &yƨ󜝷acvqn$y~.Pz3D\3o!Vx;^] ! +2Wj!+Zߧ+ + +:te>*2zjNӗGLN^ѳpW6l mc\ۜU9nj=P=sJ↟2bk<gjs7Gi5Lw90owg܎ 7rϿPti~Ms_C _ s8nė~ދ 較L =.w]Sld?h[Aͽл| TJoAP(^]l6_ :CF<{(~o5_(rQ<ubڈk-Q]D=o*B&m!t_!v\x-7^P$ E&K^g>f-GM;m3oZ?诵Of]\@츠B:CF dvDncۖamjrEr;rJc/<ͦe_[}9_\ ȭs4dbvU!zMt7Z9Zţe>˲l^&-s8nW >J [Ur޶(|Z:w,V@>tg!vY"g Vz~ESQ1t~%"v2p{;2O 5Ԏ?:GCvOqaife29vkut?W-ۻTuKwisJ/[Vw9:7 ֋ѾV˜i?5w'J'cd>s8dndR"y2r\٫u\/WZ!xmĦ; a# ڎƷBĢL [Wpٲ_37Duw=sgV>}s7c+\*o>=;uX5wGcAND^fZ~xAnhCߩn?d,K7x>!-ntlW{or2q:GCcyu,vyn}kig=8,n9Fhۇvc~i!RjnCw9r7w`kʷԾ,Z ά _Md-:j@TE6eӻM~tې^aI [՟//\_z׌[ 'rIS02( uuuKar˕ܤ;5} 7H6 ڷӹ{6ls 6_m?=J0h^iyv<]>R"MzX}^9Rjz7J K890:\./?ľ$KdGcդ6WK` !j:W]aS6CXlmVkR.9]u +m;o /'z(MoM5Ȩ1*%CI]NSf8]!K I,7f|)j՘{RNt hrf(b<}B^NHBi[B VHMETKOYR-<RMN$"wR+wuX;mK{_0J(H.=66]}%*1낺"Npe+TmL\edN7p*v;[/\n,ORFٮV@ +U\iyZicdҌ{9}w9CD|p[&(K2_'>1:Unۙ,8wga6pCUC-k3> +endobj +583 0 obj +<< +/Filter /FlateDecode +/Length 4675 +>> +stream +x]ێ$q}gK>0,/ k Ȇkg$Vz3yv֚FMUF$O,sDFcOWR,.{MQyCYࢊ/\/U9koYEN*CTޫ*&,`di0r +fIP%(Uea!I3LQP ;ZM䬠3^tzt֨͢.BgtΩx# +!$"-` %]-.8-`MI[,z' [$`HωHeti+ӒM'00H! +: [Yﴕt$x»0[-ntXI 6DAyIlI"DIbD6{E!G6Y#ӰSBL8 [@`%'q"qݒF%m 3R (P8pwJ\@Qu>X hQ +8#%. s)` ,qQ9uFG id%.*0H\(6i60޵M<7xzm%. %$.PGxp`%.: PK$.]9 R& quY-zY G$.]gQk<K\8(@7e4+9% ~ 14nuߔjsCen750IbuN}fSV~q6O̚M:Ю՘5Qp+'|p6 ++~:_Sq99qJ]q9_Ś`^MJU.[^ +ʵB0::uM47{yq juUsU<~[M,o%} +n{Q ++2>b_u6.Pro݆ s=L@Ǫ7w=d=Q}n.{UD8C}㈅=sމcT{C&=շ +P +ejәBuSu۲cӦӎ7lm[#y Q~S=adNϙ}T ;ZG={7zj6kD=a!W{g2!`WܶL?a.zw(5(l糝`zʙ|AGE5X&9@vլDZ>"Pw`ˑAmzMo[-_Ͻc)< 1n'dmRj8ͣ_OYu?b(oK(rpVyR|w3|#Sɔ5םhZ|eNj9Oe !L'["N^t˅O6'ALI1 珺E&lx5N +g|p~_sk"W\*V̭b>>)7_f +Rф@{CqzPujD[ׅ.l]gimvAn-}|&u-Mr qD Fע èɞ0U QKk:At|R5מt:^>b#ՏK1SZ7v#]۴_Jxn6FyhCR=]&ƆٱLBz&ݖB:t $c)6 uMVq(TžAe!v6Un3ݷr84|űjUx+b~ta7 ŝF_Ncdǽ]r)n:o >FY?H^ɏ[6n]GOƿґNW;MAhi.6 ͏[;5{Mi ָgmՋ-ڱ{t\Fj.2u.:+N]:d Pa-d@gi +u C먻ٱ*+ vX0ҼG0}69FM2J[XOrrUZYn{9}jЂ#Fi~lQiu. UJզ0gRZ^-ҿ=QiQ \nx-Zr-#co)[,Ys7)ʶuӲmC3zd{6I&{ORտbR?Lt֕_;)pVDJȫ+Խ& "t4u /PcPTM;9[b^VPYͦpQٶ,B2RqЛU6is>) , +endstream +endobj +584 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 583 0 R +/Resources 4 0 R +/Annots [ 585 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +585 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 639.873057 101.433071 621.123057 ] +/BS << +/W 0 +>> +/Dest (cb77-1) +>> +endobj +586 0 obj +<< +/Filter /FlateDecode +/Length 4914 +>> +stream +x]KHn篨0氀a{^Еݵ RDP!*.7ntW )U~Q){r6N1{ _~wub/_S V`y?h|XAOŜ%eEr b8cJú햕!I,K+ȡR"(xOJ)lȋh$SN{-BI9CS8 Dd1)Z!vK֕DdQAisrNeTi3O>Y$֓mZ"( d gYUFYW') jȻZybLt"`%0$MK'@$;䒄&h%0O.(U<% +x$$8xȃ,6; ,h a8+a:XpTXS:HX`SIX`6'a”kX.=JX`#aZkV8வ) Xdu8*JXp##aVu `+IIIX&)'a-@ >h%,p]q 5^ p8$,L%F]@=xJX&D۟@I$,]|"/O:BB˓!KXب L'F;jKXs4 MZtE^TNI, O*ID^`HZJX޳r{DdHX<V'e4VXwY‚ܥmS‚`pBl$,M9 aA +<|"/LDd<⢓mNDY1DY2HX`ѷ@8ȂHQ ٔsDA/)EK(aAnV%,@.5%8% xIX3dHXhJӐAtZ‚d A I2;4rIZ9Eyf 0Q(a&RAXJH~l"yz'aAJ$aAJ(#al(aAVYd )%aA q/)Ldo"6@f ;<Ȃ) ~ LB tx$,!P$,@|XHoF\$񀻈L@VGg23QƙĊzb@{[Ef#E2jmLIJ"sLOD`{ftnݷ7;_tgl/JJk +n`2#ָ}Jʟ"!| sR l?$$:z#/ +T v@2CRОEϡB~i,kWJ>/kʣGW.>%e"$pHVȌjARܪ>]Rs]2,i:ƿ|ÿ+?g\~NuX4E0UukvW?42cY ʹSx_^}eٌ3Ue:3V?˧.im%5 Q.9w`|ol7Mv\~6jMmc֎-huy_I2?sMk'<"iWYujYj}h6۱Z#r՞tVncZo8+V0̾}ZM )FL&^0mRm4ze aa,j[Jrty: x6x3Ө^VẄv 8jʰWa_ڨuu,VS(5xe_wd\O2qFn֡v,-\qh^fulM`T5?CY5X(ORn,J3,dZŬ-̵xlL _YUVْOy6K6cT,m<ֱ,,D͡DaNv"'_Ly:k8|}RڳT@,{ϳYz uO}ƹ֬@;:8Hٓ}ΊoGb~ NHzX kWVlܤ}uףص>O^{!z֘*tt'<%i+pkE :"6gfSpso8Yd}d7s3l1\zV| ٝu{ݏU `dܺ7kP<=׽ q1idgNwٕ5`9/g橃&^&ǟٍ{^=0ޱbѓ}2*O|2dla >Ogߢ?{gZY@lzYA}7V57>X,uv+C y6 ׶[93{&*]w/{|qnz{?ntVw;6OG7,\8 ␇k{ w|R0Yx8F-kGyYX#W˱w:+ȪWg^;\qfcĕ'<5y5x_ӡ*t.gIAxC|`蛼&L{ZNIB rLPh6/ց\&Eԕ~=yQѿvQ(QofRc:f5d-ёdhk?yG4%Pk6R9CƤL{NӌVeWg) wDҡΙO&-zV#;*b>O27[>p{M1s<4TaҎ[jT]؟c梇xРةum5,^5aa/z8l_&25ґ_@ 2K4/7嗦j瀭zt%(S%| ru_d&*@άK(Gr +i҆o%~2CjˤbN-Vw(:˛q-/墳HPW #B_s9I&Q  +8S[1 Բ׻v/l9qX g[2ݽB/H]BF:޶;UDŦd<6n Dlk[r"^/֎wJסvj4˄ʍk˶ @^Vkrm'2o+[Ի.J7uZB;GdLVٍ'vGX|5=NlFNKk'f Q yI1OBk%qzh$ h{[.cY/О@n[Q=*T5Y7kd}3雫R`!ݷq;94|V\әM6.J͍d2T'dn'c.@;rֆN|cw2iǽ^|)ۜP OOy7iغ"󝌾0($UbsF4~'j m7UR7Սˉ됑M3]-ӌAZl̷M߰K۟KUWpolߒ_ؐ}K|P\ sl%&$w|),.XA\fЕV5Ali>i^#{}/"Dmިn d-a}[ +yXmANwZQFMI]&E Tc),ݪZ'QKgiW)U 4nZd[9~wldhnT[Js݆낄oZ>g:HR ѩҏh-_RGߝ]bܮl+"VgrLZ5},;_)wJ :̩M%|ZP*W&Z +z}STZ~3uUR% +endstream +endobj +587 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 586 0 R +/Resources 4 0 R +/Annots [ 588 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +588 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 160.323057 101.433071 141.573057 ] +/BS << +/W 0 +>> +/Dest (cb80-1) +>> +endobj +589 0 obj +<< +/Filter /FlateDecode +/Length 4805 +>> +stream +x][6r~_ XK@@89@y>`|/JʶӪD~X,JM}U"!<]o?]~!8Q>]08|tןX`3_._w&.3ϣfH*C!('TJ[Aq^Py=ST02TA):I3Ș("̰]0A: (%`"Fi7x4tF>&D]N#| KEIG%%-N)I[ 3wL-$%qop qA+@WԥA%.p]В"Dԅ@?T$.]嬕wuF#q0l1 guPL!J%xW$.]6%.&J\xFiH!x |Ru~ ((K +$q!%.Xc$.e4oqy[q}@`!&" XU%7C kQAhT%.Zjv$.i $؂"q!xN8ӅNk -%.&bDSK:RΌD`` u4!qN,~2GH /71&7Ix|$v%.CIG7 I\q(qA +M,qf lqpQDlӔq Nz$Mv_(,4vݦk?O[1-e=?2N^wpNHyNj6RJ R;q=roQ{Qz-|eqޑ82"l5dt>.6{uun4n +G9i~~Je%b,.5:Fo;vUPr:rye4u9RtZwu];HｭsDG*jCKJj9j6f0]<:Cofr̰e_rNbí/쭳W^y/˝Η##rmՏ;>s6mS#kLaf3GԵܝeT'̃yNm?h6mfOOWZ}FrfZ3z,кg>G0/7VfK6 +9 +йVL׭ѥ@rNwmo{ `4g43yY9l7]i +_yY[9/etg}м<wy7\Zu-ͼ/0MӸ2\}_K:cؚqܯM>ۺHGKڗ{V5ɖp5{CWM;cyN>n>w\ G6𦖙l5%+s}9trƽ'z>WPD,"%ys6TN;񍪻_*y~, ]8t8"> xq${l(;~n "VchAc=t=c-=ޭ4(mh}ZٯSXAՃyΆڰ(g)Dh Or0z1>g}Y>wOfqlhPK/ɧ=s:W >J{m Q,cv,VD<`!؛%$Eu^Rvk3k36\>gŧ4^ 5#Wް.+1TDt9t>뵳ϐ>`!8y?,H-S(۳ftBq4,mm!5jv-<>Wg9}T mj9uv:.8Cww^hCϲnƱN;cO=t00 + [?#3N_dfr6F?ykOHL:zk6 %͏shj^ާx`w'6+wȏDT8A70uķzs?Je"c.XK [/{{Y1=u0И\ӋbvY[oC:`=6ik&Rs7Rз,`x{?cYYt썆~Vnr.â~=R|SLtCqs7au%x%ttۋ)ctщnfэjG/Gw &A1 E:',ۅ?)5Wp~*r";*rX"K1߽$O`+_Lq> a-ڴqWjn)TMuUl(ۣt +msZ.7Qʇ.rUd1*)KP'AtT.ЙE]u $*RN'n1T+=JXՔ +uK &i1l:{*61 ⨌*~ v+k)xR~ C3*\2_4H]Vc}aZq )`m/I.-66MC1IuA]3)\ +U6U+P~ U=WuwWʭb_Ob+rgmب3c*]V@ +U\imZ؉O_ fϗq3֙/j>X{|B'Yq +[­3q;1񠘏2lXǚe4y==t2ή*町0.Vj6bSkmZmo]+G}S'7j,E{;Ug|m'S:dh eSad@g +u5NmY6E.m/ڂI=Owd#ڋci!9PlB#َ,#"9VքZ4bi_6)gKJ@U[Ei;,ǀP Tti^l +endstream +endobj +590 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 589 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +591 0 obj +<< +/Filter /FlateDecode +/Length 4726 +>> +stream +x]ێ$q}gK~ =0l/`k ؆zj%V~dE^5*SA&3[]%~S/Z%bL)S.wUT]" "$]t9&WYQW-RZ~$5"cT * rNgT^ 41%N3\ޫ̰):N3֑QEalP^`r* JIءHkft {N1t*hNg*8]{9-.IlqZ`51p:[7thx'1[`RqdKZV1{NhtJ lVNiK8#53Ӂ' 12U6(N`:؂@{"(#H/qC6iˑFh#:&aC0 )p<`N+-z -#,F$آm-qZ|k.̔0r\`@Rs pq^s\`@Fq$k r:s\vFEq%a9.@ +s\wu S cp\`ڡ Nj ,xW[9.PGxp`9.|60p\*ac4J<"%<Ό[xY(p\q8^`F829xW$9.p] A(`~J. bwAKBF0 @RDqbzOxtp\"auDq0l1`UH t]Ü+eHx.M@9.QG+R$tXv e:bH&E -Fk -8.@D B.` ®,lAqLd-yUN絈t"t*p\XKAq^Pq̀NY B-*`*Q#2t + .tJq\5lA4qAL/9. $\鬤uf Z/(T+M0%- ?v`&9g9.Qr3r\#lRs\lz3p\$lAqA^Pqh:)9.H*b-ތ$#xZo -! +-3nIXo8-:Y ތ z=%iK`&NEd9.֛lWFZqFv@zVv@{1[v@|inL,gw 0B$m ',O "okl$[˯_0^_坲 Nn[cQiTmH,",ld&oE^iWtZX`_L4/ ~w,ys\ׯU~JsҪUei^)m)CɾOZ-¡wh,_?,SڅA.Rus l&oA'*[U/Ͽ×2ULdg0Vs@#ȮiZ=u\ +P"1M=zp:"a3gg< Z|@7y37y:Ǧh ߍ9^=yow5Ƽoj+$Oײ>\2=0̓zJDlGLC2-v,wgyAM7׳5Nmkmx^jnTlq6eLB[=6gl~ ڦ퉞t= }`k2\LhC̓;<̬ <+ ~to]7\Sj[/O=Km}-*_F + /_ˁI:{_NdX)azVگXpVĔ^xv)_ȕ+vz~S|;2ja\^ʻ۔qMjHW'oϾjsCeׯjaq"r Q~h6mo9yoOqScК+/eVƇ6ޱT#K x*}K kMvPҞpS(uL/\u~]Ovi/| $NV>]>0svC_knz +Nج0Q?J˹뇍EY6I8^rۘ{syM45зڰ?l5Q'&:v~'qQcEa.^حc +yNQx6oCу +>XɣDgJ h|&0zbrx`d'Y6 S+Rr1=iݹ[q'<,kd垧P>$+Y|ڂ/f@dߪp~yh{8c:K;B1'< RC2ߔgn?*_y{{GGEQ3h=wymVtwfjCǽyo0G&jSӇOy6FϱDst ifi/^9ڪ6!í]ѳ7=;=thۏ)_}TO7-ۼ;̨c_?y8o=?xy2ӡr?@_ :-}th=3A#WXۏy-"~=t[Qx.ϳ0Ǎ1"n>CkVu/`⼇9c̼:q(gexh#Ǖ[G'<cчx3 Hq8<~7E6nLMⓎܲsM;vvN\Ad>> .݆3옯s{PŶpdkxGs2ϳ!J0'|zGҭƿf:~( =jzט+p@UMQY?Fjsl +~'/MGpr9Ei.qB;E{6|pdZ0,0p$Rp譕_ %`n{T~7Q(M/z+!]]hQj7Xuș_sKU.ŠR܍EIs.*YAϧ{eG]/BolZOIXVU5a@A9qBNʗP~WћL~R1#DNz)T[07SW혶3 P]k[Q:߅ujV; 5һvkQջZ6JMj!#]wmљM?p +$ҥ.lRk=ZسnJ,H#ԯk1o}-}']m#..0] +*Fm(;^|Ь2zPkRbE)zgclⵓFoc9(z]*_$D-uJ:lT#j&& +i\9 +e5ukP~[ U'[e^ pw.;Fqh=V*b~tm nH;eqkd܌{9m(ze!s}2kB7n]Ǚ@<)FPm Bmb{ZWq=^SƠiG>ĺAW+3xo[ }'维W_Vp16LC}J!#.Bq9Te+3 c%dP]FХ:ۧٱ*˭ 6XUciecW{1@FM6J[H|חm1`wC,3=ӂ>4zhaW#FiJ7VjlUi(]@&Mdn-B)􏣧+͉nʭ3^L ['{KFFMj{JSeuuuͰ#Sٳ%ϴ?y'D_LVM+N2z"`5pW2ք=.ބ7(ұb(.>[lsiN?ȒP Td(g#TW' +endstream +endobj +592 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 591 0 R +/Resources 4 0 R +/Annots [ 593 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +593 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 422.823057 101.433071 404.073057 ] +/BS << +/W 0 +>> +/Dest (cb83-1) +>> +endobj +594 0 obj +<< +/Filter /FlateDecode +/Length 4629 +>> +stream +x]Ms$@ $p@9=6Uj{촪HD>*ؒ>+|_z1oϗO'5o,1;_7V6 N'cPBr& u鯿:{^G͐7ڝ6, !JP)Mʹ!㼠z%$` إ* T0Ud* T0C'VCD Q֒t %у$QH:ti޻(,lqIiI`*I[, C%.CIG727֛X 6 qA!DuAS-8 M$+qA>73DD/b^o1]u $L8zW ^ʘWQ(PoS + oĜ54XYF/f VJL(/1k<3c0-,hh5?wWchci +$ CqGPBHlDHH ZnH0=pxʣ|-+OoQ!TvVw'u|K,qwO/o=k3775y_xuک5ᬕzӵ\m'^1aY{njsj/S{X[:X^mB{Wz0_;dK^&t:ޘ9iYw4"w9F+ ,[+yQuckuZ'_yٺv9w\Qr,_լƞ?\V@,ᐺ=A煶\~QY$:GCxogku)ݱeW2Z#B~2}rLg3I?ęկBM}j5"<:CFw XP(/d3ɸ|6mwo6 +yk;[}8rn?_+cVGsղ[ߪ^m{.?ougáscޑ∕hߨeδߟߜw'JoZo22:GCfȤlE*eY VS#ţW;ԟ#^{o5CĦ;՟Yv4BXZ(?.n!x_!vZeffDuw} |~-}s7c+\#x:GC]; 9!xD^fZ~xA}~7!w_}_/m}`,ݟui#~Czg!veٞ~Yjz} ++w97rn}t츰-6$2CNm|:CF>&V>-hEtϓ7xY+:i{t"|Bx rM#\tnf؆c5,ɏo`6Uqgo4s~@Tdu&=v>_޹kx+/cSOږե`]_aH}Ir:ɕƕ][oU)Dۯ'R^ zwŁ#_Mq akVqSI1[ +;][$|Vyi6 l8o /'z(o*M5ʈԕu@l'At9 Tib0Z~?U l-J9At9\PKV5o4S/>!4E\V,u&6k\\kjxi| SWpUgmT~CJ;j's徲z@ʲ!TQ 3ҵfReLR1/T%XWUq?+P#p&v3qթ +yjM+w>sq#n]" XNFUoNƄ0B7}eVv:}lLr&'ƣ,}/|u!W?nTe Su&,3wa6Lh,&ֱu Տڶ{)+BMz^^KǦ9!i(hX~98MG%Y8EKVQf H~~ˇ #!5mn7]dU"'M3{^/d_f@Vjg.d)~~X}Aj[ MZ(Vm*ImNZE TCOJW^ +5hyO;>*(-FKT թVƒQy^Jm+IE> +endobj +596 0 obj +<< +/Filter /FlateDecode +/Length 4702 +>> +stream +x]ێ$q}gKk%Vz3y֨VFMUF$Y,sDFcOWR,.;MQyCYࢊ^~.U9k/YEN*CTޫ*&,`di0r +fIP%(Uea!I3LQP ;ZM䬠3^tzt֨͢.BgtΩx# +!$"-` %]-.8-`MI[,z' [$`HωHeti+ӒM'00H! +: [Yﴕt$x»0[-ntXI 6DAyIlI"DIbD6{E!G6Y#ӰSBL8 [@`%'q"qݒF%m 3R (P8pwJ\@Qu>X hQ +8#%. s)` ,qQ9uFG id%.*0H\(6i6b uQa: k= ]뵕l@Q-z]P=tI\”["qO`+eRxI>Qqaޢ !K\X LVT+qZҁwZޅ%. q7e4+9% a鯗_HY3k¹o*vp-/@l! |O6"n-A76K1|mdX683e[rAy>VޖF$>Á9 lLhпtAq[4~9 |dK/?}z|/~dp])'4rU&=/ŕ|NANqL)}ѿӤcsK6S~wSJՔ4w҄07=+ITF٩RF3kJ:xc֭`; Tmf :6 +gb2 \TUö+M9'Kev`ޱCxoD84GIܛ Mkxs\Z&IiK<<a50QmG/-ןMfH7ݚuߔjsCen750b2ugril +Cj5}?ٿ%»TXahI(s_Q%J⇾IB{7̵e1Mb1VRN}ۚ;gogِܼ+0ǿ~*ko\q'88t +c.[˩=e9Z*-.e9iZ!XDZif/ Β_Ꮓbu3.vb+3WV:.0]uD2vQB(7A(*{AkM8(&NuOj.{U“s +{1/e'WBO G t]r;r%=oL;(ܭe;[60ȳn{Z6n\}r)UGI^9pKG{F>OQV#y@ +;?LnPWn:t27HɹפDtsy)lo=xyYYV. O+C в] b[xjmUY;hqQe,r֓y.ޫh [4YE]ze9 +e#h˝P`rVH-;U%Ϙkzߖm%LE-5/ysy>VXn~Ui0U{W娏SGpkF[¶|:3#w+<W嫏@7+{V} :uVu;|y2ϣ23-V5j4h+WOe3 +{Ⱥ֓y~[+.mD +ȻRy> +y8?ހνy̺Պ.y>ݏ>X@^1̵Mu-Vnm?Es/_q<c<՛8L(w>jϴce }-;v^<^N;?g2wP5D"e{yp:yͣa|ܵ_D"!; hJ*T|y$oǓhY$pH%O<[! -|޽Y3g^{S +н1o7Jw6wEwq>hSm'<NFYȬ8ܢkoDwNŻ&;}ǝѓyOŭ"ML3 u>rS]ѿwDNy4rݖԻ|GW[aXϘ! ;OV^xT-ysy~흻 BhL8 \GC}U2|%oC|nHrٟWm]Ak=a@G#EQ+=wnK3yfu{(Dw +rc﵆I=%~Z[yX@ϽʷayjNt?aT(\ gOu8_cYƐu?'oK(ߙrg_)yKڑdJǚNrO-|ؼg2Ŝ2?^L⩧? 8zů>1',?Vn Ш:Js+B9}l#]rdT D`bnVfI*4S &Ҙ3Ӄoz-U{ ٺ.ta3}:3 Mk0 uk(#kQwn27הm@ ]7M̦FƜZ\ EL7HŖ*|7Cݥ,kѮ~\d6: .~(+n(xROU +U&e) 5HѠWs4CczPi216̎e3ԭҡy<&FKikb?+GF. ʯ qӷu,šq(m m[Yh-fZI[V^ 솁k؉~LZqo?_2g|Op-,s?7imܺ+E:)6mؤW4uځgםkJ4(mе =o^l̗M_KOXVbl.S׹$_"qI-!#.Bq9Te 3c%~q]F:XtV Ib,Xi^#> `i&}a,m'K] ˶rOZYn{99}jtׂ#Fi~lQi](]@MaV8Oѥ{ڏ:я6iܺ5o5ȏpulddaݤS*M˺j{Aݐ=SݳMw{xxHIdi,dXN!C!RB#os?VXXCs:7لW(b($-kIo!insԱ)S% .#og;$j#v>-'% +endstream +endobj +597 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 596 0 R +/Resources 4 0 R +/Annots [ 598 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +598 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 609.873057 101.433071 591.123057 ] +/BS << +/W 0 +>> +/Dest (cb86-1) +>> +endobj +599 0 obj +<< +/Filter /FlateDecode +/Length 4881 +>> +stream +x]M$7rׯJ ~ ``a>LLKX|ؿ$Ɍ̪i f2`1"ghbL/'5X<Y+&s&PBr& /;mYG͔7ڝYCPN`%&q^`y=a)I,5v +æ$İD!٠iJm%F)Advҽ3z1$x:G4`/M{%,.)-dqZ% $,I HidqKH@X\Y(Y @KZ$, UIKX@[SIX@@\JX@\R씰XAF쒍^J %BMY`'ґ$,]*HX`XFF;V&wMTV 5[  IX`a 5N ,pX%,L%z]@=x$,@c["aOX@I%,p]1}"/M:@º'}wQ 'FՄZwIJ܅$,9L&`"/M*(a؅'$"/L0$-axRC%,]lIUHUnȃ,kò4I *x]Bw)a`pl$,N)/aO +<|"Oxvd럔ro4~xPŁat0ԙŪmv2NvZarwfⶬJ" K<Oaitÿ.4Fvzʗyt21A;7!8*s>(2a5e6U~/[a>Q >X,C5c3n<G"RGyV2+n+ ēaywVbzm8T}|nX2ݏ<%QY*jy-,m XJ\yDaN<K@٦|;yO/z ֹQug?mfdr-bSx`ߝܬ` =8|IDp[`SG|[)M8n8WR"!"# }"ٺO5!{uγY#̹r,j6r f+vrqW_?KkRey:Kz'uO}ڹ֬mG:3O{كuΊo{-c~ FHz5XY ϠolVl RS}8Lg3I˕+kBZMiy:K>j)7=u~ޚE<ǷaPq6q,d7cl96=L=X,kiO,F :21v/:meJ³r^E`/Cq<\6I Y:Og;άy+>ut<3RdvIH|ƮϽa}4hcw&npX_boGWkY,q@!76 Vw|Sm0Yx d~c{q{yYm_=g˲3d٫#Wy WG}s5ʃuNmꔇhq[e̩:ROVp`ΡfDžS4|w߰_=Cy:ɇޱ'q+λh'ougm.]19Ec#ثÿg;Qn=r'Y1!b>N9w|Ri7?/qK\WmfMf-v \QG\뽖Q6īxIu>VQ;3:oQPh;7N4ts=ZK 4jASo.=ܩ˵WU|O~hjKeZ)_ \S4Y46oےCTcעlRIhnz[kثc5ӊRl96ey-\YGZ敭Mӭ8׽oqL&sXzQ7Evn\!6Z@IWz~ZxVتu{-jwSOnSc%>Vlˮ0qX#$ +dU>Wk(t1`/њyHo'3uLeզ_c爯:G4c_>?˸'_L.F5%V;:]􎎢k;]tQbq>dg: &yWlVBm9 y<EWr#<{PMv6Uv5dUyz1;zK|wCu>ܫ @4o*.ɶm>0c>: eNJwgpNܡӲ;0_>*:MP]v v[n@[*MoA|Q>?kX6Oӳwu{`'ӕn̦3?E>gc$gմrQ].V>No8{;_ /5Ӥbyf_ZnTC ӰuA;YxV۲aDcwqc^^]u`%uCPݸ45f ebsdtn}}6ﰮRog$rѾk (YK3$朗>oTP=07"?Rپ+ L7l54-~xy}"2A{qjX6T9TʺxZ[5'/ZQF\Nm-:E TCժZʈ|NkYiJt|Vlnx[9nΡN͗ڍj{Iuvwml gz5*=vuT-بd|ClF`#K]vdcD*Śo`}k~\-)qH)@HuSLPfrr$cȡb"ENo_a/Ih +endstream +endobj +600 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 599 0 R +/Resources 4 0 R +/Annots [ 601 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +601 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 141.573057 101.433071 122.823057 ] +/BS << +/W 0 +>> +/Dest (cb89-1) +>> +endobj +602 0 obj +<< +/Filter /FlateDecode +/Length 4767 +>> +stream +x]ێ}y I $& Ilu9EQg2;V/%XdK,!9_>>bvY ++ >Z6鯿:{GSҞH*QEԌ{err-ȩ`F T0(Ux3S gTR`u0Dvpht\*:i=8o.98-6 +,l`s:[ӂt(Ndt]tQ6cX]N:%`ւI9X`S:(tN'lduj8-?GADe8PA& +q0kTqsV\[ Xl1p\z: -Z) -p8.G0D ]]O01xCr:A׬.@'=ޛSk!`s\]f@' >  0 A3t.tRr\l7qAPL'8. $AqA0n W 4&8.@br\X:آ EqAE qIMqAQd @ qAMe8.f j&x̸zs\ lpQXlq NzlQp\fnِ֛@g]L q\ 7rk{ l@z-V6d <3 _Z#Aepl*Ra?f0F<&#w_5^I6~&9=*E򏄃RW*-o d %-Uc5J fwj%yYoɜuoW6Z`(QX_`6@L;0o 8Qb\f'Ɋ1P[.|?VFO~N5xc +s+ u${M)s:gRVҡ^ەeS U[w߼CMZw)B j?R6Q}dي_9@ +^FoL{H7A>IWajed[/ 04?@H+()Qst'OC'~A֟P3镚7MNh8ّڍ=ԏ BeIȦ^p4-sT@ +#aeVxGoACDžMܑ!xod@T!x pGѺ/ЪU^+斈)شӼ9Vnm @2tHh.P=6~{[gBGji,ϬbQ@ڝyZ}c3_tmy{5Ckfa4?{ܻņKc_Kg=,w6:U?n3v{Sz dɚ~17+5+v7㯍Pss_A~x|5Ѵڗh2ѽ}M}F\݆=_M9&.narv9{9i鎞/}^f +^4Qmy;UQwnWQws{~w+TUO8:.ۊ s8TmxW]qWhIO_~Tx. +6ݏ[Y5o֬3P3"ՏG&"q +q×\-Ѫ~5YA;;HS:)N{-7;RtwDv9B7.EWyG?WvӟNt{v 2W'A7Vo_ss4kWb^]7HCη}[^]xĺ;b;KjZAq ,97+ 4X]r9s& m!t_!t 7J& v7?Ea&W61нgw9F drXn[NO0mjbs8V 6xI~6g)>R8=|los6z̈́9N/Z+fRLw/9镐aӕ+XmhڴqS,hv)MuULG+Jӹ*,M'iorB>Rz].*Ebڜt)Ĉ.'FEtf7F!ɔt1cDn*͖%UYcnjJYjI:@kܨr*~>YϤ+k)xR:;~2z +?R-Rbf sUf:ki|M4`m/H.-66M}IeA])\ +E6U-P~ U=Wdw[ʭbWNU-6KL/&\I+QfZY#sZ؉޸?A͸4)mU%lH~u2?-T֙ռa^՛e4BeگbjZPq65ĞS h[m؈Ui{ExZ82/:a:^l.e:]sS$(i%=ɻɈP\6jLd[Iizߴ]q#RWl[thE[mqfc> i"}nHZtegȃP)K7cO'ZEFj)m+5Y64O. YVJ&7e͒8OQ?-m^)h^qTn񊷤d[8zw,d`d]Yγ S q35];c.?)"C}&j#V ΁C ֛ЄFns=VXI[c0Z /ۊU|([PP9d +KOKE;eENe/צG]f?Ы +endstream +endobj +603 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 602 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +604 0 obj +<< +/Filter /FlateDecode +/Length 4772 +>> +stream +x][q~_1Dz0`8A675$g:(ggU})vU\}UJHz1O/j +N_NoU+ +Gw6L!9Vc˟~u2)%o{VB A9AR +* .* JI*ADAaV` $AF)QC5Nɣѽ3z1$t:Igi%].J:-.)-lqHI:B6IaV:bb.I.+:آҒ.ɥH$t*&UNVaD|tx咨-*#,l!H:!FaVY-l1&-|-*x0&%L%C h'%01Mh$7OA4tFKD`lq%&F-6$ZbJ\`H\`AoIi/qL%qI kX.{uF ڵkI+ k-r:K\vVZ02W'K\L&F%qwMT$qwM uax8܂)#qw /q2 wA!N` V{茕Maܟ0VK\:D]t@ ):?I\%` l[1[2H\`Jѷ8=-8? ؂HQ0yЪΛ)е qA4k 0" % `t$. `H\W4E\i؂ [Di-qA4ѠD2sI4#(qA$?q(q f`JQ[@x$.MLsDl$.t3J\#l1H\l|3H\lA'qAR~0Y8tJI\t|Ӑ<ߌ$0Ozo EMI$7NH=730DD/. DoqIҁwz p&"[in@. >gQ\1P^*.(p/U ȗH2zqnJeE+Lzɰ-bh7. bżN.ѴѸ.7O E)J\ [ѭҀ+]t|؅!_)>lQ;}L)Q.sampvYGie]2|manq&6U;4ZO\yVUɸ[|n  uU*9xhè6[j>m v +M>2y:d.o!Zy͉f+:v0e%#QJ/9V w#&x`<_$d>>w;"ӓy)L+/_ FFbQUxy f?~mr=a=>]Ls=]#jO}(Yyn|=Mc͓yui[Z cw@-y@\n{0ÃC&jy.!r?b٬V{pX:3⋹Ez+^;h|G\y2ӡ`D%ERzjj9|OMesP~E٥h^?=eZۡГy `=ָi؀ɞm^͞!m9J a7 -ot0#xͭ7PBCBW^uu˵4w7zS.=n^"aN5S)c6[ȗRյ]}bp-V[I2y7|S1n]j_Ƒѫd)r_ 弖n[=vŏ!lｔwOmfI6~+2> eeC9(|Ϯ:{WBOT>|+50BLWPJ&=+}XWv{ZMno*eUQԯk>džV|jOe:<}S{Ya umv1 kVmS/;]Smlg髆 L*W{cS=yǤG,ei{FWmdjتs`& t>Ïɛ::%s.ϻJ}`⚽0d䩞Qr"p0`&~`Ua<<: [irA(ѽ妘^(Sr3)7PE/{B&?J;-l>u'p>rsh0"Ǧ+_*9SkŐ- VA6g?-4;睭0:p2ϓL=;ܧ^FsRIzsve T,/ ;Kѯ;H .!< NpOAiw (+9Xܕ@hJŠWWp`mW$hzCY/P>JV~s~WB7oNX$߼)::`KWipm|?JtzR(y[>ǺJW[ڗޘjbK]pu>AQmy-Qp +!ɯjxQa =[[z x5J + +/qcٗ9|n7N\Ny'},7D^<9l*v:ip2_OI ,N%~WQ ibtEeInҹaNV[w~n/Jspщ&n||3Yeq4.RnĄI1 W"]6 Niݤ +qn8eij"_6W,뭘^Mq7S$NiL ڪAB5Tņ=_ٚwa3}l:=tMkН{ڵMkQuj2;ՔC ]WM̦z_J9 ctDZO*|7C,QK Q~]okܘvqFb]\RUB;Qut)sfYeJ? +פ<)~-gle#rXzڡt c{!>3ԭҡyH<&FKnkb>+GF.v o qӵTžq(5c0_h-fZIռ]lv@ +]i-hm_@PA&y寗uzc4orF50[ѓ'' Ahh.ֱu ͏35{M 6 Fۡe܎jԾ{c*\uP$8iwВ2b,C[09VҚ+,5\ a_ڮfǢ,Ő!/ƂI=^?ߋɾ6joҷQnd͗~y|'n-ʲس-C1:HcVREQ4LUY+1T|V%q[)K:{5{orhɶȍpTOb(IUuWo{n!Ggs9jAJUJZ`u=8o-yJ+"ud 1*hk oPcPTslr[zNsjN^t B2TĖ7_ Jˏ2],h + +endstream +endobj +605 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 604 0 R +/Resources 4 0 R +/Annots [ 606 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +606 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 415.323057 101.433071 396.573057 ] +/BS << +/W 0 +>> +/Dest (cb92-1) +>> +endobj +607 0 obj +<< +/Filter /FlateDecode +/Length 4697 +>> +stream +x]M$>H' Inc#sϣZUj{fDziUTX,Q-}VTz!zNjVXbv0¯gVG$ ?hwϧ}rϼ>!Fg=MR1 >xP)M{crz%(`lx0c +f1APA5-UfYR TZmu0D1t$у DQH:yVK88lt [lTZYb5t)xI` 9RIyb;QtQ[SZEl ̢.BKQvHI: lÈt8e-t[?{OO pEq0pLI% a#u>V#5hqJ%#1凙0TN1_O&cz aNoA2Fj_c pJxĭX,5Xw²/C*e @9&v9"CR?W#iDS6LeOZ +K8\PP7ciޓ&er &yƨ󜝷acvqn$y~.Pz3D\3o!Vx;^] ! +2Wj!+Zߧ+ + +:te>*2zjNӗGLN^ѳpW6l mc\ۜU9nj=P=sJ↟2bk<gjs7Gi5Lw90owg܎ 7rϿPti~Ms_C _ s8nė~ދ 較L =.w]Sld?h[Aͽл| TJoAP(^]l6_ :CF<{(~o5_(rQ<ubڈk-Q]D=o*B&m!t_!v\x-7^P$ E&K^g>f-GM;m3oZ?诵Of]\@츠B:CF dvDncۖamjrEr;rJc/<ͦe_[}9_\ ȭs4dbvU!zMt7Z9Zţe>˲l^&-s8nW >J [Ur޶(|Z:w,V@>tg!vY"g Vz~ESQ1t~%"v2p{;2O 5Ԏ?:GCvOqaife29vkut?W-ۻTuKwisJ/[Vw9:7 ֋ѾV˜i?5w'J'cd>s8dndR"y2r\٫u\/WZ!xmĦ; a# ڎƷBĢL [Wpٲ_37Duw=sgV>}s7c+\*o>=;uX5wGcAND^fZ~xAnhCߩn?d,K7x>!-ntlW{or2q:GCcyu,vyn}kig=8,n9Fhۇvc~i!RjnCw9r7w`kʷԾ,Z ά _Md-:j@TE6eӻM~tې^aI [՟//\_z׌[ 'rIS02( uuuKar˕ܤ;5} 7H6 ڷӹ{6ls 6_m?=J0h^iyv<]>R"MzX}^9Rjz7J K890:\./?ľ$KdGcդ6WK` !j:W]aS6CXlmVkR.9]u +m;o /'z(MoM5Ȩ1*%CI]NSf8]!K I,7f|)j՘{RNt hrf(b<}B^NHBi[B VHMETKOYR-<RMN$"wR+wuX;mK{_0J(H.=66]}%*1낺"Npe+TmL\edN7p*v;[/\n,ORFٮV@ +U\iyZicdҌ{9}w9CD|p[&(K2_'>1:Unۙ,8wga6pCUC-k3> +endobj +609 0 obj +<< +/Filter /FlateDecode +/Length 4761 +>> +stream +x][#9~ϯJK&a%ha$39 tiၿWnߺS9 YLUϟiGiIO1|IM))Y^09|tX`3_Nou9&9ߗyL)yYEv +1UJi+B0 *'41%I3\ Cת3(E'`Uת3L$`N.*`6J:tM%ѓ$QH:k'H;-wQlqIiI`DJ1H:[JtNt]Q啖tN.E"QS1kQnrZ%鴞iEfAg`W.:2ŸO8bfmՒc:؂xآ(3hb^80Q2$vHQbD!XLr$JCgDVG^ba a:bI\` lA -lK@tK*i ,X.TX0$.\@)I\`)qb ,X:o$.]KK\`"-`h%. *H\@]L##qFudbTxDEx,.LV&H+7x8e$. !%.P&.(lJ\:c%.@a["qO`I%.p]1|.M:Džy^IBe%.p]g?aE58X%xW$.p] Nap$.6i芺4 Z2`T0HZJ\Xޓx"=h$._0Nʀ)$xWi*˦>D `/H\#M)/qO +:|Ove:B$.c=%k #-p-%.M1I\G<^tL1E]N B K1%.O.I\3$qAHSE,ES4%-p%. D[ J\MDXK%)3Į&4&$.p$.@`a-֑171&ǛA₤` <> ơSJ₤#MC`^r%.HV!D'd=ǛADEuNS-8 &IybI\x3J\7&[TpX3cF&L wbH6//yiߒcB8W ryζ-FԍԠŲFb)r^ f g&"T+E[{lIk;FUːW= 7O(T ~/рlȝp׿cO__W +gګ\ i(z_ +yIeP)å9]*rNS2Ӕz\nN\xR7oM54I,6\6t>% +chou ]y(a|e{e&ic=62\urq7~]]rr;Tvoءj{Si㥴_Wʞ˼Cĭe5fsmkWisc&۞ +i`:V8oX 6!]Cm6=&7y]K}Ŵ8lCj5}?ܞkc &>u]qi[&=V XU20\^ea1_mU7ɮQŶv্qs2o4 {NK^?w +ck־L[]4_eq9ߘAݞMWޝYy=ҕ5 ԙζΡrwWY.ڶn^fF`I\߲ACgKFZ#xvF]0HK;@=ApڭƜiظ|}(-jT=a]ce.X4bЫ +Wdy78XABc,&|/$W}(wxٮ7%8U4|g]*cHq|OS&)e Hfx)"ց9[qtGg=/*yiXS] υljl`oR6_VuMR(T4|cm<Z&ޫh׈i3{^#gޜfY Z(g-t.}ZP]Tkt{=L\&=p[¬z}9ՌRW;YeZ9-6\^VѳcOGf u?~,ϣo~YZ[wZ-kgfԍ_չ˨3y8TnCUn1h>#93!mph3A=WX(> Ǯ)Ump(߄@U.͌+$q2K?u8~3gjG؍4pݯ>99}ѻxq0~nz-f_C)>\}(_7t~3[|ub74Os| -u;W}ޤ2ݴ:vk|H;Vvs{PNm wKn^<m/'{zƟ2|7P5hYu;<.w7{0eT)1d{<v>@]׏#ζ޹ݦH<ᐸݳOa]!-6U>ZGoFr\%7uY`spCtgViwvwUh[Uy8ܑZŽ̊S~z{ר_m}ŝуy i[qn= s܃蟊G@hz<r-RD+vj|Y#DFշWoл7zHB|aDJ$aoٟ׫}<姶'7y4kn^"6_jF3?j8ũr7 Z긢\([ 'R#'P}٫G$O)WއwrX}&g4^vAfRlV~= +agqFRt5l?|>ZOU6|[!8,:L:w>șO*+>ۖ58^?^53|hEqĄ je b SZnRcjkGjk808R5ǡ BZ̭W.b>=N\f +?߄@{]jkbC}]LN_Ӛ0 rBv-}|\t-QMfR qD |jфlaY+K5 t4F*TgM)6d4/Q sDq)泠X8\ /'Gm&v!\\(CMUKX +SB +פ<)>v_Jxn6FoCRh +=]:ٱtTBz&ݖB:t $c) uMVq(TTŮAe!v6Ujy=ݵr7|š3dUx  X+bj+0Bw}:[;bԏ}I+S^uV裗BoۉοgpQ-Lօx\4A1Fi3 : |M=^SƠiG}8Mv!z92:6}/m?LX>Z9]g|'K:d Pa-d@gi +u /cU[1$ lNj`cia`'{1FM2J[XO|闗mͱh:y{0lsr-.FسnlQi](]@Mdݒ[^ +ͧҿ=QiQWiܺ5o6ȍpuldd~ݤS*u<4!{gsW)_;RwBtVc&TB[5rwW2քZ4l i_1UnNΖؤ:@ +4wuο)-P *OYvz#IPZ>H9o,O߿ޘ +endstream +endobj +610 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 609 0 R +/Resources 4 0 R +/Annots [ 611 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +611 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 609.873057 101.433071 591.123057 ] +/BS << +/W 0 +>> +/Dest (cb95-1) +>> +endobj +612 0 obj +<< +/Filter /FlateDecode +/Length 4895 +>> +stream +x]K8r{X=m6Еݵ Jkq+AR`L}UAR]o?_~)z?ꢰZ8yCן`71\.g.}L9/_S V`y?h|XAOb b۲"p9y11I`%a]vD$GF)As<gR6YEt4)Dxy +!$dYi!)YMQbU"ċ@;Y%J"v99'2x*Ŵ'UO6Î"( d gYUFY#Ɣjhw[eŘDdK`dQ1H4.I`b\6NK +'`d?Vi*]jsEdIX` dA ,Y ,Z$,[oA J ĵ)8 , %,\ 씰tݣk}0Xu)HX`i%aZ"%,:NV'+aZmd$,N ale2)) p$$,p]D^k< ynHXƙ a e(1B@+a  $D]H X\n$$n?$$:z#/ +T I1C>>"GD>hY֮*~߮+Iw(Ym[LM)o 4;X;|!($bl+jO"\[nL|!nϗߡOw܅^>ہvciw\/;}qsf2vdh:/sd› P{sB~ZWgBaݵs]f=3fq6&8uroi_VGY|d'=X dܵϓ}@mqZ+e_g몫=Z3,au^۽u_U{h{]/6^s𾮁΍ig7t^VkDz!PdZwW7lEXk0[>Og<][̮Wwg}hm;ljY + !搏\#qaYa;hVRtCpͥyݎ=k<ʶ;oz #R)`ߵ}س뀏FuJM[n5̻2,`KjU>2186mGqNU1YgQF9ѭ۷u f1i >,~ǬWY[q%U8*E :ʳɗ^q+XfXdj^6U_;s}ΒǨY&ky=,c XjY8?D% ct2Xi}WH#tzy:>`L>52[qFEԃn$druދ7{g˝Q=o43M6_PA_Gת Ny6Y~WzqŮ%Hj]'cĶR~ pq˹dCF8G쵩~lSdY'Y'<5j-jvj f/wj~W<?SK=׮>˞tz?L=S'h벶}X;V"ѳOfOy:+';"bx}xbTecבdvl>y,TUݤёwiOy6KtuG-:<'bCί{M$Y&yv*Nن:8Bnu"2pJ9ԓ}ΒvX!N,fw631(;z?Vm۫6rd`/=B\}V'eVOguNJ=]f9<,O\ԗoϟouU]``q#`6"Oy6 c͏\-h6 ^{=wp}5k| Ogwx0k<}ܫm==kv4)[4/XZ#f OO#D4:EYHMyo{zKiW4zFc\5JZk2f]fJeײEcT上Vuv6D4C_k&pm~-.aڭU/5ܫO_uòJUtjv]}lY/q#8E/eXɨ=9TO22-FLس1ظ9R}~u$mZ,\ (e7n_w,L[ְVwF}e*sX_~loHSVTvqLͭ]wM(O)l4ojGVLBax$`Qwkɰg{s;Kؗ{ma߸E C*@Cb[- :NyШ |ׇxh_ڢB pSh4/ 3:ܰzYZV͓ˆKDyzKX37? `U?4N:әP]Bo'7J&eˤbugN_Zk^NeK_|M&o+T!cvpٹɜ$qXN׆vS[cnT P_QM"o,3-f&kMdD!ӈ}@{C:ٸ*cB'6ѹ4[D nkGH/SCU"4˄ʍk˶ @]Vkrm'n2o+[Ի.J7uZB=Ml([?ɔȷVٍoN䷋Bk߱BjzhٸTNMOؚFҿ3TF%)k&Er~ڛV:NҀve16I t[릱cH5XuF&iXɉ +uo"w9}۪^ݷq;94|V\ M6.JF2~7d7c.@;rݭ QOǾ${RܜP2q?h#]P=qZ+2dR$n۶aDwN1 ]:ז!n\N]lmfmb dumÞ/m/KgWpy+WԴtpaq%a$7i'_ +Kb,KyY>tY&-;oWB?yCDmިo&Fx2Ֆ˰l>ǖnޮ6e{϶ oZQFMJ[ݴ:Jk#*SXU'QKgiW)U 4nx-Z-ܜc-[,ZҶv{Wo{ep]#SջMˇ3RS*!:tv:Zct07-EXi}JZ+wrLZ5},_*wJ :̩M%|^yeT`RЛ{53I_3> +endstream +endobj +613 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 612 0 R +/Resources 4 0 R +/Annots [ 614 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +614 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 137.823057 101.433071 119.073057 ] +/BS << +/W 0 +>> +/Dest (cb98-1) +>> +endobj +615 0 obj +<< +/Filter /FlateDecode +/Length 4764 +>> +stream +x]ێH}g5yIhVBJFBx讝^~.pUzvUS刼3O m}VBHz1OwOjNߘbv0'V lBr& umӟ~v<>!%o;#!JP)msCyASLIR R`$ c0RvJ0M +f䂠 +vh!A^=Lu:vӒ. {%t8M$l!zDl11XI`A$Aa ElQ^iIR$u :C\r*IM+0I>:[rIgt$x0Z ntHtDA&!LE  +J4`ȧ U:%" +8X [#WHk` H\`-l1d%.`[Z$.[RIK\`paqm$qJI εN ,H=H\`y#qZ^ ޵޵9El%.;VG+qwVAb Ыp%.V&*&` +uax84swSF2^e(B3V6%8N1 tL^'ҠZ\hA{$.p]LTV}F fT#qjZҁwIJޅ$. @oVKJ1J\%#qfAE0 %. +~=I\Y+q*#`F5a +c BҁwFK:R!I\ҐB'c'qAP8P-H8C)J\ lH\ l q0&+rb';W _ V]?۹|LIץ|Dnvf! M]}I2O.l3˜]+OP&7sb8s[w"(Ke 2Zg֌7@MW!ס2;'|O^[f׸y>(s ^M*F4alV1>n8 >2{|ccy)XM^Mh ))l;RZX#0^{gƊ/ʧy^jq䎌%e!kcr s/]К +G9qRѰz Fzm~"˨12r2ZnYZ(C*WFS=uIu\_3#} |-ϬaiڝyZ{c3_[s^!7ld9fX4O^o9xنKc_Kg=|3"WV39%_i +_y>-s8E⽌gk}y.cf^ L4LdžucIyL[:2䣚kk}aUSlɑw\^n>W\WުGgGf +^d\P*]٤.FD5~[>petgáwcW\iXሢK97ݳ#sD!@ng!tÿRzDl^| +C?b!Ҏrǂ̕|N㍶; ~#6zZ ߢgD-= УmqX@qg!vß=|n{W+(nnGP/P޸KuO}=W+mb!Rs8nD]RyZlrgWٟwϵ?Ea&W61н{w9FrDn[@\5Jېs8V 6hݭMG)mv_6nW >J[m Q,mXCw9ݩ\"IR\w=鵧4XcA_ٵvb6jFTa]V8v|WS 6lmL3xF>HJ_ ={rǧtumnM'm,mXi|gisxN믟XN^T.̒᪟了{hzw9amߟ=I8h<{xҙ_7׹ذs|%M\L;N4pȿObL`$ KbN?U)tNXd )3Aן.gUʉkł9^ՠ'1X2v:M[ 7ڪFBTWņ=_DTWa1m:tNkBӝUrQu*2唥C *M̢oz_ +t $*RN'.'1T+=JXՔ +uK &i76cDs.UlpcQUzrAH*W( +mSnGUR C3**\2?m:JxlZ/CR h +5m\:ٶtTBz&ݒL4Y#)$Uc.uEۧpe+TTWŮ@u&v2T\ ])}VJk~U`> /Fs%UlTjeRJ8N2iƽq9cIW6^>i':6#:Unۙ_wYXM#4~XӺ25{N ma#6Fۦe k|j zhɡoV=ƪuJ>7E∓)]󓼛8h aSad@g +u5NmY6E.mڂI=OdGK k+-'BxԎ~~X{> +endobj +617 0 obj +<< +/Filter /FlateDecode +/Length 4749 +>> +stream +x][,q~_ςMB!k6k0Ü 3+X_d孲gGC{}9Ȉ/"/U?(1始I%V~*ip*?_.o]W먫)yo?b1Ta9'B3,n1%1\nYbǂVȰ"06(e% bRr(-%˃ ZrCi%|L: +#|)Eg!KRq<YVrr\ i!\ +yTc"ö_1d4OI4y@))C#<\ +V@%&=ʘ)1vUw_."ŲN.)G_~~yot(|ڸ|:W>2@5+N +0+m~gв?`J\ltYduݗ}A0-xt2Nzh5O/^~emyVUh\c3Ni׌4u8R7<z~ïc~W_lښ<<5h2o2Ѵ[[L9ζ5N&8CHPr,ldg3NU?`+;W}m*;@3ݟlqjSe)U^طsu2.nY@%hyD :0fmiDڨ|`gzPy& ho<'H c-XA|7#3=Y,t?7;ӊcZY\ah2X:fz?mr0&a9Ofg :R{?*zojZ7e>6:Ogui[Z1;XqiNu Y+ǂ9u.nśܿ_:`rm)af6zuTY:OgGfja|sEz.W}l5#qW8eՓZs2|`vu'=d ~2uyK);)ߏ)ؒwa~󵗯q]w6v%Ϯ̬;IKtW7ܾ׺7~s"k +? V=ke6^_[Z"3Ni_˧- }ߗm׺o{.~Zt߸pARiE>}utdd'.6}=A+7 F2!alخ6mǍˇe68$,8UCA_ڑ:MZoxyX:Ogqc5f[V:-코"ŞM?0n[tæ.ֳNnvvy~γY[>>²T/vޱfs_?yyL3Oy:3?zl?-?c=gN b_aw +{x'<獟ޝ2n>l2.ZɹiYb+#G3͜!ܱW*ZWƇu͂OFj2A -k^/iz>,rֺ(}UM/YIzMW @obw|yn>NXt]Y c*{9>B8;[^n9hS^>h#<I#i3l?]|~#o> +Wo +JoXUIeŪ띚e?R^J[^>\?|/Xfr.jːd"eU-h7Ei.ikj5VwYY c^mtRB}Gaʕo}#X7+mr讓(z?dS&:5 -K[ 53[kSUZ6Jj6 C]76m1?q!jHKC]r5F*RWMU]n&63B  ~]ikkevlN~v+7n#GSU,7f +ר<ͤmwBk%tPrP6TfG}(t؊:lT#j&fuLVӰr$*dLmErtݵv;7|ɡW6y[W-6;clѮw6`N0[:d\Ľ]raNl7ޤ=fY?(-~bX_ݸq-Z膭+.ēd; f j;~'˺j -k=eZR5U;]@t2f6i%2?wlz^.MBzg +2v!:4+*C:Vq16ˡ%[I9vTOq( 5\ i]γ=̎MWZR`3^ [5vV0B۽~}6hoԷn xɗ~}bv {%95zjaWثnVڪ(\&+LTjwY-St_FMqT8*~SڭeK%@n4N- ͏Ҷ}u5^۰]3S٫Mw{|g3:pO^ Qڪ`JF!AqXyZvE=a85FE t${K)Y +0'7+AOu .#)# ti>Z>? m85 +endstream +endobj +618 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 617 0 R +/Resources 4 0 R +/Annots [ 619 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +619 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 370.323057 101.433071 351.573057 ] +/BS << +/W 0 +>> +/Dest (cb101-1) +>> +endobj +620 0 obj +<< +/Filter /FlateDecode +/Length 4725 +>> +stream +x]ێ}gIV~0$1N m`C~?j"RZ{ӪDKTS~>/B釓U7]Y+{> >Z6o3ϣfm?~TL++"TJvX'p1J*a=^<lLTf{MKUkT0CGVCD QdC;IgB4Qy7hpՒ.9$tXͬ$la +^9B-&xtNt]A唖tЩRgl RN$0I :[QKH:-ICFIiIga1ElAK `lQI4$^8x?p4, 4p q`I.zHi茖l$& [#W,q؂$qmh@@0SI\@`\ +%. P.%. p.;%. .d@I\@]b$.`.r:K\vHFF: $.` %.`D0I[fnH\]I\ %z]P=t$.@a["qO`A$.]}.ڣŅqVsQ DEX.3H\0 ,xWfjI&* ,x~p4 0 Z.* q$d<(8.(q*K$q*#` #q0l1 guPL!J%xW)%.p4mJ\| q  \!z$.pQAOԹV ,Q[سpH1H\ l!c$.e5oqy[q}`!Df uXU%3CkQ^yT%.Zj.I\3,qCELEC0%-p%. [ J\L*) 0Cc-t:3H\ U+M0- ?im%.M,sDl!`r3H\l1H\l *O₨ܐd @)%qAM`\f zK!*8x̙ ﾬ9j2ZIv|)?˜_a5n@>N̉0<8ݒҿrX=#fki +Xߙ VXauHC$vW*% @@ec>K,O=S_L~9I>\%]cx*{{.S|\uaބLj6kXjne*g̃4[=}o!3l_7p7uW+(9^﹏Ύzjg2m v\Sߋy(Mn!*⑞%qS_A5zcxnj_áw;w4_uetV+C-Ts8TmV4 4oIήejrPݮдc~^ƨ9۹pӵB97 wޫKjoȕ{-$Vj?9oaWHqCm:|}EtEWAAGASYFO؉{ҡ`ik!z6s҆ۨ3ߕ%֬3Pgnj=P{ ?pu͐guթFVP@lugávyKo1&fџ~e>˲l^u:磋[ݗp݈>|xzWq.iY<fs4۾gI"[uyO+34O!Nٮ0O7>g)Mڡ_cB͈j1Wɻ⧣;}ߝ3/؍{Dz )|#W]sAg^nE/m67Fyn] 'iɏq}TjXg;a sYR.<n]W"{'^qygL#cwv97踰Oc ̐Bv+3ᐻcw\+U-fт'ouf-Hj:)[44pTsB$ tc.*QEFQHmNY:K? I~rь,9YWa@.trMS +5k-_MPP^m4I}:<#ǹإ}B^NHBj[B VHMETKOYNJ_ibtRXYFj宰K-״Msi fA ԥfҦټDR1uǍ*la +Lμ; ,,ænhuimFCǍikvU=ԅAuѶB[۰]i{CxZ82/:a_/)tZ +2T)Nвi2-MZ6334}ۮTWsѸ钪4e]4IS{̺4~xx']IZH[i$-'Kit29][[EأԡQ] ]mfضRβYy(tʲR6)[nJU]Ҷ҈H3^8@wjKAE5%eٲnםgss\ q3U5]|;<]AJHILԬ=:!ynJ+ikBw LVLx"n+3:lQt_Jsj *>-mkV!ʽbh(% +endstream +endobj +621 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 620 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +622 0 obj +<< +/Filter /FlateDecode +/Length 4732 +>> +stream +x]ێ$q}g%x} H^6@ ?tNKz fKF5^a02 +?iIO1zEM))VY#~jEar:?)$g^p'WYW3v׿f)T *rn +8/Ĕ$p ݫ̠dLTfX +ޫ0A: (%`"Fi7yttFO>&D]N#鬝| KEIG%%-N)I[ ):?I\%` l[1[2H\`J޷=-? OQ0yЫΛ)е qA4a)`/5ELz @K 4I\lTK ơSJ₤#$.f Y&x¼M~3H\8(iJ¼'a vtD$y%.&D53nd´ xuђٍds| /{yU [򼱶\%7jvp /@l! |O6"f-.A76K1tdX6k83e[^y>V:׋(y:t%Bx%س>{@őeT8 맟/ݧ܏ 0˲^)'ΟthrHKqKK0ȗtȞe.iLe$JZ>Ph~O?w[ #\Qϋp?6}Z>s>ՕwyJ C1ru{Na u- KJ:V!-xxXnzy:?ݗ-{p9JxWNcKY~,vҞңKoKhG"0PvziΟQ$O/yb[Jl] W_Bb.CSm}lņҞ,[}϶%OO9}ֺZ^21ޢ9z, }4UǡOg[3 +xi\vJ|b/'͂bo%߉1qeN6^Wn쫌elV&R9[~U.+r-w;i?n3}neo29¬w77˞DboS}mOpRꪤh2"Ry4]<ڃԍ՟;|- +#Ze@:/uc掂%eCvZy8]^WSeu;#g!}dUhyoײbәi=ԩFt n{_Fg&jSKJnr0P{.ϣ֫}-|a^yέG5i@V[d}ZVSFp+#{ףgofә)7?~2ám|-Jraޡ}+:u:W T +y4}C ܪo̸CrOw} (~A㸒ޓZs/y4;!ͯJ>'9 + 4opFs<9x=B˼{w|-8OTi~p.yk>jr͑ioLrbK|9r͞;?!EN\ׁg1Mcg\ 5g11^خenݒ5^<{OY-ϗ/*v-=q2á +O7jwsG~wo; T5O<.!; p:8]|x_'mg#m}c >hi$pHX'ӌv>woF/帅m@pEtgs) u~FU\GC]:8ۋQޣkoVwNŻ&2z;p=x*n4'u{V}GdC9D(&:/yՆ; m>Vdnyٶ^=<ރGwji]|o .ݓІouyuk@;b'<b:ph`k-X?.Gw#ۼN=Lr"3W=~WE6^ %HQ=eyДi]u5pϭ5+4k^ܗq>9?oJz-nٳ: +!vM_.>I>ihHW>R.*K 9TaW0K_|Lkjfcє&~$ዚb.U-tIXe7oҘҺI-S-_ ?WZ]*l>kX"bn"d+_MןH}V`x(VuBw/T]uMlأu }nKZ.֎WQGJUe3*U+)P'AtT)0Uߍ8 ctDn)Ց +5UlYSfJ:-}HB7G-b>n̝vqTgb^\RBە[Q54i05gpU̓?h/Uf;:$vݥCKG%gҭk]uyLRǴ[0_(fRIUWVY'lkZى|lLZqo^2g3|,}?_9:nTe Su%W2xR_PutBC7-+h1_Sˮ2^ZvbSkzoC/VGKǦ-m'p7l[]mIL}*LͲ Ⱦl?Cas#6e/r+$pmL4~q_LeR{0V“6_e]sl>LC,=[65kA4lKWJE,. SEVK &d+ݒ[^ +էhҿ=QQwiܲUoVpudd]R"u5!yesw);R#!:PeX*z!>@ 9~>"Rb%}MUAך&^¼+WْBA{mrl3e"e7o|KI"J +endstream +endobj +623 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 622 0 R +/Resources 4 0 R +/Annots [ 624 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +624 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 594.873057 101.433071 576.123057 ] +/BS << +/W 0 +>> +/Dest (cb104-1) +>> +endobj +625 0 obj +<< +/Filter /FlateDecode +/Length 4958 +>> +stream +x]K$9ׯ3&~_ -q^Ϯ錬̪iF2#,}Vc +ΗNߟŸbqQ_pg(LN'La +əo'7\o?e}6SJhw";r+XM!Ă.5+@ JI,AD!횕 $F)A5OC^=Ly<ijv/M{%Ax8M$d!zDd11X vEdQ^iR$y <C\r*`VDa|xxȃ,*#,d!x gCi5t[esŘ@"`%0% 2.I`B(@D;Q(i&| +X3Z #/!ՐprEd$,BCV %XpK*i ,X.TX $,\Rs-S qXuHX`w-i%awEOY`'V awq v%,L&F%awMT$awM yap8,A]㔑2 w!N V{MaܟpVKX:bD^tƅs -O$aQY p%,OFZwIJE$,9LoV0]&bwKFxIE  IKX0P S%,IG䛆$,f Y|)pn9 $,!ȃ,pnI7NCH‚}73o"K1A,w]2I<."S/a.o"r{ǔ9b@z|X2P^x 7Hbb"^X6P_c„k-6K2vw[e¾\[^kO8\]W;ըsהvxϳ"͛@, FK X0epE6nZm5KZ}By: X9xXjxeպnVCf؝?vzp׹uE{bTa=tzYte,zZ{hyZy:k=ӂ/lz*m'LZP8|Cijy65cGBP`xw泲Cpy]=kܱ]T7*ZŲHm됟#fvl>iyx,TEd|HE;tS}S.o}"14kXE2zqi8Yd:2 +u9ԁȀx5[%<%kCX0nd7 ϗuf2b^vt?V۪6g ֽ^zx`1gĭSOgc-bt4KwU_;Yg/faĕ<5<-l2kkJuŌ'tx`Cݭ O#ç~r{lhm~MGnzYN=&>q滏[w͢GsW,-b#CW W_3OGOQҲ6 ǃcoWOI2=Z-Of-^yWa6q1M}R0h򺬆iJ2ZbZsu'f]m~Y~IzeXPu=U7/([~YWd|.Vc}-|uQer]m}z$UՓ/2 6UƲ|9dfC~Cq$1Y.k[[.c=BC,(gC  sU+l_#*뾩˸ҥDJ<cT"[f1uw`O\=S*^7#v +aimT^u6LNLN'=|u>mƿ67iغ sOJ-$VvlNֱu75{mDuȦіi ^-@s;xc{Te<] ܴtpɰMd 1AIķ #)Ub(\*L~VRVE-St߸ߕDwůqkђmTob(<ݨ[J[M˹=ePTnn!{\ UU[*!:/&+iUB[EVZɺ"Rk%|&lD֪ "lr%ݧaN*A% .CNxAiV|.,'9e +endstream +endobj +626 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 625 0 R +/Resources 4 0 R +/Annots [ 627 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +627 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 119.073057 101.433071 100.323057 ] +/BS << +/W 0 +>> +/Dest (cb107-1) +>> +endobj +628 0 obj +<< +/Filter /FlateDecode +/Length 4752 +>> +stream +x]ێ}gy I $$L`6:ċRK3kvyxX,](_JBޙI +K)fI>ޞ0~2`IUޝO;l??<R=཰*B%fT+N1FN37,Uf,FKTE4 +fh=vH%!C;NBTyWNy#tqp lQHNgaN[9آ5Eu"  +'$z1"t")aNaDgt +8a#-V 4l1t }hU4ВYآ79P8 +8P&*Ñ +z0T^s4-$tJrDlqL%l1h8. + Ze4lk 4ֈ(9.[#@pa@qup "h.@uu &8 4xW)8.0]es\`F: A 8.0]w19.0]eq + UV( xW8.P`.(lr\:9.@a[qʈ`A8.]}.ңřqVs D9.]g?`FUXԘ9xW(8.] ap8.6H貺8 ZR`D:?H r\#+80p{XlAq\: [fLYSp:aNG xM ' +^3D. +:7r\`8C1p\lJq\lq0)BJm_a%N_;,0e0어T( ld;w^Y +CW+qzM$4{3:CWh6,N+8itTDp~% ib ԖCm6ďQw?Z1~K y/w-Y?7,6.Eo$zٮNbÿ=]TnjGK1*,_mm,&Q:}۱ui`MJ +l Z2hwy  +R +s[}I~C'>I8}#UԤϟ7o;adDŽ?3a~p|q)Kqɦ^p4-sT@JiAN=roNۣ:T>wdD.[!+Աk9h,8ɼ}yV%Zi6DL?^C 9toܤ@VAdJ!dO] ;T:E _֙ЪZVgh, @L3ü[ɽ[l4垽t ksmprgaψ\A[v;m}7@36zLk}_չ9㯠?sgáyjGm63!:Z9Zy Zo܂_%yZBlu;WйVL׭ѹ@rNmw 7g43yY=9l\i&aկtow97^FwF#5pwpƾ6L֕"v4cZ4ɖcsq:ݔC׵dۥZ2G;y^NtGҕϙ}^f +^4qBs8n]tRH͋]aGLGwGG9cAJN㍶; n#6zXE]ψZ{`ΡGy۾-WEa&W61нs4$ vܶLρ0mjb#cݙpc-=ޭ4(mhg??OawVw9j7$J ++hiy}<>˲swg*6~6j9jF|ݫջ6pO_pG,H-]sSUQ4+pnڵx{WPw@< {v9Abr5.eu\sqy% wze4:2ixL&vhP!fF,W{^R8h_dnS}Y5u8+*z{7vz2z-qjjY[gSӹcKH6j3wi1=K8)?w*'ds.Ē~ʷSݍ=fzw9amN.m!M…A*@>ϴUH_nay%gSI5m)h,3eA9J$iډ$f{644`ISL(eDo}Jm1pzS|6lф9N[-3Btr)Ĵ)dt)e!6m-fK-] +ES]+푴Pi:Wd9Mw^^NVgVJ[r*Qd1*)KOrb_\Ag}k( H9#tSi/BsWS*u( RMRO6cDs.vEhpɚ2d=V6C"Jfv(HHy@ڣZ "7R+wu i.}l^2&=nI]Zl&m#*1˂"& +Slb[<W;m{[Ůps+%OU-6KL/&\I+QfZY#sZ؉? fS收*Ӓ[l,y|ϿOǼ8+QBnۙ6 ;ŴYoaiheimFCǕj{N) ʢma#VJekȼo=|rFP*PuNHQ:Kzwm8l*ղȶdiBS]AFС:Sٶ,Kg$ ۃ`#J軇׋}2@BEJˉ/˜tomRnƞ.NNյ04lSVjlVi( +]@&Mnʖ%q`[Jh[ڶRѶi<oIȶpDMY|\HMMlYםgssg*j6Hy3v<]ԁKR$D#&j#V ΁C SMhB#7+YFDr 1ۊ PmES - +nk&TiN,"AiLrihcUV@*{o6' +endstream +endobj +629 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 628 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +630 0 obj +<< +/Filter /FlateDecode +/Length 4795 +>> +stream +x][,7~_1H1_$$D8ÞI6 |5ݽjLWR.*_ګ?)1I)V%~*ip*__.oz\?yUVe1VK*ð!hWMLcA [V6EDZ :21 lY b,ǂ*JK hPxZ N,/xr%wYTAXx#Yd1 vËYd^*p)Zx2i鄋HpM0I>0< YtAgxXp<3!FfjFd:XYhYd` %t&m9mP@$l>TiY!QbZB$C H A,E2)rX4d1ZsX4dAa"ovzY`.BDDLrX| Zx^,/!XW8,\JD z % xrXdPHDȜ)Ȃ D)aAԐ QG2sIYIaA^Pa f@JYh8,MLsXd1rXf FȢIaAIzAa2q `\|3rX|S3jd°ۜ'3w-c'87<,!0 tBw;D +7&Y4HTmH], ,l$nd$,rc&iItؓKcFKvY_P䀘 ]u4;(y_Hk!^^ȃ^$z1gclwڴrRPGx_#"Hc& +XGU_~L:}{GL~׿_a/§˧s. +oJTjNt! CRf}F^-w: D̕<&SuM= IoqG۠IvC_?|qՇqYU1N>sY~=fҮkw ] o2;_yǜv4^~\iksLffFyyʚd!7UDtL݇]iҎS14U!6Oy4Ĭ:O~+PWֽApUܦ3s4S,xfkè[j>XHۛRe}<,^RgL[^ =mVL:Z/#` +_ϼق{PjVYZ4طsy΂؟߱X6N|!2=,t?6;ӊӵOf`=ĢCOy4 kYt5 y2;[`՞^{P0ֺImڼ7Oy8ۏMʍX\ǐ5={,kKVZk9_MǖfvppiWGݑEpkgolVV?bZ8r[0co+Oy8kvt\w҆tdߤ`%v,=qj,.iZ#;аM )uaN#tnL 5( Vm/`؞)8k#~. ~Jr1=v<gw1fCWm/c-'ZʹӖEʆEk]Nq>_)^wҊ|NyKg9c)MVn`-e1!՝ל 6w-cGu(H2jz_l<gfۇO#ioܞ#{ /O)^e~韏1n}Tǿco3Oy4Lq{R<'OykM=fN <,x?}U{ހ<ƕܲtM;yvT At5CͪQt^rUU5}IxEfS;A_:+Ų/MFe#(#r)GE1u;&_>4qA$m_|M?Bi ; JEiݤbN|-Ui]tr P;JV|+C'\Vlː-'D,_e+˪n Ҝ8! +-v5lt[5u-3DjKK +n”'D# c^`xHVFD%ʡNֶʣ&ʦ:߉MQujV; 53}Ƶ]- BFu5e!. 3Yzn\mRMǐn6])͵ +-UYS|M -PaHSt vqN~v+7Pn#GSҗfѝzQ yeIѽWBcJ龡4liu͎B|'mVAe=*T5Y5kd#QV!P]'f/+rӵJ' ѫ]+}ΗZ+loٱٙLk%ev(trїLS|탌˷qGz1R ^W/\ -tydI2ŇJlf j;~'Ӻj ͏k=eR5U;]@t2f6i2?o^MkE^J9xgKE≒vCF> +endobj +632 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 385.323057 101.433071 366.573057 ] +/BS << +/W 0 +>> +/Dest (cb110-1) +>> +endobj +633 0 obj +<< +/Filter /FlateDecode +/Length 4698 +>> +stream +x]M$>H' Inc#sϣZUj{fDziUTX,Q-}VTz!zNjVXbv0¯gVG$ ?hwϧ}rϼ>!Fg=MR1 >xP)M{crz%(`lx0c +f1APA5-UfYR TZmu0D1t$у DQH:yVK88lt [lTZYb5t)xI` 9RIyb;QtQ[SZEl ̢.BKQvHI: lÈt8e-t[?{OO pEq0pLI% a#u>V#5hqJ%#1凙0TN1_O&cz aNoA2Fj_c pJxĭX,5Xw²/C*e @9&v9"CR?W#iDS6LeOZ +K8\PP7ciޓ&er &yƨ󜝷acvqn$y~.Pz3D\3o!Vx;^] ! +2Wj!+Zߧ+ + +:te>*2zjNӗGLN^ѳpW6l mc\ۜU9nj=P=sJ↟2bk<gjs7Gi5Lw90owg܎ 7rϿPti~Ms_C _ s8nė~ދ 較L =.w]Sld?h[Aͽл| TJoAP(^]l6_ :CF<{(~o5_(rQ<ubڈk-Q]D=o*B&m!t_!v\x-7^P$ E&K^g>f-GM;m3oZ?诵Of]\@츠B:CF dvDncۖamjrEr;rJc/<ͦe_[}9_\ ȭs4dbvU!zMt7Z9Zţe>˲l^&-s8nW >J [Ur޶(|Z:w,V@>tg!vY"g Vz~ESQ1t~%"v2p{;2O 5Ԏ?:GCvOqaife29vkut?W-ۻTuKwisJ/[Vw9:7 ֋ѾV˜i?5w'J'cd>s8dndR"y2r\٫u\/WZ!xmĦ; a# ڎƷBĢL [Wpٲ_37Duw=sgV>}s7c+\*o>=;uX5wGcAND^fZ~xAnhCߩn?d,K7x>!-ntlW{or2q:GCcyu,vyn}kig=8,n9Fhۇvc~i!RjnCw9r7w`kʷԾ,Z ά _Md-:j@TE6eӻM~tې^aI [՟//\_z׌[ 'rIS02( uuuKar˕ܤ;5} 7H6 ڷӹ{6ls 6_m?=J0h^iyv<]>R"MzX}^9Rjz7J K890:\./?ľ$KdGcդ6WK` !j:W]aS6CXlmVkR.9]u +m;o /'z(MoM5Ȩ1*%CI]NSf8]!K I,7f|)j՘{RNt hrf(b<}B^NHBi[B VHMETKOYR-<RMN$"wR+wuX;mK{_0J(H.=66]}%*1낺"Npe+TmL\edN7p*v;[/\n,ORFٮV@ +U\iyZicdҌ{9}w9CD|p[&(K2_'>1:Unۙ,8wga6pCUC-k3> +endobj +635 0 obj +<< +/Filter /FlateDecode +/Length 4733 +>> +stream +x]ێ8r}ϯFK,a1v CuN.~%^DEJro ٙ%<< RJ*}_$=Ř/5/X]dxwՊt]f SH}Ovo.ΣfJ*S!('TJ[Aq^Py=)I*ڪ̠dLTfX +nU fIR \TZmu0DY#贛<%ѓ$QH:k'H;-wQlqIiI`DJ1H:[Jtx' [(`JKd'"KЩVg\VI:'lZQNAK8'Άjxt[esŘ@%0% +$0!L I$`(RX4QVD>-UőjBDX[@ka!+q"qݒJZ % 3k' ,(PJXpwJ\`AA ֵ ,hRX%$. )` ,qq:Z k +xH\^C/q25Q5S Ơơ 5N kx h +qr8[@`X PdH\:a4j1y xWGtK0nI{$.p]LTV}F fT#qjZҁwIJE$.&@oVKJ1J\%#qfIE0 %.O +q=I\Y+q*B#`F5a +c BҁwFK:R!I\ҔBC'k'qAP8P-HS)J\ lH\ lA q")iD.` "E dSLDW%7S kQAhT%.Zj'$.i $؂"q)DN ҅Nk -%.&b%)^gF "CE 0LS:Ëm'q?Xlb#`u$qAQaQF`כA₤` "> ơSJ₤#֛$.f Y&x¸Mz3H\8( hJ¸'a vtD$y%.@&"zqK z3]LK\ 7Jk{u񙬌⎁:̭▁b +➁I4XYF/`ZR+q@цݧ~sf ȄaA뚣%wc/|oNY% k^"JoՔ#0lB-HeT 맟/ݧ˿܏ 0b`eiqE}Ƌta/="?nK> fNy-4_s: +Ů\o)-^?~8]T疢~Bu܄ŅEWõKsܔŽ +6ž!Oq}{7hb9h~]@^2Or)m~m_v]ءJ{omm]Z'aܾF.E5fKPJj~UZvxƶiܩ?Y_g;-uI=0h0>\e֕zb[|hG1OGV 0M'͂2BK7K$_q2fNe>;{u;]?ٍ|y~::O#R3SWYqE^Mi_nWvyew?e|en[9vP8o>6]cooXR@< +}l2N6^caRT4kX-ήںj/V^!Q9ZuŕEg|vWJ;TX2K=ehlZA(ѽo^x/s)9;Oc OK :f"^u`ϒw&doV| +AnQn7p5y,bM^حRWMAu%mɷ{X*#%[z5 5 yqz駳}Qt0 #ttnЧ2iip[.y_fez!Zziy\ulPuPъ4Q Vw)P)PM(Oy:LǸ x>,q-,[BʼPۦ7KX˫VTz)HGw2ϓ =Azg`z(NYI~|Y-ee&"l[!k?ϳDͷ=:S9 +8% E* +P΀ԼkYL]RP]T#~[sކG]RKJnr0P{.ӡsl 3x9Ռe˫ye_԰IӕQ񈼃ǝOy:~ߔ>YVڷ⯃QǾ~pƿwę'<*~H[HLX xF.ZOy:ę+˭DW)> +y:Ǎ^}+ݰFF:龴^@Y<L^W{/jͩEW9BWj +>#tޏEᩭ~nw<<~ WayW˸S@aZqXۗ;nii_:9Z_l);n޹ȝv +nY|t:]_=~EQ}|unZf-3GwD9'<|=wuAUe)dC._wqؽ0EJi貣}y U 7%*wl~ =x2ct'<GV?wkn4%^ݿGߛ (8@8b(lҐ`G*vqFYdCq~vdNanQnQ-ov;];}ǝѓyO ;M)_!usS'ѿOwޝlM尻-RE;vl^c8b'B':jwOkwn!:'g  qҖ=_~t_=P69u[/h5'Xk[@!S*|ip{U9W"M_oj' -5囇 ܔ6H9WxJo9?`U~9ҡguCRt_.>=ʃ O4ͣ|aTt&wrS>n/&O5Pnє&~$&sR壪e.  SSZ7cW(ƕp~WayJ"+V̭W^|}r)|@O +lڪNBUĆ=BMXM]/iMsOxZ;JD)]*5lgTRWROvߩR435>t$RI'n1R=jزfJ,hn([>|Uk;ܘvqTGb]\RBە[Q54)GM' "#*\2*Xv*Yk'r_Y$h +-m.Bl/I[I;uyLRA&͸˟.y3>;[GQ^y7ܺ3H<)):l:Xǖ4yܘeWKJ]TWm/t͇Tm;ϸmb doڄ=_v|m +}spζ)+Nڦthtqˮ,[ɀ+g +uu]M}E[%Al`}ie`Wb/#ګֆ,ү/c1Be6ղl7l rh.zvز- \_)٪2QTLY-1%8^ +5h?v}T'W&-[f-ΡN5ZJ[dۺi]wm]3[dZ6I.{.Rc;5`?ԦlwD^I_c"kU{ oPcEWT9>9[Rbshns̴ο'P TXFe|4*v֌ +endstream +endobj +636 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 635 0 R +/Resources 4 0 R +/Annots [ 637 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +637 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 609.873057 101.433071 591.123057 ] +/BS << +/W 0 +>> +/Dest (cb113-1) +>> +endobj +638 0 obj +<< +/Filter /FlateDecode +/Length 4965 +>> +stream +x]M8r%{X=m݀a{څc`}?R"B)evwR!% +?ibL/5X]  Gw9(L!9 ?:jϙei +1VKiXM!Ă.Xc1lNbA kLXb 1LVbA \XZAmyDYKFi7y(K<'I"/xDV;-wQYAUXAyBȃ,&xh' Y`]QA啖x&"/b[QnrHI<'$IAK"8RFdx G!FaIxȃ,| ,*x K&@DlQBdC Lr)H8@Jg ^BҐb@)&k%,#V%7S kA‚섭XKXXjX.IX1V‚ ؊hK< YdKXO<%, (+ C#%U9ΌD*JXeHH) `BO~l"y F(aA(#al3ǛA‚ <> Sv%,IGěJXu(aA"x!no ,.ȃ,pnI7NCoF f ބG/b7.dx]x^\ ބg+ +3sŌ:b@{[1g9Feb*Zi?f70gx wb^v^ߔLYpJi +$L1|Bл*:Y$ݲJrEGmE>携$*Ò15:-JB>hYڮ,qז(>JZjSrܯ L$` V@cPxȉcDyk|OgJs3aލiթMƚajhiS.}W-%V}]jX{UΥRtUe:מ;#t<֓u^h޵F0-EX+ǭ\V{c;۞im1[~s~Wioo[a;V˜Q#ӑ՞rV{q}),3Lk |i6Z}N* 2;Ȝn[ع:/ga}φ>4Cgz gкpԼݕai-n.QXX(C~o;c2W"sV]oPSu^͂}?Y^:63KpY +,,ug,3V(ͰJ<ZVl%׆oL*%X|Y}m{րύaYzJDFd{Iۺ+m=꼜Mx~lQ#nn3#cyϣެQ.wnF?#t+*:KQ8e Ny9= +w-DT<6uƷOc?JJD9Dzq^O5[8dNy5k9aZRQN.C7ꛛCgr}Z:/g}{UC;_sGzޱb扞/{Y}eIƇ63U~'U,g_|Y?ĕ5FJ&mw''뼜%i'+pksy :?"6̏ǻ7aPq6qdwcl96#L=Y,kiO,F; 621(:zeJ³rD`oCq<\W6I Y:/g YVP9u"Gً=qg;/zYA&"yZH[!zڂ?z:{uYA.hOǑVyq'|ӓu^BA~W5'>r4QXR[ϳk[>/Ա}F8duёX-YMSgk!lLi|e W[9bE1Oi2ji<^cev1\uVC4+mv3(a֜7kV8^6_&;)D(0@0xη}/5y7E*#C,.A:rzg٪7 +EՑ +{q&R:ޞ'B} 6 ݌޲7f_nLYҜWI 8zs2[d50Vgx]^Nڈ1_3Z9C| { Ia{6Yaʓuqܵdm,Ȯ١|ϿݸsvIEO { c-NUykDek6;0L,КϠqX`ۃ+_yݣC%&p,!~vm@'/۝γfκZg7{=5A%x+#7*N.םU0RaT>0><:],)E';(orPM/&+!9eu+4y#[gWGZ-jU-Dѹc^oyj 9 r(WA Z^7+F҉nKTN6ʓOЬSs\uM-SH"R;jSUF51RZMm$nM[LfY'YX ɶrHXni͵ +TUS|:ŦxVtPC~[#MN6*21l[PuP'kҩQfs3TFS>hL*ݯz'ym6ZIXIچ^KlKG%ϠJ7LeR/T5Y7k aU? +9QU!]'f_V.kKթ֙]k}/ڌ|0{loec#9~tQm1b Fr] )RǾȤvls>'3½,}/~׿[8|ڿiغ",*$TUb[6h,Nֱu>n k۫쵤n]!#f95o#s7 CH*.pp;|eM*[:ְud+1ANOs#%u,o(X/xVNJA觗W"+ S7Nmx2ʥ__=.ޮGKvumQcpS[iNF4UiPeK2(j)4S54%:>+~S6[w-Qs7GzKFyF$UڶoW6 3U۔| +Y;s! ?%c6j*oT{`/h +6uJ+=a:&KiEF:f;\jICzLB*ÜdʋC8%!.C{9);1N,(-?o0^2s$ +endstream +endobj +639 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 638 0 R +/Resources 4 0 R +/Annots [ 640 0 R 641 0 R 642 0 R 643 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +640 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 167.823057 101.433071 149.073057 ] +/BS << +/W 0 +>> +/Dest (cb116-1) +>> +endobj +641 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 148.876036 99.933071 130.126036 ] +/BS << +/W 0 +>> +/Dest (cb116-2) +>> +endobj +642 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 129.929014 99.933071 111.179014 ] +/BS << +/W 0 +>> +/Dest (cb116-3) +>> +endobj +643 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 92.034971 99.933071 73.284971 ] +/BS << +/W 0 +>> +/Dest (cb116-4) +>> +endobj +644 0 obj +<< +/Filter /FlateDecode +/Length 4546 +>> +stream +x\K$I ׯ3aKZ +Z S̀P/ȌGV+{zӕv<lɹN֤`\TwM,'\9%J)Orn|ONqgoJޅ> ɤ +e)LJ>D- FH 4`89ec1\ Ia9 9VAL^`"5w&K5]pc!K(iYc0"dHVAiY[ְ>!daw}-h0p׳P Ǫpt`5,@ϓx%+O%jX.cT^1.ABX4,]*Ұ wY`AD#DjuX pyCа` ߌ0]W-9kX%aH!9 "հ wދkkiʃ,k*>dXx]km*D஄M b@@,kX3R԰  R> ɂY*pb XB%kX'RXq_܀+S Yv"!|K"!,n"$B1m9n+2$zg<ϋJa(겾;:tek t#H`zϻuw(I}]T„t{;*^]Ho?t{YH+hEyX/]jLIN&I_=VHъFUfygNu BFЬߟ~gTr12uߴq_=VY9Fek;YdnGǺI?^ bKHv>y+'+Vϵix R\[ +nzG~f '.":"y}Ɏy^60mI" EY>s;^K ˂8 DijhyA,djơ>J슞a -ҕ/Nq4^s^/OD8x˔c~Fv6韘S͐7} E!B,8YIveH>=CthBY>^#۬ΊyG$7. Yo[oR%w@'x|RzsEz§m|{RG롸[$b2bbr٫kyrPWMw{ +s} h]~D#9bfK2z]Ingpƪðs;Dvmr1xu!Xű.c=bfMqJ`KeQ6/̪O(+PQx}$REm@Wp<7}r61v(wGc}/cc+}izja/wpƾWR++M()j&O-đ:.Z,;&MM|5r4Pw}u/ߔ&ߠ6͝s?{ӁZnWۨf7#*ϲ8c6D;_nǩтU[[ Ge~4O]Ub[`Ɛ/u;ɗdd ; p9TeOK.aDD q{\Y9Ӻt5_WuIC ,ͲpݮF9!o;Gɲ,_(ϖصerUi?V?HVޮ"_8_ IGo|^Bf6 YGbv1rƮK\b2u#˞R_&V-Yaz(ȻK'yn;wɲ?hsɫ& vgչi[[G0-]SUm]o;&Jֲ/uRHBʶӪkbnĽ]i夶[G }RoG4?DN+^U$B|R%GY6OvotސO!) +Dl .X>5M4//P:U~pMJ^|1$⛝ULuXӀ4Nr)uU ]cꤲJO@ǖu@XOʙhnC7 y'n2رy&NbN6߈,$,& 0F+ykG'y3c8LO5y +^6"9y)לe[_@,qێcHW:6bwyAvy z~kuu;DtI3rŞ|ڌ\Ҩ~cB퀧S^e9TwI h=IpZbщGA'FLE lS)ݚZgUKYa^0Ji+㶈׳% P9e%BsNђvnݢy đ-ܴ|w>WZSwB\MBٞ꫰m 5>JnwD^<0MN^j FgLC9rKS4`շ !/k7˻7u> +endobj +646 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb116-5) +>> +endobj +647 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb116-6) +>> +endobj +648 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb116-7) +>> +endobj +649 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb116-8) +>> +endobj +650 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb116-9) +>> +endobj +651 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb116-10) +>> +endobj +652 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb116-11) +>> +endobj +653 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb116-12) +>> +endobj +654 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb116-13) +>> +endobj +655 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb116-14) +>> +endobj +656 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb116-15) +>> +endobj +657 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb116-16) +>> +endobj +658 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb116-17) +>> +endobj +659 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb116-18) +>> +endobj +660 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb116-19) +>> +endobj +661 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb116-20) +>> +endobj +662 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb116-21) +>> +endobj +663 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb116-22) +>> +endobj +664 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb116-23) +>> +endobj +665 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb116-24) +>> +endobj +666 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb116-25) +>> +endobj +667 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 321.391563 101.433071 302.641563 ] +/BS << +/W 0 +>> +/Dest (cb117-1) +>> +endobj +668 0 obj +<< +/Filter /FlateDecode +/Length 3191 +>> +stream +x[[\ ~_1"u +?(h =NpwS/3"uDII|&|*Z[z|<}:Q(oqUo[ҙIKHrM&JK |uu>Z?~g*Pj)UXUJ0<`QU0CchaW5STpp$ruBa"\[l@%z:rbOB9UOKX<2HrukOW%:U`X({&!tTKEJ!Ut!aoÉ""dJKNEIJiv=]:`{ 3P%b)A[TbUGK10(NiqD`A D%x\ `[n@@J=.g  qqf@@J + +)G +Ze@"hcqwx\]qV5`f WB<.Pn(x7WWΠx\ݘ0swcqwq6J wA!q=tQ<.@g!", w9glqArι<.H]8* wAp|G$. <rlqA"nH`;Fq[`uu-P-E U0+=.BqA½7 2xKqpl3`5PSx:.1VӁwJ wmz\ bqAZ):|. H,W,Z֡I,% B ƈX]@`P%ec1vu:.=.@.* ` pEFD枎AtcF`A4qAYf& ࡑKԞNqA,T& h%$?H6:`-ݬ +,؛o  "> `aq<.h\oFqAB9Mウ:`AԜs NB vtXbS ZΖoV f DD^ T7{]M L( DdM񙯬qVƀ@ ս2 p/Uq k9{i,kvo Vdr xL8a}Z2CϬ&p,9f5y~?oWMYal~lubz֟"DB|IQɠ@ݶא03mfz5.RZIv~v/߾=_|^,CFo?ӛ?wٝ}bӐ^2˄uuɄ]c]#tiݙl>VC}^}> SjYd|@ogaF2ncVe;-xWw L,A5fm=ꐏ1GLG"$62 LyZ7;OYGl8=e2zc>fZU17M'-~iGOb;,X66<c#MgǑ[];&wQVWOH>1Vg{>t| _דMRs,/۱hOؗcy_ܾ>þw|g߼_`gs2}|kn\h¿~E2DQBmhE,.yQr*̉iR'Ԑ +E/GM3,iE"mool.3m ./£"Ofh7fs%(I^=c><q9yuʡ%Zߙv#~hl _ +6I+W!unW3h yi;yp*.cٞ; eweslz+_ Six9"@ +StL̤|l|]>I0 +N d9{2y4fhWu.::vՠQ lX:|4ff\]+SLӺ*Èi]|WoDK2n2gG%#k!YS~l{2 @Li6Kw5_/9;cRVnB'pEl@5gpgEr5m+w%HX"T ŇE{^tDoȝW{w\bT@,d!!7kTZ +endstream +endobj +669 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 668 0 R +/Resources 4 0 R +/Annots [ 670 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +670 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 653.673057 101.433071 634.923057 ] +/BS << +/W 0 +>> +/Dest (cb120-1) +>> +endobj +671 0 obj +<< +/Filter /FlateDecode +/Length 4763 +>> +stream +x]K$qׯ~ dÇ F$#UY#ך>,fj|c'{r.)E4)\ISbODpIl LwZUJ&\XީSA`q+ Q`E0R$[g%K bxkdܞU MK,aJHha"hx&Gg"x&Y眊ɛ`$^Q1Ɛ%,h#d {- w9IY\tZAx Xh Y`]YAxũP"s{A윖xƨt"IIYu("sG'K9 jɻvFbm"`%%)% lJ%)}P|JN[$ 6Y#Ӑ%(!3sEdqKX,dA ,; Z$,p[o6QZu9z  T$,p\씰tIu!Z `%,p]獖wCMY`3IX$aU;VYKX6k/aڄ%@%tx rwmVܵF `( +h  r8Y`: ИK$,]S > R&(aAyE ~ -+c wP9 p%,+V‚5+[!HXsPXߔ0]W.9KX%+aVa3D%C2F*aAby/DIX#ye+aංO#XU)$pW̰jK˦1f Bl%,٫R  B>IY"%,@`+Y‚d!V‚d! B b}d,%,\ | ZxѪ"/g)yHX\Je8xEᒄ<%,HU$,REd. dA-a"] [ȂhP‚l3̨%, +\x^S%,>* +%, R<CvM9"%,R%,Xm%,mR$,( ⓰(L0oZ/a,aAq&RCl_p9Z,bM(ܖLs+w;ƄykBKв)MH3(=CһDnBQ4N] H}uܿRN7r1|ɸ޸:WsHu c3El-}uN\y_93!'B|=m|cHZդ_mQ6ZP^ʷԹֺ \9/5ΨS7W[EYe-)}me=W硬,a/r]Q؇ pS`x-^yWt$O_f뇏VkआІ5XS!,ײ_7y u?m͸dCsJ2Pf_%˿|JFRP'i$Z.MJ_zom4 *r]빕gtArz@F[Ρ#Cv6 V+GGr6uᕂltt,j^|gy_.Vc+kY-fڙY:a\Ǒ=8^(7Y>+'a`hm4eo/r'7ʽak˘d9g7|.0 29e}vE]qtwZ1OV0?Hk D[]XÛYC \,TC&:*R+?DŽySWAWbq.Y92_b1:uKTZ1B؈e;,QBGPM` u֣-ҶqG}' +cyTw 36rh,4yf=CtZ=z X0Zkޖ[ +hX,:5;UA-Fg!D}ۈg-DW^HܮCYgn6xF'Z]q$1]+X`o ĠrB'%N+*fC X&Q:?';sf0n,6Һwuo[QV`{fTh)jm%ގg.OSvwp=nArW;M.[J͇mwm1[ڙ,zqKk2XkN \wg>wVhXM;Oͳs0,lU>,.Xވ3SI';˻3vNףgf5s׿dAyk}z>ny[g fm0ROf5Oeo{-3!0vfk}Cyλͮe +62Y[2Py/ό\=[vHv3owe8NNyλ.vfk9[LM|ٯewzo'7+cG;gV_nLIJ܎edwg'?O2&v{$1쉚u77y = .bΰoembyx[7S_E*=f5մku9&TJ }6#~[la 17C\i"[[ }R/G4?DrW@:Z|DvK\K*/VLk2uk6=.P:1=q\N7;y$Nu(eR6e]c*S~4T-tdnC7 y;{rɩϸgovy{V6?sd`A0Z[;: ɤv.sK/EgQ<2E_eغ!󕌾x $4bwF <ʆf }Vt5ˉa萑m7]kLCMZϝ`/n8Ww >\scI&qEEǒ".xd!FL2HIW=T8]0.Aoi#fC{rjQ;TW/9ލԜwh \pe<7ڦӶPtM7Zo15Z8ZJ=?rM>+]Jܕvۊף%9QǒYE^S(m߷V+Q-J ;PR<ڛ䬫_sOO>+9~, ӡs:*.YW0ck}M\hqH)@ +0{\RPL*W/9 +z3}cD/ +endstream +endobj +672 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 671 0 R +/Resources 4 0 R +/Annots [ 673 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +673 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 529.294475 101.433071 510.544475 ] +/BS << +/W 0 +>> +/Dest (cb121-1) +>> +endobj +674 0 obj +<< +/Filter /FlateDecode +/Length 4587 +>> +stream +x]M$ȳ Sw0sm5>QȨvowP>(|"J~2r.)ˏR %V-~Si +?0)`S>_g(?_~_uNDkoݔrJVSX!L)V4XƂ!y1|AcA omVXb8۳ +İx1L Ia<B;L"&=jk(`s|JN[cI82Y#|Ԑ*5,pA띆ha-8b4,p[O&jX4,p@\װraJEuN @4,p@]հvQuސj<ְ89 % YxN9U^$ Rbar)5,O.iX13^ÂT \E,ES5,5,@ 1d Y jXmFI%1YÂġpd@JY@?l D ^Â-YÂ!%alͤaA!ȂOÂBq0Y8xDoZaͬaAq|)E7CEAME[`MƋaAͬa 䛈-fR 4pi԰7j=xCB|33gY1 @oڪnUR 9i1Y`YӐm@_c~ ܢ053'd[xD=ܝbt~S~ Xkt,@a"ض5uXTlXܖkc"Cb #~*EU"BU|Tt]oX~f?Uس>Y=Y[Şe*K&;',QϨ=A +5cX~ 9"x_o-/|ﾑg$ᦑ5MrsL;ey!gufWm}řV5z!'o׾\tHN,F"a&,.w0 NRn&KON' i~[OV(߮ʽejme> m1.9˸i#'Pm m[Zx~w8nq[RK|Wɢuy a5O,zziWAJiwrr +R<5ѸEっ*p~?j m~ vs묄"ԦPUK?i_h& %QmRi3u7qZ($A#)sWgjaDkFR ao}$G6wm>%]WmI;&/yDE5}w!eVW3g}%G/>Λ9_&uŗ9D_ӏ38x+&BkgӚ8߮?MduG _4~ n6Ny#jw|Fa~p>_~/OWs.߯O(Nyf^[k@|ˀul(T6T$uQۼ,{9 m~])鶧(ӢD +g/~ <4`9P?a/ޡb=Zd,_y9C-EMNީY' _bT5ʇU?\L͡TٶA~^!{?ٓd&.oM+i7Rʶ$<70@K(FCƷ~xj\bX!f4{2&<)vQ8ѠeGCq$aO$ [1|S8]t9uFIx[>T5fR9!TJv't(į5Zەfbn{)E-R/Gf~2L> +BM|r{)]הv { ?_BRJIvra/xw*B27w}ד$鱣f4ʊ2)ue2)t{>c+2AONkV am~:VJ"5! n+3tW ;F{r,ɩkea]ޮFՅolu2Ȗj7:!@a>Wr֎N|r{;L[qo?_2g]/ee@o]4:Z؎+\|n6hA6y :nk?Vt5+a̡ n813xbd>U7c:I9> +endobj +676 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 713.673057 101.433071 694.923057 ] +/BS << +/W 0 +>> +/Dest (cb124-1) +>> +endobj +677 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 155.626036 101.433071 136.876036 ] +/BS << +/W 0 +>> +/Dest (cb127-1) +>> +endobj +678 0 obj +<< +/Filter /FlateDecode +/Length 4552 +>> +stream +x]Y$G~_ϖ\#` a% ]#|UyTVTunQtEǗYU9c +._¿\bu_U+ +Gw 6L!9˾.ZW3vc)X ,rn +8/0Ĕ$p mYbPNbA 2& +1,m1L$ N., 6J<xMJd `$xi޻(si"% $,[% JY ^,( JKd'"Kg\VI<'ߴ"# d%YUFYBx gCBnxHA_B! +^Dĸ$a adHD&B &)H8`h ,VCBIX '̨F3jIXw4 0MZuE^TQ, 0 O*ID^HZ񤐇JXޓx"="h$,@^Vi$2@ +Ux]Bwyڔ&(a |)%,IO N‚@p,Y(HdS b ȂAdSȾd,%,M1IXz ZxL1E^O B Sk)"%,O.IX1$aAH"a)dOC$ Ok ,%,&b镄%)^gF "SE &Xi)EdLHXbIXXۨ yk_{4X;[{|?~+X_HJQT{߸vz?Psf|'|e(~뛯6ewMVwb5M]!c4*EWo|JMFT:UQ/uEj6\n\6o_/}fl[|@[h~c񱭎1 |Sk-r7-rr /Qu{~u9nϩG򝞶uXdc Bkd&6f#/;V uڇir9Zs~mfl\)^"yA[<ɞ^=^Yꤵ~z e4HMe^J װD4"=/=Wc;='[`B;v^d:am̻[^!:0*>oIuc>q0Hm10IE'˙qfWs~mcnoS*3K|gY\)#=DOrv#o6VЖ-y 85j@ф1Y]|_6Yc vzűm;YYcK[P,vPe]殍q<;?se]Aׂmtɡ&F}x0oM~̏KŸ󪇎G68\Ʀ^ vle2 nmX("-jSz/sSrT{us=vѝ6!;N[Q"~+VsXkO{<6\;:t^x=xuu[1~zG}#'<猟^suC-͇y՝Qn;޷yTp9 lm>!0>4vgy LSz0y(kf e'<@n=6WjwiYpJm܅Y݅H%!1l烋t>N8iç^=M퐮|XRTt1ΊםLk`'QRl.:Ϸv*`n$?_HWȄ\$WU"] +V¯$jjꝿWF]G*l>lfX [2^Mz!q˕s%/lUm뮑 y4VUޫNw/eMyD]Э",MUi*U+%AI .sU&;f31GZ.rv-jPKV57QX/вjsQ|]1jk;1Fb#?_\J뉶kjҨ Yh| ?CTFESu)>ԭ]N86+y+ꐤ>Aoh;곽tTByZjlETC*1HUXuJf+XU5"79] Ujg^wj+v>P-*omB前F2~,4Quku&@>gr֊N|xڂLqo\4g3|k[Yep6FU0[W~&I2W^5l:YVo8uWW KI]TWnOtMT5vq۠Ś|mڄ=_p|6^ +pp϶)5+.ڦtptq7ˮ$[wRUSo +}u]M}ӅGA +la}i% K0B{>:0V6_eslS\ieس5iR Z]>Qcp}ThNDQ*b(2ZQKqjNѨ5zT%*~S6> +endobj +680 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 304.323057 101.433071 285.573057 ] +/BS << +/W 0 +>> +/Dest (cb130-1) +>> +endobj +681 0 obj +<< +/Filter /FlateDecode +/Length 4533 +>> +stream +x][d7~_H9|P P`%] %<ǷS}fvthvTR.\vc +ΗoOߝ¿b_7V- lXBr& Mc_~q6>%%o;UdCPNP%ʹ%㼠zAST02WA):I3Ș("̰ݫ0A: (%`"Fix8K:I.@t.>vZҥ{#Ғ-dctXo-&+l1Nt]Q啖t..E"QS1Ľ(htZ/ش# +䃠3+DlqVIga Gҁ' 1 +jI`1DlAK `Qqaˋ>I\ ̨F3jI\8,]QbwAKF‹`QIK\2^P 8иoOϿ_̽y +k/>Kq\ygSנtJ#p~a1Z]*iVNTy/et.le=q٦m}nmy۫o7gmW~/O~`^+Dl4E;=C0C@5#Pm]V]Nhi J{h2(4&n`2CSKvi%4,k-/_͎OCn[5X{HdB^<Lo!{F;h^Ҝ=͋{ҋg̃y&6=eлAϼP2<Լ̥H&!i%S+(Aay XC퀏M0LgGf͛uwi=rQ@jBՑjF#ˬ]8";-Pm %a<]겶D2vgN,E-cٳ0ྜRiG>"ڡj{oJ/ZzE'kHf#WF[A+Vw}󆎴XP}vf, _Gk>+}k|vV+^BO7YGßu:#OqWӻ7=7v80uӆ' <cOF']~;jԏHf/qH1t;#k'\0y@*4<]\Cܫ% z<D^n=r;$>rE!?C+7uζ] Z(xlm<^kΣ ҈kJެc +e>s/8ˋa936` Pn8#C*ͬp0j(gl>MO_9p(σ,@ozt TO?.Z 5<oe_VPmWȆT "I$*=R+O<=u[T~߮g^64q7/)[h%)eZfzM v{CLs-yeloۚ"kO|@XS A> g;6%O0?kGUp(\8υ7nǫ\zC5~$| Ѹ{h=osjzqB}^l#X;qܧ?ۃoh(NcO 2/׃ywO}ɏ}?am| <c{Q>0ávt/&ALbE&l -,iNɧ +1Kjk8r/R5[ Bz/֫E1_[|3φ6a/ƴX[5^PGōu 5 Cw^NgQ֢wj2;ՔC gM̦z/Q\ZT ILWJsBK{T=MP9^eioƈVi}^Ni'~> v+v(xRX_ahV_ATᚔ' H^ &:i:$y@SiwfG騄L-uF:ls׊iNt}SqǍjlanL_  Ahh.ֱu m7fkU'R7M; +] 6 F32y27}^m8|g +cs)<'Nڧth 0ǡ-ۘɀ+igi +u COcU[1$AlLJ`cic`{1FMLΖؤ9@ +4v;A;bajPd/w.?SD +endstream +endobj +682 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 681 0 R +/Resources 4 0 R +/Annots [ 683 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +683 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 456.573057 101.433071 437.823057 ] +/BS << +/W 0 +>> +/Dest (cb133-1) +>> +endobj +684 0 obj +<< +/Filter /FlateDecode +/Length 4515 +>> +stream +x\K$9ׯJ#VBJFB8N + r3HgTVU,ӕ~#_.RΏNOZE<l4EMɟ?0E1Ooz?:lU=ȩb^`eq{A`0Ĝ%,YbPN^bA 6 1E 1l4$ > +,!Z<xƫg +),"x&Z +7/O H<Y!KQ"ċB;Y%J"蠍ND^O<9-QDf%hEdN[ G') v!Dd%$ RKeK%J +ؔ$+ +9J8 ,@yeYȂ8Y,9 Ж-8-l$,p[&HXSKX.rJYuN @=JX+a:JAudu5EdKXtT$'awQbY `U? WMIKX@]4IX@]D^TNZ!Hkpג QGpt`%,@: ИHK$,]9 R& a󉼬Lƅy -+Bw L"wCx]cw7x  M yY霒 X ++$"/*8`4P p=KX;'aAjB# KV5a +sɪH!u.M BdM@@,JXc d R>QY"P$ Xr Z⬕ ZȂAd*d]AdTDDV%^*EK(aAXKI/a^q$aϐ1CL T%,H%,@ 1$ Y JXl*3h %i^g& ũ&Xi)EdLHXbKXX<[T3SAfL BvPlӗyzwxax^adrb !K1w! `qtc!n}0[!1l̔Ѧ_, l(u>!%B6( yU;?\2:# V^YJQCH7qT$ȑ-/o`O؏ +1`9褯=h ^kJ N~i-'ZGJ2߾_%ЙFO_.Ƚ ?۰}.m>7W;&Qc+aAӕҊBBPU+}Vi(Z5)"//8$* 61՘ոxn|o'8΃^ۮbdӍ\:n-macW# L ^ۥn"{ANh{q%glgTN*Yإ'E_iΙ,V|nٖ0ɚYOtv`.VU;[_j~h'wS|Ȭ~e wҜ.5P=vs>wA}QxRco:US1__ <~[ûhXu>cbU1>u9Oo1>Cogk/yԾ<¬QҬ[$GWV}} (:1zYQs?Hy=O;ꬬV/ߖ +7Bٮ}Ϥ qom;WlyZ+s4os.i&/<Ss9z0-So #\03ǜ:W\a TR:n:(7! +-k)!\6j303j]Ր-]vm{cҞly4Mr M iþUOF)j|`!b6޷ ?|0ʚ0uZP`,uW['/n:%S&7hfM W/,&AM;nPsJ^*v#']䭜;2Dϰf/zi긆K-foڼX8Xd)x?Yqxe2{wu֒16o1B;ǗuKUnxk2 n7yuj15nBs+6Uo<[S0q+_z|ý|zG߶wcWy9KnB.|D ;wKמ'[^Nu6aXc9䘓6ofFއg|AycW癷噳G4 L+wZO9 d']CYuOx7x4{q;7ymޚ7'//Y)5&Ox雥z+.gp̔|ah{ʞ{hUF՟CϼΫrMdWV"/Z}ot}[u^q#hXTBU.bro¼Y܄3$J.zogV܀Wj$bRŷyu^|]۹%Rvc'Eq1z[晬 +m[qf$oW^l@n7oo5v2cg>OʗЃj+n&eL_ܾ[ףXxc_\j=CշlV/Gw571r1/tێvo8lK>ñ~=7ȳ9lO|aݔKKt@t|9rl牿T3XsPZ|c 7Э"/aMUZhn*7%AI =]&U 1UGV.r$[[RJjtWw)^;sDqK: ~cwǓ6;PwоHtCtNu+/S>j.ŗy F*i:$iPeuώ2I t[馱 uP@ cK6!aHUtɾmz: fpwаy$fq74y[Wc l4SnѮw6`N0\u6t&>ɤxTœu _46fY/?f%[6lݐHR|Me%i3- &zCxM^KqG:ȶ5nЌ? >NZļڦoYwT0\I5zjAGj~*mi  .@ӕZUVj)#Nb):Q~JSveZZGw}tldhaݨKJM۾k=à.H虩%sGF*UNI.(j2YW)` Ұ5rw㽒H+{99eCSwZSanw9)7}Ͳ!#/bnIoD6DbmOϿ  +endstream +endobj +685 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 684 0 R +/Resources 4 0 R +/Annots [ 686 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +686 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 432.273057 101.433071 413.523057 ] +/BS << +/W 0 +>> +/Dest (cb136-1) +>> +endobj +687 0 obj +<< +/Filter /FlateDecode +/Length 2788 +>> +stream +x]9WJ]/ b%DqmvN\y79IhΌv]~\^x+])5'\o6q9 +®~w/]5xy]1ty﮸V5\)x2u,*T╨bt9*y[`FQa +fX +P^Uf썩`11@t>AOLKJu:өGtեba:-g[7-%3]-T2l Jt +I♮Q]NJ. Ţ*L罋M:(LRD`KXDt +[ /'Rj mug[BFul\c@Y :+VBrVPT3《.x-1-KuE1h-X +[)coa,P֤zoM|b,Pf +cZ1( W +*X.{f,PPWc + +쪕XசwUq%80ce,0pWdwcfc|ŅRP [e5[`;7wXGqhB"` Xh%YӠ&Ƃ飺|ƈuQv>X]lTX]0;j`,WLP "cyߜ.U'ƂKP]vp$X;AX]l U +`X:,[: Ӂ1LXݶm20@(80b RQ]r(GƂ,D `ec,@`Xl r- }]h~`"cHJ5c,1!è2] +d +t>3l[g,@. +=cZX3X+lRa,VJ@dt f,@ %D%dI C#P3I3 cAZXeL:L0`~Z DCuE1ZY J-Ac|囙 +lAXP%&3Љ0T_oc,lfa,*7u[5|33T-! +M[0 &t j5o7#L XA&w&o"e1#>2BO [鑁ح2=3Hf",`[ =6=0vQ%CƞYrɊeaG1G~q-6ˏ}G6WXb#oׄp }Ii( l(lwd) }wۊ]-|Y-HW/hpkB.8RT7v9Z7o|׿m޼+_rC~=p 5vQQQ'<-i~;H&a,MuEomuζŷ-e簫_xvy;ƸY?.o^m~sv= +P ,{D4]K|Hi?}Z㽋edcte#׍N\c{eU=ϺJwArA{dpg< +@G륽:bd=-fi^ɅQX鶆ۄkMbE`>ym\;MZt{mvJmۄ OǣŞC~>li~ނ!C*izi=}>+XFɖî{-}oq*oвj{֞B#8 )n㫌Cv۲55:9Ѹ5~7/k!Ko!LQ^?INqz01N٠ugg^eG,Mqno4u2nt~JxЭK"2]C{1!6扈޴a2~߄;z#F1Sy*G~2]]x"hzY#Y FJ4&<2F{?m1qBbwUKC\d˔"s< +KZPgmT;I[C|Uu<.s>/B7cNeyݼ↰>>Pnp姓xRΒ_=v8 v>OtXqt.=G/і.kOG3 -TX}tyQ!Z:demJe}X;.t)u:+c:+nkx#Z՝;5G,Y,W͚e}۹^۰iHCͯ׬5wV'!cll(%%0le9k>}Vx"J֞0T%SnyT) +/>xTGF~ 47ڂ~ +ӣ!}; +:: +endstream +endobj +688 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 687 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +689 0 obj +<< +/Filter /FlateDecode +/Length 4380 +>> +stream +x\Y$~_QD^ ޅZ%E$ut%V+#x/LwBΔRsɚ-k-6-~s<;KDWSOL}N]ϧ?mw]<fQ0lª`YV&gJ`j,3y:2ĠZƂ}QXb.YbHcA WcVXBUy\4 JO;JUe\/24^5)X4AXxDGd5dPK%`Ud%!v+UTd:W +-yFKV9g"l3<(lR +CdcUy%5^,!Vϧ;4^,gRy!OANa\0lz@`PPj(PYÁ`xi@,d4$Nʃ,C4а )hXkѰ nVaAޒuIÂV % S`nvjX8Y 1y `7PIn g5, n X  pkX]5äalRŒ.@e34, ஏX湁>Zaw=a  w!Q V{|аDÂuO9@+JMD+>WиrneRD.Uа wE`GD |D.↨a8ga*[KѰ wK^xac DeCrEaA½W p4,H]K{Td kX<[L#X5)4p:Z nS +B4,HՂO%aA D@ʃ,I֦Z4,5, dаѷ@dAa̔JaA 7%U^e r&W4,@.e +xᒆ Md YaAu' p.9,`o"Sm ͬaA%<Ȃ*|d4,)qY4,@|Z(of\܍Ȥ񀻈L@V-7fg:pYԊFVd`VYX/Hjb",IZ6_ct$KT 3KEV Bt?r,\i/|/ZmD>i춯O'(!$ D;rL״'E#^N(btdutZ&A~>!Y@F#8$1q'yYPTS;~/?a?16*n"܅9l=x+s[\%ZVcyM֦jJfbY7, p[2gϽ-> I:n,c:nS1!&TzOiZ˘N %Մu.zN5~p%#u|\'@^=dRoR XX(bk>,r 7;x/ 9@(Zִξ<׬5}ng\Zy|Ri +^CRe}q7fW^=G!#aެ y +9P1qQ }ϛﺜQ }ϛZ1EdDR 7Xo+Ҿ{2r?|_oO+k-.?YK~ ~Ar9Ɏ6]_Zfc\fd>svyG_ۡ{am1COK7ƍdr7mcUL?%oZjҮ}byYThhٿuE"BF2U}7kI;44 cr_N{l;I/*A,#˛c^gbY[^aI_C.iݲ2ۮXSfelmotMX]n yt'?= ں^2Lb}/܋~)_?^_}팰O;be+s{亇ZY1BM#d~~~0C 67w|!ih&}Ka.x5zښhkj%@w kaq-$oG\!2ӇIl k2]K ;f"hmW7A>?&)ݲ{>$x'>xon#$Nn=>׏[_t 3հ>邋} Skk;-ˋW+6ݱ|iAnX^Gn o~ˎqarB뉯]^n4}q+Y[uu= )6?npݺu+cw;W;5[]ݜ"܆wNW~:ܱұN/d2,V'oO-VV'ܵo[c}4+K&ۅa%Nr~6">Nޣ;v1+y+,snLE+ u6 shᑊ]ײ=w򭋜3ec׵'"浀Δ_WK?saM+Z>iDl+yYQ4GM;#EcE^/OY',,B[=<ݯz$5nDv:p Omii|1Ӓ [ ߢxz%SMNj?xkK,Bx +͋i^OORtg,n'Uª`׵-> IU>iH +o< +KM+x{lɊb90E&ۭ!muBqJ=x$(}M}7]= dӞc6]7[nՇ!l f~Yt,YWGau+lcdqL+\BB##F#buee{-d(u#«:i;'8C=cr}\S;_nyZ_xg8mxbmm𧓫dX^Ne?'~9)d"$3qhXzA.]K8)~cp\GjqQhM/+DLHT׮PuPco96>)$M@ 9b tCѮv +rRۭűSy*k횟LSe(^5ogĆqKk[rBOr{4:N$1 ;eR>f *2II՜ o$iipg[.Y/WҞAwP=.- dhn0 yQvL08Ɲ4Yqqw96ړKdnN&S0$O}n~Z:3y4{9ܜsy+ǯNQ;|=ŏ{;lݐ'mNF= ؟dWfحaq^n'n \ISzf eؽ{ &u_L^.,7.-#.䠸)FL6H9P=Or+$/DahY9tU&֍<Я>^?zWS?L>ϒ:x:5˴>'JW?SCc ^A<3ͅQA- I6vG14iceJkj)bR&5 %F+ЖoDKa@Qs%BKl:87m,AS4#S;CWkΎ ֪J+Vpr𡽰ܖ!TDi}nJ\I΄0͎_= FCݪU2( s'\{p+ и̜*ߐMFǸ)t- +endstream +endobj +690 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 689 0 R +/Resources 4 0 R +/Annots [ 691 0 R 692 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +691 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 559.294475 101.433071 540.544475 ] +/BS << +/W 0 +>> +/Dest (cb139-1) +>> +endobj +692 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 203.747453 101.433071 184.997453 ] +/BS << +/W 0 +>> +/Dest (cb142-1) +>> +endobj +693 0 obj +<< +/Filter /FlateDecode +/Length 2896 +>> +stream +x͚K\ )f +)R/"@@[5EM.tѯ?9z^?/3"H_UB$¿Ʃ_UҕIKHrMw&JKꏗﾺ܆1#/?J%Z +%Gՠ"GR(%2WTPpfbٰ-9f5@~엟._{?_m7e lAlX23 MPxQw=ԣ Y~ܴ{nߟ{ms_mo_q0•g||5'->fn?6:%{'f̣Pcm\o7^u򌏎猋 =v>|r} t[}d;/OU^,J#NǮo>K~-1݉mN{Kx;7}X}WGeK2-pgGlN)}}:;ǹɼe;梤! W{kKu]~G'zAG!]8"`κ{8c\x9M<C +ӜEFef‡Y̗<0b*AN#tUG:( ئe'3!Aԛ.XKa #(S])*e-+=џxs&hU:̤xTb>Ǚ#W+;gh%ޓ̭1C =V]u6;*uPӠlXMh֧e{R1ŔtZWeLbZW%յ~7%PZݹ̧YsĒՑ)]v?uy lj~>gmnnZo :}A\$Z9!j(ZOn]H+YGrh߄G(󊥫iY#>m>5ֽnmיۅ(KbAo_bjh>$O< +endstream +endobj +694 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 693 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +695 0 obj +<< +/Filter /FlateDecode +/Length 4779 +>> +stream +x][$9~_QHk| $HX О3 +3 ԃ4p™dfTVV ؞VOgFG|v9YRΗO'WJ,n +{F6&ϟࢊ'?~:lUGfS1Ũ`i*F +Fa9K,#Yڲ"ĠĂdmX b8mYbhHbA }XFCcyD9+WJRYEL9"o$^V!$AxxC%d! Ed):!vK֕DdA9 N1myV{sZ<❶ANxSղw;H"`%$)% l% lr% lʊbt %pڀgNCOABg sEdq$,pAKN%XpK:  8.8 K$,p\RsSЅG P`%,p]G)HXΡȃ,0` ʙ$, 3:JX@]`A؊)i k& k#Bȋ +>$, k+aw- a E w!^N V{𬓰)D5Oi2) U׎L籍MJDXcC>h`|F@˘\Dy%r1< ,Wy~0[N֦&a~Dho{J+}َ7kTգ =t M]z"F-]n"N}o'09Ԛa6:o1za&M"n.W ˿EYs\V#=F|htmMZM{Cfkf!:*V<}٠ڇ- 2ƹnuUi2iȄ4dX$k5٨Ʀ~Xeܶ٦CYYg59tOG-]}uZ= b)>[w%q=iLJǒ79X3EyQ9gA Wl#lI:52T{Tn$=gݔ)?iȔ.=1&j9(0Ӫ?I͉ +Ovh]V>& +-[1K|/Q[4s&XKCߟuXkkmIoKna4tqΣD# M̀hU7$o_7]3^+[6Zblޮ䦥Ɨ#c/~wŊ"ċGe.3䰫qmY3S-dBИⒶbCxtsY{>~)FN)[j>vo1!߰ԃuR}/ GF.vۤufQԎ+e|0疕pV#nin\Yzz{ݰd[-Z=a v̥#^"3S/\Epxx/N9ԈLug@T|]\a6: vc7SN.oؖ+7n#'SckV7*#O0L_z'웍TH uHҀ216դPAn[P x R :K\2 0nT%]me5ڞaP$Tj~SEQ%?e'ĤFvj2YWdO!ߓixuJ| ӡ9 ],36ch~\-kqH)@ +0y)ߗU,ˆPTs&VaYltj +endstream +endobj +696 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 695 0 R +/Resources 4 0 R +/Annots [ 697 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +697 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 508.294475 101.433071 489.544475 ] +/BS << +/W 0 +>> +/Dest (cb145-1) +>> +endobj +698 0 obj +<< +/Filter /FlateDecode +/Length 4753 +>> +stream +x][8~_H|> !`%@ GBx{fvy9I 9ʗsY "!wY`3_N;_N_):?I\%` l[1[2H\`H޷<-> OQ0yЪΛ!е qA4`*`-5D z @Cv$.i $؂"q!xN8ӅNk -%.&bDSK:Ry%.*J\a&RЄ蟼v`&9XGhr3J\#l1H\lf )O₤d @)%qAMC`\f Y&x¸Mf lqpQDlӔq Nz$O_>a=ߧ矍 In[GGah! |$O6"f-NAl$Ɋk 21_b1LƝ?|w/?W@W_Fq:vt)ȞikYӻmr[mO\stS9SAc'>co_~aAFQČ,Xހ#\k錙|رOSnw\i5hheAdȖru=w|^ m/)C s4as u4*"k#!FD.]LI |&+Ky=m2 +mGBs8Drru7TͽHly;UQw7nt~Fs4Tцw}[Gzg w. +Yi79oaNEsO|TI]ڍ1+Έ[Z\|C?b'B':5tw+2WOo޿ޙp݈ |%ëЕD-= УmߗW>{tskZAes8o7.o̕Pb!R~; ~WggY;ʝex͟ ڿjvصŕ@ܸBB +Bs8/u+J^Ok_y ++} 3Pq5QRxeg5GmDQG_ݓkCCi {RV*9n|: +=ݙpx {nա=+ >Xfg62.-f)M~B_cB͈7늧,ގ7l7P{<ߙpHވeFax|YLzZUnU#m{.sY)>iБNqضI6Ģlq=-bxI)=W2ƟN\>itH(mf7vent5p +gN믟x,'q W|7p\E}^Az/N8h7={rl-sޟ(*KtVWr~_SM;Y_ިm/;?vw'h຋є&~9]TI f8 CU"]VԧnPa[W+W-nC$.׊!rzWy'8WS/6C +$2nULBŪkbCw.M盰ΛN/iM`yKx9ZK_DiUZר*̨TB$PhBgV=뵼U K% tSiTb˚J7Sm /6!oƈp.J_pcQMrrAHW(WDž[Q54i~zYdy*\f4UH}Y$*7:$Ҳ!TQ 3ԵfRdLR1/T%XWUq>+P#P] +嗙PKe^3Znʝ/\j)^0_qb^K%MlTZeL )4qїQ\Fke6Ȥriu&[x^>i':l*vǍla*|&;ǝCxaÄ7-+h1eWKJ]TW-ֆLl*te kȼoڄ}=Pp/lϬHmJ ˈ^(NYY633WR>O+l07"ڦ6l +.'`Ҽ4G0~Ledi*}zaYZ OOc B,ƞNN͵ (ƖmJxTdJDQ2UdPlS,GB)ڈ_zK:@9S-e%  \z +endstream +endobj +699 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 698 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +700 0 obj +<< +/Filter /FlateDecode +/Length 4831 +>> +stream +x]ێ$q}gK~}`^@V ?tlKz &oɌ ++`+#xd2Y*U"~t"8?"ǿJ J>$0At .⯗:EJ^+wFt*A%aTΉ+[LS [U6Eǩ`:23 lU f,*JK`hFt>&X]N>XK{"%8-NY+9l&NaF:آc0.I.+:"T.R%d q N)M0$-^`3Rs:[,r:3!FfjFl:XV[|-2x0:a h6r,c6рNNXF*H(b1sYl1r\`4lA - -ЭIq\`V*qLq- (% 8׀;9.0 ]Lq5klJr\`Ơ&-0`GaT4XQ2p\`FxU`E%X.Aqj["7xW;9.]m@f]P:m8.@cB#-wUBc4J<"P#[P' xp\q8^ j xWDjNU:I xyp + oBI@%!S8.hIs\(,d $qXHx.{w3ޕi-&j @ii$Bj0Js:!q\69.:r\`qV<>I:/p8.buqkL [ [2p\@$]]X؂L0Z XaT9"5ЩqAV + t[0U8.@(Q#3t + .tJq\5lA6qAL/9.@ZC鬤uf Z/(U+M0%- Zl; bV[Ĩi9.h9.6i8.H I/(M4$ԖKZoF Xobd<7$M$7N,{ZoF f` vx%0"3Md^x]@~+#8#c A2^DH/Me*J|n8a}<3cL}[sbfز??\~{_//;eBK[W:ٷ؂F7nCf)af#uae+L%cQ+!OcpOnb(m}s&>(>Fc}8[\mM>b卼Scźhg+}Ѧ͔DN ZX0=FRL~c4XbУI"(hkiW2-V,r09Bp/7?"~~ 5*. KR rU>ܯ*nԗ+?zշܦj|ջu~>:v*[вd_{_?WI ;Vocyʗk2CXqsb^6A#N_"ftVVڨzI{?|)S%X)K!~Oy4cOٵL!XNÞp;O/n;kv<$XjZM{>W|h&h kX{xFcg:Q{F_àuSy7;x\CqnZEsx3wۚX^kDPChzX8ku+WH%گm=\<[fA=BGDhǹGzxM3o񆎷W#[GvN~m[F_a$6PV=Qڗܭ@fm2/%)~jvGqjs{mnǀf~Ҭm֗l.uܫ]se26dӄ?76(u8n~3ϚuhKuwhO=;b·9{&L,:G_Y;=c6fB;ܒ_ԘGD +v;~#MVz.mIy\Er{޳ܫH>jXN=CߍC>Fvĝ;21C_ChOxhZiE0QM "cѕM> hl3Mڣ!(dO2Aߜ蛄Sy$wH.HS iwX:Dj\p|n|9[n%Q^/U<-ʧgSF^᧮}r`CK^*]R3*x4l -j +fTZR1Nlcmϋz0o ۺ-J;r=xY.v{4No러ps;^<#ޏy*;1A{p jw!NxZz1A|[yG6W#. 3{Yw) #('<Jq~6~=c:6i\ʽmؾo窦wSIzW @/_cr{e[~''냌|2$\zF>yCr"(:u;O$#D/َ;? 3~=2س:R=lXP,VjBҋ +4VU7֖U`AqB5NOdQlj5z͝/z[:fVLw/*bz%}\f +hޠ{Żbe t[bm=^aچwa3}:5apvAfRzvmMfRZ96?1ۅ~#klk:E+l+j9FtJky*RWMu)&gdy44ZLep76SuBo&Kl'L*1 U&%m &^(u,7ʆ^v.EgPB'mۈÐ yDRIE受q=zecCO{M}ǵllc$_ OWTa6PہX^U48׶WkIT5(t} n #i["{46^j.e:CuhWTth*blC[29v҆췣+ 5\ i]=̎MWYR`3^ [5vV0F{z}ߋɾ6joQnxɗ~}b!#23-Svu1bt^pcV@2YePmZ|Ǒr.8nJD7zoR5lɴȍpd/rXIm/il۷]]u =3۔|g,u]TwBTF*mX{pߒlF\xd#RJƞaA/Mx"W M_WK iNnvoK[yC]Z*/G3F.A*Kϛ+ +endstream +endobj +701 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 700 0 R +/Resources 4 0 R +/Annots [ 702 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +702 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 377.823057 101.433071 359.073057 ] +/BS << +/W 0 +>> +/Dest (cb148-1) +>> +endobj +703 0 obj +<< +/Filter /FlateDecode +/Length 4661 +>> +stream +x][8~_Hk|)$HX ‘ fzwY>%N.gԧ*۩؟?+N[%>S/!D|I +o%M)'K|=+I^X]oxޝ_O;m?yYVϯ{iUJ*èkS#֓ r*AZF`!Za8PzF$PZJVC$ьNYPi%\::#'e9g#bT$-dtg$-:x gUH t]œ+8n69.p> t +xHD.J:'pn9. bu_.Mme||yʷYS_|^5A,z8-Xo@SHKKmr;в|l&X9%5sW1i~S)&J B#}ݵeFTlLZ8Zɓ[+f5!/'tH iv8r~6lH߄BQj{P .stqcyTɛ[σ-oWtw7v>8r[^/z"TʪGV&_z*9X0>\>/Kd,?7FE];4r0P]uqU| {_]>;SN6"q0ѐnav`}'>\P=XS:s`yTL)15j>y*Z?9el'yޝ%HS.v7ߎ:VtD;| _Vg_黏v+B:qt%z^/s9zNl=P3 z^]ysOCηX^6@q0_oGW(~͌k=ӤSkdz= _Ls4$ ߛ嶍w3a֛ƇI@16`áu1>G}Y>}Vfoqllߔs4Ɲ~χg)au%m|[?>O,6@륳cgOs8BGJk, rw> +endobj +705 0 obj +<< +/Filter /FlateDecode +/Length 4935 +>> +stream +x][F~_1H1}I P`%=9A)競vys j㪾ӣ +_$=Ř5_no7V&=lBr&./?u}5SJhw׷";r+XM!n1%1\ C[VX+B KA-+A 4I, K+ȡR"("kvǢ{gc2It0NK4y]xY\RZ94xl Cy`%^,^,( JKd'"Kg\VI<'۴"; +JAK"8ijG' 1 +j 1Dd%0%$ 0!L I `(RP4QVD> -UőjBع"DXY@k!!+aE %xKJ{ ,b* ,FOX@.L)IX`)ab ,P:o$,]KKX`֢ȃ,0` JX@]UFFhuz `+QIX@]IX@]D^5 ynqHX@]CKXC?J'+a=xJX&D O@I%,p]>&¾*O$aQY p%,OFZwIJE$,9LoV0]&bwKFxIE  IKX0P ) SJ‚#MC`_r%,HV!D'd=A‚D!DyAS-0 &IybIX|3JX0&"z$9 bIwz p|+ df3ub@{ᭂX3P_ΑĢDfX5[S+lh s/QyCόo2a[sfv\w~rrkB|m`}kܾF ;f) RR ]VCpyO$ʣb}f}Eҵ~вmyZIϻs8B5~_y9e=Eu$VAV'h-qwa+$=d؛")Z5H1e'>VQw㯾_`/R) ]X3LmtkgB3KNq_yL[[],v9j?S'/Ժ\lbikkOWa\/[<|~kylHt`|/7j + v 5e0ʂ]:N{ 3/lȰ:ް@ݼa )3Ű(9UlYxϣ#VW+5f(+mSg#͕uVUO?z-3'W|X3sZW}R.nf]pQoqn?5k;Xϝ58^+Q~Lt.ݷs}Ί +Vx=Xb\^XFl}Mj۴Wk;|6Ky{CY<,GnGkt\q-_kZdoQBP=-o-b|}*lwC,[X5J>TLNDFu)>[%s'<%1lꐕN[KbvyLF=ʎ^UJ `luo2NΘRBupy?n=YVxak_-@#:)3k{ɕ٫g;Xd̃2e$Uvmw#1}M&c!zxtdZOтߜ{gZi,x7Ħ'<ڃOj^Y+VENG|Yz1gwgG ,n5^{S(}kݴy{M<~l?rm".yY֧Oѿ:`cweG]/Ϛ;s}"ǚ-^訖6j^zXg-8rٽHo+Oy4k-굦Bg-cM[)xOLe12VDžh^#+w׿tYA=bDߩ迳=+d8f-O^˘(7VM.TYbW|Rbud<%ǹWv{KAij1w k-mڸS?gӁLZ[ZY.ﳹ Z7ob''dK0ڙe_~٤-wǒDS.BwܧmJeoO|"]Vh# +x~+ʑOP~f-(> cϖܳ*Z֙ܶK6t/ׂy湳bsc=pK5];gXVovG46M"#Vދv~J:z[=\=E!{w\8#dh>WӲv)$ESX&E!\-v!1O8P>bo ~f)`f,O&+r1XNœ_<>ARu:q\^SӒۆ +z cήwHTIz'[#O?{jU˺!AC~>0ώ8]X}h{'{o*%q68L/7jKPPt{mT, կ^C2XQ'I VԝZ;/Qzr|4>]N*W6ŰR4k;}^#X~e+F/RizWU~b͇"lgbUSFv&U~y䶩TU{Y\^O]EQMv#KޚkK5ԺP.wo~n:Aݝ\nX [2߽Bcd+_EἳۀԷmdmUGt[kdCEǦ֥XENw/mMyx`Z;R_D*]*kTNT +'t/TGX jT El檦Bm[TVLƺ-B Q|\]u͙⢂uvqTwb#\\Z뉶jҨmf*\2I!M{׋}EV@Shm!T ОA+vKC*1HUXuJf+S'"kdWMeEnrUyݙ6ғCոyu d6X&idku&@dr٭Ƕ${ݜpQ[Qm\rǍha*Ƚ'#'$XMG4~#ںb Տ5{i+퉮aG6tʸ;۰5\4=_X> Hvp6|7m.\2]G\ⲛ05VbAԥgW幺.Kxl?t E?0~ҴG`jJ}ƘZO|ח\o.Pv{ mZꢷю['B[MZE TC/ʲ;*S4vV"^+~Ӗ-FK@7N5+ZK[h۹i=w6 [dZ7i&{ޙ UU+!:3IklY72GؕF^~d[)~&c"kU}/`cF7T>[R-nRP9_hʥ\SEA6Aoߑ J/oqiU> / +endstream +endobj +706 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 705 0 R +/Resources 4 0 R +/Annots [ 707 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +707 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 246.573057 101.433071 227.823057 ] +/BS << +/W 0 +>> +/Dest (cb151-1) +>> +endobj +708 0 obj +<< +/Filter /FlateDecode +/Length 4515 +>> +stream +x]ێ}gy)ހ$`$L{F0`!CI*=cNyxX,JCy\?Or>8KNbpFߘbq1Y +rzs> +\0 5u>;gGUҜUQԌʘ9e,r-`qhr07 +fRQyIV$N3d0QI;Afht*:ti=XGHNk` Br:[$Yآ(4sEu+$ z0ίuJxr0fuQ$-V`Bq: [?,GAC%sE (9P> h@3 -$tJrDl1d9&F.-:Z$@kآHs\p\A$@oIHqLqjo h.@u -I + 5r:s\vj)0RWr\ {qwqw܀19. 2n*#U,7- X 0C4(lPpK8.0]01cl5H,+=ՅA:83nʃ6p\`4 ̨ޕ35J p\8 )]VwAKƒ`VIr\2P ,x{wњ kðe4A(0 +t]!\wquQ<0p8.\>Vg\ Xl!G`V` \  Afpa[)r\&| ZY5xfu:8.pLŒAq~0:I[0T8.T4xϜI'xIqW ^y234֒hjNG"3=]E 0LS:ۆ,~2mU\nz -J( ͸t[q\qh:!8.c˸-A۸t-. +-p3nIXo8-*ڸz=qpx03Mx^x+}\qz6b @s+2^Vo\#Al*Ra?F+NOusw&kLo$c?~{>#eGAS+ ޷k(BxOh H ZnHLyea9 7VsT=qp,,1+,8lkF _)h'ub|̗X 2ߟ_:7k)|._~.~c)b.]7{}us22|m$SNKdSO]"F4G7u7\1_i{XޟҼMק߾_pL'P<nX^эTA>Me%e U%?"|u洲.yH~gӫxs4b5uDQFD:l{u eB h65TA6`Us4>lFoZuemKo+ +*fJhe.*JuN0'\mH\ifU<} 7PV1&bVJy>hWVtS&5<Ѭ7U)Z?k\?7PX(s8^1wTK{WGqmQiXϼ=>wGU~`3\zܿoSH#Lֺ`R; z'eʎ G.6Luo=mz 06PV= +f0^e}U5ܚ bu\DѢ*9r`13bFD˳4UzJ^Ev9w6x˚OҌL)21+ĎV~%mѦiG`,T^*ؾnBGx*/>;{s8~bX䩆kH,\#B5bF fx3PfvC32b#SGz N).U]]=fI.w]ѷ?ޙpH)_dI9,ۮ\nu6ub}ݨs8T|[t V[lܗph -E"G#ؙh(ʼnyJt>n<nnt6Reܬ~s3vdD71C[J$==֙p{^l5wpF_õN Mu3}<׎gtoƓʯ=^r]ٶK[1G;MH1>cYH1\JI(uWeLUpY9rlLY\KEi&<^Ks>Nj4xK t5tvr(-.jVR_ L])%٢4QdL$Y.%-5xǞm%}"niSJnDS]/{K:;@+w'JKzFfYJ%Nuݴ;Ͷ6bg*J6Jy3v{K5 +*4'V =9l9KEƣ(s'$",''> +endobj +710 0 obj +<< +/Filter /FlateDecode +/Length 4930 +>> +stream +x]ێ$q}g"$C5^+?}JK4z2a02+S_~/Z=Řۏ.j +N_)8(U+&cPBr& ײ)%okVYB A9ARsSyASLIR kU6E'`5& +3MkU&h+`N.*`6J:%#贛<%ѓ$QH:ti޻(,lqIiI`*I[, :[rIGH:-?<((Vg7)Ғcu/1E/QfДyId H6J,`bl$рIn>Hi茖lqKL@X\Q[(Y K-֪%. UK\@ \$. 0.Eo%. P.$. p.;%. .{休@ddwPSXD:KZ ,xH\QC/q2kX XD]0I 5 ]㔑w5^e(1BX3$q  xW',œ[M:&/qui-181P^UL(p/V 7Ĥ2z1keJĴ"+Ngxkf $Etm˯?c/* In[ M0gFԍԠ9閍]JԺOX"hU>`V[2Lf'@q¿tPg+9vzͰ5˯?0zP@ooXun>_TW> mul49pC}usuY^LXebaU;v묫-vFUot?-X;xm=W[,{_/ՆCr`m0P =N,C5g:Vvz87od~We/oaF'P{ӡs^o<: +Ƒ|G&s[#'&^0mR뼮Ϸ46;oza, j^aa<?~fˀrȌArvQVWƥ \F.1(5̜ ~m>SO2avYCo |!x?mcPFxG5Jm4.p(͸J-5J̯_XꏯVF='<~J i]S=lqamkRb*Ⱜ=?D% ct2l,}ҺidL|a 㼦ugTF={%筈z5wF[i![xFt+eW~2~yuY ?nGv? vSFpGOgNy:R~xU}7WwĦ'<B򫿰чs!+bQKoģlvk[-=3&*] ZwfW\ԗoϯwk[/. mM!\C~e= iՙϞ=\83@;ʓu9O=:p#6??=ew|odgC?ȇ>w\VFWц'wx9+7_U^緒g^==mғui팔/^_Ϲ̩=ye@+XǻnHEkx7!kh5︖~!Z:8Xjwr_'%=2>rܙ{/9zZi歸J?v [3\gfVܳO)hFz!}>jQ>r۷5h-Yr5Ó/B_|un$EvGGDuv{6XnP!bKxγ!1ǹvjug5,GiuNxĿVk m>%33&7Iy7u~lwv+J[ܓ{ڍ۞uC+={2ܽSZ2cfqpwQP/nbcPvUAg'(?{foTe/\|Y)?.?yNfܖߵ#-;T=okѶ l'2ҽ~AgyUD85g\*uu% +P_S ,`ϯIh9Gs|f};_==;ю}ǽ>:>Ky l|_>|oZϩa`mbi͙ї".hws?e W=>j/sقja-7W6)̭7̭f0E/;/ث;e5k[W\P1 ٧lK{Y Gs~Uv>mjcg@IR a# CkT~W쉈->,rHXBx?cOMwP"2)}J1Wb8Wͩ8殜Z}ưgfik o~&fn/cpگxe,LbdZ O_Sˣʕ6]&WoL!]q"0X}ݨYS+5Fg?񢓝| TGS_a9)jmY] 6 [0$ͼEqlr}WZU QycA^դgq~ Jh>-/ŚPjn]LlkYp otKMW/Ԧwj2bF&udI.;UFZ~]+l+j9At\J^5UwS:)6 Y[QT?.9Xoc"ÍY ol4JvqA(:W(WDžm:^4? SwpM|жA*?»Nl⥓7ֱ ,saKG%ϤJ7-eLR5/T#X75qƕ\讋]BtmtzZ]wqqh#؛]*͎ X;bj;cnH;qʃ}I+KY 9ίQ|߿^_Q-LօdeT8 +۴aBcwhh1m:ג1nZ.t݇Llt&# ^l̷M_SPЫU8ৃuԗ+kGh_ҡUo-[;i[>b,ȇu/*+g &~wF{z}&:Q{qi;,m'Ka[sjm{Ԃ>5zhaL{*[tZF*k-jU3B)/ӎJsWesukq8~vlddnRKR˾j{ea!GWs̝{! ?%cj*/T{pe +6us%H͕0%RA׳&AVZR)=!iN2A|kIÐuޘ"/t-'m } +endstream +endobj +711 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 710 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +712 0 obj +<< +/Filter /FlateDecode +/Length 4684 +>> +stream +x]ێH}g5yIh kAiyq:vUz刼3O l}VBHz1O˷NjNXbv0opg( N'[0L⯧?y}6CJhwGVB A9AR +*.* JI*ADAaR` $AF)QC5Ncн3z1$t:Igi%].J:-.)-lqHI:B6IaV:bb.I.+:آҒ.H$t*UNVaEa|tx咨-*#,l!H:!Fa^VY-l1&-|-*x%L%C h%01 h$7OA4tFKD`lq%&V-6ZbJ\`H\`AoIi/qL%qI kX.{uF ڵkI+ k-j:K\vVZ22`VK\ &F%qwMT$qwM uax8)#qw /q2 wA!N` V{茕 aܟVK\:bD]t ):?I\%` l[1[2H\`Hѷ=-? ؂HQ0y0Λ!е qA4k " % `t$. `H\W4D\i؂ [Di-qA4ѠD2{I #(qA$?p(q v`JQ[@`~x$.MlsDl$.v3J\#l1H\l~3H\lA'qAR~0Y8tJI\t~ӐXߌ$OXzo EMIX$7NH=73DD/"7.ft]D^`V+ deg3 +[Ŕ[1g@G0;Ŭ*ZiEu~L>vg>;6+뫬p];]{/>+UY-B 7:\[[{ ```cmseYY[ Ȼc̎ K' _Q ~̤Ͽt×eqg:iVԞs Q*l Oi4E-sU]EK7¾نE2deƧL\(܈,3LLf3]0yLm=|EmEs +s=~kH*Nr_á2sۊOdq8%}dE-g~.qF_"O牛b<;\أ!nCz ~*wH!^F @%/"vg!v#~Γ-W& s2$HRr3_Ƥ3/佽+{^M/m[[E9@ik=u AF#AqJWw9J?;zsk7P}uZڈYl(1-݁bS~AUd6݉u &vzecfl#㯹}|=:vs|ȟ L=7mQmc̑w-e-Ɇ̕9^>7PēvJ;e1mfVxμhowp_áp=lٔk9o|ƽJ +@cs44}{f?1T\ķ4'6ᐺ|̲zicG#g\;]M#RF7PV=JnpŜ-s8Lj2e4;>{]˖ϲE}Ms&c.݉QVD+^* +ʐ;FCr"w97?=VrfzW|~ƷoLf<5.$Rܞ;v9bF,^+?r;u92߇&n^t?_s8Dn\ҝF]|v28(ٝlv%\ZX^WGJ`8{1"y44ln_án}43NLj zV5#u=1nF'71]:S~`X宆5_ȘeVlE Mϙs8m\S2O:3ionpJM)3tifo5{-zּ_;㮧*<ݚu|NzdZ~_9\uw}nzlr}QPy_~]ز3->&~9Zy=Qs8[Do']{IOwms)akE}̣ݽ>&\c&܇9XJևv9}f}u7por!ߣ,6"G=T~9sx>i>c&.Ւ>"=s8DG9㕹O c쿁۸;gPy}7QZw߈ݷ遫;UUG\ru#s3}ln$s4$jݓ8;= S捛*}==:8+_WU킵"F\>ϟ&}w6R +xɤ~9U^~z^.t13dj|"}S7>i_yYnSŴ}w z i`ҙ_%I7jo !Rn!~8Tq=D?K(&T_FUwY8}T-ҹ`]N jJGp}IBv|cA^/|jГ_;b +?kԖ ֊bmU#tKjbC/Z)C竰n?55nm/}T]6F"ud*$.'AM&Y㗞\1J I,7LR*֪)|5B2lIMQ6=@kܘrrTVb\JeB۴[QUTiy4__)3ASNxm|Z/Ch +l3\:v3effyH<&Bs.+b<>+[F*vʯ3qӕT[žpk+e5ç[m0ѱQ/fIU]V@ +U\iuZ؉K?E&yaK` j~%]eP+Dw\Q-L֙dӸS/4²lXZe4?nLTJ칤. :mq+K7%yT}=la:[]iG\th4q6æT-ɀl;)CS;j0mQumY6ES!mچI=/7d+ڋci!ǎlȋPi6kϖ .Zh#TR:͎d*J!jyX3(STۑvAtEYn7{-Ρ%K,ok)Ւ6˖}ӼmiP5TjnQ!{d\tYT3!:ַQE*z!~gؤF+YfDr 1*h PmE5ZR)7B*ҜZdw:1!Too J!=^:OƟ2 +endstream +endobj +713 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 712 0 R +/Resources 4 0 R +/Annots [ 714 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +714 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 797.673057 101.433071 778.923057 ] +/BS << +/W 0 +>> +/Dest (cb154-1) +>> +endobj +715 0 obj +<< +/Filter /FlateDecode +/Length 4717 +>> +stream +x]ˎ8rWz|,0l7`m_``^5@}*E2DUSVtv"'!VJ_~_$=Ę5Xbv1ZQN>OY`3_._wɋ]RF*C!('TJ[Aq^Py=ST02TA):I3Ș("̰]0A: (%`"Fi7x tF>&D]N#| KEIG%%-N)I[ ߻I#D| +#x[26NJE¿rP'+9żf~ۿ׿;`}w|6Mۼaͣu?^Nf7 ]Tʽk=ձ]aX/}6>>ӕ{0s{{wyo9Fw@"1"UyŖwu*ʰ tcp: ݴ&9y_"Ϝ/`˛ +Dnn`;M(.P7) 2u%u\w/ =Bzն^ۨfP2{:C/m뇠B 5G +OsڊpstE=(5Xs:_7,RNXӡx' sTDIwc(DĿu l7>[+!ԴB;=Xl5q{#;bڡ'$" ޽|V޳ʰ/-'Ds=4-ޤ7x鐸~\׎m}l9f㺭F k+<'uƻ uь2Lat7ӝ7m'Hu +jȬs:nǠJwBVrGzjţ'^"sV +jYއj9jwOą?ޥĽUrޖu.'+{"z{V($)]t3cQ tLQM>wt6I[q.ΘFƴ}9w"X@8aQw#ffv)y-^; e=-o3koxhj7^G)=78Xt +s,v#yv:J~;;nGدG/X+SD^O5,ϲ9\_Yr,լ}Uχ~1֐ꞈe9Rι֍gR[=< m;2㼂b cuNg;{^ˮK,sԶ;XkϮmLu|qePfyZv<{"O{鐸+s"1Tt6KD," ['W“maC 3p鐼݌wqavewüܙ;zeƲ_OGzƨ瞋o0+m#nO[=Xl;άh2gڟڙSigIf|n̽'bуuN̝Lv$rZ摝ga74[ڝ ++9wrn}v?&٦0l.fAg, +QeӑA"Jtgeyl'M_Z~־fm8vb~z|/q&8i5#*KLV_Wj@K IdS  y⾿-NhE]IvY8}T-ҥ`aH}Iʷglqnr}W8*{ǂ5^ݫAO8WS/6C$^5*ULBźkbCS7a5f_ʚsKx[KDi~[iQUfQJ])Y'< E~Jӄɬz6km9wa,@Z.rvM:Sj*#LiP h +YF-bg̵ 7f!]ՕoҮqrz\hYUUK惂OXE5 +Wy*U$*:$ʲ!TL(I#6!cy*yź3\ɅU(NW*^:vW|Pg\?U{k Ex X:ibk1a3 čFFqYo>E&yOLou~!Q{ ]<Ǎla*ܓ7ƃ&"ˆ 1ob[YWP1UWKI]TW-6Ll*tld܆֍b d;7a/m9tckUසt+kWhsВaq%05fff@NgO} FKt,oƻ`E[~&;M3{^^d_V@Vj7.7d/{emYl rh.8F4jS;"uZE TCOʰwQ +5h?v|V :>+~Q6[<^l shwZKFAy*Vٲo]5C|LU%gνNuJ1c{5`D!_(us%ˌHɕ0YVLx"+XSoӛjIFsj _> DŽP yVc~eqPZL |', +endstream +endobj +716 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 715 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +717 0 obj +<< +/Filter /FlateDecode +/Length 4714 +>> +stream +x]ێ#}W9y)c I $$ìyn{fv7hH*[>+/bL釓SS,.+;kEar:߳)$g??rLt˯NZg3va)T *rn +8/Ĕ$p ]̠dLTfX +^0A: (%`"Fi7yttFO>&D]N#鬝| KEIG%%-N)I[ Q'\; Dl@ MQ``5F`` B LI#p[)J\&b" 8zUy3u:$.&b-qRSĤ?q$q̀N!L hK: [dK\H:%.  UWCc-tx%.'%.4JL)` hB/X`e-֑1^nF b-F M^o -$.HO&K\N) XoכQd֛X 6Y qA":؂) &IybI\fa֛- nw]3I:."S/q.Dd+g23; +[- +➁I4XYF/Bmݧq>3nd´ Dmѓ=}{ߧ_坲~Kֆ}p2 ry&m-/FԍԠŲFݦs&bY#-EX*hm* ?mQ2r/u? v{6JG3}@Ż#v0 +1!w~?}?Kݻ?;0wt|FΑ(|vENjJtȞ_XN,ʦG.E2mZ_uݗz! oqU7ča#3rCqCÝ> +bVsVБB@8*y[qi-T;7wx˱M?*'L,i 26^JhzE&[㓁zvK;cI6e{s5v3_SơhXiٿi_Umj}qP.۶VlvE{~vse1No2Vَ`o\ڠVNHF"&zoF~e)卸s͡sjK,܌ʼn2.y^5^]MW#1UrZiںf//t\~v+WzAY!Box_jUa<4Sv&DݸBq/7 ^g/Sr3)V:gya{ȗZdc@ZۛGBI +Knu7)bM"ƢKg7axA<Ȑ{t=@k7o)*=y䬳o"hxIr&,\76N=Hj fwUtK|!Efپ9Dx2[:2̌>?t]m-Z4e͡IIgtL*(I{,0e\vyCy8# FjlT[p1RCDrfIŠWn§㧝A?NF5>F@_V2^٪gxs^EW͑ߊ]+>nv`ӳi{f(hхuVXXG~ϭdmK &W]2XˑnvU;JYFr*Ϩ6t_oI~LF%GMXu0ϽBee2z8`YyuSGQ F6_SDiS뙑V>X|=Km>e^ ^ًHq_1Rx`{CߎW?7+ez0ݡv'fcǼ 47VTG QswގabWo,ocm(6c36{_l):&R{?E̱Gf>mbCʺw?7P6ēXUR:Pa55 ++xsG+0 Qso( 1xϦyꈖ#7vTH= 4q@"#1`/`{CbܹwSc=Sݙ>_cG{kbf=f<бDžďy`CN,џ^?+_?1swV/wltY_be[eq4N|: b|T,5a]aJM|Lp~Ѹj6>TMdosł9sդO-W§d4a/ƴqWZPGɦ|6Ǯ״& ù%P]KD)]kTԤlBm$ߨZ4a0~5>et +$jRM'.'1])͵ +-UYSnJY" Q~\H6XWuܘ+.~: v+v(xkWajVTᚔ' ^ &^v(uHMK0;JHϤR[H.!Uy,źj45(?-NצS2VnƝO8|hn;` +/ٱZЏ.6y^ 솁S؉~LwuVcA/ο~ܨqBNC,;=ۂ>5zhA4l%+*[TZE TCɗl[rK]n։n˭EK@nsS=e% c&Vuݴz ]|d'K_ ѱ GM:Xc/=83akyJwD^Xc"kUz OP}PT}=9[RbVPsuU7e"f7O哣y/Ox +endstream +endobj +718 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 717 0 R +/Resources 4 0 R +/Annots [ 719 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +719 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 639.873057 101.433071 621.123057 ] +/BS << +/W 0 +>> +/Dest (cb157-1) +>> +endobj +720 0 obj +<< +/Filter /FlateDecode +/Length 4746 +>> +stream +x]Mܸs,~, E0!?jCTNdiUT||*Q-uJ`!zgΗO')7 YIU{䅏V{w~>-|NQg-btZOʐ{iUJ*bT +u)KS 6s&˩`:03xEsU+é`3*%aR:"!8V…#)9p(8]98-6J,l`9-H:آ'NaFDF` XlN*NIau:|봴"$VAri⤍Xl1t K>f4Ith -|-;0D%Dm8Ё &p,C{h@G+ +:8" [q-3Ұ8. -5@ 52* |krfJ K  (E KN 9. .Y9. .8. .%9.0]"du(HwIIqbi 08t+B 9.0]w$ xW[\rwF; 7X- X C4&4 ,xWE,̜[ wU(G3,s BEX.3p\XQ5+5*% r\8oBI@E!cX.hIs\UX&au^HC9.p],ޕޕn-4kôe4U!5Ӂws:>r\i$Ё(k \0"z8.pQB9cqXP- XH1p\5l!9.e +7 lqLh :cUNtts\XD/q̀N |-*`)A3t +.tJq\4l7qAQ`F,tF83p\U&l[  D` YqA:``3ś(a <> t"ơエMm8.Lf D\7= 8M$ě`'N`\7p3o£gS!śMwm3q:.9  =u>V#hqL%#0TN_O +!4;<`C: RIoߜъk6cD0l=xw;`_Ki7_i{_ xX|o[&6W;fQ.RhD B*M9ln]ѝ[zmu㷝2OB׫ ,L'8t/uҽsTG5 sP_v5LߞK"o[$vhPm)|zuNv|ms8|xF{Ǹ]qxutvP>mN/zo{9 {F>/UpNE籱Puݣ0g/5\@UK)u ZV`cájŻi=gK1HZU\!&\$6#q[!vOSTUb:e}CW>zjlǎS+g=8GlAhw-KJ?qQnmUXh~c22$nrsܕ5K{T2._;eƿzjcáOhLS(4z;2r]_C tGnc!tſ\z;2y5/Zw1etՔcABz{ٶp̽л|I_6J73f2Уm_W+fGqc!֬m5jG5i-9WwWgwirlZ@hA(2޹5ns8l{گ4ڡIL-sC4o S]w@|LZ&C@muĕ+ v-'2(,z3jr#ȱns4m92]1Cid'#wid_Սuڕ/ɒBZoe> anG>tc!= _LW]ԡ#G4edhZCl]aZn#ЯcC?CLjզ^GHx.;rzGtwߟٿ79B<X$xd(y95x{frW- +;~n+rqp+5Zx!O Hޱ`c!J fQˡG0q)509Tw+am轓~/8u'LczC+,'0/Xǫ+c]{m31;ǔnG$9ܯoF?ay?vŮ(u:Gï_2='4ObM;Lmmo=im^Qva?۸`L^'ҜmzY{YsO(is9Rjr z)vjugK]?"Rw+Zoܓk1{ ,BOtٍuv|]2I~!5 ;=JuXz3oi`gVJ9ɛԊGyڍuİ} }c(4sD< od\v63۽noP<9u|mq'F M +/Ȥص~wIHo566_ෆV79:W l;gG,G{/9~#~pyz^@_tc!s%zտ5gMEp:GCp\ɥ~{GZ{?M79BW_X\Aݙ/jHP~mukY-'뙃>Q݌=2E=u+X5wGgsANX^p=q-wS߽~{7!?<5ݟuiƒߏg =ryGj_ޑ_qN?=܈'gAR8A4ѧw$?U _xnZH]UMOaC8\isCaX J P\ cغʺyh'dKc馒'܍=Ca6lNnxGޓ']J鞝i^ ɨ>R#ǩإc-C=^N֔X'Ҷrzv8Ȋ*M)'L,KJ_ib2Rq$"vR+wu Z.}l_*H|"RDtY#1HT +8QX•Pf#p*qӖ +9ݖv|nžJ/,vgeXL/N$UeYa5 PŕFq?IƭӏaduG*۶(~u2?䗩]q- [­q7f,,Ӧj~Pڌke%\RUE +mF tg ȼtl}=|q8 ep^CQ]M8JEME9aMLlOR>oڡtq#!Ult W LA۰QI> HBEJ˅%i!<^Já5 OC-j'NZAFjmOjlrҼPLfYigX-wpŁ%_|*iێJDێMxKT ׫d%#sm"5$efzڞ0W=SYY]g\tYT2!*׏b6ʓsLNpbK Mj:s%HΕgpC$Lx"+7բd/`RA,D4*>6!W{P&y' +endstream +endobj +721 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 720 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +722 0 obj +<< +/Filter /FlateDecode +/Length 4823 +>> +stream +x][q~_Vx}0$Y6>y8gF0`}EQ%zά0|sUKcc +/?]¿bu7V&# lBr& }~qu}5SJhw";r*ATM!.* JI*ADAaV` $AF)QC5Nɣӽ3z1$t:Igi%].J:-.)-lqHI:B6IaV:bb.I.+:آҒ.ɥH$t*&UNVaDI>:[rIgt~$x0Z ntH8_ba +^yIDɐD&ډ"ELL`%0MSx* X[y -+`M$q5 $.X--X-%.[RK\`A0SI\`6zr$qZp$.`]뼑v-E/qZJZ'V qw1z Ĩ$. 𮉊$. D]05MfnqH\@]CK\L%F]P=tJ\&D ӟ0VK\:}.M:Džq^IDe%.p]g?aF58𮶘%xW$.p] Na$.6i芺4 Z2`T0HZJ\ޓx"=h$.@\0Nʀ)$xWixXҁw +IiSX`0pBl$.'B>Q'\; Dl@ MQ``5F`` B LI#p[)J\&b" 8zUy3u:$.&LZA/q~pI& B-*`*Ad.4lA-q"]贖 ؂hPh"V^I\kIt#(qA$?q(q V`JQ[@?v`&9XGhx%.e$.6y$.H + ⓸ )?q,qh:$.H:biHK^oF UXob'd=7`C"` $[p֛`'IaI$qAכQXo""7]u $LzW ^+((P*n(p/f (/MeU( m8a}귨<0gL辮9Z2l/ǿ\^wʏFS+ n[!JՆ e„+[a*X y^KK\:aYp&Z?hG}$[rC ':ՋEP1@=郍;J 0_7ASgY>`<"B46AAX(Z%է tbާZ6? z4_oѸvqKa{[uN̒"OMW-ih]_pe9.6PnjѐoOՍVQj֎|?O]`ye4e߃qL59]SaW 7k97kfab1NӏX ͏A!/Ö(bf4E;=ـUrqC~/1}n^a! +WھCֲJ$QW5d'7,^m<"N;H8y:!G^c|i=Ƚgҋӌ^-i<ݡe@Af5uaQ׵}=m3!#nK@v,`f/?b'Ql붍Xn֟ߋ][w8qN҆UVqO7T_}w]_EЍ{!N{wNl cReR>o$ESXMXHz!09 ]b(=ot f+gTy'#JsO,۠<ҭrg)|ﺅ%_?#ʥy +5X9Oæ7|aSq!TEgT'awa?"#LPu \E}bCG<]'<+`GZ618 2^MPj"nݽYD:Bھ*vӚ7|vP yEQ4c +K7Kecƭe}[eRNA4?զc{U7.{ 5'<*9涃菸Vrf>kيܺ(om><[m_¯ydC,! s!xέ'<jĬh(c==1EBx,y:ǰ#fcd0,ocm(y>:X͢nN[-U9?$t[{ʢVf_G#uZ~ɶ +W[sؿ.7!sye1)v^zȻ% +OT" 6^ @4Lֽr>?Nѯ&^tEeI7ܱ3Gjy%O?^t¤?Zeq4墉.pD9)fQղHUv))1ѸJ6~= Bz+֫I/b~zr)| +[ԧmwڪNBUĆ=_Y7a5:ݹ5svAvR~s)QUf;R:"Qh3s$RI'n1R +5UlYSfJYE!1lw*v1⨎&~ v++녶+jxiKWahDU)3OB_ڮZ%<6xIW!4.Bl_~L5uNR1IZ+ꪘ)O^]Jtu:U+󺃻6֋C淺V{k'6 X*ibl*0B7}2Z+;W3, fO< ?旔Qi^Vy7ܺ3E<)毸(:l:Xǖ4yܘeWKJ]TWm/t;5v=k i|icTU蛃tM׮H\q6CKˈP\vfLd_IzzWXMGm.܊. B`_+M+{=ɾVjҷ^ZJxKsϽzegkӆF -hucƖmIJVdjl[rKM]ډߤrˌW%[ 9֩ƒQ>wRKil[7.k5C|LU6);saAJU~N="bTBb5p㽒H+k;&V_&E*_'gKJlc l5S-?y{2oKER/Ao" J/q}{u +endstream +endobj +723 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 722 0 R +/Resources 4 0 R +/Annots [ 724 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +724 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 490.323057 101.433071 471.573057 ] +/BS << +/W 0 +>> +/Dest (cb160-1) +>> +endobj +725 0 obj +<< +/Filter /FlateDecode +/Length 4717 +>> +stream +x]]q}_@g$an c6:9DDZX뽃-UDKRS]%Q/Z%bLO)7XL  ©䣻&v)Mv.ΣZr׿UֈCQ%29vQy%p)q*v +0æ8̰ZGFaA* T0C%Ci)Y 9VǤ Щ91tIx]t$s)k%-I:/p8.buqkL [ [2p\@$]]XO0Z XU9"5ЩqAV`*V`-%"= x% `tr\lPS9SN6tSエa A Xezqfh%ԜʼΌDEv9.0JL` hO^l; bV[Ĩr3r\#lRs\lf I$n2q `\f &x̸Mf Yࢰ:)1&؉yآ yכXo£gC17.ft]x` ϖ[K xe+F $aneC܋*1 k$6h3`ZRI6l  Qy!`Ό!_d°뚣%3;_t &)RV)aV|JLB;Yɓ@K-/nVM>a N.|b|#̶iLҙ9Ү@]caˏ_?#` F{@M9KǠ$祬Rghe,ǹ[˹k&*e˷N ّˡnDzp2w]8 +Du9Iú۩S1tUhtK :Sbg-2ȣZVcQBy`+wi'<R* RĻJ`~%=^Dr\y6AZ;d_"l9tw2OS/1^Z|ޒc7(F+Aps%M_ :-Z:e.@5/A]sϋ\ti8BXӡS9͌﵉> YLr㼻r8qp |y}#9ijp]\HA7{F=9|77xsyΆ2}߫%hzƱ'l[4ZI={ߖ⮗J7I+#$9iW,ofc+iB]$7ʱ#9b^16{3e7iɌIkӯK,^G|p|r]֢7yw[Jٖ5Ei_:$Ŗps\?{Wr5t:cWq1m>Ύ|Cыm7rdgOx9yΆ({˙=ѳ}DLE1t:y0^wGQzqgt0{'t]) +Wv/)7՞;^tODk|"_..Zw1!9hAo||=t= ~>|%!7ëIЕDmҽ0Уm?W+`!◟lYx3c0P|޹A:~3W;%126xб6`ӡu1>g}EF>wOfr,CAއj'GORQJ>nK|: +_Dz":lo!uTpխ:Ժ~ JfW¥9,Ot,Pu]'⧓͡Y;}FyNXAˊ7s6,U;yF~$\ (Voajķsߏy%ӊ[㑮 Ҕy"Yѽd5th6-&v?Xq]H}—s:=g vО;mp;(&\_'ùyXpm +yo m^Niij՚[Ot~q&.7}ح&x +~Le-S98K}ᢜ?dR7g*Ñkp6O{i_8P:o{V5_H׼QĢ_nRSêNiݟje^72%OSxQɊyϻeIu9iK-2b͠8 CY˲$3ԧ4N0+ڕ]ɖw$2>.sŌ9ڊKqq6 +jf[mbe$PXb;զMXMMH:']Po4sY*ebTRWRhάzkyY lMJ:Ft\PSŖ5o4XMmHCBiZsFou$6&k\!]RnGҤC^K*\fVIUn$*u,ʆ4 +bII-&#y*yŪ3\IU(NW*^*rW|P{\諾\"MTZٮUF0B7}eVv~I}9lqo?_iNQy/We"ͷbR6q-+[ʭ+1qPw/:lP[BMbK +<5k۲F% +]kC"Z2ֵbud7mžOM8Tcs*il:Ӧ+)g9iҡd -,[I+M+L7"mEt$ \`COhVJ觇׻}1ٗګJei%<^jS>s2x[ ղ {:9mh4®N(F4lKG+EL. EVK &d+2]qd[)TIL[^hM\nd(C:RV_222OsWm)Mml{%a!yesO3cgEToضDmU0\Svw76yJ+5;5FE:VޖJlIX0Fsr 2,) TOC^*4mY-c[Pe.|2 + +endstream +endobj +726 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 725 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +727 0 obj +<< +/Filter /FlateDecode +/Length 4916 +>> +stream +x]Kqׯ 5^+E`2d + M22d7ES)x~tQSp +rEfZQN>La +ə௯7\_/uL)yo?0b V`97`X^ObJ b@1(E' V[V&hXC'VCDQD<&{gc2It0NK4y]xY\RZ94xl Cy`%^,I/BxWyEy%^KH%T q3M.Z$֓oZ# d%YUFYBx gCl50D (HX#M)/aO +<|"Ovdv`&9"XGhx%,e$,o~3HXdA'aAR~0Y8xJIXt~Ӑߌ$Ozo AEAMI$7NCH‚=73DD/"7.dx]D^\`V+ dfg3 +밶)jĜIL@L,XVJL(/1`œ}STfL9Z1{؜_.~{//ʙ ҄ +$!eYB 0wRK4]VBTjΛ1'NcG`xlΡ1AZ)Iu>\֐s!_Qȣk/V|_wg+}жΔF +I奿U>P` <"B26^A(Z tbN|tqO?^~oӟၟ^.R-m ej@́uf[CazK7r>26WVy ή2c~YEOoNҠ*[o˿~Z;gU-~2|ʗ)]љJ[e9L_uǝv +T=QںhvQͪhpov޵k[L|sur=1]lӴiW:|iq4Bcy' sw<#CPv{ 0>ћc7VRO;iMsZc3y8Ϥ]Y<ǯu7̺ŧMxX7YZ7IRGM=4yy~lZS+7avcnkqq؇sq˯=[gK[&v>k-3`7^qGyy~bdF v٫3e.o|G\yyAݷND%X[UXjȩnbέO6ii9Fhx0uoNߟ:ES~Oy4ϵ7`0y;^EG8seee6;'7,mӂ[qM?-rc /pa2嶋{:yȢ4[meb*7 +uY)K'-埅yP! +!=:7mG˞H]nP8On/sr:D*Y~z.*Myێx?ºm'[/[si{e9TbQjVעl(<$Ͳf2V[?s{qi(r-v2#y|69k;ͦZ'8z`ȴұ\?ֳ,_ΰEoݰ8_gʶ}i_wtSw9B)׆+/~:yMBRn^NAs7[7QU&[|A7]#_S8K[W\ˠ05m|~o?vu3̫ H'3L=?&~*xyAx=wVv.4Zl= .<]M7̔Zfѽc59Yt?>?2&Tp(n#=b{xGzңV!L 3'c[,og{iXu"Ykۗ ]uMmx` +F<1/ǟK9%G-Xj*7~h*rev=z@W?Άs}<헛~<%+ǰ1O|"muWOwoʒ.fYzfj{J__,M|B%\er4墑_/{Ȅ I2E6Li,iݤ6qe4\ߕjARoߛ;̣W^=q˕Jl R_5*Um뮑 y4W7bW_ʚЙsx[;R_E*4UkTNTj'toTi`x8rHXniUKZ*h\ƪxuPI7G-d> Umb7fC] P5P^O]UFW8͟05 ߐP*'T]rۮZ'<7+y+ꐤMԥC> <Co?u^Ǎha*JO[ +NhFֱu:nLԪ쥤+'Îlm;͸mb d6m/m;#l,,H~8gے|mK:deajd;g7徺.KxԖپBˣ E0ӴG `jJ}u`L'Sm˺|`Lަږ枭AN-E5jKwJ,.@SV[ E&T+j#B)]oD[oreūђ9ѩVƒQvR+i m7.5A|LU6%߅;s! *?9c{I:jNE!_](v7ϕl3"%WsLd +Pt*n(WKJ ̩M&(UeP UoFgVh +endstream +endobj +728 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 727 0 R +/Resources 4 0 R +/Annots [ 729 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +729 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 325.323057 101.433071 306.573057 ] +/BS << +/W 0 +>> +/Dest (cb163-1) +>> +endobj +730 0 obj +<< +/Filter /FlateDecode +/Length 4568 +>> +stream +x]ێ}gy)ހ$AaX!CI*=cvJbI +R"/ONRx+o(1;۳U{~ |a[NQg-btZ%2TQY+1*.1FN3'MKT0* C^* q*JIءH"¡Judu:53F8O*NsNGF8-VIN[l1HV[tyآ;tV[E#l D.B'KV`tJ lVAri⤍X#53٪6(Nga֞Xls lq$/q5q$(p,Ch@G+E +:8"0Xr[3a +p\` ld8.0`[Z8.0[Qq\`$paqMpqJ5N Hs\`:q +5$55Yl9.; +ḀFIqw14U: CxWIxW{VḀ8 Vj I; l4X>- X ӆ4&4 ,xWE?fN +q\`*`X]ʣǙy^ʹqQ ,x8. xTq*OJGq"nB!M( 貺(d  -i `V8. 8ޅ{8p\:bq t̜F*Sp:TaNޕG x7M O8.Q{q:| [ Xl!O qװhqװ!DTl\DDDxCr:EkVSI+ H0:E[0U8.+A#2t + .tJq\4lA4qAL'9.Z]Huf )T+M0%- 0>im9.M,sXl18.Af آLMqAQ:d @IqATMM`^f &x̼ƥ lQXlAy Nzlё8.Υfa֛ٔ@HMϦ 68xXo"k=3^Ҋ3 l@{<3 ߴFb0+ج*Ji E3tӂݗ5G-fV?}{φLYQ҄ +@G Epa4X禎@S- _foӛr/>>9%ä?wOFb-˗i '֟2eލI7!;oNV1㦽=f X|-F{r]_CM-:9~"4-qoJ~O}7ކ}U^_,{%t]i8=P_{ 9<dǦ-m@~۲ylu S;C0UǰXg; I*v9Ȱ"]یMFD`3'n٪#^[6$h;ڙ))#oGr~_B߮(Wp(\7 ,R-: HHh>R62knoƎO 4m 20}uƍ +H-s8^o[σ-o# wy挻; +w98ֽۤ>(mLxCWQPLjޓ4}lrԍUDPn;\7_?#]TQPfP+kD-+Hlbyg!z[1ZzϤ8mW|i*K/&E#ݧo :o_G:GCkd7s|v,h5t03\ZX^5y> +(&C|q+1"on_áz\ٮOYmqAfn]v]'ͨ{Q&K-9uMH̑1\޳vxY-.lܾ:C=e.c7ب]Ak;;s{zK";r;r/[]9wﹿE:ݶ徫LIq^Wm*RQȭs4ƍ/ɒwE!zwк/}1G}Y}^&7v9j7wą?^ѕ|޶׹c;;ao!h3[uHvk -T&=_cB̀7ˊ'?wCUߑ?llz}~3-*3kdBf .7g[OC7!xicT)H_uP&iQB͍dhbHC\z%9a±kJe;5} yxK`G};gh6`5, {a4P:mzv$ҳ>Ӿ;ARyбRs^C)58+&tiq;`*a'(Hrv%FLwp*K[r"w}IcҸjR}][HBfطd<1#DMtRIvX LGb] ekXR(UlJ;rsUXLoN5ßj 5Ӛ^JӾܻZiEjs2 TƉ]Ns& f7v!J1ˉ-7fHR*Ԫ1|5B݄lIӖ&]<24 d*~>Yϔ+kixtSdeioHH _HQ=IEn)]zl&mK$Uc.VuE(,OV(8]癸iTɜjnKU +w>b_F\ފYxORZoWOa *4> +endobj +732 0 obj +<< +/Filter /FlateDecode +/Length 4141 +>> +stream +x\ێ}gK ` Hb 6YH,Br6 }_cVq?e +1UJTΩIR Z`$`k08Z̰& j-`f&+S%5d Й`%3.)ｋaKH:[a֒0 Qtު@ע.Bg!+6 R^0:[T$.+R"2t Ȗ.tH\-lA4(qAYC#PK:9όD*` S:m'q$HsDl!hs%.Xm%.6s$.H ⓸ ir,qh:%.H&"ߴ,qe74MxºMs$.H [BQ[4%a݂o$-6oF f DD/n ĜoqIҁwz p|k degw 4[ o= 9i3YF/Bimx ݧ~>3| ˂לb<}vʏA0fWX6ao'6;LRB:و8oe#r~j ^}vx`_}x<7;exlyqw~W?\hu8ueln lO×n|ׯ_9m#vն2elJ{z(7hk7\+SS?|w%8yx>V5x S +rsZ_2(}r⮌>ڑlCߗ '.hFt~\DsoFv u<\q ; W:ݙ2]̴.yzFFDvzYOrE/ZcU%>eRWpd:w_~x |tS1:~6#cu;4'NFMϗuf2r^v|Z0ڣ{=7؍6_r +|~:oǭg־ +f/z ۙ#)3*/+%߳sȤĢ2ig'2:ӴDHes +@Ȧ^޽:XkDsL=m? 6=X+5z+b}u(SC:wkc=]awgGls7V{Ph]y{M̓u u|;6ퟎn{YȋCn'i+OC7D7K}]Aƺ=DswklqNGE8Ց|Ywj=jq|t/+ֹ;4yY!Yŧ[wX%q-ë~?sw}_ǭ7#OYuȓwT5{JWXl-x(ֹ7g<#y(ߏ\PN! +Wy+i,uf/:,veB P>n-]Gl!톬T$Uc)6uU)O^讉]Btu3o:nʝO87hjom|^&ƣ8C?NZgRhFONwmIr49K&|dIq}eEX&q+[ʭ q83ZutB7+h~ڎU׍KISTm/tm ;еq7ak ڹizI CmUo騹s$rҡeUE(.SlafdIl?SA #%5777]d]tES7̦4-~z&R{>zcYZ Ot闗9_FEڣ䴥B ^\U S.EQTLYm1\ tQPc&iJDϊ_W%VƒQvr+IE}o{n!EUs/⿗kaA*U~a^plYg{p#6nkunwD^IC1&/EWtMSjI<m;AQ!T/CNꔃޘ ڈ[C&opYlL?( +endstream +endobj +733 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 732 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +734 0 obj +<< +/Filter /FlateDecode +/Length 3178 +>> +stream +x[M$ 賁E>9ۻ6X]Xݜ!z(|T:G"jB^/Oj86|(5d\C9rh_O?|s:{IϿSp֘Q(;C)GT(`{"$yU!eO5$`ď5R%DPz"+"Q# +^y\ФM=.@` te4qG7l~6ǕAqAkI֠K7=Bd|X!N $ .u<.ωE.%#EqeISw&ɓ蒺x\Kfi#ws3y2.2q +o"ě+3_tX[#jU3={h5l=5 +!E 'NU;T ;B=ǪT۷X|?lod R4f;u ym1pCfz3hz{p;ؖH=zılnC^;j z1#1vwpΫ΂]ՠkЫeϾeMJŲA||7#:&.%j#q1:v,{_x-c}چ2o|!#k2#]Wj5C \Vׇٝ&Z{yKjΏ_=Xgg`7c{ YWϏ_ f~ { / >7Ⱦ,|& _%~g)~oNlTзU4oNϯ|?a>|b =G|; >/9y~}GUrk2u7* z/A7;wry |\ٱlѭQno6 c4yΨ]zi =>V{+m#lze ?#]{YVT`S{?eYBGM?=SXc;ow˟|=8>L:afJT1iWk//z2*yɼ6.8nen|K31)|Ծro)>;{j,bft^v^Pk,fmÿMGf?@s&ǕhSϨFPyˏ_4:Z@GLuC̻S^MVOgfsA[o&U|[bB~jmLh&F5CgcxF,-P "uYBch3,yraoFjdPR eC麉X&Yq&2unւ}+ڕ'!C+pPlKkI>&QҪkITy(þ4;i;WNk_`-ZfmFa f[ NAG> +endobj +736 0 obj +<< +/Filter /FlateDecode +/Length 4786 +>> +stream +x]ێ}y)$# ;V|ÿyѪ5[VS1ŨPi*F냠 +F9K*#Y:WEA9yI3$p;Wea!I3LQP ;ZM䬠3^tzt֨͢.BgtΩx# +!$"-` %]-.8-`MI[,z' [$`HωHet\gW>9%1N0H! +: [YﴕtJ:w1%[-{H:[$` _b`Axb^8ƨ([H&(QX(F'р^QQ tHD4l$&p$. h4swVZAE wA!^` VY'q +Sak2?Vʤ$.]0|.+ߢ !K\ LfT+qZҁwZE%.A q7e4+9% `=^tAע.Ag1Tl$.ZJ%8 x0:C [*`*R"2t Ȗ.tH\,lA4(qA ̠%. $Zґuf QP*J\7JL)` hB/X`e-Γ)Y^n& R-V[ M^oF -$.:(%.C$7-I\f ;&xfx%.[{?ߔIAm1,׆A qBd;tM r kaٵ(a#;FRU]*:XsN=6HOCKHWb[^( .-yѽ;RbߏeDLk.gtrP܇`r.qhCGhd> b&FBq,(2-żziqt&\@~*XZuMBZ z-U7 +GBMݫ#,ˑ:9$;No;!/:ocrO+s [9ޯn 9(T_(w&*F:ڬl<*_J֭|l8N-^m]m9ϫPQ .JiݮAݥM&؝^ 0.0Iro+|_5F_-~rIkow¹/y|&nw}Oo;nr4*׵i-}b#O! Ig$%A6e>o.׻Yo<#+|TgVLvem[NH0UfksLy9% m漜خpp;tm44߈SA(L(`m1Vt C.ϣpH 9dN|K&eb{'4h&+w*-}fD^o<G|x4 ϪWU˴4{#Ou<螖bpjɋ0lǵپ%`/#F$ԉ֜TΞem,|=msg{ç7>c'q?di^|zkg}U= 5h3U H vCh ) Rd bi1ʣ3hc*yidL3 Bv1?,ǁêͧUfGyq}LѺ/ݡ5\{m1MVQweeu̅rnY F(gԲ6 +KYiO]R]֩@*,h1K\/66$j;Z<痣:mY7<a9#p[G{#z܅w>Hmqgy mzQ5eziZ-k 7ܜ/q6d^ȷzky{W_IwÏkQg6Qm?.^. {;b7ٻ_l+FnkY0ޛplFh{P\\ +zB׹=c4qAlLl2q<ܸt@y0VCrN{?r燞Jqݗ_aJ_ΓܶG(;s}j! nW{# 5 +lBy)!)c7@7#?Avd0ұx!gLjr + 'seL&_wP8z b2~nee%;Yu2+=V8?6Z_[}o%]٩bAZY_Igh7a/ƴqSl\R[ׅ.l]gi*uk(sԢjZdn0*7)ۀP'A:~kфla-0U QKk:At:|R5מt:^>?5vp)wsi='vqyyj߹B +Qr8鎗.wLGp*wDU&e)=W¾N塱I=`(Cwf2I t[c euOǡHq>~Ӑ'c8*ݲ ȱl?CḮd#uiv,J+$x2Lf4/~{}&,mޤϣ5d+ayW^RP+ Z]81:HS6'cTeJD2]eXm +s-Ib.ai?JD?J8KEK@~s=e% c&Uyݴζǡ =2=?K"{oNRտe'ĤLd|U!4> +endobj +738 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 589.294475 101.433071 570.544475 ] +/BS << +/W 0 +>> +/Dest (cb166-1) +>> +endobj +739 0 obj +<< +/Filter /FlateDecode +/Length 4512 +>> +stream +x]M$9ׯ3Jh+!`%@ #!@kwzf9yvHgdevM3*ite?">+|Oz1oϗOOj +NO)(o7V6LN',0L.yӟq粎>)%o;!,M!JP)Mʹ)㼠z-$` ص* T0Ud* T0C'VCD Q֒tMNd `$NK4y]tsik-bt'%`$]-I.+:آҒ.RV%T q3M.)IMuQ$-^$`#e$IpbfɳiI`1:؂xآ(3hʼ$q aXLF%01M6h$7Y4tFKD@ +8%& [,f-d` +H\@[% lk tkU*%. .T(PJ8H=H\@`]rH\@]K\@]ZI\`D)` ,qq"I %id$.NXLJ 5QY ,x,.L$q[VnqH\`/q2 wA!N` VMa?aN&wu4 ^IBE8.3J\ xWVjI&) xqp4 MZ.M*(qX'$.Ld<)ġx.$q*G$q*GF5a +s BҁwK:R!I\yٔ,0Q8! +6h'B>Q'\; DlJ\zJ2F`` B LI#p RL6dyUIZEt ;a)`/5ELz @S$.i+qAHSE,ES4%-%.@ D[ J\M.+ Bc/ WK:>3J\r(q v`JQ[@`|fI\6:BJ\(qA(#qA₤` "> S%.CIG727 6 qA!DuAS-8 M$+qA>73DD/bo1]u $L~W ^ʘwQ(P* Us +Hbfbg5 +Vb@'\Oa/[[1#ů+lzd2;r+] @@%3%6ָO_O/=K쇯wvК?ӠSPS:7A.2?묝n~ׯǥ+ڭ6|;Oر7˛vu_}oNzW8G[\_dl3ggdN-7yΣD9xXzxR|EW5 3HQ{^o}>ҋ_l5jN}XϦG_զ#}mE:l +C:Z{WWx +hqph=nwB1~vt?쫲FͰ Բ0}H>XC0 m0>#I[7CxKn{ָymv^6 #sr:ƒhu avyGˑw4mdhYQ+t̨)>};C~/Tm7,(6a6e6~`SF:qh:63$Ui]w42|az'㼦ugTFk%5[jpz%pCT}k5 ӭe+k|.c-cr\W3njߩG1r2V+NGJ\X۱t~/ʽiJ DzUv Q +ep2uJ!x]5O1/27UyB2ˍa*UoG9%.Ƣ}7Y@'1Oax4]NT>NcMNT:L8V7j?Ry*QV.xNrx9;Xq4_Nh+AqUkZ.”ƒN:Տջ] z1Xkq{5YߎW|ޠe{XbB*][:߅t:͆5 -ni|omzW3*5%ۀ6Nr_4"lىWa@\$[smB+{T=MP/Ȋfi_(戢q)qCknJx99fb\JUq!v8.ͯ\?ajVY>y.{ +פymwf/徱xdkeQɞWRF50[bA{M&4~˺{-B}ĦAhbq7-Ա .P>Z ~;]G}I>&q%ZkXE\Fq:LݲlCA/vˆ|I]g2˛rB`ayia`}6ڛKۍei#*͉_EK ݩ^ŒQy^Im/IU.݆^ͭJ̝k! ?%c?| Ձ R{p_ ldW׹+YgDj, +:3l i_&WKJ9`"gWÔ%!.C*oAi9^|E +]P1[ +endstream +endobj +740 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 739 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +741 0 obj +<< +/Filter /FlateDecode +/Length 4175 +>> +stream +x\Kϯ|_Ⴡ $p"Hd#XsW&Y];;l9^VXvgr/NOh\47,e]M%1!dk9Ngw)ߝmw];X՘ykUD+<MғΤR}Uy< L.:WMJ)G%V4^,YY(d )XY|Ae⡝ +dwYlN`b-D*gK.GxΙ *#gs 2ik첞];fcK +k = +KrsYƬPeF-Ͻ->I:-c:yEP>TzOiIРEϩv4^#g\.AAٍvyom&t|+ '+xs=s=2 {\yO@>s1%'6&Po@ӭkִM#CJ%]u}_L;ͼak}HZC4UޘoU|d&竗'(Q+Ҿ [42g_;}o|{:A#N_Y=~exnQf891'O:, ~yux(Ƽ{;oWQ:7,zS؋y)o2*\\/_p_,$* I\}mGoV>).7Tlk;^ecV9fkg&wjQڢj&n%y?jt.p>^v]NJS\5и.ІR~^eцK덇ija>lyL8)&|oq:]o=,Ğӭ~M}ھu\%5\ɒOUɜV{Ix=uz<^VÑV"V\v~U5*GWuM{}L{@(I]PWv{vi0lt{UScQȴtߦ]>io㍟uL'}s8w;j&_1cXcqY: +{mJFh;i/#ypdh}>9#ugxO:fXva_M~Dkj5O󮲌?v R{] uۯ{Z{-| 'g8h&G>9ycpXfvf;8-La>-ֹ{s|U~ǐV얗d/+2^ks(nDFe3;s6|U7tlUEɖ:f^t޹ bP5zҚhk?Vtg]T3.pC^LwW8e"m]逖z5dl;wuP`?ԓyJJvmWSΑHCLM"{RkM/e;N_A㍴N(7jqvrJ]}.W WZ=!DƐS^X}RCbV|6Yj"3ۛkfhsYi6k[f7E5/sI݂\>fP]I^G퇣u%nje|ūRsumVk!{#^p0X+?*e{ +O-n(Q!zn?FPcQW7^_@ NY5O8_xx1mdHp+znxo vV8X*ĞbO̷x=T!PuoϧMk# qB{L3YаڃM0Y~ɔm֮[̏Ʃ9;--Wq|n{0]j qu?^nG 1~?8lNuಆ/f{JN뷩?D&#-6frM|O%Ti+fw'Wɰf{ىm$ߝe7 F2׏vJhTk:Į壏}5?n"("z&w$Qd~aP1aJC c@m瀳d #ъ&SCuiRuNYr´aOS>T׮PuPco9 BN +<_>4/{/F)ImhUf5?EPBk:Z߀&bĆqKak[r4"q۝qbo=w2tU!4;>8.ŏϫ9 o$iipg[.Y/WҞAwP=.- dhnp yGF;&KN{Nry'yX c\xidv'doG  0FG@'~[8L˸|υRp*YekD?[ė<@ ?uC_Vn$=8F= ؟dWfؽaq^n'n \ISzfeQ<63a/a~H \ 3%Ő3K^tąb:%ۈ)'gI"\B|&fCwZ[h8 9099iȣd"L>w:x:5˴9'SCc b/"g,-hs!}TP6rRͤ=Q v1wڭZʣ復PbVIڒ0f8yt}W 0͎_epF}!9ֻU.q +3#J˲qɷx~umࢷ%Zj +endstream +endobj +742 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 741 0 R +/Resources 4 0 R +/Annots [ 743 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +743 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 237.094475 101.433071 218.344475 ] +/BS << +/W 0 +>> +/Dest (cb169-1) +>> +endobj +744 0 obj +<< +/Filter /FlateDecode +/Length 3981 +>> +stream +x\Ko$ ϯ-X/@d$p9h+6:|WPV+804Yt=~_YlM%E>>Ȥ@YZl.xp[bBɤ\ǻ.w:k)%:{rJVWX!\ ++Z% FH 4`sU K5İ%$e rXG 1{l0JYsqE%lr{`5^11Ɛ5CPjYe&Y"dѓʃ,.'dqNQxʃ,jM(Y(|sLޓƳئWy(lRL +AH<<9! W'O9+Ļ=ydq.ʃ,| \, #aKpqp次pJ^WX,xj@ x Y /aw 4,8x-Z4,[b5,[&5,\Ix ϑ5,\RѰs=SЅ' +E#aq4,(6#taRͬaA|)G7!K@ -0 &IE +kXPb|3kX0&"z$%Lj +IwF p|7$g:3KƙՊzVd@^VIWr$h1YV piI-aZ}KTpf$,p Ftslǟ}j_aiͰg+b>"\$`i+2ZdpFR*7(?DRe^ 2://!<(rBDPe*:d}tgby^&C?˘Tv +v9qp_n]߽9^? yq8ro_conFqD  ^40Hچ8y=Xd +7ou$ KDe#3!\,9Vg|q3 DK|qnև&lilV+//##8[u[]f _LviGo|8 &|~Wb:a}WNxLvUȳ:D,7c =֕*O+oY]V/-ۊJ?ӤaC m@UWǫmZiiݙn.D/YwuuexQGAHyE6$X@ +UVH/_қQ=LUXjչeNmc̋M6Ffl +67g< }ڸm];U{j!s=2^W]]+VT0N/I5h}`=VlQr_8 =5y594J.'"Mvٺ{e'E^CH?ntƑnq[ptƩHz7]b;P!A+Fry.*l8 ts;*/g'ǬˮjrmrK|eaLPAprM~+7*ؔɏwGz}"mۻ齝 GT38%yExyn~ 檛"[;$[YrL6?\Ř";CV5Ňyu ̪ݨ ~rȫ)MhxY ƕY|Rw^JfA>=ծgExf)nkx R2ϻ:u]YŅ-,>/B؞^} ~j +h*Yj\L%zFr}nG(R6s=]mVH2C+cu̚PZʒi ԾKmK4"Wu^ 8+M6A#xZA|Z* j4Լy8h*]ԙ]_4KrF䶨fvu>_:mA63.mآ2fU4݌E+|ilrzlye_`6⿝8pgqGwCƓe=&X^=a1Q"c˧!oXܲvҋifxyyΕF +% \o>k)zg +G9r~Ҿ6y`o8mw^s`HygX 6Ѫk\ӷWTSkaK<+vuiNn秫|7O#~ߌIM~$solEN>FC9ʳ<۶MvQ=sydCoU'yNX.j?&"+- gV`օZ75˽ +=='ꁋ,OgU좄dCs1 zHtc)8]Yuv֥i;/OL;*Ϫvu*Z˾!I! +Ӯ?+17Cޮv +tPBߩ[ѵ4QUj||{%K5ntwa`fz3Ovra/rS\y BETAnRrovVI3=vaMh;˦mv֗ͤ6Ie=&T-vd3nC7 yE;{ry7Sq+uy7i9xOmAvO1DyBnINχs>8Iע<e5^<wulݐL#_Ioh6lh5s\nM;t쭥j;w&É:'̈́ N=ؽzHˣcM*\ez߫ȱyP;wL j<˸g_jyX~=߃#l5nA'FLQS)nM-ˊcAytw+1̻ʸђP9hcɬܻSyv>7onqZALit g-OQ1U]*!6GfqPM[( a"y*> +endobj +746 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 574.323057 101.433071 555.573057 ] +/BS << +/W 0 +>> +/Dest (cb172-1) +>> +endobj +747 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 245.381993 101.433071 226.631993 ] +/BS << +/W 0 +>> +/Dest (cb174-1) +>> +endobj +748 0 obj +<< +/Filter /FlateDecode +/Length 4873 +>> +stream +x\IqׯIH ÛR? #E27QE74K02IƟo IdTJ9~x*zJEa_!LpQm ׷ \.U9koEN+Xޫ+[YbA Ҟ!% kJQ4nFC b2rȃ Yg +Pzx֨"/gxΩx# +!$"- %^,.8- MIY,^,$ HωHetiϳ+aNaGaBxȃ,i+d!x bJnvFybm$YYt `)% l% lr% lʊbt %pڀgNCOABg a<2IX,dA ,hK t68-i$,p\%,p@\IX0,a:`%,p@]烕v a:2Z:"%,:*g(awXU; VMIKX@]4IX@]D^T؃NZ[<7pzm%, %$,(. dJXu`0eHX& {hLA5 '2-LY܅rx.3IXWV5ZwZE%,9(@7e4LWesJx.`JX/t`HF҈C%,],aAj aȃ,.Y ׀m+iJ[ jx]c wmJX"l*DV‚H!k򉼠p%,y"IXZeBgB  "P s,%,$,> V%^*EK(aAȥT¦8\bgH‚! pE*YD@  ,%,H6! ZxhP#yf QP*JXmLH) `B'^$?H6<$pi7JLf&8X1Ѐ^* 4*5 I,@Ld)UU0xvTU9D&3!9h4[c/p׿R)k Qڲ6cWG%a!bBb-ppȐe6fʝj^ +k(|}N9y^E!JǁH7 ycBwX8%%>O<$JN$PS\<Ť&8T{χkvwAן.tb͸\*䯟~ǿ۷2Alc7|G8z)-|,jv^tonC<]!M7}Ynʿm㕶ӷ4g/C!T)7I-0m +o_ǶFq;9, E1 +('VYnM#]6 ҁFOW-8+nk?Npnrocr`ߑC IocYAЄ(ͲEF6ZȖfdFu*}i{5yVZiunS1C6Ffl vBGu/6//g}yLѧ뿯=59uO+cΚ>y$L&]Kv=H}˽4\&߆pKuf[^ͧ\t9qsReN~{|oc> \#9iںJ$luE58W~W݆;XҿKpw:$:sv3]9Ѭ\5H 9O*hc"Am3w3FKZ`1*odk݌su\wD*4'/IĹ>?:11J-,LUmPf>oioLtD; Z\Zۗ6SM#P29d\,&wcr.*_~qs_2 g&D1ʑmΏmB3 >H9W?UV=zWB)}6%j.qìZ*u7-QzU4g-=(Bqů\hɺnVo3qh$+wz^ iDŽJ_qW +ߓCl|T髖aN2Y"3USQϿ?wt"e"SuZTh<^+OMq1Z>5J6e]C]M"Hy/)>v).z?w#£%мs +;US"$Jn} +Vq %i˯'k>C|.i@l?QcuIˆg<*2QtsXV`Zqv?ζк8#"\Rv*Hz;A@}Jra]N1g4Y`C6p(2B0.t`.0OTc>C^BV~ץ}o0c+D[̀f,JW {׻oZ) x0d,@fј=be($^×RU39;?O_)GPZr +_,|$w`b>a!pƓhw3t:2#:E?oKD +1Z_~jM`Y3I's33HpmáHFCHN6~hiVdfs1ծGgSMA)ُ%jڻwx}:p4b S+1(> +?^m}]?~{ kyƃwݚ*WFrv_8竁+~ ? C?$C0A~@ g%{#}` xuSY76` ^4~|}cT|7m.Xt5*%;P^?:Z &#+FHꇥc|9t8QFG:s;%B"ɵ3=O {CЏbO۪C9޸k_&ٌ{lCg\y7E *P; /sCFJMw4F%\G4=Lw;^ꎼj$R{-ۏPH`Wi4d'0reJ-)5;=~_4?Qq, Å#Xi.]ɶA~H ҇d&֟l7*m g_ai}[7~tk[=ٓ2߻KիE|Nv 8:zn-5y . b}VqZGӺ-MWPM&rֲ/uH@F ӪJbjD]n"RJkn Sw+^UjxN{m0U_k>\`lA]<8o~`f䤇 *pl4@TFP7)>=$7;y:ꐤ.cmvoϠ[w&zM<kV aM?+gnB`AݔV![>Y0> o397.owFF[2~j ۍ& 0F +֎N9sl2.7gBgKrse6\ŏ[vl]gOM'Ff"Z`Mm}ǭFw=4AMD?t8m7]>&74o-@Kf8ҍGoToipiH\q%;u<(. l%&[1RTBL3&Rp5 !g4Fqd_iy&,"t4%~Y701c}_xKSP +0)b./P*? e*? +endstream +endobj +749 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 748 0 R +/Resources 4 0 R +/Annots [ 750 0 R 751 0 R 752 0 R 753 0 R 754 0 R 755 0 R 756 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +750 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 639.873057 101.433071 621.123057 ] +/BS << +/W 0 +>> +/Dest (cb176-1) +>> +endobj +751 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 280.181993 101.433071 261.431993 ] +/BS << +/W 0 +>> +/Dest (cb179-1) +>> +endobj +752 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 261.234971 99.933071 242.484971 ] +/BS << +/W 0 +>> +/Dest (cb179-2) +>> +endobj +753 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 242.287950 99.933071 223.537950 ] +/BS << +/W 0 +>> +/Dest (cb179-3) +>> +endobj +754 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 185.446885 99.933071 166.696885 ] +/BS << +/W 0 +>> +/Dest (cb179-4) +>> +endobj +755 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 166.499864 99.933071 147.749864 ] +/BS << +/W 0 +>> +/Dest (cb179-5) +>> +endobj +756 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 105.552842 101.433071 86.802842 ] +/BS << +/W 0 +>> +/Dest (cb180-1) +>> +endobj +757 0 obj +<< +/Filter /FlateDecode +/Length 4690 +>> +stream +x\[%~?< `!bI؇t*]gf'FOWPTʝ-~r/39|ɚjMegg)v%f>$L*SdNQxʃ,6ZJ0\2+ٜ-!XafPyXQ,rQy/@NpH9+68ǐD*`55 +2K O e +\ 4 Œ4ցB!AprUd 4,!@OAÂ%XpK8 𖬋.Ĵ nȑ4,\RѰ sSÂrOn5,@9jXհ!ʃ,0` &4, np6iX@],#afspgKp' `а1sw=[aw=a  w!a=x>hXƌGXaw]S4ʸ\ uӧq W-l\EQ   <װ.Sk[T3sA, BtsQ,\)_NYqji=cfD f tM6 +NI!ȃyj\q! Y_ 1A9 K;4wٛٹFӃ@ln#7A}I8<j?Ib2PSiRlCM*!E,GQrAf/w5̙:ShY`C6pG29i0i.L; NX\'9mTyDڻ{+OLv0F2F`\*^}o9c0Mbއ}yv;a +hUiG\r*RZK/_x_-twgfANJ+c_u9PHKzWHȉ]0\,',7Ft<Ӽ ΎsvSr+qv^޿,!8sCb6%^y҃9ǙǞ/WL$ybj"y]]y/DMY(&ҰܛZ&]5aLfu&}>ү["GT G|[JwxC;>{zaZﱐyFX#MZGRgӫ/\>ET:\'>%9u\=VW,GӐ+ 6^:d0ފ/sMYJUyr߼b}#GNo9YYc}us𩣘-F+- x/QSƤѥ2ϭ|ơiP2vetp~tQYe $vV#~vmbܺGN Rg+"w3GEtK{\3qsOY^Uڠs瞎Ttuvsv:vuhJnN]W}ځϝ:%Gr,w(^yie\eޮ!o1ǰףQNރ/ano[ύcZ#|r̓]YKL/]rvt7i?=F^,ŢgIC}!4=-r' +n񽋳PڦhR(JI`%mޭ',Myx9۰T JkiN PSB}idv4kZB͐+Brkkg*RyT-MCa!w+[k]ny ^Nqt 8)y`fz31Lvr^q*,Fr*SyꅣnRb䭒fzCX;PvJfg}ɫt؆:l%nu,ӱr&&d!9/U&s ǎo39w.oowFTF{~n ۍ& 0F*֎Nv9q/l?s2':eqo;ZqA|2&dGYnv4n#ܙCwӕRfbd>un^nAOФ< %&q'EKT7s:,Cbs']"?Sf +#6  7;7huSa&7wZ6(B?>yWc[Bީo3Ltjq{}NO^mi䌥1B 6:QSjMQt6Zo15Z8ZJ=Կ͚yVyx(+6ף 9QǒYŹv(7mn< qDvTCɧ~0A+~N,pr<Ƈ]c|--QF]^qG=a: `&"Q3jŪCzs[ԯfǦuC&I#A^y%nJ?OZ9 +endstream +endobj +758 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 757 0 R +/Resources 4 0 R +/Annots [ 759 0 R 760 0 R 761 0 R 762 0 R 763 0 R 764 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +759 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 585.573057 101.433071 566.823057 ] +/BS << +/W 0 +>> +/Dest (cb182-1) +>> +endobj +760 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 566.626036 99.933071 547.876036 ] +/BS << +/W 0 +>> +/Dest (cb182-2) +>> +endobj +761 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 547.679014 99.933071 528.929014 ] +/BS << +/W 0 +>> +/Dest (cb182-3) +>> +endobj +762 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 490.837950 99.933071 472.087950 ] +/BS << +/W 0 +>> +/Dest (cb182-4) +>> +endobj +763 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 471.890928 99.933071 453.140928 ] +/BS << +/W 0 +>> +/Dest (cb182-5) +>> +endobj +764 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 410.943907 101.433071 392.193907 ] +/BS << +/W 0 +>> +/Dest (cb183-1) +>> +endobj +765 0 obj +<< +/Filter /FlateDecode +/Length 3012 +>> +stream +xM +H}I.qoyYUn`-R%QR5_ ?orۧ ¦%]-td)K>_箸V5rtTBPrT *bqT)Rbʎ*s[T0#*0C[M +fhQU!ZXU f`TH`JttBӳrmDB.ʉ=] 9T=–Ԉ=]-UZ<]-\l+%;U؂誮P&tMBjU5訖B"CBlÊ$"lɔ-I(z:-ON$):5t XLGa !+(<RbUGX[R@l)hnClI=uuEz,[Pcl* UDn{,Vpa&y,WjV"sX .{X =+ZwE<(+']lA{,p + +SX.QXY b@XI=( WW֠x,Pp7& ۹ݘ(z,Pp7j (!7wX( XHK<$p?gMVk Z;^sX]lT gXcAwYS{:pc# Eސ< #X-0!t]] jX]`)z,.${,!X]lcAw)x,.)W[Fkòu4@t.1fӁDy,m r1A ``@=䪡=F!su9< YhQHCV=[$F%  ȾlA-=d6U%eUOcvu:. Jр=,*>Xf@걠4؂[Qc؂$c2]=[ z,┙cvh%jOd걠j*z,2ItuXvX8:"I=Y= +["EM;o` 2>r4c0ǂͨ .Y=4!7qsmlⱠ)lIHQ\lAԜu & :y [bS-g;oVH3pDF^ T;oM dt.27zg{xSA~+8{c@@o^؋ݪwɽ48Y`[ɽ6 >0a}Z2¡`Ϭٰ,8sjB~ן/{ﶛQ KiܭEBvqDM.ǿO0OJ1 K]S/Zw=pI~WG=xQִ6>WUxw[mC}ɷ˰a߆ПyZoEzcچom,x6n[{tw9^W;ˢ.#?zNtLr +Wԏ 42;#Pz< vvj3 RѮ>F3M˄isƐ o?:pLz> +/_ev+vI3sL}XXkfRc|R>>_c3<}_qYmpv/k^ywB[t?=ڼgmǜ==mBEIJw3-YepHྡྷ1[4iKqD[#kK֎0Is:h3ږe^BxTo}˳~ŞTZa>_v4zr )r 6jqՕ4Xu&{-R8Y #=^&8݋/P1+&<>hKWۅ@6?Gcϧz%َ3{ǎOf~)!5QÔu;~QB0= +inv{.W2n,t&]ЭK]Mu8eՆ4cBt̓#]MC̚]IG9ŭwLQG[4exG&ɲFHdzr1T}?_Rqj +J=V,q/SZjwfٕQȳ}`!e׆4;9g'<XˬK1+9 Il3H xk{Ƀ<0M.8B7,Iow^aE7[Q[:ܒK(YչCqyQ۴dpٯT4Š2u:ٵ.FTA +,kamXyq09`ҁ!}^c`&8Z/і,kOF3L-TXctQ!j:demc-ۈ2r)etZge81Z}ْ(\hdudy}zHu֔.{[} C!yf4K5߲vgnZg ::aV.e"1՜o~~W*B+ P/+Cmx⎷q!4Ŏ`7 +n{U+ +to +endstream +endobj +766 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 765 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +767 0 obj +<< +/Filter /FlateDecode +/Length 4222 +>> +stream +x\K$qׯd{`Z6@F5 FWfFWW+L*#c;3ɹۧ jEe8`KI>TKt˵巿m^)%:؛S +Xd +BTX,1BbgV\rX ++C 3@ ,k,aKH +䰎HAbN`"5&K4&&jbb!k<,xLIE'Y\N^%⠝2dweY(xśP2+QNsLޓƳWy()& KPTd huݞx8XA_C! A".iR2\k 79k(r1``8' x,BF< kXdA ,h xiXcx] +iXpchXX몼baA؅ e Kd5,BaAb{/D.5,]b=*4,@^Vi$BwK+ۦ1 e A4,MI)jX OEaA" KANakS|$Ys$Y2hX[- E S԰Hfraְ z Zxљ*/g)Vl5,@-e2^tIe R, 쐙k< YdkXLr/Y䚭"B-+YO HF9JsI+yZssMoaSmM"݅YbT-6vtvojXZlZh16ӢuWreIwd{[|;w.4{ZH~l BPF#9-cPT]hPTS;~o_%p%SdW5| [k} YE/Euŋ"5{eAx_gxI9QQPΉ!Ԣ(-}Wrץ[SO*x7o{>_H֩ 7/>_\뼏>_\ +R{(Ɨ} +]}&`7⳰aOrGQ?\}?w~Ed!%[!r& +qq ?^}wLob3٪$s`,lo,CY09˭]:[q\5O<`>yKxiTm) dǵ~u"mL**֪-vMMZ q';v|HPC,uVpǹv/򰽄qYn{VU?v} 4l +~_p@ !mܭ}%}uwOkG]%oh}vU>{v=m}kL|Ӣ|ɮwNZTy>iη}{!xx wV*\sKwuqpx%paEI_<}x}1M>/O]sGշ>_/i?b%|k^g~3ݝ'a|qӻZ#Qxg1,M>Ăֺ}TWr8 58 L5>릚qvȋVr-EĽnA]G|nFxv 0aOl{Te!u`QpT}}&Ҝ3s|_Lyh 7{ud(`BW;c#9Frx8{^ :ǽpگ#=ZqxE6Z~yӝgR wt׫s&O70i3N/r5 N`rc>r}7_yޟ\rG7E#ʓa/7ΝIЖs.qcjZݩQ?7yCjp"ҫΕȩ"T*f?}YyLqNRw1ӥ8;]䞓&thƘVWrce/q+ZUcpGyv{pY*l/>iN^t-CN?$[M&\1CX^f8/G#ַv3dƺO`P}zB^g?>aK- +@h\&)^,K O.ԟh5 + +endstream +endobj +768 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 767 0 R +/Resources 4 0 R +/Annots [ 769 0 R 770 0 R 771 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +769 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 484.294475 101.433071 465.544475 ] +/BS << +/W 0 +>> +/Dest (cb185-1) +>> +endobj +770 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 423.347453 101.433071 404.597453 ] +/BS << +/W 0 +>> +/Dest (cb186-1) +>> +endobj +771 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 106.050432 101.433071 87.300432 ] +/BS << +/W 0 +>> +/Dest (cb188-1) +>> +endobj +772 0 obj +<< +/Filter /FlateDecode +/Length 3943 +>> +stream +x\[dG ~_HT]7)" + aɀ)ၿ:us=h;...lɹwO֤`jTM,'\9%J)Oo\?ӿǸ7DodRNUV&%Š`h,{>Ƃ}VXb'GGV>9XÕykU &BQygb.K^1b %8f SN/BdUd9KC;Ee*h+dB*gsGLd5s&6IpH1)<Y EA@k<,rVՋw%d>ʃ,8| |,6E AFpIYp次pJ/p,I<4 YG AjXC1f]@Hհ 2.aASyŸ+~ -cѰ wHÂ|f kX5pb5,] AqH4,@|3tU^1aAf K4,kX `aAlJJQÂX,xHT^4h !Td 6Jְ yBkXOE=ߧ_JYq0~("n pet &rm/G|""2EtVrlypC^!uY*y /dn2EH/T!)2ۺc޻Bu=Ǽ'Yoqٶz}lz}l{U~m)8KߣSoN*w4y9fVwO~/7O>CckC!܍@G<~\6E;7u4@/KB^js1pͩWE]8UGڔ*^5D`\aD{q_uSh: +2Rƹz[?T3Og(cs'j !ZnaYKH e]{W޷qo?]]#81xE6gMuR5Ȩ.6|_iE|hSѦp +nz7Lޥ X޻u:yyc>dcmMdLZtmVTSmbIY+ -~C7 +͢bm_~~^B+澯OskݏZ΢j!5UM_}Κv]vC K/ך껲_KZvؾt9-Xǂl9oQk{@,t-C__u]]LB"=mWbnEf٣ۋ\9*,ӆ|䮮YaAʾ/RdQt˧./럥9ݧl/[R|HKW՝+$˱Z9Bhj)ݏl9x un-;seIؾ?kW19sd#(Y>֝-bW{3Ni_+lbÇI~>IQ2^1q.&S=q}e˝r{)59>a`Տn +DH[Y͆Z+QB28'p|Ñh&sCuqrOq#^NXg* v4Z*zq /S%]gH2uR4˔JL1uzף Yki,i4ixuNX Nn]\ɣjD:}PWؘPTx1{Py\$gL-BsXEӮbhƌ۰j)bRj:2S2ox#[՜ܝ=G.Z\G*Ϟiǵzm6x +gfjp*{hO<^DfSB*c|@⼔FyZɱ"k%J8D69j1]g0ˌecb-n>?T[\ B(_%Efdow+J/e/l +endstream +endobj +773 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 772 0 R +/Resources 4 0 R +/Annots [ 774 0 R 775 0 R 776 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +774 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 770.673057 101.433071 751.923057 ] +/BS << +/W 0 +>> +/Dest (cb189-1) +>> +endobj +775 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 453.376036 101.433071 434.626036 ] +/BS << +/W 0 +>> +/Dest (cb191-1) +>> +endobj +776 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 392.429014 101.433071 373.679014 ] +/BS << +/W 0 +>> +/Dest (cb192-1) +>> +endobj +777 0 obj +<< +/Filter /FlateDecode +/Length 4511 +>> +stream +x\[,m~_1T ~0$`J$B6UX]Vk,4Ytj|e_"R1始Vk+-V-~MQyCࢊ/\W_1Wr`9S 6N`yb>`Ă>=+B K,A& hܞ!$0Ge40VkA4x Q!eE^D+S!FeBIdY!7DZAr)JY\pZAxXh' Y`]IAx)ӞgW>9%16ȃGaBxȃ,i+d!H`Ui x]mu.$, +Q $R9 aA<|"/(\{ DdH V$aAY+aA!T6\ "E d*e" ǠUJp-x&JX#)FR*%,+$, fWGJ3At3F‚d! A M2'4rIZ<3IX((%, R<ɶM9"8Od9LY69ߌd YIXuP&KXOk I7-IX|3IXFOQ‚L#DyAS|$d$,!p$,@|XHoF\$񀻈L@V5Gg23qƙĊzb@{qZEf#E2jcLŲ"&,էD`gf D=ܝfK} y޳j=eE^)9MyE!5~(2i:]jON 9©Nyw>.+NswE :՘7!k"r҈ʉžB+H\Gd\'_=l@+`@+-ψtF:jODRuK~ivAV_?x~z|5bl5|en_ow:^?}s0BEF0&6,C:թy}c_>5(:oƢ-=yE*E,- 6$ s[O%G:4}dGjDԯ +NM;E!o&ۓ1e4bp_Xb$~rI ﲲpgN[ A_}\V~Lj%ͤegE FA_-OM_mil'fDwk66feg[[lKUݸ&Ol" ~}vZ]yƕ =C}6?oէU((ng%gTJ,,MTgLc?1SۢaBm?iEṅ4WmvdÞY/\G[a_qb(gxHtO= o#cK-'IwXcf=;KG?WmhwcvtKzWV=O'1]wf~Zj:~B ,hxoue{/ u-pa  ^cہ-rQܶDw۰Po$ژ0_11Ƀ_1iiW4{e}:m2+S{PWA X"_iҷΟX%@wcʫ i1Vۧ6sbvYC;gq`뢈*a8`c _si/o%iUxxx16h?n0_h~~nC(WrHE{9"\ k'|H[o*';UBy@_Ʒ%[ç+k'|JViQ+k*ko$󗬬'=EՀOheW~KMIk\bݵ +qcmmTn+kjd=N/>9S%^cŹ;ˋYՆoQMdbyC씎,oa`nXB~:ő !ݮ"}f3%O&\,|vhk'|[(ZɀoK&[4[Z zf|[֬i6mxr2mVT頉jaɺJ&ݱ.ۓq!vد|Coߌ#]oGR+W[>9ĩm{OqcklZ>:cCzT{zA29"bw/Y\ym.`Ϭmt`u& E~ٍᛐ2=٪BQa3VI:L=HlƷ!7Y0> /397.owFd6&di7&C0 })yp2Ľ]t)ǜu~ue_߅k/8b6غ"'h/$D4 4f vkt5;Dtqfbd~ތ{t -M*\e<74$8%;u<(. l%&> +endobj +779 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 797.673057 101.433071 778.923057 ] +/BS << +/W 0 +>> +/Dest (cb194-1) +>> +endobj +780 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 736.726036 101.433071 717.976036 ] +/BS << +/W 0 +>> +/Dest (cb195-1) +>> +endobj +781 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 404.429014 101.433071 385.679014 ] +/BS << +/W 0 +>> +/Dest (cb197-1) +>> +endobj +782 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 343.481993 101.433071 324.731993 ] +/BS << +/W 0 +>> +/Dest (cb198-1) +>> +endobj +783 0 obj +<< +/Filter /FlateDecode +/Length 4756 +>> +stream +x]ێ丑}ϯg#y0X{b?Tl5~R*v ٕ%d YGR^tHDp$. +uI\zJ6E - -H$.@F0%[\E\lA(qlH SN%.CIG7 I\(qA +M,Mf lqHQDlAҔ'a vtD$z3J\4Md@ nw]3I:.2S/q.Df+g2gw an U 7MeU( m8a}[Tp3c7쾭9z1Sl.?{_/?+;eG#A( $ Cq#64XPmH, "\ٲYVEm|^G,RhSZ',"0y>\9A7Z۝$p(!sH1d+_Ox[A + nE~e#ؠ%S7brΔ'hsvL}&V26<ɃCAK(\CqUFDTέSRe[^L1 v/l0IC;]ʌT,Q/{VTۋ2>OjP}+#רydgC9לnبܠ@ vFYn@}mhQ`W=pbX׫BNT4v }{0;h}Gxӡ8z=?G_p6[=wbVCVٞ#Rr+suwʗ'n1tEw'8:?#s[p0ǐ=Hza:YxG:R]mʨ79af^糜{$SkmL5{DX`g'ޱzγsN>#e/#1Kc!G};s{{+!?3!7Ai+)?uo6Jy:=F4Gk?ki }dO\~lR)hbMrƋ>/ۯu|0 I9enz;܆~2r [E~]msZtyP̟iP[_x:N |oyB=ף'oS+jvx1un+<21yHռLRgY7?]z<4n]LOI'*laÄwhh1WWkIT7-C&6 F[w ^l׎MK?46W\Ʈ}J&q)Z2".xdn HIs}P`iD]G}MWY V)aҼӴG0㾘kdi&}vcYOrחmαe_{eYٖ.8F4jK;*[uZ'F*k-j_U;B)ӎJs7esukْm pT/r(<ݤK*Ml{eA3SիMw{bg3:HO ѱMtƖ6| uJ;"uZtA oP +TBr[zVP9 *8Ε vR1ޘJˏ Q}P/X +endstream +endobj +784 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 783 0 R +/Resources 4 0 R +/Annots [ 785 0 R 786 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +785 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 224.073057 101.433071 205.323057 ] +/BS << +/W 0 +>> +/Dest (cb201-1) +>> +endobj +786 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 163.126036 101.433071 144.376036 ] +/BS << +/W 0 +>> +/Dest (cb202-1) +>> +endobj +787 0 obj +<< +/Filter /FlateDecode +/Length 4057 +>> +stream +x\[,9~_QHclG&x@Z28áz|-3ۥ*GG|pfZrٙK|}bM +ƮPYN&s~/J&S>_P\?_~_m՛RwdRNUV&%Š`h,{>Ƃ}VXb'GgV>9XÕykU &BQygb.K^1b %8f SN/BdUd9KC;Ee*h+dB*gsgLd5s&6IH1)<Y EA@k<,NJ9+ŻɒxxXA,>B #aOp񬁀d8sPb8%``8Yw, sUd,adLЖa-mq𖭋bZ K9ȅ) KN  wOPB`8G K쬆 %BKY` L0pM0pn5,a԰b|VlY-@%$ ]װ}԰b?Va{avQECžL-9f5zv>?_~<GI!b_+Scdl@"!|O"),C7[1r_^dH,2;3ufZQTe}s$瑏"z{\z]}TX:,ƵO6Jw=9|;Y\LzO/R><]~56+kϏ?}-!42oX2ިyâ,onҁy}7>Pf_^hO[][ƫ}ĽL*pC+~\'Tsu:hlʈ('{ʲ2FT^Kmn}lW>:%80".Da*t'npO̙[_}>mAy.nSeCh]X*M6n5]4uS>52h'Æ_uh[{?JNEÙVGuWaw])gw]?-m\}{zbc}D}-]+? ;9/ss Uо3:4>o}VwZyON6B㹍` [j?e_&WNzmx^7=b6(&>}V<6>}B(z:as]>YWK{K턾Gt|ZUџc.]]pl2-zr/w\vkv̭/~~33p{{j4O# D\TwWM v[ۼ+[ir*^Aޑs}M5( yc45_%qmu1y/X"rc0qcZlCCOrH],ȉD]M}THd@r2:5h 9#M7c!y&[mucp_fk"]~fzxۮz sGm=;gQrDAʾ` i!q!bs/a˶o?7-Ai˛;l.nN0jqοlln9M )cȑt>@s> -*5=g;rl',qjy@)U|2SrTv^4gFjwO"cwӢs?zM"=-.#+o +/k'Tfީ]? ;m(4<"AO:;:˞4~'wu^[{r0"pWo'\d玶|an=jcSWm̢?|XwE0oǎBml[11܍2uO٣͇Eu=²<N ŞҾ#bqWs\s|vQ;8Z2x҇?.3mU;/&`)m*x%aw$Jg[2s v"s?[{IO}?|m\`A+|L&lxv~|?nk=$Z/]}*]O߶[Rzpl*1w7]ᖢ]S$x6\ܞv=~~kf$~QH-uG̡}ƶv^6~Cj.|FaY~r˲ӲpbW-1kd#IC*W9t]_&W/O0jx<#toO.V_\a;l%g |<,Վv8Xl9֔}-s9ܾe>fr#,^ꭠ +-;eָFVVC y;; _%; 1vn=wy<0T'q-,=aH}V\kAE2 ckbjFݐx+B]z0V*Zy6-]SiꔇZQ&y +K,Xk'xx$?_BRj6t[;N{Ԕ&k *  +/I#4佒VzÚYwQKi/R_@wQ-4'au,3r%.0LyGr[=~'9|^ig;V76>sdl!N +@ ?uG^w2 Y~L,D O˳n0qN`5@P7+1L.d?L;Z4o-@Sfn[fI\RN> +endobj +789 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 579.873057 101.433071 561.123057 ] +/BS << +/W 0 +>> +/Dest (cb204-1) +>> +endobj +790 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 518.926036 101.433071 500.176036 ] +/BS << +/W 0 +>> +/Dest (cb205-1) +>> +endobj +791 0 obj +<< +/Filter /FlateDecode +/Length 4038 +>> +stream +x\[I~_HDfF$4H+`$v5` j<  L)pޤU"V&%Š`h,;g%%1ع2𜬿ge1l IaY<B)<Lңs\\Qy <6XWL1dǐ%/@`IA9iY| kYS^, ExJfVy<)5UN6)& KPTd W'O9+ Ź*`5pP% \Jc \3g \.S  ǒ4dsVO%pԐ[8*xY@!ca2Ee*VeQaYȅ) <0;5,]a9G x4,]5p׺B.↠aXK0]W 5,]Ӱ^Pd`HV!ġD.{Ѱ w)xaA#Qygapl3`ՐRh<.YaA԰ &!a41))E b!hp4,HBd<‰5,@`m/Y wN B b}dCDL.A/:ZelҰ %6pVR&kX7.iX1aA*GE""sg! l gADdeFҰ$T$dFBE pLi)UdLhXd;hX&Y|` rvnf r,M7 "> +E#aq4,(6#taΥY &R<%L,!ʃ,rnI7N/BWXÂY7ѫ%,fRPL4jX䛈lܞ!!>әY2άV [Ւ{᭒Z3 Hjb"QiI-aV}ZKT3sE Ft?r̿lϗJYka$ֈq\~La"vDB!}DT؊n"$\1mv/2$-2͋Tb|Te}sO$#đĈޠ|z.>|rY#ʞx?*k_˟W66`OuG7>Pe8<7|r>|rYK-zCZOx]mz|q}o7X|B=\9a$ \tM6mO8Z6^o=lcq\wӤ*} i+2Nkj|;[\}ʪX{wq 2&oxvܶv?<5&lw*nmW/};6o<.m|9/"p}Ѫ\e>.K;c0TGj0k?zu?1k.Ӧ݅=z:?*S[k1lxL~O׉~NpWmxW݌&28k)ߝ".cL#}>6鋓RI*MquS͸> yDuT/kUʊܶk5 1#&8!Rl*R>L(sPklعeO _te~c5#0?1 Ukq܀ߦl cq_Trx뾦=!:̣w[deǍׇZfr6z sGmqGtN!/]aҺ/O<F`/tf7[ޞnoޞTSmŒ +`q^A| Zc)[3шc(gxAƲ4't'qL[5ΞnVz⪞QiEi4+ bG!O!m}c;o7h.5G߉[]Vڌkp,&PIGV8K 8\*ֳw&G/Ay{zXc{Yd*ezn4sֶޞqYr̃{X RP,p;pnӽHG}zG>L뙾ҽ/k)oѦ$+>)Ƀ)$g'h36,g ~mdWK~F`/ƀrbC}~G5bq>cv?Y0 '֧PO>_Zț/gةٕonZq`}}>t0Wςd@aHy֖$.)nAM'U#n Uri +Q \fגhыsd o7'[S0$O}~Z:eiv˥9烓2z+JQm^n)ydAF'c/?6϶[-xͳ;M`-@P;+1L.d7LYh&o-@cf:❗TY^MOPJ > +endobj +793 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 683.673057 101.433071 664.923057 ] +/BS << +/W 0 +>> +/Dest (cb207-1) +>> +endobj +794 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 622.726036 101.433071 603.976036 ] +/BS << +/W 0 +>> +/Dest (cb208-1) +>> +endobj +795 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 260.429014 101.433071 241.679014 ] +/BS << +/W 0 +>> +/Dest (cb210-1) +>> +endobj +796 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 199.481993 101.433071 180.731993 ] +/BS << +/W 0 +>> +/Dest (cb211-1) +>> +endobj +797 0 obj +<< +/Filter /FlateDecode +/Length 4752 +>> +stream +x]ێ$q}gK =0l-`k Hzj%V~̌IӨb/A0yisDFcWrE=>_!O,pQm ׷ $ous*`GVS1ŨPi*F냠 +F9K*#Yګ"̠dmT f8UfhHR }TFcu0D9+W$5*lЙh%s*D2HB>I:->k#xJ\at]cw7x eH\M 芺tNI-Y +$.*H\2V~=K\;'qAj#`KV5a +kΪL!`%xW%.]6%.6I\`+qAHrAₐ5tpD]PH{ DlHV$qAY+qA.T6.b|@`22cUIJt-t&J\#)lFR*aK\W.I\33$qA̰KElE*Yx8Ӆ -%.H6! ZЈ%1Ԓ4ǙIDA(q "M0- 0?l{  D#`$qAJ$qAJj+qf kO€b7Y8tZK\MBiIK7iěu]x3J\ x(iº'!;I[l& ro& f ބG/ $7x\$LH ބg+#3Y8L≁z⑁b♁r$LD)V4Z<6_ci> +CĞ"w2cYslN|O{yU9)k?w8U|Taٶ0#e؈XHln1ka1l̔Ѫ] +sh|%[-Qxod>sgdn+-XN.XN2Q9wy`d@oס%xLg }EDOTG3R!䯟~?wO{*L oZ>-M >|=3>TōCVTc \}~Oߝ<wWz߹R|/ )6tЌt3|֗ryE#/4v-mtַp1ak`}u N'}=/Y+wq/ޱCɥ1Fϭ&pPwlLix|4pXǢc2!A2mѯU>bؕjʿN}J㟷c^W›dbY>w>qqnsƪZmڇ %ڮ}0hLَ)5,}(/9p{p~<}p<.W;{cchlxuYbi9L@U2׿t8N~7Nuix0t xwi^?AnSGo1{8>;g.wc|^ߎ _dfmYGUj~ZZڞ~=u`+^-N|f^in'| />5;7nV¶xn6Ax?h܎ +[}l+ӧP+`K6]MR sh2 +k$,ne˧ZyMxc MO绽|Ќ o)aXNFQP8DީK7O@'< ($1nQid5uF n=>]~^vЬ]ѿKmMOu/J]/୻ov1+o-3{qo0yRcd/9[` e7'|->s~kƚ:^궑ubmǶNr.+g6_4&wsC%1 _F9Fܹ2Oav#sG,.8tܝ_ H*g4xĀtÖ"t|='< ;0x,Q%Gm>5#m2q|n#ut7L#`ռL4z"a}%o=+yt2lO"\'A0;C~G}ՙMXL&^nYv_ie:v=&-?э2c1\gCcԇ;Yl^6lԥkieϜ'o,W6|[3}<(sow Ct+t<59ѹܷzI瓫%p[Kg6c`uo>ȏ|rse * +}ȡ4]TpFu+lm-?.4'sF׹0ekzRO6j^FE夢}!Pmik|OQ :see~/av?ҍtM+Ŷt4pֹ2Oc?w"sBػ4ӯ;ATpԹ2φ|||>7D{wl,t:;cgOgO'<N=MgNk~N,_E{喧# 9J^_ZNz "5N R'<rKm#9ޝ+OMsM'<Zpr~9]nS_kKy{ @{{L~df٠'ql}J >=aoOLz<>w%w+7=[~15b5+g%iGM)kwJ׉s7j~pfy蔨.dR< 6@]ɶ])Dʞ~ս.2-c@QmN畮_soa[Mo-mK1旆!JsT1Q3)WSCQ!yGCqzPO f70 CML8MvAn+}VU]MF.-g$nAnU&Y!-ԀD=_n"櫵>SJhn#?LPw +cT_<׵%sӄ.JⷋBn?H To'=21l2~ PRfPjF#6x=Hnug ۹u%w2~q:)77a_6DCl>n4A- jv1vZ㦑f#s36%;Zj5d:7T%RulВ +"1W`d@΍gi +mMɍ:\u^LY91WLfn4y&XکKfiK;RWa{+;F妵纓3p-h1:I(V3QjUmtn^cl6Z KqG)vbH> +endobj +799 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 564.873057 101.433071 546.123057 ] +/BS << +/W 0 +>> +/Dest (cb213-1) +>> +endobj +800 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 503.926036 101.433071 485.176036 ] +/BS << +/W 0 +>> +/Dest (cb214-1) +>> +endobj +801 0 obj +<< +/Filter /FlateDecode +/Length 4676 +>> +stream +x]K$I ׯ3&p$ +FB8 ԋpEd<ޝFiTlGVeWEK)x:_9}{RKp +JEa8|to2%$g?tɛӿ},)yߟ2b V`9`X^/XbJ b@1(E' V{V&hXC'VCDQD<{gc2It0NKx]xY\RZ94xl Cy`%^,I/BxWyEy%^KH%T q3-.Z$֋oZ# d%YUFYBx gCn5yw[esŘ@"YT`-$ 0!, I `](RPĴPVB> -UőjBع"DXY@k!!+aE %xKJ{ ,b* ,FOX@.\)IX`)ab ,P:o$,]KKX`֢ȃ,p` JX@]UFFXuz +QIX@]IX@]D^X5K"7p8e$, !%,,%f]@HX"RK<6IIXpE#m ++ҢR8.`HX($ya#i ƋB*a"' d@YGZR^xHD_p$, +yIXzI6E , ,H$,@F$[, E SHD$aAp*Yb\@ B%,/9]bI‚ EK4%,H%,@ DY JXMD镄Ш%jG*יQ‚H~ɩ&4"&$,}r$,@beȃ,֑1\nF b,F $YIX_r,a`<$,H:4$ae7*ԛ(}f dqHQDdAҔ} LB txD$s%,@zx$sK@&Ef%,MdRm. ?1WQ<1P^*(`/U 7HDexj +Vⱁ"&Obf y ۂc4WcOrR~4Қ_as;d˷)AiCbia=fb!5 ި|ZD=etB(9d}Mrto,)I>o%Li6!;-.D}:BţM&<6/2tE?p–RC;_?ӟϧD)~ίf}P_jr4׏Oi}EB?˯s<봶@ʑ_8M>Kom֐1j;gio嶔xhӿ?|}Õ|8\>615|~ґkvWl*s%a-qާ$u{](w撻9V>W[w'ż;7BxGެF^m =k^ Sp X:5yNd*iR[Y@ugҥ6Wvhs(\Ht{{X{ؗ=Օ4ydTQ>HGL~X܆Y _#i.,lvTN.Sfb9a6){azg8G8гŚ%fy)1g烃97_#Ϝld DM~x+)ߘ1QwK8ionѰk#M{bwU|n.;A6KRy_w^Qit7@cQϽ3˔::~oB?jӮŢ"ʇzwM^]ǥa}W"5{E'a"3s7t{C\Eֿўmͺ\\CapoWtuGd~`m54&|zn2뢣ǯ/ƭ7 +mvyl?;TksMŷ:3ٌn=2[i}M~ck{Zۚ9\ujM GNsEWf'7+ΔMDHW2ޚf3?peIװݕ=D~84mOmϹw;n>;^/:V]CwLVcmpV+--[|٩YTysYL㾙e:(׭{4hvUr602[üěY_bzql MqL1isc<4{a纼),9w6o߹DMl-!l;qKϾć]}'vra)6k˾@~I%}Po}%HQ +4&VeF 6V+R**EgAI4jecnWU FBNJ>^f令* +}uq6ImA].zAkEfQlX i/l-ɹXfmQr[mX릭۪f K8!S-m<Z( 8EmܖkPjw*kb¢4} GSj?L?cjW4Fb>~ۓLM28N;}{&K]s҉r\ +9v1/hGDcn ;r4nQm;8|iw[~ȖN DzOΫWx̸z(7Ao;oUDŦdCMUU[[93E򵡚v4˄JZnvH@J |fh#QoZ;t9h[*VqtMMC6v J yl 0)5f(:\Lvkj)+B)\ӎ[+q]өԪdzIkls*z @> +endobj +803 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 332.073057 101.433071 313.323057 ] +/BS << +/W 0 +>> +/Dest (cb217-1) +>> +endobj +804 0 obj +<< +/Filter /FlateDecode +/Length 2995 +>> +stream +xZ[\I ~_+.nR P + +M<|ԥ=LDF3]HySCd=>>(Dhlw-Ȥ%$n'H X?W͵Zˑ񗏦R BQ5QJ);ؚT4꭪<`hQU-,z*bD@HU2=]kDO'rQNZ9XR#t XZ<]BXb- +DX9 +,ꀅ2kRAG[]R!O|S\N6)G%SjXPt,OHRjuNk-$X 6cJ('(/yK ڢz$Z=-E<-ͭx< E@Xf Eqr]HS $ :x\ ,Q**5@J=..`ƕ•pq/XWRhWf +qwE0 cqwx\]qv5k% + +ލ!Օ3((x7&<1Q@Qc?f]PH`z\x] 0YHK<.H]nΙ[-{\\}.sna97 xJ<.H]gQ ˂Hy\pH<.@| Lp]WZ=.H]RQ8PHq8P 2xy\D<.]R=XF @ci$"ӁwÞKTka\LG rJF!su9<.(Ae:`Ѣ MZD`=.(X2x\ 4FwqdBmQ.P Ux\PbT8Kt,8* {:$ Ӆ٠5VT<.@F- S{:%3UsTT`JW, ?Vl' PDEz\Pkrz\P+D7,4d|4d @y\иތqΥ՛&z%snd7M%!Equ9z2Ħެ @޽VoӁwf @֫ ě +3_Yzb{e@^Dj$0QY B^pipY=dñPdn_~:|ӿwm7e +f 6l7*l) +L 1M Rܯ "1m;| x 1#ٞKeQ'06JK|#@82cUukgX#LЖ^|o?܂=o?? /qfkDt߾Ń;5NR%=3ïo'÷էv-AfqD֒$_8E۶OE ZTS؃kh_ldI`6Eڌ??e.5yůXIv^UgW S"S֏u_cv*pʃvA.b ]g Z采݇K ڶaWx9z=?@ R/v ͻ\7#*+#e}mK^p/#|gǘ;-h΋*&;/7ݎ5tgݡJwG۞lhf75Wn;tw쿲+&3?>S\|+{'HaXLK>;d'l}TWIƥ#cJ{EbŚp͈"{DCj m|vs5Hbm3lncpw>&߸>Ǒ<y_~\N{lW}6GZ!gxsmydr M4 hDoo#G>-/m?۟_&7` :bTebi̥; QBI6&zhtO}JlyaGox+do%9}sbZVHrSaS8e{X|Lx:`Y޻R{q֧֍4djCzϱ!:9ˮYX#z?Gt:ة2z9uO(ե;Fwr3B?^@kt)?N+(u[;ĕLiT8]f7LiHyåv"v6H<Qe]ť ]ŕF؅t1"GAAcyZl_"SiD"@ +S> +endobj +806 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 770.673057 101.433071 751.923057 ] +/BS << +/W 0 +>> +/Dest (cb218-1) +>> +endobj +807 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 709.726036 101.433071 690.976036 ] +/BS << +/W 0 +>> +/Dest (cb219-1) +>> +endobj +808 0 obj +<< +/Filter /FlateDecode +/Length 3904 +>> +stream +x\K$ 賁^Ⴡb ,Clk# !?z=3;kAt,ȏZlO!gJ9dM?Mbs?Y&J<`B&s:?gw)O?~uw]<3(\rQaU ++FIa%g0Z5Ԉ<YjP-QcA (5e +5|v1+,g֪<(bWx.'I2x.{I\tR,Ki]#P(Y%R*:U**dƫZT^ϖ\gCՓCTC9 |RN`K!ApЅ*J] aASа m ޢaAܒNÂ%뒆 5J"  T5,԰ tY 1y `7PIn g5, nSA8@G\ p785, .kXY5äa|RŒ)@e pG A]װ|Ұb?Va=x>hXƌGYaA4ʸR +OU2,-l\JUÂE +D.hX7Ȩ^ÂuZwVÂE5,;@7,\WUck)D.`kX,lllHNC5,H]aA k eʃ.x P׀UbŪHa5p\5,H]N_4,Uװ 25aA<|*/\G !TtL65ԢaA%xaA%Lut.5,R4,1a=jMɀkWsY ; 2AapaϑBHExTA9 .5,(`XK,3RQ V@J]`~x5,M,sTt 4,(rhXP +tkXfְZ肊OÂj2Y8xjXP]zӓK^o jXobm כYÂJ%DQyESU&I%+iXPSfѰe֛-ͬnwc2i<.*Ӥa.De-7fg:;[- EꞁI4XY 鬺m` 'E9ddEXXbu_N_? WmloDR4fW !$ȏ T;rLYkۮE#^Ne)>nX FݡB7A HwNik$Z{9(Xd5:ԃlssk.!sɖS$fYQQWX]ˊ1f݇l(3mɼ|xw n|h>$騚ŇCEPӒIФAu4^D%rT񍂲1|fm&l%, O*,F, /% O 7K} ?X=<{{fP W2D}gBrp_\xѾ7Oӧ5wn+zʵnbMyÊ?o%&P|f0eW}YzJxwzǃryGrM-4=۱r#vfk{ṟF}=ۊ]wKi>[_}wi70{ΪKWVq!avv?I7ı6lswO-=wwz~Yse%vKoSD@k l~iwCAZi~mvmMWmJ[mx/:=f-6Y%og.аcזioKU{ף[>k_C6]%2x.?^k5Η{͏];a;7M*| ِކ z?g03}n5|`_}Vza_V?mJ̚'a5d_ɉO]|L~le?J$5>^]fY;U]ry=^>]=Jǫv{1YxjEݭ¯l7+6n`Feآ`${؆yF9l܁eGm]u&`Ooپг=G7OV !rdr~Iv +b<n= }?:4Mq.MYt#^N6쩏*@M z;iA(U'59!4I!;&LYx2\r +rRzkqTReZ*CWhF-D0n\̹E?/H38JDž6ד ڝb,j.TA *27KLju±9[#IzC%+r>+Ut؆*L&&xlnz$3 LD;@w+?nK8C>:KN{.r(yθҦ]xidv2:Ydog[ R FyDD'vq/_O-}SvCֲrB{u_Ʃkvغ!L_QI#58F= _dWl0inI7M$eCAu 2,d^;7+a_/Zσ p!˲xahW,R:ōRtXf5!e'?ɩܗe_ţfeӃF!DPy!&';}?9^=]4"'QR:Ov33_]m{a9+4ViA 飂Zm] Ni6D14;h)LP6;:]G0 ;j!7(VO-Erdߥ퍓_-?km +endstream +endobj +809 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 808 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +810 0 obj +<< +/Filter /FlateDecode +/Length 5337 +>> +stream +x]K$9n# 0a{:jFYQR("\l+z1$#Wڳw%SJ9>_~>r2SJCIџ8yC矅@qٻ_NogroN.cn98~$)W2%%)F烒WYK>}Rג;6}R.Z֒>*IրQa&Y?tzҜB.ii6:-h +ZZB>ii ^|6VK[f^(QK^z'+i @^L0VK4մ4bڧ9'f!A0H!*i㳚^<xahi O1%E[h7Z/EV _CAh$aqXhIC1.CHsV2sА,xah^( 2hX@^eHeecFR +ar!JYSBݣ%%NA[awPRM/` D0p0pj4,Nàader) a "L' iX] +:o u삆 cTo ;^#͑lrpK4,]aZM6aڄSd#z\[dCx. iXϤa0~Eux%Xj- k]6x.aap4,}iy29% 4.<Ӡao³b{$LꌁzVu{a:g`#`e +*Q 0:OQCLQ^2C-}9lt#u~<}{~SfꏅX/ e7j*1B\X*$lļi󴛰 c ]3 k wF`1Ztn/wNf8wEs@ ҧOۏ/v1I<$&=ƚ[| =>\rY:5%uZyC>]*5]Ukۭ|KHK5oy˵Bjo}>nTِi-tݝףN~˃n_g;ma8Lq=;gm]H ]'J#ShUW AD22RY0]ne'(N|m !ΪzyU;Vyxg-*";#eAvrneq̹v2MR|ۣ%؍tÍttwVr[tLN;ˆ9̻YW8A"w+!V#{s U ]2nVerŹ\WCE.澴ʉK0: Ǐ~&ȃK)k\&×=l5/pCq.,^ok1c;Fˁh ira`:Y/d0&Y&~_`,fA$ _U^89`lrJ׉SKQxAeF3LO#h>M4-&c8Y? +z$EmY]8r<n&CH{q 3X{Șg ֤l/qy9ˆQ1;RK|o 7>Cz)8G$09s y>g oHUe"Հl#re2apnW{?h/9HHỉl %MfÆ;=Zۑ6/ֿV*Xۣ$jueiӓ$g¾%ceƄ6u^ #hnؘZmg[-kJF<js6eK Lčk*웮; j;EK76,@Y%28Pڱ2ϣP@E{(n=:?nC;luyɥe}2muol&{Rٵp_K@:OdnDn.ct]1SngwqGmͧn]:c띳f<&,48 R,7*[I͌(ؚ{krMX*'{}Pzez1;yNBbe~h_ױZb}i11~ëŬ]eb@m=$u>pcN_57I. +a N`Q7mȣtegշCs[jhaGuv"[oGA]|`4([{މndj\E6'yTCSJ[gߏi7jk fJ,YAsce*2_ddkt6Z-VG"03`02#F-{Ɣ=Uohp[ܘH.%'H87y Gip/{gi1 hpr 23r5r_6/w|:y^l#sE@rɖC oC1-־X6zvZ㶓$qJ!yF)xQ a.r}U+4.hB49d.&C1mݝռjxo sov3~6pHg&GgƊ<iC'Վ͓-L+ߺ.,zun8/'4K[*_aRLQTnT_s6N +rRߙZ5c0[z7jr q˗k>t9|rh=: +Lh #PڤNn܎x9G%_*z=z9E^c~jV\-_7 O`̹/OK#㒷.cپl2J~ݖ؊uYG' cMMY Oʞh*hn!&_VOT՛XVB ;F4~[W6ޒESmd!K_ŧ5 + y/\\V?.JYOby'K +_{Y~_3 -\drj$˗UbS踃lӒWihvܹy)n`9mCPR{_#&ry3|,Hd\QruHnulisW%$bґʮ+R> +endobj +812 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 724.923057 101.433071 706.173057 ] +/BS << +/W 0 +>> +/Dest (cb221-1) +>> +endobj +813 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 705.976036 99.933071 687.226036 ] +/BS << +/W 0 +>> +/Dest (cb221-2) +>> +endobj +814 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 687.029014 99.933071 668.279014 ] +/BS << +/W 0 +>> +/Dest (cb221-3) +>> +endobj +815 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 668.081993 99.933071 649.331993 ] +/BS << +/W 0 +>> +/Dest (cb221-4) +>> +endobj +816 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 649.134971 99.933071 630.384971 ] +/BS << +/W 0 +>> +/Dest (cb221-5) +>> +endobj +817 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 630.187950 99.933071 611.437950 ] +/BS << +/W 0 +>> +/Dest (cb221-6) +>> +endobj +818 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 611.240928 99.933071 592.490928 ] +/BS << +/W 0 +>> +/Dest (cb221-7) +>> +endobj +819 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 592.293907 99.933071 573.543907 ] +/BS << +/W 0 +>> +/Dest (cb221-8) +>> +endobj +820 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 573.346885 99.933071 554.596885 ] +/BS << +/W 0 +>> +/Dest (cb221-9) +>> +endobj +821 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 554.399864 99.933071 535.649864 ] +/BS << +/W 0 +>> +/Dest (cb221-10) +>> +endobj +822 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 535.452842 99.933071 516.702842 ] +/BS << +/W 0 +>> +/Dest (cb221-11) +>> +endobj +823 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 440.717735 99.933071 421.967735 ] +/BS << +/W 0 +>> +/Dest (cb221-12) +>> +endobj +824 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 421.770714 99.933071 403.020714 ] +/BS << +/W 0 +>> +/Dest (cb221-13) +>> +endobj +825 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 402.823692 99.933071 384.073692 ] +/BS << +/W 0 +>> +/Dest (cb221-14) +>> +endobj +826 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 383.876671 99.933071 365.126671 ] +/BS << +/W 0 +>> +/Dest (cb221-15) +>> +endobj +827 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 364.929649 99.933071 346.179649 ] +/BS << +/W 0 +>> +/Dest (cb221-16) +>> +endobj +828 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 345.982628 99.933071 327.232628 ] +/BS << +/W 0 +>> +/Dest (cb221-17) +>> +endobj +829 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 308.088585 99.933071 289.338585 ] +/BS << +/W 0 +>> +/Dest (cb221-18) +>> +endobj +830 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 289.141563 99.933071 270.391563 ] +/BS << +/W 0 +>> +/Dest (cb221-19) +>> +endobj +831 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 156.512413 99.933071 137.762413 ] +/BS << +/W 0 +>> +/Dest (cb221-20) +>> +endobj +832 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 137.565391 99.933071 118.815391 ] +/BS << +/W 0 +>> +/Dest (cb221-21) +>> +endobj +833 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 118.618370 99.933071 99.868370 ] +/BS << +/W 0 +>> +/Dest (cb221-22) +>> +endobj +834 0 obj +<< +/Filter /FlateDecode +/Length 3914 +>> +stream +x\[K ~_1H(]7 񀄀#: AC$ ]qff79"YMvʮe?+B?p.Gǡ㙼d+5'w\?ӿc\)P<].9h*X`r1DXł1KkVRKXCB(@ L|ͪ#d1lC +ޛ<E8<.ArPM^rx.eHR,O K,^,DŃ,%[Y87y%/CTW <'WZDL^ϗ\yG xD.6I)YA>X<,K15wgxAl!A da@I b@(HP $g` $l{/!Kd!dxɃ,\,,`,A +܊daoS[X@\.I,,`@.LZX\vZX]{S,%YX]p#Md[XttL-,.pn,,:aB)` `Enn>XX !YXCqof]@H`2XXT Z9*5YXT}&:ив@D.XXw‚%Fx] +[X0GH,,@|sa&:_K wKDa eC" # wޫ # iɃ,\k>dx]Oa>W pWæ)+! C,,HE\9YX)KhaA D@Ƀ,$֮r-Y8 r,H,,@F*!6s1,-,RE,,1V-^ +d+Q gqdaj)WK@ H,,U,,@(r% 3xYd[XL<" J,-,(LDhԒPufHr*ZX7A 4y0aaGha(sLd(,Y6TYYXP}r&[X{ *ԛA,,_jY,,Qo3rz3[XPD(& iPo,^,5%7H3Po"7֛<. +dx]d4Po"j{,Zqz#bydV<3_Cʲ$aL汁"+LN#sȈ%EV 5Ɵ趝履C=??i'e`,I .*ptBI_3Fu +IMD(Ƙz_(2$V L2YE@*N/d:B]*֭JB6/uEI/e4?8k +y]X3^/,$u Pࢼ8#$Nԣ3",pȗs,jB/A; uC_9{ȍ|So?/,Wǰ.v;ioqOƜ}\]k\w?ͷRl#@\+m. `THQ߽feC1V~4Y36bȀ 謹= @6y.oPw0JUK(;.ؐWЏ9EsU8T]]nܛet=}iE[  +.#\8{} +_ܙ6*dTw ܡ=(( Ch) _l8@FkE|ZS1&f07hacub/Yy=]Yk?|۩ ::]{CPȬO؜fQwS;O p syƮ8-| Ӱg4W2i].^ Lw%ZƎ x/0)AM%XmM'b>yǭwӒMq梊Ը̊h'O9'?b?nYvd쓗]qJnXݰUbucvk+MkCQYcA(>.x`z<=6k(okq9m}\!T;Q鈆kb˱^v6EݖԆjG!Y>?->PLYuWltTe(*ѪQ'guyu|}m'=>-?$֧fyk0`Çrj~J trb ً٘[X[E>}] *G~y1pm<7 9/c5 };:&lko\׺|uL}θXg'폇DX_&#r'j\?K3]d`)0*bR>Je&hSM59Nn汻{+$75֍jluOu  +5~ W)G=QPH4 +zgMKOlo0z/y}_[{"cD{97r 1'}9J c.qОeW/{":&cb0}hM|mazN̊㽕(1uAwN8%~YnG:!:Z y[ħKI2Oյ"T{ Od}jfkpF,ݐdAz:ة+;N@T;O{T}i4}Rߠ""OB2LJ @4@gE]U_T_Aw;P-\x +Rwofޚ+>g%J'>0}2U8Kz s$vfRQ k[ >t8Bi?< +endstream +endobj +835 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 834 0 R +/Resources 4 0 R +/Annots [ 836 0 R 837 0 R 838 0 R 839 0 R 840 0 R 841 0 R 842 0 R 843 0 R 844 0 R 845 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +836 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb221-23) +>> +endobj +837 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb221-24) +>> +endobj +838 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb221-25) +>> +endobj +839 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb221-26) +>> +endobj +840 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb221-27) +>> +endobj +841 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb221-28) +>> +endobj +842 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb221-29) +>> +endobj +843 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb221-30) +>> +endobj +844 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb221-31) +>> +endobj +845 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 567.702842 101.433071 548.952842 ] +/BS << +/W 0 +>> +/Dest (cb222-1) +>> +endobj +846 0 obj +<< +/Filter /FlateDecode +/Length 4346 +>> +stream +x\K$ s˒HAId# r=6QUzTg{=*R"?jUGdv&"/oON֤`_-/I,'\9 +I%O'?:M)ѻpa1SAa#Iɇ3b) bĞ1䠱 {VёU O5p%$,pZA,3y炉Pzxޙ/*/xD&&vibb!k<,Xd j<”Ƌ"YY|NdNQxʃ,6Z +P2+ٜm0!Y MRy(LRL +ChCQy% O'odiYO &_C!MQx\0dx@g29k(s1i0K0Kp; BQCr*Pa Cаx& h˰ p˶8 xE  1ĥY”%`Ѕ' K!z K%vVʃ,0` \& K&  7`V 0jX[1>gaw}aw} CVnkX]>jXC1F]@Hհ=x4,@c#,Ѱ w]4ʸ\2O4-l\EÂBE.3kX7XQ+:_!hXs0Xߌ0]W-9kX%aVac3D%CrEaAby/D DDe=*P n4Uc=Bw k<வhXljX|ְD^ÂٔXhp4,HRykX*YÂ! yaA!Lq\! "E d&f RǠU p2x.iX,NR&5, 4,9ְ WѰKsAtsNÂ! A 2հ+4rIZ㱕<3kX9 5, R<а#vаM9*P` rnf r,z `o& ,4,(6 5,ge䛞5,_J5,(do"SP|3iXP(* h*o4^,%F73o"WI.dx]DQ Dd3%ꎁꖁbJꞁJn@Ld9XVtV6_c|eiޢ053'd[0sbLeoO?`=oNY⤀i̶/'(!8@ΈLwdL׸']J&2<}ґJs5ғl2d"?, #ݑCeGw31vyiAv4^N_bm mT5pl ԐLeLn]ءN5fZzi&5Ý>NCL $%K@ܘ oMh#iһsl*&du eޓCһ EՄ:u zt5qǕH];/3Vwgl۬~et>^&OZ|Χ:Bg}p_$DRhP0xZǐI#!9[V:3QZ˹_y#gNo yUY_\˚T$1EV59@ߣ ޜ0 \c$Ioޞ>>y<k]S[|zq2r|7Ძl|~PfkdNI3uӏ'Ckvĭv)[^zB")5riԋ˧^mFWkZ5MQj@:vU:u"wUWnr^AF{Yf`wM +m6׶Yv"rN߃ȲFtWL&GeҶ:yjͰv +n{NCOprɶvYumۿ[myaSGUVn"n k;ڸ\kT;>а! ]MInϰīO9w?Q&F?ö*K "~fyBt:8YC:ҭcۯzuԟHXzSۻG+x[oyxWIb<{c;V.^*N99~0`<~<^c3k +Lwmx^9 MarN'+ ?z&jv8^ZUۚh/0^Cˡk->pz]Tof]zޏ<-7 Vh \6kl[HD(Gw78XBmI'sTΏҧץs9stV 9MZ}G9\ѱvjAN,Fyų[<;P7y89glVm#%e@Ph}jMS>j= v/zUpȧ,[Q#ˆ=vg؆̈́P|TNuPZoGSbuu2.kVUYpː\Nwednp}~&WrxULqFRfn!uߍ`{q8+9CÔ]0#tYqVyRTBݝHb6]wsڷ$x/y?-X4)-<3IшXB@xFDXV;l VFȼإ銆|hD4񞈆Biر=lwfaQ*՝ʞVag}۠ COC> +endobj +848 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 408.694475 101.433071 389.944475 ] +/BS << +/W 0 +>> +/Dest (cb225-1) +>> +endobj +849 0 obj +<< +/Filter /FlateDecode +/Length 4407 +>> +stream +x\[$I~_QH8"7 V:=g$iEZQtWe6L+8+3ɹoOߝȤ@W[.*kp[boI%ϯ'?}ٙROboRN*` ++ QaEkR4Y bpAcA v.+ 1<'1\ -!),K:"A;gPzxΚ+*/gxޛ1BV,3i<>'!Tdq9y vː֕UdHVoB*G9=Q0!{OZ`^I1)<Y" K4,>x Ź*`5pP.%ű.{Ù.)y \ cIx9'8jH-daxʃ,A4а{kX kѰnհol԰p!&iX>GְraJEN <@4,@]Ӱv=azawGOY`kX]o)iX]Ӱj`Q؊q9 uX#@%0p,A;.Ӱ]԰b?F]@Hհ=xkXCXaAڂOiD pfl+&h\[hkXϬa0Du85p׺B.↠aX|3`**9kX%aNaCH!Y ƆjX8ދK{ "paʃ,>; ׀U|!x]a%JEÂܕcSÂಆ +v̦5,Cȧuа  'ְ)d ,9 ,4,@D`E Y)jX$30kXBD>jLNkIÂ( 2NaHaϲ@8Lv5,5,@ dY jX]FI%j$yfְ s4*jX7A Ty0aGa$HsTd5,I5,8r6%L,4,(#Ұ،|ӱK7Mx%L,!ʃ,$@'!+aAQͬa 䛈Ւ@|3n(@&Ed5,MDZnOސ,gV+ 8[Ւ{qZ%f@_ɑԢDfZ5 +%l@_cÄKi.QEC™,-}9F3FK}= zY %.`Wǵ~#B -@q)8qؖs`C^"yZ *]>ԑS)eU[oJyᆐ@Bjy$Z=j|]=j|vYS, +‰eGa!o5BN#.ad8L=~vϿDP ~g|NP;e)G D J KN*C(CJ_`8W<m֋+jc읣߯? e/]rXrUoO؃$e>$Oc6Ѓ_hmN?x8)qLzFI!Zw҅[N[Tlw+" Zfߚic <: ;KDw <97lVod8?1 8Kob_׭ѤxEmE/׽>^~m=`ۯG֬K Ջ#vO lC^m84`렰QÉ.^6e6m0豭{LFFvͼmknUV}e%sp1ny-6MHw!LF?(m AjۅDZo8+gbV `n鐻GrH}j>DDPrN]CP#wcsE@^Ҿ8<  /7ݪ6~8ԇRٹwh ex)c+sQO=oUPa_3*G4m00(ppFERm XJ `.7G}/C~ܱ^?Va?D@3?ba=鵲l-y{+#%W]S*׬^LY.~-WN4 _5* %>'ɂٻ]f.?~%2U{iᷫ2$OǾvݶ}wS[_?@1D`WqLܲM*ɉ޳Jobi]oO`/eJFדD⬐;HXl[N{>ɽe-K\§Gjh&B/+DvOՓ Y^l_b%&3c@ێGǛdi"=Yim]XEUgom]$ۖRu*m]G'Jֲo}RH'ӮCbnĽ]iImN*i~2LxVuPm,Pkʓݸ{ BRZ8.˞q;9ӰAM +hHЩvǜ7[yee+iϨ_qG-\y>s Ym6lh5sܹ yt쭥j;w&É:'̈́+{ }fؗK?J T> +endobj +851 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 770.673057 101.433071 751.923057 ] +/BS << +/W 0 +>> +/Dest (cb228-1) +>> +endobj +852 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 399.731993 101.433071 380.981993 ] +/BS << +/W 0 +>> +/Dest (cb231-1) +>> +endobj +853 0 obj +<< +/Filter /FlateDecode +/Length 4206 +>> +stream +x\K$ ˒HFId rmfsGUU̬uީ"(#w\R,g7>)d+1{!P26s_>;뼏;zSJ.z',&rJ6(uB0)VtK,EcA 4`89ڳ +ɱƂ[ e&\0J;sE%\.8WL1dǐ%4^,1[YrxP$ ω4^,) +/CXWVyF4^!JfVy;LXN#sH9" ܂c4 ͖~8|{߇IYq0~(u7 2u8X׮J_GHe롛Pp[ EfdyQ)8lE]gz9d>M*7#w_/QȽ^NqE!߼?|}yx6d +}?o=|󦮏d)nlVـ+zR3ȶVE`qHڰrCKr<Y%[G+jc읷UYo߆W/EaovW~Z@w[L.԰0o +=Jksl㞿ڭ 9`͍v҅[F]ۭQ:\͓vtAέt[ӷ=1!;Y(B Œ/ĭ!8z2F%}f_Fd>j= v/zUimܼq lΓaT XUd/ mC^ɋzԡ\&Vӧ]ʸm[>O͘O9bz. +ni73T {XvgO"4CmN5ԯ|bQ5#<̄95߅٨ EI}3^/a wVĶqm>w!]M>:^DuQ|)r|:.`3y{՛2-dj y _q==w"W'Ö$]K-1y~F޷&yT7Idae!'cح-r"ٍi> Q߮|+u=u]BxaYgmQ4puг^_, Px^ ERǥ=܇VUecRD3$ IeKռGoH_n}^ss^⾌ׄt;lmxX' {$3fEBb!Kx&:*ނؔY YQlր3o|j%_gcu:*ɸW,irK Z]O%crb1Vo~qk?,\yZ_?EVM3a_\4ujͪiM]{i I/<|d'|A(ǩyXr٫rxI;|]WK;&#FJ(cB).rձۘ"VO\~7^'nc|aSqUaf}kzCY[sݿa{U֮ >lڷrm)WZXu빼pon'4tOZ9 qig{vsXH : d5^IvMuOxIO$:,קilw._84URߍfQ?C3FKXvq; -)bO~=.y^׿9>JNCۯ-1|زy>3Ŗ;%>Rh=H+6^γꞛ'y5]!mux.ap:Dz~Rac9?.`tʮ>s~dhxc[>&y&.jLޏ]}@ßEN>%ŎM.hq]}V/;Op3洜;IY\Ǻއ4 v佧aTqo;Zg9_w噇Fn3=O?.YCOxͣZsgb:Ⱦw4i&\!6ZkfFI^jRf^niHIe?u<(n ːLL1yz kfbjy`vLE׫}96jN}}aB퀧Ss>ԜwhEQOrkԂnfyt[yRnI[pm>bj2ŵ[SK]qVzN1?Κt%yW⮭"^ϖ'@a64VgG˞Kfޝʣ%5~n>E đ-Z^;wZSOB\"Ps_9F`Hg~V?ig%LD69qO`یinŪKzs$ ~T FfS&Mc 9F gG( +endstream +endobj +854 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 853 0 R +/Resources 4 0 R +/Annots [ 855 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +855 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 770.673057 101.433071 751.923057 ] +/BS << +/W 0 +>> +/Dest (cb234-1) +>> +endobj +856 0 obj +<< +/Filter /FlateDecode +/Length 2795 +>> +stream +xM+ltUI@@AF0 + 琿͏ye-vլbba3"O1J9qQoqW7Nj.J|l.r6y(o߿sWk +>^~L].9K$ +x%]!&Ja2̈ق=2̰Z"S Uj볪Œ15f;|:"fGtTjT90K|LW]J)3x%z3a:bZ2%آI`K(Y.ÖT+UHtU]Ō*tRry.Ua:]Dl*aEaR&[Ju%Sba:p"j.Vz%lT[0!ɉ!+5.1` bQ ,ge5:K53xg P-#zbXT[c؂ +%2(hknMg,P'pa0(%cX` +bgu5XZI +ya,0pWoRlA3N}QwKf,0p(0`V01 V\(E EݐP]vXX`n۹%0,$f.y:[Xe,@c. -a,யȚ/51DpLU3O2HӚF2g8d{RFVgKIzol41m0Yt{= iM{E%wU.^Pe*6G1|C]Uݶ^N>v[jcƿ}=uO{ӧ w{0e,SO>-ݮ,|?uu-RȢsca_.?KǂYp TisDGx~4Q~v dy2]Z $\]ْ"; +})9t&?LzLy[B?/%k˒س.} i>miϘ~kӷq +JlNs\*IǚeP~h}A-`x s.f[?ž̺GCXxmu`5 Uq.o^oaEC7.eU(AL-4R:th-,/6aݙrdoThk),iD+fצlR)akbW/<ɩ&h*k<.սcK+;=4eHrҘ]evVkewb2b6}ąz)bJZ=YN묤ݾlIGpst2k\YZR5˞n{YaӐ43Sŧ_ſY;;VoB|بg PJJ`jW]H+Y{t8S7E 7(/+HkU~>{ +y!47%}! ߯5JB`: +endstream +endobj +857 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 856 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +858 0 obj +<< +/Filter /FlateDecode +/Length 4838 +>> +stream +x][\~_QF#  $dwE{':sX7i O됺PRh;2;sIOkRX=TI,'\9? +I%/y븣7DodRNUV&%Š`h,{޳Ƃ}VXb'G{V>9XÕykU &BQygb.K^1b %8f SN/BdUd9KC;Ee*h+dB*gs{Ld5s&6I0I1)<Y EA@k<,?8(x&KN}bY0Yl>%ų>YCH_Xdxi@@, Uy +kX@D3iX@@[hX@[iX@[.jX@\i5, . T4, `.;5, .=iX@@] +kX@]5, .0p5UdkXt42iX]r6iX]װj`Q؊9[ e BK>H0p A]װ}԰b?Va=x4,@c#-Ѱ w]AS|he\.QÂuӧq WZ6.ƢaA"P  "װ w!RkcXKB3TQ V@JY`~d4,M,sTde5,x5,mz3iXP,dAƧaAHa`- uYV~VkQ]˱W88|KxאvwtQ,waÜW-r"v?@?ZdQ̠A6<'aә9'.NpA9吮5tns4 ~8Y(|ji_}~9U“^x!/g ߋdK&L%H|>m}n(*[u9u[ԯ>gw=K]̒)Xp6Gm-#s /aϿyӢo&ev i\Z rn>L+σעoh2IWuF.td७V|$G}>47K[OWخQosZZkk}i灂s&橎j<2Hf&!˩-W.IO ]?o8b--4̶.y0$O+ƟuYKeUEQ0x9HaM%[.{\h.J~?yzlP|դo$M%?里wDr,[ zS;:3z=ODD|m"* F\/Jz,Ko(j/P⺗Pe/ӣ+ p]kL[>}ZjZq 'YN!rs)Wj;;$ASw\1]-ZTOszc"YSsfLymf7f6Y2͞5^*0%@Iq#]%-fA>ƘQ+ၹο:` yV1٤ u?b7&z-HmޞvTZ;, ^5m`1; +ҽnx;` [RM# j,9/oo:բ)kI.Ex+!ۃL[I i vf0{}wW .O0`V]*qIr 8 /{J%|fjL吜_:oೕWW5g);]7h=u-Nn1:$`J|λ83f*&;'p] u+. 'oAz^j/ij{_:/S9iO[:Yjjv!EC^tB +y3)K@Tt0yRo{a^.c?ߪ!p c!/*,X16{Fin̮7pڀCݓv6y{;WfVX.IUy7=wnN:7燳YvXymaR&=ÝuLSE!$=godMs?M@ǀ&v L˴՝{F8q&w3nbv;&(GQȗ^'vEI} yOė7L})d6!c+T^wWn>ٯW]<wG`M!k?#WG_Vl KoY) uUw@:)[@wy;Oɖ^'i$ot+ zms[J_)DjQ7w/nh,*'_}-H1!vxN} ,pj3L r;zŽY8'"C s;b/κ?Pk/Ҟ㸷-|ydru,Q6bwyAvy z~kVuu;DtLB> +endobj +860 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 383.944475 101.433071 365.194475 ] +/BS << +/W 0 +>> +/Dest (cb237-1) +>> +endobj +861 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 364.997453 99.933071 346.247453 ] +/BS << +/W 0 +>> +/Dest (cb237-2) +>> +endobj +862 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 346.050432 99.933071 327.300432 ] +/BS << +/W 0 +>> +/Dest (cb237-3) +>> +endobj +863 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 327.103410 99.933071 308.353410 ] +/BS << +/W 0 +>> +/Dest (cb237-4) +>> +endobj +864 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 308.156389 99.933071 289.406389 ] +/BS << +/W 0 +>> +/Dest (cb237-5) +>> +endobj +865 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 289.209367 99.933071 270.459367 ] +/BS << +/W 0 +>> +/Dest (cb237-6) +>> +endobj +866 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 270.262346 99.933071 251.512346 ] +/BS << +/W 0 +>> +/Dest (cb237-7) +>> +endobj +867 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 251.315324 99.933071 232.565324 ] +/BS << +/W 0 +>> +/Dest (cb237-8) +>> +endobj +868 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 232.368303 99.933071 213.618303 ] +/BS << +/W 0 +>> +/Dest (cb237-9) +>> +endobj +869 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 213.421281 99.933071 194.671281 ] +/BS << +/W 0 +>> +/Dest (cb237-10) +>> +endobj +870 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 194.474260 99.933071 175.724260 ] +/BS << +/W 0 +>> +/Dest (cb237-11) +>> +endobj +871 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 156.580217 99.933071 137.830217 ] +/BS << +/W 0 +>> +/Dest (cb237-12) +>> +endobj +872 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 118.686174 99.933071 99.936174 ] +/BS << +/W 0 +>> +/Dest (cb237-13) +>> +endobj +873 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 99.739152 99.933071 80.989152 ] +/BS << +/W 0 +>> +/Dest (cb237-14) +>> +endobj +874 0 obj +<< +/Filter /FlateDecode +/Length 3218 +>> +stream +x͛K )ez$ r7`@!_?t=zڝdZfτ/UPk+YNOJ"J.6-̤%$n;H X.⏧c>Z?}o*Pj)UXUJpy*FU&O34*-,3baT0[* vp$ru0T%::N!E\]Kt"!ĞsNaKjĞ.Ī`J-.BZ*lAtUW[({&!tTKEJ!Ut!!6aFarqtdJ$=ŏ'Zmv {[b,` #@̰JKb)A[TJЪգ@-h)a 4q@@$ ab:"M=H-(@D*cJ=xc0<+5rJcvz,@ӽx,PWR cL AMW[ @ \cT<(i=`T0{,@X+y,Pp7VR +Ƃ%Օ9( ܍ nL=(5f @Hz,z]h,D%  ˟3Ae su-pǝy /ιy,H.*X]z,V ,X=˱ǂ"oH x,jz,H.=`TAWW=Ɓz,. D<dpi-R5a:sjRx:p#]<dpזM V00  rJ r#p< YhQHCV=[$F%  ȾlA-=d6U%eUOcvu:. Jр=`/*&>Xf@걠4؂KQc؂$c2]=[ z,bcVh%jOd걠j*z,4NtuXvX6:"I=mY= +["EMo` 2>r4c0ǂͨ 0/mY=4!7smlⱠ)lIHQ\lAԜy &a :y [bS-goVH3DF ToM dt.2o"WVqVĀބ=2 Uq ={h3=5 +%{l@/1ai=5ɆiǞc7X|?WIYahu) +[s +@ +f! :fDiHC73K1v_h2,6vgc$gu(Z$$Xklazg׵$b.c~:/i|g6RzX jҒҗ#~,W(%-`cWFz(0wy0.m*<7_o߿<*Z⒰ZZ{_}YSP pG'Wt5dO89gc[*}hmsv۝:sI/}U~1[`Wq=>}w!75, 9AǺ-.mA /N۬F*AS.﹉g{8ثvYX[Rzm揼kփ4vZ?}?遨־xXwԚ._ʤ^&^B kKn,*+?`w" {t X̗ǸkpNJ:eZBnc9}>\p q// A fl=Ԓ,V{8J\=DZ 6mL>bOг5"1ޓzgOI.ǂOD->o.#2r="6Y]1\Z?|宾_uRSQ7"pK}-QgiV7;n#BKUOEz_u__Z),|"ޞob9Qb3-G5_y?;=y:Ur ;4i/UaH8j+vXA%H߶=0-'K ZrL{=h^ozl潝ҿكaUi{G 3!{xu=lOy;?*!sBrݪ= +bvf_Iěc۫iGm5*r 7  ˛%kSx7x؄Wm)C _B.D69vSz5Mz!\qndY<>\yq$2:6s\J9t#[vpYN|^ĕK:Rk\:lӲk'fC!rv)Ss]."HeXV^;m{?zz}&>L:>tܘI|lx9΀m2d$9sjBk.:کv١ӾP \@F]6Z,ݦWn^*#WOuT:*W-He͒#,TgI۾w_mm4$̔ftS1sR+,ElmD5gGlؒȋ<}Vr{"J֞0AEݘo#yT2Z#^s@h\* %^o.v d(p_ +endstream +endobj +875 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 874 0 R +/Resources 4 0 R +/Annots [ 876 0 R 877 0 R 878 0 R 879 0 R 880 0 R 881 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +876 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb237-15) +>> +endobj +877 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb237-16) +>> +endobj +878 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb237-17) +>> +endobj +879 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb237-18) +>> +endobj +880 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb237-19) +>> +endobj +881 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 662.437950 101.433071 643.687950 ] +/BS << +/W 0 +>> +/Dest (cb238-1) +>> +endobj +882 0 obj +<< +/Filter /FlateDecode +/Length 3339 +>> +stream +x[Mϯ$>!V`@!?MzVڕjw_b愳ϛ?ˇǓw%y%7]~K:ťrMPqXzŸ[]z?τstןDJ-'C QJ!Y" +G&K58j* .E jAR1DC7eP3S4d! gK˵f +dDKFrᐂ%k.眪%c蒚,A%.LX ](7e%B@4CV 2K2ˢO.U"oBp I AŐE}j $ђtaX2DRQ<KKMt[ 3t%[rKR J+WbmK!bKs+`y8[L@0"הAjlqEAdqmbqnٷ`qoهlqpT3[\@\R@bqu)hqvk[\]"SH,S]H]V-.(P]2X\\@>`L0ₒ2c%6eP,.(`qR"-.;I,.4PS% It!  A jXefoqfh%ajK^֙Ihq+M0). 0>N`&9 Pb jܬ +]7eY,.h 㳸$M4PތlqR֛FM,meY,.h ]RS]45#nIXo,Y.-gYoV f`,vx750%"3MdރxSA~f 8cA segAF27 &V5V! 6_c| ޢp9dCX0Xbد?}{_oNHivl'CYW LQokIXxc5X;C^;J+zQ=QV7pJlN]Uӫe˾ӏ菺eMJ&A|0΁Gd,K[c0{(!cCFj+*pGXϣ,-CG4e6d^1|>TUS^egs>MjjYDz5r/+;_,{; ݔ_5~c_9_ ª~ { d/K9{ X=?_ C5lk oli}8}?y*~~l1>Sڮd)O!ogR-jx,lW UF~ynuYșVa|BMn)?ymn{i'^v ]69^o[=۶] ÷֙6\ֺV{Y4ڍ,xYϛcf֣_Ї] ˇj~_O&ٺ~=(6҃b~Jw ltv5tc2sͨe<Ӳ u].ڟlgU+㱽噞ܔOڜo")TOF۰+c3bj=_Ϗvsޫ*ԯ/korş~s6k>;$3}=/c )=1SXω[mt=uݔ~:ze/;>izkhrAUT~76ۣZ"HQnw[oS7٫E{gK$jP馊q+?-d)i\}Ri{eZ &}\P~Mu][CvwRns?aD6p7lOՅ(Gϙ88a +ݰē`Yj?+ҫ>N|L?;\Y$ـ]|&,~g]F]NdtSeS1i<&ُB߸n  #a9^wywઐuUzp tz܂#}% k5l,j8?^V]DDjX7RM4s@x|GՌr5jrgp$(g@Yn-͑*T]arumEbӸ<’s̱UM/37UK> z'\򗅖:LU +ӥdӺ[HlNh$:lY pYeB)gBFy!YzZ*)$#MX(lgrP-8MWg +g=z'w^5\96*Ol| ȂjLK1‚^;qlox-g2N}&,oaȊ*7y> +endobj +884 0 obj +<< +/Filter /FlateDecode +/Length 3184 +>> +stream +x[ˎd WȔHËY@8 ʌ&8~Uz*ݍPW(U3ǟ"ޕRsÉ\Vp?ٓd}M%+CN nOߜ}|Ɵ5ϿU%gBD Q.!JޡZ"ye!DK5$b +`ɞEjA _c6DD CK0zdTj,Csd.e[RJX2.dD/B ltdʠK(-Y.֩@xW1eЅyKVZDLYJ.@L{lQ Y.b5e%2KEks)Fn&,B2 $B9YrK  NBNrfBNR0yȂ DI.5eЅX\%[\`[X\[-.`O0j • ep Eg 1 R edqw).p` }a ˞E 0~,.P +Y\ PH,.nȘLYvA@!  p!3B@! lq*si+?#VΗ,.]_0|:aq#naeSD.&* wApÌ,.]Ϙ-xׇJD.hqy$`~s຦:X\`qfaGLbʲ#y @ƎZ\ޫ K%Acʠ `qFL#Yu K#lDZ\:mZ\X\`qA*jT 2|,9G 2,S]$H]Z,.p]2X\U\@>L0+Uc%K 6e2-.YboqR -.;M,.y WPS+%It! A J(Xe&34֒0%ufHr*Z\0JLiʠ h.X`e).R.7@@7 2> *%iqȈ,.`ĥ7 M,񌸭t-.]"RS]4U#nIXo,Y.5%]o f`(vx7V0%"3MMdڞ@1#?EW1 PojnU6 k$sjbeYkiBO'v-wȘ3KNV kU)vӷO|?S6~7)h*F ym+f( rM`۵hXzc5X5vt֓ XqzzrԲe' 􇽎eMJƴA|<5#:]%J#Xcu!Fjqfn.1>2(C >Ў#k2:>Tl*cZegs;P2}hӫe˾Ds~0X`هv@>dm _ҟ|~z/|/gٗK,>?|\ C5_ʼn:@g<~o?/N|?1Q=E! |">?<Ӟ5iAZV7Dk:{m>۽'4ZX;lA͞u_ܮezFR{g:^n0jM7Hˎ2ރXџki=SN=CMxt+'?G˿a;Fmyv)#{OoZCkh.|^'y0}'^[c=u;]l^|ݷڙD:GXm۶}Fo-AL[QpRf`% å&PlYp,-Wr:r ɚ+S$ݡݼrه80lNK<|$uYbc|3??d;a'WI۱c2M)3jp fד2Ayf]G]N5+Qr2}>(ǭaē?{0kfqTpP'aϴx}?M8UMeCކcB&FUú&ƛRuq"s H9ۨ[X#,WG9r8G*Re=Z*չLXQG=bx\aXS&id,%|gw{adWҝf Dzfi&63ri(+_3Pƒ=z&w^w8zhd;|~6=_F# 4g.@ + ^4zmNz~\ fSPuܳ,/ϿNr&[ɭx|LXWaA6_/l068-b%dP?; 78L 7ď;+D淎͚oV +7{wp[ה|ުĝ]S:qWۭ4;72M>mm7[dٽꁵ^lE~W,~o1UN#>Ύ): Fݦs7#xf]$gJ-p膖X/Fe`FD1 l֘N?6z\L+S,qiĸJz(ofK<s^UrDe=-Ƕl{޺!K2SZŇ__;VUj_15L3n<8Dxm|3_{Hjo ᄙ*\!lUڏU2exb/7 +mChf]*wYޢ_ű(O-?# +endstream +endobj +885 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 884 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +886 0 obj +<< +/Filter /FlateDecode +/Length 4208 +>> +stream +x\K ϯzr$p k#Xsz9ٕZvbȏdMw۳2%"/ONfI_iTMl %s8dOK*x~:]Sv:k-DgE~I9%VXBXRr!*h,1B"GGVTrX ++C O#@ ,i,aKH +a1*" Kңsvx69`5^Yb!k<,d h'!ިWqoX4,]*aA>iX#RkFLXOU9$̜xnAG1+~9}{?oIYa준i+'(!(O gd;L׸'SJY>mr,r[&A~:X@E#0$1q'yIPTS;~/џSƗ"݅YSmWV2"K`;ۭN^M$(+.bnBId{_|:7&4[t$?XtæbBF7!#L(ⴖ1$J \jjGq/˙:;?( +3QwȫN&&u|s'+Z:߫=T'{^y!_`wy,xwd-mIDۿ-w|g}Sych +7My~j̸gl]<>V0J]F|&Y\iURvZܧ(5iK[5+/4>VV 5x^{kkK^)B[!Ե=6:难"V:^Yo\,Պ6V:{a}m:2U}'] v^u!iٯdǽLC_K鮇*:1c湯{x> k+qYxLѥYFSQyqOP5? ++ ĽF7;@*p jn 8nbՆvsȈ󡯇s";<5]p8vT ]}xou=abį;N>X`.m-lq+=q%kD/Mqb.f^= +6ֱ~n}n)t>$~yWp#5gl2-_~0cܰYhh77+Ϊ<F ?Y*>U?7قЭzk{BD29D<#+mǪtݗo.XUw"W"A(L+T}u_.rk-Z=5hs5}5Xc߻ےbJZmVT=9Auqnɇ1zz@ĈӾ{^p[&;u2Z[n%:ۉGjm_oՅm.m3W+3tZe|(]<Ⱄ3?7ް=5'5m^Qw[ |ameV}H8?!5=lkuM`8`6Vd#qc۟շlRm^˵+u{B ~3::QE%tݷ<Έ+=?kXL +g.tDg;Yg)DVTߴo]K 6ڞqdDyBQyQe'}='%qwRm&G󠗟~;qWзm^teK3Y* 4 @Ϧg"c?#`ԭNkn/77=Um+ZXoczjwY%{/]]"3NꋡD?Q{aEUgsz\7㻾O7luhՌyrob?s<[ӻv_t}_9Kш[-wt}Wr~x0$3vJEˍjy䏫Y3cT`*9ޘ2$3}4c,]N&>,},cpGj/'sN>NqeG2,-y(!v1 ɾsygA GM..$ѥ%cR>T׮3PePC96>)$@|cЄ|kJݐh+B~m0v*^y^Z(}WhUG@Gd^,Sቓ\?;+L'^;L{Td4~~_" *#O`i?:[sA*I@4`);B]6aR_6?=4 + z*]<[V7 a]?+%t!0$aO3 WɢƸv>Ir;n!W|'^j`=M?I&ٙd8(LѧJ:Љ_R?N'"멆9+|~ +e-~u_kwfغ!Ho3wF8F ؟dgЭaq^ӼL`=@P; u ̈́N#ҽ{mY8ϏvАA3O!,Dΐn6Bq!rP4ńeJ RN2T +sH#'fCwZ]ˆlQ~{}7ch'I c> +endobj +888 0 obj +<< +/Filter /FlateDecode +/Length 4501 +>> +stream +x\K$qׯ和 0 m= >z$V> Vѕ3-ӕ|D_9XÕykU &BQygb.K^1b %8f SN/BdUd9KC;Ee*h+dB*gs{Ld5s&6IaGabRxDʃ,xY?8(V/,9 Udk#d)jd4 ).5 g +\ D  ǒ4 N%pԐda\Y! hX@Y<eXe[e뢆VRaraJESb' K!z K%vVʃ,0` \& K& m5,a԰b|VlY$ nA]װ}԰b?Va=x4,`#,Ѱ w]S4ʸ\2O4[hٸ GE.3kX7^ÂuOaA"nCaq%g p5,66IT^20$aXġD.{Ѱ wm Ұ w-#Qyװq xضʞFjRhl D ְ g/fְ gװ)fҰXȂOÂb0Y8xjXP\FYK7,Mxʾ-%L,!ʃ,oI7N/B_XÂY7ѫ%,fRPL4jX 䛈lxCB|3dYX@ooUK oԚJ &2ժ*Ϊe E<;LWU9$̜& #9hF4Op?˯j8?q5X|zLJL@UDHUDTDL8c8rZh,R;3x51բKN$PSYMoĹk=5;;>.^8DžG#w8y!{p -z$%O?_ϟ#VӗI]rV*_f_m<~N?ӏ߻JA>/ yLUin^ĩN8hv ]w[jɭ[oi:nuRij߰ |^ir+4kwѪJraQ[s4*ZUۥU֗Jxz*՛dzVѷ鹚O^ƿX&{D@=/krtFie|K T 8AN#vk,[G*_ +fx قm`zWC􎺼+m|/%<-9 yg/|ʲyAt7r_<\WH1"hW9jvoQ8Y +bM\@V:ɣD?|dnkt^q~EbLRD$XИ6}7cXԇ۶ =\hN) z?OP#ż͌__[koǍ AfAuc$y2?0N/Ia{~lݝ,pp֛TlAҲx:qfj"oQӆW̃XRvl"??63=>i0L#W9C 3D%WN>'|< 1f#tL{5ɹ@R8z? F*|O}"RzWpmBnƻ>-61e7Tx#ȔVoQ0^03Ԯ1M sôkA\=k {CY_s45#,8@A&+qM 0`M$mvJk O61:aѩ`ul?+v[1VkU!%-!'aPa \foGp~ZIrx,8oU"/t}69C6!0|-Dj%ɛl*~`nyɎa]; ~滑텴~yDwWm?>nOql??q}:teo!Tp :< ˖صerUJFV?HVA^8_, 61wJξ] E2s;D}H3ٍvÆOl[b;c?=^nhAG]'Vݞ,wo[rb>Zb%&3i@ێGC#;ÞhsI.b}ViZGҖR%`hC5zi4 U:5}AB]w tujn!qoWZ;tB_[ѵ4QSWhUG 5M{R&U};킠wKHJ0†fz3q;9a/rSfɛ*B +IjL"{J鱣kpFI].n\J{޺klET6Si HuX]NkX9m r"9Cߪɢ=q9v|ɩq'o[ul%6 KOl" +<`n$G0DZ4{Rݜ U57Qګw?mG ߱uE=|Z>IwLoyAvy ~kuu;Dt嵮xh2ߺ6a/!yɿIvH[w |ĕ4.\SG\̃r VbAΓtՋk%H3a9 䛇u^(njizb[zRЀSՓV B2I(4Kfdoe )V% +endstream +endobj +889 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 888 0 R +/Resources 4 0 R +/Annots [ 890 0 R 891 0 R 892 0 R 893 0 R 894 0 R 895 0 R 896 0 R 897 0 R 898 0 R 899 0 R 900 0 R 901 0 R 902 0 R 903 0 R 904 0 R 905 0 R 906 0 R 907 0 R 908 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +890 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 709.923057 101.433071 691.173057 ] +/BS << +/W 0 +>> +/Dest (cb241-1) +>> +endobj +891 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 690.976036 99.933071 672.226036 ] +/BS << +/W 0 +>> +/Dest (cb241-2) +>> +endobj +892 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 672.029014 99.933071 653.279014 ] +/BS << +/W 0 +>> +/Dest (cb241-3) +>> +endobj +893 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 653.081993 99.933071 634.331993 ] +/BS << +/W 0 +>> +/Dest (cb241-4) +>> +endobj +894 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 634.134971 99.933071 615.384971 ] +/BS << +/W 0 +>> +/Dest (cb241-5) +>> +endobj +895 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 615.187950 99.933071 596.437950 ] +/BS << +/W 0 +>> +/Dest (cb241-6) +>> +endobj +896 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 596.240928 99.933071 577.490928 ] +/BS << +/W 0 +>> +/Dest (cb241-7) +>> +endobj +897 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 577.293907 99.933071 558.543907 ] +/BS << +/W 0 +>> +/Dest (cb241-8) +>> +endobj +898 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 558.346885 99.933071 539.596885 ] +/BS << +/W 0 +>> +/Dest (cb241-9) +>> +endobj +899 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 539.399864 99.933071 520.649864 ] +/BS << +/W 0 +>> +/Dest (cb241-10) +>> +endobj +900 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 520.452842 99.933071 501.702842 ] +/BS << +/W 0 +>> +/Dest (cb241-11) +>> +endobj +901 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 463.611778 99.933071 444.861778 ] +/BS << +/W 0 +>> +/Dest (cb241-12) +>> +endobj +902 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 444.664756 99.933071 425.914756 ] +/BS << +/W 0 +>> +/Dest (cb241-13) +>> +endobj +903 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 425.717735 99.933071 406.967735 ] +/BS << +/W 0 +>> +/Dest (cb241-14) +>> +endobj +904 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 406.770714 99.933071 388.020714 ] +/BS << +/W 0 +>> +/Dest (cb241-15) +>> +endobj +905 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 387.823692 99.933071 369.073692 ] +/BS << +/W 0 +>> +/Dest (cb241-16) +>> +endobj +906 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 368.876671 99.933071 350.126671 ] +/BS << +/W 0 +>> +/Dest (cb241-17) +>> +endobj +907 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 349.929649 99.933071 331.179649 ] +/BS << +/W 0 +>> +/Dest (cb241-18) +>> +endobj +908 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 288.982628 101.433071 270.232628 ] +/BS << +/W 0 +>> +/Dest (cb242-1) +>> +endobj +909 0 obj +<< +/Title (CIS v1.6 Benchmark - Self-Assessment Guide - Rancher v2.6) +/Dest [ 6 0 R /XYZ 85.009843 502.818898 0 ] +/Count 141 +/First 910 0 R +/Last 1046 0 R +/Parent 1051 0 R +>> +endobj +910 0 obj +<< +/Title (CIS v1.6 Kubernetes Benchmark - Rancher v2.6 with Kubernetes v1.18 to v1.21) +/Dest [ 298 0 R /XYZ 84.259843 782.570079 0 ] +/Count 2 +/First 911 0 R +/Last 912 0 R +/Parent 909 0 R +/Next 913 0 R +>> +endobj +911 0 obj +<< +/Title (Overview) +/Dest [ 298 0 R /XYZ 84.259843 700.022079 0 ] +/Count 0 +/Parent 910 0 R +/Next 912 0 R +>> +endobj +912 0 obj +<< +/Title (Testing controls methodology) +/Dest [ 298 0 R /XYZ 84.259843 161.276079 0 ] +/Count 0 +/Prev 911 0 R +/Parent 910 0 R +>> +endobj +913 0 obj +<< +/Title (Controls) +/Dest [ 303 0 R /XYZ 84.259843 609.981496 0 ] +/Count 0 +/Prev 910 0 R +/Parent 909 0 R +/Next 914 0 R +>> +endobj +914 0 obj +<< +/Title (1.1 Master Node Configuration Files) +/Dest [ 307 0 R /XYZ 41.740157 784.430079 0 ] +/Count 21 +/Prev 913 0 R +/First 915 0 R +/Last 935 0 R +/Parent 909 0 R +/Next 936 0 R +>> +endobj +915 0 obj +<< +/Title (1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 307 0 R /XYZ 84.259843 682.791496 0 ] +/Count 0 +/Parent 914 0 R +/Next 916 0 R +>> +endobj +916 0 obj +<< +/Title (1.1.2 Ensure that the API server pod specification file ownership is set to root:root \(Automated\)) +/Dest [ 307 0 R /XYZ 84.259843 532.191496 0 ] +/Count 0 +/Prev 915 0 R +/Parent 914 0 R +/Next 917 0 R +>> +endobj +917 0 obj +<< +/Title (1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 307 0 R /XYZ 84.259843 396.591496 0 ] +/Count 0 +/Prev 916 0 R +/Parent 914 0 R +/Next 918 0 R +>> +endobj +918 0 obj +<< +/Title (1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root \(Automated\)) +/Dest [ 307 0 R /XYZ 84.259843 245.991496 0 ] +/Count 0 +/Prev 917 0 R +/Parent 914 0 R +/Next 919 0 R +>> +endobj +919 0 obj +<< +/Title (1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 309 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 918 0 R +/Parent 914 0 R +/Next 920 0 R +>> +endobj +920 0 obj +<< +/Title (1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root \(Automated\)) +/Dest [ 309 0 R /XYZ 84.259843 648.770079 0 ] +/Count 0 +/Prev 919 0 R +/Parent 914 0 R +/Next 921 0 R +>> +endobj +921 0 obj +<< +/Title (1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 309 0 R /XYZ 84.259843 513.170079 0 ] +/Count 0 +/Prev 920 0 R +/Parent 914 0 R +/Next 922 0 R +>> +endobj +922 0 obj +<< +/Title (1.1.8 Ensure that the etcd pod specification file ownership is set to root:root \(Automated\)) +/Dest [ 309 0 R /XYZ 84.259843 362.570079 0 ] +/Count 0 +/Prev 921 0 R +/Parent 914 0 R +/Next 923 0 R +>> +endobj +923 0 obj +<< +/Title (1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive \(Manual\)) +/Dest [ 309 0 R /XYZ 84.259843 226.970079 0 ] +/Count 0 +/Prev 922 0 R +/Parent 914 0 R +/Next 924 0 R +>> +endobj +924 0 obj +<< +/Title (1.1.10 Ensure that the Container Network Interface file ownership is set to root:root \(Manual\)) +/Dest [ 311 0 R /XYZ 84.259843 760.623057 0 ] +/Count 0 +/Prev 923 0 R +/Parent 914 0 R +/Next 925 0 R +>> +endobj +925 0 obj +<< +/Title (1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 311 0 R /XYZ 84.259843 579.076036 0 ] +/Count 0 +/Prev 924 0 R +/Parent 914 0 R +/Next 926 0 R +>> +endobj +926 0 obj +<< +/Title (1.1.14 Ensure that the admin.conf file ownership is set to root:root \(Automated\)) +/Dest [ 311 0 R /XYZ 84.259843 458.476036 0 ] +/Count 0 +/Prev 925 0 R +/Parent 914 0 R +/Next 927 0 R +>> +endobj +927 0 obj +<< +/Title (1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 311 0 R /XYZ 84.259843 337.876036 0 ] +/Count 0 +/Prev 926 0 R +/Parent 914 0 R +/Next 928 0 R +>> +endobj +928 0 obj +<< +/Title (1.1.16 Ensure that the scheduler.conf file ownership is set to root:root \(Automated\)) +/Dest [ 311 0 R /XYZ 84.259843 202.276036 0 ] +/Count 0 +/Prev 927 0 R +/Parent 914 0 R +/Next 929 0 R +>> +endobj +929 0 obj +<< +/Title (1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 315 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 928 0 R +/Parent 914 0 R +/Next 930 0 R +>> +endobj +930 0 obj +<< +/Title (1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root \(Automated\)) +/Dest [ 315 0 R /XYZ 84.259843 648.770079 0 ] +/Count 0 +/Prev 929 0 R +/Parent 914 0 R +/Next 931 0 R +>> +endobj +931 0 obj +<< +/Title (1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root \(Automated\)) +/Dest [ 315 0 R /XYZ 84.259843 513.170079 0 ] +/Count 0 +/Prev 930 0 R +/Parent 914 0 R +/Next 932 0 R +>> +endobj +932 0 obj +<< +/Title (1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 364 0 R /XYZ 84.259843 733.820079 0 ] +/Count 0 +/Prev 931 0 R +/Parent 914 0 R +/Next 933 0 R +>> +endobj +933 0 obj +<< +/Title (1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 \(Automated\)) +/Dest [ 427 0 R /XYZ 84.259843 541.781993 0 ] +/Count 0 +/Prev 932 0 R +/Parent 914 0 R +/Next 934 0 R +>> +endobj +934 0 obj +<< +/Title (1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive \(Automated\)) +/Dest [ 486 0 R /XYZ 84.259843 409.152842 0 ] +/Count 0 +/Prev 933 0 R +/Parent 914 0 R +/Next 935 0 R +>> +endobj +935 0 obj +<< +/Title (1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd \(Automated\)) +/Dest [ 499 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 934 0 R +/Parent 914 0 R +>> +endobj +936 0 obj +<< +/Title (1.2 API Server) +/Dest [ 502 0 R /XYZ 41.740157 784.430079 0 ] +/Count 35 +/Prev 914 0 R +/First 937 0 R +/Last 971 0 R +/Parent 909 0 R +/Next 972 0 R +>> +endobj +937 0 obj +<< +/Title (1.2.1 Ensure that the --anonymous-auth argument is set to false \(Automated\)) +/Dest [ 502 0 R /XYZ 84.259843 718.791496 0 ] +/Count 0 +/Parent 936 0 R +/Next 938 0 R +>> +endobj +938 0 obj +<< +/Title (1.2.2 Ensure that the --basic-auth-file argument is not set \(Automated\)) +/Dest [ 505 0 R /XYZ 84.259843 274.820079 0 ] +/Count 0 +/Prev 937 0 R +/Parent 936 0 R +/Next 939 0 R +>> +endobj +939 0 obj +<< +/Title (1.2.3 Ensure that the --token-auth-file parameter is not set \(Automated\)) +/Dest [ 510 0 R /XYZ 84.259843 556.070079 0 ] +/Count 0 +/Prev 938 0 R +/Parent 936 0 R +/Next 940 0 R +>> +endobj +940 0 obj +<< +/Title (1.2.4 Ensure that the --kubelet-https argument is set to true \(Automated\)) +/Dest [ 515 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 939 0 R +/Parent 936 0 R +/Next 941 0 R +>> +endobj +941 0 obj +<< +/Title (1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate \(Automated\)) +/Dest [ 518 0 R /XYZ 84.259843 331.070079 0 ] +/Count 0 +/Prev 940 0 R +/Parent 936 0 R +/Next 942 0 R +>> +endobj +942 0 obj +<< +/Title (1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate \(Automated\)) +/Dest [ 523 0 R /XYZ 84.259843 537.320079 0 ] +/Count 0 +/Prev 941 0 R +/Parent 936 0 R +/Next 943 0 R +>> +endobj +943 0 obj +<< +/Title (1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow \(Automated\)) +/Dest [ 528 0 R /XYZ 84.259843 743.570079 0 ] +/Count 0 +/Prev 942 0 R +/Parent 936 0 R +/Next 944 0 R +>> +endobj +944 0 obj +<< +/Title (1.2.8 Ensure that the --authorization-mode argument includes Node \(Automated\)) +/Dest [ 531 0 R /XYZ 84.259843 293.570079 0 ] +/Count 0 +/Prev 943 0 R +/Parent 936 0 R +/Next 945 0 R +>> +endobj +945 0 obj +<< +/Title (1.2.9 Ensure that the --authorization-mode argument includes RBAC \(Automated\)) +/Dest [ 536 0 R /XYZ 84.259843 574.820079 0 ] +/Count 0 +/Prev 944 0 R +/Parent 936 0 R +/Next 946 0 R +>> +endobj +946 0 obj +<< +/Title (1.2.10 Ensure that the admission control plugin EventRateLimit is set \(Automated\)) +/Dest [ 541 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 945 0 R +/Parent 936 0 R +/Next 947 0 R +>> +endobj +947 0 obj +<< +/Title (1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set \(Automated\)) +/Dest [ 544 0 R /XYZ 84.259843 256.070079 0 ] +/Count 0 +/Prev 946 0 R +/Parent 936 0 R +/Next 948 0 R +>> +endobj +948 0 obj +<< +/Title (1.2.12 Ensure that the admission control plugin AlwaysPullImages is set \(Manual\)) +/Dest [ 549 0 R /XYZ 84.259843 424.820079 0 ] +/Count 0 +/Prev 947 0 R +/Parent 936 0 R +/Next 949 0 R +>> +endobj +949 0 obj +<< +/Title (1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used \(Manual\)) +/Dest [ 549 0 R /XYZ 84.259843 213.273057 0 ] +/Count 0 +/Prev 948 0 R +/Parent 936 0 R +/Next 950 0 R +>> +endobj +950 0 obj +<< +/Title (1.2.14 Ensure that the admission control plugin ServiceAccount is set \(Automated\)) +/Dest [ 552 0 R /XYZ 84.259843 691.623057 0 ] +/Count 0 +/Prev 949 0 R +/Parent 936 0 R +/Next 951 0 R +>> +endobj +951 0 obj +<< +/Title (1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set \(Automated\)) +/Dest [ 556 0 R /XYZ 84.259843 199.820079 0 ] +/Count 0 +/Prev 950 0 R +/Parent 936 0 R +/Next 952 0 R +>> +endobj +952 0 obj +<< +/Title (1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set \(Automated\)) +/Dest [ 561 0 R /XYZ 84.259843 424.820079 0 ] +/Count 0 +/Prev 951 0 R +/Parent 936 0 R +/Next 953 0 R +>> +endobj +953 0 obj +<< +/Title (1.2.17 Ensure that the admission control plugin NodeRestriction is set \(Automated\)) +/Dest [ 566 0 R /XYZ 84.259843 556.070079 0 ] +/Count 0 +/Prev 952 0 R +/Parent 936 0 R +/Next 954 0 R +>> +endobj +954 0 obj +<< +/Title (1.2.18 Ensure that the --insecure-bind-address argument is not set \(Automated\)) +/Dest [ 571 0 R /XYZ 84.259843 706.070079 0 ] +/Count 0 +/Prev 953 0 R +/Parent 936 0 R +/Next 955 0 R +>> +endobj +955 0 obj +<< +/Title (1.2.19 Ensure that the --insecure-port argument is set to 0 \(Automated\)) +/Dest [ 574 0 R /XYZ 84.259843 256.070079 0 ] +/Count 0 +/Prev 954 0 R +/Parent 936 0 R +/Next 956 0 R +>> +endobj +956 0 obj +<< +/Title (1.2.20 Ensure that the --secure-port argument is not set to 0 \(Automated\)) +/Dest [ 579 0 R /XYZ 84.259843 556.070079 0 ] +/Count 0 +/Prev 955 0 R +/Parent 936 0 R +/Next 957 0 R +>> +endobj +957 0 obj +<< +/Title (1.2.21 Ensure that the --profiling argument is set to false \(Automated\)) +/Dest [ 584 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 956 0 R +/Parent 936 0 R +/Next 958 0 R +>> +endobj +958 0 obj +<< +/Title (1.2.22 Ensure that the --audit-log-path argument is set \(Automated\)) +/Dest [ 587 0 R /XYZ 84.259843 349.820079 0 ] +/Count 0 +/Prev 957 0 R +/Parent 936 0 R +/Next 959 0 R +>> +endobj +959 0 obj +<< +/Title (1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate \(Automated\)) +/Dest [ 592 0 R /XYZ 84.259843 612.320079 0 ] +/Count 0 +/Prev 958 0 R +/Parent 936 0 R +/Next 960 0 R +>> +endobj +960 0 obj +<< +/Title (1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate \(Automated\)) +/Dest [ 597 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 959 0 R +/Parent 936 0 R +/Next 961 0 R +>> +endobj +961 0 obj +<< +/Title (1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate \(Automated\)) +/Dest [ 600 0 R /XYZ 84.259843 331.070079 0 ] +/Count 0 +/Prev 960 0 R +/Parent 936 0 R +/Next 962 0 R +>> +endobj +962 0 obj +<< +/Title (1.2.26 Ensure that the --request-timeout argument is set as appropriate \(Automated\)) +/Dest [ 605 0 R /XYZ 84.259843 574.820079 0 ] +/Count 0 +/Prev 961 0 R +/Parent 936 0 R +/Next 963 0 R +>> +endobj +963 0 obj +<< +/Title (1.2.27 Ensure that the --service-account-lookup argument is set to true \(Automated\)) +/Dest [ 610 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 962 0 R +/Parent 936 0 R +/Next 964 0 R +>> +endobj +964 0 obj +<< +/Title (1.2.28 Ensure that the --service-account-key-file argument is set as appropriate \(Automated\)) +/Dest [ 613 0 R /XYZ 84.259843 312.320079 0 ] +/Count 0 +/Prev 963 0 R +/Parent 936 0 R +/Next 965 0 R +>> +endobj +965 0 obj +<< +/Title (1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate \(Automated\)) +/Dest [ 618 0 R /XYZ 84.259843 574.820079 0 ] +/Count 0 +/Prev 964 0 R +/Parent 936 0 R +/Next 966 0 R +>> +endobj +966 0 obj +<< +/Title (1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate \(Automated\)) +/Dest [ 623 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 965 0 R +/Parent 936 0 R +/Next 967 0 R +>> +endobj +967 0 obj +<< +/Title (1.2.31 Ensure that the --client-ca-file argument is set as appropriate \(Automated\)) +/Dest [ 626 0 R /XYZ 84.259843 293.570079 0 ] +/Count 0 +/Prev 966 0 R +/Parent 936 0 R +/Next 968 0 R +>> +endobj +968 0 obj +<< +/Title (1.2.32 Ensure that the --etcd-cafile argument is set as appropriate \(Automated\)) +/Dest [ 631 0 R /XYZ 84.259843 574.820079 0 ] +/Count 0 +/Prev 967 0 R +/Parent 936 0 R +/Next 969 0 R +>> +endobj +969 0 obj +<< +/Title (1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate \(Automated\)) +/Dest [ 636 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 968 0 R +/Parent 936 0 R +/Next 970 0 R +>> +endobj +970 0 obj +<< +/Title (1.2.34 Ensure that encryption providers are appropriately configured \(Automated\)) +/Dest [ 639 0 R /XYZ 84.259843 331.070079 0 ] +/Count 0 +/Prev 969 0 R +/Parent 936 0 R +/Next 971 0 R +>> +endobj +971 0 obj +<< +/Title (1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers \(Automated\)) +/Dest [ 645 0 R /XYZ 84.259843 162.841563 0 ] +/Count 0 +/Prev 970 0 R +/Parent 936 0 R +>> +endobj +972 0 obj +<< +/Title (1.3 Controller Manager) +/Dest [ 672 0 R /XYZ 41.740157 784.430079 0 ] +/Count 7 +/Prev 936 0 R +/First 973 0 R +/Last 979 0 R +/Parent 909 0 R +/Next 980 0 R +>> +endobj +973 0 obj +<< +/Title (1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate \(Automated\)) +/Dest [ 672 0 R /XYZ 84.259843 718.791496 0 ] +/Count 0 +/Parent 972 0 R +/Next 974 0 R +>> +endobj +974 0 obj +<< +/Title (1.3.2 Ensure that the --profiling argument is set to false \(Automated\)) +/Dest [ 672 0 R /XYZ 84.259843 145.744475 0 ] +/Count 0 +/Prev 973 0 R +/Parent 972 0 R +/Next 975 0 R +>> +endobj +975 0 obj +<< +/Title (1.3.3 Ensure that the --use-service-account-credentials argument is set to true \(Automated\)) +/Dest [ 675 0 R /XYZ 84.259843 330.123057 0 ] +/Count 0 +/Prev 974 0 R +/Parent 972 0 R +/Next 976 0 R +>> +endobj +976 0 obj +<< +/Title (1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate \(Automated\)) +/Dest [ 679 0 R /XYZ 84.259843 508.820079 0 ] +/Count 0 +/Prev 975 0 R +/Parent 972 0 R +/Next 977 0 R +>> +endobj +977 0 obj +<< +/Title (1.3.5 Ensure that the --root-ca-file argument is set as appropriate \(Automated\)) +/Dest [ 682 0 R /XYZ 84.259843 631.070079 0 ] +/Count 0 +/Prev 976 0 R +/Parent 972 0 R +/Next 978 0 R +>> +endobj +978 0 obj +<< +/Title (1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true \(Automated\)) +/Dest [ 685 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 977 0 R +/Parent 972 0 R +/Next 979 0 R +>> +endobj +979 0 obj +<< +/Title (1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 \(Automated\)) +/Dest [ 685 0 R /XYZ 84.259843 591.770079 0 ] +/Count 0 +/Prev 978 0 R +/Parent 972 0 R +>> +endobj +980 0 obj +<< +/Title (1.4 Scheduler) +/Dest [ 690 0 R /XYZ 41.740157 784.430079 0 ] +/Count 2 +/Prev 972 0 R +/First 981 0 R +/Last 982 0 R +/Parent 909 0 R +/Next 983 0 R +>> +endobj +981 0 obj +<< +/Title (1.4.1 Ensure that the --profiling argument is set to false \(Automated\)) +/Dest [ 690 0 R /XYZ 84.259843 718.791496 0 ] +/Count 0 +/Parent 980 0 R +/Next 982 0 R +>> +endobj +982 0 obj +<< +/Title (1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 \(Automated\)) +/Dest [ 690 0 R /XYZ 84.259843 363.244475 0 ] +/Count 0 +/Prev 981 0 R +/Parent 980 0 R +>> +endobj +983 0 obj +<< +/Title (2 Etcd Node Configuration Files) +/Dest [ 696 0 R /XYZ 41.740157 784.430079 0 ] +/Count 7 +/Prev 980 0 R +/First 984 0 R +/Last 990 0 R +/Parent 909 0 R +/Next 991 0 R +>> +endobj +984 0 obj +<< +/Title (2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate \(Automated\)) +/Dest [ 696 0 R /XYZ 84.259843 682.791496 0 ] +/Count 0 +/Parent 983 0 R +/Next 985 0 R +>> +endobj +985 0 obj +<< +/Title (2.2 Ensure that the --client-cert-auth argument is set to true \(Automated\)) +/Dest [ 701 0 R /XYZ 84.259843 537.320079 0 ] +/Count 0 +/Prev 984 0 R +/Parent 983 0 R +/Next 986 0 R +>> +endobj +986 0 obj +<< +/Title (2.3 Ensure that the --auto-tls argument is not set to true \(Automated\)) +/Dest [ 706 0 R /XYZ 84.259843 406.070079 0 ] +/Count 0 +/Prev 985 0 R +/Parent 983 0 R +/Next 987 0 R +>> +endobj +987 0 obj +<< +/Title (2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate \(Automated\)) +/Dest [ 711 0 R /XYZ 84.259843 274.820079 0 ] +/Count 0 +/Prev 986 0 R +/Parent 983 0 R +/Next 988 0 R +>> +endobj +988 0 obj +<< +/Title (2.5 Ensure that the --peer-client-cert-auth argument is set to true \(Automated\)) +/Dest [ 718 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 987 0 R +/Parent 983 0 R +/Next 989 0 R +>> +endobj +989 0 obj +<< +/Title (2.6 Ensure that the --peer-auto-tls argument is not set to true \(Automated\)) +/Dest [ 723 0 R /XYZ 84.259843 649.820079 0 ] +/Count 0 +/Prev 988 0 R +/Parent 983 0 R +/Next 990 0 R +>> +endobj +990 0 obj +<< +/Title (2.7 Ensure that a unique Certificate Authority is used for etcd \(Automated\)) +/Dest [ 728 0 R /XYZ 84.259843 499.820079 0 ] +/Count 0 +/Prev 989 0 R +/Parent 983 0 R +>> +endobj +991 0 obj +<< +/Title (3.1 Authentication and Authorization) +/Dest [ 735 0 R /XYZ 41.740157 784.430079 0 ] +/Count 1 +/Prev 983 0 R +/First 992 0 R +/Last 992 0 R +/Parent 909 0 R +/Next 993 0 R +>> +endobj +992 0 obj +<< +/Title (3.1.1 Client certificate authentication should not be used for users \(Manual\)) +/Dest [ 735 0 R /XYZ 84.259843 682.791496 0 ] +/Count 0 +/Parent 991 0 R +>> +endobj +993 0 obj +<< +/Title (3.2 Logging) +/Dest [ 737 0 R /XYZ 41.740157 784.430079 0 ] +/Count 2 +/Prev 991 0 R +/First 994 0 R +/Last 995 0 R +/Parent 909 0 R +/Next 996 0 R +>> +endobj +994 0 obj +<< +/Title (3.2.1 Ensure that a minimal audit policy is created \(Automated\)) +/Dest [ 737 0 R /XYZ 84.259843 718.791496 0 ] +/Count 0 +/Parent 993 0 R +/Next 995 0 R +>> +endobj +995 0 obj +<< +/Title (3.2.2 Ensure that the audit policy covers key security concerns \(Manual\)) +/Dest [ 740 0 R /XYZ 84.259843 312.320079 0 ] +/Count 0 +/Prev 994 0 R +/Parent 993 0 R +>> +endobj +996 0 obj +<< +/Title (4.1 Worker Node Configuration Files) +/Dest [ 742 0 R /XYZ 41.740157 784.430079 0 ] +/Count 10 +/Prev 993 0 R +/First 997 0 R +/Last 1006 0 R +/Parent 909 0 R +/Next 1007 0 R +>> +endobj +997 0 obj +<< +/Title (4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 742 0 R /XYZ 84.259843 682.791496 0 ] +/Count 0 +/Parent 996 0 R +/Next 998 0 R +>> +endobj +998 0 obj +<< +/Title (4.1.2 Ensure that the kubelet service file ownership is set to root:root \(Automated\)) +/Dest [ 742 0 R /XYZ 84.259843 547.191496 0 ] +/Count 0 +/Prev 997 0 R +/Parent 996 0 R +/Next 999 0 R +>> +endobj +999 0 obj +<< +/Title (4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 742 0 R /XYZ 84.259843 411.591496 0 ] +/Count 0 +/Prev 998 0 R +/Parent 996 0 R +/Next 1000 0 R +>> +endobj +1000 0 obj +<< +/Title (4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root \(Automated\)) +/Dest [ 745 0 R /XYZ 84.259843 733.820079 0 ] +/Count 0 +/Prev 999 0 R +/Parent 996 0 R +/Next 1001 0 R +>> +endobj +1001 0 obj +<< +/Title (4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 745 0 R /XYZ 84.259843 419.879014 0 ] +/Count 0 +/Prev 1000 0 R +/Parent 996 0 R +/Next 1002 0 R +>> +endobj +1002 0 obj +<< +/Title (4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root \(Automated\)) +/Dest [ 749 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 1001 0 R +/Parent 996 0 R +/Next 1003 0 R +>> +endobj +1003 0 obj +<< +/Title (4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 749 0 R /XYZ 84.259843 443.429014 0 ] +/Count 0 +/Prev 1002 0 R +/Parent 996 0 R +/Next 1004 0 R +>> +endobj +1004 0 obj +<< +/Title (4.1.8 Ensure that the client certificate authorities file ownership is set to root:root \(Automated\)) +/Dest [ 758 0 R /XYZ 84.259843 733.820079 0 ] +/Count 0 +/Prev 1003 0 R +/Parent 996 0 R +/Next 1005 0 R +>> +endobj +1005 0 obj +<< +/Title (4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive \(Automated\)) +/Dest [ 758 0 R /XYZ 84.259843 313.143907 0 ] +/Count 0 +/Prev 1004 0 R +/Parent 996 0 R +/Next 1006 0 R +>> +endobj +1006 0 obj +<< +/Title (4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root \(Automated\)) +/Dest [ 766 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 1005 0 R +/Parent 996 0 R +>> +endobj +1007 0 obj +<< +/Title (4.2 Kubelet) +/Dest [ 768 0 R /XYZ 41.740157 784.430079 0 ] +/Count 13 +/Prev 996 0 R +/First 1008 0 R +/Last 1020 0 R +/Parent 909 0 R +/Next 1021 0 R +>> +endobj +1008 0 obj +<< +/Title (4.2.1 Ensure that the anonymous-auth argument is set to false \(Automated\)) +/Dest [ 768 0 R /XYZ 84.259843 718.791496 0 ] +/Count 0 +/Parent 1007 0 R +/Next 1009 0 R +>> +endobj +1009 0 obj +<< +/Title (4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow \(Automated\)) +/Dest [ 768 0 R /XYZ 84.259843 325.547453 0 ] +/Count 0 +/Prev 1008 0 R +/Parent 1007 0 R +/Next 1010 0 R +>> +endobj +1010 0 obj +<< +/Title (4.2.3 Ensure that the --client-ca-file argument is set as appropriate \(Automated\)) +/Dest [ 773 0 R /XYZ 84.259843 672.873057 0 ] +/Count 0 +/Prev 1009 0 R +/Parent 1007 0 R +/Next 1011 0 R +>> +endobj +1011 0 obj +<< +/Title (4.2.4 Ensure that the --read-only-port argument is set to 0 \(Automated\)) +/Dest [ 773 0 R /XYZ 84.259843 294.629014 0 ] +/Count 0 +/Prev 1010 0 R +/Parent 1007 0 R +/Next 1012 0 R +>> +endobj +1012 0 obj +<< +/Title (4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 \(Automated\)) +/Dest [ 778 0 R /XYZ 84.259843 638.926036 0 ] +/Count 0 +/Prev 1011 0 R +/Parent 1007 0 R +/Next 1013 0 R +>> +endobj +1013 0 obj +<< +/Title (4.2.6 Ensure that the --protect-kernel-defaults argument is set to true \(Automated\)) +/Dest [ 784 0 R /XYZ 84.259843 443.570079 0 ] +/Count 0 +/Prev 1012 0 R +/Parent 1007 0 R +/Next 1014 0 R +>> +endobj +1014 0 obj +<< +/Title (4.2.7 Ensure that the --make-iptables-util-chains argument is set to true \(Automated\)) +/Dest [ 788 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 1013 0 R +/Parent 1007 0 R +/Next 1015 0 R +>> +endobj +1015 0 obj +<< +/Title (4.2.8 Ensure that the --hostname-override argument is not set \(Manual\)) +/Dest [ 788 0 R /XYZ 84.259843 421.126036 0 ] +/Count 0 +/Prev 1014 0 R +/Parent 1007 0 R +/Next 1016 0 R +>> +endobj +1016 0 obj +<< +/Title (4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture \(Automated\)) +/Dest [ 788 0 R /XYZ 84.259843 198.526036 0 ] +/Count 0 +/Prev 1015 0 R +/Parent 1007 0 R +/Next 1017 0 R +>> +endobj +1017 0 obj +<< +/Title (4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate \(Automated\)) +/Dest [ 792 0 R /XYZ 84.259843 524.926036 0 ] +/Count 0 +/Prev 1016 0 R +/Parent 1007 0 R +/Next 1018 0 R +>> +endobj +1018 0 obj +<< +/Title (4.2.11 Ensure that the --rotate-certificates argument is not set to false \(Automated\)) +/Dest [ 798 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 1017 0 R +/Parent 1007 0 R +/Next 1019 0 R +>> +endobj +1019 0 obj +<< +/Title (4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true \(Automated\)) +/Dest [ 802 0 R /XYZ 84.259843 593.570079 0 ] +/Count 0 +/Prev 1018 0 R +/Parent 1007 0 R +/Next 1020 0 R +>> +endobj +1020 0 obj +<< +/Title (4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers \(Automated\)) +/Dest [ 802 0 R /XYZ 84.259843 295.023057 0 ] +/Count 0 +/Prev 1019 0 R +/Parent 1007 0 R +>> +endobj +1021 0 obj +<< +/Title (5.1 RBAC and Service Accounts) +/Dest [ 809 0 R /XYZ 41.740157 784.430079 0 ] +/Count 6 +/Prev 1007 0 R +/First 1022 0 R +/Last 1027 0 R +/Parent 909 0 R +/Next 1028 0 R +>> +endobj +1022 0 obj +<< +/Title (5.1.1 Ensure that the cluster-admin role is only used where required \(Manual\)) +/Dest [ 809 0 R /XYZ 84.259843 682.791496 0 ] +/Count 0 +/Parent 1021 0 R +/Next 1023 0 R +>> +endobj +1023 0 obj +<< +/Title (5.1.2 Minimize access to secrets \(Manual\)) +/Dest [ 809 0 R /XYZ 84.259843 517.191496 0 ] +/Count 0 +/Prev 1022 0 R +/Parent 1021 0 R +/Next 1024 0 R +>> +endobj +1024 0 obj +<< +/Title (5.1.3 Minimize wildcard use in Roles and ClusterRoles \(Manual\)) +/Dest [ 809 0 R /XYZ 84.259843 411.591496 0 ] +/Count 0 +/Prev 1023 0 R +/Parent 1021 0 R +/Next 1025 0 R +>> +endobj +1025 0 obj +<< +/Title (5.1.4 Minimize access to create pods \(Manual\)) +/Dest [ 809 0 R /XYZ 84.259843 290.991496 0 ] +/Count 0 +/Prev 1024 0 R +/Parent 1021 0 R +/Next 1026 0 R +>> +endobj +1026 0 obj +<< +/Title (5.1.5 Ensure that default service accounts are not actively used. \(Automated\)) +/Dest [ 809 0 R /XYZ 84.259843 185.391496 0 ] +/Count 0 +/Prev 1025 0 R +/Parent 1021 0 R +/Next 1027 0 R +>> +endobj +1027 0 obj +<< +/Title (5.1.6 Ensure that Service Account Tokens are only mounted where necessary \(Manual\)) +/Dest [ 835 0 R /XYZ 84.259843 409.152842 0 ] +/Count 0 +/Prev 1026 0 R +/Parent 1021 0 R +>> +endobj +1028 0 obj +<< +/Title (5.2 Pod Security Policies) +/Dest [ 847 0 R /XYZ 41.740157 784.430079 0 ] +/Count 9 +/Prev 1021 0 R +/First 1029 0 R +/Last 1037 0 R +/Parent 909 0 R +/Next 1038 0 R +>> +endobj +1029 0 obj +<< +/Title (5.2.1 Minimize the admission of privileged containers \(Manual\)) +/Dest [ 847 0 R /XYZ 84.259843 718.791496 0 ] +/Count 0 +/Parent 1028 0 R +/Next 1030 0 R +>> +endobj +1030 0 obj +<< +/Title (5.2.2 Minimize the admission of containers wishing to share the host process ID namespace \(Automated\)) +/Dest [ 847 0 R /XYZ 84.259843 583.191496 0 ] +/Count 0 +/Prev 1029 0 R +/Parent 1028 0 R +/Next 1031 0 R +>> +endobj +1031 0 obj +<< +/Title (5.2.3 Minimize the admission of containers wishing to share the host IPC namespace \(Automated\)) +/Dest [ 847 0 R /XYZ 84.259843 212.250432 0 ] +/Count 0 +/Prev 1030 0 R +/Parent 1028 0 R +/Next 1032 0 R +>> +endobj +1032 0 obj +<< +/Title (5.2.4 Minimize the admission of containers wishing to share the host network namespace \(Automated\)) +/Dest [ 850 0 R /XYZ 84.259843 574.229014 0 ] +/Count 0 +/Prev 1031 0 R +/Parent 1028 0 R +/Next 1033 0 R +>> +endobj +1033 0 obj +<< +/Title (5.2.5 Minimize the admission of containers with allowPrivilegeEscalation \(Automated\)) +/Dest [ 850 0 R /XYZ 84.259843 203.287950 0 ] +/Count 0 +/Prev 1032 0 R +/Parent 1028 0 R +/Next 1034 0 R +>> +endobj +1034 0 obj +<< +/Title (5.2.6 Minimize the admission of root containers \(Manual\)) +/Dest [ 854 0 R /XYZ 84.259843 555.281993 0 ] +/Count 0 +/Prev 1033 0 R +/Parent 1028 0 R +/Next 1035 0 R +>> +endobj +1035 0 obj +<< +/Title (5.2.7 Minimize the admission of containers with the NET_RAW capability \(Manual\)) +/Dest [ 854 0 R /XYZ 84.259843 404.681993 0 ] +/Count 0 +/Prev 1034 0 R +/Parent 1028 0 R +/Next 1036 0 R +>> +endobj +1036 0 obj +<< +/Title (5.2.8 Minimize the admission of containers with added capabilities \(Manual\)) +/Dest [ 854 0 R /XYZ 84.259843 269.081993 0 ] +/Count 0 +/Prev 1035 0 R +/Parent 1028 0 R +/Next 1037 0 R +>> +endobj +1037 0 obj +<< +/Title (5.2.9 Minimize the admission of containers with capabilities assigned \(Manual\)) +/Dest [ 854 0 R /XYZ 84.259843 148.481993 0 ] +/Count 0 +/Prev 1036 0 R +/Parent 1028 0 R +>> +endobj +1038 0 obj +<< +/Title (5.3 Network Policies and CNI) +/Dest [ 859 0 R /XYZ 41.740157 784.430079 0 ] +/Count 2 +/Prev 1028 0 R +/First 1039 0 R +/Last 1040 0 R +/Parent 909 0 R +/Next 1041 0 R +>> +endobj +1039 0 obj +<< +/Title (5.3.1 Ensure that the CNI in use supports Network Policies \(Manual\)) +/Dest [ 859 0 R /XYZ 84.259843 682.791496 0 ] +/Count 0 +/Parent 1038 0 R +/Next 1040 0 R +>> +endobj +1040 0 obj +<< +/Title (5.3.2 Ensure that all Namespaces have Network Policies defined \(Automated\)) +/Dest [ 859 0 R /XYZ 84.259843 532.191496 0 ] +/Count 0 +/Prev 1039 0 R +/Parent 1038 0 R +>> +endobj +1041 0 obj +<< +/Title (5.4 Secrets Management) +/Dest [ 883 0 R /XYZ 41.740157 784.430079 0 ] +/Count 2 +/Prev 1038 0 R +/First 1042 0 R +/Last 1043 0 R +/Parent 909 0 R +/Next 1044 0 R +>> +endobj +1042 0 obj +<< +/Title (5.4.1 Prefer using secrets as files over secrets as environment variables \(Manual\)) +/Dest [ 883 0 R /XYZ 84.259843 682.791496 0 ] +/Count 0 +/Parent 1041 0 R +/Next 1043 0 R +>> +endobj +1043 0 obj +<< +/Title (5.4.2 Consider external secret storage \(Manual\)) +/Dest [ 883 0 R /XYZ 84.259843 562.191496 0 ] +/Count 0 +/Prev 1042 0 R +/Parent 1041 0 R +>> +endobj +1044 0 obj +<< +/Title (5.5 Extensible Admission Control) +/Dest [ 885 0 R /XYZ 41.740157 784.430079 0 ] +/Count 1 +/Prev 1041 0 R +/First 1045 0 R +/Last 1045 0 R +/Parent 909 0 R +/Next 1046 0 R +>> +endobj +1045 0 obj +<< +/Title (5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller \(Manual\)) +/Dest [ 885 0 R /XYZ 84.259843 682.791496 0 ] +/Count 0 +/Parent 1044 0 R +>> +endobj +1046 0 obj +<< +/Title (5.7 General Policies) +/Dest [ 887 0 R /XYZ 41.740157 784.430079 0 ] +/Count 4 +/Prev 1044 0 R +/First 1047 0 R +/Last 1050 0 R +/Parent 909 0 R +>> +endobj +1047 0 obj +<< +/Title (5.7.1 Create administrative boundaries between resources using namespaces \(Manual\)) +/Dest [ 887 0 R /XYZ 84.259843 718.791496 0 ] +/Count 0 +/Parent 1046 0 R +/Next 1048 0 R +>> +endobj +1048 0 obj +<< +/Title (5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions \(Manual\)) +/Dest [ 887 0 R /XYZ 84.259843 598.191496 0 ] +/Count 0 +/Prev 1047 0 R +/Parent 1046 0 R +/Next 1049 0 R +>> +endobj +1049 0 obj +<< +/Title (5.7.3 Apply Security Context to Your Pods and Containers \(Manual\)) +/Dest [ 887 0 R /XYZ 84.259843 312.591496 0 ] +/Count 0 +/Prev 1048 0 R +/Parent 1046 0 R +/Next 1050 0 R +>> +endobj +1050 0 obj +<< +/Title (5.7.4 The default namespace should not be used \(Automated\)) +/Dest [ 887 0 R /XYZ 84.259843 176.991496 0 ] +/Count 0 +/Prev 1049 0 R +/Parent 1046 0 R +>> +endobj +1051 0 obj +<< +/Count 142 +/First 909 0 R +/Last 909 0 R +>> +endobj +1052 0 obj +<< +/Length1 41004 +/Filter /FlateDecode +/Length 7588 +>> +stream +x| xUut;YH',-11 EF0, E!( Ā $FQCgTuo?}{WCݺ]9sOG +Q"BJf' +$պ'?rFvz;}ݯWRnAƾiv'x`drPy98P4d}M^SW8u;? +bzojNQ!`a*[X7Ơ;b)9Q珥T#*υ-\*ϜI `3 +&X0.G%̚XaU2H=rfNIH~vhn'0_>/3ᯔ 僪;ab P[Kv!BvRQ~a$@Lߢ~zzt= 0洴\9~ADtتj߃c=ofTCVuBOMKKX1\W-ѫT/~ݺnпunXʪ%gՒ ήLq$b*TUf,\\IZv5rǥK8Z_Dz%8Gb/.⸐cV\`&qn#5F݈ 88#s|Ozt$N㘿R!'s17f7D N+9k5X>&=c8GQ.lPIr2os߆8'C9li @8sO&׈CDZ/{vH8@nf 2|-'{sNF&tbtÆf303$L6cnF k*v앺b$ًILLJbf)>f1&Ihzr1#I\@7i1;0*q T`.NANm 梕c%X +h֖`4s4Qf +G\HBEN^& ݐ8)/"X:9S]TR:jCQ+Q.e)ý"!FI`0ы9Y/,8\<,kīy)li^521ӰN/Z2ǽ͢~QPL8Y9#D<.wrQVv:?r%q&gh3 ]b&B#iIZݤK]ykd!fQ5g +.8?a+Xq85ٰެB]buta7ba*yX!íkl#XFO#aLiQ8ݰHrOEd^˞~ O~ ~%g 5ʁĆSzK[їljJ.D:' r2ыx$+Y٤|` 5I'tI'tI'tI'tI'tI'tI'tI'tI'tI~21HffP"," Dۧ )AѮ\!+aN'= +HnHΩxs*Q0@QQl8:pZjk\i 7h֡#ǎa1P&K4;qMy iڹW,T3^f"]7l%u +P].Ib?v*:frP5 vZff¦1ݗغ]%#GMl&6 #=>fZ#t? +/ z&Aoe'eIZi$OJǞ}mRcu8('|A_:Y>d;(E"PtUOEIF;MU2N"Fh6tZ5!߈2TgR~K|X$D ŜB0^2 r!^7z"{B&y9/Օn.mot)Qa]>:)\QN{>^bXL~ utFCV"Z힕Qܵ55!bB9 V vmOh}z,9'ìȔOJtJL_/}1YYYQY謘„Q1 U "ۺujɎ.,*F/\Գ4:3'=6B iGZt3X8qyjkj֭'&!Ȩ)'u!-xRG5?7/ԎWO:JVw7!I-W** a%[%ZW2ڐy9`s96e7پ3—WK":V'W?ʛo_?`ݘ bI!4?ÒdUk'y]]D> lU- :ܒY=2+ V$`@0M[6nyhU˫!c馌ӧƩcv- +)ϕr@ bT#Q=~߫>ܔ?ymS2v}1r5RƲ;7ө@`w?:ҎX.ʤٵ",^\+N)l~Xغm뉝ͥy5>EJY(#l.>|B<u2[SFjnM d6Ϙe6NojbOUhc g"_%Y2eYB{[4O:`%&dviVxڮB m^Vjf"GD BE# S"aL(~<#TJŃ`1Dc WeSZf`؋/JG o>0b A7FTZgjeg4vF~!3bA `k= W)LvЪ+C@# .Kikl*eWܡJXnjjdd8ݐ/(%.+0<赸q-qF \㦡4䲗OΙvWO[p>,[0u% (jַYl\vO&VѼf! ǚP#AtjՃV rD)1JŖkI`^ +f'!U9~.߿/_={of 7o "odw5CC;Kl4cXg0 +(^"yA +$6]X[؊n<찟;|ԑ7Yh:l p5yW&:WB[s3X 3f@[b:W@ǭO[ ꖜ6nKwr]]-}}L}},fxXhJ4wJv&:'F&F%yVVWZV8_%A6f`Z1m0b1!9o#I%IKʓ'R9 K nTǗMZ p3Yf>߾>@bQΛʶ=>Ye[GVޓߤdt:[%%iRj2|9kC̿/X8?LjSbbhѫ^QZ*m[\U6|; ;/'o5&V笱rNtoQ۬uRfAt& =JgmRM}zv5lvbPSq*ݴKl'_BgP"w9{zD0i\__]@%{K \7GbDX), ;EH;G'$CBo+>h`:^HPP\NM #18KԪX[Fm<}Ye5Nk屧/0$EQl:,XϞEk{"pvc]251aXL=[1MCr͞lM tN%+qƘao*t6i + gۉm!Wש9l ϿʭٳGvUy%JH !}ȝ0|9-!UkMZv*v%lSnhBn5a/813@:ܲnA2M0 Bݞ=ve F^nUmN;E2.kC!Wh#I7jA0yٚblxk^'˃ +a!́i0a.x & x R(7Zx Et́)3+YԾ;D>VVB)g> f>(i>ͥ,jC}SQ7Q >9hS9Def;y͞=}(EtUg-Ҿ(4K;-[>Ek}c҂ۭwZ_>Q @$]qdLuJi:io)ͤud0Q:4`4t04:dQ`3wI~9-dӧ̙EfL$P4UZjT mZO?_jV-no?ZDͭ ZCޡ)oZ}CMkmZ,Dju\8bٖaxFVj5AOÃC!@=v^"ZSH H#uJΙ2sfQ)fzά(SQS#37gMWk +̄9fQ˹yR3F[ӦoDy8f!ϐ@a>,A(tR2-Ue&meX:Ϧj5meߚ J8V;/Ƹ~|y.3$k"Ii&.= +endstream +endobj +1053 0 obj +<< +/Length1 7648 +/Filter /FlateDecode +/Length 4714 +>> +stream +x9yxSU眛&-PڴItM=M4{%K%m/PRVy#3"C6Py*~Q\oFf:*f7# +MZZD{==sr~IF@t2a}%Bх&gU@?̙ oj3Qf@=#m"-DHBhhG7{`n/̝送p H;tdc!׳[ے +o/ޏQz2yМwa+/ %OEv_cT?{$m?JK +\.3'+BX'#@™Ns990Hc>/`^ml7 %/-:nX\2 +ZpvdB~N爜9o&-jHC=H@=P%TwR|bJ&%IVE0f!k&2*dAےߣT׊SA0r? Ǒ} U30^0/CzhgAc6CDr$c )Όba< BwB}Ǩc$ȷ)` xZ]"auWB; ff0*4E7b?=j؇6PV(FfH-}T#7GڅB +Tlfo]>=_O,/_v8z 9EŸ§?H)&w7;|, b6NfsBP)<,8! '@ثP>kX , 2OD$)|UxE"2NMeFDF"Z"6F<|Ļ_ML %mQH)-*3"86LB^8c7ၹ$ +<(& +E:9YIiDdY td0(O$ƅBIFQ_qb KhTu{T)n[nJIA~֎\AEExkmUܮ:F,'^%*a9,WRF(9_30 3=#%sE!$d!̊Jdg:=8y+`e]pTQBHfQF{@c@wӉ.r9}@)0#IE +,KRdIAx|]#ѶIkbhQnk ]p$2ڌkOoQRd29wً(k$|n" e,@ԬF3OšrKkD.ki(iZ2ґRk"â9n|%VlyZNAGji4 Eɩ1+f%2X7|uzJ%N^o>m4[ !H$qo)N ӹ}:#UsHT] #[.,\\[`,5VK.В?4`3鄈M::A ; dՊ,.n_a?u̞^Sit;;w6 ztxyW2koRuMOm |sCrl.Eẃ9s ≓A!89BB5v{wVV+tf-*7;OGdžqkYZ[-myjo)bm$TIT7 +Q<^ E*DyɢuIs3]m3\vNS٬.[珏>~1[je ym"9󤗠` aPI;9gj o<PJJbXa3M;5U>yotGPEW<ĝ Ҹ &iڍ&Rq/^u*+1Ijuc]N[)754Z'#\Krgw E^exbO=|ꀧ`Xr3 }m?e2 Ndb6DŻ_vv $@eMn&ϽNƸaeh: +hn +L҄ n};-\ { z c!y;?7Q +CY&\312n1݌mN$ _'| d<1X̒7w?&) d hAJ{: +-rdg"EXz<{̇!*y{{~waZǫۨ!g xĀɨHgTȂ[ݟZK/n;Wpp- R S'>orR㤒Yw3@[Ϝ ׷7i|ϨaޙƚQq/sV֫q:oZ-x9x}1yf)4r@1`Ki1)@%+LpUS!K!ث0ȶ8ęih^ S +sJ5wE9"v2>*F(ʩhXTNΘ(f벁DP)?25z2؜>JuTL,`%r8lg/q aPbccޏ> +#4`j65#bߴ?zʻpއ5ĠGIqX>Ct-5 GB#@X)=\`/Ŕ'&F4J.N+g23I,3@M88sv=.hLb&LF35 ;k l%RGu/].:#/13y!Q/G3  +&`^<$ð6YVe˺JV)qz6?ߖQh,dfx4YE5B.㚜8QłpSb]e9;V׻ڌVrǓY_ + +a97Ů`r#rFJ[7KgV65G5mi)1PV-=*Wqò i]"-OK˪2Yo! ۞qq9qFh@j+K kKo/jH+(pWJ+k1nPblRj :͓Ydn3?s>)9SeO(x.NfjDlM=Პ{#mAi,$Jmeq[jEDZoc<4\^h4ZFϺݿ_ s2P;5yIy\I6-N 0,U\ $*銗vM{xKe)i\8`>C ŵI◗ҧ_gq? |d--6f.S\J223۵dCUFcyؓ){Ry]z+y:Icx +0{Y;Q~K* _aͷi4;"1 9SK=V2{ӺƣG7m|8z-o_x8$E|CǭG p23v1< +Sp$O6 Z؉^fP xb}J&d&af~Չn7pu/io 7gB G'C4] }iзljH~4Q'jGh"eu!rH+> +stream +x} xEh-]=wIn{/&5 pŰ#DDd $@N"$ @p"F " (.l/d|;7:3{{=:u$ (($cKGWж!P3{Oܗ؞9bz{_ ")<:6S!71S_Ppž^o"4t7BdPa)ɤ+3W˟^@ܛMUk"Ba/VG%<bx)%&ApEcOm93B)S,AA?5JAK@EK΢a0_u'dU 2{z-uS#pn5P!jTdG!K$CZN"5*M GD &RY"DmC)>:]܅˕)OAo]#}g);L =L'b'_G(z KG]7NAϓսdC{A.!Nߎoqzovd雯ı7;bto틥{߰3{F0tENNwp=nJ}ynj +%Vb.}-%N7s"8N7ramtIQZxem"]5 yNW?[s7s%AVKC*NWvt"1TGë3]U?鏜> |xC 9}'9]BN<d 8}"H1NMWsLs:9ήUYΜt&ZZJiI^MͥpZ\ԒSj:Nt"8?Ƨqӂ:+tNdž1u6LG4?W<`yn:J#9t܏t86ap7,tH5p}J{l`59,`ޝHu~nڷu>^մg=\{5;ʲm.+vguwBwi8;+j.-vNciGN\N;8ifF, Ҍ.K3Hu kIͬ If6mki1NڪeG֪tYˎX|,M崙D;XJ"M`"m h4&9hdaMiF!>&&҄x/Kx{inOKqbR/ Kc8vP橦nsk,u:hwpjKmV;9dS<O,ԜNM05I!ITTTf:9e:e!It,$#aEw㱏--AH@Åh/;B Z2 +V+ TGCG 8O6"ˤ"_h\x/ڃ.ۏŬ&ZɋG6²H"MHۥGТT*APfl4 ~trrRg w;ʎ3 ΁h&{{яw$__+tQ9ZyJq"MW!-6}d|gx"am^AD3K H&r 'a}͑''-Lh;ݠ!Z3B.ij0Ny9G`^0:Afrto{b[ ǁ9?DOmя~8O,8 F8 +G3A .B1bT9R @;!sg$F \weh7n$ɿBC=G!ǚ?'~RLPD跍QzBezYl xJ-T~'7Žo즡M͗-р,+˺zVhOpGEE]vb`#F0`#F0`#F0`#F0`#~.uEaTɿ,%j9kp dE%Ѫ?.[S+=pw:ww=oߓkF! (oZ!#j>^Э33*=I x.lSW.*esK?g~KrQHIu +8E)r?@dڱ m& Em?J<9S׍T3ֹA9dyXncg~"~utݗ L(%ZVWV 9ZDb`$1*4lONj";v؎~0Juœ9'Ι=?OC +\ȿ| +^O!&:jrӭ+hȱ0lT +8jic;W SUXrGy=By] z2$&EcOLcR R"j^%1nǍkoeА;pC5YY]Z{(v%Gtbg6dP|/\V6  9U{ ثpNEF0hHF$%|nf+Lu $o8"P0 +n/X{=FF +J4۴8IDmW<^I?-[pTRZP{6MrH8^gΆh DŽ#G?_%%EzY?>B8.=Pc,m⿝fg +F!e/55][}u2#E9mgQqAZD'l\$wҹ_Mtr_2䤁p.׾_ < F!7:-<*舵F3%H8= n ;=D3DE,ڥ +<=sBay%Di{ߞ_R$_J@aBi!t@O3 C K{nɱ[@M^V;]E6^? -| ].t`;A}+탆CbP莡fg!è^ʄ.#?`u*#H*4I58hPδҏU!,W)>!znˆđaE EE"@\bXaz\bo<ɴɼɲ%aK@\ẓ#ExErz),└pR.IGg;~ѣCK7W~%KiÏ_؏6C@?33ww=% p 6{څrO [ ' 'lV!Yw2nzi{g#P +a 'Dd$h Kdw.A>D'0_H8;J"hCchSjO|?B:O pۥ!uxJKLk@)zʂ$Pb0 sPp# MbREP$8oI!XMuk>Fu7̮u?`GpYWNO 8dnMeDi$=$FK^V]Z)֜Bƚ #]Jgirka]i1pFc@uv)\pJKu6Ij`.2Ϥ3 ԅ]d}MͶ}oH7q ~7 x*_˳?U z["EןU7jquJK40tG8_]rV7&KkTp[<*+W4]!߽91y%.O\۞X /vct2"[n!~O"ɩ0S` ֯OOOI}MG׿;[cG|wo]ƣ;Bq:IZ^i;!椗v +Ř5KYWér9mļD7ZRcx 8 ^fM>{>;KO`xtg^ ޼v֬ywZ]9 S! Vб>-YYNҺhQ͂\n]S\lW&7#XC8.x z~Q!/K]i>mYV?n>oz U:tXN+G꒐b: ^ mp*22CvژyĶp'X?QcݴY^2cFޘέ9,'^3] +oX;fk5QG+Du[P6:jy"8wY&"mL#<׼aYA:_}q.|̼񿷓v?|W6Jk3p4[ +NRMb3lVx `wĩ EcKwm&^:Wt>t(Ƚ^Se,~FCl2O%@;M`*wu/|cʮt_j2FfG;S:8z{:iX -$gΝ;tΜRP ~_=׭{YyCPR@3B 7Jݑ1&dDFQ~&xوP%x($o=ڝQ@D4#6+MawGg FQlQИgFP!o2F( ŕtfCԫmq#Ds<&+0=c=PtقT{0 +0 +AuD߮DѴMnEռmqoSm{jeb܉qSЧLD_"Uc%ëf#qsY\979Mn&" MT?Ĵ&C0R4]3&fcIXK5Rm[Z[[RYj'W114ϴQh{===U*VժYukTMY-_16BG;kI_L{J\ YWehmҒ־cgRo1+EM\q ύbLuC]tդ Lejٷ!(#kYáYá/+v6͑Crh;DE l)fdAߍ͏޶};{Ux:4> kR6u^i;d6'4{l6BM7OdN>|3FΘ'V'4 󔷎❤x8qIH $ ocٍX &dYJš.O~n@/C4VJFMq *e8fIijCĖ'[ @+*JZ5:mzs?7{8ޓϔj|}}/ 0{3m~D{7#~?[$=MQdL7u`!@?wz`\ǔ,UnК6 ۓNQajI=^t4X 2 5DH3c ]y!,( #-?@p5THzA~&<+CO0!jHtp( T7d%N-8FA 'IW)dnMt\a:}N.Ohv֎vt6N֦ӇG ]j6AR'f&}j^dy#Ku,ZNʥUrBQ$oJoBNH'G$9/M>ԿFoяrG !4Cj=>Ͼ c I;qh;/@n6˖l`ef ٠-hՉ!} E;6ISG/ooZ#yg8(;OpQ X6tXb󩀔e=c8z#a20Ճ-T6v͔3,k;>Rw]G +qyeY,Ezx/-Uj-['G-Gm$coO^p Ԟ;QҴ{Am %k})B KsЅ;bbu+PI[բoBBfH#o׏>cBPp;qXZحe(f)K-IAϮF-*6ɺ(P J{ab 9aaf|o^\c䁻5A*QM]3_(?BEB4G%(A4i)%FS}kM7nޙXhfu4ƚLւ|x7b6\MRh1o3C/S,6 Ƴe:PTS C_EH@[;ju.P7Ђ_>"uuFK䉢% O8'oXLP%@A-lB ,΀e6e6UûoN/b@ wp%ZIӦa1<#fC?-%I3Su6SXɨ˲uuu:Iݮq[+uK4/Muo[[WWuo[* ̾/GA Onv )~xos_WJOЗ"ůJoe8anJZ;xM7\(y]Z 8R}/[PwPp_jeceߦQߦ0زLt+D.;3܇a,?%o&ûYnzv~K G9 +9$5Aha t /\;aCaan!K_@e҇FKM?-?u: A9kdt\A\V0 -?ڌ/ 5棥hIh\tZThYR8uE YN0.-qf0GMP3 d;Yi9_pn({?Z +endstream +endobj +1055 0 obj +<< +/Length1 17264 +/Filter /FlateDecode +/Length 12303 +>> +stream +x|yxTŶo {s;ݙ:N!d" @a0Oa!ȅ D(AA DD8@NVD]{xzCZV[ko@!db + +|f F٫?ڝz<#1=?$cʯRgA*BxGL;i>?E)O,V)ói Cf_'-\dP~hY:mFj:p4i P_4 +CЊw?h4ݻ_=!oʒ(PQ~[Ha̻<hXh~Ҙw +b~U ޸+tJrC +c갳W`& +[p]w)3b<i.ɇH1v2NQ#z!ZݢhMZxb/62QGWt] +bYK=VT;C37Qh +goG+/_p(VU,ܼ/Eo?MNONHlf9]kEwZoaWg/#ʿ+ +399 +'SF?٠?qЏWЏ&h4u=*gCcF>mF}6zFF0zz}SmFgmFAX?'G8O8⥇=TA{o2Z E&F1WlWW}yU|9ҿ,u})]h0|" /X*vd;یjkGѭi%_YA+;"V0sGs–gqtO賌n#/-aۍvAODY-zVu0vU\+FW35_|j]htW+ +Mr]F`t"La(,2EDŽ6'\bF{Cw-VE{‰|>\G|>,[i~A3=̴G>-_AC+Ϡ 4|EBwF n\F&.怀shpshV]b4?.vO3h:ܘh\N 4j).Q*vw>I=&0o|ۋ38Fcf1QOLYAcitꆑ݌F1 d4f%"3ƨQ',d14:ёLة 1jέ#XdfjdTE3*5 +5pʨ.**3*AR`,.8" uh&/5x!~tкh#70w#?WJOlóΖړF j +ȃ/CoA'`B碗krs>ZIHBk}TfuNj:J \C~)0nBҍLNBo6B+gD׃BI&'PT'8m7~ A<< cc3Fk :Bg&Ɏ8T.MKڶGq }NB8F *qdvh^m&p'@2ͧ0|\P lZkARHs>퉲a(:ZH^M>${(Cj#IGхB0I8$K])Y~rWy[ S&^]RU5M}J}UDD?bV]MѦQ55(Emf=li+=ck Y=>;cЇB'|ەZu3l,ҢsE̴DZ)1jۜRSqQk#bScl;R@ +[FQzBA\h9 Yn@mtk^N@xѴ (E~H\FQ]YYo5F"#]b6 N pc𞓓{!7ן 0 ɠVBx2=Zq4qsf3o91~8Sf`[&l6vM/Rm;[Nu=;/-"_]מbq`oiщn{iF\n-N ""&Ƙ@pnʩ fg?zy'ܺnXs6'dVVf$9V||Bfh)+;3 :Lӂ/f,{O;=qʻg-ƒw !['D~?/,?1p_Oڊ珘^t"GoO3l#7S9h/ŝigͱfoN|&f+2" fRRzj'}dbio\gs8{|& 8j\pXIԘ ˤn栁 4noaǎKղ>q9s9s]RW[vxmI4ksf .91eQޚoxįτ g ɋ{=Tǣ̜_ +'>>udN`rc"NYbZcmIXiFJrZ-tWتd#JIJD=EN#!DIy"%ysN@D\741zps buB([L?@ TGb*!!k3.A!JBqa6dAdM@YY$W'SR5M SX]uEI dvҖsi3b +]܂<ݻ5]W\Nӈ0RYۛ`TIi +0a?Œ V"X5in2ʈ$RMTzk[586g\~br#+K'8>/e%fvS`|zKBH{:[ۦl^_sj1k-&F0a x"k~ +Zj.&7Es;qߏYԴB@EnDܔަ `ӗ~ wU9GNU_8V6T*UɃ"bnOt;ѵ\ S}BRh"H)rKQSy(<'yR<`4& h@&;N;NiS٩۩C>}>enOGQzT8*GQ}N& eGamMcH,ZlWI/fu28s5JK7l,-͛?x=dHvA;ΰp*8=Vؓx3^Q3xV +R\'J')̋Mz T*fz3\WL { 9TWV56=k"$©3+Ib^!J,*k,~1nbItșY(;՟dfn% /&̢c]0Ԥϰ~TQ禚ceWlkxlQFAD tJ)4fwde\Tx}h0wMc@/|٪-fPMM?2wmDSeMlݶtǦg,GߋX\ON=۝Tᩪ.\x8&7E|C0Ԉ(5#+ELAEnĔv&ύ抮- ",'\fǞN:R"F3^b;pQ.r\2b9*RZ6+3V5nFN7Vc%ͧ!U+ rbi%7ZFv[ؗ,99hI/qGְM3]3)&x V B퀺89:R (TVXnoH9`g, OŚ%܁"DP@(qwRk}ÍK3~[إU[Znx7]ffg& onsDKa6-P/LJW|IEeAsk)7[ /bA0mOUͭ6í7T=,@2bl|_y3Le>'SL ,.n!ز{pXl/cO-~UHbB{]hЁ'k :Z_H`X[A?{U*(,W9x{ |wS_ɅhTXzD7&*cpi#;}c'Ļv]|V +Da) TK)"0ؐ p&ڪR(xx7w.^_ 5J^ïI&L:C۵ln6M (Fh/_,$oXxaQ"037*C*zP!lDij14: pn ?<$n\ %1|8-mp<[m):0y/=}n^9ĸv; a˹ <(p*U]mTmՇE(DD&wCn[/ B|EPx"hikl{<W]j ՛_fon|ó4}NJvgy,P +9 V\ { , +Zn@iRj8'wG v8~#î8G5_͈ ' _پ= <\վn>|| J,*uPYBfL iےj2< 7=jYCx3Exb5;1maŀq0: #JMuJw4PAhO '['GK8)iRC3BYB= uI tN-cԖ퍼>5-Z0( + 06Ve+20Z\ @D˿+{~6 {3bJ-klgeǏV-AnQIi.\6`jXABc{r(SW\Wn尾JKt".$ -eYU"7P f:`@%9TC8N/PDUjE& 46F75rLw uj]# :hO \>F\} K/|pig q-Ŧ/>rjU~<@Lz;ڭ般z-`]V:zYVXݪ>:BF94cSU@ \F%HeFe92ji;s.%!ǚcc/=Ycg^U57-l<^~5MJ%'ܷ K~]02~ߑi6wOF^v1 AfjCU,x춦5 +"ֽ 3y'8 春#F>1̚Yp.757k9WouҥkptV-0JlIk7 t QISyx Q7V;*q* 3sM\) 芯'x?TU*Qք aWE&^J ȀȐT^A1,ٞ^F)W6p?Ap܂̽KǕh|4UMRy:N}̷:Ց.~tɡȾg'G?Aɇ_x̂JÎQK6 +AKZ^ OV9 +~e~bmn#{'n푓;c;lv.앮ݹ\6 e&{Re۩Sզ'~J> +>]Wױwgncuk֔Y#ּaH;gd.~~鳋\@O/_)M:O۸|A|/$2b+XNzu^)z|PktX\}| awDJCBue236Hk!OШ8Gc7n=! qEzS>AGy{6Wm2 KoL?BɆӒZ>l${}H|38EP!ZX! ԛ"NJo@.Rt/rkPfk֔䪩}{@ˡC$Sap6Pen2ddEafd=EVZiUIB +ش- +$\x+zkAlƠcME8Òj!~ACm@S],Cr^ْ^6H@MZig0tG.-@`/usY2o*1*!ʒ=WbEޗo?Ҽ' њTy ݛpH!X>~748v/[{SًgFrvȰL;V>W9eTq1Eo^>p䮈/ +LLQJub3ݏ4o6h 0}VJ]lgPC|/oͻr=O#*7`5EE O^Ӈ=x_|ѓwvTtep8W$4{@>LBP1qŢHXO)Tx i K㊎^({;խ ŀ^zpNi +d&ɓ@rHN8INč?NNIu^'Q4"4R#uj>q{/qJCs9C5R + #BH(42NftSOeʟtjɏ01ZVH؝ts>(u)PtRX&I]@n s'u %$SMl:$$G%@ LÿU:^ |U`U$S ArkbuPcq0ۖ:6#}qNgXPi2r#.xi ~Z&i2-!Fdҕ'!V36+؁Ĵs_Z~NԨ:۴7Ȃ Q-f7ś;[ZFU'ds|{Jlǧnl <>g,>~2hж :sȿ&.ER'ᨲP$HrL4?с +'ԑE;+h?e$-TYbLQ8ƞ/ir +nyNyE z0o;4͗fv%.ҋ1:TѝrԆ5T]hRbG1aT\EO-@t V3l~!UԬi@ x =eݻooG̛?Ѳg\rQ?]\>ro ظ"RT7"^Rԯ_,_v7"`V"0 PVjމ8e w48£,H/h߆{~^_#6>͗~x|Q受p3+_r :k1VN/uzyឺ\`]h>ZL4@D4b M;bP>ܳ-8&gypG@s`ACZq*<N,aZ wL{'A/ӵ;c^~3 aIڵ{w̓e> Z@Eʾ֧[t4 'wjwj//׎A;+'$ ; T¾;>6 M=Fq#ܳ`pGh'p?'i'=>i2J9(uSg9y0? W +endstream +endobj +1056 0 obj +<< +/Type /FontDescriptor +/FontName /IBRUDV+DejaVuSans +/FontFamily (DejaVu Sans) +/Flags 4 +/FontBBox [ 0 -14 557 560 ] +/ItalicAngle 0 +/Ascent 928 +/Descent -235 +/CapHeight 560 +/StemV 80 +/StemH 80 +/FontFile2 1052 0 R +>> +endobj +1057 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /IBRUDV+DejaVuSans +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 3 [ 317 ] 16 [ 360 317 ] 20 [ 636 636 ] 25 [ 636 ] 36 [ 684 686 698 ] 42 [ 774 ] 44 [ 294 ] 53 [ 694 634 ] 68 [ 612 ] 70 [ 549 634 615 352 ] 75 [ 633 277 ] 78 [ 579 277 974 633 611 ] 85 [ 411 520 392 633 591 ] ] +/FontDescriptor 1056 0 R +>> +endobj +1058 0 obj +<< +/Length 744 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +30 beginbfchar +<0026> <0043> +<002c> <0049> +<0036> <0053> +<0003> <0020> +<0059> <0076> +<0014> <0031> +<0011> <002e> +<0019> <0036> +<0025> <0042> +<0048> <0065> +<0051> <006e> +<0046> <0063> +<004b> <0068> +<0050> <006d> +<0044> <0061> +<0055> <0072> +<004e> <006b> +<0010> <002d> +<004f> <006c> +<0049> <0066> +<0024> <0041> +<0056> <0073> +<0057> <0074> +<002a> <0047> +<0058> <0075> +<004c> <0069> +<0047> <0064> +<0035> <0052> +<0015> <0032> +<0052> <006f> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +1059 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /IBRUDV+DejaVuSans +/Encoding /Identity-H +/DescendantFonts [ 1057 0 R ] +/ToUnicode 1058 0 R +>> +endobj +1060 0 obj +<< +/Type /FontDescriptor +/FontName /RQONIJ+Poppins +/FontFamily (Poppins) +/Flags 4 +/FontBBox [ -27 -132 753 704 ] +/ItalicAngle 0 +/Ascent 1049 +/Descent -349 +/CapHeight 704 +/StemV 80 +/StemH 80 +/FontFile2 1053 0 R +>> +endobj +1061 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /RQONIJ+Poppins +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 3 [ 266 ] 5 [ 291 ] 7 [ 621 ] 10 [ 158 453 453 485 ] 15 [ 197 550 209 475 627 319 574 588 628 627 634 545 630 629 212 ] 32 [ 722 ] 36 [ 673 612 771 706 512 503 777 691 245 ] 46 [ 598 431 860 702 785 578 787 607 586 540 674 675 975 ] 60 [ 583 540 422 ] 64 [ 422 ] 66 [ 732 256 675 675 606 675 619 328 675 639 245 247 514 245 1029 639 639 675 675 372 521 363 639 560 819 478 562 454 ] 95 [ 290 ] 204 [ 218 ] ] +/FontDescriptor 1060 0 R +>> +endobj +1062 0 obj +<< +/Length 1430 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +79 beginbfchar +<0026> <0043> +<002c> <0049> +<0036> <0053> +<0003> <0020> +<0059> <0076> +<0014> <0031> +<0011> <002e> +<0019> <0036> +<0025> <0042> +<0048> <0065> +<0051> <006e> +<0046> <0063> +<004b> <0068> +<0050> <006d> +<0044> <0061> +<0055> <0072> +<004e> <006b> +<0010> <002d> +<004f> <006c> +<0049> <0066> +<0024> <0041> +<0056> <0073> +<0057> <0074> +<002a> <0047> +<0058> <0075> +<004c> <0069> +<0047> <0064> +<0035> <0052> +<0015> <0032> +<001b> <0038> +<001c> <0039> +<0013> <0030> +<002e> <004b> +<0045> <0062> +<005a> <0077> +<0052> <006f> +<0030> <004d> +<0031> <004e> +<004a> <0067> +<0029> <0046> +<0033> <0050> +<0016> <0033> +<001a> <0037> +<0017> <0034> +<0028> <0045> +<005d> <007a> +<002f> <004c> +<003a> <0057> +<0018> <0035> +<005c> <0079> +<005b> <0078> +<0027> <0044> +<0032> <004f> +<0037> <0054> +<0053> <0070> +<000f> <002c> +<001d> <003a> +<002b> <0048> +<0039> <0056> +<003c> <0059> +<000b> <0028> +<000c> <0029> +<004d> <006a> +<0054> <0071> +<000a> <0027> +<0012> <002f> +<000d> <002a> +<005f> <007c> +<0020> <003d> +<0042> <005f> +<0043> <0060> +<0005> <0022> +<003e> <005b> +<0040> <005d> +<00cc> <2019> +<0007> <0024> +<0038> <0055> +<003d> <005a> +<0034> <0051> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +1063 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /RQONIJ+Poppins +/Encoding /Identity-H +/DescendantFonts [ 1061 0 R ] +/ToUnicode 1062 0 R +>> +endobj +1064 0 obj +<< +/Type /FontDescriptor +/FontName /COQUPR+DejaVuSans +/FontFamily (DejaVu Sans) +/Flags 4 +/FontBBox [ -9 -92 733 729 ] +/ItalicAngle 0 +/Ascent 928 +/Descent -235 +/CapHeight 729 +/StemV 80 +/StemH 80 +/FontFile2 1054 0 R +>> +endobj +1065 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /COQUPR+DejaVuSans +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 3 [ 348 ] 11 [ 457 457 ] 16 [ 415 379 365 695 695 695 695 695 695 695 695 695 695 399 ] 36 [ 773 762 733 830 683 ] 44 [ 372 ] 46 [ 774 637 995 836 ] 51 [ 732 ] 53 [ 770 720 682 ] 57 [ 773 1103 ] 60 [ 724 ] 66 [ 500 ] 68 [ 674 715 592 715 678 435 715 711 342 ] 78 [ 665 342 1041 711 687 715 715 493 595 478 711 651 923 645 651 582 ] 5038 [ 741 ] ] +/FontDescriptor 1064 0 R +>> +endobj +1066 0 obj +<< +/Length 1182 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +61 beginbfchar +<0014> <0031> +<0013> <0030> +<0015> <0032> +<0016> <0033> +<0011> <002e> +<0003> <0020> +<0028> <0045> +<0051> <006e> +<0056> <0073> +<0058> <0075> +<0055> <0072> +<0048> <0065> +<0057> <0074> +<004b> <0068> +<0044> <0061> +<0024> <0041> +<0033> <0050> +<002c> <0049> +<0059> <0076> +<0053> <0070> +<0052> <006f> +<0047> <0064> +<0046> <0063> +<004c> <0069> +<13ae> <00660069> +<004f> <006c> +<0050> <006d> +<0019> <0036> +<0017> <0034> +<000b> <0028> +<000c> <0029> +<005a> <0077> +<001d> <003a> +<004a> <0067> +<0018> <0035> +<001a> <0037> +<001b> <0038> +<001c> <0039> +<0026> <0043> +<0031> <004e> +<004e> <006b> +<0049> <0066> +<0030> <004d> +<0010> <002d> +<002e> <004b> +<0045> <0062> +<005c> <0079> +<005d> <007a> +<0035> <0052> +<0025> <0042> +<002f> <004c> +<0036> <0053> +<005b> <0078> +<0027> <0044> +<0054> <0071> +<0039> <0056> +<0037> <0054> +<0042> <005f> +<003a> <0057> +<0012> <002f> +<003c> <0059> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +1067 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /COQUPR+DejaVuSans +/Encoding /Identity-H +/DescendantFonts [ 1065 0 R ] +/ToUnicode 1066 0 R +>> +endobj +1068 0 obj +<< +/Type /FontDescriptor +/FontName /HSGBYZ+DejaVuSansMono +/FontFamily (DejaVu Sans Mono) +/Flags 4 +/FontBBox [ 0 -155 598 728 ] +/ItalicAngle 0 +/Ascent 928 +/Descent -235 +/CapHeight 728 +/StemV 80 +/StemH 80 +/FontFile2 1055 0 R +>> +endobj +1069 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /HSGBYZ+DejaVuSansMono +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 3 [ 602 602 602 602 602 602 602 602 602 602 602 ] 15 [ 602 602 601 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 601 602 602 602 602 602 602 602 602 ] 46 [ 602 602 602 601 602 602 602 602 602 602 602 602 602 602 602 ] 62 [ 602 602 602 ] 66 [ 601 ] 68 [ 601 601 601 601 601 602 602 602 601 602 601 601 601 602 601 601 602 601 601 601 601 602 601 602 602 602 602 602 602 ] ] +/FontDescriptor 1068 0 R +>> +endobj +1070 0 obj +<< +/Length 1570 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +89 beginbfchar +<0031> <004e> +<0052> <006f> +<0057> <0074> +<0024> <0041> +<0053> <0070> +<004f> <006c> +<004c> <0069> +<0046> <0063> +<0044> <0061> +<0045> <0062> +<0048> <0065> +<0058> <0075> +<0050> <006d> +<0047> <0064> +<0056> <0073> +<0055> <0072> +<0003> <0020> +<0010> <002d> +<0051> <006e> +<0020> <003d> +<0008> <0025> +<001f> <003c> +<004b> <0068> +<0012> <002f> +<0049> <0066> +<0021> <003e> +<0038> <0055> +<001d> <003a> +<002a> <0047> +<004e> <006b> +<0042> <005f> +<005a> <0077> +<0011> <002e> +<0006> <0023> +<0004> <0021> +<0059> <0076> +<0037> <0054> +<004a> <0067> +<005c> <0079> +<0007> <0024> +<0014> <0031> +<002c> <0049> +<0033> <0050> +<0027> <0044> +<0035> <0052> +<003e> <005b> +<0005> <0022> +<005e> <007b> +<0060> <007d> +<0040> <005d> +<001e> <003b> +<005b> <0078> +<000b> <0028> +<000c> <0029> +<002f> <004c> +<000d> <002a> +<005f> <007c> +<000a> <0027> +<0015> <0032> +<0009> <0026> +<0054> <0071> +<0019> <0036> +<0017> <0034> +<0013> <0030> +<002b> <0048> +<0036> <0053> +<0028> <0045> +<0030> <004d> +<0032> <004f> +<0029> <0046> +<003f> <005c> +<001a> <0037> +<0018> <0035> +<001b> <0038> +<0016> <0033> +<0022> <003f> +<0026> <0043> +<003a> <0057> +<000f> <002c> +<003c> <0059> +<001c> <0039> +<003b> <0058> +<0039> <0056> +<0034> <0051> +<0025> <0042> +<005d> <007a> +<004d> <006a> +<0023> <0040> +<002e> <004b> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +1071 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /HSGBYZ+DejaVuSansMono +/Encoding /Identity-H +/DescendantFonts [ 1069 0 R ] +/ToUnicode 1070 0 R +>> +endobj +1072 0 obj +<< +/IBRUDV 1059 0 R +/RQONIJ 1063 0 R +/COQUPR 1067 0 R +/HSGBYZ 1071 0 R +>> +endobj +xref +0 1073 +0000000000 65535 f +0000000015 00000 n +0000001097 00000 n +0000001231 00000 n +0000040568 00000 n +0000040702 00000 n +0000043394 00000 n +0000043593 00000 n +0000047599 00000 n +0000048089 00000 n +0000048290 00000 n +0000048493 00000 n +0000048628 00000 n +0000048764 00000 n +0000048922 00000 n +0000049081 00000 n +0000049314 00000 n +0000049548 00000 n +0000049763 00000 n +0000049979 00000 n +0000050220 00000 n +0000050462 00000 n +0000050685 00000 n +0000050909 00000 n +0000051141 00000 n +0000051374 00000 n +0000051588 00000 n +0000051803 00000 n +0000052030 00000 n +0000052258 00000 n +0000052467 00000 n +0000052677 00000 n +0000052906 00000 n +0000053136 00000 n +0000053347 00000 n +0000053559 00000 n +0000053774 00000 n +0000053990 00000 n +0000054187 00000 n +0000054385 00000 n +0000054604 00000 n +0000054824 00000 n +0000055025 00000 n +0000055227 00000 n +0000055455 00000 n +0000055684 00000 n +0000055894 00000 n +0000056105 00000 n +0000056320 00000 n +0000056536 00000 n +0000060832 00000 n +0000061428 00000 n +0000061659 00000 n +0000061891 00000 n +0000062094 00000 n +0000062298 00000 n +0000062517 00000 n +0000062737 00000 n +0000062938 00000 n +0000063140 00000 n +0000063277 00000 n +0000063415 00000 n +0000063609 00000 n +0000063804 00000 n +0000063994 00000 n +0000064185 00000 n +0000064376 00000 n +0000064568 00000 n +0000064760 00000 n +0000064953 00000 n +0000065192 00000 n +0000065432 00000 n +0000065647 00000 n +0000065863 00000 n +0000066071 00000 n +0000066280 00000 n +0000066476 00000 n +0000066673 00000 n +0000066869 00000 n +0000067066 00000 n +0000067265 00000 n +0000067465 00000 n +0000067665 00000 n +0000067866 00000 n +0000068064 00000 n +0000068263 00000 n +0000068497 00000 n +0000068732 00000 n +0000068931 00000 n +0000069131 00000 n +0000069334 00000 n +0000069538 00000 n +0000069740 00000 n +0000069943 00000 n +0000070143 00000 n +0000070344 00000 n +0000070540 00000 n +0000070737 00000 n +0000070926 00000 n +0000071116 00000 n +0000071307 00000 n +0000071500 00000 n +0000071690 00000 n +0000071881 00000 n +0000072066 00000 n +0000072252 00000 n +0000076372 00000 n +0000076971 00000 n +0000077183 00000 n +0000077396 00000 n +0000077611 00000 n +0000077827 00000 n +0000078041 00000 n +0000078256 00000 n +0000078458 00000 n +0000078661 00000 n +0000078863 00000 n +0000079066 00000 n +0000079277 00000 n +0000079489 00000 n +0000079710 00000 n +0000079932 00000 n +0000080161 00000 n +0000080391 00000 n +0000080592 00000 n +0000080794 00000 n +0000080992 00000 n +0000081191 00000 n +0000081404 00000 n +0000081618 00000 n +0000081817 00000 n +0000082017 00000 n +0000082228 00000 n +0000082440 00000 n +0000082586 00000 n +0000082733 00000 n +0000082947 00000 n +0000083162 00000 n +0000083354 00000 n +0000083547 00000 n +0000083758 00000 n +0000083970 00000 n +0000084189 00000 n +0000084409 00000 n +0000084608 00000 n +0000084808 00000 n +0000085016 00000 n +0000085225 00000 n +0000085422 00000 n +0000085620 00000 n +0000085757 00000 n +0000085895 00000 n +0000086087 00000 n +0000086280 00000 n +0000086479 00000 n +0000086679 00000 n +0000091203 00000 n +0000091802 00000 n +0000091959 00000 n +0000092117 00000 n +0000092330 00000 n +0000092544 00000 n +0000092740 00000 n +0000092937 00000 n +0000093129 00000 n +0000093322 00000 n +0000093545 00000 n +0000093769 00000 n +0000093970 00000 n +0000094172 00000 n +0000094369 00000 n +0000094567 00000 n +0000094764 00000 n +0000094962 00000 n +0000095122 00000 n +0000095283 00000 n +0000095480 00000 n +0000095678 00000 n +0000095813 00000 n +0000095949 00000 n +0000096132 00000 n +0000096316 00000 n +0000096508 00000 n +0000096701 00000 n +0000096860 00000 n +0000097020 00000 n +0000097241 00000 n +0000097463 00000 n +0000097666 00000 n +0000097870 00000 n +0000098093 00000 n +0000098317 00000 n +0000098521 00000 n +0000098726 00000 n +0000098957 00000 n +0000099189 00000 n +0000099402 00000 n +0000099616 00000 n +0000099845 00000 n +0000100075 00000 n +0000100293 00000 n +0000100512 00000 n +0000100748 00000 n +0000100984 00000 n +0000101201 00000 n +0000101419 00000 n +0000106107 00000 n +0000106722 00000 n +0000106857 00000 n +0000106993 00000 n +0000107186 00000 n +0000107380 00000 n +0000107591 00000 n +0000107803 00000 n +0000108006 00000 n +0000108210 00000 n +0000108401 00000 n +0000108593 00000 n +0000108807 00000 n +0000109022 00000 n +0000109225 00000 n +0000109429 00000 n +0000109634 00000 n +0000109840 00000 n +0000110030 00000 n +0000110221 00000 n +0000110458 00000 n +0000110696 00000 n +0000110927 00000 n +0000111159 00000 n +0000111363 00000 n +0000111568 00000 n +0000111776 00000 n +0000111985 00000 n +0000112193 00000 n +0000112402 00000 n +0000112555 00000 n +0000112709 00000 n +0000112906 00000 n +0000113104 00000 n +0000113265 00000 n +0000113427 00000 n +0000113609 00000 n +0000113792 00000 n +0000113957 00000 n +0000114123 00000 n +0000114320 00000 n +0000114518 00000 n +0000114720 00000 n +0000114923 00000 n +0000115072 00000 n +0000115222 00000 n +0000115404 00000 n +0000115587 00000 n +0000115808 00000 n +0000116030 00000 n +0000116243 00000 n +0000116457 00000 n +0000120738 00000 n +0000121257 00000 n +0000121475 00000 n +0000121694 00000 n +0000121898 00000 n +0000122103 00000 n +0000122279 00000 n +0000122456 00000 n +0000122655 00000 n +0000122855 00000 n +0000123050 00000 n +0000123246 00000 n +0000123444 00000 n +0000123643 00000 n +0000123795 00000 n +0000123948 00000 n +0000124135 00000 n +0000124323 00000 n +0000124517 00000 n +0000124712 00000 n +0000124858 00000 n +0000125005 00000 n +0000125207 00000 n +0000125410 00000 n +0000125577 00000 n +0000125745 00000 n +0000125901 00000 n +0000126058 00000 n +0000126265 00000 n +0000126473 00000 n +0000126617 00000 n +0000126762 00000 n +0000126964 00000 n +0000127167 00000 n +0000127381 00000 n +0000127596 00000 n +0000127781 00000 n +0000127967 00000 n +0000128145 00000 n +0000128324 00000 n +0000133129 00000 n +0000133368 00000 n +0000133624 00000 n +0000133831 00000 n +0000134037 00000 n +0000137600 00000 n +0000137831 00000 n +0000138028 00000 n +0000138217 00000 n +0000141861 00000 n +0000142064 00000 n +0000145488 00000 n +0000145691 00000 n +0000149530 00000 n +0000149761 00000 n +0000149895 00000 n +0000150029 00000 n +0000154200 00000 n +0000154519 00000 n +0000154653 00000 n +0000154785 00000 n +0000154917 00000 n +0000155049 00000 n +0000155181 00000 n +0000155313 00000 n +0000155445 00000 n +0000155577 00000 n +0000155709 00000 n +0000155842 00000 n +0000155975 00000 n +0000156108 00000 n +0000156240 00000 n +0000161465 00000 n +0000161936 00000 n +0000162069 00000 n +0000162202 00000 n +0000162335 00000 n +0000162468 00000 n +0000162601 00000 n +0000162734 00000 n +0000162867 00000 n +0000163000 00000 n +0000163133 00000 n +0000163266 00000 n +0000163399 00000 n +0000163532 00000 n +0000163665 00000 n +0000163798 00000 n +0000163931 00000 n +0000164064 00000 n +0000164197 00000 n +0000164330 00000 n +0000164463 00000 n +0000164596 00000 n +0000164729 00000 n +0000164862 00000 n +0000164995 00000 n +0000165128 00000 n +0000165261 00000 n +0000165394 00000 n +0000165527 00000 n +0000165660 00000 n +0000165793 00000 n +0000165926 00000 n +0000166059 00000 n +0000166193 00000 n +0000170767 00000 n +0000171166 00000 n +0000171300 00000 n +0000171432 00000 n +0000171564 00000 n +0000171696 00000 n +0000171828 00000 n +0000171960 00000 n +0000172092 00000 n +0000172224 00000 n +0000172356 00000 n +0000172489 00000 n +0000172622 00000 n +0000172755 00000 n +0000172888 00000 n +0000173021 00000 n +0000173154 00000 n +0000173287 00000 n +0000173420 00000 n +0000173553 00000 n +0000173686 00000 n +0000173819 00000 n +0000173952 00000 n +0000174085 00000 n +0000174217 00000 n +0000179169 00000 n +0000179672 00000 n +0000179805 00000 n +0000179938 00000 n +0000180071 00000 n +0000180204 00000 n +0000180337 00000 n +0000180470 00000 n +0000180603 00000 n +0000180736 00000 n +0000180869 00000 n +0000181002 00000 n +0000181135 00000 n +0000181268 00000 n +0000181401 00000 n +0000181534 00000 n +0000181667 00000 n +0000181800 00000 n +0000181933 00000 n +0000182066 00000 n +0000182199 00000 n +0000182332 00000 n +0000182465 00000 n +0000182598 00000 n +0000182731 00000 n +0000182864 00000 n +0000182997 00000 n +0000183130 00000 n +0000183263 00000 n +0000183396 00000 n +0000183529 00000 n +0000183662 00000 n +0000183795 00000 n +0000183928 00000 n +0000184061 00000 n +0000184194 00000 n +0000184327 00000 n +0000184459 00000 n +0000189050 00000 n +0000189401 00000 n +0000189534 00000 n +0000189667 00000 n +0000189801 00000 n +0000189936 00000 n +0000190069 00000 n +0000190202 00000 n +0000190335 00000 n +0000190468 00000 n +0000190601 00000 n +0000190734 00000 n +0000190867 00000 n +0000191000 00000 n +0000191134 00000 n +0000191268 00000 n +0000191402 00000 n +0000191535 00000 n +0000191667 00000 n +0000196747 00000 n +0000197266 00000 n +0000197400 00000 n +0000197534 00000 n +0000197668 00000 n +0000197802 00000 n +0000197936 00000 n +0000198070 00000 n +0000198204 00000 n +0000198338 00000 n +0000198472 00000 n +0000198606 00000 n +0000198740 00000 n +0000198874 00000 n +0000199008 00000 n +0000199142 00000 n +0000199276 00000 n +0000199410 00000 n +0000199544 00000 n +0000199678 00000 n +0000199812 00000 n +0000199946 00000 n +0000200080 00000 n +0000200214 00000 n +0000200348 00000 n +0000200482 00000 n +0000200616 00000 n +0000200750 00000 n +0000200884 00000 n +0000201018 00000 n +0000201152 00000 n +0000201286 00000 n +0000201420 00000 n +0000201554 00000 n +0000201688 00000 n +0000201822 00000 n +0000201956 00000 n +0000202090 00000 n +0000202223 00000 n +0000202355 00000 n +0000206626 00000 n +0000206929 00000 n +0000207063 00000 n +0000207197 00000 n +0000207331 00000 n +0000207465 00000 n +0000207599 00000 n +0000207733 00000 n +0000207867 00000 n +0000208001 00000 n +0000208135 00000 n +0000208270 00000 n +0000208405 00000 n +0000211947 00000 n +0000212170 00000 n +0000212305 00000 n +0000217240 00000 n +0000217463 00000 n +0000217598 00000 n +0000222619 00000 n +0000222842 00000 n +0000222976 00000 n +0000227786 00000 n +0000227989 00000 n +0000232911 00000 n +0000233134 00000 n +0000233269 00000 n +0000238041 00000 n +0000238244 00000 n +0000242998 00000 n +0000243221 00000 n +0000243356 00000 n +0000248351 00000 n +0000248574 00000 n +0000248708 00000 n +0000253516 00000 n +0000253719 00000 n +0000258554 00000 n +0000258777 00000 n +0000258912 00000 n +0000263717 00000 n +0000263920 00000 n +0000268805 00000 n +0000269028 00000 n +0000269163 00000 n +0000274145 00000 n +0000274368 00000 n +0000274503 00000 n +0000279342 00000 n +0000279545 00000 n +0000284424 00000 n +0000284647 00000 n +0000284782 00000 n +0000289526 00000 n +0000289729 00000 n +0000294717 00000 n +0000294940 00000 n +0000295075 00000 n +0000299927 00000 n +0000300130 00000 n +0000305090 00000 n +0000305313 00000 n +0000305448 00000 n +0000310258 00000 n +0000310481 00000 n +0000310616 00000 n +0000315417 00000 n +0000315648 00000 n +0000315783 00000 n +0000315918 00000 n +0000320746 00000 n +0000320949 00000 n +0000325683 00000 n +0000325906 00000 n +0000326041 00000 n +0000330983 00000 n +0000331206 00000 n +0000331341 00000 n +0000336147 00000 n +0000336350 00000 n +0000341362 00000 n +0000341585 00000 n +0000341720 00000 n +0000346509 00000 n +0000346712 00000 n +0000351547 00000 n +0000351770 00000 n +0000351905 00000 n +0000356889 00000 n +0000357112 00000 n +0000357245 00000 n +0000362042 00000 n +0000362245 00000 n +0000367143 00000 n +0000367366 00000 n +0000367501 00000 n +0000372274 00000 n +0000372477 00000 n +0000377227 00000 n +0000377450 00000 n +0000377585 00000 n +0000382574 00000 n +0000382797 00000 n +0000382932 00000 n +0000387812 00000 n +0000388015 00000 n +0000392816 00000 n +0000393039 00000 n +0000393174 00000 n +0000397878 00000 n +0000398081 00000 n +0000402858 00000 n +0000403081 00000 n +0000403216 00000 n +0000408172 00000 n +0000408395 00000 n +0000408530 00000 n +0000413372 00000 n +0000413575 00000 n +0000418422 00000 n +0000418645 00000 n +0000418780 00000 n +0000423552 00000 n +0000423755 00000 n +0000428591 00000 n +0000428814 00000 n +0000428949 00000 n +0000433919 00000 n +0000434142 00000 n +0000434277 00000 n +0000439116 00000 n +0000439319 00000 n +0000444143 00000 n +0000444366 00000 n +0000444502 00000 n +0000449302 00000 n +0000449505 00000 n +0000454312 00000 n +0000454535 00000 n +0000454671 00000 n +0000459704 00000 n +0000459927 00000 n +0000460063 00000 n +0000464890 00000 n +0000465093 00000 n +0000469963 00000 n +0000470186 00000 n +0000470322 00000 n +0000475095 00000 n +0000475298 00000 n +0000480106 00000 n +0000480329 00000 n +0000480465 00000 n +0000485505 00000 n +0000485752 00000 n +0000485888 00000 n +0000486022 00000 n +0000486156 00000 n +0000486288 00000 n +0000490909 00000 n +0000491300 00000 n +0000491434 00000 n +0000491568 00000 n +0000491702 00000 n +0000491836 00000 n +0000491970 00000 n +0000492105 00000 n +0000492240 00000 n +0000492375 00000 n +0000492510 00000 n +0000492645 00000 n +0000492780 00000 n +0000492915 00000 n +0000493050 00000 n +0000493185 00000 n +0000493320 00000 n +0000493455 00000 n +0000493590 00000 n +0000493725 00000 n +0000493860 00000 n +0000493995 00000 n +0000494130 00000 n +0000494266 00000 n +0000497532 00000 n +0000497755 00000 n +0000497891 00000 n +0000502729 00000 n +0000502952 00000 n +0000503088 00000 n +0000507750 00000 n +0000507981 00000 n +0000508117 00000 n +0000508253 00000 n +0000512880 00000 n +0000513103 00000 n +0000513239 00000 n +0000517847 00000 n +0000518070 00000 n +0000518206 00000 n +0000522796 00000 n +0000523019 00000 n +0000523155 00000 n +0000526018 00000 n +0000526221 00000 n +0000530676 00000 n +0000530907 00000 n +0000531043 00000 n +0000531179 00000 n +0000534150 00000 n +0000534353 00000 n +0000539207 00000 n +0000539430 00000 n +0000539566 00000 n +0000544394 00000 n +0000544597 00000 n +0000549503 00000 n +0000549726 00000 n +0000549862 00000 n +0000554598 00000 n +0000554801 00000 n +0000559811 00000 n +0000560034 00000 n +0000560170 00000 n +0000564760 00000 n +0000564963 00000 n +0000569968 00000 n +0000570171 00000 n +0000574930 00000 n +0000575153 00000 n +0000575289 00000 n +0000580081 00000 n +0000580284 00000 n +0000585073 00000 n +0000585296 00000 n +0000585432 00000 n +0000590253 00000 n +0000590456 00000 n +0000595354 00000 n +0000595577 00000 n +0000595713 00000 n +0000600505 00000 n +0000600708 00000 n +0000605699 00000 n +0000605922 00000 n +0000606058 00000 n +0000610701 00000 n +0000610904 00000 n +0000615120 00000 n +0000615323 00000 n +0000618576 00000 n +0000618779 00000 n +0000623640 00000 n +0000623863 00000 n +0000623999 00000 n +0000628586 00000 n +0000628789 00000 n +0000633039 00000 n +0000633262 00000 n +0000633398 00000 n +0000637454 00000 n +0000637685 00000 n +0000637821 00000 n +0000637957 00000 n +0000642905 00000 n +0000643176 00000 n +0000643312 00000 n +0000643448 00000 n +0000643582 00000 n +0000643716 00000 n +0000643850 00000 n +0000643984 00000 n +0000644119 00000 n +0000648884 00000 n +0000649147 00000 n +0000649283 00000 n +0000649417 00000 n +0000649551 00000 n +0000649685 00000 n +0000649819 00000 n +0000649955 00000 n +0000653042 00000 n +0000653245 00000 n +0000657542 00000 n +0000657781 00000 n +0000657917 00000 n +0000658053 00000 n +0000658188 00000 n +0000662206 00000 n +0000662445 00000 n +0000662581 00000 n +0000662717 00000 n +0000662853 00000 n +0000667439 00000 n +0000667686 00000 n +0000667822 00000 n +0000667958 00000 n +0000668094 00000 n +0000668230 00000 n +0000673061 00000 n +0000673292 00000 n +0000673428 00000 n +0000673564 00000 n +0000677696 00000 n +0000677927 00000 n +0000678063 00000 n +0000678199 00000 n +0000682312 00000 n +0000682559 00000 n +0000682695 00000 n +0000682831 00000 n +0000682967 00000 n +0000683103 00000 n +0000687930 00000 n +0000688161 00000 n +0000688297 00000 n +0000688433 00000 n +0000693184 00000 n +0000693407 00000 n +0000693543 00000 n +0000696613 00000 n +0000696844 00000 n +0000696980 00000 n +0000697116 00000 n +0000701095 00000 n +0000701298 00000 n +0000706710 00000 n +0000707101 00000 n +0000707237 00000 n +0000707371 00000 n +0000707505 00000 n +0000707639 00000 n +0000707773 00000 n +0000707907 00000 n +0000708041 00000 n +0000708175 00000 n +0000708309 00000 n +0000708444 00000 n +0000708579 00000 n +0000708714 00000 n +0000708849 00000 n +0000708984 00000 n +0000709119 00000 n +0000709254 00000 n +0000709389 00000 n +0000709524 00000 n +0000709659 00000 n +0000709794 00000 n +0000709929 00000 n +0000710063 00000 n +0000714052 00000 n +0000714347 00000 n +0000714482 00000 n +0000714617 00000 n +0000714752 00000 n +0000714887 00000 n +0000715022 00000 n +0000715157 00000 n +0000715292 00000 n +0000715427 00000 n +0000715562 00000 n +0000715698 00000 n +0000720119 00000 n +0000720342 00000 n +0000720478 00000 n +0000724960 00000 n +0000725191 00000 n +0000725327 00000 n +0000725463 00000 n +0000729744 00000 n +0000729967 00000 n +0000730103 00000 n +0000732973 00000 n +0000733176 00000 n +0000738089 00000 n +0000738416 00000 n +0000738552 00000 n +0000738686 00000 n +0000738820 00000 n +0000738954 00000 n +0000739088 00000 n +0000739222 00000 n +0000739356 00000 n +0000739490 00000 n +0000739624 00000 n +0000739759 00000 n +0000739894 00000 n +0000740029 00000 n +0000740163 00000 n +0000740296 00000 n +0000743589 00000 n +0000743852 00000 n +0000743987 00000 n +0000744122 00000 n +0000744257 00000 n +0000744392 00000 n +0000744527 00000 n +0000744663 00000 n +0000748077 00000 n +0000748280 00000 n +0000751539 00000 n +0000751742 00000 n +0000756025 00000 n +0000756228 00000 n +0000760804 00000 n +0000761171 00000 n +0000761307 00000 n +0000761441 00000 n +0000761575 00000 n +0000761709 00000 n +0000761843 00000 n +0000761977 00000 n +0000762111 00000 n +0000762245 00000 n +0000762379 00000 n +0000762514 00000 n +0000762649 00000 n +0000762784 00000 n +0000762919 00000 n +0000763054 00000 n +0000763189 00000 n +0000763324 00000 n +0000763459 00000 n +0000763594 00000 n +0000763730 00000 n +0000763922 00000 n +0000764144 00000 n +0000764270 00000 n +0000764416 00000 n +0000764556 00000 n +0000764753 00000 n +0000764987 00000 n +0000765218 00000 n +0000765474 00000 n +0000765713 00000 n +0000765960 00000 n +0000766190 00000 n +0000766432 00000 n +0000766657 00000 n +0000766901 00000 n +0000767129 00000 n +0000767360 00000 n +0000767574 00000 n +0000767809 00000 n +0000768027 00000 n +0000768271 00000 n +0000768498 00000 n +0000768730 00000 n +0000768977 00000 n +0000769196 00000 n +0000769431 00000 n +0000769635 00000 n +0000769811 00000 n +0000770006 00000 n +0000770211 00000 n +0000770417 00000 n +0000770624 00000 n +0000770878 00000 n +0000771108 00000 n +0000771331 00000 n +0000771542 00000 n +0000771753 00000 n +0000771968 00000 n +0000772184 00000 n +0000772398 00000 n +0000772648 00000 n +0000772863 00000 n +0000773082 00000 n +0000773300 00000 n +0000773516 00000 n +0000773728 00000 n +0000773933 00000 n +0000774140 00000 n +0000774345 00000 n +0000774546 00000 n +0000774773 00000 n +0000775003 00000 n +0000775232 00000 n +0000775449 00000 n +0000775666 00000 n +0000775892 00000 n +0000776128 00000 n +0000776372 00000 n +0000776588 00000 n +0000776801 00000 n +0000777029 00000 n +0000777243 00000 n +0000777455 00000 n +0000777638 00000 n +0000777852 00000 n +0000778056 00000 n +0000778281 00000 n +0000778514 00000 n +0000778727 00000 n +0000778949 00000 n +0000779146 00000 n +0000779320 00000 n +0000779510 00000 n +0000779707 00000 n +0000779899 00000 n +0000780110 00000 n +0000780318 00000 n +0000780522 00000 n +0000780757 00000 n +0000780970 00000 n +0000781179 00000 n +0000781374 00000 n +0000781571 00000 n +0000781754 00000 n +0000781926 00000 n +0000782109 00000 n +0000782301 00000 n +0000782500 00000 n +0000782721 00000 n +0000782939 00000 n +0000783177 00000 n +0000783398 00000 n +0000783646 00000 n +0000783877 00000 n +0000784123 00000 n +0000784359 00000 n +0000784612 00000 n +0000784834 00000 n +0000785011 00000 n +0000785207 00000 n +0000785434 00000 n +0000785653 00000 n +0000785862 00000 n +0000786094 00000 n +0000786315 00000 n +0000786538 00000 n +0000786746 00000 n +0000787001 00000 n +0000787249 00000 n +0000787472 00000 n +0000787699 00000 n +0000787911 00000 n +0000788106 00000 n +0000788306 00000 n +0000788485 00000 n +0000788685 00000 n +0000788868 00000 n +0000789083 00000 n +0000789288 00000 n +0000789479 00000 n +0000789664 00000 n +0000789903 00000 n +0000790135 00000 n +0000790371 00000 n +0000790593 00000 n +0000790787 00000 n +0000791004 00000 n +0000791217 00000 n +0000791418 00000 n +0000791612 00000 n +0000791802 00000 n +0000791999 00000 n +0000792187 00000 n +0000792392 00000 n +0000792562 00000 n +0000792760 00000 n +0000792955 00000 n +0000793126 00000 n +0000793331 00000 n +0000793564 00000 n +0000793767 00000 n +0000793948 00000 n +0000794012 00000 n +0000801691 00000 n +0000806495 00000 n +0000818352 00000 n +0000830747 00000 n +0000830981 00000 n +0000831385 00000 n +0000832183 00000 n +0000832336 00000 n +0000832567 00000 n +0000833164 00000 n +0000834649 00000 n +0000834799 00000 n +0000835034 00000 n +0000835573 00000 n +0000836810 00000 n +0000836963 00000 n +0000837207 00000 n +0000837802 00000 n +0000839427 00000 n +0000839584 00000 n +trailer +<< +/Size 1073 +/Root 3 0 R +/Info 2 0 R +>> +startxref +839676 +%%EOF diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/_index.md b/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/_index.md new file mode 100644 index 00000000000..913d6594f3c --- /dev/null +++ b/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/_index.md @@ -0,0 +1,3098 @@ +--- +title: CIS v1.6 Benchmark - Self-Assessment Guide - Rancher v2.6 +weight: 101 +--- + +### CIS v1.6 Kubernetes Benchmark - Rancher v2.6 with Kubernetes v1.18 to v1.21 + +[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf). + +#### Overview + +This document is a companion to the Rancher v2.6 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark. + +This guide corresponds to specific versions of the hardening guide, Rancher, CIS Benchmark and Kubernetes: + +| Hardening Guide Version | Rancher Version | CIS Benchmark Version | Kubernetes Version | +| ----------------------- | --------------- | --------------------- | ------------------- | +| Hardening Guide CIS v1.6 Benchmark | Rancher v2.6.3 | CIS v1.6 | Kubernetes v1.18, v1.19, v1.20 and v1.21 | + +Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark do not apply and will have a result of `Not Applicable`. This guide will walk through the various controls and provide updated example commands to audit compliance in Rancher created clusters. + +This document is to be used by Rancher operators, security teams, auditors and decision makers. + +For more detail about each audit, including rationales and remediations for failing tests, you can refer to the corresponding section of the CIS Kubernetes Benchmark v1.6. You can download the benchmark, after creating a free account, in [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). + +#### Testing controls methodology + +Rancher and RKE install Kubernetes services via Docker containers. Configuration is defined by arguments passed to the container at the time of initialization, not via configuration files. + +Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher are provided for testing. When performing the tests, you will need access to the Docker command line on the hosts of all three RKE roles. The commands also make use of the [kubectl](https://kubernetes.io/docs/tasks/tools/) (with a valid configuration file) and [jq](https://stedolan.github.io/jq/) tools, which are required in the testing and evaluation of test results. + +> NOTE: For the moment only `automated` tests (previously called `scored`) are covered in this guide. + +### Controls +## 1.1 Master Node Configuration Files +### 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. +All configuration is passed in as arguments at container run time. + +### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. +All configuration is passed in as arguments at container run time. + +### 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chmod 644 + +**Audit:** + +```bash +stat -c permissions=%a +``` + +### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chown root:root + +**Audit:** + +```bash +stat -c %U:%G +``` + +### 1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE does not store the Kubernetes default kubeconfig credentials file on the nodes. + +### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE does not store the Kubernetes default kubeconfig credentials file on the nodes. + +### 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chown -R root:root /etc/kubernetes/pki/ + +**Audit Script:** `check_files_owner_in_dir.sh` + +```bash +#!/usr/bin/env bash + +# This script is used to ensure the owner is set to root:root for +# the given directory and all the files in it +# +# inputs: +# $1 = /full/path/to/directory +# +# outputs: +# true/false + +INPUT_DIR=$1 + +if [[ "${INPUT_DIR}" == "" ]]; then + echo "false" + exit +fi + +if [[ $(stat -c %U:%G ${INPUT_DIR}) != "root:root" ]]; then + echo "false" + exit +fi + +statInfoLines=$(stat -c "%n %U:%G" ${INPUT_DIR}/*) +while read -r statInfoLine; do + f=$(echo ${statInfoLine} | cut -d' ' -f1) + p=$(echo ${statInfoLine} | cut -d' ' -f2) + + if [[ $(basename "$f" .pem) == "kube-etcd-"* ]]; then + if [[ "$p" != "root:root" && "$p" != "etcd:etcd" ]]; then + echo "false" + exit + fi + else + if [[ "$p" != "root:root" ]]; then + echo "false" + exit + fi + fi +done <<< "${statInfoLines}" + + +echo "true" +exit + +``` + +**Audit Execution:** + +```bash +./check_files_owner_in_dir.sh /node/etc/kubernetes/ssl +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chmod -R 644 /etc/kubernetes/pki/*.crt + +**Audit Script:** `check_files_permissions.sh` + +```bash +#!/usr/bin/env bash + +# This script is used to ensure the file permissions are set to 644 or +# more restrictive for all files in a given directory or a wildcard +# selection of files +# +# inputs: +# $1 = /full/path/to/directory or /path/to/fileswithpattern +# ex: !(*key).pem +# +# $2 (optional) = permission (ex: 600) +# +# outputs: +# true/false + +# Turn on "extended glob" for use of '!' in wildcard +shopt -s extglob + +# Turn off history to avoid surprises when using '!' +set -H + +USER_INPUT=$1 + +if [[ "${USER_INPUT}" == "" ]]; then + echo "false" + exit +fi + + +if [[ -d ${USER_INPUT} ]]; then + PATTERN="${USER_INPUT}/*" +else + PATTERN="${USER_INPUT}" +fi + +PERMISSION="" +if [[ "$2" != "" ]]; then + PERMISSION=$2 +fi + +FILES_PERMISSIONS=$(stat -c %n\ %a ${PATTERN}) + +while read -r fileInfo; do + p=$(echo ${fileInfo} | cut -d' ' -f2) + + if [[ "${PERMISSION}" != "" ]]; then + if [[ "$p" != "${PERMISSION}" ]]; then + echo "false" + exit + fi + else + if [[ "$p" != "644" && "$p" != "640" && "$p" != "600" ]]; then + echo "false" + exit + fi + fi +done <<< "${FILES_PERMISSIONS}" + + +echo "true" +exit + +``` + +**Audit Execution:** + +```bash +./check_files_permissions.sh /node/etc/kubernetes/ssl/!(*key).pem +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chmod -R 600 /etc/kubernetes/ssl/*key.pem + +**Audit Script:** `check_files_permissions.sh` + +```bash +#!/usr/bin/env bash + +# This script is used to ensure the file permissions are set to 644 or +# more restrictive for all files in a given directory or a wildcard +# selection of files +# +# inputs: +# $1 = /full/path/to/directory or /path/to/fileswithpattern +# ex: !(*key).pem +# +# $2 (optional) = permission (ex: 600) +# +# outputs: +# true/false + +# Turn on "extended glob" for use of '!' in wildcard +shopt -s extglob + +# Turn off history to avoid surprises when using '!' +set -H + +USER_INPUT=$1 + +if [[ "${USER_INPUT}" == "" ]]; then + echo "false" + exit +fi + + +if [[ -d ${USER_INPUT} ]]; then + PATTERN="${USER_INPUT}/*" +else + PATTERN="${USER_INPUT}" +fi + +PERMISSION="" +if [[ "$2" != "" ]]; then + PERMISSION=$2 +fi + +FILES_PERMISSIONS=$(stat -c %n\ %a ${PATTERN}) + +while read -r fileInfo; do + p=$(echo ${fileInfo} | cut -d' ' -f2) + + if [[ "${PERMISSION}" != "" ]]; then + if [[ "$p" != "${PERMISSION}" ]]; then + echo "false" + exit + fi + else + if [[ "$p" != "644" && "$p" != "640" && "$p" != "600" ]]; then + echo "false" + exit + fi + fi +done <<< "${FILES_PERMISSIONS}" + + +echo "true" +exit + +``` + +**Audit Execution:** + +```bash +./check_files_permissions.sh /node/etc/kubernetes/ssl/*key.pem +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the below command: +ps -ef | grep etcd Run the below command (based on the etcd data directory found above). For example, +chmod 700 /var/lib/etcd + +**Audit:** + +```bash +stat -c %a /node/var/lib/etcd +``` + +**Expected Result**: + +```console +'700' is equal to '700' +``` + +**Returned Value**: + +```console +700 +``` + +### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the below command: +ps -ef | grep etcd +Run the below command (based on the etcd data directory found above). +For example, chown etcd:etcd /var/lib/etcd + +A system service account is required for etcd data directory ownership. +Refer to Rancher's hardening guide for more details on how to configure this ownership. + +**Audit:** + +```bash +stat -c %U:%G /node/var/lib/etcd +``` + +**Expected Result**: + +```console +'etcd:etcd' is present +``` + +**Returned Value**: + +```console +etcd:etcd +``` + +## 1.2 API Server +### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the below parameter. +--anonymous-auth=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'false' is equal to 'false' +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.2 Ensure that the --basic-auth-file argument is not set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and configure alternate mechanisms for authentication. Then, +edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and remove the --basic-auth-file= parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--basic-auth-file' is not present +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.3 Ensure that the --token-auth-file parameter is not set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and configure alternate mechanisms for authentication. Then, +edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and remove the --token-auth-file= parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--token-auth-file' is not present +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and remove the --kubelet-https parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-https' is not present OR '--kubelet-https' is not present +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the +apiserver and kubelets. Then, edit API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the +kubelet client certificate and key parameters as below. +--kubelet-client-certificate= +--kubelet-client-key= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and setup the TLS connection between +the apiserver and kubelets. Then, edit the API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the +--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. +--kubelet-certificate-authority= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-certificate-authority' is present +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --authorization-mode parameter to values other than AlwaysAllow. +One such example could be as below. +--authorization-mode=RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'Node,RBAC' not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --authorization-mode parameter to a value that includes Node. +--authorization-mode=Node,RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'Node,RBAC' has 'Node' +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --authorization-mode parameter to a value that includes RBAC, +for example: +--authorization-mode=Node,RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'Node,RBAC' has 'RBAC' +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set the desired limits in a configuration file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +and set the below parameters. +--enable-admission-plugins=...,EventRateLimit,... +--admission-control-config-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' has 'EventRateLimit' +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and either remove the --enable-admission-plugins parameter, or set it to a +value that does not include AlwaysAdmit. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --enable-admission-plugins parameter to include +AlwaysPullImages. +--enable-admission-plugins=...,AlwaysPullImages,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +### 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --enable-admission-plugins parameter to include +SecurityContextDeny, unless PodSecurityPolicy is already in place. +--enable-admission-plugins=...,SecurityContextDeny,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +### 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create ServiceAccount objects as per your environment. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and ensure that the --disable-admission-plugins parameter is set to a +value that does not include ServiceAccount. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is not present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --disable-admission-plugins parameter to +ensure it does not include NamespaceLifecycle. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is not present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create Pod Security Policy objects as per your environment. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --enable-admission-plugins parameter to a +value that includes PodSecurityPolicy: +--enable-admission-plugins=...,PodSecurityPolicy,... +Then restart the API Server. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' has 'PodSecurityPolicy' +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.17 Ensure that the admission control plugin NodeRestriction is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --enable-admission-plugins parameter to a +value that includes NodeRestriction. +--enable-admission-plugins=...,NodeRestriction,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' has 'NodeRestriction' +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.18 Ensure that the --insecure-bind-address argument is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and remove the --insecure-bind-address parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--insecure-bind-address' is not present +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.19 Ensure that the --insecure-port argument is set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the below parameter. +--insecure-port=0 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'0' is equal to '0' +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.20 Ensure that the --secure-port argument is not set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and either remove the --secure-port parameter or +set it to a different (non-zero) desired port. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +6443 is greater than 0 OR '--secure-port' is not present +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.21 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'false' is equal to 'false' +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.22 Ensure that the --audit-log-path argument is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --audit-log-path parameter to a suitable path and +file where you would like audit logs to be written, for example: +--audit-log-path=/var/log/apiserver/audit.log + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-path' is present +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --audit-log-maxage parameter to 30 or as an appropriate number of days: +--audit-log-maxage=30 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +30 is greater or equal to 30 +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --audit-log-maxbackup parameter to 10 or to an appropriate +value. +--audit-log-maxbackup=10 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +10 is greater or equal to 10 +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --audit-log-maxsize parameter to an appropriate size in MB. +For example, to set it as 100 MB: +--audit-log-maxsize=100 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +100 is greater or equal to 100 +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.26 Ensure that the --request-timeout argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +and set the below parameter as appropriate and if needed. +For example, +--request-timeout=300s + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--request-timeout' is not present OR '--request-timeout' is not present +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.27 Ensure that the --service-account-lookup argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the below parameter. +--service-account-lookup=true +Alternatively, you can delete the --service-account-lookup parameter from this file so +that the default takes effect. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-lookup' is not present OR 'true' is equal to 'true' +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.28 Ensure that the --service-account-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --service-account-key-file parameter +to the public key file for service accounts: +--service-account-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-key-file' is present +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the etcd certificate and key file parameters. +--etcd-certfile= +--etcd-keyfile= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--etcd-certfile' is present AND '--etcd-keyfile' is present +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the TLS certificate and private key file parameters. +--tls-cert-file= +--tls-private-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.31 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the client certificate authority file. +--client-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.32 Ensure that the --etcd-cafile argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the etcd certificate authority file parameter. +--etcd-cafile= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--etcd-cafile' is present +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --encryption-provider-config parameter to the path of that file: --encryption-provider-config= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--encryption-provider-config' is present +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 1.2.34 Ensure that encryption providers are appropriately configured (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +In this file, choose aescbc, kms or secretbox as the encryption provider. + +**Audit Script:** `check_encryption_provider_config.sh` + +```bash +#!/usr/bin/env bash + +# This script is used to check the encrption provider config is set to aesbc +# +# outputs: +# true/false + +# TODO: Figure out the file location from the kube-apiserver commandline args +ENCRYPTION_CONFIG_FILE="/node/etc/kubernetes/ssl/encryption.yaml" + +if [[ ! -f "${ENCRYPTION_CONFIG_FILE}" ]]; then + echo "false" + exit +fi + +for provider in "$@" +do + if grep "$provider" "${ENCRYPTION_CONFIG_FILE}"; then + echo "true" + exit + fi +done + +echo "false" +exit + +``` + +**Audit Execution:** + +```bash +./check_encryption_provider_config.sh aescbc +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +- aescbc: true +``` + +### 1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the below parameter. +--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM +_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM +_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM +_SHA384 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +## 1.3 Controller Manager +### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and set the --terminated-pod-gc-threshold to an appropriate threshold, +for example: +--terminated-pod-gc-threshold=10 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--terminated-pod-gc-threshold' is present +``` + +**Returned Value**: + +```console +root 6684 6662 1 13:04 ? 00:00:12 kube-controller-manager --profiling=false --cluster-cidr=10.42.0.0/16 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --address=0.0.0.0 --leader-elect=true --node-monitor-grace-period=40s --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --configure-cloud-routes=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --terminated-pod-gc-threshold=1000 --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.2 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'false' is equal to 'false' +``` + +**Returned Value**: + +```console +root 6684 6662 1 13:04 ? 00:00:12 kube-controller-manager --profiling=false --cluster-cidr=10.42.0.0/16 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --address=0.0.0.0 --leader-elect=true --node-monitor-grace-period=40s --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --configure-cloud-routes=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --terminated-pod-gc-threshold=1000 --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node to set the below parameter. +--use-service-account-credentials=true + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'true' is not equal to 'false' +``` + +**Returned Value**: + +```console +root 6684 6662 1 13:04 ? 00:00:12 kube-controller-manager --profiling=false --cluster-cidr=10.42.0.0/16 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --address=0.0.0.0 --leader-elect=true --node-monitor-grace-period=40s --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --configure-cloud-routes=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --terminated-pod-gc-threshold=1000 --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and set the --service-account-private-key-file parameter +to the private key file for service accounts. +--service-account-private-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-private-key-file' is present +``` + +**Returned Value**: + +```console +root 6684 6662 1 13:04 ? 00:00:12 kube-controller-manager --profiling=false --cluster-cidr=10.42.0.0/16 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --address=0.0.0.0 --leader-elect=true --node-monitor-grace-period=40s --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --configure-cloud-routes=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --terminated-pod-gc-threshold=1000 --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and set the --root-ca-file parameter to the certificate bundle file`. +--root-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--root-ca-file' is present +``` + +**Returned Value**: + +```console +root 6684 6662 1 13:04 ? 00:00:12 kube-controller-manager --profiling=false --cluster-cidr=10.42.0.0/16 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --address=0.0.0.0 --leader-elect=true --node-monitor-grace-period=40s --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --configure-cloud-routes=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --terminated-pod-gc-threshold=1000 --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. +--feature-gates=RotateKubeletServerCertificate=true + +Cluster provisioned by RKE handles certificate rotation directly through RKE. + +### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--bind-address' is not present OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 6684 6662 1 13:04 ? 00:00:12 kube-controller-manager --profiling=false --cluster-cidr=10.42.0.0/16 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --address=0.0.0.0 --leader-elect=true --node-monitor-grace-period=40s --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --configure-cloud-routes=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --terminated-pod-gc-threshold=1000 --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +## 1.4 Scheduler +### 1.4.1 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file +on the master node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-scheduler | grep -v grep +``` + +**Expected Result**: + +```console +'false' is equal to 'false' +``` + +**Returned Value**: + +```console +root 6889 6870 0 13:04 ? 00:00:02 kube-scheduler --leader-elect=true --profiling=false --v=2 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --address=0.0.0.0 +``` + +### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml +on the master node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep kube-scheduler | grep -v grep +``` + +**Expected Result**: + +```console +'--bind-address' is not present OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 6889 6870 0 13:04 ? 00:00:02 kube-scheduler --leader-elect=true --profiling=false --v=2 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --address=0.0.0.0 +``` + +## 2 Etcd Node Configuration Files +### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure TLS encryption. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml +on the master node and set the below parameters. +--cert-file= +--key-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--cert-file' is present AND '--key-file' is present +``` + +**Returned Value**: + +```console +etcd 6259 6237 1 13:03 ? 00:00:13 /usr/local/bin/etcd --listen-peer-urls=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-client-cert-auth=true --heartbeat-interval=500 --name=etcd- --initial-cluster=etcd-=https://:2380 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --listen-client-urls=https://:2379 --initial-advertise-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --client-cert-auth=true --enable-v2=true --election-timeout=5000 --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --initial-cluster-state=new --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --advertise-client-urls=https://:2379 root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 root 24183 24165 1 13:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +``` + +### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and set the below parameter. +--client-cert-auth="true" + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--client-cert-auth' is present OR 'true' is equal to 'true' +``` + +**Returned Value**: + +```console +etcd 6259 6237 1 13:03 ? 00:00:13 /usr/local/bin/etcd --listen-peer-urls=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-client-cert-auth=true --heartbeat-interval=500 --name=etcd- --initial-cluster=etcd-=https://:2380 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --listen-client-urls=https://:2379 --initial-advertise-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --client-cert-auth=true --enable-v2=true --election-timeout=5000 --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --initial-cluster-state=new --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --advertise-client-urls=https://:2379 root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 root 24183 24165 1 13:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +``` + +### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and either remove the --auto-tls parameter or set it to false. + --auto-tls=false + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--auto-tls' is not present OR '--auto-tls' is not present +``` + +**Returned Value**: + +```console +etcd 6259 6237 1 13:03 ? 00:00:13 /usr/local/bin/etcd --listen-peer-urls=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-client-cert-auth=true --heartbeat-interval=500 --name=etcd- --initial-cluster=etcd-=https://:2380 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --listen-client-urls=https://:2379 --initial-advertise-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --client-cert-auth=true --enable-v2=true --election-timeout=5000 --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --initial-cluster-state=new --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --advertise-client-urls=https://:2379 root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 root 24183 24165 1 13:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +``` + +### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure peer TLS encryption as appropriate +for your etcd cluster. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the +master node and set the below parameters. +--peer-client-file= +--peer-key-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--peer-cert-file' is present AND '--peer-key-file' is present +``` + +**Returned Value**: + +```console +etcd 6259 6237 1 13:03 ? 00:00:13 /usr/local/bin/etcd --listen-peer-urls=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-client-cert-auth=true --heartbeat-interval=500 --name=etcd- --initial-cluster=etcd-=https://:2380 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --listen-client-urls=https://:2379 --initial-advertise-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --client-cert-auth=true --enable-v2=true --election-timeout=5000 --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --initial-cluster-state=new --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --advertise-client-urls=https://:2379 root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 root 24183 24165 1 13:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +``` + +### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and set the below parameter. +--peer-client-cert-auth=true + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--peer-client-cert-auth' is present OR 'true' is equal to 'true' +``` + +**Returned Value**: + +```console +etcd 6259 6237 1 13:03 ? 00:00:13 /usr/local/bin/etcd --listen-peer-urls=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-client-cert-auth=true --heartbeat-interval=500 --name=etcd- --initial-cluster=etcd-=https://:2380 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --listen-client-urls=https://:2379 --initial-advertise-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --client-cert-auth=true --enable-v2=true --election-timeout=5000 --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --initial-cluster-state=new --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --advertise-client-urls=https://:2379 root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 root 24183 24165 1 13:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +``` + +### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and either remove the --peer-auto-tls parameter or set it to false. +--peer-auto-tls=false + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--peer-auto-tls' is not present OR '--peer-auto-tls' is present +``` + +**Returned Value**: + +```console +etcd 6259 6237 1 13:03 ? 00:00:13 /usr/local/bin/etcd --listen-peer-urls=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-client-cert-auth=true --heartbeat-interval=500 --name=etcd- --initial-cluster=etcd-=https://:2380 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --listen-client-urls=https://:2379 --initial-advertise-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --client-cert-auth=true --enable-v2=true --election-timeout=5000 --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --initial-cluster-state=new --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --advertise-client-urls=https://:2379 root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 root 24183 24165 2 13:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +``` + +### 2.7 Ensure that a unique Certificate Authority is used for etcd (Automated) + + +**Result:** pass + +**Remediation:** +[Manual test] +Follow the etcd documentation and create a dedicated certificate authority setup for the +etcd service. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the +master node and set the below parameter. +--trusted-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--trusted-ca-file' is present +``` + +**Returned Value**: + +```console +etcd 6259 6237 1 13:03 ? 00:00:13 /usr/local/bin/etcd --listen-peer-urls=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-client-cert-auth=true --heartbeat-interval=500 --name=etcd- --initial-cluster=etcd-=https://:2380 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --listen-client-urls=https://:2379 --initial-advertise-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --client-cert-auth=true --enable-v2=true --election-timeout=5000 --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --initial-cluster-state=new --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --advertise-client-urls=https://:2379 root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 root 24183 24165 2 13:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +``` + +## 3.1 Authentication and Authorization +### 3.1.1 Client certificate authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be +implemented in place of client certificates. + +## 3.2 Logging +### 3.2.1 Ensure that a minimal audit policy is created (Automated) + + +**Result:** pass + +**Remediation:** +Create an audit policy file for your cluster. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-policy-file' is present +``` + +**Returned Value**: + +```console +root 6465 6444 8 13:04 ? 00:01:03 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +``` + +### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) + + +**Result:** warn + +**Remediation:** +Consider modification of the audit policy in use on the cluster to include these items, at a +minimum. + +## 4.1 Worker Node Configuration Files +### 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. +All configuration is passed in as arguments at container run time. + +### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. +All configuration is passed in as arguments at container run time. + +### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 644 $proykubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %a /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' +``` + +**Expected Result**: + +```console +'644' is present OR '640' is present OR '600' is equal to '600' OR '444' is present OR '440' is present OR '400' is present OR '000' is present +``` + +**Returned Value**: + +```console +600 +``` + +### 4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is not present OR '/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml' is not present +``` + +### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 644 /etc/kubernetes/ssl/kubecfg-kube-node.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c permissions=%a /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' +``` + +**Expected Result**: + +```console +'permissions' is not present +``` + +### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the following command to modify the file permissions of the +--client-ca-file chmod 644 + +**Audit Script:** `check_cafile_permissions.sh` + +```bash +#!/usr/bin/env bash + +CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') +if test -z $CAFILE; then CAFILE=$kubeletcafile; fi +if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi + +``` + +**Audit Execution:** + +```bash +./check_cafile_permissions.sh +``` + +**Expected Result**: + +```console +'permissions' is not present +``` + +### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the following command to modify the ownership of the --client-ca-file. +chown root:root + +**Audit Script:** `check_cafile_ownership.sh` + +```bash +#!/usr/bin/env bash + +CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') +if test -z $CAFILE; then CAFILE=$kubeletcafile; fi +if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi + +``` + +**Audit Execution:** + +```bash +./check_cafile_ownership.sh +``` + +**Expected Result**: + +```console +'root:root' is not present +``` + +### 4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chmod 644 /var/lib/kubelet/config.yaml + +Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. +All configuration is passed in as arguments at container run time. + +### 4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chown root:root /var/lib/kubelet/config.yaml + +Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. +All configuration is passed in as arguments at container run time. + +## 4.2 Kubelet +### 4.2.1 Ensure that the anonymous-auth argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to +false. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--anonymous-auth=false +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present +``` + +### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set authorization: mode to Webhook. If +using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--authorization-mode=Webhook +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present +``` + +### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set authentication: x509: clientCAFile to +the location of the client CA file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--client-ca-file= +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present +``` + +### 4.2.4 Ensure that the --read-only-port argument is set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set readOnlyPort to 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--read-only-port=0 +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present OR '' is not present +``` + +### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set streamingConnectionIdleTimeout to a +value other than 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--streaming-connection-idle-timeout=5m +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'30m' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 7101 7078 3 13:04 ? 00:00:23 kubelet --streaming-connection-idle-timeout=30m --cluster-dns=10.43.0.10 --pod-infra-container-image=rancher/mirrored-pause:3.4.1 --node-ip= --network-plugin=cni --event-qps=0 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --cni-bin-dir=/opt/cni/bin --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --v=2 --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --hostname-override= --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-.pem --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cluster-domain=cluster.local --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet--key.pem --authentication-token-webhook=true --cni-conf-dir=/etc/cni/net.d --cgroups-per-qos=True --make-iptables-util-chains=true --read-only-port=0 --fail-swap-on=false --anonymous-auth=false --protect-kernel-defaults=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --address=0.0.0.0 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set protectKernelDefaults: true. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--protect-kernel-defaults=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present +``` + +### 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set makeIPTablesUtilChains: true. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove the --make-iptables-util-chains argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present OR '' is not present +``` + +### 4.2.8 Ensure that the --hostname-override argument is not set (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and remove the --hostname-override argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +Clusters provisioned by RKE set the --hostname-override to avoid any hostname configuration errors + +### 4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set eventRecordQPS: to an appropriate level. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present +``` + +### 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set tlsCertFile to the location +of the certificate file to use to identify this Kubelet, and tlsPrivateKeyFile +to the location of the corresponding private key file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameters in KUBELET_CERTIFICATE_ARGS variable. +--tls-cert-file= +--tls-private-key-file= +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present AND '' is not present +``` + +### 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to add the line rotateCertificates: true or +remove it altogether to use the default value. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS +variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'--rotate-certificates' is not present OR '--rotate-certificates' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 7101 7078 3 13:04 ? 00:00:23 kubelet --streaming-connection-idle-timeout=30m --cluster-dns=10.43.0.10 --pod-infra-container-image=rancher/mirrored-pause:3.4.1 --node-ip= --network-plugin=cni --event-qps=0 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --cni-bin-dir=/opt/cni/bin --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --v=2 --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --hostname-override= --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-.pem --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cluster-domain=cluster.local --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet--key.pem --authentication-token-webhook=true --cni-conf-dir=/etc/cni/net.d --cgroups-per-qos=True --make-iptables-util-chains=true --read-only-port=0 --fail-swap-on=false --anonymous-auth=false --protect-kernel-defaults=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --address=0.0.0.0 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. +--feature-gates=RotateKubeletServerCertificate=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +Clusters provisioned by RKE handles certificate rotation directly through RKE. + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +### 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set TLSCipherSuites: to +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +or to a subset of these values. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the --tls-cipher-suites parameter as follows, or to a subset of these values. +--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present +``` + +## 5.1 RBAC and Service Accounts +### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) + + +**Result:** warn + +**Remediation:** +Identify all clusterrolebindings to the cluster-admin role. Check if they are used and +if they need this role or if they could use a role with fewer privileges. +Where possible, first bind users to a lower privileged role and then remove the +clusterrolebinding to the cluster-admin role : +kubectl delete clusterrolebinding [name] + +### 5.1.2 Minimize access to secrets (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove get, list and watch access to secret objects in the cluster. + +### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) + + +**Result:** warn + +**Remediation:** +Where possible replace any use of wildcards in clusterroles and roles with specific +objects or actions. + +### 5.1.4 Minimize access to create pods (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove create access to pod objects in the cluster. + +### 5.1.5 Ensure that default service accounts are not actively used. (Automated) + + +**Result:** pass + +**Remediation:** +Create explicit service accounts wherever a Kubernetes workload requires specific access +to the Kubernetes API server. +Modify the configuration of each default service account to include this value +automountServiceAccountToken: false + +**Audit Script:** `check_for_default_sa.sh` + +```bash +#!/bin/bash + +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + +count_sa=$(kubectl get serviceaccounts --all-namespaces -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true))' | jq .metadata.namespace | wc -l) +if [[ ${count_sa} -gt 0 ]]; then + echo "false" + exit +fi + +for ns in $(kubectl get ns --no-headers -o custom-columns=":metadata.name") +do + for result in $(kubectl get clusterrolebinding,rolebinding -n $ns -o json | jq -r '.items[] | select((.subjects[].kind=="ServiceAccount" and .subjects[].name=="default") or (.subjects[].kind=="Group" and .subjects[].name=="system:serviceaccounts"))' | jq -r '"\(.roleRef.kind),\(.roleRef.name)"') + do + read kind name <<<$(IFS=","; echo $result) + resource_count=$(kubectl get $kind $name -n $ns -o json | jq -r '.rules[] | select(.resources[] != "podsecuritypolicies")' | wc -l) + if [[ ${resource_count} -gt 0 ]]; then + echo "false" + exit + fi + done +done + + +echo "true" +``` + +**Audit Execution:** + +```bash +./check_for_default_sa.sh +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) + + +**Result:** warn + +**Remediation:** +Modify the definition of pods and service accounts which do not need to mount service +account tokens to disable it. + +## 5.2 Pod Security Policies +### 5.2.1 Minimize the admission of privileged containers (Manual) + + +**Result:** warn + +**Remediation:** +Create a PSP as described in the Kubernetes documentation, ensuring that +the .spec.privileged field is omitted or set to false. + +### 5.2.2 Minimize the admission of containers wishing to share the host process ID namespace (Automated) + + +**Result:** pass + +**Remediation:** +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.hostPID field is omitted or set to false. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or (.spec.hostPID == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +1 is greater than 0 +``` + +**Returned Value**: + +```console +--count=1 +``` + +### 5.2.3 Minimize the admission of containers wishing to share the host IPC namespace (Automated) + + +**Result:** pass + +**Remediation:** +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.hostIPC field is omitted or set to false. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostIPC == null) or (.spec.hostIPC == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +1 is greater than 0 +``` + +**Returned Value**: + +```console +--count=1 +``` + +### 5.2.4 Minimize the admission of containers wishing to share the host network namespace (Automated) + + +**Result:** pass + +**Remediation:** +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.hostNetwork field is omitted or set to false. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostNetwork == null) or (.spec.hostNetwork == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +1 is greater than 0 +``` + +**Returned Value**: + +```console +--count=1 +``` + +### 5.2.5 Minimize the admission of containers with allowPrivilegeEscalation (Automated) + + +**Result:** pass + +**Remediation:** +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.allowPrivilegeEscalation field is omitted or set to false. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +1 is greater than 0 +``` + +**Returned Value**: + +```console +--count=1 +``` + +### 5.2.6 Minimize the admission of root containers (Manual) + + +**Result:** warn + +**Remediation:** +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.runAsUser.rule is set to either MustRunAsNonRoot or MustRunAs with the range of +UIDs not including 0. + +### 5.2.7 Minimize the admission of containers with the NET_RAW capability (Manual) + + +**Result:** warn + +**Remediation:** +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.requiredDropCapabilities is set to include either NET_RAW or ALL. + +### 5.2.8 Minimize the admission of containers with added capabilities (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that allowedCapabilities is not present in PSPs for the cluster unless +it is set to an empty array. + +### 5.2.9 Minimize the admission of containers with capabilities assigned (Manual) + + +**Result:** warn + +**Remediation:** +Review the use of capabilites in applications runnning on your cluster. Where a namespace +contains applicaions which do not require any Linux capabities to operate consider adding +a PSP which forbids the admission of containers which do not drop all capabilities. + +## 5.3 Network Policies and CNI +### 5.3.1 Ensure that the CNI in use supports Network Policies (Manual) + + +**Result:** warn + +**Remediation:** +If the CNI plugin in use does not support network policies, consideration should be given to +making use of a different plugin, or finding an alternate mechanism for restricting traffic +in the Kubernetes cluster. + +### 5.3.2 Ensure that all Namespaces have Network Policies defined (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create NetworkPolicy objects as you need them. + +**Audit Script:** `check_for_network_policies.sh` + +```bash +#!/bin/bash + +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + +for namespace in $(kubectl get namespaces --all-namespaces -o json | jq -r '.items[].metadata.name'); do + policy_count=$(kubectl get networkpolicy -n ${namespace} -o json | jq '.items | length') + if [[ ${policy_count} -eq 0 ]]; then + echo "false" + exit + fi +done + +echo "true" + +``` + +**Audit Execution:** + +```bash +./check_for_network_policies.sh +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +## 5.4 Secrets Management +### 5.4.1 Prefer using secrets as files over secrets as environment variables (Manual) + + +**Result:** warn + +**Remediation:** +if possible, rewrite application code to read secrets from mounted secret files, rather than +from environment variables. + +### 5.4.2 Consider external secret storage (Manual) + + +**Result:** warn + +**Remediation:** +Refer to the secrets management options offered by your cloud provider or a third-party +secrets management solution. + +## 5.5 Extensible Admission Control +### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and setup image provenance. + +## 5.7 General Policies +### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) + + +**Result:** warn + +**Remediation:** +Follow the documentation and create namespaces for objects in your deployment as you need +them. + +### 5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions (Manual) + + +**Result:** warn + +**Remediation:** +Seccomp is an alpha feature currently. By default, all alpha features are disabled. So, you +would need to enable alpha features in the apiserver by passing "--feature- +gates=AllAlpha=true" argument. +Edit the /etc/kubernetes/apiserver file on the master node and set the KUBE_API_ARGS +parameter to "--feature-gates=AllAlpha=true" +KUBE_API_ARGS="--feature-gates=AllAlpha=true" +Based on your system, restart the kube-apiserver service. For example: +systemctl restart kube-apiserver.service +Use annotations to enable the docker/default seccomp profile in your pod definitions. An +example is as below: +apiVersion: v1 +kind: Pod +metadata: + name: trustworthy-pod + annotations: + seccomp.security.alpha.kubernetes.io/pod: docker/default +spec: + containers: + - name: trustworthy-container + image: sotrustworthy:latest + +### 5.7.3 Apply Security Context to Your Pods and Containers (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and apply security contexts to your pods. For a +suggested list of security contexts, you may refer to the CIS Security Benchmark for Docker +Containers. + +### 5.7.4 The default namespace should not be used (Automated) + + +**Result:** pass + +**Remediation:** +Ensure that namespaces are created to allow for appropriate segregation of Kubernetes +resources and that all new resources are created in a specific namespace. + +**Audit Script:** `check_for_default_ns.sh` + +```bash +#!/bin/bash + +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + +count=$(kubectl get all -n default -o json | jq .items[] | jq -r 'select((.metadata.name!="kubernetes"))' | jq .metadata.name | wc -l) +if [[ ${count} -gt 0 ]]; then + echo "false" + exit +fi + +echo "true" + + +``` + +**Audit Execution:** + +```bash +./check_for_default_ns.sh +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf new file mode 100644 index 00000000000..5a5582ede24 --- /dev/null +++ b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf @@ -0,0 +1,7954 @@ +%PDF-1.7 +%🖤 +1 0 obj +<< +/Type /Pages +/Kids [ 6 0 R 8 0 R 27 0 R 32 0 R 41 0 R 58 0 R 75 0 R 90 0 R 129 0 R 165 0 R 202 0 R 237 0 R 277 0 R 317 0 R 357 0 R 391 0 R 430 0 R 470 0 R 510 0 R 534 0 R 568 0 R ] +/Count 21 +>> +endobj +2 0 obj +<< +/Title (Hardening Guide with CIS v1.6 Benchmark) +/Creator (pandoc) +/Producer (WeasyPrint 54.0) +>> +endobj +3 0 obj +<< +/Type /Catalog +/Pages 1 0 R +/Outlines 586 0 R +/Names << +/Dests << +/Names [ (TOC) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (cb1) [ 32 0 R /XYZ 84.259843 592.520079 0 ] (cb1-1) [ 32 0 R /XYZ 101.433071 590.823057 0 ] (cb1-2) [ 32 0 R /XYZ 99.933071 571.876036 0 ] (cb1-3) [ 32 0 R /XYZ 99.933071 552.929014 0 ] (cb1-4) [ 32 0 R /XYZ 99.933071 533.981993 0 ] (cb1-5) [ 32 0 R /XYZ 99.933071 515.034971 0 ] (cb10) [ 391 0 R /XYZ 84.259843 799.370079 0 ] (cb10-1) [ 391 0 R /XYZ 101.433071 797.673057 0 ] (cb10-10) [ 391 0 R /XYZ 99.933071 627.149864 0 ] (cb10-100) [ 470 0 R /XYZ 99.933071 344.444542 0 ] (cb10-101) [ 470 0 R /XYZ 99.933071 325.497520 0 ] (cb10-102) [ 470 0 R /XYZ 99.933071 306.550499 0 ] (cb10-103) [ 470 0 R /XYZ 99.933071 287.603477 0 ] (cb10-104) [ 470 0 R /XYZ 99.933071 268.656456 0 ] (cb10-105) [ 470 0 R /XYZ 99.933071 249.709434 0 ] (cb10-106) [ 470 0 R /XYZ 99.933071 230.762413 0 ] (cb10-107) [ 470 0 R /XYZ 99.933071 211.815391 0 ] (cb10-108) [ 470 0 R /XYZ 99.933071 192.868370 0 ] (cb10-109) [ 470 0 R /XYZ 99.933071 173.921348 0 ] (cb10-11) [ 391 0 R /XYZ 99.933071 608.202842 0 ] (cb10-110) [ 470 0 R /XYZ 99.933071 154.974327 0 ] (cb10-111) [ 470 0 R /XYZ 99.933071 136.027305 0 ] (cb10-112) [ 470 0 R /XYZ 99.933071 117.080284 0 ] (cb10-113) [ 470 0 R /XYZ 99.933071 98.133262 0 ] (cb10-114) [ 510 0 R /XYZ 99.933071 799.173057 0 ] (cb10-115) [ 510 0 R /XYZ 99.933071 780.226036 0 ] (cb10-116) [ 510 0 R /XYZ 99.933071 761.279014 0 ] (cb10-117) [ 510 0 R /XYZ 99.933071 742.331993 0 ] (cb10-118) [ 510 0 R /XYZ 99.933071 628.649864 0 ] (cb10-119) [ 510 0 R /XYZ 99.933071 609.702842 0 ] (cb10-12) [ 391 0 R /XYZ 99.933071 589.255821 0 ] (cb10-120) [ 510 0 R /XYZ 99.933071 590.755821 0 ] (cb10-121) [ 510 0 R /XYZ 99.933071 571.808799 0 ] (cb10-122) [ 510 0 R /XYZ 99.933071 552.861778 0 ] (cb10-123) [ 510 0 R /XYZ 99.933071 533.914756 0 ] (cb10-124) [ 510 0 R /XYZ 99.933071 514.967735 0 ] (cb10-13) [ 391 0 R /XYZ 99.933071 570.308799 0 ] (cb10-14) [ 391 0 R /XYZ 99.933071 551.361778 0 ] (cb10-15) [ 391 0 R /XYZ 99.933071 532.414756 0 ] (cb10-16) [ 391 0 R /XYZ 99.933071 513.467735 0 ] (cb10-17) [ 391 0 R /XYZ 99.933071 494.520714 0 ] (cb10-18) [ 391 0 R /XYZ 99.933071 475.573692 0 ] (cb10-19) [ 391 0 R /XYZ 99.933071 456.626671 0 ] (cb10-2) [ 391 0 R /XYZ 99.933071 778.726036 0 ] (cb10-20) [ 391 0 R /XYZ 99.933071 437.679649 0 ] (cb10-21) [ 391 0 R /XYZ 99.933071 418.732628 0 ] (cb10-22) [ 391 0 R /XYZ 99.933071 399.785606 0 ] (cb10-23) [ 391 0 R /XYZ 99.933071 380.838585 0 ] (cb10-24) [ 391 0 R /XYZ 99.933071 361.891563 0 ] (cb10-25) [ 391 0 R /XYZ 99.933071 342.944542 0 ] (cb10-26) [ 391 0 R /XYZ 99.933071 323.997520 0 ] (cb10-27) [ 391 0 R /XYZ 99.933071 305.050499 0 ] (cb10-28) [ 391 0 R /XYZ 99.933071 286.103477 0 ] (cb10-29) [ 391 0 R /XYZ 99.933071 267.156456 0 ] (cb10-3) [ 391 0 R /XYZ 99.933071 759.779014 0 ] (cb10-30) [ 391 0 R /XYZ 99.933071 229.262413 0 ] (cb10-31) [ 391 0 R /XYZ 99.933071 210.315391 0 ] (cb10-32) [ 391 0 R /XYZ 99.933071 191.368370 0 ] (cb10-33) [ 391 0 R /XYZ 99.933071 172.421348 0 ] (cb10-34) [ 391 0 R /XYZ 99.933071 153.474327 0 ] (cb10-35) [ 391 0 R /XYZ 99.933071 134.527305 0 ] (cb10-36) [ 391 0 R /XYZ 99.933071 115.580284 0 ] (cb10-37) [ 391 0 R /XYZ 99.933071 96.633262 0 ] (cb10-38) [ 430 0 R /XYZ 99.933071 799.173057 0 ] (cb10-39) [ 430 0 R /XYZ 99.933071 780.226036 0 ] (cb10-4) [ 391 0 R /XYZ 99.933071 740.831993 0 ] (cb10-40) [ 430 0 R /XYZ 99.933071 761.279014 0 ] (cb10-41) [ 430 0 R /XYZ 99.933071 742.331993 0 ] (cb10-42) [ 430 0 R /XYZ 99.933071 723.384971 0 ] (cb10-43) [ 430 0 R /XYZ 99.933071 704.437950 0 ] (cb10-44) [ 430 0 R /XYZ 99.933071 685.490928 0 ] (cb10-45) [ 430 0 R /XYZ 99.933071 666.543907 0 ] (cb10-46) [ 430 0 R /XYZ 99.933071 647.596885 0 ] (cb10-47) [ 430 0 R /XYZ 99.933071 628.649864 0 ] (cb10-48) [ 430 0 R /XYZ 99.933071 609.702842 0 ] (cb10-49) [ 430 0 R /XYZ 99.933071 590.755821 0 ] (cb10-5) [ 391 0 R /XYZ 99.933071 721.884971 0 ] (cb10-50) [ 430 0 R /XYZ 99.933071 571.808799 0 ] (cb10-51) [ 430 0 R /XYZ 99.933071 552.861778 0 ] (cb10-52) [ 430 0 R /XYZ 99.933071 533.914756 0 ] (cb10-53) [ 430 0 R /XYZ 99.933071 514.967735 0 ] (cb10-54) [ 430 0 R /XYZ 99.933071 496.020714 0 ] (cb10-55) [ 430 0 R /XYZ 99.933071 477.073692 0 ] (cb10-56) [ 430 0 R /XYZ 99.933071 458.126671 0 ] (cb10-57) [ 430 0 R /XYZ 99.933071 439.179649 0 ] (cb10-58) [ 430 0 R /XYZ 99.933071 420.232628 0 ] (cb10-59) [ 430 0 R /XYZ 99.933071 401.285606 0 ] (cb10-6) [ 391 0 R /XYZ 99.933071 702.937950 0 ] (cb10-60) [ 430 0 R /XYZ 99.933071 382.338585 0 ] (cb10-61) [ 430 0 R /XYZ 99.933071 363.391563 0 ] (cb10-62) [ 430 0 R /XYZ 99.933071 344.444542 0 ] (cb10-63) [ 430 0 R /XYZ 99.933071 325.497520 0 ] (cb10-64) [ 430 0 R /XYZ 99.933071 306.550499 0 ] (cb10-65) [ 430 0 R /XYZ 99.933071 287.603477 0 ] (cb10-66) [ 430 0 R /XYZ 99.933071 268.656456 0 ] (cb10-67) [ 430 0 R /XYZ 99.933071 249.709434 0 ] (cb10-68) [ 430 0 R /XYZ 99.933071 230.762413 0 ] (cb10-69) [ 430 0 R /XYZ 99.933071 211.815391 0 ] (cb10-7) [ 391 0 R /XYZ 99.933071 683.990928 0 ] (cb10-70) [ 430 0 R /XYZ 99.933071 192.868370 0 ] (cb10-71) [ 430 0 R /XYZ 99.933071 173.921348 0 ] (cb10-72) [ 430 0 R /XYZ 99.933071 154.974327 0 ] (cb10-73) [ 430 0 R /XYZ 99.933071 136.027305 0 ] (cb10-74) [ 430 0 R /XYZ 99.933071 117.080284 0 ] (cb10-75) [ 430 0 R /XYZ 99.933071 98.133262 0 ] (cb10-76) [ 470 0 R /XYZ 99.933071 799.173057 0 ] (cb10-77) [ 470 0 R /XYZ 99.933071 780.226036 0 ] (cb10-78) [ 470 0 R /XYZ 99.933071 761.279014 0 ] (cb10-79) [ 470 0 R /XYZ 99.933071 742.331993 0 ] (cb10-8) [ 391 0 R /XYZ 99.933071 665.043907 0 ] (cb10-80) [ 470 0 R /XYZ 99.933071 723.384971 0 ] (cb10-81) [ 470 0 R /XYZ 99.933071 704.437950 0 ] (cb10-82) [ 470 0 R /XYZ 99.933071 685.490928 0 ] (cb10-83) [ 470 0 R /XYZ 99.933071 666.543907 0 ] (cb10-84) [ 470 0 R /XYZ 99.933071 647.596885 0 ] (cb10-85) [ 470 0 R /XYZ 99.933071 628.649864 0 ] (cb10-86) [ 470 0 R /XYZ 99.933071 609.702842 0 ] (cb10-87) [ 470 0 R /XYZ 99.933071 590.755821 0 ] (cb10-88) [ 470 0 R /XYZ 99.933071 571.808799 0 ] (cb10-89) [ 470 0 R /XYZ 99.933071 552.861778 0 ] (cb10-9) [ 391 0 R /XYZ 99.933071 646.096885 0 ] (cb10-90) [ 470 0 R /XYZ 99.933071 533.914756 0 ] (cb10-91) [ 470 0 R /XYZ 99.933071 514.967735 0 ] (cb10-92) [ 470 0 R /XYZ 99.933071 496.020714 0 ] (cb10-93) [ 470 0 R /XYZ 99.933071 477.073692 0 ] (cb10-94) [ 470 0 R /XYZ 99.933071 458.126671 0 ] (cb10-95) [ 470 0 R /XYZ 99.933071 439.179649 0 ] (cb10-96) [ 470 0 R /XYZ 99.933071 420.232628 0 ] (cb10-97) [ 470 0 R /XYZ 99.933071 401.285606 0 ] (cb10-98) [ 470 0 R /XYZ 99.933071 382.338585 0 ] (cb10-99) [ 470 0 R /XYZ 99.933071 363.391563 0 ] (cb11) [ 510 0 R /XYZ 84.259843 284.621735 0 ] (cb11-1) [ 510 0 R /XYZ 101.433071 282.924714 0 ] (cb11-10) [ 510 0 R /XYZ 99.933071 112.401520 0 ] (cb11-11) [ 510 0 R /XYZ 99.933071 93.454499 0 ] (cb11-12) [ 534 0 R /XYZ 99.933071 799.173057 0 ] (cb11-13) [ 534 0 R /XYZ 99.933071 780.226036 0 ] (cb11-14) [ 534 0 R /XYZ 99.933071 761.279014 0 ] (cb11-15) [ 534 0 R /XYZ 99.933071 742.331993 0 ] (cb11-16) [ 534 0 R /XYZ 99.933071 723.384971 0 ] (cb11-17) [ 534 0 R /XYZ 99.933071 704.437950 0 ] (cb11-18) [ 534 0 R /XYZ 99.933071 685.490928 0 ] (cb11-19) [ 534 0 R /XYZ 99.933071 666.543907 0 ] (cb11-2) [ 510 0 R /XYZ 99.933071 263.977692 0 ] (cb11-20) [ 534 0 R /XYZ 99.933071 647.596885 0 ] (cb11-21) [ 534 0 R /XYZ 99.933071 628.649864 0 ] (cb11-22) [ 534 0 R /XYZ 99.933071 609.702842 0 ] (cb11-23) [ 534 0 R /XYZ 99.933071 590.755821 0 ] (cb11-24) [ 534 0 R /XYZ 99.933071 571.808799 0 ] (cb11-25) [ 534 0 R /XYZ 99.933071 552.861778 0 ] (cb11-3) [ 510 0 R /XYZ 99.933071 245.030671 0 ] (cb11-4) [ 510 0 R /XYZ 99.933071 226.083649 0 ] (cb11-5) [ 510 0 R /XYZ 99.933071 207.136628 0 ] (cb11-6) [ 510 0 R /XYZ 99.933071 188.189606 0 ] (cb11-7) [ 510 0 R /XYZ 99.933071 169.242585 0 ] (cb11-8) [ 510 0 R /XYZ 99.933071 150.295563 0 ] (cb11-9) [ 510 0 R /XYZ 99.933071 131.348542 0 ] (cb12) [ 534 0 R /XYZ 84.259843 449.668756 0 ] (cb12-1) [ 534 0 R /XYZ 101.433071 447.971735 0 ] (cb12-10) [ 534 0 R /XYZ 99.933071 277.448542 0 ] (cb12-11) [ 534 0 R /XYZ 99.933071 258.501520 0 ] (cb12-12) [ 534 0 R /XYZ 99.933071 239.554499 0 ] (cb12-13) [ 534 0 R /XYZ 99.933071 220.607477 0 ] (cb12-14) [ 534 0 R /XYZ 99.933071 201.660456 0 ] (cb12-15) [ 534 0 R /XYZ 99.933071 182.713434 0 ] (cb12-16) [ 534 0 R /XYZ 99.933071 163.766413 0 ] (cb12-17) [ 534 0 R /XYZ 99.933071 144.819391 0 ] (cb12-18) [ 534 0 R /XYZ 99.933071 125.872370 0 ] (cb12-19) [ 568 0 R /XYZ 99.933071 799.173057 0 ] (cb12-2) [ 534 0 R /XYZ 99.933071 429.024714 0 ] (cb12-20) [ 568 0 R /XYZ 99.933071 761.279014 0 ] (cb12-21) [ 568 0 R /XYZ 99.933071 742.331993 0 ] (cb12-22) [ 568 0 R /XYZ 99.933071 723.384971 0 ] (cb12-3) [ 534 0 R /XYZ 99.933071 410.077692 0 ] (cb12-4) [ 534 0 R /XYZ 99.933071 391.130671 0 ] (cb12-5) [ 534 0 R /XYZ 99.933071 372.183649 0 ] (cb12-6) [ 534 0 R /XYZ 99.933071 353.236628 0 ] (cb12-7) [ 534 0 R /XYZ 99.933071 334.289606 0 ] (cb12-8) [ 534 0 R /XYZ 99.933071 315.342585 0 ] (cb12-9) [ 534 0 R /XYZ 99.933071 296.395563 0 ] (cb2) [ 32 0 R /XYZ 84.259843 177.438971 0 ] (cb2-1) [ 32 0 R /XYZ 101.433071 175.741950 0 ] (cb2-2) [ 32 0 R /XYZ 99.933071 156.794928 0 ] (cb3) [ 41 0 R /XYZ 84.259843 799.370079 0 ] (cb3-1) [ 41 0 R /XYZ 101.433071 797.673057 0 ] (cb3-2) [ 41 0 R /XYZ 99.933071 778.726036 0 ] (cb3-3) [ 41 0 R /XYZ 99.933071 759.779014 0 ] (cb3-4) [ 41 0 R /XYZ 99.933071 740.831993 0 ] (cb4) [ 41 0 R /XYZ 84.259843 460.085993 0 ] (cb4-1) [ 41 0 R /XYZ 101.433071 458.388971 0 ] (cb5) [ 41 0 R /XYZ 84.259843 395.388971 0 ] (cb5-1) [ 41 0 R /XYZ 101.433071 393.691950 0 ] (cb5-2) [ 41 0 R /XYZ 99.933071 374.744928 0 ] (cb5-3) [ 41 0 R /XYZ 99.933071 355.797907 0 ] (cb5-4) [ 41 0 R /XYZ 99.933071 336.850885 0 ] (cb5-5) [ 41 0 R /XYZ 99.933071 317.903864 0 ] (cb6) [ 41 0 R /XYZ 84.259843 236.153864 0 ] (cb6-1) [ 41 0 R /XYZ 101.433071 234.456842 0 ] (cb6-2) [ 41 0 R /XYZ 99.933071 215.509821 0 ] (cb6-3) [ 41 0 R /XYZ 99.933071 196.562799 0 ] (cb6-4) [ 41 0 R /XYZ 99.933071 158.668756 0 ] (cb6-5) [ 41 0 R /XYZ 99.933071 120.774714 0 ] (cb7) [ 58 0 R /XYZ 84.259843 300.231496 0 ] (cb7-1) [ 58 0 R /XYZ 101.433071 298.534475 0 ] (cb7-10) [ 58 0 R /XYZ 99.933071 128.011281 0 ] (cb7-11) [ 58 0 R /XYZ 99.933071 109.064260 0 ] (cb7-12) [ 58 0 R /XYZ 99.933071 90.117238 0 ] (cb7-13) [ 75 0 R /XYZ 99.933071 799.173057 0 ] (cb7-14) [ 75 0 R /XYZ 99.933071 780.226036 0 ] (cb7-2) [ 58 0 R /XYZ 99.933071 279.587453 0 ] (cb7-3) [ 58 0 R /XYZ 99.933071 260.640432 0 ] (cb7-4) [ 58 0 R /XYZ 99.933071 241.693410 0 ] (cb7-5) [ 58 0 R /XYZ 99.933071 222.746389 0 ] (cb7-6) [ 58 0 R /XYZ 99.933071 203.799367 0 ] (cb7-7) [ 58 0 R /XYZ 99.933071 184.852346 0 ] (cb7-8) [ 58 0 R /XYZ 99.933071 165.905324 0 ] (cb7-9) [ 58 0 R /XYZ 99.933071 146.958303 0 ] (cb8) [ 75 0 R /XYZ 84.259843 683.476036 0 ] (cb8-1) [ 75 0 R /XYZ 101.433071 681.779014 0 ] (cb8-2) [ 75 0 R /XYZ 99.933071 662.831993 0 ] (cb8-3) [ 75 0 R /XYZ 99.933071 643.884971 0 ] (cb8-4) [ 75 0 R /XYZ 99.933071 605.990928 0 ] (cb8-5) [ 75 0 R /XYZ 99.933071 587.043907 0 ] (cb9) [ 75 0 R /XYZ 84.259843 201.605324 0 ] (cb9-1) [ 75 0 R /XYZ 101.433071 199.908303 0 ] (cb9-10) [ 90 0 R /XYZ 99.933071 685.490928 0 ] (cb9-100) [ 165 0 R /XYZ 99.933071 325.497520 0 ] (cb9-101) [ 165 0 R /XYZ 99.933071 306.550499 0 ] (cb9-102) [ 165 0 R /XYZ 99.933071 287.603477 0 ] (cb9-103) [ 165 0 R /XYZ 99.933071 268.656456 0 ] (cb9-104) [ 165 0 R /XYZ 99.933071 249.709434 0 ] (cb9-105) [ 165 0 R /XYZ 99.933071 230.762413 0 ] (cb9-106) [ 165 0 R /XYZ 99.933071 211.815391 0 ] (cb9-107) [ 165 0 R /XYZ 99.933071 154.974327 0 ] (cb9-108) [ 165 0 R /XYZ 99.933071 136.027305 0 ] (cb9-109) [ 165 0 R /XYZ 99.933071 117.080284 0 ] (cb9-11) [ 90 0 R /XYZ 99.933071 666.543907 0 ] (cb9-110) [ 165 0 R /XYZ 99.933071 98.133262 0 ] (cb9-111) [ 202 0 R /XYZ 99.933071 799.173057 0 ] (cb9-112) [ 202 0 R /XYZ 99.933071 780.226036 0 ] (cb9-113) [ 202 0 R /XYZ 99.933071 742.331993 0 ] (cb9-114) [ 202 0 R /XYZ 99.933071 704.437950 0 ] (cb9-115) [ 202 0 R /XYZ 99.933071 666.543907 0 ] (cb9-116) [ 202 0 R /XYZ 99.933071 647.596885 0 ] (cb9-117) [ 202 0 R /XYZ 99.933071 628.649864 0 ] (cb9-118) [ 202 0 R /XYZ 99.933071 609.702842 0 ] (cb9-119) [ 202 0 R /XYZ 99.933071 590.755821 0 ] (cb9-12) [ 90 0 R /XYZ 99.933071 647.596885 0 ] (cb9-120) [ 202 0 R /XYZ 99.933071 571.808799 0 ] (cb9-121) [ 202 0 R /XYZ 99.933071 552.861778 0 ] (cb9-122) [ 202 0 R /XYZ 99.933071 533.914756 0 ] (cb9-123) [ 202 0 R /XYZ 99.933071 514.967735 0 ] (cb9-124) [ 202 0 R /XYZ 99.933071 496.020714 0 ] (cb9-125) [ 202 0 R /XYZ 99.933071 477.073692 0 ] (cb9-126) [ 202 0 R /XYZ 99.933071 458.126671 0 ] (cb9-127) [ 202 0 R /XYZ 99.933071 439.179649 0 ] (cb9-128) [ 202 0 R /XYZ 99.933071 420.232628 0 ] (cb9-129) [ 202 0 R /XYZ 99.933071 382.338585 0 ] (cb9-13) [ 90 0 R /XYZ 99.933071 628.649864 0 ] (cb9-130) [ 202 0 R /XYZ 99.933071 363.391563 0 ] (cb9-131) [ 202 0 R /XYZ 99.933071 344.444542 0 ] (cb9-132) [ 202 0 R /XYZ 99.933071 325.497520 0 ] (cb9-133) [ 202 0 R /XYZ 99.933071 306.550499 0 ] (cb9-134) [ 202 0 R /XYZ 99.933071 287.603477 0 ] (cb9-135) [ 202 0 R /XYZ 99.933071 268.656456 0 ] (cb9-136) [ 202 0 R /XYZ 99.933071 249.709434 0 ] (cb9-137) [ 202 0 R /XYZ 99.933071 230.762413 0 ] (cb9-138) [ 202 0 R /XYZ 99.933071 211.815391 0 ] (cb9-139) [ 202 0 R /XYZ 99.933071 192.868370 0 ] (cb9-14) [ 90 0 R /XYZ 99.933071 609.702842 0 ] (cb9-140) [ 202 0 R /XYZ 99.933071 154.974327 0 ] (cb9-141) [ 202 0 R /XYZ 99.933071 136.027305 0 ] (cb9-142) [ 202 0 R /XYZ 99.933071 117.080284 0 ] (cb9-143) [ 202 0 R /XYZ 99.933071 98.133262 0 ] (cb9-144) [ 237 0 R /XYZ 99.933071 799.173057 0 ] (cb9-145) [ 237 0 R /XYZ 99.933071 780.226036 0 ] (cb9-146) [ 237 0 R /XYZ 99.933071 761.279014 0 ] (cb9-147) [ 237 0 R /XYZ 99.933071 742.331993 0 ] (cb9-148) [ 237 0 R /XYZ 99.933071 723.384971 0 ] (cb9-149) [ 237 0 R /XYZ 99.933071 704.437950 0 ] (cb9-15) [ 90 0 R /XYZ 99.933071 590.755821 0 ] (cb9-150) [ 237 0 R /XYZ 99.933071 685.490928 0 ] (cb9-151) [ 237 0 R /XYZ 99.933071 666.543907 0 ] (cb9-152) [ 237 0 R /XYZ 99.933071 647.596885 0 ] (cb9-153) [ 237 0 R /XYZ 99.933071 628.649864 0 ] (cb9-154) [ 237 0 R /XYZ 99.933071 609.702842 0 ] (cb9-155) [ 237 0 R /XYZ 99.933071 590.755821 0 ] (cb9-156) [ 237 0 R /XYZ 99.933071 571.808799 0 ] (cb9-157) [ 237 0 R /XYZ 99.933071 552.861778 0 ] (cb9-158) [ 237 0 R /XYZ 99.933071 533.914756 0 ] (cb9-159) [ 237 0 R /XYZ 99.933071 514.967735 0 ] (cb9-16) [ 90 0 R /XYZ 99.933071 571.808799 0 ] (cb9-160) [ 237 0 R /XYZ 99.933071 496.020714 0 ] (cb9-161) [ 237 0 R /XYZ 99.933071 477.073692 0 ] (cb9-162) [ 237 0 R /XYZ 99.933071 458.126671 0 ] (cb9-163) [ 237 0 R /XYZ 99.933071 439.179649 0 ] (cb9-164) [ 237 0 R /XYZ 99.933071 420.232628 0 ] (cb9-165) [ 237 0 R /XYZ 99.933071 401.285606 0 ] (cb9-166) [ 237 0 R /XYZ 99.933071 382.338585 0 ] (cb9-167) [ 237 0 R /XYZ 99.933071 363.391563 0 ] (cb9-168) [ 237 0 R /XYZ 99.933071 344.444542 0 ] (cb9-169) [ 237 0 R /XYZ 99.933071 325.497520 0 ] (cb9-17) [ 90 0 R /XYZ 99.933071 552.861778 0 ] (cb9-170) [ 237 0 R /XYZ 99.933071 306.550499 0 ] (cb9-171) [ 237 0 R /XYZ 99.933071 287.603477 0 ] (cb9-172) [ 237 0 R /XYZ 99.933071 268.656456 0 ] (cb9-173) [ 237 0 R /XYZ 99.933071 249.709434 0 ] (cb9-174) [ 237 0 R /XYZ 99.933071 230.762413 0 ] (cb9-175) [ 237 0 R /XYZ 99.933071 211.815391 0 ] (cb9-176) [ 237 0 R /XYZ 99.933071 192.868370 0 ] (cb9-177) [ 237 0 R /XYZ 99.933071 173.921348 0 ] (cb9-178) [ 237 0 R /XYZ 99.933071 154.974327 0 ] (cb9-179) [ 237 0 R /XYZ 99.933071 136.027305 0 ] (cb9-18) [ 90 0 R /XYZ 99.933071 533.914756 0 ] (cb9-180) [ 237 0 R /XYZ 99.933071 117.080284 0 ] (cb9-181) [ 237 0 R /XYZ 99.933071 98.133262 0 ] (cb9-182) [ 277 0 R /XYZ 99.933071 799.173057 0 ] (cb9-183) [ 277 0 R /XYZ 99.933071 780.226036 0 ] (cb9-184) [ 277 0 R /XYZ 99.933071 761.279014 0 ] (cb9-185) [ 277 0 R /XYZ 99.933071 742.331993 0 ] (cb9-186) [ 277 0 R /XYZ 99.933071 723.384971 0 ] (cb9-187) [ 277 0 R /XYZ 99.933071 704.437950 0 ] (cb9-188) [ 277 0 R /XYZ 99.933071 685.490928 0 ] (cb9-189) [ 277 0 R /XYZ 99.933071 666.543907 0 ] (cb9-19) [ 90 0 R /XYZ 99.933071 514.967735 0 ] (cb9-190) [ 277 0 R /XYZ 99.933071 647.596885 0 ] (cb9-191) [ 277 0 R /XYZ 99.933071 628.649864 0 ] (cb9-192) [ 277 0 R /XYZ 99.933071 609.702842 0 ] (cb9-193) [ 277 0 R /XYZ 99.933071 590.755821 0 ] (cb9-194) [ 277 0 R /XYZ 99.933071 571.808799 0 ] (cb9-195) [ 277 0 R /XYZ 99.933071 552.861778 0 ] (cb9-196) [ 277 0 R /XYZ 99.933071 533.914756 0 ] (cb9-197) [ 277 0 R /XYZ 99.933071 514.967735 0 ] (cb9-198) [ 277 0 R /XYZ 99.933071 496.020714 0 ] (cb9-199) [ 277 0 R /XYZ 99.933071 477.073692 0 ] (cb9-2) [ 75 0 R /XYZ 99.933071 162.014260 0 ] (cb9-20) [ 90 0 R /XYZ 99.933071 496.020714 0 ] (cb9-200) [ 277 0 R /XYZ 99.933071 458.126671 0 ] (cb9-201) [ 277 0 R /XYZ 99.933071 439.179649 0 ] (cb9-202) [ 277 0 R /XYZ 99.933071 420.232628 0 ] (cb9-203) [ 277 0 R /XYZ 99.933071 401.285606 0 ] (cb9-204) [ 277 0 R /XYZ 99.933071 382.338585 0 ] (cb9-205) [ 277 0 R /XYZ 99.933071 363.391563 0 ] (cb9-206) [ 277 0 R /XYZ 99.933071 344.444542 0 ] (cb9-207) [ 277 0 R /XYZ 99.933071 325.497520 0 ] (cb9-208) [ 277 0 R /XYZ 99.933071 306.550499 0 ] (cb9-209) [ 277 0 R /XYZ 99.933071 287.603477 0 ] (cb9-21) [ 90 0 R /XYZ 99.933071 477.073692 0 ] (cb9-210) [ 277 0 R /XYZ 99.933071 268.656456 0 ] (cb9-211) [ 277 0 R /XYZ 99.933071 249.709434 0 ] (cb9-212) [ 277 0 R /XYZ 99.933071 230.762413 0 ] (cb9-213) [ 277 0 R /XYZ 99.933071 211.815391 0 ] (cb9-214) [ 277 0 R /XYZ 99.933071 192.868370 0 ] (cb9-215) [ 277 0 R /XYZ 99.933071 173.921348 0 ] (cb9-216) [ 277 0 R /XYZ 99.933071 154.974327 0 ] (cb9-217) [ 277 0 R /XYZ 99.933071 136.027305 0 ] (cb9-218) [ 277 0 R /XYZ 99.933071 117.080284 0 ] (cb9-219) [ 277 0 R /XYZ 99.933071 98.133262 0 ] (cb9-22) [ 90 0 R /XYZ 99.933071 458.126671 0 ] (cb9-220) [ 317 0 R /XYZ 99.933071 799.173057 0 ] (cb9-221) [ 317 0 R /XYZ 99.933071 780.226036 0 ] (cb9-222) [ 317 0 R /XYZ 99.933071 761.279014 0 ] (cb9-223) [ 317 0 R /XYZ 99.933071 742.331993 0 ] (cb9-224) [ 317 0 R /XYZ 99.933071 723.384971 0 ] (cb9-225) [ 317 0 R /XYZ 99.933071 704.437950 0 ] (cb9-226) [ 317 0 R /XYZ 99.933071 685.490928 0 ] (cb9-227) [ 317 0 R /XYZ 99.933071 666.543907 0 ] (cb9-228) [ 317 0 R /XYZ 99.933071 647.596885 0 ] (cb9-229) [ 317 0 R /XYZ 99.933071 628.649864 0 ] (cb9-23) [ 90 0 R /XYZ 99.933071 439.179649 0 ] (cb9-230) [ 317 0 R /XYZ 99.933071 609.702842 0 ] (cb9-231) [ 317 0 R /XYZ 99.933071 590.755821 0 ] (cb9-232) [ 317 0 R /XYZ 99.933071 571.808799 0 ] (cb9-233) [ 317 0 R /XYZ 99.933071 552.861778 0 ] (cb9-234) [ 317 0 R /XYZ 99.933071 533.914756 0 ] (cb9-235) [ 317 0 R /XYZ 99.933071 514.967735 0 ] (cb9-236) [ 317 0 R /XYZ 99.933071 496.020714 0 ] (cb9-237) [ 317 0 R /XYZ 99.933071 477.073692 0 ] (cb9-238) [ 317 0 R /XYZ 99.933071 458.126671 0 ] (cb9-239) [ 317 0 R /XYZ 99.933071 439.179649 0 ] (cb9-24) [ 90 0 R /XYZ 99.933071 420.232628 0 ] (cb9-240) [ 317 0 R /XYZ 99.933071 420.232628 0 ] (cb9-241) [ 317 0 R /XYZ 99.933071 401.285606 0 ] (cb9-242) [ 317 0 R /XYZ 99.933071 382.338585 0 ] (cb9-243) [ 317 0 R /XYZ 99.933071 363.391563 0 ] (cb9-244) [ 317 0 R /XYZ 99.933071 344.444542 0 ] (cb9-245) [ 317 0 R /XYZ 99.933071 325.497520 0 ] (cb9-246) [ 317 0 R /XYZ 99.933071 306.550499 0 ] (cb9-247) [ 317 0 R /XYZ 99.933071 287.603477 0 ] (cb9-248) [ 317 0 R /XYZ 99.933071 268.656456 0 ] (cb9-249) [ 317 0 R /XYZ 99.933071 249.709434 0 ] (cb9-25) [ 90 0 R /XYZ 99.933071 401.285606 0 ] (cb9-250) [ 317 0 R /XYZ 99.933071 230.762413 0 ] (cb9-251) [ 317 0 R /XYZ 99.933071 211.815391 0 ] (cb9-252) [ 317 0 R /XYZ 99.933071 192.868370 0 ] (cb9-253) [ 317 0 R /XYZ 99.933071 173.921348 0 ] (cb9-254) [ 317 0 R /XYZ 99.933071 154.974327 0 ] (cb9-255) [ 317 0 R /XYZ 99.933071 136.027305 0 ] (cb9-256) [ 317 0 R /XYZ 99.933071 117.080284 0 ] (cb9-257) [ 317 0 R /XYZ 99.933071 98.133262 0 ] (cb9-258) [ 357 0 R /XYZ 99.933071 799.173057 0 ] (cb9-259) [ 357 0 R /XYZ 99.933071 780.226036 0 ] (cb9-26) [ 90 0 R /XYZ 99.933071 382.338585 0 ] (cb9-260) [ 357 0 R /XYZ 99.933071 761.279014 0 ] (cb9-261) [ 357 0 R /XYZ 99.933071 742.331993 0 ] (cb9-262) [ 357 0 R /XYZ 99.933071 723.384971 0 ] (cb9-263) [ 357 0 R /XYZ 99.933071 704.437950 0 ] (cb9-264) [ 357 0 R /XYZ 99.933071 685.490928 0 ] (cb9-265) [ 357 0 R /XYZ 99.933071 666.543907 0 ] (cb9-266) [ 357 0 R /XYZ 99.933071 647.596885 0 ] (cb9-267) [ 357 0 R /XYZ 99.933071 628.649864 0 ] (cb9-268) [ 357 0 R /XYZ 99.933071 609.702842 0 ] (cb9-269) [ 357 0 R /XYZ 99.933071 590.755821 0 ] (cb9-27) [ 90 0 R /XYZ 99.933071 363.391563 0 ] (cb9-270) [ 357 0 R /XYZ 99.933071 571.808799 0 ] (cb9-271) [ 357 0 R /XYZ 99.933071 552.861778 0 ] (cb9-272) [ 357 0 R /XYZ 99.933071 533.914756 0 ] (cb9-273) [ 357 0 R /XYZ 99.933071 514.967735 0 ] (cb9-274) [ 357 0 R /XYZ 99.933071 496.020714 0 ] (cb9-275) [ 357 0 R /XYZ 99.933071 477.073692 0 ] (cb9-276) [ 357 0 R /XYZ 99.933071 458.126671 0 ] (cb9-277) [ 357 0 R /XYZ 99.933071 439.179649 0 ] (cb9-278) [ 357 0 R /XYZ 99.933071 420.232628 0 ] (cb9-279) [ 357 0 R /XYZ 99.933071 401.285606 0 ] (cb9-28) [ 90 0 R /XYZ 99.933071 344.444542 0 ] (cb9-280) [ 357 0 R /XYZ 99.933071 382.338585 0 ] (cb9-281) [ 357 0 R /XYZ 99.933071 363.391563 0 ] (cb9-282) [ 357 0 R /XYZ 99.933071 344.444542 0 ] (cb9-283) [ 357 0 R /XYZ 99.933071 325.497520 0 ] (cb9-284) [ 357 0 R /XYZ 99.933071 306.550499 0 ] (cb9-285) [ 357 0 R /XYZ 99.933071 287.603477 0 ] (cb9-286) [ 357 0 R /XYZ 99.933071 268.656456 0 ] (cb9-287) [ 357 0 R /XYZ 99.933071 249.709434 0 ] (cb9-288) [ 357 0 R /XYZ 99.933071 230.762413 0 ] (cb9-29) [ 90 0 R /XYZ 99.933071 325.497520 0 ] (cb9-3) [ 75 0 R /XYZ 99.933071 124.120217 0 ] (cb9-30) [ 90 0 R /XYZ 99.933071 306.550499 0 ] (cb9-31) [ 90 0 R /XYZ 99.933071 287.603477 0 ] (cb9-32) [ 90 0 R /XYZ 99.933071 268.656456 0 ] (cb9-33) [ 90 0 R /XYZ 99.933071 249.709434 0 ] (cb9-34) [ 90 0 R /XYZ 99.933071 230.762413 0 ] (cb9-35) [ 90 0 R /XYZ 99.933071 211.815391 0 ] (cb9-36) [ 90 0 R /XYZ 99.933071 192.868370 0 ] (cb9-37) [ 90 0 R /XYZ 99.933071 173.921348 0 ] (cb9-38) [ 90 0 R /XYZ 99.933071 154.974327 0 ] (cb9-39) [ 90 0 R /XYZ 99.933071 136.027305 0 ] (cb9-4) [ 75 0 R /XYZ 99.933071 105.173195 0 ] (cb9-40) [ 90 0 R /XYZ 99.933071 117.080284 0 ] (cb9-41) [ 90 0 R /XYZ 99.933071 98.133262 0 ] (cb9-42) [ 129 0 R /XYZ 99.933071 799.173057 0 ] (cb9-43) [ 129 0 R /XYZ 99.933071 780.226036 0 ] (cb9-44) [ 129 0 R /XYZ 99.933071 761.279014 0 ] (cb9-45) [ 129 0 R /XYZ 99.933071 742.331993 0 ] (cb9-46) [ 129 0 R /XYZ 99.933071 723.384971 0 ] (cb9-47) [ 129 0 R /XYZ 99.933071 704.437950 0 ] (cb9-48) [ 129 0 R /XYZ 99.933071 685.490928 0 ] (cb9-49) [ 129 0 R /XYZ 99.933071 666.543907 0 ] (cb9-5) [ 90 0 R /XYZ 99.933071 799.173057 0 ] (cb9-50) [ 129 0 R /XYZ 99.933071 647.596885 0 ] (cb9-51) [ 129 0 R /XYZ 99.933071 628.649864 0 ] (cb9-52) [ 129 0 R /XYZ 99.933071 609.702842 0 ] (cb9-53) [ 129 0 R /XYZ 99.933071 590.755821 0 ] (cb9-54) [ 129 0 R /XYZ 99.933071 571.808799 0 ] (cb9-55) [ 129 0 R /XYZ 99.933071 552.861778 0 ] (cb9-56) [ 129 0 R /XYZ 99.933071 533.914756 0 ] (cb9-57) [ 129 0 R /XYZ 99.933071 514.967735 0 ] (cb9-58) [ 129 0 R /XYZ 99.933071 496.020714 0 ] (cb9-59) [ 129 0 R /XYZ 99.933071 477.073692 0 ] (cb9-6) [ 90 0 R /XYZ 99.933071 761.279014 0 ] (cb9-60) [ 129 0 R /XYZ 99.933071 458.126671 0 ] (cb9-61) [ 129 0 R /XYZ 99.933071 439.179649 0 ] (cb9-62) [ 129 0 R /XYZ 99.933071 420.232628 0 ] (cb9-63) [ 129 0 R /XYZ 99.933071 401.285606 0 ] (cb9-64) [ 129 0 R /XYZ 99.933071 382.338585 0 ] (cb9-65) [ 129 0 R /XYZ 99.933071 363.391563 0 ] (cb9-66) [ 129 0 R /XYZ 99.933071 344.444542 0 ] (cb9-67) [ 129 0 R /XYZ 99.933071 325.497520 0 ] (cb9-68) [ 129 0 R /XYZ 99.933071 306.550499 0 ] (cb9-69) [ 129 0 R /XYZ 99.933071 287.603477 0 ] (cb9-7) [ 90 0 R /XYZ 99.933071 742.331993 0 ] (cb9-70) [ 129 0 R /XYZ 99.933071 268.656456 0 ] (cb9-71) [ 129 0 R /XYZ 99.933071 249.709434 0 ] (cb9-72) [ 129 0 R /XYZ 99.933071 230.762413 0 ] (cb9-73) [ 129 0 R /XYZ 99.933071 211.815391 0 ] (cb9-74) [ 129 0 R /XYZ 99.933071 192.868370 0 ] (cb9-75) [ 129 0 R /XYZ 99.933071 173.921348 0 ] (cb9-76) [ 165 0 R /XYZ 99.933071 780.226036 0 ] (cb9-77) [ 165 0 R /XYZ 99.933071 761.279014 0 ] (cb9-78) [ 165 0 R /XYZ 99.933071 742.331993 0 ] (cb9-79) [ 165 0 R /XYZ 99.933071 723.384971 0 ] (cb9-8) [ 90 0 R /XYZ 99.933071 723.384971 0 ] (cb9-80) [ 165 0 R /XYZ 99.933071 704.437950 0 ] (cb9-81) [ 165 0 R /XYZ 99.933071 685.490928 0 ] (cb9-82) [ 165 0 R /XYZ 99.933071 666.543907 0 ] (cb9-83) [ 165 0 R /XYZ 99.933071 647.596885 0 ] (cb9-84) [ 165 0 R /XYZ 99.933071 628.649864 0 ] (cb9-85) [ 165 0 R /XYZ 99.933071 609.702842 0 ] (cb9-86) [ 165 0 R /XYZ 99.933071 590.755821 0 ] (cb9-87) [ 165 0 R /XYZ 99.933071 571.808799 0 ] (cb9-88) [ 165 0 R /XYZ 99.933071 552.861778 0 ] (cb9-89) [ 165 0 R /XYZ 99.933071 533.914756 0 ] (cb9-9) [ 90 0 R /XYZ 99.933071 704.437950 0 ] (cb9-90) [ 165 0 R /XYZ 99.933071 514.967735 0 ] (cb9-91) [ 165 0 R /XYZ 99.933071 496.020714 0 ] (cb9-92) [ 165 0 R /XYZ 99.933071 477.073692 0 ] (cb9-93) [ 165 0 R /XYZ 99.933071 458.126671 0 ] (cb9-94) [ 165 0 R /XYZ 99.933071 439.179649 0 ] (cb9-95) [ 165 0 R /XYZ 99.933071 420.232628 0 ] (cb9-96) [ 165 0 R /XYZ 99.933071 401.285606 0 ] (cb9-97) [ 165 0 R /XYZ 99.933071 382.338585 0 ] (cb9-98) [ 165 0 R /XYZ 99.933071 363.391563 0 ] (cb9-99) [ 165 0 R /XYZ 99.933071 344.444542 0 ] (configure-etcd-user-and-group) [ 32 0 R /XYZ 84.259843 432.234971 0 ] (configure-kernel-runtime-parameters) [ 32 0 R /XYZ 84.259843 692.570079 0 ] (contentsbox) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (create-etcd-user-and-group) [ 32 0 R /XYZ 84.259843 315.936971 0 ] (ensure-that-all-namespaces-have-network-policies-defined) [ 58 0 R /XYZ 84.259843 799.370079 0 ] (header_bottom_text) [ 6 0 R /XYZ 85.009843 422.718898 0 ] (known-issues) [ 27 0 R /XYZ 84.259843 213.933496 0 ] (overview) [ 27 0 R /XYZ 84.259843 413.481496 0 ] (reference-hardened-cloud-config) [ 510 0 R /XYZ 84.259843 477.917735 0 ] (reference-hardened-cloud-config-for-suse-linux-enterprise-server-15-sles-15) [ 510 0 R /XYZ 84.259843 350.369735 0 ] (reference-hardened-cloud-config-for-ubuntu-20.04-lts) [ 534 0 R /XYZ 84.259843 492.916756 0 ] (reference-hardened-rke-cluster.yml-configuration) [ 75 0 R /XYZ 84.259843 500.493907 0 ] (reference-hardened-rke-template-configuration) [ 357 0 R /XYZ 84.259843 193.712413 0 ] (set-automountserviceaccounttoken-to-false-for-default-service-accounts) [ 41 0 R /XYZ 84.259843 699.833993 0 ] (title-block-header) [ 6 0 R /XYZ 84.259843 502.818898 0 ] ] +>> +>> +>> +endobj +4 0 obj +<< +/ExtGState << +/a1.0 << +/ca 1 +>> +/A1.0 << +/CA 1 +>> +>> +/XObject << +>> +/Pattern << +>> +/Shading << +>> +/Font 607 0 R +>> +endobj +5 0 obj +<< +/Filter /FlateDecode +/Length 2578 +>> +stream +xˎd 602%R^Ɔi$1,_gϯSKus8BwH#H*Wbpo$fqo(VCx>j9?Es|g_)VR_*PVDՠDs5BT% Q܍ cAw7dCH B.յ ͝ Rb,@ Gq䡌ExoܕXP]1=T[cmɞF$LJ +3+RcAw{d,( 3,81j- tH3cA2EuŪ1 M3[4%Ƃ` RdEdߴ<-pZlAXof5cU+)xΡV őTplz>tf@6؂XPqR6^ίVza]9f! gC>5~QF>~m(3KK-v`(w~Ã?ǗO'J_B gL_+?,H_Ċ6S +ui__׷]í/BL8?}lu{r'5^y\W|\~%ٻg,rXˏmdDrwR|8D#:A|ݷ_/lirrDxTm'5c]l}ڹg H!,DŽ;<^q%sO[0{Vr=˒C_K?yq#]x{+^(- ieOr{5'e]e= J}:0Uσ=U)Hwp]AqTلQ(pKl{0,4}-궜^NV_JB[E2݌jSGϹ 6׉.'"|%ֆŜmz.p$GDw[+Ug/_1˔s옣=":ދK_Hߤ儼ϧ\IX!y.SeIަ +[sz&^Qxp\֫Z9ˤVWmbg.=gNM&m!5q/릸#ld.a[<]Nsf{]2\KiCx9w1'n a/>['md,^N043Za(>_';3RkO2i&[{$GtC8&LayxÌ)mu,q4N.k7qn3#ř޵YpF{Q8Bc4}tvKzҡ]~S4۲ s/ƖF.0zȎغ ֽ>hw2v@NO.֥x\G7gsoͻfhK3Y[cv}t!ڐ :d2duTni9,ՙS,/L}U$}UC~f3ʻ;tz\҉WO:dc#ڞǰeHYCOߧz`zq}!P&z|I0GT|;׼$cq#a9Jj܄g(ڇۭƷeM# x"=^Ws;șK$ITDzx^; +endstream +endobj +6 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 5 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +7 0 obj +<< +/Filter /FlateDecode +/Length 3276 +>> +stream +x]n$Wy ؇iASh w0+xQIJHdR*(zGrzM)I+'˟w7WStj?ieW;+ƅq䓡CWVfa dm?|Cʿ }C4kVkun HI nh5f=\$v1N(aJ{sVA V˶Ol=YxI#"qbf ht,pV#goo$[%_X2e x<4G"ǃ%]XQ=A#4GT?ghr^%=чNDSSSo$ѾIwJtJtJ $ +Ӻ; +ZNEXME r*w6snI@#%^JPQ ht8G9S|~#ق y(Dx0 u^x`Tø(XQ=ѢG~_"Q~ ݱE5SSS>^TH{"DDDH})>};-tCKq)E*,ANJq)QQ\!u6[-+~>PQ uht8GL-K<C d<0rWC%`<ypGr~D!tRY&DDD}潨蹈>t"}#HSSS5?2.hUEZބĀ 2D>lo܇ 1ж&qGT?߲HK`%:t_`<;t<YP%`kK= +TPQ htxY~eI#ق/ya\L<}Ń`#.iC<J< +T<0bnT?/(Ds?X"ĔAϼ=чNDSSSo$ѾIwJtJtJE ݯK?t?$',%[b^/O߿ӇRJ?k/Q/V۲ 24_d^k۹ݞZRc kSxbj5@WeUNKըi[TH:SI^|㏟ii!Q ,Rcir]۽p +pTMi ?7{*>R9hl)#[\>#/%@_[vj+ChΡ(}eTyyT-V\dzQ^փf/,j}OGyڭ9QUϏ%.僊ӅiZP?m+G`=D%ޖS{B6U㓓wk^u&ö>Zf'G6"VT4GM ~ohRI|aIY=I%C3]/k0 ոH+^ ZG=;[:<赵G* CG2m]Vh{kYz +Iim).1.tG.C25zˈ^n5?~F'i?N]ɓ +rD090rL}8ε1jngǖ{֯͸m5rѺkC)zqʠpܚ_`"guŇgöl/|V菠w vrmkanغ@mk"x>[{uQfjvjNڲOwvDf{X3kT ɵv@Sn7bk\3]R%m9Q& ¡0PV ;cBZzZस^YrX~^ +2lڵ Ifemq h-Kj/nk2&PH1A ֭\6V"j'þ򝀹I: 7 6v!:jmbsp)T0lT1anZsn,ތ{>~ڦ9ce܄[>Mk{vVb Chv:Zc\;)C(kv 4|ÛǭɁi*jA `jಬ!=-=掿۱Xn}NΖE/> +endobj +9 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 671.061024 504.679134 638.361024 ] +/BS << +/W 0 +>> +/Dest (overview) +>> +endobj +10 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 489.361263 663.111024 496.429134 648.111024 ] +/BS << +/W 0 +>> +/Dest (overview) +>> +endobj +11 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 626.361024 504.679134 593.661024 ] +/BS << +/W 0 +>> +/Dest (configure-kernel-runtime-parameters) +>> +endobj +12 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 488.881526 618.411024 496.429134 603.411024 ] +/BS << +/W 0 +>> +/Dest (configure-kernel-runtime-parameters) +>> +endobj +13 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 581.661024 504.679134 548.961024 ] +/BS << +/W 0 +>> +/Dest (configure-etcd-user-and-group) +>> +endobj +14 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 146.805601 573.711024 177.256773 554.961024 ] +/BS << +/W 0 +>> +/Dest (configure-etcd-user-and-group) +>> +endobj +15 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 488.881526 573.711024 496.429134 558.711024 ] +/BS << +/W 0 +>> +/Dest (configure-etcd-user-and-group) +>> +endobj +16 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 536.961024 504.679134 504.261024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-all-namespaces-have-network-policies-defined) +>> +endobj +17 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 488.809749 529.011024 496.429134 514.011024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-all-namespaces-have-network-policies-defined) +>> +endobj +18 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 492.261024 504.679134 459.561024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-rke-cluster.yml-configuration) +>> +endobj +19 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 234.738707 484.311024 313.229430 465.561024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-rke-cluster.yml-configuration) +>> +endobj +20 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 489.877620 484.311024 496.429134 469.311024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-rke-cluster.yml-configuration) +>> +endobj +21 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 447.561024 504.679134 414.861024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-rke-template-configuration) +>> +endobj +22 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 485.053890 439.611024 496.429134 424.611024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-rke-template-configuration) +>> +endobj +23 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 402.861024 504.679134 370.161024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-cloud-config) +>> +endobj +24 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 210.896178 394.911024 288.867613 379.911024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-cloud-config) +>> +endobj +25 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 485.030452 394.911024 496.429134 379.911024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-cloud-config) +>> +endobj +26 0 obj +<< +/Filter /FlateDecode +/Length 4818 +>> +stream +x\]$m}_F 0 d' ?L~iX?GDU\ܹ]HRW\5~>Ȩr t}t*ztQhʛ~)Up_7_~U9k/?9S 6N`yb>`Ă>=+B K,A&hܞ$0Ge40VkE4x` Q!eE^D+S!FeBItY硋7DZAr)J]\pZAxXX' ]]IAx)ӞgW>9%1#6ÌBxȃ.i+t!H`=J`Uk3Q‚I! R ^*咄Pαb!ϱl>^=us ^8z,=Ib!̱"oC7Xֽlj:ł;Fg=2KcNI<=Ős45WSSaDzйNi@f\Jr6G0eѬ@j[3Ekaa! >ѹ\nX0j˰dѬ3f|On_mc 4W_ն~ب/|iayoM>#f߰-|[jWj';qlG-X^q6U|oqK#ۓ۞؋spjڦm6asͅoSm>k68d;'m)w&?'lZL7ljxRu[֟]x]%`Z~ Ze3jKv!>8yX\p6+2 P 76~.ws^ɝpCngj{TN[s#-ϳRn5_vjYbŎ6:vr}c>CƲ|!^۸<-|rZԎi+yfj}x7Wlҙ=pG:._<ߴ; +~Ov_ 2_l D͞iqmW_ +Xs8?ߧ' O픶vj_tvTܾ< 8_^$Ina=]ӛ|[t6tϨdTgIuCՓpLj5{gm?[o'Ryس/gsj^okx/rieܶOpҩY~?ɪrBKlgVlFؽz灰}w3k +2;BPt꫁p_-~EepEj,#.J}E%O03l GV^mIߒq۾7|EgϡML0gWXu[g +XiOnM-m' +g.?R`I5Ֆ쮁T{bvdy[Ycez&.#"~/jߥ+yoK92`>I.t@l J;tb˧mzҭo/ D̞\FY z*>4AǍiF{f )gtӅAsF3nݖz&YNsLܩ't&8lǠz ElJSJ,?TR7@6ZvL.cA_|ZڷDvr#^5f*LF+?Z~()4jtr0l$NuH82s{r{t{nL17 +HuɦG]'kXɉ)Q6dC>OU{gp] wNrY7&6ڒK [ݳbA0z6[;:#F1ɤ{RӜuޖEp.ǫ#s+ +yo!K:y&+g'lFӆ-1dF[ߢqk^Ӹ]`o-MGPӹ Э2xX2H˥ϧHr4xn+ttpɲquf% y'Ep/vʈrF5A Lw'}zzʡ̀BީwN+x20_Ma.˱z3(-h1ʨiܶ6SjӖ(:\KMRGD+^S ꟹ=J7^ EnxZr<-{-Zww*}w˶W6 Qqߵ*#~9)v0Lot3u +Be7Rb[/sDZh{'Cs:r:D۲ORnX4vWTۭ?wq +endstream +endobj +27 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 26 0 R +/Resources 4 0 R +/Annots [ 28 0 R 29 0 R 30 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +28 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 445.281496 409.271317 430.281496 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://releases.rancher.com/documents/security/2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf) +>> +>> +endobj +29 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 293.575760 264.681496 442.798661 249.681496 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/) +>> +>> +endobj +30 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 249.681496 285.368241 234.681496 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/) +>> +>> +endobj +31 0 obj +<< +/Filter /FlateDecode +/Length 5071 +>> +stream +x\[$m~_V u?,nemw]'&Q0lB YR&gBJkH`#ft$eAD6 +]8*ّFƬ[% +^h4w&Jˠ5Z&erijRJh4/Z"xj4BdKH4K-TV 4buk!Ri4[r9Ҽ&FsDfPi(LR +̓dcUi%5Z/ 8C.EVlp-34'bs d4 94%*T49h0k4jp Xw ^"% /Ui%TҰ x +^< Ж--4,[.iX`jX$Ұ rJU N @5,@װ vaArV* @5,:Jа٬awaF^̪& +Ɨb5, /4, XTZ6aw}#h+7pG5, '4,U. $xjX44,@g-Ѱ w]4ʸR +OU2$-l\JUÂB4,]gѰoz "p |D.a88`}3BuUZ5aAX-@ iX06~ jX6aAZۣK(^5ljRh4uaܵ6W pM R_4,^װ 25aA4|*-G EAd4B4,cmjEÂK^ \ }xxLDA-yS2Z\ְ g2XLkX7.iX6@saAa"S<\K 1D?|?}~xϿPҫ!dK|9_й q`_ ퟯ~'yhRE;ܷku Z-$l2c1n;e.ߦ79gaIW5S +:W&'|=QV:xs< =G$ND +#ף1x?RߴS(3`'ʻ1P9n904k>zngW"{~J 1iq\THG;^{0Y^4;[h3lNavId\E|u/=ѽDfg񷷧 { ;loT1'r\oB0쳊Jvܐ'H^;(sng,X5nw߾e(eFNa;H;#GV1{8,:v? ls $<ȥ䮀—۔1^S|`lhWIXIvHTyiGvR,c#,x8%ۧfSo/t<-6{w/u+[wCs-@Hn0op\8@26<ڎeO6%TgMOy2n<KYNC^6]z Zs46rF+[B_U:GRUigé˗=/~`Vu{\|R?9fe Ks3sw7`;9xF<Š|nZϵzL+&KznMpov]5TnU3_D7+1{M5Χ(0ȇ>r,o;'&c2y}f B3%>Do< +#o_&oy~J>{(<7:Wq|v/n]oyx@R2`ʝ=T'aVʞh։bt7wk,T_Ce8;  +x]iپ˨w MfK/ɤbV\|o,)D3yP̅}!K&\|^˥i}uu3ƺ erb~zkZ̟+&wiu!ɺa1xXhpS_u9Ysb{]t.6KRUKL/ :Jc9&<)ER]&sŬ}[F)EZo-ʣVMkdez-k2ZK3+S؈ r[x\" +oHg%fvX w;eEeQ8Jy(zn¶9BiiPs:+YϠ;jmJDy=b7n3u 3fq)|aюG8 |y̸ ~GB{-l/f/}YX`p2PFZqցN~9L[qo]2CХm;rC/t}JȲ{;l˕S,O'?{0QI,ve֍]:yW^ u* 㔡(Cu B2pd>un悽܆y~L +7qp[&-%*WK:ECNq+ r!zTK7oä\fe׽=/199h0󾲜pQ&Kǃq<4۴kNh9nSB l/ 'gt-hs#uTl6bFf],퉋*<|Y7)(ge1YIo_:tvdQʒl=Ji 86mU<MFLl5? +>viߖpe~W 5|hJ%%`.3xw1sr$Llv{7c_oVH™0wS1q9T䏜vz 5[Obt*4g +endstream +endobj +32 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 31 0 R +/Resources 4 0 R +/Annots [ 33 0 R 34 0 R 35 0 R 36 0 R 37 0 R 38 0 R 39 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +33 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 590.823057 101.433071 572.073057 ] +/BS << +/W 0 +>> +/Dest (cb1-1) +>> +endobj +34 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.876036 99.933071 553.126036 ] +/BS << +/W 0 +>> +/Dest (cb1-2) +>> +endobj +35 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.929014 99.933071 534.179014 ] +/BS << +/W 0 +>> +/Dest (cb1-3) +>> +endobj +36 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.981993 99.933071 515.231993 ] +/BS << +/W 0 +>> +/Dest (cb1-4) +>> +endobj +37 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 515.034971 99.933071 496.284971 ] +/BS << +/W 0 +>> +/Dest (cb1-5) +>> +endobj +38 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 175.741950 101.433071 156.991950 ] +/BS << +/W 0 +>> +/Dest (cb2-1) +>> +endobj +39 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 156.794928 99.933071 138.044928 ] +/BS << +/W 0 +>> +/Dest (cb2-2) +>> +endobj +40 0 obj +<< +/Filter /FlateDecode +/Length 5108 +>> +stream +x]M$9nE};^5>tV¨1`fFVW4z +II=BMg??=Kɚ,oj/™O&P9'Jp)_Oq~o;׺)%: +=KgrJ6(EEX) +BT" l%KZe( x_TK"A%$, gZF2 +&BQ+sdb.e eVlbH++&VK(^yo29',l2rb,,XWV&ZVPfs2g jeD&6Y-ÌbRx6 N+cG+NN9+fˤ\jx5p5 2K/k 2}Pb|J+Xl e4 ` ^0.^v/hX ^g ha-0B0[0lZ 9z  S*000@=iX@]iX]9jX]d5,]fT Xaʬa2٤ab9 U;VjX.[a%9x 湁.Xa:0j4=/X QX4f p +ܟ2Vr.eO-+$[HPEÂ܅b p5,xTaASke]rjX0C4,3dajY1aAf Z 4,8TÂ܅{/D D{2iXeʜFjRhe]KаVܵ6 "pWܦ1 e A4,ٛR԰ 2|jY4x$ Bde'akSd /윆Ɂ  "0}x/5,\װ | Rʢ39ղ2J \1iX\dLz F% kX +xTѰd\+# [D(#Ұ ;hPÂ2h5,F. QkeJ5,> 5,4A T `BGa$Hs2kXt3kX3xqiX۔|3iXP,xAħaAHa`ejXP(#t^K7-Mxʼ-%L^B h*ʼ&!:ie5,(1J5,@|$%Lrp7 VEd5,MDZno!!> dY]1ߪ.X`/UR ,Wr$ul"Q]5[E!Yu&\V%sH9 Gts_y>~>?g%2E\W6\w&RL`qYt&n˹BkLf/28>\xdD'!!膯*cu_SCHy"G +Ů )=X%;u<]fϳ$",TMG+l'1i>^齸1BeX ݊ +%X}{%3xH +9pS]GF!Zg~;??/_am<']⤦&2>M2VЉnʍr+oexGlY0g2ٶ]<Ɲ? Z}eMޔ_ݗΡe޴2yv4&?d]?5pIOd`k;.èb7v]]~u,|Dny^ٛ2j͖?]iȣ[ \_O_$]moEMYYkx$|Ze$Ǜ + 6n{ٝ[ pae`¬<ٕ/zn# ;R^6㑳'}#@YcĴ}ݵxb9ڪǛil0ş._^g6Iyz@g/ܡλ`ثno#1Sy+K] yfbnszp,KN]ϹzeNwh%6I+wNY맻4,Bphs2,Rh ]92jE3 EN\_ڸmBAuܺ!O g֐:=m_*p,Ǔ9˾'$zg:77^/z폾Pw^m^C_ߞ[ڧ +MYJ+w!XG `;1X7d#W~h3zlCkQuSj[S׷=_dɔYh*|7fN'rr**ڇrr}wUR(#L^UܕUyy^iyyxؗ3$_=iyumu~תy.,-bzGQL_O.4%7*Q>ݕ~%YǐU=9| Ļ%]0wiSۜ& x239^ .ý|#ȥ ^>[7}0Л/i +Ǝ'>֋b[6>K ,G4)gfaeu/kh^oI~!/E3S.Ӛ v~<|R<,@zK{hf8#wXM2{K9Q>!rCg]vWE>!Vxcf^h0v8xyηbgJIj4Mfv)?Wlmowe5], !U?ݫ]o6=߫mjY L Zcb:ߏqsW@ ͔PG>[yho^3P8R#ov׵G|\rauD̈MI*q7ƚ|bCpl;+Yq{0r#L8r؊ d*|,aL&y˥{̧8;/Z1=w}iJF[gKgn֡*ߏiՋMDrG +gY!L4]$u;i_ϴ dhR/VuG-q-1a&b K!:p;\OZ\t?丬v^܊)[gEN\B\')Ix +Wj ? YQĪ?Wv,Jm%g$zXmCm!(vf(ҧ,̗_2s]B|m7\:ViO[C YE8vXaC3SA[D+*B +_w#it"sB鱣$@>w'qSv.uDO' cMnu,ӱr&MuE|>UE=v9v|ɩk$Pv'oħ,[',G&` 0F_+֎NsuL2>zn1 22mstD;<m?lG ױuE=ܽ.Ff":? Sf ݏشIu;IA0d8]7]Gm/pؗGnsr_ +pG|ē:\|1力xa; +f0Byfbz!0sò0*+~> +endobj +42 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 797.673057 101.433071 778.923057 ] +/BS << +/W 0 +>> +/Dest (cb3-1) +>> +endobj +43 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 778.726036 99.933071 759.976036 ] +/BS << +/W 0 +>> +/Dest (cb3-2) +>> +endobj +44 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 759.779014 99.933071 741.029014 ] +/BS << +/W 0 +>> +/Dest (cb3-3) +>> +endobj +45 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 740.831993 99.933071 722.081993 ] +/BS << +/W 0 +>> +/Dest (cb3-4) +>> +endobj +46 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 458.388971 101.433071 439.638971 ] +/BS << +/W 0 +>> +/Dest (cb4-1) +>> +endobj +47 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 393.691950 101.433071 374.941950 ] +/BS << +/W 0 +>> +/Dest (cb5-1) +>> +endobj +48 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 374.744928 99.933071 355.994928 ] +/BS << +/W 0 +>> +/Dest (cb5-2) +>> +endobj +49 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 355.797907 99.933071 337.047907 ] +/BS << +/W 0 +>> +/Dest (cb5-3) +>> +endobj +50 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 336.850885 99.933071 318.100885 ] +/BS << +/W 0 +>> +/Dest (cb5-4) +>> +endobj +51 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 317.903864 99.933071 299.153864 ] +/BS << +/W 0 +>> +/Dest (cb5-5) +>> +endobj +52 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 234.456842 101.433071 215.706842 ] +/BS << +/W 0 +>> +/Dest (cb6-1) +>> +endobj +53 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 215.509821 99.933071 196.759821 ] +/BS << +/W 0 +>> +/Dest (cb6-2) +>> +endobj +54 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 196.562799 99.933071 177.812799 ] +/BS << +/W 0 +>> +/Dest (cb6-3) +>> +endobj +55 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 158.668756 99.933071 139.918756 ] +/BS << +/W 0 +>> +/Dest (cb6-4) +>> +endobj +56 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 120.774714 99.933071 102.024714 ] +/BS << +/W 0 +>> +/Dest (cb6-5) +>> +endobj +57 0 obj +<< +/Filter /FlateDecode +/Length 5125 +>> +stream +x]K$qׯ|`lk! fJ;+Ef fFeU >x=G0LfZ|W!gJ9Ś-,%#~s:KDWS/L}Nח /?_sw]gfQ0lª`YV&gJ`j,3y:2ĠZƂ}QXb.YbHcA WcVXBUy\4 JO;JUe\/24^5)X4AXxDGd5dPK%`Ud%!v+UTd:W +-yFKV9g"|3 قY*P& XjѰ {װ {ȂAd:d]AdLD䘰V5^d+๬aAd0; 2AapaϑBL5,H5,@ sY jXP|*3Y 0Cc- Uk<,JSE &Xi)UdLhXb;jXX<"iXPfѰװͬaA&iqհ' ,`O7 KD -0 MKWҰ͢a 7ѫ[כY. +dx]dI`V[[otfgQw ,7bnU ,UV ,Hʲ$u*Ϊ|>-wȘ3KAV!kQ,)ϗ?b/씵PxaH*傔p'/D=쥃) +5|c}5B=fDVZ'79AtHGDm?tN&zQhJ%b] dcA6oζ7\ {|. ++1P)+; PiꮰyB +qvx;ê=NW>zѣД; I;n(ZbނME6g,D±k$?I"Vɸ +I$wz͇ !|7n&1)^?||w=zӯ/s7bJȲco|^h2'V.vO_a*/[ao->-kVor/-rݶ~nOiJ(0,M4x}2dc.0~vjZ#obWe]!fۦ*7T'6svϫQd2cZyi6.0Ž"o<:cmcYVvʪ귗?+m7M('kyVn0!&|r6hxW77^Wҿ>NOSICn+ыlҧIIq|q m} dzO8˨!u~wLguG=o]^$dla>1]_w>y{'}:^|dZ֗iX$|NMcr'{dn#XΝYnN|gPkLwi>>%f,БWũ^O2ƴy)/5xc,~Fo96vXQ`>GQyCx3y4E>qX'{ly|v7aS=}5+c N6"UawM_giZŗdʇם݆m1t9ϙI`[-/ȳKLuȼ5 o啜 ^䒫\|wj_azr!AßޞujFz&%ک*zz>{'q_w倻\]ZLW UӱLt9v9*&~75sw9$Qͮ-v9[NdsG!FoX54:<]}$smjF{Xkx䜝wxZxe5;C~r+tRϜhEk2W꺗g)fW> ͨ|y?UZףOUw~4iu.)qZ:vs1:ڜ|)6HD62Y7+ߴm{'9#4FjAӍQA-V NѦND4hdJ[eER9ŠEj:Jt%Fit(gK'@Qsd%BKv(7}*AC42S;C7[bG=j?+~?ćΖ!TĖƫqw2 0͎ ]0chzj!N΀.90zxw tw?C8 +endstream +endobj +58 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 57 0 R +/Resources 4 0 R +/Annots [ 59 0 R 60 0 R 61 0 R 62 0 R 63 0 R 64 0 R 65 0 R 66 0 R 67 0 R 68 0 R 69 0 R 70 0 R 71 0 R 72 0 R 73 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +59 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 287.395585 575.570079 323.513505 560.570079 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://github.com/projectcalico/canal) +>> +>> +endobj +60 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 545.570079 111.294999 530.570079 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://www.suse.com/c/rancher_blog/comparing-kubernetes-cni-providers-flannel-calico-canal-and-weave/) +>> +>> +endobj +61 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 308.171464 426.948497 401.561844 411.948497 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://kubernetes.io/docs/concepts/services-networking/network-policies/) +>> +>> +endobj +62 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 298.534475 101.433071 279.784475 ] +/BS << +/W 0 +>> +/Dest (cb7-1) +>> +endobj +63 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 279.587453 99.933071 260.837453 ] +/BS << +/W 0 +>> +/Dest (cb7-2) +>> +endobj +64 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 260.640432 99.933071 241.890432 ] +/BS << +/W 0 +>> +/Dest (cb7-3) +>> +endobj +65 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 241.693410 99.933071 222.943410 ] +/BS << +/W 0 +>> +/Dest (cb7-4) +>> +endobj +66 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 222.746389 99.933071 203.996389 ] +/BS << +/W 0 +>> +/Dest (cb7-5) +>> +endobj +67 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 203.799367 99.933071 185.049367 ] +/BS << +/W 0 +>> +/Dest (cb7-6) +>> +endobj +68 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 184.852346 99.933071 166.102346 ] +/BS << +/W 0 +>> +/Dest (cb7-7) +>> +endobj +69 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 165.905324 99.933071 147.155324 ] +/BS << +/W 0 +>> +/Dest (cb7-8) +>> +endobj +70 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 146.958303 99.933071 128.208303 ] +/BS << +/W 0 +>> +/Dest (cb7-9) +>> +endobj +71 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 128.011281 99.933071 109.261281 ] +/BS << +/W 0 +>> +/Dest (cb7-10) +>> +endobj +72 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 109.064260 99.933071 90.314260 ] +/BS << +/W 0 +>> +/Dest (cb7-11) +>> +endobj +73 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 90.117238 99.933071 71.367238 ] +/BS << +/W 0 +>> +/Dest (cb7-12) +>> +endobj +74 0 obj +<< +/Filter /FlateDecode +/Length 5600 +>> +stream +x][%m~?<Z] lƓā6<磪$X3ICf0ӧ"?ڞ ~g_&;\R闓R0SkjOJS%pTKrGY:׺=l83RNX0BThE`#$r/J`JZ Rd ,iE`Ö"kuƨe`y0E=jeN1WԲ2V`2CbVKDF+/s"x VtR +eDcP2ZVPfr2gF+v +M0I1)eDZ^7N+W+NrVձu{Vs2EbR 41.iR8@e?QebIxcQހ@QCo r2 iXxA /hK 3gY]10ߪ.`/UR s$ul"Q]5[E5겁"&̫Or*B|fNfA{1j| >=)rbD\t!8iJe `%7fζf2L}/"O(UNm8u7$%&JF\r!%}#n1b]"|9!x+/Hl[:U]W +v^N؁5= t1bf]?A IҖg#^톬ҐɊ^($@K Y5!CT׆ot ctDR@QW`tJ]2"BU.ĵ. )-h ˈ+J.x ۋty_&߉M~YrHϒ8!,tTwtoWx¡hL>[LFp| +o` Vk-8Gq^+0yO(؆( uO^m?wW GɈV}r7ќӋ]ƅ$gz瀟y~QCzrԀhf\W_av& 22o7>]>BP,p5@dӏxo(us2ԥO3~nmYܶ/3E_q:6z eX\&XverfF?"bfU~" ,R&>XI2 !M??W_)jR6SSjm7T,er[v@?cJ6KCER[®mfiՀ7(muk:y[ձ+UgTޔSXOú߯zġv#wݪWW7ԃ]dd\S߂UvycE9C9ƅ".?vI* B6oCכkjlXhdԄtve4\쬖zf8~.ސժ_Q.G_9Vu:gy6DPf#ZYeCpwOwFy1OƦҾGٴ6F[Vs(ي> )ͱ8Myyۼ1ܤ#y|M +OBIH3#ʷphOk:Y|1KvX`@d5M{1C p4Z;FNfߌnq;1TY]5<xCޒ፳xy__og>JmfT 5cW ,݁):6t-_n7[MZߡ*jmτ $󭥖;ۼ5z{׭;_@zW:reAZn̲>SQ4tn7lub?E熟_JT7|=T\Cc|.aq(N!ĘHx+m)e + O"!7S93qmx>F"mz6~7SWeZJCExSW*sY>/[~ۊG_~ {mݹ\[!Ā5F~jӊRAn\+JVoJ5mO+}T%;HdMSGV1^o*J;/8RO1dT 5eV:E x +dEӔ÷ 2c}js$S#0}zR<>3wWޥwu!Rg*m/Tټ?>ZD+[MR#Ѧ.ɗ !|֜ bV _x෫w>1蝿) yc˝ߕ eNXͽ;{6gvLյɈg{lmuG42F[Zu2}swgg^Cby8x:'H??|=䖣y[@s㝿i+7 F[RX9j:0,剷z6BmxEfhye71MZ,tZ=b-߇_= _^"ylcF> "<ѬqeU`| ߰ {Luς_uuXUwnaeTw5y\먔:8'kri;fi['=E,v˱P{|tG-m_-h_Wl3Gtٟ_y[oA%DTzV؊om*w^#VVf\l[yl~jmLj:ZR[}!nԁ,9M#y5(y}Lw &G o-zZ'j`ţXʼnJ_r06G*06FTHB?/X't]K_đ~[2 =G1?q0Nā6tlO/(g-oaDlbN!o}1zկPß<ِF:*7-F,`O7YTF>}G̛%j, 9 -.틭r#Aբm9z 1ˏsQ~ك烖_z-$׳Ua?/9BS\gSٵA~9ߤƎ 2Eލvlk[> ]hoCkƷ1}d +-ݓ_]<)vVg#I7A { Ə6 v֥謘V%1׈[J[WMtLN f.'i]&Y[/gbnD^i[z }RG$?XsB2Z59 6Y/@R; 0$zo'g3ePSni6_t/oTNe&:OcN^ IcG$`)B\6R^6>n% + z*=kZ aM>+%4&ΧN]_VgL,Z;ȱc$>/q~7:6ڒYsdn &1 }fS4{9Tݜq;etdG_Ot}stp[Wd7X;- :?6iC `o5mGPK%1  + W{ s3f(%Exå[@4ăb28[ +)gINă#я2nVvh-D^>ȎAˊWWrl"ŘO׏3?4}ya{94FhAGBRmhzfM,*cAt҅]]y-i5{,Z;FMhi=vg4#25Y|vEZ +h8j"LBepk!GtL佩XxAA] jMoVJ @Y0?f|]鏉SE^̿z$;ƞVK'> +endobj +76 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb7-13) +>> +endobj +77 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb7-14) +>> +endobj +78 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 681.779014 101.433071 663.029014 ] +/BS << +/W 0 +>> +/Dest (cb8-1) +>> +endobj +79 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 662.831993 99.933071 644.081993 ] +/BS << +/W 0 +>> +/Dest (cb8-2) +>> +endobj +80 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 643.884971 99.933071 625.134971 ] +/BS << +/W 0 +>> +/Dest (cb8-3) +>> +endobj +81 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 605.990928 99.933071 587.240928 ] +/BS << +/W 0 +>> +/Dest (cb8-4) +>> +endobj +82 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 587.043907 99.933071 568.293907 ] +/BS << +/W 0 +>> +/Dest (cb8-5) +>> +endobj +83 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 298.350419 416.193907 391.740800 401.193907 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rke/latest/en/installation/) +>> +>> +endobj +84 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 289.074296 348.693907 316.109452 333.693907 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rke/latest/en/config-options/nodes/) +>> +>> +endobj +85 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 199.908303 101.433071 181.158303 ] +/BS << +/W 0 +>> +/Dest (cb9-1) +>> +endobj +86 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 162.014260 99.933071 143.264260 ] +/BS << +/W 0 +>> +/Dest (cb9-2) +>> +endobj +87 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 124.120217 99.933071 105.370217 ] +/BS << +/W 0 +>> +/Dest (cb9-3) +>> +endobj +88 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 105.173195 99.933071 86.423195 ] +/BS << +/W 0 +>> +/Dest (cb9-4) +>> +endobj +89 0 obj +<< +/Filter /FlateDecode +/Length 5104 +>> +stream +x]ˮWܵ =Ơ1 uYoɨJ+#d$yxd2Ew$2*tU1&_~b*focxy߿ƼXsƿGVS1ŨPi*F냠 +FsTpG4"ܠdmT n8ͪ 7l4$> +*ᇱZ:8tƫJRYEL9"o$]V!$txC%|! E|):IEdA ЕD|AI9 N1:9-Qt= +%hE|N[I ᏤOxSz3k#:Ɨc(=H1/I`cT-I$`S(I,`SVhf((:k$"px +8_=WIg H\|$.p`[Z$.p[H\Mpᦖq] +$qJYuN H=J\+q:JAudu3I\@]gtFV)i k& k#Qkxג ( +h +r8_@`: K$.]1 }lLA5 '25.[Բ2!d `Ui t]m’u.$. +Q $R9 qA:|.(\{ D|H V$qAY+qA!T6|\DTDD0CJ`UkQ3QIa(6`.: xp:C _U$.PEd. |A-q"]茑 YhPdfAK\sIT#$qA8T3M0/ ><`&98Ody$.H Xm%.6y%. ⓸ 8L4d0ߴ$q%7i71mvQL#DuAS-8 M f $q 7ыKQ\. ft]DA\`VkdegW 4cl 4U 4ȗH2q*Fx&Nx_}1f7-}sdFO|_Ͽ(+eX{"6AWdGhhpKl؉x]tc'1c/ٺ g`b`T.ȾVZ.MgPLcՓ&S@@*-s':^MĿpA7B.1*?]~?׿/<ֹ_g\MUa_=]Q|瘏=tˋ{ߟwi5_og PUin_>[%*@`0 xk&_G oDo5:2Zj!f) +(l:Bo", 6âӴf/R!e8B5̝ +.]jR7`]5_Gayi eL3Mo݇@sbKj+Frզlw}1kS5)NߚTjsN$eLˣN#,wo.ӛ|;Kw~^r@]=%qV M!>CkI/8Y{0[A(`-WK'Wg~XR5#GIl`'y ,NMUMtef^\2eԒ6*[^.-<,d1?pB7-B4P1:#+>߅KL(f^yy~Ԅ@1?bBPI,Tl&f+Y/5h$.Dz8Sxk6#rۦW&8i^w2]LIqXfrG@\y Ux|O=š8Πہ?߃2y*mzgަ[fi‘vL: |9$'tk;h]"<{my4d}$7|L+I˩j\1E(XOj;kq{O44)gsky}B}$6luHʜ1l{@bjԆPpCGK&O#1[yh[H}٭ptB +:;#c^`OpѢ_J^m@)n r;B9A\6$ˋQGBk6!CyhSHа/vAS^8h>As yյfL/jU_6lV|Ba) oRS> 5Y\yHe>Zri 4Yx;ƥq_fٷY.}n6u >3W`8mg%Aj(B/ʣ,hi@ߤqDl-c]ɺS}uHSg[[ +w"2kmʱ<:ll_٨e"f4^/&m_8^wΥKCŭϋ6ӠtBя|-><[,"Yl¼m}S~fm!pBy.l}n ad(ϋ61gئه3[gs[3"T.fmx#7l yϳOg>>w0apty}(CpSȿjřlzFF&_b8ޚ@/k~Otx䦜m!sʕ6;S듾lWh_ig֖[\S,W|ǼYD7|bl›ٛl2!6dE Xy:~*@BG'Δ4Noj +cN=wd=9*##h<݇r=:LZW:T f.hc'<[գ%#g07wdM <t_ x$t7!Rbp3IħP>Y@u\C_! +~4h:kh4-GEHbvW(HV|>9qթ6tkM^ӱ#.{.KڀpMGwewJU׳,%o!=$!f5R|45B`ZTyaY>3sKBcD?TxqMsi.YWtR^vđ FHg,-/HS:gn;_Z_}5.ϯO+{b{1]_K]BsŇ3=C ᡘߍB? P\I5m?skscՙkZ'|XRW֮ͪMr5vDAYc&b~h5Jʻ0U QKk:Az]sbKi5]PwU +utFtG?-PZ7v^%IvQH;Wh_7 +ݐo'ҥ< ];U&e)? 5HwbU/fo+i:$?6y0;֗IZHϤRH*1WylŦj4:7(mOߺ׭`oƝo87џow|b~t1sS +1Bw}+[;w2i}R98;8߰#H; ~4}mܺ#4- Uغ 4~6[;5us݉4AMӎBp]kP3uW-ڶ7ǻs;+\u/C}H`1S\MXHzƦUF:uKŘ1?y?_ܽݯ.XڨIFi16“\es\yYv^C-/7=ׂ5zhA4uk?JU). Urէp5R8[Lѥkڏ*яoZZG8~wlddanR)]eӶ:ھ Aݑ#SKλn@JU g0PκxB3R4N_W2XCs: oPcŐ m+ҹ +p:i|]re"qЛSQqIY:)8 +endstream +endobj +90 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 89 0 R +/Resources 4 0 R +/Annots [ 91 0 R 92 0 R 93 0 R 94 0 R 95 0 R 96 0 R 97 0 R 98 0 R 99 0 R 100 0 R 101 0 R 102 0 R 103 0 R 104 0 R 105 0 R 106 0 R 107 0 R 108 0 R 109 0 R 110 0 R 111 0 R 112 0 R 113 0 R 114 0 R 115 0 R 116 0 R 117 0 R 118 0 R 119 0 R 120 0 R 121 0 R 122 0 R 123 0 R 124 0 R 125 0 R 126 0 R 127 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +91 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-5) +>> +endobj +92 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-6) +>> +endobj +93 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-7) +>> +endobj +94 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-8) +>> +endobj +95 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-9) +>> +endobj +96 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-10) +>> +endobj +97 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-11) +>> +endobj +98 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-12) +>> +endobj +99 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-13) +>> +endobj +100 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-14) +>> +endobj +101 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-15) +>> +endobj +102 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-16) +>> +endobj +103 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-17) +>> +endobj +104 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-18) +>> +endobj +105 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-19) +>> +endobj +106 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb9-20) +>> +endobj +107 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-21) +>> +endobj +108 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-22) +>> +endobj +109 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-23) +>> +endobj +110 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-24) +>> +endobj +111 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-25) +>> +endobj +112 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb9-26) +>> +endobj +113 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb9-27) +>> +endobj +114 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb9-28) +>> +endobj +115 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb9-29) +>> +endobj +116 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb9-30) +>> +endobj +117 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb9-31) +>> +endobj +118 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb9-32) +>> +endobj +119 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb9-33) +>> +endobj +120 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb9-34) +>> +endobj +121 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb9-35) +>> +endobj +122 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb9-36) +>> +endobj +123 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb9-37) +>> +endobj +124 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-38) +>> +endobj +125 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-39) +>> +endobj +126 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-40) +>> +endobj +127 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-41) +>> +endobj +128 0 obj +<< +/Filter /FlateDecode +/Length 4955 +>> +stream +x]MׯI?bZ ad10}bTI`%HdGf KΨr VkYrl./.*orH (zW}ϭ9[sƟb^HH҆$U!)[YJ>:Ƥ3\N^J$$%A.2̰8) f죐d40Vk1 h +iƫFR5*lf҈Tx#eBIJsgm4[qNKiQRZ-HiŦHRZ-[$2)sbZFN1iV{ҌQ$1 # +faK>iœRRxSLIG7i2R-F't6DAyIr:l"K ؔ$+rxA5- +N$. -֑u@u: | fj K)8  (e KN %. .`%. .$. .9%.p]"hi$w(qbY Ы +8 +ʦ%.p]wm Ӣ$ xz܂k+qZgh1BH$q +Sak2ܟ0Vʤ$.]}bZV&ŅqVV&,qQ L4." q.0Dd+5GgrbgW 4÷K o5 9h31LA\5[Eⲁ"s'\V%8D&3Ct_-vYN{jY)+ O. RKqm"t0-:lDHZ\Hb|ɰm6f;s})t:V*bal8k`Ą9ٙS[X8E2wb@ nNFkz oиV?tOߣ_N7ߙٟ};ubN:.xs*ίYy\|XeJXo(10VPMˈιGuZ݇-~[yy.Tg`3j{:셵S +u,DAvf>=ZghCJ WLF QnKSD)H!9/Qc`tR08| SV4DK9TqeA߳ފ_h|ƍczC'#esY8sN<:=h[s]X_8js>oh(yw8sFަYҍG:W9ם-{ᨽop'Y'ŷˢ}WmPmOtJ;,np ^`-܀{oiޓŜx ȫMiԞ{i<ºQ?@2&v9 HO +>DHo*8<:>:h ZѮ[qƁ:ǁcOzG'qXמ8p@,9Z|8sxB_6mQ N3EQYv|P~N|Z-Lq)@:*t[3z X{0Wۿ6_`mq>1b`9,|O|w8nw!bS,Z1ug\]VPIo%e ihuR8 MP1?DJ6֏[X@eWWgwqƺnrB$J;|vQ{#ypl+/št1&v0Y $Zl3ڳ'KPުmW:UB"櫸]ީT:=9̐qOi~yd}:-áǺL璻nYbQ0<9!˸#T.CeF? +'u8'lT2ձ<9ֶgc޷1߅f6:<؜q d}&6,Og rlx (3-TZ PIrEoN8#>s M%_tĜQ.<4s zg(VU@|[5Z3ηԿ=22G#I&:ǁ?:(9CoSIPϫ8m"eX9?A-_=5hy!Yߗ~s:ǁgi z*m*lX%M•6 -Ow?xُQ{mg`5?!%o_`eYB;s{Zt]| m?^mwܿƚo-Nc5z~kR04?{y̴7l`6; L@3embvK|R8 "~ !|&6-:wz?`R8KơT=Q.IJQ hg&uI139m[/0ڰg?`޷ gN#cv?`R87 $Tm%mڳ0j1`t6?50s z +b<<س0jB/l~9Gޔq ~m3GsgӋ c}ֱyuItiZWH2qɶ_۳5j[c%14{R8 "R, Tu[@*كؓ:^^*0;Vb94/x 9ΐI(A!ctq~?^׮$!/k9?y%)0dJKY@եUA!/q0o>١mÜq9\2WwSWjѮ6RmMg{zl;1sx$~ʊ&!#nV*݆k:oo xd${LwcN0X^mɛ76O1w!0ɣ +(fyķqۯ R:[G6ܵl~]6ħy\"uvcTbK, k35O^cVy|WWŖCs| +˷ = 0b>'FX, b74,\siXXtO'qȣ4yOZz9APNYkY|DJ6*_$k/Z_}Q1rXT,(ʬb~iR^jf[ +lż܄~ꮺ&kCXMt_u= ҵUJQu2UK! z9 t)]Wb.Tj\ o-מ5Wj|3ARmxA*nh*nŁ{5f 7vAzQWh_ +nxiR~f76 U*eY~1BӮZ%<6xH+{.F&ʯqסu,ġrk/ [0_/csb~*4۵:a3 čF_qT 2㾜~Zܜ%o9^d~}td<Gc.~rF{2k`Nh]GMlR ku#T55ֆVZC];—VMsؗK*7j?7TE;L-K>wE⊳6Tg;E\ⲫ076f2 Jjӳ +/0/fl. B`/+{?BN> +endobj +130 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-42) +>> +endobj +131 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-43) +>> +endobj +132 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-44) +>> +endobj +133 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-45) +>> +endobj +134 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-46) +>> +endobj +135 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-47) +>> +endobj +136 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-48) +>> +endobj +137 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-49) +>> +endobj +138 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-50) +>> +endobj +139 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-51) +>> +endobj +140 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-52) +>> +endobj +141 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-53) +>> +endobj +142 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-54) +>> +endobj +143 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-55) +>> +endobj +144 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-56) +>> +endobj +145 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-57) +>> +endobj +146 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb9-58) +>> +endobj +147 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-59) +>> +endobj +148 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-60) +>> +endobj +149 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-61) +>> +endobj +150 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-62) +>> +endobj +151 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-63) +>> +endobj +152 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb9-64) +>> +endobj +153 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb9-65) +>> +endobj +154 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb9-66) +>> +endobj +155 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb9-67) +>> +endobj +156 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb9-68) +>> +endobj +157 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb9-69) +>> +endobj +158 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb9-70) +>> +endobj +159 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb9-71) +>> +endobj +160 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb9-72) +>> +endobj +161 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb9-73) +>> +endobj +162 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb9-74) +>> +endobj +163 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb9-75) +>> +endobj +164 0 obj +<< +/Filter /FlateDecode +/Length 5165 +>> +stream +x]MׯIF `>^, %F$Yd5FAI>>F0Lw2;sIO?~9YKŒpv ?I%'|_qgoJޅ?JI9%$HI +CT3R${3$eAIfXK$9 ;VM!悉hygb.i i.y-.8-cZÖPl ji)'--d4s"--)JZ-@WV`iiL(YM+H91`B&Zs&aDbRj\U.($lj\i4.@a-Ѹ w]iqD xetVKhqeܢh\H}f 3׸ waqAoиqUӊ%g x5.,lliHNC5.]LE޵H޵ GM-kai8z0޵=wMEޕiS゘D0 ̦5." . B@Yjl6Jָ yBk\&+E64\8[ +6@60XC<=lJVWrR1(xM{aGw*3Dsg Gy!L޾'+rgxfoϱk Y5)^i$pXR`X֞º^uyU[kO򊪼t/bvKB?K5}S%QZSNmJѿl=P7x90V]py; ԏw?vNLx#zY[T[]X)aNqDc|K( +]v񚷓_wƲ .AӞmRjoXXNHѺIǁK׮X-+DڦmoBJy/+ڣe,O-O*rl]=O<LО3]:oim\GNCsl'vVq_ř t[ RI_ܝyH&+}:#.PT[Lm%~ +["ccҞޡix]:]6{Foc_ߞ6xk}n= +$"i7bĘ }OsxRy8@S.H+s2 g`- R͹r18ɲQo]5me_:Kz]?uO?j+wzwr(%i8CvRy<_M{{%e^@q/Weo/w.r):w78]HN>(n)Kw/ n:-G:R7J߭xc b98y`?{Ф(crсkzƷ[2t5oٮ=w҄:0 +<XymԷ[LM=ȤbvNlqŸb/'ch#fy$y$"FKG+U} (ʅ)[=vqӾ|owta my3^?'Z(~Կ(+r#|j%QNOqSB 977뺿[§k*ԢjzdU4ԜC"z:)l-k]7 .\-_IͷZO+ofuʭF4ɇ1b܋@kYn |:A| +I6BRWnge\ +Cw*B +,?7HWMo^Z(;پ\J~!ݖN5Y'O'$c/v uM,Vۧqe/TCNP U]ıqs/Nǝ|0_Ob~lbypQ*넛a M"lǪ?A͸OiSFrE;rEO| ŗ8wKw^W2G_0MNȭrU֭;Q-FsvXY>Ɋօv$T/08Y>Stg3? +endstream +endobj +165 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 164 0 R +/Resources 4 0 R +/Annots [ 166 0 R 167 0 R 168 0 R 169 0 R 170 0 R 171 0 R 172 0 R 173 0 R 174 0 R 175 0 R 176 0 R 177 0 R 178 0 R 179 0 R 180 0 R 181 0 R 182 0 R 183 0 R 184 0 R 185 0 R 186 0 R 187 0 R 188 0 R 189 0 R 190 0 R 191 0 R 192 0 R 193 0 R 194 0 R 195 0 R 196 0 R 197 0 R 198 0 R 199 0 R 200 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +166 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-76) +>> +endobj +167 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-77) +>> +endobj +168 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-78) +>> +endobj +169 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-79) +>> +endobj +170 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-80) +>> +endobj +171 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-81) +>> +endobj +172 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-82) +>> +endobj +173 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-83) +>> +endobj +174 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-84) +>> +endobj +175 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-85) +>> +endobj +176 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-86) +>> +endobj +177 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-87) +>> +endobj +178 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-88) +>> +endobj +179 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-89) +>> +endobj +180 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-90) +>> +endobj +181 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb9-91) +>> +endobj +182 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-92) +>> +endobj +183 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-93) +>> +endobj +184 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-94) +>> +endobj +185 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-95) +>> +endobj +186 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-96) +>> +endobj +187 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb9-97) +>> +endobj +188 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb9-98) +>> +endobj +189 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb9-99) +>> +endobj +190 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb9-100) +>> +endobj +191 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb9-101) +>> +endobj +192 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb9-102) +>> +endobj +193 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb9-103) +>> +endobj +194 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb9-104) +>> +endobj +195 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb9-105) +>> +endobj +196 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb9-106) +>> +endobj +197 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-107) +>> +endobj +198 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-108) +>> +endobj +199 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-109) +>> +endobj +200 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-110) +>> +endobj +201 0 obj +<< +/Filter /FlateDecode +/Length 4557 +>> +stream +x][,9 ~_H۹I$x" !Y>k*TO/gt$劝vʄWJI/ߝ?yǿbb9bwJr_˱?:}]'՚(?U%g V6X1)&#j FBrCj bQ1Xb +1(X#Ԙ V#&x&Kd(T*U ,KYB R,O K>XYbldA*-^,ީ@XW1y',^ek1y<_r䑏.foBp&# +JJdI>VY"{x Y?89bV͞ŋ(Ƀ,P ɂ da줒X @) +PNrf F'f (X@DIp,k W ̐-,`Z,,`,,`,,`.0K  S000@=[X@],,`.KI0p%x ˌ&-,::-,.-,.YX:aoawx@L^vlaw), ܥP?ތhka=x1GK,,P1 rdaABFBJ‚܅b "pY,,;xT wS[@}$஺M RV CL",,HՃ%haA D@Ƀ,֮r-d,LdaA&ȂDDfzY`.f~ @2W9&cUȕ 6y-,Y\q+K@ XX+dPBdndAma"]BdA4haA,3y ࡑK-x3EP d@JY@?lG Dc GtXXP +d!O65TYYXP}r&[X{ j(7I,,|XXP#DgIlaA<Ȃ|dd*Ԕ4, @ޜ(ofs+w& p|{ölfь3[)셷朁jdN@Ld%p`oNx/1٧q*2|fBc)W͏/=埧O?fO$MP7M DIBH"EX'THbz_ZdH23ӓx_d +d:ϒ}1> xf< ;}7wAVN:ש،ĻT8pO9F9y_|;ӌ2+pMrwfo+zz8;g7v&kQɸH؋FqOދG|a|>0hZo|2o+_(?||} ߉"7#Ai'ť엵/S8csbEfUsz7W8 +̺4Kzln?__nH.ťD:;yݝuuGםuiXv㩏:+66Q~ӎ*4-]ŵ.5ó1ivG;Gg*1>;rtf lнcgtuAkZ؎=ʱ_|еt^J9Jt3I,$Y. aJ6!B ,ActsUD$|uƘNBݙh2ɴruݦ](>gAT͵I1ྦྷ +cSBjjg"*51pd>іuȒ 5u{uu!:Q 髾P 5mC>]ʹm,W'V+z비. 4:mc\L`VjV٩+lwFӽmC/QHH_+wuc +[naykU5ǡ Fgc Vm8V;úmYWCDV}_9{q uHxLrtle9HÙRuR9uQf9y&rU' + ݹ;9Y8*.VPWлVR nd_è${HH[[Fz7#8C:DΧWs;~lj4OzBS4C!G!Q8bQ4:$>L'd-;G!E\x=1c/x}]`z6rΌ_T5uez3ؤgObGʰt̽\ntAA.ǵq=4YI;w9p9/z vv3\{س}/ ʕSCz:QsTUR~pixbćo3H.R}_v7sn..p~hZ|HWзI'kj3}';睯mP\Um[WSqy{چ5}m|pT/&IʡܛhY0X쥾6`)}aӧEr )O^Y8`ݖrzB߻|?JB;J\UpTX%S}u><~V ksyjlc+[]G]EwmSVYٻaT6-2*u767v*~9[@؟e%⑖cpz'-rO/i4wZpz`5#] 3~/0JC piF2s9Ǐ-~>Mi%ep4g~ۋ3tOSdR4ZCJ{oz\I1ߝƍ>Zi~"O+IO[ F;Jޖ.Onh/mI_kocJ=֏ۢڕۍ "jpI֧.d=8R%&3K2]\*%1^pgԿ֮scׅA,A/'ܖW䶦Z4[ɮz2H/'oMkT7bi$\m ,7r/U"b\zfj#1}]jb7tA|9^ )ft\fz#v;^j.04MjoP;Ug\-7ѱN驣X=$/e +9w+oW{C \x +R<ЭZt -MuE^}Fo`Sבƃ6߈/c-YM,d-7`Dn&2,rirsđ4L,1: +/o'9>w+/dK؇@$`!'Z~V2t ;҇Rg ˦{ Y%mXlRb|\NjK>MJ..\".Fq9ܰ.Toһ^Q.0B/yfǦmzB`/Ɔ%7+y ^YFR;wHx6˴>@]z,Cc -du1@-K@o*is.@[M4Wk2=q1{)bu8jwb.jh{Gsd%AKcN$7e}mc"HZ"ST%¿G[lUL3,QKL<&_R Ss{r&qw:0oi"Q3ٲ}sbgc*7Oˬ$],.ECҙZd5}2I +endstream +endobj +202 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 201 0 R +/Resources 4 0 R +/Annots [ 203 0 R 204 0 R 205 0 R 206 0 R 207 0 R 208 0 R 209 0 R 210 0 R 211 0 R 212 0 R 213 0 R 214 0 R 215 0 R 216 0 R 217 0 R 218 0 R 219 0 R 220 0 R 221 0 R 222 0 R 223 0 R 224 0 R 225 0 R 226 0 R 227 0 R 228 0 R 229 0 R 230 0 R 231 0 R 232 0 R 233 0 R 234 0 R 235 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +203 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-111) +>> +endobj +204 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-112) +>> +endobj +205 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-113) +>> +endobj +206 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-114) +>> +endobj +207 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-115) +>> +endobj +208 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-116) +>> +endobj +209 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-117) +>> +endobj +210 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-118) +>> +endobj +211 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-119) +>> +endobj +212 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-120) +>> +endobj +213 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-121) +>> +endobj +214 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-122) +>> +endobj +215 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-123) +>> +endobj +216 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb9-124) +>> +endobj +217 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-125) +>> +endobj +218 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-126) +>> +endobj +219 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-127) +>> +endobj +220 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-128) +>> +endobj +221 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb9-129) +>> +endobj +222 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb9-130) +>> +endobj +223 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb9-131) +>> +endobj +224 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb9-132) +>> +endobj +225 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb9-133) +>> +endobj +226 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb9-134) +>> +endobj +227 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb9-135) +>> +endobj +228 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb9-136) +>> +endobj +229 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb9-137) +>> +endobj +230 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb9-138) +>> +endobj +231 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb9-139) +>> +endobj +232 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-140) +>> +endobj +233 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-141) +>> +endobj +234 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-142) +>> +endobj +235 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-143) +>> +endobj +236 0 obj +<< +/Filter /FlateDecode +/Length 4172 +>> +stream +x]M中ׯuQ$( Ed< ^? ,$dC%U[/nMJMm狀%'J؝,[9x..%WWj%_Otlz՚cH,&W V2X)Rb+[bAT8-@ ,` .nYbbAPS1XC7y3S4x! gRc5yP#rpHUsNbK%fo ! e&D)d +dN5xY0A}x\l*x^O. x!I&#b"d>UYh0~,p"Q15w`dɃ,01C_ da@,ql@r,, +DK! bMs-`yȒ8[H@0H0p7&܂1haw#la&x3B@Esi *Ÿ@+f p7g 7Zv!jaA"P  5ZX-p7-,H] LXX5y*baA ,,;<‚ ExdODdg=&D ׀5|ɪHa>}dஆM rQB C-,®-,ՃedaA $@Ƀ,\$֮R J,%B  #p5 6\0dAhaIejrtR&O ‚R! r4]b‚R! \"' It ٠-,@Zxu)gp4&&,,}t,,M,sLdD]n"%ha榮7Cd|T‚/u)TXobgmbaAeȒ<Ȃ~ Lzd2d-,9zS,,@&2z$ ,f*wf p&2[km ?+N1+Л[͒"ZfF2+KfaͲ"LTUt(R&+܂5֌4#w?[*e'`g]X'uXan[.0tp  !3}TR7!`q-^dH2$3˝8.V +l}>ƅa +]dNX)Ks#| +I1FN8^ϻƿ|w_*tќ?w?Bӻ/?߼Cj8%r/-~*g.65::N3_[&t~ӯ-1C(] kL.OM13E +Ť, mKGVh҂}c\ZqP2!҇+h%o^ir,Ȗ9EO!>2\9ສ{Ue| f,Σd~y&ul̏d㨹h>U?_T[[04!C iyk1hzZNy3dQtkOeWf! |İ1>m~;lwH +7[2$wLuҫĤ'/v2[ݾ4ermՑ'[< M9˼:4ŗȱK5t.7 +rR㛵mycvoCnֿޏpɑh/GnqEї +9je1ug-6N^w0jF3˹;|&zd.1 {},õ'<]uj9V#:mҝh?cbg?&$I "~*|LsCWL NxU?ko9[_}Z7`4zO"y'5d qeߓ}3 ·#c<'Bqkq %L+n 4Z3.1WN&\?]U:H~cTˮibX Յ\C68j&}%_TWW2,&H{=/ +?`Ǹrܹ>1y(,(Xڤa|嵺8eߓ}qUѭ=κ׊x˖?V.^7ӇǓa?xޣeG@u%xM~=鎐l~$YgkW`Nq%%/NFMw<ڙ=s%{V)ֳEI vAn:>$k^-mdvEU󷶱 |r°tM}5_TnFPSSk NdҚ5v`5B6Az9֫n[ֵ6olS+ޠ-:ZE |S;ܓZKmI:!R1Z +|jSo$pN͗h}ԩtOlD}J鹣[\B)}Ύ + +u؎:lS'>:Y!cHM Sʯ;&gꮚ|,a~ݍ;v-t.o0e l|M֩/m}v`q 7}][;:fps2+⾜rZ\5+t1; +o6H;ZĎ;twc$nǍf F`#ڦ6zqk޺ [4tHLrS74 \i'2?6[R9 CV +'T6m!<\gt r:d(N&NL ]*? k8=[/h] Mx2^8hc{h"Jީ#ߘR;TZNZ>oλi_ߣl;@ rmhK)ݚZ;SK/h4Z%ߴ불׳% Pso-{.)-;hc~mm&H2SuK7-¿g|Z`j?K#ȶ 5B%K֍~ P>o8n+1s8&%a +F}./m)(l0o*8ˆriѥIZҮ| f| +endstream +endobj +237 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 236 0 R +/Resources 4 0 R +/Annots [ 238 0 R 239 0 R 240 0 R 241 0 R 242 0 R 243 0 R 244 0 R 245 0 R 246 0 R 247 0 R 248 0 R 249 0 R 250 0 R 251 0 R 252 0 R 253 0 R 254 0 R 255 0 R 256 0 R 257 0 R 258 0 R 259 0 R 260 0 R 261 0 R 262 0 R 263 0 R 264 0 R 265 0 R 266 0 R 267 0 R 268 0 R 269 0 R 270 0 R 271 0 R 272 0 R 273 0 R 274 0 R 275 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +238 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-144) +>> +endobj +239 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-145) +>> +endobj +240 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-146) +>> +endobj +241 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-147) +>> +endobj +242 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-148) +>> +endobj +243 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-149) +>> +endobj +244 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-150) +>> +endobj +245 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-151) +>> +endobj +246 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-152) +>> +endobj +247 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-153) +>> +endobj +248 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-154) +>> +endobj +249 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-155) +>> +endobj +250 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-156) +>> +endobj +251 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-157) +>> +endobj +252 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-158) +>> +endobj +253 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-159) +>> +endobj +254 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb9-160) +>> +endobj +255 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-161) +>> +endobj +256 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-162) +>> +endobj +257 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-163) +>> +endobj +258 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-164) +>> +endobj +259 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-165) +>> +endobj +260 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb9-166) +>> +endobj +261 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb9-167) +>> +endobj +262 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb9-168) +>> +endobj +263 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb9-169) +>> +endobj +264 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb9-170) +>> +endobj +265 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb9-171) +>> +endobj +266 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb9-172) +>> +endobj +267 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb9-173) +>> +endobj +268 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb9-174) +>> +endobj +269 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb9-175) +>> +endobj +270 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb9-176) +>> +endobj +271 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb9-177) +>> +endobj +272 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-178) +>> +endobj +273 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-179) +>> +endobj +274 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-180) +>> +endobj +275 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-181) +>> +endobj +276 0 obj +<< +/Filter /FlateDecode +/Length 4627 +>> +stream +x]Q8n~_N){8 yK,2A0LgAo<磫$6Jӛx]&E,“%ϗ_.ޕoi9X?IOsq),g%PqXvc˿_[]9䊔`@+%WJL`pZ, +G> +*bA Q @ ȪP# j +zɃ" e=[\+-˅C +s%U,^.)0{]X ](7y%J!WKu]|Ur +ɫy)rE\"oBp I&3 +%TMtI#xDEĘQg7y +/A < fK 3).YKq\#[  QRȂX\x1X@@$P.k U"tA Kd okCP[X@@\ T-, `.;-, .{rĒ-, .q0p&-,:: +B0p/0p(ZXQula|Eoawx 0ƄK"7p7&-,`n-,87. $tZXx^$ ЙHK,,HP9 rAj w`L^uƼ]ȹZXTdaA>`CD$n Dj z pyC \p]W"$.`)ZX(IL^qp`ayd.{ w}" w=#1yЅ$ZX),pz_a‚\(G d r!3y8YXP< e T‚ haA)\ Ⱦ] 2E dN*%ecI\</ JaP,,@-t^` J.* 9-^.H-,@ ^H.-,(2$Lmk)g&4&&,,h,,@beɃ.XX ]7,T]YXP}v&[X{ jԛ-,zS,,Qo3mf2tIHQLtATy LB txԜ fDFo. ֛\. +dx]dDfk +3)Zqb \2^DbxHDe)\5@X3xsOU;L)zӂcmF4/~A}_fY)k?ON:Ebpc[h#J*E7U>a24Vx y{ +@,>#A7|8FNLd7it;uz#3ӧ/?pO.Nӻn=`\X/'$Z7#%EVZ`N]k$,$"{5+S}Ƨɨ-}ɮס]0=v.~`.&2_kյyFΉftȁoMLDQ^V&m7's㡢L͍TM/~+a7'nƵOo}7ZȲxxeN9 wyX! dȡw )іߎP=XgE9:&=) Uz  ztu6QuYPk@ZeGLܵyL>P26,-"-m&ngԫmAյ¬ŐQjNgH.!liCȨ$R]]k/$QYqN,#r$ 97e~͸aR) n +'|>u}ɜ E7x}ICqkd+{<ܔ{6V\ԏ\z=Pǫ}Ҥ9/B'l7'u%KK~JymIӸ, \zKwd3S\%ǩB,N5)s"]C#jל-/pE,or](ϕXRCoR<4E\&nλҦwG!;j(ϐYE}Mʜ E7c*hN ޭ|tnYW,.$E8v$dsOO% ;'s^bMl:vmc}y C2vo 7ݤyt;o.yb{ļCm:}C?`Q`QmXgsM`&eIPt:.2?{wGùc[0qP [ {1Gf7MNʜDw~>6~*߼txhgm+bs=FYۤimyN(H&vM{ڮ-6'{Kf-s:zՏ7E`E$ J@~bN+V\o$o'_eil4} BETECR&h=Ni:lY@!}}vWoW6dԦT-9tdf#7%p+lȫOr=~Wr2KE~o%񞬮/$+Y75'bBn~CN2+>_zY\5-cvmyj;ZĎ;!dш}  kԼUܯZsGbZm8cwhLC|Y'2;6kR8-DM+CYy䧡Ki5q)UIU\F!<^u-W14A +Lر/Y} ={o*6ڡS_Fj0va9sɻZEܣScM-xs0@U 'FۜF=S5,W,J)V_GKqT8*VmgK4sYί-{.)-ҝkKjy{mUf~K¿̝nj~ 님9|!_PX%7_8d5LD4[0cU5[L4.m0pVkr﶐X'_Q|0tY>Y~J +endstream +endobj +277 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 276 0 R +/Resources 4 0 R +/Annots [ 278 0 R 279 0 R 280 0 R 281 0 R 282 0 R 283 0 R 284 0 R 285 0 R 286 0 R 287 0 R 288 0 R 289 0 R 290 0 R 291 0 R 292 0 R 293 0 R 294 0 R 295 0 R 296 0 R 297 0 R 298 0 R 299 0 R 300 0 R 301 0 R 302 0 R 303 0 R 304 0 R 305 0 R 306 0 R 307 0 R 308 0 R 309 0 R 310 0 R 311 0 R 312 0 R 313 0 R 314 0 R 315 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +278 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-182) +>> +endobj +279 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-183) +>> +endobj +280 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-184) +>> +endobj +281 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-185) +>> +endobj +282 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-186) +>> +endobj +283 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-187) +>> +endobj +284 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-188) +>> +endobj +285 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-189) +>> +endobj +286 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-190) +>> +endobj +287 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-191) +>> +endobj +288 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-192) +>> +endobj +289 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-193) +>> +endobj +290 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-194) +>> +endobj +291 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-195) +>> +endobj +292 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-196) +>> +endobj +293 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-197) +>> +endobj +294 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb9-198) +>> +endobj +295 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-199) +>> +endobj +296 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-200) +>> +endobj +297 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-201) +>> +endobj +298 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-202) +>> +endobj +299 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-203) +>> +endobj +300 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb9-204) +>> +endobj +301 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb9-205) +>> +endobj +302 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb9-206) +>> +endobj +303 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb9-207) +>> +endobj +304 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb9-208) +>> +endobj +305 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb9-209) +>> +endobj +306 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb9-210) +>> +endobj +307 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb9-211) +>> +endobj +308 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb9-212) +>> +endobj +309 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb9-213) +>> +endobj +310 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb9-214) +>> +endobj +311 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb9-215) +>> +endobj +312 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-216) +>> +endobj +313 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-217) +>> +endobj +314 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-218) +>> +endobj +315 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-219) +>> +endobj +316 0 obj +<< +/Filter /FlateDecode +/Length 4998 +>> +stream +x]Mݶ_q~AEҢ).;A\gtHJK=+bľryx8CRjJ)O./ZEߔcq1%&䯟X@Qm Z]ٟ/?Ks*`b^HH҆$U!)[YJ>:3\N^J$$%A.2̰8) f죐d40Vk1 h +iƫFR5*lf҈Tx#eBIJsgm4[qNKiQRZ-HiŦHRZ-[$2)sbZFN1iV{ҌQ$1 # +faK>iœR?RxSLIG7i2R-F't6DAyIr:l"K ؔ$+rxA5- +N$. -֑u@u: | fj K)8  (e KN %. .`%. .$. .9%.p]"hi$w(qbY Ы +8 +ʦ%.p]wm E1H8iZk ( +Eo +;[@`G% PpK$.]1 clLA5 'ee"Z\heeBx.&*wAIpŒj%.]C4YK\2p$.tŴtNI-Y 0 +$bZTd4P x{ w' w#JV5Hð4U-BJjZ,qA)qA,I[ Br*$.Y# .QCAYblqI\ZeIha Y+qA.T6.b|` CJiAbZBb#qb)0%.+v$.H3Nₘa T̥4[dK\OiH\,l7(qA Qf`F,Ҝ83I\\P*J\aHL)Є~l"` y'qAJ$qAJj+qf kO€b7Y8Ҵ x: 0.9Ld҈7 6Sx3J\lpQ4) x$b fnMx@x3]LRxi7JLNLq&q@z=Vq@{1[Eq@|9F `&"ULH4Z\6_cSD93EɌaݗf~;L_{ilc~rkCft7JM9tQM1W# hFb*tY fgf3֋H(ȶ9VCjL?bi1u"rQ̝z[d^m\6vc6wh\o>]Bo>^~ݷ_]|Q& (qVx*~ʃۅUo5!F)r+(4D\:0[|DND mLU`=0$1(sX*zj0d+ +fYl08΄=!W@n9O:c 6s!BX5lY^g/ex\DGU)o 1̙7 kL<(#e]&տ{mI#i#jI@Y13֖ Efl@7|]ݻ|Y'&BD\`c:5T[`pbfnz>"0FǀЖ?_^"o'8 x6LdekO 0[-NStWJI+=t0ޱ-t$l` P1Pv#j`o*Ltk1e-O۰9"&xB#a(t7~ftJ>jk5"|LZ|X!R,\.A `xo{<\9"؏p2آQ}I׸'\ RRQ||z: 1i>`,t |doklF$:BLz]CGtɆ7 )ӿ("9$lHH. +} +61 ,۬3CJUfD|?h>k􈕋4s yL٣cҢ]@975?4\9 !=^{uE`@pȍo^ |'4\:MNjX~klyD5{z}VXQ8H6tN91[: ҲEW{'@t~&wNn>k1;F^߀G+]R91Ä8]>MPYOOKM Ҝ "A ]aCzTyYd{"M'/L{&w(W߂H_`x0sMtD삈9kg*Mg/LJ՝T] +Ww*~ ̯ձ%,QG8v@4sOOo@$Ty+O+ofeYwO0Aw:\fQT9>9DB)]x#pv.3?/hwv.!KS|De5><8sx~)#(m߽׳g޷(~LknZ<ӘyxJ|eZyo̶ O +_\wW5 +Yޭ^{VH:$d@יQmȍrQLkf̞IYsn^+v5Kw㰺kό͖/w`rF 4w< )|`dOQ9 i]޼ryC*-_=Sְ[@lanu#\VϑIҽ0IF&b +=8rxc6cyYV؍:i'D5 +-, +mG};L]kpvk8uW߈7IyqA@)Mo#~]qPZEN}={"^{_$F䔀c}yD&>`Z3{$ys5_-sjwj[h-9~{m6pu?x +B߶s|NO}]{6%{}&iL'5s@%~NP<mk1 <e]wza: 1,k~.p۬1zk4e= +ϳ+u,ab#(tXq"ؚuvz}~W 62lΏ?u2sya,(HMyup0d]VuwfKo%&}s y@9&\5qKҊݘ_pRgמGz} +bCk>gsOǗmuN&<߲*ubʖ!cU@QNKy ySPȧT?5vkİG'cYfR|լ޵J?kG:73? +YKL<ݕMheH-o{=o +w4Ɩ߮%L_0gtc!y ja7\_М>!֟?_lNbRZɞ`QuNJR8ݰ]|{b* keb]Rt +f!6o-*>U{nb~ז9Ls^>]P-Ϣ55EFQHt+$.+=$7aJ<DO1߽4_z*\)J lƈR֩O>l߉/> +} +gBj-+^404gсQ/RfqRUzU+YFj塰Z1eX0۶IZϤ[r[H&k11IXMA]3STWž@y!v2T.ݗr8|nűO{K g4J )5jH+>OyvpY4>]~LӜ%odqwdC/%ypBd}4(2lu WI5PqkvU]Wbs B_۰]ki!|Zbqdo}Vᢽ\FuJ6E⊳)6h eSa-d@g]u5T\fۢgtM^;VFzx}qM`i"}nXZOteΡ)omR5cSFu-h#MUYt( +]@gY)16,'b)׶}+}+3^8@swkK&AZ"u5'Ͳn{mmjHj*{عV \iäQ/LD6vwRǟڌ.5Ku8y ݡx{g$ MQjԡpK@X©4ﾐS.#u^K? tX>(h +endstream +endobj +317 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 316 0 R +/Resources 4 0 R +/Annots [ 318 0 R 319 0 R 320 0 R 321 0 R 322 0 R 323 0 R 324 0 R 325 0 R 326 0 R 327 0 R 328 0 R 329 0 R 330 0 R 331 0 R 332 0 R 333 0 R 334 0 R 335 0 R 336 0 R 337 0 R 338 0 R 339 0 R 340 0 R 341 0 R 342 0 R 343 0 R 344 0 R 345 0 R 346 0 R 347 0 R 348 0 R 349 0 R 350 0 R 351 0 R 352 0 R 353 0 R 354 0 R 355 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +318 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-220) +>> +endobj +319 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-221) +>> +endobj +320 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-222) +>> +endobj +321 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-223) +>> +endobj +322 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-224) +>> +endobj +323 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-225) +>> +endobj +324 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-226) +>> +endobj +325 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-227) +>> +endobj +326 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-228) +>> +endobj +327 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-229) +>> +endobj +328 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-230) +>> +endobj +329 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-231) +>> +endobj +330 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-232) +>> +endobj +331 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-233) +>> +endobj +332 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-234) +>> +endobj +333 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-235) +>> +endobj +334 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb9-236) +>> +endobj +335 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-237) +>> +endobj +336 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-238) +>> +endobj +337 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-239) +>> +endobj +338 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-240) +>> +endobj +339 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-241) +>> +endobj +340 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb9-242) +>> +endobj +341 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb9-243) +>> +endobj +342 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb9-244) +>> +endobj +343 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb9-245) +>> +endobj +344 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb9-246) +>> +endobj +345 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb9-247) +>> +endobj +346 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb9-248) +>> +endobj +347 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb9-249) +>> +endobj +348 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb9-250) +>> +endobj +349 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb9-251) +>> +endobj +350 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb9-252) +>> +endobj +351 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb9-253) +>> +endobj +352 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-254) +>> +endobj +353 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-255) +>> +endobj +354 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-256) +>> +endobj +355 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-257) +>> +endobj +356 0 obj +<< +/Filter /FlateDecode +/Length 4959 +>> +stream +x]ێ丑}ϯg!0.`{uCWNE{B)^RR5i U '"(i?XJlr ||=|2S3Vs9$*Sp~=a鏿:}cn98,ELSL1eKJS( V3|dۢ38' v.)E fGKۢ 3\ }TLN)~ +9;]V"ltZ"[o<|lVaF+-L)jeP "ie8NVlZ[L0V+4ղ2bږ9'VfMR00H!*eZ[<lahe O1%e:dje8Y--|\-&0&%\g D'N '4pOrxE-da ce2k\@ `cҸ h\@[6j\@[66h\@ \i4. 0.(P8H=j\@`]i\@]4. .50xjl5.;Ndi\]&j\]L#qFuR20x%0xE,Nqw%hq0xױ (Ǩxp`5.G# Ph\6)sl5ٔkO-˓qeޢ'BָwH}& <Ӹw-Ske]Ѹw7x "иmUdrJx.hi\/<&Q Y @ƓAqA½g xx" x0 Pr A2NƁ)2a kLM BK QӸ $rAゐ ea±׸ <(K--YS4.sD[2h\`ѷE RԸL6̬qAzU+ nJt%٨qA<[ KM ^$0e5.`h\W4%\+AtQfD$eq<4rItVF̤qA0Iq 2M0Z[@`|$ A4G--YゔIゔ`3N`SͨqA6لId @(3FlM`^J4.do"Sm fԸ 3lQ2؂)+|줕2k\C|3i\0&"zuI I`& 4h\䛈lހx}D|&8b`@U]20^xHDfjBkeE<N>KTp)EfL Ft_svqu}=} j^)+?'X{".cAW\ht1ҩ0=:bDH Z\Hb|dX,6[3q.2zXQRi+D9LB=/`vTyhHb(;NLDW'i4]uD>~'/٩qZ)3VUpn9vK_oґ,[ n?}G~WAXTmUkCemƘ|Xc*ֿOȒ8"z VuJ5.I7pğ;VƱcx7Ǚ+3s[Ĭ4%BG3ZT݁ڠ` yRI`._45j*.B!"D$Su3:3DŎ6CCU'iq; _n&S]H@M踶{`Ji +(y0l<80+= ޛRӭGl +Qw` cyY@""A%$Vlr<۶xV{P-sSEm0Rޠig|$V P殎}6VYj[TP'sBtiC*4y0':sjͥו?G=kmXVeZdLi>Omu_~? 䶕#Nd}̉(;3ۣx~|4y(ɋ* #ZW_=mH&>I)W٘`c\HΌG$:&/@P^ZU?>(VaL0,#XWZL~ v BiEgY d;%&sLP= < Ԣw7o<*SX_]W>v/=$)#I*ǣ +% >qˬwStPy x&4]@Z^?*j~m^J.N?l½A2/-ȇ"֕ycIqyåO=y#8L,1l-31iRbGey1ٟe1g'&l@x*w³.ޮXwV$KJWoށd[JWQo`4oT#Au,#X8$Ԍ|ogPyDHH8*i&Jyw+b E|4.w# \S=dVN|t\&;cRHzmXB3حXLv˷PM as[MXiB&mʹ~u!]g/ rBt+}Uy3UFQJ}9qRD"ƔY˻QdT\SDzR#Y͔uJG4תtsP2&uq$mį'} + z!uVq2 /MS*L"7*| +,WH5"sםCez@؍uX1MF9_H]{l%\ۊ* ++Sbkb_7;}ƂkM*wXGʆZo"̎oTibY*ufH2[+;cdǽvݜ#dA)"5eC٫wܺL & aNN踣& wkn{9VևU:K]k KǦ9!!Gq +02j.U#9tqWî,[)]/s?$mu]!ʸپ";!0}lFwO_<ɡVj^Z/Lt)͇a}X}͏JzEܣ䴩B ^-'Q.UQTY1¢VeR1EiߏJDߏJ؜+W%ՙvf%" vr;l6.]7CBLMS3;vVW0lj[QCo3)pDNݒa5JFY[pLLdGMxEA_UU;QW'K:NrY,(|IЛk|μԒV'F +C +endstream +endobj +357 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 356 0 R +/Resources 4 0 R +/Annots [ 358 0 R 359 0 R 360 0 R 361 0 R 362 0 R 363 0 R 364 0 R 365 0 R 366 0 R 367 0 R 368 0 R 369 0 R 370 0 R 371 0 R 372 0 R 373 0 R 374 0 R 375 0 R 376 0 R 377 0 R 378 0 R 379 0 R 380 0 R 381 0 R 382 0 R 383 0 R 384 0 R 385 0 R 386 0 R 387 0 R 388 0 R 389 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +358 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-258) +>> +endobj +359 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-259) +>> +endobj +360 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-260) +>> +endobj +361 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-261) +>> +endobj +362 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-262) +>> +endobj +363 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-263) +>> +endobj +364 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-264) +>> +endobj +365 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-265) +>> +endobj +366 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-266) +>> +endobj +367 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-267) +>> +endobj +368 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-268) +>> +endobj +369 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-269) +>> +endobj +370 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-270) +>> +endobj +371 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-271) +>> +endobj +372 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-272) +>> +endobj +373 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-273) +>> +endobj +374 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb9-274) +>> +endobj +375 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-275) +>> +endobj +376 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-276) +>> +endobj +377 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-277) +>> +endobj +378 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-278) +>> +endobj +379 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-279) +>> +endobj +380 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb9-280) +>> +endobj +381 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb9-281) +>> +endobj +382 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb9-282) +>> +endobj +383 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb9-283) +>> +endobj +384 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb9-284) +>> +endobj +385 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb9-285) +>> +endobj +386 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb9-286) +>> +endobj +387 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb9-287) +>> +endobj +388 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb9-288) +>> +endobj +389 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 116.912413 177.650223 101.912413 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/installation) +>> +>> +endobj +390 0 obj +<< +/Filter /FlateDecode +/Length 4970 +>> +stream +x]M丑ȳIF 0`{X kCOME= ePYc Օ +2 RLw\RO/֤`oʱo +Wg9J(TOz>uߥzSJ.\EL)٠$$YGJR&%#%6) .9hI0JR6 kI0Õ$ga֪i02W\04L5-!%c YKcuZZ-1[- 0夥EB[|N%Q;EI˰jl:- %3ii6M6 &iQh4[ EM-0~4D[n䴴[O4>FAFxIY#p欱pJр/p,IiiD@-*qy؂ ϤqmhѸ@lӸl]Ը@0j\@`\ʑ5. P.T4. p.;5. .{Ҹ׸@9j\@]bg5.`.44k\v42i\]r6i\]t#qZQ` ٲ C i\] z G 7- X 0#͓pK4.]W0)}le\.Quͧj\鷨eb,.*Ҹ wAYp5.]G4j\qp4.ftմblY-y 0 +$jZ2Ӹdl,P "x{Ѹ wm Ҹ w-Q` eq*}ΪLwC ki]kSѸ weԸ &q 41))E bH˧EqAP[8pM5.H$[2h\[E0lq¬qA +1Ԫ teqAJl0; 02^wI4[U4.Pdg9'[xHsNa A ϘeFqFh%QZ[gf 2G#&i)4и#q&?lb +qA^Y゜a^`SIba <> Fd @HV2曞5.@fָ|S<2L-.[4߂0;iie5.&!8$9Ct ws6v_{]jGX"AWf+pGvg"=7<}E%"莭nL<ac&v_pi\ +=m x=D;^ SCs,|h'kX؎|A >ɿadMf-T1,JYoͬh IղśzFŭs-G`*}ŏc ib>vYJ;!vpbPs%a_Ɗ5~ۣ9e6c63Z0t ^xIm ȻypM왷_ Z/29h*idkTy Wu,{Ϭin>\V͸!چ7&k{R =d{VϦ~lMuAӀ-[UOr2m|Lb~\e;]kk;!7KHJ0sRw&v,'t*`U&>8nÜ竹M^V6Hqfr*t[Vc iWew$'_4{G{υ'qo[ƭ q?A|MQn =w?]󆊆6{5v&5u-;oЕ /Zl{foTN23UyNyHvĕdt9woˮ2[0SҪ^)H.:7B.iNyo]eStYSߘ]_hYأvki&}DOtm̡%yjQsr11IvBցх+\e펩jZ'j-Sҿ5ViVr:5oz8윳Y^IyIU-e=φ3Z|tV-W". ǻDw'aĹ i<8ƱdG_0MNS7ncVKdҙB-e>~` +endstream +endobj +391 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 390 0 R +/Resources 4 0 R +/Annots [ 392 0 R 393 0 R 394 0 R 395 0 R 396 0 R 397 0 R 398 0 R 399 0 R 400 0 R 401 0 R 402 0 R 403 0 R 404 0 R 405 0 R 406 0 R 407 0 R 408 0 R 409 0 R 410 0 R 411 0 R 412 0 R 413 0 R 414 0 R 415 0 R 416 0 R 417 0 R 418 0 R 419 0 R 420 0 R 421 0 R 422 0 R 423 0 R 424 0 R 425 0 R 426 0 R 427 0 R 428 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +392 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 797.673057 101.433071 778.923057 ] +/BS << +/W 0 +>> +/Dest (cb10-1) +>> +endobj +393 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 778.726036 99.933071 759.976036 ] +/BS << +/W 0 +>> +/Dest (cb10-2) +>> +endobj +394 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 759.779014 99.933071 741.029014 ] +/BS << +/W 0 +>> +/Dest (cb10-3) +>> +endobj +395 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 740.831993 99.933071 722.081993 ] +/BS << +/W 0 +>> +/Dest (cb10-4) +>> +endobj +396 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 721.884971 99.933071 703.134971 ] +/BS << +/W 0 +>> +/Dest (cb10-5) +>> +endobj +397 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 702.937950 99.933071 684.187950 ] +/BS << +/W 0 +>> +/Dest (cb10-6) +>> +endobj +398 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 683.990928 99.933071 665.240928 ] +/BS << +/W 0 +>> +/Dest (cb10-7) +>> +endobj +399 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 665.043907 99.933071 646.293907 ] +/BS << +/W 0 +>> +/Dest (cb10-8) +>> +endobj +400 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 646.096885 99.933071 627.346885 ] +/BS << +/W 0 +>> +/Dest (cb10-9) +>> +endobj +401 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 627.149864 99.933071 608.399864 ] +/BS << +/W 0 +>> +/Dest (cb10-10) +>> +endobj +402 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 608.202842 99.933071 589.452842 ] +/BS << +/W 0 +>> +/Dest (cb10-11) +>> +endobj +403 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 589.255821 99.933071 570.505821 ] +/BS << +/W 0 +>> +/Dest (cb10-12) +>> +endobj +404 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 570.308799 99.933071 551.558799 ] +/BS << +/W 0 +>> +/Dest (cb10-13) +>> +endobj +405 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 551.361778 99.933071 532.611778 ] +/BS << +/W 0 +>> +/Dest (cb10-14) +>> +endobj +406 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 532.414756 99.933071 513.664756 ] +/BS << +/W 0 +>> +/Dest (cb10-15) +>> +endobj +407 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 513.467735 99.933071 494.717735 ] +/BS << +/W 0 +>> +/Dest (cb10-16) +>> +endobj +408 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 494.520714 99.933071 475.770714 ] +/BS << +/W 0 +>> +/Dest (cb10-17) +>> +endobj +409 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 475.573692 99.933071 456.823692 ] +/BS << +/W 0 +>> +/Dest (cb10-18) +>> +endobj +410 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 456.626671 99.933071 437.876671 ] +/BS << +/W 0 +>> +/Dest (cb10-19) +>> +endobj +411 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 437.679649 99.933071 418.929649 ] +/BS << +/W 0 +>> +/Dest (cb10-20) +>> +endobj +412 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 418.732628 99.933071 399.982628 ] +/BS << +/W 0 +>> +/Dest (cb10-21) +>> +endobj +413 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 399.785606 99.933071 381.035606 ] +/BS << +/W 0 +>> +/Dest (cb10-22) +>> +endobj +414 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 380.838585 99.933071 362.088585 ] +/BS << +/W 0 +>> +/Dest (cb10-23) +>> +endobj +415 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 361.891563 99.933071 343.141563 ] +/BS << +/W 0 +>> +/Dest (cb10-24) +>> +endobj +416 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 342.944542 99.933071 324.194542 ] +/BS << +/W 0 +>> +/Dest (cb10-25) +>> +endobj +417 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 323.997520 99.933071 305.247520 ] +/BS << +/W 0 +>> +/Dest (cb10-26) +>> +endobj +418 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 305.050499 99.933071 286.300499 ] +/BS << +/W 0 +>> +/Dest (cb10-27) +>> +endobj +419 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 286.103477 99.933071 267.353477 ] +/BS << +/W 0 +>> +/Dest (cb10-28) +>> +endobj +420 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 267.156456 99.933071 248.406456 ] +/BS << +/W 0 +>> +/Dest (cb10-29) +>> +endobj +421 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 229.262413 99.933071 210.512413 ] +/BS << +/W 0 +>> +/Dest (cb10-30) +>> +endobj +422 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 210.315391 99.933071 191.565391 ] +/BS << +/W 0 +>> +/Dest (cb10-31) +>> +endobj +423 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 191.368370 99.933071 172.618370 ] +/BS << +/W 0 +>> +/Dest (cb10-32) +>> +endobj +424 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 172.421348 99.933071 153.671348 ] +/BS << +/W 0 +>> +/Dest (cb10-33) +>> +endobj +425 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 153.474327 99.933071 134.724327 ] +/BS << +/W 0 +>> +/Dest (cb10-34) +>> +endobj +426 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 134.527305 99.933071 115.777305 ] +/BS << +/W 0 +>> +/Dest (cb10-35) +>> +endobj +427 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 115.580284 99.933071 96.830284 ] +/BS << +/W 0 +>> +/Dest (cb10-36) +>> +endobj +428 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 96.633262 99.933071 77.883262 ] +/BS << +/W 0 +>> +/Dest (cb10-37) +>> +endobj +429 0 obj +<< +/Filter /FlateDecode +/Length 4533 +>> +stream +x]K$ s+H!F6HEc;A0䐿%=8 ](D#j dv&"_p&5M,'\9\%J)^//|.\˸7D_ +ɤ +e)LJ>D+FHyJPK jYaeAYjXcA WBRXBUyP2Wx.N;sE%\.8WL1d%4^.1[]rxP$ω4^.S^.򠋍iB&̬ +x6yLDV9g|TF%PTt d#Rh2ɒxxXA_CMQ #aOp񬁀d8sPb8%``8Yw. cXaw=a w!AO V{ ɂY*pb XB%kXcИK5[gf 2G#&i)UtLhXd;hX&NS[GĈy̞B9ɢ >ʜkdCJv#b7&Lu3[&G?}_~ږe=p]3AlwyXtQ6Ow}, lP< +V@H>-3b<ԡ /,0y21o}ۍnc:6kͶI.KD}gЌl<ڇ$NcLGB;#6<3!9:eٹ~12%MII,+L%51 qѲ:j&/+c͝.8M.EK`H<1)yFEy`).g9 G]>&s.P"}zTc#Y ljAKgdqw>h&}SV11 G1(sSF}߅~d|VvFyL!GmUlxI{ghpҠi&Z$>(J\{.0b]DJǒ_ !8>>fظC<7>a:AtMg "QQ>Z_4G{eYү_~˵$hʗÌɜ0ʮ$̻kNq!JAUg4vK?UB C1MN[-Q>kfzI>!tLOVx J?&tlqNnO _B sH4ac`o׺4U"gwuYoR%EzdW:JZEYsdY1ɾI}V|>ujN맓V>/ڹ pCHW/瓶/vL< ALHr`j9a1M_!h;\ѧ<߮7wE6f++p|@&]4I`7AhVһϪCx!ıɝY8ux~:Þ&zP4Rb̺Һb3PjDu}8 7ճEcBǸ(Zkx墈@z0$SjZᖊq1]5!/ɾ, iaTKۭ&G3&s ?=ԟA쓿(W;\E)}9Og}&i݂zkS W?\wd1Ә`%LM};z?fXLht3d~l4p]$ogU/}=_,\s̵ܧȁLVuqvx`c8:CMmmAx*o'(eoƹLڊ7f]wpTn)1(Y39ق\-ҏڽnw#9C+%ga.d/$(#vmrcK~ȵN YO mI +?KBC}UL֡$zkX!B2=Y,WgCSlXuqK!Y.İ'ڮ,WԲ, 6skY:sD|YRU\Z dQTiPK6pBz(/lZ&݈:rSHO\[hJT^DKE)WhS$wwcR&G@5otl;%$tX†z=z9_Ь4K{Ш<ͥiiDf#;dž:&u|/R^@n=v]S H5X]FӰ'ڪ[ȡP 5]ջc瞜ŝmv>_OS`-Y\?F|@눋bD,_.LO_0)xɭ#9Tώ?(k _WoqoZ+r +ȾwLxŖX,H>juHN{7-!U')tpwx+c`Y4[)7Һ^?ti<%UW]?-+}_=~gcBmި=PT.wVucZ %C5/bs7ʕjJk5SjLo^J-X{:Viz]YF-QKBiy;ldVhnT^JRu5^Edv ¿׌f@+UL+./"PKi|lr{-i<,~%q-lr2*> +endobj +431 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb10-38) +>> +endobj +432 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb10-39) +>> +endobj +433 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb10-40) +>> +endobj +434 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb10-41) +>> +endobj +435 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb10-42) +>> +endobj +436 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb10-43) +>> +endobj +437 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb10-44) +>> +endobj +438 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb10-45) +>> +endobj +439 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb10-46) +>> +endobj +440 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb10-47) +>> +endobj +441 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb10-48) +>> +endobj +442 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb10-49) +>> +endobj +443 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb10-50) +>> +endobj +444 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb10-51) +>> +endobj +445 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb10-52) +>> +endobj +446 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb10-53) +>> +endobj +447 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb10-54) +>> +endobj +448 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb10-55) +>> +endobj +449 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb10-56) +>> +endobj +450 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb10-57) +>> +endobj +451 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb10-58) +>> +endobj +452 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb10-59) +>> +endobj +453 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb10-60) +>> +endobj +454 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb10-61) +>> +endobj +455 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb10-62) +>> +endobj +456 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb10-63) +>> +endobj +457 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb10-64) +>> +endobj +458 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb10-65) +>> +endobj +459 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb10-66) +>> +endobj +460 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb10-67) +>> +endobj +461 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb10-68) +>> +endobj +462 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb10-69) +>> +endobj +463 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb10-70) +>> +endobj +464 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb10-71) +>> +endobj +465 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb10-72) +>> +endobj +466 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb10-73) +>> +endobj +467 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb10-74) +>> +endobj +468 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb10-75) +>> +endobj +469 0 obj +<< +/Filter /FlateDecode +/Length 4985 +>> +stream +x]Mo츱uaH?,$|aÛיIxL)HQREھaw%*UR]~r*zRbqP/.*orH3(|a_s)cV,G*X,mH`yb>`.1g5|tmYjĂ$  mYjhĂ&(j-v3^4zx֨"/gxD*DgxY|xă.RxP -M$^.^.$HLӖgW>igMyQ.A,'m%A_SFMDtAK`t1H$ 1*@&R.$MYIr!G H𬑀4t.HH@8\](; BXGZ$, HX@[MPSKX@@\JIX@\R씰QVKA3Z%ȃ.0` L" p8.`A؊)i p&$,p]D^T$aZK<7pzm%,p]l?Z/+a=x$,ɔEX"a 'i2) x+-lb$eS[h8(E2vb@ nQ7.FSv oиV_?|?P.ߢ(:t8Li8}~Z}w~巟=!|Cg,NyU'G!yeX{S}bW}iSO}owuzldt$(1AX $T>̠vw>Oݻ-|HBs3,BF(1טb@?!TtҘyL ud!ʞ7 z;n(+I!1tC`|^:m}eQ/&cWrO6)@FJ;Sė dL4b9oFȷOk fY@=7ګh$|34Ȋ3̼h"C1 ߐ DWjq^ a.O&aQPI+ty҇S)r]jex^< u6 '$D^g3#`ۇh3vnH +Pɮ*yB֡q#U1p޻"ΕH +&e2J^L80.k9ɇ;fUC[WlMP_<}Xn 2lIAѣfIqq ec~%Y/7cҍѥo:CFJeF98Ut,pܺ4%hI~1 +M2-͠yL$:"5Mr÷KK:dV_v?!x)k4PЂ@KPYaP;fbQ/NtP<yIitbBc6ʡ#ئ}Lƛ$H\u缷ߙG8X=lc21D$*Ek!.XdeҺiU=݌[m`VVnwa )hD`Eeca 4ޅ}<1ε?un9unEBuZOkxidwMqL<dY҇nw_鴽S٣UP׾uƻ^e' ?9 r3zoxP< |B|Ƴt1^ɐTh>M8`6|J5{neN^Z| CR7#j!+u1ṾbQ|V$՞VnEyyzp܆(g҃21i~%! cLzD1+7;]/od[vdfܠ6zsl1K#yYtnj_l&cC<3ExL(s#rǥ·uq[c.|+o,fxC9*{lc/yL2kޢңl8w#/{T˖ƛ \þKNVo+JksO*{ce mn&i :k~Lw ixƟujyf ly;RwPT,>Ps_j2+d≢ˏʎ즼Cf^\W>iךה1;egR$ͯDe/c~\Fۻt!Қ|wU9 8}\kE{D%+=}Wհb8/Gl"$ْ2MGC/;p%3on&m_ss}әkY|tA>T~P=Um]:rZuk$.]O4~k1UCr\E,7ͷTEsmY)h&jvcDS$ȜgӅؐ/> +Wԝe7 J *|2/5⽶磹l881*cپLByV؂5YG cI6!Oʞn&f oCVY0vޙv>zGWSqlnMfO̩k5VYG(F ֆN~q.7g[~VP]T_pV7 [ޓ{ XmtD:؟&e}ǭzZ45܆6ӵ/V/a^~Tp_~GKv]:v8Oîf7۟UtESПؙҼGP}R9Sۅ1LrPY_B\ԍ=jA<4-zi +RWiJhpvXu +XmrIlb}+}+aS[=^@78_KX2 K7KRmv˺vfEYoJ +^3vn2T-3&/;v&p' q +R7qX9LFkBw(G7*<ݩ[e1~BTc L0738U&raT> +endobj +471 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb10-76) +>> +endobj +472 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb10-77) +>> +endobj +473 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb10-78) +>> +endobj +474 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb10-79) +>> +endobj +475 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb10-80) +>> +endobj +476 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb10-81) +>> +endobj +477 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb10-82) +>> +endobj +478 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb10-83) +>> +endobj +479 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb10-84) +>> +endobj +480 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb10-85) +>> +endobj +481 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb10-86) +>> +endobj +482 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb10-87) +>> +endobj +483 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb10-88) +>> +endobj +484 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb10-89) +>> +endobj +485 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb10-90) +>> +endobj +486 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb10-91) +>> +endobj +487 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb10-92) +>> +endobj +488 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb10-93) +>> +endobj +489 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb10-94) +>> +endobj +490 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb10-95) +>> +endobj +491 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb10-96) +>> +endobj +492 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb10-97) +>> +endobj +493 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb10-98) +>> +endobj +494 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb10-99) +>> +endobj +495 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb10-100) +>> +endobj +496 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb10-101) +>> +endobj +497 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb10-102) +>> +endobj +498 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb10-103) +>> +endobj +499 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb10-104) +>> +endobj +500 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb10-105) +>> +endobj +501 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb10-106) +>> +endobj +502 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb10-107) +>> +endobj +503 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb10-108) +>> +endobj +504 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb10-109) +>> +endobj +505 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb10-110) +>> +endobj +506 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb10-111) +>> +endobj +507 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb10-112) +>> +endobj +508 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb10-113) +>> +endobj +509 0 obj +<< +/Filter /FlateDecode +/Length 5138 +>> +stream +x]K$mׯ Ń= c1,cCOy[0k`?F+3Yٽ=t`2xdƟ JdTJ9~|*zJCaMQyCןࢊ_/k8z\g]\9XYTL1j/2X8彊 QxŜ%,YbPN^bA 6 1E 1l4$ > +,!Z<xƫg +),"x&Z +7/O H<Y!KQ"ċB;Y%J"蠍ND^O<9-QDf)Dg!K><❶A.$V˳ig$,Fy/! E Afb\0ƨ([@&(QP(F'^QQ xH@4d$$pfȃ,.B9bIXknIg#aޒ6AZu) S8`vJXQu>X `Q +8#%, s) Xr&9 댎pJXQU alEٔܵIܵ.@E9$, xswVZAh1B@Y'aSak2ܟ0Vʤ$,]0|"/+qaBʄ%,]8*'a>xj%,]%pج%,] ^2$,SFtE^V:$aJ' ȋ +d$,+8T‚܅{IX<⒕q xœFRH<6a:f pݦ!2& Bl%,T1HX! +^‚A,Y(Uv9IX-dqJX-dA a" o1=,01? ȂHQ JH‚1hUR\H +HX\J%Lz % x$,`HXWEd. dA-a"] YȂhP‚d̠%,F. UK<Ҝg& š&4"&$,p%,@diȃ,Γ)YN7)AM7YCD|dZ‚lMK`^r$,N#D'Q‚L#DyAS-0 &Ib3IXC|3IX0&"zqI q@&Ed$,MDRn>">3$h@o 4*k9h1Y ilh ӼD`>3E~ɌiA{1;Ŗ8_R)b3pJsd" u.Ba!bBb]tc!n`"Cb )oFs Y7 Y"R,B^iس>\sCMoQҺ1 cdMɒ$|㬀R.[KdV/qAV_?t@^/ǡߙ_O/\1F2pf(Qg_iѵ˺lp(3!fًc&)Tn*A{5YoyZׅ[Isx O2P]:܎L΢sU5p&"R'J2@[ck>y~adumɀ6uOFs Hߎs%nH~ +_́^ \ȑtj.Kp*4s:S~dutݖ@_֖ʵz}nsB=ei+Ŝ62dyΕ=<[rVlv84WJe 籎y%GsD`E%#6-eyK .󥖥|kl-L᥍Pj8Bx_ǡy@x=`<9X^B97ԟ]xۢp[ewinYDz'`y;_}x~3)oI 6\!}<!PeI|q*֬(d1n(8ƽ[wKq3&NDʽ$H~|bk7,21?Ǘ ;T\1?0 { h~=Ӆ6a2>c=\XOwT.0^9SgrɐwOz$vR]v|aeL?6s˿>{_~*7Y- (QR&"mpϯlUo m;>E#2y/qkV3-u1gA C[~ؒ^Gcv% ?T\Tg[e߷Jُwv v覻I3{JYOW,LI;1hzdϾ^vu!6 y!-FOkuqe<#v|rz}6Tޯ#UX\3V6[k}ϭU;ٶman9=w{kkYroðJ_菳DlO|{:~hfx;ݓo {pnO_$:7k9m|>.Vr✛;r|azGOn V,XPخCbڞZhTl@ʕ'G*?WV7!LtnzQTgS4"_|ۖ[!b4Ó #c;qds3v'Vl7@f<%?wGNUyۈt׺0-8my5'IYdyp=Yy]⻾U';7MMVwV.wC̟ H| C| qJa U(vfu߹A/4CAu&<2*׍\|oI $̾E[ y߻Ğݘn\F )w{k[/|~2}2TSBē>(⛯hJ>,CO3/|>]g{?_F&:,r0.m|Ŗ|!?I$r`rocIw7%u۬$?q,R]JPm\Me!_خ\Nl%o=NJ+wcxo4sS|^IP1Z20?]8|w,+źo_/jDʞ$3{[H~vDD%W{㼬ko}?ArYK5ٓ큃_NէEAh;q4HsxH5A{d2A+k9]YufVi8o^ RTpkiNsPS}+8 E ~[ӄil/L͐˭@]r5G*RiTMCa.u J 9;mfrhcd7vG]SҎPоLtSA +SwSyIw*f'4CG4`(Lfg} t؊:lc&nuӱr&&dM<}z; f2wбL} t۝loűі̦Z'Yx3DyBn_2j?I&y寗c C{PoKhǭha;ȳ'߸N704b6l(5t?n4쭤j:w&ÉlZ&F=c3LsM*<̯4xn$p*anSyH ry(x_h~~tGM7ZyB`7? ;+y=~WCLީ_gj1v)'@ +endstream +endobj +510 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 509 0 R +/Resources 4 0 R +/Annots [ 511 0 R 512 0 R 513 0 R 514 0 R 515 0 R 516 0 R 517 0 R 518 0 R 519 0 R 520 0 R 521 0 R 522 0 R 523 0 R 524 0 R 525 0 R 526 0 R 527 0 R 528 0 R 529 0 R 530 0 R 531 0 R 532 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +511 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb10-114) +>> +endobj +512 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb10-115) +>> +endobj +513 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb10-116) +>> +endobj +514 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb10-117) +>> +endobj +515 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb10-118) +>> +endobj +516 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb10-119) +>> +endobj +517 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb10-120) +>> +endobj +518 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb10-121) +>> +endobj +519 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb10-122) +>> +endobj +520 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb10-123) +>> +endobj +521 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb10-124) +>> +endobj +522 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 282.924714 101.433071 264.174714 ] +/BS << +/W 0 +>> +/Dest (cb11-1) +>> +endobj +523 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 263.977692 99.933071 245.227692 ] +/BS << +/W 0 +>> +/Dest (cb11-2) +>> +endobj +524 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 245.030671 99.933071 226.280671 ] +/BS << +/W 0 +>> +/Dest (cb11-3) +>> +endobj +525 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 226.083649 99.933071 207.333649 ] +/BS << +/W 0 +>> +/Dest (cb11-4) +>> +endobj +526 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 207.136628 99.933071 188.386628 ] +/BS << +/W 0 +>> +/Dest (cb11-5) +>> +endobj +527 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 188.189606 99.933071 169.439606 ] +/BS << +/W 0 +>> +/Dest (cb11-6) +>> +endobj +528 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 169.242585 99.933071 150.492585 ] +/BS << +/W 0 +>> +/Dest (cb11-7) +>> +endobj +529 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 150.295563 99.933071 131.545563 ] +/BS << +/W 0 +>> +/Dest (cb11-8) +>> +endobj +530 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 131.348542 99.933071 112.598542 ] +/BS << +/W 0 +>> +/Dest (cb11-9) +>> +endobj +531 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 112.401520 99.933071 93.651520 ] +/BS << +/W 0 +>> +/Dest (cb11-10) +>> +endobj +532 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 93.454499 99.933071 74.704499 ] +/BS << +/W 0 +>> +/Dest (cb11-11) +>> +endobj +533 0 obj +<< +/Filter /FlateDecode +/Length 4832 +>> +stream +x][q~_&Y0΃/ y95CRI-ٳY! fUKUj2;sI/?\~Xşbb)\d+1BdR >.⯗o:M)ѻpdRNUV&%ŠKX#$e%%12 N1|r +!),g!֪<b+<LĠG睉x.yGdbb+&cu/@ƃ,L9iY(UyD/A) +/CXWVyF4^!JfVyXaw=a  w!A V{ ɂY*pb XB%kX Fd YaAqg 0/%7)P|3iXP(* h*ʼ&!:iY|a Jof f DD. d7\ Ȥ񀻈L@V-7$g:3Kƙ ꒁ[%u|%GR &2UU0U ,o04.QECIn`Z0sbtm}3/siu0~(u) 2SsΉHRGH  W w[[ Ef`f3E*Oy'Y1BȋA(?"J?C}Ti^RІ ʹh6pů>Y=$EGgE/lQx ~AnDJ˯ӿ 郄~|88Yrnϖ>|/t?s +~=/mJuo?.:zqN7D>X7 +xߤ È4zUViݠ. y&;@;syEf/Ƴh2M]$=U/hn +ѰO:1 0EcG q@+e[lme'-qs}^KVQkn']DOY!fy=xl lMN):qUgݦա\ K>#[Q&9_!,ƞ<~l +,]u|g_zi(oI»"ɋ 18'+>}{*w.zk}YB.wze+!$"-M5Iֳn6'񀴔d-Q_0`ʜs՗bUS64yeӕ' e6V4-6C0&e!/K{C~/=]ޘLA:J>%*!~96*[ =zp/1sݲmmwC[ȷ݋͋-hDZtJ6 EcN +Xm{P{iTrp͝vo G~JGط +즾lFu?#oa*Xwuuc<,oy":Էyx6\Wvz뼮xG-霃M=GPoXUа̶yg#`r̾q:1>y+˻B\ڒ꜓fȗ0f8m_7;ۇ_<9X<-r lQ>7hN_<ɺtj ڶG/d1*eLuN2dr+ɓV7=ts0=\m{.#t.px)uΣ9fAwur*.%:f:Qarj7|Rw9,˳o,l ;4J@|[\J^n;:1"zGmXF^IRnUF֞_Ndn6rFzl8N0\.fxltu.:[ӱǒ5@X#V!]'fʯ r3l,CkcבƝm6_/c5YL?N:YvWi .@;N:[:[ԯ}i</!p$'Gё/?ֳ4o~l7l]GO&?1*MyNv ~kmZ5u;CÁzGȄė(@;%՛C7$Vp1.sQwסI\Ie?T(.Kl!IzGU5\ a\Rqwcӕ6P!0cNBE7OYXgP7Hm7&x:˸l>s#ڢaQ r/.FW SEQ4VZk1U\tYbN8aJ0j%nJhZFsNl/bɬXQJ˾]#S۫M7[έj@+UN+.ӧ%41CX~"q4xcQ8ƞD69i8]Knjqzb[zn%sv36 92I(?Ffd3:.L] +endstream +endobj +534 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 533 0 R +/Resources 4 0 R +/Annots [ 535 0 R 536 0 R 537 0 R 538 0 R 539 0 R 540 0 R 541 0 R 542 0 R 543 0 R 544 0 R 545 0 R 546 0 R 547 0 R 548 0 R 549 0 R 550 0 R 551 0 R 552 0 R 553 0 R 554 0 R 555 0 R 556 0 R 557 0 R 558 0 R 559 0 R 560 0 R 561 0 R 562 0 R 563 0 R 564 0 R 565 0 R 566 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +535 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb11-12) +>> +endobj +536 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb11-13) +>> +endobj +537 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb11-14) +>> +endobj +538 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb11-15) +>> +endobj +539 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb11-16) +>> +endobj +540 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb11-17) +>> +endobj +541 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb11-18) +>> +endobj +542 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb11-19) +>> +endobj +543 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb11-20) +>> +endobj +544 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb11-21) +>> +endobj +545 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb11-22) +>> +endobj +546 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb11-23) +>> +endobj +547 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb11-24) +>> +endobj +548 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb11-25) +>> +endobj +549 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 447.971735 101.433071 429.221735 ] +/BS << +/W 0 +>> +/Dest (cb12-1) +>> +endobj +550 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 429.024714 99.933071 410.274714 ] +/BS << +/W 0 +>> +/Dest (cb12-2) +>> +endobj +551 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 410.077692 99.933071 391.327692 ] +/BS << +/W 0 +>> +/Dest (cb12-3) +>> +endobj +552 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 391.130671 99.933071 372.380671 ] +/BS << +/W 0 +>> +/Dest (cb12-4) +>> +endobj +553 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 372.183649 99.933071 353.433649 ] +/BS << +/W 0 +>> +/Dest (cb12-5) +>> +endobj +554 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 353.236628 99.933071 334.486628 ] +/BS << +/W 0 +>> +/Dest (cb12-6) +>> +endobj +555 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 334.289606 99.933071 315.539606 ] +/BS << +/W 0 +>> +/Dest (cb12-7) +>> +endobj +556 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 315.342585 99.933071 296.592585 ] +/BS << +/W 0 +>> +/Dest (cb12-8) +>> +endobj +557 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 296.395563 99.933071 277.645563 ] +/BS << +/W 0 +>> +/Dest (cb12-9) +>> +endobj +558 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 277.448542 99.933071 258.698542 ] +/BS << +/W 0 +>> +/Dest (cb12-10) +>> +endobj +559 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 258.501520 99.933071 239.751520 ] +/BS << +/W 0 +>> +/Dest (cb12-11) +>> +endobj +560 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 239.554499 99.933071 220.804499 ] +/BS << +/W 0 +>> +/Dest (cb12-12) +>> +endobj +561 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 220.607477 99.933071 201.857477 ] +/BS << +/W 0 +>> +/Dest (cb12-13) +>> +endobj +562 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 201.660456 99.933071 182.910456 ] +/BS << +/W 0 +>> +/Dest (cb12-14) +>> +endobj +563 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 182.713434 99.933071 163.963434 ] +/BS << +/W 0 +>> +/Dest (cb12-15) +>> +endobj +564 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 163.766413 99.933071 145.016413 ] +/BS << +/W 0 +>> +/Dest (cb12-16) +>> +endobj +565 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 144.819391 99.933071 126.069391 ] +/BS << +/W 0 +>> +/Dest (cb12-17) +>> +endobj +566 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 125.872370 99.933071 107.122370 ] +/BS << +/W 0 +>> +/Dest (cb12-18) +>> +endobj +567 0 obj +<< +/Filter /FlateDecode +/Length 3110 +>> +stream +x͛Ko$ )ez 0A9@`C~ztծ7JMփ]Y+ Ưjm%݅BIfSLZBk5PZ%_/u]?^˿uCk9rTBPrT *bqT)Rbʎ*s#`F*^U`<0Cܫ̈S n8*&R8AϞ.rȵ +t\ ('t-St +[R#t $V%O[TjtHru%"ixWuu2kRAG{]R!O|S\V&)GaK\lIB lQ|{:p"IYVK%Ƣ`= [dXA1 E Z= +ڂ"bKAs+`K@(V-cD؂ D`KTX [<pcJ= 3cRz, <+`t܋u%@]њ=+@]tut U<(+LcXFcf5Jwc%Xn,\] X@ݘ DcQcXG  $?-EXBDX ܰ9k +\[X]>Wn1ʁsn J<$p 5z,H. vjOrl C` &kZ  ,E؅UՕGbq ġ 2y,.%%E`q tXΚF(% {:p4ܵmcA.&c ǂ\5Rǂ:|.' H@-ZcФU%cA!D1o7=-p7?P؂HcHjSXPRF>Qt9ZkWWⱠ ؊crP=%0:V,؊B= B챠F؂hcAYf&ءKb=cA,TXeLtuXd;y,@di-cA걠V)z,oZY<4-<4d8tD WQ=`]ZY=4!Hu$[Y<4- !-n$䛠˰%6Xr|z,@|{$P-,q]Dcno"r{xSA|+e=1 7aou nU3|-Gr `&2˚SlP2";&N# w(3klX~O/_c˛l'edK$6L7p$#`)q~L3i$m > fF0="S`Ldl/o-ZScoXSX,(%-;  +ew;o{t`/W<r +dƪC[VWoٛ(eئ^_ǥ޸YF[Էr|lV>S-0>}mh6x=-or|3w+wt@ cZb=:!9 pllEX"'W=/&14 Y<-rlk˾>lKcN Io|;K+#0MyZ l;|>7D:䡱1}dw9:!w9Or= 2b{m9?/8AOpR)؁J@a|? @~F{|8CFe[z9~ÿh_-kTS.l4eyYV|Tyf2#6|^Dk:Kqi^wY6]%&L7{&>AOMrg7_ѤCXyM<'5%Fbo6m)ږUj3yTz菲?I˴=e@{2i+)-y]v~gXd%k 6~jgD/o'jn>@۫D^61o/432}O~3ŏ{Cj/p6x=C%sII6/cOcSf'nJlgN!jfS]lo ] giC8ԵlpV|a[FqƜC8L_ecY9YJ3THC&QmHS/9&D<9#zӊe쓍vGQr[Kc(UgG~2]]xG.-߲FHQm\S]& .IJK*N4YA*!4eJKCev.loHCj.XKg;nvbksz#Zfex!qtG1b2dnAj(uCl3X +8 W~߅Ʀg~Lq4 PMW렓|/"v܇ϗmY;Y#eϿ.zc㶏#Eփx-B؅c,¨ ,7}<ƅ:{/Ƀ<01\qndYF&=#|8d~ v+ЍGd*ܬ:u2$ҡոT(n۴`9z_שkYӹͮMwKެ +=~&L:>tl|^a'8ۋrmTOC,zi!vt3:=l[G +endstream +endobj +568 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 567 0 R +/Resources 4 0 R +/Annots [ 569 0 R 570 0 R 571 0 R 572 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +569 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb12-19) +>> +endobj +570 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb12-20) +>> +endobj +571 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb12-21) +>> +endobj +572 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb12-22) +>> +endobj +573 0 obj +<< +/Title (Hardening Guide with CIS v1.6 Benchmark) +/Dest [ 6 0 R /XYZ 85.009843 502.818898 0 ] +/Count 12 +/First 574 0 R +/Last 583 0 R +/Parent 586 0 R +>> +endobj +574 0 obj +<< +/Title (Overview) +/Dest [ 27 0 R /XYZ 84.259843 413.481496 0 ] +/Count 1 +/First 575 0 R +/Last 575 0 R +/Parent 573 0 R +/Next 576 0 R +>> +endobj +575 0 obj +<< +/Title (Known Issues) +/Dest [ 27 0 R /XYZ 84.259843 213.933496 0 ] +/Count 0 +/Parent 574 0 R +>> +endobj +576 0 obj +<< +/Title (Configure Kernel Runtime Parameters) +/Dest [ 32 0 R /XYZ 84.259843 692.570079 0 ] +/Count 0 +/Prev 574 0 R +/Parent 573 0 R +/Next 577 0 R +>> +endobj +577 0 obj +<< +/Title (Configure etcd user and group) +/Dest [ 32 0 R /XYZ 84.259843 432.234971 0 ] +/Count 2 +/Prev 576 0 R +/First 578 0 R +/Last 579 0 R +/Parent 573 0 R +/Next 580 0 R +>> +endobj +578 0 obj +<< +/Title (Create etcd user and group) +/Dest [ 32 0 R /XYZ 84.259843 315.936971 0 ] +/Count 0 +/Parent 577 0 R +/Next 579 0 R +>> +endobj +579 0 obj +<< +/Title (Set automountServiceAccountToken to false for default service accounts) +/Dest [ 41 0 R /XYZ 84.259843 699.833993 0 ] +/Count 0 +/Prev 578 0 R +/Parent 577 0 R +>> +endobj +580 0 obj +<< +/Title (Ensure that all Namespaces have Network Policies defined) +/Dest [ 58 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 577 0 R +/Parent 573 0 R +/Next 581 0 R +>> +endobj +581 0 obj +<< +/Title (Reference Hardened RKE cluster.yml Configuration) +/Dest [ 75 0 R /XYZ 84.259843 500.493907 0 ] +/Count 0 +/Prev 580 0 R +/Parent 573 0 R +/Next 582 0 R +>> +endobj +582 0 obj +<< +/Title (Reference Hardened RKE Template configuration) +/Dest [ 357 0 R /XYZ 84.259843 193.712413 0 ] +/Count 0 +/Prev 581 0 R +/Parent 573 0 R +/Next 583 0 R +>> +endobj +583 0 obj +<< +/Title (Reference Hardened cloud-config) +/Dest [ 510 0 R /XYZ 84.259843 477.917735 0 ] +/Count 2 +/Prev 582 0 R +/First 584 0 R +/Last 585 0 R +/Parent 573 0 R +>> +endobj +584 0 obj +<< +/Title (Reference Hardened cloud-config for SUSE Linux Enterprise Server 15 \(SLES 15\)) +/Dest [ 510 0 R /XYZ 84.259843 350.369735 0 ] +/Count 0 +/Parent 583 0 R +/Next 585 0 R +>> +endobj +585 0 obj +<< +/Title (Reference Hardened cloud-config for Ubuntu 20.04 LTS) +/Dest [ 534 0 R /XYZ 84.259843 492.916756 0 ] +/Count 0 +/Prev 584 0 R +/Parent 583 0 R +>> +endobj +586 0 obj +<< +/Count 13 +/First 573 0 R +/Last 573 0 R +>> +endobj +587 0 obj +<< +/Length1 9900 +/Filter /FlateDecode +/Length 6561 +>> +stream +xz{\UUw^py? 8rP1 |d@ i)ȔLԌу433ciJʺ9sa vk{?w/]}>`G Y= b.O.,*Oq}2R>n]4_ȃY#I+b\9K l7]J-Y!)h3h6c3rJ@"o1wIȍ i?6Ϥ)% =sނǞ|Ϸ@"|lܢ99o|~XF6S?0g^~ORqQ`2KBMMv4ITЮoҞ' &B'uUuy"0}d +} l0;pV8ёķP7A +*KܱWf<@8,Vɶ汫?mf P)uuy|y[һǔ$(Ud8' +,NGkP? `>/7N|I)pR Ǵ'i6.]8PQ0ܯ EhvR  &}#XHK}>H9`vM[]Ca>;f<(ioo{(1n#=c&3)wumzȬYmoϜ(I<jM~ֻWFaiXeظz4L9mzg?e{*jSA+Uxo lq?oxK࿻VK-tO=ȿxbs ~ӂ&AP&Dii^/ڂY৉''~R ȁ.+O_/ 痗xwA +@o/B-w>'|(Yigm<-xR[xBx̎ n {8 +ommyV.p 7 T7 ZTS7X϶uzN +y3nv*ϸikVkOO=ի̼ډXEUyXItJ;r;Rr;>!B`@O-l.ò,/s|̊-Ȅ .h,i-X,H`8GlP>{8sΠN|y 3[p +"pIM|R N4//qquñN3ʏi_ A3GQ~82ć.0bz@T8!~Çx}q"p'؂'O66L6cPL׌}zy6bDy3{1΁=bݼǃیFb< kPb!4C|0$,0@ +얇$?]:!NڇmUşM64 +T Lhp2Md.Ql\̆ yYʧY o ^8O$mla>I`%,S(HQ+\[, d):ay앯Q1@./r)K|Cw +M9/rc5&a&[S ErSVNk/8YKeX9/V*E4mgcI QFvv:Ó%q$g ZJe OcD=핫!؛_M(`U(Ev5+.p>~VQ^yfZ½U[%ĻV4b9탯lC.~[<,ZHbF< f+(fCaܗ2(H*pzc-%L:=&F݁$V]&Eþ+KSDy;leZwKGxG\G9r-ٌa'OJ +umukܖHcp`_0F[MVSkV쎔<].uHlþAaAISXyl n2 +f__!^J6:Ͻ4qVQ\g=zq`3َT&B <`Px~Uc] ONhmMP'.ݰ$vEGR8"9/NfӞe↸clq6-#hx_xMT`ҵzyj OF C!MH8C +#'٣:wm|_n&KgR7@W% lFM>нO_IɳZ+vJZ5&E#fEv؉FD&wfllLLrDyD{~}?D\mEYs+U[>|7C+M rʟ~0,}կ u3M1eݛf0Zj ;嵯 @v10TbHa]jNL~xV+-ȤS8S z<OdfHfhfXfxfDfdflqʐЪ𪈕bboƆv-ZԵ ;4;,;<;8888""""=,y=*+$?)B!Y g҉O3g^|~#߳LSN>…t4:ؠ( Q%OV`` VgWXlȠJ-R MN7NH8ZZZLd9HP4 2q;赥/}K>wϾGiټ7/1JZpv;98Z?g{4mً d&pONo:|pΓ O&Fљe 1:*|!&hl}{HL >,zK짛:/.k{VI`ULwo%1pʡﷶPW?~#>_ޫoN1d2;}f#~@4ZRe{-LLRaN-,fu(ۥQd=K.]Zsa OvJھc]mUm{~޷NK+{ 5h8SeHWmC3Nf3b#׏uK}Nq~6gڹ vEh,9\BlMF3Y!3tץ,_7x-_lGeɤKRW'H TZ̗KuT7/J#7*M+Jcٖj\)W󧕵ɰ_G o~oĿ7SKb2c Ҝmgg,vV)~ !d08|A 1,U! j J] vOfݫtkD]uuTތ4=H[?(աao-DCµ{J?!~z>T6MϽb[}pF;GQu55uYlo]ҏm=X3hP\? cM7w :\ú3jSJ ,2PM2KOܷVn/s ߛ7&jq#Kp!nk]ꝳ_ofqBO +E'!EځtL4ckl4tJty=-($G Qa#{m{aб~}~D!Gti":np3י!ݡ3ZvVigC36HTgUw(}z{tb5l +6[Peellll1C8zz{uu#,.<.":TiT8(c3ZKoz0X1K{4<"n]\]͸nS%VZJwruuӻɧY&g?_pXN=أGVgdmGN$'OY@f(o'+U_|Q2It&VʇĎsЫ1 d[(әbV&VfUU|muգ=E؃dur`O^ <<-ݥ|JE5%q"[Q\0;A ;+^C-<-;&iٱ.v݁7qr6(pĵJ +( ޤ27fӝ=ޙQʚ 5p]FhlL** +iKRh$+v]qr ltHg#qG(uL`p@|. qe%dXM1RZIڊ|ԫoS(GMcN_٭YxvIh $daxF +7xǛ&i2̨gMɨwhV;Ĩɕe[G :ĀgGSw;%iJ6Ft4EǛ2MR!/0-!],J"mMR#_:!\2"I5aqI/wAjivYfQR,FnDj1a`bIK#0]CG=i"3vg,iYH91ZiXH 6Gǖ9 +',TL.Epᴾv~g(wCڮ[cJ{UךG~/:ê"w OmrgAk_T*w@CuO#: +tA(xTd'X&cHigun΂BN5C/)ߠsf't-&z]Z?}oW%G;{]ϓvO"ib&.ދ=\bO'+A7m> +stream +xYyxSו>Y2/l%,xӓ]-YE2^$/-8f1f)ShZIPp)!MHq K 4 iәC;$4>!97{='#t"a159>h)Ede@B oWynBB{gK`sw B"Bc뚼. P4#Thu=B{!{_;tB+<M2yТ({*R|/qDu`#brB {AOf1ǡ)B.'ᎠF 2_W+H8-y2$F(-`1=l %BS.X~bc2tX99k&6} Q;d~(P& ZïڇXI.bI!J%h%Y&(qHJP6ـ,.rP!#@ <*$/=/Bt ++x:gCd)#Gc(Con1X̯ҎIa}E,!%0p?ԳQ2nG1o&h.BsoQafJ,c&:8vZAaDuA-PXgJdbTcQlȁJ7v xŏO}Ϳ+ Ff^jP܇)tG\S.aIݗh-~WgƂbgqc?pekY\Y.yjo.r~6P~@p&/?QPPFI9pSL5YD=v'{B]ck]vԱ[D6󗇎]_iy*̖ +zr +Z +G4'> dyzf#B*E2?pcu[Օ O^u!)d` (dZFi+&ADx,wݿkjT8iј[bOcҺZ]JFڒjuGL M:D6eA<=):v-}};*G=r -.>}<FS٠,~De剞+W{w Ѳ|dt|m_*-ȷF.p^?[p55,|{7ʽ K-}`y$h.<zz_4}B=Ozy;Ws-Yk:AAI3p1H"“4n7nMM8{rhfЈ#nJLh"),X){ b-&,sGcA<~ sC#+wmBWpn@В%q8K>Xq$@Ό_$a/_U? e?Y}?(}刻0tmf~55z Y>q 5p.d/ښ͏WyKEg&O|z'EujKdT2fKdp2;͝+Ȅm +UZPboɐg[^l5o m dr3 +EeтlU:Ht4Qk9`㏓N+CHY4^n,cwu,T]UUG9s@f@9~Vܾ+=I}}z5`|'$~?3 +È ?fGF{i>4?'u_0iR4|RD۸IOC3 +uPÀ,, xLYƲ.ŲeJnQ8~9%׼ݙIMhsSS%Ars,F  [ (2%eָn֦4܇힔-_@Ȼf it4+v9Glp *L_}C{d^;h;ZVV2Rpԯ,Dҙn'HIYCYE @z&aS㑼Wᰥ%㶲ÀdST8\k}>:Y XA [6j[S{N2{FA3rL9z@7b<ªjn_I5foPԔ*Vh|f:LT $wǫ*5ŵY$If)-Z˽t{uR _G .M]35ne"ɯFhGgJfΌQ&h5O[g|PLN@Q'#FBxen }Tl9-6_m~9G&2Lȏi6fV\rH^f&$mvM@R :|v@63 ~GZ|ˢ=}dr8,aGZʕt*SKSg} m3'y=|'@}@@zM}K@܏M3<=YÿW|ы2!v%ڭ> +stream +x9 tUՕ}}_'/ y// !!' IB!)"&6UFc)ZQJ2,a2LE;әYkw9}g}7dIڧbi4vi% fi骲$A=K.* ^h3amjJ ]۴sjf!} [s 6xwku +ĸ 66t7߳>.D .'֮;KYWKE9Kh-^j!wP~F4REm]vhEOGg}Տr (h)#$hAyx~h@IDUPi97?UH` q|%x焗0߁!&4:DAC}6,dA쨦}T ,Mw>9=ɓKuz{GVS@Mt}dTkp,)/-ϟ~ pd9ilv|ڎߑķM5 8JԽ)x%O2~+ǜRN NC-CK8hnGx ^Çe|(7> ?x2[y_ws{x~8T׽@_}? +Yp-c/ vwï.+_%ۍ;i`gq]L| ;fNfaa;zݍmy-U4[ +[-ͧ98&T4aVq2`w|;p}+gEJV6ɸ.ke,/3r+pj_3K| KJƕ+\Qe,ev~.Wk,-n\hoyEf>OƢ^dƹ,,X0 "`8ǀsbl7$l7y^ 8xsv@f:ۍ~;b1qVϊYB033,<ӆ13,1^!h38s &`SK0%SKI5nLrXDO.ObB'Dc<52I\cm1(wC'FGxC2Ei-<ʆQLnFعЙ|S_ÈڬnVZh1WpK 2Wؘhpc<,qȵԆvjQv%Q<%rQ(Q@L鍌xxdnõXKb'xELvE¤RedIaBT`/.A-d +:'Hшc'-ܫb}[BPhc"%K1/ˆA#W.0=+Z| ֐ `c6L !8F +leJ'JM:AW% +,5Gjapjv.IZo/vUrBkSTiT@t(qę^|x@u>4\bC:o\?D. +\p\dzr" u4NuZf$:wWKFe%#+^ n9$C?+SC?MC#3X0Ӣ‚Ư"E,2LS:'-CߕqTf,+YU$_$۲<w|?}*L}/AZ-{/tD%D#F[eIl6\t9S?HK\+:Q@ Y'7N:A}5ClH7?8r"ܮ*Whז'II3HsHä{M9w_ѵ%X-5ot0agulϝ9tY^ᵴ ӾbDAV0:0ttmmhR^4m00~$lVHH|{ZyJ~0\TY5}G}pQAF +ffW>?<|Pzc.T+`D̎&mH\B2Ǒ0pY&`'f +eAlɒ}ߨ;[6nlk۸_<~27e*rltUE $Wمb`y049dkn4Vt1qI$8ݫƭP@5YYYY^uC99ջ5ʆ3OчlDQӐ?s&bXOuǾ yG;``tKg&B$- (©^D'#|*a|Y/_׎M?}dOZ"$zA&t>藄>6 A1+K*k*6sN =T:b2)Vy%0|QQO@xo'io:-8}Nz\@.oKI\RsP./u'M+˥Ɩxs5$WW䋒c,Z$h mo0aO5Df$ӴH"qod{wkj'9<{>Ѿ_*da3`;B-HɃbYb݅,BiЖd=OdP~;E) _).&E,=#y4G{ >}QX_/ޗ@@@ b}c3 l$z7wr*Rx6ۯi)W.Dwog g{ZW3-Vw-Z4G{?Cf6lz& _qyL1긲 X*?Xr,)a`cDŽw҅_mﮩbpUʝ;N v MCN.c[0lsSXZ!iM;w6o޹sE},l{*yNAk+~ p;ddc B\yo9f(00{\or@ձnpjT?+_cS[tAف:=80tt `p r-rCJ"USv"f>!ޫӋzC|Ȝ&$6y) 12k\ye"c\.NeMKdP% t]>ݐnL73>ϙJMKOOH%&:0 (IoJzRHQ^ZLEm?ʇ5oѸ᣿;i+S@Gʷݤ$EsfD;xT馝N#}C.G":p}3Hx{C|PD±16Rs/N=7*71z'Cv6mꂤA8eyWTر<%Dr4H\H.PB`" /U <hpa&}eM}nf %Haip btC'4C#4AqLMNmTrWKXD4] EPIˠ賨Zx(]Mꩭ9]Gz(f$MD[C\UJF%Dn"2aQQ]D-: uۈźq>Y7fc}) *@Q[c1@90H`6hE.` T$Jzo«).+^UY!O鬩7voKMGyw]|~'Aj + +endstream +endobj +590 0 obj +<< +/Length1 16252 +/Filter /FlateDecode +/Length 11593 +>> +stream +x{y|TEo-w۝ҝI !IH -"  $L@ac' A#A#s:;uo||^ԽUw9uS|OBV (phg&y{lt= B=h5hO[P~8z y`PƤ[킁CRg~A*Bx7M=a9LEӓ\w'W DR̛:{y7=S'̟dPחm:kWύqB6yBI YrO~yQˊ6Y>Δw*>2~+XpNMEc9y6:x=뮝r 2j!bX MgH?ASK:MY(-l̆ʳ_{1˴;9w9"@ON4@qAɁf8_ etboR*@)r(k*ˡt54kQZg& +ZΠ (`t X; +l@Iꌺ"4 G#Ơewr;CI ޽{njdI(}y/>ZWr4r^4how Q∽b^Q +߻x)}AqѳGl=b={hx{E7iZ::w:dq.@[|3:ѹssm9Ct3 FiCt +-atD8щ,Nt gtcGűF:~(`6:a>!>N2:>bt`?N3ۖ) +dӢV(.fzBh=i8#v/ݭ{=zuBA7X`A(v3nkzZo-2Xr1ڹ-e4SB;ElFmb}iHc_ FtFrZ$M)PK tabC4}lwlۇ*!#p#ڎmh" & +==iu3o2E2LcR'd4hm4Qh:ٓŰjE{2i(jVxʨFn)flLFh2QS@vU41 ]JC@vme zFUʨ.*f*3*iQF) ކ,\Lz\R'C<4K-G!QYȢuqz| a +UzgC-\pmמߢm/-Ρ,E~/p:X<_KϹh9# P M%4ꜳUh FB 8\c܄nZ҅Lh+^j 3tIl"I@u?h$nc9BT/d7m~#x~)JGTp UTIfbdCUJSba-#]-hڈO¹ھ2}z侑0[(pemA;D Bsi&>-6T [V}M8tA\iΥ=P6#^Cx?ehFcdBaP7D v+l~3UWAZ(~#a,ӶJ2^VN(?6vGuzA?\Cᝐ=}۷F&4شty{ts(`'qSC6;69t%Goe,tzMLZ(1j>לRSqdɰpq Ong`Ui--Cx@$AP盿lNC@1[FzU ƋfHx_l@Q(F; +"D*BMzKH3&:*2jMSai}6<:* 4)v=R >VM27ص>'b/Ϝo:,[Szk;cf?̻099z?`gXv Cʂ҃oxN 3g >PϳМwL&!`tۓI$3:ffiQAA'aQ6$/.YeCP[,KeP$Wx(KUZ]QJ9es|" "ne߬+OO=n +;/9a^nQn{dt(KW('g!^U;Jy٢? w!3% wNF͡+AZ3](Ya&WmQU#jonm4zE{DI ($f!>[|UU#LĘӑ#т]/VH3PvVk4y ܳI^H^/<3K +7''|#J:5. \{iW>Ȃn|[~ۢ^oϮv]>wTm]X(gIcmv/0|L'xt@Zx|TfǪ޵dmͥ/Y0tHxcq A }"ktؠ""H&CO $Wx)),Oq5gV*@2AU=N/K84Js{_H4w$D0(s>fva+WY#?Idٷ%3/ B/c[f|饃ս r&FB P U6n_Y!9ragג)e:lagkpWs) Rx ѐ7 >] M74)5vE JCJZ;GK1vS;xcW2۵Ux۵; `}[ZzOL2dnHT+x? .,9嶄xqYOEK0܃jٹ]wpoΝEb +Vz-'x&#aAh^WK!e446SƽqdP rؿǤږ.ej R^ QU:e4ܲ ׻%[CڗAuED0~HOΨeKN.FN<,v>јŝ=zIv5b/gУ?|vK><+.3l"vv5ź]Kx{kDZJ0V1MiAj@˻P޽ iwL'| j;)DNp)FiG̦Ne < 1!r]I?sI嵵JFu)@UDUDB)گJ|J7 `}i(wd1Lt( bE +cdR+!KR@E$ߔ(%^R/y.Kpe&]Bf@8f ˚pr "r M#[Z^'/h>V½̰Y x)W>9CKĦ Z- ^!SJTL\ʄ" +>UT%IHQ%i! +VDϤb4FTTSKhNshIg4ɰP@P= tݬf7°rv, +6-R~P(EH-(Umu~sҁ$\nGNpRBf Y aIT3vkfU!C:YSa Ȁ"$?\ U<}=Ƅݽi1M.qZvsQɿC! +T-dݧa^-a:ԂTH,i6iH 8EΒ%\Χ1IZ֢eVAn 3g/\sK/|pa3]l^☖bWn>DF\k.%@z3֩般zbc+`}zYy,m>6JF Q94ږu{?.qgB)2|L0G]&&r7>]v?O]qo㐋ĝw+}|4wxڇo639k{2."Nwe5Jg *Wkڂ=7 O3, &k` E y&jE«x䴤{>"操3y| Lq e2),1{\҅nf蜗9b,z?w;vzsDآeT0ϨGHRCH)FD" XxܔZx8Lα7Xsb8b<0KUtNPuTիz"ÜE&J Ȁ=PBQV1U I/+=?0Cpܭ̽YX+Ī|m*Ibԑdw#Z>"Ut}!L!W: CP<0q4J * bݓz7%#4Q7㕵<~Ӈ/ItϩVlZbK<@R + IEH(Oiv5~W103ڱ< xM6OL$/ ϲ":-RHFdǯ%;~-s!YXd_ FJDNu)֨+M&%$ۭ*%[Pӛ,^p`pN +=h_uMi +At@yu^о{CGvσY 8b+;$MakS[4x8CIFurUw8M:< FU2${G ]וXOir=`tIMKuנ\CjΰGMxMDMq vdgrxMgPp-z?/U|@7V;4Ȩ)ˏwI#ϛ<U2Ƭ^ձ>1qt3w`'i4JFt¤WE WA" c`d遥M-ZrFpm5!ZSzݺեkZ.6)P_OR>_~N\ PG=;>|zjc$R#fTq$+t <TiؚUu*@zO3?{E=tIJ N[??8{sW.X2""[dVT6X\ x$utd}}3W;=y+3)--//-]Cϑ62w\߂3ǟy[)؁dZ[/a"QRCIY&h9[c%"n״MP>VɁ們 ˇ_->2{Q/5{dHw;؀;_ٻ(f7¾ SFSqˤ\lF,^cWXxdQuN$}?/x R4\d\˛3|W=_gpI'(&J톊8u4,#I/ 7 ̓E wt jޕ *RRT}~X#?` { b0âx(_Txl})I2`<85BZ6Xi8XLQ"hx c=Î~ekזɧ4Hbq˺!#p60;|H7qKX2YO *IH֨ ㆞-q(YRQ*0ZȋAhdd =u ëzhy|nM`)pzZ bZ&nG`+ Hc(X$Km!Tnptuq7`BZz Yt[}֮opH݌o]sdzKߡãCq#/un̜4bE1nZk.*"30n,UTE#`fa|=Q<%C^Bl؅g/PC|lyz]gJ5O*>j3L}mVWzkEp&9H{=n>'=e p0rv7 s?a!GE B)k'ۗH +/(TxkZ..9{ {Դ[=6UW>*$O$H$G/IIz ;oMכֿVu>I1ZFc (# b;VrH#JR+1 Su# St:E.M?IO)O'"X5VM"IbWUS{#d8M]Jra\ ujyƾ ESClZ,I+ހAd  SoTNWA:H@,(q"E8)WQdMN@;<]~/%/]:#a#(c\\ف&\澇Da|˿Z;,&l&~tD0R+ qCa0?X!h )0 B>f1 M!|eϪX=CyD[9-o>ᨲP$"$TG .4c}Ψ=vRz>pZL3t*pЍ]ir2jyNeU->z0o4śa%.lыq.u:TONBt&,Ũb(.Iw'f y%*j:BE d偞^̊]xWoacXE3/[PDO6Up Qߪ0 t|/t#иgxc=QaG1(T>uTgyi7vU@.fB=Ɵ*IcsG_w\׮ om[+7]/lnVF#p +:7hA+P'0uyၺ7Xh.'t4MC hq( +APwġg 4M9puC`Cњ&q2<$KN 0 -;&T8sq@e=t/ NЮ +\4Ss5E~֧[b)^ݻڝVj^kG~p 69#rj㘥 karaF]Ga_ÞRAol~CAn~zWxBҮ'LxbD:iP'&D&̍s@?@R +endstream +endobj +591 0 obj +<< +/Type /FontDescriptor +/FontName /VMONYK+DejaVuSans +/FontFamily (DejaVu Sans) +/Flags 4 +/FontBBox [ 0 -14 472 560 ] +/ItalicAngle 0 +/Ascent 928 +/Descent -235 +/CapHeight 560 +/StemV 80 +/StemH 80 +/FontFile2 587 0 R +>> +endobj +592 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /VMONYK+DejaVuSans +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 3 [ 317 ] 17 [ 317 ] 20 [ 636 ] 25 [ 636 ] 37 [ 686 698 ] 42 [ 774 751 294 ] 54 [ 634 ] 68 [ 612 ] 70 [ 549 634 615 ] 74 [ 634 633 277 ] 78 [ 579 ] 80 [ 974 633 611 ] 85 [ 411 520 392 633 591 817 ] ] +/FontDescriptor 591 0 R +>> +endobj +593 0 obj +<< +/Length 702 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +27 beginbfchar +<002b> <0048> +<0044> <0061> +<0055> <0072> +<0047> <0064> +<0048> <0065> +<0051> <006e> +<004c> <0069> +<004a> <0067> +<0003> <0020> +<002a> <0047> +<0058> <0075> +<005a> <0077> +<0057> <0074> +<004b> <0068> +<0026> <0043> +<002c> <0049> +<0036> <0053> +<0059> <0076> +<0014> <0031> +<0011> <002e> +<0019> <0036> +<0025> <0042> +<0046> <0063> +<0050> <006d> +<004e> <006b> +<0052> <006f> +<0056> <0073> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +594 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /VMONYK+DejaVuSans +/Encoding /Identity-H +/DescendantFonts [ 592 0 R ] +/ToUnicode 593 0 R +>> +endobj +595 0 obj +<< +/Type /FontDescriptor +/FontName /BYQKXS+Poppins +/FontFamily (Poppins) +/Flags 4 +/FontBBox [ -27 -260 122 795 ] +/ItalicAngle 0 +/Ascent 1049 +/Descent -349 +/CapHeight 795 +/StemV 80 +/StemH 80 +/FontFile2 588 0 R +>> +endobj +596 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /BYQKXS+Poppins +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 3 [ 266 ] 10 [ 158 453 453 ] 15 [ 197 550 209 ] 19 [ 627 319 574 588 628 627 634 545 630 629 212 ] 36 [ 673 612 771 706 512 503 777 691 245 ] 46 [ 598 431 ] 49 [ 702 785 578 ] 53 [ 607 586 540 674 675 975 ] 68 [ 675 675 606 675 619 328 675 639 245 247 514 245 1029 639 639 675 675 372 521 363 639 560 819 478 562 ] 206 [ 379 379 ] 209 [ 411 ] ] +/FontDescriptor 595 0 R +>> +endobj +597 0 obj +<< +/Length 1248 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +66 beginbfchar +<002b> <0048> +<0044> <0061> +<0055> <0072> +<0047> <0064> +<0048> <0065> +<0051> <006e> +<004c> <0069> +<004a> <0067> +<0003> <0020> +<002a> <0047> +<0058> <0075> +<005a> <0077> +<0057> <0074> +<004b> <0068> +<0026> <0043> +<002c> <0049> +<0036> <0053> +<0059> <0076> +<0014> <0031> +<0011> <002e> +<0019> <0036> +<0025> <0042> +<0046> <0063> +<0050> <006d> +<004e> <006b> +<0016> <0033> +<0017> <0034> +<001a> <0037> +<0018> <0035> +<001c> <0039> +<0032> <004f> +<0052> <006f> +<0049> <0066> +<002e> <004b> +<004f> <006c> +<0035> <0052> +<0033> <0050> +<0056> <0073> +<0053> <0070> +<0028> <0045> +<0031> <004e> +<0037> <0054> +<0010> <002d> +<0015> <0032> +<0045> <0062> +<0054> <0071> +<005c> <0079> +<000b> <0028> +<000c> <0029> +<000f> <002c> +<001d> <003a> +<0039> <0056> +<001b> <0038> +<0013> <0030> +<0027> <0044> +<0029> <0046> +<0024> <0041> +<005b> <0078> +<003a> <0057> +<00d1> <2022> +<0038> <0055> +<00ce> <201c> +<00cf> <201d> +<004d> <006a> +<002f> <004c> +<000a> <0027> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +598 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /BYQKXS+Poppins +/Encoding /Identity-H +/DescendantFonts [ 596 0 R ] +/ToUnicode 597 0 R +>> +endobj +599 0 obj +<< +/Type /FontDescriptor +/FontName /KMVTBF+DejaVuSansMono +/FontFamily (DejaVu Sans Mono) +/Flags 5 +/FontBBox [ 0 -14 584 759 ] +/ItalicAngle 0 +/Ascent 928 +/Descent -235 +/CapHeight 759 +/StemV 80 +/StemH 80 +/FontFile2 589 0 R +>> +endobj +600 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /KMVTBF+DejaVuSansMono +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 17 [ 601 ] 29 [ 601 ] 36 [ 601 ] 54 [ 601 601 ] 66 [ 601 ] 68 [ 601 ] 70 [ 601 601 601 601 ] 76 [ 601 ] 78 [ 601 601 601 601 601 601 ] 85 [ 601 601 601 601 601 ] 92 [ 601 ] ] +/FontDescriptor 599 0 R +>> +endobj +601 0 obj +<< +/Length 660 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +24 beginbfchar +<0048> <0065> +<0057> <0074> +<0046> <0063> +<0047> <0064> +<004f> <006c> +<0058> <0075> +<0056> <0073> +<0055> <0072> +<0011> <002e> +<005c> <0079> +<0050> <006d> +<0049> <0066> +<0044> <0061> +<0042> <005f> +<0053> <0070> +<0052> <006f> +<004c> <0069> +<001d> <003a> +<0051> <006e> +<0036> <0053> +<0059> <0076> +<0024> <0041> +<0037> <0054> +<004e> <006b> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +602 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /KMVTBF+DejaVuSansMono +/Encoding /Identity-H +/DescendantFonts [ 600 0 R ] +/ToUnicode 601 0 R +>> +endobj +603 0 obj +<< +/Type /FontDescriptor +/FontName /KOLXUF+DejaVuSansMono +/FontFamily (DejaVu Sans Mono) +/Flags 4 +/FontBBox [ 0 -14 585 699 ] +/ItalicAngle 0 +/Ascent 928 +/Descent -235 +/CapHeight 699 +/StemV 80 +/StemH 80 +/FontFile2 590 0 R +>> +endobj +604 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /KOLXUF+DejaVuSansMono +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 3 [ 601 602 602 602 602 602 602 602 602 602 ] 14 [ 601 602 601 601 601 601 602 602 601 601 602 602 602 602 601 602 602 ] 32 [ 602 602 ] 36 [ 602 602 602 602 602 602 602 602 602 ] 46 [ 602 602 602 601 602 601 ] 53 [ 602 602 602 602 602 602 ] 60 [ 602 ] 62 [ 602 ] 64 [ 602 ] 66 [ 602 602 602 601 601 601 601 601 602 602 602 602 601 601 602 601 601 602 602 602 601 601 601 602 601 602 601 602 602 602 602 ] ] +/FontDescriptor 603 0 R +>> +endobj +605 0 obj +<< +/Length 1500 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +84 beginbfchar +<0056> <0073> +<005c> <0079> +<0046> <0063> +<0057> <0074> +<004f> <006c> +<0012> <002f> +<0048> <0065> +<0011> <002e> +<0047> <0064> +<001c> <0039> +<0013> <0030> +<0010> <002d> +<004e> <006b> +<0058> <0075> +<0045> <0062> +<0052> <006f> +<0051> <006e> +<0049> <0066> +<0059> <0076> +<0050> <006d> +<0055> <0072> +<004c> <0069> +<0042> <005f> +<0020> <003d> +<0014> <0031> +<0053> <0070> +<0044> <0061> +<005b> <0078> +<0015> <0032> +<0018> <0035> +<0003> <0020> +<0016> <0033> +<0017> <0034> +<004a> <0067> +<0005> <0022> +<004b> <0068> +<001d> <003a> +<0036> <0053> +<0024> <0041> +<0037> <0054> +<0039> <0056> +<000e> <002b> +<0006> <0023> +<0004> <0021> +<0007> <0024> +<000b> <0028> +<004d> <006a> +<005f> <007c> +<0054> <0071> +<000a> <0027> +<003e> <005b> +<0040> <005d> +<000c> <0029> +<001e> <003b> +<005e> <007b> +<0060> <007d> +<005a> <0077> +<0031> <004e> +<0033> <0050> +<001b> <0038> +<002c> <0049> +<0028> <0045> +<002e> <004b> +<000f> <002c> +<0035> <0052> +<0027> <0044> +<0026> <0043> +<002f> <004c> +<002b> <0048> +<003a> <0057> +<002a> <0047> +<0030> <004d> +<0019> <0036> +<0032> <004f> +<003c> <0059> +<0038> <0055> +<001a> <0037> +<0009> <0026> +<0029> <0046> +<005d> <007a> +<0025> <0042> +<0043> <0060> +<0021> <003e> +<0008> <0025> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +606 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /KOLXUF+DejaVuSansMono +/Encoding /Identity-H +/DescendantFonts [ 604 0 R ] +/ToUnicode 605 0 R +>> +endobj +607 0 obj +<< +/VMONYK 594 0 R +/BYQKXS 598 0 R +/KMVTBF 602 0 R +/KOLXUF 606 0 R +>> +endobj +xref +0 608 +0000000000 65535 f +0000000015 00000 n +0000000227 00000 n +0000000343 00000 n +0000026934 00000 n +0000027067 00000 n +0000029718 00000 n +0000029917 00000 n +0000033266 00000 n +0000033595 00000 n +0000033729 00000 n +0000033865 00000 n +0000034027 00000 n +0000034190 00000 n +0000034346 00000 n +0000034503 00000 n +0000034660 00000 n +0000034843 00000 n +0000035027 00000 n +0000035202 00000 n +0000035378 00000 n +0000035554 00000 n +0000035726 00000 n +0000035899 00000 n +0000036057 00000 n +0000036216 00000 n +0000036375 00000 n +0000041267 00000 n +0000041501 00000 n +0000041751 00000 n +0000042013 00000 n +0000042274 00000 n +0000047419 00000 n +0000047681 00000 n +0000047814 00000 n +0000047945 00000 n +0000048076 00000 n +0000048207 00000 n +0000048338 00000 n +0000048471 00000 n +0000048602 00000 n +0000053784 00000 n +0000054102 00000 n +0000054235 00000 n +0000054366 00000 n +0000054497 00000 n +0000054628 00000 n +0000054761 00000 n +0000054894 00000 n +0000055025 00000 n +0000055156 00000 n +0000055287 00000 n +0000055418 00000 n +0000055551 00000 n +0000055682 00000 n +0000055813 00000 n +0000055944 00000 n +0000056075 00000 n +0000061274 00000 n +0000061592 00000 n +0000061788 00000 n +0000062047 00000 n +0000062278 00000 n +0000062411 00000 n +0000062542 00000 n +0000062673 00000 n +0000062804 00000 n +0000062935 00000 n +0000063066 00000 n +0000063197 00000 n +0000063328 00000 n +0000063459 00000 n +0000063591 00000 n +0000063722 00000 n +0000063852 00000 n +0000069526 00000 n +0000069830 00000 n +0000069962 00000 n +0000070094 00000 n +0000070227 00000 n +0000070358 00000 n +0000070489 00000 n +0000070620 00000 n +0000070751 00000 n +0000070980 00000 n +0000071217 00000 n +0000071350 00000 n +0000071481 00000 n +0000071612 00000 n +0000071742 00000 n +0000076920 00000 n +0000077420 00000 n +0000077551 00000 n +0000077682 00000 n +0000077813 00000 n +0000077944 00000 n +0000078075 00000 n +0000078207 00000 n +0000078339 00000 n +0000078471 00000 n +0000078603 00000 n +0000078736 00000 n +0000078869 00000 n +0000079002 00000 n +0000079135 00000 n +0000079268 00000 n +0000079401 00000 n +0000079534 00000 n +0000079667 00000 n +0000079800 00000 n +0000079933 00000 n +0000080066 00000 n +0000080199 00000 n +0000080332 00000 n +0000080465 00000 n +0000080598 00000 n +0000080731 00000 n +0000080864 00000 n +0000080997 00000 n +0000081130 00000 n +0000081263 00000 n +0000081396 00000 n +0000081529 00000 n +0000081662 00000 n +0000081795 00000 n +0000081928 00000 n +0000082061 00000 n +0000082193 00000 n +0000082324 00000 n +0000087354 00000 n +0000087841 00000 n +0000087974 00000 n +0000088107 00000 n +0000088240 00000 n +0000088373 00000 n +0000088506 00000 n +0000088639 00000 n +0000088772 00000 n +0000088905 00000 n +0000089038 00000 n +0000089171 00000 n +0000089304 00000 n +0000089437 00000 n +0000089570 00000 n +0000089703 00000 n +0000089836 00000 n +0000089969 00000 n +0000090102 00000 n +0000090235 00000 n +0000090368 00000 n +0000090501 00000 n +0000090634 00000 n +0000090767 00000 n +0000090900 00000 n +0000091033 00000 n +0000091166 00000 n +0000091299 00000 n +0000091432 00000 n +0000091565 00000 n +0000091698 00000 n +0000091831 00000 n +0000091964 00000 n +0000092097 00000 n +0000092230 00000 n +0000092363 00000 n +0000097603 00000 n +0000098098 00000 n +0000098231 00000 n +0000098364 00000 n +0000098497 00000 n +0000098630 00000 n +0000098763 00000 n +0000098896 00000 n +0000099029 00000 n +0000099162 00000 n +0000099295 00000 n +0000099428 00000 n +0000099561 00000 n +0000099694 00000 n +0000099827 00000 n +0000099960 00000 n +0000100093 00000 n +0000100226 00000 n +0000100359 00000 n +0000100492 00000 n +0000100625 00000 n +0000100758 00000 n +0000100891 00000 n +0000101024 00000 n +0000101157 00000 n +0000101290 00000 n +0000101424 00000 n +0000101558 00000 n +0000101692 00000 n +0000101826 00000 n +0000101960 00000 n +0000102094 00000 n +0000102228 00000 n +0000102362 00000 n +0000102496 00000 n +0000102629 00000 n +0000102761 00000 n +0000107393 00000 n +0000107872 00000 n +0000108006 00000 n +0000108140 00000 n +0000108274 00000 n +0000108408 00000 n +0000108542 00000 n +0000108676 00000 n +0000108810 00000 n +0000108944 00000 n +0000109078 00000 n +0000109212 00000 n +0000109346 00000 n +0000109480 00000 n +0000109614 00000 n +0000109748 00000 n +0000109882 00000 n +0000110016 00000 n +0000110150 00000 n +0000110284 00000 n +0000110418 00000 n +0000110552 00000 n +0000110686 00000 n +0000110820 00000 n +0000110954 00000 n +0000111088 00000 n +0000111222 00000 n +0000111356 00000 n +0000111490 00000 n +0000111624 00000 n +0000111758 00000 n +0000111892 00000 n +0000112026 00000 n +0000112159 00000 n +0000112291 00000 n +0000116538 00000 n +0000117057 00000 n +0000117191 00000 n +0000117325 00000 n +0000117459 00000 n +0000117593 00000 n +0000117727 00000 n +0000117861 00000 n +0000117995 00000 n +0000118129 00000 n +0000118263 00000 n +0000118397 00000 n +0000118531 00000 n +0000118665 00000 n +0000118799 00000 n +0000118933 00000 n +0000119067 00000 n +0000119201 00000 n +0000119335 00000 n +0000119469 00000 n +0000119603 00000 n +0000119737 00000 n +0000119871 00000 n +0000120005 00000 n +0000120139 00000 n +0000120273 00000 n +0000120407 00000 n +0000120541 00000 n +0000120675 00000 n +0000120809 00000 n +0000120943 00000 n +0000121077 00000 n +0000121211 00000 n +0000121345 00000 n +0000121479 00000 n +0000121613 00000 n +0000121747 00000 n +0000121881 00000 n +0000122014 00000 n +0000122146 00000 n +0000126848 00000 n +0000127367 00000 n +0000127501 00000 n +0000127635 00000 n +0000127769 00000 n +0000127903 00000 n +0000128037 00000 n +0000128171 00000 n +0000128305 00000 n +0000128439 00000 n +0000128573 00000 n +0000128707 00000 n +0000128841 00000 n +0000128975 00000 n +0000129109 00000 n +0000129243 00000 n +0000129377 00000 n +0000129511 00000 n +0000129645 00000 n +0000129779 00000 n +0000129913 00000 n +0000130047 00000 n +0000130181 00000 n +0000130315 00000 n +0000130449 00000 n +0000130583 00000 n +0000130717 00000 n +0000130851 00000 n +0000130985 00000 n +0000131119 00000 n +0000131253 00000 n +0000131387 00000 n +0000131521 00000 n +0000131655 00000 n +0000131789 00000 n +0000131923 00000 n +0000132057 00000 n +0000132191 00000 n +0000132324 00000 n +0000132456 00000 n +0000137529 00000 n +0000138048 00000 n +0000138182 00000 n +0000138316 00000 n +0000138450 00000 n +0000138584 00000 n +0000138718 00000 n +0000138852 00000 n +0000138986 00000 n +0000139120 00000 n +0000139254 00000 n +0000139388 00000 n +0000139522 00000 n +0000139656 00000 n +0000139790 00000 n +0000139924 00000 n +0000140058 00000 n +0000140192 00000 n +0000140326 00000 n +0000140460 00000 n +0000140594 00000 n +0000140728 00000 n +0000140862 00000 n +0000140996 00000 n +0000141130 00000 n +0000141264 00000 n +0000141398 00000 n +0000141532 00000 n +0000141666 00000 n +0000141800 00000 n +0000141934 00000 n +0000142068 00000 n +0000142202 00000 n +0000142336 00000 n +0000142470 00000 n +0000142604 00000 n +0000142738 00000 n +0000142872 00000 n +0000143005 00000 n +0000143137 00000 n +0000148171 00000 n +0000148642 00000 n +0000148776 00000 n +0000148910 00000 n +0000149044 00000 n +0000149178 00000 n +0000149312 00000 n +0000149446 00000 n +0000149580 00000 n +0000149714 00000 n +0000149848 00000 n +0000149982 00000 n +0000150116 00000 n +0000150250 00000 n +0000150384 00000 n +0000150518 00000 n +0000150652 00000 n +0000150786 00000 n +0000150920 00000 n +0000151054 00000 n +0000151188 00000 n +0000151322 00000 n +0000151456 00000 n +0000151590 00000 n +0000151724 00000 n +0000151858 00000 n +0000151992 00000 n +0000152126 00000 n +0000152260 00000 n +0000152394 00000 n +0000152528 00000 n +0000152662 00000 n +0000152796 00000 n +0000153026 00000 n +0000158071 00000 n +0000158582 00000 n +0000158717 00000 n +0000158850 00000 n +0000158983 00000 n +0000159116 00000 n +0000159249 00000 n +0000159382 00000 n +0000159515 00000 n +0000159648 00000 n +0000159781 00000 n +0000159915 00000 n +0000160049 00000 n +0000160183 00000 n +0000160317 00000 n +0000160451 00000 n +0000160585 00000 n +0000160719 00000 n +0000160853 00000 n +0000160987 00000 n +0000161121 00000 n +0000161255 00000 n +0000161389 00000 n +0000161523 00000 n +0000161657 00000 n +0000161791 00000 n +0000161925 00000 n +0000162059 00000 n +0000162193 00000 n +0000162327 00000 n +0000162461 00000 n +0000162595 00000 n +0000162729 00000 n +0000162863 00000 n +0000162997 00000 n +0000163131 00000 n +0000163265 00000 n +0000163398 00000 n +0000163530 00000 n +0000168138 00000 n +0000168657 00000 n +0000168791 00000 n +0000168925 00000 n +0000169059 00000 n +0000169193 00000 n +0000169327 00000 n +0000169461 00000 n +0000169595 00000 n +0000169729 00000 n +0000169863 00000 n +0000169997 00000 n +0000170131 00000 n +0000170265 00000 n +0000170399 00000 n +0000170533 00000 n +0000170667 00000 n +0000170801 00000 n +0000170935 00000 n +0000171069 00000 n +0000171203 00000 n +0000171337 00000 n +0000171471 00000 n +0000171605 00000 n +0000171739 00000 n +0000171873 00000 n +0000172007 00000 n +0000172141 00000 n +0000172275 00000 n +0000172409 00000 n +0000172543 00000 n +0000172677 00000 n +0000172811 00000 n +0000172945 00000 n +0000173079 00000 n +0000173213 00000 n +0000173347 00000 n +0000173481 00000 n +0000173614 00000 n +0000173746 00000 n +0000178806 00000 n +0000179325 00000 n +0000179459 00000 n +0000179593 00000 n +0000179727 00000 n +0000179861 00000 n +0000179995 00000 n +0000180129 00000 n +0000180263 00000 n +0000180397 00000 n +0000180531 00000 n +0000180665 00000 n +0000180799 00000 n +0000180933 00000 n +0000181067 00000 n +0000181201 00000 n +0000181335 00000 n +0000181469 00000 n +0000181603 00000 n +0000181737 00000 n +0000181871 00000 n +0000182005 00000 n +0000182139 00000 n +0000182273 00000 n +0000182407 00000 n +0000182541 00000 n +0000182676 00000 n +0000182811 00000 n +0000182946 00000 n +0000183081 00000 n +0000183216 00000 n +0000183351 00000 n +0000183486 00000 n +0000183621 00000 n +0000183756 00000 n +0000183891 00000 n +0000184026 00000 n +0000184161 00000 n +0000184295 00000 n +0000184428 00000 n +0000189641 00000 n +0000190032 00000 n +0000190167 00000 n +0000190302 00000 n +0000190437 00000 n +0000190572 00000 n +0000190707 00000 n +0000190842 00000 n +0000190977 00000 n +0000191112 00000 n +0000191247 00000 n +0000191382 00000 n +0000191517 00000 n +0000191652 00000 n +0000191785 00000 n +0000191918 00000 n +0000192051 00000 n +0000192184 00000 n +0000192317 00000 n +0000192450 00000 n +0000192583 00000 n +0000192716 00000 n +0000192849 00000 n +0000192981 00000 n +0000197888 00000 n +0000198359 00000 n +0000198493 00000 n +0000198627 00000 n +0000198761 00000 n +0000198895 00000 n +0000199029 00000 n +0000199163 00000 n +0000199297 00000 n +0000199431 00000 n +0000199565 00000 n +0000199699 00000 n +0000199833 00000 n +0000199967 00000 n +0000200101 00000 n +0000200235 00000 n +0000200370 00000 n +0000200503 00000 n +0000200636 00000 n +0000200769 00000 n +0000200902 00000 n +0000201035 00000 n +0000201168 00000 n +0000201301 00000 n +0000201434 00000 n +0000201568 00000 n +0000201702 00000 n +0000201836 00000 n +0000201970 00000 n +0000202104 00000 n +0000202238 00000 n +0000202372 00000 n +0000202506 00000 n +0000202640 00000 n +0000205825 00000 n +0000206072 00000 n +0000206206 00000 n +0000206340 00000 n +0000206474 00000 n +0000206608 00000 n +0000206779 00000 n +0000206933 00000 n +0000207048 00000 n +0000207214 00000 n +0000207403 00000 n +0000207546 00000 n +0000207733 00000 n +0000207920 00000 n +0000208099 00000 n +0000208276 00000 n +0000208454 00000 n +0000208651 00000 n +0000208821 00000 n +0000208883 00000 n +0000215533 00000 n +0000219776 00000 n +0000224705 00000 n +0000236389 00000 n +0000236621 00000 n +0000237011 00000 n +0000237766 00000 n +0000237916 00000 n +0000238145 00000 n +0000238677 00000 n +0000239979 00000 n +0000240126 00000 n +0000240367 00000 n +0000240736 00000 n +0000241449 00000 n +0000241603 00000 n +0000241844 00000 n +0000242445 00000 n +0000243999 00000 n +0000244153 00000 n +trailer +<< +/Size 608 +/Root 3 0 R +/Info 2 0 R +>> +startxref +244240 +%%EOF diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md new file mode 100644 index 00000000000..b06a02abc27 --- /dev/null +++ b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md @@ -0,0 +1,630 @@ +--- +title: Hardening Guide with CIS v1.6 Benchmark +weight: 100 +--- + +This document provides prescriptive guidance for hardening a production installation of a RKE cluster to be used with Rancher v2.6.3. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Information Security (CIS). + +> This hardening guide describes how to secure the nodes in your cluster, and it is recommended to follow this guide before installing Kubernetes. + +This hardening guide is intended to be used for RKE clusters and associated with specific versions of the CIS Kubernetes Benchmark, Kubernetes, and Rancher: + +| Rancher Version | CIS Benchmark Version | Kubernetes Version | +| --- | --- | --- | +| Rancher v2.6.3 | Benchmark v1.6 | Kubernetes v1.18, v1.19, v1.20 and v1.21 | + +[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf). + +- [Overview](#overview) +- [Configure Kernel Runtime Parameters](#configure-kernel-runtime-parameters) +- [Configure `etcd` user and group](#configure-etcd-user-and-group) +- [Configure `default` service account](#configure-default-service-account) +- [Configure Network Policy](#configure-network-policy) +- [Reference Hardened RKE `cluster.yml` Configuration](#reference-hardened-rke-cluster-yml-configuration) +- [Reference Hardened RKE Template Configuration](#reference-hardened-rke-template-configuration) +- [Reference Hardened **cloud-config** Configuration](#reference-hardened-cloud-config-configuration) + +### Overview + +This document provides prescriptive guidance for hardening a RKE cluster to be used for installing Rancher v2.6.3 with Kubernetes v1.18 up to v1.21 or provisioning a RKE cluster with Kubernetes v1.18 up to v.21 to be used within Rancher v2.6.3. It outlines the configurations required to address Kubernetes benchmark controls from the Center for Information Security (CIS). + +For more details about evaluating a hardened cluster against the official CIS benchmark, refer to the [CIS 1.6 Benchmark - Self-Assessment Guide - Rancher v2.6]({{}}/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/). + +#### Known Issues + +- Rancher **exec shell** and **view logs** for pods are **not** functional in a CIS v1.6 hardened setup when only public IP is provided when registering custom nodes. This functionality requires a private IP to be provided when registering the custom nodes. +- When setting the `default_pod_security_policy_template_id:` to `restricted`, Rancher creates **RoleBindings** and **ClusterRoleBindings** on the default service accounts. The CIS v1.6 check 5.1.5 requires that the default service accounts have no roles or cluster roles bound to it apart from the defaults. In addition the default service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments. + +### Configure Kernel Runtime Parameters + +The following `sysctl` configuration is recommended for all nodes type in the cluster. Set the following parameters in `/etc/sysctl.d/90-kubelet.conf`: + +```ini +vm.overcommit_memory=1 +vm.panic_on_oom=0 +kernel.panic=10 +kernel.panic_on_oops=1 +kernel.keys.root_maxbytes=25000000 +``` + +Run `sysctl -p /etc/sysctl.d/90-kubelet.conf` to enable the settings. + +### Configure `etcd` user and group + +A user account and group for the **etcd** service is required to be setup before installing RKE. The **uid** and **gid** for the **etcd** user will be used in the RKE **config.yml** to set the proper permissions for files and directories during installation time. + +#### Create `etcd` user and group + +To create the **etcd** user and group run the following console commands. The commands below use `52034` for **uid** and **gid** are for example purposes. Any valid unused **uid** or **gid** could also be used in lieu of `52034`. + +```bash +groupadd --gid 52034 etcd +useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd --shell /usr/sbin/nologin +``` + +Update the RKE **config.yml** with the **uid** and **gid** of the **etcd** user: + +```yaml +services: + etcd: + gid: 52034 + uid: 52034 +``` + +### Configure `default` Service Account + +#### Set `automountServiceAccountToken` to `false` for `default` service accounts + +Kubernetes provides a default service account which is used by cluster workloads where no specific service account is assigned to the pod. Where access to the Kubernetes API from a pod is required, a specific service account should be created for that pod, and rights granted to that service account. The default service account should be configured such that it does not provide a service account token and does not have any explicit rights assignments. + +For each namespace including **default** and **kube-system** on a standard RKE install, the **default** service account must include this value: + +```yaml +automountServiceAccountToken: false +``` + +Save the following configuration to a file called `account_update.yaml`. + +```yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: default +automountServiceAccountToken: false +``` + +Create a bash script file called `account_update.sh`. Be sure to `chmod +x account_update.sh` so the script has execute permissions. + +```bash +#!/bin/bash -e + +for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do + kubectl patch serviceaccount default -n ${namespace} -p "$(cat account_update.yaml)" +done +``` + +### Configure Network Policy + +#### Ensure that all Namespaces have Network Policies defined + +Running different applications on the same Kubernetes cluster creates a risk of one compromised application attacking a neighboring application. Network segmentation is important to ensure that containers can communicate only with those they are supposed to. A network policy is a specification of how selections of pods are allowed to communicate with each other and other network endpoints. + +Network Policies are namespace scoped. When a network policy is introduced to a given namespace, all traffic not allowed by the policy is denied. However, if there are no network policies in a namespace all traffic will be allowed into and out of the pods in that namespace. To enforce network policies, a CNI (container network interface) plugin must be enabled. This guide uses [Canal](https://github.com/projectcalico/canal) to provide the policy enforcement. Additional information about CNI providers can be found [here](https://www.suse.com/c/rancher_blog/comparing-kubernetes-cni-providers-flannel-calico-canal-and-weave/). + +Once a CNI provider is enabled on a cluster a default network policy can be applied. For reference purposes a **permissive** example is provided below. If you want to allow all traffic to all pods in a namespace (even if policies are added that cause some pods to be treated as “isolated”), you can create a policy that explicitly allows all traffic in that namespace. Save the following configuration as `default-allow-all.yaml`. Additional [documentation](https://kubernetes.io/docs/concepts/services-networking/network-policies/) about network policies can be found on the Kubernetes site. + +> This `NetworkPolicy` is just an example and is not recommended for production use. + +```yaml +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default-allow-all +spec: + podSelector: {} + ingress: + - {} + egress: + - {} + policyTypes: + - Ingress + - Egress +``` + +Create a bash script file called `apply_networkPolicy_to_all_ns.sh`. Be sure to `chmod +x apply_networkPolicy_to_all_ns.sh` so the script has execute permissions. + +```bash +#!/bin/bash -e + +for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do + kubectl apply -f default-allow-all.yaml -n ${namespace} +done +``` + +Execute this script to apply the `default-allow-all.yaml` configuration with the **permissive** `NetworkPolicy` to all namespaces. + +### Reference Hardened RKE `cluster.yml` Configuration + +The reference `cluster.yml` is used by the RKE CLI that provides the configuration needed to achieve a hardened install of Rancher Kubernetes Engine (RKE). RKE install [documentation]({{}}/rke/latest/en/installation/) is provided with additional details about the configuration items. This reference `cluster.yml` does not include the required **nodes** directive which will vary depending on your environment. Documentation for node configuration in RKE can be found [here]({{}}/rke/latest/en/config-options/nodes/). + +> For a Kubernetes v1.18 cluster, the configuration `spec.volumes: 'ephemeral'` should be removed from the `PodSecurityPolicy`, since it's not supported in this Kubernetes release. + +```yaml +# If you intend to deploy Kubernetes in an air-gapped environment, +# please consult the documentation on how to configure custom RKE images. +# https://rancher.com/docs/rke/latest/en/installation/ . + +# The nodes directive is required and will vary depending on your environment. +# Documentation for node configuration can be found here: +# https://rancher.com/docs/rke/latest/en/config-options/nodes/ +nodes: [] +services: + etcd: + image: "" + extra_args: {} + extra_binds: [] + extra_env: [] + win_extra_args: {} + win_extra_binds: [] + win_extra_env: [] + external_urls: [] + ca_cert: "" + cert: "" + key: "" + path: "" + uid: 52034 + gid: 52034 + snapshot: false + retention: "" + creation: "" + backup_config: null + kube-api: + image: "" + extra_args: {} + extra_binds: [] + extra_env: [] + win_extra_args: {} + win_extra_binds: [] + win_extra_env: [] + service_cluster_ip_range: "" + service_node_port_range: "" + pod_security_policy: true + always_pull_images: false + secrets_encryption_config: + enabled: true + custom_config: null + audit_log: + enabled: true + configuration: null + admission_configuration: null + event_rate_limit: + enabled: true + configuration: null + kube-controller: + image: "" + extra_args: + feature-gates: RotateKubeletServerCertificate=true + extra_binds: [] + extra_env: [] + win_extra_args: {} + win_extra_binds: [] + win_extra_env: [] + cluster_cidr: "" + service_cluster_ip_range: "" + scheduler: + image: "" + extra_args: {} + extra_binds: [] + extra_env: [] + win_extra_args: {} + win_extra_binds: [] + win_extra_env: [] + kubelet: + image: "" + extra_args: + feature-gates: RotateKubeletServerCertificate=true + protect-kernel-defaults: "true" + tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 + extra_binds: [] + extra_env: [] + win_extra_args: {} + win_extra_binds: [] + win_extra_env: [] + cluster_domain: cluster.local + infra_container_image: "" + cluster_dns_server: "" + fail_swap_on: false + generate_serving_certificate: true + kubeproxy: + image: "" + extra_args: {} + extra_binds: [] + extra_env: [] + win_extra_args: {} + win_extra_binds: [] + win_extra_env: [] +network: + plugin: "" + options: {} + mtu: 0 + node_selector: {} + update_strategy: null +authentication: + strategy: "" + sans: [] + webhook: null +addons: | + # Upstream Kubernetes restricted PSP policy + # https://github.com/kubernetes/website/blob/564baf15c102412522e9c8fc6ef2b5ff5b6e766c/content/en/examples/policy/restricted-psp.yaml + apiVersion: policy/v1beta1 + kind: PodSecurityPolicy + metadata: + name: restricted + spec: + privileged: false + # Required to prevent escalations to root. + allowPrivilegeEscalation: false + requiredDropCapabilities: + - ALL + # Allow core volume types. + volumes: + - 'configMap' + - 'emptyDir' + - 'projected' + - 'secret' + - 'downwardAPI' + # Assume that ephemeral CSI drivers & persistentVolumes set up by the cluster admin are safe to use. + - 'csi' + - 'persistentVolumeClaim' + - 'ephemeral' + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + # Require the container to run without root privileges. + rule: 'MustRunAsNonRoot' + seLinux: + # This policy assumes the nodes are using AppArmor rather than SELinux. + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + readOnlyRootFilesystem: false + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRole + metadata: + name: psp:restricted + rules: + - apiGroups: + - extensions + resourceNames: + - restricted + resources: + - podsecuritypolicies + verbs: + - use + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRoleBinding + metadata: + name: psp:restricted + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: psp:restricted + subjects: + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:serviceaccounts + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:authenticated + --- + apiVersion: networking.k8s.io/v1 + kind: NetworkPolicy + metadata: + name: default-allow-all + spec: + podSelector: {} + ingress: + - {} + egress: + - {} + policyTypes: + - Ingress + - Egress + --- + apiVersion: v1 + kind: ServiceAccount + metadata: + name: default + automountServiceAccountToken: false +addons_include: [] +system_images: + etcd: "" + alpine: "" + nginx_proxy: "" + cert_downloader: "" + kubernetes_services_sidecar: "" + kubedns: "" + dnsmasq: "" + kubedns_sidecar: "" + kubedns_autoscaler: "" + coredns: "" + coredns_autoscaler: "" + nodelocal: "" + kubernetes: "" + flannel: "" + flannel_cni: "" + calico_node: "" + calico_cni: "" + calico_controllers: "" + calico_ctl: "" + calico_flexvol: "" + canal_node: "" + canal_cni: "" + canal_controllers: "" + canal_flannel: "" + canal_flexvol: "" + weave_node: "" + weave_cni: "" + pod_infra_container: "" + ingress: "" + ingress_backend: "" + metrics_server: "" + windows_pod_infra_container: "" +ssh_key_path: "" +ssh_cert_path: "" +ssh_agent_auth: false +authorization: + mode: "" + options: {} +ignore_docker_version: false +kubernetes_version: v1.18.12-rancher1-1 +private_registries: [] +ingress: + provider: "" + options: {} + node_selector: {} + extra_args: {} + dns_policy: "" + extra_envs: [] + extra_volumes: [] + extra_volume_mounts: [] + update_strategy: null + http_port: 0 + https_port: 0 + network_mode: "" +cluster_name: +cloud_provider: + name: "" +prefix_path: "" +win_prefix_path: "" +addon_job_timeout: 0 +bastion_host: + address: "" + port: "" + user: "" + ssh_key: "" + ssh_key_path: "" + ssh_cert: "" + ssh_cert_path: "" +monitoring: + provider: "" + options: {} + node_selector: {} + update_strategy: null + replicas: null +restore: + restore: false + snapshot_name: "" +dns: null +upgrade_strategy: + max_unavailable_worker: "" + max_unavailable_controlplane: "" + drain: null + node_drain_input: null +``` + +### Reference Hardened RKE Template Configuration + +The reference RKE template provides the configuration needed to achieve a hardened install of Kubernetes. RKE templates are used to provision Kubernetes and define Rancher settings. Follow the Rancher [documentation]({{}}/rancher/v2.6/en/installation) for additional installation and RKE template details. + +```yaml +# +# Cluster Config +# +default_pod_security_policy_template_id: restricted +docker_root_dir: /var/lib/docker +enable_cluster_alerting: false +enable_cluster_monitoring: false +enable_network_policy: true +local_cluster_auth_endpoint: + enabled: true +name: '' +# +# Rancher Config +# +rancher_kubernetes_engine_config: + addon_job_timeout: 45 + authentication: + strategy: x509 + dns: + nodelocal: + ip_address: '' + node_selector: null + update_strategy: {} + enable_cri_dockerd: false + ignore_docker_version: true +# +# # Currently only nginx ingress provider is supported. +# # To disable ingress controller, set `provider: none` +# # To enable ingress on specific nodes, use the node_selector, eg: +# provider: nginx +# node_selector: +# app: ingress +# + ingress: + default_backend: false + default_ingress_class: true + http_port: 0 + https_port: 0 + provider: nginx + kubernetes_version: v1.21.8-rancher1-1 + monitoring: + provider: metrics-server + replicas: 1 +# +# If you are using calico on AWS +# +# network: +# plugin: calico +# calico_network_provider: +# cloud_provider: aws +# +# # To specify flannel interface +# +# network: +# plugin: flannel +# flannel_network_provider: +# iface: eth1 +# +# # To specify flannel interface for canal plugin +# +# network: +# plugin: canal +# canal_network_provider: +# iface: eth1 +# + network: + mtu: 0 + options: + flannel_backend_type: vxlan + plugin: canal + rotate_encryption_key: false +# +# services: +# kube-api: +# service_cluster_ip_range: 10.43.0.0/16 +# kube-controller: +# cluster_cidr: 10.42.0.0/16 +# service_cluster_ip_range: 10.43.0.0/16 +# kubelet: +# cluster_domain: cluster.local +# cluster_dns_server: 10.43.0.10 +# + services: + etcd: + backup_config: + enabled: true + interval_hours: 12 + retention: 6 + safe_timestamp: false + timeout: 300 + creation: 12h + extra_args: + election-timeout: 5000 + heartbeat-interval: 500 + gid: 52034 + retention: 72h + snapshot: false + uid: 52034 + kube_api: + always_pull_images: false + audit_log: + enabled: true + event_rate_limit: + enabled: true + pod_security_policy: true + secrets_encryption_config: + enabled: true + service_node_port_range: 30000-32767 + kube_controller: + extra_args: + feature-gates: RotateKubeletServerCertificate=true + kubelet: + extra_args: + feature-gates: RotateKubeletServerCertificate=true + protect-kernel-defaults: 'true' + tls-cipher-suites: >- + TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 + fail_swap_on: false + generate_serving_certificate: true + ssh_agent_auth: false + upgrade_strategy: + max_unavailable_controlplane: '1' + max_unavailable_worker: 10% +windows_prefered_cluster: false +``` + +### Reference Hardened **cloud-config** Configuration + +A **cloud-config** configuration file is generally used in cloud infrastructure environments to allow for configuration management of compute instances. The reference config configures SUSE Linux Enterprise Server (SLES), openSUSE Leap, Red Hat Enterprise Linux (RHEL) and Ubuntu operating system level settings needed before installing Kubernetes. + +#### Reference Hardened **cloud-config** for SUSE Linux Enterprise Server 15 (SLES 15) and openSUSE Leap 15 + +```yaml +#cloud-config +system_info: + default_user: + groups: + - docker +write_files: +- path: "/etc/sysctl.d/90-kubelet.conf" + owner: root:root + permissions: '0644' + content: | + vm.overcommit_memory=1 + vm.panic_on_oom=0 + kernel.panic=10 + kernel.panic_on_oops=1 + kernel.keys.root_maxbytes=25000000 +package_update: true +runcmd: +# Docker should already be installed in SLES 15 SP3 +- zypper install docker containerd +- systemctl daemon-reload +- systemctl enable docker.service +- systemctl start --no-block docker.service +- sysctl -p /etc/sysctl.d/90-kubelet.conf +- groupadd --gid 52034 etcd +- useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd --shell /usr/sbin/nologin +``` + +#### Reference Hardened **cloud-config** for Red Hat Enterprise Linux 8 (RHEL 8) and Ubuntu 20.04 LTS + +```yaml +#cloud-config +system_info: + default_user: + groups: + - docker +write_files: +- path: "/etc/sysctl.d/90-kubelet.conf" + owner: root:root + permissions: '0644' + content: | + vm.overcommit_memory=1 + vm.panic_on_oom=0 + kernel.panic=10 + kernel.panic_on_oops=1 + kernel.keys.root_maxbytes=25000000 +package_update: true +runcmd: +# Install Docker from Rancher's Docker installation scripts - github.com/rancher/install-docker +- curl https://releases.rancher.com/install-docker/20.10.sh | sh +- sysctl -p /etc/sysctl.d/90-kubelet.conf +- groupadd --gid 52034 etcd +- useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd --shell /usr/sbin/nologin +``` diff --git a/content/rancher/v2.6/en/security/hardening-guides/_index.md b/content/rancher/v2.6/en/security/hardening-guides/_index.md index a3635419be5..ea4e969f058 100644 --- a/content/rancher/v2.6/en/security/hardening-guides/_index.md +++ b/content/rancher/v2.6/en/security/hardening-guides/_index.md @@ -1,6 +1,6 @@ --- title: Self-Assessment and Hardening Guides for Rancher v2.6 -shortTitle: Rancher v2.6 Guides +shortTitle: Rancher v2.6 Hardening Guides weight: 1 aliases: - /rancher/v2.6/en/security/rancher-2.5/ @@ -10,4 +10,56 @@ aliases: - /rancher/v2.6/en/security/rancher-2.5/1.6-benchmark-2.5/ --- -Rancher v2.6 hardening guides are currently being updated. For the time being, please consult [Rancher v2.5 self-assessment and hardening guides]({{}}/rancher/v2.5/en/security/rancher-2.5) for more information. +Rancher provides specific security hardening guides for each supported Rancher's Kubernetes distributions. + +- [Rancher Kubernetes Distributions](#rancher-kubernetes-distributions) +- [Hardening Guides and Benchmark Versions](#hardening-guides-and-benchmark-versions) + - [RKE Guides](#rke-guides) + - [RKE2 Guides](#rke2-guides) + - [K3s Guides](#k3s) +- [Rancher with SELinux](#rancher-with-selinux) + +# Rancher Kubernetes Distributions + +Rancher uses the following Kubernetes distributions: + +- [**RKE**]({{}}/rke/latest/en/), Rancher Kubernetes Engine, is a CNCF-certified Kubernetes distribution that runs entirely within Docker containers. +- [**RKE2**](https://docs.rke2.io/) is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector. +- [**K3s**]({{}}/k3s/latest/en/) is a fully conformant, lightweight Kubernetes distribution. It is easy to install, with half the memory of upstream Kubernetes, all in a binary of less than 100 MB. + +To harden a Kubernetes cluster outside of Rancher's distributions, refer to your Kubernetes provider docs. + +# Hardening Guides and Benchmark Versions + +These guides have been tested along with the Rancher v2.6 release. Each self-assessment guide is accompanied with a hardening guide and tested on a specific Kubernetes version and CIS benchmark version. If a CIS benchmark has not been validated for your Kubernetes version, you can choose to use the existing guides until a newer version is added. + +### RKE Guides + +| Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides | +| --- | --- | --- | --- | +| Kubernetes v1.18, v1.19, v1.20 and v1.21 | CIS v1.6 | [Link](./1.6-benchmark-2.6) | [Link](./1.6-hardening-2.6) | + +> **Notes** +> +> - Kubernetes v1.22 is currently in experimental mode in Rancher v2.6.3. +> - CIS v1.20 benchmark version for Kubernetes v1.19 and v1.20 is not yet released as a profile in Rancher's CIS Benchmark chart. + +### RKE2 Guides + +| Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides | +| --- | --- | --- | --- | +| Kubernetes v1.18 | CIS v1.5 | [Link](https://docs.rke2.io/security/cis_self_assessment15/) | [Link](https://docs.rke2.io/security/hardening_guide/) | +| Kubernetes v1.20 | CIS v1.6 | [Link](https://docs.rke2.io/security/cis_self_assessment16/) | [Link](https://docs.rke2.io/security/hardening_guide/) | + +### K3s Guides + +| Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guide | +| --- | --- | --- | --- | +| Kubernetes v1.17, v1.18, & v1.19 | CIS v1.5 | [Link]({{}}/k3s/latest/en/security/self_assessment/) | [Link]({{}}/k3s/latest/en/security/hardening_guide/) | + + +# Rancher with SELinux + +[Security-Enhanced Linux (SELinux)](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) is a security enhancement to Linux. After being historically used by government agencies, SELinux is now industry standard and is enabled by default on RHEL and CentOS. + +To use Rancher with SELinux, we recommend installing the `rancher-selinux` RPM according to the instructions on [this page.]({{}}/rancher/v2.6/en/security/selinux/#installing-the-rancher-selinux-rpm) diff --git a/scripts/converters/run_results_to_md.sh b/scripts/converters/run_results_to_md.sh index acca856e0b1..58521f9670a 100755 --- a/scripts/converters/run_results_to_md.sh +++ b/scripts/converters/run_results_to_md.sh @@ -6,4 +6,4 @@ test_helpers=${2:?path to kube-bench test_helpers scripts is a required argument [ -f ${results} ] || (echo "file:'${results}' does not exist"; exit 1) [ -d ${test_helpers} ] || (echo "dir: '${test_helpers}' not a valid directory"; exit 1) -docker run -v${results}:/source/results.json -v ${test_helpers}:/test_helpers -it --rm doc_converters:latest results_to_md +docker run -v ${results}:/source/results.json -v ${test_helpers}:/test_helpers -it --rm doc_converters:latest results_to_md diff --git a/scripts/converters/scripts/results_to_md.sh b/scripts/converters/scripts/results_to_md.sh index 453dcbde069..388054cd449 100755 --- a/scripts/converters/scripts/results_to_md.sh +++ b/scripts/converters/scripts/results_to_md.sh @@ -1,45 +1,42 @@ #!/bin/bash -#results_file="${1:-/source/results.json}" -results_file="${1:-/home/paraglade/brain/projects/cis_benchmark/clusters/cis/csr.json}" -#test_helpers="${2:-/test_helpers}" -test_helpers="${2:-/home/paraglade/brain/repos/rancher-security-scan/package/helper_scripts}" +results_file="${1:-/source/results.json}" +test_helpers="${2:-/test_helpers}" header() { cat < NOTE: only scored tests are covered in this guide. +> NOTE: Only \`automated\` tests (previously called \`scored\`) are covered in this guide. ### Controls EOF @@ -90,12 +87,11 @@ for id in $(get_ids); do test_desc=$(echo ${result} | jq -r '.description') audit=$(echo ${result} | jq -r '.audit') audit_config=$(echo ${result} | jq -r '.audit_config') - actual_value=$(echo ${result} | jq -r '.actual_value_per_node."cis-aio-0"') + actual_value=$(echo ${result} | jq -r '.actual_value_per_node[]') type=$(echo ${result} | jq -r '.test_type') status=$(echo ${result} | jq -r '.state') remediation=$(echo ${result} | jq -r '.remediation') expected_result=$(echo ${result} | jq -r '.expected_result') -# echo "#### ${test} ${test_desc}" echo if [ "${type}" = "skip" ]; then echo "**Result:** Not Applicable" @@ -113,7 +109,7 @@ for id in $(get_ids); do if [[ ${audit} =~ ".sh" ]]; then audit_script=$(basename $(echo ${audit} | cut -d ' ' -f1)) test_helper="${test_helpers}/${audit_script}" - echo "**Audit Script:** ${audit_script}" + echo "**Audit Script:** \`${audit_script}\`" echo echo '```bash' cat ${test_helper} @@ -143,6 +139,14 @@ for id in $(get_ids); do echo '```' echo fi + if [ ! -z "${expected_result}" ]; then + echo "**Expected Result**:" + echo + echo '```console' + echo ${expected_result} + echo '```' + echo + fi if [ ! -z "${actual_value}" ] && [ "${status}" != "PASS" ] && [ "${type}" != "skip" ] && [ "${type}" != "manual" ]; then echo "**Returned Value**:" echo @@ -151,14 +155,6 @@ for id in $(get_ids); do echo '```' echo fi - if [ ! -z "${expected_result}" ]; then - echo "**Expected result**:" - echo - echo '```console' - echo ${expected_result} - echo '```' - echo - fi done done done From 176492286bd9bf2195c1f0527a8f300ed2f8b3dd Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 16 Feb 2022 09:49:46 -0500 Subject: [PATCH 246/478] Revised critical add-on verbiage --- content/rke/latest/en/config-options/add-ons/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rke/latest/en/config-options/add-ons/_index.md b/content/rke/latest/en/config-options/add-ons/_index.md index 31c819d4b00..a4ca73b596a 100644 --- a/content/rke/latest/en/config-options/add-ons/_index.md +++ b/content/rke/latest/en/config-options/add-ons/_index.md @@ -30,7 +30,7 @@ As of version v0.1.7, add-ons are split into two categories: - **Critical add-ons:** If these add-ons fail to deploy for any reason, RKE will error out. - **Non-critical add-ons:** If these add-ons fail to deploy, RKE will only log a warning and continue deploying any other add-ons. -Currently, only the [network plug-in]({{}}/rke/latest/en/config-options/add-ons/network-plugins/) is considered critical. KubeDNS, [ingress controllers]({{}}/rke/latest/en/config-options/add-ons/ingress-controllers/) and [user-defined add-ons]({{}}/rke/latest/en/config-options/add-ons/user-defined-add-ons/) are considered non-critical. +All system add-ons, such as the [network plug-in]({{}}/rke/latest/en/config-options/add-ons/network-plugins/), KubeDNS, and [ingress controllers]({{}}/rke/latest/en/config-options/add-ons/ingress-controllers/), are considered critical. [User-defined add-ons]({{}}/rke/latest/en/config-options/add-ons/user-defined-add-ons/) are considered non-critical. # Add-on Deployment Jobs From 484fbd676508455726145db2862c6fc199906475 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 16 Feb 2022 16:51:39 -0500 Subject: [PATCH 247/478] Updated per feedback --- content/k3s/latest/en/storage/_index.md | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/content/k3s/latest/en/storage/_index.md b/content/k3s/latest/en/storage/_index.md index 0dfdf265189..883128ee118 100644 --- a/content/k3s/latest/en/storage/_index.md +++ b/content/k3s/latest/en/storage/_index.md @@ -11,11 +11,23 @@ This page describes how to set up persistent storage with a local storage provid # What's changed in K3s storage? -Currently, K3s has removed both the in-tree storage drivers and the in-tree cloud provider. We removed these to achieve a smaller binary size and to avoid dependence on third-party cloud or data center technologies and services, which may not be available in many K3s use cases. We are able to do this because their removal affects neither core Kubernetes functionality nor conformance. +K3s removes several optional volume plugins and all built-in (sometimes referred to as "in-tree") cloud providers. We do this in order to achieve a smaller binary size and to avoid dependence on third-party cloud or data center technologies and services, which may not be available in many K3s use cases. We are able to do this because their removal affects neither core Kubernetes functionality nor conformance. -Both of these have out-of-tree alternatives that work in K3s: [CSI](https://github.com/container-storage-interface/spec/blob/master/spec.md) and [CCM](https://kubernetes.io/docs/tasks/administer-cluster/running-cloud-controller/). +The following volume plugins have been removed from K3s: -Additionally, upstream Kubernetes will be migrating from in-tree drivers to CSI soon. For more information on this migration, please refer [here](https://kubernetes.io/blog/2021/12/10/storage-in-tree-to-csi-migration-status-update/). +* cephfs +* fc +* flocker +* git_repo +* glusterfs +* portworx +* quobyte +* rbd +* storageos + +Both components have out-of-tree alternatives that can be used with K3s: The Kubernetes [Container Storage Interface (CSI)](https://github.com/container-storage-interface/spec/blob/master/spec.md) and [Cloud Provider Interface (CPI)](https://kubernetes.io/docs/tasks/administer-cluster/running-cloud-controller/). + +Kubernetes maintainers are actively migrating in-tree volume plugins to CSI drivers. For more information on this migration, please refer [here](https://kubernetes.io/blog/2021/12/10/storage-in-tree-to-csi-migration-status-update/). # Setting up the Local Storage Provider K3s comes with Rancher's Local Path Provisioner and this enables the ability to create persistent volume claims out of the box using local storage on the respective node. Below we cover a simple example. For more information please reference the official documentation [here](https://github.com/rancher/local-path-provisioner/blob/master/README.md#usage). From 7068d051e33bb937be9a628d3026d8db1cf3d48b Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 16 Feb 2022 17:01:22 -0500 Subject: [PATCH 248/478] Updated per feedback --- content/rke/latest/en/config-options/add-ons/_index.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/content/rke/latest/en/config-options/add-ons/_index.md b/content/rke/latest/en/config-options/add-ons/_index.md index a4ca73b596a..e449e079d77 100644 --- a/content/rke/latest/en/config-options/add-ons/_index.md +++ b/content/rke/latest/en/config-options/add-ons/_index.md @@ -27,10 +27,9 @@ There are a few things worth noting: As of version v0.1.7, add-ons are split into two categories: -- **Critical add-ons:** If these add-ons fail to deploy for any reason, RKE will error out. -- **Non-critical add-ons:** If these add-ons fail to deploy, RKE will only log a warning and continue deploying any other add-ons. +- **Critical add-ons:** If these add-ons fail to deploy for any reason, RKE will error out. All system add-ons, such as the [network plug-in]({{}}/rke/latest/en/config-options/add-ons/network-plugins/), KubeDNS, and [ingress controllers]({{}}/rke/latest/en/config-options/add-ons/ingress-controllers/), are considered critical. -All system add-ons, such as the [network plug-in]({{}}/rke/latest/en/config-options/add-ons/network-plugins/), KubeDNS, and [ingress controllers]({{}}/rke/latest/en/config-options/add-ons/ingress-controllers/), are considered critical. [User-defined add-ons]({{}}/rke/latest/en/config-options/add-ons/user-defined-add-ons/) are considered non-critical. +- **Non-critical add-ons:** If these add-ons fail to deploy, RKE will only log a warning and continue deploying any other add-ons. [User-defined add-ons]({{}}/rke/latest/en/config-options/add-ons/user-defined-add-ons/) are considered non-critical. # Add-on Deployment Jobs From 378a2fe43c979a2e57fbd3eb00fb87fc55e8d897 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20M=C3=BChl?= Date: Thu, 17 Feb 2022 18:57:44 +0700 Subject: [PATCH 249/478] typo "exclude" --- content/k3s/latest/en/installation/disable-flags/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/k3s/latest/en/installation/disable-flags/_index.md b/content/k3s/latest/en/installation/disable-flags/_index.md index 83b6b692cca..6e9f8da6202 100644 --- a/content/k3s/latest/en/installation/disable-flags/_index.md +++ b/content/k3s/latest/en/installation/disable-flags/_index.md @@ -3,7 +3,7 @@ title: "Disable Components Flags" weight: 60 --- -When starting K3s server with --cluster-init it will run all control plane components that includes (api server, controller manager, scheduler, and etcd). However you can run server nodes with certain components and execlude others, the following sections will explain how to do that. +When starting K3s server with --cluster-init it will run all control plane components that includes (api server, controller manager, scheduler, and etcd). However you can run server nodes with certain components and exclude others, the following sections will explain how to do that. # ETCD Only Nodes From aa6de5262f868134b8aba6c00db2a30390b27514 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Thu, 17 Feb 2022 09:57:32 -0500 Subject: [PATCH 250/478] Updated phrasing --- content/k3s/latest/en/installation/disable-flags/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/k3s/latest/en/installation/disable-flags/_index.md b/content/k3s/latest/en/installation/disable-flags/_index.md index 6e9f8da6202..2dbbfeb8920 100644 --- a/content/k3s/latest/en/installation/disable-flags/_index.md +++ b/content/k3s/latest/en/installation/disable-flags/_index.md @@ -3,7 +3,7 @@ title: "Disable Components Flags" weight: 60 --- -When starting K3s server with --cluster-init it will run all control plane components that includes (api server, controller manager, scheduler, and etcd). However you can run server nodes with certain components and exclude others, the following sections will explain how to do that. +Starting the K3s server with `--cluster-init` will run all control plane components, including the api server, controller manager, scheduler, and etcd. However, you can run server nodes with certain components and exclude others; the following sections will explain how to do that. # ETCD Only Nodes From 98b7142dd0c9fa5ea33a28c5d4d687bfa6d76913 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Thu, 17 Feb 2022 10:46:41 -0500 Subject: [PATCH 251/478] Added blurb on sharing templates --- .../v2.6/en/admin-settings/rke-templates/enforcement/_index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/rancher/v2.6/en/admin-settings/rke-templates/enforcement/_index.md b/content/rancher/v2.6/en/admin-settings/rke-templates/enforcement/_index.md index 9125f7ff342..cd51f196341 100644 --- a/content/rancher/v2.6/en/admin-settings/rke-templates/enforcement/_index.md +++ b/content/rancher/v2.6/en/admin-settings/rke-templates/enforcement/_index.md @@ -25,6 +25,8 @@ To require new clusters to use an RKE template, administrators can turn on RKE t 1. Go to the `cluster-template-enforcement` setting. Click **⋮ > Edit Setting**. 1. Set the value to **True** and click **Save**. + >**Important:** When the admin sets the `cluster-template-enforcement` to True, they also need to share the `clusterTemplates` with users so that users can select one of these templates to create the cluster. + **Result:** All clusters provisioned by Rancher must use a template, unless the creator is an administrator. # Disabling RKE Template Enforcement From ffb25ab379fb0bccaa58fed19d3e4ab433fe3ca0 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Thu, 17 Feb 2022 15:41:39 -0500 Subject: [PATCH 252/478] Added new section for workaround, added link to it from RKE2 config page --- .../rke2-config-reference/_index.md | 6 ++++-- .../en/faq/networking/cni-providers/_index.md | 19 +++++++++++++++++++ 2 files changed, 23 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md b/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md index 907fbfb3aea..48f15b6cbd4 100644 --- a/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md @@ -33,10 +33,12 @@ The [Network Provider](https://kubernetes.io/docs/concepts/cluster-administratio Out of the box, Rancher is compatible with the following network providers: - [Canal](https://github.com/projectcalico/canal) -- [Cilium](https://cilium.io/) +- [Cilium](https://cilium.io/)* - [Calico](https://docs.projectcalico.org/v3.11/introduction/) - [Multus](https://github.com/k8snetworkplumbingwg/multus-cni) +\* When using [project network isolation](#project-network-isolation) in the [Cilium CNI]({{}}/rancher/v2.6/en/faq/networking/cni-providers/#cilium), it is possible to enable cross-node ingress routing. Click the [CNI provider docs]({{}}/rancher/v2.6/en/faq/networking/cni-providers/#ingress-routing-across-nodes-in-cilium) to learn more. + For more details on the different networking providers and how to configure them, please view our [RKE2 documentation](https://docs.rke2.io/install/network_options/). #### Cloud Provider @@ -139,7 +141,7 @@ Select the image repository to pull Rancher images from. For more details and co ### Upgrade Strategy -#### Controle Plane Concurrency +#### Control Plane Concurrency Select how many nodes can be upgraded at the same time. Can be a fixed number or percentage. diff --git a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md index 718f2e36b24..7a4a55b7dd1 100644 --- a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md +++ b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md @@ -124,6 +124,25 @@ Cilium enables networking and network policies (L3, L4, and L7) in Kubernetes. B Cilium recommends kernel versions greater than 5.2 to be able to leverage the full potential of eBPF. Kubernetes workers should open TCP port `8472` for VXLAN and TCP port `4240` for health checks. In addition, ICMP 8/0 must be enabled for health checks. For more information, check [Cilium System Requirements](https://docs.cilium.io/en/latest/operations/system_requirements/#firewall-requirements). +#### Ingress Routing Across Nodes in Cilium +
+By default, Cilium does not allow pods to contact pods on other nodes. To work around this, enable the ingress controller to route requests across nodes with a `CiliumNetworkPolicy`. + +After selecting the Cilium CNI and enabling Project Network Isolation for your new cluster, configure as follows: + +``` +apiVersion: cilium.io/v2 +kind: CiliumNetworkPolicy +metadata: + name: hn-nodes + namespace: default +spec: + endpointSelector: {} + ingress: + - fromEntities: + - remote-node +``` + ## CNI Features by Provider The following table summarizes the different features available for each CNI network provider provided by Rancher. From 7995d836556f65ae0fffa5fb13270636bb6867e7 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 17 Feb 2022 17:12:16 -0800 Subject: [PATCH 253/478] Remove redundant 'Installing Docker' page --- .../requirements/installing-docker/_index.md | 2 +- .../resources/installing-docker/_index.md | 20 ----------------- .../requirements/installing-docker/_index.md | 2 +- .../resources/installing-docker/_index.md | 22 ------------------- .../requirements/installing-docker/_index.md | 2 +- .../resources/installing-docker/_index.md | 18 --------------- 6 files changed, 3 insertions(+), 63 deletions(-) delete mode 100644 content/rancher/v2.0-v2.4/en/installation/resources/installing-docker/_index.md delete mode 100644 content/rancher/v2.5/en/installation/resources/installing-docker/_index.md delete mode 100644 content/rancher/v2.6/en/installation/resources/installing-docker/_index.md diff --git a/content/rancher/v2.0-v2.4/en/installation/requirements/installing-docker/_index.md b/content/rancher/v2.0-v2.4/en/installation/requirements/installing-docker/_index.md index 4414cb08794..9fdeb407a47 100644 --- a/content/rancher/v2.0-v2.4/en/installation/requirements/installing-docker/_index.md +++ b/content/rancher/v2.0-v2.4/en/installation/requirements/installing-docker/_index.md @@ -3,7 +3,7 @@ title: Installing Docker weight: 1 --- -For Helm CLI installs, Docker is required to be installed on any node that runs the Rancher server. +Docker is required to be installed on nodes where the Rancher server will be installed with Helm or Docker. There are a couple of options for installing Docker. One option is to refer to the [official Docker documentation](https://docs.docker.com/install/) about how to install Docker on Linux. The steps will vary based on the Linux distribution. diff --git a/content/rancher/v2.0-v2.4/en/installation/resources/installing-docker/_index.md b/content/rancher/v2.0-v2.4/en/installation/resources/installing-docker/_index.md deleted file mode 100644 index faec8aed59c..00000000000 --- a/content/rancher/v2.0-v2.4/en/installation/resources/installing-docker/_index.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -title: Installing Docker -weight: 1 -aliases: - - /rancher/v2.0-v2.4/en/installation/requirements/installing-docker ---- - -Docker is required to be installed on nodes where the Rancher server will be installed with Helm or Docker. - -There are a couple of options for installing Docker. One option is to refer to the [official Docker documentation](https://docs.docker.com/install/) about how to install Docker on Linux. The steps will vary based on the Linux distribution. - -Another option is to use one of Rancher's Docker installation scripts, which are available for most recent versions of Docker. - -For example, this command could be used to install Docker 19.03 on Ubuntu: - -``` -curl https://releases.rancher.com/install-docker/19.03.sh | sh -``` - -Rancher has installation scripts for every version of upstream Docker that Kubernetes supports. To find out whether a script is available for installing a certain Docker version, refer to this [GitHub repository,](https://github.com/rancher/install-docker) which contains all of Rancher's Docker installation scripts. \ No newline at end of file diff --git a/content/rancher/v2.5/en/installation/requirements/installing-docker/_index.md b/content/rancher/v2.5/en/installation/requirements/installing-docker/_index.md index 02a005d245f..8b16d157505 100644 --- a/content/rancher/v2.5/en/installation/requirements/installing-docker/_index.md +++ b/content/rancher/v2.5/en/installation/requirements/installing-docker/_index.md @@ -3,7 +3,7 @@ title: Installing Docker weight: 1 --- -For Helm CLI installs, Docker is required to be installed on any node that runs the Rancher server. +Docker is required to be installed on nodes where the Rancher server will be installed with Helm or Docker. There are a couple of options for installing Docker. One option is to refer to the [official Docker documentation](https://docs.docker.com/install/) about how to install Docker on Linux. The steps will vary based on the Linux distribution. diff --git a/content/rancher/v2.5/en/installation/resources/installing-docker/_index.md b/content/rancher/v2.5/en/installation/resources/installing-docker/_index.md deleted file mode 100644 index 03bc6bbb795..00000000000 --- a/content/rancher/v2.5/en/installation/resources/installing-docker/_index.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -title: Installing Docker -weight: 1 -aliases: - - /rancher/v2.5/en/installation/requirements/installing-docker ---- - -Docker is required to be installed on nodes where the Rancher server will be installed with Helm or Docker. Docker is not required for RancherD installs. - -> **Note:** RancherD was an experimental feature available as part of Rancher v2.5.4 through v2.5.10 but is now deprecated and not available for recent releases. - -There are a couple of options for installing Docker. One option is to refer to the [official Docker documentation](https://docs.docker.com/install/) about how to install Docker on Linux. The steps will vary based on the Linux distribution. - -Another option is to use one of Rancher's Docker installation scripts, which are available for most recent versions of Docker. - -For example, this command could be used to install Docker 19.03 on Ubuntu: - -``` -curl https://releases.rancher.com/install-docker/19.03.sh | sh -``` - -Rancher has installation scripts for every version of upstream Docker that Kubernetes supports. To find out whether a script is available for installing a certain Docker version, refer to this [GitHub repository,](https://github.com/rancher/install-docker) which contains all of Rancher's Docker installation scripts. \ No newline at end of file diff --git a/content/rancher/v2.6/en/installation/requirements/installing-docker/_index.md b/content/rancher/v2.6/en/installation/requirements/installing-docker/_index.md index 02a005d245f..8b16d157505 100644 --- a/content/rancher/v2.6/en/installation/requirements/installing-docker/_index.md +++ b/content/rancher/v2.6/en/installation/requirements/installing-docker/_index.md @@ -3,7 +3,7 @@ title: Installing Docker weight: 1 --- -For Helm CLI installs, Docker is required to be installed on any node that runs the Rancher server. +Docker is required to be installed on nodes where the Rancher server will be installed with Helm or Docker. There are a couple of options for installing Docker. One option is to refer to the [official Docker documentation](https://docs.docker.com/install/) about how to install Docker on Linux. The steps will vary based on the Linux distribution. diff --git a/content/rancher/v2.6/en/installation/resources/installing-docker/_index.md b/content/rancher/v2.6/en/installation/resources/installing-docker/_index.md deleted file mode 100644 index 69be5eb6baa..00000000000 --- a/content/rancher/v2.6/en/installation/resources/installing-docker/_index.md +++ /dev/null @@ -1,18 +0,0 @@ ---- -title: Installing Docker -weight: 1 ---- - -Docker is required to be installed on nodes where the Rancher server will be installed with Helm or Docker. - -There are a couple of options for installing Docker. One option is to refer to the [official Docker documentation](https://docs.docker.com/install/) about how to install Docker on Linux. The steps will vary based on the Linux distribution. - -Another option is to use one of Rancher's Docker installation scripts, which are available for most recent versions of Docker. - -For example, this command could be used to install Docker 19.03 on Ubuntu: - -``` -curl https://releases.rancher.com/install-docker/19.03.sh | sh -``` - -Rancher has installation scripts for every version of upstream Docker that Kubernetes supports. To find out whether a script is available for installing a certain Docker version, refer to this [GitHub repository,](https://github.com/rancher/install-docker) which contains all of Rancher's Docker installation scripts. \ No newline at end of file From 5780a76515ee715cb174065365bcb4017ba70d30 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 17 Feb 2022 16:22:46 -0800 Subject: [PATCH 254/478] Update navigation to banner config --- .../v2.6/en/admin-settings/branding/_index.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/content/rancher/v2.6/en/admin-settings/branding/_index.md b/content/rancher/v2.6/en/admin-settings/branding/_index.md index 1fbe6d9f78b..4e5cff17e20 100644 --- a/content/rancher/v2.6/en/admin-settings/branding/_index.md +++ b/content/rancher/v2.6/en/admin-settings/branding/_index.md @@ -40,7 +40,21 @@ You can override the primary color used throughout the UI with a custom color of ### Fixed Banners +{{% tabs %}} +{{% tab "Rancher before v2.6.4" %}} Display a custom fixed banner in the header, footer, or both. +{{% /tab %}} +{{% tab "Rancher v2.6.4+" %}} +Display a custom fixed banner in the header, footer, or both. + +As of Rancher v2.6.4, configuration of fixed banners has moved from the **Branding** tab to the **Banners** tab. + +To configure banner settings, + +1. Click **☰ > Global settings**. +2. Click **Banners**. +{{% /tab %}} +{{% /tabs %}} # Custom Navigation Links From 578a9babad1522ef6eeafbded74c543a827881f8 Mon Sep 17 00:00:00 2001 From: Wataru Sekiguchi Date: Fri, 18 Feb 2022 16:36:38 +0900 Subject: [PATCH 255/478] Update _index.md `/rancher/v2.0-v2.4/en/cluster-admin/tools/monitoring` returns 404 page. I think the correct one is `/rancher/v2.0-v2.4/en/cluster-admin/tools/cluster-monitoring` --- content/rancher/v2.0-v2.4/en/project-admin/tools/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.0-v2.4/en/project-admin/tools/_index.md b/content/rancher/v2.0-v2.4/en/project-admin/tools/_index.md index bdd701e0d31..c1adfb7bc85 100644 --- a/content/rancher/v2.0-v2.4/en/project-admin/tools/_index.md +++ b/content/rancher/v2.0-v2.4/en/project-admin/tools/_index.md @@ -43,4 +43,4 @@ For details on project-level logging, see [this section.](./project-logging) _Available as of v2.2.0_ -Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with [Prometheus](https://prometheus.io/), a leading open-source monitoring solution. For details, refer to the [monitoring section.]({{}}/rancher/v2.0-v2.4/en/cluster-admin/tools/monitoring) +Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with [Prometheus](https://prometheus.io/), a leading open-source monitoring solution. For details, refer to the [monitoring section.]({{}}/rancher/v2.0-v2.4/en/cluster-admin/tools/cluster-monitoring) From 4860afa406eef18e732093bc75a16c58c9631ed1 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 18 Feb 2022 09:32:39 -0500 Subject: [PATCH 256/478] Fixed some typos, changed heading size for new section --- .../editing-clusters/rke2-config-reference/_index.md | 6 +++--- .../rancher/v2.6/en/faq/networking/cni-providers/_index.md | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md b/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md index 48f15b6cbd4..54539ceb934 100644 --- a/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md @@ -8,7 +8,7 @@ This section covers the configuration options that are available in Rancher for # Overview -You can configure the Kubernetes options one of two ways: +You can configure the Kubernetes options in one of the two following ways: - [Rancher UI](#configuration-options-in-the-rancher-ui): Use the Rancher UI to select options that are commonly customized when setting up a Kubernetes cluster. - [Cluster Config File](#cluster-config-file): Instead of using the Rancher UI to choose Kubernetes options for the cluster, advanced users can create an RKE2 config file. Using a config file allows you to set any of the [options](https://docs.rke2.io/install/install_options/install_options) available in an RKE2 installation. @@ -28,7 +28,7 @@ For more detail, see [Upgrading Kubernetes]({{}}/rancher/v2.6/en/cluste The [Network Provider](https://kubernetes.io/docs/concepts/cluster-administration/networking/) that the cluster uses. -> After you launch the cluster, you cannot change your network provider. Therefore, choose which network provider you want to use carefully, as Kubernetes doesn't allow switching between network providers. Once a cluster is created with a network provider, changing network providers would require you tear down the entire cluster and all its applications. +> After you launch the cluster, you cannot change your network provider. Therefore, choose which network provider you want to use carefully, as Kubernetes doesn't allow switching between network providers. Once a cluster is created with a network provider, changing network providers would require you to tear down the entire cluster and all its applications. Out of the box, Rancher is compatible with the following network providers: @@ -83,7 +83,7 @@ Each cloud provider capable of launching a cluster using RKE2 can collect metric ### Add-On Config -Additional Kubernetes manifests, managed as a [Add-on](https://kubernetes.io/docs/concepts/cluster-administration/addons/), to apply to the cluster on startup. Refer to the [RKE2 documentation](https://docs.rke2.io/helm/#automatically-deploying-manifests-and-helm-charts) for details. +Additional Kubernetes manifests, managed as an [Add-on](https://kubernetes.io/docs/concepts/cluster-administration/addons/), to apply to the cluster on startup. Refer to the [RKE2 documentation](https://docs.rke2.io/helm/#automatically-deploying-manifests-and-helm-charts) for details. ### Agent Environment Vars diff --git a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md index 7a4a55b7dd1..cb8fdb4b278 100644 --- a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md +++ b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md @@ -124,7 +124,7 @@ Cilium enables networking and network policies (L3, L4, and L7) in Kubernetes. B Cilium recommends kernel versions greater than 5.2 to be able to leverage the full potential of eBPF. Kubernetes workers should open TCP port `8472` for VXLAN and TCP port `4240` for health checks. In addition, ICMP 8/0 must be enabled for health checks. For more information, check [Cilium System Requirements](https://docs.cilium.io/en/latest/operations/system_requirements/#firewall-requirements). -#### Ingress Routing Across Nodes in Cilium +##### Ingress Routing Across Nodes in Cilium
By default, Cilium does not allow pods to contact pods on other nodes. To work around this, enable the ingress controller to route requests across nodes with a `CiliumNetworkPolicy`. From 4b82a7a182936eea08356823dd36ec53af84149c Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Fri, 18 Feb 2022 17:01:11 +0100 Subject: [PATCH 257/478] Reference new restricted-noroot PSP in hardening guides Signed-off-by: Guilherme Macedo --- .../hardening-guides/1.6-hardening-2.6/_index.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md index b06a02abc27..7220440e30a 100644 --- a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md +++ b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md @@ -33,7 +33,7 @@ For more details about evaluating a hardened cluster against the official CIS be #### Known Issues - Rancher **exec shell** and **view logs** for pods are **not** functional in a CIS v1.6 hardened setup when only public IP is provided when registering custom nodes. This functionality requires a private IP to be provided when registering the custom nodes. -- When setting the `default_pod_security_policy_template_id:` to `restricted`, Rancher creates **RoleBindings** and **ClusterRoleBindings** on the default service accounts. The CIS v1.6 check 5.1.5 requires that the default service accounts have no roles or cluster roles bound to it apart from the defaults. In addition the default service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments. +- When setting the `default_pod_security_policy_template_id:` to `restricted` or `restricted-noroot`, based on the pod security policies (PSP) [provided]({{}}/rancher/v2.6/en/admin-settings/pod-security-policies/) by Rancher, Rancher creates **RoleBindings** and **ClusterRoleBindings** on the default service accounts. The CIS v1.6 check 5.1.5 requires that the default service accounts have no roles or cluster roles bound to it apart from the defaults. In addition the default service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments. ### Configure Kernel Runtime Parameters @@ -260,7 +260,7 @@ addons: | apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: - name: restricted + name: restricted-noroot spec: privileged: false # Required to prevent escalations to root. @@ -304,12 +304,12 @@ addons: | apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: psp:restricted + name: psp:restricted-noroot rules: - apiGroups: - extensions resourceNames: - - restricted + - restricted-noroot resources: - podsecuritypolicies verbs: @@ -318,11 +318,11 @@ addons: | apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: psp:restricted + name: psp:restricted-noroot roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: psp:restricted + name: psp:restricted-noroot subjects: - apiGroup: rbac.authorization.k8s.io kind: Group @@ -445,7 +445,7 @@ The reference RKE template provides the configuration needed to achieve a harden # # Cluster Config # -default_pod_security_policy_template_id: restricted +default_pod_security_policy_template_id: restricted-noroot docker_root_dir: /var/lib/docker enable_cluster_alerting: false enable_cluster_monitoring: false From 502a436cd5e2f6f7cf352c2ae5e23c518277e405 Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Mon, 21 Feb 2022 11:36:20 +0530 Subject: [PATCH 258/478] Updating section for git-based chart repositories --- content/rancher/v2.6/en/helm-charts/_index.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/helm-charts/_index.md b/content/rancher/v2.6/en/helm-charts/_index.md index 11704efac48..b5313d0bd54 100644 --- a/content/rancher/v2.6/en/helm-charts/_index.md +++ b/content/rancher/v2.6/en/helm-charts/_index.md @@ -74,11 +74,14 @@ To add a private CA for Helm Chart repositories: [...] ``` -- **Git-based chart repositories**: It is not currently possible to add a private CA. For git-based chart repositories with a certificate signed by a private CA, you must disable TLS verification. Click **Edit YAML** for the chart repo, and add the key/value pair as follows: +- **Git-based chart repositories**: You must add a base64 encoded copy of the CA certificate in DER format to the spec.caBundle field of the chart repo, such as `openssl x509 -outform der -in ca.pem | base64 -w0`. Click **Edit YAML** for the chart repo and set, as in the following example:
``` [...] spec: - insecureSkipTLSVerify: true + caBundle: + MIIFXzCCA0egAwIBAgIUWNy8WrvSkgNzV0zdWRP79j9cVcEwDQYJKoZIhvcNAQELBQAwPzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQKDAtNeU9yZywgSW5jLjENMAsGA1UEAwwEcm9vdDAeFw0yMTEyMTQwODMyMTdaFw0yNDEwMDMwODMyMT + ... + nDxZ/tNXt/WPJr/PgEB3hQdInDWYMg7vGO0Oz00G5kWg0sJ0ZTSoA10ZwdjIdGEeKlj1NlPyAqpQ+uDnmx6DW+zqfYtLnc/g6GuLLVPamraqN+gyU8CHwAWPNjZonFN9Vpg0PIk1I2zuOc4EHifoTAXSpnjfzfyAxCaZsnTptimlPFJJqAMj+FfDArGmr4= [...] ``` From 8947956d48f4a0344edab49cfcd305bc88907568 Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Mon, 21 Feb 2022 17:48:38 +0530 Subject: [PATCH 259/478] Modified hyperlink redirect --- .../v2.6/en/overview/architecture-recommendations/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md b/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md index 179346f74aa..112388c36c9 100644 --- a/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md +++ b/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md @@ -110,4 +110,4 @@ If you are using an [authorized cluster endpoint (ACE),]({{}}/rancher/v If you are using private CA signed certificates on the load balancer, you have to supply the CA certificate, which will be included in the generated kubeconfig file to validate the certificate chain. See the documentation on [kubeconfig files]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/kubectl/) and [API keys]({{}}/rancher/v2.6/en/user-settings/api-keys/#creating-an-api-key) for more information. -As of Rancher v2.6.3, ACE support is available for registered RKE2 and K3s clusters. To view the manual steps to perform on the downstream cluster to enable the ACE, click [here]({{}}/v2.6/en/cluster-provisioning/registered-clusters/#authorized-cluster-endpoint-support-for-rke2-and-k3s-clusters). +As of Rancher v2.6.3, ACE support is available for registered RKE2 and K3s clusters. To view the manual steps to perform on the downstream cluster to enable the ACE, click [here]({{}}/rancher/v2.6/en/cluster-provisioning/registered-clusters/#authorized-cluster-endpoint-support-for-rke2-and-k3s-clusters). From 2c4454097a279a69ef637161c9a12555d2b1c218 Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Mon, 21 Feb 2022 13:47:33 +0100 Subject: [PATCH 260/478] Add hardening step and improve CSS style Signed-off-by: Guilherme Macedo --- ...her_v2-6_CIS_v1-6_Benchmark_Assessment.pdf | 15254 ++++++++-------- .../Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf | 7529 ++++---- .../1.6-hardening-2.6/_index.md | 2 + scripts/converters/css/style-portrait.css | 4 +- 4 files changed, 11497 insertions(+), 11292 deletions(-) diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf b/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf index 461c98f592c..cba5bceac24 100644 --- a/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf +++ b/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf @@ -3,25 +3,25 @@ 1 0 obj << /Type /Pages -/Kids [ 6 0 R 8 0 R 50 0 R 106 0 R 156 0 R 206 0 R 258 0 R 298 0 R 303 0 R 307 0 R 309 0 R 311 0 R 315 0 R 330 0 R 364 0 R 389 0 R 427 0 R 446 0 R 486 0 R 499 0 R 502 0 R 505 0 R 508 0 R 510 0 R 513 0 R 515 0 R 518 0 R 521 0 R 523 0 R 526 0 R 528 0 R 531 0 R 534 0 R 536 0 R 539 0 R 541 0 R 544 0 R 546 0 R 549 0 R 552 0 R 556 0 R 558 0 R 561 0 R 564 0 R 566 0 R 569 0 R 571 0 R 574 0 R 577 0 R 579 0 R 582 0 R 584 0 R 587 0 R 590 0 R 592 0 R 595 0 R 597 0 R 600 0 R 603 0 R 605 0 R 608 0 R 610 0 R 613 0 R 616 0 R 618 0 R 621 0 R 623 0 R 626 0 R 629 0 R 631 0 R 634 0 R 636 0 R 639 0 R 645 0 R 669 0 R 672 0 R 675 0 R 679 0 R 682 0 R 685 0 R 688 0 R 690 0 R 694 0 R 696 0 R 699 0 R 701 0 R 704 0 R 706 0 R 709 0 R 711 0 R 713 0 R 716 0 R 718 0 R 721 0 R 723 0 R 726 0 R 728 0 R 731 0 R 733 0 R 735 0 R 737 0 R 740 0 R 742 0 R 745 0 R 749 0 R 758 0 R 766 0 R 768 0 R 773 0 R 778 0 R 784 0 R 788 0 R 792 0 R 798 0 R 802 0 R 805 0 R 809 0 R 811 0 R 835 0 R 847 0 R 850 0 R 854 0 R 857 0 R 859 0 R 875 0 R 883 0 R 885 0 R 887 0 R 889 0 R ] -/Count 129 +/Kids [ 6 0 R 8 0 R 38 0 R 76 0 R 114 0 R 152 0 R 186 0 R 222 0 R 258 0 R 292 0 R 304 0 R 309 0 R 313 0 R 315 0 R 318 0 R 321 0 R 345 0 R 370 0 R 403 0 R 436 0 R 460 0 R 499 0 R 505 0 R 508 0 R 511 0 R 514 0 R 516 0 R 519 0 R 521 0 R 524 0 R 527 0 R 529 0 R 532 0 R 534 0 R 537 0 R 540 0 R 542 0 R 545 0 R 547 0 R 550 0 R 553 0 R 555 0 R 559 0 R 562 0 R 565 0 R 567 0 R 570 0 R 572 0 R 575 0 R 577 0 R 580 0 R 583 0 R 585 0 R 588 0 R 591 0 R 593 0 R 596 0 R 598 0 R 601 0 R 604 0 R 606 0 R 609 0 R 611 0 R 614 0 R 617 0 R 619 0 R 622 0 R 624 0 R 627 0 R 630 0 R 632 0 R 635 0 R 637 0 R 640 0 R 643 0 R 645 0 R 667 0 R 676 0 R 679 0 R 683 0 R 686 0 R 689 0 R 692 0 R 694 0 R 698 0 R 700 0 R 703 0 R 705 0 R 708 0 R 710 0 R 713 0 R 715 0 R 718 0 R 720 0 R 722 0 R 725 0 R 727 0 R 730 0 R 732 0 R 735 0 R 737 0 R 739 0 R 741 0 R 744 0 R 746 0 R 749 0 R 753 0 R 762 0 R 770 0 R 772 0 R 777 0 R 782 0 R 788 0 R 792 0 R 796 0 R 802 0 R 806 0 R 810 0 R 813 0 R 815 0 R 840 0 R 851 0 R 854 0 R 858 0 R 861 0 R 878 0 R 885 0 R 887 0 R 889 0 R 891 0 R ] +/Count 130 >> endobj 2 0 obj << /Title (CIS v1.6 Benchmark - Self-Assessment Guide - Rancher v2.6) /Creator (pandoc) -/Producer (WeasyPrint 54.0) +/Producer (WeasyPrint 54.1) >> endobj 3 0 obj << /Type /Catalog /Pages 1 0 R -/Outlines 1051 0 R +/Outlines 1053 0 R /Names << /Dests << -/Names [ (TOC) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (api-server) [ 502 0 R /XYZ 41.740157 784.430079 0 ] (apply-security-context-to-your-pods-and-containers-manual) [ 887 0 R /XYZ 84.259843 312.591496 0 ] (authentication-and-authorization) [ 735 0 R /XYZ 41.740157 784.430079 0 ] (cb1) [ 311 0 R /XYZ 84.259843 799.370079 0 ] (cb1-1) [ 311 0 R /XYZ 101.433071 797.673057 0 ] (cb101) [ 618 0 R /XYZ 84.259843 372.020079 0 ] (cb101-1) [ 618 0 R /XYZ 101.433071 370.323057 0 ] (cb104) [ 623 0 R /XYZ 84.259843 596.570079 0 ] (cb104-1) [ 623 0 R /XYZ 101.433071 594.873057 0 ] (cb107) [ 626 0 R /XYZ 84.259843 120.770079 0 ] (cb107-1) [ 626 0 R /XYZ 101.433071 119.073057 0 ] (cb11) [ 427 0 R /XYZ 84.259843 380.231993 0 ] (cb11-1) [ 427 0 R /XYZ 101.433071 378.534971 0 ] (cb11-10) [ 427 0 R /XYZ 99.933071 170.117735 0 ] (cb11-11) [ 427 0 R /XYZ 99.933071 151.170714 0 ] (cb11-12) [ 427 0 R /XYZ 99.933071 132.223692 0 ] (cb11-13) [ 427 0 R /XYZ 99.933071 113.276671 0 ] (cb11-14) [ 427 0 R /XYZ 99.933071 94.329649 0 ] (cb11-15) [ 446 0 R /XYZ 99.933071 799.173057 0 ] (cb11-16) [ 446 0 R /XYZ 99.933071 780.226036 0 ] (cb11-17) [ 446 0 R /XYZ 99.933071 761.279014 0 ] (cb11-18) [ 446 0 R /XYZ 99.933071 742.331993 0 ] (cb11-19) [ 446 0 R /XYZ 99.933071 723.384971 0 ] (cb11-2) [ 427 0 R /XYZ 99.933071 359.587950 0 ] (cb11-20) [ 446 0 R /XYZ 99.933071 704.437950 0 ] (cb11-21) [ 446 0 R /XYZ 99.933071 685.490928 0 ] (cb11-22) [ 446 0 R /XYZ 99.933071 666.543907 0 ] (cb11-23) [ 446 0 R /XYZ 99.933071 647.596885 0 ] (cb11-24) [ 446 0 R /XYZ 99.933071 628.649864 0 ] (cb11-25) [ 446 0 R /XYZ 99.933071 609.702842 0 ] (cb11-26) [ 446 0 R /XYZ 99.933071 590.755821 0 ] (cb11-27) [ 446 0 R /XYZ 99.933071 571.808799 0 ] (cb11-28) [ 446 0 R /XYZ 99.933071 552.861778 0 ] (cb11-29) [ 446 0 R /XYZ 99.933071 533.914756 0 ] (cb11-3) [ 427 0 R /XYZ 99.933071 340.640928 0 ] (cb11-30) [ 446 0 R /XYZ 99.933071 514.967735 0 ] (cb11-31) [ 446 0 R /XYZ 99.933071 496.020714 0 ] (cb11-32) [ 446 0 R /XYZ 99.933071 477.073692 0 ] (cb11-33) [ 446 0 R /XYZ 99.933071 458.126671 0 ] (cb11-34) [ 446 0 R /XYZ 99.933071 439.179649 0 ] (cb11-35) [ 446 0 R /XYZ 99.933071 420.232628 0 ] (cb11-36) [ 446 0 R /XYZ 99.933071 401.285606 0 ] (cb11-37) [ 446 0 R /XYZ 99.933071 382.338585 0 ] (cb11-38) [ 446 0 R /XYZ 99.933071 363.391563 0 ] (cb11-39) [ 446 0 R /XYZ 99.933071 344.444542 0 ] (cb11-4) [ 427 0 R /XYZ 99.933071 302.746885 0 ] (cb11-40) [ 446 0 R /XYZ 99.933071 325.497520 0 ] (cb11-41) [ 446 0 R /XYZ 99.933071 306.550499 0 ] (cb11-42) [ 446 0 R /XYZ 99.933071 287.603477 0 ] (cb11-43) [ 446 0 R /XYZ 99.933071 268.656456 0 ] (cb11-44) [ 446 0 R /XYZ 99.933071 249.709434 0 ] (cb11-45) [ 446 0 R /XYZ 99.933071 230.762413 0 ] (cb11-46) [ 446 0 R /XYZ 99.933071 211.815391 0 ] (cb11-47) [ 446 0 R /XYZ 99.933071 192.868370 0 ] (cb11-48) [ 446 0 R /XYZ 99.933071 173.921348 0 ] (cb11-49) [ 446 0 R /XYZ 99.933071 154.974327 0 ] (cb11-5) [ 427 0 R /XYZ 99.933071 264.852842 0 ] (cb11-50) [ 446 0 R /XYZ 99.933071 136.027305 0 ] (cb11-51) [ 446 0 R /XYZ 99.933071 117.080284 0 ] (cb11-52) [ 446 0 R /XYZ 99.933071 98.133262 0 ] (cb11-53) [ 486 0 R /XYZ 99.933071 780.226036 0 ] (cb11-54) [ 486 0 R /XYZ 99.933071 761.279014 0 ] (cb11-55) [ 486 0 R /XYZ 99.933071 742.331993 0 ] (cb11-56) [ 486 0 R /XYZ 99.933071 723.384971 0 ] (cb11-57) [ 486 0 R /XYZ 99.933071 704.437950 0 ] (cb11-58) [ 486 0 R /XYZ 99.933071 685.490928 0 ] (cb11-59) [ 486 0 R /XYZ 99.933071 666.543907 0 ] (cb11-6) [ 427 0 R /XYZ 99.933071 245.905821 0 ] (cb11-60) [ 486 0 R /XYZ 99.933071 647.596885 0 ] (cb11-61) [ 486 0 R /XYZ 99.933071 628.649864 0 ] (cb11-7) [ 427 0 R /XYZ 99.933071 226.958799 0 ] (cb11-8) [ 427 0 R /XYZ 99.933071 208.011778 0 ] (cb11-9) [ 427 0 R /XYZ 99.933071 189.064756 0 ] (cb110) [ 631 0 R /XYZ 84.259843 387.020079 0 ] (cb110-1) [ 631 0 R /XYZ 101.433071 385.323057 0 ] (cb113) [ 636 0 R /XYZ 84.259843 611.570079 0 ] (cb113-1) [ 636 0 R /XYZ 101.433071 609.873057 0 ] (cb116) [ 639 0 R /XYZ 84.259843 169.520079 0 ] (cb116-1) [ 639 0 R /XYZ 101.433071 167.823057 0 ] (cb116-10) [ 645 0 R /XYZ 99.933071 666.543907 0 ] (cb116-11) [ 645 0 R /XYZ 99.933071 647.596885 0 ] (cb116-12) [ 645 0 R /XYZ 99.933071 628.649864 0 ] (cb116-13) [ 645 0 R /XYZ 99.933071 609.702842 0 ] (cb116-14) [ 645 0 R /XYZ 99.933071 590.755821 0 ] (cb116-15) [ 645 0 R /XYZ 99.933071 571.808799 0 ] (cb116-16) [ 645 0 R /XYZ 99.933071 552.861778 0 ] (cb116-17) [ 645 0 R /XYZ 99.933071 533.914756 0 ] (cb116-18) [ 645 0 R /XYZ 99.933071 514.967735 0 ] (cb116-19) [ 645 0 R /XYZ 99.933071 496.020714 0 ] (cb116-2) [ 639 0 R /XYZ 99.933071 148.876036 0 ] (cb116-20) [ 645 0 R /XYZ 99.933071 477.073692 0 ] (cb116-21) [ 645 0 R /XYZ 99.933071 458.126671 0 ] (cb116-22) [ 645 0 R /XYZ 99.933071 439.179649 0 ] (cb116-23) [ 645 0 R /XYZ 99.933071 420.232628 0 ] (cb116-24) [ 645 0 R /XYZ 99.933071 401.285606 0 ] (cb116-25) [ 645 0 R /XYZ 99.933071 382.338585 0 ] (cb116-3) [ 639 0 R /XYZ 99.933071 129.929014 0 ] (cb116-4) [ 639 0 R /XYZ 99.933071 92.034971 0 ] (cb116-5) [ 645 0 R /XYZ 99.933071 799.173057 0 ] (cb116-6) [ 645 0 R /XYZ 99.933071 780.226036 0 ] (cb116-7) [ 645 0 R /XYZ 99.933071 761.279014 0 ] (cb116-8) [ 645 0 R /XYZ 99.933071 742.331993 0 ] (cb116-9) [ 645 0 R /XYZ 99.933071 704.437950 0 ] (cb117) [ 645 0 R /XYZ 84.259843 323.088585 0 ] (cb117-1) [ 645 0 R /XYZ 101.433071 321.391563 0 ] (cb12) [ 486 0 R /XYZ 84.259843 569.399864 0 ] (cb12-1) [ 486 0 R /XYZ 101.433071 567.702842 0 ] (cb120) [ 669 0 R /XYZ 84.259843 655.370079 0 ] (cb120-1) [ 669 0 R /XYZ 101.433071 653.673057 0 ] (cb121) [ 672 0 R /XYZ 84.259843 530.991496 0 ] (cb121-1) [ 672 0 R /XYZ 101.433071 529.294475 0 ] (cb124) [ 675 0 R /XYZ 84.259843 715.370079 0 ] (cb124-1) [ 675 0 R /XYZ 101.433071 713.673057 0 ] (cb127) [ 675 0 R /XYZ 84.259843 157.323057 0 ] (cb127-1) [ 675 0 R /XYZ 101.433071 155.626036 0 ] (cb130) [ 679 0 R /XYZ 84.259843 306.020079 0 ] (cb130-1) [ 679 0 R /XYZ 101.433071 304.323057 0 ] (cb133) [ 682 0 R /XYZ 84.259843 458.270079 0 ] (cb133-1) [ 682 0 R /XYZ 101.433071 456.573057 0 ] (cb136) [ 685 0 R /XYZ 84.259843 433.970079 0 ] (cb136-1) [ 685 0 R /XYZ 101.433071 432.273057 0 ] (cb139) [ 690 0 R /XYZ 84.259843 560.991496 0 ] (cb139-1) [ 690 0 R /XYZ 101.433071 559.294475 0 ] (cb142) [ 690 0 R /XYZ 84.259843 205.444475 0 ] (cb142-1) [ 690 0 R /XYZ 101.433071 203.747453 0 ] (cb145) [ 696 0 R /XYZ 84.259843 509.991496 0 ] (cb145-1) [ 696 0 R /XYZ 101.433071 508.294475 0 ] (cb148) [ 701 0 R /XYZ 84.259843 379.520079 0 ] (cb148-1) [ 701 0 R /XYZ 101.433071 377.823057 0 ] (cb15) [ 486 0 R /XYZ 84.259843 221.352842 0 ] (cb15-1) [ 486 0 R /XYZ 101.433071 219.655821 0 ] (cb151) [ 706 0 R /XYZ 84.259843 248.270079 0 ] (cb151-1) [ 706 0 R /XYZ 101.433071 246.573057 0 ] (cb154) [ 713 0 R /XYZ 84.259843 799.370079 0 ] (cb154-1) [ 713 0 R /XYZ 101.433071 797.673057 0 ] (cb157) [ 718 0 R /XYZ 84.259843 641.570079 0 ] (cb157-1) [ 718 0 R /XYZ 101.433071 639.873057 0 ] (cb160) [ 723 0 R /XYZ 84.259843 492.020079 0 ] (cb160-1) [ 723 0 R /XYZ 101.433071 490.323057 0 ] (cb163) [ 728 0 R /XYZ 84.259843 327.020079 0 ] (cb163-1) [ 728 0 R /XYZ 101.433071 325.323057 0 ] (cb166) [ 737 0 R /XYZ 84.259843 590.991496 0 ] (cb166-1) [ 737 0 R /XYZ 101.433071 589.294475 0 ] (cb169) [ 742 0 R /XYZ 84.259843 238.791496 0 ] (cb169-1) [ 742 0 R /XYZ 101.433071 237.094475 0 ] (cb172) [ 745 0 R /XYZ 84.259843 576.020079 0 ] (cb172-1) [ 745 0 R /XYZ 101.433071 574.323057 0 ] (cb174) [ 745 0 R /XYZ 84.259843 247.079014 0 ] (cb174-1) [ 745 0 R /XYZ 101.433071 245.381993 0 ] (cb176) [ 749 0 R /XYZ 84.259843 641.570079 0 ] (cb176-1) [ 749 0 R /XYZ 101.433071 639.873057 0 ] (cb179) [ 749 0 R /XYZ 84.259843 281.879014 0 ] (cb179-1) [ 749 0 R /XYZ 101.433071 280.181993 0 ] (cb179-2) [ 749 0 R /XYZ 99.933071 261.234971 0 ] (cb179-3) [ 749 0 R /XYZ 99.933071 242.287950 0 ] (cb179-4) [ 749 0 R /XYZ 99.933071 185.446885 0 ] (cb179-5) [ 749 0 R /XYZ 99.933071 166.499864 0 ] (cb18) [ 499 0 R /XYZ 84.259843 569.570079 0 ] (cb18-1) [ 499 0 R /XYZ 101.433071 567.873057 0 ] (cb180) [ 749 0 R /XYZ 84.259843 107.249864 0 ] (cb180-1) [ 749 0 R /XYZ 101.433071 105.552842 0 ] (cb182) [ 758 0 R /XYZ 84.259843 587.270079 0 ] (cb182-1) [ 758 0 R /XYZ 101.433071 585.573057 0 ] (cb182-2) [ 758 0 R /XYZ 99.933071 566.626036 0 ] (cb182-3) [ 758 0 R /XYZ 99.933071 547.679014 0 ] (cb182-4) [ 758 0 R /XYZ 99.933071 490.837950 0 ] (cb182-5) [ 758 0 R /XYZ 99.933071 471.890928 0 ] (cb183) [ 758 0 R /XYZ 84.259843 412.640928 0 ] (cb183-1) [ 758 0 R /XYZ 101.433071 410.943907 0 ] (cb185) [ 768 0 R /XYZ 84.259843 485.991496 0 ] (cb185-1) [ 768 0 R /XYZ 101.433071 484.294475 0 ] (cb186) [ 768 0 R /XYZ 84.259843 425.044475 0 ] (cb186-1) [ 768 0 R /XYZ 101.433071 423.347453 0 ] (cb188) [ 768 0 R /XYZ 84.259843 107.747453 0 ] (cb188-1) [ 768 0 R /XYZ 101.433071 106.050432 0 ] (cb189) [ 773 0 R /XYZ 84.259843 772.370079 0 ] (cb189-1) [ 773 0 R /XYZ 101.433071 770.673057 0 ] (cb191) [ 773 0 R /XYZ 84.259843 455.073057 0 ] (cb191-1) [ 773 0 R /XYZ 101.433071 453.376036 0 ] (cb192) [ 773 0 R /XYZ 84.259843 394.126036 0 ] (cb192-1) [ 773 0 R /XYZ 101.433071 392.429014 0 ] (cb194) [ 778 0 R /XYZ 84.259843 799.370079 0 ] (cb194-1) [ 778 0 R /XYZ 101.433071 797.673057 0 ] (cb195) [ 778 0 R /XYZ 84.259843 738.423057 0 ] (cb195-1) [ 778 0 R /XYZ 101.433071 736.726036 0 ] (cb197) [ 778 0 R /XYZ 84.259843 406.126036 0 ] (cb197-1) [ 778 0 R /XYZ 101.433071 404.429014 0 ] (cb198) [ 778 0 R /XYZ 84.259843 345.179014 0 ] (cb198-1) [ 778 0 R /XYZ 101.433071 343.481993 0 ] (cb2) [ 311 0 R /XYZ 84.259843 617.823057 0 ] (cb2-1) [ 311 0 R /XYZ 101.433071 616.126036 0 ] (cb201) [ 784 0 R /XYZ 84.259843 225.770079 0 ] (cb201-1) [ 784 0 R /XYZ 101.433071 224.073057 0 ] (cb202) [ 784 0 R /XYZ 84.259843 164.823057 0 ] (cb202-1) [ 784 0 R /XYZ 101.433071 163.126036 0 ] (cb204) [ 788 0 R /XYZ 84.259843 581.570079 0 ] (cb204-1) [ 788 0 R /XYZ 101.433071 579.873057 0 ] (cb205) [ 788 0 R /XYZ 84.259843 520.623057 0 ] (cb205-1) [ 788 0 R /XYZ 101.433071 518.926036 0 ] (cb207) [ 792 0 R /XYZ 84.259843 685.370079 0 ] (cb207-1) [ 792 0 R /XYZ 101.433071 683.673057 0 ] (cb208) [ 792 0 R /XYZ 84.259843 624.423057 0 ] (cb208-1) [ 792 0 R /XYZ 101.433071 622.726036 0 ] (cb21) [ 502 0 R /XYZ 84.259843 560.991496 0 ] (cb21-1) [ 502 0 R /XYZ 101.433071 559.294475 0 ] (cb210) [ 792 0 R /XYZ 84.259843 262.126036 0 ] (cb210-1) [ 792 0 R /XYZ 101.433071 260.429014 0 ] (cb211) [ 792 0 R /XYZ 84.259843 201.179014 0 ] (cb211-1) [ 792 0 R /XYZ 101.433071 199.481993 0 ] (cb213) [ 798 0 R /XYZ 84.259843 566.570079 0 ] (cb213-1) [ 798 0 R /XYZ 101.433071 564.873057 0 ] (cb214) [ 798 0 R /XYZ 84.259843 505.623057 0 ] (cb214-1) [ 798 0 R /XYZ 101.433071 503.926036 0 ] (cb217) [ 802 0 R /XYZ 84.259843 333.770079 0 ] (cb217-1) [ 802 0 R /XYZ 101.433071 332.073057 0 ] (cb218) [ 805 0 R /XYZ 84.259843 772.370079 0 ] (cb218-1) [ 805 0 R /XYZ 101.433071 770.673057 0 ] (cb219) [ 805 0 R /XYZ 84.259843 711.423057 0 ] (cb219-1) [ 805 0 R /XYZ 101.433071 709.726036 0 ] (cb221) [ 811 0 R /XYZ 84.259843 726.620079 0 ] (cb221-1) [ 811 0 R /XYZ 101.433071 724.923057 0 ] (cb221-10) [ 811 0 R /XYZ 99.933071 554.399864 0 ] (cb221-11) [ 811 0 R /XYZ 99.933071 535.452842 0 ] (cb221-12) [ 811 0 R /XYZ 99.933071 440.717735 0 ] (cb221-13) [ 811 0 R /XYZ 99.933071 421.770714 0 ] (cb221-14) [ 811 0 R /XYZ 99.933071 402.823692 0 ] (cb221-15) [ 811 0 R /XYZ 99.933071 383.876671 0 ] (cb221-16) [ 811 0 R /XYZ 99.933071 364.929649 0 ] (cb221-17) [ 811 0 R /XYZ 99.933071 345.982628 0 ] (cb221-18) [ 811 0 R /XYZ 99.933071 308.088585 0 ] (cb221-19) [ 811 0 R /XYZ 99.933071 289.141563 0 ] (cb221-2) [ 811 0 R /XYZ 99.933071 705.976036 0 ] (cb221-20) [ 811 0 R /XYZ 99.933071 156.512413 0 ] (cb221-21) [ 811 0 R /XYZ 99.933071 137.565391 0 ] (cb221-22) [ 811 0 R /XYZ 99.933071 118.618370 0 ] (cb221-23) [ 835 0 R /XYZ 99.933071 780.226036 0 ] (cb221-24) [ 835 0 R /XYZ 99.933071 761.279014 0 ] (cb221-25) [ 835 0 R /XYZ 99.933071 742.331993 0 ] (cb221-26) [ 835 0 R /XYZ 99.933071 723.384971 0 ] (cb221-27) [ 835 0 R /XYZ 99.933071 704.437950 0 ] (cb221-28) [ 835 0 R /XYZ 99.933071 685.490928 0 ] (cb221-29) [ 835 0 R /XYZ 99.933071 666.543907 0 ] (cb221-3) [ 811 0 R /XYZ 99.933071 687.029014 0 ] (cb221-30) [ 835 0 R /XYZ 99.933071 647.596885 0 ] (cb221-31) [ 835 0 R /XYZ 99.933071 628.649864 0 ] (cb221-4) [ 811 0 R /XYZ 99.933071 668.081993 0 ] (cb221-5) [ 811 0 R /XYZ 99.933071 649.134971 0 ] (cb221-6) [ 811 0 R /XYZ 99.933071 630.187950 0 ] (cb221-7) [ 811 0 R /XYZ 99.933071 611.240928 0 ] (cb221-8) [ 811 0 R /XYZ 99.933071 592.293907 0 ] (cb221-9) [ 811 0 R /XYZ 99.933071 573.346885 0 ] (cb222) [ 835 0 R /XYZ 84.259843 569.399864 0 ] (cb222-1) [ 835 0 R /XYZ 101.433071 567.702842 0 ] (cb225) [ 847 0 R /XYZ 84.259843 410.391496 0 ] (cb225-1) [ 847 0 R /XYZ 101.433071 408.694475 0 ] (cb228) [ 850 0 R /XYZ 84.259843 772.370079 0 ] (cb228-1) [ 850 0 R /XYZ 101.433071 770.673057 0 ] (cb231) [ 850 0 R /XYZ 84.259843 401.429014 0 ] (cb231-1) [ 850 0 R /XYZ 101.433071 399.731993 0 ] (cb234) [ 854 0 R /XYZ 84.259843 772.370079 0 ] (cb234-1) [ 854 0 R /XYZ 101.433071 770.673057 0 ] (cb237) [ 859 0 R /XYZ 84.259843 385.641496 0 ] (cb237-1) [ 859 0 R /XYZ 101.433071 383.944475 0 ] (cb237-10) [ 859 0 R /XYZ 99.933071 213.421281 0 ] (cb237-11) [ 859 0 R /XYZ 99.933071 194.474260 0 ] (cb237-12) [ 859 0 R /XYZ 99.933071 156.580217 0 ] (cb237-13) [ 859 0 R /XYZ 99.933071 118.686174 0 ] (cb237-14) [ 859 0 R /XYZ 99.933071 99.739152 0 ] (cb237-15) [ 875 0 R /XYZ 99.933071 799.173057 0 ] (cb237-16) [ 875 0 R /XYZ 99.933071 780.226036 0 ] (cb237-17) [ 875 0 R /XYZ 99.933071 761.279014 0 ] (cb237-18) [ 875 0 R /XYZ 99.933071 742.331993 0 ] (cb237-19) [ 875 0 R /XYZ 99.933071 723.384971 0 ] (cb237-2) [ 859 0 R /XYZ 99.933071 364.997453 0 ] (cb237-3) [ 859 0 R /XYZ 99.933071 346.050432 0 ] (cb237-4) [ 859 0 R /XYZ 99.933071 327.103410 0 ] (cb237-5) [ 859 0 R /XYZ 99.933071 308.156389 0 ] (cb237-6) [ 859 0 R /XYZ 99.933071 289.209367 0 ] (cb237-7) [ 859 0 R /XYZ 99.933071 270.262346 0 ] (cb237-8) [ 859 0 R /XYZ 99.933071 251.315324 0 ] (cb237-9) [ 859 0 R /XYZ 99.933071 232.368303 0 ] (cb238) [ 875 0 R /XYZ 84.259843 664.134971 0 ] (cb238-1) [ 875 0 R /XYZ 101.433071 662.437950 0 ] (cb24) [ 505 0 R /XYZ 84.259843 102.020079 0 ] (cb24-1) [ 505 0 R /XYZ 101.433071 100.323057 0 ] (cb241) [ 889 0 R /XYZ 84.259843 711.620079 0 ] (cb241-1) [ 889 0 R /XYZ 101.433071 709.923057 0 ] (cb241-10) [ 889 0 R /XYZ 99.933071 539.399864 0 ] (cb241-11) [ 889 0 R /XYZ 99.933071 520.452842 0 ] (cb241-12) [ 889 0 R /XYZ 99.933071 463.611778 0 ] (cb241-13) [ 889 0 R /XYZ 99.933071 444.664756 0 ] (cb241-14) [ 889 0 R /XYZ 99.933071 425.717735 0 ] (cb241-15) [ 889 0 R /XYZ 99.933071 406.770714 0 ] (cb241-16) [ 889 0 R /XYZ 99.933071 387.823692 0 ] (cb241-17) [ 889 0 R /XYZ 99.933071 368.876671 0 ] (cb241-18) [ 889 0 R /XYZ 99.933071 349.929649 0 ] (cb241-2) [ 889 0 R /XYZ 99.933071 690.976036 0 ] (cb241-3) [ 889 0 R /XYZ 99.933071 672.029014 0 ] (cb241-4) [ 889 0 R /XYZ 99.933071 653.081993 0 ] (cb241-5) [ 889 0 R /XYZ 99.933071 634.134971 0 ] (cb241-6) [ 889 0 R /XYZ 99.933071 615.187950 0 ] (cb241-7) [ 889 0 R /XYZ 99.933071 596.240928 0 ] (cb241-8) [ 889 0 R /XYZ 99.933071 577.293907 0 ] (cb241-9) [ 889 0 R /XYZ 99.933071 558.346885 0 ] (cb242) [ 889 0 R /XYZ 84.259843 290.679649 0 ] (cb242-1) [ 889 0 R /XYZ 101.433071 288.982628 0 ] (cb27) [ 510 0 R /XYZ 84.259843 383.270079 0 ] (cb27-1) [ 510 0 R /XYZ 101.433071 381.573057 0 ] (cb3) [ 315 0 R /XYZ 84.259843 351.620079 0 ] (cb3-1) [ 315 0 R /XYZ 101.433071 349.923057 0 ] (cb3-10) [ 315 0 R /XYZ 99.933071 160.452842 0 ] (cb3-11) [ 315 0 R /XYZ 99.933071 141.505821 0 ] (cb3-12) [ 315 0 R /XYZ 99.933071 122.558799 0 ] (cb3-13) [ 315 0 R /XYZ 99.933071 103.611778 0 ] (cb3-14) [ 330 0 R /XYZ 99.933071 799.173057 0 ] (cb3-15) [ 330 0 R /XYZ 99.933071 780.226036 0 ] (cb3-16) [ 330 0 R /XYZ 99.933071 761.279014 0 ] (cb3-17) [ 330 0 R /XYZ 99.933071 742.331993 0 ] (cb3-18) [ 330 0 R /XYZ 99.933071 723.384971 0 ] (cb3-19) [ 330 0 R /XYZ 99.933071 704.437950 0 ] (cb3-2) [ 315 0 R /XYZ 99.933071 330.976036 0 ] (cb3-20) [ 330 0 R /XYZ 99.933071 685.490928 0 ] (cb3-21) [ 330 0 R /XYZ 99.933071 666.543907 0 ] (cb3-22) [ 330 0 R /XYZ 99.933071 647.596885 0 ] (cb3-23) [ 330 0 R /XYZ 99.933071 628.649864 0 ] (cb3-24) [ 330 0 R /XYZ 99.933071 609.702842 0 ] (cb3-25) [ 330 0 R /XYZ 99.933071 590.755821 0 ] (cb3-26) [ 330 0 R /XYZ 99.933071 571.808799 0 ] (cb3-27) [ 330 0 R /XYZ 99.933071 552.861778 0 ] (cb3-28) [ 330 0 R /XYZ 99.933071 533.914756 0 ] (cb3-29) [ 330 0 R /XYZ 99.933071 514.967735 0 ] (cb3-3) [ 315 0 R /XYZ 99.933071 312.029014 0 ] (cb3-30) [ 330 0 R /XYZ 99.933071 496.020714 0 ] (cb3-31) [ 330 0 R /XYZ 99.933071 477.073692 0 ] (cb3-32) [ 330 0 R /XYZ 99.933071 458.126671 0 ] (cb3-33) [ 330 0 R /XYZ 99.933071 439.179649 0 ] (cb3-34) [ 330 0 R /XYZ 99.933071 420.232628 0 ] (cb3-35) [ 330 0 R /XYZ 99.933071 401.285606 0 ] (cb3-36) [ 330 0 R /XYZ 99.933071 382.338585 0 ] (cb3-37) [ 330 0 R /XYZ 99.933071 363.391563 0 ] (cb3-38) [ 330 0 R /XYZ 99.933071 344.444542 0 ] (cb3-39) [ 330 0 R /XYZ 99.933071 325.497520 0 ] (cb3-4) [ 315 0 R /XYZ 99.933071 274.134971 0 ] (cb3-40) [ 330 0 R /XYZ 99.933071 306.550499 0 ] (cb3-41) [ 330 0 R /XYZ 99.933071 287.603477 0 ] (cb3-42) [ 330 0 R /XYZ 99.933071 268.656456 0 ] (cb3-43) [ 330 0 R /XYZ 99.933071 249.709434 0 ] (cb3-44) [ 330 0 R /XYZ 99.933071 230.762413 0 ] (cb3-5) [ 315 0 R /XYZ 99.933071 255.187950 0 ] (cb3-6) [ 315 0 R /XYZ 99.933071 236.240928 0 ] (cb3-7) [ 315 0 R /XYZ 99.933071 217.293907 0 ] (cb3-8) [ 315 0 R /XYZ 99.933071 198.346885 0 ] (cb3-9) [ 315 0 R /XYZ 99.933071 179.399864 0 ] (cb30) [ 515 0 R /XYZ 84.259843 641.570079 0 ] (cb30-1) [ 515 0 R /XYZ 101.433071 639.873057 0 ] (cb33) [ 518 0 R /XYZ 84.259843 113.270079 0 ] (cb33-1) [ 518 0 R /XYZ 101.433071 111.573057 0 ] (cb36) [ 523 0 R /XYZ 84.259843 334.520079 0 ] (cb36-1) [ 523 0 R /XYZ 101.433071 332.823057 0 ] (cb39) [ 528 0 R /XYZ 84.259843 570.770079 0 ] (cb39-1) [ 528 0 R /XYZ 101.433071 569.073057 0 ] (cb4) [ 330 0 R /XYZ 84.259843 171.512413 0 ] (cb4-1) [ 330 0 R /XYZ 101.433071 169.815391 0 ] (cb42) [ 531 0 R /XYZ 84.259843 120.770079 0 ] (cb42-1) [ 531 0 R /XYZ 101.433071 119.073057 0 ] (cb45) [ 536 0 R /XYZ 84.259843 402.020079 0 ] (cb45-1) [ 536 0 R /XYZ 101.433071 400.323057 0 ] (cb48) [ 541 0 R /XYZ 84.259843 611.570079 0 ] (cb48-1) [ 541 0 R /XYZ 101.433071 609.873057 0 ] (cb51) [ 546 0 R /XYZ 84.259843 799.370079 0 ] (cb51-1) [ 546 0 R /XYZ 101.433071 797.673057 0 ] (cb54) [ 549 0 R /XYZ 84.259843 252.020079 0 ] (cb54-1) [ 549 0 R /XYZ 101.433071 250.323057 0 ] (cb55) [ 552 0 R /XYZ 84.259843 730.370079 0 ] (cb55-1) [ 552 0 R /XYZ 101.433071 728.673057 0 ] (cb56) [ 552 0 R /XYZ 84.259843 503.823057 0 ] (cb56-1) [ 552 0 R /XYZ 101.433071 502.126036 0 ] (cb59) [ 558 0 R /XYZ 84.259843 730.370079 0 ] (cb59-1) [ 558 0 R /XYZ 101.433071 728.673057 0 ] (cb62) [ 561 0 R /XYZ 84.259843 222.020079 0 ] (cb62-1) [ 561 0 R /XYZ 101.433071 220.323057 0 ] (cb65) [ 566 0 R /XYZ 84.259843 353.270079 0 ] (cb65-1) [ 566 0 R /XYZ 101.433071 351.573057 0 ] (cb68) [ 571 0 R /XYZ 84.259843 548.270079 0 ] (cb68-1) [ 571 0 R /XYZ 101.433071 546.573057 0 ] (cb7) [ 364 0 R /XYZ 84.259843 557.270079 0 ] (cb7-1) [ 364 0 R /XYZ 101.433071 555.573057 0 ] (cb7-10) [ 364 0 R /XYZ 99.933071 347.155821 0 ] (cb7-11) [ 364 0 R /XYZ 99.933071 328.208799 0 ] (cb7-12) [ 364 0 R /XYZ 99.933071 309.261778 0 ] (cb7-13) [ 364 0 R /XYZ 99.933071 290.314756 0 ] (cb7-14) [ 364 0 R /XYZ 99.933071 271.367735 0 ] (cb7-15) [ 364 0 R /XYZ 99.933071 252.420714 0 ] (cb7-16) [ 364 0 R /XYZ 99.933071 233.473692 0 ] (cb7-17) [ 364 0 R /XYZ 99.933071 214.526671 0 ] (cb7-18) [ 364 0 R /XYZ 99.933071 195.579649 0 ] (cb7-19) [ 364 0 R /XYZ 99.933071 176.632628 0 ] (cb7-2) [ 364 0 R /XYZ 99.933071 536.626036 0 ] (cb7-20) [ 364 0 R /XYZ 99.933071 157.685606 0 ] (cb7-21) [ 364 0 R /XYZ 99.933071 138.738585 0 ] (cb7-22) [ 364 0 R /XYZ 99.933071 119.791563 0 ] (cb7-23) [ 364 0 R /XYZ 99.933071 100.844542 0 ] (cb7-24) [ 389 0 R /XYZ 99.933071 799.173057 0 ] (cb7-25) [ 389 0 R /XYZ 99.933071 780.226036 0 ] (cb7-26) [ 389 0 R /XYZ 99.933071 761.279014 0 ] (cb7-27) [ 389 0 R /XYZ 99.933071 742.331993 0 ] (cb7-28) [ 389 0 R /XYZ 99.933071 723.384971 0 ] (cb7-29) [ 389 0 R /XYZ 99.933071 704.437950 0 ] (cb7-3) [ 364 0 R /XYZ 99.933071 517.679014 0 ] (cb7-30) [ 389 0 R /XYZ 99.933071 685.490928 0 ] (cb7-31) [ 389 0 R /XYZ 99.933071 666.543907 0 ] (cb7-32) [ 389 0 R /XYZ 99.933071 647.596885 0 ] (cb7-33) [ 389 0 R /XYZ 99.933071 628.649864 0 ] (cb7-34) [ 389 0 R /XYZ 99.933071 609.702842 0 ] (cb7-35) [ 389 0 R /XYZ 99.933071 590.755821 0 ] (cb7-36) [ 389 0 R /XYZ 99.933071 571.808799 0 ] (cb7-37) [ 389 0 R /XYZ 99.933071 552.861778 0 ] (cb7-38) [ 389 0 R /XYZ 99.933071 533.914756 0 ] (cb7-39) [ 389 0 R /XYZ 99.933071 514.967735 0 ] (cb7-4) [ 364 0 R /XYZ 99.933071 479.784971 0 ] (cb7-40) [ 389 0 R /XYZ 99.933071 496.020714 0 ] (cb7-41) [ 389 0 R /XYZ 99.933071 477.073692 0 ] (cb7-42) [ 389 0 R /XYZ 99.933071 458.126671 0 ] (cb7-43) [ 389 0 R /XYZ 99.933071 439.179649 0 ] (cb7-44) [ 389 0 R /XYZ 99.933071 420.232628 0 ] (cb7-45) [ 389 0 R /XYZ 99.933071 401.285606 0 ] (cb7-46) [ 389 0 R /XYZ 99.933071 382.338585 0 ] (cb7-47) [ 389 0 R /XYZ 99.933071 363.391563 0 ] (cb7-48) [ 389 0 R /XYZ 99.933071 344.444542 0 ] (cb7-49) [ 389 0 R /XYZ 99.933071 325.497520 0 ] (cb7-5) [ 364 0 R /XYZ 99.933071 441.890928 0 ] (cb7-50) [ 389 0 R /XYZ 99.933071 306.550499 0 ] (cb7-51) [ 389 0 R /XYZ 99.933071 287.603477 0 ] (cb7-52) [ 389 0 R /XYZ 99.933071 268.656456 0 ] (cb7-53) [ 389 0 R /XYZ 99.933071 230.762413 0 ] (cb7-54) [ 389 0 R /XYZ 99.933071 211.815391 0 ] (cb7-55) [ 389 0 R /XYZ 99.933071 192.868370 0 ] (cb7-56) [ 389 0 R /XYZ 99.933071 173.921348 0 ] (cb7-57) [ 389 0 R /XYZ 99.933071 154.974327 0 ] (cb7-58) [ 389 0 R /XYZ 99.933071 136.027305 0 ] (cb7-59) [ 389 0 R /XYZ 99.933071 117.080284 0 ] (cb7-6) [ 364 0 R /XYZ 99.933071 422.943907 0 ] (cb7-60) [ 427 0 R /XYZ 99.933071 799.173057 0 ] (cb7-61) [ 427 0 R /XYZ 99.933071 780.226036 0 ] (cb7-7) [ 364 0 R /XYZ 99.933071 403.996885 0 ] (cb7-8) [ 364 0 R /XYZ 99.933071 385.049864 0 ] (cb7-9) [ 364 0 R /XYZ 99.933071 366.102842 0 ] (cb71) [ 574 0 R /XYZ 84.259843 98.270079 0 ] (cb71-1) [ 574 0 R /XYZ 101.433071 96.573057 0 ] (cb74) [ 579 0 R /XYZ 84.259843 383.270079 0 ] (cb74-1) [ 579 0 R /XYZ 101.433071 381.573057 0 ] (cb77) [ 584 0 R /XYZ 84.259843 641.570079 0 ] (cb77-1) [ 584 0 R /XYZ 101.433071 639.873057 0 ] (cb8) [ 427 0 R /XYZ 84.259843 720.976036 0 ] (cb8-1) [ 427 0 R /XYZ 101.433071 719.279014 0 ] (cb80) [ 587 0 R /XYZ 84.259843 162.020079 0 ] (cb80-1) [ 587 0 R /XYZ 101.433071 160.323057 0 ] (cb83) [ 592 0 R /XYZ 84.259843 424.520079 0 ] (cb83-1) [ 592 0 R /XYZ 101.433071 422.823057 0 ] (cb86) [ 597 0 R /XYZ 84.259843 611.570079 0 ] (cb86-1) [ 597 0 R /XYZ 101.433071 609.873057 0 ] (cb89) [ 600 0 R /XYZ 84.259843 143.270079 0 ] (cb89-1) [ 600 0 R /XYZ 101.433071 141.573057 0 ] (cb92) [ 605 0 R /XYZ 84.259843 417.020079 0 ] (cb92-1) [ 605 0 R /XYZ 101.433071 415.323057 0 ] (cb95) [ 610 0 R /XYZ 84.259843 611.570079 0 ] (cb95-1) [ 610 0 R /XYZ 101.433071 609.873057 0 ] (cb98) [ 613 0 R /XYZ 84.259843 139.520079 0 ] (cb98-1) [ 613 0 R /XYZ 101.433071 137.823057 0 ] (cis-v1.6-kubernetes-benchmark---rancher-v2.6-with-kubernetes-v1.18-to-v1.21) [ 298 0 R /XYZ 84.259843 782.570079 0 ] (client-certificate-authentication-should-not-be-used-for-users-manual) [ 735 0 R /XYZ 84.259843 682.791496 0 ] (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) [ 885 0 R /XYZ 84.259843 682.791496 0 ] (consider-external-secret-storage-manual) [ 883 0 R /XYZ 84.259843 562.191496 0 ] (contentsbox) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (controller-manager) [ 672 0 R /XYZ 41.740157 784.430079 0 ] (controls) [ 303 0 R /XYZ 84.259843 609.981496 0 ] (create-administrative-boundaries-between-resources-using-namespaces-manual) [ 887 0 R /XYZ 84.259843 718.791496 0 ] (ensure-that-a-minimal-audit-policy-is-created-automated) [ 737 0 R /XYZ 84.259843 718.791496 0 ] (ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated) [ 728 0 R /XYZ 84.259843 499.820079 0 ] (ensure-that-all-namespaces-have-network-policies-defined-automated) [ 859 0 R /XYZ 84.259843 532.191496 0 ] (ensure-that-default-service-accounts-are-not-actively-used.-automated) [ 809 0 R /XYZ 84.259843 185.391496 0 ] (ensure-that-encryption-providers-are-appropriately-configured-automated) [ 639 0 R /XYZ 84.259843 331.070079 0 ] (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) [ 835 0 R /XYZ 84.259843 409.152842 0 ] (ensure-that-the---anonymous-auth-argument-is-set-to-false-automated) [ 502 0 R /XYZ 84.259843 718.791496 0 ] (ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated) [ 592 0 R /XYZ 84.259843 612.320079 0 ] (ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated) [ 597 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated) [ 600 0 R /XYZ 84.259843 331.070079 0 ] (ensure-that-the---audit-log-path-argument-is-set-automated) [ 587 0 R /XYZ 84.259843 349.820079 0 ] (ensure-that-the---authorization-mode-argument-includes-node-automated) [ 531 0 R /XYZ 84.259843 293.570079 0 ] (ensure-that-the---authorization-mode-argument-includes-rbac-automated) [ 536 0 R /XYZ 84.259843 574.820079 0 ] (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated) [ 528 0 R /XYZ 84.259843 743.570079 0 ] (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) [ 768 0 R /XYZ 84.259843 325.547453 0 ] (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) [ 706 0 R /XYZ 84.259843 406.070079 0 ] (ensure-that-the---basic-auth-file-argument-is-not-set-automated) [ 505 0 R /XYZ 84.259843 274.820079 0 ] (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) [ 685 0 R /XYZ 84.259843 591.770079 0 ] (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) [ 690 0 R /XYZ 84.259843 363.244475 0 ] (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) [ 696 0 R /XYZ 84.259843 682.791496 0 ] (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) [ 626 0 R /XYZ 84.259843 293.570079 0 ] (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) [ 773 0 R /XYZ 84.259843 672.873057 0 ] (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) [ 701 0 R /XYZ 84.259843 537.320079 0 ] (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) [ 636 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) [ 631 0 R /XYZ 84.259843 574.820079 0 ] (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) [ 618 0 R /XYZ 84.259843 574.820079 0 ] (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-automated) [ 788 0 R /XYZ 84.259843 198.526036 0 ] (ensure-that-the---hostname-override-argument-is-not-set-manual) [ 788 0 R /XYZ 84.259843 421.126036 0 ] (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) [ 571 0 R /XYZ 84.259843 706.070079 0 ] (ensure-that-the---insecure-port-argument-is-set-to-0-automated) [ 574 0 R /XYZ 84.259843 256.070079 0 ] (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) [ 749 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 745 0 R /XYZ 84.259843 419.879014 0 ] (ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated) [ 523 0 R /XYZ 84.259843 537.320079 0 ] (ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated) [ 518 0 R /XYZ 84.259843 331.070079 0 ] (ensure-that-the---kubelet-https-argument-is-set-to-true-automated) [ 515 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) [ 788 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) [ 723 0 R /XYZ 84.259843 649.820079 0 ] (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) [ 711 0 R /XYZ 84.259843 274.820079 0 ] (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) [ 718 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated) [ 584 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated-1) [ 672 0 R /XYZ 84.259843 145.744475 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated-2) [ 690 0 R /XYZ 84.259843 718.791496 0 ] (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) [ 784 0 R /XYZ 84.259843 443.570079 0 ] (ensure-that-the---read-only-port-argument-is-set-to-0-automated) [ 773 0 R /XYZ 84.259843 294.629014 0 ] (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) [ 605 0 R /XYZ 84.259843 574.820079 0 ] (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) [ 682 0 R /XYZ 84.259843 631.070079 0 ] (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated) [ 798 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) [ 579 0 R /XYZ 84.259843 556.070079 0 ] (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) [ 613 0 R /XYZ 84.259843 312.320079 0 ] (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) [ 610 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) [ 679 0 R /XYZ 84.259843 508.820079 0 ] (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) [ 778 0 R /XYZ 84.259843 638.926036 0 ] (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) [ 672 0 R /XYZ 84.259843 718.791496 0 ] (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) [ 623 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) [ 792 0 R /XYZ 84.259843 524.926036 0 ] (ensure-that-the---token-auth-file-parameter-is-not-set-automated) [ 510 0 R /XYZ 84.259843 556.070079 0 ] (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) [ 675 0 R /XYZ 84.259843 330.123057 0 ] (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) [ 311 0 R /XYZ 84.259843 458.476036 0 ] (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 311 0 R /XYZ 84.259843 579.076036 0 ] (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) [ 544 0 R /XYZ 84.259843 256.070079 0 ] (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) [ 549 0 R /XYZ 84.259843 424.820079 0 ] (ensure-that-the-admission-control-plugin-eventratelimit-is-set-automated) [ 541 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) [ 556 0 R /XYZ 84.259843 199.820079 0 ] (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) [ 566 0 R /XYZ 84.259843 556.070079 0 ] (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) [ 561 0 R /XYZ 84.259843 424.820079 0 ] (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) [ 549 0 R /XYZ 84.259843 213.273057 0 ] (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) [ 552 0 R /XYZ 84.259843 691.623057 0 ] (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) [ 768 0 R /XYZ 84.259843 718.791496 0 ] (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated) [ 645 0 R /XYZ 84.259843 162.841563 0 ] (ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 307 0 R /XYZ 84.259843 532.191496 0 ] (ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 307 0 R /XYZ 84.259843 682.791496 0 ] (ensure-that-the-audit-policy-covers-key-security-concerns-manual) [ 740 0 R /XYZ 84.259843 312.320079 0 ] (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 749 0 R /XYZ 84.259843 443.429014 0 ] (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) [ 758 0 R /XYZ 84.259843 733.820079 0 ] (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) [ 809 0 R /XYZ 84.259843 682.791496 0 ] (ensure-that-the-cni-in-use-supports-network-policies-manual) [ 859 0 R /XYZ 84.259843 682.791496 0 ] (ensure-that-the-container-network-interface-file-ownership-is-set-to-rootroot-manual) [ 311 0 R /XYZ 84.259843 760.623057 0 ] (ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual) [ 309 0 R /XYZ 84.259843 226.970079 0 ] (ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 307 0 R /XYZ 84.259843 245.991496 0 ] (ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 307 0 R /XYZ 84.259843 396.591496 0 ] (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) [ 315 0 R /XYZ 84.259843 648.770079 0 ] (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 315 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) [ 499 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) [ 486 0 R /XYZ 84.259843 409.152842 0 ] (ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 309 0 R /XYZ 84.259843 362.570079 0 ] (ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 309 0 R /XYZ 84.259843 513.170079 0 ] (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) [ 758 0 R /XYZ 84.259843 313.143907 0 ] (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) [ 766 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-automated) [ 802 0 R /XYZ 84.259843 295.023057 0 ] (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) [ 742 0 R /XYZ 84.259843 547.191496 0 ] (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 742 0 R /XYZ 84.259843 682.791496 0 ] (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 364 0 R /XYZ 84.259843 733.820079 0 ] (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) [ 315 0 R /XYZ 84.259843 513.170079 0 ] (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated) [ 427 0 R /XYZ 84.259843 541.781993 0 ] (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-automated) [ 745 0 R /XYZ 84.259843 733.820079 0 ] (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) [ 685 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 309 0 R /XYZ 84.259843 648.770079 0 ] (ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 309 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) [ 311 0 R /XYZ 84.259843 202.276036 0 ] (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 311 0 R /XYZ 84.259843 337.876036 0 ] (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) [ 887 0 R /XYZ 84.259843 598.191496 0 ] (etcd-node-configuration-files) [ 696 0 R /XYZ 41.740157 784.430079 0 ] (extensible-admission-control) [ 885 0 R /XYZ 41.740157 784.430079 0 ] (general-policies) [ 887 0 R /XYZ 41.740157 784.430079 0 ] (header_bottom_text) [ 6 0 R /XYZ 85.009843 392.718898 0 ] (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-automated) [ 742 0 R /XYZ 84.259843 411.591496 0 ] (kubelet) [ 768 0 R /XYZ 41.740157 784.430079 0 ] (logging) [ 737 0 R /XYZ 41.740157 784.430079 0 ] (master-node-configuration-files) [ 307 0 R /XYZ 41.740157 784.430079 0 ] (minimize-access-to-create-pods-manual) [ 809 0 R /XYZ 84.259843 290.991496 0 ] (minimize-access-to-secrets-manual) [ 809 0 R /XYZ 84.259843 517.191496 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) [ 847 0 R /XYZ 84.259843 212.250432 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) [ 850 0 R /XYZ 84.259843 574.229014 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) [ 847 0 R /XYZ 84.259843 583.191496 0 ] (minimize-the-admission-of-containers-with-added-capabilities-manual) [ 854 0 R /XYZ 84.259843 269.081993 0 ] (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) [ 850 0 R /XYZ 84.259843 203.287950 0 ] (minimize-the-admission-of-containers-with-capabilities-assigned-manual) [ 854 0 R /XYZ 84.259843 148.481993 0 ] (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) [ 854 0 R /XYZ 84.259843 404.681993 0 ] (minimize-the-admission-of-privileged-containers-manual) [ 847 0 R /XYZ 84.259843 718.791496 0 ] (minimize-the-admission-of-root-containers-manual) [ 854 0 R /XYZ 84.259843 555.281993 0 ] (minimize-wildcard-use-in-roles-and-clusterroles-manual) [ 809 0 R /XYZ 84.259843 411.591496 0 ] (network-policies-and-cni) [ 859 0 R /XYZ 41.740157 784.430079 0 ] (overview) [ 298 0 R /XYZ 84.259843 700.022079 0 ] (pod-security-policies) [ 847 0 R /XYZ 41.740157 784.430079 0 ] (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) [ 883 0 R /XYZ 84.259843 682.791496 0 ] (rbac-and-service-accounts) [ 809 0 R /XYZ 41.740157 784.430079 0 ] (scheduler) [ 690 0 R /XYZ 41.740157 784.430079 0 ] (secrets-management) [ 883 0 R /XYZ 41.740157 784.430079 0 ] (testing-controls-methodology) [ 298 0 R /XYZ 84.259843 161.276079 0 ] (the-default-namespace-should-not-be-used-automated) [ 887 0 R /XYZ 84.259843 176.991496 0 ] (title-block-header) [ 6 0 R /XYZ 84.259843 502.818898 0 ] (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) [ 802 0 R /XYZ 84.259843 593.570079 0 ] (worker-node-configuration-files) [ 742 0 R /XYZ 41.740157 784.430079 0 ] ] +/Names [ (TOC) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (api-server) [ 508 0 R /XYZ 41.740157 784.430079 0 ] (apply-security-context-to-your-pods-and-containers-manual) [ 889 0 R /XYZ 84.259843 324.051496 0 ] (authentication-and-authorization) [ 739 0 R /XYZ 41.740157 784.430079 0 ] (cb1) [ 315 0 R /XYZ 84.259843 207.170079 0 ] (cb1-1) [ 315 0 R /XYZ 101.433071 205.473057 0 ] (cb101) [ 624 0 R /XYZ 84.259843 715.370079 0 ] (cb101-1) [ 624 0 R /XYZ 101.433071 713.673057 0 ] (cb104) [ 627 0 R /XYZ 84.259843 241.820079 0 ] (cb104-1) [ 627 0 R /XYZ 101.433071 240.123057 0 ] (cb107) [ 632 0 R /XYZ 84.259843 463.070079 0 ] (cb107-1) [ 632 0 R /XYZ 101.433071 461.373057 0 ] (cb11) [ 436 0 R /XYZ 84.259843 543.320079 0 ] (cb11-1) [ 436 0 R /XYZ 101.433071 541.623057 0 ] (cb11-10) [ 436 0 R /XYZ 99.933071 333.205821 0 ] (cb11-11) [ 436 0 R /XYZ 99.933071 314.258799 0 ] (cb11-12) [ 436 0 R /XYZ 99.933071 295.311778 0 ] (cb11-13) [ 436 0 R /XYZ 99.933071 276.364756 0 ] (cb11-14) [ 436 0 R /XYZ 99.933071 257.417735 0 ] (cb11-15) [ 436 0 R /XYZ 99.933071 238.470714 0 ] (cb11-16) [ 436 0 R /XYZ 99.933071 219.523692 0 ] (cb11-17) [ 436 0 R /XYZ 99.933071 200.576671 0 ] (cb11-18) [ 436 0 R /XYZ 99.933071 181.629649 0 ] (cb11-19) [ 436 0 R /XYZ 99.933071 162.682628 0 ] (cb11-2) [ 436 0 R /XYZ 99.933071 522.676036 0 ] (cb11-20) [ 436 0 R /XYZ 99.933071 143.735606 0 ] (cb11-21) [ 436 0 R /XYZ 99.933071 124.788585 0 ] (cb11-22) [ 436 0 R /XYZ 99.933071 105.841563 0 ] (cb11-23) [ 460 0 R /XYZ 99.933071 799.173057 0 ] (cb11-24) [ 460 0 R /XYZ 99.933071 780.226036 0 ] (cb11-25) [ 460 0 R /XYZ 99.933071 761.279014 0 ] (cb11-26) [ 460 0 R /XYZ 99.933071 742.331993 0 ] (cb11-27) [ 460 0 R /XYZ 99.933071 723.384971 0 ] (cb11-28) [ 460 0 R /XYZ 99.933071 704.437950 0 ] (cb11-29) [ 460 0 R /XYZ 99.933071 685.490928 0 ] (cb11-3) [ 436 0 R /XYZ 99.933071 503.729014 0 ] (cb11-30) [ 460 0 R /XYZ 99.933071 666.543907 0 ] (cb11-31) [ 460 0 R /XYZ 99.933071 647.596885 0 ] (cb11-32) [ 460 0 R /XYZ 99.933071 628.649864 0 ] (cb11-33) [ 460 0 R /XYZ 99.933071 609.702842 0 ] (cb11-34) [ 460 0 R /XYZ 99.933071 590.755821 0 ] (cb11-35) [ 460 0 R /XYZ 99.933071 571.808799 0 ] (cb11-36) [ 460 0 R /XYZ 99.933071 552.861778 0 ] (cb11-37) [ 460 0 R /XYZ 99.933071 533.914756 0 ] (cb11-38) [ 460 0 R /XYZ 99.933071 514.967735 0 ] (cb11-39) [ 460 0 R /XYZ 99.933071 496.020714 0 ] (cb11-4) [ 436 0 R /XYZ 99.933071 465.834971 0 ] (cb11-40) [ 460 0 R /XYZ 99.933071 477.073692 0 ] (cb11-41) [ 460 0 R /XYZ 99.933071 458.126671 0 ] (cb11-42) [ 460 0 R /XYZ 99.933071 439.179649 0 ] (cb11-43) [ 460 0 R /XYZ 99.933071 420.232628 0 ] (cb11-44) [ 460 0 R /XYZ 99.933071 401.285606 0 ] (cb11-45) [ 460 0 R /XYZ 99.933071 382.338585 0 ] (cb11-46) [ 460 0 R /XYZ 99.933071 363.391563 0 ] (cb11-47) [ 460 0 R /XYZ 99.933071 344.444542 0 ] (cb11-48) [ 460 0 R /XYZ 99.933071 325.497520 0 ] (cb11-49) [ 460 0 R /XYZ 99.933071 306.550499 0 ] (cb11-5) [ 436 0 R /XYZ 99.933071 427.940928 0 ] (cb11-50) [ 460 0 R /XYZ 99.933071 287.603477 0 ] (cb11-51) [ 460 0 R /XYZ 99.933071 268.656456 0 ] (cb11-52) [ 460 0 R /XYZ 99.933071 249.709434 0 ] (cb11-53) [ 460 0 R /XYZ 99.933071 211.815391 0 ] (cb11-54) [ 460 0 R /XYZ 99.933071 192.868370 0 ] (cb11-55) [ 460 0 R /XYZ 99.933071 173.921348 0 ] (cb11-56) [ 460 0 R /XYZ 99.933071 154.974327 0 ] (cb11-57) [ 460 0 R /XYZ 99.933071 136.027305 0 ] (cb11-58) [ 460 0 R /XYZ 99.933071 117.080284 0 ] (cb11-59) [ 460 0 R /XYZ 99.933071 98.133262 0 ] (cb11-6) [ 436 0 R /XYZ 99.933071 408.993907 0 ] (cb11-60) [ 499 0 R /XYZ 99.933071 799.173057 0 ] (cb11-61) [ 499 0 R /XYZ 99.933071 780.226036 0 ] (cb11-7) [ 436 0 R /XYZ 99.933071 390.046885 0 ] (cb11-8) [ 436 0 R /XYZ 99.933071 371.099864 0 ] (cb11-9) [ 436 0 R /XYZ 99.933071 352.152842 0 ] (cb110) [ 637 0 R /XYZ 84.259843 715.370079 0 ] (cb110-1) [ 637 0 R /XYZ 101.433071 713.673057 0 ] (cb113) [ 640 0 R /XYZ 84.259843 241.820079 0 ] (cb113-1) [ 640 0 R /XYZ 101.433071 240.123057 0 ] (cb116) [ 645 0 R /XYZ 84.259843 511.820079 0 ] (cb116-1) [ 645 0 R /XYZ 101.433071 510.123057 0 ] (cb116-10) [ 645 0 R /XYZ 99.933071 282.758799 0 ] (cb116-11) [ 645 0 R /XYZ 99.933071 263.811778 0 ] (cb116-12) [ 645 0 R /XYZ 99.933071 244.864756 0 ] (cb116-13) [ 645 0 R /XYZ 99.933071 225.917735 0 ] (cb116-14) [ 645 0 R /XYZ 99.933071 206.970714 0 ] (cb116-15) [ 645 0 R /XYZ 99.933071 188.023692 0 ] (cb116-16) [ 645 0 R /XYZ 99.933071 169.076671 0 ] (cb116-17) [ 645 0 R /XYZ 99.933071 150.129649 0 ] (cb116-18) [ 645 0 R /XYZ 99.933071 131.182628 0 ] (cb116-19) [ 645 0 R /XYZ 99.933071 112.235606 0 ] (cb116-2) [ 645 0 R /XYZ 99.933071 491.176036 0 ] (cb116-20) [ 645 0 R /XYZ 99.933071 93.288585 0 ] (cb116-21) [ 667 0 R /XYZ 99.933071 799.173057 0 ] (cb116-22) [ 667 0 R /XYZ 99.933071 780.226036 0 ] (cb116-23) [ 667 0 R /XYZ 99.933071 761.279014 0 ] (cb116-24) [ 667 0 R /XYZ 99.933071 742.331993 0 ] (cb116-25) [ 667 0 R /XYZ 99.933071 723.384971 0 ] (cb116-3) [ 645 0 R /XYZ 99.933071 472.229014 0 ] (cb116-4) [ 645 0 R /XYZ 99.933071 434.334971 0 ] (cb116-5) [ 645 0 R /XYZ 99.933071 415.387950 0 ] (cb116-6) [ 645 0 R /XYZ 99.933071 396.440928 0 ] (cb116-7) [ 645 0 R /XYZ 99.933071 377.493907 0 ] (cb116-8) [ 645 0 R /XYZ 99.933071 358.546885 0 ] (cb116-9) [ 645 0 R /XYZ 99.933071 320.652842 0 ] (cb117) [ 667 0 R /XYZ 84.259843 664.134971 0 ] (cb117-1) [ 667 0 R /XYZ 101.433071 662.437950 0 ] (cb12) [ 499 0 R /XYZ 84.259843 720.976036 0 ] (cb12-1) [ 499 0 R /XYZ 101.433071 719.279014 0 ] (cb120) [ 667 0 R /XYZ 84.259843 290.887950 0 ] (cb120-1) [ 667 0 R /XYZ 101.433071 289.190928 0 ] (cb121) [ 676 0 R /XYZ 84.259843 550.251496 0 ] (cb121-1) [ 676 0 R /XYZ 101.433071 548.554475 0 ] (cb124) [ 679 0 R /XYZ 84.259843 715.370079 0 ] (cb124-1) [ 679 0 R /XYZ 101.433071 713.673057 0 ] (cb127) [ 679 0 R /XYZ 84.259843 162.123057 0 ] (cb127-1) [ 679 0 R /XYZ 101.433071 160.426036 0 ] (cb130) [ 683 0 R /XYZ 84.259843 325.820079 0 ] (cb130-1) [ 683 0 R /XYZ 101.433071 324.123057 0 ] (cb133) [ 686 0 R /XYZ 84.259843 500.570079 0 ] (cb133-1) [ 686 0 R /XYZ 101.433071 498.873057 0 ] (cb136) [ 689 0 R /XYZ 84.259843 441.170079 0 ] (cb136-1) [ 689 0 R /XYZ 101.433071 439.473057 0 ] (cb139) [ 694 0 R /XYZ 84.259843 565.251496 0 ] (cb139-1) [ 694 0 R /XYZ 101.433071 563.554475 0 ] (cb142) [ 694 0 R /XYZ 84.259843 214.504475 0 ] (cb142-1) [ 694 0 R /XYZ 101.433071 212.807453 0 ] (cb145) [ 700 0 R /XYZ 84.259843 514.251496 0 ] (cb145-1) [ 700 0 R /XYZ 101.433071 512.554475 0 ] (cb148) [ 705 0 R /XYZ 84.259843 403.070079 0 ] (cb148-1) [ 705 0 R /XYZ 101.433071 401.373057 0 ] (cb15) [ 499 0 R /XYZ 84.259843 392.729014 0 ] (cb15-1) [ 499 0 R /XYZ 101.433071 391.031993 0 ] (cb151) [ 710 0 R /XYZ 84.259843 290.570079 0 ] (cb151-1) [ 710 0 R /XYZ 101.433071 288.873057 0 ] (cb154) [ 715 0 R /XYZ 84.259843 148.070079 0 ] (cb154-1) [ 715 0 R /XYZ 101.433071 146.373057 0 ] (cb157) [ 722 0 R /XYZ 84.259843 715.370079 0 ] (cb157-1) [ 722 0 R /XYZ 101.433071 713.673057 0 ] (cb160) [ 727 0 R /XYZ 84.259843 571.820079 0 ] (cb160-1) [ 727 0 R /XYZ 101.433071 570.123057 0 ] (cb163) [ 732 0 R /XYZ 84.259843 425.570079 0 ] (cb163-1) [ 732 0 R /XYZ 101.433071 423.873057 0 ] (cb166) [ 741 0 R /XYZ 84.259843 595.251496 0 ] (cb166-1) [ 741 0 R /XYZ 101.433071 593.554475 0 ] (cb169) [ 746 0 R /XYZ 84.259843 267.651496 0 ] (cb169-1) [ 746 0 R /XYZ 101.433071 265.954475 0 ] (cb172) [ 749 0 R /XYZ 84.259843 607.820079 0 ] (cb172-1) [ 749 0 R /XYZ 101.433071 606.123057 0 ] (cb174) [ 749 0 R /XYZ 84.259843 298.679014 0 ] (cb174-1) [ 749 0 R /XYZ 101.433071 296.981993 0 ] (cb176) [ 753 0 R /XYZ 84.259843 715.370079 0 ] (cb176-1) [ 753 0 R /XYZ 101.433071 713.673057 0 ] (cb179) [ 753 0 R /XYZ 84.259843 375.479014 0 ] (cb179-1) [ 753 0 R /XYZ 101.433071 373.781993 0 ] (cb179-2) [ 753 0 R /XYZ 99.933071 354.834971 0 ] (cb179-3) [ 753 0 R /XYZ 99.933071 335.887950 0 ] (cb179-4) [ 753 0 R /XYZ 99.933071 279.046885 0 ] (cb179-5) [ 753 0 R /XYZ 99.933071 260.099864 0 ] (cb18) [ 505 0 R /XYZ 84.259843 715.370079 0 ] (cb18-1) [ 505 0 R /XYZ 101.433071 713.673057 0 ] (cb180) [ 753 0 R /XYZ 84.259843 200.849864 0 ] (cb180-1) [ 753 0 R /XYZ 101.433071 199.152842 0 ] (cb182) [ 762 0 R /XYZ 84.259843 655.220079 0 ] (cb182-1) [ 762 0 R /XYZ 101.433071 653.523057 0 ] (cb182-2) [ 762 0 R /XYZ 99.933071 634.576036 0 ] (cb182-3) [ 762 0 R /XYZ 99.933071 615.629014 0 ] (cb182-4) [ 762 0 R /XYZ 99.933071 558.787950 0 ] (cb182-5) [ 762 0 R /XYZ 99.933071 539.840928 0 ] (cb183) [ 762 0 R /XYZ 84.259843 480.590928 0 ] (cb183-1) [ 762 0 R /XYZ 101.433071 478.893907 0 ] (cb185) [ 772 0 R /XYZ 84.259843 490.251496 0 ] (cb185-1) [ 772 0 R /XYZ 101.433071 488.554475 0 ] (cb186) [ 772 0 R /XYZ 84.259843 429.304475 0 ] (cb186-1) [ 772 0 R /XYZ 101.433071 427.607453 0 ] (cb188) [ 772 0 R /XYZ 84.259843 116.807453 0 ] (cb188-1) [ 772 0 R /XYZ 101.433071 115.110432 0 ] (cb189) [ 777 0 R /XYZ 84.259843 772.370079 0 ] (cb189-1) [ 777 0 R /XYZ 101.433071 770.673057 0 ] (cb191) [ 777 0 R /XYZ 84.259843 459.873057 0 ] (cb191-1) [ 777 0 R /XYZ 101.433071 458.176036 0 ] (cb192) [ 777 0 R /XYZ 84.259843 398.926036 0 ] (cb192-1) [ 777 0 R /XYZ 101.433071 397.229014 0 ] (cb194) [ 782 0 R /XYZ 84.259843 799.370079 0 ] (cb194-1) [ 782 0 R /XYZ 101.433071 797.673057 0 ] (cb195) [ 782 0 R /XYZ 84.259843 738.423057 0 ] (cb195-1) [ 782 0 R /XYZ 101.433071 736.726036 0 ] (cb197) [ 782 0 R /XYZ 84.259843 410.926036 0 ] (cb197-1) [ 782 0 R /XYZ 101.433071 409.229014 0 ] (cb198) [ 782 0 R /XYZ 84.259843 349.979014 0 ] (cb198-1) [ 782 0 R /XYZ 101.433071 348.281993 0 ] (cb2) [ 318 0 R /XYZ 84.259843 730.370079 0 ] (cb2-1) [ 318 0 R /XYZ 101.433071 728.673057 0 ] (cb201) [ 788 0 R /XYZ 84.259843 230.570079 0 ] (cb201-1) [ 788 0 R /XYZ 101.433071 228.873057 0 ] (cb202) [ 788 0 R /XYZ 84.259843 169.623057 0 ] (cb202-1) [ 788 0 R /XYZ 101.433071 167.926036 0 ] (cb204) [ 792 0 R /XYZ 84.259843 583.970079 0 ] (cb204-1) [ 792 0 R /XYZ 101.433071 582.273057 0 ] (cb205) [ 792 0 R /XYZ 84.259843 523.023057 0 ] (cb205-1) [ 792 0 R /XYZ 101.433071 521.326036 0 ] (cb207) [ 796 0 R /XYZ 84.259843 700.370079 0 ] (cb207-1) [ 796 0 R /XYZ 101.433071 698.673057 0 ] (cb208) [ 796 0 R /XYZ 84.259843 639.423057 0 ] (cb208-1) [ 796 0 R /XYZ 101.433071 637.726036 0 ] (cb21) [ 508 0 R /XYZ 84.259843 565.251496 0 ] (cb21-1) [ 508 0 R /XYZ 101.433071 563.554475 0 ] (cb210) [ 796 0 R /XYZ 84.259843 296.926036 0 ] (cb210-1) [ 796 0 R /XYZ 101.433071 295.229014 0 ] (cb211) [ 796 0 R /XYZ 84.259843 235.979014 0 ] (cb211-1) [ 796 0 R /XYZ 101.433071 234.281993 0 ] (cb213) [ 802 0 R /XYZ 84.259843 640.370079 0 ] (cb213-1) [ 802 0 R /XYZ 101.433071 638.673057 0 ] (cb214) [ 802 0 R /XYZ 84.259843 579.423057 0 ] (cb214-1) [ 802 0 R /XYZ 101.433071 577.726036 0 ] (cb217) [ 806 0 R /XYZ 84.259843 428.570079 0 ] (cb217-1) [ 806 0 R /XYZ 101.433071 426.873057 0 ] (cb218) [ 806 0 R /XYZ 84.259843 131.823057 0 ] (cb218-1) [ 806 0 R /XYZ 101.433071 130.126036 0 ] (cb219) [ 810 0 R /XYZ 84.259843 799.370079 0 ] (cb219-1) [ 810 0 R /XYZ 101.433071 797.673057 0 ] (cb221) [ 815 0 R /XYZ 84.259843 768.620079 0 ] (cb221-1) [ 815 0 R /XYZ 101.433071 766.923057 0 ] (cb221-10) [ 815 0 R /XYZ 99.933071 596.399864 0 ] (cb221-11) [ 815 0 R /XYZ 99.933071 577.452842 0 ] (cb221-12) [ 815 0 R /XYZ 99.933071 482.717735 0 ] (cb221-13) [ 815 0 R /XYZ 99.933071 463.770714 0 ] (cb221-14) [ 815 0 R /XYZ 99.933071 444.823692 0 ] (cb221-15) [ 815 0 R /XYZ 99.933071 425.876671 0 ] (cb221-16) [ 815 0 R /XYZ 99.933071 406.929649 0 ] (cb221-17) [ 815 0 R /XYZ 99.933071 387.982628 0 ] (cb221-18) [ 815 0 R /XYZ 99.933071 350.088585 0 ] (cb221-19) [ 815 0 R /XYZ 99.933071 331.141563 0 ] (cb221-2) [ 815 0 R /XYZ 99.933071 747.976036 0 ] (cb221-20) [ 815 0 R /XYZ 99.933071 198.512413 0 ] (cb221-21) [ 815 0 R /XYZ 99.933071 179.565391 0 ] (cb221-22) [ 815 0 R /XYZ 99.933071 160.618370 0 ] (cb221-23) [ 815 0 R /XYZ 99.933071 103.777305 0 ] (cb221-24) [ 840 0 R /XYZ 99.933071 799.173057 0 ] (cb221-25) [ 840 0 R /XYZ 99.933071 780.226036 0 ] (cb221-26) [ 840 0 R /XYZ 99.933071 761.279014 0 ] (cb221-27) [ 840 0 R /XYZ 99.933071 742.331993 0 ] (cb221-28) [ 840 0 R /XYZ 99.933071 723.384971 0 ] (cb221-29) [ 840 0 R /XYZ 99.933071 704.437950 0 ] (cb221-3) [ 815 0 R /XYZ 99.933071 729.029014 0 ] (cb221-30) [ 840 0 R /XYZ 99.933071 685.490928 0 ] (cb221-31) [ 840 0 R /XYZ 99.933071 666.543907 0 ] (cb221-4) [ 815 0 R /XYZ 99.933071 710.081993 0 ] (cb221-5) [ 815 0 R /XYZ 99.933071 691.134971 0 ] (cb221-6) [ 815 0 R /XYZ 99.933071 672.187950 0 ] (cb221-7) [ 815 0 R /XYZ 99.933071 653.240928 0 ] (cb221-8) [ 815 0 R /XYZ 99.933071 634.293907 0 ] (cb221-9) [ 815 0 R /XYZ 99.933071 615.346885 0 ] (cb222) [ 840 0 R /XYZ 84.259843 607.293907 0 ] (cb222-1) [ 840 0 R /XYZ 101.433071 605.596885 0 ] (cb225) [ 851 0 R /XYZ 84.259843 434.451496 0 ] (cb225-1) [ 851 0 R /XYZ 101.433071 432.754475 0 ] (cb228) [ 854 0 R /XYZ 84.259843 799.370079 0 ] (cb228-1) [ 854 0 R /XYZ 101.433071 797.673057 0 ] (cb231) [ 854 0 R /XYZ 84.259843 448.229014 0 ] (cb231-1) [ 854 0 R /XYZ 101.433071 446.531993 0 ] (cb234) [ 858 0 R /XYZ 84.259843 799.370079 0 ] (cb234-1) [ 858 0 R /XYZ 101.433071 797.673057 0 ] (cb237) [ 861 0 R /XYZ 84.259843 394.701496 0 ] (cb237-1) [ 861 0 R /XYZ 101.433071 393.004475 0 ] (cb237-10) [ 861 0 R /XYZ 99.933071 222.481281 0 ] (cb237-11) [ 861 0 R /XYZ 99.933071 203.534260 0 ] (cb237-12) [ 861 0 R /XYZ 99.933071 165.640217 0 ] (cb237-13) [ 861 0 R /XYZ 99.933071 127.746174 0 ] (cb237-14) [ 861 0 R /XYZ 99.933071 108.799152 0 ] (cb237-15) [ 861 0 R /XYZ 99.933071 89.852131 0 ] (cb237-16) [ 878 0 R /XYZ 99.933071 799.173057 0 ] (cb237-17) [ 878 0 R /XYZ 99.933071 780.226036 0 ] (cb237-18) [ 878 0 R /XYZ 99.933071 761.279014 0 ] (cb237-19) [ 878 0 R /XYZ 99.933071 742.331993 0 ] (cb237-2) [ 861 0 R /XYZ 99.933071 374.057453 0 ] (cb237-3) [ 861 0 R /XYZ 99.933071 355.110432 0 ] (cb237-4) [ 861 0 R /XYZ 99.933071 336.163410 0 ] (cb237-5) [ 861 0 R /XYZ 99.933071 317.216389 0 ] (cb237-6) [ 861 0 R /XYZ 99.933071 298.269367 0 ] (cb237-7) [ 861 0 R /XYZ 99.933071 279.322346 0 ] (cb237-8) [ 861 0 R /XYZ 99.933071 260.375324 0 ] (cb237-9) [ 861 0 R /XYZ 99.933071 241.428303 0 ] (cb238) [ 878 0 R /XYZ 84.259843 683.081993 0 ] (cb238-1) [ 878 0 R /XYZ 101.433071 681.384971 0 ] (cb24) [ 511 0 R /XYZ 84.259843 106.820079 0 ] (cb24-1) [ 511 0 R /XYZ 101.433071 105.123057 0 ] (cb241) [ 891 0 R /XYZ 84.259843 768.620079 0 ] (cb241-1) [ 891 0 R /XYZ 101.433071 766.923057 0 ] (cb241-10) [ 891 0 R /XYZ 99.933071 596.399864 0 ] (cb241-11) [ 891 0 R /XYZ 99.933071 577.452842 0 ] (cb241-12) [ 891 0 R /XYZ 99.933071 520.611778 0 ] (cb241-13) [ 891 0 R /XYZ 99.933071 501.664756 0 ] (cb241-14) [ 891 0 R /XYZ 99.933071 482.717735 0 ] (cb241-15) [ 891 0 R /XYZ 99.933071 463.770714 0 ] (cb241-16) [ 891 0 R /XYZ 99.933071 444.823692 0 ] (cb241-17) [ 891 0 R /XYZ 99.933071 425.876671 0 ] (cb241-18) [ 891 0 R /XYZ 99.933071 406.929649 0 ] (cb241-2) [ 891 0 R /XYZ 99.933071 747.976036 0 ] (cb241-3) [ 891 0 R /XYZ 99.933071 729.029014 0 ] (cb241-4) [ 891 0 R /XYZ 99.933071 710.081993 0 ] (cb241-5) [ 891 0 R /XYZ 99.933071 691.134971 0 ] (cb241-6) [ 891 0 R /XYZ 99.933071 672.187950 0 ] (cb241-7) [ 891 0 R /XYZ 99.933071 653.240928 0 ] (cb241-8) [ 891 0 R /XYZ 99.933071 634.293907 0 ] (cb241-9) [ 891 0 R /XYZ 99.933071 615.346885 0 ] (cb242) [ 891 0 R /XYZ 84.259843 347.679649 0 ] (cb242-1) [ 891 0 R /XYZ 101.433071 345.982628 0 ] (cb27) [ 516 0 R /XYZ 84.259843 388.070079 0 ] (cb27-1) [ 516 0 R /XYZ 101.433071 386.373057 0 ] (cb3) [ 321 0 R /XYZ 84.259843 509.420079 0 ] (cb3-1) [ 321 0 R /XYZ 101.433071 507.723057 0 ] (cb3-10) [ 321 0 R /XYZ 99.933071 318.252842 0 ] (cb3-11) [ 321 0 R /XYZ 99.933071 299.305821 0 ] (cb3-12) [ 321 0 R /XYZ 99.933071 280.358799 0 ] (cb3-13) [ 321 0 R /XYZ 99.933071 261.411778 0 ] (cb3-14) [ 321 0 R /XYZ 99.933071 242.464756 0 ] (cb3-15) [ 321 0 R /XYZ 99.933071 223.517735 0 ] (cb3-16) [ 321 0 R /XYZ 99.933071 204.570714 0 ] (cb3-17) [ 321 0 R /XYZ 99.933071 185.623692 0 ] (cb3-18) [ 321 0 R /XYZ 99.933071 166.676671 0 ] (cb3-19) [ 321 0 R /XYZ 99.933071 147.729649 0 ] (cb3-2) [ 321 0 R /XYZ 99.933071 488.776036 0 ] (cb3-20) [ 321 0 R /XYZ 99.933071 128.782628 0 ] (cb3-21) [ 321 0 R /XYZ 99.933071 109.835606 0 ] (cb3-22) [ 321 0 R /XYZ 99.933071 90.888585 0 ] (cb3-23) [ 345 0 R /XYZ 99.933071 799.173057 0 ] (cb3-24) [ 345 0 R /XYZ 99.933071 780.226036 0 ] (cb3-25) [ 345 0 R /XYZ 99.933071 761.279014 0 ] (cb3-26) [ 345 0 R /XYZ 99.933071 742.331993 0 ] (cb3-27) [ 345 0 R /XYZ 99.933071 723.384971 0 ] (cb3-28) [ 345 0 R /XYZ 99.933071 704.437950 0 ] (cb3-29) [ 345 0 R /XYZ 99.933071 685.490928 0 ] (cb3-3) [ 321 0 R /XYZ 99.933071 469.829014 0 ] (cb3-30) [ 345 0 R /XYZ 99.933071 666.543907 0 ] (cb3-31) [ 345 0 R /XYZ 99.933071 647.596885 0 ] (cb3-32) [ 345 0 R /XYZ 99.933071 628.649864 0 ] (cb3-33) [ 345 0 R /XYZ 99.933071 609.702842 0 ] (cb3-34) [ 345 0 R /XYZ 99.933071 590.755821 0 ] (cb3-35) [ 345 0 R /XYZ 99.933071 571.808799 0 ] (cb3-36) [ 345 0 R /XYZ 99.933071 552.861778 0 ] (cb3-37) [ 345 0 R /XYZ 99.933071 533.914756 0 ] (cb3-38) [ 345 0 R /XYZ 99.933071 514.967735 0 ] (cb3-39) [ 345 0 R /XYZ 99.933071 496.020714 0 ] (cb3-4) [ 321 0 R /XYZ 99.933071 431.934971 0 ] (cb3-40) [ 345 0 R /XYZ 99.933071 477.073692 0 ] (cb3-41) [ 345 0 R /XYZ 99.933071 458.126671 0 ] (cb3-42) [ 345 0 R /XYZ 99.933071 439.179649 0 ] (cb3-43) [ 345 0 R /XYZ 99.933071 420.232628 0 ] (cb3-44) [ 345 0 R /XYZ 99.933071 401.285606 0 ] (cb3-5) [ 321 0 R /XYZ 99.933071 412.987950 0 ] (cb3-6) [ 321 0 R /XYZ 99.933071 394.040928 0 ] (cb3-7) [ 321 0 R /XYZ 99.933071 375.093907 0 ] (cb3-8) [ 321 0 R /XYZ 99.933071 356.146885 0 ] (cb3-9) [ 321 0 R /XYZ 99.933071 337.199864 0 ] (cb30) [ 521 0 R /XYZ 84.259843 643.970079 0 ] (cb30-1) [ 521 0 R /XYZ 101.433071 642.273057 0 ] (cb33) [ 524 0 R /XYZ 84.259843 136.820079 0 ] (cb33-1) [ 524 0 R /XYZ 101.433071 135.123057 0 ] (cb36) [ 529 0 R /XYZ 84.259843 358.070079 0 ] (cb36-1) [ 529 0 R /XYZ 101.433071 356.373057 0 ] (cb39) [ 534 0 R /XYZ 84.259843 628.970079 0 ] (cb39-1) [ 534 0 R /XYZ 101.433071 627.273057 0 ] (cb4) [ 345 0 R /XYZ 84.259843 342.035606 0 ] (cb4-1) [ 345 0 R /XYZ 101.433071 340.338585 0 ] (cb42) [ 537 0 R /XYZ 84.259843 181.820079 0 ] (cb42-1) [ 537 0 R /XYZ 101.433071 180.123057 0 ] (cb45) [ 542 0 R /XYZ 84.259843 463.070079 0 ] (cb45-1) [ 542 0 R /XYZ 101.433071 461.373057 0 ] (cb48) [ 547 0 R /XYZ 84.259843 715.370079 0 ] (cb48-1) [ 547 0 R /XYZ 101.433071 713.673057 0 ] (cb51) [ 550 0 R /XYZ 84.259843 181.820079 0 ] (cb51-1) [ 550 0 R /XYZ 101.433071 180.123057 0 ] (cb54) [ 555 0 R /XYZ 84.259843 350.570079 0 ] (cb54-1) [ 555 0 R /XYZ 101.433071 348.873057 0 ] (cb55) [ 555 0 R /XYZ 84.259843 113.823057 0 ] (cb55-1) [ 555 0 R /XYZ 101.433071 112.126036 0 ] (cb56) [ 559 0 R /XYZ 84.259843 613.970079 0 ] (cb56-1) [ 559 0 R /XYZ 101.433071 612.273057 0 ] (cb59) [ 562 0 R /XYZ 84.259843 144.320079 0 ] (cb59-1) [ 562 0 R /XYZ 101.433071 142.623057 0 ] (cb62) [ 567 0 R /XYZ 84.259843 358.070079 0 ] (cb62-1) [ 567 0 R /XYZ 101.433071 356.373057 0 ] (cb65) [ 572 0 R /XYZ 84.259843 508.070079 0 ] (cb65-1) [ 572 0 R /XYZ 101.433071 506.373057 0 ] (cb68) [ 577 0 R /XYZ 84.259843 715.370079 0 ] (cb68-1) [ 577 0 R /XYZ 101.433071 713.673057 0 ] (cb7) [ 370 0 R /XYZ 84.259843 711.620079 0 ] (cb7-1) [ 370 0 R /XYZ 101.433071 709.923057 0 ] (cb7-10) [ 370 0 R /XYZ 99.933071 501.505821 0 ] (cb7-11) [ 370 0 R /XYZ 99.933071 482.558799 0 ] (cb7-12) [ 370 0 R /XYZ 99.933071 463.611778 0 ] (cb7-13) [ 370 0 R /XYZ 99.933071 444.664756 0 ] (cb7-14) [ 370 0 R /XYZ 99.933071 425.717735 0 ] (cb7-15) [ 370 0 R /XYZ 99.933071 406.770714 0 ] (cb7-16) [ 370 0 R /XYZ 99.933071 387.823692 0 ] (cb7-17) [ 370 0 R /XYZ 99.933071 368.876671 0 ] (cb7-18) [ 370 0 R /XYZ 99.933071 349.929649 0 ] (cb7-19) [ 370 0 R /XYZ 99.933071 330.982628 0 ] (cb7-2) [ 370 0 R /XYZ 99.933071 690.976036 0 ] (cb7-20) [ 370 0 R /XYZ 99.933071 312.035606 0 ] (cb7-21) [ 370 0 R /XYZ 99.933071 293.088585 0 ] (cb7-22) [ 370 0 R /XYZ 99.933071 274.141563 0 ] (cb7-23) [ 370 0 R /XYZ 99.933071 255.194542 0 ] (cb7-24) [ 370 0 R /XYZ 99.933071 236.247520 0 ] (cb7-25) [ 370 0 R /XYZ 99.933071 217.300499 0 ] (cb7-26) [ 370 0 R /XYZ 99.933071 198.353477 0 ] (cb7-27) [ 370 0 R /XYZ 99.933071 179.406456 0 ] (cb7-28) [ 370 0 R /XYZ 99.933071 160.459434 0 ] (cb7-29) [ 370 0 R /XYZ 99.933071 141.512413 0 ] (cb7-3) [ 370 0 R /XYZ 99.933071 672.029014 0 ] (cb7-30) [ 370 0 R /XYZ 99.933071 122.565391 0 ] (cb7-31) [ 370 0 R /XYZ 99.933071 103.618370 0 ] (cb7-32) [ 403 0 R /XYZ 99.933071 799.173057 0 ] (cb7-33) [ 403 0 R /XYZ 99.933071 780.226036 0 ] (cb7-34) [ 403 0 R /XYZ 99.933071 761.279014 0 ] (cb7-35) [ 403 0 R /XYZ 99.933071 742.331993 0 ] (cb7-36) [ 403 0 R /XYZ 99.933071 723.384971 0 ] (cb7-37) [ 403 0 R /XYZ 99.933071 704.437950 0 ] (cb7-38) [ 403 0 R /XYZ 99.933071 685.490928 0 ] (cb7-39) [ 403 0 R /XYZ 99.933071 666.543907 0 ] (cb7-4) [ 370 0 R /XYZ 99.933071 634.134971 0 ] (cb7-40) [ 403 0 R /XYZ 99.933071 647.596885 0 ] (cb7-41) [ 403 0 R /XYZ 99.933071 628.649864 0 ] (cb7-42) [ 403 0 R /XYZ 99.933071 609.702842 0 ] (cb7-43) [ 403 0 R /XYZ 99.933071 590.755821 0 ] (cb7-44) [ 403 0 R /XYZ 99.933071 571.808799 0 ] (cb7-45) [ 403 0 R /XYZ 99.933071 552.861778 0 ] (cb7-46) [ 403 0 R /XYZ 99.933071 533.914756 0 ] (cb7-47) [ 403 0 R /XYZ 99.933071 514.967735 0 ] (cb7-48) [ 403 0 R /XYZ 99.933071 496.020714 0 ] (cb7-49) [ 403 0 R /XYZ 99.933071 477.073692 0 ] (cb7-5) [ 370 0 R /XYZ 99.933071 596.240928 0 ] (cb7-50) [ 403 0 R /XYZ 99.933071 458.126671 0 ] (cb7-51) [ 403 0 R /XYZ 99.933071 439.179649 0 ] (cb7-52) [ 403 0 R /XYZ 99.933071 420.232628 0 ] (cb7-53) [ 403 0 R /XYZ 99.933071 382.338585 0 ] (cb7-54) [ 403 0 R /XYZ 99.933071 363.391563 0 ] (cb7-55) [ 403 0 R /XYZ 99.933071 344.444542 0 ] (cb7-56) [ 403 0 R /XYZ 99.933071 325.497520 0 ] (cb7-57) [ 403 0 R /XYZ 99.933071 306.550499 0 ] (cb7-58) [ 403 0 R /XYZ 99.933071 287.603477 0 ] (cb7-59) [ 403 0 R /XYZ 99.933071 268.656456 0 ] (cb7-6) [ 370 0 R /XYZ 99.933071 577.293907 0 ] (cb7-60) [ 403 0 R /XYZ 99.933071 249.709434 0 ] (cb7-61) [ 403 0 R /XYZ 99.933071 230.762413 0 ] (cb7-7) [ 370 0 R /XYZ 99.933071 558.346885 0 ] (cb7-8) [ 370 0 R /XYZ 99.933071 539.399864 0 ] (cb7-9) [ 370 0 R /XYZ 99.933071 520.452842 0 ] (cb71) [ 580 0 R /XYZ 84.259843 271.820079 0 ] (cb71-1) [ 580 0 R /XYZ 101.433071 270.123057 0 ] (cb74) [ 585 0 R /XYZ 84.259843 538.070079 0 ] (cb74-1) [ 585 0 R /XYZ 101.433071 536.373057 0 ] (cb77) [ 588 0 R /XYZ 84.259843 103.070079 0 ] (cb77-1) [ 588 0 R /XYZ 101.433071 101.373057 0 ] (cb8) [ 403 0 R /XYZ 84.259843 171.512413 0 ] (cb8-1) [ 403 0 R /XYZ 101.433071 169.815391 0 ] (cb80) [ 593 0 R /XYZ 84.259843 373.070079 0 ] (cb80-1) [ 593 0 R /XYZ 101.433071 371.373057 0 ] (cb83) [ 598 0 R /XYZ 84.259843 628.970079 0 ] (cb83-1) [ 598 0 R /XYZ 101.433071 627.273057 0 ] (cb86) [ 601 0 R /XYZ 84.259843 181.820079 0 ] (cb86-1) [ 601 0 R /XYZ 101.433071 180.123057 0 ] (cb89) [ 606 0 R /XYZ 84.259843 463.070079 0 ] (cb89-1) [ 606 0 R /XYZ 101.433071 461.373057 0 ] (cb92) [ 611 0 R /XYZ 84.259843 715.370079 0 ] (cb92-1) [ 611 0 R /XYZ 101.433071 713.673057 0 ] (cb95) [ 614 0 R /XYZ 84.259843 223.070079 0 ] (cb95-1) [ 614 0 R /XYZ 101.433071 221.373057 0 ] (cb98) [ 619 0 R /XYZ 84.259843 463.070079 0 ] (cb98-1) [ 619 0 R /XYZ 101.433071 461.373057 0 ] (cis-v1.6-kubernetes-benchmark---rancher-v2.6-with-kubernetes-v1.18-to-v1.21) [ 304 0 R /XYZ 84.259843 784.970079 0 ] (client-certificate-authentication-should-not-be-used-for-users-manual) [ 739 0 R /XYZ 84.259843 684.651496 0 ] (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) [ 887 0 R /XYZ 84.259843 684.651496 0 ] (consider-external-secret-storage-manual) [ 885 0 R /XYZ 84.259843 568.851496 0 ] (contentsbox) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (controller-manager) [ 676 0 R /XYZ 41.740157 784.430079 0 ] (controls) [ 309 0 R /XYZ 84.259843 608.631496 0 ] (create-administrative-boundaries-between-resources-using-namespaces-manual) [ 889 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-a-minimal-audit-policy-is-created-automated) [ 741 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated) [ 732 0 R /XYZ 84.259843 595.970079 0 ] (ensure-that-all-namespaces-have-network-policies-defined-automated) [ 861 0 R /XYZ 84.259843 538.851496 0 ] (ensure-that-default-service-accounts-are-not-actively-used.-automated) [ 813 0 R /XYZ 84.259843 206.451496 0 ] (ensure-that-encryption-providers-are-appropriately-configured-automated) [ 645 0 R /XYZ 84.259843 670.970079 0 ] (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) [ 840 0 R /XYZ 84.259843 449.446885 0 ] (ensure-that-the---anonymous-auth-argument-is-set-to-false-automated) [ 508 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated) [ 598 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated) [ 601 0 R /XYZ 84.259843 352.220079 0 ] (ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated) [ 606 0 R /XYZ 84.259843 633.470079 0 ] (ensure-that-the---audit-log-path-argument-is-set-automated) [ 593 0 R /XYZ 84.259843 558.470079 0 ] (ensure-that-the---authorization-mode-argument-includes-node-automated) [ 537 0 R /XYZ 84.259843 352.220079 0 ] (ensure-that-the---authorization-mode-argument-includes-rbac-automated) [ 542 0 R /XYZ 84.259843 633.470079 0 ] (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated) [ 534 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) [ 772 0 R /XYZ 84.259843 332.207453 0 ] (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) [ 710 0 R /XYZ 84.259843 445.970079 0 ] (ensure-that-the---basic-auth-file-argument-is-not-set-automated) [ 511 0 R /XYZ 84.259843 277.220079 0 ] (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) [ 689 0 R /XYZ 84.259843 596.570079 0 ] (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) [ 694 0 R /XYZ 84.259843 369.904475 0 ] (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) [ 700 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) [ 632 0 R /XYZ 84.259843 633.470079 0 ] (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) [ 777 0 R /XYZ 84.259843 675.273057 0 ] (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) [ 705 0 R /XYZ 84.259843 558.470079 0 ] (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) [ 640 0 R /XYZ 84.259843 427.220079 0 ] (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) [ 635 0 R /XYZ 84.259843 183.470079 0 ] (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) [ 622 0 R /XYZ 84.259843 183.470079 0 ] (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-automated) [ 792 0 R /XYZ 84.259843 208.126036 0 ] (ensure-that-the---hostname-override-argument-is-not-set-manual) [ 792 0 R /XYZ 84.259843 425.926036 0 ] (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) [ 575 0 R /XYZ 84.259843 145.970079 0 ] (ensure-that-the---insecure-port-argument-is-set-to-0-automated) [ 580 0 R /XYZ 84.259843 427.220079 0 ] (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) [ 749 0 R /XYZ 84.259843 163.687950 0 ] (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 749 0 R /XYZ 84.259843 454.079014 0 ] (ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated) [ 529 0 R /XYZ 84.259843 558.470079 0 ] (ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated) [ 524 0 R /XYZ 84.259843 352.220079 0 ] (ensure-that-the---kubelet-https-argument-is-set-to-true-automated) [ 521 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) [ 792 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) [ 727 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) [ 715 0 R /XYZ 84.259843 333.470079 0 ] (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) [ 720 0 R /XYZ 84.259843 183.470079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated) [ 588 0 R /XYZ 84.259843 258.470079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated-1) [ 676 0 R /XYZ 84.259843 167.404475 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated-2) [ 694 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) [ 788 0 R /XYZ 84.259843 445.970079 0 ] (ensure-that-the---read-only-port-argument-is-set-to-0-automated) [ 777 0 R /XYZ 84.259843 301.829014 0 ] (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) [ 609 0 R /XYZ 84.259843 183.470079 0 ] (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) [ 686 0 R /XYZ 84.259843 670.970079 0 ] (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated) [ 796 0 R /XYZ 84.259843 138.881993 0 ] (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) [ 585 0 R /XYZ 84.259843 708.470079 0 ] (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) [ 619 0 R /XYZ 84.259843 633.470079 0 ] (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) [ 614 0 R /XYZ 84.259843 408.470079 0 ] (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) [ 683 0 R /XYZ 84.259843 511.220079 0 ] (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) [ 782 0 R /XYZ 84.259843 641.326036 0 ] (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) [ 676 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) [ 627 0 R /XYZ 84.259843 427.220079 0 ] (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) [ 796 0 R /XYZ 84.259843 542.326036 0 ] (ensure-that-the---token-auth-file-parameter-is-not-set-automated) [ 516 0 R /XYZ 84.259843 558.470079 0 ] (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) [ 679 0 R /XYZ 84.259843 332.523057 0 ] (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) [ 318 0 R /XYZ 84.259843 578.223057 0 ] (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 318 0 R /XYZ 84.259843 694.023057 0 ] (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) [ 550 0 R /XYZ 84.259843 352.220079 0 ] (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) [ 555 0 R /XYZ 84.259843 520.970079 0 ] (ensure-that-the-admission-control-plugin-eventratelimit-is-set-automated) [ 545 0 R /XYZ 84.259843 183.470079 0 ] (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) [ 562 0 R /XYZ 84.259843 314.720079 0 ] (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) [ 572 0 R /XYZ 84.259843 708.470079 0 ] (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) [ 567 0 R /XYZ 84.259843 558.470079 0 ] (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) [ 555 0 R /XYZ 84.259843 314.223057 0 ] (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) [ 559 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) [ 772 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated) [ 667 0 R /XYZ 84.259843 506.287950 0 ] (ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 313 0 R /XYZ 84.259843 553.851496 0 ] (ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 313 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-audit-policy-covers-key-security-concerns-manual) [ 744 0 R /XYZ 84.259843 314.720079 0 ] (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 753 0 R /XYZ 84.259843 519.629014 0 ] (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) [ 762 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) [ 813 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-cni-in-use-supports-network-policies-manual) [ 861 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-container-network-interface-file-ownership-is-set-to-rootroot-manual) [ 315 0 R /XYZ 84.259843 170.823057 0 ] (ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual) [ 315 0 R /XYZ 84.259843 347.570079 0 ] (ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 313 0 R /XYZ 84.259843 277.251496 0 ] (ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 313 0 R /XYZ 84.259843 423.051496 0 ] (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) [ 321 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 318 0 R /XYZ 84.259843 200.823057 0 ] (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) [ 499 0 R /XYZ 84.259843 234.881993 0 ] (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) [ 499 0 R /XYZ 84.259843 563.129014 0 ] (ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 315 0 R /XYZ 84.259843 478.370079 0 ] (ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 315 0 R /XYZ 84.259843 609.170079 0 ] (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) [ 762 0 R /XYZ 84.259843 383.493907 0 ] (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) [ 762 0 R /XYZ 84.259843 195.693907 0 ] (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-automated) [ 806 0 R /XYZ 84.259843 392.223057 0 ] (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) [ 746 0 R /XYZ 84.259843 553.851496 0 ] (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 746 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 345 0 R /XYZ 84.259843 184.188585 0 ] (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) [ 321 0 R /XYZ 84.259843 668.570079 0 ] (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated) [ 436 0 R /XYZ 84.259843 702.470079 0 ] (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-automated) [ 749 0 R /XYZ 84.259843 763.220079 0 ] (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) [ 689 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 315 0 R /XYZ 84.259843 739.970079 0 ] (ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 313 0 R /XYZ 84.259843 146.451496 0 ] (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) [ 318 0 R /XYZ 84.259843 331.623057 0 ] (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 318 0 R /XYZ 84.259843 462.423057 0 ] (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) [ 889 0 R /XYZ 84.259843 604.851496 0 ] (etcd-node-configuration-files) [ 700 0 R /XYZ 41.740157 784.430079 0 ] (extensible-admission-control) [ 887 0 R /XYZ 41.740157 784.430079 0 ] (general-policies) [ 889 0 R /XYZ 41.740157 784.430079 0 ] (header_bottom_text) [ 6 0 R /XYZ 85.009843 392.718898 0 ] (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-automated) [ 746 0 R /XYZ 84.259843 423.051496 0 ] (kubelet) [ 772 0 R /XYZ 41.740157 784.430079 0 ] (logging) [ 741 0 R /XYZ 41.740157 784.430079 0 ] (master-node-configuration-files) [ 313 0 R /XYZ 41.740157 784.430079 0 ] (minimize-access-to-create-pods-manual) [ 813 0 R /XYZ 84.259843 307.251496 0 ] (minimize-access-to-secrets-manual) [ 813 0 R /XYZ 84.259843 523.851496 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) [ 851 0 R /XYZ 84.259843 238.710432 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) [ 854 0 R /XYZ 84.259843 603.629014 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) [ 851 0 R /XYZ 84.259843 589.851496 0 ] (minimize-the-admission-of-containers-with-added-capabilities-manual) [ 858 0 R /XYZ 84.259843 323.081993 0 ] (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) [ 854 0 R /XYZ 84.259843 252.487950 0 ] (minimize-the-admission-of-containers-with-capabilities-assigned-manual) [ 858 0 R /XYZ 84.259843 207.281993 0 ] (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) [ 858 0 R /XYZ 84.259843 453.881993 0 ] (minimize-the-admission-of-privileged-containers-manual) [ 851 0 R /XYZ 84.259843 720.651496 0 ] (minimize-the-admission-of-root-containers-manual) [ 858 0 R /XYZ 84.259843 584.681993 0 ] (minimize-wildcard-use-in-roles-and-clusterroles-manual) [ 813 0 R /XYZ 84.259843 423.051496 0 ] (network-policies-and-cni) [ 861 0 R /XYZ 41.740157 784.430079 0 ] (overview) [ 304 0 R /XYZ 84.259843 704.822079 0 ] (pod-security-policies) [ 851 0 R /XYZ 41.740157 784.430079 0 ] (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) [ 885 0 R /XYZ 84.259843 684.651496 0 ] (rbac-and-service-accounts) [ 813 0 R /XYZ 41.740157 784.430079 0 ] (scheduler) [ 694 0 R /XYZ 41.740157 784.430079 0 ] (secrets-management) [ 885 0 R /XYZ 41.740157 784.430079 0 ] (testing-controls-methodology) [ 304 0 R /XYZ 84.259843 166.076079 0 ] (the-default-namespace-should-not-be-used-automated) [ 889 0 R /XYZ 84.259843 193.251496 0 ] (title-block-header) [ 6 0 R /XYZ 84.259843 502.818898 0 ] (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) [ 806 0 R /XYZ 84.259843 670.970079 0 ] (worker-node-configuration-files) [ 746 0 R /XYZ 41.740157 784.430079 0 ] ] >> >> >> @@ -42,7 +42,7 @@ endobj >> /Shading << >> -/Font 1072 0 R +/Font 1074 0 R >> endobj 5 0 obj @@ -51,15 +51,18 @@ endobj /Length 2619 >> stream -xˎd 602%R7H lLE]zҥx&FHG>g׋bhb˛ۓwCk>Grh TϚ{߿8xNb>LCmJ&D%C)*1{g*%{TUaeR#3jGUFc*{Dv$Bu0D4]̡` ӥJS].tT92]ܘ`K.Ö̈́`iLW`-Ue -[V]-FuEDrofTסVۣ.I -2|S' -T*%R$w-Y%1ӁYkk&?*.ÖQl3[\b HR`@j=X0zVzePХ@[Fprh7M TaK2e,P- -ܚXI, -La,PW[1rJ@\; q -j.@]V UX`*:f,ƦjX`.Qb,aa,Ԛ0c"P] 8X`nxݔ%1,8Jf.y:[X{2`0dp7v?rA[/܍ Gu=Ċ'b) TX]151dp7*"5Ӂ1ua,.Xw c[ץX]`)1 -i Gq䡌ExܕXP]1=T[%5ؒ3d5H)ܕf:pWvƂzd,(1,81fZ JQ] hgƂ*d `Uc,@bXPlє j-H }]h}`"cHZ7c,ê2]IUt2j82 - .1 1[pT BK̙.$ٌt%؂l*c"4jI,5әx "c *M` 0Xb;3A2`fc,h-y Z-Ic|X c,RɌ8t"=6ԛ p.l]&J#'dWoN_~߰c^N,p0;A  ՆX2C?HvO~Qwf39}\{u1Rt|r>}>ق>8x{ʃ=:^ۻm}X|-z#YPEٜ|#|oW(f;&@|~Nnw˟}{?[|?ֶ=#GՉU_KIA}ٳ@6caOogxk=6BY.N1\ lCz#.}9JLv9Exl>9gxc$4Z׉O(obnAo2MAߧp h{5z⨲ P8ٰ'z3,4}_m궝^NVKoPcue nF)ͣDD1a3~5E6f>DFs֣}2eDvMZtw`57Ax9!o)W;/VH uw,YRϷ2yJ<1VkMgsiIc+rZ{؝t[M^0!5q/6gr0-qt'^vyTJ=qLv>:w?#s~,qdp(,!u]8>C"sIsꞑDEgY_yQ\xI4z'#^}8ld87oq<׶3NƩ݅y&NuSme{g8ݛM/iԋaٖNWH>oC]WH hneٝ$s~۷B}ԥfx R`I=O>^78.hҧ]:_̥x\G7gѳ7]+4LrX5vݤm=vIm&b29b6ccY7nt)}+s+塯;"̖t&@ywNVϙK6"+Sjv?5lRVf*)g^8^ m]!P.z}R_Uko~w%7"d LUj&D=$ς?ZΗ7' 5 =jȱo\5ԞS-~xX3XP;lQa,@( +-!3g[d3 Ӆ.FƂ` AƂ"Ш%Lgufc,hV8&4AJ-cNjX&-fc,h $IM7+cA؂K &3Љ0Po&c,z1tԛ(ȹZެ`KFBuIS'LB :1]-cA/X4&2zz%мެdb:pia,@&2[V +3l^q6zc @oFlW"ZUzg Hfl B^|p}گ +ܡ"f/q, 9V7}G?O8nW/r71!6F?FSn4 _=?~xxݫ]/|PwD&Cݑ|aq5پ:Hf j=#){mz̗c}|-z#YPEٜ|#|oW(f;&@|~Nnwoo%oUlmYT#U'Ta~- $}grYw4I5}׀&̏B٦[dÞ\}ovOx9aZ}.}RECE1dէ4sCl]NDBІ͜m׼ +p$GDw-ϝW[˔ٱF7i_mgDt|߁H ߤ儼O\IX!y.m)neI?ߖ +GsWlB;tgbwm6y<Ԅǽ8NbGX](LyӝxٙQ2'+qs<]2w^fmLIf[me OxI'uO#%ͩ{F:e;|d?ǓLZ;#{!f&۰ıyxÌ)m,q4N.k 7qn+#<[ř|ެ}mx9L^_ͶtBy-B:Es/t'K۾sm-.0=d[l]O!F}\ pD>b.R=9c1Z9ngOgJ-쮱&m[OjCv7ɐ방rqTgN?+]])}}f3ʻ;vz\YٟR[=uG=oaː2SY凞ĿO9;‰_MHl2tﳤZۮF~3+yw%L؎`R7 a6+> stream -x]KϯsdI686 M$ʀC~=M؏ݝ, #yYb=뎖~ΤcHLtD|tSD{|{p)JamLJq?~nr|(3.9gH oA5o?|ɲ&C-#@41@8Vd#$nhm u&`l06tx(#R}:^%jԝ96lxmsڶ(t8!!ÒXX`ACȎpːt~P9vKm)}s\\HѮ۝OEKOS]sgQRQ=E)zO۩Fw/u)zO{ެMq;E;>bYTMIt⦎)q\ 6P&2y#E=oq+OCh|HQذi}RCZ:{CPCd):vq`!E.BZpn"12E}E -m~*, ,O4d1[:4)Ѐ-mx#Rh+;^4QRb:!4xPb,yR,KH|ž}*MJ%\xo!Rb,l+̘)1xCc)!h2츻Qb`&YL^41SvJ3MLZx^&4Koxyb {Drkx!]2{OVE,3 %%8Mtċa&6Dmcy34&mɄFCdBtV[9ˋgHc"x{߱2/:<L{১Ϋ3ɳNKd3ḽ/pۏ(_{;1?g5lO,nϠk@<{e+T6~ pug06%'_7 |_tUD^n^r2]Ay>L {eE'_ǀ[KNApM㢓@hP>y~Q:o`io?Z,qCb43Ӥs`JpMe`8Y^Asy.g:g4_GFy%Ӝfޯ.c7;?-g&Vaٮ|f|lW~gJy-7xȔv?Z@;n -Y5>]"P"|7N-XQATcxi)Y^sK+ʠkR/-uQ.Eo=͗x/ѥK֧3Oeghj3HR7|Zɝyȵ u֣Q7.8숻Ч |lܚV^Cv_}K~i/& -?~R6KC|Ʃ^󞖩&ۓRPAD&);Zbx|ل_҅On;:wjT֐w9L2K071tݜY5hpCBW v:oyI˞an38]~WVw0;:& -*sٺDI7^5hsJ 073Dsp/чM\àZlü*7*es6?m@V]^lׅL5Jth<Uj.Ju^S}lьrxeC)T?H8T_$VP -~8Pܠ^+,Г68/-ޞ85+V^(K5Ta bo?LJn6x4C:e -s[J{d7Kmb*L&xH1®E]K iR -:L-I-U;3wjv8 <6%<DW4MlKʤ`lי Eý>LpV\'֌{:r9|/X-?s_K]ylj˙ W^r[PiFCD~텽RVA]*A60eHO +FZ |rƗT|"ԯ>%Ő|VHWč|"S0w1K@J&E~8mD9iV]I AN܌ndy6~vz]YP37AM4mrR[E'2Fm3IXi(Z(VLae8mZ)HKJ3"Imx["αkg;e% N+#: 36ZQ>='w6ߋڢaXEKBŠx6{%G"aE/%vO/_C߳s[*=ςz["獟~nz"NcY*RN廌l*KyEV~?M +x\[ܶ~_C/@Q 4H[}v8Ӈ~Dr]ǖ>77R=}aOvJ)w3E63K '#)2磍v21Eoָ9JnMLJv/ 7Y&NCM:rBl7 Bۃ_:| +C)fKG8hy`$$2pGG7Qț:@.;htxm !D+ۃ+!GB^EKKB݄C Q83[Bxн-Do!dCc(fگ߄hJb6-n!RXx;!ྭ֣\~\CC +\q@YML=4`8ڡLS؆h`vu;ttCLJpiv ^hgjGͻ {9o-Do! E;#-Do!L!^ +[BO6av| EUT!|iqSLJ .w"M\!##kttt!qIS'B& + aK^ ߦklnk3ev![ @sM&L+2&.ɤ_6\sValA*Td ɐ"h9r!L|J"c6F0#Ľa +1Ud2t@fV8dx:l![LΓ!0,+2Ag ++2ex!|gpȾld(2؅!3MG>;q7k7h%jPR[-8,)PNJN'.a0ffL( +D3)$c9kU k>5K|^i>>ydk}D k}LLsOtմih~i/dCj͍oWq + 1JOWw\Ij2.  %u$67ѡc^:2]9̿1.an5,r,;^ GӇG}dNk߯0L&d7Ž?=zܿfرF5\4s[yWg~V|PY̱Nq~﫲o+ϫ޴)/OևXcMw9v0T=>R78Vk->_QӹNN-Xdݫ7.)BG'3|XV'm;κO4KgnǬclc6Y)t Ęs79UD6szRNe#Og$xz[}$׽95?ŞΞ, OcO$ӖD*k$r@ySt'>sqZ#|QVwz{c͢sNq _ld1uV}"8NO;WEp@NG^ BMNqGN]t?(oO3R;>v |?:/9œ]k-Z\s.Pm2GWv/00%>!"e\1u|٪j&9$xKԲc}V˓.a5Ny Ixny}>Mb#e#Oʗ3^~U5 ̬=^ukΖ'f? Xv0:sfΓ߁}mapC +6t(/+~%|_:qg[|0B g¡ 7loxu1,l.U0֝w(نQeLÜP*7d3ovځ$Mua5 +H*rkk,T|WKlhE&iyL& x:w +$D NKGYa +nh<ͥwRb#I-=]Vecl>+ȗۤc*(xUZaۼ%U~ZJsszr ղzέ;$mm<͟ͅSdZ +FfFkN6v؃l?2G)Qݼ]N??:ƼiقZn`YɈ\5U(7ɋa,WohuHko7=WI2mW%ȝCSs]N0 +x:cMdk^SWnnɦNpp5KQ4"K:z7D6Sa j4^•ĉFSׯ^feG!D7{;44(zWC;%}ͧa,=X;- +w0hj6m~\&`?DƲT䜼+^y\^ϛ^+ endstream endobj 8 0 obj @@ -99,7 +109,7 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 7 0 R /Resources 4 0 R -/Annots [ 9 0 R 10 0 R 11 0 R 12 0 R 13 0 R 14 0 R 15 0 R 16 0 R 17 0 R 18 0 R 19 0 R 20 0 R 21 0 R 22 0 R 23 0 R 24 0 R 25 0 R 26 0 R 27 0 R 28 0 R 29 0 R 30 0 R 31 0 R 32 0 R 33 0 R 34 0 R 35 0 R 36 0 R 37 0 R 38 0 R 39 0 R 40 0 R 41 0 R 42 0 R 43 0 R 44 0 R 45 0 R 46 0 R 47 0 R 48 0 R ] +/Annots [ 9 0 R 10 0 R 11 0 R 12 0 R 13 0 R 14 0 R 15 0 R 16 0 R 17 0 R 18 0 R 19 0 R 20 0 R 21 0 R 22 0 R 23 0 R 24 0 R 25 0 R 26 0 R 27 0 R 28 0 R 29 0 R 30 0 R 31 0 R 32 0 R 33 0 R 34 0 R 35 0 R 36 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> @@ -119,7 +129,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 488.857357 648.111024 496.429134 633.111024 ] +/Rect [ 488.750423 648.111024 496.429134 633.111024 ] /BS << /W 0 >> @@ -141,7 +151,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 488.869808 618.411024 496.429134 603.411024 ] +/Rect [ 485.690364 618.411024 496.429134 603.411024 ] /BS << /W 0 >> @@ -163,7 +173,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 485.053890 573.711024 496.429134 558.711024 ] +/Rect [ 485.521907 573.711024 496.429134 558.711024 ] /BS << /W 0 >> @@ -174,7 +184,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 548.961024 498.679134 517.761024 ] +/Rect [ 99.673228 530.961024 498.679134 507.561024 ] /BS << /W 0 >> @@ -185,7 +195,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 511.761024 491.179134 496.761024 ] +/Rect [ 481.786556 510.561024 491.179134 495.561024 ] /BS << /W 0 >> @@ -196,7 +206,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 523.761024 498.679134 492.561024 ] +/Rect [ 99.673228 491.361024 498.679134 467.961024 ] /BS << /W 0 >> @@ -207,7 +217,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 458.630306 501.561024 471.154720 486.561024 ] +/Rect [ 481.786556 470.961024 491.179134 455.961024 ] /BS << /W 0 >> @@ -218,7 +228,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 498.561024 498.679134 467.361024 ] +/Rect [ 99.673228 451.761024 498.679134 428.361024 ] /BS << /W 0 >> @@ -229,7 +239,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 461.361024 491.179134 446.361024 ] +/Rect [ 481.786556 431.361024 491.179134 416.361024 ] /BS << /W 0 >> @@ -240,7 +250,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 473.361024 498.679134 442.161024 ] +/Rect [ 99.673228 412.161024 498.679134 388.761024 ] /BS << /W 0 >> @@ -251,7 +261,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 436.161024 491.179134 421.161024 ] +/Rect [ 481.786556 391.761024 491.179134 376.761024 ] /BS << /W 0 >> @@ -262,7 +272,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 448.161024 498.679134 416.961024 ] +/Rect [ 99.673228 372.561024 498.679134 349.161024 ] /BS << /W 0 >> @@ -273,7 +283,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 410.961024 491.179134 395.961024 ] +/Rect [ 481.786556 352.161024 491.179134 337.161024 ] /BS << /W 0 >> @@ -284,7 +294,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 422.961024 498.679134 391.761024 ] +/Rect [ 99.673228 332.961024 498.679134 309.561024 ] /BS << /W 0 >> @@ -295,7 +305,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 458.630306 400.761024 471.154720 385.761024 ] +/Rect [ 481.786556 312.561024 491.179134 297.561024 ] /BS << /W 0 >> @@ -306,7 +316,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 397.761024 498.679134 366.561024 ] +/Rect [ 99.673228 293.361024 498.679134 269.961024 ] /BS << /W 0 >> @@ -317,7 +327,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 360.561024 491.179134 345.561024 ] +/Rect [ 481.786556 272.961024 491.179134 257.961024 ] /BS << /W 0 >> @@ -328,7 +338,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 372.561024 498.679134 341.361024 ] +/Rect [ 99.673228 253.761024 498.679134 230.361024 ] /BS << /W 0 >> @@ -339,7 +349,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 458.630306 350.361024 471.154720 335.361024 ] +/Rect [ 481.786556 233.361024 491.179134 218.361024 ] /BS << /W 0 >> @@ -350,7 +360,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 347.361024 498.679134 316.161024 ] +/Rect [ 99.673228 214.161024 498.679134 190.761024 ] /BS << /W 0 >> @@ -361,7 +371,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 310.161024 491.179134 295.161024 ] +/Rect [ 481.786556 193.761024 491.179134 178.761024 ] /BS << /W 0 >> @@ -372,7 +382,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 322.161024 498.679134 290.961024 ] +/Rect [ 99.673228 174.561024 498.679134 151.161024 ] /BS << /W 0 >> @@ -383,7 +393,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 458.630306 299.961024 471.154720 284.961024 ] +/Rect [ 481.786556 154.161024 491.179134 139.161024 ] /BS << /W 0 >> @@ -394,7 +404,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 296.961024 498.679134 265.761024 ] +/Rect [ 99.673228 134.961024 498.679134 111.561024 ] /BS << /W 0 >> @@ -405,7 +415,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 274.761024 491.179134 259.761024 ] +/Rect [ 481.786556 114.561024 491.179134 99.561024 ] /BS << /W 0 >> @@ -414,170 +424,169 @@ endobj endobj 37 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 95.173228 271.761024 498.679134 240.561024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) +/Filter /FlateDecode +/Length 3692 >> +stream +x\[ܶ~_pf8C0Р@A@g$($}P/J86֖F|s!u׿rp?z.?b3F_ٔ~Kr2TnVN~SpFލ$N$y'1E@" + cx՗=PF5&2fQTg¨ދat=[8I01L> ߁($ՙ@RgU@.^u&3f11:#lj20T}l?HBt!0ɅdPTgNlb?U$ՙ"f4![Ug%Ws6쵐XP=df9G9G)r2|C2(9 &4;9 6Fuf19 !-D1D>&64l 12?ZՇ?ZH6F>b Z5:c4'hDF1s`j`cTg1"D13x Zc1A :^hNSbc8Z`cTg$A-(AQ){1A1C1nXGƨ^3?:i+2Y&ᒺea2ienvD>z^鋷~lZֈ=YuE*Ebmg%GO;Nژ"\;:Di+:F9 ֣PqP]zYˋqtp%I4tq%m5 F?8Xjޗ5ryW.\[bfy&&,2_aiKy 5ϳΆȱΩѠCAq> d'v–}v2POWPaN F8s/oNy~f*ZF_dsě/W_}Cy_Ao>6Ey-4Z?^:h>?H7}FA=o|L&?4h^nOhdyQ&5yD۷_~M6Ov`̊oYXˇ7,ygKZȒ+w{\'1}C:]N3sl&Ye'˒q>Ɗ /+ق)ǂ2U=uXtǡrY.zL헶h2˧sdvm^Y?le}mXF,v.K?8{=lW #݇>e7۝* $@dL]I9(t@3Nm~Hekg\/xw:މhmJ'>$M &흲`eU~RkUGvp6 [CގY.&r"kWKVi:GK:rnu|qƭm_nCfs;-z?ne8gyM4w+)w|k'^c9\i6M֦ݫf&Cq1U]΂Ex**oyKE[Ҝ+q(ha{wz(4y-{T)O/7ao0`?B.m37 `b1tZIaWdX[SM QyJM%XCa.W܎r-qc*6TjJwuJ;FTð Z,ʵOr*yJp⸃+34B~P}}]ë t'hс9ȓϱ/\_Kƞ^ o*<|i!=or@LWn,KEΩy,eoDN +endstream endobj 38 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 478.654720 249.561024 491.179134 234.561024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 37 0 R +/Resources 4 0 R +/Annots [ 39 0 R 40 0 R 41 0 R 42 0 R 43 0 R 44 0 R 45 0 R 46 0 R 47 0 R 48 0 R 49 0 R 50 0 R 51 0 R 52 0 R 53 0 R 54 0 R 55 0 R 56 0 R 57 0 R 58 0 R 59 0 R 60 0 R 61 0 R 62 0 R 63 0 R 64 0 R 65 0 R 66 0 R 67 0 R 68 0 R 69 0 R 70 0 R 71 0 R 72 0 R 73 0 R 74 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 39 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 246.561024 498.679134 215.361024 ] +/Rect [ 99.673228 790.370079 498.679134 766.970079 ] /BS << /W 0 >> -/Dest (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +/Dest (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) >> endobj 40 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 224.361024 491.179134 209.361024 ] +/Rect [ 481.786556 769.970079 491.179134 754.970079 ] /BS << /W 0 >> -/Dest (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +/Dest (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) >> endobj 41 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 221.361024 498.679134 190.161024 ] +/Rect [ 99.673228 750.770079 498.679134 727.370079 ] /BS << /W 0 >> -/Dest (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) +/Dest (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) >> endobj 42 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 199.161024 491.179134 184.161024 ] +/Rect [ 481.786556 730.370079 491.179134 715.370079 ] /BS << /W 0 >> -/Dest (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) +/Dest (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) >> endobj 43 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 196.161024 498.679134 164.961024 ] +/Rect [ 99.673228 711.170079 498.679134 687.770079 ] /BS << /W 0 >> -/Dest (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +/Dest (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) >> endobj 44 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 158.961024 491.179134 143.961024 ] +/Rect [ 481.786556 690.770079 491.179134 675.770079 ] /BS << /W 0 >> -/Dest (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +/Dest (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) >> endobj 45 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 170.961024 498.679134 139.761024 ] +/Rect [ 99.673228 671.570079 498.679134 648.170079 ] /BS << /W 0 >> -/Dest (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) +/Dest (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) >> endobj 46 0 obj << /Type /Annot /Subtype /Link -/Rect [ 458.630306 148.761024 471.154720 133.761024 ] +/Rect [ 481.786556 651.170079 491.179134 636.170079 ] /BS << /W 0 >> -/Dest (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) +/Dest (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) >> endobj 47 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 145.761024 498.679134 114.561024 ] +/Rect [ 99.673228 631.970079 498.679134 608.570079 ] /BS << /W 0 >> -/Dest (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) +/Dest (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) >> endobj 48 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 123.561024 491.179134 108.561024 ] +/Rect [ 481.786556 611.570079 491.179134 596.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +49 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 592.370079 498.679134 568.970079 ] /BS << /W 0 >> /Dest (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) >> endobj -49 0 obj -<< -/Filter /FlateDecode -/Length 4222 ->> -stream -x]K Ud=c rYcfۻ6YCJ31EdH2-5_ cɚH [F )]MɏLN;n?:>.Ͽ~YHtvLgf ΤG%lD49ۘ6Kc`hi%{! -K6ep,R w`<&lx7OeCR ^q p lMB ob G)4)h5F0}c2z"%!tijLG"l&:Fra{nZƯ?y?ǯ3;;뻔a 99CmLM؄nnhy-AP(TmZ_N=]B}ID*ܽ~zAbIw8B?[uNm&yjs{g89Y'k CGGXq(16ps8,}H73 zxi>>X:E_})>nM):E_]l%Wsۊyt;0e յ#gBhBb Aᑨfi -99Mgtl:GPb !9-|`}Z:Xi1# k1 Y-|3e-|SA &`̤r^1`:֙0k1uSMg:DZu)xp)x!cH%5ap1 xʚ<E5a -7x2LWNFcc\û3<˲lr{~Ƽxr^AzNz('2`+^OY0eGSI@8Jȝ";Ao럿[{\dOfǂpu@.J큜 {:iG3A S$}&AgAgr739Eܞ {E( -..l*K=8yy-`i {Ą,=K*yE@9;=# 4ӽQto˲#`E{- xN>eJ|sA"zZr dC䘯aÆmq@v{e s8ӿa=s1tÇ~'G9B'߉"b27LǮ`P n͔G!O]ض:5w Шb vieHNN v.D ] ·7Nx.O m6F|ra壱:VxV0.men-mzQ\Fs7.m<(x[Mؽ0W~b`in=+,tIv 792c.M9":gn^5ͤʗ80]l0C2,>(W*H︌-mUWZi -S[`[| Ϊ[`9;[ձ:+Mϱw>/^mUxp|S'{߫.>aмH=LܯM V?J嫾pK_ܥ -c?vnDK^SWj;.m?(ry_ 1{kW|NK۟;|7Wχ0ӿ[ 5uq?Ҧ/ܕAq1?=p}ZU[rj[=ȃ)5Yuu8\m.87~wP">xf6V݉*u[>7WŇyi`Ki?75U1S;=Ñ_ vֆ^gԡA-r>F8n򺜶7|1';Dګx%/,R{n: O{=Ӛe|{:T޲^ nڗAsXvz/QrK;k[o{_2GW\8Wqߋukl6G;|b,nQr' [; vq/엶OwѾw~%w-ޘ} J ?0],*{oL=/LIK?<տH,ьg hǗWN"zB1{_9$xYm.б~Z^DO2r]O|qe£?;7ɵ a^1_U5hyh N6_y^= $@fat#9w^Ɓ~hX\ y#+$ dLtzX7Y-ɏ s.78:BaI_KN//WP^HjSMOeZN;\z.HfH2 -3ۀۍd#5v`.9렃{:7/'UJsŻVʕJ|-C#Yw9&b*/7FXR57UZTB|4Q9M/cwf WsW2|p,b6aR ;klۖ ' -jOÎj )‹VS_c1^CQ>Mo% gJ:_E'| Mz{(N6BN}C`Eǂ݌0g(u7ʡ^=&Ԛ֩~8 ZsYNmcn䴩Z 1QSmb^(Lh)5]w -Nae8z)֞Q=M=*ՉԣxeRjkD}8fmL+]8}]ƹRmϝ 36|V{Y}yknaX.;8'(bF|Yr%R6KzI /ڽ#_foܖIOs^PKs{;BtG+{njs -endstream -endobj 50 0 obj << -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 49 0 R -/Resources 4 0 R -/Annots [ 51 0 R 52 0 R 53 0 R 54 0 R 55 0 R 56 0 R 57 0 R 58 0 R 59 0 R 60 0 R 61 0 R 62 0 R 63 0 R 64 0 R 65 0 R 66 0 R 67 0 R 68 0 R 69 0 R 70 0 R 71 0 R 72 0 R 73 0 R 74 0 R 75 0 R 76 0 R 77 0 R 78 0 R 79 0 R 80 0 R 81 0 R 82 0 R 83 0 R 84 0 R 85 0 R 86 0 R 87 0 R 88 0 R 89 0 R 90 0 R 91 0 R 92 0 R 93 0 R 94 0 R 95 0 R 96 0 R 97 0 R 98 0 R 99 0 R 100 0 R 101 0 R 102 0 R 103 0 R 104 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 571.970079 491.179134 556.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) >> endobj 51 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 808.370079 498.679134 777.170079 ] +/Rect [ 99.673228 552.770079 498.679134 529.370079 ] /BS << /W 0 >> @@ -588,7 +597,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 771.170079 491.179134 756.170079 ] +/Rect [ 481.786556 532.370079 491.179134 517.370079 ] /BS << /W 0 >> @@ -599,7 +608,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 783.170079 498.679134 751.970079 ] +/Rect [ 99.673228 513.170079 498.679134 489.770079 ] /BS << /W 0 >> @@ -610,7 +619,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 458.630306 760.970079 471.154720 745.970079 ] +/Rect [ 481.786556 492.770079 491.179134 477.770079 ] /BS << /W 0 >> @@ -621,7 +630,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 757.970079 498.679134 726.770079 ] +/Rect [ 99.673228 473.570079 498.679134 450.170079 ] /BS << /W 0 >> @@ -632,7 +641,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 720.770079 491.179134 705.770079 ] +/Rect [ 481.786556 453.170079 491.179134 438.170079 ] /BS << /W 0 >> @@ -643,7 +652,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 732.770079 498.679134 701.570079 ] +/Rect [ 99.673228 433.970079 498.679134 410.570079 ] /BS << /W 0 >> @@ -654,7 +663,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 458.630306 710.570079 471.154720 695.570079 ] +/Rect [ 481.786556 413.570079 491.179134 398.570079 ] /BS << /W 0 >> @@ -665,7 +674,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 76.423228 689.570079 504.679134 656.870079 ] +/Rect [ 76.423228 394.370079 504.679134 361.670079 ] /BS << /W 0 >> @@ -676,7 +685,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 485.690364 681.620079 496.429134 666.620079 ] +/Rect [ 481.982112 386.420079 496.429134 371.420079 ] /BS << /W 0 >> @@ -687,7 +696,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 656.870079 498.679134 625.670079 ] +/Rect [ 99.673228 343.670079 498.679134 320.270079 ] /BS << /W 0 >> @@ -698,7 +707,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 634.670079 491.179134 619.670079 ] +/Rect [ 481.786556 323.270079 491.179134 308.270079 ] /BS << /W 0 >> @@ -709,7 +718,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 631.670079 498.679134 600.470079 ] +/Rect [ 99.673228 304.070079 498.679134 280.670079 ] /BS << /W 0 >> @@ -720,7 +729,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 609.470079 491.179134 594.470079 ] +/Rect [ 481.786556 298.670079 491.179134 283.670079 ] /BS << /W 0 >> @@ -731,7 +740,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 606.470079 498.679134 575.270079 ] +/Rect [ 99.673228 264.470079 498.679134 241.070079 ] /BS << /W 0 >> @@ -742,7 +751,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 584.270079 491.179134 569.270079 ] +/Rect [ 481.786556 259.070079 491.179134 244.070079 ] /BS << /W 0 >> @@ -753,7 +762,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 581.270079 498.679134 550.070079 ] +/Rect [ 99.673228 224.870079 498.679134 201.470079 ] /BS << /W 0 >> @@ -764,7 +773,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 559.070079 491.179134 544.070079 ] +/Rect [ 481.786556 219.470079 491.179134 204.470079 ] /BS << /W 0 >> @@ -775,7 +784,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 556.070079 498.679134 524.870079 ] +/Rect [ 99.673228 185.270079 498.679134 161.870079 ] /BS << /W 0 >> @@ -786,7 +795,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 518.870079 491.179134 503.870079 ] +/Rect [ 481.786556 164.870079 491.179134 149.870079 ] /BS << /W 0 >> @@ -797,7 +806,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 530.870079 498.679134 499.670079 ] +/Rect [ 99.673228 145.670079 498.679134 122.270079 ] /BS << /W 0 >> @@ -808,7 +817,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 458.630306 508.670079 471.154720 493.670079 ] +/Rect [ 481.786556 125.270079 491.179134 110.270079 ] /BS << /W 0 >> @@ -819,7 +828,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 505.670079 498.679134 474.470079 ] +/Rect [ 99.673228 106.070079 498.679134 82.670079 ] /BS << /W 0 >> @@ -830,7 +839,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 483.470079 491.179134 468.470079 ] +/Rect [ 481.786556 85.670079 491.179134 70.670079 ] /BS << /W 0 >> @@ -839,369 +848,372 @@ endobj endobj 75 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 95.173228 480.470079 498.679134 449.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-includes-node-automated) +/Filter /FlateDecode +/Length 3494 >> +stream +x\M$d1r0p9̶=6YvyTݭM.fW*J{d#%M{<9aλ,]=>X\s$5jyg_c=95%!\w)\}~E)QKqpK슧 ޕ8\!-Q ]-P_ YYAC`S,#DN P10- sv>g Â- :|*"0zYa1 D)Ơa|40Q\Ȟϑ d10EdrW", Spx mV LB&oqv "=Y\hp#fyr:I ☥!9R̎Kb`HDiQ'XPN$8$If m֘ERBda%nqQKK0,٥0\ % +Z~ . 2 +!2!26`r$!y!GY!e =,2c r%s I3*:?OvHtI-.PAO +-.PU1 ٝbp!8 %(P=J哜B(ZZU,*.0eKxROB]lUIhbULS^E.tD,apҫ(.f CHFhuE-P{ҫ Z5#[z5ASB)0qna .: ^ESEVg*0"AC$$K&h- +qyҫ)''HT^EJuiU'TX*;b=2&'Hҫ9D0cJ^mV-C(U̧[z\eHCt ̨5[z3nL*& S7\B0L/C٨E|Xz5g̗E5Z\̗$,m֔, ҫuPQ-ZPU f,ZPQ +ҫZXz@cR-ZQҫSWAo@{dULP0BVǮjVT &_Z=8,vzZ=Jr{G#WZY^-9u$KB},ҫ +QA^ŜZW1%WZZ1,ꘇDK*:bUVWK*:&K*:tvBK 1a}Z3fH–S9`/[r4s 5荅kA-B+ Us1v޲}\_M{l]icmR[n9Ȣs Mjm=Gs+o9Ub\Lnl 9.}ӏ~;6JYｇey6@6G`0'.?O18:Ge?Yϫ>s>1εK3͏GKG#g=鞖6>\w{gL&^;l>݇ziiaN1__MV׸4a0mS>*3.q=clfiׂ_ ݇ȥγŸ/v2*Iko~/'x~6^G7!Zy^pD^{m^:/V yn:F*?,vlF~95>>^kk]ծ^F[y0ЧGst`:^[-> Hx k>L?Oi=N}=O$!D'a/⨾1$y>y8:2}yyWͅo(h{E Y2F؎ԘK[hq̑n:Bl_xtOj99O-}pĨixX +k/"}vbq4 IaG}ZmTd[eH3CtȬ|?vK{Xǣ"zb+Y(jQyJzq^,\i%@&TzjcϜ~^}mGO?Pu(Zv`k>l },7 +endstream endobj 76 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 478.654720 458.270079 491.179134 443.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-includes-node-automated) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 75 0 R +/Resources 4 0 R +/Annots [ 77 0 R 78 0 R 79 0 R 80 0 R 81 0 R 82 0 R 83 0 R 84 0 R 85 0 R 86 0 R 87 0 R 88 0 R 89 0 R 90 0 R 91 0 R 92 0 R 93 0 R 94 0 R 95 0 R 96 0 R 97 0 R 98 0 R 99 0 R 100 0 R 101 0 R 102 0 R 103 0 R 104 0 R 105 0 R 106 0 R 107 0 R 108 0 R 109 0 R 110 0 R 111 0 R 112 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 77 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 455.270079 498.679134 424.070079 ] +/Rect [ 99.673228 790.370079 498.679134 766.970079 ] /BS << /W 0 >> -/Dest (ensure-that-the---authorization-mode-argument-includes-rbac-automated) +/Dest (ensure-that-the---authorization-mode-argument-includes-node-automated) >> endobj 78 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 433.070079 491.179134 418.070079 ] +/Rect [ 481.786556 769.970079 491.179134 754.970079 ] /BS << /W 0 >> -/Dest (ensure-that-the---authorization-mode-argument-includes-rbac-automated) +/Dest (ensure-that-the---authorization-mode-argument-includes-node-automated) >> endobj 79 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 430.070079 498.679134 398.870079 ] +/Rect [ 99.673228 750.770079 498.679134 727.370079 ] /BS << /W 0 >> -/Dest (ensure-that-the-admission-control-plugin-eventratelimit-is-set-automated) +/Dest (ensure-that-the---authorization-mode-argument-includes-rbac-automated) >> endobj 80 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 407.870079 491.179134 392.870079 ] +/Rect [ 481.786556 730.370079 491.179134 715.370079 ] /BS << /W 0 >> -/Dest (ensure-that-the-admission-control-plugin-eventratelimit-is-set-automated) +/Dest (ensure-that-the---authorization-mode-argument-includes-rbac-automated) >> endobj 81 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 404.870079 498.679134 373.670079 ] +/Rect [ 99.673228 711.170079 498.679134 687.770079 ] /BS << /W 0 >> -/Dest (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) +/Dest (ensure-that-the-admission-control-plugin-eventratelimit-is-set-automated) >> endobj 82 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 382.670079 491.179134 367.670079 ] +/Rect [ 481.786556 690.770079 491.179134 675.770079 ] /BS << /W 0 >> -/Dest (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) +/Dest (ensure-that-the-admission-control-plugin-eventratelimit-is-set-automated) >> endobj 83 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 379.670079 498.679134 348.470079 ] +/Rect [ 99.673228 671.570079 498.679134 648.170079 ] /BS << /W 0 >> -/Dest (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) +/Dest (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) >> endobj 84 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 357.470079 491.179134 342.470079 ] +/Rect [ 481.786556 651.170079 491.179134 636.170079 ] /BS << /W 0 >> -/Dest (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) +/Dest (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) >> endobj 85 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 354.470079 498.679134 323.270079 ] +/Rect [ 99.673228 631.970079 498.679134 608.570079 ] /BS << /W 0 >> -/Dest (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) +/Dest (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) >> endobj 86 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 317.270079 491.179134 302.270079 ] +/Rect [ 481.786556 611.570079 491.179134 596.570079 ] /BS << /W 0 >> -/Dest (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) +/Dest (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) >> endobj 87 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 329.270079 498.679134 298.070079 ] +/Rect [ 99.673228 592.370079 498.679134 568.970079 ] /BS << /W 0 >> -/Dest (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) +/Dest (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) >> endobj 88 0 obj << /Type /Annot /Subtype /Link -/Rect [ 458.630306 307.070079 471.154720 292.070079 ] +/Rect [ 481.786556 571.970079 491.179134 556.970079 ] /BS << /W 0 >> -/Dest (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) +/Dest (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) >> endobj 89 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 304.070079 498.679134 272.870079 ] +/Rect [ 99.673228 552.770079 498.679134 529.370079 ] /BS << /W 0 >> -/Dest (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) +/Dest (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) >> endobj 90 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 281.870079 491.179134 266.870079 ] +/Rect [ 481.786556 532.370079 491.179134 517.370079 ] /BS << /W 0 >> -/Dest (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) +/Dest (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) >> endobj 91 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 278.870079 498.679134 247.670079 ] +/Rect [ 99.673228 513.170079 498.679134 489.770079 ] /BS << /W 0 >> -/Dest (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) +/Dest (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) >> endobj 92 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 256.670079 491.179134 241.670079 ] +/Rect [ 481.786556 492.770079 491.179134 477.770079 ] /BS << /W 0 >> -/Dest (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) +/Dest (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) >> endobj 93 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 253.670079 498.679134 222.470079 ] +/Rect [ 99.673228 473.570079 498.679134 450.170079 ] /BS << /W 0 >> -/Dest (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) +/Dest (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) >> endobj 94 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 231.470079 491.179134 216.470079 ] +/Rect [ 481.786556 453.170079 491.179134 438.170079 ] /BS << /W 0 >> -/Dest (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) +/Dest (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) >> endobj 95 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 228.470079 498.679134 197.270079 ] +/Rect [ 99.673228 433.970079 498.679134 410.570079 ] /BS << /W 0 >> -/Dest (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) +/Dest (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) >> endobj 96 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 206.270079 491.179134 191.270079 ] +/Rect [ 481.786556 413.570079 491.179134 398.570079 ] /BS << /W 0 >> -/Dest (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) +/Dest (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) >> endobj 97 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 203.270079 498.679134 172.070079 ] +/Rect [ 99.673228 394.370079 498.679134 370.970079 ] /BS << /W 0 >> -/Dest (ensure-that-the---insecure-port-argument-is-set-to-0-automated) +/Dest (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) >> endobj 98 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 181.070079 491.179134 166.070079 ] +/Rect [ 481.786556 373.970079 491.179134 358.970079 ] /BS << /W 0 >> -/Dest (ensure-that-the---insecure-port-argument-is-set-to-0-automated) +/Dest (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) >> endobj 99 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 178.070079 498.679134 146.870079 ] +/Rect [ 99.673228 354.770079 498.679134 331.370079 ] /BS << /W 0 >> -/Dest (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) +/Dest (ensure-that-the---insecure-port-argument-is-set-to-0-automated) >> endobj 100 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 155.870079 491.179134 140.870079 ] +/Rect [ 481.786556 349.370079 491.179134 334.370079 ] /BS << /W 0 >> -/Dest (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) +/Dest (ensure-that-the---insecure-port-argument-is-set-to-0-automated) >> endobj 101 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 152.870079 498.679134 121.670079 ] +/Rect [ 99.673228 315.170079 498.679134 291.770079 ] /BS << /W 0 >> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated) +/Dest (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) >> endobj 102 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 130.670079 491.179134 115.670079 ] +/Rect [ 481.786556 309.770079 491.179134 294.770079 ] /BS << /W 0 >> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated) +/Dest (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) >> endobj 103 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 127.670079 498.679134 96.470079 ] +/Rect [ 99.673228 275.570079 498.679134 252.170079 ] /BS << /W 0 >> -/Dest (ensure-that-the---audit-log-path-argument-is-set-automated) +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated) >> endobj 104 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 105.470079 491.179134 90.470079 ] +/Rect [ 481.786556 270.170079 491.179134 255.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated) +>> +endobj +105 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 235.970079 498.679134 212.570079 ] /BS << /W 0 >> /Dest (ensure-that-the---audit-log-path-argument-is-set-automated) >> endobj -105 0 obj -<< -/Filter /FlateDecode -/Length 4045 ->> -stream -x]K ׯs8"%R!AY &!ȡ2 !?˒(jmӴH*8:s_)R/n1̇ Nl!)d_zL~rF<ÿR"w'Bs `)f@,S -ə,EYb2Aϒ`r΃'G!Ag~`PBt,hB0!#XAaul,-F[*%VS 璛;K;7ms'6Z);"@iZI KR9q4l:I6}R`ѕYY2q'0/] -Vtt!Un_{:8 t$IAn=Qo 8HqYч".#jRh8T!owp#K:ā:;8hkS>txq%E5_vRw?/*$)HG^(x4 )HG~N7{HG>RFWߴXn =FvYw8oӔ+ے&,(<1eM' -fdIT)XvecH`v}dNtٰJ\a]AљaLؖyDg朢ʒ*d"9rb.$g8.3p슢sfˮ: 2bSٲ+ YxG#b%cƥmKu04b,vIF}N.{ˮNc|YL`E|a9:FE*0c1[v%9]=x˥R "bkt`m,ޞ }bj>2܅:}#]uImPࡏLk#TDr[שCCLQTc㦃:Qmzk҈%ݹ.jL80tuCK7DoSe͗OEMHRFW?YQPmK=rTl O׉ -"a?e Wx򔃳ybynm$YDtE\lsC[,;o'GY0sl,>\yU (On]>~Я>$/Q$E^pBwĒs7;~2?_tq_&e  %[$dgor5k E^\dtk)DOFQdtkI5A. "* E@`~o7 `3vlgӭVnX]DhgrpIۙLyUVvEo-)s2sk_mYNɃloo Ci6KSXHce[ -=9uyәomy*2nױf:i.|lo?^Ǘ훤}SQ**se8{ fWN7aFZ,p|Z{6\v= n1r}c:-i>x ϲt|_+l2/|Q=E\yz:oS;jn;7ȿ\8OgB2ri}ӝE5jL`X/7}q ;wwtwQr5.0^瞍z,(3}k_5eO(Jg]sFcm~e.;|Ajq':M~,+ eews-Zlʹ^_+s,LqmO >_o0/˭r0]<.=eyNxD>$']lkeMjXO=!~ox1U{:޳5P=/ԱU|݂#`ڝl`/yr<25f"˹E":/ݐd ^mltF1GG,|]e^9eOu@ϧtBgvjrS簻dUax<v}ƕ@wf֊g_V8_\`tW;uMNE]WǦp"^W,tS?}%7:RkϽNW+pߴ7}}qbv;Iֶe5x=W+bW== TAY R<;NyU]UUI.|h^}2-}{aL Wȴ味\[$Q\>'חO&=k&@I`2'y`^>fd千pf(UYYQ\CVkDsS9^0zX -\BE/ eϰĔ2S(IA|=ę~8vgs7[Hn"ag??9L'0yK"g9OaB}*M*i͕fn ROY6U&%ς7r&%X_^*<J_B\ub0h>`?*Y*"%)q,9+/0/aPU׮-Ax:X>oR w5WJF RyCsW.ߎ+԰~Rh|mNMe4jHƕzCݧ>ZR&ny\+uyqn'\7 -G54ѫq9/SuUYYh \*QK7 Iu!%7yts:a+`*cKw/2vr6汁\1WJjc$CF.%JMtU By w={Ơڸ̭v>krlfDX|%-%Sgj4aɽ>䚭:Ae'֌{:0Os;qn+}_[!W%ՐWX.GeG*J` jBAC,ڈЧY=tV(<賡ff@ިϚ +V~q9=*|krzj" ;:F5BC BDE:Jk#ƪ/UM/St?IҜH-uK5@9v\ldڠ>QCv);l{TfM-Nװ-a8DK!rZy9bH],ђ{"H,j>vNnӤ9`c-7 AW-T>إqXAO -endstream -endobj 106 0 obj << -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 105 0 R -/Resources 4 0 R -/Annots [ 107 0 R 108 0 R 109 0 R 110 0 R 111 0 R 112 0 R 113 0 R 114 0 R 115 0 R 116 0 R 117 0 R 118 0 R 119 0 R 120 0 R 121 0 R 122 0 R 123 0 R 124 0 R 125 0 R 126 0 R 127 0 R 128 0 R 129 0 R 130 0 R 131 0 R 132 0 R 133 0 R 134 0 R 135 0 R 136 0 R 137 0 R 138 0 R 139 0 R 140 0 R 141 0 R 142 0 R 143 0 R 144 0 R 145 0 R 146 0 R 147 0 R 148 0 R 149 0 R 150 0 R 151 0 R 152 0 R 153 0 R 154 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 230.570079 491.179134 215.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-path-argument-is-set-automated) >> endobj 107 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 808.370079 498.679134 777.170079 ] +/Rect [ 99.673228 196.370079 498.679134 172.970079 ] /BS << /W 0 >> @@ -1212,7 +1224,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 786.170079 491.179134 771.170079 ] +/Rect [ 481.786556 175.970079 491.179134 160.970079 ] /BS << /W 0 >> @@ -1223,7 +1235,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 783.170079 498.679134 751.970079 ] +/Rect [ 99.673228 156.770079 498.679134 133.370079 ] /BS << /W 0 >> @@ -1234,7 +1246,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 760.970079 491.179134 745.970079 ] +/Rect [ 481.786556 136.370079 491.179134 121.370079 ] /BS << /W 0 >> @@ -1245,7 +1257,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 757.970079 498.679134 726.770079 ] +/Rect [ 99.673228 117.170079 498.679134 93.770079 ] /BS << /W 0 >> @@ -1256,7 +1268,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 735.770079 491.179134 720.770079 ] +/Rect [ 481.786556 96.770079 491.179134 81.770079 ] /BS << /W 0 >> @@ -1265,507 +1277,469 @@ endobj endobj 113 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 95.173228 732.770079 498.679134 701.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) +/Filter /FlateDecode +/Length 3623 >> +stream +x\K,X$c1rXxrif sOQɒZ*Lkf=#>$)l[? #dM d? rOeNH~dr! .|s}ə0o%$IPL!i 1@!"mX7XbFl0,'P1EvڤaXfFYfbe1Z0,b3!`I&$BChBޢ1Yw @$9$k2ULf',hqevT aVq^8&seY`FbL4L2sR1bVǑ5H?X搂,s̊2#zXf]VC1?efhoYf9+-lh`-Ĥg93!S I1c,&OGa'rINƇ :e&<̈9)z轍I֍d:e +I1e?\هA.Bj\Jc1`?uE?u9.A.81,3AA1,C]T:cXf6*\uY$92Fx C;? sA2X:ȥґ? @ǰ>[R'pYǰ\ IuO#)xt l9),`!4-%39[q2ǯ.`}3LkE6WEjS MNI 2щb3=7q荈q, ݼ3T$>pm=v.Ee::SBhT@k S?.tn`-B̑mF噡"sdE*2GVv$Q9:4 &&k4 u0a\d=&SRs +59!57;̑mB)9%k2g0>@̜LmM-9oc ; ;qbډ䢉;7q'v; I;ߝIN$Qv'vع݉9 +vb'qIN$Qn'vXwb's;9GNdQ;<݉\NE;Ŵp^݉ĝyu'v2q^݉\1;9GٝɜNdQ;sXNRn'x^7s,߇ b]#uy ͅ+ML{Y%Tm:߼?}7?3wͻӿ7ȥ<{tA5>T^A5> U^>s E#"Hre-_hGֽXwOJgᾸͤÝ:=n [#mс]_/VoK<`Z cix΋,O[mçp3ӈNwhL<9h.'qOښ LuZvv=Z.J~)\Uiw>SU'=L40 tỉ|;]خCiǃO6v+GO<v[mt`űcl8ݷXV] vvv6O{f6~}gQv~ygng*c5NlފΆ< qTc1P?(K~;MzۮGuNO1k.3a3Rg"q m\'7(Z8362,;ce^x)zj4N[FUo~Ac 阸*҉_VRqDޏfopedüFgZǫ'۱/B !vcN`bnn_Iz]S%9^ա #N[DZQj\8h:Mp3˛ijg^>瘕ߟ߆m-_A~KysW{hH>}xO3˸9뫶8I]RFHy>Fnuœn<ȴAO ݜUxkr([RGގ-Jhc~u{v3\7n%7)fvij&" {N 7qإT<إ4^6q݁YL^3@e +۾~"C5pȥ:]̦YLo7|8%!eҕ~Ѱt\ ƭ>4(o_o%N&7|#&w,ɏl\b>#c7qBmPv=/_X }[ 7 7Poc!TnP B*_K!~k+kdcjΤ#a[!]O[h j]ݧڠiQB[ T,PmmwCJ޹!?B\A+l'^mdtjLUUV֕cZ2pP@e z#%6y$IupMc R_ىQAM dXiFkh·o˄1VheqZRlcNMj:H4%iђo 9َlcɴB#ywbGJmmj{.sbguSj-afRs.ÝD9|2DLbm%K"uDI6Dx y`5}}lW4l~cm+ÊP;erA!ڍf!aj +endstream endobj 114 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 478.654720 710.570079 491.179134 695.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 113 0 R +/Resources 4 0 R +/Annots [ 115 0 R 116 0 R 117 0 R 118 0 R 119 0 R 120 0 R 121 0 R 122 0 R 123 0 R 124 0 R 125 0 R 126 0 R 127 0 R 128 0 R 129 0 R 130 0 R 131 0 R 132 0 R 133 0 R 134 0 R 135 0 R 136 0 R 137 0 R 138 0 R 139 0 R 140 0 R 141 0 R 142 0 R 143 0 R 144 0 R 145 0 R 146 0 R 147 0 R 148 0 R 149 0 R 150 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 115 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 707.570079 498.679134 676.370079 ] +/Rect [ 99.673228 790.370079 498.679134 766.970079 ] /BS << /W 0 >> -/Dest (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) +/Dest (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) >> endobj 116 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 685.370079 491.179134 670.370079 ] +/Rect [ 481.786556 769.970079 491.179134 754.970079 ] /BS << /W 0 >> -/Dest (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) +/Dest (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) >> endobj 117 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 682.370079 498.679134 651.170079 ] +/Rect [ 99.673228 750.770079 498.679134 727.370079 ] /BS << /W 0 >> -/Dest (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) +/Dest (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) >> endobj 118 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 660.170079 491.179134 645.170079 ] +/Rect [ 481.786556 730.370079 491.179134 715.370079 ] /BS << /W 0 >> -/Dest (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) +/Dest (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) >> endobj 119 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 657.170079 498.679134 625.970079 ] +/Rect [ 99.673228 711.170079 498.679134 687.770079 ] /BS << /W 0 >> -/Dest (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) +/Dest (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) >> endobj 120 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 634.970079 491.179134 619.970079 ] +/Rect [ 481.786556 690.770079 491.179134 675.770079 ] /BS << /W 0 >> -/Dest (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) +/Dest (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) >> endobj 121 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 631.970079 498.679134 600.770079 ] +/Rect [ 99.673228 671.570079 498.679134 648.170079 ] /BS << /W 0 >> -/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) +/Dest (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) >> endobj 122 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 609.770079 491.179134 594.770079 ] +/Rect [ 481.786556 651.170079 491.179134 636.170079 ] /BS << /W 0 >> -/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) +/Dest (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) >> endobj 123 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 606.770079 498.679134 575.570079 ] +/Rect [ 99.673228 631.970079 498.679134 608.570079 ] /BS << /W 0 >> -/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) +/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) >> endobj 124 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 584.570079 491.179134 569.570079 ] +/Rect [ 481.786556 611.570079 491.179134 596.570079 ] /BS << /W 0 >> -/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) +/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) >> endobj 125 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 581.570079 498.679134 550.370079 ] +/Rect [ 99.673228 592.370079 498.679134 568.970079 ] /BS << /W 0 >> -/Dest (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) +/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) >> endobj 126 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 559.370079 491.179134 544.370079 ] +/Rect [ 481.786556 571.970079 491.179134 556.970079 ] /BS << /W 0 >> -/Dest (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) +/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) >> endobj 127 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 556.370079 498.679134 525.170079 ] +/Rect [ 99.673228 552.770079 498.679134 529.370079 ] /BS << /W 0 >> -/Dest (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) +/Dest (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) >> endobj 128 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 534.170079 491.179134 519.170079 ] +/Rect [ 481.786556 532.370079 491.179134 517.370079 ] /BS << /W 0 >> -/Dest (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) +/Dest (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) >> endobj 129 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 531.170079 498.679134 499.970079 ] +/Rect [ 99.673228 513.170079 498.679134 489.770079 ] /BS << /W 0 >> -/Dest (ensure-that-encryption-providers-are-appropriately-configured-automated) +/Dest (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) >> endobj 130 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 508.970079 491.179134 493.970079 ] +/Rect [ 481.786556 492.770079 491.179134 477.770079 ] /BS << /W 0 >> -/Dest (ensure-that-encryption-providers-are-appropriately-configured-automated) +/Dest (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) >> endobj 131 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 505.970079 498.679134 474.770079 ] +/Rect [ 99.673228 473.570079 498.679134 450.170079 ] /BS << /W 0 >> -/Dest (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated) +/Dest (ensure-that-encryption-providers-are-appropriately-configured-automated) >> endobj 132 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 483.770079 491.179134 468.770079 ] +/Rect [ 481.786556 453.170079 491.179134 438.170079 ] /BS << /W 0 >> -/Dest (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated) +/Dest (ensure-that-encryption-providers-are-appropriately-configured-automated) >> endobj 133 0 obj << /Type /Annot /Subtype /Link -/Rect [ 76.423228 462.770079 504.679134 430.070079 ] +/Rect [ 99.673228 433.970079 498.679134 410.570079 ] /BS << /W 0 >> -/Dest (controller-manager) +/Dest (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated) >> endobj 134 0 obj << /Type /Annot /Subtype /Link -/Rect [ 482.258235 454.820079 496.429134 439.820079 ] +/Rect [ 481.786556 413.570079 491.179134 398.570079 ] /BS << /W 0 >> -/Dest (controller-manager) +/Dest (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated) >> endobj 135 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 430.070079 498.679134 398.870079 ] +/Rect [ 76.423228 394.370079 504.679134 361.670079 ] /BS << /W 0 >> -/Dest (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) +/Dest (controller-manager) >> endobj 136 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 407.870079 491.179134 392.870079 ] +/Rect [ 482.305843 386.420079 496.429134 371.420079 ] /BS << /W 0 >> -/Dest (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) +/Dest (controller-manager) >> endobj 137 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 404.870079 498.679134 373.670079 ] +/Rect [ 99.673228 343.670079 498.679134 320.270079 ] /BS << /W 0 >> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-1) +/Dest (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) >> endobj 138 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 382.670079 491.179134 367.670079 ] +/Rect [ 481.786556 323.270079 491.179134 308.270079 ] /BS << /W 0 >> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-1) +/Dest (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) >> endobj 139 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 379.670079 498.679134 348.470079 ] +/Rect [ 99.673228 304.070079 498.679134 280.670079 ] /BS << /W 0 >> -/Dest (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-1) >> endobj 140 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 357.470079 491.179134 342.470079 ] +/Rect [ 481.786556 298.670079 491.179134 283.670079 ] /BS << /W 0 >> -/Dest (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-1) >> endobj 141 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 354.470079 498.679134 323.270079 ] +/Rect [ 99.673228 264.470079 498.679134 241.070079 ] /BS << /W 0 >> -/Dest (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) +/Dest (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) >> endobj 142 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 332.270079 491.179134 317.270079 ] +/Rect [ 481.786556 244.070079 491.179134 229.070079 ] /BS << /W 0 >> -/Dest (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) +/Dest (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) >> endobj 143 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 329.270079 498.679134 298.070079 ] +/Rect [ 99.673228 224.870079 498.679134 201.470079 ] /BS << /W 0 >> -/Dest (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) +/Dest (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) >> endobj 144 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 307.070079 491.179134 292.070079 ] +/Rect [ 481.786556 204.470079 491.179134 189.470079 ] /BS << /W 0 >> -/Dest (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) +/Dest (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) >> endobj 145 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 304.070079 498.679134 272.870079 ] +/Rect [ 99.673228 185.270079 498.679134 161.870079 ] /BS << /W 0 >> -/Dest (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) +/Dest (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) >> endobj 146 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 281.870079 491.179134 266.870079 ] +/Rect [ 481.786556 164.870079 491.179134 149.870079 ] /BS << /W 0 >> -/Dest (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) +/Dest (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) >> endobj 147 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 278.870079 498.679134 247.670079 ] +/Rect [ 99.673228 145.670079 498.679134 122.270079 ] /BS << /W 0 >> -/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) +/Dest (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) >> endobj 148 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 256.670079 491.179134 241.670079 ] +/Rect [ 481.786556 125.270079 491.179134 110.270079 ] /BS << /W 0 >> -/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) +/Dest (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) >> endobj 149 0 obj << /Type /Annot /Subtype /Link -/Rect [ 76.423228 235.670079 504.679134 202.970079 ] +/Rect [ 99.673228 106.070079 498.679134 82.670079 ] /BS << /W 0 >> -/Dest (scheduler) +/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) >> endobj 150 0 obj << /Type /Annot /Subtype /Link -/Rect [ 481.957942 227.720079 496.429134 212.720079 ] +/Rect [ 481.786556 85.670079 491.179134 70.670079 ] /BS << /W 0 >> -/Dest (scheduler) +/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) >> endobj 151 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 95.173228 202.970079 498.679134 171.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-2) ->> -endobj -152 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 478.654720 180.770079 491.179134 165.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-2) ->> -endobj -153 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 95.173228 177.770079 498.679134 146.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) ->> -endobj -154 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 478.654720 155.570079 491.179134 140.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) ->> -endobj -155 0 obj -<< /Filter /FlateDecode -/Length 4449 +/Length 3784 >> stream -x]K|T>$! $0޵sOQG~ͮk3h}]"jGR/rr[烘, -7KTo7VM^ Ju4n2^y/)hTT;?lluiOHVLyx9s N p_I)4Ӎ'n -ÃWhq)T.3Vcg9,y⤮+y|]~ R+\I@vNJuZq/Y9Z__l:8|$?񋙘%/}Ҏ`N=MgWбt r'C'޵5t5U)mD#pp\-L$㏿|eXj `BY/2Zʍd̤j5E2ɸI+0 IgeɁ!5ːjEٯA)?˒`#QI;˓hdHguEGɐVz5KIgv)E:; ǔ"0KiKcGvi#GvL $U -1Gv@J#" PĠAQ*Q0ˑΚ=ˑH51]tze2*)z` rLK'vQ= 8K+ -95lѨAi @3 Hg(Fv!@c?R]: zRbnW5c__' vT -Ζ -owڪ2Iub٦O=TW[G;.Tbjjpac+(yF橾OuJd|RFOvlVxb q8`c8Ki6cVq+q`xͨ־;ڞ̚S"Nѝ;EZQҼt,)St+QO7k)St]]vM h6 /̫xg0.;\\*F˄2xs/"7eΨ:h9\җ^nbx]e޼QmOݏNMfWH(yF$o.?"ahzW՗n+Ku\XF)xZ`WqPϩ^ t>jVp|Tt`V`8Zpl - Wp|X<mf -uשXyEbNѝ f(Zi^Yo:)S(ڧ5)S.E?fxe}`^=k&msF&-܆L -2& b,"!c&m7tFmn llý.:n}#:;utn',}BŤە+}I۽Ka$7E9WnӔݽg끑ӼfW5 Nڠ4MZ,ۼf8[،jʑ.(e⩾ky8:6߂W);&j%aټ6(q+q5yJ+tM1|y<f -uשq;Ew.(zc(פt,)St+QO7k)St]]vI=y g,'eG -\[J d ]ˣZd$@X2t.2tюd5OoX`$&ں,F,K~gUt2m 2P6ˁvHA@0%9 GA5YoE7YdS[#PM rZ3YeǑRh1+xq"1wUGlpQ]0q -&b 8m&qTq;I 85sx3w\r;Rq w;></G xk2ZMj;^&k;`RSH:op5 x&oihOuPӶf5|%}զϝ M9C;8Ih(4R߽?BͿF %'o:T{&&'x"7D?  a h= -r  t [Кu^B nS(jnk' m &{,A#$^&oi>?%&T ,kp2bc&%~ >u ߰nKnXoY⌺(7bK*0K"Y.cpK_z=*)rn~Mo]"|y 3F[| .ʙ3nh':XqSKca$YZA)4gd僲)y_(t ? C{i(dqdqR>7|? E0y%NBL[6SE]+QOE-74RzV:+c8+]YT|Z=o}r -2}oF׀Ͳ;9}ocs7}khjE_c}8 u;ް yxZ~''oC?}nv}/x|Қ7jt!07jUp,yv1}6i 'ߗMV4< ۅc{㌜W>32h -_!m1s$3x_a4{6ǚ5%˴(jإdzB?-O#Mru^')v*|RSu4cɆ^͘Klc2;/A^7-52k}'_C[6UB>9[[['~bCQv^5zlW!z:()0fΩDI;Y>qoz<]ۂ?)@"2{R`}L·W5mU-`S$$s\vEcUM~=0>۫6>s:\NYmcJS׳/_S~"/6֦^)}Jmtkս͇uC|[W'Eum%_)E;Cum#_+q}P{nKͦWy{;b={'?{<_+C^~mâiuMo;%eM7: ɖ+cnyu[{x͡R?.ύm##u!ޖHƆor+#N֣";. ^Ov>4Uxx8\>[hx[ۯ Rɭ%MtI MRjkr+`e׽KULldlCj/o0Pt@&;GigJqgq

$s@ ǩg" >\]J$r>uӡ+G)\9'UJkfE3;"} kXިx:h;Xjzl ;Q򥠴 -jF,<~Kf4TE2 $q< Y.IzNtCc\pzHQ2g]C Kɵ")As*?Wp3U^DH-ɵ6G\纳y\ < pH}&)p)}d ,QQ(p)3ؚ>,$뭸ÏyS?έ@m/~I?q%rPV0_C~BX"i@X"):PN'I+rr*gp/̽) P'hMZ7]yO%Ȇ Ztz;t&EJ͐|?P0;`ۈp{PY>tf+Hv2j`|R_QfzI h.}h6,Q=09yXqOMNFZ@usO - &M E.mӒ[f]K6) -#4d'"YȆqӊwK:o-։"~vFH-zP1eg*isg="]naj>lw1TCjz#W3n,["YgpEVRLo7PVNkuJ[>%'jC.;_^Zr/[P7c +x]K|T> f sOQYEvzz ,fXEVW(\5_1E~&`:?>X4WO6w}MZI~"88E'6 0LVf `z` Vʲb'VRc@or(^7ViؠA=Jذjsg_غ +)Blv4T/挱]ָ`aQM ס {줮ouן._5J_g1/ՑL>LЇȇȇ>v}1H:ט?M;!HiJϛ"e͛+YF|b3. +C 4Pƥ_b Hn&u)O-nY [$ vo&yBXlP-uۮX [dO[ioR&-ANͬc#v;q6, plA88w~FuxQDIѓ޹yPy3zIѓ'E?ET|Bw'EO}BW\z ;ޭkRpg"qmaum *'eQf$2Ωi$T@π*jL83R0739/ީwsF}\<G2TTIyKc  @&92ڑWW}c )A03X*i4 +cD?3R:ALx{uWA*pe$N=)蝛 E4=)zRQOŗ/t{RIW-t5muߢٔyg=My(_R;3}x;2APг F@#])uoe +Qx"|]5li5LEOKTn0E>1ڰUMw¢DMlgȞ22ز*`=nTTUNCTaa)-,JىeNb{@yTIѓ'E7s{h3f3'EO~"uO=)MhE =_0Bv{@4}.+}1$ň*1Ș"]֏_Lfʿ";!>arxЇ B߇-x-~k:b]T;gdi_+߾H᫿_|{>Пfi~%ZBN'7|[ +4a ̟l/-Z޾[:}uYv҃dK/3j[~9/l]Ҭ/)r7 E~8VF_ՙ]c( S",z';Ƈ|.sa/׋%JA!,)l2Ql뗎%ny(:wc]-L#g8P ]1Nm}eK۠ 6YY7NV<9f(~WF'JjGsŔ>uYߣ.g~ZYFOW}f3]>[JaL}?C{mkȷUo?F=2Ƙ7d1Qgo~#HAF$'Q&P#:Z;ofew |6]fML3I )E}?rc')!y?soIaƔxVa%l~`2E"Q bP;muEUsSX$k@Ʃ>6纨 +f=/fU\X \*rv-ڰF*TMSGz:~`H# +Zç- +GhUD͂T`Es>/7E> endobj -157 0 obj +153 0 obj << /Type /Annot /Subtype /Link @@ -1773,10 +1747,10 @@ endobj /BS << /W 0 >> -/Dest (etcd-node-configuration-files) +/Dest (scheduler) >> endobj -158 0 obj +154 0 obj << /Type /Annot /Subtype /Link @@ -1784,564 +1758,369 @@ endobj /BS << /W 0 >> -/Dest (etcd-node-configuration-files) +/Dest (scheduler) +>> +endobj +155 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 739.670079 498.679134 716.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-2) +>> +endobj +156 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 734.270079 491.179134 719.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-2) +>> +endobj +157 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 700.070079 498.679134 676.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) +>> +endobj +158 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 679.670079 491.179134 664.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) >> endobj 159 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 757.670079 498.679134 726.470079 ] +/Rect [ 76.423228 660.470079 504.679134 627.770079 ] /BS << /W 0 >> -/Dest (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) +/Dest (etcd-node-configuration-files) >> endobj 160 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 735.470079 491.179134 720.470079 ] +/Rect [ 481.237972 652.520079 496.429134 637.520079 ] /BS << /W 0 >> -/Dest (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) +/Dest (etcd-node-configuration-files) >> endobj 161 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 732.470079 498.679134 701.270079 ] +/Rect [ 99.673228 609.770079 498.679134 586.370079 ] /BS << /W 0 >> -/Dest (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) +/Dest (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) >> endobj 162 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 710.270079 491.179134 695.270079 ] +/Rect [ 481.786556 589.370079 491.179134 574.370079 ] /BS << /W 0 >> -/Dest (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) +/Dest (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) >> endobj 163 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 707.270079 498.679134 676.070079 ] +/Rect [ 99.673228 570.170079 498.679134 546.770079 ] /BS << /W 0 >> -/Dest (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) +/Dest (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) >> endobj 164 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 685.070079 491.179134 670.070079 ] +/Rect [ 481.786556 564.770079 491.179134 549.770079 ] /BS << /W 0 >> -/Dest (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) +/Dest (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) >> endobj 165 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 682.070079 498.679134 650.870079 ] +/Rect [ 99.673228 530.570079 498.679134 507.170079 ] /BS << /W 0 >> -/Dest (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) +/Dest (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) >> endobj 166 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 659.870079 491.179134 644.870079 ] +/Rect [ 481.786556 525.170079 491.179134 510.170079 ] /BS << /W 0 >> -/Dest (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) +/Dest (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) >> endobj 167 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 656.870079 498.679134 625.670079 ] +/Rect [ 99.673228 490.970079 498.679134 467.570079 ] /BS << /W 0 >> -/Dest (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) +/Dest (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) >> endobj 168 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 634.670079 491.179134 619.670079 ] +/Rect [ 481.786556 470.570079 491.179134 455.570079 ] /BS << /W 0 >> -/Dest (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) +/Dest (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) >> endobj 169 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 631.670079 498.679134 600.470079 ] +/Rect [ 99.673228 451.370079 498.679134 427.970079 ] /BS << /W 0 >> -/Dest (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) +/Dest (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) >> endobj 170 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 609.470079 491.179134 594.470079 ] +/Rect [ 481.786556 430.970079 491.179134 415.970079 ] /BS << /W 0 >> -/Dest (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) +/Dest (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) >> endobj 171 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 606.470079 498.679134 575.270079 ] +/Rect [ 99.673228 411.770079 498.679134 388.370079 ] /BS << /W 0 >> -/Dest (ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated) +/Dest (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) >> endobj 172 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.654720 584.270079 491.179134 569.270079 ] +/Rect [ 481.786556 406.370079 491.179134 391.370079 ] /BS << /W 0 >> -/Dest (ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated) +/Dest (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) >> endobj 173 0 obj << /Type /Annot /Subtype /Link -/Rect [ 76.423228 563.270079 504.679134 530.570079 ] +/Rect [ 99.673228 372.170079 498.679134 348.770079 ] /BS << /W 0 >> -/Dest (authentication-and-authorization) +/Dest (ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated) >> endobj 174 0 obj << /Type /Annot /Subtype /Link -/Rect [ 477.518001 555.320079 496.429134 540.320079 ] +/Rect [ 481.786556 366.770079 491.179134 351.770079 ] /BS << /W 0 >> -/Dest (authentication-and-authorization) +/Dest (ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated) >> endobj 175 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 530.570079 498.679134 499.370079 ] +/Rect [ 76.423228 332.570079 504.679134 299.870079 ] /BS << /W 0 >> -/Dest (client-certificate-authentication-should-not-be-used-for-users-manual) +/Dest (authentication-and-authorization) >> endobj 176 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 508.370079 491.179134 493.370079 ] +/Rect [ 478.154476 324.620079 496.429134 309.620079 ] /BS << /W 0 >> -/Dest (client-certificate-authentication-should-not-be-used-for-users-manual) +/Dest (authentication-and-authorization) >> endobj 177 0 obj << /Type /Annot /Subtype /Link -/Rect [ 76.423228 487.370079 504.679134 454.670079 ] +/Rect [ 99.673228 281.870079 498.679134 258.470079 ] /BS << /W 0 >> -/Dest (logging) +/Dest (client-certificate-authentication-should-not-be-used-for-users-manual) >> endobj 178 0 obj << /Type /Annot /Subtype /Link -/Rect [ 481.214534 479.420079 496.429134 464.420079 ] +/Rect [ 477.090267 261.470079 491.179134 246.470079 ] /BS << /W 0 >> -/Dest (logging) +/Dest (client-certificate-authentication-should-not-be-used-for-users-manual) >> endobj 179 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 454.670079 498.679134 423.470079 ] +/Rect [ 76.423228 242.270079 504.679134 209.570079 ] /BS << /W 0 >> -/Dest (ensure-that-a-minimal-audit-policy-is-created-automated) +/Dest (logging) >> endobj 180 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 432.470079 491.179134 417.470079 ] +/Rect [ 477.986019 234.320079 496.429134 219.320079 ] /BS << /W 0 >> -/Dest (ensure-that-a-minimal-audit-policy-is-created-automated) +/Dest (logging) >> endobj 181 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 429.470079 498.679134 398.270079 ] +/Rect [ 99.673228 191.570079 498.679134 168.170079 ] /BS << /W 0 >> -/Dest (ensure-that-the-audit-policy-covers-key-security-concerns-manual) +/Dest (ensure-that-a-minimal-audit-policy-is-created-automated) >> endobj 182 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 407.270079 491.179134 392.270079 ] +/Rect [ 477.090267 186.170079 491.179134 171.170079 ] /BS << /W 0 >> -/Dest (ensure-that-the-audit-policy-covers-key-security-concerns-manual) +/Dest (ensure-that-a-minimal-audit-policy-is-created-automated) >> endobj 183 0 obj << /Type /Annot /Subtype /Link -/Rect [ 76.423228 386.270079 504.679134 353.570079 ] +/Rect [ 99.673228 151.970079 498.679134 128.570079 ] /BS << /W 0 >> -/Dest (worker-node-configuration-files) +/Dest (ensure-that-the-audit-policy-covers-key-security-concerns-manual) >> endobj 184 0 obj << /Type /Annot /Subtype /Link -/Rect [ 477.986019 378.320079 496.429134 363.320079 ] +/Rect [ 477.090267 146.570079 491.179134 131.570079 ] /BS << /W 0 >> -/Dest (worker-node-configuration-files) +/Dest (ensure-that-the-audit-policy-covers-key-security-concerns-manual) >> endobj 185 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 95.173228 353.570079 498.679134 322.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -186 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 472.392513 331.370079 491.179134 316.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -187 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 95.173228 328.370079 498.679134 297.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) ->> -endobj -188 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 472.392513 306.170079 491.179134 291.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) ->> -endobj -189 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 95.173228 303.170079 498.679134 271.970079 ] -/BS << -/W 0 ->> -/Dest (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -190 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 472.392513 265.970079 491.179134 250.970079 ] -/BS << -/W 0 ->> -/Dest (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -191 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 95.173228 277.970079 498.679134 246.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-automated) ->> -endobj -192 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 446.105892 255.770079 464.892513 240.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-automated) ->> -endobj -193 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 95.173228 252.770079 498.679134 221.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -194 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 472.392513 215.570079 491.179134 200.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -195 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 95.173228 227.570079 498.679134 196.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -196 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 446.105892 205.370079 464.892513 190.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -197 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 95.173228 202.370079 498.679134 171.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -198 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 472.392513 165.170079 491.179134 150.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -199 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 95.173228 177.170079 498.679134 145.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) ->> -endobj -200 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 446.105892 154.970079 464.892513 139.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) ->> -endobj -201 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 95.173228 151.970079 498.679134 120.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) ->> -endobj -202 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 472.392513 114.770079 491.179134 99.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) ->> -endobj -203 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 95.173228 126.770079 498.679134 95.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) ->> -endobj -204 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 446.105892 104.570079 464.892513 89.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) ->> -endobj -205 0 obj -<< /Filter /FlateDecode -/Length 4613 +/Length 3763 >> stream -x]M$mEXFY q w;36CU$J힃At(QCR:'3)|vdM$`9dK o'gW'APwrv"_eѤhےCt{gpOl2/'Av6 z4qι-& `Kww8Pfdh򺑦v,OmEtq0?ӝ5Wqp`~pK,$Jh~77'7Յn/ٗ?7g{%0+5M̓0$p|?|8'_.a+ _ -ȧ<[+_)Whl N5w]Srڙ;{c>H &]Px 0;8K -O L`dsy8'a<“YqL*!!(5֩<.;gM -@xSp); ֫<87^7LF3+1!!9ђM̌ٛ>{ +[W|䜭Wp,=(MQyyw9 -,%9G1p^̌ -s6;7 i\JNs"7sW D -9ʣRpgNprB'rl}c-6gݘC.Tu`92D\B>`s\@߮l)b24BY_l -XM tb&W\JPǥb[A+S!q:7L <Щ$ -K}q8u)p-s78ȶ\8ˆC]wvܪꀃ;In+,5f6B8+ -$^! -WBkF>h&BN!:G -WBBWiqG._ԑ&+ rCru0L4T6yC rA"1urHr ԋS5l,6@l25X6kIƓ ufʓ9Ųym܏9)F_{T0KK)6.FS+FZaɀ.hA,L#Y}fC -f'2S& -1  'Y9Ji,e% ̳OLxr29)&KrjAiؕTƓcQC귘n7Edm,4ggc1Aꪄ;,ZU?.*4„JtiRo$j.1a:u}]TJB@oxSK얚{{FGACzkR)t8ՏKꀃ;AЛR"qχ76B8+ -$^! -WBC#^! -W~ ݣ}+D_!P+oL(;_qY;t~kQmY}E3jO3Kd*ΡH!Y*;]?Be!w;E#B=_> x򡇄,x ,7~w!1|x*3gqpM{OhB -$<{.w2c!7p=b  -HECD/$ Ip_;:<W |Mn ɷ[xg,.9Ժ.]eX%೵lk? ZX齖 ?zs%\]y*Vq?x>V\i8]e/m˵Evc!PB(rQk/c1eQ^Ty]a;=Ŧ3.n-v#,P[ܪD .2OX}*sy<;(z:v؅U\I$XܨVEN2ƾ1)'bR-9bŢw{5\hk/eD{sJӓ -/㾬6yn[1qV9oun}VC8#=OS8`VI`e=_>-qWlT]as <5<ۓ1Z(qC]9O=jj,t5no`E[NpF5Bjt"G&1?eSuN~JmVbw_VL:N5pk>'u?>r%|Nb,ugQc=6xho][غ{ mRW7:{Vn tQ/2V<+ڮ7;=}54nJ -Ĥ ZTq=D>喇>u'} 29ޢbfj3Oވ,nwmc"iBdlq^اps(m(Dq}ݭY0YW˪m@҇Ƈ @}[nUe|oHξuw+qW;s6TI${hs\eYڝ絫mWi&[Anqn#>~r큡p -Ġ*[C9' u/`ƭ{f*@e˦TfuBwOrb[.TK%iKn()mDx S7/ko/ix|Py7 qwAx{ʦ?b8kzT5++FM(1WRt*)7zKMv27lvUzyGS*/__ c1z4GUIPW ζfrx0|W -7a8ρug{_x6ju(4,^ @*og?ؐ˺AWm\_&YC `2JoLNP:+Ü N6w qj[_ r*-/\9ׯ@UҞjɗGV" nO.ڗ-dG B3{(y{MrN= -q1+/e2؆.M]˩ʖuJhP ѼTnT l8MHv]^ ԠSu$l|MHӔoRq4WtW~B[lR9M|u$@&7#^N%_O'sE!=ы~9/Ej*J+dKyQRbG#IzhYgp;0\tw@&Jjc$u\RXO˕h X\'SsZWa wo';Jrl;ѫ}+Ll%OUH'm]&}`:ѯ FkN.lƽrZ3C\q|ڝy~/<e hu ˙ _r eb%D@;٥K< 5'Zu$R Cs]p^XecVLSYtGO|A4) -lfqH)%(>ʮ+mB B0ɠ?^9(Ԗ6 -%9/a*7[H -J։ Jk=:6fY4NS+VSt_IҌH-UK@$9vlldЂlݨ9}e(ζg^ތv#a3a+ĥas)wRCHP$FF,o)Eѱ )^0j} Al*y׷,;B< -Sy6K]n:] +x\ˮ#+66_"ËbY8,,9ntI|gu!|ZG[R`&&?3bs1/7!A'!8V1.k'R&1wI'6=G{;Kay:5<ޱISghMHOr(B^@\nkq#eٷYVmFyYW?mL,BsnvL&4uCm8tk~;6 }HC;ٗ?7|N>sc6$M;i?t|M?|:򇏗olFyMׄ|Mț$8[Kt|M?|:>fj-N.>tM. 9o?m0%J:&Mb(cfr[a8X`m13Y$pѪ .4 8; y1lMT0*a˞ i8n &JdU 3%cqd|2J90r?b8;?.%b28c Y8j29S&qOpN*9`g%~K?ރ3%R1ɆďW1Ξan جďQ1XP &%`6S'9DSRb A + ILSfU vI9FgV8p&̊JarR'xpTLgo8)8cP1Θc d*0 iMɪIgV'dRIPrQfV⇰uK䢊XSP1ypvK[Vpư?ٸb&Lh'D<?8'U ́X~))< K1Qg=#6j9|{R‰:X\n!bhL +&s 3(EcƙB4gh8##Lg9wɀ3 A 8;K#gQ8RK^ .S2ƹrNI301sRALlk'dGc#L,eCG.ilh(*.eCKt?¤R6}&qUx_<}]E~T֏" w?G*{>C͇*"-qU^ľ/)\BfEO{'sU_OW{t=ʋ6*Sy5͒"1^varx1'~g{yq/dNx>v "]ž[ue|^/cVpmsw=1O^n[#54ZxFU6FOS|8P%nCO.M<ˏ䪟lY{i:뇆ZLmbŊ_>]~9LI;b(s=ܜ7m70˃E5`+NgymnC-~T%e]*A(2Kq}B"IUlT(V{ëbBHB#u1r0Wkosw4R[ztZ.Jm2WLyA*7)UdsHh~M> endobj -207 0 obj +187 0 obj << /Type /Annot /Subtype /Link @@ -2349,575 +2128,804 @@ endobj /BS << /W 0 >> -/Dest (kubelet) +/Dest (worker-node-configuration-files) +>> +endobj +188 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.518001 782.420079 496.429134 767.420079 ] +/BS << +/W 0 +>> +/Dest (worker-node-configuration-files) +>> +endobj +189 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 739.670079 498.679134 716.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +190 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 719.270079 491.179134 704.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +191 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 700.070079 498.679134 676.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) +>> +endobj +192 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 679.670079 491.179134 664.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) +>> +endobj +193 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 660.470079 498.679134 637.070079 ] +/BS << +/W 0 +>> +/Dest (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +194 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 640.070079 491.179134 625.070079 ] +/BS << +/W 0 +>> +/Dest (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +195 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 620.870079 498.679134 597.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-automated) +>> +endobj +196 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 600.470079 491.179134 585.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-automated) +>> +endobj +197 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 581.270079 498.679134 557.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +198 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 560.870079 491.179134 545.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +199 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 541.670079 498.679134 518.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +200 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 521.270079 491.179134 506.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +201 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 502.070079 498.679134 478.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +202 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 481.670079 491.179134 466.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +203 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 462.470079 498.679134 439.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) +>> +endobj +204 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 442.070079 491.179134 427.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) +>> +endobj +205 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 422.870079 498.679134 399.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) +>> +endobj +206 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 402.470079 491.179134 387.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) +>> +endobj +207 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 383.270079 498.679134 359.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) >> endobj 208 0 obj << /Type /Annot /Subtype /Link -/Rect [ 477.482112 782.420079 496.429134 767.420079 ] +/Rect [ 477.090267 362.870079 491.179134 347.870079 ] /BS << /W 0 >> -/Dest (kubelet) +/Dest (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) >> endobj 209 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 757.670079 498.679134 726.470079 ] +/Rect [ 76.423228 343.670079 504.679134 310.970079 ] /BS << /W 0 >> -/Dest (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) +/Dest (kubelet) >> endobj 210 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 735.470079 491.179134 720.470079 ] +/Rect [ 481.214534 335.720079 496.429134 320.720079 ] /BS << /W 0 >> -/Dest (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) +/Dest (kubelet) >> endobj 211 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 732.470079 498.679134 701.270079 ] +/Rect [ 99.673228 292.970079 498.679134 269.570079 ] /BS << /W 0 >> -/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) +/Dest (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) >> endobj 212 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 710.270079 491.179134 695.270079 ] +/Rect [ 477.090267 272.570079 491.179134 257.570079 ] /BS << /W 0 >> -/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) +/Dest (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) >> endobj 213 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 707.270079 498.679134 676.070079 ] +/Rect [ 99.673228 253.370079 498.679134 229.970079 ] /BS << /W 0 >> -/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) +/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) >> endobj 214 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 685.070079 491.179134 670.070079 ] +/Rect [ 477.090267 232.970079 491.179134 217.970079 ] /BS << /W 0 >> -/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) +/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) >> endobj 215 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 682.070079 498.679134 650.870079 ] +/Rect [ 99.673228 213.770079 498.679134 190.370079 ] /BS << /W 0 >> -/Dest (ensure-that-the---read-only-port-argument-is-set-to-0-automated) +/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) >> endobj 216 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 659.870079 491.179134 644.870079 ] +/Rect [ 477.090267 193.370079 491.179134 178.370079 ] /BS << /W 0 >> -/Dest (ensure-that-the---read-only-port-argument-is-set-to-0-automated) +/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) >> endobj 217 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 656.870079 498.679134 625.670079 ] +/Rect [ 99.673228 174.170079 498.679134 150.770079 ] /BS << /W 0 >> -/Dest (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) +/Dest (ensure-that-the---read-only-port-argument-is-set-to-0-automated) >> endobj 218 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 634.670079 491.179134 619.670079 ] +/Rect [ 477.090267 168.770079 491.179134 153.770079 ] /BS << /W 0 >> -/Dest (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) +/Dest (ensure-that-the---read-only-port-argument-is-set-to-0-automated) >> endobj 219 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 631.670079 498.679134 600.470079 ] +/Rect [ 99.673228 134.570079 498.679134 111.170079 ] /BS << /W 0 >> -/Dest (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) +/Dest (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) >> endobj 220 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 609.470079 491.179134 594.470079 ] +/Rect [ 477.090267 114.170079 491.179134 99.170079 ] /BS << /W 0 >> -/Dest (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) +/Dest (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) >> endobj 221 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 95.173228 606.470079 498.679134 575.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) +/Filter /FlateDecode +/Length 4004 >> +stream +x\K sU$X @ E$@lE0䐿ZV3=^zT(GRΖ}ΤcɚHr!̐?L^ ^Oh@29xVhrne]XĘ8RPt)O rVug)8k$o/x4L3{E@JhLY+<Vl|*9` +QGdU0cLQ0PGM"C-`8⨈ + !T04Lc6ML8QrDt9$So='LR>fΘ@}S&`ʖ᜙r`!2-ԚgĢ4 .[MskN~O!rYbXme{ S[zйXdW0G?~lCȪ8܎Bܜ`&.rt<]In%'-ԋ l%uWWt?zqp85,ˎptP%rhLqp׷pi!QR8cǡJ˼y͗=EiE#D!]Wj<чɈ!G~ ݣ}#D!zW+oPG~u;h~.8zy&Lm{rX6Ü'LmTx_ٷ-9O^ҭsٺf&u6+:u(dE60@Vt.uʊ$̚ΜT4=3e41]jS*[} vΔ'qMIȅ>hOжĦ<LQ9oGLy8RN6h:g<D[bAPtcA9B#=>eϱcHKDȱ#⫑j;CC ;>*8QB%b,×4SIzMgQ9<)SMWBr`WbZPtN8ZpX.Ξc'tȱu&9m}u,&: e'i~ˆr$I儠Td)o+N;A_ق.*ٍ!xUggv(Q; +ztBwGeeы5]vRܙabvy1E\xxO&DSՇ<E'- .i< <{ēiy'[5}?8Amc"P L1ڤX1Sy*f %b?&B۽ i}ur7O +J>϶v3x?~9|e̮?xGZ3 ""2o+Wy>MҾVd-S/] ݋~v-o5[Z?T[.(^d^~Z~w=3FUGbK/tbPֱގY>/U B[t1 ;.YU|83\=}'tPm}E߿:_ipiY}_ZLv [;⁽V텿XX'v[AؼO'8n1&j> ]]җ5=vsEΗSX9{eiuR[[FmjZ}@^Ԁߊ?>}p%F~m;1gr5 je}%|O7ԬݾiظǺAظP]>q|7dՎqkŧ._qYѳZU0%&]vuvlѢKff *;ƓvxYeEfn2!!::P|(*lkK*.>n_Kf-j?H&m>[m'F$s}Pqx=>~pN'ˊ(-fVMɿm}n$ݰaVʿ,mﴙDJ$P"w^sٴ,kh|k窟ô|1LqRC#&0ڒlpB7 WyglC/gm8}yz{羿|S25<8U-ۓ|W2@z*L/H{c07^臹cĮ47^Nx9X>O: uvJNӄTpS.Pru&iW{T\i4CcbJ4,NpMuy_B0Bw/wv 7\a$zo'';ePcjlJ*SKY W:gCHN^IC:8@^QJ{q)3/IswdsS$~nם<u۳ܺ"˙ 7_$Na#"K7y@kH UIaCA2/+B^lƄ}=mp|qiϢK>+cJ!NTC!n?J(|%NDQNc]72 +N4FWL~sxݍ{U9(Ԟ;YR +'9/a}|Pˋ1J \H4UBVBDlc)f,ˈJ4ITIv6j;1:;8{-& [w*Nh{ٸf۳E¨LhF;7忷j+ĥa']Ϲ;Cg_>]Myu}d%6K$Fv3_/_]le; pYUo|}h꧱,)%{l.ڃ}w^?Q +endstream endobj 222 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 472.392513 584.270079 491.179134 569.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 221 0 R +/Resources 4 0 R +/Annots [ 223 0 R 224 0 R 225 0 R 226 0 R 227 0 R 228 0 R 229 0 R 230 0 R 231 0 R 232 0 R 233 0 R 234 0 R 235 0 R 236 0 R 237 0 R 238 0 R 239 0 R 240 0 R 241 0 R 242 0 R 243 0 R 244 0 R 245 0 R 246 0 R 247 0 R 248 0 R 249 0 R 250 0 R 251 0 R 252 0 R 253 0 R 254 0 R 255 0 R 256 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 223 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 581.270079 498.679134 550.070079 ] +/Rect [ 99.673228 790.370079 498.679134 766.970079 ] /BS << /W 0 >> -/Dest (ensure-that-the---hostname-override-argument-is-not-set-manual) +/Dest (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) >> endobj 224 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 559.070079 491.179134 544.070079 ] +/Rect [ 477.090267 769.970079 491.179134 754.970079 ] /BS << /W 0 >> -/Dest (ensure-that-the---hostname-override-argument-is-not-set-manual) +/Dest (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) >> endobj 225 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 556.070079 498.679134 524.870079 ] +/Rect [ 99.673228 750.770079 498.679134 727.370079 ] /BS << /W 0 >> -/Dest (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-automated) +/Dest (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) >> endobj 226 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 518.870079 491.179134 503.870079 ] +/Rect [ 477.090267 730.370079 491.179134 715.370079 ] /BS << /W 0 >> -/Dest (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-automated) +/Dest (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) >> endobj 227 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 530.870079 498.679134 499.670079 ] +/Rect [ 99.673228 711.170079 498.679134 687.770079 ] /BS << /W 0 >> -/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) +/Dest (ensure-that-the---hostname-override-argument-is-not-set-manual) >> endobj 228 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 493.670079 491.179134 478.670079 ] +/Rect [ 477.090267 705.770079 491.179134 690.770079 ] /BS << /W 0 >> -/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) +/Dest (ensure-that-the---hostname-override-argument-is-not-set-manual) >> endobj 229 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 505.670079 498.679134 474.470079 ] +/Rect [ 99.673228 671.570079 498.679134 648.170079 ] /BS << /W 0 >> -/Dest (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated) +/Dest (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-automated) >> endobj 230 0 obj << /Type /Annot /Subtype /Link -/Rect [ 446.105892 483.470079 464.892513 468.470079 ] +/Rect [ 477.090267 651.170079 491.179134 636.170079 ] /BS << /W 0 >> -/Dest (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated) +/Dest (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-automated) >> endobj 231 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 480.470079 498.679134 449.270079 ] +/Rect [ 99.673228 631.970079 498.679134 608.570079 ] /BS << /W 0 >> -/Dest (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) +/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) >> endobj 232 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 443.270079 491.179134 428.270079 ] +/Rect [ 477.090267 611.570079 491.179134 596.570079 ] /BS << /W 0 >> -/Dest (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) +/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) >> endobj 233 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 455.270079 498.679134 424.070079 ] +/Rect [ 99.673228 592.370079 498.679134 568.970079 ] /BS << /W 0 >> -/Dest (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-automated) +/Dest (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated) >> endobj 234 0 obj << /Type /Annot /Subtype /Link -/Rect [ 446.105892 433.070079 464.892513 418.070079 ] +/Rect [ 477.090267 571.970079 491.179134 556.970079 ] /BS << /W 0 >> -/Dest (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-automated) +/Dest (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated) >> endobj 235 0 obj << /Type /Annot /Subtype /Link -/Rect [ 76.423228 412.070079 504.679134 379.370079 ] +/Rect [ 99.673228 552.770079 498.679134 529.370079 ] /BS << /W 0 >> -/Dest (rbac-and-service-accounts) +/Dest (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) >> endobj 236 0 obj << /Type /Annot /Subtype /Link -/Rect [ 482.198909 404.120079 496.429134 389.120079 ] +/Rect [ 477.090267 532.370079 491.179134 517.370079 ] /BS << /W 0 >> -/Dest (rbac-and-service-accounts) +/Dest (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) >> endobj 237 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 379.370079 498.679134 348.170079 ] +/Rect [ 99.673228 513.170079 498.679134 489.770079 ] /BS << /W 0 >> -/Dest (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) +/Dest (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-automated) >> endobj 238 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 357.170079 491.179134 342.170079 ] +/Rect [ 477.090267 492.770079 491.179134 477.770079 ] /BS << /W 0 >> -/Dest (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) +/Dest (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-automated) >> endobj 239 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 354.170079 498.679134 322.970079 ] +/Rect [ 76.423228 473.570079 504.679134 440.870079 ] /BS << /W 0 >> -/Dest (minimize-access-to-secrets-manual) +/Dest (rbac-and-service-accounts) >> endobj 240 0 obj << /Type /Annot /Subtype /Link -/Rect [ 446.105892 346.970079 464.892513 331.970079 ] +/Rect [ 481.191097 465.620079 496.429134 450.620079 ] /BS << /W 0 >> -/Dest (minimize-access-to-secrets-manual) +/Dest (rbac-and-service-accounts) >> endobj 241 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 328.970079 498.679134 297.770079 ] +/Rect [ 99.673228 422.870079 498.679134 399.470079 ] /BS << /W 0 >> -/Dest (minimize-wildcard-use-in-roles-and-clusterroles-manual) +/Dest (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) >> endobj 242 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 306.770079 491.179134 291.770079 ] +/Rect [ 477.090267 402.470079 491.179134 387.470079 ] /BS << /W 0 >> -/Dest (minimize-wildcard-use-in-roles-and-clusterroles-manual) +/Dest (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) >> endobj 243 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 303.770079 498.679134 272.570079 ] +/Rect [ 99.673228 383.270079 498.679134 359.870079 ] /BS << /W 0 >> -/Dest (minimize-access-to-create-pods-manual) +/Dest (minimize-access-to-secrets-manual) >> endobj 244 0 obj << /Type /Annot /Subtype /Link -/Rect [ 446.105892 296.570079 464.892513 281.570079 ] +/Rect [ 477.090267 377.870079 491.179134 362.870079 ] /BS << /W 0 >> -/Dest (minimize-access-to-create-pods-manual) +/Dest (minimize-access-to-secrets-manual) >> endobj 245 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 278.570079 498.679134 247.370079 ] +/Rect [ 99.673228 343.670079 498.679134 320.270079 ] /BS << /W 0 >> -/Dest (ensure-that-default-service-accounts-are-not-actively-used.-automated) +/Dest (minimize-wildcard-use-in-roles-and-clusterroles-manual) >> endobj 246 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 256.370079 491.179134 241.370079 ] +/Rect [ 477.090267 338.270079 491.179134 323.270079 ] /BS << /W 0 >> -/Dest (ensure-that-default-service-accounts-are-not-actively-used.-automated) +/Dest (minimize-wildcard-use-in-roles-and-clusterroles-manual) >> endobj 247 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 253.370079 498.679134 222.170079 ] +/Rect [ 99.673228 304.070079 498.679134 280.670079 ] /BS << /W 0 >> -/Dest (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) +/Dest (minimize-access-to-create-pods-manual) >> endobj 248 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 231.170079 491.179134 216.170079 ] +/Rect [ 477.090267 298.670079 491.179134 283.670079 ] /BS << /W 0 >> -/Dest (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) +/Dest (minimize-access-to-create-pods-manual) >> endobj 249 0 obj << /Type /Annot /Subtype /Link -/Rect [ 76.423228 210.170079 504.679134 177.470079 ] +/Rect [ 99.673228 264.470079 498.679134 241.070079 ] /BS << /W 0 >> -/Dest (pod-security-policies) +/Dest (ensure-that-default-service-accounts-are-not-actively-used.-automated) >> endobj 250 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.154476 202.220079 496.429134 187.220079 ] +/Rect [ 477.090267 244.070079 491.179134 229.070079 ] /BS << /W 0 >> -/Dest (pod-security-policies) +/Dest (ensure-that-default-service-accounts-are-not-actively-used.-automated) >> endobj 251 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 177.470079 498.679134 146.270079 ] +/Rect [ 99.673228 224.870079 498.679134 201.470079 ] /BS << /W 0 >> -/Dest (minimize-the-admission-of-privileged-containers-manual) +/Dest (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) >> endobj 252 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 155.270079 491.179134 140.270079 ] +/Rect [ 477.090267 204.470079 491.179134 189.470079 ] /BS << /W 0 >> -/Dest (minimize-the-admission-of-privileged-containers-manual) +/Dest (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) >> endobj 253 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 152.270079 498.679134 121.070079 ] +/Rect [ 76.423228 185.270079 504.679134 152.570079 ] /BS << /W 0 >> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) +/Dest (pod-security-policies) >> endobj 254 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 130.070079 491.179134 115.070079 ] +/Rect [ 478.790950 177.320079 496.429134 162.320079 ] /BS << /W 0 >> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) +/Dest (pod-security-policies) >> endobj 255 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 127.070079 498.679134 95.870079 ] +/Rect [ 99.673228 134.570079 498.679134 111.170079 ] /BS << /W 0 >> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) +/Dest (minimize-the-admission-of-privileged-containers-manual) >> endobj 256 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 104.870079 491.179134 89.870079 ] +/Rect [ 477.090267 129.170079 491.179134 114.170079 ] /BS << /W 0 >> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) +/Dest (minimize-the-admission-of-privileged-containers-manual) >> endobj 257 0 obj << /Filter /FlateDecode -/Length 4206 +/Length 3763 >> stream -x]Kـi0 H56!ak#1!?EDQ=ݞ4.UT&I7 Κrr¡9~Ol'F|WKz~Id^9; X%>!eI -iSOAA݀ $M6Cj@vtlI@0ƢF4N ma@DF q| WZ3!xDpF;BS`EBlhPR)bǏl0#y4XyS%1QvOᥖ8)e5GY($TQJ1G@>UBKڧuJ#ƐS*s5nا^ -/?^y!}\)ET9|K(RW -NJ[:.$L-Fa[zXz0^e4lYT*| r}=AJ]8rV]7R}{_[??x2J٢Ԏ5n@|f9v=,շXAǟi`LOEnE3E=St6i)ho;)z虢oT|Fw/u=SLч6V=ߌ[.^kk <4 -EPfL)1V -w0>1 -w0>1)`|b`|b<|0>1A -0>1z0>Ӻ ;f'e|{|:{1g뮂FV&I-Vk&5.M6=+Д[eie -2 l`&Էd o5|\R o/YݴQ^[k롮R92fYl j!Yd9ZkocgUR}{rsg7~Mz㇊N֛̎LT Crhp?lR}{?0f`ڼ~*r{L3Eݤc&E}mG3E=SRg)Fr1C='l혁l?.ח!~Ώ2ޏhH{PҪ}ځ͟ӧdP0"·EvEgiՁti`>TsV4B,~Z͈ Cˑ :G6A"F6t(D#2KtDㄓH7 Z8 -G6 Ax -C5b1r`CV: =叔q$um(%eUkqrt݇ U#*2#Z2yOREN^.ˇϗ+%;?]8(jJo΄do`1oD3A{oeb;Qq`T#?~aDS=1 poeҚ(P>6WxDM= C0,+2:0>96#沴C2Y9>1ahm1&Rp[WɑANJk=B:jzOo>' Xi/D>ave<αy=ҺyOuݙo{ZԷ綈ꗥjWIL<7d"|\{$stn6kKZ[EJ$_*#@VmZpwZ9yZZ'_5wKĿ*dE^#|ׯ#*r~k6zFl/Xm~`8kz|/cL3:>TemuCI֘'J>[PO3fxhW9??;LX\"gvLFlt6lR -l*à:Id_odjXGS. e;p^/7g6֡cXu[ }jz}n`Y'*;sj66UN2\"slдu,ƞP.\uekh5˟er$RU5z]óҾAam$CJۻvrl}.Gkm6?Xv,*3{WMҹtJ3̴7n|y +=+7YW0K*VVdT+mFQ~U;{2iܹwSNȓHu;:e>uGST3vvKqFaO(ʵuYULu^++VuwN^{# Vyu onynz,I>{ZNy. dޅ~j{fv'w=sFO=0^ Ǖm;"Suvs*[#cP=O;W2y5Xއ>wG3l/:y|,6ovt:г-ak4Eol[:j!l_qHL0~ܪ &\.`xO[H$])ǝ&x ^4Z0NcoKPH1>oX>23CM}^"⊏O|}۪f_LE[*7:AY`,L;%P)޼c~y7~#[Lp ?CoO;#ʲLX%֔:< eq]>#Ga&=QFf"b/; ia Gݰ LN@/t:EYf낆뉇0h@܂0`ȴ<,h":70gMBl} - -u,fBb,1O(Zyey5%|}$SB@K.SPzjȖP׾6J(gv_^UtZFm%֝ |AסZ+$f/u>R3cvNT*⍀GIF-U,6(MGim/;be&c YXJha(QWX²}JB -c rbIU - w,VؖaW<%j,3xY1}fRu9| -3V(TZP$uFy]{;L!_3)ƺq%KP60d*~፰ ,i@eXٯ0J9JnOgJ(ʳjCt,b<ڰC#6PC>kKؒtIkKgb'_P%kČəG wFC]336kH 4 LC#OGa'm΀^g"Z -^mK+ZYɩQ91P_OKș5Ls(B\L62kVreOQџ{W6;^-Bήj'+eKf5Rgl۴s -bTpCyW'wQ2Ԩ 8v[K5fl猇%ۑHpNhێD8~-ިsZ|?ZG3 en{:{o&2@OIɝT6c4pH +x]K$ E> 0ٵX琿JZupU_HOI]ScΚ? +!zI+Od~*]m]T!{~ ʭ#\O똕9[%Iʛ' <,)OA͊㄄GIF(cf ~FT&4*ZG0R*F(Lh8fWlj; 7񧡨t f8R(ƉG7i7q)IpFX7i$X;QOYe qOhUى>`.:=))5 +zcBAO| +hzħQ:!RdْqVOٙ8Rq] +fScOdYB|MjD#WLr0) LpaS gu8k qSkFYH\32\3sf6tDO\3[hFfZhvO\3 `Bk&7iPkʌq ^O|f"$A3}f6k~Sk&j郠>)bLhfLfruSㆭOTk0=#5Y\<2#JjS~>}S9bN:Mj#W,]ڊ "J]ù6>_G&/&33s;!Tj.0 +NlW4.U"qB?^x|ōF]%Jxn*QXjlKBf\` DNp\(fFbC(,5yѦ .dγUw{?> pBbv~0;~x(,5+XhvRw?;+ +OSJnt)iލ FtO{S8?K{Sʻ, A5E=mJ-q̷<tKl=)~X'[,r[,>c;l>a(;a00vE8-[,!ݻ8<:L@h(IG9o?/(sF/c:R<껗̮/B/tKiEMh0cNhu_S&M恣i.iPm;f![n5`hje/"Jg- _8>_y^Vϵqj@^rϳg:,;*N(ˍl,0\Z,B]zK ԓSl}6fXkg]6l!)u]x_kUqMnƚ3DQwv'VU5/-_V~$G}d +fPd dn6y#4̉B&kEkf y.JS +t]ZrpBcY|: ӷjÉ &ahqy2L^v.@Y,k;.OPJx^-N2%ukP1h ?X>u]NƦ{16M&V C2t=욮PRЯ _5FnYave󙫪+:3m ۅZt j!B=tFЂ[q낮JŊRԅ53kPB6bQn]NC̍| +X,TinC5[lQ.h[{8qQ}/Tw5Z[[4ԇb*N͂Z*,.Sȳ&$f{#Iժ# 'қ+yG ө}*ZC{PXZVJP%X\c7=*{w|j|7 Zp" xYni006Ÿ(4.Z$utMY__>jm`lq! +XF7؄FK%jBij5S Rn 24/+։k}zjtPDOC̶|,,Ο" D2S!06:5S@J!II8ӈtjgڬd]eM;}J8^+Z+(:ւ7Frs0J6 U^V䞭mj݉QvY& ) - t*G_trbeah%_ EZWIz]&ْ ts0(mec/t۳6E\v]Q$wNx t'85$q ȳo\o)vxQ?Vˢyؽ9}|U6#TO}Z*R OI;^?l> endstream endobj 258 0 obj @@ -2927,7 +2935,7 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 257 0 R /Resources 4 0 R -/Annots [ 259 0 R 260 0 R 261 0 R 262 0 R 263 0 R 264 0 R 265 0 R 266 0 R 267 0 R 268 0 R 269 0 R 270 0 R 271 0 R 272 0 R 273 0 R 274 0 R 275 0 R 276 0 R 277 0 R 278 0 R 279 0 R 280 0 R 281 0 R 282 0 R 283 0 R 284 0 R 285 0 R 286 0 R 287 0 R 288 0 R 289 0 R 290 0 R 291 0 R 292 0 R 293 0 R 294 0 R 295 0 R 296 0 R ] +/Annots [ 259 0 R 260 0 R 261 0 R 262 0 R 263 0 R 264 0 R 265 0 R 266 0 R 267 0 R 268 0 R 269 0 R 270 0 R 271 0 R 272 0 R 273 0 R 274 0 R 275 0 R 276 0 R 277 0 R 278 0 R 279 0 R 280 0 R 281 0 R 282 0 R 283 0 R 284 0 R 285 0 R 286 0 R 287 0 R 288 0 R 289 0 R 290 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> @@ -2936,457 +2944,535 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 808.370079 498.679134 777.170079 ] +/Rect [ 99.673228 790.370079 498.679134 766.970079 ] /BS << /W 0 >> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) >> endobj 260 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 786.170079 491.179134 771.170079 ] +/Rect [ 477.090267 769.970079 491.179134 754.970079 ] /BS << /W 0 >> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) >> endobj 261 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 783.170079 498.679134 751.970079 ] +/Rect [ 99.673228 750.770079 498.679134 727.370079 ] /BS << /W 0 >> -/Dest (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) >> endobj 262 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 760.970079 491.179134 745.970079 ] +/Rect [ 477.090267 730.370079 491.179134 715.370079 ] /BS << /W 0 >> -/Dest (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) >> endobj 263 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 757.970079 498.679134 726.770079 ] +/Rect [ 99.673228 711.170079 498.679134 687.770079 ] /BS << /W 0 >> -/Dest (minimize-the-admission-of-root-containers-manual) +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) >> endobj 264 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 735.770079 491.179134 720.770079 ] +/Rect [ 477.090267 690.770079 491.179134 675.770079 ] /BS << /W 0 >> -/Dest (minimize-the-admission-of-root-containers-manual) +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) >> endobj 265 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 732.770079 498.679134 701.570079 ] +/Rect [ 99.673228 671.570079 498.679134 648.170079 ] /BS << /W 0 >> -/Dest (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) +/Dest (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) >> endobj 266 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 710.570079 491.179134 695.570079 ] +/Rect [ 477.090267 651.170079 491.179134 636.170079 ] /BS << /W 0 >> -/Dest (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) +/Dest (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) >> endobj 267 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 707.570079 498.679134 676.370079 ] +/Rect [ 99.673228 631.970079 498.679134 608.570079 ] /BS << /W 0 >> -/Dest (minimize-the-admission-of-containers-with-added-capabilities-manual) +/Dest (minimize-the-admission-of-root-containers-manual) >> endobj 268 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 685.370079 491.179134 670.370079 ] +/Rect [ 477.090267 626.570079 491.179134 611.570079 ] /BS << /W 0 >> -/Dest (minimize-the-admission-of-containers-with-added-capabilities-manual) +/Dest (minimize-the-admission-of-root-containers-manual) >> endobj 269 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 682.370079 498.679134 651.170079 ] +/Rect [ 99.673228 592.370079 498.679134 568.970079 ] /BS << /W 0 >> -/Dest (minimize-the-admission-of-containers-with-capabilities-assigned-manual) +/Dest (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) >> endobj 270 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 660.170079 491.179134 645.170079 ] +/Rect [ 477.090267 571.970079 491.179134 556.970079 ] /BS << /W 0 >> -/Dest (minimize-the-admission-of-containers-with-capabilities-assigned-manual) +/Dest (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) >> endobj 271 0 obj << /Type /Annot /Subtype /Link -/Rect [ 76.423228 639.170079 504.679134 606.470079 ] +/Rect [ 99.673228 552.770079 498.679134 529.370079 ] /BS << /W 0 >> -/Dest (network-policies-and-cni) +/Dest (minimize-the-admission-of-containers-with-added-capabilities-manual) >> endobj 272 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.142757 631.220079 496.429134 616.220079 ] +/Rect [ 477.090267 532.370079 491.179134 517.370079 ] /BS << /W 0 >> -/Dest (network-policies-and-cni) +/Dest (minimize-the-admission-of-containers-with-added-capabilities-manual) >> endobj 273 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 606.470079 498.679134 575.270079 ] +/Rect [ 99.673228 513.170079 498.679134 489.770079 ] /BS << /W 0 >> -/Dest (ensure-that-the-cni-in-use-supports-network-policies-manual) +/Dest (minimize-the-admission-of-containers-with-capabilities-assigned-manual) >> endobj 274 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 584.270079 491.179134 569.270079 ] +/Rect [ 477.090267 492.770079 491.179134 477.770079 ] /BS << /W 0 >> -/Dest (ensure-that-the-cni-in-use-supports-network-policies-manual) +/Dest (minimize-the-admission-of-containers-with-capabilities-assigned-manual) >> endobj 275 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 581.270079 498.679134 550.070079 ] +/Rect [ 76.423228 473.570079 504.679134 440.870079 ] /BS << /W 0 >> -/Dest (ensure-that-all-namespaces-have-network-policies-defined-automated) +/Dest (network-policies-and-cni) >> endobj 276 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 559.070079 491.179134 544.070079 ] +/Rect [ 478.154476 465.620079 496.429134 450.620079 ] /BS << /W 0 >> -/Dest (ensure-that-all-namespaces-have-network-policies-defined-automated) +/Dest (network-policies-and-cni) >> endobj 277 0 obj << /Type /Annot /Subtype /Link -/Rect [ 76.423228 538.070079 504.679134 505.370079 ] +/Rect [ 99.673228 422.870079 498.679134 399.470079 ] /BS << /W 0 >> -/Dest (secrets-management) +/Dest (ensure-that-the-cni-in-use-supports-network-policies-manual) >> endobj 278 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.070980 530.120079 496.429134 515.120079 ] +/Rect [ 477.090267 417.470079 491.179134 402.470079 ] /BS << /W 0 >> -/Dest (secrets-management) +/Dest (ensure-that-the-cni-in-use-supports-network-policies-manual) >> endobj 279 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 505.370079 498.679134 474.170079 ] +/Rect [ 99.673228 383.270079 498.679134 359.870079 ] /BS << /W 0 >> -/Dest (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) +/Dest (ensure-that-all-namespaces-have-network-policies-defined-automated) >> endobj 280 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 483.170079 491.179134 468.170079 ] +/Rect [ 477.090267 362.870079 491.179134 347.870079 ] /BS << /W 0 >> -/Dest (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) +/Dest (ensure-that-all-namespaces-have-network-policies-defined-automated) >> endobj 281 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 480.170079 498.679134 448.970079 ] +/Rect [ 76.423228 343.670079 504.679134 310.970079 ] /BS << /W 0 >> -/Dest (consider-external-secret-storage-manual) +/Dest (secrets-management) >> endobj 282 0 obj << /Type /Annot /Subtype /Link -/Rect [ 446.105892 472.970079 464.892513 457.970079 ] +/Rect [ 479.138851 335.720079 496.429134 320.720079 ] /BS << /W 0 >> -/Dest (consider-external-secret-storage-manual) +/Dest (secrets-management) >> endobj 283 0 obj << /Type /Annot /Subtype /Link -/Rect [ 76.423228 436.970079 504.679134 404.270079 ] +/Rect [ 99.673228 292.970079 498.679134 269.570079 ] /BS << /W 0 >> -/Dest (extensible-admission-control) +/Dest (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) >> endobj 284 0 obj << /Type /Annot /Subtype /Link -/Rect [ 479.138851 429.020079 496.429134 414.020079 ] +/Rect [ 477.090267 272.570079 491.179134 257.570079 ] /BS << /W 0 >> -/Dest (extensible-admission-control) +/Dest (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) >> endobj 285 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 404.270079 498.679134 373.070079 ] +/Rect [ 99.673228 253.370079 498.679134 229.970079 ] /BS << /W 0 >> -/Dest (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) +/Dest (consider-external-secret-storage-manual) >> endobj 286 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 382.070079 491.179134 367.070079 ] +/Rect [ 477.090267 247.970079 491.179134 232.970079 ] /BS << /W 0 >> -/Dest (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) +/Dest (consider-external-secret-storage-manual) >> endobj 287 0 obj << /Type /Annot /Subtype /Link -/Rect [ 76.423228 361.070079 504.679134 328.370079 ] +/Rect [ 76.423228 213.770079 504.679134 181.070079 ] /BS << /W 0 >> -/Dest (general-policies) +/Dest (extensible-admission-control) >> endobj 288 0 obj << /Type /Annot /Subtype /Link -/Rect [ 478.118587 353.120079 496.429134 338.120079 ] +/Rect [ 478.118587 205.820079 496.429134 190.820079 ] /BS << /W 0 >> -/Dest (general-policies) +/Dest (extensible-admission-control) >> endobj 289 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 328.370079 498.679134 297.170079 ] +/Rect [ 99.673228 163.070079 498.679134 139.670079 ] /BS << /W 0 >> -/Dest (create-administrative-boundaries-between-resources-using-namespaces-manual) +/Dest (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) >> endobj 290 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 306.170079 491.179134 291.170079 ] +/Rect [ 477.090267 142.670079 491.179134 127.670079 ] /BS << /W 0 >> -/Dest (create-administrative-boundaries-between-resources-using-namespaces-manual) +/Dest (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) >> endobj 291 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 95.173228 303.170079 498.679134 271.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) +/Filter /FlateDecode +/Length 2228 >> +stream +xZMDWDQv}K==P/*eIwv̨SO\_TfKL%E?/5)XiA>7&4ņ8lbn~7%e_ '73M) jʀS@؃{Pd.&`"n +]R^Ik, +AG0 "o1\*Dv;pc~a5֋8<4?0?nW$jtk~86eJ0ҡϼ`_Zbn$+yw7NO9?ytܬex|NG8ڭJt|N|:>]HaKNǁj'!3o64(hq Mѳs'4 &33}(ڼMPIx MLbyMH9b>q3]3}Pz*h.tS V ghbr9\r6M6Nc&݉yyYc&݉yQ<;1r;1OK2N;bw'uU@5ڔδvvK<s/&/%JlԅUM_|_ kӇ| _羚H‰($!@jP$W[ SEogE R/W駊-5:ӇR^S9k=a7w Bؿ+m\ufՃrS»d2'{PH]ؕȫ"!^Sܺ*єqcۜ57 i^РmʳT~M. 8OעS%mj6<Õ,~5zXe#3$Z-w}mm՞iMw]wRc^A[]˩]n2޼b6`{աt]*ye_ѱ9*w]-)~/3x.}__z+LQᖗ^(%#7xKק۬f]wbCWqبŽpOs\_v !]n0QkT3ڝ[CTLjMݛz㎦K-!lrR%6TZ]Yzhq GezJW+&-ޮx3sT_a͵ ޺>^]~ +>(ҦK0OjiR# i?&bF4|cj{'^kbzrPՠӯ=S#X+3`ksq +?` +L}zY9<ͭyT~|{ޭ09!d(*@X  Ļ087`´(RAQ]rL$]CA0d))!^tce֞)y ]ah: JB–PgfR!XǗ[8VmVq;pj)0j ztَxhl*JM׿k.Q"0=Bjn +5ƣTdi*sՇÉw +Xl*)<V))[$%#R qʗ < ,, + |v^4,bQ|ĴhZ w2D. %m^CAqDUnGagJ + +rWaP(KO2\(̧flHYrh=7YQ%[:&@3Xf5k@j!b׮pU6ݸ6Y3VH<6=heρ^r vA/UT +10n縹8yS1Z Uh:AB=cQH 2&46K[q>RbiK1b^;ʗw<閜4@AsRz|E=[P?(c{~+wY-ELvU>&wOЏ6G!F!9tsNj-}Vg#Os~X?-A&x…n7ƴb4|u0GP) ${펾^,L +endstream endobj 292 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 472.392513 280.970079 491.179134 265.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 291 0 R +/Resources 4 0 R +/Annots [ 293 0 R 294 0 R 295 0 R 296 0 R 297 0 R 298 0 R 299 0 R 300 0 R 301 0 R 302 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 293 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 277.970079 498.679134 246.770079 ] +/Rect [ 76.423228 790.370079 504.679134 757.670079 ] /BS << /W 0 >> -/Dest (apply-security-context-to-your-pods-and-containers-manual) +/Dest (general-policies) >> endobj 294 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 255.770079 491.179134 240.770079 ] +/Rect [ 478.131038 782.420079 496.429134 767.420079 ] /BS << /W 0 >> -/Dest (apply-security-context-to-your-pods-and-containers-manual) +/Dest (general-policies) >> endobj 295 0 obj << /Type /Annot /Subtype /Link -/Rect [ 95.173228 252.770079 498.679134 221.570079 ] +/Rect [ 99.673228 739.670079 498.679134 716.270079 ] /BS << /W 0 >> -/Dest (the-default-namespace-should-not-be-used-automated) +/Dest (create-administrative-boundaries-between-resources-using-namespaces-manual) >> endobj 296 0 obj << /Type /Annot /Subtype /Link -/Rect [ 472.392513 230.570079 491.179134 215.570079 ] +/Rect [ 477.090267 719.270079 491.179134 704.270079 ] /BS << /W 0 >> -/Dest (the-default-namespace-should-not-be-used-automated) +/Dest (create-administrative-boundaries-between-resources-using-namespaces-manual) >> endobj 297 0 obj << -/Filter /FlateDecode -/Length 4730 +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 700.070079 498.679134 676.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) >> -stream -x\[H}_1H"@BJ"!@<$@J<9m3.WUէcw%r ||ᤦ#-E?.zC9ǟg3?SL1*OX,-ay?h| 'L1gƂ>:5\N3&VEm 5LԎ>VC((!<3z -)Ly< Y;׌O砋J3.^;8"bU]L"t1N&]] -J3^9Ӟg|V1֓GlZÊB$<]򠋷0.8mLVSVUV3.DGyg`tQ10 - -.1 01N.@$;Cb L 92Jg4w!aRt1,`kqa:D  u*kx ,j*kSp , X`v2,],ȰuaZ ܵN+k-Τ<fXtNaZ"22 q V&bX&)ǰwMD -8a Zk<27pxe8q&0,@LE. r` ߃g, 3Y@IxNpIGX[Xy!dDex.31,OȨajLx]mbX<äQ0,@~BR^TNa dI% ':aA"g pW9=]l2 P׀eK4I wT pM!I *0,M9 dJ> =Â@,ʃ..:(lsbX t0,d`X`7@ 8JalJ9`U fJpMy <&bͰ{)a3,O\bX5ӎaAKaRє *sE6TiͰ jaA2 ̠ Cc/ S3Se$R*2,2NHIy0)mϰl6͡ω +}P`?]-F0'_<- 燍HlDž!%`?Q-ŨgKn_X:<9qa7.9-F=3?Trce:<9qaHeo^r\>voǾhӑVE>/)LKLŽ^xAH:0wª'%IɐCfzc>\Qzk-HI w#}7?.|_R 8,^ȯ ;__,cp[t!9qb2mxu}o_s/T)~E)[z}^RRCyzUq>Zug9}ZsZ>c~XqYu_ZZKszp;Ϗ+c2-/ 8l˯n*/Lg }ZdKKX;1nD$hZ7 f3ܯ9r.g(q/ޗ96/O_li -j^~BUVZ~&sR-!aA4nhF֫v(4-s6׬X1LsD YE؇-WO2ޯ9:Q{u{fz ˘k_DD|qnik7a]՗.O9ݾ:ȜgW?W ~C Wl P|qC'^>Vs~sUVET݊b/59Uc5$f枘ڮ~>TόvW{Tiv> %6gV;ľc-ROrwW>sϭŊyMLUͼշƭo12&xbQݏXmӼ>YvŢVtn3{I}pnyg;0TG?!՟n?X.9;ev:N^^NɽAEzfo{(-zr9Dlx+1:aǔCYn'q?xz+ﹸv+g[Ο{{D߾9 ԝ ѵ|^uw>s[y;gzq>fO_mdw}$Țl+q̬OA+9J, [o콩d%qWu׉a*Ou>u]_s63`ڨ׃:?ё^k/<KWgVcݻZ;և3S~֏ɚs0N4yr^h:Of郔⁘4[és4G]>/4v^Nߖ>dʏfS~&rRnaP;_?ӟ{+6' ɰA9ζ<|Xw`zAlVyjkM7WL0E{s.;+b|YYus".RwmmzϫNniI.JojDk;Кe]EHa,TmNQLWf.ļ;G/fw֨%ۣudƿS]U=^~k/7>$8zb^!ϼO[[֘J'{Цs%㵍;9Wiu۪&$I(TŶ7mfEU}w~t^u^+9osA[W/p"2M..aQ#ңXo/) lb~g[M[ۣs0?s($UmʋMc>ܓNW7ٰ|un?QTyKyy8X/Ig7]1L=S#dzׯr5*r҈ؼX_[ׯٔ}=<%Td焗 " zO.W^~]BSŇ3]c~MJ:ٸ.oh TuG [+(UQպ@JBܨlqOt9;UE;8L5\8BUomTjJu mJb([Phhy׮:ב!n\I݆lZmeb+dꛞC۟20֤jU(0u),D )\gĉ8Bq(.f% EN–kQFCyY)Y!(<̓>D駗כ -(*mbS{c.n&ˊg[ӗF/-p cTPS?mE] hҚXu -i,Rl5E]ZK4#z镰[֌ת% - /9٩>ՒЂW^19kU]\W0mUOˊN1\}/o}/ş!c*wkRJШt?bx -endstream endobj 298 0 obj << -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 297 0 R -/Resources 4 0 R -/Annots [ 299 0 R 300 0 R 301 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 679.670079 491.179134 664.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) >> endobj 299 0 obj << /Type /Annot /Subtype /Link -/Rect [ 84.259843 735.770079 409.271317 720.770079 ] +/Rect [ 99.673228 660.470079 498.679134 637.070079 ] +/BS << +/W 0 +>> +/Dest (apply-security-context-to-your-pods-and-containers-manual) +>> +endobj +300 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 655.070079 491.179134 640.070079 ] +/BS << +/W 0 +>> +/Dest (apply-security-context-to-your-pods-and-containers-manual) +>> +endobj +301 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 620.870079 498.679134 597.470079 ] +/BS << +/W 0 +>> +/Dest (the-default-namespace-should-not-be-used-automated) +>> +endobj +302 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 615.470079 491.179134 600.470079 ] +/BS << +/W 0 +>> +/Dest (the-default-namespace-should-not-be-used-automated) +>> +endobj +303 0 obj +<< +/Filter /FlateDecode +/Length 4728 +>> +stream +x\ێȍ}ϯg 0; czS6j3'$EC:RfVۅJ!A2RAR]o/?]¿yp0oW\!Bqٛ9_/}5Shrv)F +%,)XPGgܞ3p$JPú힕1G +zhA5`xFO!e)/aStVƳƔj5eu[e5ybLt]|&@q LK.10)O.F`d?#4xF3 +xX ]V.Ak 0,gXC0,[fX`NpbX`6ǰrJaZ`' r ,P`Xu)0,]bXLʃ.`@d8*2,p],#ð^abe2))kr pDʋ֠eXc +,swWagQB`jxஶԌ&+3,@8LI+.Ix.`0,@TP^HaxRC.{fX[˰ wCCy&ðu xXdMXR0pWixJ̰ wKdXb!İ +N Âܔc BV䣼03, +ȢsF9;;FG~v\fv\{g'ⵔ츰\-D|\=x+Y.qaqޠX3;.$sK}=x9Yfqaqޠ#X3;.$K}<>xo~~\{\7hū{<̎ ;{&ؿ|<՞ tڤϗ~~?\O_+e~oJr +z>ïo^hG2y&+e:s?,3&-r܏x֯vvz[?{s0r:AOmyY{jWC׹_giQ +oVfr׻#67_~Y2V^i9eXm🿽|u 0Vc*mEC {S}qϪ*W[Qe&9Gitf~?2ߣ ?AhrWTz"qkFζ*bv1B|vnb#{zݝwV٧xC]1l)㋽jgrɆbTbYg~{N5ĝ_mr^'>VZd[ܛ}N:;QAڨד:?ё^ko<KWgVcݻZ;և3S.ɚknKq^hV-/νw>y|[<)Ë +pI]Ǐvm~wdd\g[Xw`zޝlVyjkM7Wh v{}ony`gV;˗:+rnNZdYM4Pp@yuS"Yi->v߅_QC m\YUD(D&iIb`WULLq;kTxѺ2?)®j/AkNOlgrקʭ-nk̈JʉNxrڽbkhӹƉIúmUy{ڤUb[ӛkmjwvsjlnEVyՐfFmO"ze1"kl*LyCNMP6hf]Ƕ*?6`[WNJ2k +^AoMn!w;T{Y^O"l7Wϟ43Gތ5_SjvP{vGC綟.a*_gS);oC'enҳa-q?QTyLyV9q_섚\*ӳd|M9ʗ„3ޓդWryQZz*>TAUD%.U}tyF3]Ħ4cM<#.R_)ESiV(ב!nBhg6ekrGH JSJ\-UnS3<ijQeǑUqcvۥ<#^|$} +kIr9/S5fWZg] ~/Rf#FP1 hXa.cYi/_@ndsUT[5rj\'ʯRE׋-7vJrl-M&W|%^jٮ_LbN0:jmTCY?E2˜ܑ VW*Kcow-%4l2Vؖ '`uc}Ǎx{ƕDm(ȦVXƟo+B潾 {9ur-oKZomp:|"qT3DH8]A"E']a˵ā(#ʡ<Ӭ]i,VHNˋA׻ +(*mbS "q9l9^A]BMk϶"/^Z@ƨ~:ˋJ.ZE T5ӪY'jjN^iF+a7ȭUK@^sS}d%yv>VnvͶW1  2U4&{ڡT6̝[* qݍ%y^ɾ#R{%JpUQWs^BT};?-+: p-kCƲU,춥MMQ4]\om?  +endstream +endobj +304 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 303 0 R +/Resources 4 0 R +/Annots [ 305 0 R 306 0 R 307 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +305 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 740.570079 409.271317 725.570079 ] /BS << /W 0 >> @@ -3397,11 +3483,11 @@ endobj >> >> endobj -300 0 obj +306 0 obj << /Type /Annot /Subtype /Link -/Rect [ 351.653153 212.024079 461.230790 197.024079 ] +/Rect [ 351.653153 216.824079 461.230790 201.824079 ] /BS << /W 0 >> @@ -3412,11 +3498,11 @@ endobj >> >> endobj -301 0 obj +307 0 obj << /Type /Annot /Subtype /Link -/Rect [ 84.259843 197.024079 165.615800 182.024079 ] +/Rect [ 84.259843 201.824079 165.615800 186.824079 ] /BS << /W 0 >> @@ -3427,42 +3513,41 @@ endobj >> >> endobj -302 0 obj +308 0 obj << /Filter /FlateDecode -/Length 3488 +/Length 3515 >> stream -x[K$ ˒H@ N $ Núc# ?%ŞY/>d3"H# gϧ*Wk+ϗw'J{ -?%Rh;!PqXz¯~=}?1]k9t\dX>JɕS6X98l51RGVjXcB j# b +x[K$ ׯ˒H@b NnzsǪbϬ2i*ȏT.ߟ\d\-JZ{++t K.@ŕbɗۂ_wM|3]k9t񭰘\dX>JɕS6X98,51RgVjXcB j# b rɃ e(=[\-6W %Z<" ,^s9T-C|x -daeBɃ,xDh -Y]A}x\j5|-ȋ>T %&<()!K<ȒGGxDVF9)XYb,l o!@̐ŗlAN\0 E@ Vr\Z(ks\ -Y0[r[p|/ CB -qrMdP,`adLЖ-} }bz K5ȅ+5 KN ^,, .-, .qp8x K&-,:: -,,`._,,`.QVula|Z ܍ճ ܍!3H0p7&lݘ|c?dka=x,,d."- wCC34ʅڲ *g 7-B‚E" pY-,;DhaABx w7$ . 5yV X -;_$&88R`YX),pXw/‚ ܕiaA.BG reJCgC;YXP< e kԪ%B‚! R }dCd\mQA/GW UBvR[Xw.YX1 laAiG"W#2s l 5BdXQefoa"4jIⱗ:ZXP9;I-,1A 4y0aa#vM9&Pb jRnV j,G Ro ,,,h>;I-,罅-Tԛ-,zZXȣDgFYbaAcȒ<Ȃzd2d-,h9KY-,@zy%P,up75 "3zU{o*lf7Л[+E*杁Jd^@LT5`o^x/1>`I_QeCA̬E6p,9V7zv? ~S6>N{a{;!%rrv)hYvO9go*@ͣꂝ=]NW+ƚGo%^~ -:#鼧#a\;jsǥtݫl}_N3M.t20cļ-:S4@epW{W@{W`zC|\!!O=rPˈp鳯_o -?y?n/E$vi3`on?ܝ\9 z;nomͱ~Ztkn~6[4{__=gNUydM7T"'-C,GSR佉\2T똷lH6n*S|e˩:Rk.p'[0ek\D\cG7]f5{Ywk}VtvL~klGGt=u1f%8{9>)+o}>;m[K~1x} anNr!mnv*O[~9}wyeCC]?MOě7ƌm|_L>˹jٲ|7^\n=onu>0a \,|6qyb.=fB9ݶgl|p:=mI!L{K98w&o#,E<4SCAU ?bcX}爒:H (Q}n!/:_[,y |4)p6<ڤ|wXzol͈X.d|`|oĂi휩bww1J9e_=waohnJSVq }рDulHvy*B*vy{_Y:r^;3(`0+m^a=JncӠ(B$,sNJp[}ZAHlM<"RXoa؂C Vіn+1Iz. {Hc?">Wv$v䨞8 3p~0~^ր<1?[[Գa7 Sc;R6'u,63RBn'9MWK4js9"牝WM.AOyߓXdn-K0"/v8u2+^N?zCbd -β -?>-#lj;djr@<(bdꛆ78k^3L iPtHi&=Ciq&26+`ߚJ^lMA.|VS%]WHM`[ԋLՋMAj4Bx¬z.TzbzѶo&r'@'scBgS79c1М٣䬣R 5*j]öI/ʃ[t A3!Sކ WSKetVJL*WofK4ݹsՠe=zRyA;G=m$ԯacΎyn~zCHO|n᪮F~J7"Ds8&%"\h/3Ta͛[u -xbp%e"qI[g%᲻:)[ +Y`]A}x\j5|-̋>T %&!Kl!\Y! :XX@Y"eXe߂eRlaraJ݋ԥ%oawɃ,0` B% K  7`W0[X[qVoawclawcA0yƄ%X0p7rPǛpt`-,@/E%$nhO\-[XbL^s@B.,,H]* w`CD$n Dj y pyC \0]לoZXhaHb! # wޛiɃ,Tk>dx]}id஄M rB@@,8ZX+VJ 7R>‚AH,YH]V-,(PY2XX, Ŭ SHjcz Zx9Z&C(rNoaIda/AEFd/@$ / j,-,DhԒPc/ufrv*ZX7A 4y0aaGda(sLdܬ +Y6,4YYX|v&[X{ Z7#[XzZXȣDgm,f1dIHQLdA &:Y Ybc ZRoV fDFo T7y\M dLhDfk +3Y扁&V{yfR#e*|O># s("܂ݏcvݶ_>{{'IYuM 6)ߥ%(.r,U{3SvNFW3[ɧWEH:Hg1Nd8uNz5Ҕ qeMv#HeE^lois~)4@`0@L=|F2gSPty>le +)) ǻT%cnj)(XQi.+qI;zAQdq(eDG8xn?_?- +7oSOi3ҿFO;F_ ׽Oy; c6ZIh{˰.f?ls#抠Ss}헷dUNEɞ６uy}6OQPWSmhr纵X2|-"풱Ze(9Fl}aS9xCGxN-񨗾UN5#5iwzw}w汎]ϻ.,qϽۇg~?gG'g;_gwX>F>Zĺbקrar|w9RV:v}}. }-?tϷ{uw{k]~caLr!mnv>&UU?-A0B;vOS}U`|͛]c+{}wW;þO\L5lwxys9JnHa^yDŽ  xlrK=\=fB9}ͬ=yk8OB-h͹ly!w(nLU  w;>[qMO)WM)wgezkr 3*7y3q +F@QK@bqj"~i(i~,VM)۰`Ur}߃$&hR9B~]ɶ˰!z=e\ݵm~:շB@4L0 غ_zo Qޏd lʵ qVņ˃'׷ +ߏ^^={-Do .w]_ ++ޘ"/AfYG?0ܩӮKŶ%hT꫑SLُWoD<Ù,Gb]u%.3s@}Ɂ"3ѫ&9rGj=BUAiz3:OkR j=dž't] ⧾W&vCѯ~麘ة2zh뚟LS:oЮ*.ySXHβ}}UvOxx$ߖTibO4Ը\I- +ir$7H*ȳ~_ _H8@8@֑L^pH;q"FV?ɡξ[È1*{ap51M*rBi&=Ciq$2tofޚijH^uh-:C:ՃhAT)AL1H=Pz+HR FH&gCwں +)01hu@4u,Ll*|lCitc=ItZmTQ|liI{p1b2uR9Ť5 %&+WodK4͹sՠeIvsh{Q)HSϏ¿տדP[E +EZQל!,hg?YD虰| /70 5Tw@%<<|=˾bq fRQŋ$fzz 'j endstream endobj -303 0 obj +309 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 302 0 R +/Contents 308 0 R /Resources 4 0 R -/Annots [ 304 0 R 305 0 R ] +/Annots [ 310 0 R 311 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -304 0 obj +310 0 obj << /Type /Annot /Subtype /Link @@ -3477,7 +3562,7 @@ endobj >> >> endobj -305 0 obj +311 0 obj << /Type /Annot /Subtype /Link @@ -3492,144 +3577,52 @@ endobj >> >> endobj -306 0 obj -<< -/Filter /FlateDecode -/Length 3569 ->> -stream -x\M$ 賁%  I`]Aouy.I*xfv=S"UETT*Wjm%]Isq)\R,|=׮_OqpC:VXLR|2X ,`J)ؚłp#@ n5Y,1VU!q td5K`1BK`9BAL2-^ .+-˅C -s!Kj>XYR`0b2dLAX YY" ^,j >XF.lxzE\DlL< -%LdI#xDV[x7y -/A <Ȃɷ fK , 8n-W -B ĖV, %qdaxɃ,,, ,2ܲo޲BLoaqf0fas iatRlawDA@GG ܥ ܅E 0v-,Xz dawc ܍G 9f `(l Iv:Y ރ4" p74?çV.Ԗ-,HP1}&Pqoern$.YXja0!F p7"ؼ !YXsp o.xkηZ-,H]RQ -$1yc瑇ZX‚ ‚ A5m F|RX<a4 2pW¦!V C-,ȕ]+%[X)daA $@Ƀ,\$֮QY(F J,H,,@FZ@m. \0dAhalaAI1hj\ -^(8XXpz N% x-,( U,,@(r5"3x ɶ.x!XXP#dA6haA-,@ZxeY-,MR<#da?Xlbc %(jaA%halS֛‚! 2> Nd yoaA /eY-,hFY֛‚Ɛ%!E1yIS3&erfi֛GU֛|\M dL(`Z{o*lfg5x@oBl5x`/U1ẋ+˚ͧ`o>6_c|'* -bf-2`dc1n~O9byR68)`f -ymV+L^BRCnX օC^k+F X)ͺ;M$ϑ\uzv5crA1 P)kt/8peis5v12z,[_x5y1Y5bP A-YϽ.č Mֆ4YS]bPm*'<4QP6mhPgWS;~//x|0Pv1Cd)ݿ8ߋ}fΗ_9/|Z`5be8ߋ8#tǥw88gxO9o^ ٲ;| yy~߿_-֏ߝ q2>XrߴP/E<>ѧtք&s kKF[Ekщ뾠W#β@6JׯW^wꍿHH+;Z/|xYn<شֿ)v|> /*-M{VZZ^ 9ǩNɇ6\T5[!޲n0m㱝L^6N۵Yb>ik+w.y}ڮd#Q }m/2UjZѦU~\UJ7EV0`s:/FYk+ssYbW^V(!:ODR!iiy:u<R:86Cnm全^&,}wwtɫ]~\MǴύM͠beÑɻr$K/\kniM^5pl5'v>ҖYb>OCml۬a頍OzX'uv'֕Xcݱ;YcNc!MGWOۘ}U.}c_%f+GXDkybUm{cձU-ֻXulU7ĪOZ>wzݨ`h9M}@[ޏHyu&8>sdǭvCq]y0H} -m54k%BƯ.ۧ͌w&ѯSf.nJTᔗa9}aq!sf9t>MaQl8qR/G%LShro˙dkIL:dfHzG[zAw߻_/hRFO69+Wec;s8eޅ,()wA ;7*9Wt$z$G96T'qUX,/'tK{դiTnFJ6c l8_4c2_͚ɺk7$Zg.'Z3UF:om]SiT ڢZE%G<-Yr1׾*xx$/b -i"vi/ZjW\DAETA"0)96KA*I@4̺J]aZ_z=4*)zi]<[rV7a]?+5w!$a yʙ{g9(sOI;\ƌ9b8*xOӯI~Dٙ"N --a.RMLR: -η-8@8uC֑LޯRH}P8F#+؟Pgԭa^O`5@09Ӎf=N#عV!Rb> -endobj -308 0 obj -<< -/Filter /FlateDecode -/Length 3349 ->> -stream -xK)l@4U|r$P i,VzvZ̪Y&_=Kg'_EȕRsɻ=m5vM %H5x~.r:?릸V8s\)PX,p7HH (jB-{[,@c.`Yb T9 Z9*5Y,. 2W մi eb:łT՜łT=tXP YHXXʵX,p r-X2X,U?؂̕*b DŽjRp%צ@GbA␊bR`[,., H, -[0U, 2t[ȶX.tD J-X Z,(`dh%jK'^bAth;M`bG7b6?lbc` GXPJfXP -l >X,@l~3[,`gtl{ -A,`^~X,Ϙ7ł*%bb` M՘`K%TXPSfXeXћ7y܍dt.Vb -obek=3g莳w <[[E=ɼi3,ɼk -%yw[T ᐑ3K֋sjH_~<}O]?XFy?}ZTjuFokJ{iqxӾژTzDkVics]6^ڬr!w|[Tkł)GL"q_>֮ˤeTo|4;M-VLbͱ^vv[rg uɪꭷV_Lόկ2-=ߝ4:2erstrı/#8c~r8uE/Boh:_ o5^zdɅϐ|sxOLǶ?df鷔/|+g,Tg_gJ3 c;_9c~2mcٟ2~sesy!o_{ZvGkwv0x+~IɷѬ~*jd T2б/̍t;>9?u߮?\eG ?)͝e 7t[xϢtgi㻾ͷ{+RYVCnۇ V!;%7 \hK~7}~һ߽{gλs`ӳmzh-oOA%|9_~~*jܾ'jU~]@o :Y f}^WSkߊyG{ ܷyc5Un{?[-ogL\Zŗ5)mOLԬOQjI8Գ>U< aͱt~eV{?#奥_xs*.uoM\B/LI%C,{UhKWˉ&Gas!c?M+˵cC3zQ8q+ap6(kCHFHӤ4;ѹ9{'4#H򬻸r17+tGᱝtq"ϵ؋iD+º+WF)#vigS;K{Nq|Xy8]x܊5KdnvaO>l>[u~8'q/N[ CAb7]U:OIV^xau'^3YSIv60Ȃ)2 #Z~פAPUq;ˍBSf&k:>ۭBaLILJXNDamť:-ۙv2\:}-eE:ivm˶X` kamXh1LN}t}HV0Rފi_9ZwzhșSc.-dWXctyZNvD1pb6vZwvRk)it\Ge81uݞj(Ys%!KC*&wٱoݳy 2xQs=殃UlwB̗2/)!f)˭>~d gҿbE}biK0m_!4Y!XE_h͞CvO( -endstream -endobj -309 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 308 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -310 0 obj -<< -/Filter /FlateDecode -/Length 3764 ->> -stream -x\ێ}gIV~0`$1NiyT7o];;]! --VrX,*r?L%E>_ޟ>IRcSX?o -gg9J^L*x?]q~Wn۸7Dwb2)d*PYG*QQEg0R4`Ğ\rTgE89: -`XS+!)*gykUXfa31_T]%LLtCt ,Xl50"P$D.uʪXlN2dfUW9`B&9갣H1):,ц%RnɒtXO1bS(;/iS2\Xqw=qŀ wA!AOq=t4.@g#-Ѹ w]AS4ʸ\2O,[Xٸ@E.3k\7^uHqA"oCqqꊱ%g x5.@66IT]2p$qXD.{Ѹ wm Ҹ w-#QuBk\:l[eO#Y5փ)4x:Z+aS゘Dh{ bfSRbCʧA9h\,ꀅk\*Y䁅׸ y`Aʠq2Sox,p|LQ0ɅY"cVu:4.H BӸg)5.I4. k\ -`h\PdGf ָ.ti\= Ը Sf B, Sk:rdFRE MpS:`Mh\vи6qQuB5.q3k\3x5.oy3i\P, Ӹh$Mָ4qq7,Λ8)PfҸ0(X4e߂p;i,%F9of f༉^rLux70"3&2[loA!!?ӕYNY1ހت^Xp/UR ,WH`dzk -굁"'OU;$̜dۂ3ǨFT[~O:}ܔ'rE|r〉\K&!с땛@D F-m vHey<,  EQEM^0/«F͋[uV楰Rd2,T_jh%NP?K 8#EK<$ayS'PS~EGFe_bwem߼r;ί28K|CEoA%kRTuP*rr_$ؖ@m{1xN2C>;-:f!fQ"/w;GCbӻu߽G.mk_8C8s8A[ږi-]"DZw;m[Ρ]QemGlK-eܶM媍psfi7YF"ʬɍm|L-]vr(,rC@ _TFy4yp֟S _ߑ {f@1rx{_6uAYn[-lW=-,s@y6Տ_̳GoFv氝jR-(YP<0tkL+a.K)pN)\\F\H!N=}Ip^92rwN+d2Nv]5mCr3{wu}㪭--Xhcw.sjmwaZx9TFqvfZTl9<a![襎I/s ;ixN)~ysx.£<_zi8d-eā}=i8T 31}6=0<* Pw˫x-F;=Կ -y#|mj c]{Ϟ $iwڲ/kejW8bPf_Ni9,n#O%\{3e;mo8,GH8/M4-5ai/WZTY. TjNrRl뚱]?<\ -ss$J.'^-JVMK2\r7"[lTI޸q+͓r -wߟBRj64כ4Ҕ5L͕W]*̳|p]J1.i:Yqu'sr*t{nt2$Ou],ӹr q|oU7&w!;gq+];|^{~n =ڍ&RANw86q/OK=kqo;[έE|X^o¾m&Q74oq\K;4[Mu, Æw&˄+Ί=yڌi\Gx*領FH>O]$UGHw@S@)9M/y^ -”FHGneS4̓ ׳׽BmS{>1vӥc6PG=[c)>:IhV+yPn͠-Pt6Y15L6kfYfU+S ϳü*݈a^x+׳% P9QYŹuIMvch{H¡){gmuj&v5Dp!,L'G~Wriw%HXD69tPSWUқN knG-w ^LrT*$Wޖ?DP -endstream -endobj -311 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 310 0 R -/Resources 4 0 R -/Annots [ 312 0 R 313 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj 312 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 797.673057 101.433071 778.923057 ] -/BS << -/W 0 ->> -/Dest (cb1-1) +/Filter /FlateDecode +/Length 3610 >> +stream +x\M$ s% l drXwm9籺$88ǽ(|j*=~^S9Z[|?}8yWK" >%Rh{R,|=ݡn~=}ӿst"br!j@(%WJL0,H#EjpA  +5KAX["Z*(x xf,$albpLY,hɈ\.RdSd ]R%dЅK e ZȒaf*twUS]|5rUfS ԣ,R%,dQX\ Y.٧fʠK"-AƏ%O$*%Sd XؔA,1C_E 'dq@,ql@rX h 8bY . #rMtP.h`qtLؖ-} }jz K5ʅ+5 KN p/XRhf K %™ -.;: +,.`._,.`.(Z\Uulq|Z ލճ ލ)$ `ennL>Z\1[\GqoV]PHH3QX\!1 rlqA3eͅq +s w}V 5Z\-x7-.H]  (,.@~suMYsjqAW0)+,.;: EzodODdg= P ak4U#’w} +[2Y\6-.EX-.Up WvlqAn2|,;' @Y pa PXFZ\P"t-.(dkշ=.ps`2W%e`UKtm*dX\P +;`qR"-.;),.4PՈܒ"T`qAՠ5V2{Iڒ}frvR*Z\0NLiʠ hl`m).Zl7BMo .,.h>;)-.C-T7#[\f~[<#neo CŔAM͈[p`'KKllqAYo7/ Torx750%2MTރxSA}f 8yzry{y|ed^4Yl^5@Z0x'ܮ>KTP3kI6{ٌhv>/ +eG|#Iڱaߟ`lQf_WT;@ӽ-5^N +ƶc[j8ԵM5_O,`GSmpL +CMXB}LkT +Қ ~q"kY\^D qİ]k,,^"WeG=_eu /.Xl*" eЄ>qTM[pAC|NyiPP6}hssi˾U"WJu|b:c퀼36vS ̂/| +kCl<%^%|f=# _%>{xy͖jc˟E.i_?}͟w|}`|2>r.E` ?ϯcLSvjBkːv2dm߭۰ }A!ʎ8 1f;nڵГՓWKuOѥ7k}׶rߗMr3|ڦlZ[&ﭷ+>‚`bޯ#,-lцwVQ}qJr~𛛬ja6Vn%yeeh^M76mp0bN7U~2%y؏nEՓVi]9_#f9mBs{966NZquێ;ւnLkĉD*++g(sum.;[[z譎o~yo~"O';ˤlj0Sӷ߭=Uu#:n쨸߶e>زLi߾V]zNdZ /sβ,Ϻ?OɄ/+ƽGo~iZ=$G8j+~[ ̯ y|(ͱ;ߤKyjIto$$&?ozwٲd_9XYvz氷֧̓9V[E˒x>ȄnHa“F ܣuAfeӒ"e +~ +]e[|u ˷<`8uL&o3FaȊ'l7<kIe TiPqn ,/;+Bcf&!aGiV8a2)đ4)RDNqlSzazџRT!4e<Ӭc,Ttm}U9tP@tr#YzN H"g,-xs}Tu6HzPfО(]=S^OfYf\M+QSL'mWe1UɇoxZQ%eϖْ:vcl{VHC'Sb| j+!W Qs(iy+9CX^SK#>둰| ~O[+O)=w|h#,/x[X."[Ey#I[5TG\>Y~1g +endstream endobj 313 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 616.126036 101.433071 597.376036 ] -/BS << -/W 0 ->> -/Dest (cb2-1) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 312 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 314 0 obj << /Filter /FlateDecode -/Length 4096 +/Length 3665 >> stream -x\I$G3Ҥ33"7,2q7[ Ҙ/rx=aSOWEYU/L%E>_ޜޞI_m;I,'\9I%O'w8]?}ٛRw÷b2)d*`YG -+QaEgph,{f%%12 NYbXcA WBRXBUy2Wx.G睉x.yGdbb+&cu/@ƃ,L9iY(UyD/A! +%ų>YCH_Xdxi@@,Uy -kX@D3iX@@[hX@[iX@[.jX@\i5, . T4, `.;5, .=iX@@] -kX@]5, .0p=UdkXt42iX]r6iX]װV5èa| ٲ )@%$ .A]װ}԰b?Va=x4,`ƣ,Ѱ w]ASbhe\.QÂuSyŸ+q -cѰ wHÂ|f kX5pb5,] Aq(4,@~3uU^1aAf K4,:TÂEz/D DDe=*Pa4Uc=Bw5pT4,]I$5,Uװ f6%aA,<|*/ !Td6Jְ yBkXs:@/^ϥ~B8\B'XyJ[tv,}}'mc9n6.6m1d~l.m>|_/zH[eՖ((~!ܥ)$c?T¯ʊmEIO}*o}qxєZ/WJq%8wԂ)}<%2U$\͊dmJ{T6-QC]]z w:JGiQr=uޔ#Lq=vG([ksQ|DNu"|궹{o;tXQ'65%T.ez2n*8ujq(69 v{ty׊ē7uV:/7i[vXpzoSl:<ʝD!([>D9=GL|pr4|>-va`Rrš`K|"tϺazGCޝ6>4SMC߻ewھ'y?[XL ߍm"OLD d\eü7 Ʃ0MtV2((I;w^i\fpȘmg͐!xɄ (}7K{pAn9כ7%{Gٱ2ia@tuKmmNksp\c+{ w%_aBoc8~9ܑ7~[ZfZV"Q@k.iT2Pۨ'(+ʕ"ʑ{|===Qܥd7[ >H=""`xv_E'ߔLyFӳba,{$vGz|:R$ey]wn\BKDc]>dytq+V9eĕ2 P=m>Qg5MuOveCĶ*JWi)ǚcWʦdOw߃M?Do(SwAuO|z ؒp d!bEOMh٥fgJ^_ 6roM?_"SQ}=1!&wĸ~( +R^|_b!A\uQ,nnٟv!֎=o+H8 R]:_X7 ܃{4,%!wNG~L# 0F*G@'~8L˸</_$',U;mo'>$qoZ;.dŋNa=/?.϶{/xͳ[npWb:\~ܑ 7G!󡶙 {;ؔ'yKrHvfJ>/CLΔ.#NAqLXd;1!IE~^MA2rrJ3ͮCwZ J`ZOց٭<^l&r RDž uNz#YNzN h=E YZdхg r&bhƈ[zYR5Ť~j:VJ UU[gQ-(i^-G-Z\{*ϖis~me$n{Ď>j|]"Olc5}n\u&0MN~M r NVzI呂gUuGm$KE/7O$4O߿|5 +x\ێ}gY 0#@\B ȃ4VX\ !Y\Gqof]PH`Z\x]` И HK,.]ƚ[9*5Y\T0}:ʰnaeG)U "x-.]gQKHm w7D X\uM]ubqA0DGjqA"W xGf x S,\kò54Uҁw=a-x\-.H] P,.@,8X\s UR>S!,S,$֮r-,9 R JȾ] 2E dT rL؏.W2([\8b{)W-.;M,. H,.XT,.@(r% 3t,H-.@ % A J(e&oq"40bqA4U;M0ЄlG fS,Rn7K7 2> ONd @yoqAf .uY,.X7U%"E1u&%` U,.)~X\4Md@f6 ,xi7Z{{,,扁FV{yfAG2 ;˒SU(ɛ|Lp=}!#fX9F5|NB=gIY!8?Kҍr2_=v1(\H-n +ᶞBbLHfɦ_ls| G r=LɂXdl7zW~6_ޜ#x/{=SO8 ~{2b_=IGFzG7\Hk=^ߗ.]v`i}Ѻw෬|FZ_ֿ~\,}E&\jҟ1!i:Ty&_iuoTmkzk07Y7k[ŵNUƥ^ZS13~MV mZs?m/m8>VXþ x13ь) bY(_/3M>;"z}#[ݵ' ?.eVex^V{+_m{in#\zݲdD}feuz}][}v4[,}oftNcm_qI Y'ĶoE>9u-Ol `O$p[^=olixB3c~ՍYvD󔯿~~ qح۬k>n;I#Dc;uxumu|ˉ0{#ǽL[&#pQc5aoOgQ#Dc;)~x)m#E=~#Eѕ#yDHGFߎ~ڍQtvs7kۗ];~zcθR[I/v~ ީf z?dfW>B9հc{qz'Ǔcۍkku,~i㴙Yܼ}̿vƒ-iiϱUaV\^sɍWfGn}L1Ga%ĝ-BͶrGH0FY @*4Hi<.z}<u\>N]x9є4H;ޔ&_np}LDo8Sv%!n(׍w0އn erj'*+qjyj/gxWΦpq +Aag$,7;F* gr͕'˱1oR)O٬m-5'h3=-m9sWf}'G4(A 㹞VyOGjδ{eJ4,kf}hZxQĪq_gom/ e;7WVymo- "EoYՄgih0mNiyؒ}*F9czz}q*-+]\jk{y /ZaoObAU~-7MvA]D$AJ9\"J.ŷJ< wDG;Z*_qRS hP溣qbb? Q8HCw7]}6M׾L~)J_C|{٨W\on?eHsil2}URERe Iw)}}F'6xkY:ewf [z1VQ k[]Wc9>Y~k_ endstream endobj 315 0 obj @@ -3639,7 +3632,7 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 314 0 R /Resources 4 0 R -/Annots [ 316 0 R 317 0 R 318 0 R 319 0 R 320 0 R 321 0 R 322 0 R 323 0 R 324 0 R 325 0 R 326 0 R 327 0 R 328 0 R ] +/Annots [ 316 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> @@ -3648,188 +3641,364 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 349.923057 101.433071 331.173057 ] +/Rect [ 101.433071 205.473057 101.433071 186.723057 ] /BS << /W 0 >> -/Dest (cb3-1) +/Dest (cb1-1) >> endobj 317 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 330.976036 99.933071 312.226036 ] -/BS << -/W 0 ->> -/Dest (cb3-2) +/Filter /FlateDecode +/Length 3689 >> +stream +x[oϧ8p8A"EE$JP>?˞Ieq] p͐=>'W\)5'9_^^Rbw%H5x~.r:ߝ\gsp@ˏv죡PybC9d9tVK3b GURKT0CB( L|TU2Tc6TaM " EdTj.CG9X:fP$KW]J)K'%VO.–H"-]-؛:JfKaKw+:'KWZDL]Η\࣋[:"17aEaR6t$-}t [_K1Vk͞EBS[0B->' XANd1   +;)R, +RBNRt,-QE&"Xp` +X,`-Abb[,0x+paX .$ T ebXbSX.KI e!o@]fi` &1X . 2 + 00Y,\qo@PX,p7dS [,p7Dtn>X,p7HH 0QlBb=t-2X,.U?cMVJM "Kgꪣ ^vRX]*X]X,"jX]bDjKRbAw7DX,@|s1uM]ub RX(|IL]vHd0vył"W bAw 1uKX:,[cM#Yu>tZ,HஆM) 0!  RWsN R!3u:Z,d:"Y, vkXl,[2X,@F*!6lAh$sX,1a?Z\+QX8bX+X xł\a "W2sKGIdY,( XPB.3yKՖN3ł"ih;M`bG7b6?lbc` GXPJfXP +l >X,fXP=lAg4MXCłJ  .uY,TobgIbA:؂L~tt * jJ, f`<(q+d]db.Dfk=33[YtYFVV<3CeI*c"ӧ*a:d̒B=([~ n?[Naec󫆊R`d;hR aܣF:$`q;tS#nɰXm&$3Kd. +d[n͋mA,Z`xu~:_ܞ#x/{=SП4^.ȶ;ˈqŷs;z<5uߎVn>v^|6ײ5/[37h>sm۝ g|'q-0omZZ]/{-A_kaY-͞Ѵ-Ȗix(Jrj9r~[Dm3c j+{suO/'VDGR.>^W>6ǣS8pxy()gxӦk|JTǩX)@i[fKi_gkό[dmd>z}>Ǻ?4oLr5#6e{^Wȃkvtvߩywu, f49ͣE>])5b$88oD&/=Lt=vg^FocRՇ1 2L׾udɎC8<"W'Gcݟv(tG7~H"Dq¢}˝~~vIkk3~R͙9ˢQ[|$?8|El݉Ho7Mؗ$ 2a͆Cx-v?JR'(u,Ç8O.+/Dc3zɭsh5f. |ĕ!Z Ӎ+` 97]<mMSLG#o}g%vV2p3fM>jɾzKo{ߣZ8mB2VQk[Odo=5,_; +endstream endobj 318 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 312.029014 99.933071 293.279014 ] -/BS << -/W 0 ->> -/Dest (cb3-3) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 317 0 R +/Resources 4 0 R +/Annots [ 319 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 319 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 274.134971 99.933071 255.384971 ] +/Rect [ 101.433071 728.673057 101.433071 709.923057 ] /BS << /W 0 >> -/Dest (cb3-4) +/Dest (cb2-1) >> endobj 320 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 255.187950 99.933071 236.437950 ] -/BS << -/W 0 ->> -/Dest (cb3-5) +/Filter /FlateDecode +/Length 4631 >> +stream +x\[$m~_V+ 0!FEfڳ6yGUR:g9.R"?R*Uwev&"_o?_~XſZbsQٿ'Lp%pYL*x}\_]s[])%z*,&rJ6(uB0)VtC,EcA=+A .9h,g!qrt*' brr8oʃ sD(=j'x xh( Y`]YAxL(YlNm0!Y MRy(LRL +ChCQy% O'odiYO &_C!MQx\0dx@g29k(s1i0K0Kp; BQCr*Pa Cаx& h˰ p˶8 xE  1ĥY”%`Ѕ' K!z K%vVʃ,0` \& K&  7`V 0jX[1>gaw}aw}BPyI!h0p׳P Ǫpt`5,@ϓhx%+O%jX.cT^1.ABX4,]*Ұ wY`AD#DjuX pyCа` ߌ0]W-9kX%aH!9 "հ wދkkiʃ,k*>dXx]0km*D஄M b@@,kX3R԰  R> ɂY*pb XB%kX]y-JD@t>_?|7ç.?(s nqn`-,fZ +w,#Pk;-5:~BxVvCjnß2No/6ڭ򵲟wu6ۘP?~S3P5{y&XӿQ1O/D&lj+3-}Թ<1~,Dess DyQ"};XM#ݥvDV@dWi -['=I|*oLc̵ݦ*S bi_qAIdױ,Oi- U?S( +&/{I[廥\F~uy7kfn-0)ZoͲD-Ro7O\2Ma E%7v2F|dߙn.S/./bȓ)uEyÄzchQEuhKV=r0@{EA^Ͷk 9M璝.;+a ] 1tN&N/K-uvv،z9]mknc~Nmw2[{it:. -μ'k棱Yl|UF!.\,3yR&eu5qzTl=/?ӹ:GQw?Ьl=mY^<}mv-/='QeenwLB1B$ ˙Xİ,uc6d~x2\#ϼhvY`[F) +e9}su>:9SuOZֶYeUC'(6LkC.%w:N8S*B^)bA[D:NU8)tho~%:FI&>#]ua R9&וcSxGP{-`SpX9na'#xIv[A@zAP^ ktW$G#~Z&:˱ \3] c +Ku>DAC9k9 E_n>l^95?o>aXRPkE64V[n;}}F{У/e+8Ao15]# 8%OmgfQ+q\TZq_O%#Uq}I)Z9Jr؟p8Bsu>L OіBx=3=fc] +wh-ex2ŖX6%{C,ajp"<<I+'A|n|g=86gX̪K^=\|tKзT+ѲqFR}A˻Ǧgr[Uf+6N)O0w,f;]RI0` ^@xȁ]Wdh!W@a]|&Ǣ)2W_S1NRq, 񻖔 ]Qi{G)IV31_.>,i~򀾑&Mx[S_T5մm$TJ >O +vQ4c2;5yB͐+B]rkkTZ()w+KM>bܒ屈>6Ov ^#\BRJ64ӛ4{T9"k6> -/Dest (cb3-6) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 320 0 R +/Resources 4 0 R +/Annots [ 322 0 R 323 0 R 324 0 R 325 0 R 326 0 R 327 0 R 328 0 R 329 0 R 330 0 R 331 0 R 332 0 R 333 0 R 334 0 R 335 0 R 336 0 R 337 0 R 338 0 R 339 0 R 340 0 R 341 0 R 342 0 R 343 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 322 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 217.293907 99.933071 198.543907 ] +/Rect [ 101.433071 507.723057 101.433071 488.973057 ] /BS << /W 0 >> -/Dest (cb3-7) +/Dest (cb3-1) >> endobj 323 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 198.346885 99.933071 179.596885 ] +/Rect [ 99.933071 488.776036 99.933071 470.026036 ] /BS << /W 0 >> -/Dest (cb3-8) +/Dest (cb3-2) >> endobj 324 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 179.399864 99.933071 160.649864 ] +/Rect [ 99.933071 469.829014 99.933071 451.079014 ] /BS << /W 0 >> -/Dest (cb3-9) +/Dest (cb3-3) >> endobj 325 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 160.452842 99.933071 141.702842 ] +/Rect [ 99.933071 431.934971 99.933071 413.184971 ] /BS << /W 0 >> -/Dest (cb3-10) +/Dest (cb3-4) >> endobj 326 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 141.505821 99.933071 122.755821 ] +/Rect [ 99.933071 412.987950 99.933071 394.237950 ] /BS << /W 0 >> -/Dest (cb3-11) +/Dest (cb3-5) >> endobj 327 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 122.558799 99.933071 103.808799 ] +/Rect [ 99.933071 394.040928 99.933071 375.290928 ] /BS << /W 0 >> -/Dest (cb3-12) +/Dest (cb3-6) >> endobj 328 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 103.611778 99.933071 84.861778 ] +/Rect [ 99.933071 375.093907 99.933071 356.343907 ] +/BS << +/W 0 +>> +/Dest (cb3-7) +>> +endobj +329 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 356.146885 99.933071 337.396885 ] +/BS << +/W 0 +>> +/Dest (cb3-8) +>> +endobj +330 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 337.199864 99.933071 318.449864 ] +/BS << +/W 0 +>> +/Dest (cb3-9) +>> +endobj +331 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 318.252842 99.933071 299.502842 ] +/BS << +/W 0 +>> +/Dest (cb3-10) +>> +endobj +332 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 299.305821 99.933071 280.555821 ] +/BS << +/W 0 +>> +/Dest (cb3-11) +>> +endobj +333 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 280.358799 99.933071 261.608799 ] +/BS << +/W 0 +>> +/Dest (cb3-12) +>> +endobj +334 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 261.411778 99.933071 242.661778 ] /BS << /W 0 >> /Dest (cb3-13) >> endobj -329 0 obj +335 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 242.464756 99.933071 223.714756 ] +/BS << +/W 0 +>> +/Dest (cb3-14) +>> +endobj +336 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 223.517735 99.933071 204.767735 ] +/BS << +/W 0 +>> +/Dest (cb3-15) +>> +endobj +337 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 204.570714 99.933071 185.820714 ] +/BS << +/W 0 +>> +/Dest (cb3-16) +>> +endobj +338 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 185.623692 99.933071 166.873692 ] +/BS << +/W 0 +>> +/Dest (cb3-17) +>> +endobj +339 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 166.676671 99.933071 147.926671 ] +/BS << +/W 0 +>> +/Dest (cb3-18) +>> +endobj +340 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 147.729649 99.933071 128.979649 ] +/BS << +/W 0 +>> +/Dest (cb3-19) +>> +endobj +341 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 128.782628 99.933071 110.032628 ] +/BS << +/W 0 +>> +/Dest (cb3-20) +>> +endobj +342 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 109.835606 99.933071 91.085606 ] +/BS << +/W 0 +>> +/Dest (cb3-21) +>> +endobj +343 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 90.888585 99.933071 72.138585 ] +/BS << +/W 0 +>> +/Dest (cb3-22) +>> +endobj +344 0 obj << /Filter /FlateDecode -/Length 5150 +/Length 4927 >> stream -x]]#7r}ׯ撬`a $pb`y_{vx󐿟SG)]ͮf*VSUl6q'39鷓5)XYjl.pv οJ%J)X鏿;ϖǝ)%zEHL&lPH$H!`R!* n5Bb{R\rHP -)C hO*P' jBrz8oJ"BsDtzhޙ/*-hD&&vibb!k4.Xt j4”FЅ"Y]|Nt蝢2t* hF+dB*fs{Ld5s&`nJEabRhDJ.h]5p"PYV/MF * `55% |Jg |&Ù>)ñ$ :мӀ,t 5$ ]Ҡ ְgaw}aw} PiI[<7p5,`g5,D1F]@Hհ4O@K4,]WZK԰ w]b\B+v^6.ƢaAQ  <װ wSk4jX!а8Ҋ%g p5,66ITZ2HNC5,]aA@aAZFأҠ ea`M#X5)4p:FZ+nSÂg A5,MI)jX !JAÂdQY* pb XB%kX Fd YaAqg `of -YH-%L.!J.b$@'/aAQͬa 䛈%,fR 4pi԰7jL'f8b`U]2^xXHDfj -겁"&\V%3s,0 Ftr^ީvY˟N{>nY)&?q:\Eht1ҩPQ",n$\1m9/n24xlPQuI>pc; A7|8v_'yޯc4]ysڶ*yTP;?]I{;"r? FU,N4$`D-*^')M?x_7B9Fz{hϧZ~'/_t !h.-1ôٲs8bFadj -3<@}%Hn)KOk`4CJh+y@#=ObTOHF[_D}{ȃѰ9ѹp'2qI w/ uO|"~Y@yda B{s,׀%$M*LȈϑ".D ެͱw~<0CGdαE#OEIטW}>[ĀBVαHX%91X^fb8S 93bǩ~niQ㑮I K0I, 펟byYku\fۻcHEtͪm+Yb#Ky[9׋yJеoԥpOG(!x/e|m%y.bA|ϗL<;;?oGܛs1#cZ*<sP\G jQW_gQ@2d -¶d$ZOLQIJA{bI G(d>y=\-9,̠a+9^=R&fY@(X^gr.y얟;96b(}遛(X^Bc"JF(, ƛeBr>Vi~6$l(z: Vs<\-H~:/ZxX?_ u^>x%r(>}d{)S A Z=Oy;&E1s<k!Ҟi+a3<=Ks -s2d[BHfs 1ĥm/cI덻\unu!k->y1̮YWח⟳yR6v -Y2:DifSd# 7q>f/Aq`u Hi$z;rDb|GONGjxŤ i wzwȀd^ynVX}{ފ}FxOpߑh)w'ZhG'Z -#DK~dh<̽{B" VCI%Y"fw<l?'4˼'4V?#5Y7ϱ$ znrN -Ihf=nw6bcy/lƱ8işlD˹H;ze::Yy#~JhwpU"Ex.o{owz.ጎ\?aG+#O} !)nU?0DyKGN=VfՇu:rT` @۱n$cyυ))\W-KW`jzz햶'j0<;%ޟ+Ns{.?eR)Mj5@j^.a5-h|ި)!(o];)]MYD7onU-+Ňg|ܬ`89H^ -/gn#z'ĞHav8 aQ{QU59 $e eoUKq|y_ ] d Tttm;}/+^>͘*g٧V_䇵AEF!{ ocm.Y g#ۦr -:LnXw~s5Z-EV~3Aa/-I6&/g΀c&v)ξ^/'1V,md L ҄_PFCeo9iX)gtb{dk P6^ŦJUg+@vؑ -þb9kic¦unZקa8o,]~QKōTQw2*4Ԛm@RvR -U4c0}59RDVzJIJ mR;k=USrxl飵4/ 6b~G:6 -NC`WR;tN8>_zrӬer{Jy/۔CuUoDlo;i, uXǩ˥_.[nzlS:tPJUO@ǶصY׊j4 mUЦMq34S 50Cۋc/cqj# M0kX~bYӧ56v -藥ZkC'qN>-nSFrS;c:'>S=ǽmhnGO&?̖'ja3^7^sgkM5XzžM]hp[ ѱrIBU.e4.<ĕT.T#.F,]2!FZ׋<,C!i(-w1TAL(h(y}xWc)mJƤ^Je^6C@5CM G-C \st(͝mFml-kS)l[;j/S?=QiQ"z-Q 8S;kX2+eqnkR-۷۶=]#S®C\xVZr58jv<-?pksN#%OynWDZ0MN~XW 0?cOe)Üݭ-U,- B2I(?MKfEde(mO} +x][$m~_ `>y؝ݱ p|T.g%JK"?*ڝ-~~p/39闓5-J~dؕdRa.o??6M);>(S +HlRRtXFӖ  bY!e(%#1\ᤐ[ % +^965w&JK5Z&&r4Z11F 4CvDVA +9iYB VASh xNQh@J,6ZJ0\2J+ٜ-!XafPi(LRL +Ch4z G'8kbxHAL>B #aOP񤁀PPJA_P,IÁ`hi@,daY K(aA4,x +-A[4,[iXd]԰ p!հ qCaAB.=iXװ vaArV* @5,:rа٤awaF^̪F +l5, ϖ4, Op*-`аq z^zQ(X5BX V{|а̌GXaw]Slhe\.QSiŸWl\EQ   <װ.Sk4jX] a8g*[rְ%aHҒ"9 "հ wދk9 "pYB  f4Uc=Bw k4வhX65,I +|ְD^ÂɔXhp$d4B4,@`mJ(YÂ!K^Â! B }dADL.D$0-zZe\Ұ %2pNR&5, 4,9Ұ SѰd\9Ȃ [D9aAѠgdjX\CJ5,Li)UdLhXd5,@diJ,IÂYÂ!^IÂb! "> Fd YaAq' `of J7)v[B|3iXP0BY4nI7N-B_HÂY7ѫKYͤ.w4pi԰7jrB|dY]1^oU ,*k+9h1Y樮謺l`h էy*B|fNrfA{1w]ӯ?_Օ$,& pe*;B@^0F>FHeˢ W w[[ Ef`"SpuYn$Y!E !膯Ǯ6O׹1Hwy 9FB&k_UȽʻw~:BU~ϠPIc55ý̆3[:!ˎǚ+>Dy]Y=N%_HPr V|JLjΨ{ 'ֆ]mg|X=vv i-G}ivӮ ,E3nWxZ"$L)(Ÿ#6o%{ĩg@]5X U~82ȓw>YoR>2W#yFI8X;=/yKѩ>X{(h rl,b>bcSFJU a͕iI1$zܽ'kk59*{-gd}ٯ&נ~{L?ÎD0r}Km%)xP( e2AbrYG>w&q)3pEZ}*\(O#sF.Hd,k->>81puuc)i9KI[,%)x#W=+jQd-Dv_B"P$fOvf]d~VkU 6e.{㢅L&g<;?5]mϸ2|~x58Ͳ% JybҚ +4EȲQ? {I'3-{-D FݏDKi}gH#ohip04VҶ\SpOhr6m |P"+Yy7{D=k <  X$^}dXއv)ڐGlǚ| `:SC58jl#y%n=Ї|W8×>%4^;0ȭ#YBbvla-㓾w7wNZ.߱Gxڽa +!tJﰏg?um%voPu/+1{/ͪ t}9AθqªoAƱ&ϐ!p"Xh9CǪcۚq* +ql 9cM>'VΒݚw ot,ťxhlrږGd:H}^zZV_p}ѧMր7 )əO^4z{ˋ9. y)jō}.ZX=6kwC׫W|gmiw0uwW=R[XK( _Qzd>WWeWwzI%9Jޗ I-a2|^+Ӣ*eG*!5םV{͔B=lk~7^Vbex,WC'ݡ㫀H?׺l-f%ErcqpHsrW89UfўcM>eʷ|3N}yq;${P< ]cwEEw.\ʗɋą»G{Y2|ş'y{via!ic{g,@MﴬGsk(rVqXR'瓼>ԓum-ξ]ⷓLJ1b)\>΋\ǬV'L d/]>znw#5d%]_:V +2mܽ5n)ө,W±,YwgHsp4-vN-SwXޝou}X>Em.}SK%nz$Tj >OJI)6քidKanD^iZo}RGF~2T=>J?و 8 F;o +_NLGۉRVXn7o/v(.`Le/PT~pUJVW^pPFjq֎Nr8L/,9rCOtvŏ{wl]ϞL% ,o hlBObG]n^hn#ԹNžwaQr5=ֹr͡ GT6p1.K\IA%?5SeHSrOTk Fά[Y +B0_̌͝<7"rl {\oLJ;饡^e96#yBriЂVNy4[*)UQt@mecj2ťYzYcQyy>ΥժVԕѼrPKmK6u}ii6J+"md a(|o.e0jߩ7-7RЀ9Y _RP7^')HЛu~Z-ԟyҀ endstream endobj -330 0 obj +345 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 329 0 R +/Contents 344 0 R /Resources 4 0 R -/Annots [ 331 0 R 332 0 R 333 0 R 334 0 R 335 0 R 336 0 R 337 0 R 338 0 R 339 0 R 340 0 R 341 0 R 342 0 R 343 0 R 344 0 R 345 0 R 346 0 R 347 0 R 348 0 R 349 0 R 350 0 R 351 0 R 352 0 R 353 0 R 354 0 R 355 0 R 356 0 R 357 0 R 358 0 R 359 0 R 360 0 R 361 0 R 362 0 R ] +/Annots [ 346 0 R 347 0 R 348 0 R 349 0 R 350 0 R 351 0 R 352 0 R 353 0 R 354 0 R 355 0 R 356 0 R 357 0 R 358 0 R 359 0 R 360 0 R 361 0 R 362 0 R 363 0 R 364 0 R 365 0 R 366 0 R 367 0 R 368 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -331 0 obj +346 0 obj << /Type /Annot /Subtype /Link @@ -3837,10 +4006,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-14) +/Dest (cb3-23) >> endobj -332 0 obj +347 0 obj << /Type /Annot /Subtype /Link @@ -3848,10 +4017,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-15) +/Dest (cb3-24) >> endobj -333 0 obj +348 0 obj << /Type /Annot /Subtype /Link @@ -3859,10 +4028,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-16) +/Dest (cb3-25) >> endobj -334 0 obj +349 0 obj << /Type /Annot /Subtype /Link @@ -3870,10 +4039,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-17) +/Dest (cb3-26) >> endobj -335 0 obj +350 0 obj << /Type /Annot /Subtype /Link @@ -3881,10 +4050,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-18) +/Dest (cb3-27) >> endobj -336 0 obj +351 0 obj << /Type /Annot /Subtype /Link @@ -3892,10 +4061,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-19) +/Dest (cb3-28) >> endobj -337 0 obj +352 0 obj << /Type /Annot /Subtype /Link @@ -3903,10 +4072,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-20) +/Dest (cb3-29) >> endobj -338 0 obj +353 0 obj << /Type /Annot /Subtype /Link @@ -3914,10 +4083,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-21) +/Dest (cb3-30) >> endobj -339 0 obj +354 0 obj << /Type /Annot /Subtype /Link @@ -3925,10 +4094,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-22) +/Dest (cb3-31) >> endobj -340 0 obj +355 0 obj << /Type /Annot /Subtype /Link @@ -3936,10 +4105,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-23) +/Dest (cb3-32) >> endobj -341 0 obj +356 0 obj << /Type /Annot /Subtype /Link @@ -3947,10 +4116,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-24) +/Dest (cb3-33) >> endobj -342 0 obj +357 0 obj << /Type /Annot /Subtype /Link @@ -3958,10 +4127,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-25) +/Dest (cb3-34) >> endobj -343 0 obj +358 0 obj << /Type /Annot /Subtype /Link @@ -3969,10 +4138,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-26) +/Dest (cb3-35) >> endobj -344 0 obj +359 0 obj << /Type /Annot /Subtype /Link @@ -3980,10 +4149,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-27) +/Dest (cb3-36) >> endobj -345 0 obj +360 0 obj << /Type /Annot /Subtype /Link @@ -3991,10 +4160,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-28) +/Dest (cb3-37) >> endobj -346 0 obj +361 0 obj << /Type /Annot /Subtype /Link @@ -4002,10 +4171,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-29) +/Dest (cb3-38) >> endobj -347 0 obj +362 0 obj << /Type /Annot /Subtype /Link @@ -4013,10 +4182,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-30) +/Dest (cb3-39) >> endobj -348 0 obj +363 0 obj << /Type /Annot /Subtype /Link @@ -4024,10 +4193,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-31) +/Dest (cb3-40) >> endobj -349 0 obj +364 0 obj << /Type /Annot /Subtype /Link @@ -4035,10 +4204,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-32) +/Dest (cb3-41) >> endobj -350 0 obj +365 0 obj << /Type /Annot /Subtype /Link @@ -4046,10 +4215,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-33) +/Dest (cb3-42) >> endobj -351 0 obj +366 0 obj << /Type /Annot /Subtype /Link @@ -4057,10 +4226,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-34) +/Dest (cb3-43) >> endobj -352 0 obj +367 0 obj << /Type /Annot /Subtype /Link @@ -4068,10 +4237,658 @@ endobj /BS << /W 0 >> -/Dest (cb3-35) +/Dest (cb3-44) >> endobj -353 0 obj +368 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 340.338585 101.433071 321.588585 ] +/BS << +/W 0 +>> +/Dest (cb4-1) +>> +endobj +369 0 obj +<< +/Filter /FlateDecode +/Length 4731 +>> +stream +x]K$ȳH" l,>Í=ttX,0="U]cg*ԃA)EH?9L%EtbM +jEer2'!P2vs??:M)ѻpga1SAa#Iɇ3R4=߲Ƃ}VXb'G1|r +!),g!֪<b+<Lң\|Qy <#21 Nc Y1d : KpVA4^,ɪ)ñ$ :Ӏ,d 5$ Y ְtwǟ/~-k rV/ > =`v0~d9&Zmʶi)^m>䥺\&?-]5󗵛+=v6DگmT%_ϋ9utqy"?.[MFꥇ}#eokm{8ڬuL4/h--.m""YVEƂX *>{:oBX02^ܛ%A D ڄ뢆~1ln˟>Z޸myuXʟE`Fg=TٯP!5GSo(=.n\ suk[ߊO57R_u(5ՓudcVMyy9^Oh]"Z˥u]` vy֗{ vݻN;dp08?-_6ÙId%]s^rۊ|N9ِnb~g萆j.zvdI6r=:h#͈4~yiX >nkAߘlg3sU(˝Ŧ(<ѹ0<֖-IrAX᧪zM* d +g&ʑi2͌FhLf4eh-&3*r;ًe˶=ue+AKܵjD~BĐ<{5fhi89!k]fc +0j_%dE힛R?wa";sw;,r`cUV5\{[ѤGZ>^wmkⲼ&; +Ǿm8\7u@z]mZۖ~fCݶnlܴNl6zmnKg4zN8/]#1 - g)jzϽ!ISqX\Deo"ױBfn B\h/@M_ʺnnC& +m_:V-Ye'i6^.JMfG< dGv"[dM'tAϪs>MrA~UrXkiXh4 U:5}@Bz(lk1?޲s3$J+^.jG*RyT-MCaꔻZJMr#-Ycmd7r =q^BRJ64ӛ4{Ԕ&g_*B +/I5jt"[%Q5 8N.d$fg}lt؆:l%nu,ӱr&&M< UE7{ru&>N#v'oėxOϭAT3DyJnIXm_iK s>,]e~_o0%{wlݐH&'d<݈m& Q64kq yT[IuL CwӕfN=ֱ{vs&.e<!:5+):B:짊am;y +)K<avn]LE|17,OF[e#"}96jN:S Nz=U. h=IpZbщG@;FtE lS)՚ZgUKYa0J)+׳% P9d%BsNQoݢu đQ-ܔ|wsR> +endobj +371 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 709.923057 101.433071 691.173057 ] +/BS << +/W 0 +>> +/Dest (cb7-1) +>> +endobj +372 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 690.976036 99.933071 672.226036 ] +/BS << +/W 0 +>> +/Dest (cb7-2) +>> +endobj +373 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 672.029014 99.933071 653.279014 ] +/BS << +/W 0 +>> +/Dest (cb7-3) +>> +endobj +374 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 634.134971 99.933071 615.384971 ] +/BS << +/W 0 +>> +/Dest (cb7-4) +>> +endobj +375 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 596.240928 99.933071 577.490928 ] +/BS << +/W 0 +>> +/Dest (cb7-5) +>> +endobj +376 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 577.293907 99.933071 558.543907 ] +/BS << +/W 0 +>> +/Dest (cb7-6) +>> +endobj +377 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 558.346885 99.933071 539.596885 ] +/BS << +/W 0 +>> +/Dest (cb7-7) +>> +endobj +378 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 539.399864 99.933071 520.649864 ] +/BS << +/W 0 +>> +/Dest (cb7-8) +>> +endobj +379 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 520.452842 99.933071 501.702842 ] +/BS << +/W 0 +>> +/Dest (cb7-9) +>> +endobj +380 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 501.505821 99.933071 482.755821 ] +/BS << +/W 0 +>> +/Dest (cb7-10) +>> +endobj +381 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 482.558799 99.933071 463.808799 ] +/BS << +/W 0 +>> +/Dest (cb7-11) +>> +endobj +382 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 463.611778 99.933071 444.861778 ] +/BS << +/W 0 +>> +/Dest (cb7-12) +>> +endobj +383 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 444.664756 99.933071 425.914756 ] +/BS << +/W 0 +>> +/Dest (cb7-13) +>> +endobj +384 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 425.717735 99.933071 406.967735 ] +/BS << +/W 0 +>> +/Dest (cb7-14) +>> +endobj +385 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 406.770714 99.933071 388.020714 ] +/BS << +/W 0 +>> +/Dest (cb7-15) +>> +endobj +386 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 387.823692 99.933071 369.073692 ] +/BS << +/W 0 +>> +/Dest (cb7-16) +>> +endobj +387 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 368.876671 99.933071 350.126671 ] +/BS << +/W 0 +>> +/Dest (cb7-17) +>> +endobj +388 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 349.929649 99.933071 331.179649 ] +/BS << +/W 0 +>> +/Dest (cb7-18) +>> +endobj +389 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 330.982628 99.933071 312.232628 ] +/BS << +/W 0 +>> +/Dest (cb7-19) +>> +endobj +390 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 312.035606 99.933071 293.285606 ] +/BS << +/W 0 +>> +/Dest (cb7-20) +>> +endobj +391 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 293.088585 99.933071 274.338585 ] +/BS << +/W 0 +>> +/Dest (cb7-21) +>> +endobj +392 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 274.141563 99.933071 255.391563 ] +/BS << +/W 0 +>> +/Dest (cb7-22) +>> +endobj +393 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 255.194542 99.933071 236.444542 ] +/BS << +/W 0 +>> +/Dest (cb7-23) +>> +endobj +394 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 236.247520 99.933071 217.497520 ] +/BS << +/W 0 +>> +/Dest (cb7-24) +>> +endobj +395 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 217.300499 99.933071 198.550499 ] +/BS << +/W 0 +>> +/Dest (cb7-25) +>> +endobj +396 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 198.353477 99.933071 179.603477 ] +/BS << +/W 0 +>> +/Dest (cb7-26) +>> +endobj +397 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 179.406456 99.933071 160.656456 ] +/BS << +/W 0 +>> +/Dest (cb7-27) +>> +endobj +398 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 160.459434 99.933071 141.709434 ] +/BS << +/W 0 +>> +/Dest (cb7-28) +>> +endobj +399 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 141.512413 99.933071 122.762413 ] +/BS << +/W 0 +>> +/Dest (cb7-29) +>> +endobj +400 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 122.565391 99.933071 103.815391 ] +/BS << +/W 0 +>> +/Dest (cb7-30) +>> +endobj +401 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 103.618370 99.933071 84.868370 ] +/BS << +/W 0 +>> +/Dest (cb7-31) +>> +endobj +402 0 obj +<< +/Filter /FlateDecode +/Length 4923 +>> +stream +x]K$m赁+K". pAb|[ְ>a +PyI[fnkX]>jXC1F]@Hհ=x4,@c#,Ѱ w]4ʸ\2O4-l\EÂDE.3kX7Q3:_!hXs0ߌ0]W-9kX%afac3D%CrEaAbz/D DDe=*P n4Uc=Bwk<வhX2mjX|ְD^ÂٔXhp4,HRykX*YÂ! yaA!Lq\! "E d&f RǠU p2x.iXLNR&5, 4,9ְ WѰSsAtsNÂ! A 2հ34rIZ㱕<3kX9 5, R<а#vаM9*P` rnf r,z `o& ,4,(6 5,ge䛞5,_J5,(do"SP|3iXP(* h*o4^,%F73o"WI].dx]DQ\ Dd3%ꊁ̭ꒁbJꚁJ.@Ld9VtV]6_cÄӸDa sfNrn[ы'.c_1_ԕGI/n1A#H#B҅teMT鶜L3E0TuY$Y2C81J +b:OoW&u%+֐!(>dN4ـ)S }5!'+/3`Mr8-_ֽ 6b$f=_ ~y?Gk9'_q_j3BQ#KuDTCCv1$6 GpiM 4fL㳬.to:z'y߁ kLAV*C DK~K)wRˡN<Sm hӖNVϛ6Wel RPĝNwOD+:ĂZnul{As>d=&$\VyڂĦX]uխ8qq*rn/sÃD<\Oy򒺡[|-SZ7 };pI?͈@_22ZT[dO uCwN/?-`Jm1vu>ƇGX^f+Q|mZFZ)p'mNYQHUq 搝̸p ˴Y:HQ۶|먻,?q\y'k.øvg5>'YGB :t:ȓ +P:tUݿ/{rpT'GPh)_!gmtRoWn /[f?oU&pkV}X&pn8\qK$;\L&{)+z`GF } %`l8B:=;9嶹ؾcx(`jTj߱zCT`|@J: +ԗ?CdJT3u-. *\R}+SY}-Ju۪,ğ:/q@TYBs Ob!3BʼnfJ;*N/?"AO{y{sjϮ.k3?=L!Cޗ?e5%躚?As#} w_D7 "d?2tfA'染dۼ'Tj%mـtck[@M! +ST1x)!k$G# Bae UmAE$G9\y)S[fCmO|+z(:5ݲtcu1y[lPov\Qo2T4|=!R\}w={Ծ3kRs& >eܱ [h FeH4a]dA,wZ o)V#9qY _%>FE^.'g"_!It*h*Z*̀/tx69Z{g_+2AC^t=CGlpG]D̀ gu^G]$o 1ޝmNoL_>F!uә\1 /H%iob$c&sU^g`0j[̈́g Ҋ)q(:YX烽ecc26X(:*wk3wnlحz.p_۽0'(x'F<z==~vސH!G[mnsev,͢ tzL @ȱ:p3$}.dzɡ*d<R^Pji|wGdƀ8W87Uy #q4t &˓_~1"22Hej +/^ʄEO [)RqvnA~{B;xճVc ezsG_ߗ?ے5+]vm+}+V*w+{isu15YwکoW>ks*˵6;8a쟆Yۀ᯻b?_cȦ6nUL;CݥK(83e{ƕTLO0n@w )`W3 wT^턏ʻNw_׃8/ -| yW4$Y~Uc%6d{ٰZCǽ{uہ}-p fѠpv| rI͡#\Wp1.sQC}JPc:,]bc'M"?C!k{F%uivlzջ bliȣ{}/"ڠQ?Fj16өT/9TyZ[4 F-xs1@ͽR JtN .@+VRmUKj)S2j:ҔQ:hZFsNl/bɬXQ}y ^-J>ΥժVj[WB\GWcfS52ctL)y<,]Z~Ed]+{p&"|QCSodcrK)@Y +0gw+AgYjIRE17ϟ$ԥ Y>PuO +endstream +endobj +403 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 402 0 R +/Resources 4 0 R +/Annots [ 404 0 R 405 0 R 406 0 R 407 0 R 408 0 R 409 0 R 410 0 R 411 0 R 412 0 R 413 0 R 414 0 R 415 0 R 416 0 R 417 0 R 418 0 R 419 0 R 420 0 R 421 0 R 422 0 R 423 0 R 424 0 R 425 0 R 426 0 R 427 0 R 428 0 R 429 0 R 430 0 R 431 0 R 432 0 R 433 0 R 434 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +404 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb7-32) +>> +endobj +405 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb7-33) +>> +endobj +406 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb7-34) +>> +endobj +407 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb7-35) +>> +endobj +408 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb7-36) +>> +endobj +409 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb7-37) +>> +endobj +410 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb7-38) +>> +endobj +411 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb7-39) +>> +endobj +412 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb7-40) +>> +endobj +413 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb7-41) +>> +endobj +414 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb7-42) +>> +endobj +415 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb7-43) +>> +endobj +416 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb7-44) +>> +endobj +417 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb7-45) +>> +endobj +418 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb7-46) +>> +endobj +419 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb7-47) +>> +endobj +420 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb7-48) +>> +endobj +421 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb7-49) +>> +endobj +422 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb7-50) +>> +endobj +423 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb7-51) +>> +endobj +424 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb7-52) +>> +endobj +425 0 obj << /Type /Annot /Subtype /Link @@ -4079,10 +4896,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-36) +/Dest (cb7-53) >> endobj -354 0 obj +426 0 obj << /Type /Annot /Subtype /Link @@ -4090,10 +4907,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-37) +/Dest (cb7-54) >> endobj -355 0 obj +427 0 obj << /Type /Annot /Subtype /Link @@ -4101,10 +4918,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-38) +/Dest (cb7-55) >> endobj -356 0 obj +428 0 obj << /Type /Annot /Subtype /Link @@ -4112,10 +4929,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-39) +/Dest (cb7-56) >> endobj -357 0 obj +429 0 obj << /Type /Annot /Subtype /Link @@ -4123,10 +4940,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-40) +/Dest (cb7-57) >> endobj -358 0 obj +430 0 obj << /Type /Annot /Subtype /Link @@ -4134,10 +4951,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-41) +/Dest (cb7-58) >> endobj -359 0 obj +431 0 obj << /Type /Annot /Subtype /Link @@ -4145,10 +4962,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-42) +/Dest (cb7-59) >> endobj -360 0 obj +432 0 obj << /Type /Annot /Subtype /Link @@ -4156,10 +4973,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-43) +/Dest (cb7-60) >> endobj -361 0 obj +433 0 obj << /Type /Annot /Subtype /Link @@ -4167,10 +4984,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-44) +/Dest (cb7-61) >> endobj -362 0 obj +434 0 obj << /Type /Annot /Subtype /Link @@ -4178,968 +4995,320 @@ endobj /BS << /W 0 >> -/Dest (cb4-1) ->> -endobj -363 0 obj -<< -/Filter /FlateDecode -/Length 4499 ->> -stream -x\[$7~_1HqlW&Ey@B@$@ 6= t+w=53}v=*_[ev&"/?~ z G `(ch  z8Y`ϓ(x%+ZK԰ w]Fb\hXHÂ|f #װ wax]հ w7 `!аq%g p5,(lld`HNC5,] EÂܵHÂܵGA^5mFjRh ɂY*pb XB%kX$I˧^l^^ګeP5ւ{-Xo-C]jrs=")hnQ^' ˉ$,^SC h-tWDD7fyl-XUN^z_Xƫ/V#T6-V}Yik݋]{yWeȓǕ,wս,b-MQAݔ"eɨ+lD-m\<x9$E ;nq4SnnZ]u}NnL<`T0Ga<HoΫWH(n-hi)z* w#Zޭn`'M΄ڿEqåan3Hcy>|s|99j m(l;uNOK-dyrv،|} -᧲6!vjee,3S\-Oc쮽q׎VYmԹ gdŋ>y9?2CY߈6M@`&o9d 3Is46G* 4f/x,(ç!Amǔ쎕hv];~rzg^r̋7^7 es{]v/.!~Cp\'42fYkDz84)eLwue"fѷ棬 "yG^Peg:'-uڱSzC._#vZq(hQh.V=~n&%%dHKey/gOsЏK}aE+'/%Hl*uS5(Ҷl̾>xk'A[<ح ~LE.#$7/x9Kњ.3{elˁξ:vF -gz.Gab\_ ivv^ @ZL-a>vu9m~X/Lkkpr连ή聆}{ד2s;,eJSR0vO^SwOZk$h׷'b]ָ,wɆ֧E (紣!ّhs}஺8]Yun֧;/'TK{JJv4*Z!I!]N - ۊftfO&wsbn=]i夦[K ROG4?DN+^U$/|R%M6Ov㯈Sz -IIVLo&Tn'g;ePell4&/P:UpMJn'Qf'o4cG48\Jfg}l=u؆:l%nu,ӱr&&MuCrʢ=r9v|ɩ]^dxbU2nT6`A0Z[;:dڈ{9T9OKɛS(˝4Ӯ.㸷-| y=[ Y޻Ոm& 64k^n#ܙ'+W"fe|jߌ{yq?Γ\nRanSxcHwrYmʈP> -endobj -365 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 555.573057 101.433071 536.823057 ] -/BS << -/W 0 ->> -/Dest (cb7-1) ->> -endobj -366 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 536.626036 99.933071 517.876036 ] -/BS << -/W 0 ->> -/Dest (cb7-2) ->> -endobj -367 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 517.679014 99.933071 498.929014 ] -/BS << -/W 0 ->> -/Dest (cb7-3) ->> -endobj -368 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 479.784971 99.933071 461.034971 ] -/BS << -/W 0 ->> -/Dest (cb7-4) ->> -endobj -369 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 441.890928 99.933071 423.140928 ] -/BS << -/W 0 ->> -/Dest (cb7-5) ->> -endobj -370 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 422.943907 99.933071 404.193907 ] -/BS << -/W 0 ->> -/Dest (cb7-6) ->> -endobj -371 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 403.996885 99.933071 385.246885 ] -/BS << -/W 0 ->> -/Dest (cb7-7) ->> -endobj -372 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 385.049864 99.933071 366.299864 ] -/BS << -/W 0 ->> -/Dest (cb7-8) ->> -endobj -373 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 366.102842 99.933071 347.352842 ] -/BS << -/W 0 ->> -/Dest (cb7-9) ->> -endobj -374 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 347.155821 99.933071 328.405821 ] -/BS << -/W 0 ->> -/Dest (cb7-10) ->> -endobj -375 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 328.208799 99.933071 309.458799 ] -/BS << -/W 0 ->> -/Dest (cb7-11) ->> -endobj -376 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 309.261778 99.933071 290.511778 ] -/BS << -/W 0 ->> -/Dest (cb7-12) ->> -endobj -377 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 290.314756 99.933071 271.564756 ] -/BS << -/W 0 ->> -/Dest (cb7-13) ->> -endobj -378 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 271.367735 99.933071 252.617735 ] -/BS << -/W 0 ->> -/Dest (cb7-14) ->> -endobj -379 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 252.420714 99.933071 233.670714 ] -/BS << -/W 0 ->> -/Dest (cb7-15) ->> -endobj -380 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 233.473692 99.933071 214.723692 ] -/BS << -/W 0 ->> -/Dest (cb7-16) ->> -endobj -381 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 214.526671 99.933071 195.776671 ] -/BS << -/W 0 ->> -/Dest (cb7-17) ->> -endobj -382 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 195.579649 99.933071 176.829649 ] -/BS << -/W 0 ->> -/Dest (cb7-18) ->> -endobj -383 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 176.632628 99.933071 157.882628 ] -/BS << -/W 0 ->> -/Dest (cb7-19) ->> -endobj -384 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 157.685606 99.933071 138.935606 ] -/BS << -/W 0 ->> -/Dest (cb7-20) ->> -endobj -385 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 138.738585 99.933071 119.988585 ] -/BS << -/W 0 ->> -/Dest (cb7-21) ->> -endobj -386 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 119.791563 99.933071 101.041563 ] -/BS << -/W 0 ->> -/Dest (cb7-22) ->> -endobj -387 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 100.844542 99.933071 82.094542 ] -/BS << -/W 0 ->> -/Dest (cb7-23) ->> -endobj -388 0 obj -<< -/Filter /FlateDecode -/Length 4877 ->> -stream -x]]8n}_Q V/` IHIAzN"`69tْ\-EMOuIQ%eZ\Rۯ.֤`Tbu1'Lp%pUL*x}௻˾wzSJ.\L)٠ -X֑ -CTXb) jĞ5䠱{VіUO5p%$,pZE,3y炉31_T^%LLxCx ]BNxЅ)' E*H%;Ee*h+dB*gs[Ld5s&6I0H1)<] EA@k<.?8(x&KN}b]0]l>%ų>YCH_Xdxi@@. UyЅ -kX@D3iX@@[hX@[iX@[.jX@\i5, . T4, `.;5, .=iX@@] -kX@]5, .0p*5,:r4,`.94,`.kXQ5èal ٲ SK>H0p܂6sw}^zQX5B@a*3a -?ŧV5,]1|*ߢhXHÂ|f 3װ wax]հ w7 `!аq%g p5,,lld`HNC5,]LEÂܵHÂܵGA^5mFjRh ɂY*pb XB%kX있*G*RN<,ݱn%K^+?yVf{`>(zG΄G~p]p+$*HӂG-@3-f{o{?c5o-;ٶ*;X>|%~Lu BtVrU@Y !D4=pxgc2/i"B9޺[x붅#ުH cMNr}Lu c:˘DNӳҽqg ].kبEfc2Sz>t/mgωWwϮ_MۘH&ejA!o?(itۅh^N{g4;iWlJ5# >M^{:gqxRj˳#yW .YX^1(: ssOnd^@ 5c"3z !|a\7 x7y\Yq gy1JTa͠5=hjweز#>2f???D]SVHG#Yɶ^i9q`vV2DSGEq&\Lմd{Ylko: y;r Xݖ(=b/yA BDÆ]^i=#𺡣V:(u`ŨV7]?3nks}! H9^B?AKܽ9h#ⳛv{3k?O˄H-xbkKj^_5({9иᅈe^~($s]smGLE+ǂ#^5GS9$2F,Bz871uǷ'E>}aLu@4hZWp6DYW4,73ɳюy)}'t]ݹ͎)E9;䅜St{}xV{}}FHH! Z~[H ϴBpRbb}ohSρc-ڞ}t˽'FUt+gowF" Bf * NѸ:{zYu? -9x Zt@N OO]NXE)It*h*4}dCpf}: 䤢@ &>Zɘ y:0ZuWqy<y"K*7I?'y$W2G h(`b4y# 8] -#YU鐐Uu\\1&9 sAbi{xw}?oجz.p+,'t(cgn32ɏg y_ -W9:v_EO)t $MF۝W-41#Ww}G_/h=#I?n~l6&$B9w˨%239VYۿux+_`bR6>S]>&9hU=/%NlArFvˉYZ%ȾwLx@||ش vI͡p.sQ]mJ}'R\v JM1Ⱦ?C!HEF%5izMwALE_1ѲGQ{}*ZR{j1Vө4]esh:nqC.|j\m&6}V.E B5E8-2qV{)՘QtGvbG%nJˌW%P9d%Btr+I m6^fkw-2M,lJ¿3s[uJVB\nC]"OOKtRĹ[9,xd"-a8 GBu(Du1yMc,5W߼ T/$Ao߲J֩KC2zdI -endstream -endobj -389 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 388 0 R -/Resources 4 0 R -/Annots [ 390 0 R 391 0 R 392 0 R 393 0 R 394 0 R 395 0 R 396 0 R 397 0 R 398 0 R 399 0 R 400 0 R 401 0 R 402 0 R 403 0 R 404 0 R 405 0 R 406 0 R 407 0 R 408 0 R 409 0 R 410 0 R 411 0 R 412 0 R 413 0 R 414 0 R 415 0 R 416 0 R 417 0 R 418 0 R 419 0 R 420 0 R 421 0 R 422 0 R 423 0 R 424 0 R 425 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -390 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb7-24) ->> -endobj -391 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb7-25) ->> -endobj -392 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb7-26) ->> -endobj -393 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb7-27) ->> -endobj -394 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb7-28) ->> -endobj -395 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb7-29) ->> -endobj -396 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb7-30) ->> -endobj -397 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb7-31) ->> -endobj -398 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb7-32) ->> -endobj -399 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb7-33) ->> -endobj -400 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb7-34) ->> -endobj -401 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb7-35) ->> -endobj -402 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb7-36) ->> -endobj -403 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb7-37) ->> -endobj -404 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb7-38) ->> -endobj -405 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb7-39) ->> -endobj -406 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb7-40) ->> -endobj -407 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb7-41) ->> -endobj -408 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb7-42) ->> -endobj -409 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb7-43) ->> -endobj -410 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb7-44) ->> -endobj -411 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb7-45) ->> -endobj -412 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb7-46) ->> -endobj -413 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb7-47) ->> -endobj -414 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb7-48) ->> -endobj -415 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb7-49) ->> -endobj -416 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb7-50) ->> -endobj -417 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb7-51) ->> -endobj -418 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb7-52) ->> -endobj -419 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb7-53) ->> -endobj -420 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb7-54) ->> -endobj -421 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb7-55) ->> -endobj -422 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb7-56) ->> -endobj -423 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb7-57) ->> -endobj -424 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb7-58) ->> -endobj -425 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb7-59) ->> -endobj -426 0 obj -<< -/Filter /FlateDecode -/Length 4516 ->> -stream -x\[$m~_1T*nAlId a󐿟]GG3Mօ"?.j?ɹO/֤`_-I,'\9\%J)^_/gw9o.qWoJޅ? ɤ -e)LJ>D- FH 4`89gc1\ Ia9 9VAL^`"5w&K5]pc!K(iYc0"dHVAiY[ְ>!daw}-h0p׳P Ǫpt`5,@ϓhx%+O%jX.cT^1.ABX4,]*Ұ wY`AD#DjuX pyCа` ߌ0]W-9kX%aH!9 "հ wދkkiʃ,k*>dXx]0km*D஄M b@@,kX3R԰  R> ɂY*pb XB%kXl(åLfCz 1كKdmHBW=ߐOэL=nY'AZ= -/.eB+A~!MRBL>$;u.o!s`Vwiw/[ q[6Ў\ˮ۶^7xM^'~O21DV,m5 UCy2I;i];,{m {(im6lUQS;mTSI,_NU6'Ku;SqOƭXh³^rVjFpNYuZD}dχ:$K5`qOdW5oY>VGpHMV'pϫ*ǽű)%vYaFZsiӹ*96Ҹ縜Ɲ] ~%C n4[ rj/=nQlWo/}&+K'6ZhVWzb}M~f⸳WS YL^j嘴xZv}"q/cιH/G۩E ",9#!aԑǹ4N41&J-FV=:*y޿Ӑ<6jiScɫԕ-}j=<-?6V[n6-{{{.{\{XnmZ4\ڎ]meh]si){G(ׇ -{]qGcdZu_ǥJ˽ ~{$2b.ǣ-&Jꭜ}I~[ѷУ  xYr!@b݆ϯICuQC􎺼m/\a w:~ⰺApwqژF-)ۯmXϝ.8S&'If<=[A8Wk#@,rd+&yKZ>K5)\Uc9J-uޏ")uoZkZxR=r1K_uom۬?2{w=bˡ{xRV,r &ٕcﶛӔqte&CrX驖suޏi$YΙWm܏+iv K|6n8DBϦ=}r\Nf&yj'ՐOemݹ\nS\[8mn1yA`G~]<~GzDbyQPLX1kHp4zz>dwHhhLOvȲY6}>dA? "ȳNt?-DܴۭoOIy I.%a鱸fe:۱N}tvZwfòv]S.Jck~hΕLyJ[wT7IsYϥ{v?l?_b}gmR% qi{[ht%)[unCZ5ym+DYcݓq+Yޚ WbYy.;ىvn=7yM4 vAT9ٚjhtjh%p't(olkii煘!q/WZ9tBKQ4QSWhUG+5k&~nr<͓;{ ^BRJ64ӛ4{T9ҵk6I5bwyAvy z~kVuu;DtlL8 vZ/K~=ɣM*\̷VӜwhEQOrkԂ7N<)7ڦ(:\fLqR8ZJ=Կ̚t%yT]YiE-QOliܝ%{.Zkw*h}mm$ԎjߗRgꠕju%jv<շ#0E^4uJWDZ0MN立 -FyΘjի)@Y -0gV 3JuA_&*[I,K=~f? -endstream -endobj -427 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 426 0 R -/Resources 4 0 R -/Annots [ 428 0 R 429 0 R 430 0 R 431 0 R 432 0 R 433 0 R 434 0 R 435 0 R 436 0 R 437 0 R 438 0 R 439 0 R 440 0 R 441 0 R 442 0 R 443 0 R 444 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -428 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb7-60) ->> -endobj -429 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb7-61) ->> -endobj -430 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 719.279014 101.433071 700.529014 ] -/BS << -/W 0 ->> /Dest (cb8-1) >> endobj -431 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 378.534971 101.433071 359.784971 ] -/BS << -/W 0 ->> -/Dest (cb11-1) ->> -endobj -432 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 359.587950 99.933071 340.837950 ] -/BS << -/W 0 ->> -/Dest (cb11-2) ->> -endobj -433 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 340.640928 99.933071 321.890928 ] -/BS << -/W 0 ->> -/Dest (cb11-3) ->> -endobj -434 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 302.746885 99.933071 283.996885 ] -/BS << -/W 0 ->> -/Dest (cb11-4) ->> -endobj 435 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 264.852842 99.933071 246.102842 ] -/BS << -/W 0 ->> -/Dest (cb11-5) +/Filter /FlateDecode +/Length 4512 >> +stream +x\K$ s+H Y ]8C~>JfwNb =_N_mw]8AXL&lPX,Ha`R!* XƂ!kV\rX ++C U O5p%$,pZA,3y炉Pzxޙ/*/xD&&vibb!k<,Xd j<”Ƌ"YY|NdNQxʃ,6Z +P2+ٜ5`B&9`Q,ц K 5A?rVՋw%d>ʃ,| |,6E AFpIYp次pJ/p,I<4 YG AjXC1f]@Hհ 2.aASyŸ+~ -cѰ wHÂ|f kX5pb5,] AqH4,@|3tU^1aAf K4,kX `aAlJJQÂX,xHT^4x$ Bd<‰5,@bm +aA򐅼װ yȂAd8d\CdL.V5^&'๤aAJlXK װo$]ҰbXÂT \E"=2s l 眆CddʌVDh%jV֙YÂHa+M ʃ, 0?`&9*P` r Y6e4,( Ӱh$Mְ0aR֛YÂBM,-e4,( YRY4oIXo4^,%FYof f`^ȲLvp7 "3MdxCB~38c`U2^DXMe*Ϊ|0a}"!!f$,p Fv(|gusHjiF~7}; "U2i*C(\7D(;|FRն[1Q Bea/౶ȶ`iBIWz(tBRHsCKVR)$J^VD5\`FzQp`!aySWN@Ueӻ?: +M|QHw_}<("0 CX7 ry˗W:2z8>?wdqqఀT_/cX]S>DEٗ2?urmwcD&ڑaլ9v07Ծcow[bӼ#דm:H1Coy9͆־laŎ7Η+Zl/~-ߓOZ_VibF\4o~Ҽ>.6D~VV;;ɖizB^U\y,W׼vn',Zdcq^ۊw(vh_IcQڮVsukiX/4볝:Ժgl)>q6~zCm'8y]s֮[ǰui3(Y۱4]|~+&7O}Dy+?~A=2-,v--2; +ٻrȞ >o?hAqɰ馿z+X}KST +V{Pdgv4kQ;:: -BG˻U@nfW]9S]NhVljR$/"6$QVtF!VQ;^=,򏖧t[n?Ci{D5 >\2a o{ lf3 E6_Kv[,(@1ʘ@w@ +[XRa}wRKdOkgg͸x-6Fx<tS L!W[~oZl-A'&[É9s#;rLJa|cRtVA' (F c:cx2wR[[i?<ꔣPeg:Ov{=ewz +v;%ڕ b(d(4{^fp7L3D㣗DdHNאVٙP$*%S L:=y$_Or<aݾ],la-<+Ň6.7AǑQ8TyWyDHtA>Uyȭ$pI[4[g\Y9L3r4{D9<:/ӳlM&S6?| p[$W+r 0"&$;VdE[~ߑ>l*uS=(^-b7 D=^Yכo7au\/>A6y\H7v;~fGr4\ܮvEN='8-'->b}+|*6 `ç"l՟O5<]IÍ d :^o/o즿s7-m4gm{0qO~ + Ξa*..Lס*OQr!ED%z}KA.\6>];fc]BԖ7NPtFboMY! 3ʄAQLTyBl;y%AhՌ(/|^r]!9r[˥u]7`d^yI,^UvA]߷i{v;]nI =J*Ii}\me:²osNQ[ϓ +W_gc8sm?Z_rl=wi9ٜ,2iFW[x9Ҹ"/cȌru\U;ߨYc/~DwNa-cNN;Ő~JrBf'i{[FSٗ`8NahUxl[!Wі"jFwM[V|4>.JMfG< ɎD D;u7ȞMyx9[S_TdjM5zi4 U:5}BϓB5͘ΟfM.> -/Dest (cb11-6) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 435 0 R +/Resources 4 0 R +/Annots [ 437 0 R 438 0 R 439 0 R 440 0 R 441 0 R 442 0 R 443 0 R 444 0 R 445 0 R 446 0 R 447 0 R 448 0 R 449 0 R 450 0 R 451 0 R 452 0 R 453 0 R 454 0 R 455 0 R 456 0 R 457 0 R 458 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 437 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 226.958799 99.933071 208.208799 ] +/Rect [ 101.433071 541.623057 101.433071 522.873057 ] /BS << /W 0 >> -/Dest (cb11-7) +/Dest (cb11-1) >> endobj 438 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 208.011778 99.933071 189.261778 ] +/Rect [ 99.933071 522.676036 99.933071 503.926036 ] /BS << /W 0 >> -/Dest (cb11-8) +/Dest (cb11-2) >> endobj 439 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 189.064756 99.933071 170.314756 ] +/Rect [ 99.933071 503.729014 99.933071 484.979014 ] /BS << /W 0 >> -/Dest (cb11-9) +/Dest (cb11-3) >> endobj 440 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 170.117735 99.933071 151.367735 ] +/Rect [ 99.933071 465.834971 99.933071 447.084971 ] /BS << /W 0 >> -/Dest (cb11-10) +/Dest (cb11-4) >> endobj 441 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 151.170714 99.933071 132.420714 ] +/Rect [ 99.933071 427.940928 99.933071 409.190928 ] /BS << /W 0 >> -/Dest (cb11-11) +/Dest (cb11-5) >> endobj 442 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 132.223692 99.933071 113.473692 ] +/Rect [ 99.933071 408.993907 99.933071 390.243907 ] /BS << /W 0 >> -/Dest (cb11-12) +/Dest (cb11-6) >> endobj 443 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 113.276671 99.933071 94.526671 ] +/Rect [ 99.933071 390.046885 99.933071 371.296885 ] /BS << /W 0 >> -/Dest (cb11-13) +/Dest (cb11-7) >> endobj 444 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 94.329649 99.933071 75.579649 ] +/Rect [ 99.933071 371.099864 99.933071 352.349864 ] +/BS << +/W 0 +>> +/Dest (cb11-8) +>> +endobj +445 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 352.152842 99.933071 333.402842 ] +/BS << +/W 0 +>> +/Dest (cb11-9) +>> +endobj +446 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 333.205821 99.933071 314.455821 ] +/BS << +/W 0 +>> +/Dest (cb11-10) +>> +endobj +447 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 314.258799 99.933071 295.508799 ] +/BS << +/W 0 +>> +/Dest (cb11-11) +>> +endobj +448 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 295.311778 99.933071 276.561778 ] +/BS << +/W 0 +>> +/Dest (cb11-12) +>> +endobj +449 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 276.364756 99.933071 257.614756 ] +/BS << +/W 0 +>> +/Dest (cb11-13) +>> +endobj +450 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 257.417735 99.933071 238.667735 ] /BS << /W 0 >> /Dest (cb11-14) >> endobj -445 0 obj +451 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 238.470714 99.933071 219.720714 ] +/BS << +/W 0 +>> +/Dest (cb11-15) +>> +endobj +452 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 219.523692 99.933071 200.773692 ] +/BS << +/W 0 +>> +/Dest (cb11-16) +>> +endobj +453 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 200.576671 99.933071 181.826671 ] +/BS << +/W 0 +>> +/Dest (cb11-17) +>> +endobj +454 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 181.629649 99.933071 162.879649 ] +/BS << +/W 0 +>> +/Dest (cb11-18) +>> +endobj +455 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 162.682628 99.933071 143.932628 ] +/BS << +/W 0 +>> +/Dest (cb11-19) +>> +endobj +456 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 143.735606 99.933071 124.985606 ] +/BS << +/W 0 +>> +/Dest (cb11-20) +>> +endobj +457 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 124.788585 99.933071 106.038585 ] +/BS << +/W 0 +>> +/Dest (cb11-21) +>> +endobj +458 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 105.841563 99.933071 87.091563 ] +/BS << +/W 0 +>> +/Dest (cb11-22) +>> +endobj +459 0 obj << /Filter /FlateDecode -/Length 5005 +/Length 4906 >> stream -x]]8n}_Q V/`0  ]L@4}ӽŝyϡ˖2,WWo%Z"HIvev&"~=v&S)d+1BdR > ]]OeٛRw/b2)d*`YG -+QaEgph,{޲Ƃ}VXj'G[V>9XPÕykU &ӣ\|Qy <#21 Nc Y1t :KpVA4^.ɪ)ñ$ :Ӏ,t 5$ ] ְ`Xx]0km*DL$5,Qװ f6%aA,<|*/\ !Tt 6Jְ yBkXszl &_O?쇯?À6~p0u^kgJC9-"ϟu.;s6eJnhUǸSd'=юvu_3}ѩ꾴k=&?|kc!̰i"A {?(a}{B̍T@֎ݐNHj<2vKӠjxACL"x//W=vW\g*^tV۸֑J'³.}^ckI7,]Au u!א`t"Q3\ -د+O;1 KGx&טw~ga,lLJ,]eՌ(D3>x gK`G`m`}`$٬T$E4k6&z-[!<ͬC I9`UA{҅Lz&-&N0?3`0|/೤hp0EZj?aY&|K&U:LN%_fu޽ y綵/w˜Kq]OtHOjAe^& -{pzK#Ӊd>9uj5:5c+hי&+7̂q~ں@D^(")1UuQ>ѹ0A eY2Ŝ$'@>$:XܡOe&{r61y7_Y#N.fU~ѧʩ5̷xe^/&(!]buGc­dzM*L@LL^nqe4G#)7uڶ#Zew:$pߏd^YvJC2 8c1)˞Mn1ݠ{ tJYݐ[nmr&苳Nw +9fc"/cxbNQԀZ [. r i7MG٠tnuu[-VE[o19k8dy BD7n.'bkwBP,0ʼ^`/ERWƩl;{NJ>C_}vڵDѥ08ڃ2/C[Xʺ"}`Z͓]owޛVGGD9J@4m,e6Cy/p'<lk8gџH*b9h^1(: lZm]q<_;f@%7?׌pd!}c'n\ bEjqϊk0'R 3(zqM#:hjwuز#>2f?ǷTGY*$VHVw9jݹ$̎l>nkHm>*zv5DZMK7!4Yb̘>SwEQN`ìGb乧٘ :li+/POzG鮏]"uCG#t=׎;~bTMlt.fV~Ccm;c1aX[MÛʳqЀ5鱧~1&2G%y3"uu:۝:'ɆuIyV8d?z@g7hcuqim)#x}y H `S״d\JAދ\&ګ6e`A޿94~+z@">+z,o(. -8ݳ92= alP{|mk܇HX=Sy09x_YPP4v#?`D%Zu]ʵeh(Oz;yŸ'wgLu,'\2;3 -?ђuOm*i?ѠCܽsФG#xz{m&c {o7zq}Yls z_ V1"M T,O ^zoq|PeX96;fr[9I#I"+$o;EM+%ĹG gJGpM@ҡ@5CX\.GV:Tm[Lutď->26]ut+iF# f)F.2ûI<ۏY_][nxeôțxXGc"OYQuРuDyf !ݴL93Mw>UFH$vqnaS}nv$<}EFdCKE$凜h_~Ol[x']Bh~z+ڼ34Sze3غ4RKVΡH|v?Ou4Iv$ݲ U=6)NSu;mrXFĨ%v0cU%R?HV^h~9Æb.4d[d:#o9墑OMA珶%GCho1^`),}XF"&1<Ʊ\_VnKG7:*VUB\tU}Va%˙F [kdyR׏9U\7KYG|;YTwg/4*u@Bz;)R5c0+5yCZ,I-7HZ*7Ѳ|S: -m꣙:|\呌:6wv7ķ<\!BRJ6,mҨ)/]\hZRyIɻUkD|םcEzqjeBXm/R^@=v]SY&ju,Oʞh%\#j+r3TW 6]gȱb{ONuĝ8[l~!M_H#b>(4rxkE'2cs2m};4MsȽ,D@b(˝e~N|˗yۊbdIy,ߢtD7˭lXwxM6`_Jr{bh}ؑ}5]pvՋ5ֱi咖C3$^E;̍GmJ>wUJ)\ .Jq5Xf+5 Fj׋]!xܦپ6EWDW_-+}voYxP+W{O7& -x:˸sMo\P:ߣ4h.zB(/UDQ4ji)bKLw^J5hԿ=QQR2hjzsNl+Ycɬb/]JB۶붗7EbLm #sZuJ-?J -0Qd=M>isN^jQ]LWnX(KA f%h"9eTQ7RVrJ֩KC26V +x]]不}_q">AX$42 s3 $eKr,V/jzL-G,܋şoKk[7X]L?ِ 3$J&)]e_/.q/ޔ(@&,+uMJŠKXPSaJP# jPBre  jIa9 =VAyDtzxޙ/*/xD&ibb5^.\x ]؅`5t ƋЅ"Y]|Nt蝢2tue]lN2\r*gs[l8Ya&a  w!a{_~}il`$,. peڙ& Q",΋n$bL~qkLwv)8 E]2ҕv~Hb c%Ҁd0C4+H}W1Gh%/GE4¿t{_We7- _>t_ݟhӗZ^G_>N2!.n]ThiOX:Ϛ0 cEE}΢~毷_q߉rvQY0B(QL_Y筰٫`z$9:bD>H[wd6%"Z+Jdjl*q?FpNNO~gwD iK)2}AS5 rJtSBma6liU݄7s':AAc[F 5i_F_f3X45^}cie:-d9{V1$$<) 9ݤwOȽ Gލ@wZe *tã@/)L->̴=Dy8cY_%\W4J; bK,g4{ XJxEuΣqQΔ l[ÑG$ń +7$wN hLi0ԙcIp] 93br[d?+-OoMCQ/,bXQȏ*dMdaZN#aM~O1 VjC7yv8{|<5[ ҂@=(4>9|f*ʺ"}`ZFw]oɉĽ#!-Ss0aOSíiʳ|øT<)Y#y(A[W2-AW>$r[Ww׎61SkDg8dgqM ~kX=•Rd>yfۚ0hjweز#>2f???J]}VH Fmr r\tKȣmeg^~M$jHiRtg_u<9ݮ/02yEF7A'tXy{y HsXE +U3 : o׏JԁjZ]wH̸U6/xݭo ;j:`dE^:p1 ==MfK(ow`[ɝ l<)p=΄!v!n˸i=4SFp?xܑd?sS״~)A'<[AjU2 qqI0:wE= j7;Edd(7gPy(`cP;5[{HX=Sy09x_Y#.f:!j&}#*\Rm-cF;pd.F_L;wNwuud'JUBZ<}QBb7՞65DW-6Jx>H9^B?AKܽBȬIϰ%rޚXyz#lN?{9o[W'U=h oS!+cbGx!Ade}ɣo[1I#I",Eq"ޝ"DH56UǷӧ LӒ c"3,!Ufюo!ʺa)ʾC9dfDlUrJ#Ruu6;N"0%yl"BA{bTDUt+gowF" Bf ?h +WuO^1cЫE] gyZ}bT0r=}*Xr𧬂"NY9UРUD9 (2b(@ R=Oo8_+ydsdf>&wCHtK$c}4[WL[L_`LLy$[Rҽ0U3>*6x @PI2u~q}tcLy:hڻsNȺŗxAb샺v3 Uc6Bn=A>N"=?z=Fcvn"z_EO)t1IZ`GvVv3zȋM>ΣF%Ӟ$Gb??ۦdQ1мDfyƀ8NJV"5;u״n×y;رT}gg$'-8tN{ ϗ8m&_ɩc0]Nr ,arSǺw$_IArt.XCǽ:4qۀ})*#jQ3|zӋ5ش zI͡p.sQ_*q%E۔n .Jq5Xf+5 Fj׋ +y_ta\R6U/."+oQ>^YxP+W[O7& +x:˸sMg:.zEQ rk".zo4,UDQ4ji)bKLw^J5h=N~T⦬Իx5ZqoΩݝm%k,Z+5жmulFh&ƛ\enVRۯ$`./mɢ3Rr4rXZvEdY+[p@d0Ux37X喎u`nV߰PL*OVY~i+Y. MK(a|2?i endstream endobj -446 0 obj +460 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 445 0 R +/Contents 459 0 R /Resources 4 0 R -/Annots [ 447 0 R 448 0 R 449 0 R 450 0 R 451 0 R 452 0 R 453 0 R 454 0 R 455 0 R 456 0 R 457 0 R 458 0 R 459 0 R 460 0 R 461 0 R 462 0 R 463 0 R 464 0 R 465 0 R 466 0 R 467 0 R 468 0 R 469 0 R 470 0 R 471 0 R 472 0 R 473 0 R 474 0 R 475 0 R 476 0 R 477 0 R 478 0 R 479 0 R 480 0 R 481 0 R 482 0 R 483 0 R 484 0 R ] +/Annots [ 461 0 R 462 0 R 463 0 R 464 0 R 465 0 R 466 0 R 467 0 R 468 0 R 469 0 R 470 0 R 471 0 R 472 0 R 473 0 R 474 0 R 475 0 R 476 0 R 477 0 R 478 0 R 479 0 R 480 0 R 481 0 R 482 0 R 483 0 R 484 0 R 485 0 R 486 0 R 487 0 R 488 0 R 489 0 R 490 0 R 491 0 R 492 0 R 493 0 R 494 0 R 495 0 R 496 0 R 497 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -447 0 obj +461 0 obj << /Type /Annot /Subtype /Link @@ -5147,10 +5316,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-15) +/Dest (cb11-23) >> endobj -448 0 obj +462 0 obj << /Type /Annot /Subtype /Link @@ -5158,10 +5327,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-16) +/Dest (cb11-24) >> endobj -449 0 obj +463 0 obj << /Type /Annot /Subtype /Link @@ -5169,10 +5338,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-17) +/Dest (cb11-25) >> endobj -450 0 obj +464 0 obj << /Type /Annot /Subtype /Link @@ -5180,10 +5349,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-18) +/Dest (cb11-26) >> endobj -451 0 obj +465 0 obj << /Type /Annot /Subtype /Link @@ -5191,10 +5360,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-19) +/Dest (cb11-27) >> endobj -452 0 obj +466 0 obj << /Type /Annot /Subtype /Link @@ -5202,10 +5371,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-20) +/Dest (cb11-28) >> endobj -453 0 obj +467 0 obj << /Type /Annot /Subtype /Link @@ -5213,10 +5382,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-21) +/Dest (cb11-29) >> endobj -454 0 obj +468 0 obj << /Type /Annot /Subtype /Link @@ -5224,10 +5393,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-22) +/Dest (cb11-30) >> endobj -455 0 obj +469 0 obj << /Type /Annot /Subtype /Link @@ -5235,10 +5404,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-23) +/Dest (cb11-31) >> endobj -456 0 obj +470 0 obj << /Type /Annot /Subtype /Link @@ -5246,10 +5415,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-24) +/Dest (cb11-32) >> endobj -457 0 obj +471 0 obj << /Type /Annot /Subtype /Link @@ -5257,10 +5426,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-25) +/Dest (cb11-33) >> endobj -458 0 obj +472 0 obj << /Type /Annot /Subtype /Link @@ -5268,10 +5437,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-26) +/Dest (cb11-34) >> endobj -459 0 obj +473 0 obj << /Type /Annot /Subtype /Link @@ -5279,10 +5448,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-27) +/Dest (cb11-35) >> endobj -460 0 obj +474 0 obj << /Type /Annot /Subtype /Link @@ -5290,10 +5459,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-28) +/Dest (cb11-36) >> endobj -461 0 obj +475 0 obj << /Type /Annot /Subtype /Link @@ -5301,10 +5470,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-29) +/Dest (cb11-37) >> endobj -462 0 obj +476 0 obj << /Type /Annot /Subtype /Link @@ -5312,10 +5481,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-30) +/Dest (cb11-38) >> endobj -463 0 obj +477 0 obj << /Type /Annot /Subtype /Link @@ -5323,10 +5492,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-31) +/Dest (cb11-39) >> endobj -464 0 obj +478 0 obj << /Type /Annot /Subtype /Link @@ -5334,10 +5503,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-32) +/Dest (cb11-40) >> endobj -465 0 obj +479 0 obj << /Type /Annot /Subtype /Link @@ -5345,10 +5514,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-33) +/Dest (cb11-41) >> endobj -466 0 obj +480 0 obj << /Type /Annot /Subtype /Link @@ -5356,10 +5525,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-34) +/Dest (cb11-42) >> endobj -467 0 obj +481 0 obj << /Type /Annot /Subtype /Link @@ -5367,10 +5536,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-35) +/Dest (cb11-43) >> endobj -468 0 obj +482 0 obj << /Type /Annot /Subtype /Link @@ -5378,10 +5547,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-36) +/Dest (cb11-44) >> endobj -469 0 obj +483 0 obj << /Type /Annot /Subtype /Link @@ -5389,10 +5558,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-37) +/Dest (cb11-45) >> endobj -470 0 obj +484 0 obj << /Type /Annot /Subtype /Link @@ -5400,10 +5569,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-38) +/Dest (cb11-46) >> endobj -471 0 obj +485 0 obj << /Type /Annot /Subtype /Link @@ -5411,10 +5580,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-39) +/Dest (cb11-47) >> endobj -472 0 obj +486 0 obj << /Type /Annot /Subtype /Link @@ -5422,10 +5591,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-40) +/Dest (cb11-48) >> endobj -473 0 obj +487 0 obj << /Type /Annot /Subtype /Link @@ -5433,10 +5602,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-41) +/Dest (cb11-49) >> endobj -474 0 obj +488 0 obj << /Type /Annot /Subtype /Link @@ -5444,10 +5613,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-42) +/Dest (cb11-50) >> endobj -475 0 obj +489 0 obj << /Type /Annot /Subtype /Link @@ -5455,10 +5624,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-43) +/Dest (cb11-51) >> endobj -476 0 obj +490 0 obj << /Type /Annot /Subtype /Link @@ -5466,21 +5635,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-44) +/Dest (cb11-52) >> endobj -477 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb11-45) ->> -endobj -478 0 obj +491 0 obj << /Type /Annot /Subtype /Link @@ -5488,10 +5646,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-46) +/Dest (cb11-53) >> endobj -479 0 obj +492 0 obj << /Type /Annot /Subtype /Link @@ -5499,10 +5657,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-47) +/Dest (cb11-54) >> endobj -480 0 obj +493 0 obj << /Type /Annot /Subtype /Link @@ -5510,10 +5668,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-48) +/Dest (cb11-55) >> endobj -481 0 obj +494 0 obj << /Type /Annot /Subtype /Link @@ -5521,10 +5679,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-49) +/Dest (cb11-56) >> endobj -482 0 obj +495 0 obj << /Type /Annot /Subtype /Link @@ -5532,10 +5690,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-50) +/Dest (cb11-57) >> endobj -483 0 obj +496 0 obj << /Type /Annot /Subtype /Link @@ -5543,10 +5701,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-51) +/Dest (cb11-58) >> endobj -484 0 obj +497 0 obj << /Type /Annot /Subtype /Link @@ -5554,178 +5712,32 @@ endobj /BS << /W 0 >> -/Dest (cb11-52) ->> -endobj -485 0 obj -<< -/Filter /FlateDecode -/Length 4196 ->> -stream -x\K$ s˒HAId 1rm9磪nNWx6NEIuUev&"/?>I_moYN&s8$J&SDKX#$|JK bYaeAݲ -ɱƂ[ e&\0J;sE%\.8WL1dǐ%4^,1[YrxP$ ω4^,) -/CXWVyF4^!JfVy` Z` 죆0j6=,X a3i -Ÿ@+r>WKивq1 p4,]gְoQZw/VÂE4,9@7,LWcK.`kX(lld`HNC5,]aA@aAZFڣ eaඊO#Y5)4p:Z+aSÂೆ ̦5,łOEaA @ʃ,X$֦P$Y{ ,H4,@F`C Y)jX$30kXBD=jMNksI ; PK װo$]ҰbXÂT \E"=2s l 眆CddQeFa"4jIZ㱕:3kX9I5,R<а#vаM9*P` rRnf r,z `Ro& ,4,(6I5,geԛ5,_J5,(dQoSPz3iXP(* i*Po4^,%F7H3Po"WԛI=.dx]dQܠDf3ꉁV{zf`R#e*Ϊ|o0a9}"!!f$,p Fvkьh}zU=)k?O"`W(aX񇪄%}DTSmE"C2SW.CG QWYI(Ī^yuNJRd}vWŏ`3*^]Ho/ ՇB5~]!eyZ>G-`WXص:ƟB B4~e!͋S@|8QM*SIxNW( Ǻ dW(dceNGzD3?ߌm?6&dQV%-GtZRӤʓiOکWXSƹ\ZgvLZָ}+2;} EwMn-%%$?.{4& S]MZm e.қP>ߏuyk8ܳ4SXy~ǂkW92 Xvf8p'jV1oCÚ|#ʈnVw,_dzӜq5g}ı֦W5om^ۆWcψDFZ#'m[e򴣗4Ir9JDYqvhAeɁ)9@Y~:՝Qw3Hs,>㼿ymob5=jMұ,&O,bIzq+.4%6o#o>om b2rg3?lH(aA^yPuC$i>o@(>߳a) -70<(4 5~%Zixi+4uykvTսcHcs]Mt,pWnu4,>;ZQ{$y]E8>6^wM|C =8dKtC*mZTtkg˜f>b}A՗lxyِC9K!M*֝YSo%d Iy;n|T7VoWm%gn$Bf6 Yck ;N\ťKjhՇꗉ"zFwK[V wtcq hYQjm},}AϪs>Myx9aZ>T9nC5zi4 U:5}CB ΟvM^ZvSHn-JU]Ke:xVuR|#ȯ|ۇ,g#}m/: LiNvˠTl4yE_"t OpMJq7&䭒fzÚvRK/^@P'MTxRYt> ǎ39w&b;|#^j`k~n <̧O6`A0X[;:ɷdZĽ~<0)x#9y~β?h ~yڛ\Kغ!ϑL%$ײ4bwyAvy z~kuu;DtI3rŞҽ{qIlRf^niHIe?u<(n ːl#> -endobj -487 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb11-53) ->> -endobj -488 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb11-54) ->> -endobj -489 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb11-55) ->> -endobj -490 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb11-56) ->> -endobj -491 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb11-57) ->> -endobj -492 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb11-58) ->> -endobj -493 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> /Dest (cb11-59) >> endobj -494 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb11-60) ->> -endobj -495 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb11-61) ->> -endobj -496 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 567.702842 101.433071 548.952842 ] -/BS << -/W 0 ->> -/Dest (cb12-1) ->> -endobj -497 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 219.655821 101.433071 200.905821 ] -/BS << -/W 0 ->> -/Dest (cb15-1) ->> -endobj 498 0 obj << /Filter /FlateDecode -/Length 3467 +/Length 3936 >> stream -x[ێ$ }+S"u?H' qc# C~?ҥ9=LEj&SĻRjNr|8}<ˑJn|r<{좯pvƐ?۵鯿:k_ǟ5?*aK U<]!&CkTUeZ ,F^,`>:!G`dwPM]`]⣷tեbt,tX!K,%[,Le` N5tX] %򖮲 -\nu,.7aEaR6tXj%2K"tȹc]L-]:`[ PN`9%BNjBa'ET'9EF'fjqAbb "xY,.;ҁw}dqA"nG`q7 kꪣZ Z -`vT$.;8dq Z\-.H]=X @ekiҁwc-x(W xWM RVA(C,.HE\9Y\*A%hqA&"(d\9 `qADzDfz,p3?`Ahq̕*bqA jRp%M]g r[\\,z @N% :/ -,X*`+r% 2tXd[\H:-.(X Z\PBA%ajK'yfHr*Z\eLLi4aqGhq$HsLp J n J@JJilqh:" /7X\uf2!DgIlqA`QL hƺ'!;Y,5%73o"7<. -ft]D Ddk,qĀ@{yd@^V<3 H`",<5 -'؀OU;d% + 9,l}zU;)ϒ4F&T7ʵ&"QN)Hlny\=d VLE1WL\*o䣈 _*":֟ BKA,N_?_c?5{܀hʗȷrІk&߮z~ -U/|=L̲U WٮCI[wi[!<7d e"&*K˗m0ز -#xJ؁A~اSmoK i'j78ek+F|\mۮMOV h[Vew<̥KMXd==nrܴou~mFuCgک/Mfe*KuݵYGqwP}7;thuv'쮽^u[r^ڶRgw^|6 ->{-nѱl>ks=[hE#q#:W?re,vKn~*hltg9krc}mݧ" nu.. khv76yZsLt ]X>kXy߂eiRenr(/.}qh ?ΛR-vA1^5 al#}zfz/@Z}F0N49r8tC%ĴpٶJ fбl [ryՕ~wŨ=MFQ2mꃍC-/zƉEjwH_1+*wWd/ s>ReSqᖭ->8J{WY$gÇ$N϶Wihn} X?txǢZWJŢ\uU<,no%znOh-æ/ynj'd{DsjSqAj;-].7[.8T2#lU<~mej/bc} _)9='>+$u48'A,Oogj%?RۻS裴닕Vc'_ũiQ{ωk/O'}M 1?RF[{!ǒXr]Ѹe}4Z?jAvfb=9]xKJL3AYgŞi[!-Mqa4j:L/2ɔJn@C :"c dQoZ0C̚> -Kw$j/g.'Z3G2n e:axClI~k*߄e)~:l+(v[;ąLi.TX]O** /åI⽑Vy#Yv1yj/_(;Jy bn:t7qN5q_U~9^N?68M{} o?(5><u4" n݉םL.;]8" 2 caki{/]qpbxGx9Xq2;7sþ|^X_pexnIiѹC+aQ.։lSrd^:}-7KOt Ll)۴{xF[=A\3꣋j[v*]o. .-)mպYڈiTKx?gscΔ _ +I9% + +E+LJ.DKX#$vg%%1ع2߳ +pɲƂ,AT!f &BQ9kb.MNyobb+&c +Y K̤ 4^,>zRy5^,) +/CXWVy"YW %35,` X.Ӱ]԰b?f]@Hհ<5,`!-Ѱ wmAS|hel.QÂܵۧ WZ66ƢaA"Py p5,DTaAZHҰ w7 `"аX骼baA†2D%C !հ wދK{ "piʃ,>; ׀U|ɪ!x]a%JEÂܕaALBpYh; bfSRB!Sy:hXRykX_AA  #0"VsQ,5,\5,H!V5^t&'٤aAJlLkX7.iX1aA*aBƳItV A ˨2#iXZxLRgf 2G#pT@JY`A2GAXÂYÂ!#alSͤaA!ȂOÂBHa`<" ͨ7kXz3kXP> I:d/.+j5ÙJ)yU!o5)7//+’kwyyBFd2ͿcY(*]9$/(~嘺iHSRIҧx78Ȧj3 I%GZd ad\RX&`ԨkRk[zWgmɂ&Ww2`~Nm'tq'k= _ữ1c d]6* /GgB "p_ݵ;a H굍v,95߮懭mӶ_m;xM Rޅ\KJX4Pgh+L[dړv*` 8gkaiGZӤsӓ\X)[*Iw傟.WaKC]GcR'7ʊIMZm]u;|H될\^z}GzȹUZޤ] }suy׬[TZA>4_NPWkUű)%d&fq^5~_O| i~;99MogYw܂Գ1wņkXm|$zn~㰭x'iӐGrjE9)gkCwiV[nF8^Ӗ%"J;MBV[FzҼO&7?{^#Gcy<&cūrdwIkzaf(F ]Qp;ee" zuc{yMpMuݛmhٞy5{S׿{N[uT5eJZhn5DSKc)lX |br; +t͚^pNx͒R*<\:ˮ0|jv$O6]Qd ElTL JF{'s-i;mr["uLYQ>%)tE],7&{^QiE]qtI.cuu[QG7:y(nߊ;}Eݪnws=DoRR1Hw=/FV= qgl; )|tH7JGKRKsX_]FTSm\sKZn>,&!tw=)n bKLlY m m{h[_u1(2yOڪX{гmZ_@&y'IG_N.C&,H]ǃ, +y$7B\?Rmc:ri+G#хZ7yaɵ+ebɲzJnU좄d'C<7H'bin7yU>Nں4m5i9Q6T.FPSCk7>)A!~NmhfvkB͐+B:vhTZ(}Wh H od_^S툧CxIiVPh74n'g2)7U5M5*S?X&%ovVI3=vaMh;˦mv֗<Ʋo/[wm&z*M<[VaM?+g"5!0 nʏ3tW 'v2رq&Vq'oS l|NmAvԣݘl" +<`vt3hitPÜxV^e,{|up[79;Ef":`mmC剡tF4Am0t8]7]gpx:bOd>toF^.}[M +rpϏ|ĕ4!+SG\̃r 6bAΓtՋ> @@ -5744,85 +5756,65 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 567.873057 101.433071 549.123057 ] +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] /BS << /W 0 >> -/Dest (cb18-1) +/Dest (cb11-60) >> endobj 501 0 obj << -/Filter /FlateDecode -/Length 4860 +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb11-61) >> -stream -x][$9~_QHIh9#!@+}_$=ŘIM))VY=>09|t,a -ə/'7_Nov`&9XGhx%.e$.6y$.H - ⓸ )?q,qh:$.H:biHK^oF UXob'd=7`C"` $[p֛`'IaI$qAכQXo""7]u $L8zW ^+((Po *{ -k$qfbek -Vⶁ" '̻O|f ȄiA뚣%WcOp?ONYcl8iI'tk}'~8"24]҂\(̻Yx9ubDy`͈}Y˱YUk.;:kI'~9a vmBm֒Nݪj#; ֛ Y{Zel eHm5˲uCj4u?B Kտt7^51 -}A n-sI_ -BMP/GSR6)BPDQ|CK"5UzG׉o@}6|'I[_'#|3oqkd|_'w'}! u}x?wOȉEdr(oBAMyHg& o(/乽u(y]Nu^em;ϛJ|1OW4r/u~kcXnꥤh5Q4h74zAw'h - ߉&_e%>~7?S -<` T/JQTAR;|Rjoa73MKo42ZR+zL,EВ. %OMmz'r*g{4K9Wpg{.%U߻Vٚ,--3Ү8X]f˵_$+[L6j)#@m9f[Nn[,x+vҞsy2m|ѕWʞQʼq8qδ=Z~/^of8o>~l]~s7i)\Jugޥy.iNe}0Cwm+[p}6dOM:]׮UFmkZL3Oq^Gf)Cx}QK LƁ$gy^,nr2|l2|SMNhJsCt^$kJйR[hҜ˝]=AZaJ|Pa<܋!V% %{)küˍSr3)7=`bqK2kr^!z_RPa`ϒw&ld|.=W|۹ \ag|uSOcX*&N1̶,+nnMvoi }YAJ *zEl,M)9^+<@N\By y*?;4thL),q-,[{yʁئ7LOS}iT+HKDQw -)!XAJ38G3q=s?pQG? -*yKYoJ+_Y&;+x".?2ԡx r'ͮG=M^W淈(0r y~YZ(g@j^t.}Z.u];H9/~ ^W& s<jm-|a^yέG5i@l9o<-i==ѭ6\:^{|:2#q=<۱嫷@n7[\Zо>C -*_gpg܈>gb~:h=v{zOV(/0I1n`CMt^o}< Htק{~{t}1ncl/ݕf ŕcycѻxY@5cywhϛh\ִ+>dplX\!8O|ه]|ub74״Os|[·w9rWި2ݴ:w"׎q7Vwq6i`xcrYltgK(`C('{zd<Ѳ<^q0ájg;wjgsǸJVWP"% ޾<jG諜|q$;p]Abt<8=yn ]퀔fu_qfR[xM]{1WJg6iH#'F=z0á8S(7US<ޝ↝|-s﹩܃zEC w<Bwaw[ڥWo^c 8c+B+:jWWD{|6\-4MVej(!XX3l)kΞխIf>|~OV>N+;Ξ&J -Oʒ.äsE'j'Ώ_,?x҉&|v~OhA=$ A1 E$ 1nRT *ƕp~WCID6?AsX"[1^Mz>d#_M[H}V`˸+VuB&6Tlu }nKZ%P/0P*kTΨTBu?1e#F Yݨsga,@.tr-:R-k*=LiPv }H#ʖk1?'nFx993Sr] - -zʭ^_0,2~-?SRfCS?JxnVzCRh --m]:پtTBz&ݚJuY'$Uc-uUVre/TTĮBe%nv:UyrW|šǎW{kb~,4Q۵:a3 čF_N*M2^N9e7g3|ߢGY?N7ܺ߹LEXM'4~ҺǍZvՈԕAuB -]m32b d>wlÞm{*oc]8ͥk~M}8*LͲ Ⱦl?Ca #657]d]? &WVFzz}/&2XZJ_zimK+Ro/P-vs MZh'-ےR*-djl[rKM]?*]?*~-FK@shS-e% }*ٶnZ]k5C|LU6)_;ߤT/^tGM:Xc+UB@s{s0Y淐&@]Q r&VP͓t~ ]B0R:i9> +/Dest (cb12-1) >> endobj 503 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 559.294475 101.433071 540.544475 ] +/Rect [ 101.433071 391.031993 101.433071 372.281993 ] /BS << /W 0 >> -/Dest (cb21-1) +/Dest (cb15-1) >> endobj 504 0 obj << /Filter /FlateDecode -/Length 4946 +/Length 3121 >> stream -x]Y$IR~_+M߇a%h`$]Y|naqdvm+iUf~XvDd*|+9=cpۯ.j^_i8(?V.N^W"8M ~ _~we}5Sh/rv)FVKi+b4>'b b["p9y11I`%a]vD$GF)As<gR6YEt4)Dxy -!$dYi!)YMQbU"ċ@;Y%J"v99'2x*Ŵ'UO6Î"( d gYUFY#Ɣjhw[eŘDdK`dQ1H4.I`b\6NK -'`d?Vi*]jsEdIX` dA ,Y ,Z$,[oA J ĵ)8 , %,\ 씰tݣk}0Xu)HX`i%aZ"%,:NV'+aZmd$,N ale2)) p$$,p]D^k&{ DdqIXz6' , ,$,@D0e[L EdA(alJ9 ǠU̔"Z%t F7k KM ^Dᒄ<$,`HXW4%\iȂ [Di-aA2Ѡ$dAIX\xNQ$,H.L*JXmLH) `B%^$?H63E:Ɍmݷ7?Op?wRV4!60}kб8f)>Ӈ sэDGoEjnI1C>pC#"|m,kWJ>%m˚i 54;Xƒ]>ND1ml6ʈו[4O,ŽC4O^~7~z_);My -h=qem_cq1~Lg8??ϰrtU2_\2:־?oxiJq_4̒t4,?s]Ė& 7szIuV3&P渹\.Mv6h[IWI!҈ B8ϓ}^@m~fc:XEϝm$,[,kU&sm ;ќ(aFͪGxYʯ`I~G6&}e i[V GY$,lo覅 .+]CzYA@:x\jxejVgiA`k훊6^@!rV,ռ+򴵞jjţ+[J -~yc C1C>s}^jcgBP`xF+EYJ:Z!`Υy[=k<ʶ;ozžr{6j)FuJM[l7! K[!&xz[_Yl5Ū]?r^cƃqlyxZdntmaÂYLyڂy9 >W mp ̒yj"KY ,J3,dZ^s;|Z׆Yz-٪DZdWdZfiWv5`e*pl=?D% ct2n,su6mG}^Φ"O/zyQ`[7tp +f+'Gb-v#^oUץ -pvQߨhIjW_G᳙Pu>x~Ddă:Ws^N"fl"V'f{w2n`; 'lC`aŇ8`n,odأqZUm(m ' ֽ>eqn fc/[j8^GYkY+ ef kv٪gD,zYA%2[Lk!zڂ{,8ǯ[93&*]w -޻w3/gGct4KWU_;Y{>V3ݰ'ʓ}^j~{uVwy׏w6q 5սRj]dw1}q.Gd~z˖{lh-=l&T=,7C`jU`/,z{f 1K hl`?d w?w?0OD]T%Mt"6n;LtAa|bxzٯ9YQET",<|>{+?|WIR0'liv^"S'Xz=y=N9y+=JCWx_cr&dab}޿<'ܬkWT--@Is8t~Ok˧~UnݣJeϷ05wFgx!-u{]:C?BʸlMvq̅2ŞsktJ7aӪvU=qCRȫZv^+QZ˝_ƘkH$IWK[u]z^z+ kdK-<]fi|ox߽r#~s(o|==]g:Lz a̲Plr61\o^UuC>0iP*L{عג EN1}6g̴qƺhX646O> JC.=DG}Ǻ-Qq>--}";[i\^gzԝx@O{0dݒoۨo[ܟP1׶<:(ՆM&r^Nޑdr -K9}k5稥%bG=i^߽hUbTfY@DϠd:{5L/[JBdm#5Q:ٸ*7ՅNlsil9 #]+^PUF5eBFe[I .;UF=(NLՐ\kk;t|[Z5WwQ/ЊfjDZ=l$SZ%f7fE]k;/> -} -qe6rR^:ͼ֬4z8CoTBAfR~'K%qzh$ h{[.cY/О@n[P=*T%Y7kd}3VM43wаc[qM}hqW867SjޮOƈ]0B'w}/[:&IS=RX0mfЕV΂5Ali>i^#uEuA{sj;16a9Juv ,{9}k-2jO*m1iu .@SFU0wj)gD-Stꟸ=_DW%ҸhɶssTob$ݨ-NuABLUW-¿gνPuZ՟R ѩih-/V)`EXi>uEJLXY@"lh[V)=aN*A=)H"s) -f*E/~ +x͛[ Ss+H݀ +b4->88Aq\C~]vb;svDj$EDi|&bʡV/ONJ"j\6-̤%$n{H X?7ŵ/N1#/?J%Z +%Gՠ"GR(%2z, 0M)]l&<`|l<`&9HRFnV–HcbcA#؂cA,MXCG䱠q~3KoVMMly$~x,h +[RW[45gނIoN.ÖcAc 7ѻG=.wS<4{,@MdޞTj;ЛGb*Gr `&v5XVdr E>wLO#p(X3kl~9f5y~>O/b=ӻ/~ѼmbxWakODm2 acF6d`8t3#cmq&blOWb+ɮ}ϯn+, uU~:gF>WW4>R"p]L7O_~_0:oޝ_jJj'MV aEPCfz<^{OVv6V:ҽަ;d뷣taS^ꔽt|,-{+memp܏:̯~~#>mO͍һlɭ{m};]x>|fozo {=}ˣNopƻeWl>SkGijfOk #E'!OolZ G٦5v[nܴ-hEIP='nEdc_NzE4ErVO)~YOե;Nl,}ڵ(ӣ}+E ~#|z ݖnؖ\u/窫7ϖ{@ >q}Zʦ{"1!]`G;nvsөXǔz@re eZeCc{ա#IcpoʼΡlPpq;:1v7>c/`V apSս'Ήe;KʴlqO7D=>M.h^Fj.VnG j+7~.=x ɲ 8-$ٲ +o+{^zk&1dP2 ?ap۹o=YlL8Xr`gV܇7;W:>Z[d_ء +R8,mb̽t+~87ꈱQ/іr8d@v[S6y_ԟO6K5z% +!|/jARmp6kY1 -t/)a;S8L_],rBr+}p]jo{7ҐbTk1Nrr7̡_FNwa큤^;ZKcʨU筭{~2C]p#|tH~y-6}.qS1ᔊS;MVP꡷ +eiw+xR054Fu_;iA k7I:i"^ו./ێ ǴYQO1Y7hx uN&Ю4}Ȳx&=!xq$2;6sދ݈}ѭBa}\K(YչCqQ۴L ȵz_סk),iet.k]=R)avec'OgIڇa3/c͑dOі,sOF3L-"BZ;./QK)ulO\]/SLϫ:*Éi|W+Ȗd$@i 2f͑KVG׻TgMڞiH)]Oߧ[,VNBίtP+O5g0DEu9{>+?g%kO"ToyTmG8<ݸvb_/V{-vOD endstream endobj 505 0 obj @@ -5841,33 +5833,41 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 100.323057 101.433071 81.573057 ] +/Rect [ 101.433071 713.673057 101.433071 694.923057 ] /BS << /W 0 >> -/Dest (cb24-1) +/Dest (cb18-1) >> endobj 507 0 obj << /Filter /FlateDecode -/Length 4735 +/Length 4866 >> stream -x]ێq}gK%z`^@6V@ ?NK0z ya2Xd4ZiT1"/̓'#Wo4Stp);|jEap:?!$g]_w&W_W3v׿~a!T *rn8/p)I*Z̠dLTfX -ڮU fIR \TZmu0DY#<K:I.@t>vZҥ{#Ғ-dctXo-&+l1h$"l-+-\D.AbkQnpZ%iEF:Ag`W.:2ŸO8bFmՒc:؂Ηxآ(#h`^80P2$vHQb@!XLr$JCgDVG^ba a:bI\` lA -lK@tK*i ,X.TX0$.\@)I\`)qb ,X:o$.]KK\`"-`h%. *H\@] ##qzu`bTxDExL. VSfnqH\@]CK\ %z]P=tJ\D ӟ0VK\:D]t@ ?_~]^5F򟆃0&$tqc9ZI˕TҠ9Fa0ePoG!F.)l,<30 0׿?.>^_(0]`2~80;ֱm4N.jS46-%-g8PDhyjZ,_s7L8;Ev\P[W0 tn?oߵ HMrFCF4};?xL;i>{\'wozXٙe2,ؘ/z&NZ@&:7ղ*-5kbT&GJ5/&qL2s:–;8^!`D(<Fت7fOSs1Vr<1e=8bͽMh))lXx)靎5Zʺ[i{0kʗe\##Bv1? -YM 6suun4C)@IE~}s:]^~kYFݝW-u;*(B9R2:K:?;T:Uw~K[gg#}%%j9j}|aVoy&M/R}3Oc/ srn}gozZܛ|92"7V3g}Y^}mJ|`ӡv'_hUJ]%m_usbaOC9Ž=\"IR\w魷4XcA_ٵ>,>;+t̨QuY'⧣͡Y}bG{, 8,=KA=nQ(^1 k[m;u#ڦ] wuWƛƞ`!9Qmժ=y[\6㠦y% wzg4uuȘ~顃yNV'0]_Qw#n*]bpwyˣ޺@$gyfޟ0]|Fv%(yu 9~wb~|ѓj'h8tǼqE٭خ yl޵u0x0ڿO/.[\<&vs?X~][HehaU[[\z#n7yn=7` zi;U$;P]<oF-WDo_g.م9o|^g4L~o1wgq&U;Kc?w3(ӧ<]9{Qn}\>UxzHWcx퐮DjKncFqsKyE[0fDZD?ƴ7*~x$ A1 矪E:',7 Oiݠ柩/`~φ󻜍, Sł9^ՠg1/;bfkԦ֌bmU#tkjbCєUXLoN7ݟӚt=jm/}Y.*QEfRt~D F YM00f QIr:At\PRŚ5喯TX^m4Koڌ/&C+UlpcVQUvqAH*W( -mSnGUR| C3xg  -W<MR;N=,e#r_Xjڦtm{騄L%uiiFR6IR ꊘ),OV]B\te2Rno8׼Q`> oFs%UlTjeRJo8N}kY4.Ӝ$V}Go ]q -[­ q;>}2lXǚe4yܘfWsJ]Tm+t )56-o]+GkNӡ'j,o2A{:8Ug|m'S:d8h aSa-d@g -u5NmY6E.mڂI=OdGK [+-'BxԎ~yX;*omRmƞ-NNյAFk9k+,[T'B,+%lf8OQi[ڵRѵWi<oȵpTMY|(|HYuڜUC|LUV)gƎ3*jIk5oy(6܏#"9VքZ4ai_6K'gKJ<@U[6n}=6ǀP9 T-;7 Jޮjz="|2zF +x]ێ$q}gK~`! 2 ?tNK0z f̌iJޙFMUF$O7sʹϗO'RWS,p6'L9?%J)_Oouȓ~y٪R5׏N@T!l*&"`FH* _rT0[U'㶪3l2^R SBTFcu0D{ﬠ3AEtzt֨-.AgtΩ Fc Yy6.`גxEEl99I`EAa ЕElQIW +%{/ +t:YTiIg +uQ-Q"`KpJ:[<$x"0[-ntX-|l-:E06% >K,`sQ>%'р-AXN謑i|1sElqK\,lA -; -8ЭH\^(qL-q ( 8ׁ;%.p ]L$q|8FK\!-`GLvx3:I\FV9k k~}2W}702Uo?מ'Y0wDwǥ: #Wy'rZv[]Bݞu1MpzgY=ul2:@ =̥'r%a]oޒsKjܵ@el[UZgJ`z=M;KVG׉>WBOWRy >}<h%yt6뽀v:s븙QE+!\A+ ݩm\Lv<oǢw^CwC߳k<\筢ޫWXnޢmeiWtؒyCQ֬wOenUwô>Mui^nmi;aڹ]S;d|ݴ:w"18NgkceDZr輖m%W|D~Cs0!vS=adL?3|WPv/v/8P 杻GFJ>VWP5"%)}yU;jq?ТvǑpg[?wl0y4$q={l ݾ +)?Mh}_͚0PgT:Wiwv +艳hT<Hﳰ#=-jn̩x +zpf`CUqz-aHϹsn#K}<Нr-R_Ev7 zƬmX}ȼo}%Ͷ+y4Ґ VﾔЛFn&ݓІ5W%kCR3Xf8MM-2@+{)=*~|m!sZWO~oInz-5Y"mZO}){FfV2j6ZM}fYK/8Gh+)3=#6kM&S;֜䬯BSoGtzXv0\MmCz7YxA{GLeyo Jq#9P1uZ6z¨-؜*VLbzHVn>% Gb4PfGCM]g6%P[K_E)z.s̨ҥ8 "zFnE{ f׳Q'9O܀{ IL7H*0e@Flh~.>:3؍r +!٦+thB^4UMF']JS!EϲG]$.uƧuIcZHOS[HY1y*<"NKb?+P7#PׅxT W {qũw{{ Mxͯ*b10 0ăF_NsL2^N9U7g]tt޳,s;>@M~sB=)[O&<҆ǭe|Gv=4AMra}ĶCz&^V/ᰧCG/G7p 3r endstream endobj 508 0 obj @@ -5877,200 +5877,191 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 507 0 R /Resources 4 0 R +/Annots [ 509 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 509 0 obj << -/Filter /FlateDecode -/Length 4847 +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 563.554475 101.433071 544.804475 ] +/BS << +/W 0 +>> +/Dest (cb21-1) >> -stream -x]ێ$q}g%x}`^6=H0z oɌm Jite/ADWo4Stt]8|tןX`3__/o^7YWv?*K!('TJ[Aq^Py)I*ڪ̠dLTfX -nU fIR \TZmu0DY#[<:K:I.@t.>vZҥ{#Ғ-dctXo-&+l1$"l-+-]\D.Ab[QnqZ%^iEfAg`W.:2O8bfmՒc:؂xآ(3ha^8P2$vHQbB!XLr $JCgDVG^ba a:bI\` lA -lK@tK*i ,X.TX0$.\@)I\`)qb ,X:o$.]KK\`"-`h%. *H\@]L##qFubbTxDExQA+qwC$ 5N kx h -qr8[@Cg(l1K$.p]9 ZtL^'Ңz\E{$.p]8*+q>H\SK:6II\âH\h芺 Z2 /*ID]X$-qxQC%.]$q*ga-6 @i+i2` -IU#,J$q۔(q \ |%%.IAON₠ p,Q[(dS b ؂ADK҈l\Dɖ$.c=^t,1E]N BXK\1%./.I\3$qAHSE%DN ҅Nk -%.&bXK%)^gF "CE 0MS:Ëm'q?Xlb#`u$qAQaQF`כA₤` "> ơSJ₤#֛$.f Y&x¼Mz3H\8( hJ¼'a vtD$y%.@&"zqK z3]LK\ 7Jk{u񙬌⎁:Vq@{ᭂg@F7 `&VыpPj%n(/1p}iܢCό0-}[sdA؟x {SV4_av5oa24X\mH, ",lln?ll,rc%yEtܓK',"0%oshr@L탖m}4;Iy>V8Bu?v{w=:!0dcf`m)!(ol":f ߘ VX#"Hca -ZG*>]@Ŋ>}GL~75__bݔ5ٗ/rrsR]VDE!E5KpmϦIlRҮfkhjGop?WEwp"]-,=/'5$U@a-Lwl<;Mlk}.Ø.5P2p5xdg2VHӈFIIBM3|W=@΂=D-"!gI#[YMLn9Lg^,:mLR #tt]==PP\00FvUSҸ?5SH=3ǰlywģ'<2#QB/Ϝh #mר؍T WOeT8k΀)a?np[H}tޏa~ 2}.e}ydgCُMŅiEWCy!%X?G>6o9uOW;ggíGy>@#u7;x\C~lvWncnkyqZshϱp{kڀVk'r~|OԵ;<8č|Dm"y:Dǚ9Z3ݪyݫ3;6N\gLe4wĕ'<{<: JmEhT71X-O6i,sʯ8;>ͶO;gZ1;={ָiwv?؋6D eg/\֋2HUa9`mw}C{E=BtznoC_gU)VFK4dz}+eJcRNx%6t_*f5'\Xcvn cmfTyz,G)i8 cC|P]VmWkܦߦj-;Vn870ߝvcިM{KZ+>sCN@cS:΅gsd5?`y"yuHC2ӀҖ[[acឩ:2V[txXiqA(}9M1? hQn0fR`楎=!2'Z['y~]Σ)̲H]cӕӊuLI̖u/mqp=,N^ A?=9<Vxۋ߱O޹TQ~(7ޘUO續jj[\,1m9:s2ϓ $<'yᔓ{zGjGaz.ӡvy-@Ծ7z-1ΘgCԺƗt{A3T*M_֣>rNUmo7@[~7g#q=vŖ!_>bߗ>p>H5X&9Q}-UO"ZߙAwXIߑ&?e@ʦ]LSdvu?vNq|#4S^d94ZCW@p(_x $Տ4oat~Ն_0NB0ܱ g~m-Uy0%yD >z8zů~9 b¢𤘅je ^ KS11&q5l6:R5cW,뭘[]r)| {4bm t[bCom]绰>v5a=j,}ZT]F&u5ej$nAEQ~ޅZT ELWJsmBK{T{ҡncxAH0Gb>Z7f#]ₐuPBoڡ&KU*OULTᚔ' =WMQBO;tav/Bz&ݖJ:t @yźj45(NצS2VnƝ8fo+w|޲cYЏ.6y^ 솁k)|L˟. V;(K_i_%w?nTc Ӹu%=G<)o6mXǞU44?nԳN5n vއ4mq;ԋ-c@Vp16lwסH\qҡ%3dX(. -Sle&ru=OPXk]G͎EWYnŐ!/ƂI=^x܋ɾ6joQFxKl>惕ujeaC Z]g+ X)U٪(]@Mdݒ[^ --?=QiQ\nx-Z-r#Co)[,s7)ʶuӺmC3{dz6I.{ܹvT'_ GM:Xc7=8,akyJ;"ud ñ*hN;لW(ұb(~ߝ-)Ioa+Ӝ/5ʻyC]^*wYz#JPZ~:Pj$?3o -endstream endobj 510 0 obj << +/Filter /FlateDecode +/Length 4963 +>> +stream +x]I$qׯIq_c X6 kI0/XI2TSF X2_*NR]o?_~)z?⢰_rq:?)fob_pɛ_/諙rF_~"SL1*/2XJ[A`=a9K,3n͊%p$ uQ5+C XCgVCDQY#$SHdH V%^0SkQ‚W%,@.5%z K@ 𴓰 fȂ"a\є "s! l 邧@D$e%a<4rIZ9Eyf 0Q(a 2M ȃ, ?l{ D# N‚ I‚ QF&Q‚ "> +SJ‚M$,|3IXBO87AEAMY8$@' N‚I7ы%Df]L4HX 䛈l^x}D|&3eI(@oK + oŚR$ &2Ī*ZeEU9Di!o9Gof7cן|ۯJJk +dlG|cqR$!| sR G !8ȋ2\b|f>"GD>hY֮*>oו$}>JV۶5S2-@k:iw|!($blq+h?\rd#t?|~ +=vϿSQw>?'zEz̛8^ k6^\V̅)zq~ΰr圴*/.Uk_7fTwA?Ʊ]Yk6Zgz{`* Z|I4':JQjGi%r+X--`I_lږQ 8i,ȤJоrz;^Y)6hFgݙaodXP| !搏\P1|Qvw0>oWgSNmYX5ѓ}^cφT-Ө1i;c"ycޕai+D/>Qo+똭X(3coP"sN[oPb|YZhC|M`T5?SY6X(*_fxŭpeQa!C26 ԛlV='%2K[e-/CuK-?Wcsa!*eNcӮ.Fi8:r6}|zkd㌊{]Bq}ފWgg˝מQ7ɦ[PA_G?^786+B#NصDI-Vxl:ԙVԯ"#x.*)[m3[{Y6=~/dƓ5׷aRR YF-lC7zZ\[ꞈeOy5Ku=Gj,Ox۲}nXV"ѳwfOy9+ޏ^[GFުKrQ*Ejw_Gz]᳙Pu9x~Ddă:W~s^O"f?m"V'f{O2n`;? 'lC`\BFC x,es%kCX0nd7 Ϸuf2bQv8V۪6r^e`{xf1ĭVOy5 YVP5]u2G=l3c |"=,bɇ<-H&5OM=m==]:,-ZӹqU}oz'bӓ}^BXÞhZd*Xo >,8ǯ[93'*=]wf-xlk`͓}^~NJ]]f9WrxPۻzCx[|e=R늄'tx`C= O<"ӧ^cCke31z>fVǭ{f#Nݳ6KhY" < S5.;"Z[4oߙ')VI#a3DڼMm/H+ufi;ПjLԷ=n,u )^vW;iZѝaEm65F396i?ɳ7y'<=kqѫUWm=9T]iܽ ;(gB.οc},"mgtk +25K>عZPw7{2m: \yog{֋l i{2(C)=]sj("?W[+{tJ7aӪ\ڪFWVsr/k_g1v "zVeWkWofaaiwT{3,;woܒ]Q_BOBzVDzϳֻ3tzD̲PlrSXm.>/I:Ny|N<%arKf$<9&lNä2zn5,ӕƾ<(ߎzT(QogRo(Ã1׫8솆VipΖ7[_< Q^Qo75y NYr]m21׶:(.ֆM@t^O5&H/ =RclcV~Dx&U%>}e N7-fe72[ +&7Ҝq~l]$A4iCߢt n*+;)t&]=wOZ ) +z;yF~1lH[jR:F2֏ }ulLjc9ݒJ)-ZgXoԌu5nJgj#[^j|X gk2^Mz&/WB݈}@{Ctl\GB'6ѹ4Y9E]0"UkTY&TnT_[ qm"Suhl|k;1UCr]"Gmbkz\5EnSS@*Dcgɔ\VٍYoIBk߱BjzhٸTN5p4+^IS=VX]0.mfЕVV 44/~x}"zڠQ9- d-ay|E=]Cm,ΞmAN?=p nz瓺J[LZE Tc)ݪZʊbN3״ҔU[z-ynαN-L-ލzK[irml zdz7j=sv}Ԫ-wQ;U +K4pZɺ"Rk%|&lUQC"lr%=aN*AAs .#ED_o@S %-' +endstream +endobj +511 0 obj +<< /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 509 0 R +/Contents 510 0 R /Resources 4 0 R -/Annots [ 511 0 R ] +/Annots [ 512 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -511 0 obj +512 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 381.573057 101.433071 362.823057 ] +/Rect [ 101.433071 105.123057 101.433071 86.373057 ] +/BS << +/W 0 +>> +/Dest (cb24-1) +>> +endobj +513 0 obj +<< +/Filter /FlateDecode +/Length 4732 +>> +stream +x]Y~_,(^@ /Af;6q;J-J-u`,;VctP>/bLǓS7 ; ra'RFOXEv1UJi+B0 *bJ +f@3(E'`UKU&hT0C'VCD QD:Fd `$ti޻(si"%` $-[%`J[ Z' [(`JKd"KЩRg\VI:lZQNAK8'Άjxt[esŘ@%0% +$0! I$`(RX4PV@>-UőjBDX[@ka!+q"qݒJZ % 3k' ,(PJXpwJ\`AA ֵ ,hRX%$. )` ,qq:Z k +xH\^C/q25Q5S Ơk2xא(Gxdw`%.|-wu'iՠc8>Q¸E+$qb8.3J\0 xW[ԒMR8.'q0h8`~tE]TQ- 0 *ID]$-qxPC%.]LIUZ Q; Dl@MQ``5F`` \  Ip[)J\&b" 8ZUy3u:$.LZA/q~`wI& B-*`*g.4l-q<]贖 oPh"V^I\kI4#(qA$?(q V`JQ[@x$.M,sDl$.r3J\#l1H\lz3H\l'qAR~`7Y8tJI\tzӐތ$Oz^o E8MI$7NH=7p3ބG/"7.ft]x^` VZ+ deg# +0!lĘI L,VJ (/1Zp5Ԇ<0g'0,}Ysdv%5>wϞ01R415&oӷ 2vOZ4j NA66 +;/,_ͫz#? +IuoW4zw\cs8̀-w?>_O@r~ L&߁=&5\Xi>ݗmىy\Ʀ  -O[MkߙczjbI#gh+6E9C4ݸo_k7'~}t|1mN0y?SyrܽYaCfger;ܼbc>S8jaйk-38Z)Ferp +oT"9)X&ӝySr 6hvu;eob׈[[Lzj~ :|Ɗv9lg2R})m eg w 5ӱFZY{;mf{P4ϛ#wdD(.[!kcr2ihg{RsNٶݍ7=WR`/|23 h^ Rsg +^d?tV\`gmxW]qW +x~$ywp 6F!7?f][\{w97o$ו#r3M?l\Q5W +Bs8V 6h[ٯSXA՝yڍ%7hQv9Z>MxKtueY{3{ccZ)%yڍ~χW)qwm|2 +=ݙpr$Ipݭ:Pcy}nf׆Kk/1fDeœ#j6n4g=ws8y>,HT޲H/k.z2Ex4,mm!l5 +jv-<]!P+o{^ytG Cl=qa.R :tW畈6I/8iygL#cv97T0c)/S91S}|WghN/了{hzr9am?wR&i`g;3:ҹذs\ǒjoQLu3`J?t۟Y7*~9x$ N1 E:', 7 Oiݠ/`4. w9Y@*'[ Bz)Wļ`t)g!RX3nU- e{4GSWa1m:tNkBӝEfܺFmJEr!TI]NS&tf7{\1J IL7JO*֬)|5BllIxf}1Z}b^NH◓ BjWB Vhr8*{.04wTኔg@wǩGEo}=PMU8hOlM8uJLm8l*Lղ ȶl?]aq#Vi-:ƳhA[04G0>`i"}iXZO˜c]-TʲسɩC4;h1Hc6%pmeJDQ2eĐmS,GB)]+]+~3^lq\ PNՔŗ̷jJe˺i^wmiP5WTln!{d;sI ѱntƞ;{p񖧁b;X2"c%mM莁UAo+&@MQ/ӾtrSPP>jcls KE޲yޠ<|2N| +endstream +endobj +514 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 513 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +515 0 obj +<< +/Filter /FlateDecode +/Length 4869 +>> +stream +x][,~_Qφu2k1ЧffY_(uKeTfvMP=M%$}"TfW +ED)x{}"EprEV]A8|tI`o7].ZB$C H(,E2)r\4l1Zs\4lAq"ovy[v}`a "E d"&k9.c=^t^@׬.B!XW8.ZJDLz @% `tr\lTHDȜ)؂ D)qA԰ QG2kIt5֙hPL4&8.bq\X:b FMqAEKqIqAIzAa2q `^z3r\zK}?Oק5h-,? +Çg'_eP\AOCo`Qy>5Loqs۩myݥJMWOy6 cd3xa8~D,hJ!myi 9LNʚl"Rv]1;e>]gieZ,p?BcX|JAwy=<cӶrc}[ˋ:B+9ͶO;g1;={ָiwv?؋6D1egD%RˈJ' el)ݖ9zPmK^e{}ևu+c#\w闆p[VƤ$;z~ ӊV6,#g"a-Q_pZ6͝~Yc5+}ݽ*XlRҶ;\ =\fcH|?r'1Z]f76UoYr];s n75돌?}DZ: ƢiYku:΅gs#sPX^ʃhd.~`暽X`Ds~Klwr ܭ0y!=3UX:Cf~wK& qQn("9;;yc{HϭN}m[<= oQn76j̲hǦ+'똃|w@xdza}ۊ*4mPFO'zvo4{ 0z=)Oz<q_n&сR9Y]EN"ΌCqi`u N\G6w˒AMa4#9ZwFY%~b]-t֕xd7=I1*lfj;~Ӻǵ{M Zg܎6b d~t\8:J/Vbl.cיCݥCkc*LݲȱdP]FХ:XtV Ib,تҴ1ǽ i&}a$mKMsL>VY'oViAN=4l%+U:F*k%j/jGB)cOqTZ'qT&-[=^L ['{KFFMj{JSeۺmC3l7Tln!{d,y].U;!*iQ[6o=8ҟ6[#γW{%cMaA_Mx"+_%6}lugcjW K^4Ym6 +endstream +endobj +516 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 515 0 R +/Resources 4 0 R +/Annots [ 517 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +517 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 386.373057 101.433071 367.623057 ] /BS << /W 0 >> /Dest (cb27-1) >> endobj -512 0 obj +518 0 obj << /Filter /FlateDecode /Length 4697 >> stream -x]M$>H' Inc#sϣZUj{fDziUTX,Q-}VTz!zNjVXbv0¯gVG$ ?hwϧ}rϼ>!Fg=MR1 >xP)M{crz%(`lx0c -f1APA5-UfYR TZmu0D1t$у DQH:yVK88lt [lTZYb5t)xI` 9RIyb;QtQ[SZEl ̢.BKQvHI: lÈt8e-t[?{OO pEq0pLI% a#u>V#5hqJ%#1凙0TN1_O&cz aNoA2Fj_c pJxĭX,5Xw²/C*e @9&v9"CR?W#iDS6LeOZ -K8\PP7ciޓ&er &yƨ󜝷acvqn$y~.Pz3D\3o!Vx;^] ! -2Wj!+Zߧ+ - -:te>*2zjNӗGLN^ѳpW6l mc\ۜU9nj=P=sJ↟2bk<gjs7Gi5Lw90owg܎ 7rϿPti~Ms_C _ s8nė~ދ 較L =.w]Sld?h[Aͽл| TJoAP(^]l6_ :CF<{(~o5_(rQ<ubڈk-Q]D=o*B&m!t_!v\x-7^P$ E&K^g>f-GM;m3oZ?诵Of]\@츠B:CF dvDncۖamjrEr;rJc/<ͦe_[}9_\ ȭs4dbvU!zMt7Z9Zţe>˲l^&-s8nW >J [Ur޶(|Z:w,V@>tg!vY"g Vz~ESQ1t~%"v2p{;2O 5Ԏ?:GCvOqaife29vkut?W-ۻTuKwisJ/[Vw9:7 ֋ѾV˜i?5w'J'cd>s8dndR"y2r\٫u\/WZ!xmĦ; a# ڎƷBĢL [Wpٲ_37Duw=sgV>}s7c+\*o>=;uX5wGcAND^fZ~xAnhCߩn?d,K7x>!-ntlW{or2q:GCcyu,vyn}kig=8,n9Fhۇvc~i!RjnCw9r7w`kʷԾ,Z ά _Md-:j@TE6eӻM~tې^aI [՟//\_z׌[ 'rIS02( uuuKar˕ܤ;5} 7H6 ڷӹ{6ls 6_m?=J0h^iyv<]>R"MzX}^9Rjz7J K890:\./?ľ$KdGcդ6WK` !j:W]aS6CXlmVkR.9]u -m;o /'z(MoM5Ȩ1*%CI]NSf8]!K I,7f|)j՘{RNt hrf(b<}B^NHBi[B VHMETKOYR-<RMN$"wR+wuX;mK{_0J(H.=66]}%*1낺"Npe+TmL\edN7p*v;[/\n,ORFٮV@ -U\iyZicdҌ{9}w9CD|p[&(K2_'>1:Unۙ,8wga6pCUC-k3/B釓U7/Y+{> >Zö髏Ng3茶I*T*IPY;xoTN%̰ /Ufp VR 6&3* 5K*J+ءR(f2Nӝ3zp!(Q[ Dla " q7؂ADCԈl\DɆ%.a=^t E]N{ Sk!`K\R$q̀N>  0 2t Ȗ.tZK\ lA4(qA0L$. $ZұJ qA`7PQ 4&$.bJ\X:B%.f bLM/qATQ!ơSJ₨֛%.L qA$&x¸zK\X( h¸'a vtDz3H\0MDbJ ]LI\7Jk{ iČZ̭b@{1[y1g@i$& `&VYLPj% /8}jSTp3O1,}YsbR'11S44#005.Is"d! |N2j-NId$01#fӄVI +XY VXau(C$vW*:Yq́|̗X wߟ>ǟ=;|_zr_o>ToU Z62 ڮ@Vǘܕz4o;+c&[ұ۞ݼΎxjg,^=W}~û9H>\\p2$q+s <ÝlːJDiFu*HE:w{fQ鯺Ԇ -~{ӱV+B;R(-Ts8TM4~$Iz>6\vI18{!1le?TD-ʽGy۾-W+} _~i[W2ƨnnxg6Z?GKA}N[#&às[Wp׾4^gdˍW;T92w҃YY QSv}Owk-Fa&W69h;.跐ᐸ7}$ٮض7Fu[o\sGam :CkxXAK3OwiV}W)Ȩr; q%YS^Ak3ݍ}u}O2xctueY{v6qlj9j7ą?^-*9oe>-;+{ v;,|3IR\w=t)y>vvmy@?OejFTsOwG:9iYw42y'F+ ̻ 8#3ꆯK7;;ŷz-.eл;JFkDvz.Xf#omGV +Uj7`k Oᐸ}+}&b(fKD," od\v4dmwo6 +yk9ud2đheûres~ZwIHo5<76_s8tn;=}9~k<9}NOZo+| YpȤlE*eY VS#ƣW;_#^{o5CMw9BF~W5zo3VEJ|;~-efnJz |~n}WU|{v96j.n=x-حtǵM~HSSk~nCY^n`7}Bzg!r;F_[(H=dYħݮs~u3;.좹3/XcC"3Ԧʇs8nCJo}Y $}/?߫/\_z׌[ 'rIS02( uuuKar˕ܤ;5} 7H6 ڷӹ{6ls 6_m?=J0h^iyv<]>R"MzX}^9Rjz7J K890:\./?ľ$KdGcդ6WK` !j:W]aS6CXlmVkR.9]u +m;o /'z(MoM5Ȩ1*%CI]Ncf8]!K I,7f|)j՘{RNt hrf(b<}B^NHBi[B VHMETKOYR-<RMN$"wR+wuX;mK{_0J(H.=66]}%*1낺"Npe+TmL\edN7p*v;[/\n,ORFٮV@ +U\iyZicdҌ{9}w9CD|p[&(K2'>%:Unۙ,8wga6pCUC-k3> -endobj -514 0 obj -<< -/Filter /FlateDecode -/Length 4679 ->> -stream -x][+q~ׯгy)ހ` p`8I:->k#QQCAYP$ Xr Z⬕ Z؂AD*D.` "E d*e" XW%]*EеKЙ(qAXKI/q^q$q̀ΐ1L T%-%.@ 1$ [ J\l*3h ࡱDWK:ҼL$ -CE 0MS:Ëm/q?Xlb#`$qAJIₔ`V`כQ€a "> d @i-qA6 MK`^z3I\zKU9cײ];s7е=KϥFK&pP^-a%_V}3?׶={~'=(i^ێ[?W6!:f/O'6?iFcBa1'l񯟊qys0ꊫ}J,Ҭk%EF1fRnzb`V![Fu/=ձP8bagͻLlXy/92==O)a=Ʀ(ܭbE"'9NBvy{вX!!NoreN*-39*y,7ϼKz|IH}|')gLì|mg&׵͓m=ngn{fA%l~6@(-h`u}&Y{y}= ^ /7IKoS_UOg#r -)WҤr,σ ͷzљXgYm7O<6/2i&(QeQ*6M,K]aj罇V ~C8d]hhCu/Z/FU8l.5P`r&qʪMGḡZѵ˶cc 6u/){ aXC-vvT &W>rNfeeވ{~ \OGf 8G?v?|2=VԾ 1 S*gpg%xcoŧ2ZC[@`dE<ְgo܆J@a=?6Ry> -y8ޏ?ހ[mt]WH~L ɓޓr꬯}ݕfn Ǖ7.Ľ$<Ǣo⽊gͷ8#3yϛ֫7Xlޢm:^ŵeЏ<᪪wO˃?nQ?Uv>-uVnXm;~ٹ]|P;D|a7(y4|ŝc<՛8,(w>jcc.qC9be[rGwD9<G9;F4쿁aGcOhp?7wsFW7P#% -+ ޾<jGW `Hxc[߸OFbv"`GCbe`sX ^ݻ՛5k9~%7uP%O5Jw6iJ#BžW=PwpGjŽ) ?=k|WUS <ޝ⦝Ķs܃z/EC w<Bwiw[ڥwWobܼW7P<|sWOcy;q흻Wwqs~3W7:Ƥ#VBy8) {4b B=TŖ=Ol]>vq{ պY*JNnrfb|RWB7Iwt)M'L*3 *|2\~+N塱I=`(Cwf2I t[ce${9Tܜu1P>|;zo!mܺ!#/fTa6@]lRO+vku'45M; -}AltqC;ԋ-ұ{t|Dxj.2u.<+N]:d Pamd@gi -u C먻ٱ*+ vX0ҼG0}59FM:J[XOrr"TZYn{9}jЂ6#Fi~lSiu. UJզfRZ^-ҿ=QiQ WiZZG8:SX2 0nR)]]Mۺ=͠nH葩Uw{x򮔪pdҘN!C,"RFޜ^H+kp(rNGÿ' -EW Eߓe-6m lu:'ٔ *ۓeC]F^*o9zIF>)_m -endstream -endobj -515 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 514 0 R -/Resources 4 0 R -/Annots [ 516 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -516 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 639.873057 101.433071 621.123057 ] -/BS << -/W 0 ->> -/Dest (cb30-1) ->> -endobj -517 0 obj -<< -/Filter /FlateDecode -/Length 4920 ->> -stream -x][$9R~_Q+MUBF40 -5}v +mG:#/U}hCOe/pKWibL˯5X\U+&K&PBr& 叿粏)%oKfYB A9RsSy%$ 5+@ XVd5+A XC'VCDQ֒xMJd `$NK4y]xsikă,bx'% $^,I/BXWyEy%^ɥhKg\$RO6IDa|xxȃ,xY,J<pZM>ݤHK<Y VAlC8AS% LMJ `"M6(i!&$ 3ZRY/!ibqrEdd%, Y@"b,IX@@[ kV%-ao^BL%aq)z+araJIS K K6z KV+ ,p=EdKXtHGwI a KX[LJ 5QY ,p&Aw$ 5N ,pX%,L%F]@'\; DdJXzJ@2F‚` B LI#s Y)JX$bV‚<1hUy3y<$,NpZRSġ?pIYpT$,+Ad.4dA-a"]𴖰 ȂhP‚h"L$,F. UK3Ȅcaݷ7f_t'8R)5"10 }k,04ʟ"!|O".,E,$_s]XH荼Z@BgDet>pC"tm,kWJ>%+mMi" qw|!($bY>/g3Aaa4^`xwkHvw0>oWg SNmYX #s5R6ܷs}^cφo>~bCʡ;=3mgh8jޘweXZ۹6me}e]cqomCqMUj}BQdim^`bʳ|ϫYُC5c;n<Gڥ2RGyV2+n+ ċ`Vbzm8ReݰdzOy9KޏQY*ky-,c XJ,\E͡DaN<;eNZ] l t>l qE:3*uG}̌RVD:;,\nH6= -_l>/gY~zqŮ%jY'cĶR~ pqsQI(p<O3!GuϫY# j-j6j f+wj|ѫnϵiOIJ'Dz{U/8ߚsCzްb/{Y~*{w6*D=! -pvQߨh"5!?Ǯil>iyx,TEݤѡN{YAY |NVXЬ.-b|b>Ÿ kE0c!P͡ND^d0dWd{PaLJ8`md7 Ϸuf2bQv8V۪6g ֽ>s fc̯[mAm&?s}^:8GYkY; ef> {v٪gD,zYA%2yZL[!zڂ{f}BX9Z(Xcux5Sq>fwgphd^XS{*3᩻9Fx:.żG5O??STnp,a黊\f%~F 5䷪Q~,+ڨwh8.m c=9v[rneZ-+k|.g5K{$GZ-;K[JWy_l=ji}IKX"Yy]cPde)4I>q涱GzhcP꟥uAcn]s>]3[33qۅȁfN>BQ{` &}ȯp&& ̵Զ949 ގzXx(Qo'X6R&Jt!SJ:OV7Wo3 w[Cu>< J4o)!m19 ?/ - 8M^68lr5a^e0!7P9,:P~֯J>=+ĸ?ݱ*ăt{ǫUL^4m_e,bjq~2X]^|rvʡlHڨM(V_7zYzE己7޿]-E';IP u#& -dk'sGƲ6l^2g/FYW-Ԫڈ < DzMΫWFDodn>m!YbD&*6]'u\ummk=iiu]DFLԨlb> E ~lkX ɶvHn͵ -U]S|:ŦxVt4SC$vFՏKr.VٍYogI BkױBjzHlFKgp4+-d7 -רymIe>I>T:VҀe!4Q 3Mc *S[7XuFVӰUuk w9];Nɼfڸvsrh;[ϛm\fx+͎lNF5o'c.@;r= kIv9C#W{7iغ sO)$節vlXco54?n kۻ쵥n]!#fFӌ!-@k;%ƫTe<.ʆUn]:ְMd 1AIo #%un]ie B`|`i! } S2Lr闗5_5"v9h..2jOj+m1iu .@SF U&?wj)+B):\ӎJSWmhZ9:[X2 -4{7-s^2lTnn){ UU[*!:Y:ՙ*z ۏ4pZɺ"Rk%|&ldTKPeH 6TT[RSP -0V-x)Rj!K/)1WWPZ~"P>-'-z0 -endstream -endobj -518 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 517 0 R -/Resources 4 0 R -/Annots [ 519 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj 519 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 111.573057 101.433071 92.823057 ] -/BS << -/W 0 ->> -/Dest (cb33-1) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 518 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 520 0 obj << /Filter /FlateDecode -/Length 4733 +/Length 4726 >> stream -x]ێ}y I $$L{F0`~NQETmzUK<<,.g/$ F!D$ooR?X]$~*ί'_O?<{R=཰*B%fT+N1FN37,Uf,FKTE4 -fh=vH%!C;NBTyWNy#tqp lQHNgaN[9آ5Eu"  -'$z1"t")aNaDgt -8a#-V 4l1t }hU4ВYآ79P8 -8P&*Ñ -z0T^s4-$tJrDlqL%l1h8. - Ze4lk 4ֈ(9.[#@pa@qup "h.@uu &8 4xW)8.0]es\`F: A 8.0]w19.0]eq - UV( xW8.P`.(lr\:9.@a[qʈ`A8.]}.ңřqVs D9.]g?`FUXԘ9xW(8.] ap8.6H貺8 ZR`D:?H r\#+80p{XlAq\: [fLYSp:aNG xM ' -^3D. -:7r\`8C1p\lJq\lq/07)R$*-oQd # c5Qɏ?fvc -cpgа&@ͻft:* =G 9}8}?| {9+ }k`2?Qa<# _w߶u*ZtGrouR51oߥӥ=|rpai6m|J[OMSKò_qf&W>6E9C$] ?j7'?_ȯoc|2?FWui.]Z>̒?6sӥʠs!vJO2z{;;)rV4n<6 2(ީƔΝyj6tތ`T*4~^+GjveF}3^H,hw^>%ta2cME<Wa?UXGu Hr:IېMz&}di~ YPRLzbEirg sRJ w:(s3Le<;m{P+ %Ȉ]j\(d%:v-<2~&Zm( ""(Z]Gn@Z}3]FF:ݶ},dܬe$m}DUsRAL`SJI I@f?*D4jؙhQwn݇Ws{~wߺoVO8]ؙp8">|`H\on_[Abmڍ}y~-1uf uGϋz/QzSr*NDצ. -q_[E]ws8)9s8HtB(yhU唽j£qetgmE(VPti4#蟊C d9h[A}ͽ3л|w÷kQtO9(|۷յjww9b7C6|ţ7OnГ(ޙh(~핫 4X]zs& -xwwfrljCo.nv_áv#z_xkUJ]m_—eb;;aT.$..U[J}1Ϡ/pi{bzm:&$T,H-]sSUQ4U7Zx+B ^V|ǽ;}T mj9tv:.Ս8LSֆ;e2Szw4y%iE٭خ ylֵ,n7(ΰkJ0ot. pmW6~7[:D*$p\8@zo32k>It f +x]ێ#}W9i/^ <;6q;b7/.u`vUT?(1ǓI%Y~;+ip*?_Oo싿_:EJ^+w=! JPIes"ZB$C H(,E2)r\4l1Zs\4lAq"ov{[v`a "E d"&k9.c?Qt^@׬.B!XW8.^JD,z @% `tr\lRHDȜ)؂ D)qA԰ QG2{I 5hP,4&8.fq\6:b FMqAEKqIqAIzAa2q `]~3r\~[79SV~oFLi7J,v59 S@sҍ+MB-MdB0.VAagmΛjAH3ru/v /,uvɹ 沗eWu+}yhS?4j;Cβ .sg~զܾD`v8MΟ7^ڲÇkvv/4h"4MkQ& %h ɞmLuWdžV6?gVʼt` `T7_u6)D Wx.ͳƐXN2RFx9.s-Y;yz(fTu-#C`CNg杛gFc\%vo;+j+L^^`CNt5W}_?s<6E:ĸݒX<'?n =ͧݛVs;n%z6uP!*ɖUrO6Pv'# M=zá`Fj\LFf_^r}OM'<zw7d;U{Muԣ(wdy8ėCvR_Ek6TX_͇t-iTg5k3=~~W(I4˧ciG}I(|,Jzَ_sd='sէTwKmٳ8"&|i*+=o8{+gsHcU&Vߩc-EC$e:u3Oc11O'GA#eG].DG[Flm;OjGLmYU* 544Ne;Ê>;Ԯ wUhe)da}Snj5ZPV +3_j +gRAۗm bed'tkkbm=C盰ꦿա-n(}etyi.QΨTb<1ˉ~"KYݬё0 Z.rrbͭ:Sj*#LiP7<#tnHS^.t~Yk;rr&~=v++녦klxiRWXEFjU*%/CqUf/:eC+ +b/%SH#vCC*IUXUE]\ e15P~].U'kg^upw&;_{q3jom|^cK'MevN )4q,.}kKyq/Oi4U换(K2_'{S9!vZVЕ[ޓ׻ăb"˦j~ʺǵڶ{)*텮a'Znd܆2b d>tnÞ.M9:{.Vᢿ\Ʀ3%&qEEK".Fque 3 }'u~O.Ktپ"wAlaN軗l/+ګ#i%<^j_^Vceemn䴥B 1Ic6p}GQ2YdPls2,#;JM}?Ү:*KW%S 9d%##}*)uvw6l3ķTjnU.gFsO΄T*m=87us%Hɕ=a:5FE_xț +EWtM/C%mͭx9!T/m 'HM)"} J"} endstream endobj 521 0 obj @@ -6080,202 +6071,219 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 520 0 R /Resources 4 0 R +/Annots [ 522 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 522 0 obj << -/Filter /FlateDecode -/Length 4760 +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 642.273057 101.433071 623.523057 ] +/BS << +/W 0 +>> +/Dest (cb30-1) >> -stream -x]ێ$q}g"d=^+?u$32+wP^O*#x 2/ -?hbLˏ5/Xdw  Gw va__]g]G_͔7]UCPNP%&Aq^Py=ST0kV`MI*a* AV` J* J+ءR(k:&{Igc2It0hj%].J: [\RZ9ⴵJK1H:[ȓu@.$Aa ElQ^iIhr)Z+t*&zr&:( \uő2`ŏO8 -1 -&EZ9bL`%0% - $0!L6+4h&Ɇ@ &SxhHgau lA `$qm-"qnJZZ…JRVJISb K K6z KV+ ,x5El%.;N#I\`Uw1 8+QI\`&*+q „9HXq8)rwSF 5x l -qr:[@ CgH46%8Nœ[M:&/qui-Q'; DlJ\zJ2F`` R LI#p SL6dyUIZEt ;!k "& % `tJ\lThӰItZh` A Xez%q"4֒pיQhĩ&Xi)ElMH\Ŷ,6u F(qA(#q qARId @)%qAMc%.f zKx!\+y~7RŚ9lJl4ՙxrR|'h9w&GFQ -ZGU~L+}zؙN#8wzR5F g??N͟X(TϿUW6s/C;7|GEn췝uKn)criwt/>Cྟ_O^yE57x|sU~ -t:d CXl⺺e; -,l8GMmC,uzڕ~I궶pZ2 {9dg"Vd(Ѭ + U j7[DTd{^:6{? -Ifx`cv#1rcԓuS먚aDb^PӇBѾ!Gj^ ǷupFh`SN:jl0;mJ#vQ?suI5% -;~нBܝypTX3bψ 2DOy:d϶#MkTf*ceלRQ& &!Oy6WZ!x/rӓuǹ/mvrQKUx<-5V Ӳ q=;"vw7M8]ތ:Oܴ܄!< :hzpΣ?w5u lk~isɥSuiqwyγ!s͏-n8ՙWY9\fLw@^yӡΞD%U\kT79XiO6iiAY#_qvw|m}8cwOܐo/ =Y{g?rxEpyZPo18cawב5cd?|۷]$avr\26{n; v^-zeOBi"c|)ۘ^Ŗ9ؑWOz?b*CmcؿvAo鿜KIΖllѦ|.>KtvsUιmx]w8+c9my1Qv\ʼvj:v9wRe~Vnl&;<s\3e|>ǫs+~+̣sqKu1w(,0 |:F/ ˏ罇Sgߡ6\~w7~>g9Ƅy͞J > o=k^8Y?pઽO9P4 l:&~pr谤 y ۢ49 ^ն1?ghϽ@Ur36/c6[tC&:O;Z,?Wr ̨s_?y7pm\:Y]:MUj3l?^|~o?U>NѯN|WBHW~^Tdu&;5K+~,vp~ }w1 Zb;UGS9)fUն. SK5yoj\9J5~WU巕 Bz+W^^8r)|ɬ -[/l5NBu{47a5w5#niR~sixר*ΨTb8 E~JYݨ;1ga,@\*"[ZsuB-[Tv!~j -06|m!Zk8aajd@T׳ -⾺.Cj:lt oӴG0}1ٗJUK뉱,|ׇ5P5LusjӦFK-h'R"[uZE TC/Պ[GKMӮD׏ߔvKīpT+Ys(|_Jm+IEۮ.ڝmVmJ>̝ΰ *?y'DRij'LE!Cyw㽒H+{pLHM6 t_5U\-)a+ќ?&P= TEF$Ai3BO?F[ -endstream endobj 523 0 obj << +/Filter /FlateDecode +/Length 4922 +>> +stream +x][q~_Lx?^<ٱ p}DDZɢsiUR,HWibLˏ5X]/V6LN'L0L׷ .y˟~vu}5SJhw̲ۗ4r+4 , KLIbA [V6E' 5& +1M[V&h+ N., 6J<%#<%ѓ$H<xi޻(,dqIi *Y, &qB˓>IXpT$a> HX%pW$,p] NäHX6iyiR)F pd$,T0I!wޓ,Y( ׀c+i2@ +U;,J$af)a`pBl$,N)/aO +<|"Ovd3Ȅcaݷ7fs}o3/T_p Lv;D'_'U !{d!BBjRtB?퇕<ȋ| C6$*[$L]!keY]W(YmkM˴.8;Xƒ]>ND1m(8ʈו]5O"\[nL|!nǯzzQ8Naӹ:.~9үƱtfcc+1]ƴm<2eY ʹSx_^}\ltUe:3V_]K?":mvu0ٔzm^m;Ƭ-ۆ0`Y6|Q[=ٌY]k=<}md^mvv\Z|D|:s}j}}@ 'Tq9F/sr[!ňIG; wZjzLl6ȬX &s!+Roa<<^iTNn;3bG+ Kk;wFocbնk89y,;~ۑ}\SZep}ۇ*߱`Rs}΂ǡ zձ7YR#ڥүRGy +xŭpcQa!p0r`+16am>TYeK6q,>,܏QY&ky=,c XJ,D͡DaNl qE:3*uG};B[mr+ud<5j-jvj f/wj|ѫyk3,˞lJc{7U/8sGzޱb;{YUةI`vrS*Ej껯C~],}dYRI[#OӞtxP}N6XЬ.o-b|f>Ÿ kE0c%PC x5[MSy:K>ҰCX0v631(;zUJ³rd`/=Bq\}+VcPdgN{ٝ5`>j[3:])3{IL߳}^=0ޱwĢ'-ݹqU}zwĦ'<WbU{[Y;+VŢ&ʿ~\g`w?~mr̙=Q麇~` |(}iт6=t8ntVw?6wG7gYq@!7v7+"xs:~apwUץ;8 &j,\Get4KwU߼;YgZ?8_3ݱwĕ'<5fVǽ{f#Nٳ6KhҞ5,L`d4idY?f(j5/c6k& qI;CYs[|+78Fڬ"!N!:a#]=oyK}gƞ#7Fv):?Ny׫|>0pM^`F.c,WhM؝0IBaBnB\Kk#Jˆދv~J{&.!ӡLy1uv4n4RyGb~_;4 w7*Ӽ,Zr1"&`>/f΢U@{6ίNlwi*/{aahپ쪇7U!DPŪB~?mXkF*^E4n0u닾=hi1jI>/t[GEm10yVU5lNj//IWot/!Efau&];=wmZ-_X6e@l&WBYs#풿* +dk{}@jcYRJY)-KjrWWXZUQy<@DOz5酜n"N\&J8mw<$kRDŦdc<:wbNmM`yx`Zo"5U8҈ ՖmCl'tTb3Z~ULՐlkj;t\۩Z5UwQSlh7V sQT?ɹZEf7fC]m'..] +q"q9n/?hVZ~j +רymI%>I>V:VҀe!4Q 3Mc+*ST cM9CXOJNTULɮۊt:&󚙻kvoɡonqW86;:I'ռ]`N0V6t*Y>C&y寗 9I=_@__7iغ"sO'$vlXco54?n kۻ쵥n]!#fFӌC ZlMw%8sJ \ΣlH\ݥk >(.لK3$>oVP]0"_RfЕVV &~OVBx}/"z2A{qj[X6T.*e=]Cm,bgZӏF-(miVVG4UimPeK(j)S54%:+~6[=^@sSe%@wޒ*m;]]-vA|LU6-߅9;s K%D}8j*_'J#_+VDjτ, +:,_)wKJ\c +JAԦT > endobj -524 0 obj +525 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 332.823057 101.433071 314.073057 ] +/Rect [ 101.433071 135.123057 101.433071 116.373057 ] +/BS << +/W 0 +>> +/Dest (cb33-1) +>> +endobj +526 0 obj +<< +/Filter /FlateDecode +/Length 4734 +>> +stream +x]ɎWYC^AˆCwiZc@IdȪ)84zK0 g% F!DI +K%fI ~=Ka`et?@G;_w=}?:{R=཰*B%fT+N1FN37,Uf,FKTE4 +fh=vH%!à;NBTyWNy#tqp lQHNgaN[9آ5Eat"  +'$z1"t")aNaEagt +8a#-V 4l1t }jUВYآ7`9P8 + +8P&*Ñ +z0T^s4-$tJrDlqL%l1Xh8. +Ze4lk 4ֈ(9.[#@pa@qup "h.@uu &8 4xW)8.0]Qes\`XF: A 8.0]w `u~8swUF9 #h +|8[@C4hlPK8.]5 d ޕ =FYA:9.]8*q>Uq\`RSs:TQp\`, p\6H貺8 ZR "IX$qxC9.p]q +5+ V[tP ˖YV+$fӁw%q$P8 +V`EB>V[ Xl1p\z: -Z) -8.@D0D؂H01xèr:A׬.@'=ޛXr\9..q\3a +pECP9-9.@ [ r\T. ࡱPs:#h8. *r\e&l[ fV[5h8.(8.6i9. +7Pqh:!8.2` X D-YQ;oz -! +-"nIo8-* s  ~=lk#Ӂw: p&"[no/@#>㕁vPoeS oٜML,cpPJ Yp˜}jSTpIF, 9j1Rl̏'8=|2eG"@H +,1ѷk@.Yn)KX)FFѿRͼ[l~$m[F?,%qf^Zm{lL !$p(" +ź@+̬ߝ&+Dm9fAرe>ǟ߽;}׊׼s _ce~l7u]KWVz;oԏ\te6\'v*O2~{;;r(̸}Ox7© p-TVan`t_Y;͛1_<[ + +o%Ţ~:d_C+>~u+5o֛泝' |m,1.eC<۱:AJ1[ )eM3;kxigv/*:0_⎌ۥvxG!+Աk9瑙oJW2@QEhYphWy3(sWF]gu +!.+t*(L;R:;?);T>E hgBW*j oCPksl Սzsv> MOR]eoʧɃ?g<ņKc_C) ksegEq=:CMȒӿlsX;m6u]wę; z,J*koh5f4V 8BUs8nę-M"~5ty9t: +9 +ǍйLѹ@rOms 3{O^v{ObΩ>gTe='%;! ƕn-s8_Eo⽌gk}u6f#EeTWX<%oqni3+ƫBy옹]<s8D]rҵ;f4~qhiEV䱳Py}߈z5Wb6L11e[yu*]uyE~ G_*pޘݾ#6٦HYpHݒ]'n"^|ޔڱ/ѵKGܕVQ]a;u;3R}f227|z9%jz"[_9e+;wu&&]D=͹c}ޑYhueԫ#ӟyպ+ (]},\ rƣ;G; z7|.6(ĜC.}[^]W+#_>5oVj77k[(Wp(ވk\]]pߥA>>枫69Pw[_wYhw}d&RyZƬtSvgWٟ7?EaW&^uč vܶ_a:zu+ +hcwXw9BXˌw;J|L~6ޭmٯ*RXA՝uڍ% B +Z6:GCkɷ1G]}Y^}^}fHjC.n=4d_áv#zG\xk]Jؚ]mX—eb;;a\2I\\v9鵧4\c/wmhŧ2t^[ 5 +߰.;| 9TuG4ߟٿrgpߟ/AteARG%/wޞkߌnQ^1K[u}M+@=[u3ۻ+ew ѐǨAbr5.mu\sqE% }tze5>iXL;=02 8#3\xĎmsL6ܕy^2 {O`7ӥx(a/֣ܞ7Yp2{S$ {-I畚ݗ?R0!ގ2+9&IF3kI g{^]hA SL(m ؠ/ 4N_?*φ\^)aD.KƎ!j:ًANbzct)e! lmVK-] +E]+2t +fsY&Э^:ʣDƨX6,b<1ˉ~.rYͬѫ{Fa@2\ĖZe|)j՘GRCxFhzzmFbG3Z7j!)+_O3m +a3Zn- *^?aif)1O@OvBk]aÍ4mKz_0ێ )O[JI!k>f +yŲl"(N[*;s-V+ڊ}qIo*vg%96Ӌ !wRJoW;k0BW}MZ ;uǺ8{9xJnNi">8-Ŋm%C9%gJP[g֓kxN17 ˲i4_2Բ6q6ĞK h[c؈U{ExF2;7a:la:]]iGTtIOn*mMZ63vR7Th9h:UgmβtM=h64a{y}O&HZH_[i91:a9Ly*mfԥQC 3;h1HC6m&ffGQ2eEmrS<,;JUc;Ҷ2(KfW%] ׳d%#sm"5βefw4L5TjvQ.guW*L wpFz9Rz#7I\zdɹ'L`^o+&BMSkjQt0Jsb Jo&O͔*6NJ^/J1I?# +endstream +endobj +527 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 526 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +528 0 obj +<< +/Filter /FlateDecode +/Length 4793 +>> +stream +x]ێ$q}gK~=X0`ȖAKm F:-^ ?(1퇛I)VY{wWTݿ' "$t9&^Qw-RZ߿#5"cT * rNgT^ 41%N3\nUfVȨ"06(U% +fRv(-%!Zri%|L: +#|)NENgaKRq:[Vr:bM duE`8]-I.+:"T.R%d q N)M0I>0: [tgtXp:3!FfjFl:XV[h[d` %t&m9mX@$l>TiY1Qb:bh؂[5Z8.0[+oT…5[ (PJpwr\`@5k h9.0]cwANV[` ¨h8.]dw14Uz cXr\`:` +`uA`  ,xW;4Iqj=H6B,ӆ&4 xW%L̘[ wUD$TǙq / }w1Q x9. ̨U35*$q\8oBI@%!S8.hIs\YX&auAHC9.]Lޕ @Ŋe]#S?o~zWfQq\>nJC쥤ܜLUEkmTr* õ>'ѢfhڪKcK#S'~O5h-vkY~  +twN:GաF=B.¡yfj0ll ⁍gͶstwc>Ջy X"L=^{d-"%5G_hMWI{j[^EZC8&BGt&`WNfUtFK%\y-ӡ2o~нBI<{ +Awq\3rsό1,[j>wxbCq zK̉z;Wt\㑡䪩 ~0E04ϼ= 1y:ǰ?K-[f/B^lDZ)<|z:jv<ĢC <6[kf:<uu4|{P0hݤ6{o^t;Mʃrc,/NpcM/ 7 1o囟l_˯e}84M]sCHGtTڝ!ZCqE<٭{pؽ>kmumϔGyG\y1ϳќyiHLo3(ZŨF˼j9H|OMes4S~Ei߼y džЍ~#=;dooHmPVĔ/#w&Wf}Mm}J/%-cÂ*}fjfpa9}ږ,ls-KM˘|gv/U\6N4]Vcp\8=yu9}hkI3_wޮ1GN`GߡˬɎO\;9\)s5жw8_T<>Kγݶ,6|bi[۽SWߡ6\~w7~f>ĄvRguW IM>I% yZ]g?pފn!`WG +Nح0y!=p6UXÆo-Q$E`Jt/g|=gɡϸ9C::ov:[Lluz=ѳSyd^00 +;!ydq_>Ǯ?F,˲%pf?}?¿ES >M \ j+7qv<φ7?i9q,+p0eѷW"כ`Mouif[ ZzI+9_< RN]AJఉ>0Tc=wဣۿ-nNGEQӓhym늺ᱩ}o:HEml|y<φZuȱ'd_y~lrH\f^9ݾ6|}Cs4\mܩqgymDZW嫏@739?w>3Ou;|Gy1ӡ8臝\c- Yhzgoºð^~<φBa۩0.YayQ7N-y9>9y{<-|!BCo;e{^p{uv^ѳE"thLx~ϛ[.&r]ﾼ[nivJ!^na3l6TH n;T~Q(M/F{+\MHwz^ƪM*;VwrR7Kz,ppypQ;ram2]z[Flm?w"&a([YVU Y>ca|Ԯ򻚍feMd{ʖ!rzSPELoT”+LM c^`x*VFBʡ.ֶڣ u 5Cw 7Tkf++8עwl23ՔCl'F1od-ڢ3~5z"HK5#zt4z*TgMݔuc8j+"1"Mi2l]zsI:W} 6q/]JY>ahVK_5)1Ol_Jhl6I7ֱ =.B/%Hn[I yDRniND7U>FYH[W_Z6Ѝ[Wq&oMU؆ v.Vu mzk۳N5j vAt2g܁1y2?o\8:FUVbl.cי>%߇"qEICF\r0uVf J~;v!KuOcU[1$AlƋ`Jwd_GI7(m #i#<^j__9]uv0L r衅]]g+ XUuhtVb6%8^ +-ҿvc4'W&-[g-ΡN-̏ʶuuuͰ#SٳMw{ΒguR՟b4&j&CރC,}Cqys㽒H+kBwk 7tgKmlue?y_3o@KEn/CAo$ ROM[ͫtvH +endstream +endobj +529 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 528 0 R +/Resources 4 0 R +/Annots [ 530 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +530 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 356.373057 101.433071 337.623057 ] /BS << /W 0 >> /Dest (cb36-1) >> endobj -525 0 obj -<< -/Filter /FlateDecode -/Length 4730 ->> -stream -x]M$@ $p@9wlvyTd*=l`vZU$U"JTK~>/Z=ĘwOjNXbv0opglN>wY@aə'ϧ}rϼ>!%o;1, !JP)Mʹ!㼠z%$` إ* T0Ud* T0C'VCD Q֒t %у$QH:ti޻(,lqIiI`*I[, +w5at]mw78 A۠+ҠR8.hH\UxPL" i @ƃ*qbyOxrDxp{Dlh$._0ʀ)$xWi*M |%.`#qvH!x |Ru~ ((KpD)J\ l!c$.e4o1<-XOQ0W%7C kQA쀥XK\Xj.I\3Vₐ` XhK: [dK\O:%. (+ B#DWK:r%.U&RЄl;  D#` 9+qA&QaQF`3ǛA₤` <> Cv%.CIGěJ\y(qA"x!0oo -.-p0oI7NoF f ބG/b7.ft]x^ ބg+ -3YsŌ:b@{Z1g@9F0eb*Zi?fp>E&L ~{,o{zd̔ a,m_av5.<ZЎGd#BjFjtFb3aW驞>a>/x`T㯣_{tc7MK]E*l];L7շa^¶o:F\>L7uv^_l(Uzӱ+=}/O}7詎9@Uy  ":t paTA;g卝unx$ЁMH?me_A'[v:hK+]/k_ޜ1_qhxutvkL]&LgWuɨxdde*2ɣh;v9n{?5=7ӌǽkޕi9=! Yh2Cx_ӕy^yZ1>v#m԰O tn$y}Pz3DnVkHl>~$s8$Ip_?GU5.CWOv*|GoFO{ҡ`\$\ҴDlEhw-c~Wʄ[:CtT??阎S27W#2O5CZYHݜ=*9TU3w[;emv }BerpDх!tE)Pz {JeږRԫ| _VuSGWϹ5Zzzmt̽л| Tz$޿dr УmߖW֫>{Ypg/?֫7cq[(Wp(ko]]p߅!b5b@C4Bw9Bmj";FCIL#x]{rw;Z?诵Of][\iY497o$׵#r[rNzcQ\f(; - ocXw9BXw /F[M-~b62/SXA՝uڍ/ɒBVr{Ѻ?~d>+2~ۖƱ}H>mv_áv#_xo(%niܱXA#O#Cr}2dڈr~zjFTvQ]~wP~SgʾOߟ/ᠼDz"|#RP]sQg/3(a\ 08!PO2{v9mQˡGָq)1sqXvݝJDzzc6eȘ~顝u VXvWs?0XW].1iQ2 y+[QHeC#VW~2~yuߍܬY?#?zQ+70ǷǮ}_Jƈサ2es?u/es84̹>u=.jYլZ~cM.u\kH ; ac_{Rw[݃#{∕h_eδߟON߻f-{Im{;ԃE$oEo9ha7twjg!x#KDñv5WW|ӝuЍ/,kj; -fE- +:n xg!8_j잨g Zofܗyk^s8m߱N,C9/?[᪟s3{6Wa1lߟ=L8h_Qzv;B:7DEVacJŮRӻ^U~[~E`*8ߝtCFT]QJ])YqD T-٨R]rDXnjՑ -TlUSfJ:lI˚QT>>@knBx99[gb?\Jq!v8&7@05,' -WyVH7sv<7xI\+X ,.B,/P>n-]{l&e]!2IUuE]g -+S U1kbW<7;]{9 ľr3::f[e/˸^Iبڵ1a3 čFGqoT>I&ӷq3LO:5{Y?>kQ-L֙dq8saBc7+h1m2Z.tTMg ȼtlڂ}=rq8 p/-g$rѶCk ( Slff$?IlCA\쀹ζe7]dU"p'M3{^/d_f@Vjg.d)~~X:2y[ն=NN͵Q&T",. SEV[ &?U+2^q{)TI=Nt|Tlnx[9ЮN՗Uj[I*e=˰> -endobj -527 0 obj -<< -/Filter /FlateDecode -/Length 4810 ->> -stream -x]ێ$9}g%|>-`CwP,>'K:*zӕDvK~/bLIM))VY-~;kEar:X`3_No쓿?yL)y";r*ATM!n1%I3\ C[UT0* KAۭ* 4I* J+ءR("kvӽ3z1$t:Igi%].J:-.)-lqHI:B6IaV:bb.$Aa ElQ^iIR$u :Cr*IM+УH>:[rIgt~$x[ ntH4DA&!LE & -J4`ȧ U:%" -8X [=WHk` H\`-l1d%.`[Z$.[RIK\`paqm$qJI εN ,H=H\`y#qZ^ ޵޵9El%.;NVG+qwVA Ъp%.V&&*&`uaBx8܂4rwSF2^e(1B3V6%8N> tL^'Ҥ<.[xy' xwAQpH\bt]mw78 I#ۤ+ҤR8.hH\QxRL" i @ƓB*qbxOxrJ\:bq tBF:)t]’THx.%.`#q4>):?I\%` l[1[2H\`Jѷ8=-8? ؂HQ0yUIZEt 0k 0": % `t$. H\hӰAtZh` A ez%qFh%jIGQH~PQt4&$.@dI\&:bI\f Fbf )؂O₤aq蔒 ! /y%.HVa)o< $-!-oIo$-&{oF f`^\< rx%0"2MD^x]@|&+#8b@cdf@V~w.V̫3h݇ӗӯ_wϧ~s_}o\\?"SIEgZ>J-=`@:gy]v- "@n]ghI?s~Ss=f-6{ 2KnLܲϲhH3:oNzcCe0Z˔XO)]miD{+TgNS Qs n-+,mgCVDd-l8 oi̥\햿 '1{㶢γ|K^miY,3sGYV[$Ξ9 -߻⻾m؂κJu -;.b]kϐ= (t9i/4#lKz|xENril o<+ؖ~,rP~6[^^b4K5ߧ(*io QNw0ϫ&oj/aRhev=8bɣxg "%K,zƦy\Daz/ڳ)9R7Σ쮇L~􈜷<4\m١ņyY3l]^}y/AϽnk zY$- -W& 2'u/NB} e0m@ϔ$޽*=鱋3\T;NfțkܧV+uiPi=8'r]/ӎ~jLcZӎS:y2J?[sAՉj +J7ᒀPRr1kG5ymx,Ͻ!ԑf!M^XAf% -p|?/Y`]~sU)Jbr,ϝ TڬU.&+[thXd Y&;+8o"YVw*Gh=КfoSeu>®\rYZ(g@jt.tDPѵa?Vƞ~ ^U& sjαVzsÖDFӅ-or2?[眺[Vlwn7*6ܥ#/qGymcWo,oF}N̨c_?Թ;_@+̃y[(7O6Z[HL xFuswh݉3oA-WX[xŀӏ1?s~ -Mt^ȣ8R$ '*BЇ&Ft0KewYE3!\@p+5{5sw{}/q{gswYQ9OZܛ -~`Wu#:K-z0?c5}]y+5\o{rbKYp5Gy-CWv_v"׶qV7qwު`xv,d۞ݒ cD|Es0Ͻ!*^r+Zwi_@Uu􅊃yU;`e޹uߌoT׾"%F+lo]`CNtu3w8_兊5} HV#XC85>c7.퀔gguu8{3z)-{SO -v=[և+JMH.pS~oT=PHQXQnQ97UΩkr=лTܰҔjzymp>x#.ջy;尺-R_D+V%Vv3>"=ѱyz> rzsy;ko7I~x>Q!jAClyyx%#~3toj'+ kȪ@v9)86UwSnWa؜phmx6@d -|F_˫i+2SާjiRk54Jn}z\_mM11g^ע;{V5'Hfx >aUϞ&^ EeIfٱ|!g>cMx\>17cI'|:hEtrĄIA1 E$'oҘҺI-S-_ ?W󻒍O#U|n\ DNb{5E'.W¯Va+qWn+T]uMlأD:߄ukք9 N֎QJw2ԕA z: /T)ИUߵ9 ctDO'1R-jزfJ,hʊ([>|>Imk;ܘi'm/'ԮqrzvVqT /MbqlC -W< -)>]JoVIW!BK۹KP1KG%gҭVeSh_c-uUVSbkbW7;]NʼjM+wP[\aZn"|b~,4QukufHdq魕 4ɤ)s:[x>!7ο+uQ-L֕6A1Fn u:t|M-j^Rʠj{k>ĦBhy]> ^̧MKN 3y-Vᢿ\ƦmH>wE⊓!Z2]F\ⲫ05Vf2 J~r]EFm:jl_t E_0ҴG0}1ٗJUK덱,ү/cQ6ղll rZh.zvز- \_)٪2PTLY-1%qjLѤ?v}T'U&-[F-Ρݝj)k,sW)ȶuӺ2ڞ۠foj&5}g3:HO^ ѱoto,S{pNylWDZI_c"kUs /P}EWT^:9[R-a)ќڬ/kyA^*wYz#EJPZ>I7a -endstream -endobj -528 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 527 0 R -/Resources 4 0 R -/Annots [ 529 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -529 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 569.073057 101.433071 550.323057 ] -/BS << -/W 0 ->> -/Dest (cb39-1) ->> -endobj -530 0 obj -<< -/Filter /FlateDecode -/Length 4907 ->> -stream -x][$9R~_Q+M/ᛄa%h%>5svzfyٙ#YgZЭSK8WiIO1zEM))%VwՊt] G^_~wu}5SJhwOEv -1VKi+B0 ,' 1%1\ C[VX+B KA-+A 4I, K+ȡR"("kvҽ3z1$x:gi%^.J<,.)-dqHId@ ^GR^xpD$, -yIXzJ6E , ,p$,G0% [  ESH6D$aAp*b\@b-ab)bKX$aO!A, M3xɖ.xZKX d7(aA4QW`F, UKǛQ7ы) .$p7JLfqF1c{2P^VA(oĤDd5 -Vb@OQyCCd² x-N9??]~O}y]ɔտB)M Lt;x÷hʟ"!|N".,.I,$gQqϹDuBP=pCV3X)>[Wj L[ikߺ<1oMرT:ESC\=WW_Yv򼵞rzÂolݯ*m+LZPlއӁ՞jVkb,WE)hvnKm{VyXmu c~d~-cyry9 {6ij)FuLM.Gw2,r`/e:)VM}e\căvێ㘪cμ"sV#˷y f>i >W,\"i~!>3KpY -,,ug/3V(Ͱjy!j^2U?UYw,9>꼜%Q-M3;x{XX2sqC^( x~o5> -iDqt>Ylx~lQ#nn3#cyϣެQ.wnF?#t+*:KQ8e Ny9= -w-DT<6uƷ2Oc?JJD9Dzq^O5[eYu^O\߇YkK9VG5;9N߸oɥkO'뼜eｓz$Wy-k;,[11Oٓu^͊2dwP9 vh C>G̞,uzPVyZv~z"O{YAY |"O6ЬYZƓ̬1l竡dmX(P'<l9!r|Ì~b0ݰ]|m#cDZj^,<[(M=Ձݺ76o'NrypN̚G͙fvA= wv޳8etO'뼚eLE$rZH[!zڂ?z:{uYA.hOǑV9]s8 :/gXN4~+ }2c/Jvwkr|m3w麇~` |iт20=qY,ELGqYL~-o泶we#=fƸcJT ris "ՁtSW}䚼e簴(1r;2OncC XMhlCZtG9L/`"Y;Vѓ-w*|AQN VY$ 閃mZEߺѽEom +S\{쵬{?,UNrɰWˆuEg{/U7&U&؈ՋQ|?G})[L6ԩ/^<❥n³]ExVhWɳf~r!.+-oz/t͗ GeIiES|/T$ ]?,)E'| WuBZs#%U dɜ$gQvf4Ć5wI ~Mj|.ZȖKd"jz%ѫI/u7q˓o{{CݖXwlʣMu\uM-k{ڑE/٨MUh ՒmB͓@]w6Mg*rHXni͵ -TUS|Mh]l([?9os"!.J/Үc"%Zn#GSSx勞3TFS>hj&/kO6y$N uHҀ2ur}騄t[馱Cej&fu!a%'*dLˊtm::󚙻kvoCqoovWll4I'v#v -aK!Щ\ |Lqo?_6g39pg}B׿7Q -LdkIrJlˆ 1d{YW0^]u`%uCPݸ452͸;۠| {~=mlJ><γ}K&-\2"xxd.Jl,?񩰹/܈h;6˛2 -V.aҼӴG -S2Lѯ۞cK`YoPk˲gӗFw-hmQcpSUuhpb2ZUKqOѩv|V)ۭ;^ls7GzKFyF^VڶoZ]w+uA|LU6%¿g\g:Hߒ ѱ6j[UE!+Pdϕl3"5W{tLd -:,015UW8 :̩M&|c9=PB1P1No_[Xn>),3 -endstream -endobj 531 0 obj << -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 530 0 R -/Resources 4 0 R -/Annots [ 532 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] +/Filter /FlateDecode +/Length 4774 >> +stream +x][,9~_QH؎MB<,Z ҈ڇsjAa|J_yNOWFitU+!_o_~[cŨ^b?X]5]_/l^9ݎ5<ܻ7ӈz1w>A:`͵Qb2cyNjrL;%#koSFӆy#2Fw]΋nFO؉{֡`ik!z6s҆5~Wr{q%`vbw_I4m_6_*> Уm?W>{WV@}4wn~[~Fj6&Qf3Y}}{Ԥ{S/@>a$vq%71h;.wx0ِ;q@m[N`QXus(Ś' + ocOX9BXKw+J%Z?n6-3꣏<>[=ty(GV^Ak3=cyNc?e>˲l^XŽ v'_hUJ]%m_—ebaOC9¶}9$EuW4ghCl]an|"SCͿ@DŽ\c~œw=C5OOG}7Y/+>}|,`ӡ`0oq)PҶXY[oݟ׵'|كyNԝ}Ϥڷzy^vs YFo<ѣOf9潝=_Eץzv_hNR>>V[?đկBM}j#ؙqڃyNĝ8G.^,5CAwkD“ܠ}k' +!h[{;l(Ľ7P<{;-O9VV7,8~-W&=ey[oUoOGzF=?o`ӡsgў}zso2fz7 {M}{KE92N$d+w-J#Gz=:tމ{5WH `!t'ێƏBLo {>t_lٯg9#H+k#Oƛ8l;X5OGcAND^fzZ~yCihC?.?d,K<;1͞Ցs8k ++9wbvw㒺W/ݷ_׌[ 'rI32vQljץ-[d&u߱XNȄ7՗ O4]?+Nu7elEpqCz+[F*ʯ3qӖ +ʜnnKU +wb_z\Yx'6 !WRFٮVa *4:h-4~2iƽ]r9CD|pӹG.|]>>Unۙ,2өYXM#4~Pڌ25{N ma#6FS2vCxZ82o:a/)t] +2T)Nвi2-MZ6334}ۮTWsѸ钪4e]4IS{̺4~zx']IZH_[i$-'Kit25][[EأԡQ] ]mfضRβYy(tʲR6)[nJUm+m+n6g-Qql g_NՔŗ ̵kJʲe<;϶6gj6H=3vy*ўY{2t ΁C894lJ+ikBw LVLx"+^SQlQXJsj *>-mV!bhhʹYd0e +endstream endobj 532 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 119.073057 101.433071 100.323057 ] -/BS << -/W 0 ->> -/Dest (cb42-1) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 531 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 533 0 obj << /Filter /FlateDecode -/Length 4764 +/Length 4801 >> stream -x]ێ}y I $& Ilu9EQg2;V/%XE/93˧R>ޞ0~2`ϟHUޝO;l?ӿyY 1:%Ǐ2z{aUJHͨW1*'b -fXoY<01XN3RQz0Cyi8̐zF%JVC1Z1:iFwN"I8փFZb+V$hp -Qycf) }7V✗IhX[fzeunU/5*AFg -7fyEVpp 計B1. -3KFd-Rl>+v׿o߁OIommoD1 zQܘ~0Lr'qMNcxN=j,ʛ##Bv -Y&ݥv.םCvZc( ""(ru_UVZ/-Sduiy/rhnܤ@VAdJ!dO]6L֕"v4cQu-9a5yi5΃WMۍ}y/M_nEmx>sq:ݔCZj얬/gg!꺗YiehiEՖ3Py}5u7W|\AUe[qy 懲#.ʻ[Gzc w{oMi79u?lYCo!ÈyWw27%rK7uP~.(v6Mv#"enIYugángDLD//FD[/U)k;vFw9z7"M+L(4zsS鹃/E!zGng!tÿ\zwDl^|n1!ǂ̕| m+荷w9zFl5P+ /e.ψZ{`ΡGy۾-WwWfrljC.nv_6lW o޽J [+m Q,uv,x;;aT.$..USJ}1ϠOpi{bzm:&$Ta]V<*biw>멳`n>}g!x_,tAteAR {zɋUsڝ- -SUQ4+pnڵx{UPC V|ǵ;}T mj9tv:.Ս8LSSXz錄hLuey2 [?#3F_ĎesLJ?ykWpL`;l3Ks(ak/vFiϓo v9~7b ~g|I1Xi}S{|kw|N>$(a?uOˊyƝ1yza\ g7k6bbu"_vg!u+{R7]y̵?/mJl -Ot'qgd܌{9pJӜVEpZҋ[/K49!gǕ(l -LF ;,,æ*~Pڌ2+E%RE -mmF -tM+K׊őyi {AJY{89uhTZ6PM l[ɲYy(tȲR6)[ntƁm%_|*miJiD[rW%] ׳5e%#sm"55βef^wmij"]wtQ.UK0QHNpb荳ބ&4rs뱒eD$JښZx EV4E=OEm *͉E$(y<'S@zZ*ژ+B#{6-E,| +x]َ,9}g1^›$5Ai3dfTeVߦە^q]2g KdTJ9:_=}w*z%⡨FST[b6 䯧es*`?3ȩb^Peq{APĜ%,mUfPN^R 6 3E㶪 3l4$`> +*aZ:tƫNRYEL9"o$]V!$txC%l! El):IaEdA` ЕDlAI9 N1muV{sZ:❶OxSf3k#:؂آc(3H1/I`cT-I$`S(I,`SVhf((:k$"px +8[3WIga H\l$.p`[Z$.p[H\Mpaq] +$qJYuN H=J\+q:JAudu9El%.;*g(qw1U eSx&MxF,.*A'qwGkxג ( +Eo +;[@`: PpK$.] slLA5 '2=.[2!d l{  D#`$qAJ$qAJj+qf kO€b7Y8tZK\MBiIK7iěy]x3J\ x(i¼'!;I[l& ro& f ބG/n $7]$Lx@ V5Gg2qę X[- j= I4,Sw Bimh ӸE53Endƴ x-ܕd?r_yzA)?w8]0+U#Dp-/@l! |K6"n-Λnl$b,^ɰm6pfJhQ/BrA~ 14fu4 抇X&{dr_1:zjv>XC) mnz/,b=''OVi"^V*8m$׏$V% mS:OiL}Z_m|4rњ&8[v[Sd.}1`Ӗg.cJT1%җ] +8 \yrO?wu';{Q+bc. .̽yۂ*-G9tN6n Zijу^_p> ]0ɽiVPLgާ\UXyye%Z! +%}y[?ў>1fR![wKU$G,NRzre7<B۹ z^nul<:@ -'r#1r39¹tƭCV},GX!y$lp_[ܧ1nP\~9S*8K%xe2iy2m˳e>RJ㼬pC]J*gYUx |[X^\A

9z+~%e|!=p[®z}9ՂRð*9BY>rNfeee=ց-w1;+h~`CmC=ezJa9%kgԍoXչ_Ãy{*Fme0TFk>#y FMhh ;~=hrz/Ҕ%oXCm]t^o[ ys GUqhI/9u}HxWJo7.Dcy}ѻxY@5ΈocywVp+,^6o6Vy^iWX=ot. =MoqsޖzS짝i=Za|i=rݴ:w<0VwqpQNkce o)]Ӓ+kD|s0!궗SΞ0|}f/ +-ǣHy<vv˼s~=¼)Qaay8TxW}@)Ǒpg[?ǓݦH<ѐna,ɟu+|3蛧ћ5s9~%>PgT:٤Uڝ4]|eVՃyuwYؑYq +sor8oVONS+}<ޝwŭv{v^e#7{K}<r-R_Evj| zƬ"auؐy% 7df}}0ϣ7 =ЛD͆玨M' k|ۏkľa`C?P}[?j|ISDy87NW7wq5=WW:Ƥ#\By8  !.Nٟ'm]>kD=`W2 f Fl~ޮ|2z3pׇ +7ac4qjǠ0w~u{7٬Z~5e^/@[|0Ջ?=͟ӱ]r0 UXww|YJl#|i̯-K]Rs45\rʯ ,.)~ifؾ;r )Ww)>WO&a2cJ ߵT.h,8>+dRrrA.dC|D1 痺E]XUe0kTyyV+k6ObAlz,/HOZ4a/ƴqWl~+Cu]lcRu cיakZ%P[K_E)_m^kuܤlBm$ҵh`60j|A$LHN]Nb4F*Tg͵).dߚ2˥okcӀ^NLדBj߹B +Qr8鎗.e~zYe|&?QoRfP_۟z%<7xI<4! Şv.c_&i!=nKzl!l\cj&f +Ӹrjbߠw;}^ʂ[]wF}V*b~tm nH;q;\>ɤr,sy˷Ug2!Uq[ƭ 񗽤b*lfZhMi}EC[ǭzv݉4AMӎBp]k3|{ztq|4\E≓%ZCF> endobj 535 0 obj << -/Filter /FlateDecode -/Length 4804 +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 627.273057 101.433071 608.523057 ] +/BS << +/W 0 +>> +/Dest (cb39-1) >> -stream -x]ێ$9}gM| $V0CO6+ԋ g-F2qc -o/]¿bv_7V- lBr&-.o?y}5CJhwkVB A9AR -*ULIR Z`$ c0RvJ0M -f䂠 -vh!At/|L&FY;@iIｋ`KJK:[&RAybU ;IEtEQ[WZ%;D]N:ࢵJi=8`ӊ:(4\uYe$-Ip6(Vý*%-u/1E/Qz$q adH"@&B )H<`h-VBu&؂X [ Y ,ؖ ,TX-)%. \$.`\=I\`ARs-S EwXuH\`Aw-i%qwENQ[` J\@]UFFz Ĩ$. 𮉊$. D]5UFnqH\@]CK\ %F]P=tJ\D ßЧVK\:D]tDž~ /$qb8.3J\0 xW[ԒMR8.'q0h`|tE]TQ- 0 -*ID]$-qxPC%.] IUZ Q\; Dl@ MQ``5F`` B  I#p[)J\&b" 8*b]@b-qRCD?p$q̀N!t 0 2t Ȗ.tZK\ lA4(qA4L$.$\-H<3J\*J\n&RЄhl; 0dQ[# b4<݌[2< $[I\8L4R$14$q%7*71mAD!DuAS-8 M$ y(q 7ыKA\.ft]D^\`V+ degW al U ȗH2zq*Z -xV0>KTp3cJ&t Bt_-H6}O_0^OJYrjB|n`!֨9I<Fs~_ȣďmv_t_̽G=Fڢ!7(eO-wfy -xDil2<1Q4KdŸN_/;i ]?|{_/@_?B!nn\OgR,Qè(9uYyi68;G^}ma᷸c§C~spYN \Sڅ]4wi!toUp.Puӽx?JkX.]g --]ZěCbujIh4Bcy͓y t˚@O?uڡ{]~H$fQ?%c׫ھO dFt^G-z.n^qG<k>gVUV?brq˥޷`wĕ'<o'L-clFB*_qˣ-3S)23޿&˨W+ܐz7قκt ǚ66KF/q: N@}l\x=YWO}u#D*Y~euͦlX.[>Ə-u,kP>syV^ƏxE'-#l3!A{눰6?N~+#t-#cyzƼ*>Iw6,~OKdTV!2%_Ӫ}ljVKjX. -H[l% -u|c{1˂˱~+?2Nu Ӓ%.^uۭzus2r 0GhS9]Ǽ^zK8*FKu6o gtfeaDc<.P{=M1?MhQnfRnV vC&?K }ړ';<ύu><qh"!ƦKS+c˜) ցw%.h`#upO:-n{e -p6MKLAeYz꾻=/†J;EC>Irtd'AJ3>FJ "rSh,669,mOm@hGhG @IEO<>Њo[LfڋC?+uleOD|yA7Qi?.tmyu8UTnE<)濃QtBC7-+h1_Sˮ2^;5vq;‹5mҶ~嗮pWl]mHL}ne33M~򽺋.KtԆپ"˵ E_0if`nd_zK+W[/ci%> +stream +x]K$ȳ 9}]>ttXa~T$Y]ngE}"**|OrzJ)ஷ/?]ŸRbPؿZ8yC`71\.gx.:j/rv)FVKi+b4>' 1g1|tmYbĂΘ$İ.jeeav b +rhȃ 9kS҃3z +),"x:g^K<|xkă,Φ(d*YLVEb,du%YTPZe;y ,`׺$,]봒wEMY`'wVQ22`V'a2kr8உD^k< ]㕑w3AQ7x,X ߃ghl2pK$,] kh5锃OIGh\XCx.6*+a> ;wN-d%ao& @oV0]'SwKF“J@'`<).,aA*oYl2VXpV'e4fXwY‚ܥmS‚`pl$,M9 aA +<|"/LxDd<⢓mNDY1DY2HX`޷@8OQ ٔsDA/)EK(aAnV%,@,5%,z K@ 𴓰 fȂ"a)xOC8Ok ,%,H&! JЈ%jřI‚DX&4"&$,P%,@`aȃ,; R2n& R,F `oF ,$,*L&KXO) N7$aA +&Ba?`݉n.X>߶ɈGXmo/PNʭ{tsN_᷺&m] :Oy6tά+~Pۜx8`f7oѓ0{g7={C{2ዞtyI}CN< ~ DS^t|K9ZcH}MOy: =ȯ̲Fv[Y;3VN~e(>:fv1ffDuAQӌe>`{yY}ߔݬ]f98,o\ԗ߆'DXM d*k 鷬MY:Og}͏-t4Kge<;Y3\83ݱw'<5LcΤŕ{!Sv> }-]<] +Յ(6pšӼK,9 Cpê -UȜcg3DgNt贬+3`۬Bȓu$lؗeا>ů|^셅?g9J+6w̪L\f76I)g{lwˍoѣ׶@auõckI`DQ\aƇ{xS[o`Rt3ݴ-B}:yڧlWɳ)O_ǰ.*Ikp +dWIutQ,_S+|kJ2a)S~_r߽*do'QGr%*$SKfg +{CP}_=jS"j%դ2}gD(4bo^񐬭bD%*]'WtpS]&:Wf_˚ȦvAvT6UkTY&TnT_K qm"Sil|6ktLLՐ\+k9t|J^5WwQ/n,KpAmE&_.e3JPq} /VqZ+2{I2}O%eÈ1dzY_0v^Kꆠq9w2ikewA͑ڹh(BGWyoW$huUo%[I;i' +JFУ<׷YtQ"p- ;;+y߽zC]DmިoFx2Ֆǰ~l{-xZ[=ۜ4kVF5jK;un .@SZUTj)#Nb):/\ӞJS6eݺ5o6ss}tldhnTKJ}ʆ {W¿ΐuJ՟ ѩ_h-߁RG_c]bϕl3"5W{tLZ5},t)WJc +RA&Tά$KB=[mC^hMKQiMI?P +endstream +endobj +537 0 obj +<< /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 535 0 R +/Contents 536 0 R /Resources 4 0 R -/Annots [ 537 0 R ] +/Annots [ 538 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -537 0 obj +538 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 400.323057 101.433071 381.573057 ] +/Rect [ 101.433071 180.123057 101.433071 161.373057 ] +/BS << +/W 0 +>> +/Dest (cb42-1) +>> +endobj +539 0 obj +<< +/Filter /FlateDecode +/Length 4786 +>> +stream +x]Ms+$@CY f{wbNyTd*=l{ўVIbj¿/4bL'5ߘbv1'V6 N',0L]/o~q<>!%o;sVYB A9ARsCyAGLIR KU6E'`5& +3MKU&h+`N.*`6J:%#<*K:I.@tDV;-wQYҒUXAyB-&tNt]Q啖t.AbKQnpHI:lCB# l%Q[)#Xt G!FܻIt-h|-*xЃKHDlQb`C Lr)H<@JCgD`^bҰŢ:BJ\@ DXh@V%-qo^L%qq)z+qr$qs )qt݃%%%Kґ$.]*H\`FFz Ĩ$.]wM €>HXqxik(Gxdw`%.x! P`H\:a4j1y xWG4Kqߢ}w1P FՄZҁwIJޅ$. @oVKJ1J\%#qFAE0 %. +~=I\I\u~ tB:(t]’THxn6%.! L>!%.IAON₠ p,Q[l(qA0 AxCl\-%. 1Y+qAp1Ԫft-"t:H\0k 0": !K 贕 $؂"q!xN8ӅNk -%.&b1DUK:<3J\(q f`JQ[@}dI\&:BJ\(qA(#qA₤` <> Cv%.CIG727曘 6 qAEuNS-8 M$+qA>7p30߄G/bo1\u $L|4W ^ʘgQ(P* Uc +Hbfbf5 +Vb@'\OWJ9:5p MQqk35 jzc&}e5<dZ) Mti3lGϗ8Ƈ05`one_ aRI?&`~lV6m>VL>r^lW{jt9P/2w|x(+$;mugádZ{m~*+K筐,uȪ(B9Rsy7us/P]ztm 2v~F髨ʗ6990P/Pnsl :97oMOR=c˧1i~:ҺՆ 쥳WoGϭq/˝Χ==rm͛=s8ޕY_V=ߌ6z:# +*p3w9*m?h6i~j#2ZM3>#&Zw9Z7{zV,v}y~\Lѥ@2;sL ԜS{}`76gW꼒YM0[ޗp{}4qF|39ZF^%]cJߚq܏,m8ƙkڧ=HrdK|k:{Ch^|s8|mxF1k_q15UyΎz|b;ɶ [+Y#/gg!궗3<=в~:WP"Z[&ys8TmD~`޹uߌoT[߽0WP<%.4V\`gnxW]q(WY<|}?|;cx2-6Eۙhueݖԫ| _Fu+ }wH;:3t+ m2zν3л| TLB-ëЕ 鞄gQ˫k +b=s8nh^ +@Ѹ-s8o7VWwaX|߷sP qЄBXFg62.&P3z :)⧣͡}߿?}g!x_,tAyeERGjlϭ79 +Ӱx!lk XV绂s4$>*1-f-n{XRVǥυa=tw+m轓~/8ޓygL#os8LoxžbQ7ں#Zffv)oh5zm'I} \UzFtMiXKQs~,m_w#6+wV7ȏDT8 +M;Lmok}^8f}4e}}es845.&6wjs&}U>s4}7֤ڷy^6sYFqbޕٝyv|]"݊,r7{ZYy[?ĞBM}j#qڝyč8{.^,։PyXe͝+{uxF!}s3H3ᐼˌ2a5;zGxyӥ_m{.cY)~kz`e)]2~?/mpr=zt㛼'e7L +5j|N믟XN,Mþ!GQեXs +bkSWU˲$ 5 OInPT \W&w%[>;Ǫc7R^ zsn@ӕ8_lhyV`˸)֤-ݮ-|.Z:߄t^u5Ikk[ ^"J隥RFU1R6$.'A*E[4fճVg]tDn*Ֆ +5UlYSfJ:ZlIݬ(*_b[ 7f!=_N.] + +XUUKf/ ] OWpUgmT>]YJr_YJ5mhiYu*fy}騄tkZc3)2&I\+8SXʕ\] +嗙jWͼfpw&;_8Ƚjo-a/f{q~,7ibhnƄ0B7}ťVvLjI#i 9œ'r/K4_=YvǍla*|$ǝ|xnÄ2ob[ZWPqc_ۖ]5b/)ueP]\Z25X͸KWՑym۴zIpʇp gV$r6Ck ˈ ^(. Slff$IlMA^삹ζa]dS$p_7M3{^nd_z@Vj.d)~~Y:y[ ղ=NN͵ Q&-۔"ݴ . SEVK &?e+2>qk)TI5xJtU"m.x[9ОN՗Uj[J*e=ǰ> +endobj +541 0 obj +<< +/Filter /FlateDecode +/Length 4763 +>> +stream +x]ێ$q}gK~ =X0`ȖAKm F:-YiKiTe/aVWVSzE$ ~*ip*?_.o]~)y/ߓb1TQ9'B3*.XmUfVȨ"06(sJ0Ce9PF$PZJVCF3:儇=Jtbu:43F`S. ｋt8etŚ8-`p[4]-@WduEz8]2¥h-KNK'\4Fr:6 ÈB'4l%V[b΄ѪitisE`YlAs =ls$8!H@G#lc!tr80RAGFg=F`Ia p\` lp\`hnLRy fJ Do9.0\@)q\`qb X89.0]cwU 59Yl9.; +w 0Wp9.VQr\`:Jq)1h8.]nj'5(#h +q|8[@`N PK8.p]01cl%TLUPg-,De8.p]g/0j xWԜt8.q  0 %]VL1r\%qfa!# ) @B"w1' p*1F$Rx_/=郍6Y:!w(ml":&ZK,z1I +ZGUt+}v9Naro~>]\>+ڕkYvi_.T6.iLݦfҽL'R\߁M9jkKOQY|3u˿|Z22(-a| MPy5MGϥ<͛<[4}[ˋvcM 7灻ic7k am{]})ײ>\2=0ÃCHۼ:*y.!r?"iqB)e@Z|{3p94+Vl;q:znûQQ#<Шك+M{A*F})=e^cZέĕiᓻTP9G3WdLmLG8O14>27cCch34x珐{.!w?|dk2\FhC̓;<̬ m<hl98*ȃ??DT:Um C\: ~[qP֐fk2^۵x{-ꒋ+,=NFwf zIFܔ|g52\hCR}1կlttйbq؈rԗrtܣի>kώ쐽-u.3 c@j2 ?Sĭ ʩ&W򽶕챡폥ou+L;2 +kaRWX.&`ҕ>[߭}0+B-6JMiӆ5\GS~h6m}5պ/_oOzHl& 6YF~L[Ò1}ᒙe k˪s;qqOOΩc[}X}]4unn;\C_5'Qۍt6/Dsyu-B!:*Z[w 6+L^D% ++g huCaDmp)ѽl=Gɡϸ9옗1C:?c7V뇭&3toQn7y5FY1R:`$:xdzyRU hHty4- p&ɣ

    B,7eXK\6_H!$x-EVbPS{(u yEI[3 Dgd7>O[61-%Mo['>NZF9IS)u)̓ݭCi nFmÿLmϝRMGh qQ$5Eup?"ⷞGOǘ>xPTC~͟,ڨQ.ᯆauQ +PLY8 +{,Ұv_'<"W_p6|Tid|cr辖.݆%sDzGs2!j?Q}=Kw@հuayU`ϼp~~7w @ꑒ&tѾ<φ*%«G1y#O<7qo5(o(8ڈ$p__rU+pcP$hīRws|e>(t=ASҮ]r9}we>MS(烱ivp^3[^$vWGr`{8Xʯ{VSa܆n;T~Q(M/z+C{4VnRٱ&g~]-Uy r7%(zTE.#y۲E]mۖ[8|,S Uv YGE(Uj6z 5[*fսZ/*bzcy\f +Lm^{C2r{bm=p\绰>N _0tvAfRzOr-zW&3QI]M:Ķ~bD #N֢-:^M.Xd[T1ۅMWJsBK{T=MP79݆ǩ aHSOk;l]vqI:WHW7 +PnGҥ!VWahV_5)1Olo_Jhl6I7ֱ =.B/Lz"ݖyl%\6CI5XUC]U45(N׆2VnƝo8Wfo+w|fg1A?JX6a7 ŝF߲Nkd܌{9mNQ.1RC_/eײnܺ3xRLI +۰*Z|m{vىTAUӎB}8uVf&/@kO˥h赥*\e:ӧP$(iҡzȈP\nLXIs=oǮ0Tp1tiiv,r+$x1lXiZ^LuQ{06&_esL~VƞiAN=4l%+UN. UJ &_UGK]nD7KKEK@ns譓=e%##c&=:^fn]w{ΒguR՟b]3&j&.X# +ak<{%;"ud !12([j oPcPT;k|$&=f+Ӝ L'O vhH;PO~7dj$7dZ +endstream +endobj +542 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 541 0 R +/Resources 4 0 R +/Annots [ 543 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +543 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 461.373057 101.433071 442.623057 ] /BS << /W 0 >> /Dest (cb45-1) >> endobj -538 0 obj +544 0 obj << /Filter /FlateDecode -/Length 4669 +/Length 4834 >> stream -x]ێ丑}ϯg# ?X=mbmCwΔ {dVwR$bCLI_~/bL凋S7oU+ -Gw> lBr&uvۼ!%o";r*AT !.1%I3\ CKUT0* KAۥ* 4I* J+ءR("kvG{Igc2It0NK4x]t[\RZ94tl u`%]-]-@WuEy%]KH%T q3 .Z$փ6È|tx咨-*#,l!H:!Fa C%.CIG7 I\qכQd֛X 6YכAD!DuAS-8 M$ yכQXo"S17.ft]D^`VZ+ de+(f anS -܋*9k$1i3^`ZR+1mh OQy!`Ό!_d° Duъٕb|gL?1SV~44!00 v5.z qb$-FԌԠ)閍]fozY~sy"Whq$s:$&.o/_!;Zߗ;* -:t>2zjMӷ;G G'],u+wPǂ|ԃuN@ڃ_B'zN򹎘!ąlwNQڣ:]3w{;E{лVo<yMs'ߊ3 Ԩ f' ^\Po^ 2u$usnz ld}>h[A}|}л }%>dr_> Уm?W>Xӡv'D\hUJ,eܱXAЃuNسE$Ipݭ:zyȼmk#ˍwY|*w tLQM:WVt> ]F)b{,+Jw<򔗂Z=2+BiXjy!kղ~:nvYw42|0 -{ugFuGܽSZD@$1f>0]|;Fv%(:e;Y~#?FQ+<60u$ǡ}Je"#_)D[/{\|^:CK8q)PUJ.7\RϵTD,{ِwnܓzh { ~Zhϕ>HكuN{;{^ˮK,sjYcc}6S4yk8URIOF;3"O{鐸+}"1Tt~%"g+GCѶ~vܰQ{oDO|K`!y'_}˸G+6 o˕Iϱ{ǹjַ{owGzƨ`V|Cطzv ߭=V}9~{|sѝ0k+'is X`!s'zɻyd%#@XM=^s:R~zw:CN~'5z'3VŢdv:[kfvOT]w 7w3˼5f|9u;߱bwGc!'?ȋ:Lw\/o;DXNK/A7:CF[tTd٫#ynWr+h|ɤ?θ2<ݺw츰ņ֚!6^>`!7CJէ~,Zg֊oNsڎ=ƼȎ=/ޝ~򣿢Apџo~_7>Tv | _3n1%o!eǹg_pcQMzqA(W(WDž[Q54i{Yd;U*3~T!߻ӎIجy'qCRh -,.B,/P>n-]{l&e]!2IUuE]g -+S U1kbW:7;]{9 ľr+q_T2mبgr&6vdL )4qQ\Fke 6Ȥveu&ჷ:GY(5~zoKhQ-L֙d 8QaBCXV4yԪF쥤 ]C&6F[3nCxz2oM\Nc닊U8tMW$r6CKUo섩Y633v}+l>;`aD>MGmMxB`xäI觇כ>JUʥ²,㡟9^Aj[=[64ZhAQ&TRNZ&J"-bn8jLѤ=Wj':(-3^l shWZKFAy*V4?wm2[dZ5(=3vuTk0QkNBe"K<\g;Ẅ\ ?1*hmńW(Ҿ5:NxIu -j4czpLÐ.>U1WИR% +x]ێ$9}gM|HhX!!nҊ Bδ錼Tu;3lG+U#wz|r^0~2`@G>_?uU 1:%_eT*!5v^YǨ9̰(Tyab +f +0C/Rap*!J +!cbt8 QEV硓^q:獴9g3F!9-V#8l1:xN`vZ:آלщ.+:".` ЉRlZp:) ljVIr)ℍX-ӰӁ'!0Uխau1rExQVАx`2 LX@85G*9BB$GZkZ`` +p\5lQFs\h@n 5B: 4f + 4Wg8.Р\@)r\qb{ 4XW[8.Р]m@w5Yl9.;Zqj)<e8.XTUA xWyVAq*.pP2q\ F]P:9.@cBXqǬi CtX >V1̺(ҹqQi ,x8. ޕӁw E`9.A +@A8.]В^xL I @ƃ@q½G xWX9.p]a:آq tX̚F:t]!1Ü+8nr8*p\Dw(C܀kqXP- XQqWE+qW!(}[)r\&B4ocUN<{3K = !K G؂q\"sN'a l B'%ADtxh%1ԜΈ *r\e&ٶ`&9hk8.Af آLMqAQ!ơ(p\uエ16jh`E` Ȭ[p`'N`\o f`M lk#Ӂw: p&"[no/@#>!81^ ʦ ʳ9M{$6i3 B)6_cf c3OX}sbzؘ׏rHA|e""v Es"d! |N2f-NId$_0o#xq@h=`[|gW4X`soPFG C\)̬/]Ɋ1Z/ e>_~0zt/o$5aȦؗ +~_5>AY5k6oKɩ{K4)mٮӽsݵ=&ϥʆW@D7mbX`9lU7 W )5 +~:˴d$4KrM+ry:~̦K9y\=$=M+}Ps{Kn "Ucv{!,#~Bэ &9~>Buʴ~!Ea=Vt5ZrwR=?/SWB[7r΍T^`<0f+W +z[iuBj/68XtH_U7m9fH^}C%A(C.}[^]W+ :CN<{*~yWa]#h}} zz,Zgi,PJTl;oZ=ϑ~uZ@n`VoǠ/ʒwB +ZI0Z9ZţgټƱ$=s:W >K {+-*|Z:O,V@>`!l;|Q2I\\v9~GSgFyHD+Қ1^|*#PQmZ?rnWriw;_QxSE:gC9 ]F)3Df\92<4K^,zhZ^(dν^[5TP@< 1&H[ZN=]ƅK5?!N:>ZzYw4<|02gzugFݙرSߚ絈z$IHkQpe>㡌nXB7ܟ78Xt2s$v͑D< +M;LmL]t?J ?lSi =˲gY `0q.P]J.A7\R﵊bكuNԝsϤ:zyY m;2㼂b}2{Plgku.=eW2Zm%:1Vg5Չ?ؕBMsj5"i9wo}x%_xND"OkD"yOоuqj(cuNz~Lr>i}W*o>=u;cE..Ayn'iԧOC"nY^Wo :Cveș~I~};}}9ӕP{ ;SoQC8ROiw.sbΡfǙS4|w_An VCJmڽ|:CN>ƞǵ+{ъ'7xn KU!)#X/1obXC~gRUy;Vܪ ]lRQѱM''?^ T6M:F'o[=-dG[}y#Sm[8#>5fږՁ b_Ri[>*[zR-}%_ +?ޘKq$N \5źb3AC˶[]ԂR(XbL;C皰NN/e'ӹ%]p[KYiziViUQJm)Y'ybD #F &ɬWPdjX1ۅ-7fLZ*|3A]:F"AIֈ\:p 7j!]+/3m +a Pv8&M_OXE^ܐ?R<4R+$*:i|+KKz_1KKO[KIɐżDRSiXV:_e9.m#Td䴥B 3%ЪM,)Mt(ڢ/6Z1ERYqjkd)}h%k,ԴȖ6{o{%0"SѪEɇ3\3!2wwQu"81鍚vd)z'L`^o+&mӋu +zCzOf_`( endstream endobj -539 0 obj +545 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 538 0 R +/Contents 544 0 R /Resources 4 0 R /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -540 0 obj +546 0 obj << /Filter /FlateDecode -/Length 4913 +/Length 4884 >> stream -x]Ɏ$WY/öې=a>%-}`rKfR=q֠Օ\ ͒Wo$Bޙˏ1y+_JxHoU -'+  |ʻ/?v2)FTFO>x/,P :F&ȩ`F T0(Uxת3S gTR`u0Dvrt锜\*:i=9o.N98-6 -,l`s:[ӂt(Ndt]tQO6cX]N:%dւI9Y`S:( N'lduj8-8xj3[n-t( -|-;0&%p$L0cd h'x@ h[qh [ f.-: -HqְEq 5"J 48. \)8.`\@rqjp'9.`]m@v  F - xWkdu8i4.:`eR! xWa8.0]X05,ynBq\`(q2 wA!` {M -a +#3V q\`2`X]G3r\69.p*p\'Dw(C܄gqXP- XOQqWE+qW!(}[)r\&B4ocUN<{3K &= % `tp\#lTh - -9A6t゠` A -Xe:q<4֒jNg3BE 0MS:Cmq?Xlb`-7!%&7=QD|D& -9.C'Q7֛エ֛X16jGMqA4"DauASd-8 MsEEqAt֛Xo"g7=]޵Lxz- ^@+Poe ʳ{Kk$vfbek -춁"3+Nw-*8xੑ kLo$~]?K;eq5!_M<&mE,CF،żFFk &bY"I-3zT+X[ma=譯,E<'3ZÁu YfF 3irx fV^pc/ #ͿYF~AQ*(̟-th?Hk¬d~LNyNWt"?r.Vs])kTK9בgsbJ[}Xηdt&T1IlIǨQo2eq O4&1ȳas4w;6_\%?k^?t|]bA~^'݀eO DpަpI:KD_L 6GT!wQjK$0cUu(b  *_]EbKxbD9;}#AجKGi_uyz"ɾ/QU#ʍ:C8sۺ)Z;9c% Ӈ=Noy_\P<s=kaN[m't|;rӸ_x=o>gش1n ޡraF q&󻥣otTxxm#4H/B`րBHw.χ,+yqXk9,i0nqe8̸ٕ6~\Wߺ<˼]wr,ߋ%a8QvLp۰}lSY-iv~նlgߵϵ2׊ ]lhO8Y dAp3[=W$w߯%FgD8Z%OEjHQBl6PWjsuҔxeҖ<<.?̸ZG&,e LMFuca!!Pg|o.::C^+oXvsya{Oy4e|[9'DZȈCD6hf8L4.աX2Gz1"]m1|.ϣaG}Pb8|q"y3nqbS=[-t+$w4"[]r9AOvb{.8\ia-GR;|.!x? - 1h -8z< ܌tʛ3y^yk(O=z:wu[󙖿+y}Z˶;\S^i?,Bv_'<"׎q7Vwq!G3S{tWklۭ;-Q<('=bd>f-Mh:HS!EV *^vR/wu .}l_2&=nM]{l!z;"T%XVU1QXʕP#P] -嗅iTVdw[mbW:nr;-963 TJTo*0B7}I2[+;ѷmqvܜVDNK`H5~q1ߕMg?De Uu!=}I8)'):m:27 --h~\M.2^h[vbUzoC/@CǦ9QK(pUx蛃tkW$(iseC_( -cla&v=oTWЅ47]d] 64.a~q&2HZJ_zimI+R**P-KwsO MZCNZ"[TZE D}l[RKM}ӶډJKW%] ٷ։ƒ>wRٺnxk q-2-]|fsʿ"CHN_&sCMFγW){%}Mh-/Mx"+ʗ٢`t_0[AVP MiO3mGOKEB6MAoBPI  +x]Y$9~_QHk|VHKBX⡻vzEZx3}3fUS>/vUJ}_JĘw/R'/X\d + ©䣻~GDHN}Oz',)yIe1UJ*è!hWMLS kU6Eǩ`:23 ʬU f,*JK`hFt>&X]N>XK{"%8-NY+9l&NaF:آc0.I.+:"T.R%d q N)M00H>0: [tgtXq:3!FfjFl:XV[0h[d` %t&m9mX@$l>TiY1Qb:bh؂[5Z8.0[+oT…5[ (PJpwr\`@5k h9.0]cwANV[` ¨h8.]dw14Uz cXr\`: 0 ynvRs\`jq"?LJq=tp\„FXqiP1y xWE KB83oBy8.p]8*q>#x9.p]e9xW$9.p] A( %]VL1r\%qL c!r\pޕ d @IqARMm9.f &x̼Mz3p\,lqQXlAДy Nz3jd´뚣%3ɦ~{]^~wʟya I'7J,V59 %R3RM726]4 +Ln]ԋXzwwb譯,kaC ? g*Oqg3kH=kNc~ӯ~'ׇ_~&%F,x᳽wЇaE])/h >~k*:7QJK{F>1)(S|fwu#mN+'s[J˿^?jSߏJ3ܜ<&wӜT:SpsS箦7UҨ)O.e|.p~9lJ5>3Ԇ,5d_yIӱn5ǔ6m/s90]շT& 7]Bi PdO}Z7STEM +iB<`PܛM= Z+L;" _R5RWEjAZfo~'`g]{F3_{OY!%ha(q'IpQn…J۳Ʋ29J-=uPf>ͲΛJ/ uL1?3`);l=9P,,s}*Gi/pW[,8>`ӥyvT_C#g}|&祟/lge3cDCyfovò.)!CqX5uYr{?̸9fJU+o]e쮻Նr}7a8QLp۰}lSY/iraնlg߷ϵ2׊ ]@px +<!"_iBh<!G +QS|mᠮyT3 kkw4?>vv}Y鶴ea;e#X>Ѱw(50]ݍ}\C9 a{`󽹘4+<y7tXmb'<./hj7r]n(1X#Sg"[9o !A/ϯ0{뻺v ڭc;ȶ)P_7ΘzOyֵur 85qͯ,{-Re^Y_^Eosm xUB+=Bʹ<fvpgR{b`aw/ue@2o)+L)y;A\6!]i/M~nh0"ɨ~<Z^y\5bVHo;#@1 H +|]\TPu2 "-7cgMNL=P9Űt=ύ{KgFly9)?i9=ԸpY[^=?y 8G?ж}Vzd~_9ls5 ̨c_?y7P8dC~yOӎ:tйmu%>"!9䳧7,4@UE_-I6dC.;wlc\Zd=Cv/p2á WݷFq~ w=s $vMx.ϣ!1a,ɟ5ty7RВ_/rѸzj.ͼDgS^}ůƓ͍Jm.vq +G^dCq*6orq޾ڭ:MddC↝k7!u>s﹩܃zOEC w'<BawۥDv?%[1Əg xm5P|!bsw6큆(Yvz.!~_t>YQyʿ%cf>a!Wv{g2ϣ!amGM?Lܶuwm6G +pB/h:e Yqyg-^p/_Q$=īRIJ5q|&bdml4>غ;Nv_\ـҖ޸/Ghs}R=u6҆հ}*^zx+MOz+x3+P9JcU&;V]7r}_SIzY:c1>w'F!8rįze +}RLeYUV DS'1GG]|J6;%7*fZLBbztNf\m2Э-(z:߄T7%p oTkF++vJjYe3*U+):Nva_R`V}7jtI lMJ:Ft\PSŖ5o4X;>iǥÍ^ ogLl׋ Lj׸B^hr8ʆ&~Ydth +W<Rtv*YN徲z@vݥBKEɤ'ҭk-]uyDRIyo|tWo=H+~ߖO~\rB{2zY<)Ea6PێXŖ4T?u׶eKJUTUm/t;t=vk ctiJ讵tb.26i.+J\:Vwqˮ,[I+]O~( ]ta]EYnE!/+M {<>yg}$^6xɗ~yY}7|-P-ts MZEN[9+E8J"%bn-l/S4vNtUZ*x-ΡN5Զue^ffol*-s}0sCਭ +F(XXzW;^zG5)e3FEMx"+lIMFsX:}˼!T/-!HϞ Em}y endstream endobj -541 0 obj +547 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 540 0 R +/Contents 546 0 R /Resources 4 0 R -/Annots [ 542 0 R ] +/Annots [ 548 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -542 0 obj +548 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 609.873057 101.433071 591.123057 ] +/Rect [ 101.433071 713.673057 101.433071 694.923057 ] /BS << /W 0 >> /Dest (cb48-1) >> endobj -543 0 obj +549 0 obj << /Filter /FlateDecode -/Length 4777 +/Length 4945 >> stream -x][$;R~_Q+\_7 J8#0]szWY|vHgkzbVOWF?G2U")<]o\~)8%⢨opW(LN',a -əo7\o?):?I\%` l[1[2H\`J޷=-? OQ0yЫΛ)е qA4a)`/5ELz @Sv$.i $؂"q)xN8ӅNk -%.&bXDWK:Ry%.*J\i&RЄv`&9XGhv3J\#l1H\lf )O₤d @)%qAMC`^f Y&x¼Mf lqpQDlӔy N~$ -϶BZoy<Z7Fξ*{QYae~(}H>\CApχw)htep?$'<}5$ˑw4md24lue\b7aӨe:fTSoGi׸A9oF <?-6a62}jlOy'<XhϐT{~F)؀ў~G -Qq!C8kղ~m< wdCjV{Z+XzJDFdX 1`sy[wlX~Feԃn]bʱq򨷎H<Ǖ ^j43[/K`u/qE78{瑧Zm39hw~Zm(igrtv`K <\QWs'<: Y(Ѿutt<>َCN˼g'-gz=:|KxUN>[7=YN4~+>%;xsyk[-=3'*{wZwO3|@7ygt;; 9}︶/_ OkY/A7?:?cdރ?V\z>Etͽa8ٿ)'zOI n2s~lJD_r[h EY[g'j=G\a u,sb[T{{^^%j-۽/3[m~>;`|˺oôG!UGq׎|XUsR^X"B-?T+2> eBmnØי?׶+wR;3_ (i^͜<>٤Yy kdWǾ)MsY抇P\ׯk>k|糤UlƲ>ǡYrP2_Y\m\kw̮l^}+m`{Xe0iS"ޗEf-+/^hK2gjlMlíпwKz񥭵?O 9m}blajXpk]>_ cN>*-(s 6>mW:UpPb.7m9`lu(y!oW3{S;1%׋/O I)#k~pTt&]:V_7rRQ9eD>Hy/*hE]{QHM8 珪E&l -aJcL -~4&w5[~^-Ȗ'+Z[&=ed+Lq a/x^`x(V1[  U{t~y:߅tu Mk=j(}ڻF5eF&u5ej$nAEMF-?.HҥN.b4F*TgM)6dfi/bsDq)~kknJx8j3..] -*вr8.05,?U9 -פyM RWf/;}cz@SiYwfy騄t[c )2&IR8SXƕ\]Btm2]+}7.mu~}0_(Џ.6v2&솁[ةx[[4??.t:nTc Ӹu!+Y~W<)6m.ֱu m75{MBMіކ^l׎M_GV7l_H\}I ˈ ^(.Y[03WҺ>O|(l]07"_ڮ򢫬% l/44-~xz}&:Q{qikX6“\e[s5_{eܳSeس lQi](]@M~V8Oѥ=Nt|T*m.x[rΡN͗MJ=uݴW ͭR>̝{! ?%cj[ޕʯ -Yhyc%H0YoMx"+XQr&PP9[q% .C*淜r|(G|?/'n9j +x][q~_0Cs /bFv8C~DDZsLbU;_)~tQS +JEaju_$Sp}pɋ]~諙rF_)X,~ 0Ĝ%eEr b8cJú햕!I,K+ȡR"(xOJ)lȋh$SN{-BI9CS8 Dd1)Z!vK֕DdQAisrNeTi3O>Y$֓mZI +Q"xijG') j!1щ<ȂɗȢb +h"\08l&%$0)O.F+~r!G -UŻ !Րa'qaB˓!KXب L'F;j KXs4 MZtE^TNI, O*ID^`HZJX޳rp{DdHX<,[aMYRH<ҘaU*f pM B$I@ ^ $7!+0KX% N8S9IX dHX d a<)kxbxY`.b| ]Ys:]2:iA_?xOz@4/iW\IXJ-uRWj6|X^wYu"aU9v +«]M;Q_U3}i_?ֆXs{_dskyP_njvlFSLz\.y3gTΣzγ+z7 g-˖MYW_6ZmXmpYjy:u17P +ƙxF3Cf_:o#&Qyfwp/:VUVmY߱0LR-GoaW,ǬgYq%U8Y,,uaW +72YbZVlL _X/UVْzOy6K6}T,m<ֶ,xDaN<Kv[w4Mdv؏iO/zֹQ`?6 %7{f팲pv'W}o7ɦ[PA_)ۯEkcC~~Ŵ\Ɠ9aZRQN.C7ZL.=KeOy6K}{7U/C;sGzޱb扞;{Y}eI`v*s*Ajg_GzX]Y?ĕ5FJ&mv~<:OgyZ;+pksy :"6gf]0j8Yd8V2 +y1π^r\6zYA3>NtvLF=Ǫm{{نRvpPnݛ{(`v +u4ibyγY;xN̚z͙g殃=$^$ٍ{^>ޱw'ȥ-ݱqU}MOy: =ȯ̲FD㷲wf`{yY}ߔݬ]f98,w\ԗOkU^A7wMY:Og}͏-Ǟh6 ^y>w̳pz|tWtxyCz[re̩{* O6]#?L|Z-w26q;k-|`ʳ0U}E= jD_~`;NOQBsFLÄ/ik9K|/etM%oWraKIV~yu{-e>3 M^{,95JL魜sI0Ie:pB7ҕ¾ߢyQhѿv(Qm1gRmZЛĞ=Ԑ)'k;쎆UpΖCwhzByT ߚӼK,9闇1:"&eU;At[9+9t[Lt8iY;WzS3>$!hþ\>o_9Wy|K; (xݓuĂٙ93}ɏ~oǼ{mˑA90غYm̻~&+6Rq7 ˍ +dZTSwx_>\v%)W馥$X{a>/mvkYԧc~.*Iz5NW:!utQ,oZ^f|{:۸L#XT&Njn"Vy*d8>~$]#N ;ad".UkW 8Ny,Z-{mu4Tjt ,S"j%դ2%Mv +Mr7x`xHV1뮓h:컩.tbNeMdyx[;RD*26UkTY&TnT_K qm"Sil|6ktLLՐ\+k9t|J^5WwQ/n,AmTl([?ɔ;ms!.޵oҾc<%Zn#'Safѱ{ +ߨ+MJؔv׼% 9ѩ^I^Q]/i+m۷[]w+낄^oJ ޳v:CA*UJ&D +lNGklyJ!CO*R#׹+fDj阜*jz,e%1sj *,ΒjЈ׈Zrz,*-?WO?~K# endstream endobj -544 0 obj +550 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 543 0 R +/Contents 549 0 R /Resources 4 0 R +/Annots [ 551 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -545 0 obj -<< -/Filter /FlateDecode -/Length 4885 ->> -stream -x]َH}g1/$hJ5AiDڹ8^0շ3O lyB`B\o^[ ƯW).$~*ﮯ_/:Ϥ2z{aUJHͨW1*'b -fXoY<01XN3RQz0Cyi8̐zF%JVC1Z1:iAwN"I8փFZb+, s: [ds\H:)9. -  ]Cc/tF>3p\(T;M0%- 0?ٶ`&9hk8.Av3p\lQBq\l~s\lAqAn08tBp\e~S .i8.Z`-nvD[,BV[4Ef݂;q:[T4Dh8.@&"z6%htxF0"2uMD^xG|+81^ ʦ ʳ9=4Yf VM/11Ԧ3X}sbzؘ.?}ߗLY66֖nՐ3`"V@@2j)N)726^97L:/v}DiZzowTbJVkiӽ)ѱFF?lҨ{‰cw{CۍUdD\tT@;[3+O/Rl7+q姿/?O/ nL D_~!ƿVrc~j?UG]`g Т0a&aee2|٫ŏݟTLehMFiɔ.7i~t穩-f?b[gϥֲ 9)` -)aqlP Ȼ߇fVS*RZ.EK[hwV@Aon_=ݘ6+>)sck3ens[fX~,s6,+ƧW˰τIiʨf,>d׿l]oԧ^]pqkm Jz[O7y~Lϓlk z?PEIdsht)<JXƋ'zd;ki55> R<`Xax;:n#Gn/bL;Ll)'x3ʞRӧޚuW:/Eˬb5۴ʾdUJUC.lXӡm'}oCBfyQi~Xa}r~u+5o֛afxSb:crIR@Jf'_tD;t|m%l|ZQj|ʞG?3i٭-Q!26Z9Z2zmn"˨k]CIVMdHRU';?woSAJ5µj*|il"s:m|2ls}޲˞',Ol:n}Mkѳk[Ȋ\A[{uNC=%kLK_;+0}]_Aq:CvyO<4r=j2o֘X5`/Yh=Vlh;q=h'v z~Qhk x:Cv.|p:=:2Hn!m8^mD;! ƕ$j۱]ѝ̠y3qF|'EËk̚k*ߕ5+FL<s:SWMzAݦvzoJb;fK٧Uu-9a5E7&v_ _n'2ztk݈tytv|tt6vk@skO,]i!_AU4&`ӡj' =ݳn|#>_sU5R2) s:TDW]qhH:~8<;sVd#X!oafɟ=t;|3%ͫݛS;v%6uPŽwgtl:]7u3RmX߸\#/Uﴊs:e7)uiTf>Bs:ė]vRL[eǏG9j[Ao}vrwIջ[tѵE'zwꚿ=s:ij7(м=s:ĵWWwkĿs -Bojs:xCf -yŲl"(N[3'nؗboi|ޒc3r'UDvFX )Tq$Ϋ5/!W -%ȯ?(~q17nj~\pLz2zk8(faY6PXZf4?TצVsIYTm+u *UR7#c7nK ֹ{<-Ρla:]]iGTthj*mMZ63vR7Th9h:UgmβtM=h64a~xyy']^$-^I R^doҖn֞.AN]504jSvjliv. YVZ&7UÒ8KLQoGڶRѶeJKd[8zv,d`d]YڜZ.J>NuJ埔 k HDpb ބ&5rw\2#s%mOh-VLx"+^բ`O`RA"ބ)!T=m@BkI/ x -endstream -endobj -546 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 545 0 R -/Resources 4 0 R -/Annots [ 547 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -547 0 obj +551 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 797.673057 101.433071 778.923057 ] +/Rect [ 101.433071 180.123057 101.433071 161.373057 ] /BS << /W 0 >> /Dest (cb51-1) >> endobj -548 0 obj +552 0 obj << /Filter /FlateDecode -/Length 4735 +/Length 4742 >> stream -x]K丑ȳ~9X=w1  sl5>/( Q*H݅"#BJ*|_rzJ)ஷ/?]¿RbuS7V.N^G"8M ny~q󺎾)`3bQyR -,+ CYbA q[V.'/ 3& 1nYbĂ:((% r B&FY;/O!$,>+-'D^O<䓵Ji=yئyXQ,A, H< Y~$pۘZ nxȃ,| L,* &% LI `\rIBb 'rp* XY X YVȃ,6; ,( a8+a:XpTXS:HX`SIX`6'a”kX.{uF ص. ,p:$,p]kQSA@d%,p]Uw v$,L&%%ak"'A+a!H;7pxe$,p]L2 w!^v V+a  -SJ‚M$,x3IXBOX7AEA8MYX$ě@' N‚śI7ы)Df]L 4HXěl^x}&3EI(@* Us -K14,SVJL(/19STgHX}9z1SlΏ_~{_//( ɘn[c61.3ICB܅Ԁ%FBbJrN6@?#>0gv\P!_ۅev]I{j۴f*Z%GhMk M*h -A'26B},eʭ -H1-~嗿]_2iBa6ꥌ[j_ֲ rrr꼬몗u&C_D]N{[6l>3F1UZEw83-˿~Xef|-7t̨=>4E?(Ot3&1'2ݸi7xbtk{t"?2Uӓ:fȈfYe֬趞dG5uXz?H2ġҧ]!l|ٴfLzkdΝsݜ?I.!ylmFi ;AIvљla [%(|2Wh;su~;ǒ<4s\''R6uƱ̗~Gq{ıy%~ao=`L'h}@ǎViY:Og}1wت2cv@Z4#>+*lwo}ZhO}wB;R{O|_{jeOy6K5}قs;8+Navkg,fmwy1}+>WZa۝ -GOpϓm={E10ecב{;\N^C\Yc*o?h7jOy:Kj$)W7V(chyod>2k,tj8Yd8V2 -I1π^r\6zYA3>Ntvr}F&#EGoǪm{{نRvpPnݛSP<=׽~>idgN{o==>DAmszYDfڮ⮧2o --W'<Rp}iOK[d:Og՟Y,Y+|Qg'KoD >Y,_n9*c<;Z`vIvMuSƼξ7Oy:򧣛,8 k{ "c~md*k C$&i,\{Ζct4Kge_=;YwZ=q>gc'<5 ;ƵZ>eym=wf cE &hl`e7k?wl'-*u5ip<7ɿ)o|OoI2=nXM߉\˳Y.gmRO!w:gsY57\֯Sמ4Y=UJs6Pe>/^eK,c_vұ&v~2#/Y5uqEi/@ ʙgmYqMsҿ_zb/"b (]˼t9lR>Ԭ2?ɤYek6wGyMѷ[ڪ2W{mc6+J/O;KYV)8MV;,Gy݌sOSԣJ{zeȽ\s>RE$X2AKyRuڜ>*+t('|Ymm -#V+۶4Q7 W$=iyPkreî~9_'zhk[E "pzU'M6\to -: b<30SS?j[+k1HM6k>.Sy[Ogkge"!y3m?]B9CMs4UH6t5>mKbZINrg7̍[yoJ+`E[~vwWB?xC]DmިFx2Ֆ۰m{M]]C-֞mNN_ݵpnz睺J[uZ7Jk-*SXU'QKGig)Y nd9>:K6_2 k7%mmvn{ep]=SիMɇ3RS2!:㉱Q;T -KK,5:s%یH͕0VEM& -F>fղ6sj *_S^+ v)T&vPJ3 +x][F~_1H1}I( $.R!L RW3lڳ㪾g4St|{)fKw֊tѝe CH~9MrgRF>b VP97`T^Ŕ$p -UfPNR 2& +3,m3L$`N.*`6J:t %у$QH:kH;-wQlqIiI`DJ1H:[JtNt]Q啖t.E"QS1ĥ(7htZش# +䃠3+DlqVIga Gҁ' 1 +jI`1DlAK `D `/H\# )/qO +:|ve:B$.c=$k #-.` "SL6D$qAp1ft-"t:H\ XK ^0:M[0T$.T4D\i'[xi-qA4ޠD234֒hjIGיQH~`WQ 4&$.@bI\X:bI\f Fbf )O₤nq蔒 ! 0.y%.HVa%0n $-.-p0nIXo$-&{^oF f` ^ D^o1\u $LzW ^+(F anC +܋*154XYF/F 0B6P_ck Qy!`Όo2aXJk|_? >=l aLM0 LBw;xo9>fxbfb a#y؈8HL09ހG8£DfzcmiZ=ҠBXĚo; ++:il2L'p k-䱂'=/ꏿ_(E?]z@5IXCqһ&>]g<>sYInIL5uЕ#/sJ=B;ueޒ.SPӯ?9:!z_ do<7VG5;Nԁt1@zZF;56?wW|lsN3IVtIuve}3}g zn҉歊 @~; X.$c_ېD|N+Xq{L%~ROHLإ֩v8}cIɚxoٔFeB~k8nm_án2&TϽXNE.'r_-4: +֏6ScyHn_揿ӟk+]9K;c &En <>[֌7Pr1BC-c(,GnXݙ XuloÞa0lean}ڪ7f߬Nمu[XaD+琖jTq FS$Bʾ<AJ5۹=H)-,֜qi:V{2^.CwZ}("N*IF0 ~77jI9g> v7JsdS+5?'f;}ѻx/; 3v9\o:ox'+I8=qrW{uגI4T&m]c]#%ӵ*ɖp5{W߇&__ѣ}]}쯸wުGgG=ޏmʙaG.n񀗳3n{9=;?dy2\Ѳ܋̖3Py}3Qu7W|\AU3貭3ᐸ7}$V} u[oXs6V@ug!4Q 5YO?65 6>[ݙpoM=fWQv9ZmDQG_ݓ٫N ٙp݈>|xzWq^?F=ڱXAНy{Ϧ=vJC)59.m3ZS8Nv{+1T@t9t>빳Ϥ>}g!x_,t3zyZ>5e{n}3ZEO6vOԤO55=";5}ˉzS}yYn==|nw}}OA~!ҙ/1MzlX}^9FjzmVl.ߍI'y_߂Fq4_NDb)fQHEv!)o)Щǁ^?󻜍N+bA^/|'1I2vM[ 7ڪFBTWņ=E~Ӷk{4k{/ry+ޒ-kݩQ6wRMilY7γ Ꙫ-R>k. ?c$D=LԤ5݉ރC_n(6܎,#"9VքZ4b i[2PΖxK5 +4%cr KEWѪUA/OYd/ endstream endobj -549 0 obj +553 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 548 0 R +/Contents 552 0 R /Resources 4 0 R -/Annots [ 550 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -550 0 obj +554 0 obj +<< +/Filter /FlateDecode +/Length 4495 +>> +stream +x]Y ~_\ubȁ m`C~>T$[YL `v$Hִ4J)@NZEXhʛ?Up~=_cVa9S 6N`yb>`Ă>-+B K,A& hܖ!$0Ge40VkA4x Q!eE^D+S!FeBIdY!7DZAr)JY\pZAxXh' Y]IAx)ӖgW>9%17ÎBxȃ,i+d!|IиoeeBx.wI`BDxqklx./aA$ )"/+SwKVDaDEG2F*aA"g pW{$,]MH{DdqJXO(3{^y^y`g>ܔI(PQ Q# h PDiWNY锾#3֟}o˟~Ԛ2vfz~Po͉Q_~F/ U`ei"G ʳHMlwk;˝<ĝuYrvZJG}Ot>o:>ꁴⅥ5G [V(!]h͞Ic޾&lwC"[\-]qi0-0=)=9O6ڕEk1.I^3Fr}lѡ{R뿎x-"_㗶+gd \-6؝1?"i5= 4p;ysy=o=lY/0}= a5z,[Ek[e\/Ş7ιeϴ5ϴsѷV4KW\Ty=B5| >o΃?I~]iXOoMyszp'vj,drQro+->yEul̴V;qs]Ϯ=VgIu kM̓}ޚ׹i;]{w{Y :8\saطױ> \z{깮A7/Wƙ߷ND-X[E:e}8~xOḺ3v'| ]=7t?uzϛwDMH+'Oͣ8y<}5U L`>EDXA7"qM;imM>bNm=<>UNܖYSY塰,G߯nn|?N)1JdY}?uXtmΗz^I}YeyQÜfi җcLx͟vL<<ּ6qCqg|.ɡKOLFN lؓ/1mc{Mves4_Wby(>3 (m^y>s>~ fn_bs;ʺ2CK[=Ak;4°w>tێpGOq2zX,zĤ i܆f:W#VUQ,j(iw?rY?iT`ISԼ3br4#+b9^TKhkG e\{-UݕizPrp>s~(yH>َs_ȡv쟋wŎkˆz{<˱3\YVSaDelmwy/EfRWc4,m3l~M_luga\-+)PJ"`7SGML&|"o93y<Njm/d "Ei~(}p=co\yNk!jlr$j9}lV3tĐW<*LAPu +csMOXU"ƿLO5[Naz~d}Ym ,5|6PctHX~9 #Sdbygy 񋒊Ǜߣ#jUb ^Ŕ2Qn8_6VVa/nТ^-r3vp_eZw=ْyZoE7߅& +cw#ilooz-Uy 9.tb}T_8r´nM}:TծՍrڲ$?uh1k"HN ]Nby4,[Ի.Jwu>2D~GK24[4/'ʹ!|ZWnҩtYi$ +ߨSU*'!&`"PκMt +BrHi8H=+g99Q# +FF uӛG +ˁP\*$q&~zFA,<O +endstream +endobj +555 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 554 0 R +/Resources 4 0 R +/Annots [ 556 0 R 557 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +556 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 250.323057 101.433071 231.573057 ] +/Rect [ 101.433071 348.873057 101.433071 330.123057 ] /BS << /W 0 >> /Dest (cb54-1) >> endobj -551 0 obj -<< -/Filter /FlateDecode -/Length 4726 ->> -stream -x][q~_` @l2y8;džq:ɒTRϜL: zUKX8;7*璢~r*?⢲'>`J3\RVeY\*%ZB,T) -X8JɆ(Qb) b߲%1Y`e|2n*&%0%$e40VkA -<TңijF\ly G py%,]PSA@GLvx3:IXXFV̪F `+%,]wm yIa : xj%,]%pآ%,] A2$,SFtE^Q,aAJg K -d$,+8T‚܅{/DIX#ye+al5`Ui x]m0u*D.M b"@@(JXW%(aA,<|"/*\ !DdKXZWBgB  "P sY)JX$Sx/aA -*U9E^$ R -HX\Je,z % xKX -dRHe\Ȃ [D#aAѠfdQKX\x^S%,>* -%,2A y0!a懒 a$HsDdqKXt3KX3dJXۤ|3IXP4dA'aAQQ,a`<%,(&#ߴ^K7iHu[\|3IXP^7ZPȿCA6>]>u~ ^MrsX-S:ʚwps{~jʛG_M~*8* TY$RRVOⵏ~6(D%hwl Wb)jD(|n |uRM4.tyx,Vݿoƪ[$>| kBSiv;D :>D!eniiǴY|Jn([#k׏k6VqޫMP4!-f(,kv1w9.B!Q 7 Mi<{ *Ҋ'ǓrY)j\SMkn ٧zH#͑hEFyHá7F鵍fۑ#;]@XgM1gۉ62fٶ6[Gr8g֧clt4jYhZiaˎ%κAkjYAK'1dqU-gm;{vsSw z2i}[8v>´sM{}#!M;m_<};{Cs'w>jόc%DZv{U[#;u΢z3Kw/ɿcUlG,bE'"P@FNDvj\m_[˧$‚JT'\sګElm{n2@fR}^u2>P_(WxZ6ͫD?zbz -&ˋe3m\b=4t<5zE7+6M5םP_z)$MGѱKu\:?_L_CgbJ&&]LT/W$O2.Ц6PЪ ^B2u,Q3-FtlVn]z%G wiF [f MCuAs6Ml: ukH,[SMVwcBN dI .;ݚgFgM rHXnn-JTUKe]h&:(%is3!.8oa`8ѱv;9a/rSfщJS yIѩhjtBkJQK0>L]&n\_Ht؂T4:x,ɦ[]'5tD݄@w)-CЗjнh ǎo:e6߈L['luv3Fy[%щn?" - jN}>0v^e9Po˱z3-(Qm.x6GNUkbj2ŹZSKqzL1|V)K6ף%9QǒYE^S(m۷_ݼ AL6%߅Y;vR<Մ&9sOG]'uJ;"mP9 7o` TpjECzLVЀi<{uC_&J8qf:=se/ -endstream -endobj -552 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 551 0 R -/Resources 4 0 R -/Annots [ 553 0 R 554 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -553 0 obj +557 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 728.673057 101.433071 709.923057 ] +/Rect [ 101.433071 112.126036 101.433071 93.376036 ] /BS << /W 0 >> /Dest (cb55-1) >> endobj -554 0 obj +558 0 obj +<< +/Filter /FlateDecode +/Length 4774 +>> +stream +x]ێ$q}g%x}`/%CO}`򖙑Y=Q4%<< 2Xc +/?]¿bqտ+V&# lBr&.o?D `(H\#M)/qO +:|Ove:B$.@`=%k  "F-.` " RL6D$qAp1xUy3u:$.&LZA/q~pI& B-*`*Ad.4lA-q"]贖 ؂hPh"V^I\kIZґuf 8T+M0- ?v`&9XGhx%.e$.6y$.H + ⓸ )?q,qh:$.H:biHK^oF UXob'd=7`C"` $[p֛`'IaI$qAכQXo""7]u $LzW ^+((P*n(p/f (/MeU( m8a}<0gL辭9z2l˟.|{\^w-y^X#x ry&m[ߓAeӍT6]4Ln-RAm}8ۊB"Docp`$%-Ksx%س>-ب]; mӏ_#?~'0v;eRONw_ޫ)EqN,F^ҲDxψnC=̲o\>QZj+r9^??v)4˦Pe2Pb?X~h-#6>cuM;Bur|+7خteq6`G[k)O\Sjܮ~3vվѵoSbT1Zie*~uSҎc:xoTǭ- me۪߲,TY(}t|-1w_|hy[rC1C[-17Q;NIj pj}&w-MG5R[5Kca#?u2רNU͝[!*:}S#IJhlA(ѽƢohx/s)9A=O +vCeѪ|+{Jޙ֓͛v+Gq|)HR酻u@JǟI6owf2LnA"{A6h%c-J#*9^W};kGqzE?*kNein+2,X<{ڶ{S>=% K6h_3^fFe^R~dt4ˆ]t$ftӨ:ϦķJٴ1ea]56݄ՒA*Ǥ&˻< V¥ z0Ӽ/J\y?e=ŲU4|oSUFR'$) d'AJ7ۺ3Hi&׬Q3/WJ{g1.*_ykY-%V|38ͷ]ў9!thwyyoC' _E=yO.wޜ-Bj^ůuI&]թ:@m1X]ԆƗ2a\Cmϱ/#Ϲef4Y_ sj6n}N=-w1:_Ό8~.ϳߏ)_}tO_9ջj߂F`FU3J8dC8xh1˭Q;[ٿY|33u<ZGH6]"~=twQ(x{-t5426HnL^2ֳ~Ez&oԵE{W9BAp+5F[y6CW]Y@g8gt?[Eͫ;,7o6Z )\}%1ul}%oG=XW)vNsK2ZRw>ܼs͑;?!5증׹Zތ.K|oB#R&H!C(4t;#07(7U;]<φtTj)?[KzYrS'ѿπݻyjw[ڥE;vYf鉎ֆdž̝|'Ao_st=T}JB> ?WDmҽmX|~[^ݛvǓySm6Von1jG(>PA`{n$v?NЫᔫ$0_ڞtի㜖J|Tn Ж&~3֗z@R\SPN@vHGx@>!|D@=!#Hr}f  =+RٓmtOY O4}4򱅖t&;9?Tg򹏹Nj?^t1ʇr,^tۅe'ALB:|T,h*XÔ)Qc?64󻚍#U|\\ DNbntq7S(&Ҙ3Umj U{4\绰>N_Ӛ0t=jZ&J8ZTQMfRu~D Nբ C񡤳0V QKj:AtJiThbϚ)66 pFY_ƈRgaVqoGm$v!\\(CMUKX]Ye|#?SkRfASگz%<6xQMܥCh3c AR5IRꚘ)q(TTŮAm!v6Tjy=ݵr7|šS/Ux X+bl+0Bw}:Z;ԏ}I3Ku Vc4.tzF<4n]Ǚ`$Ta6@]cO*2VƞmAN=ňA{R-*E TCɗl-QRh1Ey{9э7i:hɶȍpuldd~ݤS*M˺l{A#SճMw{ƎxpޘIkl6F8l<^vG5;&V?'E:V E՟㓳%%61[AL\yC]^*OYz#2LPZ>h:Iv}W +endstream +endobj +559 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 558 0 R +/Resources 4 0 R +/Annots [ 560 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +560 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 502.126036 101.433071 483.376036 ] +/Rect [ 101.433071 612.273057 101.433071 593.523057 ] /BS << /W 0 >> /Dest (cb56-1) >> endobj -555 0 obj +561 0 obj << /Filter /FlateDecode -/Length 4753 +/Length 4908 >> stream -x][8~_H|)$Vp$szw@hiၿ$+N3 eG{SKUDC)x޾|wQCp -%+U+ -Gw6 lBr&t?cYG_͐7]MVB A9AR -*.* JI*ADAaZ` $AF)QC5Ncн3z1$t:Igi%].J:-.)-lqHI:B6IaV:bb.I.+:آҒ.H$t*UNVaEa|tx咨-*#,l!H:!FaZ9bL Q[0[T` $0! I$`(RX4PV@>-UőjBXDX[P@ka!+q"qݒJZ % 3k' ,(PJXpwJ\`AXA ֵ ,hRX%$. 𮵨)` ,qq:Z k -xH\YC/q25Q5.@ԅkJ\@]p 5dQb489- X 3V46%8Npš[ :&/qui#.[O8.wAQpj$.p]m%xW$.p] Na$.tE]TQ- $. d<(ġx.{wVUGkò4A0*t]Bw۔,0Q8 -6HC -K\!AA@YP Xɦ(qA0#qA0!}-%. 1I\~ *b]@\{!bK\r$q̀N!, hK: [dK\H:%.  ]WCc/t>3J\9T;M0- 0?y$.MlsDl$.f Fb qARI!ơSJ₤#$.(qA -Mlu qA":؂) &IybI\(q 7ы)ALw]3I:."S/q.Dd+g2g3 -[Ŕ[1g@y$& `&vыYU( -xV0ex>3| ˂=G+f7Mp׿1SV~44!20 }kܾ 1ggd#BjFjtF aWcvŧsGG*oh֣M& RѢ>\ي)Z/ q^~g`( _hvq ,s,nXc-gߣeTڋ)׬}j[w:SM֎Ƈ'urfiorZ/_^~a 1JhD;>Vs0߀.w[ B7Mmi{Y>B Y@]|s6b'ua9+;|ezTݺKbzbe}VR'Bi1*8wzjǵ+Oj9k+l,GCi;'GOR*9ob -_ ==Xt{V($)]^t3cQ/+t̨QM>wXtމ`ugFݙSߛ筈z$Iky>0]|Fv%z~2~yuNߝܬ87;Zx'f7v7 oIϱ{ǹjVa,!Ktixgĭs ~љ5okΙvfvAڙ=zfk'ǟg+so X`!s'zɛyd'+@M=^s:R~zｿO`!t'ىBbQw|ǯ[{fLT:]ofܗy{s:{:Z 9}֧>>ڟau'o/헶>1N/_Hs:Dޏ5rHge=Y3\ߗ>3@q:CNmꔇ޷!J)y';u7rΡfDžS4pZkt{ЃuΆܸ}'q+^";<7y֊AL8bKwG`Fw_7yz>EapNȧs3.diވ|~|aud}dmi QC4uߍLL\go ǻ뗑S37QXr6ݱz"{l~KG)ΣnuvvkGP[vr?8| m+^Ih{Bpks (ܺ9qs3.:0s^1p1P0\L/y~Ir Ƹ~l-~Bisݿ.бbA?&nXe?ko88 v>w WW[ds|5!/ -WH)Ж<U7V#)34?!wTaʿ<#D$7u3| Y}s[N[m߱)m'jھM~AӐOt7%]I5ת}WKoZS+װw{щ_V$5)Mzo"AL4,?RnÐ֕o֩6n]h\\ߕjIBvcA^ՠgq~X|)!l /lw*&tkb5boC盰·N/eM`yOx[K_Ei~QiQUfQJ])Y'< E~JӈtճYojT E,7LZ*|3A:lYQ|\s^:*|&ZBʆC*e늺*VƧr%bkbW7;]]{kwWmb_Cq_rR2mtlԋ3c餉ޮuƄ0B7}eVvurqo]F7g3 ]<̗$bFU0[bAq~ceÄ7+h~ԪF쥤 ]C&6F[62֍b d>wnÞ.m_/R\Ʀ%_YEK (.YY03wR>O|*l]0"_ڦfyE6+ 0iiZ#yMedi*}zcYZ O//ϱ|Qoږek -ZcIc6pS*EQTLYm1\ xQPc&igWeshq8vwdd׮Rj%me^mP3ķTjnU){fLuTkIklP~aR#׹+YgDJZt~l+i_*C%%c ͩU&h|eLː613(-sV?2צ +x]Y丑~_F} ? 0crl,j /( Q*;ۍJE_R)U7%r zEM+)-V;9$6N1{Kǟ\f9L,gbT^`e)F +zsXGgܖ!K,I+A 뢶[V&j' > +, 6J<Fi?(=H<"/xN!:S' JK<YvNI<2B8mLI8NUVK<YNAl&@8Aᒄ&e$0N.$Iyr1Z L 9J8`h , ,'WA@4ZbmE u*k ,)$,\$,@\raJY ̵N ,@=JX`#aZkV8வ) Xdu8*JX8FF; V&wMRN5.@ gJXc k P&. dJX` ,wu4j)  HXSK<6YIX0I#m ++rJx.`HX/<$yq!i ƓB*aA½g pWyk%,]J`"/1 XKX\jJ8' +$,i'aA̐GE)DOC Ok ,%,H&! JxhPs$aAraPQd@JY`( A4GA띄)J7)AM7YAD|d& +%,Y'IXsIf [|)pn oF ,!ȃ,pnI7N/@973o"K( >$pi7JLf&8X1P^* *5I,@Ld)UU0 +xm0a>U9Di!o9Gofwo|'RVjC|c`2#XЦ8f)>҇ Kэ?퇕DGoEjt2?#?03s(rD탖ev]IGj۶fjJ:t1` 򁆠t" hc!QFܪ~)rd#t㯟Ͽ[/o4LOg;i,`~ZX~ƅy-?gpkoi-ciqL2G&Ykoڛru]쿯~yOk*l\H9x˗| aI>N~_ۼlڗQy7Y{Iw:ct0)wdg3PdwrJٺnV̰; x=tݵu6;j-~EVƫr.5йq4 :F}U̵kAG[UOy:uwquc_Y󼵞tz.?C۵zu~u~Wi/}6o;a;VP@g1|d<ޏ] Au g3_" m-vMYTydfXIEJlfǞ /^|iTY^ѴvnQʼ+ڎ +/QXX(3cvdTeuepݺ}ۇ*ر`Ss}΂ǡ zձ7YR#Rd`<|EiLV`Vp\eݱdt|?F6YS=aakRMzJDd{i}WH#tzy:>`L>52[qFEԃn$dr>Eԛ3[O7ɦ[PA_Gת Ny6Y~WzqŮ%Hj]'cĶR~ pqsQI(p<8|W?SK=kReOy:K޻'Z)4qYہ>wtp+f;'<ߏ^[ +tj|N`c1>ܱ]Uw*ZŲHmHOik;|6K>y{COg'H>id_ԣ{΂ 6=,#}_BXy:;Ytd<ߏ_sfvOTz]s0Vv>4hcX.np\߱bwG7gYq@!7v7 "xs:~apwU׵8XH/{0I`'U?؋6q͞YB{i0OYvލAE=bFZk15 ؤ#ӓ/u%gI7!ql򸰥$G?˼v͑_)%Z4^֧*Yf\o 邭{O#<6[jM1N![zGn]k9K/nizwXI=9T_Ka]_jr&daٞkAzy?-ZI{۲e}Qlav1tVL&-{Xk;zn ͖:v~]5;u{3t0C)Uw)s5aط}⎞f;^=uƵ-[űvu5Zߛ7#S\;cWcl,$她%T1>)ER20 +Cs0L/D&t vG4>" +#ף. sۇ){ԛ`b~*Lz_7ECu!l~~eu/ +} +qe6rR^:?hVf7*!O]3)zUvl䵒8=4q-S,חNJhOZ7Les@ǚ52AXOJNTULɾۊz& ovrhɱ7y۸+VdNF5o'c.@;r= Ivۥ9cd2 h?wM}oǍjhaܓї>dJldžc:ZC0v^[ꆠq9w2ikewA-ҽ{uqǫTe<] +j]:ΰMd+1 $M$[ai.v纛CWZYk >|ҼG jF}Զ06\e9v ,;{9h­.2jݖO*m5iu .@SFUtj)+Nb):o\ӞJS6miZd[9Ǿ:[X2 {7-mmv빫e.H葩Cٙ UU[*!:oZv:Zc˗g0EXi}JZ+3a;&gUgv_*wJ\ :̩M%|^yeTRЛۺmm*U7>5 endstream endobj -556 0 obj +562 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 555 0 R +/Contents 561 0 R /Resources 4 0 R +/Annots [ 563 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -557 0 obj -<< -/Filter /FlateDecode -/Length 4659 ->> -stream -x][8~_H|)$HX ‘ f3 4+'$t=CʗsvY "!I\ ̨F3j I\8 ]QbwAKFƒ`QIK\2P Z1!=Mz==QsӷpavS0Y>4,˺˘6OyrR ]zwv溿Wmzao̼QY.ܴZ.Ѽ^Cӥ뿍eS  GerAٜF/#y"Bzu'+"4OrZTG񝑉T4\_%y2mg8}i<ƈh| jEn:Uݨ~Y0ӜK9l8co$٠b| zϚ|>N=',cy@Fq6]cʔy{4Mngfמ,VXWkLjIWW`9fwz0σ`2)ow0}DžldMa6<|c>Ua x_OHcy)쨎 u`z V\l>~WT>2[JQ|5ʞr/r}>֤gy<ZI]zm~ZzvL 3y]=9.Ŷςݝ7_`m}0{>| - 4oq3y߉-ڪ,a|cӸ⻢u㹤PrǑpݿ.t<u?>s.vhɟu_7ߛ,P刹%>\Q*٤EڝT.fՃyu#R,DdQQWѪSz3z0áw穸E)?[KzsSߊ@ѻy;"-E7yG2KOtkX}ȷ|Fzky q'6z|G/Z{ao5_Ɉwy8/߷ wd/P|,áxǯrwu}>\m 8hKz,!t7++޳]ʝe󏿐_Y=Bv}`GCbډ~ܢ6~@۶^]5JX1փyb+J;%Z?{֦N6P{Gl`CD?bvQ!zw`C1C~~WdœٛxSv 9Ptw8@^ĽUrsM}*ľ6 ͛{YqdFeKg|r -x6@K -ᬸ)+;/y0i-Seɿκϭ{-Ӗyۿ4u1-(v\sTZ9?ݴf;{f)ّ| nF:o|= h]େxeKt 9;w؟LI'G -є&~=+dH؃bNžBv1!-SZ70yиr5ߕlmNJ!rzիAOb~ Ot)_O -lwڪNBUĆ=mM盰75k ڥU?JQu2ԕC M̪zPjT IL7jO*|3A,$ ^n([b=PZ7f%Ցį'Ԯqڮ*I9<aho@T᪔'hMYf:$vͥCKG%gҭkͤ]uyLR> -endobj -559 0 obj +563 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 728.673057 101.433071 709.923057 ] +/Rect [ 101.433071 142.623057 101.433071 123.873057 ] /BS << /W 0 >> /Dest (cb59-1) >> endobj -560 0 obj +564 0 obj << /Filter /FlateDecode -/Length 4867 +/Length 4733 >> stream -x]Y$q~_Q}>0l/ + ؆fj0z _x%3ָ4z2G0"RWoVSzE$]A8|tן`௯7]_/志uUVgbY#B A:0,DySX Mq,a +B c2kV:(˱ J.0,%!R<"5)'<9VǤ ੠91xIx]x$s)k%ǃ,C<XApI[t4F91 `@''O#xZq@`$dqsH`dX,d9,0@m hka-IqX`V*aBLa- SJ`vrX`X5k `9,0]cwAMY`QpX`Fabi 0v9,wu .5h8,]0sw V{ `(#h q|8Y߃ hLh%8Jp̚Z wU$Tƙu - }w  <wx]w78 `B!M( eyI# X $,/`,$P I3rX*rXe&Al; fYĨi9,h9,m~3pX$dAaA^Pa`<)9,H*b-Xߌ$#Yxo ,! -˃,nIo8,:Y ߌ ~= lwz p&"[no/. >㙑vH@oeS o؜M@L,gp`*ɦ $]a=4WKoa)o&Sz:Lu7WDֲ"*L7/I'^m㧡L*+otv|γ2{lKkVt[slg mM@jPFOCj?Lp2 VcӬ.ivl>Ylɡg "\`$droW^#0 mOA`Ve0muQq; -l~y:9]y!p͑D,A$g+c`:ԙ\?/Jko~8PU8n -T?Ak)Z}B[mre:sucy+4{تj$)7V(&bhykd>>Y`iPq26q,dd޻{3z%˱Ib:OgZ3'f 3 Ϸdأ۱jV!,,tSPܘ{Aoq1 Q(cyγYُ[OϬ~+7~뜩,`fWwٜxn=[Ø{2EOy:<Ȥ>َʹYZn2ǹo ~^t|K5Z{㝖Tz' Ħ'<WeYffZ# =,dg`6o9{}xXf6i^{uk]y1o5o͓ucjoK`qqڇrǵMǻ"CNkO&3wy]CHo訴;su"c-;<,m!{uf?suz3}s@\yYAm)ɦBʽ9TJ+驻9iz0;neً6qrYB{ -d E! ͑w nD:=E^`&?w;zJr,]/'J|Y߯={ Z].qhSݵuJ=iTO~ι|9=XZɊM,#@qAijM~ϝBX"K}veq|L+3Xg4knzgeYs/):eE0<^Zv4Kiㆅ]-2Udu^YmWS?TgiO{zN.r}wZa6E|];К^R +uқ*z23͵:[]6Wdm:QP+>v[Ȧe^,\)k657Ȯre=hFvU5rspӓ*wsY9 ȹ74WMv?΍=r̘8ߟ+lRy=msیޣzi-ز.rr}"ocY.|kvf9[k[׻zZa޼xH^YaY2krOGQIG_W}ELpB3(Msuzc 9vȧ[ Bx5m)Of=:!}~r~$<.Ӣ{9mc>&{V΋0g\mZxij9ԐoZ͆m[¡cA<60Ӽ ͥtecǴqn+[*|ƥ!Ytb#̦NDYyܓu$EҰ/鰇}CȲs/oX>\~ΓXp= /οޖy-tvi|嬱0QptY3">謞uUӁW Mҗ ]¥@򱁙/,GԼ j}!"r_ -K -tea:M*+V]7jj* @g:E)s.*YAϷ"I2ûz-CVd"eU-h7 pi.`S5Nvu4Tjt"h]3DjMK - -S|vc`xHVFD&ʡNֶʣtۦ:߉MQujZSݚRTծfRZMmĐnM[LfF'މmR-ǐn\i͵ -TUS|M -P}ʰFd}Znx8Vb'^\`JUfhҩf9*\6vUf#/4}Ci@R!4dMc ꠲R@ǒ52AXOʑ(讓]3R{`ɾaHmm6_L&ӏNֲy@:k&)RR>EyKvs8Mijo}ew<{Z6 [ѓѷēdJlf j;~'˺j ͏k=eZR5U;]@t2f6i2_:7a/MD:Jq8gKM⊊vCE\r0ubA4Փv -JCAlwcӕG1AlƋaNBF臗{@:R|闗瘜kegZӗF-bс{RJ[tZE VZk1T|VՒGY-Stꏣ8+Mn*KVע% 7s裓d%#CcFuvwa {d*{5*=vuWLv8j&C,}JqH~d'LȠ{y^Hnj|$!ML*Ü\eigNːu'2F ((=D4? +x]Y~_,>1^ <̴wlyWx*=vnU(?KY C;s|8}<[) ۳VF |ʻ um9{GSҞ~O*QEԌ{err)ȩ`F T0(Ux3S gTR`u0Dvpht\*:i=8o.98-6 +,l`s:[ӂt(Ndt]tQ6cX]N:%`ւI9X`S:(tN'lduj8-GADe8PA& +q0kTqsV[ Xl1p\z: -Z) -p8.G0D ]]O01xCr:A׬.@'=ޛSk!`s\]f@' >  0 A3t.tRr\l7qAPL'8. $AqA0n W 4&8.@br\X:آ EqAE qIMqAQd @ qAMe8.f j&x̸zs\ lpQXlq NzlQp\fnِ֛@g]L q\7rk{ l@z-V6d <3 _Z#Aepl*Ra?f0F<$#w_5^I6~&9=&E򟄃RW*-o\ ݒ*%AStG3Kajc p uoW6Z`( pÁ5v +`6&ߘ X%pH" +Ÿ+,ޝ`d-Rl>+v݇ӗ/?~Z1~ Mf7ʰ/jc9VS#k9d?|E=$KrOuX;?b[hii +W[Vj|1.2s\ͯOsw9ZU^+斈1|B]^+76UP r:Ry ?i]I١:)ztm 2?G*jMK-D[ݗp96Z9;Մe'1ʇiz9w ƾ~.xEϵy-˝·=#rmՏ=s8]ޔ^Y_OVo_#0}]W挿;̝yJ}ϼr=j4f)V]}FcՀ#d]ESuH#%X]*ɖcsq:ݔ3]M]%+sٙpkOw,]iehiEՖ3Py}5jnׯu)G7u˶; Uvû∋@U#s1}GmM{3x%0NجÈyWe>WoJN؉ԥCsK|i)]2Nmͪ;u;#R}d"27|z1%jz"Z_9e+;wu&&5w]97;RtwDv9B݆E(*:^frǂ̕| mވ;b;bǻ ^wkFYy ++#3Pq%QU^AOs4}<>˲swgG?TzuVt/ ٗp݈{zWqgawCw9=4 1rkoi(e<>5kå}FY|JCwPPuYn;fߍ>y}==I;X5x{=ݢbꗶ67FznMo +$q/dI0HE;BLd&VWr}4?T֚vۢV}7)N2ڟXcO$1&8ۋO aN1 edNXd/|>~R8~yl>os6ڞˆH Ɗ!r:ًANbJ2 z:rMX3n.Hz4bztV; /'T{3+ rQu(2攥CL'Ft91/D.ڠ35h $SŜ]Nl4[zʗTf):gd&q1"t9;"4Q dMU|Im+W +uSnQRt C3h +[<^ڣZ "7R+wu i.}l^2&=nI]Zl&m#*1˂"& +Slb[<W;m{[Ůps+%jU-6KL/&\I+QfZY#sZ؉v? fS收*Ӓ6il,y/|ϿN+8+QBnۙ ;ŴoaiheimFCǕj{N) ʢma#VJekȼo=|rF~R*PuNHQ:Kz[wm8l*ղȶdiBS]AFС:Sٶ,Kg$ ۃ`#J軇׋}2@BEJˉ/˜tomRnƞ.NNյ04lSVjlVi( +]@&Mnʖ%q`[Jj[ڶRѶi<oIȶpDMY|\HMMlYםgssg*j6Hy3v<]ԁKR$D&j#V ΁C nMhB#7+YFDr 1ۊ PmES!- +nk&TiN,"AiLrihcڋV@{1{oV^f? endstream endobj -561 0 obj +565 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 560 0 R +/Contents 564 0 R /Resources 4 0 R -/Annots [ 562 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -562 0 obj +566 0 obj +<< +/Filter /FlateDecode +/Length 4988 +>> +stream +x]Y$~_&yXc{ksl,j a~T`(Q5Ft2HE}H}UFR]o?\~%z械ZxC`71\_/o_/:jS V`yh|XA/b b۳"p9y11I`%a]vD$GF)As<gR6YEt4%Dxy !$dYi!)YMQbU"ċ@;Y%J"v99'2x*ŴUO6Ê$( d gYUFY#Ɣjhu[eŘDdK`dQ1H.I`b\\6NK +`dVi*]jrEdIX` dA ,Y ,Z$,[oA J ĵ)8 , %,\ 씰tܣk}0Xu)HX`i%aZ"%,:.V'+aZed$,. ale1)) p$$,p]D^\k< ynHXƙ a e(1B@+a[  U9Di!{Q)/?^?_LYJi +dLG1| Y)A7ncbiaMXpxP?Cv );l#0%oP䈘 _-:tJd}s lb~nR>,?:ΈQ `ҞB۾V2MCRJm">&K o+lِ0bܦ|Nk_2iG㯟~O?\+8Z7.ݭ2T^jV}-ukZ;Wy ϣ!y1F8GZ/R:5lv}1quY<$G)O:}^ָʾh5.& #wh{gaGfns/l10Mxo, + v1|eֽ3;)yi|N=5kcGOy:<DY@%-hyD:iHerF+s +"3Xֱt|,-ŲmY=oljcSqc{ڃ|-YUsǂY,b)Y:OgkYtۿ~v;Jb?{`20滸߁<Ǧ=r.s >X|Ns[ î)6[/ [;M%udy-Q -X&F7Z.kF^d61B2fǧߜ?X [1GГurC:6ͷ#AFh'pn1`^D`d'6lv4G扨u{k{tLⒾHkYq_%%Ҫq\kȅ='9Zsϵ]WyFNs(^X0V㺹UnSWؘݦKE_#2}" չCb،y=KkeUt};aFz`fN׿mC9R'c)j+A6zp*(gB.ve^j[2[lIiLם-:.>O[mcޖ6u6tgf]~ +{q3g\2ZKYo2}ݽڼodښ2"&oNGaSt+2]st|h<]ru=Xqh5rs8#I֥bXZu74W]F>.[޻Q1~`wjOoLkut*H۸KHӸm{l_dl!h]iGR%=~ G>bΦ] n>b&tFGk|#Dj 複KzE=K󮃵]=`QN8zZ20Eez m갅r͋BQm1=(ϣ>,cΤڴviiPC`hk4z8zg3J;4OOBu!|T ii%U️y *bRT ⦳'YPٴ{}OOgzt괬;n:wld'Ita\v텾5 `2V#Se۰-=e.*-R $;E]e?s^LP;L Uk<{d'!vTG-i~J$kXReww~aN d8B1YRgw^_unkhz#!9ݒ) + +dm9:Ogf^3&$<9i3[(}馹(|$bsfpgn-'v\>Yl9C\\C~շ Jyny5r 7.7{BnL9lZ:P1[}퍇6<"]z6z={h< GmX<NyKb{}RYlw/6[ܓ(dvpku;@FqH1F/na-5;S\Ĺ\Ͳa7m?^By.`U!aOI/iP*&+/)t&]wjWKշ+z.p}>,EAJԪiz7;8bLQ'KKb?q6 GhoqNB3mX f{2^-i*tQs'/;UDźd<UU&<".WJnM5i ;շ}B\'toTka2;s%fH˭@]r5g*RiTMCa6u ;*Q}ܒTikݘvA~(+hY԰A4kHP;|Юt\NhmvVI:8IQKmK'%'6T2FG cK: c%'&dMuCrTv9t|g\Ӌf]fx+d2:d1 0F_ ֎N Xdǽ]v)nXoXޛΣ,}_-~^Թq:Z2d-$uaDNo1 ݨ#\NClmf6i2?un^/mW6p4xv+kWTttpaq%06bANI~ǧR_삅ti 7˛n2 +V!ayy# O*rh+;SOrr-ޡޖek g,ZQFMZ-y66G4hd +ZSKq{L1|V=+K6ף% 9ѩQǒI^S(im߷ݼ AˆLըw%߅Y;k) j?%x5[L!p"R#os+gDZX*j9YW0ck}'\-+qHoS +0vC%YB2VgRЛQq>)?gq +endstream +endobj +567 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 566 0 R +/Resources 4 0 R +/Annots [ 568 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +568 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 220.323057 101.433071 201.573057 ] +/Rect [ 101.433071 356.373057 101.433071 337.623057 ] /BS << /W 0 >> /Dest (cb62-1) >> endobj -563 0 obj +569 0 obj << /Filter /FlateDecode -/Length 4731 +/Length 4714 >> stream -x]ێ}y I $$L`6:ċRK3k`vZUbQMɳ#w|xtRER_oR?X]$~*']ɟO<R=཰*B%fT+n1FN37,Uf,FKTE4 -fh=vH%!C;NBTyWNy#tqp lQHNgaN[9آ5Eu"  -'$z1"t")aNaDgt -8a#-V 4l1t }hU4ВYآ79P8 -8P&*Ñ -z0T^s4-$tJrDlqL%l1h8. - Ze4lk 4ֈ(9.[#@pa@qup "h.@uu &8 4xW)8.0]es\`F: A 8.0]w19.0]eq UV( xW8.P`.(lr\:9.@a[qʈ`A8.]}.ңřqVs D9.]g?`FUXԘ9xW(8.] ap8.6H貺8 ZR`D:?H r\#+80p{XlAq\: [fLYSp:aNG xM ' -^3D. -:7r\`8C1p\lJq\lqw/0W)R$0Pm}Kܾvpe0어T( ld;w^~Y -CW+ ʋz"Cֽ^h]*YG -XcfcY^`\4:*P 84Y1jec>&u؍wO_/o=kƯ ZIn$w_ۄ௫i2&xB})(y\WVeccӤ<ٜ5rq%зv5q=o#jYYOM}sͻ9,C`Iq}Y^X_pi!*s\J=-wxeM9S$'2DCVuԉ6.l u;矿MmdHM;I(o⎌E|+d%t.ȧ.Cv -Z<qAњ*Zw9ZU^+斈)شӼ9Vnm @2tHh.dvuWѵ3hLh]qWQk -_hJ&B}, Y7ĜS{}cw l4WJzHj97^FwF#5Έwpƾ4h6kNGyT[^:235[W1\>uжH)Mȇ#乧ʹ׸_<׆gto7}uSix}tv~tSkɶK[2G;y^N{gisfٿ&MT[2扴/FD[/U)k;vFw9z7"M+L(4zsS鹃/E!zGng!m]tRHO,Zy"{CXxGw9z7bW_I~x/txF"s=;myumZAǝy Po5_}xTv ~]D9f$vmqob{ߙpH܈lWm+i)úWW\QXx+#ƺ3/Zz[i,P %YOid?+OawVw9j7_%myְ}oc%:}^I\ŭJ9j7w?^|ܶ(|Z:;+#31HVrk4XcAtLåsFY|JNqiwOCUwO;YO+}w;b{]sÓi?^[uӮۧ;ؙhH}T mj9tG-0qnυa:6dm轓Y+老Lb:y y&0?]8N+:_hIz4o{tramN.;DG ggr}GrwsC/&4\,#"9VքKmńg(ⶢ)yz!- -nk&TiN,"A)BRj[ eUqI +x]ێ}gI@^ <̶wlZ6NQg-btZʐ{iUJ*bT +u)[S 6s&˩`:03xEsU+é`3*%aR:"!8V…#)9p(8]98-6J,l`9-H:آ'NaFDF` XlN*NIau:|봴"$VNri⤍Xl1t K>f4Ith -|-;0D%Dm8Ё &p,C{h@G+ +:8" [q-#Ұ 8. -5@ 52* |krfJ K  (E KN 9. .Y9. .8. .%9.0]"du(HwIIqbi Ы8t+B 9.0]w$ xW[7swF; 7X- X 0C&4 ,xWEL̘[ wU@(G3,s DEX.3p\Q535*% r\8oBI@E!cX.hIs\YX&au^HC9.p]Lޕޕn-4kðe4U!5ӁwBs:>r\i$Ё(k \0"z8.pQB9kqXP- XH1p\5l!9.e +7<- >0"`21xCr:EkVST8.ZJ z @"K G؂q"4dİ0˚&d?x{ߧφHYQpn [ɡfɓ@c-/;?L, S>bV +Kh9`:@%GmPԉ9L @@ec>K,wO_}?FO×+xmkҸ˟_\u%}*u_K]Z|Jƌ.IbG?7_z.N_I]\J~O{7}އmY^$:-|rW6]5M9Cwj t5O>uCe-\H<'QbKՍyVVZN#r z~_@!UKWu6g>@R}]n:܀1 M~.TeܔO>qj϶}`n\Q\݃WR`"9o;w^FwF{nv[h39\l +V]`u½g8t/uҽ^sG5 cP_r7L֥pMtdSm.t,tr6kcKxF{髻]qd-_CM9Lz2b:پ0G^1OY*TIܤߧV5os8_lٯg9#H 5{#O{nx oAVp͑jIV5?#qN?=t܈As)Py3 *_ۯ + .GĩyOzДRnNSw^g(ҺPy('dbK)Ivg(6`=̺IRYya٪aggDڑ9$I 9#*Se:0Ru=4tǓFOzA*~9d #6F$?RQ9a]^>%Y!ǏN66Most9 g\+f\^ +5)Ax)e!6m-f\+΅tj[i:WT9Mw^Nz +MgrjYd攥CL'Ft91e.ڠ3tU2LIs:Ft9l)_R5斯TS( Ȇ6>+ތITR侖 /'kH◓Lj[B VHMEdKfWEgLT:C^J,i#rWXp-iR̶d'-KMM5ry +yLŪ)\ +e6U-P~ U=WTw[ʭbW*X-60^r%UejeRJ/8N7 f0i:#ηm,u|O@lY;l+STmK۶WJ#ڶW,m*7x[ξޝ)/ks))uiy=7a!zfoع\3DBTGb6ʓsLNpbބ&4rw۱yD$JښI^늦V>[-L(ҜEHBҧ12t {ƞ&翄 endstream endobj -564 0 obj +570 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 563 0 R +/Contents 569 0 R /Resources 4 0 R /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -565 0 obj +571 0 obj << /Filter /FlateDecode -/Length 4937 +/Length 4976 >> stream -x]K$qׯM|lÇm FW2{ZN+# F2Yc -?]~%8"opW(,N''&ذL .⯗?:jEv 1VKi+[B0 ,bJ b@1(E' V{V&hXC'VCDQD<{gc2It0NKx]xY\RZ94xl Cy`%^,I/BXWyEy%^KH%T q3-.Z$֋mZAAK"8ij#Άjxv[esŘ@"`%0% Z$ 0!, I `](RPĴPVB> -UőjB"DXYP@k!!+aE %xKJ{ ,b* ,FOX@.L)IX`)ab ,P:o$,]KKX`֢ȃ,0` JX@]UFF;V&*&`Z knA]㔑 w!N V{-aܟ0VKX:bD^Ztƅy -/$aQY p%,/FZwIJE$,9,oV0]bwKFxEE IKX0^P ՏM|@mE5S.iG㮟~o ~zѪoѸu3›pF{)kBwAn7-:iOTx SoX^ܣFu8`ٔ:5=^M{r_M"ˑtzw5.Z *_b 3L m~4v(9n(aF͡Ei0LU@a-Lz2<&=4ٚe3K(p7:fXZF0Z J1g*~~P۫,gIښdbPv\1m>\g6$,pgcfM}<{u\m֯\qouī|qd}U27tfgeTy -ڴcY˼tyL[)k]E 6RFEғ.OsY5 xConi~:6]Jsa¹惋 Mnz57j |n8^PWA_;U캨e{'L_P?;>E82w$g~g#'Q}h;~'orB݉Oy ]7@HIr:HHngꮃp1Jauɖ~no[46-"-{)7 W%9T;;yykjy{CC_ݻ'7ޡy~A{y܀[|)̲HAoۦ+;Tq2&;^\TBqbogN}`Թ')nl-Gv\>Yl)uV}/<6G(pz%Es4#ٴ%/џxikiن{%mt8Yl8:#׶E&ݰ127蟈lUIoGոn#O;y1k =8 %-)z/9%aEƓuĢz/t9B'Zʹ/?MToJ*nj|>9V/VwPp΃XJ348u0f}2wO*m8=R8nQ%hOöغ>|gTcgM yZmRWMC'?6K놄AF4lKau:`|\#ίNÄt󢲤0X}Q3 s+UΊW||,$?\??.29zɯ>כ2DsQHׂ KK1y~4 wFıc^|jхgŖ+DˍloWKV D'N6T|fS&:= -iS 3U̵]BFudj$/U& fZX ZT XHV*jMƦxuTa#֏[2lc> A|qfb'^\JUvhҩ|T ST@ -ר_rnXgx瘷O,};|Տ4lݐGOQO;+*MhhNֱu7fkUZR7Ս;]@6tfyb dtl^/mX> Jvp;v|.\2CE\r0u6bA4ճ4徆!Kyt 0ӴGǽ `jF}ƘO|鷗ؼNޮ֖mAN=h5j;JtZE ~ViPeZUK(j)S2jڍҔQnx-Z-r9~wldh~ݨKJM۾A]#Sի]w{Zg:HO΄&TBu ys\>#Rs%cOUA"37Ւom -RA.' sB]"/WP)頴#?Iw -}G +x]Y$m~_Q6z`@’a衧w[k`}i 4z`|d\Y%t~ju_"Kp}'W׿H,gbT^`e%F +zAsXGgܞ!K,I+A 뢶{V&j' > +, 6J<Fi(=H<"/x.!:K' JK<YvNI<2B6$VC*%,D' :_B ApIqd\P&Ņ%JgVAVC+ Nk HX`-d1JX`"a:xX.TX MIX`0,aZ`%,@]냑vKA ܵN+ pZy,aq:Y pj%,p] ##azu `+IIIX&)'a 1h%,p]swWF5 `( Gpp`%,X PbHX: ch蔃OEGh\Cx.wI`j$,]m%pW$,] ^âHXhyyQ9% $pio" +#3hƙ⒁[Eq@|i$.@L,SW VJ\6P_cn _ +0"52cX8D}18R~4!00}k4!L EB!!bBjb]t#!ua#9'ё@k4P~ Q)aR!9D~8]#"|,PwJ<.c +sӯ&Fp/v8"Wl15cBlOvmeҥpLȔpQ`O*AfC0rZX#14O_?/.+i_~vנDC|=4Ϲ{":QoW䧼f+Wj[>Q +Tkn+i N{/C^~bSt~kdeTQp0;vy.s>2*<ܶ&3-3LP|Mix{:o'ώvaiCB6E9z#Oy6c閨q y=e^}ۖ6Y61B2& LV=6$5>2oXh-p{{.Y;GWǦm.[8n }ED#hCWT4oQWWg1!3徴;zMK|LNcWVn281žNczK-}Q\39֬mU#hy2ǃ6UӡYYjLuj¦MV,FhmSUo(G/'XZ}9]ﮖHjqF0o.ԾF*QcEWc-ɿRY6J7ڑ>SWvvzdC1X->]Y璷W[`}Mֱ&M:3Ίn<'=˖mKIPOUmL7-_YO'/ŰPon쁵dX2߰~qDx</ o.u*o#Mf>W챥0k~C?JT/W/HNG19Wŭz[-t d;q<ZĀwy[$yჺhvizxvTaszQ7K46/>! +%{t"(Q{}XGI'L9j|744O9fd;Zhw[lh~Au! ei%QB۶s:鞈It+{N'x}E4k:CTi7@[;OJVĹ bPa\NDW/ I-_4-iwZam|RݡRFf믷l9qdg`q{{}O;U&('9l3lnL9lZ:muҗONln8-tQ{"Ny:>yO#ɦD.;-7`x0E|!9_E7s)£^u +=nPlc'ƩѬn/ۼZup򐟞VnLZ;>P͗{:Fz.Yk<ĵqNkV׃Y~1]7-ksv.gԲ0%Oha>[fc+̿a|g<&uӁuszӴɏm~ݯ:ǜ6Ã6G#;Oy:k;)^}e~c2ǯ;#X}T]*?gtVyg>ml<5:bF͂@ :syZęX#Wܖۭ߰^[?٬0ǍX\K"iwػE[ u-]"kU{3!G\7چxz$wLm_qKW(^tmBrwC'CmzRcܲi; + +jK֫?ȱ6׫4t&]7rׅS7+z(Pn}8{.ӥ\U(^ +90z۳΍ wDU/~?^qsJۘ%Z*_?ZC}For%=Tk9ޓjѕLoNOBW,:qxQxbD'*V Ů0]t:ͺ5ujL}VTӮQfPS}K;~HjE;tf^ tH1]-=UYseM]]4l(>ntJn̎zA~(+ǞhY԰A +C]q +S yIӨf'o顣4]itfI t{ꮱ cnHuؒuN&kXɉ wS~ߐUzeA3sA;99.o/|#f2~j QۍqPFkG'Bq 2^r)nXodEͣ,}o-~^~q:Z2d$ɠaDN#o1 Ȯ#\NClmfubdo^mkf64xv++Ottpa #06bAJI~ǻR]쁅h 7ˋn +!`yy# W{9@ΩaD'Smy slJP/˲g{3-(&RhJpj^bl28Z=ԿpM{+]JإrђGHc$ݩnmnʚ aDjd¿5ϴ j?e%D`8j5|J!C?ĖFsV_ik%&tUQwy"3XQ{lYMzLRЀ9[ *_R˂P4Un&ʉ0:e|R~]K endstream endobj -566 0 obj +572 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 565 0 R +/Contents 571 0 R /Resources 4 0 R -/Annots [ 567 0 R ] +/Annots [ 573 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -567 0 obj +573 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 351.573057 101.433071 332.823057 ] +/Rect [ 101.433071 506.373057 101.433071 487.623057 ] /BS << /W 0 >> /Dest (cb65-1) >> endobj -568 0 obj -<< -/Filter /FlateDecode -/Length 4714 ->> -stream -x]ێܸ}Kx}X H@lb Hx/-PIEZὶQ9%p1r*af0`90ZF`h0C{e8PzF$PZJVC1¡Judu:5#e9g3F8-V#9l1Vhqfܢr.r\` } 3wat]w7X p\M( 貺(d  -i 0 $ Iq\2~(=r\q\au~ t̘*Sp:TaNޕG x7M8:p\`q FD.J:'pm9. buxqk) -5^ #QfpaSL&B4ochUNtts\XKAq^$w2[0T8.T$glq<] ho゠VNr\kI453238\E 0LS:ۖ,~2tZn B-Zj ʹD [q\M4DԆ˴ DXobnjH.7= 8M$7N ѹ z=ipxF03uMx^x+CZq6b As+2^VHoZ#Aepl*Ja ?ffp>!*8x̙}Ysd7o1!R!a#V}rh%,{$#|F*tKFbKaCTůՃ@X;<`f[4ub'@~4߽9hl|Ű7oћ% -m5v;^ڪF47E=>X|lIGmP-Px:Ku/}̞61P"[Cت]y(k(D/uǻ(Wy5}їengǺń.vc֭Ww?wRZJ>ne>툇ns8= _HWݪCM{_єi>vMvmi@?i6 #jTz"eœwC;⧃;}޿?}c!x[,tAieARnGv]sk- -'~n+R8v-< -ȧ$ 1|GiUˡ{0q)50MJXzzc4uyqyߕ,I;#?xAN-VZߴ +nE؏v]&i̶o=gYcO]/is1],ƞM,uEe79RWx&u׾-c|Yh[iυ6Xo/j<ѭOf79m{;{^s$r 5u'NG~*$nS+vi79W⴯x!^0{Nx zy'A ގ}f 5 xOc!y%^kiaû|es~wMHo5<72_ෆV79:W l;߭g{,?G{/1~#ޜ~7qyzw q%zɫWkf5ژp^~޽^_io} f7ݘp]~aQ~!tg*6!Aԇmyk-5sL]w;}if{ip o0-:*>r9@m5 -xc0駇1nI]Zl"mK$Uc*VuE(,OV(mD\e2RnϭؗW@bo)|^+b-lW+k0BW}yv9X7^N?iNtme{dο]q- [­q;Fq:= ˰i4_*Դ6Z7|mjvY=TAUѶB[۰]i{CxZ82/:a_/)t_ -2T)NdE[(. -clbfd[IidiR]EFK:Sٶ,Iڋ`J>HBEJˍ%i!<^Jå^9"B,j'ZEFj1m+5Y64O. YVJ&7f2q`[Jj[ڶRѶfiSy+ȶpdMY|\HMMIY6Lγ S q35{5OuR!B=Q4crws&4܎#"9VքHz- E\W4E=٢do`BA,DP*>-m!cTlhh36 ?f@ -endstream -endobj -569 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 568 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -570 0 obj -<< -/Filter /FlateDecode -/Length 4760 ->> -stream -x]ێ}gy)ހ$AbavvF0`~NQEjI=;޴N"yxX,Jj}VRHz1O'5/X]dw ;` SH~>O|賙RFOYEv -1UJi+B0 *'41%I3\ C3(E'`U3L$`N.*`6J:tM%ѓ$QH:k'H;-wQlqIiI`DJ1H:[JtNt]Q啖tN.E"QS1KQnrZ%鴞iEfAg`W.:2O8bfmՒc:؂xآ(3hb^80Q2$vHQbD!XLr$JCgDVG^ba a:bI\` lA -lK@tK*i ,X.TX0$.\@)I\`)qb ,X:o$.]KK\`"-`h%. *H\@]L##qFudbTxDEx,.LV&H+7x8e$. !%.P&.(lJ\:c%.@a["qO`I%.p]1|.M:Džy^IBe%.p]g?aE58X%xW$.p] Nap$.6i芺4 Z2`T0HZJ\Xޓx"=h$._0Nʀ)$xWi*˦>D `/H\#M)/qO -:|Ove:B$.c=%k #-n` "SL6D$qAp1ft-"t:H\MXKM^0:M[0U$.R4E\i'[xi-qA4ޠD2+4jIGQH~bWQL4&$.fI\6:bI\f Fbf )O₤nq蔒 ! 0/y%.HVa-0o $-.-p0oIo$-&{oF f` ^ Do1\u $L~W ^;(F amC -܋*1=4YF/F B6P_ct sQy!`͌0-}sdJ9>)+?BNM0 Lp;xͷ303I0%y؈H,|ae9 gӑ"ϱ>R?(Nc`xl&ߜg!-ںdy^V\+uR(0#dcfzem? VNKqvc7fyEil2$RJ͛ub|tRi͇Wo߀7OU|濏g J4-}M㖿-%X& #Ҽ׬wyZM:4-rņR'=Z~)m}Ti;*o=dyAFZ 6nDz| -.8*JdZD:hBuGf iTXOlm϶vii. E>7#70bIT$*aQe0Ok9 B>c1PXlZP d  g[H642 VJNlr;&޲|Unz-_ yre"nЃRe){O[tνaz>l{oc_Y^Ы,PfNS'}O0u~#]ct5c%>1ٯܲl_Zrr#2Òb^zgiz[2O O,Uֽ,'H랽bG>P=sϹZ"?gt2!Z2V_mO_/#cyfiX2>Iw1f߭&7-e B)~]uY•qTs;]8&ߵͭ _ƢÒ3͞lgvcԳRlwYh?미7m z13z -|a>v{')`+ƅ4tZ_TڂryjcHuQCqR_-49 rSw x/ڳ)97vLWzhtrF~xaĶ6ld)8^tr;ryh0"aMQجcp0eN"Eų95r=[*3 -Q|' {Ayd{Ը/-S;78s>`ͯ+=ȫkrv42cخ A(N[vZQ5vŠ -p7-d17\`p]D -8Ȗ,[6yˮ%Y> -tʨ;Er,ϝ ;GR{Ehn#Msoh ;~-h -r+z/tLImsw(_n@!y>"b>4ۈ\yerC&f %և;o7^AwA[8#3幻߉ xC4'-fygT&\I)7}X^|uH#5\T-%5{|oC+<ti|Zc|uns-؝\^fTuswډy}5Q4w_x;}ly~C8P]om?ǓhQ$soHL~-19yekђ_qfR[xϦ{1ć+J᡿T.~'"VՃyu#RxhD8ocWуy;w |V;6TGNWOE] ѻy;ݖWHj  ;B;:.ǣwlnyuOphm~Wݛ*dw ܏}.eE;m<1~͕0_6剬H)7uÝe0R[ )yYnSjX}+Cgv{ꭖ_Y=1T{^7] ǓϯgI~J,2L:w>_ə|Z^n<Œc'hϏ,\4_\MRpjYK*{))cGJk8+bJ"_5W,K1^Mz˿d+_M᧷H}V`˸+VuBw)T]uMlأe|V&tù%|8wk;ܘ QM|rAHW(W mWnGҤ!,2~?SRfAS]JxnVzCRh --m]:پtTBz&ݚJuY'$Uc-uUVre/TTĮBy%nv:UyrW|šV{k1/l4TFծU a &n4eVvV($Vӏ ?j^>i?Nt}y㼎UTn]!2a6PGMcK -:nLԲF% ևTmqǡ#cҶo-Vo.cٶ$"qIے-.#.BqUe+3}%~r]EFm:jl_tVtI/t_iZ#㾘 `i*}a,'Km˺vjY{:9mj4ׂV=F;ilٖlUiY(*]@M~V%8OѤ?=QQiܲUoVpudd]R"u5!yes)_/;s! *?9c{1jJE!G(vlJ.#"%VׄZ4-l3i_ULΖؤ:@5S49B2Vʲ3IU$+T;g -endstream -endobj -571 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 570 0 R -/Resources 4 0 R -/Annots [ 572 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -572 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 546.573057 101.433071 527.823057 ] -/BS << -/W 0 ->> -/Dest (cb68-1) ->> -endobj -573 0 obj -<< -/Filter /FlateDecode -/Length 4909 ->> -stream -x]]q}_VG @g$dwۆq7:9dd*=d.VIS[go4~ES)x:_~>rRSp -JAQ09|t石)$g?k8O鿖uL)y?e)T *rn -8/p)I*Z̠dLTfX -ڮU fIR \TZmu0DY#贛<:K:'I.@tN>vZҥ{#Ғ-dctXo-&+l1$"l-+-钝\D.AbkQnrZ%鴞iEfAg`W.:2O8bfɳ*%-u/1E/QfДyIDɐD&ډ"ELL`%0MSx* X[y -+`M$q5$.X--X-%.[RK\`A0SI\`6zr$qZp$.`]뼑v-E/qZJZ'V qw1 8+QI\@]I\@]D]05 ynqH\@]CK\L%F]P:c%.@cAX"q'iդc8>Q&¼E/O$qQY x%.OFZҁwIJE$.&@I+@WԥI%.p]В^xRL" i @ƓB*q½' ):?I\%` l[1[2H\`Jѷ<-> ؂HQ0yЫΛ)е qA4k "& )K 4I\lThӰAtZh` A Xez%q<4֒jIG*3CE 0MS:N,~2GHM^nF b-F ͼ $[I\r,qh:$.H:biH˼ތ$O $-!-0oIXo$-&ތ zytx%0"2MD^x]@|&+c^qF1c@UL(p/Us -Hbfbe5[R+1mh OQy!gƐ/2aZF[~:8tUɔ&W&ao˷8]O -3otn/_mr3Ŵz|v29/me˸Y7סlxw6P²l/]cʱsP\ :?Q}5O.Yϟ;%K?0/ b X)݅+*Ut?-ƐkS8=\shin |d$Ehy5cz QQ]"*"|}3Ld2 z!g;vFu@ECsCXoJ{-,žȆr{6$)U^i#c<2ʸ"/˨ -3j -_GqŃvy"Zlle6~/#ز(y5c7!#OR`+=2+4BfsyV+3!P $ǹ`C2V-/=CŅK-?WsCT"0F'ߛv]w42|az'qe~1f:3*uGܭS7[6) UFc<#aq%z~2~yu^;Y~yŮ%j'X逩#_EGXTRVÊp|]U>:au;׶' wy]{Yx"ǚ9Zt4#ȲWG_<;Y=\K˙h OĕNmjph#d2TJy'tuW8Pw.Gl~8xo dž#rwx0qǵ>ne?؋6DǞAZ[=ۂ>5zhAQ&\R-NZE TCj+b/StyO;>**ۭEK@9Sd% vR/il}nZz3 ^ͭJ>̝[! ?%c5`-RV{p,5puFJ0Y/ŖMx"+XSrKzTP9;%!C^* \ݍAiVfN-'ۚ=u -endstream -endobj 574 0 obj << -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 573 0 R -/Resources 4 0 R -/Annots [ 575 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] +/Filter /FlateDecode +/Length 4803 >> +stream +x]ێ}VxAbr,FvzwN9DD.3fUK<<,آ +|!_0r!zg._bv_۫VF$~*/]/v  0 A3t.tRr\l7qAPL'8. $֙`ܐ\E 0LS:ۖ,~2m ! [Pi9. +7$78tBp\ezS 0.z3p\zKK,]~}0|B/$J߀d#~1ۀLZ=Lp-qZgW=j9a,G)o ٩̩*OuߦHY]uMg,BGPf=o9k2ll$߮~{9Pb\a~[Dz[ Ha))暺<ϛѸI=]I;uJ]uRF}˰ӵL9嚖wwޫlkboǕ{6;0LQ{qx0ـ& +"#s q橵z;|ђGtUt*dT4TH 'o +vݏNvg#1]ڰ:]̦1)7s:ԙMSCH鉞S7?8|#x]3ipK=*iӕ{Ps{LaQ Xӡw!QZㄢA97՞;ZtU)TB;m#X!tǿV\Pn^iHQuzWι=^ z|񌣍G9zնO&zo{>5D-}dGy۾/W+wWVJB> RB9Bl 4&Qg3Y8>k=MQ.1z,k]{\I 49NdrXn}[I0m\5rXA1փyNc1JcRDg=ͦu_[}1b;_%'as:G+wFYG_ѧ϶yc C1;磋;=l5;{R^ +>nK|: +==t=+_HݪC{_Ԟt}2mct@?Oi< 5զG~SCUO;~`(9BQJO,+Jw
    Rationale -Setting admission control policy to NamespaceLifecycle ensures that objects cannot be created in non-existent namespaces, and that namespaces undergoing termination are not used for creating the new objects. This is recommended to enforce the integrity of the namespace termination process and also for the availability of the newer objects. +Setting admission control policy to `NamespaceLifecycle` ensures that objects cannot be created in non-existent namespaces, and that namespaces undergoing termination are not used for creating the new objects. This is recommended to enforce the integrity of the namespace termination process and also for the availability of the newer objects. This can be remediated by passing this argument as a value to the `enable-admission-plugins=` and pass that to `--kube-apiserver-arg=` argument to `k3s server`. An example can be found below.
    -### Control 1.2.16 (mentioned above) +### Control 1.2.16 Ensure that the admission control plugin `PodSecurityPolicy` is set.
    Rationale -A Pod Security Policy is a cluster-level resource that controls the actions that a pod can perform and what it has the ability to access. The PodSecurityPolicy objects define a set of conditions that a pod must run with in order to be accepted into the system. Pod Security Policies are comprised of settings and strategies that control the security features a pod has access to and hence this must be used to control pod access permissions. +A Pod Security Policy is a cluster-level resource that controls the actions that a pod can perform and what it has the ability to access. The `PodSecurityPolicy` objects define a set of conditions that a pod must run with in order to be accepted into the system. Pod Security Policies are comprised of settings and strategies that control the security features a pod has access to and hence this must be used to control pod access permissions. This can be remediated by passing this argument as a value to the `enable-admission-plugins=` and pass that to `--kube-apiserver-arg=` argument to `k3s server`. An example can be found below.
    @@ -446,16 +450,18 @@ This can be remediated by passing this argument as a value to the `--kube-apiser Ensure that the `--encryption-provider-config` argument is set as appropriate.
    Rationale -Where `etcd` encryption is used, it is important to ensure that the appropriate set of encryption providers is used. Currently, the aescbc, kms and secretbox are likely to be appropriate options. +`etcd` is a highly available key-value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should be encrypted at rest to avoid any disclosures. + +Detailed steps on how to configure secrets encryption in K3s are available in [Secrets Encryption](../secrets_encryption/).
    ### Control 1.2.34 Ensure that encryption providers are appropriately configured.
    Rationale -`etcd` is a highly available key-value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should be encrypted at rest to avoid any disclosures. +Where `etcd` encryption is used, it is important to ensure that the appropriate set of encryption providers is used. Currently, the `aescbc`, `kms` and `secretbox` are likely to be appropriate options. -This can be remediated by passing a valid configuration to `k3s` as outlined above. +This can be remediated by passing a valid configuration to `k3s` as outlined above. Detailed steps on how to configure secrets encryption in K3s are available in [Secrets Encryption](../secrets_encryption/).
    ### Control 1.3.1 @@ -468,7 +474,7 @@ This can be remediated by passing this argument as a value to the `--kube-apiser ### Control 3.2.1 -Ensure that a minimal audit policy is created (Scored) +Ensure that a minimal audit policy is created.
    Rationale Logging is an important detective control for all systems, to detect potential unauthorized access. @@ -476,7 +482,6 @@ Logging is an important detective control for all systems, to detect potential u This can be remediated by passing controls 1.2.22 - 1.2.25 and verifying their efficacy.
    - ### Control 4.2.7 Ensure that the `--make-iptables-util-chains` argument is set to true.
    @@ -487,24 +492,23 @@ This can be remediated by passing this argument as a value to the `--kube-apiser
    ### Control 5.1.5 -Ensure that default service accounts are not actively used. (Scored) +Ensure that default service accounts are not actively used
    Rationale - -Kubernetes provides a default service account which is used by cluster workloads where no specific service account is assigned to the pod. +Kubernetes provides a `default` service account which is used by cluster workloads where no specific service account is assigned to the pod. Where access to the Kubernetes API from a pod is required, a specific service account should be created for that pod, and rights granted to that service account. The default service account should be configured such that it does not provide a service account token and does not have any explicit rights assignments. -
    -The remediation for this is to update the `automountServiceAccountToken` field to `false` for the `default` service account in each namespace. +This can be remediated by updating the `automountServiceAccountToken` field to `false` for the `default` service account in each namespace. For `default` service accounts in the built-in namespaces (`kube-system`, `kube-public`, `kube-node-lease`, and `default`), K3s does not automatically do this. You can manually update this field on these service accounts to pass the control. + ## Control Plane Execution and Arguments -Listed below are the K3s control plane components and the arguments they're given at start, by default. Commented to their right is the CIS 1.5 control that they satisfy. +Listed below are the K3s control plane components and the arguments they are given at start, by default. Commented to their right is the CIS 1.6 control that they satisfy. ```bash kube-apiserver @@ -604,7 +608,7 @@ kubelet --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key # 4.2.10 ``` -The command below is an example of how the outlined remediations can be applied. +The command below is an example of how the outlined remediations can be applied to harden K3s. ```bash k3s server \ @@ -625,4 +629,4 @@ k3s server \ ## Conclusion -If you have followed this guide, your K3s cluster will be configured to comply with the CIS Kubernetes Benchmark. You can review the [CIS Benchmark Self-Assessment Guide](../self_assessment/) to understand the expectations of each of the benchmarks and how you can do the same on your cluster. +If you have followed this guide, your K3s cluster will be configured to comply with the CIS Kubernetes Benchmark. You can review the [CIS Benchmark Self-Assessment Guide](../self_assessment/) to understand the expectations of each of the benchmark's checks and how you can do the same on your cluster. diff --git a/content/k3s/latest/en/security/self_assessment/_index.md b/content/k3s/latest/en/security/self_assessment/_index.md index ff7ba082384..6471a95fb83 100644 --- a/content/k3s/latest/en/security/self_assessment/_index.md +++ b/content/k3s/latest/en/security/self_assessment/_index.md @@ -1,18 +1,17 @@ --- -title: "CIS Self Assessment Guide" +title: CIS Self Assessment Guide weight: 90 --- - -### CIS Kubernetes Benchmark v1.5 - K3s v1.17, v1.18, & v1.19 +### CIS Kubernetes Benchmark v1.6 - K3s with Kubernetes v1.17 to v1.21 #### Overview -This document is a companion to the K3s security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of K3s, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the CIS Kubernetes benchmark. It is to be used by K3s operators, security teams, auditors, and decision-makers. +This document is a companion to the K3s security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of K3s, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the CIS Kubernetes Benchmark. It is to be used by K3s operators, security teams, auditors, and decision-makers. -This guide is specific to the **v1.17**, **v1.18**, and **v1.19** release line of K3s and the **v1.5.1** release of the CIS Kubernetes Benchmark. +This guide is specific to the **v1.17**, **v1.18**, **v1.19**, **v1.20** and **v1.21** release line of K3s and the **v1.6** release of the CIS Kubernetes Benchmark. -For more detail about each control, including more detailed descriptions and remediations for failing tests, you can refer to the corresponding section of the CIS Kubernetes Benchmark v1.5. You can download the benchmark after logging in to [CISecurity.org](https://www.cisecurity.org/benchmark/kubernetes/). +For more information about each control, including detailed descriptions and remediations for failing tests, you can refer to the corresponding section of the CIS Kubernetes Benchmark v1.6. You can download the benchmark, after creating a free account, in [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). #### Testing controls methodology @@ -24,2474 +23,3056 @@ These are the possible results for each control: - **Pass** - The K3s cluster under test passed the audit outlined in the benchmark. - **Not Applicable** - The control is not applicable to K3s because of how it is designed to operate. The remediation section will explain why this is so. -- **Not Scored - Operator Dependent** - The control is not scored in the CIS benchmark and it depends on the cluster's use case or some other factor that must be determined by the cluster operator. These controls have been evaluated to ensure K3s does not prevent their implementation, but no further configuration or auditing of the cluster under test has been performed. +- **Warn** - The control is manual in the CIS benchmark and it depends on the cluster's use case or some other factor that must be determined by the cluster operator. These controls have been evaluated to ensure K3s does not prevent their implementation, but no further configuration or auditing of the cluster under test has been performed. This guide makes the assumption that K3s is running as a Systemd unit. Your installation may vary and will require you to adjust the "audit" commands to fit your scenario. +> NOTE: Only `automated` tests (previously called `scored`) are covered in this guide. + ### Controls --- -## 1 Master Node Security Configuration -### 1.1 Master Node Configuration Files -#### 1.1.1 -Ensure that the API server pod specification file permissions are set to `644` or more restrictive (Scored) -
    -Rationale -The API server pod specification file controls various parameters that set the behavior of the API server. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system. -
    +## 1.1 Master Node Configuration Files +### 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) + **Result:** Not Applicable +**Remediation:** +Run the below command (based on the file location on your system) on the +master node. +For example, chmod 644 /etc/kubernetes/manifests/kube-apiserver.yaml + +### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) -#### 1.1.2 -Ensure that the API server pod specification file ownership is set to `root:root` (Scored) -
    -Rationale -The API server pod specification file controls various parameters that set the behavior of the API server. You should set its file ownership to maintain the integrity of the file. The file should be owned by `root:root`. -
    **Result:** Not Applicable +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chown root:root /etc/kubernetes/manifests/kube-apiserver.yaml + +### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated) -#### 1.1.3 -Ensure that the controller manager pod specification file permissions are set to `644` or more restrictive (Scored) -
    -Rationale -The controller manager pod specification file controls various parameters that set the behavior of the Controller Manager on the master node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system. -
    **Result:** Not Applicable +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chmod 644 /etc/kubernetes/manifests/kube-controller-manager.yaml + +### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) -#### 1.1.4 -Ensure that the controller manager pod specification file ownership is set to `root:root` (Scored) -
    -Rationale -The controller manager pod specification file controls various parameters that set the behavior of various components of the master node. You should set its file ownership to maintain the integrity of the file. The file should be owned by root:root. -
    **Result:** Not Applicable +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chown root:root /etc/kubernetes/manifests/kube-controller-manager.yaml + +### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated) -#### 1.1.5 -Ensure that the scheduler pod specification file permissions are set to `644` or more restrictive (Scored) -
    -Rationale -The scheduler pod specification file controls various parameters that set the behavior of the Scheduler service in the master node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system. -
    **Result:** Not Applicable +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chmod 644 /etc/kubernetes/manifests/kube-scheduler.yaml + +### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) -#### 1.1.6 -Ensure that the scheduler pod specification file ownership is set to `root:root` (Scored) -
    -Rationale -The scheduler pod specification file controls various parameters that set the behavior of the kube-scheduler service in the master node. You should set its file ownership to maintain the integrity of the file. The file should be owned by root:root. -
    **Result:** Not Applicable +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chown root:root /etc/kubernetes/manifests/kube-scheduler.yaml + +### 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated) -#### 1.1.7 -Ensure that the etcd pod specification file permissions are set to `644` or more restrictive (Scored) -
    -Rationale -The etcd pod specification file /var/lib/rancher/k3s/agent/pod-manifests/etcd.yaml controls various parameters that set the behavior of the etcd service in the master node. etcd is a highly- available key-value store which Kubernetes uses for persistent storage of all of its REST API object. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system. -
    **Result:** Not Applicable +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chmod 644 /etc/kubernetes/manifests/etcd.yaml + +### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) -#### 1.1.8 -Ensure that the etcd pod specification file ownership is set to `root:root` (Scored) -
    -Rationale -The etcd pod specification file /var/lib/rancher/k3s/agent/pod-manifests/etcd.yaml controls various parameters that set the behavior of the etcd service in the master node. etcd is a highly- available key-value store which Kubernetes uses for persistent storage of all of its REST API object. You should set its file ownership to maintain the integrity of the file. The file should be owned by root:root. -
    **Result:** Not Applicable +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chown root:root /etc/kubernetes/manifests/etcd.yaml + +### 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Manual) -#### 1.1.9 -Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Not Scored) -
    -Rationale -Container Network Interface provides various networking options for overlay networking. You should consult their documentation and restrict their respective file permissions to maintain the integrity of those files. Those files should be writable by only the administrators on the system. -
    **Result:** Not Applicable +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chmod 644 + +### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual) -#### 1.1.10 -Ensure that the Container Network Interface file ownership is set to root:root (Not Scored) -
    -Rationale -Container Network Interface provides various networking options for overlay networking. You should consult their documentation and restrict their respective file permissions to maintain the integrity of those files. Those files should be owned by root:root. -
    **Result:** Not Applicable +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chown root:root -#### 1.1.11 -Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored) -
    -Rationale -etcd is a highly-available key-value store used by Kubernetes deployments for persistent storage of all of its REST API objects. This data directory should be protected from any unauthorized reads or writes. It should not be readable or writable by any group members or the world. -
    +### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) -**Result:** Pass -**Audit:** +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the below command: +ps -ef | grep etcd +Run the below command (based on the etcd data directory found above). For example, +chmod 700 /var/lib/etcd + +**Audit Script:** `check_for_k3s_etcd.sh` + ```bash -stat -c %a /var/lib/rancher/k3s/server/db/etcd +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo "$(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth')";; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo "$(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth')";; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 1.1.11 +``` + +**Expected Result**: + +```console +'700' is equal to '700' +``` + +**Returned Value**: + +```console 700 ``` -**Remediation:** -K3s manages the etcd data directory and sets its permissions to 700. No manual remediation needed. (only relevant when Etcd is used for the data store) +### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) -#### 1.1.12 -Ensure that the etcd data directory ownership is set to `etcd:etcd` (Scored) -
    -Rationale -etcd is a highly-available key-value store used by Kubernetes deployments for persistent storage of all of its REST API objects. This data directory should be protected from any unauthorized reads or writes. It should be owned by etcd:etcd. -
    - **Result:** Not Applicable +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the below command: +ps -ef | grep etcd +Run the below command (based on the etcd data directory found above). +For example, chown etcd:etcd /var/lib/etcd -#### 1.1.13 -Ensure that the `admin.conf` file permissions are set to `644` or more restrictive (Scored) -
    -Rationale -The admin.conf is the administrator kubeconfig file defining various settings for the administration of the cluster. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system. +### 1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Automated) -In K3s, this file is located at `/var/lib/rancher/k3s/server/cred/admin.kubeconfig`. -
    -**Result:** Pass +**Result:** Not Applicable **Remediation:** -By default, K3s creates the directory and files with the expected permissions of `644`. No manual remediation should be necessary. +Run the below command (based on the file location on your system) on the master node. +For example, +chmod 644 /var/lib/rancher/k3s/server/cred/admin.kubeconfig + +### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) -#### 1.1.14 -Ensure that the `admin.conf` file ownership is set to `root:root` (Scored) -
    -Rationale -The admin.conf file contains the admin credentials for the cluster. You should set its file ownership to maintain the integrity of the file. The file should be owned by root:root. - -In K3s, this file is located at `/var/lib/rancher/k3s/server/cred/admin.kubeconfig`. -
    - -**Result:** Pass +**Result:** pass **Remediation:** -By default, K3s creates the directory and files with the expected ownership of `root:root`. No manual remediation should be necessary. - - -#### 1.1.15 -Ensure that the `scheduler.conf` file permissions are set to `644` or more restrictive (Scored) -
    -Rationale - -The scheduler.conf file is the kubeconfig file for the Scheduler. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system. - -In K3s, this file is located at `/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig`. -
    - -**Result:** Pass - -**Remediation:** -By default, K3s creates the directory and files with the expected permissions of `644`. No manual remediation should be necessary. - - -#### 1.1.16 -Ensure that the `scheduler.conf` file ownership is set to `root:root` (Scored) -
    -Rationale -The scheduler.conf file is the kubeconfig file for the Scheduler. You should set its file ownership to maintain the integrity of the file. The file should be owned by root:root. - -In K3s, this file is located at `/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig`. -
    - -**Result:** Pass - -**Remediation:** -By default, K3s creates the directory and files with the expected ownership of `root:root`. No manual remediation should be necessary. - - -#### 1.1.17 -Ensure that the `controller.kubeconfig` file permissions are set to `644` or more restrictive (Scored) -
    -Rationale -The controller.kubeconfig file is the kubeconfig file for the Scheduler. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system. - -In K3s, this file is located at `/var/lib/rancher/k3s/server/cred/controller.kubeconfig`. -
    - -**Result:** Pass - -**Remediation:** -By default, K3s creates the directory and files with the expected permissions of `644`. No manual remediation should be necessary. - - -#### 1.1.18 -Ensure that the `controller.kubeconfig` file ownership is set to `root:root` (Scored) -
    -Rationale -The controller.kubeconfig file is the kubeconfig file for the Scheduler. You should set its file ownership to maintain the integrity of the file. The file should be owned by root:root. - -In K3s, this file is located at `/var/lib/rancher/k3s/server/cred/controller.kubeconfig`. -
    - -**Result:** Pass - -**Remediation:** -By default, K3s creates the directory and files with the expected ownership of `root:root`. No manual remediation should be necessary. - - -#### 1.1.19 -Ensure that the Kubernetes PKI directory and file ownership is set to `root:root` (Scored) -
    -Rationale -Kubernetes makes use of a number of certificates as part of its operation. You should set the ownership of the directory containing the PKI information and all files in that directory to maintain their integrity. The directory and files should be owned by root:root. -
    - -**Result:** Pass +Run the below command (based on the file location on your system) on the master node. +For example, +chown root:root /etc/kubernetes/admin.conf **Audit:** + ```bash -stat -c %U:%G /var/lib/rancher/k3s/server/tls +/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console root:root ``` +### 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated) + + +**Result:** pass + **Remediation:** -By default, K3s creates the directory and files with the expected ownership of `root:root`. No manual remediation should be necessary. - - -#### 1.1.20 -Ensure that the Kubernetes PKI certificate file permissions are set to `644` or more restrictive (Scored) -
    -Rationale -Kubernetes makes use of a number of certificate files as part of the operation of its components. The permissions on these files should be set to 644 or more restrictive to protect their integrity. -
    - -**Result:** Pass +Run the below command (based on the file location on your system) on the master node. +For example, +chmod 644 scheduler **Audit:** -Run the below command on the master node. ```bash -stat -c %n\ %a /var/lib/rancher/k3s/server/tls/*.crt +/bin/sh -c 'if test -e scheduler; then stat -c permissions=%a scheduler; fi' ``` -Verify that the permissions are `644` or more restrictive. +**Expected Result**: + +```console +'permissions' is not present +``` + +### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) + + +**Result:** pass **Remediation:** -By default, K3s creates the files with the expected permissions of `644`. No manual remediation is needed. - - -#### 1.1.21 -Ensure that the Kubernetes PKI key file permissions are set to `600` (Scored) -
    -Rationale -Kubernetes makes use of a number of key files as part of the operation of its components. The permissions on these files should be set to 600 to protect their integrity and confidentiality. -
    - -**Result:** Pass +Run the below command (based on the file location on your system) on the master node. +For example, +chown root:root scheduler **Audit:** -Run the below command on the master node. ```bash -stat -c %n\ %a /var/lib/rancher/k3s/server/tls/*.key +/bin/sh -c 'if test -e scheduler; then stat -c %U:%G scheduler; fi' ``` -Verify that the permissions are `600` or more restrictive. +**Expected Result**: + +```console +'root:root' is not present +``` + +### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated) + + +**Result:** pass **Remediation:** -By default, K3s creates the files with the expected permissions of `600`. No manual remediation is needed. - - -### 1.2 API Server -This section contains recommendations relating to API server configuration flags - - -#### 1.2.1 -Ensure that the `--anonymous-auth` argument is set to false (Not Scored) - -
    -Rationale -When enabled, requests that are not rejected by other configured authentication methods are treated as anonymous requests. These requests are then served by the API server. You should rely on authentication to authorize access and disallow anonymous requests. - -If you are using RBAC authorization, it is generally considered reasonable to allow anonymous access to the API Server for health checks and discovery purposes, and hence this recommendation is not scored. However, you should consider whether anonymous discovery is an acceptable risk for your purposes. -
    - -**Result:** Pass +Run the below command (based on the file location on your system) on the master node. +For example, +chmod 644 controllermanager **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "anonymous-auth" +/bin/sh -c 'if test -e controllermanager; then stat -c permissions=%a controllermanager; fi' ``` -Verify that `--anonymous-auth=false` is present. +**Expected Result**: + +```console +'permissions' is not present +``` + +### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) + + +**Result:** pass **Remediation:** -By default, K3s kube-apiserver is configured to run with this flag and value. No manual remediation is needed. - -#### 1.2.2 -Ensure that the `--basic-auth-file` argument is not set (Scored) -
    -Rationale -Basic authentication uses plaintext credentials for authentication. Currently, the basic authentication credentials last indefinitely, and the password cannot be changed without restarting the API server. The basic authentication is currently supported for convenience. Hence, basic authentication should not be used. -
    - -**Result:** Pass +Run the below command (based on the file location on your system) on the master node. +For example, +chown root:root controllermanager **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "basic-auth-file" +stat -c %U:%G /var/lib/rancher/k3s/server/tls ``` -Verify that the `--basic-auth-file` argument does not exist. +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) + + +**Result:** pass **Remediation:** -By default, K3s does not run with basic authentication enabled. No manual remediation is needed. - - -#### 1.2.3 -Ensure that the `--token-auth-file` parameter is not set (Scored) - -
    -Rationale -The token-based authentication utilizes static tokens to authenticate requests to the apiserver. The tokens are stored in clear-text in a file on the apiserver, and cannot be revoked or rotated without restarting the apiserver. Hence, do not use static token-based authentication. -
    - -**Result:** Pass +Run the below command (based on the file location on your system) on the master node. +For example, +chown -R root:root /etc/kubernetes/pki/ **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "token-auth-file" +find /etc/kubernetes/pki/ | xargs stat -c %U:%G ``` -Verify that the `--token-auth-file` argument does not exist. +**Expected Result**: + +```console +'root:root' is not present +``` + +### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Manual) + + +**Result:** pass **Remediation:** -By default, K3s does not run with basic authentication enabled. No manual remediation is needed. +Run the below command (based on the file location on your system) on the master node. +For example, +chmod -R 644 /etc/kubernetes/pki/*.crt -#### 1.2.4 -Ensure that the `--kubelet-https` argument is set to true (Scored) +**Audit:** + +```bash +stat -c %n %a /var/lib/rancher/k3s/server/tls/*.crt +``` + +**Expected Result**: + +```console +'permissions' is not present +``` + +### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chmod -R 600 /etc/kubernetes/pki/*.key + +**Audit:** + +```bash +stat -c %n %a /var/lib/rancher/k3s/server/tls/*.key +``` + +**Expected Result**: + +```console +'permissions' is not present +``` + +## 1.2 API Server +### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the below parameter. +--anonymous-auth=false + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'anonymous-auth' +``` + +### 1.2.2 Ensure that the --basic-auth-file argument is not set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and configure alternate mechanisms for authentication. Then, +edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and remove the --basic-auth-file= parameter. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'basic-auth-file' +``` + +**Expected Result**: + +```console +'--basic-auth-file' is not present +``` + +### 1.2.3 Ensure that the --token-auth-file parameter is not set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and configure alternate mechanisms for authentication. Then, +edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and remove the --token-auth-file= parameter. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'token-auth-file' +``` + +**Expected Result**: + +```console +'--token-auth-file' is not present +``` + +### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) -
    -Rationale -Connections from apiserver to kubelets could potentially carry sensitive data such as secrets and keys. It is thus important to use in-transit encryption for any communication between the apiserver and kubelets. -
    **Result:** Not Applicable +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and remove the --kubelet-https parameter. + +### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the +apiserver and kubelets. Then, edit API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the +kubelet client certificate and key parameters as below. +--kubelet-client-certificate= +--kubelet-client-key= + **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "kubelet-https" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority' ``` -Verify that the `--kubelet-https` argument does not exist. +**Expected Result**: + +```console +'--kubelet-client-certificate' is not present AND '--kubelet-client-key' is not present +``` + +### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) + + +**Result:** pass **Remediation:** -By default, K3s kube-apiserver doesn't run with the `--kubelet-https` parameter as it runs with TLS. No manual remediation is needed. - -#### 1.2.5 -Ensure that the `--kubelet-client-certificate` and `--kubelet-client-key` arguments are set as appropriate (Scored) - -
    -Rationale -The apiserver, by default, does not authenticate itself to the kubelet's HTTPS endpoints. The requests from the apiserver are treated anonymously. You should set up certificate-based kubelet authentication to ensure that the apiserver authenticates itself to kubelets when submitting requests. -
    - -**Result:** Pass +Follow the Kubernetes documentation and setup the TLS connection between +the apiserver and kubelets. Then, edit the API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the +--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. +--kubelet-certificate-authority= **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep -E 'kubelet-client-certificate|kubelet-client-key' +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority' ``` -Verify that the `--kubelet-client-certificate` and `--kubelet-client-key` arguments exist and they are set as appropriate. +**Expected Result**: + +```console +'--kubelet-certificate-authority' is not present +``` + +### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass **Remediation:** -By default, K3s kube-apiserver is ran with these arguments for secure communication with kubelet. No manual remediation is needed. - - -#### 1.2.6 -Ensure that the `--kubelet-certificate-authority` argument is set as appropriate (Scored) -
    -Rationale -The connections from the apiserver to the kubelet are used for fetching logs for pods, attaching (through kubectl) to running pods, and using the kubelet’s port-forwarding functionality. These connections terminate at the kubelet’s HTTPS endpoint. By default, the apiserver does not verify the kubelet’s serving certificate, which makes the connection subject to man-in-the-middle attacks, and unsafe to run over untrusted and/or public networks. -
    - -**Result:** Pass +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --authorization-mode parameter to values other than AlwaysAllow. +One such example could be as below. +--authorization-mode=RBAC **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "kubelet-certificate-authority" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' ``` -Verify that the `--kubelet-certificate-authority` argument exists and is set as appropriate. +**Expected Result**: + +```console +'--authorization-mode' is not present +``` + +### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) + + +**Result:** pass **Remediation:** -By default, K3s kube-apiserver is ran with this argument for secure communication with kubelet. No manual remediation is needed. - - -#### 1.2.7 -Ensure that the `--authorization-mode` argument is not set to `AlwaysAllow` (Scored) -
    -Rationale -The API Server, can be configured to allow all requests. This mode should not be used on any production cluster. -
    - -**Result:** Pass +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --authorization-mode parameter to a value that includes Node. +--authorization-mode=Node,RBAC **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' ``` -Verify that the argument value doesn't contain `AlwaysAllow`. +**Expected Result**: + +```console +'--authorization-mode' is not present +``` + +### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) + + +**Result:** pass **Remediation:** -By default, K3s sets `Node,RBAC` as the parameter to the `--authorization-mode` argument. No manual remediation is needed. - - -#### 1.2.8 -Ensure that the `--authorization-mode` argument includes `Node` (Scored) -
    -Rationale -The Node authorization mode only allows kubelets to read Secret, ConfigMap, PersistentVolume, and PersistentVolumeClaim objects associated with their nodes. -
    - -**Result:** Pass +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --authorization-mode parameter to a value that includes RBAC, +for example: +--authorization-mode=Node,RBAC **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' ``` -Verify `Node` exists as a parameter to the argument. +**Expected Result**: + +```console +'--authorization-mode' is not present +``` + +### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual) + + +**Result:** pass **Remediation:** -By default, K3s sets `Node,RBAC` as the parameter to the `--authorization-mode` argument. No manual remediation is needed. - - -#### 1.2.9 -Ensure that the `--authorization-mode` argument includes `RBAC` (Scored) -
    -Rationale -Role Based Access Control (RBAC) allows fine-grained control over the operations that different entities can perform on different objects in the cluster. It is recommended to use the RBAC authorization mode. -
    - -**Result:** Pass +Follow the Kubernetes documentation and set the desired limits in a configuration file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +and set the below parameters. +--enable-admission-plugins=...,EventRateLimit,... +--admission-control-config-file= **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' ``` -Verify `RBAC` exists as a parameter to the argument. +**Expected Result**: + +```console +'--enable-admission-plugins' is not present +``` + +### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) + + +**Result:** pass **Remediation:** -By default, K3s sets `Node,RBAC` as the parameter to the `--authorization-mode` argument. No manual remediation is needed. - - -#### 1.2.10 -Ensure that the admission control plugin EventRateLimit is set (Not Scored) -
    -Rationale -Using `EventRateLimit` admission control enforces a limit on the number of events that the API Server will accept in a given time slice. A misbehaving workload could overwhelm and DoS the API Server, making it unavailable. This particularly applies to a multi-tenant cluster, where there might be a small percentage of misbehaving tenants which could have a significant impact on the performance of the cluster overall. Hence, it is recommended to limit the rate of events that the API server will accept. - -Note: This is an Alpha feature in the Kubernetes 1.15 release. -
    - -**Result:** **Not Scored - Operator Dependent** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and either remove the --enable-admission-plugins parameter, or set it to a +value that does not include AlwaysAdmit. **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "enable-admission-plugins" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' ``` -Verify that the `--enable-admission-plugins` argument is set to a value that includes EventRateLimit. +**Expected Result**: + +```console +'--enable-admission-plugins' is not present OR '--enable-admission-plugins' is not present +``` + +### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) + + +**Result:** pass **Remediation:** -By default, K3s only sets `NodeRestriction,PodSecurityPolicy` as the parameter to the `--enable-admission-plugins` argument. -To configure this, follow the Kubernetes documentation and set the desired limits in a configuration file. Then refer to K3s's documentation to see how to supply additional api server configuration via the kube-apiserver-arg parameter. - - -#### 1.2.11 -Ensure that the admission control plugin `AlwaysAdmit` is not set (Scored) -
    -Rationale -Setting admission control plugin AlwaysAdmit allows all requests and do not filter any requests. - -The AlwaysAdmit admission controller was deprecated in Kubernetes v1.13. Its behavior was equivalent to turning off all admission controllers. -
    - -**Result:** Pass +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --enable-admission-plugins parameter to include +AlwaysPullImages. +--enable-admission-plugins=...,AlwaysPullImages,... **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "enable-admission-plugins" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' ``` -Verify that if the `--enable-admission-plugins` argument is set, its value does not include `AlwaysAdmit`. +**Expected Result**: + +```console +'--enable-admission-plugins' is not present +``` + +### 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) + + +**Result:** pass **Remediation:** -By default, K3s only sets `NodeRestriction,PodSecurityPolicy` as the parameter to the `--enable-admission-plugins` argument. No manual remediation needed. - - -#### 1.2.12 -Ensure that the admission control plugin AlwaysPullImages is set (Not Scored) -
    -Rationale -Setting admission control policy to `AlwaysPullImages` forces every new pod to pull the required images every time. In a multi-tenant cluster users can be assured that their private images can only be used by those who have the credentials to pull them. Without this admission control policy, once an image has been pulled to a node, any pod from any user can use it simply by knowing the image’s name, without any authorization check against the image ownership. When this plug-in is enabled, images are always pulled prior to starting containers, which means valid credentials are required. - -
    - -**Result:** **Not Scored - Operator Dependent** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --enable-admission-plugins parameter to include +SecurityContextDeny, unless PodSecurityPolicy is already in place. +--enable-admission-plugins=...,SecurityContextDeny,... **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "enable-admission-plugins" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' ``` -Verify that the `--enable-admission-plugins` argument is set to a value that includes `AlwaysPullImages`. +**Expected Result**: + +```console +'--enable-admission-plugins' is not present OR '--enable-admission-plugins' is not present +``` + +### 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) + + +**Result:** pass **Remediation:** -By default, K3s only sets `NodeRestriction,PodSecurityPolicy` as the parameter to the `--enable-admission-plugins` argument. -To configure this, follow the Kubernetes documentation and set the desired limits in a configuration file. Then refer to K3s's documentation to see how to supply additional api server configuration via the kube-apiserver-arg parameter. - -#### 1.2.13 -Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Not Scored) -
    -Rationale -SecurityContextDeny can be used to provide a layer of security for clusters which do not have PodSecurityPolicies enabled. -
    - -**Result:** Not Scored +Follow the documentation and create ServiceAccount objects as per your environment. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and ensure that the --disable-admission-plugins parameter is set to a +value that does not include ServiceAccount. **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "enable-admission-plugins" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'ServiceAccount' ``` -Verify that the `--enable-admission-plugins` argument is set to a value that includes `SecurityContextDeny`, if `PodSecurityPolicy` is not included. +**Expected Result**: + +```console +'--disable-admission-plugins' is not present OR '--disable-admission-plugins' is not present +``` + +### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) + + +**Result:** pass **Remediation:** -K3s would need to have the `SecurityContextDeny` admission plugin enabled by passing it as an argument to K3s. `--kube-apiserver-arg='enable-admission-plugins=SecurityContextDeny` - - -#### 1.2.14 -Ensure that the admission control plugin `ServiceAccount` is set (Scored) -
    -Rationale -When you create a pod, if you do not specify a service account, it is automatically assigned the `default` service account in the same namespace. You should create your own service account and let the API server manage its security tokens. -
    - -**Result:** Pass +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --disable-admission-plugins parameter to +ensure it does not include NamespaceLifecycle. **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "ServiceAccount" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'disable-admission-plugins' ``` -Verify that the `--disable-admission-plugins` argument is set to a value that does not includes `ServiceAccount`. +**Expected Result**: + +```console +'--disable-admission-plugins' is not present OR '--disable-admission-plugins' is not present +``` + +### 1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set (Automated) + + +**Result:** pass **Remediation:** -By default, K3s does not use this argument. If there's a desire to use this argument, follow the documentation and create ServiceAccount objects as per your environment. Then refer to K3s's documentation to see how to supply additional api server configuration via the kube-apiserver-arg parameter. - - -#### 1.2.15 -Ensure that the admission control plugin `NamespaceLifecycle` is set (Scored) -
    -Rationale -Setting admission control policy to `NamespaceLifecycle` ensures that objects cannot be created in non-existent namespaces, and that namespaces undergoing termination are not used for creating the new objects. This is recommended to enforce the integrity of the namespace termination process and also for the availability of the newer objects. -
    - -**Result:** Pass +Follow the documentation and create Pod Security Policy objects as per your environment. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --enable-admission-plugins parameter to a +value that includes PodSecurityPolicy: +--enable-admission-plugins=...,PodSecurityPolicy,... +Then restart the API Server. **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "disable-admission-plugins" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' ``` -Verify that the `--disable-admission-plugins` argument is set to a value that does not include `NamespaceLifecycle`. +**Expected Result**: + +```console +'--enable-admission-plugins' is not present +``` + +### 1.2.17 Ensure that the admission control plugin NodeRestriction is set (Automated) + + +**Result:** pass **Remediation:** -By default, K3s does not use this argument. No manual remediation needed. - - -#### 1.2.16 -Ensure that the admission control plugin `PodSecurityPolicy` is set (Scored) -
    -Rationale -A Pod Security Policy is a cluster-level resource that controls the actions that a pod can perform and what it has the ability to access. The `PodSecurityPolicy` objects define a set of conditions that a pod must run with in order to be accepted into the system. Pod Security Policies are comprised of settings and strategies that control the security features a pod has access to and hence this must be used to control pod access permissions. - -**Note:** When the PodSecurityPolicy admission plugin is in use, there needs to be at least one PodSecurityPolicy in place for ANY pods to be admitted. See section 1.7 for recommendations on PodSecurityPolicy settings. -
    - -**Result:** Pass +Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --enable-admission-plugins parameter to a +value that includes NodeRestriction. +--enable-admission-plugins=...,NodeRestriction,... **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "enable-admission-plugins" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' ``` -Verify that the `--enable-admission-plugins` argument is set to a value that includes `PodSecurityPolicy`. +**Expected Result**: + +```console +'--enable-admission-plugins' is not present +``` + +### 1.2.18 Ensure that the --insecure-bind-address argument is not set (Automated) + + +**Result:** pass **Remediation:** -K3s would need to have the `PodSecurityPolicy` admission plugin enabled by passing it as an argument to K3s. `--kube-apiserver-arg='enable-admission-plugins=PodSecurityPolicy`. - - -#### 1.2.17 -Ensure that the admission control plugin `NodeRestriction` is set (Scored) -
    -Rationale -Using the `NodeRestriction` plug-in ensures that the kubelet is restricted to the `Node` and `Pod` objects that it could modify as defined. Such kubelets will only be allowed to modify their own `Node` API object, and only modify `Pod` API objects that are bound to their node. - -
    - -**Result:** Pass +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and remove the --insecure-bind-address parameter. **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "enable-admission-plugins" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'insecure-bind-address' ``` -Verify that the `--enable-admission-plugins` argument is set to a value that includes `NodeRestriction`. +**Expected Result**: + +```console +'--insecure-bind-address' is not present +``` + +### 1.2.19 Ensure that the --insecure-port argument is set to 0 (Automated) + + +**Result:** pass **Remediation:** -K3s would need to have the `NodeRestriction` admission plugin enabled by passing it as an argument to K3s. `--kube-apiserver-arg='enable-admission-plugins=NodeRestriction`. - - -#### 1.2.18 -Ensure that the `--insecure-bind-address` argument is not set (Scored) -
    -Rationale -If you bind the apiserver to an insecure address, basically anyone who could connect to it over the insecure port, would have unauthenticated and unencrypted access to your master node. The apiserver doesn't do any authentication checking for insecure binds and traffic to the Insecure API port is not encrpyted, allowing attackers to potentially read sensitive data in transit. -
    - -**Result:** Pass +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the below parameter. +--insecure-port=0 **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "insecure-bind-address" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'insecure-port' ``` -Verify that the `--insecure-bind-address` argument does not exist. +**Expected Result**: + +```console +'--insecure-port' is not present +``` + +### 1.2.20 Ensure that the --secure-port argument is not set to 0 (Automated) + + +**Result:** pass **Remediation:** -By default, K3s explicitly excludes the use of the `--insecure-bind-address` parameter. No manual remediation is needed. - - -#### 1.2.19 -Ensure that the `--insecure-port` argument is set to `0` (Scored) -
    -Rationale -Setting up the apiserver to serve on an insecure port would allow unauthenticated and unencrypted access to your master node. This would allow attackers who could access this port, to easily take control of the cluster. -
    - -**Result:** Pass +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and either remove the --secure-port parameter or +set it to a different (non-zero) desired port. **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "insecure-port" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'secure-port' ``` -Verify that the `--insecure-port` argument is set to `0`. +**Expected Result**: + +```console +'--secure-port' is not present OR '--secure-port' is not present +``` + +### 1.2.21 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass **Remediation:** -By default, K3s starts the kube-apiserver process with this argument's parameter set to `0`. No manual remediation is needed. - - -#### 1.2.20 -Ensure that the `--secure-port` argument is not set to `0` (Scored) -
    -Rationale -The secure port is used to serve https with authentication and authorization. If you disable it, no https traffic is served and all traffic is served unencrypted. -
    - -**Result:** Pass +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the below parameter. +--profiling=false **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "secure-port" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'profiling' ``` -Verify that the `--secure-port` argument is either not set or is set to an integer value between 1 and 65535. +**Expected Result**: + +```console +'--profiling' is not present +``` + +### 1.2.22 Ensure that the --audit-log-path argument is set (Automated) + + +**Result:** pass **Remediation:** -By default, K3s sets the parameter of 6444 for the `--secure-port` argument. No manual remediation is needed. - - -#### 1.2.21 -Ensure that the `--profiling` argument is set to `false` (Scored) -
    -Rationale -Profiling allows for the identification of specific performance bottlenecks. It generates a significant amount of program data that could potentially be exploited to uncover system and program details. If you are not experiencing any bottlenecks and do not need the profiler for troubleshooting purposes, it is recommended to turn it off to reduce the potential attack surface. -
    - -**Result:** Pass +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --audit-log-path parameter to a suitable path and +file where you would like audit logs to be written, for example: +--audit-log-path=/var/log/apiserver/audit.log **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "profiling" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-path' ``` -Verify that the `--profiling` argument is set to false. +**Expected Result**: + +```console +'--audit-log-path' is not present +``` + +### 1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) + + +**Result:** pass **Remediation:** -By default, K3s sets the `--profiling` flag parameter to false. No manual remediation needed. - - -#### 1.2.22 -Ensure that the `--audit-log-path` argument is set (Scored) -
    -Rationale -Auditing the Kubernetes API Server provides a security-relevant chronological set of records documenting the sequence of activities that have affected system by individual users, administrators or other components of the system. Even though currently, Kubernetes provides only basic audit capabilities, it should be enabled. You can enable it by setting an appropriate audit log path. -
    - -**Result:** Pass +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --audit-log-maxage parameter to 30 or as an appropriate number of days: +--audit-log-maxage=30 **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "audit-log-path" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxage' ``` -Verify that the `--audit-log-path` argument is set as appropriate. +**Expected Result**: + +```console +'--audit-log-maxage' is not present +``` + +### 1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) + + +**Result:** pass **Remediation:** -K3s server needs to be run with the following argument, `--kube-apiserver-arg='audit-log-path=/path/to/log/file'`. - - -#### 1.2.23 -Ensure that the `--audit-log-maxage` argument is set to `30` or as appropriate (Scored) -
    -Rationale -Retaining logs for at least 30 days ensures that you can go back in time and investigate or correlate any events. Set your audit log retention period to 30 days or as per your business requirements. -
    - -**Result:** Pass +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --audit-log-maxbackup parameter to 10 or to an appropriate +value. +--audit-log-maxbackup=10 **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "audit-log-maxage" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxbackup' ``` -Verify that the `--audit-log-maxage` argument is set to `30` or as appropriate. +**Expected Result**: + +```console +'--audit-log-maxbackup' is not present +``` + +### 1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) + + +**Result:** pass **Remediation:** -K3s server needs to be run with the following argument, `--kube-apiserver-arg='audit-log-maxage=30'`. - - -#### 1.2.24 -Ensure that the `--audit-log-maxbackup` argument is set to `10` or as appropriate (Scored) -
    -Rationale -Kubernetes automatically rotates the log files. Retaining old log files ensures that you would have sufficient log data available for carrying out any investigation or correlation. For example, if you have set file size of 100 MB and the number of old log files to keep as 10, you would approximate have 1 GB of log data that you could potentially use for your analysis. -
    - -**Result:** Pass +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --audit-log-maxsize parameter to an appropriate size in MB. +For example, to set it as 100 MB: +--audit-log-maxsize=100 **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "audit-log-maxbackup" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxsize' ``` -Verify that the `--audit-log-maxbackup` argument is set to `10` or as appropriate. +**Expected Result**: + +```console +'--audit-log-maxsize' is not present +``` + +### 1.2.26 Ensure that the --request-timeout argument is set as appropriate (Automated) + + +**Result:** pass **Remediation:** -K3s server needs to be run with the following argument, `--kube-apiserver-arg='audit-log-maxbackup=10'`. - - -#### 1.2.25 -Ensure that the `--audit-log-maxsize` argument is set to `100` or as appropriate (Scored) -
    -Rationale -Kubernetes automatically rotates the log files. Retaining old log files ensures that you would have sufficient log data available for carrying out any investigation or correlation. If you have set file size of 100 MB and the number of old log files to keep as 10, you would approximate have 1 GB of log data that you could potentially use for your analysis. -
    - -**Result:** Pass +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +and set the below parameter as appropriate and if needed. +For example, +--request-timeout=300s **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "audit-log-maxsize" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'request-timeout' ``` -Verify that the `--audit-log-maxsize` argument is set to `100` or as appropriate. +**Expected Result**: + +```console +'--request-timeout' is not present OR '--request-timeout' is not present +``` + +### 1.2.27 Ensure that the --service-account-lookup argument is set to true (Automated) + + +**Result:** pass **Remediation:** -K3s server needs to be run with the following argument, `--kube-apiserver-arg='audit-log-maxsize=100'`. - - -#### 1.2.26 -Ensure that the `--request-timeout` argument is set as appropriate (Scored) -
    -Rationale -Setting global request timeout allows extending the API server request timeout limit to a duration appropriate to the user's connection speed. By default, it is set to 60 seconds which might be problematic on slower connections making cluster resources inaccessible once the data volume for requests exceeds what can be transmitted in 60 seconds. But, setting this timeout limit to be too large can exhaust the API server resources making it prone to Denial-of-Service attack. Hence, it is recommended to set this limit as appropriate and change the default limit of 60 seconds only if needed. -
    - -**Result:** Pass +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the below parameter. +--service-account-lookup=true +Alternatively, you can delete the --service-account-lookup parameter from this file so +that the default takes effect. **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "request-timeout" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'service-account-lookup' ``` -Verify that the `--request-timeout` argument is either not set or set to an appropriate value. +**Expected Result**: + +```console +'--service-account-lookup' is not present OR '--service-account-lookup' is not present +``` + +### 1.2.28 Ensure that the --service-account-key-file argument is set as appropriate (Automated) + + +**Result:** pass **Remediation:** -By default, K3s does not set the `--request-timeout` argument. No manual remediation needed. - - -#### 1.2.27 -Ensure that the `--service-account-lookup` argument is set to `true` (Scored) -
    -Rationale -If `--service-account-lookup` is not enabled, the apiserver only verifies that the authentication token is valid, and does not validate that the service account token mentioned in the request is actually present in etcd. This allows using a service account token even after the corresponding service account is deleted. This is an example of time of check to time of use security issue. -
    - -**Result:** Pass +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --service-account-key-file parameter +to the public key file for service accounts: +--service-account-key-file= **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "service-account-lookup" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'service-account-key-file' ``` -Verify that if the `--service-account-lookup` argument exists it is set to `true`. +**Expected Result**: + +```console +'--service-account-key-file' is not present +``` + +### 1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) + + +**Result:** pass **Remediation:** -K3s server needs to be run with the following argument, `--kube-apiserver-arg='service-account-lookup=true'`. +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the etcd certificate and key file parameters. +--etcd-certfile= +--etcd-keyfile= - -#### 1.2.28 -Ensure that the `--service-account-key-file` argument is set as appropriate (Scored) -
    -Rationale -By default, if no `--service-account-key-file` is specified to the apiserver, it uses the private key from the TLS serving certificate to verify service account tokens. To ensure that the keys for service account tokens could be rotated as needed, a separate public/private key pair should be used for signing service account tokens. Hence, the public key should be specified to the apiserver with `--service-account-key-file`. -
    - -**Result:** Pass - -**Audit:** -Run the below command on the master node. +**Audit Script:** `check_for_k3s_etcd.sh` ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "service-account-key-file" +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo "$(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth')";; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo "$(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth')";; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + ``` -Verify that the `--service-account-key-file` argument exists and is set as appropriate. - -**Remediation:** -By default, K3s sets the `--service-account-key-file` explicitly. No manual remediation needed. - - -#### 1.2.29 -Ensure that the `--etcd-certfile` and `--etcd-keyfile` arguments are set as appropriate (Scored) -
    -Rationale -etcd is a highly-available key-value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should be protected by client authentication. This requires the API server to identify itself to the etcd server using a client certificate and key. -
    - -**Result:** Pass - -**Audit:** -Run the below command on the master node. +**Audit Execution:** ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep -E 'etcd-certfile|etcd-keyfile' +./check_for_k3s_etcd.sh 1.2.29 ``` -Verify that the `--etcd-certfile` and `--etcd-keyfile` arguments exist and they are set as appropriate. +**Expected Result**: + +```console +'--etcd-certfile' is present AND '--etcd-keyfile' is present +``` + +**Returned Value**: + +```console +Feb 21 23:13:24 k3s[5223]: time="2022-02-21T23:13:24.847339487Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit-log --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,NamespaceLifecycle,ServiceAccount --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --insecure-port=0 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) + + +**Result:** pass **Remediation:** -By default, K3s sets the `--etcd-certfile` and `--etcd-keyfile` arguments explicitly. No manual remediation needed. - - -#### 1.2.30 -Ensure that the `--tls-cert-file` and `--tls-private-key-file` arguments are set as appropriate (Scored) -
    -Rationale -API server communication contains sensitive parameters that should remain encrypted in transit. Configure the API server to serve only HTTPS traffic. -
    - -**Result:** Pass +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the TLS certificate and private key file parameters. +--tls-cert-file= +--tls-private-key-file= **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep -E 'tls-cert-file|tls-private-key-file' +journalctl -D /var/log/journal -u k3s | grep -A1 'Running kube-apiserver' | tail -n2 ``` -Verify that the `--tls-cert-file` and `--tls-private-key-file` arguments exist and they are set as appropriate. +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +Feb 21 23:13:24 k3s[5223]: time="2022-02-21T23:13:24.847339487Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit-log --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,NamespaceLifecycle,ServiceAccount --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --insecure-port=0 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" Feb 21 23:13:24 k3s[5223]: {"level":"info","ts":"2022-02-21T23:13:24.848Z","caller":"raft/raft.go:1530","msg":"b3656202b34887ca switched to configuration voters=(12926846069174208458)"} +``` + +### 1.2.31 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass **Remediation:** -By default, K3s sets the `--tls-cert-file` and `--tls-private-key-file` arguments explicitly. No manual remediation needed. - - -#### 1.2.31 -Ensure that the `--client-ca-file` argument is set as appropriate (Scored) -
    -Rationale -API server communication contains sensitive parameters that should remain encrypted in transit. Configure the API server to serve only HTTPS traffic. If `--client-ca-file` argument is set, any request presenting a client certificate signed by one of the authorities in the `client-ca-file` is authenticated with an identity corresponding to the CommonName of the client certificate. -
    - -**Result:** Pass +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the client certificate authority file. +--client-ca-file= **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "client-ca-file" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'client-ca-file' ``` -Verify that the `--client-ca-file` argument exists and it is set as appropriate. +**Expected Result**: + +```console +'--client-ca-file' is not present +``` + +### 1.2.32 Ensure that the --etcd-cafile argument is set as appropriate (Automated) + + +**Result:** pass **Remediation:** -By default, K3s sets the `--client-ca-file` argument explicitly. No manual remediation needed. - - -#### 1.2.32 -Ensure that the `--etcd-cafile` argument is set as appropriate (Scored) -
    -Rationale -etcd is a highly-available key-value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should be protected by client authentication. This requires the API server to identify itself to the etcd server using a SSL Certificate Authority file. -
    - -**Result:** Pass +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the etcd certificate authority file parameter. +--etcd-cafile= **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "etcd-cafile" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-cafile' ``` -Verify that the `--etcd-cafile` argument exists and it is set as appropriate. +**Expected Result**: + +```console +'--etcd-cafile' is not present +``` + +### 1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate (Manual) + + +**Result:** pass **Remediation:** -By default, K3s sets the `--etcd-cafile` argument explicitly. No manual remediation needed. - - -#### 1.2.33 -Ensure that the `--encryption-provider-config` argument is set as appropriate (Scored) -
    -Rationale -etcd is a highly available key-value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should be encrypted at rest to avoid any disclosures. -
    - -**Result:** Pass +Follow the Kubernetes documentation and configure a EncryptionConfig file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --encryption-provider-config parameter to the path of that file: --encryption-provider-config=     **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "encryption-provider-config" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'encryption-provider-config' ``` -Verify that the `--encryption-provider-config` argument is set to a EncryptionConfigfile. Additionally, ensure that the `EncryptionConfigfile` has all the desired resources covered especially any secrets. +**Expected Result**: + +```console +'--encryption-provider-config' is not present +``` + +### 1.2.34 Ensure that encryption providers are appropriately configured (Manual) + + +**Result:** warn **Remediation:** -K3s server needs to be ran with the follow, `--kube-apiserver-arg='encryption-provider-config=/path/to/encryption_config'`. This can be done by running k3s with the `--secrets-encryptiuon` argument which will configure the encryption provider. - - -#### 1.2.34 -Ensure that encryption providers are appropriately configured (Scored) -
    -Rationale -Where `etcd` encryption is used, it is important to ensure that the appropriate set of encryption providers is used. Currently, the `aescbc`, `kms` and `secretbox` are likely to be appropriate options. -
    - -**Result:** Pass - -**Remediation:** -Follow the Kubernetes documentation and configure a `EncryptionConfig` file. -In this file, choose **aescbc**, **kms** or **secretbox** as the encryption provider. +Follow the Kubernetes documentation and configure a EncryptionConfig file. +In this file, choose aescbc, kms or secretbox as the encryption provider. **Audit:** -Run the below command on the master node. ```bash grep aescbc /path/to/encryption-config.json ``` -Run the below command on the master node. - -Verify that aescbc is set as the encryption provider for all the desired resources. - -**Remediation** -K3s server needs to be run with the following, `--secrets-encryption=true`, and verify that one of the allowed encryption providers is present. +### 1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual) -#### 1.2.35 -Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Not Scored) +**Result:** pass -
    -Rationale -TLS ciphers have had a number of known vulnerabilities and weaknesses, which can reduce the protection provided by them. By default Kubernetes supports a number of TLS cipher suites including some that have security concerns, weakening the protection provided. -
    - -**Result:** **Not Scored - Operator Dependent** +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the below parameter. +--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM +_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM +_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM +_SHA384 **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "tls-cipher-suites" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'tls-cipher-suites' ``` -Verify that the `--tls-cipher-suites` argument is set as outlined in the remediation procedure below. +**Expected Result**: + +```console +'--tls-cipher-suites' is not present +``` + +## 1.3 Controller Manager +### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual) + + +**Result:** pass **Remediation:** -By default, K3s explicitly doesn't set this flag. No manual remediation needed. - - -### 1.3 Controller Manager - -#### 1.3.1 -Ensure that the `--terminated-pod-gc-threshold` argument is set as appropriate (Not Scored) -
    -Rationale -Garbage collection is important to ensure sufficient resource availability and avoiding degraded performance and availability. In the worst case, the system might crash or just be unusable for a long period of time. The current setting for garbage collection is 12,500 terminated pods which might be too high for your system to sustain. Based on your system resources and tests, choose an appropriate threshold value to activate garbage collection. -
    - -**Result:** **Not Scored - Operator Dependent** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and set the --terminated-pod-gc-threshold to an appropriate threshold, +for example: +--terminated-pod-gc-threshold=10 **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-controller-manager" | tail -n1 | grep "terminated-pod-gc-threshold +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'terminated-pod-gc-threshold' ``` -Verify that the `--terminated-pod-gc-threshold` argument is set as appropriate. +**Expected Result**: + +```console +'--terminated-pod-gc-threshold' is not present +``` + +### 1.3.2 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass **Remediation:** -K3s server needs to be run with the following, `--kube-controller-manager-arg='terminated-pod-gc-threshold=10`. - - -#### 1.3.2 -Ensure that the `--profiling` argument is set to false (Scored) -
    -Rationale -Profiling allows for the identification of specific performance bottlenecks. It generates a significant amount of program data that could potentially be exploited to uncover system and program details. If you are not experiencing any bottlenecks and do not need the profiler for troubleshooting purposes, it is recommended to turn it off to reduce the potential attack surface. -
    - -**Result:** Pass +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and set the below parameter. +--profiling=false **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-controller-manager" | tail -n1 | grep "profiling" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'profiling' ``` -Verify that the `--profiling` argument is set to false. +**Expected Result**: + +```console +'--profiling' is not present +``` + +### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) + + +**Result:** pass **Remediation:** -By default, K3s sets the `--profiling` flag parameter to false. No manual remediation needed. - - -#### 1.3.3 -Ensure that the `--use-service-account-credentials` argument is set to `true` (Scored) -
    -Rationale -The controller manager creates a service account per controller in the `kube-system` namespace, generates a credential for it, and builds a dedicated API client with that service account credential for each controller loop to use. Setting the `--use-service-account-credentials` to `true` runs each control loop within the controller manager using a separate service account credential. When used in combination with RBAC, this ensures that the control loops run with the minimum permissions required to perform their intended tasks. -
    - -**Result:** Pass +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node to set the below parameter. +--use-service-account-credentials=true **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-controller-manager" | tail -n1 | grep "use-service-account-credentials" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'use-service-account-credentials' ``` -Verify that the `--use-service-account-credentials` argument is set to true. +**Expected Result**: + +```console +'--use-service-account-credentials' is not present +``` + +### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) + + +**Result:** pass **Remediation:** -K3s server needs to be run with the following, `--kube-controller-manager-arg='use-service-account-credentials=true'` - - -#### 1.3.4 -Ensure that the `--service-account-private-key-file` argument is set as appropriate (Scored) -
    -Rationale -To ensure that keys for service account tokens can be rotated as needed, a separate public/private key pair should be used for signing service account tokens. The private key should be specified to the controller manager with `--service-account-private-key-file` as appropriate. -
    - -**Result:** Pass +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and set the --service-account-private-key-file parameter +to the private key file for service accounts. +--service-account-private-key-file= **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-controller-manager" | tail -n1 | grep "service-account-private-key-file" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'service-account-private-key-file' ``` -Verify that the `--service-account-private-key-file` argument is set as appropriate. +**Expected Result**: + +```console +'--service-account-private-key-file' is not present +``` + +### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) + + +**Result:** pass **Remediation:** -By default, K3s sets the `--service-account-private-key-file` argument with the service account key file. No manual remediation needed. - - -#### 1.3.5 -Ensure that the `--root-ca-file` argument is set as appropriate (Scored) -
    -Rationale -Processes running within pods that need to contact the API server must verify the API server's serving certificate. Failing to do so could be a subject to man-in-the-middle attacks. - -Providing the root certificate for the API server's serving certificate to the controller manager with the `--root-ca-file` argument allows the controller manager to inject the trusted bundle into pods so that they can verify TLS connections to the API server. -
    - -**Result:** Pass +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and set the --root-ca-file parameter to the certificate bundle file`. +--root-ca-file= **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-controller-manager" | tail -n1 | grep "root-ca-file" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'root-ca-file' ``` -Verify that the `--root-ca-file` argument exists and is set to a certificate bundle file containing the root certificate for the API server's serving certificate +**Expected Result**: -**Remediation:** -By default, K3s sets the `--root-ca-file` argument with the root ca file. No manual remediation needed. - - -#### 1.3.6 -Ensure that the `RotateKubeletServerCertificate` argument is set to `true` (Scored) -
    -Rationale -`RotateKubeletServerCertificate` causes the kubelet to both request a serving certificate after bootstrapping its client credentials and rotate the certificate as its existing credentials expire. This automated periodic rotation ensures that there are no downtimes due to expired certificates and thus addressing availability in the CIA security triad. - -Note: This recommendation only applies if you let kubelets get their certificates from the API server. In case your kubelet certificates come from an outside authority/tool (e.g. Vault) then you need to take care of rotation yourself. -
    - -**Result:** Not Applicable - -**Audit:** -Run the below command on the master node. - -```bash -journalctl -u k3s | grep "Running kube-controller-manager" | tail -n1 | grep "RotateKubeletServerCertificate" +```console +'--root-ca-file' is not present ``` -Verify that RotateKubeletServerCertificateargument exists and is set to true. +### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) -**Remediation:** -By default, K3s implements its own logic for certificate generation and rotation. - - -#### 1.3.7 -Ensure that the `--bind-address` argument is set to `127.0.0.1` (Scored) -
    -Rationale -The Controller Manager API service which runs on port 10252/TCP by default is used for health and metrics information and is available without authentication or encryption. As such it should only be bound to a localhost interface, to minimize the cluster's attack surface. -
    - -**Result:** Pass - -**Audit:** -Run the below command on the master node. - -```bash -journalctl -u k3s | grep "Running kube-controller-manager" | tail -n1 | grep "bind-address" -``` - -Verify that the `--bind-address` argument is set to 127.0.0.1. - -**Remediation:** -By default, K3s sets the `--bind-address` argument to `127.0.0.1`. No manual remediation needed. - - -### 1.4 Scheduler -This section contains recommendations relating to Scheduler configuration flags - - -#### 1.4.1 -Ensure that the `--profiling` argument is set to `false` (Scored) -
    -Rationale -Profiling allows for the identification of specific performance bottlenecks. It generates a significant amount of program data that could potentially be exploited to uncover system and program details. If you are not experiencing any bottlenecks and do not need the profiler for troubleshooting purposes, it is recommended to turn it off to reduce the potential attack surface. -
    - -**Result:** Pass - -**Audit:** -Run the below command on the master node. - -```bash -journalctl -u k3s | grep "Running kube-scheduler" | tail -n1 | grep "profiling" -``` - -Verify that the `--profiling` argument is set to false. - -**Remediation:** -By default, K3s sets the `--profiling` flag parameter to false. No manual remediation needed. - - -#### 1.4.2 -Ensure that the `--bind-address` argument is set to `127.0.0.1` (Scored) -
    -Rationale - -The Scheduler API service which runs on port 10251/TCP by default is used for health and metrics information and is available without authentication or encryption. As such it should only be bound to a localhost interface, to minimize the cluster's attack surface. -
    - -**Result:** Pass - -**Audit:** -Run the below command on the master node. - -```bash -journalctl -u k3s | grep "Running kube-scheduler" | tail -n1 | grep "bind-address" -``` - -Verify that the `--bind-address` argument is set to 127.0.0.1. - -**Remediation:** -By default, K3s sets the `--bind-address` argument to `127.0.0.1`. No manual remediation needed. - - -## 2 Etcd Node Configuration -This section covers recommendations for etcd configuration. - -#### 2.1 -Ensure that the `cert-file` and `key-file` fields are set as appropriate (Scored) -
    -Rationale -etcd is a highly-available key-value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should be encrypted in transit. -
    - -**Result:** Pass - -**Audit:** -Run the below command on the master node. - -```bash -grep -E 'cert-file|key-file' /var/lib/rancher/k3s/server/db/etcd/config -``` - -Verify that the `cert-file` and the `key-file` fields are set as appropriate. - -**Remediation:** -By default, K3s uses a config file for etcd that can be found at `/var/lib/rancher/k3s/server/db/etcd/config`. Server and peer cert and key files are specified. No manual remediation needed. - - -#### 2.2 -Ensure that the `client-cert-auth` field is set to `true` (Scored) -
    -Rationale -etcd is a highly-available key-value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should not be available to unauthenticated clients. You should enable the client authentication via valid certificates to secure the access to the etcd service. -
    - -**Result:** Pass - -**Audit:** -Run the below command on the master node. - -```bash -grep 'client-cert-auth' /var/lib/rancher/k3s/server/db/etcd/config -``` - -Verify that the `client-cert-auth` field is set to true. - -**Remediation:** -By default, K3s uses a config file for etcd that can be found at `/var/lib/rancher/k3s/server/db/etcd/config`. `client-cert-auth` is set to true. No manual remediation needed. - - -#### 2.3 -Ensure that the `auto-tls` field is not set to `true` (Scored) -
    -Rationale -etcd is a highly-available key-value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should not be available to unauthenticated clients. You should enable the client authentication via valid certificates to secure the access to the etcd service. -
    - -**Result:** Pass - -**Remediation:** -By default, K3s starts Etcd without this flag. It is set to `false` by default. - - -#### 2.4 -Ensure that the `peer-cert-file` and `peer-key-file` fields are set as appropriate (Scored) -
    -Rationale -etcd is a highly-available key-value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should be encrypted in transit and also amongst peers in the etcd clusters. -
    - -**Result:** Pass - -**Remediation:** -By default, K3s starts Etcd with a config file found here, `/var/lib/rancher/k3s/server/db/etcd/config`. The config file contains `peer-transport-security:` which has fields that have the peer cert and peer key files. - - -#### 2.5 -Ensure that the `client-cert-auth` field is set to `true` (Scored) -
    -Rationale -etcd is a highly-available key-value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should be accessible only by authenticated etcd peers in the etcd cluster. -
    - -**Result:** Pass - -**Audit:** -Run the below command on the master node. - -```bash -grep 'client-cert-auth' /var/lib/rancher/k3s/server/db/etcd/config -``` - -Verify that the `client-cert-auth` field in the peer section is set to true. - -**Remediation:** -By default, K3s uses a config file for etcd that can be found at `/var/lib/rancher/k3s/server/db/etcd/config`. Within the file, the `client-cert-auth` field is set. No manual remediation needed. - - -#### 2.6 -Ensure that the `peer-auto-tls` field is not set to `true` (Scored) -
    -Rationale -etcd is a highly-available key-value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should be accessible only by authenticated etcd peers in the etcd cluster. Hence, do not use self- signed certificates for authentication. -
    - -**Result:** Pass - -**Audit:** -Run the below command on the master node. - -```bash -grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config -``` - -Verify that if the `peer-auto-tls` field does not exist. - -**Remediation:** -By default, K3s uses a config file for etcd that can be found at `/var/lib/rancher/k3s/server/db/etcd/config`. Within the file, it does not contain the `peer-auto-tls` field. No manual remediation needed. - - -#### 2.7 -Ensure that a unique Certificate Authority is used for etcd (Not Scored) -
    -Rationale -etcd is a highly available key-value store used by Kubernetes deployments for persistent storage of all of its REST API objects. Its access should be restricted to specifically designated clients and peers only. - -Authentication to etcd is based on whether the certificate presented was issued by a trusted certificate authority. There is no checking of certificate attributes such as common name or subject alternative name. As such, if any attackers were able to gain access to any certificate issued by the trusted certificate authority, they would be able to gain full access to the etcd database. -
    - -**Result:** Pass - -**Audit:** -Run the below command on the master node. - -```bash -# To find the ca file used by etcd: -grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config -# To find the kube-apiserver process: -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 -``` - -Verify that the file referenced by the `client-ca-file` flag in the apiserver process is different from the file referenced by the `trusted-ca-file` parameter in the etcd configuration file. - -**Remediation:** -By default, K3s uses a config file for etcd that can be found at `/var/lib/rancher/k3s/server/db/etcd/config` and the `trusted-ca-file` parameters in it are set to unique values specific to etcd. No manual remediation needed. - - - -## 3 Control Plane Configuration - - -### 3.1 Authentication and Authorization - - -#### 3.1.1 -Client certificate authentication should not be used for users (Not Scored) -
    -Rationale -With any authentication mechanism the ability to revoke credentials if they are compromised or no longer required, is a key control. Kubernetes client certificate authentication does not allow for this due to a lack of support for certificate revocation. -
    - -**Result:** Not Scored - Operator Dependent - -**Audit:** -Review user access to the cluster and ensure that users are not making use of Kubernetes client certificate authentication. - -**Remediation:** -Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented in place of client certificates. - -### 3.2 Logging - - -#### 3.2.1 -Ensure that a minimal audit policy is created (Scored) -
    -Rationale -Logging is an important detective control for all systems, to detect potential unauthorized access. -
    - -**Result:** Does not pass. See the [Hardening Guide](../hardening_guide/) for details. - -**Audit:** -Run the below command on the master node. - -```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "audit-policy-file" -``` - -Verify that the `--audit-policy-file` is set. Review the contents of the file specified and ensure that it contains a valid audit policy. - -**Remediation:** -Create an audit policy file for your cluster and pass it to k3s. e.g. `--kube-apiserver-arg='audit-log-path=/var/lib/rancher/k3s/server/logs/audit-log'` - - -#### 3.2.2 -Ensure that the audit policy covers key security concerns (Not Scored) -
    -Rationale -Security audit logs should cover access and modification of key resources in the cluster, to enable them to form an effective part of a security environment. -
    - -**Result:** Not Scored - Operator Dependent - -**Remediation:** - - -## 4 Worker Node Security Configuration - - -### 4.1 Worker Node Configuration Files - - -#### 4.1.1 -Ensure that the kubelet service file permissions are set to `644` or more restrictive (Scored) -
    -Rationale -The `kubelet` service file controls various parameters that set the behavior of the kubelet service in the worker node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system. -
    **Result:** Not Applicable **Remediation:** -K3s doesn’t launch the kubelet as a service. It is launched and managed by the K3s supervisor process. All configuration is passed to it as command line arguments at run time. +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. +--feature-gates=RotateKubeletServerCertificate=true + +### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) -#### 4.1.2 -Ensure that the kubelet service file ownership is set to `root:root` (Scored) -
    -Rationale -The `kubelet` service file controls various parameters that set the behavior of the kubelet service in the worker node. You should set its file ownership to maintain the integrity of the file. The file should be owned by `root:root`. -
    +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'bind-address' +``` + +**Expected Result**: + +```console +'--bind-address' is present OR '--bind-address' is not present +``` + +## 1.4 Scheduler +### 1.4.1 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file +on the master node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1 +``` + +**Expected Result**: + +```console +'false' is equal to 'false' +``` + +**Returned Value**: + +```console +Feb 21 23:13:24 k3s[5223]: time="2022-02-21T23:13:24.851975832Z" level=info msg="Running kube-scheduler --address=127.0.0.1 --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --port=10251 --profiling=false --secure-port=0" +``` + +### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml +on the master node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1 | grep 'bind-address' +``` + +**Expected Result**: + +```console +'--bind-address' is present OR '--bind-address' is not present +``` + +## 2 Etcd Node Configuration Files +### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure TLS encryption. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml +on the master node and set the below parameters. +--cert-file=     +--key-file=     + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo "$(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth')";; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo "$(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth')";; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.1 +``` + +**Expected Result**: + +```console +'cert-file' is present AND 'key-file' is present +``` + +**Returned Value**: + +```console +cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key +``` + +### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master +node and set the below parameter. +--client-cert-auth="true" + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo "$(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth')";; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo "$(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth')";; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.2 +``` + +**Expected Result**: + +```console +'--client-cert-auth' is not present +``` + +**Returned Value**: + +```console +client-cert-auth: true +``` + +### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master +node and either remove the --auto-tls parameter or set it to false. + --auto-tls=false + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo "$(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth')";; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo "$(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth')";; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.3 +``` + +**Expected Result**: + +```console +'--auto-tls' is not present OR '--auto-tls' is not present +``` + +**Returned Value**: + +```console +false +``` + +### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure peer TLS encryption as appropriate +for your etcd cluster. +Then, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the +master node and set the below parameters. +--peer-client-file=     +--peer-key-file=     + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo "$(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth')";; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo "$(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth')";; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.4 +``` + +**Expected Result**: + +```console +'cert-file' is present AND 'key-file' is present +``` + +**Returned Value**: + +```console +cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key +``` + +### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master +node and set the below parameter. +--peer-client-cert-auth=true + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo "$(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth')";; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo "$(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth')";; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.5 +``` + +**Expected Result**: + +```console +'--client-cert-auth' is not present +``` + +**Returned Value**: + +```console +client-cert-auth: true +``` + +### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master +node and either remove the --peer-auto-tls parameter or set it to false. +--peer-auto-tls=false + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo "$(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth')";; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo "$(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth')";; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.6 +``` + +**Expected Result**: + +```console +'--peer-auto-tls' is not present OR '--peer-auto-tls' is present +``` + +**Returned Value**: + +```console +false +``` + +### 2.7 Ensure that a unique Certificate Authority is used for etcd (Manual) + + +**Result:** pass + +**Remediation:** +[Manual test] +Follow the etcd documentation and create a dedicated certificate authority setup for the +etcd service. +Then, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the +master node and set the below parameter. +--trusted-ca-file=     + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo "$(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth')";; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo "$(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth')";; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.7 +``` + +**Expected Result**: + +```console +'trusted-ca-file' is present +``` + +**Returned Value**: + +```console +trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt +``` + +## 3.1 Authentication and Authorization +### 3.1.1 Client certificate authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be +implemented in place of client certificates. + +## 3.2 Logging +### 3.2.1 Ensure that a minimal audit policy is created (Manual) + + +**Result:** warn + +**Remediation:** +Create an audit policy file for your cluster. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-policy-file' +``` + +### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) + + +**Result:** warn + +**Remediation:** +Consider modification of the audit policy in use on the cluster to include these items, at a +minimum. + +## 4.1 Worker Node Configuration Files +### 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated) + **Result:** Not Applicable **Remediation:** -K3s doesn’t launch the kubelet as a service. It is launched and managed by the K3s supervisor process. All configuration is passed to it as command line arguments at run time. +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 644 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) -#### 4.1.3 -Ensure that the proxy kubeconfig file permissions are set to `644` or more restrictive (Scored) -
    -Rationale -The `kube-proxy` kubeconfig file controls various parameters of the `kube-proxy` service in the worker node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system. - -It is possible to run `kube-proxy` with the kubeconfig parameters configured as a Kubernetes ConfigMap instead of a file. In this case, there is no proxy kubeconfig file. -
    **Result:** Not Applicable +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf + +### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Manual) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 644 /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig + **Audit:** -Run the below command on the worker node. ```bash stat -c %a /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig +``` + +**Expected Result**: + +```console +'permissions' is present OR '/var/lib/rancher/k3s/agent/kubeproxy.kubeconfig' is not present +``` + +**Returned Value**: + +```console 644 ``` -Verify that if a file is specified and it exists, the permissions are 644 or more restrictive. +### 4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root (Manual) + + +**Result:** pass **Remediation:** -K3s runs `kube-proxy` in process and does not use a config file. - - -#### 4.1.4 -Ensure that the proxy kubeconfig file ownership is set to `root:root` (Scored) -
    -Rationale -The kubeconfig file for `kube-proxy` controls various parameters for the `kube-proxy` service in the worker node. You should set its file ownership to maintain the integrity of the file. The file should be owned by `root:root`. -
    - -**Result:** Not Applicable +Run the below command (based on the file location on your system) on the each worker node. +For example, chown root:root /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig **Audit:** -Run the below command on the master node. ```bash stat -c %U:%G /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig +``` + +**Expected Result**: + +```console +'root:root' is not present OR '/var/lib/rancher/k3s/agent/kubeproxy.kubeconfig' is not present +``` + +**Returned Value**: + +```console root:root ``` -Verify that if a file is specified and it exists, the permissions are 644 or more restrictive. +### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated) + + +**Result:** pass **Remediation:** -K3s runs `kube-proxy` in process and does not use a config file. - - -#### 4.1.5 -Ensure that the kubelet.conf file permissions are set to `644` or more restrictive (Scored) -
    -Rationale -The `kubelet.conf` file is the kubeconfig file for the node, and controls various parameters that set the behavior and identity of the worker node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system. -
    - -**Result:** Pass +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 644 /var/lib/rancher/k3s/server/cred/admin.kubeconfig **Audit:** -Run the below command on the worker node. ```bash stat -c %a /var/lib/rancher/k3s/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'644' is equal to '644' +``` + +**Returned Value**: + +```console 644 ``` +### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Manual) + + +**Result:** warn + **Remediation:** -By default, K3s creates `kubelet.kubeconfig` with `644` permissions. No manual remediation needed. - -#### 4.1.6 -Ensure that the kubelet.conf file ownership is set to `root:root` (Scored) -
    -Rationale -The `kubelet.conf` file is the kubeconfig file for the node, and controls various parameters that set the behavior and identity of the worker node. You should set its file ownership to maintain the integrity of the file. The file should be owned by `root:root`. -
    - -**Result:** Not Applicable +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /var/lib/rancher/k3s/server/cred/admin.kubeconfig **Audit:** -Run the below command on the master node. ```bash stat -c %U:%G /var/lib/rancher/k3s/agent/kubelet.kubeconfig -root:root ``` +### 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Manual) + + +**Result:** pass + **Remediation:** -By default, K3s creates `kubelet.kubeconfig` with `root:root` ownership. No manual remediation needed. - - -#### 4.1.7 -Ensure that the certificate authorities file permissions are set to `644` or more restrictive (Scored) -
    -Rationale -The certificate authorities file controls the authorities used to validate API requests. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system. -
    - -**Result:** Pass +Run the following command to modify the file permissions of the +--client-ca-file chmod 644 **Audit:** -Run the below command on the master node. ```bash stat -c %a /var/lib/rancher/k3s/server/tls/server-ca.crt +``` + +**Expected Result**: + +```console +'644' is equal to '644' OR '640' is present OR '600' is present OR '444' is present OR '440' is present OR '400' is present OR '000' is present +``` + +**Returned Value**: + +```console 644 ``` -Verify that the permissions are 644. +### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Manual) + + +**Result:** warn **Remediation:** -By default, K3s creates `/var/lib/rancher/k3s/server/tls/server-ca.crt` with `644` permissions. - - -#### 4.1.8 -Ensure that the client certificate authorities file ownership is set to `root:root` (Scored) -
    -Rationale -The certificate authorities file controls the authorities used to validate API requests. You should set its file ownership to maintain the integrity of the file. The file should be owned by `root:root`. -
    - -**Result:** Pass +Run the following command to modify the ownership of the --client-ca-file. +chown root:root **Audit:** -Run the below command on the master node. ```bash stat -c %U:%G /var/lib/rancher/k3s/server/tls/client-ca.crt -root:root ``` -**Remediation:** -By default, K3s creates `/var/lib/rancher/k3s/server/tls/client-ca.crt` with `root:root` ownership. +### 4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated) -#### 4.1.9 -Ensure that the kubelet configuration file has permissions set to `644` or more restrictive (Scored) -
    -Rationale -The kubelet reads various parameters, including security settings, from a config file specified by the `--config` argument. If this file is specified you should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system. -
    - **Result:** Not Applicable **Remediation:** -K3s doesn’t require or maintain a configuration file for the kubelet process. All configuration is passed to it as command line arguments at run time. +Run the following command (using the config file location identified in the Audit step) +chmod 644 /var/lib/kubelet/config.yaml +### 4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root (Automated) -#### 4.1.10 -Ensure that the kubelet configuration file ownership is set to `root:root` (Scored) -
    -Rationale -The kubelet reads various parameters, including security settings, from a config file specified by the `--config` argument. If this file is specified you should restrict its file permissions to maintain the integrity of the file. The file should be owned by `root:root`. -
    **Result:** Not Applicable **Remediation:** -K3s doesn’t require or maintain a configuration file for the kubelet process. All configuration is passed to it as command line arguments at run time. +Run the following command (using the config file location identified in the Audit step) +chown root:root /var/lib/kubelet/config.yaml + +## 4.2 Kubelet +### 4.2.1 Ensure that the anonymous-auth argument is set to false (Automated) -### 4.2 Kubelet -This section contains recommendations for kubelet configuration. - - -#### 4.2.1 -Ensure that the `--anonymous-auth` argument is set to false (Scored) -
    -Rationale -When enabled, requests that are not rejected by other configured authentication methods are treated as anonymous requests. These requests are then served by the Kubelet server. You should rely on authentication to authorize access and disallow anonymous requests. -
    - -**Result:** Pass - -**Audit:** -Run the below command on the master node. - -```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "anonymous-auth" -``` - -Verify that the value for `--anonymous-auth` is false. +**Result:** pass **Remediation:** -By default, K3s starts kubelet with `--anonymous-auth` set to false. No manual remediation needed. - -#### 4.2.2 -Ensure that the `--authorization-mode` argument is not set to `AlwaysAllow` (Scored) -
    -Rationale -Kubelets, by default, allow all authenticated requests (even anonymous ones) without needing explicit authorization checks from the apiserver. You should restrict this behavior and only allow explicitly authorized requests. -
    - -**Result:** Pass +If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to +false. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--anonymous-auth=false +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'anonymous-auth' | grep -v grep ``` -Verify that `AlwaysAllow` is not present. +**Expected Result**: + +```console +'false' is equal to 'false' +``` + +**Returned Value**: + +```console +Feb 21 23:13:24 k3s[5223]: time="2022-02-21T23:13:24.847339487Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit-log --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,NamespaceLifecycle,ServiceAccount --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --insecure-port=0 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass **Remediation:** -K3s starts kubelet with `Webhook` as the value for the `--authorization-mode` argument. No manual remediation needed. - - -#### 4.2.3 -Ensure that the `--client-ca-file` argument is set as appropriate (Scored) -
    -Rationale -The connections from the apiserver to the kubelet are used for fetching logs for pods, attaching (through kubectl) to running pods, and using the kubelet’s port-forwarding functionality. These connections terminate at the kubelet’s HTTPS endpoint. By default, the apiserver does not verify the kubelet’s serving certificate, which makes the connection subject to man-in-the-middle attacks, and unsafe to run over untrusted and/or public networks. Enabling Kubelet certificate authentication ensures that the apiserver could authenticate the Kubelet before submitting any requests. -
    - -**Result:** Pass +If using a Kubelet config file, edit the file to set authorization: mode to Webhook. If +using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--authorization-mode=Webhook +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "client-ca-file" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' | grep -v grep ``` -Verify that the `--client-ca-file` argument has a ca file associated. +**Expected Result**: + +```console +'Node,RBAC' not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +Feb 21 23:13:24 k3s[5223]: time="2022-02-21T23:13:24.847339487Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit-log --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,NamespaceLifecycle,ServiceAccount --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --insecure-port=0 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass **Remediation:** -By default, K3s starts the kubelet process with the `--client-ca-file`. No manual remediation needed. - - -#### 4.2.4 -Ensure that the `--read-only-port` argument is set to `0` (Scored) -
    -Rationale -The Kubelet process provides a read-only API in addition to the main Kubelet API. Unauthenticated access is provided to this read-only API which could possibly retrieve potentially sensitive information about the cluster. -
    - -**Result:** Pass +If using a Kubelet config file, edit the file to set authentication: x509: clientCAFile to +the location of the client CA file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--client-ca-file= +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kubelet" | tail -n1 | grep "read-only-port" +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver'| tail -n1 | grep 'client-ca-file' | grep -v grep ``` -Verify that the `--read-only-port` argument is set to 0. + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +Feb 21 23:13:24 k3s[5223]: time="2022-02-21T23:13:24.847339487Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit-log --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,NamespaceLifecycle,ServiceAccount --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --insecure-port=0 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 4.2.4 Ensure that the --read-only-port argument is set to 0 (Manual) + + +**Result:** warn **Remediation:** -By default, K3s starts the kubelet process with the `--read-only-port` argument set to `0`. - - -#### 4.2.5 -Ensure that the `--streaming-connection-idle-timeout` argument is not set to `0` (Scored) -
    -Rationale -Setting idle timeouts ensures that you are protected against Denial-of-Service attacks, inactive connections and running out of ephemeral ports. - -**Note:** By default, `--streaming-connection-idle-timeout` is set to 4 hours which might be too high for your environment. Setting this as appropriate would additionally ensure that such streaming connections are timed out after serving legitimate use cases. -
    - -**Result:** Pass +If using a Kubelet config file, edit the file to set readOnlyPort to 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--read-only-port=0 +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kubelet" | tail -n1 | grep "streaming-connection-idle-timeout" +journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'read-only-port' ``` -Verify that there's nothing returned. +### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual) + + +**Result:** warn **Remediation:** -By default, K3s does not set `--streaming-connection-idle-timeout` when starting kubelet. - - -#### 4.2.6 -Ensure that the `--protect-kernel-defaults` argument is set to `true` (Scored) -
    -Rationale -Kernel parameters are usually tuned and hardened by the system administrators before putting the systems into production. These parameters protect the kernel and the system. Your kubelet kernel defaults that rely on such parameters should be appropriately set to match the desired secured system state. Ignoring this could potentially lead to running pods with undesired kernel behavior. -
    - -**Result:** Pass +If using a Kubelet config file, edit the file to set streamingConnectionIdleTimeout to a +value other than 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--streaming-connection-idle-timeout=5m +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kubelet" | tail -n1 | grep "protect-kernel-defaults" +journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'streaming-connection-idle-timeout' ``` +### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) + + +**Result:** pass + **Remediation:** -K3s server needs to be started with the following, `--protect-kernel-defaults=true`. - - -#### 4.2.7 -Ensure that the `--make-iptables-util-chains` argument is set to `true` (Scored) -
    -Rationale -Kubelets can automatically manage the required changes to iptables based on how you choose your networking options for the pods. It is recommended to let kubelets manage the changes to iptables. This ensures that the iptables configuration remains in sync with pods networking configuration. Manually configuring iptables with dynamic pod network configuration changes might hamper the communication between pods/containers and to the outside world. You might have iptables rules too restrictive or too open. -
    - -**Result:** Pass +If using a Kubelet config file, edit the file to set protectKernelDefaults: true. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--protect-kernel-defaults=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kubelet" | tail -n1 | grep "make-iptables-util-chains" +journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'protect-kernel-defaults' ``` -Verify there are no results returned. +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +Feb 21 23:13:32 k3s[5223]: time="2022-02-21T23:13:32.581127632Z" level=info msg="Running kubelet --address=0.0.0.0 --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=cgroupfs --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --cni-bin-dir=/var/lib/rancher/k3s/data/9de9bfcf367b723ef0ac73dd91761165a4a8ad11ad16a758d3a996264e60c612/bin --cni-conf-dir=/var/lib/rancher/k3s/agent/etc/cni/net.d --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --container-runtime=remote --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override= --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels= --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" +``` + +### 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated) + + +**Result:** pass **Remediation:** -K3s server needs to be run with the following, `--kube-apiserver-arg='make-iptables-util-chains=true'`. +If using a Kubelet config file, edit the file to set makeIPTablesUtilChains: true. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove the --make-iptables-util-chains argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'make-iptables-util-chains' +``` + +**Expected Result**: + +```console +'true' is equal to 'true' OR '--make-iptables-util-chains' is not present +``` + +**Returned Value**: + +```console +Feb 21 23:13:32 k3s[5223]: time="2022-02-21T23:13:32.581127632Z" level=info msg="Running kubelet --address=0.0.0.0 --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=cgroupfs --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --cni-bin-dir=/var/lib/rancher/k3s/data/9de9bfcf367b723ef0ac73dd91761165a4a8ad11ad16a758d3a996264e60c612/bin --cni-conf-dir=/var/lib/rancher/k3s/agent/etc/cni/net.d --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --container-runtime=remote --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override= --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels= --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" +``` + +### 4.2.8 Ensure that the --hostname-override argument is not set (Manual) -#### 4.2.8 -Ensure that the `--hostname-override` argument is not set (Not Scored) -
    -Rationale -Overriding hostnames could potentially break TLS setup between the kubelet and the apiserver. Additionally, with overridden hostnames, it becomes increasingly difficult to associate logs with a particular node and process them for security analytics. Hence, you should setup your kubelet nodes with resolvable FQDNs and avoid overriding the hostnames with IPs. -
    **Result:** Not Applicable **Remediation:** -K3s does set this parameter for each host, but K3s also manages all certificates in the cluster. It ensures the hostname-override is included as a subject alternative name (SAN) in the kubelet's certificate. +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and remove the --hostname-override argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +### 4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Manual) -#### 4.2.9 -Ensure that the `--event-qps` argument is set to 0 or a level which ensures appropriate event capture (Not Scored) -
    -Rationale -It is important to capture all events and not restrict event creation. Events are an important source of security information and analytics that ensure that your environment is consistently monitored using the event data. -
    - -**Result:** Not Scored - Operator Dependent +**Result:** warn **Remediation:** -See CIS Benchmark guide for further details on configuring this. - -#### 4.2.10 -Ensure that the `--tls-cert-file` and `--tls-private-key-file` arguments are set as appropriate (Scored) -
    -Rationale -Kubelet communication contains sensitive parameters that should remain encrypted in transit. Configure the Kubelets to serve only HTTPS traffic. -
    - -**Result:** Pass +If using a Kubelet config file, edit the file to set eventRecordQPS: to an appropriate level. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service **Audit:** -Run the below command on the master node. ```bash -journalctl -u k3s | grep "Running kubelet" | tail -n1 | grep -E 'tls-cert-file|tls-private-key-file' +/bin/ps -fC containerd ``` -Verify the `--tls-cert-file` and `--tls-private-key-file` arguments are present and set appropriately. +### 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual) + + +**Result:** warn **Remediation:** -By default, K3s sets the `--tls-cert-file` and `--tls-private-key-file` arguments when executing the kubelet process. +If using a Kubelet config file, edit the file to set tlsCertFile to the location +of the certificate file to use to identify this Kubelet, and tlsPrivateKeyFile +to the location of the corresponding private key file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameters in KUBELET_CERTIFICATE_ARGS variable. +--tls-cert-file= +--tls-private-key-file= +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service +**Audit:** -#### 4.2.11 -Ensure that the `--rotate-certificates` argument is not set to `false` (Scored) -
    -Rationale +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 +``` -The `--rotate-certificates` setting causes the kubelet to rotate its client certificates by creating new CSRs as its existing credentials expire. This automated periodic rotation ensures that there is no downtime due to expired certificates and thus addressing availability in the CIA security triad. +### 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Manual) -**Note:** This recommendation only applies if you let kubelets get their certificates from the API server. In case your kubelet certificates come from an outside authority/tool (e.g. Vault) then you need to take care of rotation yourself. - -**Note:**This feature also requires the `RotateKubeletClientCertificate` feature gate to be enabled (which is the default since Kubernetes v1.7) -
    **Result:** Not Applicable **Remediation:** -By default, K3s implements its own logic for certificate generation and rotation. +If using a Kubelet config file, edit the file to add the line rotateCertificates: true or +remove it altogether to use the default value. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS +variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service +### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Manual) -#### 4.2.12 -Ensure that the `RotateKubeletServerCertificate` argument is set to `true` (Scored) -
    -Rationale -`RotateKubeletServerCertificate` causes the kubelet to both request a serving certificate after bootstrapping its client credentials and rotate the certificate as its existing credentials expire. This automated periodic rotation ensures that there are no downtimes due to expired certificates and thus addressing availability in the CIA security triad. - -Note: This recommendation only applies if you let kubelets get their certificates from the API server. In case your kubelet certificates come from an outside authority/tool (e.g. Vault) then you need to take care of rotation yourself. -
    **Result:** Not Applicable **Remediation:** -By default, K3s implements its own logic for certificate generation and rotation. +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. +--feature-gates=RotateKubeletServerCertificate=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +### 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual) -#### 4.2.13 -Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Not Scored) -
    -Rationale -TLS ciphers have had a number of known vulnerabilities and weaknesses, which can reduce the protection provided by them. By default Kubernetes supports a number of TLS ciphersuites including some that have security concerns, weakening the protection provided. -
    - -**Result:** Not Scored - Operator Dependent +**Result:** warn **Remediation:** -Configuration of the parameter is dependent on your use case. Please see the CIS Kubernetes Benchmark for suggestions on configuring this for your use-case. - - -## 5 Kubernetes Policies - - -### 5.1 RBAC and Service Accounts - - -#### 5.1.1 -Ensure that the cluster-admin role is only used where required (Not Scored) -
    -Rationale -Kubernetes provides a set of default roles where RBAC is used. Some of these roles such as `cluster-admin` provide wide-ranging privileges which should only be applied where absolutely necessary. Roles such as `cluster-admin` allow super-user access to perform any action on any resource. When used in a `ClusterRoleBinding`, it gives full control over every resource in the cluster and in all namespaces. When used in a `RoleBinding`, it gives full control over every resource in the rolebinding's namespace, including the namespace itself. -
    - -**Result:** Pass - -**Remediation:** -K3s does not make inappropriate use of the cluster-admin role. Operators must audit their workloads of additional usage. See the CIS Benchmark guide for more details. - -#### 5.1.2 -Minimize access to secrets (Not Scored) -
    -Rationale -Inappropriate access to secrets stored within the Kubernetes cluster can allow for an attacker to gain additional access to the Kubernetes cluster or external resources whose credentials are stored as secrets. -
    - -**Result:** Not Scored - Operator Dependent - -**Remediation:** -K3s limits its use of secrets for the system components appropriately, but operators must audit the use of secrets by their workloads. See the CIS Benchmark guide for more details. - -#### 5.1.3 -Minimize wildcard use in Roles and ClusterRoles (Not Scored) -
    -Rationale -The principle of least privilege recommends that users are provided only the access required for their role and nothing more. The use of wildcard rights grants is likely to provide excessive rights to the Kubernetes API. -
    - -**Result:** Not Scored - Operator Dependent +If using a Kubelet config file, edit the file to set TLSCipherSuites: to +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +or to a subset of these values. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the --tls-cipher-suites parameter as follows, or to a subset of these values. +--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service **Audit:** -Run the below command on the master node. ```bash -# Retrieve the roles defined across each namespaces in the cluster and review for wildcards -kubectl get roles --all-namespaces -o yaml - -# Retrieve the cluster roles defined in the cluster and review for wildcards -kubectl get clusterroles -o yaml +/bin/ps -fC containerd ``` -Verify that there are not wildcards in use. +## 5.1 RBAC and Service Accounts +### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) + + +**Result:** warn **Remediation:** -Operators should review their workloads for proper role usage. See the CIS Benchmark guide for more details. +Identify all clusterrolebindings to the cluster-admin role. Check if they are used and +if they need this role or if they could use a role with fewer privileges. +Where possible, first bind users to a lower privileged role and then remove the +clusterrolebinding to the cluster-admin role : +kubectl delete clusterrolebinding [name] -#### 5.1.4 -Minimize access to create pods (Not Scored) -
    -Rationale -The ability to create pods in a cluster opens up possibilities for privilege escalation and should be restricted, where possible. -
    +### 5.1.2 Minimize access to secrets (Manual) -**Result:** Not Scored - Operator Dependent + +**Result:** warn **Remediation:** -Operators should review who has access to create pods in their cluster. See the CIS Benchmark guide for more details. +Where possible, remove get, list and watch access to secret objects in the cluster. -#### 5.1.5 -Ensure that default service accounts are not actively used. (Scored) -
    -Rationale -Kubernetes provides a default service account which is used by cluster workloads where no specific service account is assigned to the pod. +### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) -Where access to the Kubernetes API from a pod is required, a specific service account should be created for that pod, and rights granted to that service account. -The default service account should be configured such that it does not provide a service account token and does not have any explicit rights assignments. -
    +**Result:** warn -**Result:** Fail. Currently requires operator intervention See the [Hardening Guide]({{}}/k3s/latest/en/security/hardening_guide) for details. +**Remediation:** +Where possible replace any use of wildcards in clusterroles and roles with specific +objects or actions. -**Audit:** -For each namespace in the cluster, review the rights assigned to the default service account and ensure that it has no roles or cluster roles bound to it apart from the defaults. Additionally ensure that the automountServiceAccountToken: false setting is in place for each default service account. +### 5.1.4 Minimize access to create pods (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove create access to pod objects in the cluster. + +### 5.1.5 Ensure that default service accounts are not actively used. (Manual) + + +**Result:** warn **Remediation:** Create explicit service accounts wherever a Kubernetes workload requires specific access to the Kubernetes API server. Modify the configuration of each default service account to include this value - -``` bash automountServiceAccountToken: false -``` + +### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) -#### 5.1.6 -Ensure that Service Account Tokens are only mounted where necessary (Not Scored) -
    -Rationale -Mounting service account tokens inside pods can provide an avenue for privilege escalation attacks where an attacker is able to compromise a single pod in the cluster. - -Avoiding mounting these tokens removes this attack avenue. -
    - -**Result:** Not Scored - Operator Dependent +**Result:** warn **Remediation:** -The pods launched by K3s are part of the control plane and generally need access to communicate with the API server, thus this control does not apply to them. Operators should review their workloads and take steps to modify the definition of pods and service accounts which do not need to mount service account tokens to disable it. +Modify the definition of pods and service accounts which do not need to mount service +account tokens to disable it. -### 5.2 Pod Security Policies +## 5.2 Pod Security Policies +### 5.2.1 Minimize the admission of privileged containers (Manual) -#### 5.2.1 -Minimize the admission of containers wishing to share the host process ID namespace (Scored) -
    -Rationale -Privileged containers have access to all Linux Kernel capabilities and devices. A container running with full privileges can do almost everything that the host can do. This flag exists to allow special use-cases, like manipulating the network stack and accessing devices. +**Result:** warn -There should be at least one PodSecurityPolicy (PSP) defined which does not permit privileged containers. - -If you need to run privileged containers, this should be defined in a separate PSP and you should carefully check RBAC controls to ensure that only limited service accounts and users are given permission to access that PSP. -
    - -**Result:** Pass +**Remediation:** +Create a PSP as described in the Kubernetes documentation, ensuring that +the .spec.privileged field is omitted or set to false. **Audit:** -Run the below command on the master node. ```bash -kubectl describe psp | grep MustRunAsNonRoot +kubectl describe psp global-restricted-psp | grep MustRunAsNonRoot ``` -Verify that the result is `Rule: MustRunAsNonRoot`. +### 5.2.2 Minimize the admission of containers wishing to share the host process ID namespace (Manual) + + +**Result:** pass **Remediation:** -An operator should apply a PodSecurityPolicy that sets the `Rule` value to `MustRunAsNonRoot`. An example of this can be found in the [Hardening Guide](../hardening_guide/). - - -#### 5.2.2 -Minimize the admission of containers wishing to share the host process ID namespace (Scored) -
    -Rationale -A container running in the host's PID namespace can inspect processes running outside the container. If the container also has access to ptrace capabilities this can be used to escalate privileges outside of the container. - -There should be at least one PodSecurityPolicy (PSP) defined which does not permit containers to share the host PID namespace. - -If you need to run containers which require hostPID, this should be defined in a separate PSP and you should carefully check RBAC controls to ensure that only limited service accounts and users are given permission to access that PSP. -
    - -**Result:** Pass +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.hostPID field is omitted or set to false. **Audit:** -Run the below command on the master node. ```bash kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or (.spec.hostPID == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' ``` -Verify that the returned count is 1. +**Expected Result**: + +```console +1 is greater than 0 +``` + +**Returned Value**: + +```console +--count=1 +``` + +### 5.2.3 Minimize the admission of containers wishing to share the host IPC namespace (Manual) + + +**Result:** pass **Remediation:** -An operator should apply a PodSecurityPolicy that sets the `hostPID` value to false explicitly for the PSP it creates. An example of this can be found in the [Hardening Guide](../hardening_guide/). - - -#### 5.2.3 -Minimize the admission of containers wishing to share the host IPC namespace (Scored) -
    -Rationale - -A container running in the host's IPC namespace can use IPC to interact with processes outside the container. - -There should be at least one PodSecurityPolicy (PSP) defined which does not permit containers to share the host IPC namespace. - -If you have a requirement to containers which require hostIPC, this should be defined in a separate PSP and you should carefully check RBAC controls to ensure that only limited service accounts and users are given permission to access that PSP. -
    - -**Result:** Pass +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.hostIPC field is omitted or set to false. **Audit:** -Run the below command on the master node. ```bash kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostIPC == null) or (.spec.hostIPC == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' ``` -Verify that the returned count is 1. +**Expected Result**: + +```console +1 is greater than 0 +``` + +**Returned Value**: + +```console +--count=1 +``` + +### 5.2.4 Minimize the admission of containers wishing to share the host network namespace (Manual) + + +**Result:** pass **Remediation:** -An operator should apply a PodSecurityPolicy that sets the `HostIPC` value to false explicitly for the PSP it creates. An example of this can be found in the [Hardening Guide](../hardening_guide/). - - -#### 5.2.4 -Minimize the admission of containers wishing to share the host network namespace (Scored) -
    -Rationale -A container running in the host's network namespace could access the local loopback device, and could access network traffic to and from other pods. - -There should be at least one PodSecurityPolicy (PSP) defined which does not permit containers to share the host network namespace. - -If you have need to run containers which require hostNetwork, this should be defined in a separate PSP and you should carefully check RBAC controls to ensure that only limited service accounts and users are given permission to access that PSP. -
    - -**Result:** Pass +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.hostNetwork field is omitted or set to false. **Audit:** -Run the below command on the master node. ```bash kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostNetwork == null) or (.spec.hostNetwork == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' ``` -Verify that the returned count is 1. +**Expected Result**: + +```console +1 is greater than 0 +``` + +**Returned Value**: + +```console +--count=1 +``` + +### 5.2.5 Minimize the admission of containers with allowPrivilegeEscalation (Manual) + + +**Result:** pass **Remediation:** -An operator should apply a PodSecurityPolicy that sets the `HostNetwork` value to false explicitly for the PSP it creates. An example of this can be found in the [Hardening Guide](../hardening_guide/). - - -#### 5.2.5 -Minimize the admission of containers with `allowPrivilegeEscalation` (Scored) -
    -Rationale -A container running with the `allowPrivilegeEscalation` flag set to true may have processes that can gain more privileges than their parent. - -There should be at least one PodSecurityPolicy (PSP) defined which does not permit containers to allow privilege escalation. The option exists (and is defaulted to true) to permit setuid binaries to run. - -If you have need to run containers which use setuid binaries or require privilege escalation, this should be defined in a separate PSP and you should carefully check RBAC controls to ensure that only limited service accounts and users are given permission to access that PSP. -
    - -**Result:** Pass +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.allowPrivilegeEscalation field is omitted or set to false. **Audit:** -Run the below command on the master node. ```bash kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' ``` -Verify that the returned count is 1. +**Expected Result**: + +```console +1 is greater than 0 +``` + +**Returned Value**: + +```console +--count=1 +``` + +### 5.2.6 Minimize the admission of root containers (Manual) + + +**Result:** pass **Remediation:** -An operator should apply a PodSecurityPolicy that sets the `allowPrivilegeEscalation` value to false explicitly for the PSP it creates. An example of this can be found in the [Hardening Guide](../hardening_guide/). - - -#### 5.2.6 -Minimize the admission of root containers (Not Scored) -
    -Rationale -Containers may run as any Linux user. Containers which run as the root user, whilst constrained by Container Runtime security features still have an escalated likelihood of container breakout. - -Ideally, all containers should run as a defined non-UID 0 user. - -There should be at least one PodSecurityPolicy (PSP) defined which does not permit root users in a container. - -If you need to run root containers, this should be defined in a separate PSP and you should carefully check RBAC controls to ensure that only limited service accounts and users are given permission to access that PSP. -
    - -**Result:** Not Scored +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.runAsUser.rule is set to either MustRunAsNonRoot or MustRunAs with the range of +UIDs not including 0. **Audit:** -Run the below command on the master node. ```bash kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' ``` -Verify that the returned count is 1. +**Expected Result**: -**Remediation:** -An operator should apply a PodSecurityPolicy that sets the `runAsUser.Rule` value to `MustRunAsNonRoot`. An example of this can be found in the [Hardening Guide](../hardening_guide/). - - -#### 5.2.7 -Minimize the admission of containers with the NET_RAW capability (Not Scored) -
    -Rationale -Containers run with a default set of capabilities as assigned by the Container Runtime. By default this can include potentially dangerous capabilities. With Docker as the container runtime the NET_RAW capability is enabled which may be misused by malicious containers. - -Ideally, all containers should drop this capability. - -There should be at least one PodSecurityPolicy (PSP) defined which prevents containers with the NET_RAW capability from launching. - -If you need to run containers with this capability, this should be defined in a separate PSP and you should carefully check RBAC controls to ensure that only limited service accounts and users are given permission to access that PSP. -
    - -**Result:** Not Scored - -**Audit:** -Run the below command on the master node. - -```bash -kubectl get psp -o json | jq .spec.requiredDropCapabilities[] +```console +1 is greater than 0 ``` -Verify the value is `"ALL"`. +**Returned Value**: + +```console +--count=1 +``` + +### 5.2.7 Minimize the admission of containers with the NET_RAW capability (Manual) + + +**Result:** warn **Remediation:** -An operator should apply a PodSecurityPolicy that sets `.spec.requiredDropCapabilities[]` to a value of `All`. An example of this can be found in the [Hardening Guide](../hardening_guide/). - - -#### 5.2.8 -Minimize the admission of containers with added capabilities (Not Scored) -
    -Rationale -Containers run with a default set of capabilities as assigned by the Container Runtime. Capabilities outside this set can be added to containers which could expose them to risks of container breakout attacks. - -There should be at least one PodSecurityPolicy (PSP) defined which prevents containers with capabilities beyond the default set from launching. - -If you need to run containers with additional capabilities, this should be defined in a separate PSP and you should carefully check RBAC controls to ensure that only limited service accounts and users are given permission to access that PSP. -
    - -**Result:** Not Scored +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.requiredDropCapabilities is set to include either NET_RAW or ALL. **Audit:** -Run the below command on the master node. ```bash kubectl get psp ``` -Verify that there are no PSPs present which have `allowedCapabilities` set to anything other than an empty array. +### 5.2.8 Minimize the admission of containers with added capabilities (Manual) + + +**Result:** warn **Remediation:** -An operator should apply a PodSecurityPolicy that sets `allowedCapabilities` to anything other than an empty array. An example of this can be found in the [Hardening Guide](../hardening_guide/). +Ensure that allowedCapabilities is not present in PSPs for the cluster unless +it is set to an empty array. + +### 5.2.9 Minimize the admission of containers with capabilities assigned (Manual) -#### 5.2.9 -Minimize the admission of containers with capabilities assigned (Not Scored) -
    -Rationale -Containers run with a default set of capabilities as assigned by the Container Runtime. Capabilities are parts of the rights generally granted on a Linux system to the root user. +**Result:** warn -In many cases applications running in containers do not require any capabilities to operate, so from the perspective of the principle of least privilege use of capabilities should be minimized. -
    +**Remediation:** +Review the use of capabilites in applications runnning on your cluster. Where a namespace +contains applicaions which do not require any Linux capabities to operate consider adding +a PSP which forbids the admission of containers which do not drop all capabilities. -**Result:** Not Scored +## 5.3 Network Policies and CNI +### 5.3.1 Ensure that the CNI in use supports Network Policies (Manual) -**Audit:** -Run the below command on the master node. + +**Result:** warn + +**Remediation:** +If the CNI plugin in use does not support network policies, consideration should be given to +making use of a different plugin, or finding an alternate mechanism for restricting traffic +in the Kubernetes cluster. + +### 5.3.2 Ensure that all Namespaces have Network Policies defined (Manual) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create NetworkPolicy objects as you need them. + +**Audit Script:** `check_for_rke2_network_policies.sh` ```bash -kubectl get psp -``` +#!/bin/bash -**Remediation:** -An operator should apply a PodSecurityPolicy that sets `requiredDropCapabilities` to `ALL`. An example of this can be found in the [Hardening Guide](../hardening_guide/). +set -eE +handle_error() { + echo "false" +} -### 5.3 Network Policies and CNI +trap 'handle_error' ERR - -#### 5.3.1 -Ensure that the CNI in use supports Network Policies (Not Scored) -
    -Rationale -Kubernetes network policies are enforced by the CNI plugin in use. As such it is important to ensure that the CNI plugin supports both Ingress and Egress network policies. -
    - -**Result:** Pass - -**Audit:** -Review the documentation of CNI plugin in use by the cluster, and confirm that it supports Ingress and Egress network policies. - -**Remediation:** -By default, K3s use Canal (Calico and Flannel) and fully supports network policies. - - -#### 5.3.2 -Ensure that all Namespaces have Network Policies defined (Scored) -
    -Rationale -Running different applications on the same Kubernetes cluster creates a risk of one compromised application attacking a neighboring application. Network segmentation is important to ensure that containers can communicate only with those they are supposed to. A network policy is a specification of how selections of pods are allowed to communicate with each other and other network endpoints. - -Network Policies are namespace scoped. When a network policy is introduced to a given namespace, all traffic not allowed by the policy is denied. However, if there are no network policies in a namespace all traffic will be allowed into and out of the pods in that namespace. -
    - -**Result:** Pass - -**Audit:** -Run the below command on the master node. - -```bash -for i in kube-system kube-public default; do - kubectl get networkpolicies -n $i; +for namespace in kube-system kube-public default; do + policy_count=$(/var/lib/rancher/rke2/bin/kubectl get networkpolicy -n ${namespace} -o json | jq -r '.items | length') + if [ ${policy_count} -eq 0 ]; then + echo "false" + exit + fi done + +echo "true" + ``` -Verify that there are network policies applied to each of the namespaces. - -**Remediation:** -An operator should apply NetworkPolcyies that prevent unneeded traffic from traversing networks unnecessarily. An example of applying a NetworkPolcy can be found in the [Hardening Guide](../hardening_guide/). - -### 5.4 Secrets Management - - -#### 5.4.1 -Prefer using secrets as files over secrets as environment variables (Not Scored) -
    -Rationale -It is reasonably common for application code to log out its environment (particularly in the event of an error). This will include any secret values passed in as environment variables, so secrets can easily be exposed to any user or entity who has access to the logs. -
    - -**Result:** Not Scored - -**Audit:** -Run the following command to find references to objects which use environment variables defined from secrets. +**Audit Execution:** ```bash -kubectl get all -o jsonpath='{range .items[?(@..secretKeyRef)]} {.kind} {.metadata.name} {"\n"}{end}' -A +./check_for_rke2_network_policies.sh ``` -**Remediation:** -If possible, rewrite application code to read secrets from mounted secret files, rather than from environment variables. +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +## 5.4 Secrets Management +### 5.4.1 Prefer using secrets as files over secrets as environment variables (Manual) -#### 5.4.2 -Consider external secret storage (Not Scored) -
    -Rationale -Kubernetes supports secrets as first-class objects, but care needs to be taken to ensure that access to secrets is carefully limited. Using an external secrets provider can ease the management of access to secrets, especially where secrets are used across both Kubernetes and non-Kubernetes environments. -
    - -**Result:** Not Scored - -**Audit:** -Review your secrets management implementation. +**Result:** warn **Remediation:** -Refer to the secrets management options offered by your cloud provider or a third-party secrets management solution. - - -### 5.5 Extensible Admission Control - - -#### 5.5.1 -Configure Image Provenance using ImagePolicyWebhook admission controller (Not Scored) -
    -Rationale -Kubernetes supports plugging in provenance rules to accept or reject the images in your deployments. You could configure such rules to ensure that only approved images are deployed in the cluster. -
    - -**Result:** Not Scored +if possible, rewrite application code to read secrets from mounted secret files, rather than +from environment variables. **Audit:** -Review the pod definitions in your cluster and verify that image _provenance_ is configured as appropriate. + +```bash +kubectl get all -o jsonpath='{range .items[?(@..secretKeyRef)]} {.kind} {.metadata.name} {' '}{end}' -A +``` + +### 5.4.2 Consider external secret storage (Manual) + + +**Result:** warn + +**Remediation:** +Refer to the secrets management options offered by your cloud provider or a third-party +secrets management solution. + +## 5.5 Extensible Admission Control +### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) + + +**Result:** warn **Remediation:** Follow the Kubernetes documentation and setup image provenance. - -### 5.6 Omitted -The v1.5.1 Benchmark skips 5.6 and goes from 5.5 to 5.7. We are including it here merely for explanation. +## 5.7 General Policies +### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) -### 5.7 General Policies -These policies relate to general cluster management topics, like namespace best practices and policies applied to pod objects in the cluster. +**Result:** warn + +**Remediation:** +Follow the documentation and create namespaces for objects in your deployment as you need +them. + +### 5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions (Manual) -#### 5.7.1 -Create administrative boundaries between resources using namespaces (Not Scored) -
    -Rationale -Limiting the scope of user permissions can reduce the impact of mistakes or malicious activities. A Kubernetes namespace allows you to partition created resources into logically named groups. Resources created in one namespace can be hidden from other namespaces. By default, each resource created by a user in Kubernetes cluster runs in a default namespace, called default. You can create additional namespaces and attach resources and users to them. You can use Kubernetes Authorization plugins to create policies that segregate access to namespace resources between different users. -
    +**Result:** warn -**Result:** Not Scored +**Remediation:** +Seccomp is an alpha feature currently. By default, all alpha features are disabled. So, you +would need to enable alpha features in the apiserver by passing "--feature- +gates=AllAlpha=true" argument. +Edit the /etc/kubernetes/apiserver file on the master node and set the KUBE_API_ARGS +parameter to "--feature-gates=AllAlpha=true" +KUBE_API_ARGS="--feature-gates=AllAlpha=true" +Based on your system, restart the kube-apiserver service. For example: +systemctl restart kube-apiserver.service +Use annotations to enable the docker/default seccomp profile in your pod definitions. An +example is as below: +apiVersion: v1 +kind: Pod +metadata: + name: trustworthy-pod + annotations: + seccomp.security.alpha.kubernetes.io/pod: docker/default +spec: + containers: + - name: trustworthy-container + image: sotrustworthy:latest + +### 5.7.3 Apply Security Context to Your Pods and Containers (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and apply security contexts to your pods. For a +suggested list of security contexts, you may refer to the CIS Security Benchmark for Docker +Containers. + +### 5.7.4 The default namespace should not be used (Manual) + + +**Result:** pass + +**Remediation:** +Ensure that namespaces are created to allow for appropriate segregation of Kubernetes +resources and that all new resources are created in a specific namespace. **Audit:** -Run the below command and review the namespaces created in the cluster. ```bash -kubectl get namespaces +kubectl get all --no-headers -n default | grep -v service | wc -l | xargs -I {} echo '--count={}' ``` -Ensure that these namespaces are the ones you need and are adequately administered as per your requirements. +**Expected Result**: -**Remediation:** -Follow the documentation and create namespaces for objects in your deployment as you need them. - - -#### 5.7.2 -Ensure that the seccomp profile is set to `docker/default` in your pod definitions (Not Scored) -
    -Rationale -Seccomp (secure computing mode) is used to restrict the set of system calls applications can make, allowing cluster administrators greater control over the security of workloads running in the cluster. Kubernetes disables seccomp profiles by default for historical reasons. You should enable it to ensure that the workloads have restricted actions available within the container. -
    - -**Result:** Not Scored - -**Audit:** -Review the pod definitions in your cluster. It should create a line as below: - -```yaml -annotations: - seccomp.security.alpha.kubernetes.io/pod: docker/default +```console +'0' is equal to '0' ``` -**Remediation:** -Review the Kubernetes documentation and if needed, apply a relevant PodSecurityPolicy. +**Returned Value**: -#### 5.7.3 -Apply Security Context to Your Pods and Containers (Not Scored) -
    -Rationale -A security context defines the operating system security settings (uid, gid, capabilities, SELinux role, etc..) applied to a container. When designing your containers and pods, make sure that you configure the security context for your pods, containers, and volumes. A security context is a property defined in the deployment yaml. It controls the security parameters that will be assigned to the pod/container/volume. There are two levels of security context: pod level security context, and container-level security context. -
    - -**Result:** Not Scored - -**Audit:** -Review the pod definitions in your cluster and verify that you have security contexts defined as appropriate. - -**Remediation:** -Follow the Kubernetes documentation and apply security contexts to your pods. For a suggested list of security contexts, you may refer to the CIS Security Benchmark. - - -#### 5.7.4 -The default namespace should not be used (Scored) -
    -Rationale -Resources in a Kubernetes cluster should be segregated by namespace, to allow for security controls to be applied at that level and to make it easier to manage resources. -
    - -**Result:** Pass - -**Audit:** -Run the below command on the master node. - -```bash -kubectl get all -n default +```console +--count=0 ``` - -The only entries there should be system-managed resources such as the kubernetes service. - -**Remediation:** -By default, K3s does not utilize the default namespace. diff --git a/scripts/converters/headers/header-2.6.md b/scripts/converters/headers/header-2.6.md new file mode 100755 index 00000000000..f3d6b8a1333 --- /dev/null +++ b/scripts/converters/headers/header-2.6.md @@ -0,0 +1,36 @@ +--- +title: CIS v1.6 Benchmark - Self-Assessment Guide - Rancher v2.6 +weight: 101 +--- + +### CIS v1.6 Kubernetes Benchmark - Rancher v2.6 with Kubernetes v1.18 to v1.21 + +[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf). + +#### Overview + +This document is a companion to the Rancher v2.6 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark. + +This guide corresponds to specific versions of the hardening guide, Rancher, CIS Benchmark and Kubernetes: + +| Hardening Guide Version | Rancher Version | CIS Benchmark Version | Kubernetes Version | +| ----------------------- | --------------- | --------------------- | ------------------- | +| Hardening Guide CIS v1.6 Benchmark | Rancher v2.6.3 | CIS v1.6 | Kubernetes v1.18, v1.19, v1.20 and v1.21 | + +Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark do not apply and will have a result of \`Not Applicable\`. This guide will walk through the various controls and provide updated example commands to audit compliance in Rancher created clusters. + +This document is to be used by Rancher operators, security teams, auditors and decision makers. + +For more detail about each audit, including rationales and remediations for failing tests, you can refer to the corresponding section of the CIS Kubernetes Benchmark v1.6. You can download the benchmark, after creating a free account, in [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). + +#### Testing controls methodology + +Rancher and RKE install Kubernetes services via Docker containers. Configuration is defined by arguments passed to the container at the time of initialization, not via configuration files. + +Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher are provided for testing. When performing the tests, you will need access to the Docker command line on the hosts of all three RKE roles. The commands also make use of the [kubectl](https://kubernetes.io/docs/tasks/tools/) (with a valid configuration file) and [jq](https://stedolan.github.io/jq/) tools, which are required in the testing and evaluation of test results. + +> NOTE: Only `automated` tests (previously called `scored`) are covered in this guide. + +### Controls + +--- diff --git a/scripts/converters/headers/header-k3s.md b/scripts/converters/headers/header-k3s.md new file mode 100755 index 00000000000..9bb285229c0 --- /dev/null +++ b/scripts/converters/headers/header-k3s.md @@ -0,0 +1,35 @@ +--- +title: CIS Self Assessment Guide +weight: 90 +--- + +### CIS Kubernetes Benchmark v1.6 - K3s with Kubernetes v1.17 to v1.21 + +#### Overview + +This document is a companion to the K3s security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of K3s, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the CIS Kubernetes Benchmark. It is to be used by K3s operators, security teams, auditors, and decision-makers. + +This guide is specific to the **v1.17**, **v1.18**, **v1.19**, **v1.20** and **v1.21** release line of K3s and the **v1.6** release of the CIS Kubernetes Benchmark. + +For more information about each control, including detailed descriptions and remediations for failing tests, you can refer to the corresponding section of the CIS Kubernetes Benchmark v1.6. You can download the benchmark, after creating a free account, in [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). + +#### Testing controls methodology + +Each control in the CIS Kubernetes Benchmark was evaluated against a K3s cluster that was configured according to the accompanying hardening guide. + +Where control audits differ from the original CIS benchmark, the audit commands specific to K3s are provided for testing. + +These are the possible results for each control: + +- **Pass** - The K3s cluster under test passed the audit outlined in the benchmark. +- **Not Applicable** - The control is not applicable to K3s because of how it is designed to operate. The remediation section will explain why this is so. +- **Warn** - The control is manual in the CIS benchmark and it depends on the cluster's use case or some other factor that must be determined by the cluster operator. These controls have been evaluated to ensure K3s does not prevent their implementation, but no further configuration or auditing of the cluster under test has been performed. + +This guide makes the assumption that K3s is running as a Systemd unit. Your installation may vary and will require you to adjust the "audit" commands to fit your scenario. + +> NOTE: Only `automated` tests (previously called `scored`) are covered in this guide. + +### Controls + +--- + diff --git a/scripts/converters/run_results_to_md.sh b/scripts/converters/run_results_to_md.sh index acca856e0b1..ae3ac700b9d 100755 --- a/scripts/converters/run_results_to_md.sh +++ b/scripts/converters/run_results_to_md.sh @@ -2,8 +2,9 @@ results=${1:?path to kube-bench json results is a required argument} test_helpers=${2:?path to kube-bench test_helpers scripts is a required argument} +header=${3:?path to header file is a required argument} [ -f ${results} ] || (echo "file:'${results}' does not exist"; exit 1) [ -d ${test_helpers} ] || (echo "dir: '${test_helpers}' not a valid directory"; exit 1) -docker run -v${results}:/source/results.json -v ${test_helpers}:/test_helpers -it --rm doc_converters:latest results_to_md +docker run -v ${results}:/source/results.json -v ${test_helpers}:/test_helpers -v ${header}:/headers/header.md -it --rm doc_converters:latest results_to_md diff --git a/scripts/converters/scripts/results_to_md.sh b/scripts/converters/scripts/results_to_md.sh index 453dcbde069..6e087588c3f 100755 --- a/scripts/converters/scripts/results_to_md.sh +++ b/scripts/converters/scripts/results_to_md.sh @@ -1,48 +1,11 @@ #!/bin/bash -#results_file="${1:-/source/results.json}" -results_file="${1:-/home/paraglade/brain/projects/cis_benchmark/clusters/cis/csr.json}" -#test_helpers="${2:-/test_helpers}" -test_helpers="${2:-/home/paraglade/brain/repos/rancher-security-scan/package/helper_scripts}" +results_file="${1:-/source/results.json}" +test_helpers="${2:-/test_helpers}" +header_file="${3:-/headers/header.md}" header() { -cat < NOTE: only scored tests are covered in this guide. - -### Controls -EOF +cat ${header_file} } get_ids() { From bcea7393c636a7f6ddda1bf97b6e9562c7ebc274 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Mon, 21 Feb 2022 18:31:58 -0700 Subject: [PATCH 264/478] Use the current hostname for baseUrl --- Dockerfile.dev | 2 +- Dockerfile.prod | 2 +- Dockerfile.staging | 2 +- config.toml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Dockerfile.dev b/Dockerfile.dev index af34fcf57dc..53225113ca0 100644 --- a/Dockerfile.dev +++ b/Dockerfile.dev @@ -10,4 +10,4 @@ RUN mkdir -p /output /theme/rancher-website-theme && tar -xzf /run/master.tar.gz # Expose default hugo port EXPOSE 9001 -ENTRYPOINT ["hugo", "serve", "--bind=0.0.0.0", "--buildDrafts", "--buildFuture", "--baseURL=" ] +ENTRYPOINT ["hugo", "serve", "--bind=0.0.0.0", "--buildDrafts", "--buildFuture" ] diff --git a/Dockerfile.prod b/Dockerfile.prod index 38ba46de614..0a0511d279c 100644 --- a/Dockerfile.prod +++ b/Dockerfile.prod @@ -16,7 +16,7 @@ COPY .git .git ADD https://github.com/rancherlabs/website-theme/archive/master.tar.gz /run/master.tar.gz RUN mkdir -p /output /theme/rancher-website-theme && tar -xzf /run/master.tar.gz -C /run/node_modules/rancher-website-theme --strip=1 && rm /run/master.tar.gz -RUN ["hugo", "--buildFuture", "--baseURL=https://rancher.com/docs", "--destination=/output"] +RUN ["hugo", "--buildFuture", "--destination=/output"] # Make sure something got built RUN stat /output/index.html diff --git a/Dockerfile.staging b/Dockerfile.staging index 5dc30768635..ea6ea487cfb 100644 --- a/Dockerfile.staging +++ b/Dockerfile.staging @@ -16,7 +16,7 @@ COPY .git .git ADD https://github.com/rancherlabs/website-theme/archive/master.tar.gz /run/master.tar.gz RUN mkdir -p /output /theme/rancher-website-theme && tar -xzf /run/master.tar.gz -C /run/node_modules/rancher-website-theme --strip=1 && rm /run/master.tar.gz -RUN ["hugo", "--buildDrafts", "--buildFuture", "--baseURL=https://staging.rancher.com/docs", "--destination=/output"] +RUN ["hugo", "--buildDrafts", "--buildFuture", "--destination=/output"] # Make sure something got built RUN stat /output/index.html diff --git a/config.toml b/config.toml index 6ea4f5e3a0b..43108bfb452 100644 --- a/config.toml +++ b/config.toml @@ -1,4 +1,4 @@ -baseURL = "" +baseURL = ".Permalink" languageCode = "en-us" title = "Rancher Labs" From 3f66842469dc7b9e38426d0dd3a3c03173365ab0 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Wed, 23 Feb 2022 16:27:17 -0800 Subject: [PATCH 265/478] Add stalebot config --- .github/stale.yml | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 .github/stale.yml diff --git a/.github/stale.yml b/.github/stale.yml new file mode 100644 index 00000000000..d0d3032f610 --- /dev/null +++ b/.github/stale.yml @@ -0,0 +1,39 @@ +# Configuration for probot-stale - https://github.com/probot/stale + +# Number of days of inactivity before an Issue or Pull Request becomes stale +daysUntilStale: 90 + +# Number of days of inactivity before an Issue or Pull Request with the stale label is closed. +# Set to false to disable. If disabled, issues still need to be closed manually, but will remain marked as stale. +daysUntilClose: 30 + +# Only issues or pull requests with all of these labels are check if stale. Defaults to `[]` (disabled) +onlyLabels: [] + +# Issues or Pull Requests with these labels will never be considered stale. Set to `[]` to disable +exemptLabels: [] + +# Set to true to ignore issues in a project (defaults to false) +exemptProjects: true + +# Set to true to ignore issues in a milestone (defaults to false) +exemptMilestones: true + +# Set to true to ignore issues with an assignee (defaults to false) +exemptAssignees: true + +# Label to use when marking as stale +staleLabel: status/stale + +# Comment to post when marking as stale. Set to `false` to disable +markComment: > + This repository uses a bot to automatically label issues which have not had any activity (commit/comment/label) + for 90 days. This helps us manage the community issues better. If the issue is still relevant, please add a comment to the + issue so the bot can remove the label and we know it is still valid. If it is no longer relevant (or possibly fixed in the + latest release), the bot will automatically close the issue in 30 days. Thank you for your contributions. + +# Limit the number of actions per hour, from 1-30. Default is 30 +limitPerRun: 30 + +# Limit to only `issues` +only: issues \ No newline at end of file From 5485c621c9de1463b784a487b2eeb72215c5e955 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 24 Feb 2022 15:09:20 -0800 Subject: [PATCH 266/478] Add newline to end of file --- .github/stale.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/stale.yml b/.github/stale.yml index d0d3032f610..972e235a185 100644 --- a/.github/stale.yml +++ b/.github/stale.yml @@ -36,4 +36,4 @@ markComment: > limitPerRun: 30 # Limit to only `issues` -only: issues \ No newline at end of file +only: issues From 8d624eba9743acf1a2780aa9eeea50ab2f1e4598 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 24 Feb 2022 16:00:00 -0800 Subject: [PATCH 267/478] Update navigation to Cluster Members --- .../rbac/cluster-project-roles/_index.md | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/content/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/_index.md b/content/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/_index.md index 022b08762ce..c2767b8a66f 100644 --- a/content/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/_index.md +++ b/content/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/_index.md @@ -5,7 +5,7 @@ weight: 1127 Cluster and project roles define user authorization inside a cluster or project. -To manage these roles, +To manage these roles, 1. Click **☰ > Users & Authentication**. 1. In the left navigation bar, click **Roles** and go to the **Cluster** or **Project/Namespaces** tab. @@ -60,8 +60,8 @@ The following table lists the permissions available for the `Manage Nodes` role | SSH Access | ✓ | ✓ | | Delete Nodes | ✓ | ✓ | | Scale Clusters Up and Down | ✓ | * | -***In RKE2, you must have permission to edit a cluster to be able to scale clusters up and down.** -
    +***In RKE2, you must have permission to edit a cluster to be able to scale clusters up and down.** +
    For details on how each cluster role can access Kubernetes resources, you can look them up in the Rancher UI: @@ -81,12 +81,24 @@ To assign a custom role to a new cluster member, you can use the Rancher UI. To To assign the role to a new cluster member, +{{% tabs %}} +{{% tab "Rancher before v2.6.4" %}} 1. Click **☰ > Cluster Management**. 1. Go to the cluster where you want to assign a role to a member and click **Explore**. 1. Click **RBAC > Cluster Members**. 1. Click **Add**. 1. In the **Cluster Permissions** section, choose the custom cluster role that should be assigned to the member. 1. Click **Create**. +{{% /tab %}} +{{% tab "Rancher v2.6.4+" %}} +1. Click **☰ > Cluster Management**. +1. Go to the cluster where you want to assign a role to a member and click **Explore**. +1. Click **Cluster > Cluster Members**. +1. Click **Add**. +1. In the **Cluster Permissions** section, choose the custom cluster role that should be assigned to the member. +1. Click **Create**. +{{% /tab %}} +{{% /tabs %}} **Result:** The member has the assigned role. From 7b663df2041814c8aa9a6a659a9340f21830999e Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Fri, 25 Feb 2022 14:45:29 -0800 Subject: [PATCH 268/478] Remove right arrow on edit page button --- layouts/partials/page-edit.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/layouts/partials/page-edit.html b/layouts/partials/page-edit.html index 4ab823fef49..a478a426a1b 100755 --- a/layouts/partials/page-edit.html +++ b/layouts/partials/page-edit.html @@ -1,7 +1,7 @@ {{ if not .Lastmod.IsZero }}Last updated on {{ .Lastmod.Format "Jan 2, 2006" }}{{ end }}     From efe305af78e656f07afcc2368cf5d46cc8362b69 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 4 Mar 2022 13:29:35 -0500 Subject: [PATCH 281/478] Removed broken link from 2.6 TOC --- .../hosted-kubernetes-clusters/aks/_index.md | 1 - 1 file changed, 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/aks/_index.md b/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/aks/_index.md index a0ad8a5c24f..f54e1e42bdd 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/aks/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/aks/_index.md @@ -14,7 +14,6 @@ You can use Rancher to create a cluster hosted in Microsoft Azure Kubernetes Ser - [Role-based Access Control](#role-based-access-control) - [AKS Cluster Configuration Reference](#aks-cluster-configuration-reference) - [Private Clusters](#private-clusters) -- [Minimum AKS Permissions](#minimum-aks-permissions) - [Syncing](#syncing) - [Programmatically Creating AKS Clusters](#programmatically-creating-aks-clusters) From 15f0b81debba68c390b83b4ee438df7917a42c49 Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Mon, 7 Mar 2022 17:01:20 +0530 Subject: [PATCH 282/478] Amendments to Cluster provisioning and registering documentation --- .../registered-clusters/_index.md | 13 ++++---- suggesting-an-improvement.md | 33 +++++++++++++++++++ 2 files changed, 39 insertions(+), 7 deletions(-) create mode 100644 suggesting-an-improvement.md diff --git a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md index 4d9ab0c2a1f..cdcbc76e1a1 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md @@ -3,7 +3,7 @@ title: Registering Existing Clusters weight: 6 --- -The cluster registration feature replaced the feature to import clusters. +Along with importing clusters, as of v2.5, Rancher allows you to tie in closer with cloud APIs and manage your cluster by registering existing clusters. The control that Rancher has to manage a registered cluster depends on the type of cluster. For details, see [Management Capabilities for Registered Clusters.](#management-capabilities-for-registered-clusters) @@ -168,7 +168,7 @@ Also in the K3s documentation, nodes with the worker role are called agent nodes # Debug Logging and Troubleshooting for Registered K3s Clusters -Nodes are upgraded by the system upgrade controller running in the downstream cluster. Based on the cluster configuration, Rancher deploys two [plans](https://github.com/rancher/system-upgrade-controller#example-upgrade-plan) to upgrade K3s nodes: one for controlplane nodes and one for workers. The system upgrade controller follows the plans and upgrades the nodes. +Nodes are upgraded by the system upgrade controller running in the downstream cluster. Based on the cluster configuration, Rancher deploys two [plans](https://github.com/rancher/system-upgrade-controller#example-upgrade-plan) to upgrade K3s nodes: one for controlplane nodes and one for workers. The system upgrade controller follows the plans and upgrades the nodes. To enable debug logging on the system upgrade controller deployment, edit the [configmap](https://github.com/rancher/system-upgrade-controller/blob/50a4c8975543d75f1d76a8290001d87dc298bdb4/manifests/system-upgrade-controller.yaml#L32) to set the debug environment variable to true. Then restart the `system-upgrade-controller` pod. @@ -196,7 +196,7 @@ Authorized Cluster Endpoint (ACE) support has been added for registered RKE2 and > **Note:** > -> - These steps only need to be performed on the control plane nodes of the downstream cluster. You must configure each control plane node individually. +> - These steps only need to be performed on the control plane nodes of the downstream cluster. You must configure each control plane node individually. > > - The following steps will work on both RKE2 and K3s clusters registered in v2.6.x as well as those registered (or imported) from a previous version of Rancher with an upgrade to v2.6.x. > @@ -223,19 +223,19 @@ Authorized Cluster Endpoint (ACE) support has been added for registered RKE2 and context: user: Default cluster: Default - + 1. Add the following to the config file (or create one if it doesn’t exist); note that the default location is `/etc/rancher/{rke2,k3s}/config.yaml`: kube-apiserver-arg: - authentication-token-webhook-config-file=/var/lib/rancher/{rke2,k3s}/kube-api-authn-webhook.yaml - + 1. Run the following commands: sudo systemctl stop {rke2,k3s}-server sudo systemctl start {rke2,k3s}-server 1. Finally, you **must** go back to the Rancher UI and edit the imported cluster there to complete the ACE enablement. Click on **⋮ > Edit Config**, then click the **Networking** tab under Cluster Configuration. Finally, click the **Enabled** button for **Authorized Endpoint**. Once the ACE is enabled, you then have the option of entering a fully qualified domain name (FQDN) and certificate information. - + >**Note:** The FQDN field is optional, and if one is entered, it should point to the downstream cluster. Certificate information is only needed if there is a load balancer in front of the downstream cluster that is using an untrusted certificate. If you have a valid certificate, then nothing needs to be added to the CA Certificates field. # Annotating Registered Clusters @@ -286,4 +286,3 @@ To annotate a registered cluster, 1. Click **Save**. **Result:** The annotation does not give the capabilities to the cluster, but it does indicate to Rancher that the cluster has those capabilities. - diff --git a/suggesting-an-improvement.md b/suggesting-an-improvement.md new file mode 100644 index 00000000000..c243c72b006 --- /dev/null +++ b/suggesting-an-improvement.md @@ -0,0 +1,33 @@ +# Suggesting an improvement + +If you notice an issue with Kubewarden documentation or want to suggest new content, then open an issue. You only require access to a [GitHub account](https://github.com/join) and a browser. + +In most cases, any new documentation work for Kubewarden begins with an issue in GitHub. The [documentation team for Kubewarden](https://github.com/orgs/kubewarden/teams/kubewarden-documentation) reviews, categorizes and tags them as appropriate. Everybody is welcome to work on the issue, including the reporter, but we request that you assign it to yourself before commencing any work to avoid duplicate efforts. + +## Opening an issue + +If you want to suggest improvements to existing documentation content or notice an error, then open an issue. + +- Click the GitHub Octocat icon on the top. This redirects you to the [documentation repository for Kubewarden](https://github.com/kubewarden/docs). +- Navigate to the Issues tab and click **New issue**. +- Describe the issue or suggestion for improvement. The more details you provide, the better! +- Click Submit new issue. +- Post submitting, you can either assign it to yourself or wait for a community member to pick it up. Members of the documentation team and from the community might request clarifications before they can take action on your issue, so we'd request you to actively check your issue or [turn on GitHub notifications](https://docs.github.com/en/account-and-profile/managing-subscriptions-and-notifications-on-github/setting-up-notifications/configuring-notifications). + +## New content suggestions + +If you want to suggest new content, please file an issue following the steps above. Either + +- You can choose an existing page in the section you think the content belongs in and click Create an issue. +OR +- Navigate to [GitHub](https://github.com/kubewarden/docs/issues/new/choose) and file the issue directly. + +## How do I make my contribution count? + +No contribution is big or small! However, to ensure that the community derives maximum value we'd request you to follow the below when reporting an issue: + +- Focus on providing a clear description of the issue. Some key points to consider would be specifically describing what is missing, outdated, erroneous, or requires qualitative/technical improvement. +- Detailing the specific impact the issue has on users. +- Delimiting the scope of the issue. If the scope is larger, we'd request you to break it down to smaller tasks within an issue. For example, "Creating a Contribution guide" is very widely scoped since there would be multiple tasks associated with the issue. However, "Fixing grammatical error on the Quickstart page" is a more narrowly scoped issue that would, potentially, require only a single pull request. +- Crosscheck existing issues to avoid duplicate work. +- There is a fair chance that you're opening an issue with reference to another pull request or existing issue. Ensure you reference it in the issue you're opening to provide context for contributors who may want to work on it. From 0cefcedccda62c3bab7db44a185ac2b41f570289 Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Mon, 7 Mar 2022 17:17:50 +0530 Subject: [PATCH 283/478] Adding change to the registereing cluster docs --- suggesting-an-improvement.md | 33 --------------------------------- 1 file changed, 33 deletions(-) delete mode 100644 suggesting-an-improvement.md diff --git a/suggesting-an-improvement.md b/suggesting-an-improvement.md deleted file mode 100644 index c243c72b006..00000000000 --- a/suggesting-an-improvement.md +++ /dev/null @@ -1,33 +0,0 @@ -# Suggesting an improvement - -If you notice an issue with Kubewarden documentation or want to suggest new content, then open an issue. You only require access to a [GitHub account](https://github.com/join) and a browser. - -In most cases, any new documentation work for Kubewarden begins with an issue in GitHub. The [documentation team for Kubewarden](https://github.com/orgs/kubewarden/teams/kubewarden-documentation) reviews, categorizes and tags them as appropriate. Everybody is welcome to work on the issue, including the reporter, but we request that you assign it to yourself before commencing any work to avoid duplicate efforts. - -## Opening an issue - -If you want to suggest improvements to existing documentation content or notice an error, then open an issue. - -- Click the GitHub Octocat icon on the top. This redirects you to the [documentation repository for Kubewarden](https://github.com/kubewarden/docs). -- Navigate to the Issues tab and click **New issue**. -- Describe the issue or suggestion for improvement. The more details you provide, the better! -- Click Submit new issue. -- Post submitting, you can either assign it to yourself or wait for a community member to pick it up. Members of the documentation team and from the community might request clarifications before they can take action on your issue, so we'd request you to actively check your issue or [turn on GitHub notifications](https://docs.github.com/en/account-and-profile/managing-subscriptions-and-notifications-on-github/setting-up-notifications/configuring-notifications). - -## New content suggestions - -If you want to suggest new content, please file an issue following the steps above. Either - -- You can choose an existing page in the section you think the content belongs in and click Create an issue. -OR -- Navigate to [GitHub](https://github.com/kubewarden/docs/issues/new/choose) and file the issue directly. - -## How do I make my contribution count? - -No contribution is big or small! However, to ensure that the community derives maximum value we'd request you to follow the below when reporting an issue: - -- Focus on providing a clear description of the issue. Some key points to consider would be specifically describing what is missing, outdated, erroneous, or requires qualitative/technical improvement. -- Detailing the specific impact the issue has on users. -- Delimiting the scope of the issue. If the scope is larger, we'd request you to break it down to smaller tasks within an issue. For example, "Creating a Contribution guide" is very widely scoped since there would be multiple tasks associated with the issue. However, "Fixing grammatical error on the Quickstart page" is a more narrowly scoped issue that would, potentially, require only a single pull request. -- Crosscheck existing issues to avoid duplicate work. -- There is a fair chance that you're opening an issue with reference to another pull request or existing issue. Ensure you reference it in the issue you're opening to provide context for contributors who may want to work on it. From 6e36eaaadf8be26de24e1b6cecdc3502692dce9a Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Mon, 7 Mar 2022 17:32:52 +0530 Subject: [PATCH 284/478] Rewording the amendment of v2.5 & 2.6 CA documentation --- .../en/installation/resources/update-ca-cert/_index.md | 10 ++++++++++ .../en/installation/resources/update-ca-cert/_index.md | 9 +++++++++ 2 files changed, 19 insertions(+) diff --git a/content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md b/content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md index c256f9f5905..08c26328652 100644 --- a/content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md +++ b/content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md @@ -13,6 +13,7 @@ A summary of the steps is as follows: 2. Create or update the `tls-ca` Kubernetes secret resource with the root CA certificate (only required when using a private CA). 3. Update the Rancher installation using the Helm CLI. 4. Reconfigure the Rancher agents to trust the new CA certificate. +5. Select Force Update of fleet clusters to connect fleet-agent to Rancher The details of these instructions are below. @@ -145,3 +146,12 @@ First, generate the agent definitions as described here: https://gist.github.com Then, connect to a controlplane node of the downstream cluster via SSH, create a Kubeconfig and apply the definitions: https://gist.github.com/superseb/b14ed3b5535f621ad3d2aa6a4cd6443b + + +# 5. Select Force Update of fleet clusters to connect fleet-agent to Rancher + +Select 'Force Update' for the clusters within the Continuous Delivery view of the Rancher Explorer UI to allow the fleet-agent in downstream clusters to successfully connect to Rancher. + +### Why is this step required? + +Fleet agents in Rancher managed clusters store kubeconfig that is used to connect to the Rancher proxied kube-api in the fleet-agent secret of the fleet-system namespace. The kubeconfig contains a certificate-authority-data block containing the Rancher CA. When changing the Rancher CA, this needs to be updated for a successful connection of the fleet-agent to Rancher. diff --git a/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md b/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md index 5a7a477fa82..658ffc2ea34 100644 --- a/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md +++ b/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md @@ -11,6 +11,7 @@ A summary of the steps is as follows: 2. Create or update the `tls-ca` Kubernetes secret resource with the root CA certificate (only required when using a private CA). 3. Update the Rancher installation using the Helm CLI. 4. Reconfigure the Rancher agents to trust the new CA certificate. +5. Select Force Update of fleet clusters to connect fleet-agent to Rancher The details of these instructions are below. @@ -143,3 +144,11 @@ First, generate the agent definitions as described here: https://gist.github.com Then, connect to a controlplane node of the downstream cluster via SSH, create a Kubeconfig and apply the definitions: https://gist.github.com/superseb/b14ed3b5535f621ad3d2aa6a4cd6443b + +# 5. Select Force Update of fleet clusters to connect fleet-agent to Rancher + +Select 'Force Update' for the clusters within the Continuous Delivery view of the Rancher Explorer UI to allow the fleet-agent in downstream clusters to successfully connect to Rancher. + +### Why is this step required? + +Fleet agents in Rancher managed clusters store kubeconfig that is used to connect to the Rancher proxied kube-api in the fleet-agent secret of the fleet-system namespace. The kubeconfig contains a certificate-authority-data block containing the Rancher CA. When changing the Rancher CA, this needs to be updated for a successful connection of the fleet-agent to Rancher. From a318798cb711e1727d6c952279e717e90fed5a74 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 7 Mar 2022 17:10:36 -0500 Subject: [PATCH 285/478] Updated note to be more noticeable to link to extra_args page. --- content/rke/latest/en/config-options/services/_index.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/rke/latest/en/config-options/services/_index.md b/content/rke/latest/en/config-options/services/_index.md index 0266731a249..f607b54ae74 100644 --- a/content/rke/latest/en/config-options/services/_index.md +++ b/content/rke/latest/en/config-options/services/_index.md @@ -6,7 +6,9 @@ weight: 230 To deploy Kubernetes, RKE deploys several core components or services in Docker containers on the nodes. Based on the roles of the node, the containers deployed may be different. -**All services support additional [custom arguments, Docker mount binds and extra environment variables]({{}}/rke/latest/en/config-options/services/services-extras/).** +>**Note:** All services support additional custom arguments, Docker mount binds, and extra environment variables. +> +>Please see the [documentation]({{}}/rke/latest/en/config-options/services/services-extras/) for more details. | Component | Services key name in cluster.yml | |-------------------------|----------------------------------| From 206e74d32c084e11e3d16ddeab879fcbbed74716 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Mon, 7 Mar 2022 19:22:33 -0700 Subject: [PATCH 286/478] Discourage Docker install, encourage Helm CLI install --- .../install-rancher-on-k8s/_index.md | 2 + .../single-node-docker/_index.md | 6 +- .../single-node-upgrades/_index.md | 4 +- .../deployment/equinix-metal-qs/_index.md | 2 +- .../quickstart-manual-setup/_index.md | 132 +++++++----------- 5 files changed, 60 insertions(+), 86 deletions(-) diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md index 5d27916781c..a969bd01663 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md @@ -148,6 +148,8 @@ cert-manager-webhook-787858fcdb-nlzsq 1/1 Running 0 2m The exact command to install Rancher differs depending on the certificate configuration. +> **Tip for testing and development:** This final command to install Rancher requires a domain name that forwards traffic to Rancher. If you are using the Helm CLI to set up a proof of concept, you can use a fake domain name when passing the `hostname` option. An example of a fake domain name would be `.sslip.io`, which would expose Rancher on an IP where Rancher would be running. Production installs would require a real domain name. + {{% tabs %}} {{% tab "Rancher-generated Certificates" %}} diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md index 26ba9770630..e6521e26db2 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md @@ -91,7 +91,9 @@ docker run -d --restart=unless-stopped \ ### Option C: Bring Your Own Certificate, Signed by a Recognized CA -In production environments where you're exposing an app publicly, use a certificate signed by a recognized CA so that your user base doesn't encounter security warnings. +In production environments where you're exposing an app publicly, you would use a certificate signed by a recognized CA so that your user base doesn't encounter security warnings. + +The Docker install is not recommended for production. these instructions are provided for testing and development purposes. > **Prerequisites:** > @@ -127,6 +129,8 @@ docker run -d --restart=unless-stopped \ For production environments, you also have the option of using [Let's Encrypt](https://letsencrypt.org/) certificates. Let's Encrypt uses an http-01 challenge to verify that you have control over your domain. You can confirm that you control the domain by pointing the hostname that you want to use for Rancher access (for example, `rancher.mydomain.com`) to the IP of the machine it is running on. You can bind the hostname to the IP address by creating an A record in DNS. +The Docker install is not recommended for production. These instructions are provided for testing and development purposes. + > **Prerequisites:** > > - Let's Encrypt is an Internet service. Therefore, this option cannot be used in an internal/air gapped network. diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md index 42a5504789d..31a47c5f896 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md @@ -5,9 +5,11 @@ weight: 1010 The following instructions will guide you through upgrading a Rancher server that was installed with Docker. +> **Docker installs are not supported in production.** We don't support upgrading Docker installs in production environments, and these instructions are provided for testing and development purposes only. If you have already deployed a Docker install in production and need to upgrade to a new Rancher version, we recommend [migrating to the Helm chart install]({{}}/rancher/v2.6/en/backups/migrating-rancher/) before upgrading. + # Prerequisites -- **Review the [known upgrade issues]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/#known-upgrade-issues) in the Rancher documentation for the most noteworthy issues to consider when upgrading Rancher. A more complete list of known issues for each Rancher version can be found in the release notes on [GitHub](https://github.com/rancher/rancher/releases) and on the [Rancher forums.](https://forums.rancher.com/c/announcements/12) Note that upgrades to or from any chart in the [rancher-alpha repository]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/#helm-chart-repositories/) aren’t supported. +- **Review the [known upgrade issues]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/#known-upgrade-issues)** in the Rancher documentation for the most noteworthy issues to consider when upgrading Rancher. A more complete list of known issues for each Rancher version can be found in the release notes on [GitHub](https://github.com/rancher/rancher/releases) and on the [Rancher forums.](https://forums.rancher.com/c/announcements/12) Note that upgrades to or from any chart in the [rancher-alpha repository]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/#helm-chart-repositories/) aren’t supported. - **For [air gap installs only,]({{}}/rancher/v2.6/en/installation/other-installation-methods/air-gap) collect and populate images for the new Rancher server version**. Follow the guide to [populate your private registry]({{}}/rancher/v2.6/en/installation/other-installation-methods/air-gap/populate-private-registry/) with the images for the Rancher version that you want to upgrade to. # Placeholder Review diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/equinix-metal-qs/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/equinix-metal-qs/_index.md index 4fce68ecc7d..ad208bd3bf8 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/equinix-metal-qs/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/equinix-metal-qs/_index.md @@ -10,7 +10,7 @@ weight: 250 - Creation of your first cluster - Deployment of an application, Nginx ->**Note:** The intent of these guides is to quickly launch a sandbox that you can use to evaluate Rancher. These guides are not intended for production environments. For comprehensive setup instructions, see [Installation]({{}}/rancher/v2.6/en/installation/). +>**Note:** The intent of these guides is to quickly launch a sandbox that you can use to evaluate Rancher. The Docker install is not recommended for production environments. For comprehensive setup instructions, see [Installation]({{}}/rancher/v2.6/en/installation/). ## Quick Start Outline diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md index a5c970e3281..57c6d4a37cb 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md @@ -1,118 +1,84 @@ --- -title: Manual Quick Start +title: Helm CLI Quick Start weight: 300 --- -Howdy Partner! This tutorial walks you through: -- Installation of Rancher 2.x -- Creation of your first cluster -- Deployment of an application, Nginx +These instructions capture a quick way to set up a proof-of-concept Rancher installation. ->**Note:** The intent of these guides is to quickly launch a sandbox that you can use to evaluate Rancher. These guides are not intended for production environments. For comprehensive setup instructions, see [Installation]({{}}/rancher/v2.6/en/installation/). +These instructions assume you have a Linux virtual machine that you will communicate with from your local workstation. Rancher will be installed on the Linux machine. You will need to retrieve the IP address of that machine to make it so that you can access Rancher from your local workstation. Rancher is designed to manage Kubernetes clusters remotely, so any Kubernetes cluster that Rancher manages in the future will also need to be able to reach this IP address. -## Quick Start Outline +We don't recommend installing Rancher locally because it creates a networking problem. Installing Rancher on localhost does not allow Rancher to communicate with downstream Kubernetes clusters, so on localhost you wouldn't be able to test Rancher's cluster provisioning or cluster management functionality. -This Quick Start Guide is divided into different tasks for easier consumption. +Your Linux machine can be anywhere. It could be an Amazon EC2 instance, a Digital Ocean droplet, or an Azure virtual machine, to name a few examples. (Other Rancher docs often use 'node' as a generic term for all of these.) One possible way to deploy a Linux machine is by setting up an Amazon EC2 instance as shown in [this tutorial.]({{}}/rancher/v2.6/en/installation/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/) - +The full installation requirements are [here.]({{}}/rancher/v2.6/en/installation/requirements/) -1. [Provision a Linux Host](#1-provision-a-linux-host) +## Install K3s on Linux -1. [Install Rancher](#2-install-rancher) +Install a K3s Kubernetes cluster by running this command on the Linux machine: -1. [Log In](#3-log-in) +``` +curl -sfL https://get.k3s.io | sh -s - server +``` -1. [Create the Cluster](#4-create-the-cluster) +Save the IP of the Linux machine. - -
    -### 1. Provision a Linux Host +## Save the kubeconfig to your workstation - Begin creation of a custom cluster by provisioning a Linux host. Your host can be: +The kubeconfig file is important for accessing the Kubernetes cluster. Copy the file at `/etc/rancher/k3s/k3s.yaml` from the Linux machine and save it to your local workstation in the directory `~/.kube/config`. One way to do this is by using the `scp` tool and run this command on your local machine: -- A cloud-host virtual machine (VM) -- An on-prem VM -- A bare-metal server +``` +scp root@:/etc/rancher/k3s/k3s.yaml ~/.kube/config +``` - >**Note:** - > When using a cloud-hosted virtual machine you need to allow inbound TCP communication to ports 80 and 443. Please see your cloud-host's documentation for information regarding port configuration. - > - > For a full list of port requirements, refer to [Docker Installation]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/). +## Edit the Rancher server URL in the kubeconfig - Provision the host according to our [Requirements]({{}}/rancher/v2.6/en/installation/requirements/). +In the kubeconfig file, the server directive is defined as `localhost`. You will need to change the server directive from `localhost` to `:6443`. (The Kubernetes API server will be reached at port 6443, while the Rancher server will be reached at ports 80 and 443.) This edit is needed so that when you run Helm or kubectl commands from your local workstation, you will be able to communicate with the Kubernetes cluster that Rancher will be installed on. -### 2. Install Rancher +One way to open the kubeconfig file for editing is to use Vim: -To install Rancher on your host, connect to it and then use a shell to install. +``` +vi ~/.kube/config +``` -1. Log in to your Linux host using your preferred shell, such as PuTTy or a remote Terminal connection. +Press `i` to put Vim in insert mode. To save your work, press `Esc`. Then press `:wq` and press `enter`. -2. From your shell, enter the following command: +## Install Rancher with Helm - ``` - sudo docker run -d --restart=unless-stopped -p 80:80 -p 443:443 --privileged rancher/rancher - ``` +Then from your local workstation, run the following commands. You will need to have installed [kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl) and [helm.](https://helm.sh/docs/intro/install/) -**Result:** Rancher is installed. +``` +helm repo add rancher-latest https://releases.rancher.com/server-charts/latest -### 3. Log In +kubectl create namespace cattle-system -Log in to Rancher to begin using the application. After you log in, you'll make some one-time configurations. +kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.5.1/cert-manager.crds.yaml -1. Open a web browser and enter the IP address of your host: `https://`. +helm repo add jetstack https://charts.jetstack.io - Replace `` with your host IP address. +helm repo update -2. When prompted, create a password for the default `admin` account there cowpoke! +helm install cert-manager jetstack/cert-manager \ + --namespace cert-manager \ + --create-namespace \ + --version v1.5.1 +``` -3. Set the **Rancher Server URL**. The URL can either be an IP address or a host name. However, each node added to your cluster must be able to connect to this URL.

    If you use a hostname in the URL, this hostname must be resolvable by DNS on the nodes you want to add to you cluster. +The final command to install Rancher is below. The command requires a domain name that forwards traffic to the Linux machine. For the sake of simplicity in this tutorial, you can use a fake domain name to create your proof of concept. An example of a fake domain name would be `.sslip.io`. -
    +``` +helm install rancher rancher-latest/rancher \ + --namespace cattle-system \ + --set hostname=.sslip.io \ + --set replicas=1 \ + --set bootstrapPassword= +``` -### 4. Create the Cluster +Now if you navigate to `.sslip.io` in a web browser, you should see the Rancher UI. -Welcome to Rancher! You are now able to create your first Kubernetes cluster. +To make these instructions simple, we used a fake domain name and self-signed certificates to do this installation. For production installs, you would need a high-availability setup with a load balancer, a real domain name and real certificates. -In this task, you can use the versatile **Custom** option. This option lets you add _any_ Linux host (cloud-hosted VM, on-prem VM, or bare-metal) to be used in a cluster. +These instructions also left out the full installation requirements and other installation options. If you have any issues with these steps, refer to the full [Helm CLI installation docs.]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/) -1. Click **☰ > Cluster Management**. -1. From the **Clusters** page, click **Create**. -2. Choose **Custom**. - -3. Enter a **Cluster Name**. - -4. Skip **Member Roles** and **Cluster Options**. We'll tell you about them later. - -5. Click **Next**. - -6. From **Node Role**, select _all_ the roles: **etcd**, **Control**, and **Worker**. - -7. **Optional**: Rancher auto-detects the IP addresses used for Rancher communication and cluster communication. You can override these using `Public Address` and `Internal Address` in the **Node Address** section. - -8. Skip the **Labels** stuff. It's not important for now. - -9. Copy the command displayed on screen to your clipboard. - -10. Log in to your Linux host using your preferred shell, such as PuTTy or a remote Terminal connection. Run the command copied to your clipboard. - -11. When you finish running the command on your Linux host, click **Done**. - -**Result:** - -Your cluster is created and assigned a state of **Provisioning**. Rancher is standing up your cluster. - -You can access your cluster after its state is updated to **Active**. - -**Active** clusters are assigned two Projects: - -- `Default`, containing the `default` namespace -- `System`, containing the `cattle-system`, `ingress-nginx`, `kube-public`, and `kube-system` namespaces - -#### Finished - -Congratulations! You have created your first cluster. - -#### What's Next? - -Use Rancher to create a deployment. For more information, see [Creating Deployments]({{}}/rancher/v2.6/en/quick-start-guide/workload). +To launch new Kubernetes clusters with your new Rancher server, you may need to set up cloud credentials in Rancher. For more information, see [Launching Kubernetes clusters with Rancher.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/) \ No newline at end of file From e6f414711c3b4f9d1f4fe6e909e86187dbc75b6a Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Tue, 8 Mar 2022 16:23:41 +0530 Subject: [PATCH 287/478] Modifying content for v2.5 and 2.6 CA certificate content --- .../v2.6/en/cluster-provisioning/registered-clusters/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md index cdcbc76e1a1..35146cafedd 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/registered-clusters/_index.md @@ -3,7 +3,7 @@ title: Registering Existing Clusters weight: 6 --- -Along with importing clusters, as of v2.5, Rancher allows you to tie in closer with cloud APIs and manage your cluster by registering existing clusters. +The cluster registration feature replaced the feature to import clusters. The control that Rancher has to manage a registered cluster depends on the type of cluster. For details, see [Management Capabilities for Registered Clusters.](#management-capabilities-for-registered-clusters) From 9d42c3ee57e422f1f9f3233d9c90fc0c3e1ba13f Mon Sep 17 00:00:00 2001 From: Manuel Buil Date: Fri, 4 Mar 2022 16:19:00 +0100 Subject: [PATCH 288/478] Add comment about disabling netpol when flannel-backend=none Signed-off-by: Manuel Buil --- content/k3s/latest/en/installation/network-options/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/k3s/latest/en/installation/network-options/_index.md b/content/k3s/latest/en/installation/network-options/_index.md index dcc65a03aea..78e734929ea 100644 --- a/content/k3s/latest/en/installation/network-options/_index.md +++ b/content/k3s/latest/en/installation/network-options/_index.md @@ -22,7 +22,7 @@ If you wish to use WireGuard as your flannel backend it may require additional k ### Custom CNI -Run K3s with `--flannel-backend=none` and install your CNI of choice. IP Forwarding should be enabled for Canal and Calico. Please reference the steps below. +Run K3s with `--flannel-backend=none` and install your CNI of choice. Most CNI plugins come with their own network policy engine, so it is recommended to set `--disable-network-policy` as well to avoid conflicts. IP Forwarding should be enabled for Canal and Calico. Please reference the steps below. {{% tabs %}} {{% tab "Canal" %}} From 03250a7ecc82624e748ab3de91658aba1000c59f Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 8 Mar 2022 09:30:09 -0500 Subject: [PATCH 289/478] Updated wording per feedback --- content/rke/latest/en/config-options/services/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rke/latest/en/config-options/services/_index.md b/content/rke/latest/en/config-options/services/_index.md index f607b54ae74..77a3a969195 100644 --- a/content/rke/latest/en/config-options/services/_index.md +++ b/content/rke/latest/en/config-options/services/_index.md @@ -8,7 +8,7 @@ To deploy Kubernetes, RKE deploys several core components or services in Docker >**Note:** All services support additional custom arguments, Docker mount binds, and extra environment variables. > ->Please see the [documentation]({{}}/rke/latest/en/config-options/services/services-extras/) for more details. +>To configure advanced options for Kubernetes services such as `kubelet`, `kube-controller`, and `kube-apiserver` that are not documented below, see the [`extra_args` documentation]({{}}/rke/latest/en/config-options/services/services-extras/) for more details. | Component | Services key name in cluster.yml | |-------------------------|----------------------------------| From 5800f6da0a8cb7e090f4d05427a7157ef4c05d47 Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Tue, 8 Mar 2022 20:52:03 +0530 Subject: [PATCH 290/478] Update content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md Co-authored-by: Jen Travinski --- .../v2.5/en/installation/resources/update-ca-cert/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md b/content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md index 08c26328652..7a3b3e9413b 100644 --- a/content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md +++ b/content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md @@ -150,7 +150,7 @@ https://gist.github.com/superseb/b14ed3b5535f621ad3d2aa6a4cd6443b # 5. Select Force Update of fleet clusters to connect fleet-agent to Rancher -Select 'Force Update' for the clusters within the Continuous Delivery view of the Rancher Explorer UI to allow the fleet-agent in downstream clusters to successfully connect to Rancher. +Select 'Force Update' for the clusters within the [Continuous Delivery]({{}}/rancher/v2.5/en/deploy-across-clusters/fleet/#accessing-fleet-in-the-rancher-ui) view under Cluster Explorer in the Rancher UI to allow the fleet-agent in downstream clusters to successfully connect to Rancher. ### Why is this step required? From be250166d22a8ac92099047eeac7378022a0ac83 Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Tue, 8 Mar 2022 20:52:20 +0530 Subject: [PATCH 291/478] Update content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md Co-authored-by: Jen Travinski --- .../v2.5/en/installation/resources/update-ca-cert/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md b/content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md index 7a3b3e9413b..ee6457aeefb 100644 --- a/content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md +++ b/content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md @@ -13,7 +13,7 @@ A summary of the steps is as follows: 2. Create or update the `tls-ca` Kubernetes secret resource with the root CA certificate (only required when using a private CA). 3. Update the Rancher installation using the Helm CLI. 4. Reconfigure the Rancher agents to trust the new CA certificate. -5. Select Force Update of fleet clusters to connect fleet-agent to Rancher +5. Select Force Update of Fleet clusters to connect fleet-agent to Rancher. The details of these instructions are below. From 4ed4c8ee202eb21d2541da2cfe7517b2d826a4c1 Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Tue, 8 Mar 2022 20:52:34 +0530 Subject: [PATCH 292/478] Update content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md Co-authored-by: Jen Travinski --- .../v2.5/en/installation/resources/update-ca-cert/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md b/content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md index ee6457aeefb..5b8e5f7b256 100644 --- a/content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md +++ b/content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md @@ -148,7 +148,7 @@ Then, connect to a controlplane node of the downstream cluster via SSH, create a https://gist.github.com/superseb/b14ed3b5535f621ad3d2aa6a4cd6443b -# 5. Select Force Update of fleet clusters to connect fleet-agent to Rancher +# 5. Select Force Update of Fleet clusters to connect fleet-agent to Rancher Select 'Force Update' for the clusters within the [Continuous Delivery]({{}}/rancher/v2.5/en/deploy-across-clusters/fleet/#accessing-fleet-in-the-rancher-ui) view under Cluster Explorer in the Rancher UI to allow the fleet-agent in downstream clusters to successfully connect to Rancher. From 39596de19eb13291a33ac7b439b812e1ca3d0e89 Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Tue, 8 Mar 2022 20:52:54 +0530 Subject: [PATCH 293/478] Update content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md Co-authored-by: Jen Travinski --- .../v2.5/en/installation/resources/update-ca-cert/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md b/content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md index 5b8e5f7b256..751feae2d8c 100644 --- a/content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md +++ b/content/rancher/v2.5/en/installation/resources/update-ca-cert/_index.md @@ -154,4 +154,4 @@ Select 'Force Update' for the clusters within the [Continuous Delivery]({{ Date: Tue, 8 Mar 2022 20:53:05 +0530 Subject: [PATCH 294/478] Update content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md Co-authored-by: Jen Travinski --- .../v2.6/en/installation/resources/update-ca-cert/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md b/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md index 658ffc2ea34..1844c02f224 100644 --- a/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md +++ b/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md @@ -11,7 +11,7 @@ A summary of the steps is as follows: 2. Create or update the `tls-ca` Kubernetes secret resource with the root CA certificate (only required when using a private CA). 3. Update the Rancher installation using the Helm CLI. 4. Reconfigure the Rancher agents to trust the new CA certificate. -5. Select Force Update of fleet clusters to connect fleet-agent to Rancher +5. Select Force Update of Fleet clusters to connect fleet-agent to Rancher. The details of these instructions are below. From cef5df873db5995274d42d080fa218519a17a4dd Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Tue, 8 Mar 2022 20:53:15 +0530 Subject: [PATCH 295/478] Update content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md Co-authored-by: Jen Travinski --- .../v2.6/en/installation/resources/update-ca-cert/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md b/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md index 1844c02f224..737c3160586 100644 --- a/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md +++ b/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md @@ -145,7 +145,7 @@ First, generate the agent definitions as described here: https://gist.github.com Then, connect to a controlplane node of the downstream cluster via SSH, create a Kubeconfig and apply the definitions: https://gist.github.com/superseb/b14ed3b5535f621ad3d2aa6a4cd6443b -# 5. Select Force Update of fleet clusters to connect fleet-agent to Rancher +# 5. Select Force Update of Fleet clusters to connect fleet-agent to Rancher Select 'Force Update' for the clusters within the Continuous Delivery view of the Rancher Explorer UI to allow the fleet-agent in downstream clusters to successfully connect to Rancher. From 83f2ae662f1ee2ab2a095cd713d26cddf70284e4 Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Tue, 8 Mar 2022 20:53:29 +0530 Subject: [PATCH 296/478] Update content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md Co-authored-by: Jen Travinski --- .../v2.6/en/installation/resources/update-ca-cert/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md b/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md index 737c3160586..1e51027858c 100644 --- a/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md +++ b/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md @@ -147,7 +147,7 @@ https://gist.github.com/superseb/b14ed3b5535f621ad3d2aa6a4cd6443b # 5. Select Force Update of Fleet clusters to connect fleet-agent to Rancher -Select 'Force Update' for the clusters within the Continuous Delivery view of the Rancher Explorer UI to allow the fleet-agent in downstream clusters to successfully connect to Rancher. +Select 'Force Update' for the clusters within the [Continuous Delivery]({{}}/rancher/v2.6/en/deploy-across-clusters/fleet/#accessing-fleet-in-the-rancher-ui) view of the Rancher UI to allow the fleet-agent in downstream clusters to successfully connect to Rancher. ### Why is this step required? From 7bc69e96ca47a3cd0c876910ccbbe353de5412e0 Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Tue, 8 Mar 2022 20:53:38 +0530 Subject: [PATCH 297/478] Update content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md Co-authored-by: Jen Travinski --- .../v2.6/en/installation/resources/update-ca-cert/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md b/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md index 1e51027858c..3c01e5f7eaf 100644 --- a/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md +++ b/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md @@ -151,4 +151,4 @@ Select 'Force Update' for the clusters within the [Continuous Delivery]({{ Date: Mon, 7 Mar 2022 17:28:38 -0500 Subject: [PATCH 298/478] Update documentation on resource quota limits --- .../quotas-for-projects/_index.md | 24 +++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/project-admin/resource-quotas/quotas-for-projects/_index.md b/content/rancher/v2.6/en/project-admin/resource-quotas/quotas-for-projects/_index.md index 63a18ba0f49..cefac3e9f1d 100644 --- a/content/rancher/v2.6/en/project-admin/resource-quotas/quotas-for-projects/_index.md +++ b/content/rancher/v2.6/en/project-admin/resource-quotas/quotas-for-projects/_index.md @@ -19,11 +19,13 @@ The resource quota includes two limits, which you set while creating or editing - **Project Limits:** - This set of values configures an overall resource limit for the project. If you try to add a new namespace to the project, Rancher uses the limits you've set to validate that the project has enough resources to accommodate the namespace. In other words, if you try to move a namespace into a project near its resource quota, Rancher blocks you from moving the namespace. + This set of values configures a total limit for each specified resource shared among all namespaces in the project. - **Namespace Default Limits:** - This value is the default resource limit available for each namespace. When the resource quota is created at the project level, this limit is automatically propagated to each namespace in the project. Each namespace is bound to this default limit unless you override it. + This set of values configures the default quota limit available for each namespace for each specified resource. + When a namespace is created in the project without overrides, this limit is automatically bound to the namespace and enforced. + In the following diagram, a Rancher administrator wants to apply a resource quota that sets the same CPU and memory limit for every namespace in their project (`Namespace 1-4`). However, in Rancher, the administrator can set a resource quota for the project (`Project Resource Quota`) rather than individual namespaces. This quota includes resource limits for both the entire project (`Project Limit`) and individual namespaces (`Namespace Default Limit`). Rancher then propagates the `Namespace Default Limit` quotas to each namespace (`Namespace Resource Quota`) when created. @@ -32,6 +34,24 @@ In the following diagram, a Rancher administrator wants to apply a resource quot Let's highlight some more nuanced functionality. If a quota is deleted at the project level, it will also be removed from all namespaces contained within that project, despite any overrides that may exist. Further, updating an existing namespace default limit for a quota at the project level will not result in that value being propagated to existing namespaces in the project; the updated value will only be applied to newly created namespaces in that project. To update a namespace default limit for existing namespaces you can delete and subsequently recreate the quota at the project level with the new default value. This will result in the new default value being applied to all existing namespaces in the project. +Before creating a namespace in a project, Rancher compares the amounts of the project's available resources and requested resources (regardless of whether they come from the default or overriden limits). +If a new namespace, for any one resource, will exceed the remaining quota for it, +Rancher will still grant the remaining amount for that resource. +However, this is not the case with namespaces created outside of Rancher's UI. For namespaces created via `kubectl`, Rancher +will assign a resource quota that has a **zero** amount for any exceeding resource. + +To create a namespace in an existing project via `kubectl`, use the `field.cattle.io/projectId` annotation. To override the default +requested quota limit, use the `field.cattle.io/resourceQuota` annotation. +``` +apiVersion: v1 +kind: Namespace +metadata: + annotations: + field.cattle.io/projectId: [your-cluster-ID]:[your-project-ID] + field.cattle.io/resourceQuota: '{"limit":{"limitsCpu":"100m", "limitsMemory":"100Mi", "configMaps": "50"}}' + name: my-ns +``` + The following table explains the key differences between the two quota types. | Rancher Resource Quotas | Kubernetes Resource Quotas | From 749fec0a3e339febf9d749b4b2d9f7f0184a47a3 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Tue, 8 Mar 2022 12:15:28 -0700 Subject: [PATCH 299/478] Clarify sentences about project resource quotas --- .../resource-quotas/quotas-for-projects/_index.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/rancher/v2.6/en/project-admin/resource-quotas/quotas-for-projects/_index.md b/content/rancher/v2.6/en/project-admin/resource-quotas/quotas-for-projects/_index.md index cefac3e9f1d..8b6d3cdf3c8 100644 --- a/content/rancher/v2.6/en/project-admin/resource-quotas/quotas-for-projects/_index.md +++ b/content/rancher/v2.6/en/project-admin/resource-quotas/quotas-for-projects/_index.md @@ -35,10 +35,10 @@ In the following diagram, a Rancher administrator wants to apply a resource quot Let's highlight some more nuanced functionality. If a quota is deleted at the project level, it will also be removed from all namespaces contained within that project, despite any overrides that may exist. Further, updating an existing namespace default limit for a quota at the project level will not result in that value being propagated to existing namespaces in the project; the updated value will only be applied to newly created namespaces in that project. To update a namespace default limit for existing namespaces you can delete and subsequently recreate the quota at the project level with the new default value. This will result in the new default value being applied to all existing namespaces in the project. Before creating a namespace in a project, Rancher compares the amounts of the project's available resources and requested resources (regardless of whether they come from the default or overriden limits). -If a new namespace, for any one resource, will exceed the remaining quota for it, -Rancher will still grant the remaining amount for that resource. +If the requested resources exceed the remaining capacity in the project for those resources, Rancher will assign the namespace the remaining capacity for that resource. + However, this is not the case with namespaces created outside of Rancher's UI. For namespaces created via `kubectl`, Rancher -will assign a resource quota that has a **zero** amount for any exceeding resource. +will assign a resource quota that has a **zero** amount for any resource that requested more capacity than what remains in the project. To create a namespace in an existing project via `kubectl`, use the `field.cattle.io/projectId` annotation. To override the default requested quota limit, use the `field.cattle.io/resourceQuota` annotation. From 66cb74545f206a3e2ef8804b8de22489146db26b Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Tue, 8 Mar 2022 16:50:43 -0800 Subject: [PATCH 300/478] Update process to get IDP metadata for Keycloak SAML --- .../authentication/keycloak/_index.md | 101 +++++++++++++----- .../authentication/keycloak-saml/_index.md | 101 +++++++++++++----- 2 files changed, 152 insertions(+), 50 deletions(-) diff --git a/content/rancher/v2.5/en/admin-settings/authentication/keycloak/_index.md b/content/rancher/v2.5/en/admin-settings/authentication/keycloak/_index.md index 95a37c00e2f..e4e75f36477 100644 --- a/content/rancher/v2.5/en/admin-settings/authentication/keycloak/_index.md +++ b/content/rancher/v2.5/en/admin-settings/authentication/keycloak/_index.md @@ -25,36 +25,87 @@ If your organization uses Keycloak Identity Provider (IdP) for user authenticati >1: Optionally, you can enable either one or both of these settings. >2: Rancher SAML metadata won't be generated until a SAML provider is configured and saved. - + {{< img "/img/rancher/keycloak/keycloak-saml-client-configuration.png" "">}} - + - In the new SAML client, create Mappers to expose the users fields - Add all "Builtin Protocol Mappers" {{< img "/img/rancher/keycloak/keycloak-saml-client-builtin-mappers.png" "">}} - Create a new "Group list" mapper to map the member attribute to a user's groups - {{< img "/img/rancher/keycloak/keycloak-saml-client-group-mapper.png" "">}} -- Export a `metadata.xml` file from your Keycloak client: - From the `Installation` tab, choose the `SAML Metadata IDPSSODescriptor` format option and download your file. - - >**Note** - > Keycloak versions 6.0.0 and up no longer provide the IDP metadata under the `Installation` tab. - > You can still get the XML from the following url: - > - > `https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}/protocol/saml/descriptor` - > - > The XML obtained from this URL contains `EntitiesDescriptor` as the root element. Rancher expects the root element to be `EntityDescriptor` rather than `EntitiesDescriptor`. So before passing this XML to Rancher, follow these steps to adjust it: - > - > * Copy all the attributes from `EntitiesDescriptor` to the `EntityDescriptor` that are not present. - > * Remove the `` tag from the beginning. - > * Remove the `` from the end of the xml. - > - > You are left with something similar as the example below: - > - > ``` - > - > .... - > - > ``` + {{< img "/img/rancher/keycloak/keycloak-saml-client-group-mapper.png" "">}} + +## Getting the IDP Metadata + +{{% tabs %}} +{{% tab "Keycloak 5 and earlier" %}} +To get the IDP metadata, export a `metadata.xml` file from your Keycloak client. +From the **Installation** tab, choose the **SAML Metadata IDPSSODescriptor** format option and download your file. +{{% /tab %}} +{{% tab "Keycloak 6-13" %}} + +1. From the **Configure** section, click the **Realm Settings** tab. +1. Click the **General** tab. +1. From the **Endpoints** field, click **SAML 2.0 Identity Provider Metadata**. + +Verify the IDP metadata contains the following attributes: + +``` +xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" +xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" +xmlns:ds="http://www.w3.org/2000/09/xmldsig#" +``` + +Some browsers, such as Firefox, may render/process the document such that the contents appear to have been modified, and some attributes appear to be missing. In this situation, use the raw response data that can be found using your browser. + +The following is an example process for Firefox, but will vary slightly for other browsers: + +1. Press **F12** to access the developer console. +1. Click the **Network** tab. +1. From the table, click the row containing `descriptor`. +1. From the details pane, click the **Response** tab. +1. Copy the raw response data. + +The XML obtained contains `EntitiesDescriptor` as the root element. Rancher expects the root element to be `EntityDescriptor` rather than `EntitiesDescriptor`. So before passing this XML to Rancher, follow these steps to adjust it: + +1. Copy all the attributes from `EntitiesDescriptor` to the `EntityDescriptor` that are not present. +1. Remove the `` tag from the beginning. +1. Remove the `` from the end of the xml. + +You are left with something similar as the example below: + +``` + +.... + +``` + +{{% /tab %}} +{{% tab "Keycloak 14+" %}} + +1. From the **Configure** section, click the **Realm Settings** tab. +1. Click the **General** tab. +1. From the **Endpoints** field, click **SAML 2.0 Identity Provider Metadata**. + +Verify the IDP metadata contains the following attributes: + +``` +xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" +xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" +xmlns:ds="http://www.w3.org/2000/09/xmldsig#" +``` + +Some browsers, such as Firefox, may render/process the document such that the contents appear to have been modified, and some attributes appear to be missing. In this situation, use the raw response data that can be found using your browser. + +The following is an example process for Firefox, but will vary slightly for other browsers: + +1. Press **F12** to access the developer console. +1. Click the **Network** tab. +1. From the table, click the row containing `descriptor`. +1. From the details pane, click the **Response** tab. +1. Copy the raw response data. + +{{% /tab %}} +{{% /tabs %}} ## Configuring Keycloak in Rancher diff --git a/content/rancher/v2.6/en/admin-settings/authentication/keycloak-saml/_index.md b/content/rancher/v2.6/en/admin-settings/authentication/keycloak-saml/_index.md index bd94b700d23..ca2952111fb 100644 --- a/content/rancher/v2.6/en/admin-settings/authentication/keycloak-saml/_index.md +++ b/content/rancher/v2.6/en/admin-settings/authentication/keycloak-saml/_index.md @@ -23,36 +23,87 @@ If your organization uses Keycloak Identity Provider (IdP) for user authenticati >1: Optionally, you can enable either one or both of these settings. >2: Rancher SAML metadata won't be generated until a SAML provider is configured and saved. - + {{< img "/img/rancher/keycloak/keycloak-saml-client-configuration.png" "">}} - + - In the new SAML client, create Mappers to expose the users fields - Add all "Builtin Protocol Mappers" {{< img "/img/rancher/keycloak/keycloak-saml-client-builtin-mappers.png" "">}} - Create a new "Group list" mapper to map the member attribute to a user's groups - {{< img "/img/rancher/keycloak/keycloak-saml-client-group-mapper.png" "">}} -- Export a `metadata.xml` file from your Keycloak client: - From the `Installation` tab, choose the `SAML Metadata IDPSSODescriptor` format option and download your file. - - >**Note** - > Keycloak versions 6.0.0 and up no longer provide the IDP metadata under the `Installation` tab. - > You can still get the XML from the following url: - > - > `https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}/protocol/saml/descriptor` - > - > The XML obtained from this URL contains `EntitiesDescriptor` as the root element. Rancher expects the root element to be `EntityDescriptor` rather than `EntitiesDescriptor`. So before passing this XML to Rancher, follow these steps to adjust it: - > - > * Copy all the attributes from `EntitiesDescriptor` to the `EntityDescriptor` that are not present. - > * Remove the `` tag from the beginning. - > * Remove the `` from the end of the xml. - > - > You are left with something similar as the example below: - > - > ``` - > - > .... - > - > ``` + {{< img "/img/rancher/keycloak/keycloak-saml-client-group-mapper.png" "">}} + +## Getting the IDP Metadata + +{{% tabs %}} +{{% tab "Keycloak 5 and earlier" %}} +To get the IDP metadata, export a `metadata.xml` file from your Keycloak client. +From the **Installation** tab, choose the **SAML Metadata IDPSSODescriptor** format option and download your file. +{{% /tab %}} +{{% tab "Keycloak 6-13" %}} + +1. From the **Configure** section, click the **Realm Settings** tab. +1. Click the **General** tab. +1. From the **Endpoints** field, click **SAML 2.0 Identity Provider Metadata**. + +Verify the IDP metadata contains the following attributes: + +``` +xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" +xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" +xmlns:ds="http://www.w3.org/2000/09/xmldsig#" +``` + +Some browsers, such as Firefox, may render/process the document such that the contents appear to have been modified, and some attributes appear to be missing. In this situation, use the raw response data that can be found using your browser. + +The following is an example process for Firefox, but will vary slightly for other browsers: + +1. Press **F12** to access the developer console. +1. Click the **Network** tab. +1. From the table, click the row containing `descriptor`. +1. From the details pane, click the **Response** tab. +1. Copy the raw response data. + +The XML obtained contains `EntitiesDescriptor` as the root element. Rancher expects the root element to be `EntityDescriptor` rather than `EntitiesDescriptor`. So before passing this XML to Rancher, follow these steps to adjust it: + +1. Copy all the attributes from `EntitiesDescriptor` to the `EntityDescriptor` that are not present. +1. Remove the `` tag from the beginning. +1. Remove the `` from the end of the xml. + +You are left with something similar as the example below: + +``` + +.... + +``` + +{{% /tab %}} +{{% tab "Keycloak 14+" %}} + +1. From the **Configure** section, click the **Realm Settings** tab. +1. Click the **General** tab. +1. From the **Endpoints** field, click **SAML 2.0 Identity Provider Metadata**. + +Verify the IDP metadata contains the following attributes: + +``` +xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" +xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" +xmlns:ds="http://www.w3.org/2000/09/xmldsig#" +``` + +Some browsers, such as Firefox, may render/process the document such that the contents appear to have been modified, and some attributes appear to be missing. In this situation, use the raw response data that can be found using your browser. + +The following is an example process for Firefox, but will vary slightly for other browsers: + +1. Press **F12** to access the developer console. +1. Click the **Network** tab. +1. From the table, click the row containing `descriptor`. +1. From the details pane, click the **Response** tab. +1. Copy the raw response data. + +{{% /tab %}} +{{% /tabs %}} ## Configuring Keycloak in Rancher From 40aa2ced730725b032dff4adbabab8d3d12e282b Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 9 Mar 2022 10:03:14 -0500 Subject: [PATCH 301/478] Added clarifying note on quota behavior in Rancher UI --- .../resource-quotas/quotas-for-projects/_index.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/rancher/v2.6/en/project-admin/resource-quotas/quotas-for-projects/_index.md b/content/rancher/v2.6/en/project-admin/resource-quotas/quotas-for-projects/_index.md index 8b6d3cdf3c8..7e2aaf3e869 100644 --- a/content/rancher/v2.6/en/project-admin/resource-quotas/quotas-for-projects/_index.md +++ b/content/rancher/v2.6/en/project-admin/resource-quotas/quotas-for-projects/_index.md @@ -32,12 +32,12 @@ In the following diagram, a Rancher administrator wants to apply a resource quot Rancher: Resource Quotas Propagating to Each Namespace ![Rancher Resource Quota Implementation]({{}}/img/rancher/rancher-resource-quota.png) -Let's highlight some more nuanced functionality. If a quota is deleted at the project level, it will also be removed from all namespaces contained within that project, despite any overrides that may exist. Further, updating an existing namespace default limit for a quota at the project level will not result in that value being propagated to existing namespaces in the project; the updated value will only be applied to newly created namespaces in that project. To update a namespace default limit for existing namespaces you can delete and subsequently recreate the quota at the project level with the new default value. This will result in the new default value being applied to all existing namespaces in the project. +Let's highlight some more nuanced functionality for namespaces created **_within_** the Rancher UI. If a quota is deleted at the project level, it will also be removed from all namespaces contained within that project, despite any overrides that may exist. Further, updating an existing namespace default limit for a quota at the project level will not result in that value being propagated to existing namespaces in the project; the updated value will only be applied to newly created namespaces in that project. To update a namespace default limit for existing namespaces you can delete and subsequently recreate the quota at the project level with the new default value. This will result in the new default value being applied to all existing namespaces in the project. -Before creating a namespace in a project, Rancher compares the amounts of the project's available resources and requested resources (regardless of whether they come from the default or overriden limits). +Before creating a namespace in a project, Rancher compares the amounts of the project's available resources and requested resources, regardless of whether they come from the default or overridden limits. If the requested resources exceed the remaining capacity in the project for those resources, Rancher will assign the namespace the remaining capacity for that resource. -However, this is not the case with namespaces created outside of Rancher's UI. For namespaces created via `kubectl`, Rancher +However, this is not the case with namespaces created **_outside_** of Rancher's UI. For namespaces created via `kubectl`, Rancher will assign a resource quota that has a **zero** amount for any resource that requested more capacity than what remains in the project. To create a namespace in an existing project via `kubectl`, use the `field.cattle.io/projectId` annotation. To override the default From e2c49984f1d053985321e63d74a44e906a686437 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Wed, 9 Mar 2022 15:59:41 -0800 Subject: [PATCH 302/478] Update API link and page name --- content/rancher/v2.6/en/api/_index.md | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/api/_index.md b/content/rancher/v2.6/en/api/_index.md index a4b56bd9478..d6f903d0bdd 100644 --- a/content/rancher/v2.6/en/api/_index.md +++ b/content/rancher/v2.6/en/api/_index.md @@ -5,7 +5,22 @@ weight: 24 ## How to use the API -The API has its own user interface accessible from a web browser. This is an easy way to see resources, perform actions, and see the equivalent cURL or HTTP request & response. To access it, click on your user avatar in the upper right corner. Under **API & Keys**, you can find the URL endpoint (`https:///v3`) as well as create [API keys]({{}}/rancher/v2.6/en/user-settings/api-keys/). +The API has its own user interface accessible from a web browser. This is an easy way to see resources, perform actions, and see the equivalent cURL or HTTP request & response. To access it: + +{{% tabs %}} +{{% tab % "Rancher v2.6.4+" %}} + +1. Click on your user avatar in the upper right corner. +1. Click **Account & API Keys**. +1. Under the **API Keys** section, find the **API Endpoint** field and click the link. The link will look something like `https:///v3`, where `` is the fully qualified domain name of your Rancher deployment. + +{{% /tab %}} +{{% tab "Rancher before v2.6.4" %}} + +Go to the URL endpoint at `https:///v3`, where `` is the fully qualified domain name of your Rancher deployment. + +{{% /tab %}} +{{% /tabs %}} ## Authentication From a33d971fbab70cf389ce188d24dadaa0dd43262e Mon Sep 17 00:00:00 2001 From: Alex Seymour <9771530+axeal@users.noreply.github.com> Date: Fri, 11 Mar 2022 10:53:58 +0100 Subject: [PATCH 303/478] Fix no_proxy to noProxy for rancher chart value is noProxy (per https://github.com/rancher/rancher/blob/v2.6.3/chart/values.yaml#L89 and https://rancher.com/docs/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/), this is correct in v2.5 doc at https://rancher.com/docs/rancher/v2.5/en/installation/other-installation-methods/behind-proxy/install-rancher/ --- .../behind-proxy/install-rancher/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md index ae9faf9304b..35ceaf1b26a 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md @@ -65,7 +65,7 @@ helm upgrade --install rancher rancher-latest/rancher \ --namespace cattle-system \ --set hostname=rancher.example.com \ --set proxy=http://${proxy_host} - --set no_proxy=127.0.0.0/8\\,10.0.0.0/8\\,cattle-system.svc\\,172.16.0.0/12\\,192.168.0.0/16\\,.svc\\,.cluster.local + --set noProxy=127.0.0.0/8\\,10.0.0.0/8\\,cattle-system.svc\\,172.16.0.0/12\\,192.168.0.0/16\\,.svc\\,.cluster.local ``` After waiting for the deployment to finish: From ee11131a03a47544ff617b606656f93ce72bdde7 Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Fri, 11 Mar 2022 14:05:05 +0100 Subject: [PATCH 304/478] Replace jq command with jsonpath tempalte in kubectl --- .../en/security/hardening-guides/1.6-hardening-2.6/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md index 4e410880842..53d7cdb3edb 100644 --- a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md +++ b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md @@ -98,7 +98,7 @@ Create a bash script file called `account_update.sh`. Be sure to `chmod +x accou ```bash #!/bin/bash -e -for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do +for namespace in $(kubectl get namespaces -A -o=jsonpath="{.items[*]['metadata.name']}"); do kubectl patch serviceaccount default -n ${namespace} -p "$(cat account_update.yaml)" done ``` @@ -137,7 +137,7 @@ Create a bash script file called `apply_networkPolicy_to_all_ns.sh`. Be sure to ```bash #!/bin/bash -e -for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do +for namespace in $(kubectl get namespaces -A -o=jsonpath="{.items[*]['metadata.name']}"); do kubectl apply -f default-allow-all.yaml -n ${namespace} done ``` From 05bf4245929572eb331a12d88f124b4a544b1eb7 Mon Sep 17 00:00:00 2001 From: Alex Seymour <9771530+axeal@users.noreply.github.com> Date: Fri, 11 Mar 2022 14:08:49 +0100 Subject: [PATCH 305/478] Update local_cluster_auth_endpoint ca_certs Clarify format of ca_certs field in local_cluster_auth_endpoint to prevent confusion with double base 64 encoding --- .../editing-clusters/rke-config-reference/_index.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke-config-reference/_index.md b/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke-config-reference/_index.md index 0f0c03d67f2..27e73a4c408 100644 --- a/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke-config-reference/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke-config-reference/_index.md @@ -341,7 +341,10 @@ Example: local_cluster_auth_endpoint: enabled: true fqdn: "FQDN" - ca_certs: "BASE64_CACERT" + ca_certs: |- + -----BEGIN CERTIFICATE----- + ... + -----END CERTIFICATE----- ``` ### Custom Network Plug-in From 6f801b8cc3678cc876634a190ce143db7ddba335 Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Fri, 11 Mar 2022 16:02:45 +0100 Subject: [PATCH 306/478] Add extra configurations for tls-cipher-suites --- .../1.6-hardening-2.6/_index.md | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md index 53d7cdb3edb..9ec9b5338dd 100644 --- a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md +++ b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md @@ -205,6 +205,7 @@ services: image: "" extra_args: feature-gates: RotateKubeletServerCertificate=true + tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 extra_binds: [] extra_env: [] win_extra_args: {} @@ -214,7 +215,8 @@ services: service_cluster_ip_range: "" scheduler: image: "" - extra_args: {} + extra_args: + tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 extra_binds: [] extra_env: [] win_extra_args: {} @@ -224,7 +226,7 @@ services: image: "" extra_args: feature-gates: RotateKubeletServerCertificate=true - protect-kernel-defaults: "true" + protect-kernel-defaults: true tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 extra_binds: [] extra_env: [] @@ -525,6 +527,9 @@ rancher_kubernetes_engine_config: # cluster_dns_server: 10.43.0.10 # services: + scheduler: + extra_args: + tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 etcd: backup_config: enabled: true @@ -550,15 +555,15 @@ rancher_kubernetes_engine_config: secrets_encryption_config: enabled: true service_node_port_range: 30000-32767 - kube_controller: + kube-controller: extra_args: feature-gates: RotateKubeletServerCertificate=true + tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 kubelet: extra_args: feature-gates: RotateKubeletServerCertificate=true - protect-kernel-defaults: 'true' - tls-cipher-suites: >- - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 + protect-kernel-defaults: true + tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 fail_swap_on: false generate_serving_certificate: true ssh_agent_auth: false From 226f8334d0b5a82b03b2f3a7fe6422b3ddf5535a Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 11 Mar 2022 17:50:01 -0500 Subject: [PATCH 307/478] Created new section for RKE1 v. RKE2 difference highlights --- .../_index.md | 28 +++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md new file mode 100644 index 00000000000..28db222307d --- /dev/null +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md @@ -0,0 +1,28 @@ +--- +title: Behavior Differences Between RKE1 and RKE2 +weight: 2450 +--- + +RKE2, also known as RKE Government, is a Kubernetes distribution that focuses on security and compliance for U.S. Federal Government entities. It is considered the next iteration of the Rancher Kubernetes Engine, now known as RKE1. + +RKE1 and RKE2 have several slight behavioral differences to note, and this page will highlight some of these at a high level. + +### Control Plane Components + +RKE1 uses Docker for deploying and managing control plane components and the container runtime for Kubernetes. By contrast, RKE2 launches control plane components such as static pods that are managed by the kubelet. RKE2's container runtime is containerd, which allows things such as container registry mirroring (RKE1 with Docker does not). + +### Cluster API + +RKE2/K3s V2 provisioning is built on top of the Cluster API (CAPI) upstream framework which often makes RKE2-provisioned clusters behave differently than RKE1-provisioned clusters. + +When you make changes to your cluster configuration in RKE2, this may result in nodes reprovisioning. This is controlled by CAPI controllers and not by Rancher itself. Note that for etcd nodes, the same behavior does not apply. + +Users who are used to RKE1 provisioning should take note of this new RKE2 behavior which may be unexpected. + +### Terminology + +You will notice that some terms have changed or gone away going from RKE1 to RKE2. For example, in RKE2, **node templates** have been deprecated, and you can confiugure your cluster nodes directly. Another example is that the term **node pool** in RKE1 is now known as **machine pool** in RKE2. + + + + From e155f2531b1885cbdf20b054ae3cb68fa7f87984 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 11 Mar 2022 18:22:57 -0500 Subject: [PATCH 308/478] Updated per feedback --- .../behavior-differences-between-rke1-and-rke2/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md index 28db222307d..e530f5abc17 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md @@ -13,7 +13,7 @@ RKE1 uses Docker for deploying and managing control plane components and the con ### Cluster API -RKE2/K3s V2 provisioning is built on top of the Cluster API (CAPI) upstream framework which often makes RKE2-provisioned clusters behave differently than RKE1-provisioned clusters. +RKE2/K3s provisioning is built on top of the Cluster API (CAPI) upstream framework which often makes RKE2-provisioned clusters behave differently than RKE1-provisioned clusters. When you make changes to your cluster configuration in RKE2, this may result in nodes reprovisioning. This is controlled by CAPI controllers and not by Rancher itself. Note that for etcd nodes, the same behavior does not apply. From 7cf2e83c27089160fcfeb6c0f78ef54cc95b767e Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 11 Mar 2022 18:25:08 -0500 Subject: [PATCH 309/478] Emphasizing reprovisioning may occur --- .../behavior-differences-between-rke1-and-rke2/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md index e530f5abc17..bc0e1134ec4 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md @@ -15,7 +15,7 @@ RKE1 uses Docker for deploying and managing control plane components and the con RKE2/K3s provisioning is built on top of the Cluster API (CAPI) upstream framework which often makes RKE2-provisioned clusters behave differently than RKE1-provisioned clusters. -When you make changes to your cluster configuration in RKE2, this may result in nodes reprovisioning. This is controlled by CAPI controllers and not by Rancher itself. Note that for etcd nodes, the same behavior does not apply. +When you make changes to your cluster configuration in RKE2, this **may** result in nodes reprovisioning. This is controlled by CAPI controllers and not by Rancher itself. Note that for etcd nodes, the same behavior does not apply. Users who are used to RKE1 provisioning should take note of this new RKE2 behavior which may be unexpected. From 2d252669a392ed444f6d8e9d61123abcaa373571 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 11 Mar 2022 18:36:11 -0500 Subject: [PATCH 310/478] Updated per feedback --- .../behavior-differences-between-rke1-and-rke2/_index.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md index bc0e1134ec4..94e2c64bfb4 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md @@ -17,6 +17,12 @@ RKE2/K3s provisioning is built on top of the Cluster API (CAPI) upstream framewo When you make changes to your cluster configuration in RKE2, this **may** result in nodes reprovisioning. This is controlled by CAPI controllers and not by Rancher itself. Note that for etcd nodes, the same behavior does not apply. +The following are some specific example configuration changes that may cause the described behavior: + +- When editing the cluster and enabling `drain before delete`, the existing control plane nodes and worker are deleted and new nodes are created. + +- When nodes are being provisioned, performing a scale down operation may result in both nodes getting deleted and a new one being provisioned. + Users who are used to RKE1 provisioning should take note of this new RKE2 behavior which may be unexpected. ### Terminology From a31e4e8eb9e058a097104640a5cb03edaf9f5851 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 11 Mar 2022 18:43:27 -0500 Subject: [PATCH 311/478] Updated per feedback --- .../behavior-differences-between-rke1-and-rke2/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md index 94e2c64bfb4..8b739dfed4a 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md @@ -21,7 +21,7 @@ The following are some specific example configuration changes that may cause the - When editing the cluster and enabling `drain before delete`, the existing control plane nodes and worker are deleted and new nodes are created. -- When nodes are being provisioned, performing a scale down operation may result in both nodes getting deleted and a new one being provisioned. +- When nodes are being provisioned, performing a scale down operation may, in some cases, result in both nodes getting deleted and a new one being provisioned. Users who are used to RKE1 provisioning should take note of this new RKE2 behavior which may be unexpected. From a2af488e27427eec7d3aa6c2dddc80dd08b55f12 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 11 Mar 2022 19:14:39 -0500 Subject: [PATCH 312/478] Updated note --- .../behavior-differences-between-rke1-and-rke2/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md index 8b739dfed4a..bce8acd8604 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md @@ -21,7 +21,7 @@ The following are some specific example configuration changes that may cause the - When editing the cluster and enabling `drain before delete`, the existing control plane nodes and worker are deleted and new nodes are created. -- When nodes are being provisioned, performing a scale down operation may, in some cases, result in both nodes getting deleted and a new one being provisioned. +- When nodes are being provisioned and a scale down operation is performed, rather than scaling down directly, nodes are deleted and new nodes are provisioned to reach the desired node count. Users who are used to RKE1 provisioning should take note of this new RKE2 behavior which may be unexpected. From 84d4555168bd0fb036ede33f35b799381d9dac01 Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Mon, 14 Mar 2022 00:08:38 +0100 Subject: [PATCH 313/478] Add steps to enable API Server audit logs Signed-off-by: Guilherme Macedo --- .../en/security/hardening_guide/_index.md | 49 ++++++++++++++++++- 1 file changed, 47 insertions(+), 2 deletions(-) diff --git a/content/k3s/latest/en/security/hardening_guide/_index.md b/content/k3s/latest/en/security/hardening_guide/_index.md index 829347a6c19..e22571f30ef 100644 --- a/content/k3s/latest/en/security/hardening_guide/_index.md +++ b/content/k3s/latest/en/security/hardening_guide/_index.md @@ -36,7 +36,7 @@ kernel.keys.root_maxbytes=25000000 ## Kubernetes Runtime Requirements -The runtime requirements to comply with the CIS Benchmark are centered around pod security (PSPs) and network policies. These are outlined in this section. K3s doesn't apply any default PSPs or network policies. However, K3s ships with a controller that is meant to apply a given set of network policies. By default, K3s runs with the `NodeRestriction` admission controller. To enable PSPs, add the following to the K3s start command: `--kube-apiserver-arg="enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount"`. This will have the effect of maintaining the `NodeRestriction` plugin as well as enabling the `PodSecurityPolicy`. +The runtime requirements to comply with the CIS Benchmark are centered around pod security (PSPs), network policies and API Server auditing logs. These are outlined in this section. K3s doesn't apply any default PSPs or network policies. However, K3s ships with a controller that is meant to apply a given set of network policies. By default, K3s runs with the `NodeRestriction` admission controller. To enable PSPs, add the following to the K3s start command: `--kube-apiserver-arg="enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount"`. This will have the effect of maintaining the `NodeRestriction` plugin as well as enabling the `PodSecurityPolicy`. The same happens with the API Server auditing logs, K3s doesn't enable them by default, so audit log configuration and audit policy must be created manually. ### Pod Security Policies @@ -371,6 +371,50 @@ spec: > **Note:** Operators must manage network policies as normal for additional namespaces that are created. +### API Server audit configuration + +CIS requirements 1.2.22 to 1.2.25 are related to configuring audit logs for the API Server. K3s doesn't create by default the log directory and audit policy, as auditing requirements are specific to each user's policies and environment. + +The log directory, ideally, must be created before starting K3s. A restrictive access permission is recommended to avoid leaking potential sensitive information. + +```bash +sudo mkdir -p -m 700 /var/lib/rancher/k3s/server/logs +``` + +A starter audit policy to log request metadata is provided below. The policy should be written to a file named `audit.yaml` in `/var/lib/rancher/k3s/server` directory. Detailed information about policy configuration for the API server can be found in the Kubernetes [documentation](https://kubernetes.io/docs/tasks/debug-application-cluster/audit/). + +```yaml +apiVersion: audit.k8s.io/v1 +kind: Policy +rules: +- level: Metadata +``` + +Both configurations must be passed as arguments to the API Server as: + +```bash +--kube-apiserver-arg='audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log' +--kube-apiserver-arg='audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml' +``` + +If the configurations are created after K3s is installed, they must be added to K3s' systemd service in `/etc/systemd/system/k3s.service`. + +```bash +ExecStart=/usr/local/bin/k3s \ + server \ + '--kube-apiserver-arg=audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log' \ + '--kube-apiserver-arg=audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml' \ +``` + +K3s must be restarted to load the new configuration. + +```bash +sudo systemctl daemon-reload +sudo systemctl restart k3s.service +``` + +Additional information about CIS requirements 1.2.22 to 1.2.25 is presented below. + ## Known Issues The following are controls that K3s currently does not pass by default. Each gap will be explained, along with a note clarifying whether it can be passed through manual operator intervention, or if it will be addressed in a future release of K3s. @@ -614,7 +658,8 @@ The command below is an example of how the outlined remediations can be applied k3s server \ --protect-kernel-defaults=true \ --secrets-encryption=true \ - --kube-apiserver-arg='audit-log-path=/var/lib/rancher/k3s/server/logs/audit-log' \ + --kube-apiserver-arg='audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log' \ + --kube-apiserver-arg='audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml' \ --kube-apiserver-arg='audit-log-maxage=30' \ --kube-apiserver-arg='audit-log-maxbackup=10' \ --kube-apiserver-arg='audit-log-maxsize=100' \ From 2e57f45960c7bce95c11cbef612dd2f45d8f73a5 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 14 Mar 2022 15:40:26 -0400 Subject: [PATCH 314/478] Added info on Harvester node driver ISO images --- content/rancher/v2.6/en/virtualization-admin/_index.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/content/rancher/v2.6/en/virtualization-admin/_index.md b/content/rancher/v2.6/en/virtualization-admin/_index.md index f37ffb8b951..e0152cded19 100644 --- a/content/rancher/v2.6/en/virtualization-admin/_index.md +++ b/content/rancher/v2.6/en/virtualization-admin/_index.md @@ -25,6 +25,10 @@ To navigate to the Harvester cluster, click **☰ > Virtualization Management**. The [Harvester node driver](https://docs.harvesterhci.io/v0.3/rancher/node-driver/) is marked as `tech preview` on RKE and RKE2 options in Rancher. This will be the case both on the Create page and once the driver is already enabled. The node driver is available whether or not the Harvester feature flag is enabled. Note that the node driver is off by default. Users may create RKE or RKE2 clusters on Harvester only from the Cluster Management page. +Starting in Rancher v2.6.4, Harvester allows `.ISO` images to be uploaded and displayed through the Harvester UI. + +>**Important:** When using Harvester node driver in Rancher, `.ISO` images are not displayed, by design, in the Rancher UI. This is because `.ISO` images usually require additional setup that interferes with a clean deployment (without requiring user intervention), and they are not typically used in cloud environments. + Click [here]({{}}/rancher/v2.6/en/admin-settings/drivers/#node-drivers) for more information on node drivers in Rancher. ### Limitations From 0c55d58f93ab07e5f37a4d4e5d0deda1e427fda9 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 14 Mar 2022 12:45:50 -0700 Subject: [PATCH 315/478] Fix typo --- content/rancher/v2.6/en/api/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/api/_index.md b/content/rancher/v2.6/en/api/_index.md index d6f903d0bdd..d1cc9cc4454 100644 --- a/content/rancher/v2.6/en/api/_index.md +++ b/content/rancher/v2.6/en/api/_index.md @@ -8,7 +8,7 @@ weight: 24 The API has its own user interface accessible from a web browser. This is an easy way to see resources, perform actions, and see the equivalent cURL or HTTP request & response. To access it: {{% tabs %}} -{{% tab % "Rancher v2.6.4+" %}} +{{% tab "Rancher v2.6.4+" %}} 1. Click on your user avatar in the upper right corner. 1. Click **Account & API Keys**. From 0712f2c7e0afe1c55d1dea706d30355803d40006 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 14 Mar 2022 17:21:15 -0400 Subject: [PATCH 316/478] Updated note per feedback --- content/rancher/v2.6/en/virtualization-admin/_index.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/content/rancher/v2.6/en/virtualization-admin/_index.md b/content/rancher/v2.6/en/virtualization-admin/_index.md index e0152cded19..19c517f7c3d 100644 --- a/content/rancher/v2.6/en/virtualization-admin/_index.md +++ b/content/rancher/v2.6/en/virtualization-admin/_index.md @@ -25,9 +25,7 @@ To navigate to the Harvester cluster, click **☰ > Virtualization Management**. The [Harvester node driver](https://docs.harvesterhci.io/v0.3/rancher/node-driver/) is marked as `tech preview` on RKE and RKE2 options in Rancher. This will be the case both on the Create page and once the driver is already enabled. The node driver is available whether or not the Harvester feature flag is enabled. Note that the node driver is off by default. Users may create RKE or RKE2 clusters on Harvester only from the Cluster Management page. -Starting in Rancher v2.6.4, Harvester allows `.ISO` images to be uploaded and displayed through the Harvester UI. - ->**Important:** When using Harvester node driver in Rancher, `.ISO` images are not displayed, by design, in the Rancher UI. This is because `.ISO` images usually require additional setup that interferes with a clean deployment (without requiring user intervention), and they are not typically used in cloud environments. +Harvester allows `.ISO` images to be uploaded and displayed through the Harvester UI, but this is not supported in the Rancher UI. This is because `.ISO` images usually require additional setup that interferes with a clean deployment (without requiring user intervention), and they are not typically used in cloud environments. Click [here]({{}}/rancher/v2.6/en/admin-settings/drivers/#node-drivers) for more information on node drivers in Rancher. From f5cb16986ae339e0dd612b872e40f81644850900 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 14 Mar 2022 18:15:23 -0400 Subject: [PATCH 317/478] Fixed typo --- .../behavior-differences-between-rke1-and-rke2/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md index bce8acd8604..28c8d0c741c 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md @@ -27,7 +27,7 @@ Users who are used to RKE1 provisioning should take note of this new RKE2 behavi ### Terminology -You will notice that some terms have changed or gone away going from RKE1 to RKE2. For example, in RKE2, **node templates** have been deprecated, and you can confiugure your cluster nodes directly. Another example is that the term **node pool** in RKE1 is now known as **machine pool** in RKE2. +You will notice that some terms have changed or gone away going from RKE1 to RKE2. For example, in RKE2, **node templates** have been deprecated, and you can configure your cluster nodes directly. Another example is that the term **node pool** in RKE1 is now known as **machine pool** in RKE2. From 34bb682d5f9d4247192d12d35af2d02ec3a15d36 Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Tue, 15 Mar 2022 15:56:02 +0100 Subject: [PATCH 318/478] Update hardening guide to add bind-address flag Signed-off-by: Guilherme Macedo --- ...her_v2-6_CIS_v1-6_Benchmark_Assessment.pdf | 9784 +++++++++-------- .../1.6-benchmark-2.6/_index.md | 232 +- .../Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf | 5010 +++++---- .../1.6-hardening-2.6/_index.md | 8 +- scripts/converters/scripts/results_to_md.sh | 2 +- 5 files changed, 7623 insertions(+), 7413 deletions(-) diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf b/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf index cba5bceac24..f08210f51e6 100644 --- a/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf +++ b/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf @@ -3,25 +3,25 @@ 1 0 obj << /Type /Pages -/Kids [ 6 0 R 8 0 R 38 0 R 76 0 R 114 0 R 152 0 R 186 0 R 222 0 R 258 0 R 292 0 R 304 0 R 309 0 R 313 0 R 315 0 R 318 0 R 321 0 R 345 0 R 370 0 R 403 0 R 436 0 R 460 0 R 499 0 R 505 0 R 508 0 R 511 0 R 514 0 R 516 0 R 519 0 R 521 0 R 524 0 R 527 0 R 529 0 R 532 0 R 534 0 R 537 0 R 540 0 R 542 0 R 545 0 R 547 0 R 550 0 R 553 0 R 555 0 R 559 0 R 562 0 R 565 0 R 567 0 R 570 0 R 572 0 R 575 0 R 577 0 R 580 0 R 583 0 R 585 0 R 588 0 R 591 0 R 593 0 R 596 0 R 598 0 R 601 0 R 604 0 R 606 0 R 609 0 R 611 0 R 614 0 R 617 0 R 619 0 R 622 0 R 624 0 R 627 0 R 630 0 R 632 0 R 635 0 R 637 0 R 640 0 R 643 0 R 645 0 R 667 0 R 676 0 R 679 0 R 683 0 R 686 0 R 689 0 R 692 0 R 694 0 R 698 0 R 700 0 R 703 0 R 705 0 R 708 0 R 710 0 R 713 0 R 715 0 R 718 0 R 720 0 R 722 0 R 725 0 R 727 0 R 730 0 R 732 0 R 735 0 R 737 0 R 739 0 R 741 0 R 744 0 R 746 0 R 749 0 R 753 0 R 762 0 R 770 0 R 772 0 R 777 0 R 782 0 R 788 0 R 792 0 R 796 0 R 802 0 R 806 0 R 810 0 R 813 0 R 815 0 R 840 0 R 851 0 R 854 0 R 858 0 R 861 0 R 878 0 R 885 0 R 887 0 R 889 0 R 891 0 R ] -/Count 130 +/Kids [ 6 0 R 8 0 R 38 0 R 76 0 R 114 0 R 152 0 R 186 0 R 222 0 R 258 0 R 292 0 R 304 0 R 309 0 R 313 0 R 315 0 R 318 0 R 323 0 R 325 0 R 349 0 R 374 0 R 407 0 R 440 0 R 464 0 R 503 0 R 508 0 R 511 0 R 514 0 R 516 0 R 519 0 R 521 0 R 524 0 R 527 0 R 529 0 R 532 0 R 534 0 R 537 0 R 540 0 R 542 0 R 545 0 R 548 0 R 550 0 R 553 0 R 555 0 R 559 0 R 562 0 R 565 0 R 567 0 R 570 0 R 572 0 R 575 0 R 578 0 R 580 0 R 583 0 R 586 0 R 588 0 R 591 0 R 593 0 R 596 0 R 599 0 R 601 0 R 604 0 R 607 0 R 609 0 R 612 0 R 614 0 R 617 0 R 620 0 R 622 0 R 625 0 R 627 0 R 630 0 R 633 0 R 635 0 R 638 0 R 641 0 R 643 0 R 660 0 R 674 0 R 677 0 R 680 0 R 683 0 R 686 0 R 689 0 R 692 0 R 694 0 R 698 0 R 700 0 R 703 0 R 705 0 R 708 0 R 710 0 R 713 0 R 715 0 R 717 0 R 720 0 R 722 0 R 725 0 R 727 0 R 730 0 R 732 0 R 734 0 R 737 0 R 739 0 R 741 0 R 743 0 R 746 0 R 748 0 R 751 0 R 755 0 R 764 0 R 772 0 R 774 0 R 779 0 R 784 0 R 790 0 R 794 0 R 798 0 R 804 0 R 808 0 R 812 0 R 815 0 R 817 0 R 842 0 R 853 0 R 856 0 R 860 0 R 863 0 R 880 0 R 887 0 R 889 0 R 891 0 R 893 0 R ] +/Count 131 >> endobj 2 0 obj << /Title (CIS v1.6 Benchmark - Self-Assessment Guide - Rancher v2.6) /Creator (pandoc) -/Producer (WeasyPrint 54.1) +/Producer (WeasyPrint 54.2) >> endobj 3 0 obj << /Type /Catalog /Pages 1 0 R -/Outlines 1053 0 R +/Outlines 1055 0 R /Names << /Dests << -/Names [ (TOC) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (api-server) [ 508 0 R /XYZ 41.740157 784.430079 0 ] (apply-security-context-to-your-pods-and-containers-manual) [ 889 0 R /XYZ 84.259843 324.051496 0 ] (authentication-and-authorization) [ 739 0 R /XYZ 41.740157 784.430079 0 ] (cb1) [ 315 0 R /XYZ 84.259843 207.170079 0 ] (cb1-1) [ 315 0 R /XYZ 101.433071 205.473057 0 ] (cb101) [ 624 0 R /XYZ 84.259843 715.370079 0 ] (cb101-1) [ 624 0 R /XYZ 101.433071 713.673057 0 ] (cb104) [ 627 0 R /XYZ 84.259843 241.820079 0 ] (cb104-1) [ 627 0 R /XYZ 101.433071 240.123057 0 ] (cb107) [ 632 0 R /XYZ 84.259843 463.070079 0 ] (cb107-1) [ 632 0 R /XYZ 101.433071 461.373057 0 ] (cb11) [ 436 0 R /XYZ 84.259843 543.320079 0 ] (cb11-1) [ 436 0 R /XYZ 101.433071 541.623057 0 ] (cb11-10) [ 436 0 R /XYZ 99.933071 333.205821 0 ] (cb11-11) [ 436 0 R /XYZ 99.933071 314.258799 0 ] (cb11-12) [ 436 0 R /XYZ 99.933071 295.311778 0 ] (cb11-13) [ 436 0 R /XYZ 99.933071 276.364756 0 ] (cb11-14) [ 436 0 R /XYZ 99.933071 257.417735 0 ] (cb11-15) [ 436 0 R /XYZ 99.933071 238.470714 0 ] (cb11-16) [ 436 0 R /XYZ 99.933071 219.523692 0 ] (cb11-17) [ 436 0 R /XYZ 99.933071 200.576671 0 ] (cb11-18) [ 436 0 R /XYZ 99.933071 181.629649 0 ] (cb11-19) [ 436 0 R /XYZ 99.933071 162.682628 0 ] (cb11-2) [ 436 0 R /XYZ 99.933071 522.676036 0 ] (cb11-20) [ 436 0 R /XYZ 99.933071 143.735606 0 ] (cb11-21) [ 436 0 R /XYZ 99.933071 124.788585 0 ] (cb11-22) [ 436 0 R /XYZ 99.933071 105.841563 0 ] (cb11-23) [ 460 0 R /XYZ 99.933071 799.173057 0 ] (cb11-24) [ 460 0 R /XYZ 99.933071 780.226036 0 ] (cb11-25) [ 460 0 R /XYZ 99.933071 761.279014 0 ] (cb11-26) [ 460 0 R /XYZ 99.933071 742.331993 0 ] (cb11-27) [ 460 0 R /XYZ 99.933071 723.384971 0 ] (cb11-28) [ 460 0 R /XYZ 99.933071 704.437950 0 ] (cb11-29) [ 460 0 R /XYZ 99.933071 685.490928 0 ] (cb11-3) [ 436 0 R /XYZ 99.933071 503.729014 0 ] (cb11-30) [ 460 0 R /XYZ 99.933071 666.543907 0 ] (cb11-31) [ 460 0 R /XYZ 99.933071 647.596885 0 ] (cb11-32) [ 460 0 R /XYZ 99.933071 628.649864 0 ] (cb11-33) [ 460 0 R /XYZ 99.933071 609.702842 0 ] (cb11-34) [ 460 0 R /XYZ 99.933071 590.755821 0 ] (cb11-35) [ 460 0 R /XYZ 99.933071 571.808799 0 ] (cb11-36) [ 460 0 R /XYZ 99.933071 552.861778 0 ] (cb11-37) [ 460 0 R /XYZ 99.933071 533.914756 0 ] (cb11-38) [ 460 0 R /XYZ 99.933071 514.967735 0 ] (cb11-39) [ 460 0 R /XYZ 99.933071 496.020714 0 ] (cb11-4) [ 436 0 R /XYZ 99.933071 465.834971 0 ] (cb11-40) [ 460 0 R /XYZ 99.933071 477.073692 0 ] (cb11-41) [ 460 0 R /XYZ 99.933071 458.126671 0 ] (cb11-42) [ 460 0 R /XYZ 99.933071 439.179649 0 ] (cb11-43) [ 460 0 R /XYZ 99.933071 420.232628 0 ] (cb11-44) [ 460 0 R /XYZ 99.933071 401.285606 0 ] (cb11-45) [ 460 0 R /XYZ 99.933071 382.338585 0 ] (cb11-46) [ 460 0 R /XYZ 99.933071 363.391563 0 ] (cb11-47) [ 460 0 R /XYZ 99.933071 344.444542 0 ] (cb11-48) [ 460 0 R /XYZ 99.933071 325.497520 0 ] (cb11-49) [ 460 0 R /XYZ 99.933071 306.550499 0 ] (cb11-5) [ 436 0 R /XYZ 99.933071 427.940928 0 ] (cb11-50) [ 460 0 R /XYZ 99.933071 287.603477 0 ] (cb11-51) [ 460 0 R /XYZ 99.933071 268.656456 0 ] (cb11-52) [ 460 0 R /XYZ 99.933071 249.709434 0 ] (cb11-53) [ 460 0 R /XYZ 99.933071 211.815391 0 ] (cb11-54) [ 460 0 R /XYZ 99.933071 192.868370 0 ] (cb11-55) [ 460 0 R /XYZ 99.933071 173.921348 0 ] (cb11-56) [ 460 0 R /XYZ 99.933071 154.974327 0 ] (cb11-57) [ 460 0 R /XYZ 99.933071 136.027305 0 ] (cb11-58) [ 460 0 R /XYZ 99.933071 117.080284 0 ] (cb11-59) [ 460 0 R /XYZ 99.933071 98.133262 0 ] (cb11-6) [ 436 0 R /XYZ 99.933071 408.993907 0 ] (cb11-60) [ 499 0 R /XYZ 99.933071 799.173057 0 ] (cb11-61) [ 499 0 R /XYZ 99.933071 780.226036 0 ] (cb11-7) [ 436 0 R /XYZ 99.933071 390.046885 0 ] (cb11-8) [ 436 0 R /XYZ 99.933071 371.099864 0 ] (cb11-9) [ 436 0 R /XYZ 99.933071 352.152842 0 ] (cb110) [ 637 0 R /XYZ 84.259843 715.370079 0 ] (cb110-1) [ 637 0 R /XYZ 101.433071 713.673057 0 ] (cb113) [ 640 0 R /XYZ 84.259843 241.820079 0 ] (cb113-1) [ 640 0 R /XYZ 101.433071 240.123057 0 ] (cb116) [ 645 0 R /XYZ 84.259843 511.820079 0 ] (cb116-1) [ 645 0 R /XYZ 101.433071 510.123057 0 ] (cb116-10) [ 645 0 R /XYZ 99.933071 282.758799 0 ] (cb116-11) [ 645 0 R /XYZ 99.933071 263.811778 0 ] (cb116-12) [ 645 0 R /XYZ 99.933071 244.864756 0 ] (cb116-13) [ 645 0 R /XYZ 99.933071 225.917735 0 ] (cb116-14) [ 645 0 R /XYZ 99.933071 206.970714 0 ] (cb116-15) [ 645 0 R /XYZ 99.933071 188.023692 0 ] (cb116-16) [ 645 0 R /XYZ 99.933071 169.076671 0 ] (cb116-17) [ 645 0 R /XYZ 99.933071 150.129649 0 ] (cb116-18) [ 645 0 R /XYZ 99.933071 131.182628 0 ] (cb116-19) [ 645 0 R /XYZ 99.933071 112.235606 0 ] (cb116-2) [ 645 0 R /XYZ 99.933071 491.176036 0 ] (cb116-20) [ 645 0 R /XYZ 99.933071 93.288585 0 ] (cb116-21) [ 667 0 R /XYZ 99.933071 799.173057 0 ] (cb116-22) [ 667 0 R /XYZ 99.933071 780.226036 0 ] (cb116-23) [ 667 0 R /XYZ 99.933071 761.279014 0 ] (cb116-24) [ 667 0 R /XYZ 99.933071 742.331993 0 ] (cb116-25) [ 667 0 R /XYZ 99.933071 723.384971 0 ] (cb116-3) [ 645 0 R /XYZ 99.933071 472.229014 0 ] (cb116-4) [ 645 0 R /XYZ 99.933071 434.334971 0 ] (cb116-5) [ 645 0 R /XYZ 99.933071 415.387950 0 ] (cb116-6) [ 645 0 R /XYZ 99.933071 396.440928 0 ] (cb116-7) [ 645 0 R /XYZ 99.933071 377.493907 0 ] (cb116-8) [ 645 0 R /XYZ 99.933071 358.546885 0 ] (cb116-9) [ 645 0 R /XYZ 99.933071 320.652842 0 ] (cb117) [ 667 0 R /XYZ 84.259843 664.134971 0 ] (cb117-1) [ 667 0 R /XYZ 101.433071 662.437950 0 ] (cb12) [ 499 0 R /XYZ 84.259843 720.976036 0 ] (cb12-1) [ 499 0 R /XYZ 101.433071 719.279014 0 ] (cb120) [ 667 0 R /XYZ 84.259843 290.887950 0 ] (cb120-1) [ 667 0 R /XYZ 101.433071 289.190928 0 ] (cb121) [ 676 0 R /XYZ 84.259843 550.251496 0 ] (cb121-1) [ 676 0 R /XYZ 101.433071 548.554475 0 ] (cb124) [ 679 0 R /XYZ 84.259843 715.370079 0 ] (cb124-1) [ 679 0 R /XYZ 101.433071 713.673057 0 ] (cb127) [ 679 0 R /XYZ 84.259843 162.123057 0 ] (cb127-1) [ 679 0 R /XYZ 101.433071 160.426036 0 ] (cb130) [ 683 0 R /XYZ 84.259843 325.820079 0 ] (cb130-1) [ 683 0 R /XYZ 101.433071 324.123057 0 ] (cb133) [ 686 0 R /XYZ 84.259843 500.570079 0 ] (cb133-1) [ 686 0 R /XYZ 101.433071 498.873057 0 ] (cb136) [ 689 0 R /XYZ 84.259843 441.170079 0 ] (cb136-1) [ 689 0 R /XYZ 101.433071 439.473057 0 ] (cb139) [ 694 0 R /XYZ 84.259843 565.251496 0 ] (cb139-1) [ 694 0 R /XYZ 101.433071 563.554475 0 ] (cb142) [ 694 0 R /XYZ 84.259843 214.504475 0 ] (cb142-1) [ 694 0 R /XYZ 101.433071 212.807453 0 ] (cb145) [ 700 0 R /XYZ 84.259843 514.251496 0 ] (cb145-1) [ 700 0 R /XYZ 101.433071 512.554475 0 ] (cb148) [ 705 0 R /XYZ 84.259843 403.070079 0 ] (cb148-1) [ 705 0 R /XYZ 101.433071 401.373057 0 ] (cb15) [ 499 0 R /XYZ 84.259843 392.729014 0 ] (cb15-1) [ 499 0 R /XYZ 101.433071 391.031993 0 ] (cb151) [ 710 0 R /XYZ 84.259843 290.570079 0 ] (cb151-1) [ 710 0 R /XYZ 101.433071 288.873057 0 ] (cb154) [ 715 0 R /XYZ 84.259843 148.070079 0 ] (cb154-1) [ 715 0 R /XYZ 101.433071 146.373057 0 ] (cb157) [ 722 0 R /XYZ 84.259843 715.370079 0 ] (cb157-1) [ 722 0 R /XYZ 101.433071 713.673057 0 ] (cb160) [ 727 0 R /XYZ 84.259843 571.820079 0 ] (cb160-1) [ 727 0 R /XYZ 101.433071 570.123057 0 ] (cb163) [ 732 0 R /XYZ 84.259843 425.570079 0 ] (cb163-1) [ 732 0 R /XYZ 101.433071 423.873057 0 ] (cb166) [ 741 0 R /XYZ 84.259843 595.251496 0 ] (cb166-1) [ 741 0 R /XYZ 101.433071 593.554475 0 ] (cb169) [ 746 0 R /XYZ 84.259843 267.651496 0 ] (cb169-1) [ 746 0 R /XYZ 101.433071 265.954475 0 ] (cb172) [ 749 0 R /XYZ 84.259843 607.820079 0 ] (cb172-1) [ 749 0 R /XYZ 101.433071 606.123057 0 ] (cb174) [ 749 0 R /XYZ 84.259843 298.679014 0 ] (cb174-1) [ 749 0 R /XYZ 101.433071 296.981993 0 ] (cb176) [ 753 0 R /XYZ 84.259843 715.370079 0 ] (cb176-1) [ 753 0 R /XYZ 101.433071 713.673057 0 ] (cb179) [ 753 0 R /XYZ 84.259843 375.479014 0 ] (cb179-1) [ 753 0 R /XYZ 101.433071 373.781993 0 ] (cb179-2) [ 753 0 R /XYZ 99.933071 354.834971 0 ] (cb179-3) [ 753 0 R /XYZ 99.933071 335.887950 0 ] (cb179-4) [ 753 0 R /XYZ 99.933071 279.046885 0 ] (cb179-5) [ 753 0 R /XYZ 99.933071 260.099864 0 ] (cb18) [ 505 0 R /XYZ 84.259843 715.370079 0 ] (cb18-1) [ 505 0 R /XYZ 101.433071 713.673057 0 ] (cb180) [ 753 0 R /XYZ 84.259843 200.849864 0 ] (cb180-1) [ 753 0 R /XYZ 101.433071 199.152842 0 ] (cb182) [ 762 0 R /XYZ 84.259843 655.220079 0 ] (cb182-1) [ 762 0 R /XYZ 101.433071 653.523057 0 ] (cb182-2) [ 762 0 R /XYZ 99.933071 634.576036 0 ] (cb182-3) [ 762 0 R /XYZ 99.933071 615.629014 0 ] (cb182-4) [ 762 0 R /XYZ 99.933071 558.787950 0 ] (cb182-5) [ 762 0 R /XYZ 99.933071 539.840928 0 ] (cb183) [ 762 0 R /XYZ 84.259843 480.590928 0 ] (cb183-1) [ 762 0 R /XYZ 101.433071 478.893907 0 ] (cb185) [ 772 0 R /XYZ 84.259843 490.251496 0 ] (cb185-1) [ 772 0 R /XYZ 101.433071 488.554475 0 ] (cb186) [ 772 0 R /XYZ 84.259843 429.304475 0 ] (cb186-1) [ 772 0 R /XYZ 101.433071 427.607453 0 ] (cb188) [ 772 0 R /XYZ 84.259843 116.807453 0 ] (cb188-1) [ 772 0 R /XYZ 101.433071 115.110432 0 ] (cb189) [ 777 0 R /XYZ 84.259843 772.370079 0 ] (cb189-1) [ 777 0 R /XYZ 101.433071 770.673057 0 ] (cb191) [ 777 0 R /XYZ 84.259843 459.873057 0 ] (cb191-1) [ 777 0 R /XYZ 101.433071 458.176036 0 ] (cb192) [ 777 0 R /XYZ 84.259843 398.926036 0 ] (cb192-1) [ 777 0 R /XYZ 101.433071 397.229014 0 ] (cb194) [ 782 0 R /XYZ 84.259843 799.370079 0 ] (cb194-1) [ 782 0 R /XYZ 101.433071 797.673057 0 ] (cb195) [ 782 0 R /XYZ 84.259843 738.423057 0 ] (cb195-1) [ 782 0 R /XYZ 101.433071 736.726036 0 ] (cb197) [ 782 0 R /XYZ 84.259843 410.926036 0 ] (cb197-1) [ 782 0 R /XYZ 101.433071 409.229014 0 ] (cb198) [ 782 0 R /XYZ 84.259843 349.979014 0 ] (cb198-1) [ 782 0 R /XYZ 101.433071 348.281993 0 ] (cb2) [ 318 0 R /XYZ 84.259843 730.370079 0 ] (cb2-1) [ 318 0 R /XYZ 101.433071 728.673057 0 ] (cb201) [ 788 0 R /XYZ 84.259843 230.570079 0 ] (cb201-1) [ 788 0 R /XYZ 101.433071 228.873057 0 ] (cb202) [ 788 0 R /XYZ 84.259843 169.623057 0 ] (cb202-1) [ 788 0 R /XYZ 101.433071 167.926036 0 ] (cb204) [ 792 0 R /XYZ 84.259843 583.970079 0 ] (cb204-1) [ 792 0 R /XYZ 101.433071 582.273057 0 ] (cb205) [ 792 0 R /XYZ 84.259843 523.023057 0 ] (cb205-1) [ 792 0 R /XYZ 101.433071 521.326036 0 ] (cb207) [ 796 0 R /XYZ 84.259843 700.370079 0 ] (cb207-1) [ 796 0 R /XYZ 101.433071 698.673057 0 ] (cb208) [ 796 0 R /XYZ 84.259843 639.423057 0 ] (cb208-1) [ 796 0 R /XYZ 101.433071 637.726036 0 ] (cb21) [ 508 0 R /XYZ 84.259843 565.251496 0 ] (cb21-1) [ 508 0 R /XYZ 101.433071 563.554475 0 ] (cb210) [ 796 0 R /XYZ 84.259843 296.926036 0 ] (cb210-1) [ 796 0 R /XYZ 101.433071 295.229014 0 ] (cb211) [ 796 0 R /XYZ 84.259843 235.979014 0 ] (cb211-1) [ 796 0 R /XYZ 101.433071 234.281993 0 ] (cb213) [ 802 0 R /XYZ 84.259843 640.370079 0 ] (cb213-1) [ 802 0 R /XYZ 101.433071 638.673057 0 ] (cb214) [ 802 0 R /XYZ 84.259843 579.423057 0 ] (cb214-1) [ 802 0 R /XYZ 101.433071 577.726036 0 ] (cb217) [ 806 0 R /XYZ 84.259843 428.570079 0 ] (cb217-1) [ 806 0 R /XYZ 101.433071 426.873057 0 ] (cb218) [ 806 0 R /XYZ 84.259843 131.823057 0 ] (cb218-1) [ 806 0 R /XYZ 101.433071 130.126036 0 ] (cb219) [ 810 0 R /XYZ 84.259843 799.370079 0 ] (cb219-1) [ 810 0 R /XYZ 101.433071 797.673057 0 ] (cb221) [ 815 0 R /XYZ 84.259843 768.620079 0 ] (cb221-1) [ 815 0 R /XYZ 101.433071 766.923057 0 ] (cb221-10) [ 815 0 R /XYZ 99.933071 596.399864 0 ] (cb221-11) [ 815 0 R /XYZ 99.933071 577.452842 0 ] (cb221-12) [ 815 0 R /XYZ 99.933071 482.717735 0 ] (cb221-13) [ 815 0 R /XYZ 99.933071 463.770714 0 ] (cb221-14) [ 815 0 R /XYZ 99.933071 444.823692 0 ] (cb221-15) [ 815 0 R /XYZ 99.933071 425.876671 0 ] (cb221-16) [ 815 0 R /XYZ 99.933071 406.929649 0 ] (cb221-17) [ 815 0 R /XYZ 99.933071 387.982628 0 ] (cb221-18) [ 815 0 R /XYZ 99.933071 350.088585 0 ] (cb221-19) [ 815 0 R /XYZ 99.933071 331.141563 0 ] (cb221-2) [ 815 0 R /XYZ 99.933071 747.976036 0 ] (cb221-20) [ 815 0 R /XYZ 99.933071 198.512413 0 ] (cb221-21) [ 815 0 R /XYZ 99.933071 179.565391 0 ] (cb221-22) [ 815 0 R /XYZ 99.933071 160.618370 0 ] (cb221-23) [ 815 0 R /XYZ 99.933071 103.777305 0 ] (cb221-24) [ 840 0 R /XYZ 99.933071 799.173057 0 ] (cb221-25) [ 840 0 R /XYZ 99.933071 780.226036 0 ] (cb221-26) [ 840 0 R /XYZ 99.933071 761.279014 0 ] (cb221-27) [ 840 0 R /XYZ 99.933071 742.331993 0 ] (cb221-28) [ 840 0 R /XYZ 99.933071 723.384971 0 ] (cb221-29) [ 840 0 R /XYZ 99.933071 704.437950 0 ] (cb221-3) [ 815 0 R /XYZ 99.933071 729.029014 0 ] (cb221-30) [ 840 0 R /XYZ 99.933071 685.490928 0 ] (cb221-31) [ 840 0 R /XYZ 99.933071 666.543907 0 ] (cb221-4) [ 815 0 R /XYZ 99.933071 710.081993 0 ] (cb221-5) [ 815 0 R /XYZ 99.933071 691.134971 0 ] (cb221-6) [ 815 0 R /XYZ 99.933071 672.187950 0 ] (cb221-7) [ 815 0 R /XYZ 99.933071 653.240928 0 ] (cb221-8) [ 815 0 R /XYZ 99.933071 634.293907 0 ] (cb221-9) [ 815 0 R /XYZ 99.933071 615.346885 0 ] (cb222) [ 840 0 R /XYZ 84.259843 607.293907 0 ] (cb222-1) [ 840 0 R /XYZ 101.433071 605.596885 0 ] (cb225) [ 851 0 R /XYZ 84.259843 434.451496 0 ] (cb225-1) [ 851 0 R /XYZ 101.433071 432.754475 0 ] (cb228) [ 854 0 R /XYZ 84.259843 799.370079 0 ] (cb228-1) [ 854 0 R /XYZ 101.433071 797.673057 0 ] (cb231) [ 854 0 R /XYZ 84.259843 448.229014 0 ] (cb231-1) [ 854 0 R /XYZ 101.433071 446.531993 0 ] (cb234) [ 858 0 R /XYZ 84.259843 799.370079 0 ] (cb234-1) [ 858 0 R /XYZ 101.433071 797.673057 0 ] (cb237) [ 861 0 R /XYZ 84.259843 394.701496 0 ] (cb237-1) [ 861 0 R /XYZ 101.433071 393.004475 0 ] (cb237-10) [ 861 0 R /XYZ 99.933071 222.481281 0 ] (cb237-11) [ 861 0 R /XYZ 99.933071 203.534260 0 ] (cb237-12) [ 861 0 R /XYZ 99.933071 165.640217 0 ] (cb237-13) [ 861 0 R /XYZ 99.933071 127.746174 0 ] (cb237-14) [ 861 0 R /XYZ 99.933071 108.799152 0 ] (cb237-15) [ 861 0 R /XYZ 99.933071 89.852131 0 ] (cb237-16) [ 878 0 R /XYZ 99.933071 799.173057 0 ] (cb237-17) [ 878 0 R /XYZ 99.933071 780.226036 0 ] (cb237-18) [ 878 0 R /XYZ 99.933071 761.279014 0 ] (cb237-19) [ 878 0 R /XYZ 99.933071 742.331993 0 ] (cb237-2) [ 861 0 R /XYZ 99.933071 374.057453 0 ] (cb237-3) [ 861 0 R /XYZ 99.933071 355.110432 0 ] (cb237-4) [ 861 0 R /XYZ 99.933071 336.163410 0 ] (cb237-5) [ 861 0 R /XYZ 99.933071 317.216389 0 ] (cb237-6) [ 861 0 R /XYZ 99.933071 298.269367 0 ] (cb237-7) [ 861 0 R /XYZ 99.933071 279.322346 0 ] (cb237-8) [ 861 0 R /XYZ 99.933071 260.375324 0 ] (cb237-9) [ 861 0 R /XYZ 99.933071 241.428303 0 ] (cb238) [ 878 0 R /XYZ 84.259843 683.081993 0 ] (cb238-1) [ 878 0 R /XYZ 101.433071 681.384971 0 ] (cb24) [ 511 0 R /XYZ 84.259843 106.820079 0 ] (cb24-1) [ 511 0 R /XYZ 101.433071 105.123057 0 ] (cb241) [ 891 0 R /XYZ 84.259843 768.620079 0 ] (cb241-1) [ 891 0 R /XYZ 101.433071 766.923057 0 ] (cb241-10) [ 891 0 R /XYZ 99.933071 596.399864 0 ] (cb241-11) [ 891 0 R /XYZ 99.933071 577.452842 0 ] (cb241-12) [ 891 0 R /XYZ 99.933071 520.611778 0 ] (cb241-13) [ 891 0 R /XYZ 99.933071 501.664756 0 ] (cb241-14) [ 891 0 R /XYZ 99.933071 482.717735 0 ] (cb241-15) [ 891 0 R /XYZ 99.933071 463.770714 0 ] (cb241-16) [ 891 0 R /XYZ 99.933071 444.823692 0 ] (cb241-17) [ 891 0 R /XYZ 99.933071 425.876671 0 ] (cb241-18) [ 891 0 R /XYZ 99.933071 406.929649 0 ] (cb241-2) [ 891 0 R /XYZ 99.933071 747.976036 0 ] (cb241-3) [ 891 0 R /XYZ 99.933071 729.029014 0 ] (cb241-4) [ 891 0 R /XYZ 99.933071 710.081993 0 ] (cb241-5) [ 891 0 R /XYZ 99.933071 691.134971 0 ] (cb241-6) [ 891 0 R /XYZ 99.933071 672.187950 0 ] (cb241-7) [ 891 0 R /XYZ 99.933071 653.240928 0 ] (cb241-8) [ 891 0 R /XYZ 99.933071 634.293907 0 ] (cb241-9) [ 891 0 R /XYZ 99.933071 615.346885 0 ] (cb242) [ 891 0 R /XYZ 84.259843 347.679649 0 ] (cb242-1) [ 891 0 R /XYZ 101.433071 345.982628 0 ] (cb27) [ 516 0 R /XYZ 84.259843 388.070079 0 ] (cb27-1) [ 516 0 R /XYZ 101.433071 386.373057 0 ] (cb3) [ 321 0 R /XYZ 84.259843 509.420079 0 ] (cb3-1) [ 321 0 R /XYZ 101.433071 507.723057 0 ] (cb3-10) [ 321 0 R /XYZ 99.933071 318.252842 0 ] (cb3-11) [ 321 0 R /XYZ 99.933071 299.305821 0 ] (cb3-12) [ 321 0 R /XYZ 99.933071 280.358799 0 ] (cb3-13) [ 321 0 R /XYZ 99.933071 261.411778 0 ] (cb3-14) [ 321 0 R /XYZ 99.933071 242.464756 0 ] (cb3-15) [ 321 0 R /XYZ 99.933071 223.517735 0 ] (cb3-16) [ 321 0 R /XYZ 99.933071 204.570714 0 ] (cb3-17) [ 321 0 R /XYZ 99.933071 185.623692 0 ] (cb3-18) [ 321 0 R /XYZ 99.933071 166.676671 0 ] (cb3-19) [ 321 0 R /XYZ 99.933071 147.729649 0 ] (cb3-2) [ 321 0 R /XYZ 99.933071 488.776036 0 ] (cb3-20) [ 321 0 R /XYZ 99.933071 128.782628 0 ] (cb3-21) [ 321 0 R /XYZ 99.933071 109.835606 0 ] (cb3-22) [ 321 0 R /XYZ 99.933071 90.888585 0 ] (cb3-23) [ 345 0 R /XYZ 99.933071 799.173057 0 ] (cb3-24) [ 345 0 R /XYZ 99.933071 780.226036 0 ] (cb3-25) [ 345 0 R /XYZ 99.933071 761.279014 0 ] (cb3-26) [ 345 0 R /XYZ 99.933071 742.331993 0 ] (cb3-27) [ 345 0 R /XYZ 99.933071 723.384971 0 ] (cb3-28) [ 345 0 R /XYZ 99.933071 704.437950 0 ] (cb3-29) [ 345 0 R /XYZ 99.933071 685.490928 0 ] (cb3-3) [ 321 0 R /XYZ 99.933071 469.829014 0 ] (cb3-30) [ 345 0 R /XYZ 99.933071 666.543907 0 ] (cb3-31) [ 345 0 R /XYZ 99.933071 647.596885 0 ] (cb3-32) [ 345 0 R /XYZ 99.933071 628.649864 0 ] (cb3-33) [ 345 0 R /XYZ 99.933071 609.702842 0 ] (cb3-34) [ 345 0 R /XYZ 99.933071 590.755821 0 ] (cb3-35) [ 345 0 R /XYZ 99.933071 571.808799 0 ] (cb3-36) [ 345 0 R /XYZ 99.933071 552.861778 0 ] (cb3-37) [ 345 0 R /XYZ 99.933071 533.914756 0 ] (cb3-38) [ 345 0 R /XYZ 99.933071 514.967735 0 ] (cb3-39) [ 345 0 R /XYZ 99.933071 496.020714 0 ] (cb3-4) [ 321 0 R /XYZ 99.933071 431.934971 0 ] (cb3-40) [ 345 0 R /XYZ 99.933071 477.073692 0 ] (cb3-41) [ 345 0 R /XYZ 99.933071 458.126671 0 ] (cb3-42) [ 345 0 R /XYZ 99.933071 439.179649 0 ] (cb3-43) [ 345 0 R /XYZ 99.933071 420.232628 0 ] (cb3-44) [ 345 0 R /XYZ 99.933071 401.285606 0 ] (cb3-5) [ 321 0 R /XYZ 99.933071 412.987950 0 ] (cb3-6) [ 321 0 R /XYZ 99.933071 394.040928 0 ] (cb3-7) [ 321 0 R /XYZ 99.933071 375.093907 0 ] (cb3-8) [ 321 0 R /XYZ 99.933071 356.146885 0 ] (cb3-9) [ 321 0 R /XYZ 99.933071 337.199864 0 ] (cb30) [ 521 0 R /XYZ 84.259843 643.970079 0 ] (cb30-1) [ 521 0 R /XYZ 101.433071 642.273057 0 ] (cb33) [ 524 0 R /XYZ 84.259843 136.820079 0 ] (cb33-1) [ 524 0 R /XYZ 101.433071 135.123057 0 ] (cb36) [ 529 0 R /XYZ 84.259843 358.070079 0 ] (cb36-1) [ 529 0 R /XYZ 101.433071 356.373057 0 ] (cb39) [ 534 0 R /XYZ 84.259843 628.970079 0 ] (cb39-1) [ 534 0 R /XYZ 101.433071 627.273057 0 ] (cb4) [ 345 0 R /XYZ 84.259843 342.035606 0 ] (cb4-1) [ 345 0 R /XYZ 101.433071 340.338585 0 ] (cb42) [ 537 0 R /XYZ 84.259843 181.820079 0 ] (cb42-1) [ 537 0 R /XYZ 101.433071 180.123057 0 ] (cb45) [ 542 0 R /XYZ 84.259843 463.070079 0 ] (cb45-1) [ 542 0 R /XYZ 101.433071 461.373057 0 ] (cb48) [ 547 0 R /XYZ 84.259843 715.370079 0 ] (cb48-1) [ 547 0 R /XYZ 101.433071 713.673057 0 ] (cb51) [ 550 0 R /XYZ 84.259843 181.820079 0 ] (cb51-1) [ 550 0 R /XYZ 101.433071 180.123057 0 ] (cb54) [ 555 0 R /XYZ 84.259843 350.570079 0 ] (cb54-1) [ 555 0 R /XYZ 101.433071 348.873057 0 ] (cb55) [ 555 0 R /XYZ 84.259843 113.823057 0 ] (cb55-1) [ 555 0 R /XYZ 101.433071 112.126036 0 ] (cb56) [ 559 0 R /XYZ 84.259843 613.970079 0 ] (cb56-1) [ 559 0 R /XYZ 101.433071 612.273057 0 ] (cb59) [ 562 0 R /XYZ 84.259843 144.320079 0 ] (cb59-1) [ 562 0 R /XYZ 101.433071 142.623057 0 ] (cb62) [ 567 0 R /XYZ 84.259843 358.070079 0 ] (cb62-1) [ 567 0 R /XYZ 101.433071 356.373057 0 ] (cb65) [ 572 0 R /XYZ 84.259843 508.070079 0 ] (cb65-1) [ 572 0 R /XYZ 101.433071 506.373057 0 ] (cb68) [ 577 0 R /XYZ 84.259843 715.370079 0 ] (cb68-1) [ 577 0 R /XYZ 101.433071 713.673057 0 ] (cb7) [ 370 0 R /XYZ 84.259843 711.620079 0 ] (cb7-1) [ 370 0 R /XYZ 101.433071 709.923057 0 ] (cb7-10) [ 370 0 R /XYZ 99.933071 501.505821 0 ] (cb7-11) [ 370 0 R /XYZ 99.933071 482.558799 0 ] (cb7-12) [ 370 0 R /XYZ 99.933071 463.611778 0 ] (cb7-13) [ 370 0 R /XYZ 99.933071 444.664756 0 ] (cb7-14) [ 370 0 R /XYZ 99.933071 425.717735 0 ] (cb7-15) [ 370 0 R /XYZ 99.933071 406.770714 0 ] (cb7-16) [ 370 0 R /XYZ 99.933071 387.823692 0 ] (cb7-17) [ 370 0 R /XYZ 99.933071 368.876671 0 ] (cb7-18) [ 370 0 R /XYZ 99.933071 349.929649 0 ] (cb7-19) [ 370 0 R /XYZ 99.933071 330.982628 0 ] (cb7-2) [ 370 0 R /XYZ 99.933071 690.976036 0 ] (cb7-20) [ 370 0 R /XYZ 99.933071 312.035606 0 ] (cb7-21) [ 370 0 R /XYZ 99.933071 293.088585 0 ] (cb7-22) [ 370 0 R /XYZ 99.933071 274.141563 0 ] (cb7-23) [ 370 0 R /XYZ 99.933071 255.194542 0 ] (cb7-24) [ 370 0 R /XYZ 99.933071 236.247520 0 ] (cb7-25) [ 370 0 R /XYZ 99.933071 217.300499 0 ] (cb7-26) [ 370 0 R /XYZ 99.933071 198.353477 0 ] (cb7-27) [ 370 0 R /XYZ 99.933071 179.406456 0 ] (cb7-28) [ 370 0 R /XYZ 99.933071 160.459434 0 ] (cb7-29) [ 370 0 R /XYZ 99.933071 141.512413 0 ] (cb7-3) [ 370 0 R /XYZ 99.933071 672.029014 0 ] (cb7-30) [ 370 0 R /XYZ 99.933071 122.565391 0 ] (cb7-31) [ 370 0 R /XYZ 99.933071 103.618370 0 ] (cb7-32) [ 403 0 R /XYZ 99.933071 799.173057 0 ] (cb7-33) [ 403 0 R /XYZ 99.933071 780.226036 0 ] (cb7-34) [ 403 0 R /XYZ 99.933071 761.279014 0 ] (cb7-35) [ 403 0 R /XYZ 99.933071 742.331993 0 ] (cb7-36) [ 403 0 R /XYZ 99.933071 723.384971 0 ] (cb7-37) [ 403 0 R /XYZ 99.933071 704.437950 0 ] (cb7-38) [ 403 0 R /XYZ 99.933071 685.490928 0 ] (cb7-39) [ 403 0 R /XYZ 99.933071 666.543907 0 ] (cb7-4) [ 370 0 R /XYZ 99.933071 634.134971 0 ] (cb7-40) [ 403 0 R /XYZ 99.933071 647.596885 0 ] (cb7-41) [ 403 0 R /XYZ 99.933071 628.649864 0 ] (cb7-42) [ 403 0 R /XYZ 99.933071 609.702842 0 ] (cb7-43) [ 403 0 R /XYZ 99.933071 590.755821 0 ] (cb7-44) [ 403 0 R /XYZ 99.933071 571.808799 0 ] (cb7-45) [ 403 0 R /XYZ 99.933071 552.861778 0 ] (cb7-46) [ 403 0 R /XYZ 99.933071 533.914756 0 ] (cb7-47) [ 403 0 R /XYZ 99.933071 514.967735 0 ] (cb7-48) [ 403 0 R /XYZ 99.933071 496.020714 0 ] (cb7-49) [ 403 0 R /XYZ 99.933071 477.073692 0 ] (cb7-5) [ 370 0 R /XYZ 99.933071 596.240928 0 ] (cb7-50) [ 403 0 R /XYZ 99.933071 458.126671 0 ] (cb7-51) [ 403 0 R /XYZ 99.933071 439.179649 0 ] (cb7-52) [ 403 0 R /XYZ 99.933071 420.232628 0 ] (cb7-53) [ 403 0 R /XYZ 99.933071 382.338585 0 ] (cb7-54) [ 403 0 R /XYZ 99.933071 363.391563 0 ] (cb7-55) [ 403 0 R /XYZ 99.933071 344.444542 0 ] (cb7-56) [ 403 0 R /XYZ 99.933071 325.497520 0 ] (cb7-57) [ 403 0 R /XYZ 99.933071 306.550499 0 ] (cb7-58) [ 403 0 R /XYZ 99.933071 287.603477 0 ] (cb7-59) [ 403 0 R /XYZ 99.933071 268.656456 0 ] (cb7-6) [ 370 0 R /XYZ 99.933071 577.293907 0 ] (cb7-60) [ 403 0 R /XYZ 99.933071 249.709434 0 ] (cb7-61) [ 403 0 R /XYZ 99.933071 230.762413 0 ] (cb7-7) [ 370 0 R /XYZ 99.933071 558.346885 0 ] (cb7-8) [ 370 0 R /XYZ 99.933071 539.399864 0 ] (cb7-9) [ 370 0 R /XYZ 99.933071 520.452842 0 ] (cb71) [ 580 0 R /XYZ 84.259843 271.820079 0 ] (cb71-1) [ 580 0 R /XYZ 101.433071 270.123057 0 ] (cb74) [ 585 0 R /XYZ 84.259843 538.070079 0 ] (cb74-1) [ 585 0 R /XYZ 101.433071 536.373057 0 ] (cb77) [ 588 0 R /XYZ 84.259843 103.070079 0 ] (cb77-1) [ 588 0 R /XYZ 101.433071 101.373057 0 ] (cb8) [ 403 0 R /XYZ 84.259843 171.512413 0 ] (cb8-1) [ 403 0 R /XYZ 101.433071 169.815391 0 ] (cb80) [ 593 0 R /XYZ 84.259843 373.070079 0 ] (cb80-1) [ 593 0 R /XYZ 101.433071 371.373057 0 ] (cb83) [ 598 0 R /XYZ 84.259843 628.970079 0 ] (cb83-1) [ 598 0 R /XYZ 101.433071 627.273057 0 ] (cb86) [ 601 0 R /XYZ 84.259843 181.820079 0 ] (cb86-1) [ 601 0 R /XYZ 101.433071 180.123057 0 ] (cb89) [ 606 0 R /XYZ 84.259843 463.070079 0 ] (cb89-1) [ 606 0 R /XYZ 101.433071 461.373057 0 ] (cb92) [ 611 0 R /XYZ 84.259843 715.370079 0 ] (cb92-1) [ 611 0 R /XYZ 101.433071 713.673057 0 ] (cb95) [ 614 0 R /XYZ 84.259843 223.070079 0 ] (cb95-1) [ 614 0 R /XYZ 101.433071 221.373057 0 ] (cb98) [ 619 0 R /XYZ 84.259843 463.070079 0 ] (cb98-1) [ 619 0 R /XYZ 101.433071 461.373057 0 ] (cis-v1.6-kubernetes-benchmark---rancher-v2.6-with-kubernetes-v1.18-to-v1.21) [ 304 0 R /XYZ 84.259843 784.970079 0 ] (client-certificate-authentication-should-not-be-used-for-users-manual) [ 739 0 R /XYZ 84.259843 684.651496 0 ] (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) [ 887 0 R /XYZ 84.259843 684.651496 0 ] (consider-external-secret-storage-manual) [ 885 0 R /XYZ 84.259843 568.851496 0 ] (contentsbox) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (controller-manager) [ 676 0 R /XYZ 41.740157 784.430079 0 ] (controls) [ 309 0 R /XYZ 84.259843 608.631496 0 ] (create-administrative-boundaries-between-resources-using-namespaces-manual) [ 889 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-a-minimal-audit-policy-is-created-automated) [ 741 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated) [ 732 0 R /XYZ 84.259843 595.970079 0 ] (ensure-that-all-namespaces-have-network-policies-defined-automated) [ 861 0 R /XYZ 84.259843 538.851496 0 ] (ensure-that-default-service-accounts-are-not-actively-used.-automated) [ 813 0 R /XYZ 84.259843 206.451496 0 ] (ensure-that-encryption-providers-are-appropriately-configured-automated) [ 645 0 R /XYZ 84.259843 670.970079 0 ] (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) [ 840 0 R /XYZ 84.259843 449.446885 0 ] (ensure-that-the---anonymous-auth-argument-is-set-to-false-automated) [ 508 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated) [ 598 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated) [ 601 0 R /XYZ 84.259843 352.220079 0 ] (ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated) [ 606 0 R /XYZ 84.259843 633.470079 0 ] (ensure-that-the---audit-log-path-argument-is-set-automated) [ 593 0 R /XYZ 84.259843 558.470079 0 ] (ensure-that-the---authorization-mode-argument-includes-node-automated) [ 537 0 R /XYZ 84.259843 352.220079 0 ] (ensure-that-the---authorization-mode-argument-includes-rbac-automated) [ 542 0 R /XYZ 84.259843 633.470079 0 ] (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated) [ 534 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) [ 772 0 R /XYZ 84.259843 332.207453 0 ] (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) [ 710 0 R /XYZ 84.259843 445.970079 0 ] (ensure-that-the---basic-auth-file-argument-is-not-set-automated) [ 511 0 R /XYZ 84.259843 277.220079 0 ] (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) [ 689 0 R /XYZ 84.259843 596.570079 0 ] (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) [ 694 0 R /XYZ 84.259843 369.904475 0 ] (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) [ 700 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) [ 632 0 R /XYZ 84.259843 633.470079 0 ] (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) [ 777 0 R /XYZ 84.259843 675.273057 0 ] (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) [ 705 0 R /XYZ 84.259843 558.470079 0 ] (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) [ 640 0 R /XYZ 84.259843 427.220079 0 ] (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) [ 635 0 R /XYZ 84.259843 183.470079 0 ] (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) [ 622 0 R /XYZ 84.259843 183.470079 0 ] (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-automated) [ 792 0 R /XYZ 84.259843 208.126036 0 ] (ensure-that-the---hostname-override-argument-is-not-set-manual) [ 792 0 R /XYZ 84.259843 425.926036 0 ] (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) [ 575 0 R /XYZ 84.259843 145.970079 0 ] (ensure-that-the---insecure-port-argument-is-set-to-0-automated) [ 580 0 R /XYZ 84.259843 427.220079 0 ] (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) [ 749 0 R /XYZ 84.259843 163.687950 0 ] (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 749 0 R /XYZ 84.259843 454.079014 0 ] (ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated) [ 529 0 R /XYZ 84.259843 558.470079 0 ] (ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated) [ 524 0 R /XYZ 84.259843 352.220079 0 ] (ensure-that-the---kubelet-https-argument-is-set-to-true-automated) [ 521 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) [ 792 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) [ 727 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) [ 715 0 R /XYZ 84.259843 333.470079 0 ] (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) [ 720 0 R /XYZ 84.259843 183.470079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated) [ 588 0 R /XYZ 84.259843 258.470079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated-1) [ 676 0 R /XYZ 84.259843 167.404475 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated-2) [ 694 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) [ 788 0 R /XYZ 84.259843 445.970079 0 ] (ensure-that-the---read-only-port-argument-is-set-to-0-automated) [ 777 0 R /XYZ 84.259843 301.829014 0 ] (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) [ 609 0 R /XYZ 84.259843 183.470079 0 ] (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) [ 686 0 R /XYZ 84.259843 670.970079 0 ] (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated) [ 796 0 R /XYZ 84.259843 138.881993 0 ] (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) [ 585 0 R /XYZ 84.259843 708.470079 0 ] (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) [ 619 0 R /XYZ 84.259843 633.470079 0 ] (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) [ 614 0 R /XYZ 84.259843 408.470079 0 ] (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) [ 683 0 R /XYZ 84.259843 511.220079 0 ] (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) [ 782 0 R /XYZ 84.259843 641.326036 0 ] (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) [ 676 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) [ 627 0 R /XYZ 84.259843 427.220079 0 ] (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) [ 796 0 R /XYZ 84.259843 542.326036 0 ] (ensure-that-the---token-auth-file-parameter-is-not-set-automated) [ 516 0 R /XYZ 84.259843 558.470079 0 ] (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) [ 679 0 R /XYZ 84.259843 332.523057 0 ] (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) [ 318 0 R /XYZ 84.259843 578.223057 0 ] (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 318 0 R /XYZ 84.259843 694.023057 0 ] (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) [ 550 0 R /XYZ 84.259843 352.220079 0 ] (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) [ 555 0 R /XYZ 84.259843 520.970079 0 ] (ensure-that-the-admission-control-plugin-eventratelimit-is-set-automated) [ 545 0 R /XYZ 84.259843 183.470079 0 ] (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) [ 562 0 R /XYZ 84.259843 314.720079 0 ] (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) [ 572 0 R /XYZ 84.259843 708.470079 0 ] (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) [ 567 0 R /XYZ 84.259843 558.470079 0 ] (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) [ 555 0 R /XYZ 84.259843 314.223057 0 ] (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) [ 559 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) [ 772 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated) [ 667 0 R /XYZ 84.259843 506.287950 0 ] (ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 313 0 R /XYZ 84.259843 553.851496 0 ] (ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 313 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-audit-policy-covers-key-security-concerns-manual) [ 744 0 R /XYZ 84.259843 314.720079 0 ] (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 753 0 R /XYZ 84.259843 519.629014 0 ] (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) [ 762 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) [ 813 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-cni-in-use-supports-network-policies-manual) [ 861 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-container-network-interface-file-ownership-is-set-to-rootroot-manual) [ 315 0 R /XYZ 84.259843 170.823057 0 ] (ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual) [ 315 0 R /XYZ 84.259843 347.570079 0 ] (ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 313 0 R /XYZ 84.259843 277.251496 0 ] (ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 313 0 R /XYZ 84.259843 423.051496 0 ] (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) [ 321 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 318 0 R /XYZ 84.259843 200.823057 0 ] (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) [ 499 0 R /XYZ 84.259843 234.881993 0 ] (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) [ 499 0 R /XYZ 84.259843 563.129014 0 ] (ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 315 0 R /XYZ 84.259843 478.370079 0 ] (ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 315 0 R /XYZ 84.259843 609.170079 0 ] (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) [ 762 0 R /XYZ 84.259843 383.493907 0 ] (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) [ 762 0 R /XYZ 84.259843 195.693907 0 ] (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-automated) [ 806 0 R /XYZ 84.259843 392.223057 0 ] (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) [ 746 0 R /XYZ 84.259843 553.851496 0 ] (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 746 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 345 0 R /XYZ 84.259843 184.188585 0 ] (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) [ 321 0 R /XYZ 84.259843 668.570079 0 ] (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated) [ 436 0 R /XYZ 84.259843 702.470079 0 ] (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-automated) [ 749 0 R /XYZ 84.259843 763.220079 0 ] (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) [ 689 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 315 0 R /XYZ 84.259843 739.970079 0 ] (ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 313 0 R /XYZ 84.259843 146.451496 0 ] (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) [ 318 0 R /XYZ 84.259843 331.623057 0 ] (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 318 0 R /XYZ 84.259843 462.423057 0 ] (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) [ 889 0 R /XYZ 84.259843 604.851496 0 ] (etcd-node-configuration-files) [ 700 0 R /XYZ 41.740157 784.430079 0 ] (extensible-admission-control) [ 887 0 R /XYZ 41.740157 784.430079 0 ] (general-policies) [ 889 0 R /XYZ 41.740157 784.430079 0 ] (header_bottom_text) [ 6 0 R /XYZ 85.009843 392.718898 0 ] (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-automated) [ 746 0 R /XYZ 84.259843 423.051496 0 ] (kubelet) [ 772 0 R /XYZ 41.740157 784.430079 0 ] (logging) [ 741 0 R /XYZ 41.740157 784.430079 0 ] (master-node-configuration-files) [ 313 0 R /XYZ 41.740157 784.430079 0 ] (minimize-access-to-create-pods-manual) [ 813 0 R /XYZ 84.259843 307.251496 0 ] (minimize-access-to-secrets-manual) [ 813 0 R /XYZ 84.259843 523.851496 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) [ 851 0 R /XYZ 84.259843 238.710432 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) [ 854 0 R /XYZ 84.259843 603.629014 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) [ 851 0 R /XYZ 84.259843 589.851496 0 ] (minimize-the-admission-of-containers-with-added-capabilities-manual) [ 858 0 R /XYZ 84.259843 323.081993 0 ] (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) [ 854 0 R /XYZ 84.259843 252.487950 0 ] (minimize-the-admission-of-containers-with-capabilities-assigned-manual) [ 858 0 R /XYZ 84.259843 207.281993 0 ] (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) [ 858 0 R /XYZ 84.259843 453.881993 0 ] (minimize-the-admission-of-privileged-containers-manual) [ 851 0 R /XYZ 84.259843 720.651496 0 ] (minimize-the-admission-of-root-containers-manual) [ 858 0 R /XYZ 84.259843 584.681993 0 ] (minimize-wildcard-use-in-roles-and-clusterroles-manual) [ 813 0 R /XYZ 84.259843 423.051496 0 ] (network-policies-and-cni) [ 861 0 R /XYZ 41.740157 784.430079 0 ] (overview) [ 304 0 R /XYZ 84.259843 704.822079 0 ] (pod-security-policies) [ 851 0 R /XYZ 41.740157 784.430079 0 ] (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) [ 885 0 R /XYZ 84.259843 684.651496 0 ] (rbac-and-service-accounts) [ 813 0 R /XYZ 41.740157 784.430079 0 ] (scheduler) [ 694 0 R /XYZ 41.740157 784.430079 0 ] (secrets-management) [ 885 0 R /XYZ 41.740157 784.430079 0 ] (testing-controls-methodology) [ 304 0 R /XYZ 84.259843 166.076079 0 ] (the-default-namespace-should-not-be-used-automated) [ 889 0 R /XYZ 84.259843 193.251496 0 ] (title-block-header) [ 6 0 R /XYZ 84.259843 502.818898 0 ] (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) [ 806 0 R /XYZ 84.259843 670.970079 0 ] (worker-node-configuration-files) [ 746 0 R /XYZ 41.740157 784.430079 0 ] ] +/Names [ (TOC) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (api-server) [ 508 0 R /XYZ 41.740157 784.430079 0 ] (apply-security-context-to-your-pods-and-containers-manual) [ 891 0 R /XYZ 84.259843 324.051496 0 ] (authentication-and-authorization) [ 741 0 R /XYZ 41.740157 784.430079 0 ] (cb1) [ 315 0 R /XYZ 84.259843 207.170079 0 ] (cb1-1) [ 315 0 R /XYZ 101.433071 205.473057 0 ] (cb10) [ 349 0 R /XYZ 84.259843 342.035606 0 ] (cb10-1) [ 349 0 R /XYZ 101.433071 340.338585 0 ] (cb101) [ 622 0 R /XYZ 84.259843 504.320079 0 ] (cb101-1) [ 622 0 R /XYZ 101.433071 502.623057 0 ] (cb104) [ 627 0 R /XYZ 84.259843 772.370079 0 ] (cb104-1) [ 627 0 R /XYZ 101.433071 770.673057 0 ] (cb107) [ 630 0 R /XYZ 84.259843 313.070079 0 ] (cb107-1) [ 630 0 R /XYZ 101.433071 311.373057 0 ] (cb110) [ 635 0 R /XYZ 84.259843 560.570079 0 ] (cb110-1) [ 635 0 R /XYZ 101.433071 558.873057 0 ] (cb113) [ 638 0 R /XYZ 84.259843 110.570079 0 ] (cb113-1) [ 638 0 R /XYZ 101.433071 108.873057 0 ] (cb116) [ 643 0 R /XYZ 84.259843 418.070079 0 ] (cb116-1) [ 643 0 R /XYZ 101.433071 416.373057 0 ] (cb116-10) [ 643 0 R /XYZ 99.933071 189.008799 0 ] (cb116-11) [ 643 0 R /XYZ 99.933071 170.061778 0 ] (cb116-12) [ 643 0 R /XYZ 99.933071 151.114756 0 ] (cb116-13) [ 643 0 R /XYZ 99.933071 132.167735 0 ] (cb116-14) [ 643 0 R /XYZ 99.933071 113.220714 0 ] (cb116-15) [ 643 0 R /XYZ 99.933071 94.273692 0 ] (cb116-16) [ 660 0 R /XYZ 99.933071 799.173057 0 ] (cb116-17) [ 660 0 R /XYZ 99.933071 780.226036 0 ] (cb116-18) [ 660 0 R /XYZ 99.933071 761.279014 0 ] (cb116-19) [ 660 0 R /XYZ 99.933071 742.331993 0 ] (cb116-2) [ 643 0 R /XYZ 99.933071 397.426036 0 ] (cb116-20) [ 660 0 R /XYZ 99.933071 723.384971 0 ] (cb116-21) [ 660 0 R /XYZ 99.933071 704.437950 0 ] (cb116-22) [ 660 0 R /XYZ 99.933071 685.490928 0 ] (cb116-23) [ 660 0 R /XYZ 99.933071 666.543907 0 ] (cb116-24) [ 660 0 R /XYZ 99.933071 647.596885 0 ] (cb116-25) [ 660 0 R /XYZ 99.933071 628.649864 0 ] (cb116-3) [ 643 0 R /XYZ 99.933071 378.479014 0 ] (cb116-4) [ 643 0 R /XYZ 99.933071 340.584971 0 ] (cb116-5) [ 643 0 R /XYZ 99.933071 321.637950 0 ] (cb116-6) [ 643 0 R /XYZ 99.933071 302.690928 0 ] (cb116-7) [ 643 0 R /XYZ 99.933071 283.743907 0 ] (cb116-8) [ 643 0 R /XYZ 99.933071 264.796885 0 ] (cb116-9) [ 643 0 R /XYZ 99.933071 226.902842 0 ] (cb117) [ 660 0 R /XYZ 84.259843 569.399864 0 ] (cb117-1) [ 660 0 R /XYZ 101.433071 567.702842 0 ] (cb120) [ 660 0 R /XYZ 84.259843 196.152842 0 ] (cb120-1) [ 660 0 R /XYZ 101.433071 194.455821 0 ] (cb121) [ 674 0 R /XYZ 84.259843 550.251496 0 ] (cb121-1) [ 674 0 R /XYZ 101.433071 548.554475 0 ] (cb124) [ 677 0 R /XYZ 84.259843 571.820079 0 ] (cb124-1) [ 677 0 R /XYZ 101.433071 570.123057 0 ] (cb127) [ 680 0 R /XYZ 84.259843 575.570079 0 ] (cb127-1) [ 680 0 R /XYZ 101.433071 573.873057 0 ] (cb13) [ 374 0 R /XYZ 84.259843 711.620079 0 ] (cb13-1) [ 374 0 R /XYZ 101.433071 709.923057 0 ] (cb13-10) [ 374 0 R /XYZ 99.933071 501.505821 0 ] (cb13-11) [ 374 0 R /XYZ 99.933071 482.558799 0 ] (cb13-12) [ 374 0 R /XYZ 99.933071 463.611778 0 ] (cb13-13) [ 374 0 R /XYZ 99.933071 444.664756 0 ] (cb13-14) [ 374 0 R /XYZ 99.933071 425.717735 0 ] (cb13-15) [ 374 0 R /XYZ 99.933071 406.770714 0 ] (cb13-16) [ 374 0 R /XYZ 99.933071 387.823692 0 ] (cb13-17) [ 374 0 R /XYZ 99.933071 368.876671 0 ] (cb13-18) [ 374 0 R /XYZ 99.933071 349.929649 0 ] (cb13-19) [ 374 0 R /XYZ 99.933071 330.982628 0 ] (cb13-2) [ 374 0 R /XYZ 99.933071 690.976036 0 ] (cb13-20) [ 374 0 R /XYZ 99.933071 312.035606 0 ] (cb13-21) [ 374 0 R /XYZ 99.933071 293.088585 0 ] (cb13-22) [ 374 0 R /XYZ 99.933071 274.141563 0 ] (cb13-23) [ 374 0 R /XYZ 99.933071 255.194542 0 ] (cb13-24) [ 374 0 R /XYZ 99.933071 236.247520 0 ] (cb13-25) [ 374 0 R /XYZ 99.933071 217.300499 0 ] (cb13-26) [ 374 0 R /XYZ 99.933071 198.353477 0 ] (cb13-27) [ 374 0 R /XYZ 99.933071 179.406456 0 ] (cb13-28) [ 374 0 R /XYZ 99.933071 160.459434 0 ] (cb13-29) [ 374 0 R /XYZ 99.933071 141.512413 0 ] (cb13-3) [ 374 0 R /XYZ 99.933071 672.029014 0 ] (cb13-30) [ 374 0 R /XYZ 99.933071 122.565391 0 ] (cb13-31) [ 374 0 R /XYZ 99.933071 103.618370 0 ] (cb13-32) [ 407 0 R /XYZ 99.933071 799.173057 0 ] (cb13-33) [ 407 0 R /XYZ 99.933071 780.226036 0 ] (cb13-34) [ 407 0 R /XYZ 99.933071 761.279014 0 ] (cb13-35) [ 407 0 R /XYZ 99.933071 742.331993 0 ] (cb13-36) [ 407 0 R /XYZ 99.933071 723.384971 0 ] (cb13-37) [ 407 0 R /XYZ 99.933071 704.437950 0 ] (cb13-38) [ 407 0 R /XYZ 99.933071 685.490928 0 ] (cb13-39) [ 407 0 R /XYZ 99.933071 666.543907 0 ] (cb13-4) [ 374 0 R /XYZ 99.933071 634.134971 0 ] (cb13-40) [ 407 0 R /XYZ 99.933071 647.596885 0 ] (cb13-41) [ 407 0 R /XYZ 99.933071 628.649864 0 ] (cb13-42) [ 407 0 R /XYZ 99.933071 609.702842 0 ] (cb13-43) [ 407 0 R /XYZ 99.933071 590.755821 0 ] (cb13-44) [ 407 0 R /XYZ 99.933071 571.808799 0 ] (cb13-45) [ 407 0 R /XYZ 99.933071 552.861778 0 ] (cb13-46) [ 407 0 R /XYZ 99.933071 533.914756 0 ] (cb13-47) [ 407 0 R /XYZ 99.933071 514.967735 0 ] (cb13-48) [ 407 0 R /XYZ 99.933071 496.020714 0 ] (cb13-49) [ 407 0 R /XYZ 99.933071 477.073692 0 ] (cb13-5) [ 374 0 R /XYZ 99.933071 596.240928 0 ] (cb13-50) [ 407 0 R /XYZ 99.933071 458.126671 0 ] (cb13-51) [ 407 0 R /XYZ 99.933071 439.179649 0 ] (cb13-52) [ 407 0 R /XYZ 99.933071 420.232628 0 ] (cb13-53) [ 407 0 R /XYZ 99.933071 382.338585 0 ] (cb13-54) [ 407 0 R /XYZ 99.933071 363.391563 0 ] (cb13-55) [ 407 0 R /XYZ 99.933071 344.444542 0 ] (cb13-56) [ 407 0 R /XYZ 99.933071 325.497520 0 ] (cb13-57) [ 407 0 R /XYZ 99.933071 306.550499 0 ] (cb13-58) [ 407 0 R /XYZ 99.933071 287.603477 0 ] (cb13-59) [ 407 0 R /XYZ 99.933071 268.656456 0 ] (cb13-6) [ 374 0 R /XYZ 99.933071 577.293907 0 ] (cb13-60) [ 407 0 R /XYZ 99.933071 249.709434 0 ] (cb13-61) [ 407 0 R /XYZ 99.933071 230.762413 0 ] (cb13-7) [ 374 0 R /XYZ 99.933071 558.346885 0 ] (cb13-8) [ 374 0 R /XYZ 99.933071 539.399864 0 ] (cb13-9) [ 374 0 R /XYZ 99.933071 520.452842 0 ] (cb130) [ 683 0 R /XYZ 84.259843 560.570079 0 ] (cb130-1) [ 683 0 R /XYZ 101.433071 558.873057 0 ] (cb133) [ 686 0 R /XYZ 84.259843 556.820079 0 ] (cb133-1) [ 686 0 R /XYZ 101.433071 555.123057 0 ] (cb136) [ 689 0 R /XYZ 84.259843 369.020079 0 ] (cb136-1) [ 689 0 R /XYZ 101.433071 367.323057 0 ] (cb139) [ 694 0 R /XYZ 84.259843 565.251496 0 ] (cb139-1) [ 694 0 R /XYZ 101.433071 563.554475 0 ] (cb14) [ 407 0 R /XYZ 84.259843 171.512413 0 ] (cb14-1) [ 407 0 R /XYZ 101.433071 169.815391 0 ] (cb142) [ 694 0 R /XYZ 84.259843 102.004475 0 ] (cb142-1) [ 694 0 R /XYZ 101.433071 100.307453 0 ] (cb145) [ 700 0 R /XYZ 84.259843 514.251496 0 ] (cb145-1) [ 700 0 R /XYZ 101.433071 512.554475 0 ] (cb148) [ 705 0 R /XYZ 84.259843 309.320079 0 ] (cb148-1) [ 705 0 R /XYZ 101.433071 307.623057 0 ] (cb151) [ 710 0 R /XYZ 84.259843 103.070079 0 ] (cb151-1) [ 710 0 R /XYZ 101.433071 101.373057 0 ] (cb154) [ 717 0 R /XYZ 84.259843 613.970079 0 ] (cb154-1) [ 717 0 R /XYZ 101.433071 612.273057 0 ] (cb157) [ 722 0 R /XYZ 84.259843 403.070079 0 ] (cb157-1) [ 722 0 R /XYZ 101.433071 401.373057 0 ] (cb160) [ 727 0 R /XYZ 84.259843 178.070079 0 ] (cb160-1) [ 727 0 R /XYZ 101.433071 176.373057 0 ] (cb163) [ 734 0 R /XYZ 84.259843 628.970079 0 ] (cb163-1) [ 734 0 R /XYZ 101.433071 627.273057 0 ] (cb166) [ 743 0 R /XYZ 84.259843 595.251496 0 ] (cb166-1) [ 743 0 R /XYZ 101.433071 593.554475 0 ] (cb169) [ 748 0 R /XYZ 84.259843 267.651496 0 ] (cb169-1) [ 748 0 R /XYZ 101.433071 265.954475 0 ] (cb17) [ 440 0 R /XYZ 84.259843 543.320079 0 ] (cb17-1) [ 440 0 R /XYZ 101.433071 541.623057 0 ] (cb17-10) [ 440 0 R /XYZ 99.933071 333.205821 0 ] (cb17-11) [ 440 0 R /XYZ 99.933071 314.258799 0 ] (cb17-12) [ 440 0 R /XYZ 99.933071 295.311778 0 ] (cb17-13) [ 440 0 R /XYZ 99.933071 276.364756 0 ] (cb17-14) [ 440 0 R /XYZ 99.933071 257.417735 0 ] (cb17-15) [ 440 0 R /XYZ 99.933071 238.470714 0 ] (cb17-16) [ 440 0 R /XYZ 99.933071 219.523692 0 ] (cb17-17) [ 440 0 R /XYZ 99.933071 200.576671 0 ] (cb17-18) [ 440 0 R /XYZ 99.933071 181.629649 0 ] (cb17-19) [ 440 0 R /XYZ 99.933071 162.682628 0 ] (cb17-2) [ 440 0 R /XYZ 99.933071 522.676036 0 ] (cb17-20) [ 440 0 R /XYZ 99.933071 143.735606 0 ] (cb17-21) [ 440 0 R /XYZ 99.933071 124.788585 0 ] (cb17-22) [ 440 0 R /XYZ 99.933071 105.841563 0 ] (cb17-23) [ 464 0 R /XYZ 99.933071 799.173057 0 ] (cb17-24) [ 464 0 R /XYZ 99.933071 780.226036 0 ] (cb17-25) [ 464 0 R /XYZ 99.933071 761.279014 0 ] (cb17-26) [ 464 0 R /XYZ 99.933071 742.331993 0 ] (cb17-27) [ 464 0 R /XYZ 99.933071 723.384971 0 ] (cb17-28) [ 464 0 R /XYZ 99.933071 704.437950 0 ] (cb17-29) [ 464 0 R /XYZ 99.933071 685.490928 0 ] (cb17-3) [ 440 0 R /XYZ 99.933071 503.729014 0 ] (cb17-30) [ 464 0 R /XYZ 99.933071 666.543907 0 ] (cb17-31) [ 464 0 R /XYZ 99.933071 647.596885 0 ] (cb17-32) [ 464 0 R /XYZ 99.933071 628.649864 0 ] (cb17-33) [ 464 0 R /XYZ 99.933071 609.702842 0 ] (cb17-34) [ 464 0 R /XYZ 99.933071 590.755821 0 ] (cb17-35) [ 464 0 R /XYZ 99.933071 571.808799 0 ] (cb17-36) [ 464 0 R /XYZ 99.933071 552.861778 0 ] (cb17-37) [ 464 0 R /XYZ 99.933071 533.914756 0 ] (cb17-38) [ 464 0 R /XYZ 99.933071 514.967735 0 ] (cb17-39) [ 464 0 R /XYZ 99.933071 496.020714 0 ] (cb17-4) [ 440 0 R /XYZ 99.933071 465.834971 0 ] (cb17-40) [ 464 0 R /XYZ 99.933071 477.073692 0 ] (cb17-41) [ 464 0 R /XYZ 99.933071 458.126671 0 ] (cb17-42) [ 464 0 R /XYZ 99.933071 439.179649 0 ] (cb17-43) [ 464 0 R /XYZ 99.933071 420.232628 0 ] (cb17-44) [ 464 0 R /XYZ 99.933071 401.285606 0 ] (cb17-45) [ 464 0 R /XYZ 99.933071 382.338585 0 ] (cb17-46) [ 464 0 R /XYZ 99.933071 363.391563 0 ] (cb17-47) [ 464 0 R /XYZ 99.933071 344.444542 0 ] (cb17-48) [ 464 0 R /XYZ 99.933071 325.497520 0 ] (cb17-49) [ 464 0 R /XYZ 99.933071 306.550499 0 ] (cb17-5) [ 440 0 R /XYZ 99.933071 427.940928 0 ] (cb17-50) [ 464 0 R /XYZ 99.933071 287.603477 0 ] (cb17-51) [ 464 0 R /XYZ 99.933071 268.656456 0 ] (cb17-52) [ 464 0 R /XYZ 99.933071 249.709434 0 ] (cb17-53) [ 464 0 R /XYZ 99.933071 211.815391 0 ] (cb17-54) [ 464 0 R /XYZ 99.933071 192.868370 0 ] (cb17-55) [ 464 0 R /XYZ 99.933071 173.921348 0 ] (cb17-56) [ 464 0 R /XYZ 99.933071 154.974327 0 ] (cb17-57) [ 464 0 R /XYZ 99.933071 136.027305 0 ] (cb17-58) [ 464 0 R /XYZ 99.933071 117.080284 0 ] (cb17-59) [ 464 0 R /XYZ 99.933071 98.133262 0 ] (cb17-6) [ 440 0 R /XYZ 99.933071 408.993907 0 ] (cb17-60) [ 503 0 R /XYZ 99.933071 799.173057 0 ] (cb17-61) [ 503 0 R /XYZ 99.933071 780.226036 0 ] (cb17-7) [ 440 0 R /XYZ 99.933071 390.046885 0 ] (cb17-8) [ 440 0 R /XYZ 99.933071 371.099864 0 ] (cb17-9) [ 440 0 R /XYZ 99.933071 352.152842 0 ] (cb172) [ 751 0 R /XYZ 84.259843 607.820079 0 ] (cb172-1) [ 751 0 R /XYZ 101.433071 606.123057 0 ] (cb174) [ 751 0 R /XYZ 84.259843 298.679014 0 ] (cb174-1) [ 751 0 R /XYZ 101.433071 296.981993 0 ] (cb176) [ 755 0 R /XYZ 84.259843 715.370079 0 ] (cb176-1) [ 755 0 R /XYZ 101.433071 713.673057 0 ] (cb179) [ 755 0 R /XYZ 84.259843 375.479014 0 ] (cb179-1) [ 755 0 R /XYZ 101.433071 373.781993 0 ] (cb179-2) [ 755 0 R /XYZ 99.933071 354.834971 0 ] (cb179-3) [ 755 0 R /XYZ 99.933071 335.887950 0 ] (cb179-4) [ 755 0 R /XYZ 99.933071 279.046885 0 ] (cb179-5) [ 755 0 R /XYZ 99.933071 260.099864 0 ] (cb18) [ 503 0 R /XYZ 84.259843 720.976036 0 ] (cb18-1) [ 503 0 R /XYZ 101.433071 719.279014 0 ] (cb180) [ 755 0 R /XYZ 84.259843 200.849864 0 ] (cb180-1) [ 755 0 R /XYZ 101.433071 199.152842 0 ] (cb182) [ 764 0 R /XYZ 84.259843 655.220079 0 ] (cb182-1) [ 764 0 R /XYZ 101.433071 653.523057 0 ] (cb182-2) [ 764 0 R /XYZ 99.933071 634.576036 0 ] (cb182-3) [ 764 0 R /XYZ 99.933071 615.629014 0 ] (cb182-4) [ 764 0 R /XYZ 99.933071 558.787950 0 ] (cb182-5) [ 764 0 R /XYZ 99.933071 539.840928 0 ] (cb183) [ 764 0 R /XYZ 84.259843 480.590928 0 ] (cb183-1) [ 764 0 R /XYZ 101.433071 478.893907 0 ] (cb185) [ 774 0 R /XYZ 84.259843 490.251496 0 ] (cb185-1) [ 774 0 R /XYZ 101.433071 488.554475 0 ] (cb186) [ 774 0 R /XYZ 84.259843 429.304475 0 ] (cb186-1) [ 774 0 R /XYZ 101.433071 427.607453 0 ] (cb188) [ 774 0 R /XYZ 84.259843 116.807453 0 ] (cb188-1) [ 774 0 R /XYZ 101.433071 115.110432 0 ] (cb189) [ 779 0 R /XYZ 84.259843 772.370079 0 ] (cb189-1) [ 779 0 R /XYZ 101.433071 770.673057 0 ] (cb191) [ 779 0 R /XYZ 84.259843 459.873057 0 ] (cb191-1) [ 779 0 R /XYZ 101.433071 458.176036 0 ] (cb192) [ 779 0 R /XYZ 84.259843 398.926036 0 ] (cb192-1) [ 779 0 R /XYZ 101.433071 397.229014 0 ] (cb194) [ 784 0 R /XYZ 84.259843 799.370079 0 ] (cb194-1) [ 784 0 R /XYZ 101.433071 797.673057 0 ] (cb195) [ 784 0 R /XYZ 84.259843 738.423057 0 ] (cb195-1) [ 784 0 R /XYZ 101.433071 736.726036 0 ] (cb197) [ 784 0 R /XYZ 84.259843 410.926036 0 ] (cb197-1) [ 784 0 R /XYZ 101.433071 409.229014 0 ] (cb198) [ 784 0 R /XYZ 84.259843 349.979014 0 ] (cb198-1) [ 784 0 R /XYZ 101.433071 348.281993 0 ] (cb2) [ 318 0 R /XYZ 84.259843 730.370079 0 ] (cb2-1) [ 318 0 R /XYZ 101.433071 728.673057 0 ] (cb201) [ 790 0 R /XYZ 84.259843 230.570079 0 ] (cb201-1) [ 790 0 R /XYZ 101.433071 228.873057 0 ] (cb202) [ 790 0 R /XYZ 84.259843 169.623057 0 ] (cb202-1) [ 790 0 R /XYZ 101.433071 167.926036 0 ] (cb204) [ 794 0 R /XYZ 84.259843 583.970079 0 ] (cb204-1) [ 794 0 R /XYZ 101.433071 582.273057 0 ] (cb205) [ 794 0 R /XYZ 84.259843 523.023057 0 ] (cb205-1) [ 794 0 R /XYZ 101.433071 521.326036 0 ] (cb207) [ 798 0 R /XYZ 84.259843 700.370079 0 ] (cb207-1) [ 798 0 R /XYZ 101.433071 698.673057 0 ] (cb208) [ 798 0 R /XYZ 84.259843 639.423057 0 ] (cb208-1) [ 798 0 R /XYZ 101.433071 637.726036 0 ] (cb21) [ 508 0 R /XYZ 84.259843 565.251496 0 ] (cb21-1) [ 508 0 R /XYZ 101.433071 563.554475 0 ] (cb210) [ 798 0 R /XYZ 84.259843 296.926036 0 ] (cb210-1) [ 798 0 R /XYZ 101.433071 295.229014 0 ] (cb211) [ 798 0 R /XYZ 84.259843 235.979014 0 ] (cb211-1) [ 798 0 R /XYZ 101.433071 234.281993 0 ] (cb213) [ 804 0 R /XYZ 84.259843 640.370079 0 ] (cb213-1) [ 804 0 R /XYZ 101.433071 638.673057 0 ] (cb214) [ 804 0 R /XYZ 84.259843 579.423057 0 ] (cb214-1) [ 804 0 R /XYZ 101.433071 577.726036 0 ] (cb217) [ 808 0 R /XYZ 84.259843 428.570079 0 ] (cb217-1) [ 808 0 R /XYZ 101.433071 426.873057 0 ] (cb218) [ 808 0 R /XYZ 84.259843 131.823057 0 ] (cb218-1) [ 808 0 R /XYZ 101.433071 130.126036 0 ] (cb219) [ 812 0 R /XYZ 84.259843 799.370079 0 ] (cb219-1) [ 812 0 R /XYZ 101.433071 797.673057 0 ] (cb221) [ 817 0 R /XYZ 84.259843 768.620079 0 ] (cb221-1) [ 817 0 R /XYZ 101.433071 766.923057 0 ] (cb221-10) [ 817 0 R /XYZ 99.933071 596.399864 0 ] (cb221-11) [ 817 0 R /XYZ 99.933071 577.452842 0 ] (cb221-12) [ 817 0 R /XYZ 99.933071 482.717735 0 ] (cb221-13) [ 817 0 R /XYZ 99.933071 463.770714 0 ] (cb221-14) [ 817 0 R /XYZ 99.933071 444.823692 0 ] (cb221-15) [ 817 0 R /XYZ 99.933071 425.876671 0 ] (cb221-16) [ 817 0 R /XYZ 99.933071 406.929649 0 ] (cb221-17) [ 817 0 R /XYZ 99.933071 387.982628 0 ] (cb221-18) [ 817 0 R /XYZ 99.933071 350.088585 0 ] (cb221-19) [ 817 0 R /XYZ 99.933071 331.141563 0 ] (cb221-2) [ 817 0 R /XYZ 99.933071 747.976036 0 ] (cb221-20) [ 817 0 R /XYZ 99.933071 198.512413 0 ] (cb221-21) [ 817 0 R /XYZ 99.933071 179.565391 0 ] (cb221-22) [ 817 0 R /XYZ 99.933071 160.618370 0 ] (cb221-23) [ 817 0 R /XYZ 99.933071 103.777305 0 ] (cb221-24) [ 842 0 R /XYZ 99.933071 799.173057 0 ] (cb221-25) [ 842 0 R /XYZ 99.933071 780.226036 0 ] (cb221-26) [ 842 0 R /XYZ 99.933071 761.279014 0 ] (cb221-27) [ 842 0 R /XYZ 99.933071 742.331993 0 ] (cb221-28) [ 842 0 R /XYZ 99.933071 723.384971 0 ] (cb221-29) [ 842 0 R /XYZ 99.933071 704.437950 0 ] (cb221-3) [ 817 0 R /XYZ 99.933071 729.029014 0 ] (cb221-30) [ 842 0 R /XYZ 99.933071 685.490928 0 ] (cb221-31) [ 842 0 R /XYZ 99.933071 666.543907 0 ] (cb221-4) [ 817 0 R /XYZ 99.933071 710.081993 0 ] (cb221-5) [ 817 0 R /XYZ 99.933071 691.134971 0 ] (cb221-6) [ 817 0 R /XYZ 99.933071 672.187950 0 ] (cb221-7) [ 817 0 R /XYZ 99.933071 653.240928 0 ] (cb221-8) [ 817 0 R /XYZ 99.933071 634.293907 0 ] (cb221-9) [ 817 0 R /XYZ 99.933071 615.346885 0 ] (cb222) [ 842 0 R /XYZ 84.259843 607.293907 0 ] (cb222-1) [ 842 0 R /XYZ 101.433071 605.596885 0 ] (cb225) [ 853 0 R /XYZ 84.259843 434.451496 0 ] (cb225-1) [ 853 0 R /XYZ 101.433071 432.754475 0 ] (cb228) [ 856 0 R /XYZ 84.259843 799.370079 0 ] (cb228-1) [ 856 0 R /XYZ 101.433071 797.673057 0 ] (cb231) [ 856 0 R /XYZ 84.259843 448.229014 0 ] (cb231-1) [ 856 0 R /XYZ 101.433071 446.531993 0 ] (cb234) [ 860 0 R /XYZ 84.259843 799.370079 0 ] (cb234-1) [ 860 0 R /XYZ 101.433071 797.673057 0 ] (cb237) [ 863 0 R /XYZ 84.259843 394.701496 0 ] (cb237-1) [ 863 0 R /XYZ 101.433071 393.004475 0 ] (cb237-10) [ 863 0 R /XYZ 99.933071 222.481281 0 ] (cb237-11) [ 863 0 R /XYZ 99.933071 203.534260 0 ] (cb237-12) [ 863 0 R /XYZ 99.933071 165.640217 0 ] (cb237-13) [ 863 0 R /XYZ 99.933071 127.746174 0 ] (cb237-14) [ 863 0 R /XYZ 99.933071 108.799152 0 ] (cb237-15) [ 863 0 R /XYZ 99.933071 89.852131 0 ] (cb237-16) [ 880 0 R /XYZ 99.933071 799.173057 0 ] (cb237-17) [ 880 0 R /XYZ 99.933071 780.226036 0 ] (cb237-18) [ 880 0 R /XYZ 99.933071 761.279014 0 ] (cb237-19) [ 880 0 R /XYZ 99.933071 742.331993 0 ] (cb237-2) [ 863 0 R /XYZ 99.933071 374.057453 0 ] (cb237-3) [ 863 0 R /XYZ 99.933071 355.110432 0 ] (cb237-4) [ 863 0 R /XYZ 99.933071 336.163410 0 ] (cb237-5) [ 863 0 R /XYZ 99.933071 317.216389 0 ] (cb237-6) [ 863 0 R /XYZ 99.933071 298.269367 0 ] (cb237-7) [ 863 0 R /XYZ 99.933071 279.322346 0 ] (cb237-8) [ 863 0 R /XYZ 99.933071 260.375324 0 ] (cb237-9) [ 863 0 R /XYZ 99.933071 241.428303 0 ] (cb238) [ 880 0 R /XYZ 84.259843 683.081993 0 ] (cb238-1) [ 880 0 R /XYZ 101.433071 681.384971 0 ] (cb24) [ 511 0 R /XYZ 84.259843 125.570079 0 ] (cb24-1) [ 511 0 R /XYZ 101.433071 123.873057 0 ] (cb241) [ 893 0 R /XYZ 84.259843 768.620079 0 ] (cb241-1) [ 893 0 R /XYZ 101.433071 766.923057 0 ] (cb241-10) [ 893 0 R /XYZ 99.933071 596.399864 0 ] (cb241-11) [ 893 0 R /XYZ 99.933071 577.452842 0 ] (cb241-12) [ 893 0 R /XYZ 99.933071 520.611778 0 ] (cb241-13) [ 893 0 R /XYZ 99.933071 501.664756 0 ] (cb241-14) [ 893 0 R /XYZ 99.933071 482.717735 0 ] (cb241-15) [ 893 0 R /XYZ 99.933071 463.770714 0 ] (cb241-16) [ 893 0 R /XYZ 99.933071 444.823692 0 ] (cb241-17) [ 893 0 R /XYZ 99.933071 425.876671 0 ] (cb241-18) [ 893 0 R /XYZ 99.933071 406.929649 0 ] (cb241-2) [ 893 0 R /XYZ 99.933071 747.976036 0 ] (cb241-3) [ 893 0 R /XYZ 99.933071 729.029014 0 ] (cb241-4) [ 893 0 R /XYZ 99.933071 710.081993 0 ] (cb241-5) [ 893 0 R /XYZ 99.933071 691.134971 0 ] (cb241-6) [ 893 0 R /XYZ 99.933071 672.187950 0 ] (cb241-7) [ 893 0 R /XYZ 99.933071 653.240928 0 ] (cb241-8) [ 893 0 R /XYZ 99.933071 634.293907 0 ] (cb241-9) [ 893 0 R /XYZ 99.933071 615.346885 0 ] (cb242) [ 893 0 R /XYZ 84.259843 347.679649 0 ] (cb242-1) [ 893 0 R /XYZ 101.433071 345.982628 0 ] (cb27) [ 516 0 R /XYZ 84.259843 425.570079 0 ] (cb27-1) [ 516 0 R /XYZ 101.433071 423.873057 0 ] (cb3) [ 318 0 R /XYZ 84.259843 523.623057 0 ] (cb3-1) [ 318 0 R /XYZ 101.433071 521.926036 0 ] (cb30) [ 521 0 R /XYZ 84.259843 715.370079 0 ] (cb30-1) [ 521 0 R /XYZ 101.433071 713.673057 0 ] (cb33) [ 524 0 R /XYZ 84.259843 211.820079 0 ] (cb33-1) [ 524 0 R /XYZ 101.433071 210.123057 0 ] (cb36) [ 529 0 R /XYZ 84.259843 451.820079 0 ] (cb36-1) [ 529 0 R /XYZ 101.433071 450.123057 0 ] (cb39) [ 534 0 R /XYZ 84.259843 730.370079 0 ] (cb39-1) [ 534 0 R /XYZ 101.433071 728.673057 0 ] (cb42) [ 537 0 R /XYZ 84.259843 294.320079 0 ] (cb42-1) [ 537 0 R /XYZ 101.433071 292.623057 0 ] (cb45) [ 542 0 R /XYZ 84.259843 575.570079 0 ] (cb45-1) [ 542 0 R /XYZ 101.433071 573.873057 0 ] (cb48) [ 545 0 R /XYZ 84.259843 129.320079 0 ] (cb48-1) [ 545 0 R /XYZ 101.433071 127.623057 0 ] (cb51) [ 550 0 R /XYZ 84.259843 350.570079 0 ] (cb51-1) [ 550 0 R /XYZ 101.433071 348.873057 0 ] (cb54) [ 555 0 R /XYZ 84.259843 538.070079 0 ] (cb54-1) [ 555 0 R /XYZ 101.433071 536.373057 0 ] (cb55) [ 555 0 R /XYZ 84.259843 301.323057 0 ] (cb55-1) [ 555 0 R /XYZ 101.433071 299.626036 0 ] (cb56) [ 559 0 R /XYZ 84.259843 799.370079 0 ] (cb56-1) [ 559 0 R /XYZ 101.433071 797.673057 0 ] (cb59) [ 562 0 R /XYZ 84.259843 350.570079 0 ] (cb59-1) [ 562 0 R /XYZ 101.433071 348.873057 0 ] (cb6) [ 318 0 R /XYZ 84.259843 138.376036 0 ] (cb6-1) [ 318 0 R /XYZ 101.433071 136.679014 0 ] (cb62) [ 567 0 R /XYZ 84.259843 598.970079 0 ] (cb62-1) [ 567 0 R /XYZ 101.433071 597.273057 0 ] (cb65) [ 572 0 R /XYZ 84.259843 772.370079 0 ] (cb65-1) [ 572 0 R /XYZ 101.433071 770.673057 0 ] (cb68) [ 575 0 R /XYZ 84.259843 271.820079 0 ] (cb68-1) [ 575 0 R /XYZ 101.433071 270.123057 0 ] (cb71) [ 580 0 R /XYZ 84.259843 571.820079 0 ] (cb71-1) [ 580 0 R /XYZ 101.433071 570.123057 0 ] (cb74) [ 583 0 R /XYZ 84.259843 144.320079 0 ] (cb74-1) [ 583 0 R /XYZ 101.433071 142.623057 0 ] (cb77) [ 588 0 R /XYZ 84.259843 440.570079 0 ] (cb77-1) [ 588 0 R /XYZ 101.433071 438.873057 0 ] (cb80) [ 593 0 R /XYZ 84.259843 715.370079 0 ] (cb80-1) [ 593 0 R /XYZ 101.433071 713.673057 0 ] (cb83) [ 596 0 R /XYZ 84.259843 275.570079 0 ] (cb83-1) [ 596 0 R /XYZ 101.433071 273.873057 0 ] (cb86) [ 601 0 R /XYZ 84.259843 556.820079 0 ] (cb86-1) [ 601 0 R /XYZ 101.433071 555.123057 0 ] (cb89) [ 604 0 R /XYZ 84.259843 125.570079 0 ] (cb89-1) [ 604 0 R /XYZ 101.433071 123.873057 0 ] (cb9) [ 325 0 R /XYZ 84.259843 509.420079 0 ] (cb9-1) [ 325 0 R /XYZ 101.433071 507.723057 0 ] (cb9-10) [ 325 0 R /XYZ 99.933071 318.252842 0 ] (cb9-11) [ 325 0 R /XYZ 99.933071 299.305821 0 ] (cb9-12) [ 325 0 R /XYZ 99.933071 280.358799 0 ] (cb9-13) [ 325 0 R /XYZ 99.933071 261.411778 0 ] (cb9-14) [ 325 0 R /XYZ 99.933071 242.464756 0 ] (cb9-15) [ 325 0 R /XYZ 99.933071 223.517735 0 ] (cb9-16) [ 325 0 R /XYZ 99.933071 204.570714 0 ] (cb9-17) [ 325 0 R /XYZ 99.933071 185.623692 0 ] (cb9-18) [ 325 0 R /XYZ 99.933071 166.676671 0 ] (cb9-19) [ 325 0 R /XYZ 99.933071 147.729649 0 ] (cb9-2) [ 325 0 R /XYZ 99.933071 488.776036 0 ] (cb9-20) [ 325 0 R /XYZ 99.933071 128.782628 0 ] (cb9-21) [ 325 0 R /XYZ 99.933071 109.835606 0 ] (cb9-22) [ 325 0 R /XYZ 99.933071 90.888585 0 ] (cb9-23) [ 349 0 R /XYZ 99.933071 799.173057 0 ] (cb9-24) [ 349 0 R /XYZ 99.933071 780.226036 0 ] (cb9-25) [ 349 0 R /XYZ 99.933071 761.279014 0 ] (cb9-26) [ 349 0 R /XYZ 99.933071 742.331993 0 ] (cb9-27) [ 349 0 R /XYZ 99.933071 723.384971 0 ] (cb9-28) [ 349 0 R /XYZ 99.933071 704.437950 0 ] (cb9-29) [ 349 0 R /XYZ 99.933071 685.490928 0 ] (cb9-3) [ 325 0 R /XYZ 99.933071 469.829014 0 ] (cb9-30) [ 349 0 R /XYZ 99.933071 666.543907 0 ] (cb9-31) [ 349 0 R /XYZ 99.933071 647.596885 0 ] (cb9-32) [ 349 0 R /XYZ 99.933071 628.649864 0 ] (cb9-33) [ 349 0 R /XYZ 99.933071 609.702842 0 ] (cb9-34) [ 349 0 R /XYZ 99.933071 590.755821 0 ] (cb9-35) [ 349 0 R /XYZ 99.933071 571.808799 0 ] (cb9-36) [ 349 0 R /XYZ 99.933071 552.861778 0 ] (cb9-37) [ 349 0 R /XYZ 99.933071 533.914756 0 ] (cb9-38) [ 349 0 R /XYZ 99.933071 514.967735 0 ] (cb9-39) [ 349 0 R /XYZ 99.933071 496.020714 0 ] (cb9-4) [ 325 0 R /XYZ 99.933071 431.934971 0 ] (cb9-40) [ 349 0 R /XYZ 99.933071 477.073692 0 ] (cb9-41) [ 349 0 R /XYZ 99.933071 458.126671 0 ] (cb9-42) [ 349 0 R /XYZ 99.933071 439.179649 0 ] (cb9-43) [ 349 0 R /XYZ 99.933071 420.232628 0 ] (cb9-44) [ 349 0 R /XYZ 99.933071 401.285606 0 ] (cb9-5) [ 325 0 R /XYZ 99.933071 412.987950 0 ] (cb9-6) [ 325 0 R /XYZ 99.933071 394.040928 0 ] (cb9-7) [ 325 0 R /XYZ 99.933071 375.093907 0 ] (cb9-8) [ 325 0 R /XYZ 99.933071 356.146885 0 ] (cb9-9) [ 325 0 R /XYZ 99.933071 337.199864 0 ] (cb92) [ 609 0 R /XYZ 84.259843 440.570079 0 ] (cb92-1) [ 609 0 R /XYZ 101.433071 438.873057 0 ] (cb95) [ 614 0 R /XYZ 84.259843 685.370079 0 ] (cb95-1) [ 614 0 R /XYZ 101.433071 683.673057 0 ] (cb98) [ 617 0 R /XYZ 84.259843 238.070079 0 ] (cb98-1) [ 617 0 R /XYZ 101.433071 236.373057 0 ] (cis-v1.6-kubernetes-benchmark---rancher-v2.6-with-kubernetes-v1.18-to-v1.21) [ 304 0 R /XYZ 84.259843 784.970079 0 ] (client-certificate-authentication-should-not-be-used-for-users-manual) [ 741 0 R /XYZ 84.259843 684.651496 0 ] (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) [ 889 0 R /XYZ 84.259843 684.651496 0 ] (consider-external-secret-storage-manual) [ 887 0 R /XYZ 84.259843 568.851496 0 ] (contentsbox) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (controller-manager) [ 674 0 R /XYZ 41.740157 784.430079 0 ] (controls) [ 309 0 R /XYZ 84.259843 612.381496 0 ] (create-administrative-boundaries-between-resources-using-namespaces-manual) [ 891 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-a-minimal-audit-policy-is-created-automated) [ 743 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated) [ 734 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-all-namespaces-have-network-policies-defined-automated) [ 863 0 R /XYZ 84.259843 538.851496 0 ] (ensure-that-default-service-accounts-are-not-actively-used.-automated) [ 815 0 R /XYZ 84.259843 206.451496 0 ] (ensure-that-encryption-providers-are-appropriately-configured-automated) [ 643 0 R /XYZ 84.259843 577.220079 0 ] (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) [ 842 0 R /XYZ 84.259843 449.446885 0 ] (ensure-that-the---anonymous-auth-argument-is-set-to-false-automated) [ 508 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated) [ 596 0 R /XYZ 84.259843 445.970079 0 ] (ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated) [ 601 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated) [ 604 0 R /XYZ 84.259843 295.970079 0 ] (ensure-that-the---audit-log-path-argument-is-set-automated) [ 591 0 R /XYZ 84.259843 183.470079 0 ] (ensure-that-the---authorization-mode-argument-includes-node-automated) [ 537 0 R /XYZ 84.259843 464.720079 0 ] (ensure-that-the---authorization-mode-argument-includes-rbac-automated) [ 542 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated) [ 532 0 R /XYZ 84.259843 183.470079 0 ] (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) [ 774 0 R /XYZ 84.259843 332.207453 0 ] (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) [ 710 0 R /XYZ 84.259843 258.470079 0 ] (ensure-that-the---basic-auth-file-argument-is-not-set-automated) [ 511 0 R /XYZ 84.259843 295.970079 0 ] (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) [ 689 0 R /XYZ 84.259843 524.420079 0 ] (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) [ 694 0 R /XYZ 84.259843 257.404475 0 ] (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) [ 700 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) [ 630 0 R /XYZ 84.259843 483.470079 0 ] (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) [ 779 0 R /XYZ 84.259843 675.273057 0 ] (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) [ 705 0 R /XYZ 84.259843 464.720079 0 ] (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) [ 638 0 R /XYZ 84.259843 295.970079 0 ] (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) [ 635 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) [ 622 0 R /XYZ 84.259843 689.720079 0 ] (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-automated) [ 794 0 R /XYZ 84.259843 208.126036 0 ] (ensure-that-the---hostname-override-argument-is-not-set-manual) [ 794 0 R /XYZ 84.259843 425.926036 0 ] (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) [ 575 0 R /XYZ 84.259843 427.220079 0 ] (ensure-that-the---insecure-port-argument-is-set-to-0-automated) [ 580 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) [ 751 0 R /XYZ 84.259843 163.687950 0 ] (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 751 0 R /XYZ 84.259843 454.079014 0 ] (ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated) [ 529 0 R /XYZ 84.259843 652.220079 0 ] (ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated) [ 524 0 R /XYZ 84.259843 427.220079 0 ] (ensure-that-the---kubelet-https-argument-is-set-to-true-automated) [ 519 0 R /XYZ 84.259843 164.720079 0 ] (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) [ 794 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) [ 727 0 R /XYZ 84.259843 333.470079 0 ] (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) [ 717 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) [ 722 0 R /XYZ 84.259843 558.470079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated) [ 588 0 R /XYZ 84.259843 595.970079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated-1) [ 677 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated-2) [ 694 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) [ 790 0 R /XYZ 84.259843 445.970079 0 ] (ensure-that-the---read-only-port-argument-is-set-to-0-automated) [ 779 0 R /XYZ 84.259843 301.829014 0 ] (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) [ 609 0 R /XYZ 84.259843 595.970079 0 ] (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) [ 686 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated) [ 798 0 R /XYZ 84.259843 138.881993 0 ] (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) [ 583 0 R /XYZ 84.259843 314.720079 0 ] (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) [ 617 0 R /XYZ 84.259843 408.470079 0 ] (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) [ 612 0 R /XYZ 84.259843 164.720079 0 ] (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) [ 683 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) [ 784 0 R /XYZ 84.259843 641.326036 0 ] (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) [ 674 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) [ 625 0 R /XYZ 84.259843 239.720079 0 ] (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) [ 798 0 R /XYZ 84.259843 542.326036 0 ] (ensure-that-the---token-auth-file-parameter-is-not-set-automated) [ 516 0 R /XYZ 84.259843 595.970079 0 ] (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) [ 680 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) [ 323 0 R /XYZ 84.259843 586.670079 0 ] (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 323 0 R /XYZ 84.259843 702.470079 0 ] (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) [ 550 0 R /XYZ 84.259843 520.970079 0 ] (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) [ 555 0 R /XYZ 84.259843 708.470079 0 ] (ensure-that-the-admission-control-plugin-eventratelimit-is-set-automated) [ 545 0 R /XYZ 84.259843 314.720079 0 ] (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) [ 562 0 R /XYZ 84.259843 520.970079 0 ] (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) [ 570 0 R /XYZ 84.259843 258.470079 0 ] (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) [ 567 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) [ 555 0 R /XYZ 84.259843 501.723057 0 ] (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) [ 555 0 R /XYZ 84.259843 264.976036 0 ] (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) [ 774 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated) [ 660 0 R /XYZ 84.259843 411.552842 0 ] (ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 313 0 R /XYZ 84.259843 553.851496 0 ] (ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 313 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-audit-policy-covers-key-security-concerns-manual) [ 746 0 R /XYZ 84.259843 333.470079 0 ] (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 755 0 R /XYZ 84.259843 519.629014 0 ] (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) [ 764 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) [ 815 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-cni-in-use-supports-network-policies-manual) [ 863 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-container-network-interface-file-ownership-is-set-to-rootroot-manual) [ 315 0 R /XYZ 84.259843 170.823057 0 ] (ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual) [ 315 0 R /XYZ 84.259843 347.570079 0 ] (ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 313 0 R /XYZ 84.259843 277.251496 0 ] (ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 313 0 R /XYZ 84.259843 423.051496 0 ] (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) [ 325 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 323 0 R /XYZ 84.259843 209.270079 0 ] (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) [ 318 0 R /XYZ 84.259843 365.776036 0 ] (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) [ 318 0 R /XYZ 84.259843 694.023057 0 ] (ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 315 0 R /XYZ 84.259843 478.370079 0 ] (ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 315 0 R /XYZ 84.259843 609.170079 0 ] (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) [ 764 0 R /XYZ 84.259843 383.493907 0 ] (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) [ 764 0 R /XYZ 84.259843 195.693907 0 ] (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-automated) [ 808 0 R /XYZ 84.259843 392.223057 0 ] (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) [ 748 0 R /XYZ 84.259843 553.851496 0 ] (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 748 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 349 0 R /XYZ 84.259843 184.188585 0 ] (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) [ 325 0 R /XYZ 84.259843 668.570079 0 ] (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated) [ 440 0 R /XYZ 84.259843 702.470079 0 ] (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-automated) [ 751 0 R /XYZ 84.259843 763.220079 0 ] (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) [ 689 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 315 0 R /XYZ 84.259843 739.970079 0 ] (ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 313 0 R /XYZ 84.259843 146.451496 0 ] (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) [ 323 0 R /XYZ 84.259843 340.070079 0 ] (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 323 0 R /XYZ 84.259843 470.870079 0 ] (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) [ 891 0 R /XYZ 84.259843 604.851496 0 ] (etcd-node-configuration-files) [ 700 0 R /XYZ 41.740157 784.430079 0 ] (extensible-admission-control) [ 889 0 R /XYZ 41.740157 784.430079 0 ] (general-policies) [ 891 0 R /XYZ 41.740157 784.430079 0 ] (header_bottom_text) [ 6 0 R /XYZ 85.009843 392.718898 0 ] (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-automated) [ 748 0 R /XYZ 84.259843 423.051496 0 ] (kubelet) [ 774 0 R /XYZ 41.740157 784.430079 0 ] (logging) [ 743 0 R /XYZ 41.740157 784.430079 0 ] (master-node-configuration-files) [ 313 0 R /XYZ 41.740157 784.430079 0 ] (minimize-access-to-create-pods-manual) [ 815 0 R /XYZ 84.259843 307.251496 0 ] (minimize-access-to-secrets-manual) [ 815 0 R /XYZ 84.259843 523.851496 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) [ 853 0 R /XYZ 84.259843 238.710432 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) [ 856 0 R /XYZ 84.259843 603.629014 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) [ 853 0 R /XYZ 84.259843 589.851496 0 ] (minimize-the-admission-of-containers-with-added-capabilities-manual) [ 860 0 R /XYZ 84.259843 323.081993 0 ] (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) [ 856 0 R /XYZ 84.259843 252.487950 0 ] (minimize-the-admission-of-containers-with-capabilities-assigned-manual) [ 860 0 R /XYZ 84.259843 207.281993 0 ] (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) [ 860 0 R /XYZ 84.259843 453.881993 0 ] (minimize-the-admission-of-privileged-containers-manual) [ 853 0 R /XYZ 84.259843 720.651496 0 ] (minimize-the-admission-of-root-containers-manual) [ 860 0 R /XYZ 84.259843 584.681993 0 ] (minimize-wildcard-use-in-roles-and-clusterroles-manual) [ 815 0 R /XYZ 84.259843 423.051496 0 ] (network-policies-and-cni) [ 863 0 R /XYZ 41.740157 784.430079 0 ] (overview) [ 304 0 R /XYZ 84.259843 704.822079 0 ] (pod-security-policies) [ 853 0 R /XYZ 41.740157 784.430079 0 ] (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) [ 887 0 R /XYZ 84.259843 684.651496 0 ] (rbac-and-service-accounts) [ 815 0 R /XYZ 41.740157 784.430079 0 ] (scheduler) [ 694 0 R /XYZ 41.740157 784.430079 0 ] (secrets-management) [ 887 0 R /XYZ 41.740157 784.430079 0 ] (testing-controls-methodology) [ 304 0 R /XYZ 84.259843 166.076079 0 ] (the-default-namespace-should-not-be-used-automated) [ 891 0 R /XYZ 84.259843 193.251496 0 ] (title-block-header) [ 6 0 R /XYZ 84.259843 502.818898 0 ] (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) [ 808 0 R /XYZ 84.259843 670.970079 0 ] (worker-node-configuration-files) [ 748 0 R /XYZ 41.740157 784.430079 0 ] ] >> >> >> @@ -42,7 +42,7 @@ endobj >> /Shading << >> -/Font 1074 0 R +/Font 1076 0 R >> endobj 5 0 obj @@ -51,18 +51,20 @@ endobj /Length 2619 >> stream -x[ Wu+H @(^8A./f!vŮG>D=$ς?ZΗ7' 5 =jȱo\5ԞS-~xX3XP;lQa,@( --!3g[d3 Ӆ.FƂ` AƂ"Ш%Lgufc,hV8&4AJ-cNjX&-fc,h $IM7+cA؂K &3Љ0Po&c,z1tԛ(ȹZެ`KFBuIS'LB :1]-cA/X4&2zz%мެdb:pia,@&2[V +3l^q6zc @oFlW"ZUzg Hfl B^|p}گ -ܡ"f/q, 9V7}G?O8nW/r71!6F?FSn4 _=?~xxݫ]/|PwD&Cݑ|aq5پ:Hf j=#){mz̗c}|-z#YPEٜ|#|oW(f;&@|~Nnwoo%oUlmYT#U'Ta~- $}grYw4I5}׀&̏B٦[dÞ\}ovOx9aZ}.}RECE1dէ4sCl]NDBІ͜m׼ -p$GDw-ϝW[˔ٱF7i_mgDt|߁H ߤ儼O\IX!y.m)neI?ߖ -GsWlB;tgbwm6y<Ԅǽ8NbGX](LyӝxٙQ2'+qs<]2w^fmLIf[me OxI'uO#%ͩ{F:e;|d?ǓLZ;#{!f&۰ıyxÌ)m,q4N.k 7qn+#<[ř|ެ}mx9L^_ͶtBy-B:Es/t'K۾sm-.0=d[l]O!F}\ pD>b.R=9c1Z9ngOgJ-쮱&m[OjCv7ɐ방rqTgN?+]])}}f3ʻ;vz\YٟR[=uG=oaː2SY凞ĿO9;‰_MHl2tﳤZۮF~3+yw%L؎`R7 a6+w +DMt_C#?%oUͩGk@׃GMMɆ=럹te mGT|r´\D~6,ct3Oi='" 9ۮy-rH6я.'6Z;Ugc)յͅ'cn꿠Έx/.c.I y=NyBp]۸Sd˒"-y&?S9>y5Zk?S|HL[huݖ+:}v_؄wsےmڇy {q^7Ŏ>Pnt;3ϣeNVyei׹Kiw!ۘ͞dh&ۄ0@aF8Nq2q/_OGKSu$*=ˊ7dFirI&-dxd{b=c m_VuoV6uQ/jUh쯃f[:]! w]!ZKۃh샢MؗewfC̥wm +ƖFxSV݇-.Huo['w?x}L.t}Jv|1Nqrߜ1GwK3YGcv}tحC'!t duTne9޸U3X_E>x3[ҙݝz;Y=g.وOO:ds#ڞװeHYCϏǜzz&$u@}\YJCVmW#wߕ<ވ}&lG0UҎEbj }?o׃S ]fRJ=m *^ E:9 H endstream endobj 6 0 obj @@ -79,27 +81,19 @@ endobj 7 0 obj << /Filter /FlateDecode -/Length 3648 +/Length 3661 >> stream -x\[ܶ~_C/@Q 4H[}v8Ӈ~Dr]ǖ>77R=}aOvJ)w3E63K '#)2磍v21Eoָ9JnMLJv/ 7Y&NCM:rBl7 Bۃ_:| -C)fKG8hy`$$2pGG7Qț:@.;htxm !D+ۃ+!GB^EKKB݄C Q83[Bxн-Do!dCc(fگ߄hJb6-n!RXx;!ྭ֣\~\CC -\q@YML=4`8ڡLS؆h`vu;ttCLJpiv ^hgjGͻ {9o-Do! E;#-Do!L!^ -[BO6av| EUT!|iqSLJ .w"M\!##kttt!qIS'B& - aK^ ߦklnk3ev![ @sM&L+2&.ɤ_6\sValA*Td ɐ"h9r!L|J"c6F0#Ľa -1Ud2t@fV8dx:l![LΓ!0,+2Ag ++2ex!|gpȾld(2؅!3MG>;q7k7h%jPR[-8,)PNJN'.a0ffL( -D3)$c9kU k>5K|^i>>ydk}D k}LLsOtմih~i/dCj͍oWq - 1JOWw\Ij2.  %u$67ѡc^:2]9̿1.an5,r,;^ GӇG}dNk߯0L&d7Ž?=zܿfرF5\4s[yWg~V|PY̱Nq~﫲o+ϫ޴)/OևXcMw9v0T=>R78Vk->_QӹNN-Xdݫ7.)BG'3|XV'm;κO4KgnǬclc6Y)t Ęs79UD6szRNe#Og$xz[}$׽95?ŞΞ, OcO$ӖD*k$r@ySt'>sqZ#|QVwz{c͢sNq _ld1uV}"8NO;WEp@NG^ BMNqGN]t?(oO3R;>v |?:/9œ]k-Z\s.Pm2GWv/00%>!"e\1u|٪j&9$xKԲc}V˓.a5Ny Ixny}>Mb#e#Oʗ3^~U5 ̬=^ukΖ'f? Xv0:sfΓ߁}mapC -6t(/+~%|_:qg[|0B g¡ 7loxu1,l.U0֝w(نQeLÜP*7d3ovځ$Mua5 -H*rkk,T|WKlhE&iyL& x:w -$D NKGYa -nh<ͥwRb#I-=]Vecl>+ȗۤc*(xUZaۼ%U~ZJsszr ղzέ;$mm<͟ͅSdZ +FfFkN6v؃l?2G)Qݼ]N??:ƼiقZn`YɈ\5U(7ɋa,WohuHko7=WI2mW%ȝCSs]N0 -x:cMdk^SWnnɦNpp5KQ4"K:z7D6Sa j4^•ĉFSׯ^feG!D7{;44(zWC;%}ͧa,=X;- -w0hj6m~\&`?DƲT䜼+^y\^ϛ^+ +x\[ܶ~_C/@Q  $Ѥ-`oq(p6-}onD{4?)?,1̗ǏK'Ȝ69=X&(7~n8Ll'5t0Lٺ㯯C: +i3't%t?Û桇HS6̖Dqp"HtIe:[;_o;7u0ho]w &xqJK:zB!qXI4ȶi7cgjQoiqCs\ 41E;;ߏQ1Br(,,q [Bt\!*5GvFt [BBt??ѽ-Dl~lC(f⦎!*p\>^C4G G[C2x Pm.=vF;Ԁ2yMف.AH#f1Dx]8;Xiڄ`jDŽh {9o-Do! чEeJMчB}Ot/-Do!z GMt8A򗌏%FoMpP fB" L%VdM] +FI;9(2lf"T@g!E&sBe4(:E&la2G{ c de3&ͬpt,$CЙ'CaYV8dVV8d8DCsA}Q8d 19Cf'&}vF0@go8,oJ8: :["qXRO]$`D#40QdgR8 HxĘ(>ptv:CxAJA0xl3"U CgcMT9hrBD M^uFGI0oaBDOqX{ZM :;.È%H*Fm Y0ZVSj5%VS@1dLjJD4:DAA +upBM:{d2CAxh5%1)9!X)#i5%fLRZMLSjJ2n!pL!$ dp:{!fC7 +AgrV)AgCgVSy2*!3?lO N$)u"y*_i5%%XLX c0Ed3Yj +<xjJPjJak5~1VS2ZM#O1`p__VS2G Cg8dLrζD"3fZM:ÊݲVSryəa)DguB""kU^홌B#,P+O(s^W{kWƄbNC6.ŋ}ߝ5K_8`|X0*TFd#te- _ ś}?/>e::W:uGxD͠vޯ-"ڀtLQw囿tsqgl3g|ͣjb|͇2|c+G4,{ʹh>awʹii|.as:ɩ+2{z=%eFDf-`ҙqYfImqָum̦>k0s3fNOީl> D|d:Zu/D9&?ٓeݞidڒVx~;9@3~b-E(oJ3g#4NRT#NOcybYt'$eg!˹?O>Hۑ| NMgxo3ksW,f߷Ϊ9OdG`Oʝ>W^(IQk{[)n5ى\ƒyY}"Aqvާ?Ў]O{ֶ}9 ۯ[sۗV^VL\/ň Eٖ atteGS /#R_їhbC ˛zX-=<.Vapԏv ta/6/R_6w.{| >WC[ILlٝoq/olS1@ٔe'^3>`<ؗp=4-o`N,Ka9̭qaMz[BYqwg1 #Iz*{^Way ]R;:+_e) +sjn9zmUv4 rCJ6f|c?71A.FSZT7\vaWnmbJ\tWw(ĝ8-/A¡X$7Ow6݁4\ahthR!4+V6T -g>T(NJl6x$Ieǀ +lg%_6ttcl@eWTK#l5O˕4U tan|7]OnZV`ݹr睄c ׁ |s~tLv3vŐ: hm{U\1򍪛7i=2__n[8-U^r[HrVljDv{-vU905%33D汶{9uuplZD_s$E8+'q#Nd8٠fqHI)\KiD9ueV6]yB[qCNώG}U9(hK hXA[G|Vsܱ =&9=4'GmN}ņNkh|Sb:J> -/Dest (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +/Dest (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) >> endobj 36 0 obj @@ -419,23 +413,27 @@ endobj /BS << /W 0 >> -/Dest (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +/Dest (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) >> endobj 37 0 obj << /Filter /FlateDecode -/Length 3692 +/Length 3681 >> stream -x\[ܶ~_pf8C0Р@A@g$($}P/J86֖F|s!u׿rp?z.?b3F_ٔ~Kr2TnVN~SpFލ$N$y'1E@" - cx՗=PF5&2fQTg¨ދat=[8I01L> ߁($ՙ@RgU@.^u&3f11:#lj20T}l?HBt!0ɅdPTgNlb?U$ՙ"f4![Ug%Ws6쵐XP=df9G9G)r2|C2(9 &4;9 6Fuf19 !-D1D>&64l 12?ZՇ?ZH6F>b Z5:c4'hDF1s`j`cTg1"D13x Zc1A :^hNSbc8Z`cTg$A-(AQ){1A1C1nXGƨ^3?:i+2Y&ᒺea2ienvD>z^鋷~lZֈ=YuE*Ebmg%GO;Nژ"\;:Di+:F9 ֣PqP]zYˋqtp%I4tq%m5 F?8Xjޗ5ryW.\[bfy&&,2_aiKy 5ϳΆȱΩѠCAq> d'v–}v2POWPaN F8s/oNy~f*ZF_dsě/W_}Cy_Ao>6Ey-4Z?^:h>?H7}FA=o|L&?4h^nOhdyQ&5yD۷_~M6Ov`̊oYXˇ7,ygKZȒ+w{\'1}C:]N3sl&Ye'˒q>Ɗ /+ق)ǂ2U=uXtǡrY.zL헶h2˧sdvm^Y?le}mXF,v.K?8{=lW #݇>e7۝* $@dL]I9(t@3Nm~Hekg\/xw:މhmJ'>$M &흲`eU~RkUGvp6 [CގY.&r"kWKVi:GK:rnu|qƭm_nCfs;-z?ne8gyM4w+)w|k'^c9\i6M֦ݫf&Cq1U]΂Ex**oyKE[Ҝ+q(ha{wz(4y-{T)O/7ao0`?B.m37 `b1tZIaWdX[SM QyJM%XCa.W܎r-qc*6TjJwuJ;FTð Z,ʵOr*yJp⸃+34B~P}}]ë t'hс9ȓϱ/\_Kƞ^ o*<|i!=or@LWn,KEΩy,eoDN +x\[~?< AI&`ȕ%-}41 g LL S! LA@#ɢ3g ,:/&΁7\ L1yЋX1PĠ3ǐDgP A.ML@rc&J61ѻ90Μ$љ!0!ɢ3%,H CB!/:byK!0 :{HrJ6&:ʉcD(?DQ&G1b6G#.`cDgF (:P?$%(e#5ȧlƑ!r6| lA!0A lR9 R1QIHD.)"c1s`Nb`cDgJ1"$13x Rc1A :^dLSD'dKVhKR:(s 13 a@Pl,0Re7EXGd<d%0˔geqKe2ienvD>z^ӗo?}ziYEY>O;~TgL/2z^/jO_~e(ߝ 7h>>y&Ih^n]ȬK;|/?a^d\0Wge|Y7NaGuii2˧sbף?levê-aU͋.fy.GNYIܖ1qb޼wC4'_IQ?(.l2nmYc|L#߇>&nr;+ &d6s%F­1D.oNq{uDݟ0X*bM+>:Vmgզ!qkW"0cAC q8gy-y$n+O$n|kgo_?a.hMԁM֦O_ + VɍKabx4TiUHB*whنl7.C,^pbr/8e,%qVW!^{&ڳeF_yN|ɆpaYmx+tՆUUۑG[5S򧲥>MrӕoוMre8uO |KXag?w8D)ڊRߖ_>8 +M +PMv9[${fi룤>3z1uO~xG(gFYӗhًM}R {a7@~u`XlqNUMi^N-mR&j]OoP4)Wd#$4vD͕ _Bf;>./\)4\崋[ZTjO-]ꔛwda<͵8*k+yJpⴃ+TMggd60N46xmQ[ {:v0|v,vtYl%L6Sijc-uM)ڧQ]ss凕-Tkgwnǖ;Fqj zWe*la+Vϵ.Fߪ]lv$)tqOFkNn,=*TjZk)PI~o[n]JH›b҄-l!!w1 #:}O -B;: +pcs],Æb<^]nH?qTq81%<4){ +%É36*CkRSr줙^#} ;4Bw ̎MW4`89ceώ^}Q9PiKM0JT޾ݸm5κS[ECQS}t~PeNkhBŮb:jiyJ)ydGVVۭ͖MxtG;%,g7iHúZm0BW$߇{ե׏B"sNQr DV!F|}HX2~{Txm%!=o^@LWnҥ"o,A^ ;wW endstream endobj 38 0 obj @@ -458,7 +456,7 @@ endobj /BS << /W 0 >> -/Dest (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) +/Dest (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) >> endobj 40 0 obj @@ -469,7 +467,7 @@ endobj /BS << /W 0 >> -/Dest (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) +/Dest (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) >> endobj 41 0 obj @@ -480,7 +478,7 @@ endobj /BS << /W 0 >> -/Dest (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +/Dest (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) >> endobj 42 0 obj @@ -491,7 +489,7 @@ endobj /BS << /W 0 >> -/Dest (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +/Dest (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) >> endobj 43 0 obj @@ -502,7 +500,7 @@ endobj /BS << /W 0 >> -/Dest (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) +/Dest (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) >> endobj 44 0 obj @@ -513,7 +511,7 @@ endobj /BS << /W 0 >> -/Dest (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) +/Dest (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) >> endobj 45 0 obj @@ -524,7 +522,7 @@ endobj /BS << /W 0 >> -/Dest (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +/Dest (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) >> endobj 46 0 obj @@ -535,7 +533,7 @@ endobj /BS << /W 0 >> -/Dest (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +/Dest (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) >> endobj 47 0 obj @@ -546,7 +544,7 @@ endobj /BS << /W 0 >> -/Dest (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) +/Dest (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) >> endobj 48 0 obj @@ -557,7 +555,7 @@ endobj /BS << /W 0 >> -/Dest (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) +/Dest (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) >> endobj 49 0 obj @@ -568,7 +566,7 @@ endobj /BS << /W 0 >> -/Dest (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) +/Dest (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) >> endobj 50 0 obj @@ -579,7 +577,7 @@ endobj /BS << /W 0 >> -/Dest (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) +/Dest (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) >> endobj 51 0 obj @@ -590,7 +588,7 @@ endobj /BS << /W 0 >> -/Dest (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated) +/Dest (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) >> endobj 52 0 obj @@ -601,7 +599,7 @@ endobj /BS << /W 0 >> -/Dest (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated) +/Dest (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) >> endobj 53 0 obj @@ -612,7 +610,7 @@ endobj /BS << /W 0 >> -/Dest (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated) +/Dest (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) >> endobj 54 0 obj @@ -623,7 +621,7 @@ endobj /BS << /W 0 >> -/Dest (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated) +/Dest (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) >> endobj 55 0 obj @@ -634,7 +632,7 @@ endobj /BS << /W 0 >> -/Dest (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) +/Dest (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated) >> endobj 56 0 obj @@ -645,7 +643,7 @@ endobj /BS << /W 0 >> -/Dest (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) +/Dest (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated) >> endobj 57 0 obj @@ -656,7 +654,7 @@ endobj /BS << /W 0 >> -/Dest (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) +/Dest (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated) >> endobj 58 0 obj @@ -667,7 +665,7 @@ endobj /BS << /W 0 >> -/Dest (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) +/Dest (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated) >> endobj 59 0 obj @@ -849,22 +847,20 @@ endobj 75 0 obj << /Filter /FlateDecode -/Length 3494 +/Length 3492 >> stream -x\M$d1r0p9̶=6YvyTݭM.fW*J{d#%M{<9aλ,]=>X\s$5jyg_c=95%!\w)\}~E)QKqpK슧 ޕ8\!-Q ]-P_ YYAC`S,#DN P10- sv>g Â- :|*"0zYa1 D)Ơa|40Q\Ȟϑ d10EdrW", Spx mV LB&oqv "=Y\hp#fyr:I ☥!9R̎Kb`HDiQ'XPN$8$If m֘ERBda%nqQKK0,٥0\ % -Z~ . 2 -!2!26`r$!y!GY!e =,2c r%s I3*:?OvHtI-.PAO --.PU1 ٝbp!8 %(P=J哜B(ZZU,*.0eKxROB]lUIhbULS^E.tD,apҫ(.f CHFhuE-P{ҫ Z5#[z5ASB)0qna .: ^ESEVg*0"AC$$K&h- -qyҫ)''HT^EJuiU'TX*;b=2&'Hҫ9D0cJ^mV-C(U̧[z\eHCt ̨5[z3nL*& S7\B0L/C٨E|Xz5g̗E5Z\̗$,m֔, ҫuPQ-ZPU f,ZPQ -ҫZXz@cR-ZQҫSWAo@{dULP0BVǮjVT &_Z=8,vzZ=Jr{G#WZY^-9u$KB},ҫ -QA^ŜZW1%WZZ1,ꘇDK*:bUVWK*:&K*:tvBK 1a}Z3fH–S9`/[r4s 5荅kA-B+ Us1v޲}\_M{l]icmR[n9Ȣs Mjm=Gs+o9Ub\Lnl 9.}ӏ~;6JYｇey6@6G`0'.?O18:Ge?Yϫ>s>1εK3͏GKG#g=鞖6>\w{gL&^;l>݇ziiaN1__MV׸4a0mS>*3.q=clfiׂ_ ݇ȥγŸ/v2*Iko~/'x~6^G7!Zy^pD^{m^:/V yn:F*?,vlF~95>>^kk]ծ^F[y0ЧGst`:^[-> Hx k>L?Oi=N}=O$!D'a/⨾1$y>y8:2}yyWͅo(h{E Y2F؎ԘK[hq̑n:Bl_xtOj99O-}pĨixX -k/"}vbq4 IaG}ZmTd[eH3CtȬ|?vK{Xǣ"zb+Y(jQyJzq^,\i%@&TzjcϜ~^}mGO?Pu(Zv`k>l },7 +x\ێ}gIV1"m`ր~⥻53ӽ 6JR:: {S8R4'>~yq~!dWϦ>b fhsb Yz̩2|ձ-Zf@V&s|Vf`ŞQhb`UVGWK*aNҫСfK*:FBcTWg1lUL 0`UV'<0Vg.K*:!ҫ +XzUաҫ +΅ҫ +,>{Lk߰njY20e)KVFⴜ"&9u zcZPmU\|l{ar?[W/}n{&[4dwv_|q#wU]=Ow_~_>a{%Pœ S>_=,`^nɤ~oQ{kx#>=PJ7D*CXb16- edQ[n9&嶌̕7*1Q{CAM&z27ccz|GHyHLS%CƲڼy<7x|u^ "^yf#XwlG{j̥-4t8Hjo{~th6L=DV~suFn5}T~;V$CmwϏiG5̵Z-W.g(p4 Z%\SvY%洼%.Ʋˋ>P3/W/&i*!sرm}v}3ֵǺL/cx'8[_ײGsúڷ&z,hjO[;?R_GH L,uX\^Ui}ε Ϝ|sZ?N(hig?>` ˻z@ +n\_5?7?fo_z2s5 zIŴ0Ÿq8~c۫x #L\޻eֽԛ"h;&\tavaM 7Nxtn}ڴm}(Vi] twG:A6ٳ$Փǩ9^55|z5f]<)}0uwq94sgbv7a)l|n] sڍM0$aii1ڳSPcmUR" =7Jt"_?cgsyd1R9F>l&c)s(WZou<)_8ݏ[yxR]^Oݪ~  ICq\x)eluJ_(2Ek; :k2{rI-WSkS=s[z~=9Z+B}7שhA!6tO3 endstream endobj 76 0 obj @@ -1278,19 +1274,18 @@ endobj 113 0 obj << /Filter /FlateDecode -/Length 3623 +/Length 3624 >> stream -x\K,X$c1rXxrif sOQɒZ*Lkf=#>$)l[? #dM d? rOeNH~dr! .|s}ə0o%$IPL!i 1@!"mX7XbFl0,'P1EvڤaXfFYfbe1Z0,b3!`I&$BChBޢ1Yw @$9$k2ULf',hqevT aVq^8&seY`FbL4L2sR1bVǑ5H?X搂,s̊2#zXf]VC1?efhoYf9+-lh`-Ĥg93!S I1c,&OGa'rINƇ :e&<̈9)z轍I֍d:e -I1e?\هA.Bj\Jc1`?uE?u9.A.81,3AA1,C]T:cXf6*\uY$92Fx C;? sA2X:ȥґ? @ǰ>[R'pYǰ\ IuO#)xt l9),`!4-%39[q2ǯ.`}3LkE6WEjS MNI 2щb3=7q荈q, ݼ3T$>pm=v.Ee::SBhT@k S?.tn`-B̑mF噡"sdE*2GVv$Q9:4 &&k4 u0a\d=&SRs -59!57;̑mB)9%k2g0>@̜LmM-9oc ; ;qbډ䢉;7q'v; I;ߝIN$Qv'vع݉9 -vb'qIN$Qn'vXwb's;9GNdQ;<݉\NE;Ŵp^݉ĝyu'v2q^݉\1;9GٝɜNdQ;sXNRn'x^7s,߇ b]#uy ͅ+ML{Y%Tm:߼?}7?3wͻӿ7ȥ<{tA5>T^A5> U^>s E#"Hre-_hGֽXwOJgᾸͤÝ:=n [#mс]_/VoK<`Z cix΋,O[mçp3ӈNwhL<9h.'qOښ LuZvv=Z.J~)\Uiw>SU'=L40 tỉ|;]خCiǃO6v+GO<v[mt`űcl8ݷXV] vvv6O{f6~}gQv~ygng*c5NlފΆ< qTc1P?(K~;MzۮGuNO1k.3a3Rg"q m\'7(Z8362,;ce^x)zj4N[FUo~Ac 阸*҉_VRqDޏfopedüFgZǫ'۱/B !vcN`bnn_Iz]S%9^ա #N[DZQj\8h:Mp3˛ijg^>瘕ߟ߆m-_A~KysW{hH>}xO3˸9뫶8I]RFHy>Fnuœn<ȴAO ݜUxkr([RGގ-Jhc~u{v3\7n%7)fvij&" {N 7qإT<إ4^6q݁YL^3@e -۾~"C5pȥ:]̦YLo7|8%!eҕ~Ѱt\ ƭ>4(o_o%N&7|#&w,ɏl\b>#c7qBmPv=/_X }[ 7 7Poc!TnP B*_K!~k+kdcjΤ#a[!]O[h j]ݧڠiQB[ T,PmmwCJ޹!?B\A+l'^mdtjLUUV֕cZ2pP@e z#%6y$IupMc R_ىQAM dXiFkh·o˄1VheqZRlcNMj:H4%iђo 9َlcɴB#ywbGJmmj{.sbguSj-afRs.ÝD9|2DLbm%K"uDI6Dx y`5}}lW4l~cm+ÊP;erA!ڍf!aj +x\݋6￢QTRUIAA}rn1Wr[R.Lf703]TOIV^~\%1O%3!'w|DΗP i:ggYqybX"( zaffaT!LH!̔$?!̈d9P PbO &z " ,bA1bN 1c6'bE "1"3 ,2#lOc&Fj`>eD7.JcQʠxfE RC BB`cX0?(u0X?(uP9JJ@mȌD:(D#2G1:(9:$P`6Fd?(u0PlLvP('Ǥ8)#Tv)JA6Fdf1:(2?$uP@`cDX<CR!B1"C6ibHꠌGƈ^2?2Βa>fLxpYܲZ43YhZG'3t?/i Hœx*rxRLZmkV ΜܳqdшIх"\@钪>4=[[XZwjPO % zU #-.yU+jQij]ߧx%}2^!lAѳ0ȵ\aPv/ʥU aEu}ޕXv޼P\xKK^(ןt>xBj KG +P|@w+t_B%D_B j[rjƼA׌Vs]ӧM XR`0098Ă,L xzH(:70QTȐ9͸>34dN>zC$N02.2Y2G2°+PPg o y"bl`Z 08%4%s.ђ9I9QR%ss&ddS4l}ySNr;9HbډK;cti'v;$w'v2I߉,9Ď8;%GNdQ;YrT؉,9*ĎHNQq'v(܉"9 +wbԇ;SCܝ)x'v=ɫ;S]ډ’Wwb՝)u;Er߉"9N;S$GN쀗$vG@ezu=Wc%_]pZo.̿_C9ob*2ޫz%~tÿ<7>W|b 糯7e@inL4mCL>94me_>=EGu=?oE7fv`>ځpg?z}[`سXo>ؑua۠yL:oTFCЈSDtd΋"L[mȭӧGx3?]俟F0t9u}?8hnk>fc~L͇L=dB2ص>o TiޜںOY ps߆ڰjSkڰ }㵰ȏO3_Yz.v:s9򚍍[%/)(}+ίq}j].9yi~ ?fXcBQ߃-0\N7'f@8_׹o1P|lˇjlR&՝;cj<;~eW5xަ8l[۝!c|I7ӽ[yEh6G]އ~LSR? z!`-,0ft )f*.oMЮ['S۫:Bv~5mҙ/7Yus+D\{_Is&:8q,5v07%("]jn%KÆ~XckՁ2ÆiOi6^RW:-4֗4PS!AiTrE7(וՂ317GŽ+ B:Vq37Jǭi~2\=ڤ*iQB\-lpE<j޹"?(i +O41*AMֺ*Sk^h hf'/ܳi0 R}VK&+t;klAU*Sivc=y,нk +kR}Bd 98{kA;u=w>jroku7i*lxI[#|v1EIRF'r֞~8l?2"RZ_p'Ҷx}~uA֕,LKtbE CXjx*_ݏސ3(HCJ3dOZ[m3 +4I3I%';rǵ8JQ +%Սrʩj bVԍtWQ"ֶԉF8(uMPu3‚1n,YugE@ީ;V=St^sⱞ꼢9#4'G5fFBEߖ15xeq^RcAYkUI[ox};;?},WhThmVm8126B>+='vV7K!o&C<:̒C))aVk#O^,^i%%1LڣO !£\(+ڥ)`k_.ViSE*y7fedb9 endstream endobj 114 0 obj @@ -1540,7 +1535,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 482.305843 386.420079 496.429134 371.420079 ] +/Rect [ 483.326107 386.420079 496.429134 371.420079 ] /BS << /W 0 >> @@ -1704,27 +1699,16 @@ endobj 151 0 obj << /Filter /FlateDecode -/Length 3784 +/Length 3789 >> stream -x]K|T> f sOQYEvzz ,fXEVW(\5_1E~&`:?>X4WO6w}MZI~"88E'6 0LVf `z` Vʲb'VRc@or(^7ViؠA=Jذjsg_غ -)Blv4T/挱]ָ`aQM ס {줮ouן._5J_g1/ՑL>LЇȇȇ>v}1H:ט?M;!HiJϛ"e͛+YF|b3. -C 4Pƥ_b Hn&u)O-nY [$ vo&yBXlP-uۮX [dO[ioR&-ANͬc#v;q6, plA88w~FuxQDIѓ޹yPy3zIѓ'E?ET|Bw'EO}BW\z ;ޭkRpg"qmaum *'eQf$2Ωi$T@π*jL83R0739/ީwsF}\<G2TTIyKc  @&92ڑWW}c )A03X*i4 -cD?3R:ALx{uWA*pe$N=)蝛 E4=)zRQOŗ/t{RIW-t5muߢٔyg=My(_R;3}x;2APг F@#])uoe -Qx"|]5li5LEOKTn0E>1ڰUMw¢DMlgȞ22ز*`=nTTUNCTaa)-,JىeNb{@yTIѓ'E7s{h3f3'EO~"uO=)MhE =_0Bv{@4}.+}1$ň*1Ș"]֏_Lfʿ";!>arxЇ B߇-x-~k:b]T;gdi_+߾H᫿_|{>Пfi~%ZBN'7|[ -4a ̟l/-Z޾[:}uYv҃dK/3j[~9/l]Ҭ/)r7 E~8VF_ՙ]c( S",z';Ƈ|.sa/׋%JA!,)l2Ql뗎%ny(:wc]-L#g8P ]1Nm}eK۠ 6YY7NV<9f(~WF'JjGsŔ>uYߣ.g~ZYFOW}f3]>[JaL}?C{mkȷUo?F=2Ƙ7d1Qgo~#HAF$'Q&P#:Z;ofew |6]fML3I )E}?rc')!y?soIaƔxVa%l~`2E"Q bP;muEUsSX$k@Ʃ>6纨 -f=/fU\X \*rv-ڰF*TMSGz:~`H# -Zç- -GhUD͂T`Es>/7EIwi''cp㯞>tlҌwFs$IȇO{W{4=xWO{ƄZ-ȸq^#\)*3Ws]#VAD\p2*a¨2(Mv$h29[#"Di Ad20CZʪ#ZJ#Z^ F\c4p +=o}6otf7ϸ( g,X64B~it& allԥ/c7#<$p8qNmN#G}TQcQ„ѸQyhG}N336q>Z?bL[L 2 Aܗ ֎d43\H1 ଆAR`ͨN+QW#Qz b +۫2*pV;੺p*;w 1w Q:@:jwj=RAQ;H5pFwjpj<;H5pFz w(-(WĹ+pSR;j>eFP*+{O5pSrTw<(8=bAl{8ş)CRs"mvBonzPwoo2.2|+g1\򕸷)Z@omoUܼ4Hݶa̞ ,- -3<5G~s݉㖮6*nNlA..[h#7S}bS^u((#qRI E_)PO3zIѓ'E?ETGݓ'EOj+iCͦ|/Fϗ̻8nʋF\\l!xۑ @_& 0iJ?g{ Խ):F-nuՌZQs0z5?E,QqQ.J8h hV7US 5Uqd"{`˪$-kX[QaS5Wq;q2qS5#nN\ \(6f'u:N1;ݧe$N=) 6iF;#:)zRGh/t{RIW-t%mB#(x$yzkv18^!)L>\o?F"廨灁wRɤ7.w_H޼swW߾!iV[Q,d({o[ +4FAKMML~5z0_ڬgc30nENh{nm ogIǓ- ̰_l弰vKle\S,,2X}93}TgvWX0?Osϭ_wǡKՂ BXSdf/1K݄PtrS"[Gp._3?Dgc&F1T۾ϗAAm2n:/eyrx͖Q:E(M~SEgd}TiyheoAߧ>]u/RTcRY"kLW/^{Fްj|cޔ8B1GC#e4ͱo_WXU m*]4βZs6?K V;\>f|W eL@:e2^3JH35uȯ=A/>@f32GL=NsP&58cs˲ܡ\jz?fQ,-:vcMх =G _ccZk\Pm6uru2}lו]\4NŐ@\]P!wΧ[K#RZ|((jwn-732;ˆG}.sa&W$_YDsx1퓔 Mr^򹷤rcJ Q<~0Z̒\Jm6s`2E"Q bP;m> @@ -1996,7 +1980,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 478.154476 324.620079 496.429134 309.620079 ] +/Rect [ 477.986019 324.620079 496.429134 309.620079 ] /BS << /W 0 >> @@ -2040,7 +2024,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 477.986019 234.320079 496.429134 219.320079 ] +/Rect [ 477.506282 234.320079 496.429134 219.320079 ] /BS << /W 0 >> @@ -2094,18 +2078,25 @@ endobj 185 0 obj << /Filter /FlateDecode -/Length 3763 +/Length 3766 >> stream -x\ˮ#+66_"ËbY8,,9ntI|gu!|ZG[R`&&?3bs1/7!A'!8V1.k'R&1wI'6=G{;Kay:5<ޱISghMHOr(B^@\nkq#eٷYVmFyYW?mL,BsnvL&4uCm8tk~;6 }HC;ٗ?7|N>sc6$M;i?t|M?|:򇏗olFyMׄ|Mț$8[Kt|M?|:>fj-N.>tM. 9o?m0%J:&Mb(cfr[a8X`m13Y$pѪ .4 8; y1lMT0*a˞ i8n &JdU 3%cqd|2J90r?b8;?.%b28c Y8j29S&qOpN*9`g%~K?ރ3%R1ɆďW1Ξan جďQ1XP &%`6S'9DSRb A - ILSfU vI9FgV8p&̊JarR'xpTLgo8)8cP1Θc d*0 iMɪIgV'dRIPrQfV⇰uK䢊XSP1ypvK[Vpư?ٸb&Lh'D<?8'U ́X~))< K1Qg=#6j9|{R‰:X\n!bhL -&s 3(EcƙB4gh8##Lg9wɀ3 A 8;K#gQ8RK^ .S2ƹrNI301sRALlk'dGc#L,eCG.ilh(*.eCKt?¤R6}&qUx_<}]E~T֏" w?G*{>C͇*"-qU^ľ/)\BfEO{'sU_OW{t=ʋ6*Sy5͒"1^varx1'~g{yq/dNx>v "]ž[ue|^/cVpmsw=1O^n[#54ZxFU6FOS|8P%nCO.M<ˏ䪟lY{i:뇆ZLmbŊ_>]~9LI;b(s=ܜ7m70˃E5`+NgymnC-~T%e]*A(2Kq}B"IUlT(V{ëbBHB#u1r0Wkosw4R[ztZ.Jm2WLyA*7)UdsHh~M /o~qŝ6'Jm$Iv~to>c7HXV#򖐷JBﱻխ4-:!']n}#\SrؙA9R0_ޭ0tL'.F VÀs`F \0^ǀ3ygIU1]6&ipv@6! c0`,8Uô}0AɦH*ƻr4Lq!ď LV1'ĘC +#7(]*&sq m*&I.+1X&ɨ2Y{&NsR18+]L 1+=8T sD^p skpf%~|g獊blYlRR1 f3%~|Š)짜8$%JJ`˜2{bK1"5 8lUYQ1X)'%~ȃb8cP11%%(35)Cd*%`0xU1 ?gVrRIÄ +Y[ +. +,8D*Ɓ aI0xk٪gk +*& ob%B"Y8'U XyȤb8Gc&˳gV@̈́P5Q3{4gGi2G%~g TgCT'rtY6Bg2['W c#1.k ]&DdGEʀэι]3t(f (+1X [/M#dOϺB: + J5N^ɹҋ Rc{ +?嫐S8+9mI?ijed|U.hWҕ^V~db46Rw;WV-Eo)zOl+n)zK[PSݭԽ-Eo)<!^ƥ(3\vthu<|}R‰[yd)%H?\BG8Jјqfpƙ`sg<2d[Jy6k3zN 8B +d^a,8}r_ +gp >jKi(4>8S(%LPʆXxbN}46R6t% 3 M +KІVaR)F>zb<IB/-1l4U8cS8g S8ge{yqQ8czyqlbggc}8c iCyiC"&8c8c83893=i8D9sp gcXYi X2y(X>VAg"ڳ (a ߬=8~#ƃGg"oݿocy~/aq㕿7߿EG>ȳJ~o9NX -?^WC. Hnr/*"EU9*$=o X4gط<T!g*GmX&0̯r=SEr*rWxl/'sUW^qR rŜ]4{k@X+}_͝]D&{C-S\s~~F tݨ +>uP|Sp'&䪟lYh:džZ~LSߊ 4G$ p*sJLOWb9zo'K9US!5\W~e!0T->δµu%+s<[-mБئ 5:77}bHfPJa6bBY/,Ċm#\xƗ++\2{/{% +/KN4ąBaV4K@J%?IWK\mDeVv]e(hLv1Y4 H?9rPmjo{)m+6፥~˶}-"|[ Z]ԛ- RօM*k=rf,J]t^iF + [+^- +2tdK,MJ\7uv/AH;Sӛ3濧jU +0 jߗ2)F!T~ސ)ȣŒH-HMpްEmPǍ|jFlCz64~O~\j\!2ٲ| endstream endobj 186 0 obj @@ -2135,7 +2126,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 477.518001 782.420079 496.429134 767.420079 ] +/Rect [ 477.434505 782.420079 496.429134 767.420079 ] /BS << /W 0 >> @@ -2377,7 +2368,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 481.214534 335.720079 496.429134 320.720079 ] +/Rect [ 484.911067 335.720079 496.429134 320.720079 ] /BS << /W 0 >> @@ -2497,28 +2488,30 @@ endobj 221 0 obj << /Filter /FlateDecode -/Length 4004 +/Length 4001 >> stream -x\K sU$X @ E$@lE0䐿ZV3=^zT(GRΖ}ΤcɚHr!̐?L^ ^Oh@29xVhrne]XĘ8RPt)O rVug)8k$o/x4L3{E@JhLY+<Vl|*9` -QGdU0cLQ0PGM"C-`8⨈ - !T04Lc6ML8QrDt9$So='LR>fΘ@}S&`ʖ᜙r`!2-ԚgĢ4 .[MskN~O!rYbXme{ S[zйXdW0G?~lCȪ8܎Bܜ`&.rt<]In%'-ԋ l%uWWt?zqp85,ˎptP%rhLqp׷pi!QR8cǡJ˼y͗=EiE#D!]Wj<чɈ!G~ ݣ}#D!zW+oPG~u;h~.8zy&Lm{rX6Ü'LmTx_ٷ-9O^ҭsٺf&u6+:u(dE60@Vt.uʊ$̚ΜT4=3e41]jS*[} vΔ'qMIȅ>hOжĦ<LQ9oGLy8RN6h:g<D[bAPtcA9B#=>eϱcHKDȱ#⫑j;CC ;>*8QB%b,×4SIzMgQ9<)SMWBr`WbZPtN8ZpX.Ξc'tȱu&9m}u,&: e'i~ˆr$I儠Td)o+N;A_ق.*ٍ!xUggv(Q; -ztBwGeeы5]vRܙabvy1E\xxO&DSՇ<E'- .i< <{ēiy'[5}?8Amc"P L1ڤX1Sy*f %b?&B۽ i}ur7O -J>϶v3x?~9|e̮?xGZ3 ""2o+Wy>MҾVd-S/] ݋~v-o5[Z?T[.(^d^~Z~w=3FUGbK/tbPֱގY>/U B[t1 ;.YU|83\=}'tPm}E߿:_ipiY}_ZLv [;⁽V텿XX'v[AؼO'8n1&j> ]]җ5=vsEΗSX9{eiuR[[FmjZ}@^Ԁߊ?>}p%F~m;1gr5 je}%|O7ԬݾiظǺAظP]>q|7dՎqkŧ._qYѳZU0%&]vuvlѢKff *;ƓvxYeEfn2!!::P|(*lkK*.>n_Kf-j?H&m>[m'F$s}Pqx=>~pN'ˊ(-fVMɿm}n$ݰaVʿ,mﴙDJ$P"w^sٴ,kh|k窟ô|1LqRC#&0ڒlpB7 WyglC/gm8}yz{羿|S25<8U-ۓ|W2@z*L/H{c07^臹cĮ47^Nx9X>O: uvJNӄTpS.Pru&iW{T\i4CcbJ4,NpMuy_B0Bw/wv 7\a$zo'';ePcjlJ*SKY W:gCHN^IC:8@^QJ{q)3/IswdsS$~nם<u۳ܺ"˙ 7_$Na#"K7y@kH UIaCA2/+B^lƄ}=mp|qiϢK>+cJ!NTC!n?J(|%NDQNc]72 -N4FWL~sxݍ{U9(Ԟ;YR -'9/a}|Pˋ1J \H4UBVBDlc)f,ˈJ4ITIv6j;1:;8{-& [w*Nh{ٸf۳E¨LhF;7忷j+ĥa']Ϲ;Cg_>]Myu}d%6K$Fv3_/_]le; pYUo|}h꧱,)%{l.ڃ}w^?Q +x\K$ sE @FX֝];PzTYҳ*%RHR=/Йr x|>$)7c +:jlISGET0e0 O!a h0Md$Ɖ%0D&)z9arR6sƤ +샜2!$S <)pFTxSV0>lGYVxq$ξO .h6 2sf` i)q,“s&2!DWY>LFG>B3<?= +G>BwuW37.袟 hY7kk +hbԶ'AZ,>@rlM"oU ^B[t1 ;.YU|qp#g{f?W1O6^ˡn+0 _ugabi11lZor"bamWc:VX r[o~`ꘔ)/,Gw[^ym?WYlq^*Nar#!/jw矋?޿q%F~m;1g31j_ ;ʷj]xO3]7 X5>~[=*]ԽKwu\5ߍ9YcqWxa~kV`}VK  + V4jҌĜT(+e? OjFj=T͠*ҽ F͐,`_V[nqh[gΎ9Zv{lDsxnOxxjwYQ $}o|=6~ +(>J-sļ[=lג'mj5$OTzW#WGy9^m:Ey(8pIji8_UelJd+Yɿm}n$ݰaV i qk;mf ]\6m>.m@3Q2b٩}[&lˀe -0w6U[{Bw%btVBh "h7y6՞P?@yq02O7ͫpSn,v,O-͓LѪgsL{+p"fk9jL}/nrġ,IB2q).$h8Ų|t/~ӚƄ2Ix>P~ ]hK~b S?<\;c|y~nם<Nxs{:zn]L7{"H }Gs;{t=~UiPn~ )Ɗ1a_O}-_>w*'r8|5? +*h'S>lfqH) +_dQFS?fe׍Bѭ:F'>_^w^U- +N}>B oNiX9/n;,"|/rFhW'G5fPl6Qt4ht +Y324R5Š$-MnDoxZ"q^K -֝7^6e,C0*S;юE%3}qƵ +qoa a=s.NٗOWS$F>Yi%Rvoc;P/DW5fNi8|b7}XSM=6>mi endstream endobj 222 0 obj @@ -2724,7 +2717,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 481.191097 465.620079 496.429134 450.620079 ] +/Rect [ 478.154476 465.620079 496.429134 450.620079 ] /BS << /W 0 >> @@ -2878,7 +2871,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 478.790950 177.320079 496.429134 162.320079 ] +/Rect [ 478.622493 177.320079 496.429134 162.320079 ] /BS << /W 0 >> @@ -2910,22 +2903,25 @@ endobj 257 0 obj << /Filter /FlateDecode -/Length 3763 +/Length 3764 >> stream -x]K$ E> 0ٵX琿JZupU_HOI]ScΚ? -!zI+Od~*]m]T!{~ ʭ#\O똕9[%Iʛ' <,)OA͊㄄GIF(cf ~FT&4*ZG0R*F(Lh8fWlj; 7񧡨t f8R(ƉG7i7q)IpFX7i$X;QOYe qOhUى>`.:=))5 -zcBAO| -hzħQ:!RdْqVOٙ8Rq] -fScOdYB|MjD#WLr0) LpaS gu8k qSkFYH\32\3sf6tDO\3[hFfZhvO\3 `Bk&7iPkʌq ^O|f"$A3}f6k~Sk&j郠>)bLhfLfruSㆭOTk0=#5Y\<2#JjS~>}S9bN:Mj#W,]ڊ "J]ù6>_G&/&33s;!Tj.0 -NlW4.U"qB?^x|ōF]%Jxn*QXjlKBf\` DNp\(fFbC(,5yѦ .dγUw{?> pBbv~0;~x(,5+XhvRw?;+ -OSJnt)iލ FtO{S8?K{Sʻ, A5E=mJ-q̷<tKl=)~X'[,r[,>c;l>a(;a00vE8-[,!ݻ8<:L@h(IG9o?/(sF/c:R<껗̮/B/tKiEMh0cNhu_S&M恣i.iPm;f![n5`hje/"Jg- _8>_y^Vϵqj@^rϳg:,;*N(ˍl,0\Z,B]zK ԓSl}6fXkg]6l!)u]x_kUqMnƚ3DQwv'VU5/-_V~$G}d -fPd dn6y#4̉B&kEkf y.JS -t]ZrpBcY|: ӷjÉ &ahqy2L^v.@Y,k;.OPJx^-N2%ukP1h ?X>u]NƦ{16M&V C2t=욮PRЯ _5FnYave󙫪+:3m ۅZt j!B=tFЂ[q낮JŊRԅ53kPB6bQn]NC̍| -X,TinC5[lQ.h[{8qQ}/Tw5Z[[4ԇb*N͂Z*,.Sȳ&$f{#Iժ# 'қ+yG ө}*ZC{PXZVJP%X\c7=*{w|j|7 Zp" xYni006Ÿ(4.Z$utMY__>jm`lq! +XF7؄FK%jBij5S Rn 24/+։k}zjtPDOC̶|,,Ο" D2S!06:5S@J!II8ӈtjgڬd]eM;}J8^+Z+(:ւ7Frs0J6 U^V䞭mj݉QvY& ) - t*G_trbeah%_ EZWIz]&ْ ts0(mec/t۳6E\v]Q$wNx t'85$q ȳo\o)vxQ?Vˢyؽ9}|U6#TO}Z*R OI;^?l> +x]m$>b>,K*1Đl6y%&>k8C~J=z)uճwg~ZUGU%iz{Y'Q!D|y:?iI"ѝ,/1^m8 +#DcOwA+p8E+|vyܔ9[%_~"71/[5ƉSޣ1n_$ + lj +*Y31 ~&T&2*ZG0R*F(LdxXi=A4: 7PT:3{)Qb}M(.)üۙ=*idfFR{@!pʶ(kDX搝&*NH蜟p +(qf +I=*> Q:!RdٓNE~)G*V1`f3fR˳$Ɖ%qlMpjYjbՑ3&9pcS&0=93Y8#NdiCpjmT8csfz"Cs&qxΙ`̇0z9ӱf2sL? hg93&29g"/Zs4\Uf2sfz)IO8EI`grLl"c5LSs&jك +>1p \Z&23 pfӜ39N8ETaij gĪ4 A/3¾Y)Mc$O_<N>[DK)$buyC[;L^MIw8wt}88zE/XB:lt4ehAxWa ɡו9jJH4EHnPU$mZ+U_]g Z0(;a00zEK'-]Tw& 4\$_WCO] ] ^~/ZiH. <5ChP'ۆ;\V橱{%!wC&*<+`|nTq |ף\FF2YG~v_E{9 y>~ΑmE/dõ:>Ƙq=z]kuEo{h"6vm~';r51=j92lXu^`g&ۢ\kh\hYl{X_$3tnxve?6/ڗ21};wFmi's>nުpI6^p6/S_/? G6=FgQu9*5gyb?H+/>X v-1Z}h:I>~|9'(Iщ2For>XGGu[m)_}83&.m 1eR{Pmql8604n[m=r~ehje/bZ+:l~e,|y9zq[>orvRy0۫jꁶd9c~50ʎ6 + e%KET:{IczbM: Yrc uAgJd[h#꺹M[߶Q[&~٭D4钒D-7N:6H݌N,(jRUG6B\" +Ӽ.W{9j{O)<|e<*Hhx5u"r=kd(G]-Ȟ2Vj^2( [<|HꇏV4A.Y{Lvȗ_ 0&Z6\KZˆX47j4@Wu]{ANRC;%NX&}Z ӷDS0;FG3Z\ A?Wl Px2gyT~Vקq,db5Pt=b~dX>um wMb$-M3JoT.prU+©֝+$PP6j +b3Av!l mA-5c0Yrn.]gEs^N֮! +bP bV+JEـ42s|Tb@P.F)_B47SP:~->(Gqj-=\ l) x"?+4'A+ڭpm4ԇ*͂5UPESY7]4 Ϛ$qWZ)M, }b:f e%C VEo Mhu@kl؋O%H͇:t_(h xYyNd^M+S[:48Ndw4l+g$%VSq!FT(Ͳ4 d?J*l%N4"2+. !F\kT;{F8^{6ٕHhM}hXBkv9ui9vs%xj[VĞmj݉ ,@R)SZ +EM}ˊ[|S4'iT'dmdSْ ٷ&Ya9yuEIڂmucT۳6C\vm$_^;[FRV u C?R`{i8y bo7K["eDjb:xn7*`>-)'ut " endstream endobj 258 0 obj @@ -3131,7 +3127,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 478.154476 465.620079 496.429134 450.620079 ] +/Rect [ 478.070980 465.620079 496.429134 450.620079 ] /BS << /W 0 >> @@ -3197,7 +3193,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 479.138851 335.720079 496.429134 320.720079 ] +/Rect [ 478.118587 335.720079 496.429134 320.720079 ] /BS << /W 0 >> @@ -3263,7 +3259,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 478.118587 205.820079 496.429134 190.820079 ] +/Rect [ 478.131038 205.820079 496.429134 190.820079 ] /BS << /W 0 >> @@ -3295,21 +3291,11 @@ endobj 291 0 obj << /Filter /FlateDecode -/Length 2228 +/Length 2232 >> stream -xZMDWDQv}K==P/*eIwv̨SO\_TfKL%E?/5)XiA>7&4ņ8lbn~7%e_ '73M) jʀS@؃{Pd.&`"n -]R^Ik, -AG0 "o1\*Dv;pc~a5֋8<4?0?nW$jtk~86eJ0ҡϼ`_Zbn$+yw7NO9?ytܬex|NG8ڭJt|N|:>]HaKNǁj'!3o64(hq Mѳs'4 &33}(ڼMPIx MLbyMH9b>q3]3}Pz*h.tS V ghbr9\r6M6Nc&݉yyYc&݉yQ<;1r;1OK2N;bw'uU@5ڔδvvK<s/&/%JlԅUM_|_ kӇ| _羚H‰($!@jP$W[ SEogE R/W駊-5:ӇR^S9k=a7w Bؿ+m\ufՃrS»d2'{PH]ؕȫ"!^Sܺ*єqcۜ57 i^РmʳT~M. 8OעS%mj6<Õ,~5zXe#3$Z-w}mm՞iMw]wRc^A[]˩]n2޼b6`{աt]*ye_ѱ9*w]-)~/3x.}__z+LQᖗ^(%#7xKק۬f]wbCWqبŽpOs\_v !]n0QkT3ڝ[CTLjMݛz㎦K-!lrR%6TZ]Yzhq GezJW+&-ޮx3sT_a͵ ޺>^]~ ->(ҦK0OjiR# i?&bF4|cj{'^kbzrPՠӯ=S#X+3`ksq -?` -L}zY9<ͭyT~|{ޭ09!d(*@X  Ļ087`´(RAQ]rL$]CA0d))!^tce֞)y ]ah: JB–PgfR!XǗ[8VmVq;pj)0j ztَxhl*JM׿k.Q"0=Bjn -5ƣTdi*sՇÉw -Xl*)<V))[$%#R qʗ < ,, - |v^4,bQ|ĴhZ w2D. %m^CAqDUnGagJ - -rWaP(KO2\(̧flHYrh=7YQ%[:&@3Xf5k@j!b׮pU6ݸ6Y3VH<6=heρ^r vA/UT -10n縹8yS1Z Uh:AB=cQH 2&46K[q>RbiK1b^;ʗw<閜4@AsRz|E=[P?(c{~+wY-ELvU>&wOЏ6G!F!9tsNj-}Vg#Os~X?-A&x…n7ƴb4|u0GP) ${펾^,L +xZ݋$7q,r $w= G&#,YU]y_ɒ/\ρd&璢ӻɚ,4͠>7&4ņ8lbn~;%e_ '73OMSbԔd \1\&McDS+(Zœ8X!q&,a>cI Yf`5 I8ڭJt|Nǿ}:>]HaKNǁj'!3o74(hq Mѳs'4 &33}(ڼMPIx MLbyMH9b>q3]3}Pz*h.tS V ghbr9\r6M6Nc&݉yyYc&݉yQ<;1r;1OK2N;bw'uU@5ڔδvvK<s&/%*w22Vq`~x;}|?_N Wa-\@j ܝoBMA#;V{>o0:7vv]SmK{oQv?,jtx؀Uuͫžj|EԦڦu]8/ }- |$>2 Fsgx<[^xΏuq}Ƀ.vIvl0QkT3ڝ[C{TLjMݛz㎦K-!lrR%6TZ]Yzhq GezJW+&-ެx3sT_a͵ ޺>^u r}PM`,58G>~LŌ'hNPd!A_{!zҧF&Wg9?n'\~i&lc+JWs%^Mx[K *p]}=[arBQU聰8zM;wapVaZ%niQ.٥6(3-&3pHF/(`E+SJASCb;sˬ=9S+d3t2unA<*-?T^6ncF2qQC/p`_۬w2պ/SHa +84_2ДTóR]ԣD`z4xk$G:ӠU nlkjU&Sx*^-RR<0H \KGj-+A$/x$U)YXA8Jh8!zYyk~f!^B)p(FEa^* JˑdG;2:m]R_9=7iJ@Xd]x: J(*]PQ)^4* cԵaeqsp /rI3Rc~31> @@ -3437,23 +3423,23 @@ endobj 303 0 obj << /Filter /FlateDecode -/Length 4728 +/Length 4723 >> stream -x\ێȍ}ϯg 0; czS6j3'$EC:RfVۅJ!A2RAR]o/?]¿yp0oW\!Bqٛ9_/}5Shrv)F +%,)XPGgܞ3p$JPú힕1G +x\ێH}g"!E$ B<ۻB=H >'mgf}.rD:y"2첾*|/9=cpˏ5Eo1oU+'sHlb&mrx)`rv)F +%,)XPGgܞ3p$JPú힕1G zhA5`xFO!e)/aStVƳƔj5eu[e5ybLt]|&@q LK.10)O.F`d?#4xF3 xX ]V.Ak 0,gXC0,[fX`NpbX`6ǰrJaZ`' r ,P`Xu)0,]bXLʃ.`@d8*2,p],#ð^abe2))kr pDʋ֠eXc ,swWagQB`jxஶԌ&+3,@8LI+.Ix.`0,@TP^HaxRC.{fX[˰ wCCy&ðu xXdMXR0pWixJ̰ wKdXb!İ N Âܔc BV䣼03, ȢsF9;;FG~v\fv\{g'ⵔ츰\-D|\=x+Y.qaqޠX3;.$sK}=x9Yfqaqޠ#X3;.$K}<>xo~~\{\7hū{<̎ ;{&ؿ|<՞ tڤϗ~~?\O_+e~oJr -z>ïo^hG2y&+e:s?,3&-r܏x֯vvz[?{s0r:AOmyY{jWC׹_giQ -oVfr׻#67_~Y2V^i9eXm🿽|u 0Vc*mEC {S}qϪ*W[Qe&9Gitf~?2ߣ ?AhrWTz"qkFζ*bv1B|vnb#{zݝwV٧xC]1l)㋽jgrɆbTbYg~{N5ĝ_mr^'>VZd[ܛ}N:;QAڨד:?ё^ko<KWgVcݻZ;և3S.ɚknKq^hV-/νw>y|[<)Ë -pI]Ǐvm~wdd\g[Xw`zޝlVyjkM7Wh v{}ony`gV;˗:+rnNZdYM4Pp@yuS"Yi->v߅_QC m\YUD(D&iIb`WULLq;kTxѺ2?)®j/AkNOlgrקʭ-nk̈JʉNxrڽbkhӹƉIúmUy{ڤUb[ӛkmjwvsjlnEVyՐfFmO"ze1"kl*LyCNMP6hf]Ƕ*?6`[WNJ2k -^AoMn!w;T{Y^O"l7Wϟ43Gތ5_SjvP{vGC綟.a*_gS);oC'enҳa-q?QTyLyV9q_섚\*ӳd|M9ʗ„3ޓդWryQZz*>TAUD%.U}tyF3]Ħ4cM<#.R_)ESiV(ב!nBhg6ekrGH JSJ\-UnS3<ijQeǑUqcvۥ<#^|$} -kIr9/S5fWZg] ~/Rf#FP1 hXa.cYi/_@ndsUT[5rj\'ʯRE׋-7vJrl-M&W|%^jٮ_LbN0:jmTCY?E2˜ܑ VW*Kcow-%4l2Vؖ '`uc}Ǎx{ƕDm(ȦVXƟo+B潾 {9ur-oKZomp:|"qT3DH8]A"E']a˵ā(#ʡ<Ӭ]i,VHNˋA׻ -(*mbS "q9l9^A]BMk϶"/^Z@ƨ~:ˋJ.ZE T5ӪY'jjN^iF+a7ȭUK@^sS}d%yv>VnvͶW1  2U4&{ڡT6̝[* qݍ%y^ɾ#R{%JpUQWs^BT};?-+: p-kCƲU,춥MMQ4]\om?  +؋li@|6 &v)Ю*ZѶs;LXOE932ɌePݷ=Gf-|^^~2w {={|8. tAą>M(>yJHdYƃuy r(qb[Kn_X:<9qa7.9-Fe~ߩuy r޼y~\ɠG-w]S9,뎉dsA.s|:.zXh?̇ ;.1~0<qa_\5ay!ox3. ދ凑VE__0;{nyGKҥ_xqa_\5ayš`zg>\Y>b{{t!5 w7iœQoёe x-%3;.$W _.W;J ~~\{\7h+{<̎ ;{_,s;FN~~\{\7h{<̎ ;{_,~󀾟> Zr;N{ 'd\Vt՟~~|JߛR6i{KW7/4i<~VW2ulo9eV_W9^ZVʹ~C6+f;q-o9[~hVuàWSȶx2'nyX9;sm rױvM]w]}7`JQ<0Y/}~z_UPn|W-zΦ OW. r>SԷx=zϸ|͔$IznRܞgK+8yxv}lUEb뽺:,l" 1?ڋ?4yr^5伵r[o㓈ǦjlYL* +Sއm%PvVKbVK'Em0\+ c$u\ ڧa$.ɾ@zTbApMn'uygKӷ1_9-~dZĮ@;Z:P֏}{pӜޔ;2 +2Yei7][qZYf ۲DwN}1]?]u`#uCPݸ ٴ5 +mcVȼ7=a/Nm)U  SٞB$ОuF)₹k6YR^+l8eD9z+m)iy;GZ2Zg7#mkl{p]+SOo¿Ke ѩ% +h_RW]9;"W"wLZuy;W|!D׻ӲSz6a,[n[T4A#o endstream endobj 304 0 obj @@ -3516,23 +3502,24 @@ endobj 308 0 obj << /Filter /FlateDecode -/Length 3515 +/Length 3498 >> stream -x[K$ ׯ˒H@b NnzsǪbϬ2i*ȏT.ߟ\d\-JZ{++t K.@ŕbɗۂ_wM|3]k9t񭰘\dX>JɕS6X98,51RgVjXcB j# b +x[Kϯ$2p 6Q9|n35|!ZԬXV8{|Wjm%]IzCoI๸Z^T\i)|MSw|vqL8GZ!y',&Wj)>dRrĔ V[lbAT8=@ n5Y,1VU!q tj# b rɃ e(=[\-6W %Z<" ,^s9T-C|x -daeBɃ,xDh -Y`]A}x\j5|-̋>T %&!Kl!\Y! :XX@Y"eXe߂eRlaraJ݋ԥ%oawɃ,0` B% K  7`W0[X[qVoawclawcA0yƄ%X0p7rPǛpt`-,@/E%$nhO\-[XbL^s@B.,,H]* w`CD$n Dj y pyC \0]לoZXhaHb! # wޛiɃ,Tk>dx]}id஄M rB@@,8ZX+VJ 7R>‚AH,YH]V-,(PY2XX, Ŭ SHjcz Zx9Z&C(rNoaIda/AEFd/@$ / j,-,DhԒPc/ufrv*ZX7A 4y0aaGda(sLdܬ -Y6,4YYX|v&[X{ Z7#[XzZXȣDgm,f1dIHQLdA &:Y Ybc ZRoV fDFo T7y\M dLhDfk -3Y扁&V{yfR#e*|O># s("܂ݏcvݶ_>{{'IYuM 6)ߥ%(.r,U{3SvNFW3[ɧWEH:Hg1Nd8uNz5Ҕ qeMv#HeE^lois~)4@`0@L=|F2gSPty>le -)) ǻT%cnj)(XQi.+qI;zAQdq(eDG8xn?_?- -7oSOi3ҿFO;F_ ׽Oy; c6ZIh{˰.f?ls#抠Ss}헷dUNEɞ６uy}6OQPWSmhr纵X2|-"풱Ze(9Fl}aS9xCGxN-񨗾UN5#5iwzw}w汎]ϻ.,qϽۇg~?gG'g;_gwX>F>Zĺbקrar|w9RV:v}}. }-?tϷ{uw{k]~caLr!mnv>&UU?-A0B;vOS}U`|͛]c+{}wW;þO\L5lwxys9JnHa^yDŽ  xlrK=\=fB9}ͬ=yk8OB-h͹ly!w(nLU  w;>[qMO)WM)wgezkr 3*7y3q -F@QK@bqj"~i(i~,VM)۰`Ur}߃$&hR9B~]ɶ˰!z=e\ݵm~:շB@4L0 غ_zo Qޏd lʵ qVņ˃'׷ -ߏ^^={-Do .w]_ -+ޘ"/AfYG?0ܩӮKŶ%hT꫑SLُWoD<Ù,Gb]u%.3s@}Ɂ"3ѫ&9rGj=BUAiz3:OkR j=dž't] ⧾W&vCѯ~麘ة2zh뚟LS:oЮ*.ySXHβ}}UvOxx$ߖTibO4Ը\I- -ir$7H*ȳ~_ _H8@8@֑L^pH;q"FV?ɡξ[È1*{ap51M*rBi&=Ciq$2tofޚijH^uh-:C:ՃhAT)AL1H=Pz+HR FH&gCwں -)01hu@4u,Ll*|lCitc=ItZmTQ|liI{p1b2uR9Ť5 %&+WodK4͹sՠeIvsh{Q)HSϏ¿տדP[E -EZQל!,hg?YD虰| /70 5Tw@%<<|=˾bq fRQŋ$fzz 'j +Y]A}x\j5|-}ryKM2y()!K<ȒGGcJFFn,^,16yƷ fK , 8n-W +B ĖV, %qdaDɃ,,, ,2ܲo޲BLoaqfpfas iatRlawDi PR"f +.-,`n-,`n,H&8 YXݘ+swcF8xB]@E‚ ψi e p7T5 +4n-B‚E" pY-,;dhaABx wQ7$ .5yV X ;_$&88R`YXQ/˫+-VS3ʿ Fy槝h/'＝x~;{z;oöX?b:5w{'w9'{|oi} +Z2l ȿ%xC==Ēy䙒'M4EV撹ZǼe_(5G]nɡ#<y4V!GJ{ߡN00rzLwnO<~-p\ūSs esC n\(ZA4B|b){_)xvfE;;`9SM9[vcY+-Pr]:?L&X8`gGZ)4ʝ.9,WL/šZǼ0)io91M sߥP,6RP0H*c-7 >A78R93:Jdy}^c?|:,u |i,)p6ڥ>7^(w{e{嗏mF$&r%=Ӵ4{#Lqrީ](2^KH̖?)NY6NF6ֹ!u +T\(9p,ܻQ*ܙIA׎ڜMk +إ 󀴵l!wVIX6$W7e_ݟ է$&y("O^b[4?4~a?^n=*u)(.pTC{lNՅ(߸3;FC'L+6_~|? / UcM(B<\;XI>b̼G?0i.m=As؍Oc\_9o D,d8:[y5!k5Er ry#ئ8Dת o,ʜ/(}~jR哜1.砑Mj=Ax ]Ns?fsFÑxkA~liZ^u mCKT E"_4,UM#^Ng$.;-i&w_U!4M^ TIKɫZHlNQI'갥eU +L +tg况ULK HM8IX~!Г+_%g\,iλybU˴xS9AƷdq:Yg[) Fl︚Z*XԟTbVw}eޑfDJڝڝ_=g-Y Z֣'WOȶg ^U5,$1/ޭ^߄ BP(R^ a^pUW#yw%7"Ds8&%۳E^f鳇5on)'VkוBh6iU./~kү>3]B endstream endobj 309 0 obj @@ -3583,18 +3570,21 @@ endobj /Length 3610 >> stream -x\M$ s% l drXwm9籺$88ǽ(|j*=~^S9Z[|?}8yWK" >%Rh{R,|=ݡn~=}ӿst"br!j@(%WJL0,H#EjpA  +x\ߋ$~b 'K/0C&Z\1[\GqoV]PHH3QX\!1 rlqA3eͅq +s w}V 5Z\-x7-.H]  (,.@~suMYsjqAW0)+,.;: EzodODdg= P ak4U#’w} [2Y\6-.EX-.Up WvlqAn2|,;' @Y pa PXFZ\P"t-.(dkշ=.ps`2W%e`UKtm*dX\P -;`qR"-.;),.4PՈܒ"T`qAՠ5V2{Iڒ}frvR*Z\0NLiʠ hl`m).Zl7BMo .,.h>;)-.C-T7#[\f~[<#neo CŔAM͈[p`'KKllqAYo7/ Torx750%2MTރxSA}f 8yzry{y|ed^4Yl^5@Z0x'ܮ>KTP3kI6{ٌhv>/ +eG|#Iڱaߟ`lQf_WT;@ӽ-5^N -ƶc[j8ԵM5_O,`GSmpL -CMXB}LkT -Қ ~q"kY\^D qİ]k,,^"WeG=_eu /.Xl*" eЄ>qTM[pAC|NyiPP6}hssi˾U"WJu|b:c퀼36vS ̂/| -kCl<%^%|f=# _%>{xy͖jc˟E.i_?}͟w|}`|2>r.E` ?ϯcLSvjBkːv2dm߭۰ }A!ʎ8 1f;nڵГՓWKuOѥ7k}׶rߗMr3|ڦlZ[&ﭷ+>‚`bޯ#,-lцwVQ}qJr~𛛬ja6Vn%yeeh^M76mp0bN7U~2%y؏nEՓVi]9_#f9mBs{966NZquێ;ւnLkĉD*++g(sum.;[[z譎o~yo~"O';ˤlj0Sӷ߭=Uu#:n쨸߶e>زLi߾V]zNdZ /sβ,Ϻ?OɄ/+ƽGo~iZ=$G8j+~[ ̯ y|(ͱ;ߤKyjIto$$&?ozwٲd_9XYvz氷֧̓9V[E˒x>ȄnHa“F ܣuAfeӒ"e -~ -]e[|u ˷<`8uL&o3FaȊ'l7<kIe TiPqn ,/;+Bcf&!aGiV8a2)đ4)RDNqlSzazџRT!4e<Ӭc,Ttm}U9tP@tr#YzN H"g,-xs}Tu6HzPfО(]=S^OfYf\M+QSL'mWe1UɇoxZQ%eϖْ:vcl{VHC'Sb| j+!W Qs(iy+9CX^SK#>둰| ~O[+O)=w|h#,/x[X."[Ey#I[5TG\>Y~1g +;`qR"-.;),.4PՈܒ"T`qAՠ5V2{Iڒ}frvR*Z\0NLiʠ hl`m).Zl7BMo .,.h>;)-.C-T7#[\f~[<#neo CŔAM͈[p`'KKllqAYo7/ Torx750%2MTރxSA}f 8yzry{y|ed^4Yl^5@Z0x'ܮ>KTP3kI6{ٌhv>/ ˕#$HAXذO0k+*Lrb/'c[ +v-`]p5ZЋ'l#)Ͷc8 ws&WIϡu,^Na?>5A*iM`8N,mu@vY]8bخ5Z[/ZekUs,Q²}mn|h[8-c yjPU>Tz<ێ4}(>499ԴeK*+w>~1Xvc1v@d)ۿK}fr>~yDiՌ!6|/| >3Wr/xY=r.E` ?ϯcLSvjBkːv2dm߭۰ }A!ʎ8 1f;nڵГՓW+uOѥ7k}׶rߗMr3|ڦlZ[&ﭷ+>‚`bޯ#,-lцwVQ}qJr~𛛬ja6Vn%yeeh^M76mp0bN7U~2%y؏nEՓVi]9_#f9mBs{966NZquێ;ւnLkĉD*++g(sum.;[[z譎o~yoHOvLo9 ݗI`o-[X]ױڎtw븱~ۖ`3]Zu49si3(1Bx8˲=<&;Vَ2fg[}tjuu8sGn٧72~|sy lC'cߟwIao|&|W6]e˒}7V8bgKkՊ^Z6$w?=yW ّC;˳ULa1l8q +V/CfWe߃W$&|= ؀',Տ8 vH4ٵuR 5>9?-Ϧ6@{VXޢQGyru<@^z5܄#w}u ~\M9 C(m +z:8SF3%U83CQ)ՀmjQSR2L/^ +ԁ*#䐦g]wljm1z*jUcb³QZp:AiأQИo*I Š `cui,ˌi2j- #&*VoTK4 +ݹrԒ>{<[Rǎcvmj<ɳ2thQ1c>`?˕P+9ל!,/)\եG둰| ~O[+O)=w|h#,/x[X."[Ey#I[5TG\>Y~r endstream endobj 313 0 obj @@ -3611,18 +3601,22 @@ endobj 314 0 obj << /Filter /FlateDecode -/Length 3665 +/Length 3664 >> stream -x\ێ}gY 0#@\B ȃ4VX\ !Y\Gqof]PH`Z\x]` И HK,.]ƚ[9*5Y\T0}:ʰnaeG)U "x-.]gQKHm w7D X\uM]ubqA0DGjqA"W xGf x S,\kò54Uҁw=a-x\-.H] P,.@,8X\s UR>S!,S,$֮r-,9 R JȾ] 2E dT rL؏.W2([\8b{)W-.;M,. H,.XT,.@(r% 3t,H-.@ % A J(e&oq"40bqA4U;M0ЄlG fS,Rn7K7 2> ONd @yoqAf .uY,.X7U%"E1u&%` U,.)~X\4Md@f6 ,xi7Z{{,,扁FV{yfAG2 ;˒SU(ɛ|Lp=}!#fX9F5|NB=gIY!8?Kҍr2_=v1(\H-n -ᶞBbLHfɦ_ls| G r=LɂXdl7zW~6_ޜ#x/{=SO8 ~{2b_=IGFzG7\Hk=^ߗ.]v`i}Ѻw෬|FZ_ֿ~\,}E&\jҟ1!i:Ty&_iuoTmkzk07Y7k[ŵNUƥ^ZS13~MV mZs?m/m8>VXþ x13ь) bY(_/3M>;"z}#[ݵ' ?.eVex^V{+_m{in#\zݲdD}feuz}][}v4[,}oftNcm_qI Y'ĶoE>9u-Ol `O$p[^=olixB3c~ՍYvD󔯿~~ qح۬k>n;I#Dc;uxumu|ˉ0{#ǽL[&#pQc5aoOgQ#Dc;)~x)m#E=~#Eѕ#yDHGFߎ~ڍQtvs7kۗ];~zcθR[I/v~ ީf z?dfW>B9հc{qz'Ǔcۍkku,~i㴙Yܼ}̿vƒ-iiϱUaV\^sɍWfGn}L1Ga%ĝ-BͶrGH0FY @*4Hi<.z}<u\>N]x9є4H;ޔ&_np}LDo8Sv%!n(׍w0އn erj'*+qjyj/gxWΦpq -Aag$,7;F* gr͕'˱1oR)O٬m-5'h3=-m9sWf}'G4(A 㹞VyOGjδ{eJ4,kf}hZxQĪq_gom/ e;7WVymo- "EoYՄgih0mNiyؒ}*F9czz}q*-+]\jk{y /ZaoObAU~-7MvA]D$AJ9\"J.ŷJ< wDG;Z*_qRS hP溣qbb? Q8HCw7]}6M׾L~)J_C|{٨W\on?eHsil2}URERe Iw)}}F'6xkY:ewf [z1VQ k[]Wc9>Y~k_ +x\Mϯ,V 0 @A4VݵҮ[XͰM> EȕRsɻ=-56E~s<"T +8\c|\/N^CjM7v죡PybC9d9 VK1K*-`HP`GUI,`PP +ޛ:" E`dTj.CG9X:fP$KW]J)K''K%t"\K‰P2[ ,֩ :`ɓb-"BK.G]-M6uXQ ]c5uK"tȹc],]:`[ , + +rK  NBNrfBNR'YDX$ ErMp 8 *X\ ,A +݊dqoSA-.`0.$0(T-.`p.;-.`.{SA,%Y\]xW:`[\vtL-..x(X\Yudq|ŅR ŋ !e5x7D }@AB?h1X\T5 rTj w`L]uaqcʎRD.[\bq8! "xҁw)ToqA"o!͑뚺|-- /`S,.;<Ex$$=X @eki$0z [:Z\6-.HYX\Yp q5dqA:|.9CAYX$H]Z,.X8 r  #p}`d\"䘰U-] +dе+Q gqdqR`[\w.Y\БX\+`X\PJ@fnXd[\L:" JdPLDh%ajK'^"ihq v`JS, 0?َ`&9X8n JMof d|TơJ `]~X\Pc-n+'of KDbIS5-8 MKX\PSfi#lwc3Y:.2dq +o"33[YtYꍈ摁"Ze|ud&v%P7 <8z4Q%CF,YY,}sj@?|{?/Cp~kd rK{&HSQZ\$B1m=/ Ċ,#M*抓Xf r=LɂXdl7zͷ3|ywWzLA?4^.;ˈy~~(&ykmMr"MxG~_kwimE^zx߲i}Zڧ_Ytrų}p :Kr0d7iHPjh[|սPUaewܴd߭m=:Umzi2Ode68S۴4 ~L۸_\\q}X}bgQS( 93P~A_igZ?|vJE*Gk;WO7;\am;ˬiV쭿FGF|">:PekGg~:,N6:iXrkftNcm_qI Y'ĶﶳE>;m=Ol `$pߎ->mlixB3c;-=dcoD󔯿~~ qح۬k>n;I#Dc;&>;mG=>eͯ'LoFL[&`(1o?"űO)~x)m#E=~O#EѕۑiDHGFߎ~ڍQtvs7kۗ];~zSθR[Yv~+ީf zw2+!Yj1M>v~=y2pˆ#@8mC7}󯩝m~1sZZslեvy{CrƕzmhS~hun٢Eh1v?\Hr#(THT)Mw1?'\o^ak)/;zcǛäP 7/2npj43L9ruҖz̷Qn̖^7 +´wz%|CYXD9^';)rar.R,r7՛#6Wž,ļ]~Hu?sOy*fn=?mI_=Ayi˱89H<@ Zt#t| +=Rs,UaYX5Ckm'Vͤ=3~3h{Y -۹:nw׾wmKnYy,~˪&Y< iŰt~=wj׷I{SanXR[kH~ +C| xDm ui &"_RUv>(UkdžW&:u*W㵔:fG2 IB?u7AGvhV7i:o /'t{)ZSͺwOjVOy2D!|[ӂi1쫰4G^zr2뭭>S*,? W o.SnF<[nS\2M8/(}%)fv\csYS]\!ͥ +K!VJKy/$ݥAQ⭑fy#H;r>;ۋ7+bdIk$c+u]ӹr q|/{g&w!N;gq3NVA۝| /K`X]N8Fgp) EVkg'}S}̊O%A؉I_,:uNr=}w[79+=ue3 L?TFؼ&qjRgPY 'q'Ί=y܌}-ra}Baex$JZuth%L07a60!NSG)saJ#C'#M72 +R` sBsuy_!TکKgiJ;R^i[1ZhwX䌥1R fe\VsdN[tobnzY32bZ)bH-YFC]mE-qOyΏ=,,WwdǾewi2qY<|=e/XrBeDŽ@-9i|I "vq2|5J'"d g?2dC>jȾzsHf__YZBuT5-.|+L1P,?CvƏ endstream endobj 315 0 obj @@ -3651,20 +3645,19 @@ endobj 317 0 obj << /Filter /FlateDecode -/Length 3689 +/Length 3947 >> stream -x[oϧ8p8A"EE$JP>?˞Ieq] p͐=>'W\)5'9_^^Rbw%H5x~.r:ߝ\gsp@ˏv죡PybC9d9tVK3b GURKT0CB( L|TU2Tc6TaM " EdTj.CG9X:fP$KW]J)K'%VO.–H"-]-؛:JfKaKw+:'KWZDL]Η\࣋[:"17aEaR6t$-}t [_K1Vk͞EBS[0B->' XANd1   -;)R, -RBNRt,-QE&"Xp` -X,`-Abb[,0x+paX .$ T ebXbSX.KI e!o@]fi` &1X . 2 - 00Y,\qo@PX,p7dS [,p7Dtn>X,p7HH 0QlBb=t-2X,.U?cMVJM "Kgꪣ ^vRX]*X]X,"jX]bDjKRbAw7DX,@|s1uM]ub RX(|IL]vHd0vył"W bAw 1uKX:,[cM#Yu>tZ,HஆM) 0!  RWsN R!3u:Z,d:"Y, vkXl,[2X,@F*!6lAh$sX,1a?Z\+QX8bX+X xł\a "W2sKGIdY,( XPB.3yKՖN3ł"ih;M`bG7b6?lbc` GXPJfXP -l >X,fXP=lAg4MXCłJ  .uY,TobgIbA:؂L~tt * jJ, f`<(q+d]db.Dfk=33[YtYFVV<3CeI*c"ӧ*a:d̒B=([~ n?[Naec󫆊R`d;hR aܣF:$`q;tS#nɰXm&$3Kd. -d[n͋mA,Z`xu~:_ܞ#x/{=SП4^.ȶ;ˈqŷs;z<5uߎVn>v^|6ײ5/[37h>sm۝ g|'q-0omZZ]/{-A_kaY-͞Ѵ-Ȗix(Jrj9r~[Dm3c j+{suO/'VDGR.>^W>6ǣS8pxy()gxӦk|JTǩX)@i[fKi_gkό[dmd>z}>Ǻ?4oLr5#6e{^Wȃkvtvߩywu, f49ͣE>])5b$88oD&/=Lt=vg^FocRՇ1 2L׾udɎC8<"W'Gcݟv(tG7~H"Dq¢}˝~~vIkk3~R͙9ˢQ[|$?8|El݉Ho7Mؗ$ 2a͆Cx-v?JR'(u,Ç8O.+/Dc3zɭsh5f. |ĕ!Z Ӎ+` 97]<mMSLG#o}g%vV2p3fM>jɾzKo{ߣZ8mB2VQk[Odo=5,_; +x\[d ~_UU I &<0yϧ:u;}4=dClRI:=~>/59|ˉL +o +gKL%pY>TKtWk7cΔ _{rJVWX!\ ++Z% FHJK bsYae9Yde1l IaY<B)<Lңs\\Qy <6XWL1dǐ%/@`IA9iY| kYS^, ExJfVy<)y {x֚*MI9)Y'9;)79CGNئԛIÂB4Y8xDQo:ְ~)fְxBOԛI% EQyISQz"dq5,(1J5,@zz$Lqp7 "3&2['oHtf3' {zf@_C2GaLKӧ*bfN`d3Ͷ_<}{ǏIY0~ϱb_7&m'H$GHe +iMD(F-E"E2SWƻyQ*X앏od:B݋/ {_wyuޫ;R'9=ռTEY;$2mz] +ڼ}^y;G yv# ":d 'o~>}?~ş1} +=N|-qeNmsWC^~CC&6zl4eч־}\ۖ趍J}kjǩzoǐ'4ioȢ.nu۸xSˏ(L ,[,fo<9"V58)QAwNnև!/*Zv87/YCc+id^7?;MAr$Se_= =,,| _Tf/AAO7Sn^}Z7S˼[.YcxVM -(@`rq3JIZT[{ѻvY|vzXKfw+zqku֎.sn wE>nhvYmk՚=*ʫ-RWf{s깲+mHFL-ՖGK>6-Qr va hGЏ ~л}8c7{X[q}Dr;Ďp0Ǻw{o]`7,w{Y-ui{Sןfj1tTT^/`_TZgu.{efg7)fޯC.ʼnos6[1aK֚~o2\jQ(ّTL[Plo')>9ӽi*=t/ibO {՚2궕D=e[̏R)rjҚZ>cAN5C/b|x>L n0=\L󋒜vXRn_ݦ6ߗ,yrB-khJT^f\r$6Մ7-n.e_2|hv)޲\& %f,21L *;a/H;vY.Kv{Ds]0ƴ*O떤Tu/nEq+x8_Q~/腢.k^WE{qu=y7h G{7ƴýܮ^2m}i/2}5=ul{1cmca9^6ezۇۺMؽS56ۆc]w+n'_g؆y!'ޯ"a`roߔR.;cCBzg搣$OGv#9Ov>Î"fK%;^_GR@PoiynXM^0rzc@ )|vNU}P e[|~Ws r])3;ƿ} mb},WS(fczl@g۷V3=V%` 墵n(!^4pt6Y!3Wc!qW 7rFv.HлCLn+DHՓ,/fU8pv|l=-p$2$;XyIb.N}U]ui[I>Tyծյh"T[ O +rRS욼s7$Jo.']-JU]KeC +%y,c)/v)I~:+P#/ri/rW\qo0'x xh( Y`]YAxL(YlNm0!Y MRy(LRL -ChCQy% O'odiYO &_C!MQx\0dx@g29k(s1i0K0Kp; BQCr*Pa Cаx& h˰ p˶8 xE  1ĥY”%`Ѕ' K!z K%vVʃ,0` \& K&  7`V 0jX[1>gaw}aw}BPyI!h0p׳P Ǫpt`5,@ϓhx%+O%jX.cT^1.ABX4,]*Ұ wY`AD#DjuX pyCа` ߌ0]W-9kX%aH!9 "հ wދkkiʃ,k*>dXx]0km*D஄M b@@,kX3R԰  R> ɂY*pb XB%kX]y-JD@t>_?|7ç.?(s nqn`-,fZ -w,#Pk;-5:~BxVvCjnß2No/6ڭ򵲟wu6ۘP?~S3P5{y&XӿQ1O/D&lj+3-}Թ<1~,Dess DyQ"};XM#ݥvDV@dWi -['=I|*oLc̵ݦ*S bi_qAIdױ,Oi- U?S( -&/{I[廥\F~uy7kfn-0)ZoͲD-Ro7O\2Ma E%7v2F|dߙn.S/./bȓ)uEyÄzchQEuhKV=r0@{EA^Ͷk 9M璝.;+a ] 1tN&N/K-uvv،z9]mknc~Nmw2[{it:. -μ'k棱Yl|UF!.\,3yR&eu5qzTl=/?ӹ:GQw?Ьl=mY^<}mv-/='QeenwLB1B$ ˙Xİ,uc6d~x2\#ϼhvY`[F) -e9}su>:9SuOZֶYeUC'(6LkC.%w:N8S*B^)bA[D:NU8)tho~%:FI&>#]ua R9&וcSxGP{-`SpX9na'#xIv[A@zAP^ ktW$G#~Z&:˱ \3] c -Ku>DAC9k9 E_n>l^95?o>aXRPkE64V[n;}}F{У/e+8Ao15]# 8%OmgfQ+q\TZq_O%#Uq}I)Z9Jr؟p8Bsu>L OіBx=3=fc] -wh-ex2ŖX6%{C,ajp"<<I+'A|n|g=86gX̪K^=\|tKзT+ѲqFR}A˻Ǧgr[Uf+6N)O0w,f;]RI0` ^@xȁ]Wdh!W@a]|&Ǣ)2W_S1NRq, 񻖔 ]Qi{G)IV31_.>,i~򀾑&Mx[S_T5մm$TJ >O -vQ4c2;5yB͐+B]rkkTZ()w+KM>bܒ屈>6Ov ^#\BRJ64ӛ4{T9"k6> +/Dest (cb6-1) +>> +endobj +322 0 obj +<< +/Filter /FlateDecode +/Length 3538 +>> +stream +xM +leVl z"V룻v7h!ibXY=τ=)])5'9_ޜޞH,7dz'.Jmu\Q\oQHw|~?EzT!2sGUO)h0adž נ:@Ki gzcz|;t |w?|_7O?Mo|瘯KZ_o&%V"Sm_77c襦{o¶*XzuW_1D+:ʰ0^6f< "*݀?.ٻ 8-nOA/DڻH{[DؓˌiN*EoP@IY1zDn#56WKtc^k%4IW_v\y^cklǩ[Yc\읯% {Xwq|Z+|cʺ=mʫ+X9OS43rXh}Y)iks?8~(bw:mqK2/\h\~aHBFߋi3><.cqgu|t=|=f";i-Z/{-CfZs֘5xˤif1KF}[Nʡ/ych-iDWnuϮyrV ftOE~^=>Ǿ?m*JS~$S R;VDwA8BcN~^}>Ǿk.,Vcƺ.6^&M|~ +WԈ2HG2F2g)[#Q甉5nqs;1T+?_~wyyv2ı9}r8ig\x QoI(\x!y>NӞ8Ӫ5og`O/+c]mPv+72^uɶi} #]H)\ƻKݴBqg3:flp<')烾چcz'% 6M~q?sBj}G}dtLdrq}Z%!;\bEFXG}D]NPSݷh8}z1v5z~lsvB/O]683X_N\qnJLfG2{IB Pwץ!Ϯ!Or°ޙR}uռx2vil-H'Ct9ϩu-̮fMg +K $jkg.'[3{2NÔ\ e*̳;q+5)nAx9:VPl7 y귋 x\4L]Y>`u0AtmvI߬|98,C#%.qMGJVt"Nq8 Xe35 A~u`*#NFn*&(y>;?Z7Fz&Tޥw_J;l)/i{s-Ok{3(-ds0$-㴵A& EddlJi-KC8Jwbg%j-j{phd1di>Ke&;-۱[=O!Ð4*SC߇9V eD->swPI }M7Kn9+9iJ0N){m= wPSW7اU2/pUG Z~]rCf*oga-zT~; +endstream +endobj +323 0 obj +<< /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 320 0 R +/Contents 322 0 R /Resources 4 0 R -/Annots [ 322 0 R 323 0 R 324 0 R 325 0 R 326 0 R 327 0 R 328 0 R 329 0 R 330 0 R 331 0 R 332 0 R 333 0 R 334 0 R 335 0 R 336 0 R 337 0 R 338 0 R 339 0 R 340 0 R 341 0 R 342 0 R 343 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -322 0 obj +324 0 obj +<< +/Filter /FlateDecode +/Length 4631 +>> +stream +x\[$m~_V+ 0XI~00,0Ӟ C~>Jfw9sAOwPR]-s/39zŚ,#>)\d+1/BdR >./?:M)ѻpWa1SAa#Iɇ3b) bĞY bpAcA >+ 1{V>9XÕykU &BQygb.K^1b %8f SN/BdUd9KC;Ee*h+dB*gs%ų>YCH_Xdxi@@, Uy +kX@D3iX@@[hX@[iX@[.jX@\i5, . T4, `.;5, .=iX@@] +kX@]5, .0p5UdkXt42iX]r6iX]װj`Q؊9[ e BK>H0p A]װ}԰b?Va=x4,@c#-Ѱ w]AS|he\.QÂuӧq WZ6.ƢaA"P  "װ w!RkcXKB3TQ V@JY`~d4,M,sTde5,x5,mz3iXP,dAƧaAHa`|@)Opnwk9/e1c׺PPe*]ii:ijRv¶>3V*NR_y]I՞>rI< knù'[y~jȹcÍxMkꛧNLk]7{N޺ SIWh15۹קrP\oaO~Yk?w>i~8q5]F}n~1cT\s5԰nE}:_v91G~Xm{? Z,u-J]|]c~{[ֱ|]y/B֯oFU~-ETBPڷkO)cex[bk1 '`oۺjТ(T%Ylɖrawh??X5skNw~k$jx x +i +D_n(J,K\6#pu~(tyCLW/ʻ&,C-z]UNXV@5.9#mqIEȑҲVW.W:@,]:F@̀`ZrI.qǙR9b:H " r4uqQLD>nG{x#s=<Ԑ,-aN0ME6) [6n96l;Ek +TNGq <Hsu>6hnr'{ rw]=ΧLXK6*%9B9OӢ5YJ4S8\Ꝭ&ZپE_m(*uarH\ܮyq ÒZ;.%r7ڃ},TS"`V]g?U(c_MXy#z^<958o/:\y4#у,lk0r[-vA$"ZV'-7^$Ó?>x,R_Gqa"cs.&z˜1ˢ-Jm> ʍP\g &[QF(6:۪0[tJy·QNf1;1?Ol=#Oǃe]-EPV躺]&G Ѥ +<5=%Oq'vҍwdiXߵ\O^OKNO=ʷܴNNlNJzi_W`,HKd6\ l q&WjiK Yy݆> +endobj +326 0 obj << /Type /Annot /Subtype /Link @@ -3732,10 +3767,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-1) +/Dest (cb9-1) >> endobj -323 0 obj +327 0 obj << /Type /Annot /Subtype /Link @@ -3743,10 +3778,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-2) +/Dest (cb9-2) >> endobj -324 0 obj +328 0 obj << /Type /Annot /Subtype /Link @@ -3754,10 +3789,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-3) +/Dest (cb9-3) >> endobj -325 0 obj +329 0 obj << /Type /Annot /Subtype /Link @@ -3765,10 +3800,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-4) +/Dest (cb9-4) >> endobj -326 0 obj +330 0 obj << /Type /Annot /Subtype /Link @@ -3776,10 +3811,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-5) +/Dest (cb9-5) >> endobj -327 0 obj +331 0 obj << /Type /Annot /Subtype /Link @@ -3787,10 +3822,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-6) +/Dest (cb9-6) >> endobj -328 0 obj +332 0 obj << /Type /Annot /Subtype /Link @@ -3798,10 +3833,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-7) +/Dest (cb9-7) >> endobj -329 0 obj +333 0 obj << /Type /Annot /Subtype /Link @@ -3809,10 +3844,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-8) +/Dest (cb9-8) >> endobj -330 0 obj +334 0 obj << /Type /Annot /Subtype /Link @@ -3820,10 +3855,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-9) +/Dest (cb9-9) >> endobj -331 0 obj +335 0 obj << /Type /Annot /Subtype /Link @@ -3831,10 +3866,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-10) +/Dest (cb9-10) >> endobj -332 0 obj +336 0 obj << /Type /Annot /Subtype /Link @@ -3842,10 +3877,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-11) +/Dest (cb9-11) >> endobj -333 0 obj +337 0 obj << /Type /Annot /Subtype /Link @@ -3853,10 +3888,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-12) +/Dest (cb9-12) >> endobj -334 0 obj +338 0 obj << /Type /Annot /Subtype /Link @@ -3864,10 +3899,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-13) +/Dest (cb9-13) >> endobj -335 0 obj +339 0 obj << /Type /Annot /Subtype /Link @@ -3875,10 +3910,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-14) +/Dest (cb9-14) >> endobj -336 0 obj +340 0 obj << /Type /Annot /Subtype /Link @@ -3886,10 +3921,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-15) +/Dest (cb9-15) >> endobj -337 0 obj +341 0 obj << /Type /Annot /Subtype /Link @@ -3897,10 +3932,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-16) +/Dest (cb9-16) >> endobj -338 0 obj +342 0 obj << /Type /Annot /Subtype /Link @@ -3908,10 +3943,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-17) +/Dest (cb9-17) >> endobj -339 0 obj +343 0 obj << /Type /Annot /Subtype /Link @@ -3919,10 +3954,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-18) +/Dest (cb9-18) >> endobj -340 0 obj +344 0 obj << /Type /Annot /Subtype /Link @@ -3930,10 +3965,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-19) +/Dest (cb9-19) >> endobj -341 0 obj +345 0 obj << /Type /Annot /Subtype /Link @@ -3941,10 +3976,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-20) +/Dest (cb9-20) >> endobj -342 0 obj +346 0 obj << /Type /Annot /Subtype /Link @@ -3952,10 +3987,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-21) +/Dest (cb9-21) >> endobj -343 0 obj +347 0 obj << /Type /Annot /Subtype /Link @@ -3963,42 +3998,44 @@ endobj /BS << /W 0 >> -/Dest (cb3-22) +/Dest (cb9-22) >> endobj -344 0 obj +348 0 obj << /Filter /FlateDecode -/Length 4927 +/Length 4926 >> stream -x][$m~_ `>y؝ݱ p|T.g%JK"?*ڝ-~~p/39闓5-J~dؕdRa.o??6M);>(S -HlRRtXFӖ  bY!e(%#1\ᤐ[ % -^965w&JK5Z&&r4Z11F 4CvDVA -9iYB VASh xNQh@J,6ZJ0\2J+ٜ-!XafPi(LRL -Ch4z G'8kbxHAL>B #aOP񤁀PPJA_P,IÁ`hi@,daY K(aA4,x --A[4,[iXd]԰ p!հ qCaAB.=iXװ vaArV* @5,:rа٤awaF^̪F +l5, ϖ4, Op*-`аq z^zQ(X5BX V{|а̌GXaw]Slhe\.QSiŸWl\EQ   <װ.Sk4jX] a8g*[rְ%aHҒ"9 "հ wދk9 "pYB  f4Uc=Bw k4வhX65,I -|ְD^ÂɔXhp$d4B4,@`mJ(YÂ!K^Â! B }dADL.D$0-zZe\Ұ %2pNR&5, 4,9Ұ SѰd\9Ȃ [D9aAѠgdjX\CJ5,Li)UdLhXd5,@diJ,IÂYÂ!^IÂb! "> Fd YaAq' `of J7)v[B|3iXP0BY4nI7N-B_HÂY7ѫKYͤ.w4pi԰7jrB|dY]1^oU ,*k+9h1Y樮謺l`h էy*B|fNrfA{1w]ӯ?_Օ$,& pe*;B@^0F>FHeˢ W w[[ Ef`"SpuYn$Y!E !膯Ǯ6O׹1Hwy 9FB&k_UȽʻw~:BU~ϠPIc55ý̆3[:!ˎǚ+>Dy]Y=N%_HPr V|JLjΨ{ 'ֆ]mg|X=vv i-G}ivӮ ,E3nWxZ"$L)(Ÿ#6o%{ĩg@]5X U~82ȓw>YoR>2W#yFI8X;=/yKѩ>X{(h rl,b>bcSFJU a͕iI1$zܽ'kk59*{-gd}ٯ&נ~{L?ÎD0r}Km%)xP( e2AbrYG>w&q)3pEZ}*\(O#sF.Hd,k->>81puuc)i9KI[,%)x#W=+jQd-Dv_B"P$fOvf]d~VkU 6e.{㢅L&g<;?5]mϸ2|~x58Ͳ% JybҚ -4EȲQ? {I'3-{-D FݏDKi}gH#ohip04VҶ\SpOhr6m |P"+Yy7{D=k <  X$^}dXއv)ڐGlǚ| `:SC58jl#y%n=Ї|W8×>%4^;0ȭ#YBbvla-㓾w7wNZ.߱Gxڽa -!tJﰏg?um%voPu/+1{/ͪ t}9AθqªoAƱ&ϐ!p"Xh9CǪcۚq* +ql 9cM>'VΒݚw ot,ťxhlrږGd:H}^zZV_p}ѧMր7 )əO^4z{ˋ9. y)jō}.ZX=6kwC׫W|gmiw0uwW=R[XK( _Qzd>WWeWwzI%9Jޗ I-a2|^+Ӣ*eG*!5םV{͔B=lk~7^Vbex,WC'ݡ㫀H?׺l-f%ErcqpHsrW89UfўcM>eʷ|3N}yq;${P< ]cwEEw.\ʗɋą»G{Y2|ş'y{via!ic{g,@MﴬGsk(rVqXR'瓼>ԓum-ξ]ⷓLJ1b)\>΋\ǬV'L d/]>znw#5d%]_:V -2mܽ5n)ө,W±,YwgHsp4-vN-SwXޝou}X>Em.}SK%nz$Tj >OJI)6քidKanD^iZo}RGF~2T=>J?و 8 F;o -_NLGۉRVXn7o/v(.`Le/PT~pUJVW^pPFjq֎Nr8L/,9rCOtvŏ{wl]ϞL% ,o hlBObG]n^hn#ԹNžwaQr5=ֹr͡ GT6p1.K\IA%?5SeHSrOTk Fά[Y -B0_̌͝<7"rl {\oLJ;饡^e96#yBriЂVNy4[*)UQt@mecj2ťYzYcQyy>ΥժVԕѼrPKmK6u}ii6J+"md a(|o.e0jߩ7-7RЀ9Y _RP7^')HЛu~Z-ԟyҀ +x][$m~_ `p8 yGuR]xv0;]D$#R29sI/~=Y_?7YJ]ϿHAH&)NrvoN_qgoJ_DeT@.($f稐3R4D1dH +)C@Ʌ-@ i$ +',pZA,Q +ͱѼ31_TZ%B01cъ1rhYX# PIEb* FKctBːڕUd:VᒉTZ攷4opj4 C7JEabRhDEAkY? 8!X68ƐD* `55% |J' |2e |.R + †bI@N`! SԐ 8B\YB! ,aASа m ڢaAܒ-NÂ%뢆 1r$  T4,԰ taI (G p7p7Ti +a &  3`V 0jX]1>gaw}aw} Pi[<7p׳pד@Q Ǫpz8Y߃惆`f<  +ܟb@+r0peLJ+%beb,0p*hX]gְoQ uZw/V"n` !а8 Uiؒ ,y @ iX06q ^4,]!hX4װq h0[Ŧ kfXwMEÂaALRೆ +L5,łOEkְ Y0 KAJakSB$Y$Y2hX[M E R԰Hfr!Ұ qD>Qhћ*-撆)+v 2FaHa͑@pE&{DA 9 ,5,>#ˌVxhjFV̬aAh$T԰fLH `B̏$۬a$HsTd L% Y@7%L YiXPl4&kXZ 7=iX|3kXPEOIÂB4Ȃ(v LB thB% @^]Ȓo&uȤрL@V-3%ꊁ2|d`VI]3_ɑE2GunDge EKT3s,0 BtsQ-S>~9%f1_0݀+S2D16"D*CHX\DHbrZdH,2;3hTzw':,w A7|8vm\yAdeM12YBUޕ.ȿÎr }$H/Le6ҙXv<b$$"+ hl_NrK%ϟ~9OOn?wr'/ڿ3c/e~Y -/^^D/?ߗі !erWle Q3-["[Z۰#cϊHb-3Y͗A9|?K@!EڽA19ăJcLLap "!:Km:RwN4Yo;5=,S9/6= [J9{Dr;zC=ɶA[Ln32l^y$dL::eNZkIPiP=bd'(YbSGMgZv˳N#x$5pE*n*HŷSaT8G[ݥU$UifIAW0;l[N(01y cs|]CZ++>Dy]Y=N%_HPr V|JLjΨ{ 'ֆ]mg|X=vv i-G}ivӮ ,E3nWxZ"$L)(Ÿ#6o%{ĩg@]5X U~82ȓw>YoR>2W#yFI8X{(h rl,b>bcSFJU a͕iI1$zܽ'kk59*{-gd_giMA.k6aTڗڔK=2S6Q4e6䲎|_gABĥQj +p9<ՎI\\"]u<`0ǘwՍ5,%my޳폨^FMrg} ֒CM>ț=wQ5YIxz9V'^ 썋3ǚ| G@tͶ=tu> 4˖8$()Ikv+@Ft!K &nGX3I^'M+HIw$ZJG$#w?-#DKDK񴒶r(4-{B㐳lcLp04>ÀYyʻ#YNhyOhИ\0ǚ|%g$+>Kц|8b;L#)l:Q#gs+qu> )݁Gn +`3l}ݾ};tuv= STZ}D=޿kC`/5&~گ{!X}nV}H[ rƍVM};l25yO99HB:V Gzҫ:g}` xcyݐE'HZkf[粫c) v7t:YqM|wv_,]і6}S{w#U=QuywKVޟ+Ns5zUxuwTC}b:&Iż_y1-z_yt*i\siձw0L[!#Yn6wEa)[V(w}ϲ[A5t]-H= +/q6ҺQikn0i]]Y-W9T8'w-Se >[|Knη: g[O E?VyW:_Xt]|Θ~>^nlU;S%ȸx…FOh桼>3l;̩t5q}mftpBV3QhV@kCo-q8)y`zsalRyA \6KyG]lq5:AcGFQur)ueJ!Si HuXuX Oʹ6!(o!'wSe;nRw|Gq6>Nvη—XT?NFo[9Fw뫜(OK#wV]ik%sOC!{t@(UN-<VnPJP┺]<=IA,_{-j endstream endobj -345 0 obj +349 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 344 0 R +/Contents 348 0 R /Resources 4 0 R -/Annots [ 346 0 R 347 0 R 348 0 R 349 0 R 350 0 R 351 0 R 352 0 R 353 0 R 354 0 R 355 0 R 356 0 R 357 0 R 358 0 R 359 0 R 360 0 R 361 0 R 362 0 R 363 0 R 364 0 R 365 0 R 366 0 R 367 0 R 368 0 R ] +/Annots [ 350 0 R 351 0 R 352 0 R 353 0 R 354 0 R 355 0 R 356 0 R 357 0 R 358 0 R 359 0 R 360 0 R 361 0 R 362 0 R 363 0 R 364 0 R 365 0 R 366 0 R 367 0 R 368 0 R 369 0 R 370 0 R 371 0 R 372 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -346 0 obj +350 0 obj << /Type /Annot /Subtype /Link @@ -4006,10 +4043,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-23) +/Dest (cb9-23) >> endobj -347 0 obj +351 0 obj << /Type /Annot /Subtype /Link @@ -4017,10 +4054,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-24) +/Dest (cb9-24) >> endobj -348 0 obj +352 0 obj << /Type /Annot /Subtype /Link @@ -4028,10 +4065,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-25) +/Dest (cb9-25) >> endobj -349 0 obj +353 0 obj << /Type /Annot /Subtype /Link @@ -4039,10 +4076,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-26) +/Dest (cb9-26) >> endobj -350 0 obj +354 0 obj << /Type /Annot /Subtype /Link @@ -4050,10 +4087,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-27) +/Dest (cb9-27) >> endobj -351 0 obj +355 0 obj << /Type /Annot /Subtype /Link @@ -4061,10 +4098,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-28) +/Dest (cb9-28) >> endobj -352 0 obj +356 0 obj << /Type /Annot /Subtype /Link @@ -4072,10 +4109,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-29) +/Dest (cb9-29) >> endobj -353 0 obj +357 0 obj << /Type /Annot /Subtype /Link @@ -4083,10 +4120,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-30) +/Dest (cb9-30) >> endobj -354 0 obj +358 0 obj << /Type /Annot /Subtype /Link @@ -4094,10 +4131,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-31) +/Dest (cb9-31) >> endobj -355 0 obj +359 0 obj << /Type /Annot /Subtype /Link @@ -4105,10 +4142,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-32) +/Dest (cb9-32) >> endobj -356 0 obj +360 0 obj << /Type /Annot /Subtype /Link @@ -4116,10 +4153,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-33) +/Dest (cb9-33) >> endobj -357 0 obj +361 0 obj << /Type /Annot /Subtype /Link @@ -4127,10 +4164,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-34) +/Dest (cb9-34) >> endobj -358 0 obj +362 0 obj << /Type /Annot /Subtype /Link @@ -4138,10 +4175,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-35) +/Dest (cb9-35) >> endobj -359 0 obj +363 0 obj << /Type /Annot /Subtype /Link @@ -4149,10 +4186,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-36) +/Dest (cb9-36) >> endobj -360 0 obj +364 0 obj << /Type /Annot /Subtype /Link @@ -4160,10 +4197,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-37) +/Dest (cb9-37) >> endobj -361 0 obj +365 0 obj << /Type /Annot /Subtype /Link @@ -4171,10 +4208,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-38) +/Dest (cb9-38) >> endobj -362 0 obj +366 0 obj << /Type /Annot /Subtype /Link @@ -4182,10 +4219,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-39) +/Dest (cb9-39) >> endobj -363 0 obj +367 0 obj << /Type /Annot /Subtype /Link @@ -4193,10 +4230,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-40) +/Dest (cb9-40) >> endobj -364 0 obj +368 0 obj << /Type /Annot /Subtype /Link @@ -4204,10 +4241,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-41) +/Dest (cb9-41) >> endobj -365 0 obj +369 0 obj << /Type /Annot /Subtype /Link @@ -4215,10 +4252,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-42) +/Dest (cb9-42) >> endobj -366 0 obj +370 0 obj << /Type /Annot /Subtype /Link @@ -4226,10 +4263,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-43) +/Dest (cb9-43) >> endobj -367 0 obj +371 0 obj << /Type /Annot /Subtype /Link @@ -4237,10 +4274,10 @@ endobj /BS << /W 0 >> -/Dest (cb3-44) +/Dest (cb9-44) >> endobj -368 0 obj +372 0 obj << /Type /Annot /Subtype /Link @@ -4248,42 +4285,44 @@ endobj /BS << /W 0 >> -/Dest (cb4-1) +/Dest (cb10-1) >> endobj -369 0 obj +373 0 obj << /Filter /FlateDecode -/Length 4731 +/Length 4729 >> stream -x]K$ȳH" l,>Í=ttX,0="U]cg*ԃA)EH?9L%EtbM -jEer2'!P2vs??:M)ѻpga1SAa#Iɇ3R4=߲Ƃ}VXb'G1|r +!),g!֪<b+<Lң\|Qy <#21 Nc Y1d : KpVA4^,ɪ)ñ$ :Ӏ,d 5$ Y ְtwǟ/~-k rV/ > =`v0~d9&Zmʶi)^m>䥺\&?-]5󗵛+=v6DگmT%_ϋ9utqy"?.[MFꥇ}#eokm{8ڬuL4/h--.m""YVEƂX *>{:oBX02^ܛ%A D ڄ뢆~1ln˟>Z޸myuXʟE`Fg=TٯP!5GSo(=.n\ suk[ߊO57R_u(5ՓudcVMyy9^Oh]"Z˥u]` vy֗{ vݻN;dp08?-_6ÙId%]s^rۊ|N9ِnb~g萆j.zvdI6r=:h#͈4~yiX >nkAߘlg3sU(˝Ŧ(<ѹ0<֖-IrAX᧪zM* d -g&ʑi2͌FhLf4eh-&3*r;ًe˶=ue+AKܵjD~BĐ<{5fhi89!k]fc -0j_%dE힛R?wa";sw;,r`cUV5\{[ѤGZ>^wmkⲼ&; -Ǿm8\7u@z]mZۖ~fCݶnlܴNl6zmnKg4zN8/]#1 - g)jzϽ!ISqX\Deo"ױBfn B\h/@M_ʺnnC& -m_:V-Ye'i6^.JMfG< dGv"[dM'tAϪs>MrA~UrXkiXh4 U:5}@Bz(lk1?޲s3$J+^.jG*RyT-MCaꔻZJMr#-Ycmd7r =q^BRJ64ӛ4{Ԕ&g_*B -/I5jt"[%Q5 8N.d$fg}lt؆:l%nu,ӱr&&M< UE7{ru&>N#v'oėxOϭAT3DyJnIXm_iK s>,]e~_o0%{wlݐH&'d<݈m& Q64kq yT[IuL CwӕfN=ֱ{vs&.e<!:5+):B:짊am;y -)K<avn]LE|17,OF[e#"}96jN:S Nz=U. h=IpZbщG@;FtE lS)՚ZgUKYa0J)+׳% P9d%BsNQoݢu đQ-ܔ|wsR腱SmcQc`QzD$3#f]Ȫ RE~!Z|+395)X%6g|R:Wbן@ɤ| ~.⯗mw]󋰘L)٠ +X֑ +CTXb) bĞoY bpAcA >+ 1[V>9XÕykU &BQygb.K^1b %8f SN/BdUd9KC;Ee*h+dB*gsʷ%ų>YCH_Xdxi@@, Uy +kX@D3iX@@[hX@[iX@[.jX@\i5, . T4, `.;5, .=iX@@] +kX@]5, .0p5UdkXt42iX]r6iX]װj`Q؊9[ e BK>H0p܂>Xaw=a  w!AO V{Ne}||M])k?OX|xLm B*"$|W%#!0n"&1n/n+4dҙzoѢKJ!Y7uR"1`J~|_?槯+k rV/ > =`v0s?-6eۏ46R]k?,]5׵+=v6D<ֺBCڇ_YoD[>m沿Кk3qǵUXnk׭&4KkZ燵Q-M:T/VjM8hik?R|ꊿ,zj ӽƥ*eo5޶=}a_h1ѼʢbnPڷ'E]$DD:.p!$@TLm}!uޅ0+`d07CK E ch?>fj{:Koaa+j*_aRw.ia~F|EF&1uϭERl !Wʿ joXV^su( ײm0x̋SWܠ=㢿@^Q"x(䭗޾_[fr+ Ĝ5XdM񰜩<=*}P@@v(NsUG1bZg Y.Sj&{e, +Ng'<:1sXJlQgH:o;ewzuNvamW D +Bsew4!xyBɘX};G6mj`Vva$cL-M8ڃ^e{hf#~L-GltyOMjpc@*Y|x2\ܶ⾜vN6d٦':!}76]h9Yi t}gqθ:ڈd3"Ͷ9~ju>nbaP=V*OpÇC8Qw{𫪧r(z\2BF#&=,yֶ "5#D?YrBxߚ֖$e&[byc3Wkjy4fF#CSw&32ޒ9wet:Oɲ pc?$ +~5"f!bHu]3ô{k.v1rctvM)؟0Xy Nہ9*In۽hR|dUs qY^lanc6G_G +}S_U .Iٶ -mKm}?q|?en[76no{Z'y6=r7%3\=l @M΅цUʳf=^J~d$Y8_E2[ٷA~uCׯ7; P8/)+׾[bGЪɩl[!ꗎ"jFwKƬdI Wb eG!ّhsk%]uq4Op>"\-*UkM5&JVqRH/mM3Q[bnĽ\iE-H^*i~2LrWB:ZI4|R%}m_.'%$tXaC3HSAM +hr^"t O⸛_3F'⛝ULuXӀ4NBFmv֗V)/Kwm&z*M<[VaM?+gmBAݔ_7!gl,Cowcי;9۝l_j`=YL?NYfS|zgqPܼھ'"</y}$'gY/O0%{wlݐH&'d<݈m& Q64kq yT[IuL CwӕfN=c3rI 1@M*\̷> endobj -371 0 obj +375 0 obj << /Type /Annot /Subtype /Link @@ -4291,10 +4330,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-1) +/Dest (cb13-1) >> endobj -372 0 obj +376 0 obj << /Type /Annot /Subtype /Link @@ -4302,10 +4341,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-2) +/Dest (cb13-2) >> endobj -373 0 obj +377 0 obj << /Type /Annot /Subtype /Link @@ -4313,10 +4352,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-3) +/Dest (cb13-3) >> endobj -374 0 obj +378 0 obj << /Type /Annot /Subtype /Link @@ -4324,10 +4363,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-4) +/Dest (cb13-4) >> endobj -375 0 obj +379 0 obj << /Type /Annot /Subtype /Link @@ -4335,10 +4374,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-5) +/Dest (cb13-5) >> endobj -376 0 obj +380 0 obj << /Type /Annot /Subtype /Link @@ -4346,10 +4385,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-6) +/Dest (cb13-6) >> endobj -377 0 obj +381 0 obj << /Type /Annot /Subtype /Link @@ -4357,10 +4396,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-7) +/Dest (cb13-7) >> endobj -378 0 obj +382 0 obj << /Type /Annot /Subtype /Link @@ -4368,10 +4407,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-8) +/Dest (cb13-8) >> endobj -379 0 obj +383 0 obj << /Type /Annot /Subtype /Link @@ -4379,10 +4418,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-9) +/Dest (cb13-9) >> endobj -380 0 obj +384 0 obj << /Type /Annot /Subtype /Link @@ -4390,10 +4429,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-10) +/Dest (cb13-10) >> endobj -381 0 obj +385 0 obj << /Type /Annot /Subtype /Link @@ -4401,10 +4440,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-11) +/Dest (cb13-11) >> endobj -382 0 obj +386 0 obj << /Type /Annot /Subtype /Link @@ -4412,10 +4451,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-12) +/Dest (cb13-12) >> endobj -383 0 obj +387 0 obj << /Type /Annot /Subtype /Link @@ -4423,10 +4462,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-13) +/Dest (cb13-13) >> endobj -384 0 obj +388 0 obj << /Type /Annot /Subtype /Link @@ -4434,10 +4473,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-14) +/Dest (cb13-14) >> endobj -385 0 obj +389 0 obj << /Type /Annot /Subtype /Link @@ -4445,10 +4484,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-15) +/Dest (cb13-15) >> endobj -386 0 obj +390 0 obj << /Type /Annot /Subtype /Link @@ -4456,10 +4495,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-16) +/Dest (cb13-16) >> endobj -387 0 obj +391 0 obj << /Type /Annot /Subtype /Link @@ -4467,10 +4506,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-17) +/Dest (cb13-17) >> endobj -388 0 obj +392 0 obj << /Type /Annot /Subtype /Link @@ -4478,10 +4517,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-18) +/Dest (cb13-18) >> endobj -389 0 obj +393 0 obj << /Type /Annot /Subtype /Link @@ -4489,10 +4528,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-19) +/Dest (cb13-19) >> endobj -390 0 obj +394 0 obj << /Type /Annot /Subtype /Link @@ -4500,10 +4539,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-20) +/Dest (cb13-20) >> endobj -391 0 obj +395 0 obj << /Type /Annot /Subtype /Link @@ -4511,10 +4550,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-21) +/Dest (cb13-21) >> endobj -392 0 obj +396 0 obj << /Type /Annot /Subtype /Link @@ -4522,10 +4561,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-22) +/Dest (cb13-22) >> endobj -393 0 obj +397 0 obj << /Type /Annot /Subtype /Link @@ -4533,10 +4572,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-23) +/Dest (cb13-23) >> endobj -394 0 obj +398 0 obj << /Type /Annot /Subtype /Link @@ -4544,10 +4583,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-24) +/Dest (cb13-24) >> endobj -395 0 obj +399 0 obj << /Type /Annot /Subtype /Link @@ -4555,10 +4594,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-25) +/Dest (cb13-25) >> endobj -396 0 obj +400 0 obj << /Type /Annot /Subtype /Link @@ -4566,10 +4605,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-26) +/Dest (cb13-26) >> endobj -397 0 obj +401 0 obj << /Type /Annot /Subtype /Link @@ -4577,10 +4616,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-27) +/Dest (cb13-27) >> endobj -398 0 obj +402 0 obj << /Type /Annot /Subtype /Link @@ -4588,10 +4627,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-28) +/Dest (cb13-28) >> endobj -399 0 obj +403 0 obj << /Type /Annot /Subtype /Link @@ -4599,10 +4638,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-29) +/Dest (cb13-29) >> endobj -400 0 obj +404 0 obj << /Type /Annot /Subtype /Link @@ -4610,10 +4649,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-30) +/Dest (cb13-30) >> endobj -401 0 obj +405 0 obj << /Type /Annot /Subtype /Link @@ -4621,43 +4660,50 @@ endobj /BS << /W 0 >> -/Dest (cb7-31) +/Dest (cb13-31) >> endobj -402 0 obj +406 0 obj << /Filter /FlateDecode -/Length 4923 +/Length 4922 >> stream -x]K$m赁+K". pAb|[ְ>a -PyI[fnkX]>jXC1F]@Hհ=x4,@c#,Ѱ w]4ʸ\2O4-l\EÂDE.3kX7Q3:_!hXs0ߌ0]W-9kX%afac3D%CrEaAbz/D DDe=*P n4Uc=Bwk<வhX2mjX|ְD^ÂٔXhp4,HRykX*YÂ! yaA!Lq\! "E d&f RǠU p2x.iXLNR&5, 4,9ְ WѰSsAtsNÂ! A 2հ34rIZ㱕<3kX9 5, R<а#vаM9*P` rnf r,z `o& ,4,(6 5,ge䛞5,_J5,(do"SP|3iXP(* h*o4^,%F73o"WI].dx]DQ\ Dd3%ꊁ̭ꒁbJꚁJ.@Ld9VtV]6_cÄӸDa sfNrn[ы'.c_1_ԕGI/n1A#H#B҅teMT鶜L3E0TuY$Y2C81J -b:OoW&u%+֐!(>dN4ـ)S }5!'+/3`Mr8-_ֽ 6b$f=_ ~y?Gk9'_q_j3BQ#KuDTCCv1$6 GpiM 4fL㳬.to:z'y߁ kLAV*C DK~K)wRˡN<Sm hӖNVϛ6Wel RPĝNwOD+:ĂZnul{As>d=&$\VyڂĦX]uխ8qq*rn/sÃD<\Oy򒺡[|-SZ7 };pI?͈@_22ZT[dO uCwN/?-`Jm1vu>ƇGX^f+Q|mZFZ)p'mNYQHUq 搝̸p ˴Y:HQ۶|먻,?q\y'k.øvg5>'YGB :t:ȓ -P:tUݿ/{rpT'GPh)_!gmtRoWn /[f?oU&pkV}X&pn8\qK$;\L&{)+z`GF } %`l8B:=;9嶹ؾcx(`jTj߱zCT`|@J: -ԗ?CdJT3u-. *\R}+SY}-Ju۪,ğ:/q@TYBs Ob!3BʼnfJ;*N/?"AO{y{sjϮ.k3?=L!Cޗ?e5%躚?As#} w_D7 "d?2tfA'染dۼ'Tj%mـtck[@M! -ST1x)!k$G# Bae UmAE$G9\y)S[fCmO|+z(:5ݲtcu1y[lPov\Qo2T4|=!R\}w={Ծ3kRs& >eܱ [h FeH4a]dA,wZ o)V#9qY _%>FE^.'g"_!It*h*Z*̀/tx69Z{g_+2AC^t=CGlpG]D̀ gu^G]$o 1ޝmNoL_>F!uә\1 /H%iob$c&sU^g`0j[̈́g Ҋ)q(:YX烽ecc26X(:*wk3wnlحz.p_۽0'(x'F<z==~vސH!G[mnsev,͢ tzL @ȱ:p3$}.dzɡ*d<R^Pji|wGdƀ8W87Uy #q4t &˓_~1"22Hej -/^ʄEO [)RqvnA~{B;xճVc ezsG_ߗ?ے5+]vm+}+V*w+{isu15YwکoW>ks*˵6;8a쟆Yۀ᯻b?_cȦ6nUL;CݥK(83e{ƕTLO0n@w )`W3 wT^턏ʻNw_׃8/ -| yW4$Y~Uc%6d{ٰZCǽ{uہ}-p fѠpv| rI͡#\Wp1.sQC}JPc:,]bc'M"?C!k{F%uivlzջ bliȣ{}/"ڠQ?Fj16өT/9TyZ[4 F-xs1@ͽR JtN .@+VRmUKj)S2j:ҔQ:hZFsNl/bɬXQ}y ^-J>ΥժVj[WB\GWcfS52ctL)y<,]Z~Ed]+{p&"|QCSodcrK)@Y -0gw+AgYjIRE17ϟ$ԥ Y>PuO +x]]#muH"8)r`zyo=Nzѿ߇^.!GF#L%E>|dM +jEer2g!P2.??:M)ѻp7a1SAa#Iɇ3R4=Y bpAcA >+ 1=@ k,JH +Yἵ*Xf +31_T^%LLxCx YBNx)'! E*H%⡝2dueYlN2dfW9=`B&9`Q,ц K 5A_rVՋw%d>ʃ,| |,6E AFpIYp次pJ/p,I<4 YG AH0p܂6sw}^zQX5B@a3a +?ŧV5,]1|*qoeb,.&*Ұ wY`5,]G5pb5,] Aq4,f骼blYÂ,y 0 $*/Ӱ`l,P "p{Ѱ wm Ұ w-#Qyװq xp[ŧkFXwMEÂܕiSÂೆ +̦5,łOEaA @ʃ,X֦P$Y{ ,4,@D`C Y)jX$30kXBD>jMNksIÂ`*v 2NaHaϱ@L5,5,@ sdY jX}FKBYÂHa&RAIH~l"QykXt3kX3dkX۔|3iXP,dAħaAHa`)vY_O=8JbE|pLmEBH".,.n"$bLܾȐXdvf/2zw'uAyTR#TNy^~4Y,Yi AY&DuLRI 9яDXx3%,o + tYn؈ӯǟ~O?Z7?8˵wULBY# +\TkT!7U7H8̀Mk5cҭew{{Ё$=l8\cj R҄oD$]2do]JZuTȰJ|mk@ve~޴*/ckȿ"t{"\!D~grwc t#!5#$6zu誛nmljSw7v{% +-z "S}mIKlFm2ՖG쐦"|Zms@|yanySUjs1>?bVt5>+9ɢ,8\8СyFgWСj}ؓ{|?>B+OJ? 9kD}r N~iR0y2s]ݷJH2wQ["١b"5ٛHIQ} @irao}e|}W'⣰w :l? Euu޶=}g&vto$ |CIuqܵ{b}km۲ܥLpl1V\L8^$;GAa ꃫ~1WeBJ1!n~J$m-mkt]kcw S`=IR{2g_f7hc~<7!lV{$Oq&w֛DSXףAeRIS&d](.i3a#0zYY;204b/cJNyAߑ!<.=-ÛESR32O:`TjϬQ(?&S"֞YlvQzݐr[ݷpz{FmPVeY&y(BПK_`g~b6fv-NDW-6SjtVsz  z:K̜V{P|vu^\a +l #//y.A,lU[ "DI@ᅈ'Ȑa7 =6$s=IR;, &oX:Bh +Q8"Mo ^#6?I +{.{="n7."9<ʑ檼ȫM"6l=~cv^SU^GA薥ϧ( Nbr}꼎][g wJCG$!#wCp!#\w.{74Y)玵dX}*GH0,>0*CU +EX" Bf *yKd펃|*ehhz(cAYE@H;emhVAV'V1Go|>ûB;;Z\ :f;2"bq>ӟ:"ykX$ns2}dJ0Ѭ窼yA*9L#4`=nw6:Q[h&m8ӏaVKSU^F:-K+1D`GYdQ[ѵpGe.nv=}?@a=A};1J3Fs|F +y>jsw(ܰcn}H[/׃`REU%БSU!s!#sHT!㱐rmBR;Lc; +'3ĹzŹIv;nߥmt,ťxHd0)^ᐹFz/S_UxR&ee.rdJ1%Es uX-Ӄ;?->ޖ]W m[_CXV[÷}.OE[A*uиwN}Œ];+UYyu d2 bKE6Qu:L=`\JG87W.]\&GGIǹ)ۻ0bJt%|q ,-fHe{j'|TޕvZ` +rf^  Hgwl($-I)S{, +bϗ:]sָCJ}mwzUw\VT/6qigiMO_az[|~Xmzazjci䅻T.eK܎=rUIzt/ neEx'd]_듣7Ӷ_/:$'Bf6~,mmZ L.._Kk\Wֻa&'~JlұBDd{$ YNoφD qY e{!Yİ'ڡNeֲ}-mAlse}nR赩UHW BF k6 I!vm1?y!Ր+k9vR-6RʽjY5EN)^U-$?G1eֱy#d[͎q +I):VذHFζK"\T\irn{ШMJ)\CE\rt6bA4Ջ<C!yܧٱVb(Ƌavce#"㾈WjFƄOR6P+Wjm{Ԃ=h5jK0v+m:Q4ͮbZeKU-bNۨ0JSbG%Jע%jP9d%BcF^Vھoζ6 {dj{+=;:WZo] q]]"Ol3q4rwk%ud a&'+F9f M9We-ݧe)ÜݭŸeA]&IwH,?S +mO r endstream endobj -403 0 obj +407 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 402 0 R +/Contents 406 0 R /Resources 4 0 R -/Annots [ 404 0 R 405 0 R 406 0 R 407 0 R 408 0 R 409 0 R 410 0 R 411 0 R 412 0 R 413 0 R 414 0 R 415 0 R 416 0 R 417 0 R 418 0 R 419 0 R 420 0 R 421 0 R 422 0 R 423 0 R 424 0 R 425 0 R 426 0 R 427 0 R 428 0 R 429 0 R 430 0 R 431 0 R 432 0 R 433 0 R 434 0 R ] +/Annots [ 408 0 R 409 0 R 410 0 R 411 0 R 412 0 R 413 0 R 414 0 R 415 0 R 416 0 R 417 0 R 418 0 R 419 0 R 420 0 R 421 0 R 422 0 R 423 0 R 424 0 R 425 0 R 426 0 R 427 0 R 428 0 R 429 0 R 430 0 R 431 0 R 432 0 R 433 0 R 434 0 R 435 0 R 436 0 R 437 0 R 438 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -404 0 obj +408 0 obj << /Type /Annot /Subtype /Link @@ -4665,10 +4711,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-32) +/Dest (cb13-32) >> endobj -405 0 obj +409 0 obj << /Type /Annot /Subtype /Link @@ -4676,10 +4722,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-33) +/Dest (cb13-33) >> endobj -406 0 obj +410 0 obj << /Type /Annot /Subtype /Link @@ -4687,10 +4733,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-34) +/Dest (cb13-34) >> endobj -407 0 obj +411 0 obj << /Type /Annot /Subtype /Link @@ -4698,10 +4744,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-35) +/Dest (cb13-35) >> endobj -408 0 obj +412 0 obj << /Type /Annot /Subtype /Link @@ -4709,10 +4755,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-36) +/Dest (cb13-36) >> endobj -409 0 obj +413 0 obj << /Type /Annot /Subtype /Link @@ -4720,10 +4766,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-37) +/Dest (cb13-37) >> endobj -410 0 obj +414 0 obj << /Type /Annot /Subtype /Link @@ -4731,10 +4777,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-38) +/Dest (cb13-38) >> endobj -411 0 obj +415 0 obj << /Type /Annot /Subtype /Link @@ -4742,10 +4788,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-39) +/Dest (cb13-39) >> endobj -412 0 obj +416 0 obj << /Type /Annot /Subtype /Link @@ -4753,10 +4799,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-40) +/Dest (cb13-40) >> endobj -413 0 obj +417 0 obj << /Type /Annot /Subtype /Link @@ -4764,10 +4810,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-41) +/Dest (cb13-41) >> endobj -414 0 obj +418 0 obj << /Type /Annot /Subtype /Link @@ -4775,10 +4821,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-42) +/Dest (cb13-42) >> endobj -415 0 obj +419 0 obj << /Type /Annot /Subtype /Link @@ -4786,10 +4832,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-43) +/Dest (cb13-43) >> endobj -416 0 obj +420 0 obj << /Type /Annot /Subtype /Link @@ -4797,10 +4843,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-44) +/Dest (cb13-44) >> endobj -417 0 obj +421 0 obj << /Type /Annot /Subtype /Link @@ -4808,10 +4854,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-45) +/Dest (cb13-45) >> endobj -418 0 obj +422 0 obj << /Type /Annot /Subtype /Link @@ -4819,10 +4865,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-46) +/Dest (cb13-46) >> endobj -419 0 obj +423 0 obj << /Type /Annot /Subtype /Link @@ -4830,10 +4876,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-47) +/Dest (cb13-47) >> endobj -420 0 obj +424 0 obj << /Type /Annot /Subtype /Link @@ -4841,10 +4887,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-48) +/Dest (cb13-48) >> endobj -421 0 obj +425 0 obj << /Type /Annot /Subtype /Link @@ -4852,10 +4898,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-49) +/Dest (cb13-49) >> endobj -422 0 obj +426 0 obj << /Type /Annot /Subtype /Link @@ -4863,10 +4909,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-50) +/Dest (cb13-50) >> endobj -423 0 obj +427 0 obj << /Type /Annot /Subtype /Link @@ -4874,10 +4920,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-51) +/Dest (cb13-51) >> endobj -424 0 obj +428 0 obj << /Type /Annot /Subtype /Link @@ -4885,10 +4931,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-52) +/Dest (cb13-52) >> endobj -425 0 obj +429 0 obj << /Type /Annot /Subtype /Link @@ -4896,10 +4942,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-53) +/Dest (cb13-53) >> endobj -426 0 obj +430 0 obj << /Type /Annot /Subtype /Link @@ -4907,10 +4953,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-54) +/Dest (cb13-54) >> endobj -427 0 obj +431 0 obj << /Type /Annot /Subtype /Link @@ -4918,10 +4964,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-55) +/Dest (cb13-55) >> endobj -428 0 obj +432 0 obj << /Type /Annot /Subtype /Link @@ -4929,10 +4975,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-56) +/Dest (cb13-56) >> endobj -429 0 obj +433 0 obj << /Type /Annot /Subtype /Link @@ -4940,10 +4986,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-57) +/Dest (cb13-57) >> endobj -430 0 obj +434 0 obj << /Type /Annot /Subtype /Link @@ -4951,10 +4997,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-58) +/Dest (cb13-58) >> endobj -431 0 obj +435 0 obj << /Type /Annot /Subtype /Link @@ -4962,10 +5008,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-59) +/Dest (cb13-59) >> endobj -432 0 obj +436 0 obj << /Type /Annot /Subtype /Link @@ -4973,10 +5019,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-60) +/Dest (cb13-60) >> endobj -433 0 obj +437 0 obj << /Type /Annot /Subtype /Link @@ -4984,10 +5030,10 @@ endobj /BS << /W 0 >> -/Dest (cb7-61) +/Dest (cb13-61) >> endobj -434 0 obj +438 0 obj << /Type /Annot /Subtype /Link @@ -4995,44 +5041,42 @@ endobj /BS << /W 0 >> -/Dest (cb8-1) +/Dest (cb14-1) >> endobj -435 0 obj +439 0 obj << /Filter /FlateDecode -/Length 4512 +/Length 4511 >> stream -x\K$ s+H Y ]8C~>JfwNb =_N_mw]8AXL&lPX,Ha`R!* XƂ!kV\rX -+C U O5p%$,pZA,3y炉Pzxޙ/*/xD&&vibb!k<,Xd j<”Ƌ"YY|NdNQxʃ,6Z -P2+ٜ5`B&9`Q,ц K 5A?rVՋw%d>ʃ,| |,6E AFpIYp次pJ/p,I<4 YG AjXC1f]@Hհ 2.aASyŸ+~ -cѰ wHÂ|f kX5pb5,] AqH4,@|3tU^1aAf K4,kX `aAlJJQÂX,xHT^4x$ Bd<‰5,@bm -aA򐅼װ yȂAd8d\CdL.V5^&'๤aAJlXK װo$]ҰbXÂT \E"=2s l 眆CddʌVDh%jV֙YÂHa+M ʃ, 0?`&9*P` r Y6e4,( Ӱh$Mְ0aR֛YÂBM,-e4,( YRY4oIXo4^,%FYof f`^ȲLvp7 "3MdxCB~38c`U2^DXMe*Ϊ|0a}"!!f$,p Fv(|gusHjiF~7}; "U2i*C(\7D(;|FRն[1Q Bea/౶ȶ`iBIWz(tBRHsCKVR)$J^VD5\`FzQp`!aySWN@Ueӻ?: -M|QHw_}<("0 CX7 ry˗W:2z8>?wdqqఀT_/cX]S>DEٗ2?urmwcD&ڑaլ9v07Ծcow[bӼ#דm:H1Coy9͆־laŎ7Η+Zl/~-ߓOZ_VibF\4o~Ҽ>.6D~VV;;ɖizB^U\y,W׼vn',Zdcq^ۊw(vh_IcQڮVsukiX/4볝:Ժgl)>q6~zCm'8y]s֮[ǰui3(Y۱4]|~+&7O}Dy+?~A=2-,v--2; -ٻrȞ >o?hAqɰ馿z+X}KST +V{Pdgv4kQ;:: -BG˻U@nfW]9S]NhVljR$/"6$QVtF!VQ;^=,򏖧t[n?Ci{D5 >\2a o{ lf3 E6_Kv[,(@1ʘ@w@ -[XRa}wRKdOkgg͸x-6Fx<tS L!W[~oZl-A'&[É9s#;rLJa|cRtVA' (F c:cx2wR[[i?<ꔣPeg:Ov{=ewz -v;%ڕ b(d(4{^fp7L3D㣗DdHNאVٙP$*%S L:=y$_Or<aݾ],la-<+Ň6.7AǑQ8TyWyDHtA>Uyȭ$pI[4[g\Y9L3r4{D9<:/ӳlM&S6?| p[$W+r 0"&$;VdE[~ߑ>l*uS=(^-b7 D=^Yכo7au\/>A6y\H7v;~fGr4\ܮvEN='8-'->b}+|*6 `ç"l՟O5<]IÍ d :^o/o즿s7-m4gm{0qO~ - Ξa*..Lס*OQr!ED%z}KA.\6>];fc]BԖ7NPtFboMY! 3ʄAQLTyBl;y%AhՌ(/|^r]!9r[˥u]7`d^yI,^UvA]߷i{v;]nI =J*Ii}\me:²osNQ[ϓ -W_gc8sm?Z_rl=wi9ٜ,2iFW[x9Ҹ"/cȌru\U;ߨYc/~DwNa-cNN;Ő~JrBf'i{[FSٗ`8NahUxl[!Wі"jFwM[V|4>.JMfG< ɎD D;u7ȞMyx9[S_TdjM5zi4 U:5}BϓB5͘ΟfM. B-ȯ`oSJ^SV:Me&p'H +Av02>*BDlP #7\<,M< JNH\ʹtxhIJZj#DQjf1ـ+qtU,VH"P,$,o +dZX6Gu4>x=xK}oyo)\eǕNL?r?hw<݀"x\Gϓ8,`="' U4Ɗ%8ڕ>?nLLTD~})9jS@^`n@.Pp?ty7FlYVjݱ*cwɦ{;Lgll;yGb~}˳̹o6d ,vov<_ײ4f{al|ֺ؇L{,6墩}8ߕvu#꿛{[̞$[uhB1 IzuT<4V=r坳ln#@\^ڹHhvym+ޕ[r1:m|utRd$ѲEiZPX9Yc>vҷ(S㞑ɫXl[=ڼ[r qbʗDzw=u[nJwkԥТ$~mǮtq^|?Z ,?O(h+ȴ"<$c(d!{6Hmr,>?&JlcM-MQz$XB1<D@|R.FW]uNv:VYVY#0I~Dڐ(GY:ȇX}GVx?Z"Z oyx64lrɄGڿ[3%qR07L|/ٱ:o|l(cm(laIY N/K-=6⩞U[Mm,3S\mG[Z_Dx̳߭K{G֝.o8S*= AX.>2CU~mDBmiYIesr 4f/[wx(28yw=YFi{+Ѻݻv!#ӽ-/x6uzٽܻǷC(^Wl߷CU0YbiCvSU/9EI"crQ"x(57'Rz>~oZl-A'&[É9s#;rLJa|cRtVA' (F c:cx2wR[[i?<ꔣPeg:Ov{=ewz +v;%ڕ _0~LR}۽g/_@ "f2$ťu4rc+aˠlIX̳nO5bv&z4`;Ty& "I.}FT?'D߃uF5דE/vءpjW//[= +Gͫˍ'oq|#xig@wryU!<3s4ucUG1r+ a,8D.'f)3{V=##<-QNp5i+elɔ/Vo2 +Ǿ9ȶ#ɎyafMrX"׋$wt߮W^R8˻eWnt>,@mNshRuuJaihסE[NFy@\"FWX;FϼWy/78[nogN'y60˲j~:zի^4X62㩜*e{&W7j/K]S|ahzXT'ǓNv1e'/ljd!~|.'T%)9N8nh~h"VUc]eָ,0Ob eGC#;5N &K]uq4Ot#^N*7ZSMvMBN d.'mM3&Y 17C^r +rR˭>Sʣji S.M$_|RsKC}(v㯈Sr +I)VLo&n'g;ePSnk6\/P:U!\k`~ovVI3=vaM(;˥mv֗V)/Kwm&z*M<[VaM?+gmBAݔ_6!gl,CowcΗ;N6߈xOϭAk[|zgqP/ܼ|9L?O5y +^rHN>G3gY_#~u%{wlݐH&/1Fn3=O?.YCr[+hR`o%]GP׹31 NdMWn ̈́;N=ܹ{y68tCrsIy8x̃G#$&$EGHTsx:,Cbs']"?SA0H#M7ZT)0sNFEOvϞU<@;e N=Y h=IpZaщG@;FtE lS)՚ZꈳsA0JWbg%^v[((sɬ\SyF}h{C82S;;KݮV;!./ P˖Xc|+qF^]^H+{t&|u^(SSSzb!NVЀ9{TXo d(o%Iz.Y u eUU endstream endobj -436 0 obj +440 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 435 0 R +/Contents 439 0 R /Resources 4 0 R -/Annots [ 437 0 R 438 0 R 439 0 R 440 0 R 441 0 R 442 0 R 443 0 R 444 0 R 445 0 R 446 0 R 447 0 R 448 0 R 449 0 R 450 0 R 451 0 R 452 0 R 453 0 R 454 0 R 455 0 R 456 0 R 457 0 R 458 0 R ] +/Annots [ 441 0 R 442 0 R 443 0 R 444 0 R 445 0 R 446 0 R 447 0 R 448 0 R 449 0 R 450 0 R 451 0 R 452 0 R 453 0 R 454 0 R 455 0 R 456 0 R 457 0 R 458 0 R 459 0 R 460 0 R 461 0 R 462 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -437 0 obj +441 0 obj << /Type /Annot /Subtype /Link @@ -5040,10 +5084,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-1) +/Dest (cb17-1) >> endobj -438 0 obj +442 0 obj << /Type /Annot /Subtype /Link @@ -5051,10 +5095,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-2) +/Dest (cb17-2) >> endobj -439 0 obj +443 0 obj << /Type /Annot /Subtype /Link @@ -5062,10 +5106,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-3) +/Dest (cb17-3) >> endobj -440 0 obj +444 0 obj << /Type /Annot /Subtype /Link @@ -5073,10 +5117,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-4) +/Dest (cb17-4) >> endobj -441 0 obj +445 0 obj << /Type /Annot /Subtype /Link @@ -5084,10 +5128,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-5) +/Dest (cb17-5) >> endobj -442 0 obj +446 0 obj << /Type /Annot /Subtype /Link @@ -5095,10 +5139,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-6) +/Dest (cb17-6) >> endobj -443 0 obj +447 0 obj << /Type /Annot /Subtype /Link @@ -5106,10 +5150,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-7) +/Dest (cb17-7) >> endobj -444 0 obj +448 0 obj << /Type /Annot /Subtype /Link @@ -5117,10 +5161,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-8) +/Dest (cb17-8) >> endobj -445 0 obj +449 0 obj << /Type /Annot /Subtype /Link @@ -5128,10 +5172,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-9) +/Dest (cb17-9) >> endobj -446 0 obj +450 0 obj << /Type /Annot /Subtype /Link @@ -5139,10 +5183,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-10) +/Dest (cb17-10) >> endobj -447 0 obj +451 0 obj << /Type /Annot /Subtype /Link @@ -5150,10 +5194,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-11) +/Dest (cb17-11) >> endobj -448 0 obj +452 0 obj << /Type /Annot /Subtype /Link @@ -5161,10 +5205,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-12) +/Dest (cb17-12) >> endobj -449 0 obj +453 0 obj << /Type /Annot /Subtype /Link @@ -5172,10 +5216,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-13) +/Dest (cb17-13) >> endobj -450 0 obj +454 0 obj << /Type /Annot /Subtype /Link @@ -5183,10 +5227,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-14) +/Dest (cb17-14) >> endobj -451 0 obj +455 0 obj << /Type /Annot /Subtype /Link @@ -5194,10 +5238,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-15) +/Dest (cb17-15) >> endobj -452 0 obj +456 0 obj << /Type /Annot /Subtype /Link @@ -5205,10 +5249,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-16) +/Dest (cb17-16) >> endobj -453 0 obj +457 0 obj << /Type /Annot /Subtype /Link @@ -5216,10 +5260,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-17) +/Dest (cb17-17) >> endobj -454 0 obj +458 0 obj << /Type /Annot /Subtype /Link @@ -5227,10 +5271,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-18) +/Dest (cb17-18) >> endobj -455 0 obj +459 0 obj << /Type /Annot /Subtype /Link @@ -5238,10 +5282,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-19) +/Dest (cb17-19) >> endobj -456 0 obj +460 0 obj << /Type /Annot /Subtype /Link @@ -5249,10 +5293,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-20) +/Dest (cb17-20) >> endobj -457 0 obj +461 0 obj << /Type /Annot /Subtype /Link @@ -5260,10 +5304,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-21) +/Dest (cb17-21) >> endobj -458 0 obj +462 0 obj << /Type /Annot /Subtype /Link @@ -5271,44 +5315,50 @@ endobj /BS << /W 0 >> -/Dest (cb11-22) +/Dest (cb17-22) >> endobj -459 0 obj +463 0 obj << /Filter /FlateDecode -/Length 4906 +/Length 4905 >> stream -x]]不}_q">AX$42 s3 $eKr,V/jzL-G,܋şoKk[7X]L?ِ 3$J&)]e_/.q/ޔ(@&,+uMJŠKXPSaJP# jPBre  jIa9 =VAyDtzxޙ/*/xD&ibb5^.\x ]؅`5t ƋЅ"Y]|Nt蝢2tue]lN2\r*gs[l8Ya&a  w!a{_~}il`$,. peڙ& Q",΋n$bL~qkLwv)8 E]2ҕv~Hb c%Ҁd0C4+H}W1Gh%/GE4¿t{_We7- _>t_ݟhӗZ^G_>N2!.n]ThiOX:Ϛ0 cEE}΢~毷_q߉rvQY0B(QL_Y筰٫`z$9:bD>H[wd6%"Z+Jdjl*q?FpNNO~gwD iK)2}AS5 rJtSBma6liU݄7s':AAc[F 5i_F_f3X45^}cie:-d9{V1$$<) 9ݤwOȽ Gލ@wZe *tã@/)L->̴=Dy8cY_%\W4J; bK,g4{ XJxEuΣqQΔ l[ÑG$ń -7$wN hLi0ԙcIp] 93br[d?+-OoMCQ/,bXQȏ*dMdaZN#aM~O1 VjC7yv8{|<5[ ҂@=(4>9|f*ʺ"}`ZFw]oɉĽ#!-Ss0aOSíiʳ|øT<)Y#y(A[W2-AW>$r[Ww׎61SkDg8dgqM ~kX=•Rd>yfۚ0hjweز#>2f???J]}VH Fmr r\tKȣmeg^~M$jHiRtg_u<9ݮ/02yEF7A'tXy{y HsXE -U3 : o׏JԁjZ]wH̸U6/xݭo ;j:`dE^:p1 ==MfK(ow`[ɝ l<)p=΄!v!n˸i=4SFp?xܑd?sS״~)A'<[AjU2 qqI0:wE= j7;Edd(7gPy(`cP;5[{HX=Sy09x_Y#.f:!j&}#*\Rm-cF;pd.F_L;wNwuud'JUBZ<}QBb7՞65DW-6Jx>H9^B?AKܽBȬIϰ%rޚXyz#lN?{9o[W'U=h oS!+cbGx!Ade}ɣo[1I#I",Eq"ޝ"DH56UǷӧ LӒ c"3,!Ufюo!ʺa)ʾC9dfDlUrJ#Ruu6;N"0%yl"BA{bTDUt+gowF" Bf ?h -WuO^1cЫE] gyZ}bT0r=}*Xr𧬂"NY9UРUD9 (2b(@ R=Oo8_+ydsdf>&wCHtK$c}4[WL[L_`LLy$[Rҽ0U3>*6x @PI2u~q}tcLy:hڻsNȺŗxAb샺v3 Uc6Bn=A>N"=?z=Fcvn"z_EO)t1IZ`GvVv3zȋM>ΣF%Ӟ$Gb??ۦdQ1мDfyƀ8NJV"5;u״n×y;رT}gg$'-8tN{ ϗ8m&_ɩc0]Nr ,arSǺw$_IArt.XCǽ:4qۀ})*#jQ3|zӋ5ش zI͡p.sQ_*q%E۔n .Jq5Xf+5 Fj׋ -y_ta\R6U/."+oQ>^YxP+W[O7& -x:˸sMg:.zEQ rk".zo4,UDQ4ji)bKLw^J5h=N~T⦬Իx5ZqoΩݝm%k,Z+5жmulFh&ƛ\enVRۯ$`./mɢ3Rr4rXZvEdY+[p@d0Ux37X喎u`nV߰PL*OVY~i+Y. MK(a|2?i +x]]$}_qXDQa xF7ugauR "E%GJv/q+gr.)_/]IlTbu1OgC2J(Tاv_7}˟wZƽxSJ_S +X֑b6)y ++:[,EcA N-+AP2k, ++C +іUO.h, +',pZElcQygb.K^c1rxpN1tax%PN/BdUt9Kţw֕Ut:Wp!)oy޲Ld5saQ.rQyЅzG%N0odi<.ާ _CMQx\0dBAɄ>R" |abIuyY!jH@xʃ.T +hX@]| h`-64, m.jX@\i5, .4, @.LhX@\vjX@]{ҰkX@] +9jX@] +jXDTyaѐˤaAIÂ܅y 0v5,հ w}A SK>Hg܂6sw=[aAࣆ0j4@a*3a uӟ@+r0pe +%eb,0piX]gְo0z 3:_ ECa7,LWcK0p5,,lld`HNC5,]LEÂܵLaAڀGA^5mFjRh7wֆqo";uR=aHkcd|*!S2p9Y[_ +83>ݵ?|ZP1-L Fn4eN $T)NE }DYbUu̝bxm5P~!}`pxY jAx8YŐVBŪ(6!MwxDX#d5{wtx,\2w=Y"y7_ݱjEe'0X0}P@/d.@p]Hp+$6HGn-@-d`*i:E-:Szo$0³m G"#"+ܐ,y;-x1dSg1C&uu?&DH>-f{ou{?Vc5-Gٶ*k_ߏ|N&bEn"?&4'[+|'lUL/rlA8n w㚐-EװlEz+n/}3(|qʹ5#`ԗdeG|d~bV.und%zĹrّGZurHr1VӒ dξx&#r]_ae<4n2O-^׫>mg$^7t4J3G-Fմ:Rq[[nm^aw-38[߶3vtQ=R du)7mc2OzD+{ا ̖Q9;:y$ISYw CCܠɗq9v{h#~,i3SeOy{1X"ګ6e`A%jEau?F>*z@n<| vPHqwoΠEQ@<\Ww~mk܇t_>zH!`sq+=^G\t B>~MO/ ;FT?^ץ\Z6v0z] +vD .|VNs9~F{9#YaK伽56G:um4s\ CaFO`zuߦCW04B{2O~G($s]cmGLEY㘣)D;El$oO%DgXB˽`BuOR}rxG朐uuP/%2,u9#ݼg``gիvv?mݗ3Tz"}Ez~,ȭ{޽9 ݢ0u+E93BwRfc͟cYN zgMw}Gc&Kç=#I?_6lL %B9wͨ%239VYۿux-Ďl~S=sݜ>&9h+U?mwLupwCe~(W7m4JNrEc` >:ֽ#9Jo a4\i.i*+k +mr@ؙ,? WTb0e[Mp,5"okP_Ks}׹n>uyzAtK}SKUKb&[h)U*u@B'zQإjMQCļRRN!^rsm\G*R*)׎WhS$|eF6oI) +,/mҨ)/]\hrD} +TA դv߬u'XQ'h=BjeB?.g>_qo+Z+r?6ABn}`]ney:{uhRUuaGtgk ѱiC3$/Zᢿ\ƣ6%tUJ);A\k4VjAԮC?< m^h]tESW\hY(}ڽ>> endobj -461 0 obj +465 0 obj << /Type /Annot /Subtype /Link @@ -5316,10 +5366,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-23) +/Dest (cb17-23) >> endobj -462 0 obj +466 0 obj << /Type /Annot /Subtype /Link @@ -5327,10 +5377,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-24) +/Dest (cb17-24) >> endobj -463 0 obj +467 0 obj << /Type /Annot /Subtype /Link @@ -5338,10 +5388,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-25) +/Dest (cb17-25) >> endobj -464 0 obj +468 0 obj << /Type /Annot /Subtype /Link @@ -5349,10 +5399,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-26) +/Dest (cb17-26) >> endobj -465 0 obj +469 0 obj << /Type /Annot /Subtype /Link @@ -5360,10 +5410,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-27) +/Dest (cb17-27) >> endobj -466 0 obj +470 0 obj << /Type /Annot /Subtype /Link @@ -5371,10 +5421,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-28) +/Dest (cb17-28) >> endobj -467 0 obj +471 0 obj << /Type /Annot /Subtype /Link @@ -5382,10 +5432,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-29) +/Dest (cb17-29) >> endobj -468 0 obj +472 0 obj << /Type /Annot /Subtype /Link @@ -5393,10 +5443,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-30) +/Dest (cb17-30) >> endobj -469 0 obj +473 0 obj << /Type /Annot /Subtype /Link @@ -5404,10 +5454,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-31) +/Dest (cb17-31) >> endobj -470 0 obj +474 0 obj << /Type /Annot /Subtype /Link @@ -5415,10 +5465,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-32) +/Dest (cb17-32) >> endobj -471 0 obj +475 0 obj << /Type /Annot /Subtype /Link @@ -5426,10 +5476,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-33) +/Dest (cb17-33) >> endobj -472 0 obj +476 0 obj << /Type /Annot /Subtype /Link @@ -5437,10 +5487,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-34) +/Dest (cb17-34) >> endobj -473 0 obj +477 0 obj << /Type /Annot /Subtype /Link @@ -5448,10 +5498,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-35) +/Dest (cb17-35) >> endobj -474 0 obj +478 0 obj << /Type /Annot /Subtype /Link @@ -5459,10 +5509,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-36) +/Dest (cb17-36) >> endobj -475 0 obj +479 0 obj << /Type /Annot /Subtype /Link @@ -5470,10 +5520,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-37) +/Dest (cb17-37) >> endobj -476 0 obj +480 0 obj << /Type /Annot /Subtype /Link @@ -5481,10 +5531,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-38) +/Dest (cb17-38) >> endobj -477 0 obj +481 0 obj << /Type /Annot /Subtype /Link @@ -5492,10 +5542,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-39) +/Dest (cb17-39) >> endobj -478 0 obj +482 0 obj << /Type /Annot /Subtype /Link @@ -5503,10 +5553,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-40) +/Dest (cb17-40) >> endobj -479 0 obj +483 0 obj << /Type /Annot /Subtype /Link @@ -5514,10 +5564,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-41) +/Dest (cb17-41) >> endobj -480 0 obj +484 0 obj << /Type /Annot /Subtype /Link @@ -5525,10 +5575,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-42) +/Dest (cb17-42) >> endobj -481 0 obj +485 0 obj << /Type /Annot /Subtype /Link @@ -5536,10 +5586,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-43) +/Dest (cb17-43) >> endobj -482 0 obj +486 0 obj << /Type /Annot /Subtype /Link @@ -5547,10 +5597,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-44) +/Dest (cb17-44) >> endobj -483 0 obj +487 0 obj << /Type /Annot /Subtype /Link @@ -5558,10 +5608,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-45) +/Dest (cb17-45) >> endobj -484 0 obj +488 0 obj << /Type /Annot /Subtype /Link @@ -5569,10 +5619,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-46) +/Dest (cb17-46) >> endobj -485 0 obj +489 0 obj << /Type /Annot /Subtype /Link @@ -5580,10 +5630,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-47) +/Dest (cb17-47) >> endobj -486 0 obj +490 0 obj << /Type /Annot /Subtype /Link @@ -5591,10 +5641,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-48) +/Dest (cb17-48) >> endobj -487 0 obj +491 0 obj << /Type /Annot /Subtype /Link @@ -5602,10 +5652,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-49) +/Dest (cb17-49) >> endobj -488 0 obj +492 0 obj << /Type /Annot /Subtype /Link @@ -5613,10 +5663,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-50) +/Dest (cb17-50) >> endobj -489 0 obj +493 0 obj << /Type /Annot /Subtype /Link @@ -5624,10 +5674,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-51) +/Dest (cb17-51) >> endobj -490 0 obj +494 0 obj << /Type /Annot /Subtype /Link @@ -5635,10 +5685,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-52) +/Dest (cb17-52) >> endobj -491 0 obj +495 0 obj << /Type /Annot /Subtype /Link @@ -5646,10 +5696,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-53) +/Dest (cb17-53) >> endobj -492 0 obj +496 0 obj << /Type /Annot /Subtype /Link @@ -5657,10 +5707,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-54) +/Dest (cb17-54) >> endobj -493 0 obj +497 0 obj << /Type /Annot /Subtype /Link @@ -5668,10 +5718,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-55) +/Dest (cb17-55) >> endobj -494 0 obj +498 0 obj << /Type /Annot /Subtype /Link @@ -5679,10 +5729,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-56) +/Dest (cb17-56) >> endobj -495 0 obj +499 0 obj << /Type /Annot /Subtype /Link @@ -5690,10 +5740,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-57) +/Dest (cb17-57) >> endobj -496 0 obj +500 0 obj << /Type /Annot /Subtype /Link @@ -5701,10 +5751,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-58) +/Dest (cb17-58) >> endobj -497 0 obj +501 0 obj << /Type /Annot /Subtype /Link @@ -5712,47 +5762,46 @@ endobj /BS << /W 0 >> -/Dest (cb11-59) +/Dest (cb17-59) >> endobj -498 0 obj +502 0 obj << /Filter /FlateDecode -/Length 3936 +/Length 3167 >> stream -x\Y$ ~_,Sub0ymf󐿟Q]cfg bgAQGRUH\RL -jEe8`KN>TKx?gscΔ _ -I9% - -E+LJ.DKX#$vg%%1ع2߳ -pɲƂ,AT!f &BQ9kb.MNyobb+&c -Y K̤ 4^,>zRy5^,) -/CXWVy"YW %35,` X.Ӱ]԰b?f]@Hհ<5,`!-Ѱ wmAS|hel.QÂܵۧ WZ66ƢaA"Py p5,DTaAZHҰ w7 `"аX骼baA†2D%C !հ wދK{ "piʃ,>; ׀U|ɪ!x]a%JEÂܕaALBpYh; bfSRB!Sy:hXRykX_AA  #0"VsQ,5,\5,H!V5^t&'٤aAJlLkX7.iX1aA*aBƳItV A ˨2#iXZxLRgf 2G#pT@JY`A2GAXÂYÂ!#alSͤaA!ȂOÂBHa`<" ͨ7kXz3kXP> I:d/.+j5ÙJ)yU!o5)7//+’kwyyBFd2ͿcY(*]9$/(~嘺iHSRIҧx78Ȧj3 I%GZd ad\RX&`ԨkRk[zWgmɂ&Ww2`~Nm'tq'k= _ữ1c d]6* /GgB "p_ݵ;a H굍v,95߮懭mӶ_m;xM Rޅ\KJX4Pgh+L[dړv*` 8gkaiGZӤsӓ\X)[*Iw傟.WaKC]GcR'7ʊIMZm]u;|H될\^z}GzȹUZޤ] }suy׬[TZA>4_NPWkUű)%d&fq^5~_O| i~;99MogYw܂Գ1wņkXm|$zn~㰭x'iӐGrjE9)gkCwiV[nF8^Ӗ%"J;MBV[FzҼO&7?{^#Gcy<&cūrdwIkzaf(F ]Qp;ee" zuc{yMpMuݛmhٞy5{S׿{N[uT5eJZhn5DSKc)lX |br; -t͚^pNx͒R*<\:ˮ0|jv$O6]Qd ElTL JF{'s-i;mr["uLYQ>%)tE],7&{^QiE]qtI.cuu[QG7:y(nߊ;}Eݪnws=DoRR1Hw=/FV= qgl; )|tH7JGKRKsX_]FTSm\sKZn>,&!tw=)n bKLlY m m{h[_u1(2yOڪX{гmZ_@&y'IG_N.C&,H]ǃ, -y$7B\?Rmc:ri+G#хZ7yaɵ+ebɲzJnU좄d'C<7H'bin7yU>Nں4m5i9Q6T.FPSCk7>)A!~NmhfvkB͐+B:vhTZ(}Wh H od_^S툧CxIiVPh74n'g2)7U5M5*S?X&%ovVI3=vaMh;˦mv֗<Ʋo/[wm&z*M<[VaM?+g"5!0 nʏ3tW 'v2رq&Vq'oS l|NmAvԣݘl" -<`vt3hitPÜxV^e,{|up[79;Ef":`mmC剡tF4Am0t8]7]gpx:bOd>toF^.}[M -rpϏ|ĕ4!+SG\̃r 6bAΓtՋZY&VȀV=3 HDgY{j +&{l@_cz zD9ɆPT~9}˿OoNE5B$6p!dMhS6!'L1J"2@8r3ly|k!I(eu[ CIv%)_Hҩ F̓UC(g,{J}/uߩ#O֏eERkz_Wȧ?)ؿ'(_XH"9Ek6k +Eҏ%,}N%-Z^X#}uO"6*Mf#_;}|@ QY-qIYWے$/l(e%wMi TSжŤlV=jg$lp\Pv?j \%m|+V+mo~V7c^]1Fr}1 +\5Vva)iNGHnwM=hvw[{t`sXѰ}IGFzD/~Fz[66Z]鵿ٸG^'$yr|건xV79=NZfԀ@c[K##pڷ{5V{f>9ù/G5ToOދ1~76?iv8+}cv 25q()w :v.8'>Ifl7Q6Ŝ/'l+jC_k7Ҡ"TG谓C K+9INݑtk}CqjiXQuNm]SRڦZ%FcJfnk;tD$?RqFDYJ_& ơ*f9ܡ" !u=WsAVJukcuq)gW}Yt?@w.*[u x\yx u \ԅv+?\ijYXw·\ yǺweKlzK6ׯ}I4l!N +63aoۈ=2Rb\ɓ˒3=X&b]ˆmJv%9Pɯ)Z.2.etuNbX֋uauv%#'g90A}Xƌ:ϧv/GΑ XKؓQИ^]>Pv HiWD14괱b2cZWvR5Ťj:VJLUX[gQ-(e͑-UHzmm$ʔt7Sbgss_Ir(_P_Ѻ|JODYɺT +"<ўf,K5row.vȽmBXh!VV{ݴGCJ:>پ X9 endstream endobj -499 0 obj +503 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 498 0 R +/Contents 502 0 R /Resources 4 0 R -/Annots [ 500 0 R 501 0 R 502 0 R 503 0 R ] +/Annots [ 504 0 R 505 0 R 506 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -500 0 obj +504 0 obj << /Type /Annot /Subtype /Link @@ -5760,10 +5809,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-60) +/Dest (cb17-60) >> endobj -501 0 obj +505 0 obj << /Type /Annot /Subtype /Link @@ -5771,69 +5820,14 @@ endobj /BS << /W 0 >> -/Dest (cb11-61) ->> -endobj -502 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 719.279014 101.433071 700.529014 ] -/BS << -/W 0 ->> -/Dest (cb12-1) ->> -endobj -503 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 391.031993 101.433071 372.281993 ] -/BS << -/W 0 ->> -/Dest (cb15-1) ->> -endobj -504 0 obj -<< -/Filter /FlateDecode -/Length 3121 ->> -stream -x͛[ Ss+H݀ -b4->88Aq\C~]vb;svDj$EDi|&bʡV/ONJ"j\6-̤%$n{H X?7ŵ/N1#/?J%Z -%Gՠ"GR(%2z, 0M)]l&<`|l<`&9HRFnV–HcbcA#؂cA,MXCG䱠q~3KoVMMly$~x,h -[RW[45gނIoN.ÖcAc 7ѻG=.wS<4{,@MdޞTj;ЛGb*Gr `&v5XVdr E>wLO#p(X3kl~9f5y~>O/b=ӻ/~ѼmbxWakODm2 acF6d`8t3#cmq&blOWb+ɮ}ϯn+, uU~:gF>WW4>R"p]L7O_~_0:oޝ_jJj'MV aEPCfz<^{OVv6V:ҽަ;d뷣taS^ꔽt|,-{+memp܏:̯~~#>mO͍һlɭ{m};]x>|fozo {=}ˣNopƻeWl>SkGijfOk #E'!OolZ G٦5v[nܴ-hEIP='nEdc_NzE4ErVO)~YOե;Nl,}ڵ(ӣ}+E ~#|z ݖnؖ\u/窫7ϖ{@ >q}Zʦ{"1!]`G;nvsөXǔz@re eZeCc{ա#IcpoʼΡlPpq;:1v7>c/`V apSս'Ήe;KʴlqO7D=>M.h^Fj.VnG j+7~.=x ɲ 8-$ٲ -o+{^zk&1dP2 ?ap۹o=YlL8Xr`gV܇7;W:>Z[d_ء -R8,mb̽t+~87ꈱQ/іr8d@v[S6y_ԟO6K5z% -!|/jARmp6kY1 -t/)a;S8L_],rBr+}p]jo{7ҐbTk1Nrr7̡_FNwa큤^;ZKcʨU筭{~2C]p#|tH~y-6}.qS1ᔊS;MVP꡷ -eiw+xR054Fu_;iA k7I:i"^ו./ێ ǴYQO1Y7hx uN&Ю4}Ȳx&=!xq$2;6sދ݈}ѭBa}\K(YչCqQ۴L ȵz_סk),iet.k]=R)avec'OgIڇa3/c͑dOі,sOF3L-"BZ;./QK)ulO\]/SLϫ:*Éi|W+Ȗd$@i 2f͑KVG׻TgMڞiH)]Oߧ[,VNBίtP+O5g0DEu9{>+?g%kO"ToyTmG8<ݸvb_/V{-vOD -endstream -endobj -505 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 504 0 R -/Resources 4 0 R -/Annots [ 506 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] +/Dest (cb17-61) >> endobj 506 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 713.673057 101.433071 694.923057 ] +/Rect [ 101.433071 719.279014 101.433071 700.529014 ] /BS << /W 0 >> @@ -5843,31 +5837,26 @@ endobj 507 0 obj << /Filter /FlateDecode -/Length 4866 +/Length 4957 >> stream -x]ێ$q}gK~`! 2 ?tNK0z f̌iJޙFMUF$O7sʹϗO'RWS,p6'L9?%J)_Oouȓ~y٪R5׏N@T!l*&"`FH* _rT0[U'㶪3l2^R SBTFcu0D{ﬠ3AEtzt֨-.AgtΩ Fc Yy6.`גxEEl99I`EAa ЕElQIW -%{/ -t:YTiIg -uQ-Q"`KpJ:[<$x"0[-ntX-|l-:E06% >K,`sQ>%'р-AXN謑i|1sElqK\,lA -; -8ЭH\^(qL-q ( 8ׁ;%.p ]L$q|8FK\!-`GLvx3:I\FV9k k~}2W}702Uo?מ'Y0wDwǥ: #Wy'rZv[]Bݞu1MpzgY=ul2:@ =̥'r%a]oޒsKjܵ@el[UZgJ`z=M;KVG׉>WBOWRy >}<h%yt6뽀v:s븙QE+!\A+ ݩm\Lv<oǢw^CwC߳k<\筢ޫWXnޢmeiWtؒyCQ֬wOenUwô>Mui^nmi;aڹ]S;d|ݴ:w"18NgkceDZr輖m%W|D~Cs0!vS=adL?3|WPv/v/8P 杻GFJ>VWP5"%)}yU;jq?ТvǑpg[?wl0y4$q={l ݾ -)?Mh}_͚0PgT:Wiwv -艳hT<Hﳰ#=-jn̩x -zpf`CUqz-aHϹsn#K}<Нr-R_Ev7 zƬmX}ȼo}%Ͷ+y4Ґ VﾔЛFn&ݓІ5W%kCR3Xf8MM-2@+{)=*~|m!sZWO~oInz-5Y"mZO}){FfV2j6ZM}fYK/8Gh+)3=#6kM&S;֜䬯BSoGtzXv0\MmCz7YxA{GLeyo Jq#9P1uZ6z¨-؜*VLbzHVn>% Gb4PfGCM]g6%P[K_E)z.s̨ҥ8 "zFnE{ f׳Q'9O܀{ IL7H*0e@Flh~.>:3؍r -!٦+thB^4UMF']JS!EϲG]$.uƧuIcZHOS[HY1y*<"NKb?+P7#PׅxT W {qũw{{ Mxͯ*b10 0ăF_NsL2^N9U7g]tt޳,s;>@M~sB=)[O&<҆ǭe|Gv=4AMra}ĶCz&^V/ᰧCG/G7p 3r +x]ۊ%}_ '́cY$փ6ÈB'( l gQ[UFY#Ɣjht[eŘDlAK `lQ1H4/I`b\6N"K hd?Vi茖*]j0rElI\` lA -Y ,-XЭSYK\`N qL%q (e ,8ׂ;%. ] (qZk] +XuZI\"-`d%.p]Uw18 +III\&)'q)@cJ\ƣ 5^ x8$.P.(lJ\:c%.@aAX"qO`A$.]}.:¸Bw1QY p`!e$.>`=J`Aע.A1Sk!aK\(\f@1  0 2t Ȗ.tZK\ lA4(qA2 ̠$. $\-霢uf 0P(q V`JQ[@h%.M,sDlI\f %bؤf +؂O€@aq蔒 q`\z3I\zK$xi'Xo" +#3Yhř[-l=5i3LA5 +Vⶁ"s+NwU"!okn$/?bo_C4HAm_.pk@.4]ӂ\RXv-vabDy`M}˱KEΪӈ56&0Hb[^^n0iot{G3:+/{1QVVA]sjeںD +¡w5zdF\t..eM2"/(Ŵziq sq9 +ViS!R/>t긐C(j^U2p)R@; _9ȸ߸l;39b>| /o6 9( tҾ͍j(Fw5y0І|M(mRmPv*ܬ^Uֻ󼻭+DzE#ZwFzz]Wɚ${6;ޠ z Υrn+O><_+ ++]nP@xnR.)?h`F~ldh]xDkMQ7L܏PZ 4F9SZTQ~KZYԅm۲rF9ʋq-zd{c53cSxff>fy集!lxumq"x~Tc;`ͦVkf\F?6|fgGjV%N<6qWcTǮ.-5Su LJ2KwD7\fIe$m< EBdlf7ϫbi" ]G{Q +vN-gWjkکٛkj8~_l%xMӞg{˦6+aPnYTX)tD_ANP> \c!*e2=)e;솇$u{,,4rՒv~WX~w`%r>O[4DNrXDu[|5v+PYtm;AzP[ aݟQ%y޲Gp'}cn~GC乾*FXغ,o!~ wOyאV }| +NlrW<@zB=2ʱy yp?Q~K/W::"ͧ$7fO߼N$<.ꌋrc{eP@E:syelzheO&tV:52?^"4Y[i+.{@B[.yoV.{\#M ,QL?n~x>_Wf~KRS<R"U@TvSk=3Zrm;*2GԾ끝ű䍑{;ZolOm!3ƇC92Oy8d]m^\Y{( kϸ{ maѠuu4o~Λ1v \CxQ\mlqq+.ODֲ'9Q_Ocqe2/lڶuƓ;!鹤T%G޹<rٓqXϮfc)oH3[~ޏY?YlGzY͐U2;<'<zA\YYEϲUq|5ri+ybf!mg yWu2bcO#dC~01[׼޾AtsϨw\ky1ڎλqDwE@s2áy?]ţ4;7 ;T{F_īK|sm#+ƶFқĔ.oG<ƴǮh({zz]ݕZ<0T +5xfH;Vҽi^^p?}CLy][ήo=8ӈS[ۢ([{E3ۻ<":w.Yj"[ި:V,3赘Z=/iYhM tdbӠke;‹-yk {򢫬%Al /i^i#~LuQ{pikIR[N9Vec϶ Z (mJyf։dZl-IRl1E{^iNW*-[g-y[zK&Ax&u=un^wmzdz6J*{(?e'D LNGklJ!C}*:lwׄ*j*l X_e%6>[AVon峄eϯlHKE +7Ӣx#mI??"; endstream endobj 508 0 obj @@ -5896,21 +5885,21 @@ endobj 510 0 obj << /Filter /FlateDecode -/Length 4963 +/Length 4918 >> stream -x]I$qׯIq_c X6 kI0/XI2TSF X2_*NR]o?_~)z?⢰_rq:?)fob_pɛ_/諙rF_~"SL1*/2XJ[A`=a9K,3n͊%p$ uQ5+C XCgVCDQY#$SHdH V%^0SkQ‚W%,@.5%z K@ 𴓰 fȂ"a\є "s! l 邧@D$e%a<4rIZ9Eyf 0Q(a 2M ȃ, ?l{ D# N‚ I‚ QF&Q‚ "> -SJ‚M$,|3IXBO87AEAMY8$@' N‚I7ы%Df]L4HX 䛈l^x}D|&3eI(@oK - oŚR$ &2Ī*ZeEU9Di!o9Gof7cן|ۯJJk -dlG|cqR$!| sR G !8ȋ2\b|f>"GD>hY֮*>oו$}>JV۶5S2-@k:iw|!($blq+h?\rd#t?|~ -=vϿSQw>?'zEz̛8^ k6^\V̅)zq~ΰr圴*/.Uk_7fTwA?Ʊ]Yk6Zgz{`* Z|I4':JQjGi%r+X--`I_lږQ 8i,ȤJоrz;^Y)6hFgݙaodXP| !搏\P1|Qvw0>oWgSNmYX5ѓ}^cφT-Ө1i;c"ycޕai+D/>Qo+똭X(3coP"sN[oPb|YZhC|M`T5?SY6X(*_fxŭpeQa!C26 ԛlV='%2K[e-/CuK-?Wcsa!*eNcӮ.Fi8:r6}|zkd㌊{]Bq}ފWgg˝מQ7ɦ[PA_G?^786+B#NصDI-Vxl:ԙVԯ"#x.*)[m3[{Y6=~/dƓ5׷aRR YF-lC7zZ\[ꞈeOy5Ku=Gj,Ox۲}nXV"ѳwfOy9+ޏ^[GFުKrQ*Ejw_Gz]᳙Pu9x~Ddă:W~s^O"f?m"V'f{O2n`;? 'lC`\BFC x,es%kCX0nd7 Ϸuf2bQv8V۪6r^e`{xf1ĭVOy5 YVP5]u2G=l3c |"=,bɇ<-H&5OM=m==]:,-ZӹqU}oz'bӓ}^BXÞhZd*Xo >,8ǯ[93'*=]wf-xlk`͓}^~NJ]]f9WrxPۻzCx[|e=R늄'tx`C= O<"ӧ^cCke31z>fVǭ{f#Nݳ6KhY" < S5.;"Z[4oߙ')VI#a3DڼMm/H+ufi;ПjLԷ=n,u )^vW;iZѝaEm65F396i?ɳ7y'<=kqѫUWm=9T]iܽ ;(gB.οc},"mgtk -25K>عZPw7{2m: \yog{֋l i{2(C)=]sj("?W[+{tJ7aӪ\ڪFWVsr/k_g1v "zVeWkWofaaiwT{3,;woܒ]Q_BOBzVDzϳֻ3tzD̲PlrSXm.>/I:Ny|N<%arKf$<9&lNä2zn5,ӕƾ<(ߎzT(QogRo(Ã1׫8솆VipΖ7[_< Q^Qo75y NYr]m21׶:(.ֆM@t^O5&H/ =RclcV~Dx&U%>}e N7-fe72[ -&7Ҝq~l]$A4iCߢt n*+;)t&]=wOZ ) -z;yF~1lH[jR:F2֏ }ulLjc9ݒJ)-ZgXoԌu5nJgj#[^j|X gk2^Mz&/WB݈}@{Ctl\GB'6ѹ4Y9E]0"UkTY&TnT_[ qm"Suhl|k;1UCr]"Gmbkz\5EnSS@*Dcgɔ\VٍYoIBk߱BjzhٸTN5p4+^IS=VX]0.mfЕVV 44/~x}"zڠQ9- d-ay|E=]Cm,ΞmAN?=p nz瓺J[LZE Tc)ݪZʊbN3״ҔU[z-ynαN-L-ލzK[irml zdz7j=sv}Ԫ-wQ;U -K4pZɺ"Rk%|&lUQC"lr%=aN*AAs .#ED_o@S %-' +x]]q}_VXI~0p#00ӻc# C~NEDZꞹw{iUX<<,RjJ~/9=cpOOj^_I(?7V.N^'8M .yӟse}6Shrv)FUJi+b4>'41gI3|tƭUfΘ$̰.jVeav +f죠 +vh!9kSӃ3z +),"t:Ig^K<|tk甤-Φ(l*Q[LVEb,l-*(-鲝|NΉ J1uF'kzuQ-A,`H: [~$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a +c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& +%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn 'E93Ejdưpۚ'ɮc/|oNYJj +dtG|A+G1w#5hqt##1ѿrN#7E2s`RâCsf7<&GD>h*^ody>Vۺ5SR-`kiv@Y> +ND1il6ʈו[$`⺷.C4N㟿˿O_N'|w_w|=k:C,h33<׆tkIGy˞\+z~^Di_u`ٖeiL/8%dJ|~ʎeʾؿ;u]@Dy|uie5md'p/y6@aw QGz_7| TF9A/.c{:P/;w<询 zeZsFʱ鐺cex\^}Z}C9k1湵yamԦBgy6ĺxvg⼏G2OZ܍Z6@{0ӡv9r֑Y.o=wq&|Yy:ĩ1pl4dzc{0ϳ<:ְjDW:uﳡb(T簊6Q潈߳'nD~`#6Ps<Jw+B\ᩞ~eR$Ud:z[x*7!XC C>enSlr@{<ZoǮޖ(Y/p(͸JAjU<'pe~m< z@y:$ߎq]zʞmqa-kR9VbTц]iyL#c]ރyŞ,kXqFeԝn񈿖I.17y^wVR4ǙQhg$L4?,㡂_)=> ?Xޮ߅o|=7c1bGQvW7.6˷f'z]sX6cCCkv&Oa6wi=kmz%OB}2 yY;;\&=f^*p큻h +65$7e@ݬTM_͇anW2-u~!-}=2Of!n)rw?Ήͥ"?W>7}W 3N.o6V42uwNСdf/1=`.%K>=˂k'lVä2;TXot͓Bm/K$D{r0e>ry[kw=d+&vCa;[N{/򢫬%Al/i^i^#p&:HڨI߹5d-ay[uv,{9}h-.8F4ls+uUN. SUJզ0gn)-Nb)oӞJsVi:hɶs8:SX2 s7)mv˺l{fpݐ#SճUʇs3:HO ѩ5[^RG.+YԽ^cr֪镾 P}+WΖؤ luSNDj +WKAo7EpI?)J endstream endobj 511 0 obj @@ -5929,7 +5918,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 105.123057 101.433071 86.373057 ] +/Rect [ 101.433071 123.873057 101.433071 105.123057 ] /BS << /W 0 >> @@ -5939,28 +5928,28 @@ endobj 513 0 obj << /Filter /FlateDecode -/Length 4732 +/Length 4711 >> stream -x]Y~_,(^@ /Af;6q;J-J-u`,;VctP>/bLǓS7 ; ra'RFOXEv1UJi+B0 *bJ -f@3(E'`UKU&hT0C'VCD QD:Fd `$ti޻(si"%` $-[%`J[ Z' [(`JKd"KЩRg\VI:lZQNAK8'Άjxt[esŘ@%0% -$0! I$`(RX4PV@>-UőjBDX[@ka!+q"qݒJZ % 3k' ,(PJXpwJ\`AA ֵ ,hRX%$. )` ,qq:Z k -xH\^C/q25Q5S Ơk2xא(Gxdw`%.|-wu'iՠc8>Q¸E+$qb8.3J\0 xW[ԒMR8.'q0h8`~tE]TQ- 0 *ID]$-qxPC%.]LIUZ Q; Dl@MQ``5F`` \  Ip[)J\&b" 8ZUy3u:$.LZA/q~`wI& B-*`*g.4l-q<]贖 oPh"V^I\kI4#(qA$?(q V`JQ[@x$.M,sDl$.r3J\#l1H\lz3H\l'qAR~`7Y8tJI\tzӐތ$Oz^o E8MI$7NH=7p3ބG/"7.ft]x^` VZ+ deg# -0!lĘI L,VJ (/1Zp5Ԇ<0g'0,}Ysdv%5>wϞ01R415&oӷ 2vOZ4j NA66 -;/,_ͫz#? -IuoW4zw\cs8̀-w?>_O@r~ L&߁=&5\Xi>ݗmىy\Ʀ  -O[MkߙczjbI#gh+6E9C4ݸo_k7'~}t|1mN0y?SyrܽYaCfger;ܼbc>S8jaйk-38Z)Ferp -oT"9)X&ӝySr 6hvu;eob׈[[Lzj~ :|Ɗv9lg2R})m eg w 5ӱFZY{;mf{P4ϛ#wdD(.[!kcr2ihg{RsNٶݍ7=WR`/|23 h^ Rsg -^d?tV\`gmxW]qW -x~$ywp 6F!7?f][\{w97o$ו#r3M?l\Q5W -Bs8V 6h[ٯSXA՝yڍ%7hQv9Z>MxKtueY{3{ccZ)%yڍ~χW)qwm|2 -=ݙpr$Ipݭ:Pcy}nf׆Kk/1fDeœ#j6n4g=ws8y>,HT޲H/k.z2Ex4,mm!l5 -jv-<]!P+o{^ytG Cl=qa.R :tW畈6I/8iygL#cv97T0c)/S91S}|WghN/了{hzr9am?wR&i`g;3:ҹذs\ǒjoQLu3`J?t۟Y7*~9x$ N1 E:', 7 Oiݠ/`4. w9Y@*'[ Bz)Wļ`t)g!RX3nU- e{4GSWa1m:tNkBӝEfܺFmJEr!TI]NS&tf7{\1J IL7JO*֬)|5BllIxf}1Z}b^NH◓ BjWB Vhr8*{.04wTኔg@wǩGEo}=PMU8hOlM8uJLm8l*Lղ ȶl?]aq#Vi-:ƳhA[04G0>`i"}iXZO˜c]-TʲسɩC4;h1Hc6%pmeJDQ2eĐmS,GB)]+]+~3^lq\ PNՔŗ̷jJe˺i^wmiP5WTln!{d;sI ѱntƞ;{p񖧁b;X2"c%mM莁UAo+&@MQ/ӾtrSPP>jcls KE޲yޠ<|2N| +x]ۊ$}gJyH`d X#l$?}"RYQjKTɓQٕ,!9_~9zRER_oR?X]_HUޝ_Nl~iyVCNI{#|^XFR3*ku#e*3L S T`Tfh㥞"P^N3dQI;aVNSrp!f*Zh,lQV[([w` K(H@=`*x9PE:%9"X8&\V[t4h[a2 5@ tkDhq\A0Sp\:8qJ N 4Hs\:qj` qq2h xWK9.0] #qzuʠB +p\`c +`u~𮲸n*+r(Gxbyw`9.|A-wenji CtX >V̸E+ҹqbX.3p\0* ,xWjԜ+UX.q0H8`~tY]D  -) 0 "IX$qxC9.p]LVk xW=8._-3B)8xWH0 +#K&Γ@ `/Xq\tpXpm9. buxq!8. +h8. +e%ovy[v}`` }_OU-!(ж10m sg!Srh突k7o =^Y/ALh^@aU}y}b aW]5"ɖKo/ב\qu]L>mdnKs>jAz Rvyy>dߓ~35=;>sY-xyݟ3C%;䓏6>GEѻ/Ы7܂ӿWmV-k|עɦ%o33>m4Rϓ{VrK<:3o|t{ [F$YZmn_s8Ϋq[;us-ݾߙph^{g1+#b;G̛gV9rh]'B ;hܗhh4~–sgYOݻ+#w<9{0? +6B6C2투m=ݞxd;՝y gWAM ,&G[ݗp݈>o³*z[Bkd.D>ŋzdzyЍF3fI):(3~=m}BK=]G;lk;J[}hTD;4u vOsYV)Eo_GFJGh(; nÿܻhRv a*Ŝy~nz6 +[sÅUjZM\Y(M+EkNGy +#5y痱M>SuoYiuЂF[2'PpE^Z}j6׾<׆uo7}uS+.U^GgG-Tʡ|Ѷˈ]`;vGs8Dm<%,7>gyTW; U~c;786aGkg!ekWd~_Ԟ,Ϋk%WSȻn\mG\''9^{Vonߍ3к!ֽ{"s7I>ݓ蟙M"i Hm"[{o3ᐺ ;(M򊑷/j;vs4D}dyh7-Or0 8ۙpU_i? +xP-ڴg< +l嚲j{Minñ Ƚ; qܻsq^_W};i687kݙpF . 'E'9{:+QBnۙ;tpaiheimFCǕj{N) ʢma#VJeҵbqd:a_/u9TԪl.e:]sS$(i%ɈP\6jLd[Iizߴ]q#RWl[thE[mqbc~MvyP{rc$-Kut23][[SFu-h# 5ۘ,T'B,+%lfIwVŧҟۖmFmYZ*7x[-};QS_202.RSS,mu܆ꙊRk.?)"C=^+}!&4J+ikBw Fk%` q[2tg UHP:K=$S@\zZ*ژN!Љ^G4|~ endstream endobj 514 0 obj @@ -5977,19 +5966,21 @@ endobj 515 0 obj << /Filter /FlateDecode -/Length 4869 +/Length 4924 >> stream -x][,~_Qφu2k1ЧffY_(uKeTfvMP=M%$}"TfW -ED)x{}"EprEV]A8|tI`o7].ZB$C H(,E2)r\4l1Zs\4lAq"ovy[v}`a "E d"&k9.c=^t^@׬.B!XW8.ZJDLz @% `tr\lTHDȜ)؂ D)qA԰ QG2kIt5֙hPL4&8.bq\X:b FMqAEKqIqAIzAa2q `^z3r\zK}?Oק5h-,? -Çg'_eP\AOCo`Qy>5Loqs۩myݥJMWOy6 cd3xa8~D,hJ!myi 9LNʚl"Rv]1;e>]gieZ,p?BcX|JAwy=<cӶrc}[ˋ:B+9ͶO;g1;={ָiwv?؋6D1egD%RˈJ' el)ݖ9zPmK^e{}ևu+c#\w闆p[VƤ$;z~ ӊV6,#g"a-Q_pZ6͝~Yc5+}ݽ*XlRҶ;\ =\fcH|?r'1Z]f76UoYr];s n75돌?}DZ: ƢiYku:΅gs#sPX^ʃhd.~`暽X`Ds~Klwr ܭ0y!=3UX:Cf~wK& qQn("9;;yc{HϭN}m[<= oQn76j̲hǦ+'똃|w@xdza}ۊ*4mPFO'zvo4{ 0z=)Oz<q_n&сR9Y]EN"ΌCqi`u N\G6w˒AMa4#9ZwFY%~b]-t֕xd7=I1*lfj;~Ӻǵ{M Zg܎6b d~t\8:J/Vbl.cיCݥCkc*LݲȱdP]FХ:XtV Ib,تҴ1ǽ i&}a$mKMsL>VY'oViAN=4l%+U:F*k%j/jGB)cOqTZ'qT&-[=^L ['{KFFMj{JSeۺmC3l7Tln!{d,y].U;!*iQ[6o=8ҟ6[#γW{%cMaA_Mx"+_%6}lugcjW K^4Ym6 +x]۪ʑ}gÑ~p c?z00{ۘ}ߟR^BJ{w]DF\JU%r zEM+S.f/V.N^'8M ׷ .y˟uu}5ShWR9;*CTO1U>:㶪3\N^R gLT fXݪ20Q;I3tQPi;QJ5N)A=Mu:v +i%]B>I:[|VZysJgSt`-&E+"l1Nt ]ItN>'D]N:䓵Ji=y`ӊ:(tR|u[e$-%xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a +c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& +%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ +CĜ"52cX8Dmѓٝdr &_qyռSVjsj +dtG|6iTm, ",ld&hz4S'JAf>4AKS?3,ha@ ͠E}[% ȴXӷKf>b:맟.^/oJAӧY}&,\OuB`m(o+oeZeTZ>-C[T_mdfguV乗Qi*>}|~?9 +8 7.zsYϿswް﷞G?>/ul(Cڥ ]#UH7=! oz"+艬g^׽^֤!ϝdVVfv|l726RpZ8Jy:cC!rCI32a|ėlM7$uL=? MF=tH=juިQ?(`5[Gb{1i Г+yDZk5J_Gu23zf1Qk^Y ڐ{cyu : +j_ǡsEe؈3m͑GBifl{ '<q:g&0$U<^?1d|QAf\leBګj_fiD >'<c\+gxFtKeX%(2~{4=t+w瑧Y:GIW9Vxl:`Ll&vWJ9fvÙzP'%7kCڤ'w?)itF X`wڐN]zbϵUF }]<:<|Rf,~IGZgYLkn7zhS.eE;CkZm{jrTJ5 ]ծ[|u4bIk)I>]9qQ#G7qPpZsc}Ӷ꧑5}ޒ>2Z%g_c1tc#~^cK7~,_,x-b9|iGaVhYAc].[X|6F}Nx =r*;]>0^:e=`. { ˂v+aR֮zzDc.PۥYD{a}&'񆒽!3?d|;^Ւw=OO=u! <`y%QB}l\zᰎ19)hw Ir`ڽqӃ*G+RSw2ϓ,u9ܧ^'<8sֵzSv97npJa0Z I SCGNAy ц#6&W["Q'˵ːK,rcR>6>Qt#qΓye젏PaMY~h<\w`:sRJwaL?n"5Ǒz.!5yacŷ}Mj$Ս׸lk;|7%Oyb[F̍p<2>1Rk:Bt}yBd~su;ey3)!sy3Qe+pGGHODQԷ:WX[cB6ۺIa݉!O|8w'{r<2f&.Eaᝣc8sfGzY͔U2t1zy:މ+chÊȿ =G|m7cQP?Jnޚn=vv{lNǏ-iSy7ZaNˠثV&z4aꨫ^׵>"Gl 0Gzx&,\m9Kj;N_za޻^vt_{g!c.Lc~^{$;ʯ =Cq۰鶟/a~߁BI7љᘯͤӵX}9-U E//J颳 j'S/B s1 Wr=Pe7mI:|5TMdw. B z+֫I1Bl +:؄@{ƻbmPظj6ׅ.lsi5; M;kQջF5eF&5eI.Uv̦gFo]ɵtD[OŖ*zҡNOunH?ƈZLOVlwm$vG!\|ZVn'ҥ1UWahVW_7)1E)z7plⵓ<4q=-saK'%'mVR2&G$c- uMLVӸ U5uoP~[ UZeA3VnƝo\[kzs0_ybsj%]lTzeL )tqѷY\Gkc-'kdҌ{2OszCOw xD?.e7iܺ~&ӯTa6Lh.֩ m7U'R7M˅Mіyo[ }'j.xsp)ʊ%S:ΰUe+3 zT`a]ڮs}EW +!`yye`7{19@FMƥa$m'K|֗mαuv,{9}h­.8F4l%畺*[UZ'F*k%jS(٪['K]Wi{9^ TnZd[9co)[,Y๛ʶuuufnH葩&=cg3:Hy'DjyLNGkk*q/%5p㽒H+5;&g~Q6 |_ )gJlc:ͩN_^!.#-w,~(*-Ua~ha}2?x[K endstream endobj 516 0 obj @@ -6008,7 +5999,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 386.373057 101.433071 367.623057 ] +/Rect [ 101.433071 423.873057 101.433071 405.123057 ] /BS << /W 0 >> @@ -6018,19 +6009,35 @@ endobj 518 0 obj << /Filter /FlateDecode -/Length 4697 +/Length 4770 >> stream -x]ێ}gIV~ p.E nc#ϡZ*=l`vZU$UbKTK~>/B釓U7/Y+{> >Zö髏Ng3茶I*T*IPY;xoTN%̰ /Ufp VR 6&3* 5K*J+ءR(f2Nӝ3zp!(Q[ Dla " q7؂ADCԈl\DɆ%.a=^t E]N{ Sk!`K\R$q̀N>  0 2t Ȗ.tZK\ lA4(qA0L$. $ZұJ qA`7PQ 4&$.bJ\X:B%.f bLM/qATQ!ơSJ₨֛%.L qA$&x¸zK\X( h¸'a vtDz3H\0MDbJ ]LI\7Jk{ iČZ̭b@{1[y1g@i$& `&VYLPj% /8}jSTp3O1,}YsbR'11S44#005.Is"d! |N2j-NId$01#fӄVI -XY VXau(C$vW*:Yq́|̗X wߟ>ǟ=;|_zr_o>ToU Z62 ڮ@Vǘܕz4o;+c&[ұ۞ݼΎxjg,^=W}~û9H>\\p2$q+s <ÝlːJDiFu*HE:w{fQ鯺Ԇ -~{ӱV+B;R(-Ts8TM4~$Iz>6\vI18{!1le?TD-ʽGy۾-W+} _~i[W2ƨnnxg6Z?GKA}N[#&às[Wp׾4^gdˍW;T92w҃YY QSv}Owk-Fa&W69h;.跐ᐸ7}$ٮض7Fu[o\sGam :CkxXAK3OwiV}W)Ȩr; q%YS^Ak3ݍ}u}O2xctueY{v6qlj9j7ą?^-*9oe>-;+{ v;,|3IR\w=t)y>vvmy@?OejFTsOwG:9iYw42y'F+ ̻ 8#3ꆯK7;;ŷz-.eл;JFkDvz.Xf#omGV -Uj7`k Oᐸ}+}&b(fKD," od\v4dmwo6 -yk9ud2đheûres~ZwIHo5<76_s8tn;=}9~k<9}NOZo+| YpȤlE*eY VS#ƣW;_#^{o5CMw9BF~W5zo3VEJ|;~-efnJz |~n}WU|{v96j.n=x-حtǵM~HSSk~nCY^n`7}Bzg!r;F_[(H=dYħݮs~u3;.좹3/XcC"3Ԧʇs8nCJo}Y $}/?߫/\_z׌[ 'rIS02( uuuKar˕ܤ;5} 7H6 ڷӹ{6ls 6_m?=J0h^iyv<]>R"MzX}^9Rjz7J K890:\./?ľ$KdGcդ6WK` !j:W]aS6CXlmVkR.9]u -m;o /'z(MoM5Ȩ1*%CI]Ncf8]!K I,7f|)j՘{RNt hrf(b<}B^NHBi[B VHMETKOYR-<RMN$"wR+wuX;mK{_0J(H.=66]}%*1낺"Npe+TmL\edN7p*v;[/\n,ORFٮV@ -U\iyZicdҌ{9}w9CD|p[&(K2'>%:Unۙ,8wga6pCUC-k3џrq:?)fob8pȓ,賙rF??)T*~ p9K*3VaK*I* 뢶 3LNR }TZmu0D9g~ +h 錞B&FY;ג.O!$->+-'D]NnuF'kzuQ-A,`H: [$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4swWF5 Do +;[@`X PdH\:c4j) p`)e$.>`=VtL)E]NG btb-qRS ?$q̀N; b-*`*g.4l-q<]贖 oPdVAI\kI4s֙ID&Xi)ElMH\Ŷ,6uz'qAJIₔ`QF`֛Q€` <> +ơSJ€֛I\qI$qA +M,qmf ;ᢈ:) &Ib @$q 7ы!D( >$xiXo³ +#3YhřĈz̭b@{1[E1f@F0+ĨU( + p5CTp3S}[sdv%5>Ͽ~o{zU? v0 LFw{xoHLDRd! |&s7Ro,,?m>c/;@݆b!X? VXa Hc!vW*H'um|̗X ;ӯG/Nor<Ҭ| (WYΚf.߃ZeN79}d^txvzf[Zڳ8^=|~ߝtKxp.Ney N<ϛE:s7١K_ʹ\Mu]nN?_a13@uvma D.|GN]s4buTSԛVO^(&{ń^C~4r +iUBe}bqi30@zvV>(GnIQ[A}-w9]ly\FBt~eF~*Fn\ +If=nLCʩǬL+fN&Jg a ҷ8{ue!UqiSCǏW˲,r̷ӗ<7P6>WE;}$ 3($,Yǘ[FR}E8BS"D s4 r廙Ƹ]F8!e==p{Djr.$ݻwwpihՕZV87C+g+COcIGy +-y痹O,y]eL3OZ-ZarIW{-׾<׆lz*{cc<.cY9mletY0Vz9{Mgz2~UV=ܙh_wwyDmtcw{7yEwPuѰ㌬G]o/j&#uӭNp%L36|•YCW}q?ۙpU+hyhu{a3+eWZCFc&ߙp]\y'5v +;s84n?^9z+b$S[}lWcaԷñ2rz<3ѐ]}WG谟Ln`l1'b;Ir_"=)=:i>a/aׂ9bs/ya蜾 +qO;o}xݙp>$ !#ORTlϽ'pOVrBZkղvm<ί zYyzw9} +ٛkBֲ.u9x"hx{Wh,uۼ 1Dwgaz_lgAׯaQ7#Z&1Ĕ7kkHWh 3{H^<CC{3 +?Olok~9~7b~|%`1;|~Ҝcmc`;.Xۃj'z'&C&}=SRtZ9l[ˑڐN-{My>ճкYe7R-4,\vg 󖴗eX[[{fgĮ驵U/{Uode-ՄE1N![z\[oϭYZr qn)g^[7a~*r(k[f{r$uH`3 El:5t8=E[/W:/ـ MJ_]6ŀS G]I畜r?T{z^;p} ;\:'$7:v;T'SDsع>7$Vm> stream -x]ێ#}W9i/^ <;6q;b7/.u`vUT?(1ǓI%Y~;+ip*?_Oo싿_:EJ^+w=! JPIes"ZB$C H(,E2)r\4l1Zs\4lAq"ov{[v`a "E d"&k9.c?Qt^@׬.B!XW8.^JD,z @% `tr\lRHDȜ)؂ D)qA԰ QG2{I 5hP,4&8.fq\6:b FMqAEKqIqAIzAa2q `]~3r\~[79SV~oFLi7J,v59 S@sҍ+MB-MdB0.VAagmΛjAH3ru/v /,uvɹ 沗eWu+}yhS?4j;Cβ .sg~զܾD`v8MΟ7^ڲÇkvv/4h"4MkQ& %h ɞmLuWdžV6?gVʼt` `T7_u6)D Wx.ͳƐXN2RFx9.s-Y;yz(fTu-#C`CNg杛gFc\%vo;+j+L^^`CNt5W}_?s<6E:ĸݒX<'?n =ͧݛVs;n%z6uP!*ɖUrO6Pv'# M=zá`Fj\LFf_^r}OM'<zw7d;U{Muԣ(wdy8ėCvR_Ek6TX_͇t-iTg5k3=~~W(I4˧ciG}I(|,Jzَ_sd='sէTwKmٳ8"&|i*+=o8{+gsHcU&Vߩc-EC$e:u3Oc11O'GA#eG].DG[Flm;OjGLmYU* 544Ne;Ê>;Ԯ wUhe)da}Snj5ZPV -3_j -gRAۗm bed'tkkbm=C盰ꦿա-n(}etyi.QΨTb<1ˉ~"KYݬё0 Z.rrbͭ:Sj*#LiP7<#tnHS^.t~Yk;rr&~=v++녦klxiRWXEFjU*%/CqUf/:eC+ -b/%SH#vCC*IUXUE]\ e15P~].U'kg^upw&;_{q3jom|^cK'MevN )4q,.}kKyq/Oi4U换(K2_'{S9!vZVЕ[ޓ׻ăb"˦j~ʺǵڶ{)*텮a'Znd܆2b d>tnÞ.M9:{.Vᢿ\Ʀ3%&qEEK".Fque 3 }'u~O.Ktپ"wAlaN軗l/+ګ#i%<^j_^Vceemn䴥B 1Ic6p}GQ2YdPls2,#;JM}?Ү:*KW%S 9d%##}*)uvw6l3ķTjnU.gFsO΄T*m=87us%Hɕ=a:5FE_xț -EWtM/C%mͭx9!T/m 'HM)"} J"} +x][q~_ ؀?8yc# C~ċҥ{f{s}ZD~XE)uNh1o.?_N_N8UISGw&~i\{G]HkTֈCQ%29vQy%p)q*v +0æ8̰ZGFaA* T0C%Ci)Y 9VǤ Щ91tIx]t$s)k%-KTp3cL}9Z2lZ.}{\~Wʟ9O|%ry&mMYCFԌTyэT6]Z fg&_]ԋPAgm;ϧ + >׋y:C#)`^KqDqg3}k@=kM_~/oHiZC1ÈR_?"Ӳ*]TrSu9 2}~6 6ԎLҒ,gˠ|5[os]aʛ9:T.N6(j 4\T1y.uի̗Ttt,`j.4j^WKWtH.2Aɽ&emQ:]adkFvmDZ h/_2;ʷ@KKÔc{<3zIEx]-NMSOq^ܧe&?[# ew6}gB!{ +DCm2 \O"%j$0%܄ ڳFm_W[|:o6Z8UZic"`ϜwK#XH2{<|(7x's_B,hE;g }$lV'ϻ'WGm]$j|HOOf#\gC;!Ǟ ˖^Lqy&ZX7}_|uH2jza'<z҂o+/CvQhV1riy}fƧƚ]ܖ%aT;Gsho)ʱ={SzytCt9;ϗ'<j3=;8ή)]C[#bY];Hծm /C>|~ Y\:|x~nTϟ=ϟO߆|9 ukg#y }ytrQ;qc㹏dpD$D=r2ӡ<uw)hcDvFEEAg1~^XZw==pY +~F4?kt2I.1Vs4k16J6E t)Fћ7f[ٖʢO2AC-϶N:x|w\ׁhw}uW *gccۮe>HZ_lYlKf._ê~{K\b +rCQJ7ܰ꺑3b皊HF sdNs.*YAO 0!Cfq変/ˈeYUV DDS'|jᴵtd},L޻u"Wk1]j[f0󙯦jU +}V`x(VFvBʮ&ֶأhWt }өKZ.֌wVJ(EղLgTRWRhάhI lMJ:Ft\PSŖ5o4X6^ՍiRL;־Í^ ogHl Lj׸B^hr8ʆ&Che +W<@ +)#JhlVzcP6]s*fB Ϥ'ҭk-]uyDR-\WBTlDmU0䷦=8ҋyJ+"eIѪ12(z-o;XUލgKY +j4~C~b^ B4PH;5FzM[; m|@] endstream endobj 521 0 obj @@ -6080,7 +6092,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 642.273057 101.433071 623.523057 ] +/Rect [ 101.433071 713.673057 101.433071 694.923057 ] /BS << /W 0 >> @@ -6090,24 +6102,27 @@ endobj 523 0 obj << /Filter /FlateDecode -/Length 4922 +/Length 4786 >> stream -x][q~_Lx?^<ٱ p}DDZɢsiUR,HWibLˏ5X]/V6LN'L0L׷ .y˟~vu}5SJhw̲ۗ4r+4 , KLIbA [V6E' 5& -1M[V&h+ N., 6J<%#<%ѓ$H<xi޻(,dqIi *Y, &qB˓>IXpT$a> HX%pW$,p] NäHX6iyiR)F pd$,T0I!wޓ,Y( ׀c+i2@ -U;,J$af)a`pBl$,N)/aO -<|"Ovd3Ȅcaݷ7fs}o3/T_p Lv;D'_'U !{d!BBjRtB?퇕<ȋ| C6$*[$L]!keY]W(YmkM˴.8;Xƒ]>ND1m(8ʈו]5O"\[nL|!nǯzzQ8Naӹ:.~9үƱtfcc+1]ƴm<2eY ʹSx_^}\ltUe:3V_]K?":mvu0ٔzm^m;Ƭ-ۆ0`Y6|Q[=ٌY]k=<}md^mvv\Z|D|:s}j}}@ 'Tq9F/sr[!ňIG; wZjzLl6ȬX &s!+Roa<<^iTNn;3bG+ Kk;wFocbնk89y,;~ۑ}\SZep}ۇ*߱`Rs}΂ǡ zձ7YR#ڥүRGy -xŭpcQa!p0r`+16am>TYeK6q,>,܏QY&ky=,c XJ,D͡DaNl qE:3*uG};B[mr+ud<5j-jvj f/wj|ѫyk3,˞lJc{7U/8sGzޱb;{YUةI`vrS*Ej껯C~],}dYRI[#OӞtxP}N6XЬ.o-b|f>Ÿ kE0c%PC x5[MSy:K>ҰCX0v631(;zUJ³rd`/=Bq\}+VcPdgN{ٝ5`>j[3:])3{IL߳}^=0ޱwĢ'-ݹqU}zwĦ'<WbU{[Y;+VŢ&ʿ~\g`w?~mr̙=Q麇~` |(}iт6=t8ntVw?6wG7gYq@!7v7+"xs:~apwUץ;8 &j,\Get4KwU߼;YgZ?8_3ݱwĕ'<5fVǽ{f#Nٳ6KhҞ5,L`d4idY?f(j5/c6k& qI;CYs[|+78Fڬ"!N!:a#]=oyK}gƞ#7Fv):?Ny׫|>0pM^`F.c,WhM؝0IBaBnB\Kk#Jˆދv~J{&.!ӡLy1uv4n4RyGb~_;4 w7*Ӽ,Zr1"&`>/f΢U@{6ίNlwi*/{aahپ쪇7U!DPŪB~?mXkF*^E4n0u닾=hi1jI>/t[GEm10yVU5lNj//IWot/!Efau&];=wmZ-_X6e@l&WBYs#풿* -dk{}@jcYRJY)-KjrWWXZUQy<@DOz5酜n"N\&J8mw<$kRDŦdc<:wbNmM`yx`Zo"5U8҈ ՖmCl'tTb3Z~ULՐlkj;t\۩Z5UwQSlh7V sQT?ɹZEf7fC]m'..] -q"q9n/?hVZ~j -רymI%>I>V:VҀe!4Q 3Mc+*ST cM9CXOJNTULɮۊt:&󚙻kvoɡonqW86;:I'ռ]`N0V6t*Y>C&y寗 9I=_@__7iغ"sO'$vlXco54?n kۻ쵥n]!#fFӌC ZlMw%8sJ \ΣlH\ݥk >(.لK3$>oVP]0"_RfЕVV &~OVBx}/"z2A{qj[X6T.*e=]Cm,bgZӏF-(miVVG4UimPeK(j)S54%:+~6[=^@sSe%@wޒ*m;]]-vA|LU6-߅9;s K%D}8j*_'J#_+VDjτ, -:,_)wKJ\c -JAԦT 'i;Y]S"ӕDOU.}VJR/ߟ~8)zꢨZ8yCI`71NoN:lOrv)FUJi+b4>'bΒ +f۪"p9yI31IP%a]v0D$GAF)QCs:IgR6YEt4)Dty +!$lYiIa)I[MQbU;Y%t%Q[TPZe;u:bO*IM+00H! +:[Yot8H:1%aVY-Rxd#Y҈:Ɵ?|z/h_iv.uXr헿y+zhk)Ӣ[8^6 CPV? a׶Zh^k?/~ߝ~a ʲLAIY;R# +8Wq|K7/ֵL,_"Ϭ0] 2tD]úѩp<x̾ޛq!==ԾþO. $ڻF~&=Xs逬7ɣD\S_HFWp٥'OcwSTJVב{!zy ֏и.A~ ~N=ƋVG/28ͭU:OckX;ztD +E s(r[#X IuZ{뿰Hu+2 qih۽0D~dH2RM;g<R͍\;V/ZƉ:G}[7Zq#: +<.ӗ]! |`C|v/Sy'{-ݱ{γ]]ȽQRj_F]62C60ּ2D!;B5{]ߠcAM[3ڲ}31ۊ͑'τg;dy:__GwVI!z~F)2;\cp(͸JIf226x^wcus\+g7τrdgl{\XԲ'rUa|=Xۺ+1}.:OC<^yQX|mKL9m%oh ;o#khg$L2߬_bD)׳j伆o}Xgï+w瑧YwsSGrv^cms`_Y)X3_4b#.`>-6%kǂm)+TO>J[VW岏Pl\lSd}?.eS׏6QkkԎk5[*VhPt4+{Ό+3۬]Z˼2n7 [`yUy@3;꜎ئn^s;7kvtpތDA8+HXkQ<DZ+dwQ{IȷcL^xϛ^)yDu9&ƥGZlH8*vhs]u7{}>MqC/eY<n9L*ӉQCB|˴bEc.ТUۥrZ=j0e1j󷥷e!SN.u>޺s-с*wx҃BVm75K,9y}V耟;A\$eP{6#)36tZfe8\$7S׸O}{)7\z9>`R˒idyga(=aAl5 :tI3@`mQu௡(*3 jkhvXC5 +sZqsS>E=8GMm90(v4U"7PT}=謇CtM]@]GX>븬-(p%_/l=J2FZzٳZO6)u93V4iCʟh!3Qu.睚(Zt~Eab)CO:_6 IڪiQvԝ v4pyZ[N*ǒjyw7)N/wC}F'!zE;VLw&44*4S(nޠe{M VXw]l\Gu u -k"k Q&J,T.VUfQI}-ĵqD Jզ٨I0U V.rr-6RJjt/. @`sDr-6*1ܘr.~;(+Bm:^4*L*s*|5HYwBsNXI.]:ƆY/PHn[I˘{C$mޤo\nd-a}b-juv,{%9}j­.8F4jK;uUF*k-jSXU;Nb);iG9Q nx-[-αߝ%[.Y൛ʶ}u5ڞmnH虩]wܙ RSvBtGq#P;T + 2KlkulwD^ 19kU=y oP +T=ZV-VP9 *_TˆPTE&:rj endstream endobj 524 0 obj @@ -6126,7 +6141,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 135.123057 101.433071 116.373057 ] +/Rect [ 101.433071 210.123057 101.433071 191.373057 ] /BS << /W 0 >> @@ -6136,36 +6151,25 @@ endobj 526 0 obj << /Filter /FlateDecode -/Length 4734 +/Length 4688 >> stream -x]ɎWYC^AˆCwiZc@IdȪ)84zK0 g% F!DI -K%fI ~=Ka`et?@G;_w=}?:{R=཰*B%fT+N1FN37,Uf,FKTE4 -fh=vH%!à;NBTyWNy#tqp lQHNgaN[9آ5Eat"  -'$z1"t")aNaEagt -8a#-V 4l1t }jUВYآ7`9P8 - -8P&*Ñ -z0T^s4-$tJrDlqL%l1Xh8. -Ze4lk 4ֈ(9.[#@pa@qup "h.@uu &8 4xW)8.0]Qes\`XF: A 8.0]w `u~8swUF9 #h -|8[@C4hlPK8.]5 d ޕ =FYA:9.]8*q>Uq\`RSs:TQp\`, p\6H貺8 ZR "IX$qxC9.p]q -5+ V[tP ˖YV+$fӁw%q$P8 -V`EB>V[ Xl1p\z: -Z) -8.@D0D؂H01xèr:A׬.@'=ޛXr\9..q\3a -pECP9-9.@ [ r\T. ࡱPs:#h8. *r\e&l[ fV[5h8.(8.6i9. -7Pqh:!8.2` X D-YQ;oz -! --"nIo8-* s  ~=lk#Ӂw: p&"[no/@#>㕁vPoeS oٜML,cpPJ Yp˜}jSTpIF, 9j1Rl̏'8=|2eG"@H +,1ѷk@.Yn)KX)FFѿRͼ[l~$m[F?,%qf^Zm{lL !$p(" -ź@+̬ߝ&+Dm9fAرe>ǟ߽;}׊׼s _ce~l7u]KWVz;oԏ\te6\'v*O2~{;;r(̸}Ox7© p-TVan`t_Y;͛1_<[ - -o%Ţ~:d_C+>~u+5o֛泝' |m,1.eC<۱:AJ1[ )eM3;kxigv/*:0_⎌ۥvxG!+Աk9瑙oJW2@QEhYphWy3(sWF]gu -!.+t*(L;R:;?);T>E hgBW*j oCPksl Սzsv> MOR]eoʧɃ?g<ņKc_C) ksegEq=:CMȒӿlsX;m6u]wę; z,J*koh5f4V 8BUs8nę-M"~5ty9t: -9 -ǍйLѹ@rOms 3{O^v{ObΩ>gTe='%;! ƕn-s8_Eo⽌gk}u6f#EeTWX<%oqni3+ƫBy옹]<s8D]rҵ;f4~qhiEV䱳Py}߈z5Wb6L11e[yu*]uyE~ G_*pޘݾ#6٦HYpHݒ]'n"^|ޔڱ/ѵKGܕVQ]a;u;3R}f227|z9%jz"[_9e+;wu&&]D=͹c}ޑYhueԫ#ӟyպ+ (]},\ rƣ;G; z7|.6(ĜC.}[^]W+#_>5oVj77k[(Wp(ވk\]]pߥA>>枫69Pw[_wYhw}d&RyZƬtSvgWٟ7?EaW&^uč vܶ_a:zu+ -hcwXw9BXˌw;J|L~6ޭmٯ*RXA՝uڍ% B -Z6:GCkɷ1G]}Y^}^}fHjC.n=4d_áv#zG\xk]Jؚ]mX—eb;;a\2I\\v9鵧4\c/wmhŧ2t^[ 5 +߰.;| 9TuG4ߟٿrgpߟ/AteARG%/wޞkߌnQ^1K[u}M+@=[u3ۻ+ew ѐǨAbr5.mu\sqE% }tze5>iXL;=02 8#3\xĎmsL6ܕy^2 {O`7ӥx(a/֣ܞ7Yp2{S$ {-I畚ݗ?R0!ގ2+9&IF3kI g{^]hA SL(m ؠ/ 4N_?*φ\^)aD.KƎ!j:ًANbzct)e! lmVK-] -E]+2t -fsY&Э^:ʣDƨX6,b<1ˉ~.rYͬѫ{Fa@2\ĖZe|)j՘GRCxFhzzmFbG3Z7j!)+_O3m -a3Zn- *^?aif)1O@OvBk]aÍ4mKz_0ێ )O[JI!k>f -yŲl"(N[*;s-V+ڊ}qIo*vg%96Ӌ !wRJoW;k0BW}MZ ;uǺ8{9xJnNi">8-Ŋm%C9%gJP[g֓kxN17 ˲i4_2Բ6q6ĞK h[c؈U{ExF2;7a:la:]]iGTtIOn*mMZ63vR7Th9h:UgmβtM=h64a{y}O&HZH_[i91:a9Ly*mfԥQC 3;h1HC6m&ffGQ2eEmrS<,;JUc;Ҷ2(KfW%] ׳d%#sm"5βefw4L5TjvQ.guW*L wpFz9Rz#7I\zdɹ'L`^o+&BMSkjQt0Jsb Jo&O͔*6NJ^/J1I?# +x][~_ρ~؅$ By8ӳ'K8!?lbl='̡UU>}*eK\9k gpR8s\;fD\?Gr#]_sX'Wd!X)_?EVy!T*.29'%TV0\b +f^J3Pyj +0C:)8B%8sRCJ:aE[J'>@tIJN #(]`Z)-&pA l1BkN`VQ: [U面tHN t]ntA1֤.@ǽKtB0l*RFIb %SEҁ'rUޭ)&uO1;KQzDqt 5E+ HvNQ4 aG:)("Pm)&Ph\R[T( [`Ԋ@  +ty(R\@0S\[MqJUN HQ\XIq*- +hRI` Lqؑ)wh.ʀCKq¤ ޕk 4xW: 1AEqJKFn4\R\RKKq?CKq{褢'cn +?OR\`£H]`¡Ɖ~Zf@qbR.S\gQ%+FjJ2p x~p`ߘ. ).0]В0LB cR\`ˍRX.p{HlQ^R\:t[OYe\)(x 0rM ). ^z͂s8tpHe868e:آ5 *x -JJ -p(.GMN` B4lHq5XPJy脣90 0b<0:).pP\y Ϝ 'x Aq ^z2-#4撨jJygz ,` $u4Aq'N `i-h q).H.).6|Q\8lGqAE78tS\|Sj /|S\|S<e|Q\4l1pQHl~ N|D,lAS\MOq 7ѓ!盎 wM3Q:.8a-˷?> 0z977߈-o7~åCwLcRIҤ4}Or)'}|2iˏz[O@1zɔFMtli5l7Ke.]?s}X֞l5s cu-2֯qU[:T(e0Dy i~jppPJvʓt;Xyqu;kYC]q +O0P;r )ѰJ%cl2ms5md,c} gב=imurVz(בV2-{ʒo*aaCf_!lrhv,Qe4x3b?"f}yN>o1Y.R[#նdͥKe 12KoJx++QH1s#wnYzõ3鐻Et޷f|ߙlhV~ 9#fgѡ±_mdi\iŰ`yNm?vTb<2~u7gjGnxrqgadleVH눬 VyڙtWpJ7z,KQ;;q3w⮝gЌ-Q&.%XBҷOhiPݮ٘?(۵#벵S:SUzs:FK=*UnBKZ9gow*b'P{z]jV3鐷s.:ѲڮHz>-o{$7FV\3{|y\^RTWQg{55Ki}'*~|ů4JM13P_:껔lE8+r<ŜynZ: +Zèk:u;}8J_f6g ,1g 2>ǔ.I3W;MX%]V~ƢN2' v%qBG 3g\ns/_;ֽm\ա6#."<{=N +ිm ÌwXٙl;w}-_3t$kXj؝yN_ GDm\3EVZEzs6hqF~j'F޾Hw +rG={ u9w|']O~jզ.,_AouyL q4jb~=~4O԰X0!DN+xILMG6blrB]-',wBJhB^WR'{Dܿ-W-lz]ujV9 U]@өRJe2*dI)sNv!tj^j' .tv!Mg3\NK֐jR|xB6$uqp~6@jk+ȅv1:"~G6+IЫ:o{^Rfŝ#U,3:C*&WJ!ofjͬڕUu 2f#ԹfҪ* ɼHRu WQ% Zԅ=ww}2٦ڳ LxT v~uRUS)]zvPcmJ`Bu +ME x3djؓOQ?5mVɕhViޒ2:wR%ٲl=/;2t1ϔlf.y* fpJkN*4r8vdI$4Jq'ޠTo>tK:VD(_DSSrC& zs 244ܼӳ_1< endstream endobj 527 0 obj @@ -6182,24 +6186,23 @@ endobj 528 0 obj << /Filter /FlateDecode -/Length 4793 +/Length 4917 >> stream -x]ێ$q}gK~=X0`ȖAKm F:-^ ?(1퇛I)VY{wWTݿ' "$t9&^Qw-RZ߿#5"cT * rNgT^ 41%N3\nUfVȨ"06(U% -fRv(-%!Zri%|L: -#|)NENgaKRq:[Vr:bM duE`8]-I.+:"T.R%d q N)M0I>0: [tgtXp:3!FfjFl:XV[h[d` %t&m9mX@$l>TiY1Qb:bh؂[5Z8.0[+oT…5[ (PJpwr\`@5k h9.0]cwANV[` ¨h8.]dw14Uz cXr\`:` -`uA`  ,xW;4Iqj=H6B,ӆ&4 xW%L̘[ wUD$TǙq / }w1Q x9. ̨U35*$q\8oBI@%!S8.hIs\YX&auAHC9.]Lޕ @Ŋe]#S?o~zWfQq\>nJC쥤ܜLUEkmTr* õ>'ѢfhڪKcK#S'~O5h-vkY~  -twN:GաF=B.¡yfj0ll ⁍gͶstwc>Ջy X"L=^{d-"%5G_hMWI{j[^EZC8&BGt&`WNfUtFK%\y-ӡ2o~нBI<{ -Awq\3rsό1,[j>wxbCq zK̉z;Wt\㑡䪩 ~0E04ϼ= 1y:ǰ?K-[f/B^lDZ)<|z:jv<ĢC <6[kf:<uu4|{P0hݤ6{o^t;Mʃrc,/NpcM/ 7 1o囟l_˯e}84M]sCHGtTڝ!ZCqE<٭{pؽ>kmumϔGyG\y1ϳќyiHLo3(ZŨF˼j9H|OMes4S~Ei߼y džЍ~#=;dooHmPVĔ/#w&Wf}Mm}J/%-cÂ*}fjfpa9}ږ,ls-KM˘|gv/U\6N4]Vcp\8=yu9}hkI3_wޮ1GN`GߡˬɎO\;9\)s5жw8_T<>Kγݶ,6|bi[۽SWߡ6\~w7~f>ĄvRguW IM>I% yZ]g?pފn!`WG -Nح0y!=p6UXÆo-Q$E`Jt/g|=gɡϸ9C::ov:[Lluz=ѳSyd^00 -;!ydq_>Ǯ?F,˲%pf?}?¿ES >M \ j+7qv<φ7?i9q,+p0eѷW"כ`Mouif[ ZzI+9_< RN]AJఉ>0Tc=wဣۿ-nNGEQӓhym늺ᱩ}o:HEml|y<φZuȱ'd_y~lrH\f^9ݾ6|}Cs4\mܩqgymDZW嫏@739?w>3Ou;|Gy1ӡ8臝\c- Yhzgoºð^~<φBa۩0.YayQ7N-y9>9y{<-|!BCo;e{^p{uv^ѳE"thLx~ϛ[.&r]ﾼ[nivJ!^na3l6TH n;T~Q(M/F{+\MHwz^ƪM*;VwrR7Kz,ppypQ;ram2]z[Flm?w"&a([YVU Y>ca|Ԯ򻚍feMd{ʖ!rzSPELoT”+LM c^`x*VFBʡ.ֶڣ u 5Cw 7Tkf++8עwl23ՔCl'F1od-ڢ3~5z"HK5#zt4z*TgMݔuc8j+"1"Mi2l]zsI:W} 6q/]JY>ahVK_5)1Ol_Jhl6I7ֱ =.B/%Hn[I yDRniND7U>FYH[W_Z6Ѝ[Wq&oMU؆ v.Vu mzk۳N5j vAt2g܁1y2?o\8:FUVbl.cי>%߇"qEICF\r0uVf J~;v!KuOcU[1$AlƋ`Jwd_GI7(m #i#<^j__9]uv0L r衅]]g+ XUuhtVb6%8^ --ҿvc4'W&-[g-ΡN-̏ʶuuuͰ#SٳMw{ΒguR՟b4&j&CރC,}Cqys㽒H+kBwk 7tgKmlue?y_3o@KEn/CAo$ ROM[ͫtvH +x]]q}_ 5py)J$KTIixӪGxxX(*_rzJ)ஷ/\¿buQoW\!$qٛo7\o?'41gI3|tmUfΘ$̰.jUeav +f죠 +vh!9kSӃ3z +),"t:Ig^K<|tk甤-Φ(l*Q[LVEb,l-*(-鲝|NΉ J1muF'kzuQ-A,`H: [~$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a +c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& +%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ +CĜ"52cX8Dmѓٝd?z &_SV4!00}k41`CژYDlYuae+L%c+@SKR2+Cd^[$Jf_HlO\Y}mho[*a/Vbdg+Vhh|aD6V*FdVze]ސ{cyu :XKEe؈3mڙmifAu#\C;ہ87!z~wRd9 uM_qn2[)b㔽W2pe~m<d.>|ZۺgZֱ4fhcu!@mCR]1v>0} 1ůaQuG\&1ĔcG12bFi 3hg$L4_P/qFkz4݈l5ߕGfk$GJX逩3ju5F(;/iw6RnRu2XOKjxڤo?Dٞ5bYg/a6g紞sm|_g4aKY%v-.J3zݽ漤٫ܘ\[~\XRc,[)v)VY{SKoӝI̥v%O[l nSQm9ji#;lmYmf^l#A9 7__T2WkjcӸeI+߰>syRmxbRmKIyf˒6uhS<&r, ~LAh\qHpf'֗nḠ~kW;oOwmsMʘ0zqfv{̺Ӊ>u ʮ}0W?UvƑTz,u;'.uۊ?V0 ~Y8He~~lN]v)gpUu X e29yn\ux` W:R|jq2ϻn{r7{m*qQ(ln ZΝ[at\t +A%.Pۥr:ў{}GIKP;ʹw=dcK3ڢ=vt opΖVKM7-'َXZ5>r7\e#K̐NE798(Obpcb)CÇ35.y6G0:bYm_oEgg^4_,!_y͊ڔQvE:yelP xbn -%znqi;HqtH|}nm? c;HZWx=k;|6K3toGkBwӰp<2!ZGJc=<G KAa7.bQx.ϳ0[ϰ[i{G`m5!u>Y;G@ ouuA g6ۺIa݉!O9w'{r<`5f&,Eaᝣ8sf>U2lv,F(JZAyhˑ&. tD~ ɪ?T^'pݕ9bjIYy)T jF<cy+feSam\By.U!M MCWzaRM8V_wrR-oW2_zZvtD/Il"N^tۅ޲sa;b.U+V@qcJ'|xQ#x}Fos&osł9ފjҋT&\f +m^i{=] VXu]l\GӛMB6ӹ4D֝GQ&Jص]2ruk$nAE;tfӳ^TZ\ EL[OŖ*zҡnSs #}#֏k1=GZ%.޵oԾsz\hYMTKT]YeF +ߤ7b*lÆ c:0v=^SƠiw2i52mb do=_8zv^W[o.S>%_Y}JP\ +sle&W\O;b,KuO*+`I[~ vWWF{x}s/&:HڨI߸5d-a}[{eس-Cnu1ʤg[x^UuhtVb6%[uKiq[LѥW=IKEK@9֩ŒII]Oil[[]g+k놄oR3v<îk1Q;T +3Klk<{%WkBwLZ5}lU_OΖؤ luS%Je߲lHKE4KAozJﳡ#~}R~W endstream endobj 529 0 obj @@ -6218,7 +6221,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 356.373057 101.433071 337.623057 ] +/Rect [ 101.433071 450.123057 101.433071 431.373057 ] /BS << /W 0 >> @@ -6228,27 +6231,26 @@ endobj 531 0 obj << /Filter /FlateDecode -/Length 4774 +/Length 4900 >> stream -x][,9~_QH؎MB<,Z ҈ڇsjAa|J_yNOWFitU+!_o_~[cŨ^b?X]5]_/l^9ݎ5<ܻ7ӈz1w>A:`͵Qb2cyNjrL;%#koSFӆy#2Fw]΋nFO؉{֡`ik!z6s҆5~Wr{q%`vbw_I4m_6_*> Уm?W>{WV@}4wn~[~Fj6&Qf3Y}}{Ԥ{S/@>a$vq%71h;.wx0ِ;q@m[N`QXus(Ś' - ocOX9BXKw+J%Z?n6-3꣏<>[=ty(GV^Ak3=cyNc?e>˲l^XŽ v'_hUJ]%m_—ebaOC9¶}9$EuW4ghCl]an|"SCͿ@DŽ\c~œw=C5OOG}7Y/+>}|,`ӡ`0oq)PҶXY[oݟ׵'|كyNԝ}Ϥڷzy^vs YFo<ѣOf9潝=_Eץzv_hNR>>V[?đկBM}j#ؙqڃyNĝ8G.^,5CAwkD“ܠ}k' -!h[{;l(Ľ7P<{;-O9VV7,8~-W&=ey[oUoOGzF=?o`ӡsgў}zso2fz7 {M}{KE92N$d+w-J#Gz=:tމ{5WH `!t'ێƏBLo {>t_lٯg9#H+k#Oƛ8l;X5OGcAND^fzZ~yCihC?.?d,K<;1͞Ցs8k -+9wbvw㒺W/ݷ_׌[ 'rI32vQljץ-[d&u߱XNȄ7՗ O4]?+Nu7elEpqCz+[F*ʯ3qӖ -ʜnnKU -wb_z\Yx'6 !WRFٮVa *4:h-4~2iƽ]r9CD|pӹG.|]>>Unۙ,2өYXM#4~Pڌ25{N ma#6FS2vCxZ82o:a/)t] -2T)Nвi2-MZ6334}ۮTWsѸ钪4e]4IS{̺4~zx']IZH_[i$-'Kit25][[EأԡQ] ]mfضRβYy(tʲR6)[nJUm+m+n6g-Qql g_NՔŗ ̵kJʲe<;϶6gj6H=3vy*ўY{2t ΁C894lJ+ikBw LVLx"+^SQlQXJsj *>-mV!bhhʹYd0e +x]M丑ȳ, /|b)Fc%!f(̪ng/܅JET )%}VNR/?~9)z꠨og\!$qٛo'7o?:lHS VPy?h|TAObΒ +f茻VEr +f8cJ0ú* T0CgVCD QY#负=H:ɢ.BtN!:S'I`JK:[vNI:l.uŤh%]-]-@WuE%]9QS)kQ~Z%鴞 ,h׺$.]봒wEMQ[` J\V(qb 8 +III\&)'q%@ sJ\ƣ 5^ x8$.P&.(lJ\:c%.@cAX"qO`I$.]>Q'1¼(O:,qbx.3I\ `?QtL)E]NG btb-qRS¤?Q$q̀N; b-*`)Ad.4lA-q"]贖 ؂hPdvAI\{I sID&i)ElMH\fK\6:b %C$qAJ(#qI(qAVYd @)%qA M$.f [&x¼6~3J\lQDlAДy N~$l1I\CfaŔ@f]L4H\7J{{LLb@z=V1eX3P _#Ie +b*ZiE<8a>U"!o{^ncןJhC|i`2}ktH,!#bFjt##ѿ0rzNϧDŽ3y9a:Z|g4N6͆ C\ܪo?Ŋ9X/vƟ?|0zSʅ|כ/@m2ϘGhu9j;"*xGO>.nKeJ<=Ovcsc\YQύVaxoߏzac9#~?O85KtZ谙;"=V=VdRDvJ7%&v]>jkk2fqJ۵ ~hOe +/ӶsraGY{9`gvF7֞g :F}O9ꎲ⽑\j{H4O, ߳c^㰶ȹ6l; " a a<M+O#JXk,C UqmSCǏ3 +댨-~wU~YeҎ_x2se,z( a6~}<WHV' `Ͻg&oD{(=VP_r0o[a%r7 1Gmyxz`g9åaT7jMov ,&;CXQèzKeis>?W$ӊ~AnXl@uҌ~q|tډ1]>3.U>G11X>[vY0]v`cuQ&B#Ʒ>U:OQ?w2va@`gC1gXlڸdQ~b}v~Gw]6ڛٸ XJ)dmth݉!Aj]p%`8:Qs!W>rcw{wyewPu<RwaG1N`˚m wHP"<"wbU]W }y_:φ`~7r +b@Y^v5d[=:OޝuBWC=VƨDoj@yǃu;WN/=uE쀄-ˆ@n?p!GuI}'޾?i,ù\:φ\,~m(.Xޓ" t}݇?ynԲb܃uͷcn=}jv[jYV9]<{@#d}<:φ{2U7ySs޺6c҃;u˹~H\tԲqxq̖{ }3q,>=z`Cν]]U99ly/lѦeLe~> >p_:Oҝ +vweǽ|ASߜ9oAd1rSyJޓy6ƃוC1mn]S1:O۱k%{5ZU +eot_.W]3B5{]׿Bǂ-ԙwqVl<57t$ GCRGRTwe'ٞ[(mjueVƵ8.7'u.>V|;Ƶ~SzvƶŅK-zu]αso,Z^c6Vw`)KqXNTrJq2N1'ЎGr-jUvA <>|׏P}_ѣly|bAA_jҋ^ۖ&ff{ bmkbb=^ц.ta3feMd%pZ;JD),6UGר&̨ܤlqOrߩڴ3y^1 Skr-'.'ҚoTUsnJMmمEC戲ZLI5܎s%k3N> +} ++вv8.',͟05^X@Tᛔ|ЮA^:ҏIhn6z<4qh{Y6\:ƆY>^:)[g =2U*=2w:CA*UJ&D*,NGkly J!CI2R#w׹+Έ\ ?19kUByل7(5U_6/WJ} :ͩLPypSB0V^ n)MӨ|a2ya>)? endstream endobj 532 0 obj @@ -6265,25 +6267,18 @@ endobj 533 0 obj << /Filter /FlateDecode -/Length 4801 +/Length 4820 >> stream -x]َ,9}g1^›$5Ai3dfTeVߦە^q]2g KdTJ9:_=}w*z%⡨FST[b6 䯧es*`?3ȩb^Peq{APĜ%,mUfPN^R 6 3E㶪 3l4$`> -*aZ:tƫNRYEL9"o$]V!$txC%l! El):IaEdA` ЕDlAI9 N1muV{sZ:❶OxSf3k#:؂آc(3H1/I`cT-I$`S(I,`SVhf((:k$"px -8[3WIga H\l$.p`[Z$.p[H\Mpaq] -$qJYuN H=J\+q:JAudu9El%.;*g(qw1U eSx&MxF,.*A'qwGkxג ( -Eo -;[@`: PpK$.] slLA5 '2=.[2!d l{  D#`$qAJ$qAJj+qf kO€b7Y8tZK\MBiIK7iěy]x3J\ x(i¼'!;I[l& ro& f ބG/n $7]$Lx@ V5Gg2qę X[- j= I4,Sw Bimh ӸE53Endƴ x-ܕd?r_yzA)?w8]0+U#Dp-/@l! |K6"n-Λnl$b,^ɰm6pfJhQ/BrA~ 14fu4 抇X&{dr_1:zjv>XC) mnz/,b=''OVi"^V*8m$׏$V% mS:OiL}Z_m|4rњ&8[v[Sd.}1`Ӗg.cJT1%җ] -8 \yrO?wu';{Q+bc. .̽yۂ*-G9tN6n Zijу^_p> ]0ɽiVPLgާ\UXyye%Z! -%}y[?ў>1fR![wKU$G,NRzre7<B۹ z^nul<:@ -'r#1r39¹tƭCV},GX!y$lp_[ܧ1nP\~9S*8K%xe2iy2m˳e>RJ㼬pC]J*gYUx |[X^\A

    9z+~%e|!=p[®z}9ՂRð*9BY>rNfeee=ց-w1;+h~`CmC=ezJa9%kgԍoXչ_Ãy{*Fme0TFk>#y FMhh ;~=hrz/Ҕ%oXCm]t^o[ ys GUqhI/9u}HxWJo7.Dcy}ѻxY@5ΈocywVp+,^6o6Vy^iWX=ot. =MoqsޖzS짝i=Za|i=rݴ:w<0VwqpQNkce o)]Ӓ+kD|s0!궗SΞ0|}f/ --ǣHy<vv˼s~=¼)Qaay8TxW}@)Ǒpg[?ǓݦH<ѐna,ɟu+|3蛧ћ5s9~%>PgT:٤Uڝ4]|eVՃyuwYؑYq -sor8oVONS+}<ޝwŭv{v^e#7{K}<r-R_Evj| zƬ"auؐy% 7df}}0ϣ7 =ЛD͆玨M' k|ۏkľa`C?P}[?j|ISDy87NW7wq5=WW:Ƥ#\By8  !.Nٟ'm]>kD=`W2 f Fl~ޮ|2z3pׇ -7ac4qjǠ0w~u{7٬Z~5e^/@[|0Ջ?=͟ӱ]r0 UXww|YJl#|i̯-K]Rs45\rʯ ,.)~ifؾ;r )Ww)>WO&a2cJ ߵT.h,8>+dRrrA.dC|D1 痺E]XUe0kTyyV+k6ObAlz,/HOZ4a/ƴqWl~+Cu]lcRu cיakZ%P[K_E)_m^kuܤlBm$ҵh`60j|A$LHN]Nb4F*Tg͵).dߚ2˥okcӀ^NLדBj߹B -Qr8鎗.e~zYe|&?QoRfP_۟z%<7xI<4! Şv.c_&i!=nKzl!l\cj&f -Ӹrjbߠw;}^ʂ[]wF}V*b~tm nH;q;\>ɤr,sy˷Ug2!Uq[ƭ 񗽤b*lfZhMi}EC[ǭzv݉4AMӎBp]k3|{ztq|4\E≓%ZCF]K(/#B*I_~'bLS/dU+ +Gw6 !9}˟u!%oGVB A9AR +*.* JI*ADAaZ` $AF)QC5Ncн3z1$t:Igi%].J:-.)-lqHI:B6IaV:bb.I.+:آҒ.H$t*UNVaEa|tx咨-*#,l!H:!Fa^VY-l1&-|-*x%L%C h%01 h$7OA4tFKD`lq%&V-6ZbJ\`H\`AoIi/qL%qI kX.{uF ڵkI+ k-j:K\vVZ22`VK\ &F%qwMT$qwM €5h%. q8i5dQ78- X Cghl0pK$.p] kl5蘼#OԥAn1ʃ>I\ب F;j I\8 ]QbwAKFƒ`QIK\2P RASҍV6]=7L>3PAcm·y F>#V_ڜ6C'{o>]c_;l x O_~PXJ_E/9|Icae>&EYqlnF87 c9eu#4F{XfJ'mlȳΌz=ձP1~?2n6G3lK;<mhl>N0]Wکd6ߏ<7{áLvP ~KVml^*g^.XxC5&"`a !b^E%Fqh꡶ G@F?çj+/;ͫ6SSdc$lv7A%r&@Ob-! -ףV8hQmUaΤ=tFyry1BVE"g/f>[Uż9A>ϣ@ uK&/qf"g7u& +[B.p>q:li^Wm&3|)靬kpܧ0VOsl9Wv4ʌ_.V<*d-mTt\ڪ^u̼(oa]N:%XŠ!j_,;8NE:φP Ahq!MQcQǟ(e;ee;>âP@ue< ʚl'^*&v(+B~>k̏ $F_UluȬhB;k|z<~k6H=WwPB.;]Ԛ3v6GόX!uuoseeqՉ+i:;f6VnQEyK4&2SCO2y6d:GJzg #[Լf|?rfP<#f'< +ufCgti u}"3sA2#yKm[g<)dbPsuy>r&|Wfvm|ڏ-xGc?Gfćf:v͐T4| x<zʓ:]Բw=ZUmF^&Yi<=ܖaT;G:φXo>ޘx7YyZOy:noշf??YмBڝ+bvVF*3̫-%b9ڶƑ[Wv>)MQ|{>y:4+duw\T/ׯwfw7R+>'WWfG%fV/^k\]2WOy6dwA]Ǐ Q(#vړuw[p%mu.]gb=}Hչo k'<B'U`C.CfD_M\KhR{Eqŵwm̮^4.:K۾tZI ;ⳏsu~ߙ=Bkۻ r__Ŋ@iZnŪ:B|yγ!/\_ķ.rw]ޑ]54}<-_": Q:2A["dCA>tݓ]sanSEǗWO̷ӷylJ ]lDtӡyt(e;IY{W{VJGhQNy:g*"X";#꽘3?/QвL/ςݭlOpq1k5G87o; g9b0{%wp&e6գV~ˢ/yڮl)u∼|y:Yua=:\5~ʇXر<.LR϶&LWfݑ'<fdyG'<Z杻gfZQp| uγ!%\}_7޸C{y_ԙɫ%Ո)nsY uk5>Yz}!{ d''>kfLR[tH=Ȇ=gTM򁙷_^lx!7Yu7=W +o{'<yV:7r X%MN9 +?M, 3͏{jayՋG}Οw&]E6^ ?W|&"'~ay)OD1LXB:'?ɏ('o}Wٔ.S$2d\~yeg칔i9ϏA~w{HW~vTt&V_7j7>\K)~/?8?ih\9J5~RG  Bz-Wң8WS!UlkU<k:[ U]*h~H~:߄~t7 t otk7QʯZ)M5lgTRWJ :Ovߩ4a25~`(HT˥RN.b5Wg*RUMe) 6ցdy&i෸ukDq.<eUpcVQ]MvqA(WHkڭ^',"}#U*e4UH#Qf:$våCKG%gҭͤݐuyLRO9EXM'4~ʺ5{)+텮a'6Fnd܎ȼwnچ=rre~A +06m[kG\mВ*o]Y63wR~*,tnڦMY>\` ;M3{^^d_VK+W[/'JxC??{+.PmvkV'-Zh'TR:-E TCOʰ3(S4vAtUYnx[r=C;;JV_2 +2׮Rj%myevA> @@ -6312,24 +6307,22 @@ endobj 536 0 obj << /Filter /FlateDecode -/Length 4898 +/Length 4862 >> stream -x]K$ȳ 9}]>ttXa~T$Y]ngE}"**|OrzJ)ஷ/?]ŸRbPؿZ8yC`71\.gx.:j/rv)FVKi+b4>' 1g1|tmYbĂΘ$İ.jeeav b -rhȃ 9kS҃3z -),"x:g^K<|xkă,Φ(d*YLVEb,du%YTPZe;y ,`׺$,]봒wEMY`'wVQ22`V'a2kr8உD^k< ]㕑w3AQ7x,X ߃ghl2pK$,] kh5锃OIGh\XCx.6*+a> ;wN-d%ao& @oV0]'SwKF“J@'`<).,aA*oYl2VXpV'e4fXwY‚ܥmS‚`pl$,M9 aA -<|"/LxDd<⢓mNDY1DY2HX`޷@8OQ ٔsDA/)EK(aAnV%,@,5%,z K@ 𴓰 fȂ"a)xOC8Ok ,%,H&! JЈ%jřI‚DX&4"&$,P%,@`aȃ,; R2n& R,F `oF ,$,*L&KXO) N7$aA -&Ba?`݉n.X>߶ɈGXmo/PNʭ{tsN_᷺&m] :Oy6tά+~Pۜx8`f7oѓ0{g7={C{2ዞtyI}CN< ~ DS^t|K9ZcH}MOy: =ȯ̲Fv[Y;3VN~e(>:fv1ffDuAQӌe>`{yY}ߔݬ]f98,o\ԗ߆'DXM d*k 鷬MY:Og}͏-t4Kge<;Y3\83ݱw'<5LcΤŕ{!Sv> }-]<] -Յ(6pšӼK,9 Cpê -UȜcg3DgNt贬+3`۬Bȓu$lؗeا>ů|^셅?g9J+6w̪L\f76I)g{lwˍoѣ׶@auõckI`DQ\aƇ{xS[o`Rt3ݴ-B}:yڧlWɳ)O_ǰ.*Ikp -dWIutQ,_S+|kJ2a)S~_r߽*do'QGr%*$SKfg -{CP}_=jS"j%դ2}gD(4bo^񐬭bD%*]'WtpS]&:Wf_˚ȦvAvT6UkTY&TnT_K qm"Sil|6ktLLՐ\+k9t|J^5WwQ/n,KpAmE&_.e3JPq} /VqZ+2{I2}O%eÈ1dzY_0v^Kꆠq9w2ikewA͑ڹh(BGWyoW$huUo%[I;i' -JFУ<׷YtQ"p- ;;+y߽zC]DmިoFx2Ֆǰ~l{-xZ[=ۜ4kVF5jK;un .@SZUTj)#Nb):/\ӞJS6eݺ5o6ss}tldhnTKJ}ʆ {W¿ΐuJ՟ ѩ_h-߁RG_c]bϕl3"5W{tLZ5},t)WJc -RA&Tά$KB=[mC^hMKQiMI?P +x]ێ$9}gM|Hi  5ۻBH >'i;ӳ[ ӕagK_~/9=cp.j^_I(?7V.N^{8M ח .y˟v:)`R9;*CTO1U>:㶪3\N^R gLT fXݪ20Q;I3tQPi;QJ5N)A=Mu:v +i%]B>I:[|VZysJgSt`-&E+"l1Nt ]ItN>'D]N:䓵Ji=y`ӊ:(tR|u[e$-?">VI1P^U2P^VQ3P _Z#0+]LPj%n(/1yoQ!bL1,Ny^~]VvFPR;W&=o@1 *1Us7Km62 n?ld,rc%h!kSJwXcE`h춾:]#b|mlk;IyVL`XzzE#%~gbf֋1cLlm#%S'PS>Sٿf&2;GDfC3(hkV2]%31h_O@__iiw!4vݖN뗼>oeTNҙ~oK]u]<$͠r`oթ/R%o  CD{]~a 2I +h;,/Ŝ8Mr?0麘W8iӳl$=P&Oݝa|ru+O-Q U2HdG.VG[{LO$t!{mq,Zar٤C2$LcpuǜG_&!t25ErkDP $g|NKOlD5xފ`qyi(=1D~ބG;HdC@8V/ZƉ:G}[VP7'Zq0Gy|^iiwwhdCxvoV˗>?yإݨEFyC{2ϣǸ*QMG[\·q0 k*kZyM<#y}\z2áNs٦:@ftcu:_na<&=:yH~ms98|?iFcaE}ŷ^ИH]p=i75Zz8tgCQOgVVfv|-nޡpHeGݺdZwExFtKigNYM/j~y8,vmOtԙm;Mjw/110,Wq Bh-_&oo)it^ ~'L0ZɻsZOT[6_oi0z12*2˵Y5Z*#5f}kW=|ʥts/Yj +ݫV˖*GG4l)Z=J7wP-uZʙg2(&?pE|sm+bO[ڟ-+r- yf#,u9Ｃg6inúow;aH3+b-s[viӎrUs;]`fS`m~Ѭ}Q"?3͡觙zY]&Rm7of3PK缵E3LfY<=s.Ѽ5mYPJKĺumq5ǍQY~ +hEGNynjSJrˍE&v+aR*7zm fZp.SUBۇ){?dۂP{CW|;Dzgz: jy4rףg(/DTP UB@rlQ9Vtxk=v2ϣ!*k}ͣkaN_ ۹%>{[w:$z`vl ߽tOy\y;(챟fRB1 +y4ju.`rLoOΓg?6ۺ"JaJ8aѣǠad ow܁W]mW@:Et5@QtҞwM]bvoGL] at7UᲉ^nLYnusyj_7=ＬMJ6%"u9%X4iC_#p ngbҩIYk7X}Y|ᇖj>EG4Œ_tv,g"N^t˅wع~{񎘄Grݭ3NyLիZ>[?_[C}Fg:Ur\ DΠbj"H]B36[x^`xWbB*V]Wt^ms]f:wf_ӚȺHxZ;J_D)z^5,3*7)[Ov_ZCg6=5:;v +$N.b4z*Tgݔuٍ*l([?tJ 7f#]k#_.> +} ++вr8. +CM +ߤA&͸w2 I V<#%;F50[Wb>b^*lÆ c:0v=^SƠiw2i52mb d>o=_83LWpuOWV$(iҡue/-[I4דw #v,/J+X_=o^ɡ6jo.m #i#QiinՐV'?. endstream endobj 537 0 obj @@ -6348,7 +6341,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 180.123057 101.433071 161.373057 ] +/Rect [ 101.433071 292.623057 101.433071 273.873057 ] /BS << /W 0 >> @@ -6358,27 +6351,22 @@ endobj 539 0 obj << /Filter /FlateDecode -/Length 4786 +/Length 4739 >> stream -x]Ms+$@CY f{wbNyTd*=l{ўVIbj¿/4bL'5ߘbv1'V6 N',0L]/o~q<>!%o;sVYB A9ARsCyAGLIR KU6E'`5& -3MKU&h+`N.*`6J:%#<*K:I.@tDV;-wQYҒUXAyB-&tNt]Q啖t.AbKQnpHI:lCB# l%Q[)#Xt G!FܻIt-h|-*xЃKHDlQb`C Lr)H<@JCgD`^bҰŢ:BJ\@ DXh@V%-qo^L%qq)z+qr$qs )qt݃%%%Kґ$.]*H\`FFz Ĩ$.]wM €>HXqxik(Gxdw`%.x! P`H\:a4j1y xWG4Kqߢ}w1P FՄZҁwIJޅ$. @oVKJ1J\%#qFAE0 %. -~=I\I\u~ tB:(t]’THxn6%.! L>!%.IAON₠ p,Q[l(qA0 AxCl\-%. 1Y+qAp1Ԫft-"t:H\0k 0": !K 贕 $؂"q!xN8ӅNk -%.&b1DUK:<3J\(q f`JQ[@}dI\&:BJ\(qA(#qA₤` <> Cv%.CIG727曘 6 qAEuNS-8 M$+qA>7p30߄G/bo1\u $L|4W ^ʘgQ(P* Uc -Hbfbf5 -Vb@'\OWJ9:5p MQqk35 jzc&}e5<dZ) Mti3lGϗ8Ƈ05`one_ aRI?&`~lV6m>VL>r^lW{jt9P/2w|x(+$;mugádZ{m~*+K筐,uȪ(B9Rsy7us/P]ztm 2v~F髨ʗ6990P/Pnsl :97oMOR=c˧1i~:ҺՆ 쥳WoGϭq/˝Χ==rm͛=s8ޕY_V=ߌ6z:# -*p3w9*m?h6i~j#2ZM3>#&Zw9Z7{zV,v}y~\Lѥ@2;sL ԜS{}`76gW꼒YM0[ޗp{}4qF|39ZF^%]cJߚq܏,m8ƙkڧ=HrdK|k:{Ch^|s8|mxF1k_q15UyΎz|b;ɶ [+Y#/gg!궗3<=в~:WP"Z[&ys8TmD~`޹uߌoT[߽0WP<%.4V\`gnxW]q(WY<|}?|;cx2-6Eۙhueݖԫ| _Fu+ }wH;:3t+ m2zν3л| TLB-ëЕ 鞄gQ˫k -b=s8nh^ -@Ѹ-s8o7VWwaX|߷sP qЄBXFg62.&P3z :)⧣͡}߿?}g!x_,tAyeERGjlϭ79 -Ӱx!lk XV绂s4$>*1-f-n{XRVǥυa=tw+m轓~/8ޓygL#os8LoxžbQ7ں#Zffv)oh5zm'I} \UzFtMiXKQs~,m_w#6+wV7ȏDT8 -M;Lmok}^8f}4e}}es845.&6wjs&}U>s4}7֤ڷy^6sYFqbޕٝyv|]"݊,r7{ZYy[?ĞBM}j#qڝyč8{.^,։PyXe͝+{uxF!}s3H3ᐼˌ2a5;zGxyӥ_m{.cY)~kz`e)]2~?/mpr=zt㛼'e7L -5j|N믟XN,Mþ!GQեXs -bkSWU˲$ 5 OInPT \W&w%[>;Ǫc7R^ zsn@ӕ8_lhyV`˸)֤-ݮ-|.Z:߄t^u5Ikk[ ^"J隥RFU1R6$.'A*E[4fճVg]tDn*Ֆ -5UlYSfJ:ZlIݬ(*_b[ 7f!=_N.] - -XUUKf/ ] OWpUgmT>]YJr_YJ5mhiYu*fy}騄tkZc3)2&I\+8SXʕ\] -嗙jWͼfpw&;_8Ƚjo-a/f{q~,7ibhnƄ0B7}ťVvLjI#i 9œ'r/K4_=YvǍla*|$ǝ|xnÄ2ob[ZWPqc_ۖ]5b/)ueP]\Z25X͸KWՑym۴zIpʇp gV$r6Ck ˈ ^(. Slff$IlMA^삹ζa]dS$p_7M3{^nd_z@Vj.d)~~Y:y[ ղ=NN͵ Q&-۔"ݴ . SEVK &?e+2>qk)TI5xJtU"m.x[9ОN՗Uj[J*e=ǰ\׎7OQsHg/_.iq,+STiŜwBB*csXBe)@`qZ T0CK J;3R #T!9'u0k$Y4tR0 A'tJ10f5ib#hEYIl)J`DBa Il J3kMt;?InJqJ'3"uQ$-@`Q\R:[4(x(=1Ze݊+A liR[H [`KHRS$ bkOiE2mp(."aіb%`%uEMq (.P +H(.P`[ P\@Aqj., + 39 +(P.(.P\@t1 +(ЮR\J Nq*^Q\JpGqbI Ы 8+Lz).]鹦@w@Th48jJ%+( Io +1;[@`N* PpK(.0]0clńG-N[2 xwAp<Ì*).0]0SS:𮐁S\` p(.tI]` ,ơ <֛RS\qכ₠8֛X6(כ₠aB` @[p֛`'Jga `m\oz f` tdkҁwZ p&<[jmA?>8=1^ pp/f+G 87Ƞ[2jiJɰ3NGLI >9J2WO|?)KZÿ0m} h,GD#\(F +tFbaC*W0߫X%u Vs,0ZQAFvWr=I :Zq|̗X ki>]o|ᯀч?MxlXr~c~P1i-i)U.qBlhԯƼbz./ԟXӞC.0(p<],y{S~.P?TF5L`M@~I5y26es5uɰK5;odoia%iƨ^v9`ZEB/![H˽!rZK=SW!K=#>$oTLu?ROܾzMA;# ǒ9:}PY@hH\Mu9B7}fl4Depz,!Z2zTgb1}{^lm"w,:SK_s:nFK=*?}W?cH˺K~aTNJc6 ;L%=[AQCfuَRe-'׷ꘀڔKC9fӷ<7P֎2,]:}}օvMRZ߉*_##yW#|D֎ٿ*%ؙtص;}5GԆ?lD: )fkWlv_TO\vMkWWW_K+*v`[G\xו=ը{;?-3'tO|?f6- lɸ6j}yNԍh8#?#o/j;;}w<ywlD: vW}Zvz{mςVWZ{s:n.W5okq⎝yN ta7S&${S]q%3pY_pr܏ݙt{ӷFh?h۩M@3ِ׽F{dwdDVй]%Os:$?s}H~XA铧f?m:f;[Wl; н -GջBjKh eE;wܐ6#@X +y-2R7YmNlT8+pα.'y9}\EggׄNٳ5%.Le5\+rcL ^8ԩy'L0fgFPW/*@LkMAi°Japaup-<7/Íq;E~Ich294<;dpbDp/~ߩ-NÅ֘?CY&ϱxQ6N'囱ʞ SIum^(1A[τZ"poH$ׅËͩw51CYlH!Ae:(K|&Nq?y.K0n`bBRǟ!L)M:ߤl}GDjxϽbBV9835lfKN[ +,7BJhB^UWR'{D|]n:[D)tUw oTZ )oDME֕f>KBfn,#w;0J(uEE,|Ik<.e׺dSJTdm-4 +ЕBU-cV#hߔ ~ɡ_PA}:8Eʔ|QLZth2.UX613$7}_]b]AFCUtLuI6E.ꂵ+ {}4٦ڳLxT vzuiej䔡Q\ =91ZI}6&0u:&"d> stream -x]ێ$q}gK~ =X0`ȖAKm F:-YiKiTe/aVWVSzE$ ~*ip*?_.o]~)y/ߓb1TQ9'B3*.XmUfVȨ"06(sJ0Ce9PF$PZJVCF3:儇=Jtbu:43F`S. ｋt8etŚ8-`p[4]-@WduEz8]2¥h-KNK'\4Fr:6 ÈB'4l%V[b΄ѪitisE`YlAs =ls$8!H@G#lc!tr80RAGFg=F`Ia p\` lp\`hnLRy fJ Do9.0\@)q\`qb X89.0]cwU 59Yl9.; -w 0Wp9.VQr\`:Jq)1h8.]nj'5(#h -q|8[@`N PK8.p]01cl%TLUPg-,De8.p]g/0j xWԜt8.q  0 %]VL1r\%qfa!# ) @B"w1' p*1F$Rx_/=郍6Y:!w(ml":&ZK,z1I -ZGUt+}v9Naro~>]\>+ڕkYvi_.T6.iLݦfҽL'R\߁M9jkKOQY|3u˿|Z22(-a| MPy5MGϥ<͛<[4}[ˋvcM 7灻ic7k am{]})ײ>\2=0ÃCHۼ:*y.!r?"iqB)e@Z|{3p94+Vl;q:znûQQ#<Шك+M{A*F})=e^cZέĕiᓻTP9G3WdLmLG8O14>27cCch34x珐{.!w?|dk2\FhC̓;<̬ m<hl98*ȃ??DT:Um C\: ~[qP֐fk2^۵x{-ꒋ+,=NFwf zIFܔ|g52\hCR}1կlttйbq؈rԗrtܣի>kώ쐽-u.3 c@j2 ?Sĭ ʩ&W򽶕챡폥ou+L;2 -kaRWX.&`ҕ>[߭}0+B-6JMiӆ5\GS~h6m}5պ/_oOzHl& 6YF~L[Ò1}ᒙe k˪s;qqOOΩc[}X}]4unn;\C_5'Qۍt6/Dsyu-B!:*Z[w 6+L^D% -+g huCaDmp)ѽl=Gɡϸ9옗1C:?c7V뇭&3toQn7y5FY1R:`$:xdzyRU hHty4- p&ɣ

      B,7eXK\6_H!$x-EVbPS{(u yEI[3 Dgd7>O[61-%Mo['>NZF9IS)u)̓ݭCi nFmÿLmϝRMGh qQ$5Eup?"ⷞGOǘ>xPTC~͟,ڨQ.ᯆauQ -PLY8 -{,Ұv_'<"W_p6|Tid|cr辖.݆%sDzGs2!j?Q}=Kw@հuayU`ϼp~~7w @ꑒ&tѾ<φ*%«G1y#O<7qo5(o(8ڈ$p__rU+pcP$hīRws|e>(t=ASҮ]r9}we>MS(烱ivp^3[^$vWGr`{8Xʯ{VSa܆n;T~Q(M/z+C{4VnRٱ&g~]-Uy r7%(zTE.#y۲E]mۖ[8|,S Uv YGE(Uj6z 5[*fսZ/*bzcy\f -Lm^{C2r{bm=p\绰>N _0tvAfRzOr-zW&3QI]M:Ķ~bD #N֢-:^M.Xd[T1ۅMWJsBK{T=MP79݆ǩ aHSOk;l]vqI:WHW7 -PnGҥ!VWahV_5)1Olo_Jhl6I7ֱ =.B/Lz"ݖyl%\6CI5XUC]U45(N׆2VnƝo8Wfo+w|fg1A?JX6a7 ŝF߲Nkd܌{9mNQ.1RC_/eײnܺ3xRLI -۰*Z|m{vىTAUӎB}8uVf&/@kO˥h赥*\e:ӧP$(iҡzȈP\nLXIs=oǮ0Tp1tiiv,r+$x1lXiZ^LuQ{06&_esL~VƞiAN=4l%+UN. UJ &_UGK]nD7KKEK@ns譓=e%##c&=:^fn]w{ΒguR՟b]3&j&.X# -ak<{%;"ud !12([j oPcPT;k|$&=f+Ӝ L'O vhH;PO~7dj$7dZ +x][q~_K8``#0ӻc#8/%N"c%U")<]o?_~)89"ZQN>,a +əo7\.yL)yoYEv +1UJi+B0 *'41%I3\ C[UT0* KAۭ* 4I* J+ءR("kvG{Igc2It0NK4y]t[\RZ94tl u`%]-]-@WuEy%]KH%T q3M.Z$֓6Ì l%Q[UFYBt gCl5I\X 'F+j I\8LX&]Q&bwAKF“`Q&IK\2P xSzN~]H&s}yaѺbo-'̓P6|]p(uvNu2XTAuQ/U[IӦM#H BŲ6;L +s9cy)78nWV22Ye6E[]9GŬ +sNwVeLfbzިT]\-TۈNp;FmT-'hU۵gV;vYoyEgĶ2l~f1 ʝ_lrSϥl6?.c}wvd4,0K]aΛ/:tnCmvݍ}S1; B)s[viӝbpeNe}0Cwm+[f^Eev)43R++VYz)9oic%#ˮv柞{z޹9 sw)m~im]I,>]4ul^;9qt, S< +C?ks^EFxgep؂vN<w+L9߼*,4aSIJK46M"%ףNE{r;?%Fʝݎceq=dCD伽C}pL:VΫMT֓:vqOXy=O`Eq.-[謋${n흎#h9w[牟I|v4;G p$k>rn㽓r"8oK7+ ->I|>*J²weEPDSJ.=T"]Qw<{(\kn˿au.CoEn'SoߴM/l2 + 1$y5CٽͶӋdd4eezT[b$py3˞C}dVia7~-+6+Ej0#\CjC !vЩ-grͰya݀ b\/QQfg8ʶ%,yҝ[;jo]$sg.2SC~{'<2ڋ#k%->!}tK_gZ5nύ(#g&3bvQx2ӡXGI0nnA}"Ƒe˜u'V ڬHۺIa|H'38wC#=A_7g†w#vsd>4zJz;Q)h}t=+KV^:l]_+F6F^Yi!<$p$wޒ0;G<φذo>јWnϵ<ßtQ|g.h=}wL'<ލ?zAHsEwlq:"W"{8rlǭOgX(]G[>"uA?쎚!N?y)Ϡ}~O m6 ~i}y6e,9zV4u{g#y}ͣ{$E)w^~?x<|W#4EF('<J˳QGr6FdgqTT}s5 +ڮu7GOkF'wPgkpq@,0ܱz'g>j9_|cbIK/:O'r,\4ۅOd'ALԎ8pjYEv-))g+dHD67W,뭘[&T8WSe*lR2Um {4Z7a5: IkB7{Q&J,RT]vF*u%e$nA*EQIga,@.tv-:R-k*=LiPSQn7#ʖk1RZ7f#]ՙoԮqrzvVqT /Mʻ'L"*\2*Lv*YN徲I=)]w*f gҭk]uyLRV a &n4eVv/ )$V寗 {/K_i~y7ܺ+H<)o):m:Xǖ4uܘeWKJ]TWm/t;5v=v#ѱi |iKd>ڶX9Mgے|'mK:d eWajd@Ԯg +uu-}E[% l`}ie`ׇ}1ٗJUKkXZ O|חuͱP2y[ղl7lurh.zvز- \_)٪ҲPTLY-1tKnq{)TIGvGoreūޒZTKY}(|JEu5!yes̝9ϰ *?y'Dv7jME!_(v[#+& D֪dޠHNJ]|r&=VP9 _wP *Yvz#-LPZ>4&Zm`У endstream endobj 542 0 obj @@ -6431,7 +6418,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 461.373057 101.433071 442.623057 ] +/Rect [ 101.433071 573.873057 101.433071 555.123057 ] /BS << /W 0 >> @@ -6441,27 +6428,29 @@ endobj 544 0 obj << /Filter /FlateDecode -/Length 4834 +/Length 4929 >> stream -x]ێ$9}gM|HhX!!nҊ Bδ錼Tu;3lG+U#wz|r^0~2`@G>_?uU 1:%_eT*!5v^YǨ9̰(Tyab -f -0C/Rap*!J -!cbt8 QEV硓^q:獴9g3F!9-V#8l1:xN`vZ:آלщ.+:".` ЉRlZp:) ljVIr)ℍX-ӰӁ'!0Uխau1rExQVАx`2 LX@85G*9BB$GZkZ`` -p\5lQFs\h@n 5B: 4f - 4Wg8.Р\@)r\qb{ 4XW[8.Р]m@w5Yl9.;Zqj)<e8.XTUA xWyVAq*.pP2q\ F]P:9.@cBXqǬi CtX >V1̺(ҹqQi ,x8. ޕӁw E`9.A -@A8.]В^xL I @ƃ@q½G xWX9.p]a:آq tX̚F:t]!1Ü+8nr8*p\Dw(C܀kqXP- XQqWE+qW!(}[)r\&B4ocUN<{3K = !K G؂q\"sN'a l B'%ADtxh%1ԜΈ *r\e&ٶ`&9hk8.Af آLMqAQ!ơ(p\uエ16jh`E` Ȭ[p`'N`\o f`M lk#Ӂw: p&"[no/@#>!81^ ʦ ʳ9M{$6i3 B)6_cf c3OX}sbzؘ׏rHA|e""v Es"d! |N2f-NId$_0o#xq@h=`[|gW4X`soPFG C\)̬/]Ɋ1Z/ e>_~0zt/o$5aȦؗ -~_5>AY5k6oKɩ{K4)mٮӽsݵ=&ϥʆW@D7mbX`9lU7 W )5 -~:˴d$4KrM+ry:~̦K9y\=$=M+}Ps{Kn "Ucv{!,#~Bэ &9~>Buʴ~!Ea=Vt5ZrwR=?/SWB[7r΍T^`<0f+W -z[iuBj/68XtH_U7m9fH^}C%A(C.}[^]W+ :CN<{*~yWa]#h}} zz,Zgi,PJTl;oZ=ϑ~uZ@n`VoǠ/ʒwB -ZI0Z9ZţgټƱ$=s:W >K {+-*|Z:O,V@>`!l;|Q2I\\v9~GSgFyHD+Қ1^|*#PQmZ?rnWriw;_QxSE:gC9 ]F)3Df\92<4K^,zhZ^(dν^[5TP@< 1&H[ZN=]ƅK5?!N:>ZzYw4<|02gzugFݙرSߚ絈z$IHkQpe>㡌nXB7ܟ78Xt2s$v͑D< -M;LmL]t?J ?lSi =˲gY `0q.P]J.A7\R﵊bكuNԝsϤ:zyY m;2㼂b}2{Plgku.=eW2Zm%:1Vg5Չ?ؕBMsj5"i9wo}x%_xND"OkD"yOоuqj(cuNz~Lr>i}W*o>=u;cE..Ayn'iԧOC"nY^Wo :Cveș~I~};}}9ӕP{ ;SoQC8ROiw.sbΡfǙS4|w_An VCJmڽ|:CN>ƞǵ+{ъ'7xn KU!)#X/1obXC~gRUy;Vܪ ]lRQѱM''?^ T6M:F'o[=-dG[}y#Sm[8#>5fږՁ b_Ri[>*[zR-}%_ -?ޘKq$N \5źb3AC˶[]ԂR(XbL;C皰NN/e'ӹ%]p[KYiziViUQJm)Y'ybD #F &ɬWPdjX1ۅ-7fLZ*|3A]:F"AIֈ\:p 7j!]+/3m -a Pv8&M_OXE^ܐ?R<4R+$*:i|+KKz_1KKO[KIɐżDRSiXV:_e9.m#Td䴥B 3%ЪM,)Mt(ڢ/6Z1ERYqjkd)}h%k,ԴȖ6{o{%0"SѪEɇ3\3!2wwQu"81鍚vd)z'L`^o+&mӋu -zCzOf_`( +x]]$}_QφMa ?b.ݵ6װʔʪ陭5+# +YJ}VFR/?~<)z%ꢨZ8yCH`71OoOrg"!p )_s5 ?R"M<=LP"ܚy6D1ά;Vָy[_s|?/Fy:߈U?;hlbW}Ōς8pK[ky7bכzϨֆ1*|tahhua?RYSWHzW~Ykñ2r`gC~^ 4mP?_?'޾0iLss{<rům')BE@u@eGh]%?yͨEF{ =Ǹw:G:rv5 >1;rg2?{@WhΗ;{``Cߍ8ߑ٩Jܹvc҃+yɟDG0Nosxg3qzY|zeSlrA#7yk빷5JVjjW3.{!QKկLtqGuot,){;{ ud;Fy`#k'gody:__GwVI!z~z)SIg|^GQq! +ieVxߗ `gCrZa='=;cZyܗs=?Ĩ WFcnF<~=YPװʨ7#~.]bʱkw/y;+])Ll43[P/qF˞toX]+?_V{%`Ǧ7cĶ~po/110o\;`moGPODddDHڤobCCkvtoa6ē紞赶nȗwQ/,@Dž';:zy[rN$5=܎KSEkbkiT&5EYպHaiNX#)dKg.KyiZ|rwrm9n)+\#igmq־y aA9PvpSJ͎Kj_f}Mm,}rUgF؟g~6]}Nϰ-}}-O^+i"5J(Yo}g s|8_U՞Ň-x{,bfBݫ z7%L^d,Z^T|:t#XX:,\RB1ƚ'z] 1 t[>WuZ>56͒jak6:F֩ȖT!rSդ1%Mv +qx^`xSbB*V]WtDxs]f:wf_ӚȺrBvRzD-zר&̨ܤlZ? I~jY*\Kk:At9|R5WwS:mjdVl([?ŴZ%^N޵'Ծsz\hYMTKɌ' *Î*|5HсWBcNXI.]:ƆY/Hn[I˘ѫA1 +۰aBwN=hh1]Ϯ:ה1nZ.݇Llt32x27}ž/mm-j.xsp)̊%S:ΰUe+3 zT`a]ڮs}EWYiK ^ӼҼG0 i&}06“\eslYX=ʲlC eԳ- > endobj 546 0 obj << -/Filter /FlateDecode -/Length 4884 ->> -stream -x]Y$9~_QHk|VHKBX⡻vzEZx3}3fUS>/vUJ}_JĘw/R'/X\d - ©䣻~GDHN}Oz',)yIe1UJ*è!hWMLS kU6Eǩ`:23 ʬU f,*JK`hFt>&X]N>XK{"%8-NY+9l&NaF:آc0.I.+:"T.R%d q N)M00H>0: [tgtXq:3!FfjFl:XV[0h[d` %t&m9mX@$l>TiY1Qb:bh؂[5Z8.0[+oT…5[ (PJpwr\`@5k h9.0]cwANV[` ¨h8.]dw14Uz cXr\`: 0 ynvRs\`jq"?LJq=tp\„FXqiP1y xWE KB83oBy8.p]8*q>#x9.p]e9xW$9.p] A( %]VL1r\%qL c!r\pޕ d @IqARMm9.f &x̼Mz3p\,lqQXlAДy Nz3jd´뚣%3ɦ~{]^~wʟya I'7J,V59 %R3RM726]4 -Ln]ԋXzwwb譯,kaC ? g*Oqg3kH=kNc~ӯ~'ׇ_~&%F,x᳽wЇaE])/h >~k*:7QJK{F>1)(S|fwu#mN+'s[J˿^?jSߏJ3ܜ<&wӜT:SpsS箦7UҨ)O.e|.p~9lJ5>3Ԇ,5d_yIӱn5ǔ6m/s90]շT& 7]Bi PdO}Z7STEM -iB<`PܛM= Z+L;" _R5RWEjAZfo~'`g]{F3_{OY!%ha(q'IpQn…J۳Ʋ29J-=uPf>ͲΛJ/ uL1?3`);l=9P,,s}*Gi/pW[,8>`ӥyvT_C#g}|&祟/lge3cDCyfovò.)!CqX5uYr{?̸9fJU+o]e쮻Նr}7a8QLp۰}lSY/iraնlg߷ϵ2׊ ]@px -<!"_iBh<!G -QS|mᠮyT3 kkw4?>vv}Y鶴ea;e#X>Ѱw(50]ݍ}\C9 a{`󽹘4+<y7tXmb'<./hj7r]n(1X#Sg"[9o !A/ϯ0{뻺v ڭc;ȶ)P_7ΘzOyֵur 85qͯ,{-Re^Y_^Eosm xUB+=Bʹ<fvpgR{b`aw/ue@2o)+L)y;A\6!]i/M~nh0"ɨ~<Z^y\5bVHo;#@1 H -|]\TPu2 "-7cgMNL=P9Űt=ύ{KgFly9)?i9=ԸpY[^=?y 8G?ж}Vzd~_9ls5 ̨c_?y7P8dC~yOӎ:tйmu%>"!9䳧7,4@UE_-I6dC.;wlc\Zd=Cv/p2á WݷFq~ w=s $vMx.ϣ!1a,ɟ5ty7RВ_/rѸzj.ͼDgS^}ůƓ͍Jm.vq -G^dCq*6orq޾ڭ:MddC↝k7!u>s﹩܃zOEC w'<BawۥDv?%[1Əg xm5P|!bsw6큆(Yvz.!~_t>YQyʿ%cf>a!Wv{g2ϣ!amGM?Lܶuwm6G -pB/h:e Yqyg-^p/_Q$=īRIJ5q|&bdml4>غ;Nv_\ـҖ޸/Ghs}R=u6҆հ}*^zx+MOz+x3+P9JcU&;V]7r}_SIzY:c1>w'F!8rįze -}RLeYUV DS'1GG]|J6;%7*fZLBbztNf\m2Э-(z:߄T7%p oTkF++vJjYe3*U+):Nva_R`V}7jtI lMJ:Ft\PSŖ5o4X;>iǥÍ^ ogLl׋ Lj׸B^hr8ʆ&~Ydth -W<Rtv*YN徲z@vݥBKEɤ'ҭk-]uyDRIyo|tWo=H+~ߖO~\rB{2zY<)Ea6PێXŖ4T?u׶eKJUTUm/t;t=vk ctiJ讵tb.26i.+J\:Vwqˮ,[I+]O~( ]ta]EYnE!/+M {<>yg}$^6xɗ~yY}7|-P-ts MZEN[9+E8J"%bn-l/S4vNtUZ*x-ΡN5Զue^ffol*-s}0sCਭ -F(XXzW;^zG5)e3FEMx"+lIMFsX:}˼!T/-!HϞ Em}y -endstream -endobj -547 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 546 0 R -/Resources 4 0 R -/Annots [ 548 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -548 0 obj -<< /Type /Annot /Subtype /Link -/Rect [ 101.433071 713.673057 101.433071 694.923057 ] +/Rect [ 101.433071 127.623057 101.433071 108.873057 ] /BS << /W 0 >> /Dest (cb48-1) >> endobj +547 0 obj +<< +/Filter /FlateDecode +/Length 4833 +>> +stream +x]ێ}gyH8 lﮍ`C~?("tٵ;V/%X*!蝹~zRER_oR?X]_HU]/l?_~yyUCNI{=|^XFR3*ku#e*3L S T`Tfh^"P^N3dQI;aVNSrp!f*Zh,lQV[([w` K(H@=`*x9PE:%9"X8&\V[t4h[a2 5@ tkDhq\A0Sp\:8qJ N 4Hs\:qj` qq2h xWK9.0] #qzuʠB +p\`c +`u~𮲸n*+r(Gxbyw`9.|A-wenji CtX >V̸E+ҹqbX.3p\0* ,xWjԜ+UX.q0H8`~tY]D  -) 0 "IX$qxC9.p]LVk xW=8._-3B)8xWH0 +#K&Γ@ `/Xq\tpXpm9. buxq!8. +h8. +e%ovy[v}`` kv/oh?!\=Z1]M&Yޚ<yŇybC_,a橱ֲ[mlm)۬֙mI6>cc[gϥl۵ksO}.~3% J/X[Ƥ߂n>oz} <vVok~ ~tm`{|ۤ񾱵iN-3Y$]jOӯsYjӤQM7XHuȮ~ߕ໺;.N̻n9+ oX<òvܿʎϓ}lbHf~'~灂G"e8L4Pj^|ҏGZ1\]m(d)r|۾q&?"L>$/0uį%?&ޗINǮeJs[6ce5=v_6&|6qqL[SMXcEn]T|ʦ +Lh&z9 zNY8zAPikVG{ҼNr&}}7˴󰽗2]d1[B=5+/׹2H2+bAsU:*…grKݞ0 MAY~=潖ҼpzGq>^v M2t9fۥm#+5nm|RzUȴ} vۏ] +p,ꙗ̝\=f-B@hd-{Ѽ#>s:d:;P)Rm iŻXK*+&wXbہ]ONrܿ`ӡuk{ݱ''tOb?f6}oUl}`!u'pQ<#o_ll嚲j{MwqJ&qY_>F oib3r%UDjeRJIGka':8qo/iSڪNK:H~}19H1OuR HFrwsCzyc%ˈH5;x[1hz]E} *͉E$() T.=-mLi/0Җ,|~F +endstream +endobj +548 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 547 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj 549 0 obj << /Filter /FlateDecode -/Length 4945 +/Length 4894 >> stream -x][q~_0Cs /bFv8C~DDZsLbU;_)~tQS -JEaju_$Sp}pɋ]~諙rF_)X,~ 0Ĝ%eEr b8cJú햕!I,K+ȡR"(xOJ)lȋh$SN{-BI9CS8 Dd1)Z!vK֕DdQAisrNeTi3O>Y$֓mZI -Q"xijG') j!1щ<ȂɗȢb +h"\08l&%$0)O.F+~r!G -UŻ !Րa'qaB˓!KXب L'F;j KXs4 MZtE^TNI, O*ID^`HZJX޳rp{DdHX<,[aMYRH<ҘaU*f pM B$I@ ^ $7!+0KX% N8S9IX dHX d a<)kxbxY`.b| ]Ys:]2:iA_?xOz@4/iW\IXJ-uRWj6|X^wYu"aU9v -«]M;Q_U3}i_?ֆXs{_dskyP_njvlFSLz\.y3gTΣzγ+z7 g-˖MYW_6ZmXmpYjy:u17P -ƙxF3Cf_:o#&Qyfwp/:VUVmY߱0LR-GoaW,ǬgYq%U8Y,,uaW -72YbZVlL _X/UVْzOy6K6}T,m<ֶ,xDaN<Kv[w4Mdv؏iO/zֹQ`?6 %7{f팲pv'W}o7ɦ[PA_)ۯEkcC~~Ŵ\Ɠ9aZRQN.C7ZL.=KeOy6K}{7U/C;sGzޱb扞;{Y}eI`v*s*Ajg_GzX]Y?ĕ5FJ&mv~<:OgyZ;+pksy :"6gf]0j8Yd8V2 -y1π^r\6zYA3>NtvLF=Ǫm{{نRvpPnݛ{(`v -u4ibyγY;xN̚z͙g殃=$^$ٍ{^>ޱw'ȥ-ݱqU}MOy: =ȯ̲FD㷲wf`{yY}ߔݬ]f98,w\ԗOkU^A7wMY:Og}͏-Ǟh6 ^y>w̳pz|tWtxyCz[re̩{* O6]#?L|Z-w26q;k-|`ʳ0U}E= jD_~`;NOQBsFLÄ/ik9K|/etM%oWraKIV~yu{-e>3 M^{,95JL魜sI0Ie:pB7ҕ¾ߢyQhѿv(Qm1gRmZЛĞ=Ԑ)'k;쎆UpΖCwhzByT ߚӼK,9闇1:"&eU;At[9+9t[Lt8iY;WzS3>$!hþ\>o_9Wy|K; (xݓuĂٙ93}ɏ~oǼ{mˑA90غYm̻~&+6Rq7 ˍ -dZTSwx_>\v%)W馥$X{a>/mvkYԧc~.*Iz5NW:!utQ,oZ^f|{:۸L#XT&Njn"Vy*d8>~$]#N ;ad".UkW 8Ny,Z-{mu4Tjt ,S"j%դ2%Mv -Mr7x`xHV1뮓h:컩.tbNeMdyx[;RD*26UkTY&TnT_K qm"Sil|6ktLLՐ\+k9t|J^5WwQ/n,AmTl([?ɔ;ms!.޵oҾc<%Zn#'Safѱ{ -ߨ+MJؔv׼% 9ѩ^I^Q]/i+m۷[]w+낄^oJ ޳v:CA*UJ&D -lNGklyJ!CO*R#׹+fDj阜*jz,e%1sj *,ΒjЈ׈Zrz,*-?WO?~K# +x]ێ丑}ϯg#~ c`w/`؇)F}HRY]= Օ%<< R_~/9=cpۏ.j^_I(?7V.N^G8M ׷ .y˟~uu}5Shrv)FUJi+b4>'41gI3|tmUfΘ$̰.jUeav +f죠 +vh!9kSӃ3z +),"t:Ig^K<|tk甤-Φ(l*Q[LVEb,l-*(-鲝|NΉ J1muF'kzuQ-A,`H: [~$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a +c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& +%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ +CĜ"52cX8DmѓٝdrgL׿Weh%C|a`2#h-`CژYDlYuae+L%c+@`,{J` ͒և59"&A˶vz$[F1y!Yy7vq[10h<lm#%S'ŤDi~fY>`a@ ͠E}[%ݧ tbާo|tO?^~?}?^w_\_0bEvï3=}KAfy," i^"?5C;6W*,m?jKm.=w'HG乻t#W6[2Sq7D2IONy:$߉c9z.g~G̨ul4/dPH=l51UKC؜6yfamfGv\FF*C8ֵRwF ]u5->V8siWc3O~r0,\mIC_9Ɗ7Sse^Lugncֽkf]D1 -wiӃȧyusKOy/vRW9LZ6ϝ[aPanMTwK46O>" +%{]*d s/S3)7ILyىx纑n-3X<=}ׅ(^n7k>.Vcx@x'a{ϟtۀby2wH/:] ;un+d'Y6qͼP>w8`ztAēy<.9pBr֏c\grRl4zp#8S|q^>lym4nv{8$jVӤ5GQOy: G?g4Z69 |8mG Xμ2dܾZnyG&)-o9F۹y[W8}JK +vmfɓwfkArA֢G/zm˛1b/lkxj}U/Z9(Zr'$ayQ=^fōFBXP~Cwwrgi~T?תiW,$V~=gnY\ڰ鶟.ES7)UZ7K`iݤcu'gZ;+ƚ^aZ_,*Eg7}Q򪈓]vpع~s1 d7jћZ>(?_[C}F}t&͇sł9ފjҋ!Mv +:Rn^i{=] VXu]l\G;}B6ӹ4D֝GQ&J]2ruk$nAE;tfӳ^TZ\ EL[OŖ*zҡNnH_:ƈZL㵾Vlwm$vG!\|ZVn'ҥ6Ь2z;)?SoRbA)zplⵓ<4q=-saK'%'mVR2&G$c- uMLVӸ U5uoP~[ UZeA3VnƝo\[kz]t0_2QLO.6v2&솁[ة?e4.iXo~`5}]P_;F50[Wb>w夓b*lÆ c:0v=^SƠiw2i52mb do=_8^\o.S>%_Y}JP\ +sle&W\O;b,KuO*+`I[~ vWWF{x}u/&:HڨI߸5d-a}[n{eس-Cnu1ʤg[x^UuhtVb6%[uKiq[LѥW=IKEK@9֩ŒII]Oil[[]g+k놄oR3v<î 1Q;;U +kcKlk<{%WkBwLZ5}{lUYRΖؤ luSaelHKE@KAo/9Jϼn]mr endstream endobj 550 0 obj @@ -6559,7 +6548,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 180.123057 101.433071 161.373057 ] +/Rect [ 101.433071 348.873057 101.433071 330.123057 ] /BS << /W 0 >> @@ -6569,28 +6558,28 @@ endobj 552 0 obj << /Filter /FlateDecode -/Length 4742 +/Length 4696 >> stream -x][F~_1H1}I( $.R!L RW3lڳ㪾g4St|{)fKw֊tѝe CH~9MrgRF>b VP97`T^Ŕ$p -UfPNR 2& -3,m3L$`N.*`6J:t %у$QH:kH;-wQlqIiI`DJ1H:[JtNt]Q啖t.E"QS1ĥ(7htZش# -䃠3+DlqVIga Gҁ' 1 -jI`1DlAK `D `/H\# )/qO -:|ve:B$.c=$k #-.` "SL6D$qAp1ft-"t:H\ XK ^0:M[0T$.T4D\i'[xi-qA4ޠD234֒hjIGיQH~`WQ 4&$.@bI\X:bI\f Fbf )O₤nq蔒 ! 0.y%.HVa%0n $-.-p0nIXo$-&{^oF f` ^ D^o1\u $LzW ^+(F anC -܋*154XYF/F 0B6P_ck Qy!`Όo2aXJk|_? >=l aLM0 LBw;xo9>fxbfb a#y؈8HL09ހG8£DfzcmiZ=ҠBXĚo; -+:il2L'p k-䱂'=/ꏿ_(E?]z@5IXCqһ&>]g<>sYInIL5uЕ#/sJ=B;ueޒ.SPӯ?9:!z_ do<7VG5;Nԁt1@zZF;56?wW|lsN3IVtIuve}3}g zn҉歊 @~; X.$c_ېD|N+Xq{L%~ROHLإ֩v8}cIɚxoٔFeB~k8nm_án2&TϽXNE.'r_-4: -֏6ScyHn_揿ӟk+]9K;c &En <>[֌7Pr1BC-c(,GnXݙ XuloÞa0lean}ڪ7f߬Nمu[XaD+琖jTq FS$Bʾ<AJ5۹=H)-,֜qi:V{2^.CwZ}("N*IF0 ~77jI9g> v7JsdS+5?'f;}ѻx/; 3v9\o:ox'+I8=qrW{uגI4T&m]c]#%ӵ*ɖp5{W߇&__ѣ}]}쯸wުGgG=ޏmʙaG.n񀗳3n{9=;?dy2\Ѳ܋̖3Py}3Qu7W|\AU3貭3ᐸ7}$V} u[oXs6V@ug!4Q 5YO?65 6>[ݙpoM=fWQv9ZmDQG_ݓ٫N ٙp݈>|xzWq^?F=ڱXAНy{Ϧ=vJC)59.m3ZS8Nv{+1T@t9t>빳Ϥ>}g!x_,t3zyZ>5e{n}3ZEO6vOԤO55=";5}ˉzS}yYn==|nw}}OA~!ҙ/1MzlX}^9FjzmVl.ߍI'y_߂Fq4_NDb)fQHEv!)o)Щǁ^?󻜍N+bA^/|'1I2vM[ 7ڪFBTWņ=E~Ӷk{4k{/ry+ޒ-kݩQ6wRMilY7γ Ꙫ-R>k. ?c$D=LԤ5݉ރC_n(6܎,#"9VքZ4b i[2PΖxK5 -4%cr KEWѪUA/OYd/ +x]ێ}gy)ހ $Aaϡ$^Dnݳc vJaD*d}pO_/sF_brЫǙ:#) +\05u߾{G^UU\)Hw;' +P 1sXFeeK S H\`o8 <0Cz +0C9I +f`vH%!H+F'MgQ)YT`u:Ӻ.tZ9tI$8l!E[-XlQiN`BFa YlVHNtg'bu:᝟0Z N'egMУH1:[0t8xh=[UZh lQ-h|-YЃK(: +8P^ws,|9р +#ZH@ brL%l!\V[t -HqְE@m h@nIqߒ …  ( 48W;9. ]twqjc[ 4xWxWkdui5R8 n8.@vX*/*!չ}Ps\@]ep UF( HY #Xo +1;[@`Ni PXp\`2`c4ت>X xWz4 tqߢ;imw1Pi x9.wQ+5FjNޕ* x~p$ 0uR.t"xq;$ud X.q +5+n-+ @ni8P` +N-Bqa@y ``/Xq\`=u9q :|v868e:B8.c<NN #肄N` SL@q31*t~t1ƼQ7!ß/-'W雞s,۔$_%=[Lw#)w?~6`a U,?1u]`Ti$.ULMS }K爰TD'7?˶XUV]KQD&:xyO3<5- +Fְ\1!e  {\0[o9dAۤ-uВ)OzMF;# ǒźΟ{,^#T1ԝyΆPwy({"epZ,!m  ByTgb1}{]lmʷvCk `:ov_ӡvOMmv~b)ze۫njs_s:mܤo淳δ`;cuPhy#uZAһ- /&g"N;|=:ߪcnjSFǏ +wOrȷoun%eGUrhg[ډE?UGzJGQ[Qv9J7˽.e3h#,ΊiFGteu|kkv9]|S }MT12Hv18s'0^G6G%}~G:p8aі 1x^:x|wk_kú:vEdWk=ףr[Ѷۈ~3cum3ِj7awI^1f c qVw; ՇdN;[wgӡy}t6^NFa*-TӰ ~^zs:٧#tcmg=, 7 +s:$?s}H~XA铷f?:[g}O& 5wCqĸ9ְUru0oO cعTbA\εĈ #Nq?E.dJe7BRN?C.\St51IB$R"3"sqzQwl6d3@ӖKMԢPT+bEwUg0^W?Uj5VJ㞣TJd +YjR ۉ.K&4fWwn>r1ۅM7frKʗ!|1@]\񌬯QvU:mlWQ3b("~Ǥ6+IЫ*7(x) ]3W*LFHʐ{וr7xZIf!$.\l]_ &}$ݜ:DZUY%w!I*T,38RX̕P$#p"6/q +YYrf|.f{slԊ#}:I+GrJX )qї^zkf-ɸvsJjխ,y/|Ͽ.t>m6JdP['z$+{nS U_җ&!JU|M%(ĞR̠2kk)uXU"5Gۦ áN` +.C*G1iҡ%UeA](b$T7*7"ꢣ2E'YU> &Y4La{=6(Ԟ/4_Xf㥺?> stream -x]Y ~_\ubȁ m`C~>T$[YL `v$Hִ4J)@NZEXhʛ?Up~=_cVa9S 6N`yb>`Ă>-+B K,A& hܖ!$0Ge40VkA4x Q!eE^D+S!FeBIdY!7DZAr)JY\pZAxXh' Y]IAx)ӖgW>9%17ÎBxȃ,i+d!|IиoeeBx.wI`BDxqklx./aA$ )"/+SwKVDaDEG2F*aA"g pW{$,]MH{DdqJXO(3{^y^y`g>ܔI(PQ Q# h PDiWNY锾#3֟}o˟~Ԛ2vfz~Po͉Q_~F/ U`ei"G ʳHMlwk;˝<ĝuYrvZJG}Ot>o:>ꁴⅥ5G [V(!]h͞Ic޾&lwC"[\-]qi0-0=)=9O6ڕEk1.I^3Fr}lѡ{R뿎x-"_㗶+gd \-6؝1?"i5= 4p;ysy=o=lY/0}= a5z,[Ek[e\/Ş7ιeϴ5ϴsѷV4KW\Ty=B5| >o΃?I~]iXOoMyszp'vj,drQro+->yEul̴V;qs]Ϯ=VgIu kM̓}ޚ׹i;]{w{Y :8\saطױ> \z{깮A7/Wƙ߷ND-X[E:e}8~xOḺ3v'| ]=7t?uzϛwDMH+'Oͣ8y<}5U L`>EDXA7"qM;imM>bNm=<>UNܖYSY塰,G߯nn|?N)1JdY}?uXtmΗz^I}YeyQÜfi җcLx͟vL<<ּ6qCqg|.ɡKOLFN lؓ/1mc{Mves4_Wby(>3 (m^y>s>~ fn_bs;ʺ2CK[=Ak;4°w>tێpGOq2zX,zĤ i܆f:W#VUQ,j(iw?rY?iT`ISԼ3br4#+b9^TKhkG e\{-UݕizPrp>s~(yH>َs_ȡv쟋wŎkˆz{<˱3\YVSaDelmwy/EfRWc4,m3l~M_luga\-+)PJ"`7SGML&|"o93y<Njm/d "Ei~(}p=co\yNk!jlr$j9}lV3tĐW<*LAPu -csMOXU"ƿLO5[Naz~d}Ym ,5|6PctHX~9 #Sdbygy 񋒊Ǜߣ#jUb ^Ŕ2Qn8_6VVa/nТ^-r3vp_eZw=ْyZoE7߅& -cw#ilooz-Uy 9.tb}T_8r´nM}:TծՍrڲ$?uh1k"HN ]Nby4,[Ի.Jwu>2D~GK24[4/'ʹ!|ZWnҩtYi$ -ߨSU*'!&`"PκMt -BrHi8H=+g99Q# -FF uӛG -ˁP\*$q&~zFA,<O +x\ۊ$}gRyH`d XcnK#af +?}"23*gv$v<]Ul)DӇ59Zk%6M~s<;KDWS,}N]⏧|v綎;{Sk.UL.9ۨ*TEǤ3b +0b&OGU %j* *(pTUّ WcVT֪:D+:MѓΤR}Uu: L.:MWMJ)MGu.KtDV 5]UuK.u+*XlN`b-DBgK.GtΙ + +lXb^`!h:D ez^"xI &_cQVa^8lzH`PXj(рPY`tiD,DJ,%TҸ x`A BOA%xtK: K.`Z 7DP.\j\ܩqAbg X75.@%i\ո!8`G\ x785. .׸jIX % 3U `и>b z ' (ch +z8, X Chx%D5 2ԤqAﺂSuո +V6.qAb +D.h\7QvjMuZ "xqCԸ` gẪ[KѸ wAK^04.8T^5.H]Cи w-!Qu׸q tXʚFjSh:uaM޵6W xM Rf/A5.HL9i\!KQl!,U,I֦Z4.Xd,4.@D`CwQDLD䘐.yS2Z\ָ g2؊ȥL׸o8\Ҹ0sqAq"S<"sMAtsNѠdj\$LrY4.( ` S:`Mh\d;j\&U,!xN7^&Yj&aqո|ӓXo j7)붆fָD(X4Ue݂o4]_I゚E7ѫGͬwc3i:."Ӥq.o"r{ ,qz#V{[e|9GR eIU(U ,8a9}GT g̃X~XRl9ovRV_a鎈|$%uD-n ;?l8CGmE" [ I1{:OBΈy|p:i*ﴕu^ $9F:nWvka cT.ڦ4-@[aϬ "GtP&Tϻ)(yMߜ@+~\ +6Joޟ/_}ϰӛ~gS|~D߷-gHY(eko욣~:t$MG=#VNhZ_n]MT®Nc7ߜ~f-z?WcpZoqn6\貝OsZZmˠ2~7>}]y׎!l1Zpա;zu>5v&5yvׅ:}bɴ[LQp60|ni[^Qqw;?nr;y:r-(\JTXxgCxr[} oWݱz;py&Vĸ_L;_L_}?͙p:D֭gl ?[K n>ײ'xmX`tsczoX>|*LjI#<cch\&uԃgp 4hѧeax"bO }G-NϽk8}ie+d y˳ͭoNZa;,1ʳli^׿IG^a[wsv:?Q`r:߲{{tlmuroؿb^}Xy[v|D)y2 ߴ۩u|u;ll }JN|a /pm&_I<G-w׶[o>rlx4oI}LHΚaqWLxgb0^$3%FЇ 6Z'n BevXuة8{-PMLJX|KJ*jdjĜiQG܃|b +W,ԏ0DJwHQ)otۭXkRTm7pBgy*P7|3un'ܟk|[SL^`y"{5ˋ$obI^.Tw>/=TO'y#mYގ"Q/7?pZw3)M+dǥ=v6a[ n(N{m7_"tzXzŴ#!P+{-م߭5R tߜr<,r?dA'H٭/w7x6K} ipJy7מy(g>y[4Y@Oku+5۫d>Re,?p.kmߟڭP=koM=ŏ'~)bCN1 ׏vEnĢ]vAMݗDrm׏3`{c ׏? +}~XfrG1m*ń* (ld+()8~v.M.M>%t/}TT.. TK 1OrR4a2^? Kw$j/.'Z3G2n ez("̯kĆq+a̵-oAx9E+qO1+ +N# bLi.TX] U!ei go$iipgYa.Yi/WRIwHɄ<IjV 1SXJ)8\q#8XюΒGSw>Jq3w+| /mc]N۱΄p)L&uLq/Nm!z>N{JdFo.-֍XdVrrՅc'AS,7}{4I콤 V +㴡axCxYq2;7s^.C#.ppY.-,[:EE\Fq):&;d񓜊} Fe:۬l(DA^ȆN} +`!}10ӥ]s™/mrҘm. +iQvJ]o. ]6ZSZuJySt2嬤CYnx#Z +#ҝ%G,YYfeǾiwmb4Y-J^v:STi'!WI`&g׹}Vr<g%'LlvW#ihVV:@9 +4g'AE큺v 4.3^AoבeorVNb5 endstream endobj 555 0 obj @@ -6638,7 +6631,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 348.873057 101.433071 330.123057 ] +/Rect [ 101.433071 536.373057 101.433071 517.623057 ] /BS << /W 0 >> @@ -6649,7 +6642,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 112.126036 101.433071 93.376036 ] +/Rect [ 101.433071 299.626036 101.433071 280.876036 ] /BS << /W 0 >> @@ -6659,15 +6652,25 @@ endobj 558 0 obj << /Filter /FlateDecode -/Length 4774 +/Length 4808 >> stream -x]ێ$q}g%x}`/%CO}`򖙑Y=Q4%<< 2Xc -/?]¿bqտ+V&# lBr&.o?D `(H\#M)/qO -:|Ove:B$.@`=%k  "F-.` " RL6D$qAp1xUy3u:$.&LZA/q~pI& B-*`*Ad.4lA-q"]贖 ؂hPh"V^I\kIZґuf 8T+M0- ?v`&9XGhx%.e$.6y$.H - ⓸ )?q,qh:$.H:biHK^oF UXob'd=7`C"` $[p֛`'IaI$qAכQXo""7]u $LzW ^+((P*n(p/f (/MeU( m8a}<0gL辭9z2l˟.|{\^w-y^X#x ry&m[ߓAeӍT6]4Ln-RAm}8ۊB"Docp`$%-Ksx%س>-ب]; mӏ_#?~'0v;eRONw_ޫ)EqN,F^ҲDxψnC=̲o\>QZj+r9^??v)4˦Pe2Pb?X~h-#6>cuM;Bur|+7خteq6`G[k)O\Sjܮ~3vվѵoSbT1Zie*~uSҎc:xoTǭ- me۪߲,TY(}t|-1w_|hy[rC1C[-17Q;NIj pj}&w-MG5R[5Kca#?u2רNU͝[!*:}S#IJhlA(ѽƢohx/s)9A=O -vCeѪ|+{Jޙ֓͛v+Gq|)HR酻u@JǟI6owf2LnA"{A6h%c-J#*9^W};kGqzE?*kNein+2,X<{ڶ{S>=% K6h_3^fFe^R~dt4ˆ]t$ftӨ:ϦķJٴ1ea]56݄ՒA*Ǥ&˻< V¥ z0Ӽ/J\y?e=ŲU4|oSUFR'$) d'AJ7ۺ3Hi&׬Q3/WJ{g1.*_ykY-%V|38ͷ]ў9!thwyyoC' _E=yO.wޜ-Bj^ůuI&]թ:@m1X]ԆƗ2a\Cmϱ/#Ϲef4Y_ sj6n}N=-w1:_Ό8~.ϳߏ)_}tO_9ջj߂F`FU3J8dC8xh1˭Q;[ٿY|33u<ZGH6]"~=twQ(x{-t5426HnL^2ֳ~Ez&oԵE{W9BAp+5F[y6CW]Y@g8gt?[Eͫ;,7o6Z )\}%1ul}%oG=XW)vNsK2ZRw>ܼs͑;?!5증׹Zތ.K|oB#R&H!C(4t;#07(7U;]<φtTj)?[KzYrS'ѿπݻyjw[ڥE;vYf鉎ֆdž̝|'Ao_st=T}JB> ?WDmҽmX|~[^ݛvǓySm6Von1jG(>PA`{n$v?NЫᔫ$0_ڞtի㜖J|Tn Ж&~3֗z@R\SPN@vHGx@>!|D@=!#Hr}f  =+RٓmtOY O4}4򱅖t&;9?Tg򹏹Nj?^t1ʇr,^tۅe'ALB:|T,h*XÔ)Qc?64󻚍#U|\\ DNbntq7S(&Ҙ3Umj U{4\绰>N_Ӛ0t=jZ&J8ZTQMfRu~D Nբ C񡤳0V QKj:AtJiThbϚ)66 pFY_ƈRgaVqoGm$v!\\(CMUKX]Ye|#?SkRfASگz%<6xQMܥCh3c AR5IRꚘ)q(TTŮAm!v6Tjy=ݵr7|šS/Ux X+bl+0Bw}:Z;ԏ}I3Ku Vc4.tzF<4n]Ǚ`$Ta6@]cO*2VƞmAN=ňA{R-*E TCɗl-QRh1Ey{9э7i:hɶȍpuldd~ݤS*M˺l{A#SճMw{ƎxpޘIkl6F8l<^vG5;&V?'E:V E՟㓳%%61[AL\yC]^*OYz#2LPZ>h:Iv}W +x][ȑ~_Qφy30?beN1=>/$EYKUit)"//$}UNHz1Oן.?_¿`T]08|tןX`3_/;l_?u )y?b VP97`T^8Ŕ$p ݪ̠dLTfX +ު0A: (%`"Fi7x tF>&D]N#| KEIG%%-N)I[ ;wN-$%qop qA+@WԥA%.p]В"Dԅ@?T$.]嬕wuF#ql5 guPL!Jc%xW$.]6%.&J\xFiH!x |Ru~ ((K +$q!%.Xc$.e4o1<-l(qlH<1ft-"t:H\ ؊E/q~`wI& B-X*`+g.4l-q<]贖 oPh"L$.XC-Hq%.v%.2A u4!q懃m'qsDl$.p%.e$.69 $[I\M4R$o(qA +&B-pe[ ehUn$a(ٸWx:vD\.#=ZF?e=ǭش]ژ|gg`@! Q&;hEw9eب맟._~Oo-gz:=ɝ=7ġɲ?BMb  + 8^f2;=mњOg&89oѡu]GMwdΜKs/Ǝ*o:gk0n[u)Sg:Kg.3>խWf7Ӝv~G]h&n{/\w> +c:qyjS ]}yA_p29'U4FmR:!_܏*&Vm8%UrЬjV[aGvl,.`gg̈́Jq[A'i\mtstVAKU8ٴ0eҹH3њ[&%:bRC"8ƉMs&5na`DQcQǟܕ2e/_ۿj>{ یhUĨ(;V$(fm.Œy_VRg36(˳B~9kc;$NLzۣnmZhc1dw}c0=^ԔG:gCxsRhJ֩[%zͶq}]7ڑWi%7omuFϟ GF5= ;,]˗ՠ}U4~̠yF6 +9 +efAgT]IHODV?-_ctE_Sdll\uBv|H|C/Oo#X!oLJg2,G}d+%#D 7#m۟#?ѝW6>62 W|[-&j-_+FnsS73 >m4V2wErk:QXas:n?}U(O\Kt 鐻2:O쯉շpм;;l6;gW1_?ֶʑ[V6>)9Qm4s64m?vza˹<3}=xUʐݠ?{o drڗddՃuNɻSPuWټ6Q"x+j9jw p:]kh=̥y,փއY7>p`!t'zQ GҘ2j ˈ&{~:Twm,^4wn޶/MsRrN/lXJFKZ]FMyVߞ{no.±5{{b-+zy_U{WH/9vwZfvqu];Rײ=bɮٌ +2A[/ X!x'[.o9˄WO̷ӯy_%{&wy4":Xt;o]k')J}')~?}d%pȈڻ`4G*emQQP^̅(Yf;.k{wksFnvpՕ:F87; g9b0{%F[_v_zT}oYe?O}pP-N7F<8_:Vtfc?Yis|<:;m}ѶcĻXys8>6c* s6Tŝżs>o^);W_#?7^C/H^VfյגJ]7Nv /|ו}Hߍ}к}C½qwϘ˵O&vyl:CN6M; +mYcVJ&?qJޔ2j|>"Xj|>yYn~˓hN̰cCdh}7r.ʹ|(J" i}~,,~v-[wڪFn鮊 e{4 bz;t\քf:tk{(WUd1*%˄P'Azߩ4a25~Q$HTʥ\N^rskT(bWS*m,/1ڬeǥ V^XҮrrz6qT/UWOXYƯ'pE3~T ůG^EV 4B- `/PI.#6CC1IXuA]3)\ +U6U+P~_,UJg^7pw*;[q(3Kn,|76 ;bnW;k0BW}yvwuI;oqCXaUj~`e ][3F0[v'Cǃb~ me 5_:ֲ.4|MĞK h[c؈MѶ!|F82aO6xA{:8Ug|m[:d8haa-d@g +}5nmY6ES.mچI=/l+ڋci!> @@ -6696,25 +6699,27 @@ endobj 561 0 obj << /Filter /FlateDecode -/Length 4908 +/Length 4950 >> stream -x]Y丑~_F} ? 0crl,j /( Q*;ۍJE_R)U7%r zEM+)-V;9$6N1{Kǟ\f9L,gbT^`e)F -zsXGgܖ!K,I+A 뢶[V&j' > -, 6J<Fi?(=H<"/xN!:S' JK<YvNI<2B8mLI8NUVK<YNAl&@8Aᒄ&e$0N.$Iyr1Z L 9J8`h , ,'WA@4ZbmE u*k ,)$,\$,@\raJY ̵N ,@=JX`#aZkV8வ) Xdu8*JX8FF; V&wMRN5.@ gJXc k P&. dJX` ,wu4j)  HXSK<6YIX0I#m -+rJx.`HX/<$yq!i ƓB*aA½g pWyk%,]J`"/1 XKX\jJ8' -$,i'aA̐GE)DOC Ok ,%,H&! JxhPs$aAraPQd@JY`( A4GA띄)J7)AM7YAD|d& -%,Y'IXsIf [|)pn oF ,!ȃ,pnI7N/@973o"K( >$pi7JLf&8X1P^* *5I,@Ld)UU0 -xm0a>U9Di!o9Gofwo|'RVjC|c`2#XЦ8f)>҇ Kэ?퇕DGoEjt2?#?03s(rD탖ev]IGj۶fjJ:t1` 򁆠t" hc!QFܪ~)rd#t㯟Ͽ[/o4LOg;i,`~ZX~ƅy-?gpkoi-ciqL2G&Ykoڛru]쿯~yOk*l\H9x˗| aI>N~_ۼlڗQy7Y{Iw:ct0)wdg3PdwrJٺnV̰; x=tݵu6;j-~EVƫr.5йq4 :F}U̵kAG[UOy:uwquc_Y󼵞tz.?C۵zu~u~Wi/}6o;a;VP@g1|d<ޏ] Au g3_" m-vMYTydfXIEJlfǞ /^|iTY^ѴvnQʼ+ڎ -/QXX(3cvdTeuepݺ}ۇ*ر`Ss}΂ǡ zձ7YR#Rd`<|EiLV`Vp\eݱdt|?F6YS=aakRMzJDd{i}WH#tzy:>`L>52[qFEԃn$dr>Eԛ3[O7ɦ[PA_Gת Ny6Y~WzqŮ%Hj]'cĶR~ pqsQI(p<8|W?SK=kReOy:K޻'Z)4qYہ>wtp+f;'<ߏ^[ -tj|N`c1>ܱ]Uw*ZŲHmHOik;|6K>y{COg'H>id_ԣ{΂ 6=,#}_BXy:;Ytd<ߏ_sfvOTz]s0Vv>4hcX.np\߱bwG7gYq@!7v7 "xs:~apwU׵8XH/{0I`'U?؋6q͞YB{i0OYvލAE=bFZk15 ؤ#ӓ/u%gI7!ql򸰥$G?˼v͑_)%Z4^֧*Yf\o 邭{O#<6[jM1N![zGn]k9K/nizwXI=9T_Ka]_jr&daٞkAzy?-ZI{۲e}Qlav1tVL&-{Xk;zn ͖:v~]5;u{3t0C)Uw)s5aط}⎞f;^=uƵ-[űvu5Zߛ7#S\;cWcl,$她%T1>)ER20 -Cs0L/D&t vG4>" -#ף. sۇ){ԛ`b~*Lz_7ECu!l~~eu/ -} -qe6rR^:?hVf7*!O]3)zUvl䵒8=4q-S,חNJhOZ7Les@ǚ52AXOJNTULɾۊz& ovrhɱ7y۸+VdNF5o'c.@;r= Ivۥ9cd2 h?wM}oǍjhaܓї>dJldžc:ZC0v^[ꆠq9w2ikewA-ҽ{uqǫTe<] +j]:ΰMd+1 $M$[ai.v纛CWZYk >|ҼG jF}Զ06\e9v ,;{9h­.2jݖO*m5iu .@SFUtj)+Nb):o\ӞJS6miZd[9Ǿ:[X2 {7-mmv빫e.H葩Cٙ UU[*!:oZv:Zc˗g0EXi}JZ+3a;&gUgv_*wJ\ :̩M%|^yeTRЛۺmm*U7>5 +x]]q}_ 0p $Fa cn<%%VnwӪGxxX(*_rzJ)ஷ/\¿buQoW\!$qٛo7\o?v'I>m %,bzAlzö^X,{6mH C1)31Q`4*ADfC3(hkV2]%31hϗ?߁O'_\_0bEvï3=}KAfy," i^"?5C;6W*,m?jKmQO[d02gz r>si^X_;V9]#?5xG;\Cߝ sw9:Gldf0j;[od\utH9z.g~G̨ul4/da(L$zOy6v[êόJfl[z<Ⰺ6S棈gv.#}a#[wA);O\CqS=Rr€ւL7Ǖq%[=? ŨMF=tH=kvިkud( ~#=q]4݆^}'<c\+g7g{l{\XԲۮrաUa=h,umȘ~.Tgu;z(mFKoWtzõMXrm9zz|s[N[ +v`ZޱC\̣^ ʙg<2A~&Fqs,6L٣Ϥm E]:pΖIwxBy/78ÚK,9y:P\䤨= bN`aٽlл(2==TZFE+yz̡͓ydAڸ/z}3[􍋼:5 $N]nÍ"BQY$t#3LJSZ>FZ+bN>IPͦd0׎6!/t| ãGHAj#\gCjև|}pm||rxD#Eu$-+ص>%Oy=A}tqT۴  dtȴ5rn󼟟>Y{G +{缙wssy3ޱ>Y;. ҿ6ۺIa݉!3O9w'|< +3g)o Iݯ3Caw|d#}dgCVwLCM/<~Y Meѣw A5Mrul"^WC6] З#OG7՛YCCKn[YL]V?(pMrc7r~#~ӸtRݙzÜٳa҆Mr mX4iC_Yp n6MM8V_wr/zZAUŒ?_tvJ*iWEL bѦ;b.U+vRn 81Z>T84ޟTMd!rSդ1}Ar)tS {w*&[buqMm ]LӬkZYw oTkG(7עwj2ˌMk! ]ЙMzS; SkrM'n1Ro=[ԳnJ::ۗؑH_ƈZLZ_pc6Ż6⣐wPB -+xҘ04ITᛔ|ЮAۯz%46x$.ubOܥclI t[汕cI5XuC]U4BU@u]VnoCիVY šq^m2WLlnSj] a .4Vu6v*!Y>A&͸_/e3:oQ/kkyܨqJg2ΙtRLASm0qXW4y׮gWkJT7-C&6 F[ ^lMK[G'*\2uS+Jڧthaq %0wVf y%d]a.v]4ˋ +!`yye`Wbr#ڛK[HOr֗mαVC,ƞmAN=p Q&M=ےJ]*E Tc),٪[Jb.+ҜyMZ*x-Z-αN-L,MzJ[eۺݺ:^Y3\7$Tl~]3vT_h-ݧRG_]b[#9+Խ^cr֪[eޠ r&=a+Ӝ*eC]FZ*ҷY +z}YPTZ~vnI?iEL endstream endobj 562 0 obj @@ -6733,7 +6738,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 142.623057 101.433071 123.873057 ] +/Rect [ 101.433071 348.873057 101.433071 330.123057 ] /BS << /W 0 >> @@ -6743,27 +6748,27 @@ endobj 564 0 obj << /Filter /FlateDecode -/Length 4733 +/Length 4793 >> stream -x]Y~_,>1^ <̴wlyWx*=vnU(?KY C;s|8}<[) ۳VF |ʻ um9{GSҞ~O*QEԌ{err)ȩ`F T0(Ux3S gTR`u0Dvpht\*:i=8o.98-6 -,l`s:[ӂt(Ndt]tQ6cX]N:%`ւI9X`S:(tN'lduj8-GADe8PA& -q0kTqsV[ Xl1p\z: -Z) -p8.G0D ]]O01xCr:A׬.@'=ޛSk!`s\]f@' >  0 A3t.tRr\l7qAPL'8. $AqA0n W 4&8.@br\X:آ EqAE qIMqAQd @ qAMe8.f j&x̸zs\ lpQXlq NzlQp\fnِ֛@g]L q\7rk{ l@z-V6d <3 _Z#Aepl*Ra?f0F<$#w_5^I6~&9=&E򟄃RW*-o\ ݒ*%AStG3Kajc p uoW6Z`( pÁ5v -`6&ߘ X%pH" -Ÿ+,ޝ`d-Rl>+v݇ӗ/?~Z1~ Mf7ʰ/jc9VS#k9d?|E=$KrOuX;?b[hii -W[Vj|1.2s\ͯOsw9ZU^+斈1|B]^+76UP r:Ry ?i]I١:)ztm 2?G*jMK-D[ݗp96Z9;Մe'1ʇiz9w ƾ~.xEϵy-˝·=#rmՏ=s8]ޔ^Y_OVo_#0}]W挿;̝yJ}ϼr=j4f)V]}FcՀ#d]ESuH#%X]*ɖcsq:ݔ3]M]%+sٙpkOw,]iehiEՖ3Py}5jnׯu)G7u˶; Uvû∋@U#s1}GmM{3x%0NجÈyWe>WoJN؉ԥCsK|i)]2Nmͪ;u;#R}d"27|z1%jz"Z_9e+;wu&&5w]97;RtwDv9B݆E(*:^frǂ̕| mވ;b;bǻ ^wkFYy -+#3Pq%QU^AOs4}<>˲swgG?TzuVt/ ٗp݈{zWqgawCw9=4 1rkoi(e<>5kå}FY|JCwPPuYn;fߍ>y}==I;X5x{=ݢbꗶ67FznMo -$q/dI0HE;BLd&VWr}4?T֚vۢV}7)N2ڟXcO$1&8ۋO aN1 edNXd/|>~R8~yl>os6ڞˆH Ɗ!r:ًANbJ2 z:rMX3n.Hz4bztV; /'T{3+ rQu(2攥CL'Ft91/D.ڠ35h $SŜ]Nl4[zʗTf):gd&q1"t9;"4Q dMU|Im+W -uSnQRt C3h -[<^ڣZ "7R+wu i.}l^2&=nI]Zl&m#*1˂"& -Slb[<W;m{[Ůps+%jU-6KL/&\I+QfZY#sZ؉v? fS收*Ӓ6il,y/|ϿN+8+QBnۙ ;ŴoaiheimFCǕj{N) ʢma#VJekȼo=|rF~R*PuNHQ:Kz[wm8l*ղȶdiBS]AFС:Sٶ,Kg$ ۃ`#J軇׋}2@BEJˉ/˜tomRnƞ.NNյ04lSVjlVi( -]@&Mnʖ%q`[Jj[ڶRѶi<oIȶpDMY|\HMMlYםgssg*j6Hy3v<]ԁKR$D&j#V ΁C nMhB#7+YFDr 1ۊ PmES!- -nk&TiN,"AiLrihcڋV@{1{oV^f? +x][8~_H|)$HaA!H }>c\!#1G=ݩb\8>+}_$=ĘO'5oL1;Y+ +Gw1 lBr& uҐB'c'qAP8P-H8C)J\ lH\ l q Cv%.CIG7 I\qכQd֛X 6YכADEuNS-8 M$ yכQXo£C17.ft]x^` VZ+ de+(F anC +܋*1k$1h3^`ZR+1l'CC>ɄaA뚣% ɮL1RV41500 }ks&l! |$O6"f-NAl$|cf9 nfkI"wfyGGm=d2;r+ @@!3%dӏO~鏀ѧ_~_~;GI7!7}<ӱB9嘕W~oz_qfwh=] t,c,?bvvtD \uH.neSO;z8Yjg7CH\8r~)=VMSq}^Y[}ȝy+ m>'%7]G5- !Xqڙpވ>SA=q˒L:ܦ(?je^S9nӗ<7P֏6,vwE3g7HfVV)$Eǘ3#yW#4Č(}y r廙_V=GUQ>]hG[}w?7EݻwwpkՅ:&pn&|Yr$;L}K0f2壖5Ӿ\ Zl)+{/~y/96p Őpނ=;v>݋_3Ed:ʻ n#pQ=#o__lܙp c7=W>rھʸs8oﴟ^B]ۏ{_/ +\Czֽٕs8nyG!e4; ~?] }sׇk\SW {S]y%3rY_c;>|G#O& {~}^ԧb;I글v?Kq]ퟗ83:FsUuw~+$~q\ޙpHU_߱eOaî3м>Z} +񅫶YZ/2yfr{Fs8}ه{"U+\}B./{X@ڙpH~.U"=bgO͸~x<f}w&.< {s4 Խ=G]! +B"~;w܈6M#g#}^ (}`_ݙphx@E&ֳ߫7ׄٳ5%.,eu\jٕכrx"hCWbe4uۼ31@wgaz_lgAׯbQ7#Zffv)o_kKHWgykQH=C#Vg~2~X_[ݗp݈ +=XuKZ +M;cv9bحc;.X忛i;+* +$}Hy}9<!3LJ!''ϿW}x:rSj}efi&7g.[qmqIN믟XN,TrL +W|7p\9n;A೧!wHN[ncB?T۔U~b~U`J?t!7QM9hS~- bgSղHUv!)+o|؄Odo$"U<׊!rz}+g=ۃ`#_Mq a+xV`˸)V1*V]*t 4֝k ^&J;KKQu2ˌJUJ!TI]NU&tfճ^o~ +ctDn*՞ +5UlYSifJF4ס1l9Ud17QMvrAHW(WDž[Q54i~ffT43CST~];jYFr_YZZ\:Y^:*!}&ݚLʚC*e1늺*Vڧr%bkbW67;]{kwWmb_Cq_dX2eبgRIUgV6@ +MhmZi| 2iƽ~9cI^>i~?NtCyu7:,=緺a6Lh~Һ:ZvՈԕAurkmĦBhZƭ/]+VGپiЖC56BX~:8Mg۔|fE('mS:dXFBq*LͲ~]as]쀹6i]dY$p-?敦=}2ٗګKei%> stream -x]Y$~_&yXc{ksl,j a~T`(Q5Ft2HE}H}UFR]o?\~%z械ZxC`71\_/o_/:jS V`yh|XA/b b۳"p9y11I`%a]vD$GF)As<gR6YEt4%Dxy !$dYi!)YMQbU"ċ@;Y%J"v99'2x*ŴUO6Ê$( d gYUFY#Ɣjhu[eŘDdK`dQ1H.I`b\\6NK -`dVi*]jrEdIX` dA ,Y ,Z$,[oA J ĵ)8 , %,\ 씰tܣk}0Xu)HX`i%aZ"%,:.V'+aZed$,. ale1)) p$$,p]D^\k< ynHXƙ a e(1B@+a[  U9Di!{Q)/?^?_LYJi -dLG1| Y)A7ncbiaMXpxP?Cv );l#0%oP䈘 _-:tJd}s lb~nR>,?:ΈQ `ҞB۾V2MCRJm">&K o+lِ0bܦ|Nk_2iG㯟~O?\+8Z7.ݭ2T^jV}-ukZ;Wy ϣ!y1F8GZ/R:5lv}1quY<$G)O:}^ָʾh5.& #wh{gaGfns/l10Mxo, - v1|eֽ3;)yi|N=5kcGOy:<DY@%-hyD:iHerF+s -"3Xֱt|,-ŲmY=oljcSqc{ڃ|-YUsǂY,b)Y:OgkYtۿ~v;Jb?{`20滸߁<Ǧ=r.s >X|Ns[ î)6[/ [;M%udy-Q -X&F7Z.kF^d61B2fǧߜ?X [1GГurC:6ͷ#AFh'pn1`^D`d'6lv4G扨u{k{tLⒾHkYq_%%Ҫq\kȅ='9Zsϵ]WyFNs(^X0V㺹UnSWؘݦKE_#2}" չCb،y=KkeUt};aFz`fN׿mC9R'c)j+A6zp*(gB.ve^j[2[lIiLם-:.>O[mcޖ6u6tgf]~ -{q3g\2ZKYo2}ݽڼodښ2"&oNGaSt+2]st|h<]ru=Xqh5rs8#I֥bXZu74W]F>.[޻Q1~`wjOoLkut*H۸KHӸm{l_dl!h]iGR%=~ G>bΦ] n>b&tFGk|#Dj 複KzE=K󮃵]=`QN8zZ20Eez m갅r͋BQm1=(ϣ>,cΤڴviiPC`hk4z8zg3J;4OOBu!|T ii%U️y *bRT ⦳'YPٴ{}OOgzt괬;n:wld'Ita\v텾5 `2V#Se۰-=e.*-R $;E]e?s^LP;L Uk<{d'!vTG-i~J$kXReww~aN d8B1YRgw^_unkhz#!9ݒ) - -dm9:Ogf^3&$<9i3[(}馹(|$bsfpgn-'v\>Yl9C\\C~շ Jyny5r 7.7{BnL9lZ:P1[}퍇6<"]z6z={h< GmX<NyKb{}RYlw/6[ܓ(dvpku;@FqH1F/na-5;S\Ĺ\Ͳa7m?^By.`U!aOI/iP*&+/)t&]wjWKշ+z.p}>,EAJԪiz7;8bLQ'KKb?q6 GhoqNB3mX f{2^-i*tQs'/;UDźd<UU&<".WJnM5i ;շ}B\'toTka2;s%fH˭@]r5g*RiTMCa6u ;*Q}ܒTikݘvA~(+hY԰A4kHP;|Юt\NhmvVI:8IQKmK'%'6T2FG cK: c%'&dMuCrTv9t|g\Ӌf]fx+d2:d1 0F_ ֎N Xdǽ]v)nXoXޛΣ,}_-~^Թq:Z2d-$uaDNo1 ݨ#\NClmf6i2?un^/mW6p4xv+kWTttpaq%06bANI~ǧR_삅ti 7˛n2 -V!ayy# O*rh+;SOrr-ޡޖek g,ZQFMZ-y66G4hd -ZSKq{L1|V=+K6ף% 9ѩQǒI^S(im߷ݼ AˆLըw%߅Y;k) j?%x5[L!p"R#os+gDZX*j9YW0ck}'\-+qHoS -0vC%YB2VgRЛQq>)?gq +x]]$}_Qφ װ6xa?LL,}aPHeTfVO{(ve>BW?h/9=cpϗ_.j^ῒbPOW\!$qٛoox.yL9_IS VPy?h|TAOhbΒ +f۪"p9yI31IP%a]v0D$GAF)QCs:IgR6YEt4)Dty +!$lYiIa)I[MQbU;Y%t%Q[TPZe;u:bO*IM+0I! +:[Yot8t ocJh54ZybLt%0$ +$01N.'Ivr%LʓJ4`\Q4tFKD`l.HL`5lq$. l ,֩%.[tpaqm +N kX.{uF ڵ. ,x:$.p]kSXdu8*J\FF ɤ$.p]wM 1h%.p]ik (Gxp`%.| ,wu'iդSxN>Q'qa˓!K\ L'̨F3jK\8L&]Q'SwAKF“J`Q'IK\2P x{ wVUa-6 @a+i2` +IU=,J,qAҴ)qA$0I8! +6c dB>Q&<{ DlqI\z6' - -$.@D0e[\E\8؂HQ0ٔsDW%]0SkQQ݄XK\Ԕ0%.O.I\3Nₘa dK: [dK\H:%.H  UfP`ZtN:3I\\(T+M0- ?`&9X$.Hr3I\l1H\lz3J\lA'qAVa0Y8tJI\uz8 0.i$.Va%0n ތd[V=7^/"YԇYp`&Qq&[{6o?] X#&]?|{^/ GпY>,S\ +IwX~WWʥ9-r/~*EF]~Y]򅭜';ܽ.s}^ʥ|~)e?r*TmCoZ1涘wκ4ʭT/Byn? K o!um[ӗv,C9˶`)>*{prRVص#{vޖھJ6ڋ ʁ߄ RgWո]|RmKZ +q".O* +K~N/J~* /}X\l)ϵL{}72߽j6{>2jN)wyҙQϔ<]ƚgknq5tck<#qvl6U=vվ|| F0V_}vr9(>uic nW+ԑ{ih7b}5=1G"s qGzOr_ _⑏h3*W,۹{Yw䞏`͝uO%}q@[%s~T@xhw-(Xw2SN6rU&v5Q[21 L7DO?})F5\ֲtb2q֐c.K=%qDc3VxB(KH(ў>L٣Ϥ4|X DLy`x}]-PL*>cag;ΖmOz QnQn7p5y FYrc/+:@ m%JOD[ 9 :Z-Z콅6ЧCLUCed!=U%0?)];[ sY{bȡ0tnq浏FF]MWʚuXPک`ݯu*vM溴NjK99ٖl]ZɄ;N!\'Ap7=7$UH%2"u쭚!tpnU6[[ioԵZ8z6{k um}ai?2[/nk[VXq,tXl450囓=BCǡɆ8=Xl1Yxq,K#c9y:,]^3Q_5~ Jɱoy3cdČ0ۼ(Ʉ\4F3[/hh}Ȱq< +]<aH^ Ft'<~t#Ga=ɱ#Sg"[>{C\`H{`blϯUŝu_[E6Fw[m6=5r)½5Ϻ\7#Q}.ϓ\qrgQG<^f;/{7mg+;3OݶQtQPv2ϓMz|^v*UOυeSuĬ ^+iHhwõ}d6ia/czS}?TGjňLY%Csyqx22g٪e8Zy~%nHWBL" ѕ={kU[slo.1)5rsy `?[cÇ8z% o|uчT捛y'ύZdp=*i_Cˉޗ~{O(ǷGx{=/,;NKs9]N;P{*-|&?Tۋ#1 qTHƈZLwVlwm$vG!\!oIut)EJ' * <3U&%)kKxSf塱<]it _:)!=nK<21y<"Fknkbƕ\}Jmz* ݷr84|z\ӍV.|F1A?Jب6ʘRNoE\Gkc'2iƽ]~)ӜНFje"_wcvǍjla|&I'2U؆ hui}ECǍa|zvՉԍAur>dbӠke;|k {~qtGe\oS>%_Yx}JP< +sle&W\O;b,GuO*+`I[ vWWF{x}s/&:HڨI߸5d-a[7{eس-Cn1ʤg[x^UuhtVb6%[uKiq[LѥW=IKEK@9֩ŒII]Oil[[]g+k놄oR3vKT_ ѩN:Zc87DyJ;"uׄ*jEل7(U|QΖؤ lu^)^aI iH_g)M=@QiR>).;B endstream endobj 567 0 obj @@ -6815,7 +6821,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 356.373057 101.433071 337.623057 ] +/Rect [ 101.433071 597.273057 101.433071 578.523057 ] /BS << /W 0 >> @@ -6825,22 +6831,23 @@ endobj 569 0 obj << /Filter /FlateDecode -/Length 4714 +/Length 4809 >> stream -x]ێ}gI@^ <̶wlZ6NQg-btZʐ{iUJ*bT -u)[S 6s&˩`:03xEsU+é`3*%aR:"!8V…#)9p(8]98-6J,l`9-H:آ'NaFDF` XlN*NIau:|봴"$VNri⤍Xl1t K>f4Ith -|-;0D%Dm8Ё &p,C{h@G+ -:8" [q-#Ұ 8. -5@ 52* |krfJ K  (E KN 9. .Y9. .8. .%9.0]"du(HwIIqbi Ы8t+B 9.0]w$ xW[7swF; 7X- X 0C&4 ,xWEL̘[ wU@(G3,s DEX.3p\Q535*% r\8oBI@E!cX.hIs\YX&au^HC9.p]Lޕޕn-4kðe4U!5ӁwBs:>r\i$Ё(k \0"z8.pQB9kqXP- XH1p\5l!9.e -7<- >0"`21xCr:EkVST8.ZJ z @"K G؂q"4dİ0˚&d?x{ߧφHYQpn [ɡfɓ@c-/;?L, S>bV -Kh9`:@%GmPԉ9L @@ec>K,wO_}?FO×+xmkҸ˟_\u%}*u_K]Z|Jƌ.IbG?7_z.N_I]\J~O{7}އmY^$:-|rW6]5M9Cwj t5O>uCe-\H<'QbKՍyVVZN#r z~_@!UKWu6g>@R}]n:܀1 M~.TeܔO>qj϶}`n\Q\݃WR`"9o;w^FwF{nv[h39\l -V]`u½g8t/uҽ^sG5 cP_r7L֥pMtdSm.t,tr6kcKxF{髻]qd-_CM9Lz2b:پ0G^1OY*TIܤߧV5os8_lٯg9#H 5{#O{nx oAVp͑jIV5?#qN?=t܈As)Py3 *_ۯ - .GĩyOzДRnNSw^g(ҺPy('dbK)Ivg(6`=̺IRYya٪aggDڑ9$I 9#*Se:0Ru=4tǓFOzA*~9d #6F$?RQ9a]^>%Y!ǏN66Most9 g\+f\^ -5)Ax)e!6m-f\+΅tj[i:WT9Mw^Nz +MgrjYd攥CL'Ft91e.ڠ3tU2LIs:Ft9l)_R5斯TS( Ȇ6>+ތITR侖 /'kH◓Lj[B VHMEdKfWEgLT:C^J,i#rWXp-iR̶d'-KMM5ry -yLŪ)\ -e6U-P~ U=WTw[ʭbW*X-60^r%UejeRJ/8N7 f0i:#ηm,u|O@lY;l+STmK۶WJ#ڶW,m*7x[ξޝ)/ks))uiy=7a!zfoع\3DBTGb6ʓsLNpbބ&4rw۱yD$JښI^늦V>[-L(ҜEHBҧ12t {ƞ&翄 +x]M丑ȳ6| 0|a,0}?R"B셻P] +! +?iIO1|IM)+%VE~;kEar:?e SH~==WYg3v~*S!('TJ[Aq^Py=)I*ڪ̠dLTfX +nU fIR \TZmu0DY#贛<%ѓ$QH:k'H;-wQlqIiI`DJ1H:[Jtx' [(`JKd'"KЩVg\VI:'lZQAAK8#ΆjjI`1DlK `181P^UL(p/V 7Ĥ2z1keJĴ" ''CCd´ Dmыٝbs~; o{zUɔ&W&ao[_j`%r>hzګ_z9~/Z/upN5E\i?+h! ,}Ǫ_^ ZaCQ]>BW^p0 0|y ͙e\c47`G\6nX5e^FW&cIeV}체Qυ[VO9bŖJN^>2,_<*{=l4~Ef#K,kYl,ζrw0ֱ:!SF=#kݷ>U=`!lAA[:VPu=yͣa|̨OJy~)<REH v\u/[=ۻnrYO]&ڶs/5y Zޗu,fJ*cu7⯯bHs;Z[!r$3G{M'Vίv9,̤H=Vz#vh""ibL}{)DJ+:1Ϊ;mԒ:3&2ٽu FA[=-|f X(AoC pDتړpAj}ˬև1*|t~h;phxdˍ2;_mi2Ȳocwߞ8X{ +ֿ:Búc=觱 Υ;r<rX2IA.X3g9E5"JF>h_,~o3InxIk֥m~;spH> cexD# 7v8qX#:r,_vew;#=X[/{$śQqy84_q߻W:G:rv +SrϘz͝Vyf4{/6e;<܍8#Ͻ%Su҅-_$dqpH~_DG +5@lbaE}Ƿ^b{áƽh NqSs #GB8U6ߊ[ѦeЏl2twJ︯`C +W3< !c.u@REkA&_;-_9,FU4-@:TAr asn#?a5&7ޑ=Xz=vm#F^Myպd |_.W]3B5{YߠcAMR;oqVl<5wp5fV$ϐT=?](3/p(͸ٚi\ 08.7'e.>V|=Ƶ~vsM!GvƶDžK-.Gz86WJ\v[w4"Yރu 7؝~ <Ψzc[<63KLnq޻TJj43[P/qE~cu7r~W~vK +MomF^.v+rLy$Fb'K>?8$ʏ~&}=S Mӵk-lgО;u}k|)㋴zFVvt,kWyāQsbuv]le9\w_UjTwmR1/]>:[^XoC򃣷4ҖjG{vޗC>g`[~Wd|.xNsܿiǨU0v_yAfkfLu++"KKߟ6U?S/vmpz ݾ>]eW|>5R(x +Թ&W}fFT{;Kw"/}WUSfviSz_d?a)w6~ƪY By =ԣ/kי]#j:9+>^+gz9bo#fkjౖ8=sՏUlx3λw oEZ?,O ;mSbl"76+g d~͍gl)dX)+e +Zf?CMa7SLDg4f!6reY+h_gE!iQa3l?|y.OWޜ=My +霟%]IN򲠟[A*R ?Nz~;X\'D$k|Y8zůD=H!jmn1o] SKZWcGjor}Wg𒪅ly +|bA^oŹjҋ8/'Nv9 7*&t[bbC\绰]ײ&&pZ;J_Ei~KGmzר&̨ԤlBm$Si`6=Y+K rKkThb)66 <06G?icPl6PuPB -kx(f'EgpM| ޏIlⵓ7!B/ܥChQ 3c+)sT$c- uM)q%jNŮAu%v6Uz2]k}W.mu~t0_(Џ$]lT[ɘRNE\gkcTcdҊ{9T9cIoQ>8:nTc Ӹu%+Y~oY<(16m.ֱu m75{-B}ĦAh</[ ޱ |hkp_cپ$Y8E-VQn H~l?\쀅ve7]eB`xäI軧׻}1ڛK[Dz,ЯۚcN֖es϶ OZcIcpTeօdZj-QRh1E{QiNt|Tlnx-Z-rΡN-MJi}ڞY7{dz5)y3w:CA*UJ&D,Ԥ5UE!_(ț\ϕl3"5WτZt~l+鶂5U+WKJ :ͩM&ʱ\- vV17+**}R~Qye endstream endobj 570 0 obj @@ -6857,25 +6864,24 @@ endobj 571 0 obj << /Filter /FlateDecode -/Length 4976 +/Length 4937 >> stream -x]Y$m~_Q6z`@’a衧w[k`}i 4z`|d\Y%t~ju_"Kp}'W׿H,gbT^`e%F -zAsXGgܞ!K,I+A 뢶{V&j' > -, 6J<Fi(=H<"/x.!:K' JK<YvNI<2B6$VC*%,D' :_B ApIqd\P&Ņ%JgVAVC+ Nk HX`-d1JX`"a:xX.TX MIX`0,aZ`%,@]냑vKA ܵN+ pZy,aq:Y pj%,p] ##azu `+IIIX&)'a 1h%,p]swWF5 `( Gpp`%,X PbHX: ch蔃OEGh\Cx.wI`j$,]m%pW$,] ^âHXhyyQ9% $pio" -#3hƙ⒁[Eq@|i$.@L,SW VJ\6P_cn _ -0"52cX8D}18R~4!00}k4!L EB!!bBjb]t#!ua#9'ё@k4P~ Q)aR!9D~8]#"|,PwJ<.c -sӯ&Fp/v8"Wl15cBlOvmeҥpLȔpQ`O*AfC0rZX#14O_?/.+i_~vנDC|=4Ϲ{":QoW䧼f+Wj[>Q -Tkn+i N{/C^~bSt~kdeTQp0;vy.s>2*<ܶ&3-3LP|Mix{:o'ώvaiCB6E9z#Oy6c閨q y=e^}ۖ6Y61B2& LV=6$5>2oXh-p{{.Y;GWǦm.[8n }ED#hCWT4oQWWg1!3徴;zMK|LNcWVn281žNczK-}Q\39֬mU#hy2ǃ6UӡYYjLuj¦MV,FhmSUo(G/'XZ}9]ﮖHjqF0o.ԾF*QcEWc-ɿRY6J7ڑ>SWvvzdC1X->]Y璷W[`}Mֱ&M:3Ίn<'=˖mKIPOUmL7-_YO'/ŰPon쁵dX2߰~qDx</ o.u*o#Mf>W챥0k~C?JT/W/HNG19Wŭz[-t d;q<ZĀwy[$yჺhvizxvTaszQ7K46/>! -%{t"(Q{}XGI'L9j|744O9fd;Zhw[lh~Au! ei%QB۶s:鞈It+{N'x}E4k:CTi7@[;OJVĹ bPa\NDW/ I-_4-iwZam|RݡRFf믷l9qdg`q{{}O;U&('9l3lnL9lZ:muҗONln8-tQ{"Ny:>yO#ɦD.;-7`x0E|!9_E7s)£^u -=nPlc'ƩѬn/ۼZup򐟞VnLZ;>P͗{:Fz.Yk<ĵqNkV׃Y~1]7-ksv.gԲ0%Oha>[fc+̿a|g<&uӁuszӴɏm~ݯ:ǜ6Ã6G#;Oy:k;)^}e~c2ǯ;#X}T]*?gtVyg>ml<5:bF͂@ :syZęX#Wܖۭ߰^[?٬0ǍX\K"iwػE[ u-]"kU{3!G\7چxz$wLm_qKW(^tmBrwC'CmzRcܲi; - -jK֫?ȱ6׫4t&]7rׅS7+z(Pn}8{.ӥ\U(^ -90z۳΍ wDU/~?^qsJۘ%Z*_?ZC}For%=Tk9ޓjѕLoNOBW,:qxQxbD'*V Ů0]t:ͺ5ujL}VTӮQfPS}K;~HjE;tf^ tH1]-=UYseM]]4l(>ntJn̎zA~(+ǞhY԰A -C]q -S yIӨf'o顣4]itfI t{ꮱ cnHuؒuN&kXɉ wS~ߐUzeA3sA;99.o/|#f2~j QۍqPFkG'Bq 2^r)nXodEͣ,}o-~^~q:Z2d$ɠaDN#o1 Ȯ#\NClmfubdo^mkf64xv++Ottpa #06bAJI~ǻR]쁅h 7ˋn -!`yy# W{9@ΩaD'Smy slJP/˲g{3-(&RhJpj^bl28Z=ԿpM{+]JإrђGHc$ݩnmnʚ aDjd¿5ϴ j?e%D`8j5|J!C?ĖFsV_ik%&tUQwy"3XQ{lYMzLRЀ9[ *_R˂P4Un&ʉ0:e|R~]K +x][q~_Vxր <ٱX!?_EJ= LcUI-wEC)x~|QCp +rAV]08|tןX`3_/;l_u )y?b VP97`T^8Ŕ$p -UfPNR 2& +3,m3L$`N.*`6J:t %у$QH:kH;-wQlqIiI`DJ1H:[JtNt]Q啖t.E"QS1ĥ(7htZش+ +䃠3+DlqVIga Gҁ' 1 +jI`1DlK `D `/H\# )/qO +:|8ve:B$.c=$k #-p-%. 1I\G ơSJ₤#MC`]r%.HV!D'd=ǛADEuNS-8 &IybI\x3J\7&/jE1Q֋>Z-"๵‹-k3B/N!=Z^_.{_h XOǿ7חdBJe~_/K>O[9+hyn*Om\8`-<`EbtzzðШk (|Zti>@VIsفuLO&ʭrw +ΏTeƱ:5]M:+{tH TQ&>ز} +sm8een}rԭ86FjV])nMy]6_m(7ةX]nc +Vlϩl}[aն8?j>׶Z+64d``s!G|I<#"}j4;=R*u*R̈́ D1zVP[WO7& ڔ)cck3uns[fX6q,s:,&f^=:&Ԕ17X}е#;6ZO`n]+ oXvO:òvܛ2#x/d?7[5cF}b~/ ӵ׹7ڍQשּׂe O.߃,YmcXax;n=G.lzxud/s976|.x\ p+úg8]uN@Yv @ڍ7܏E+u;ʍ75e_u&֬حnj&Ĩ(;V$(NHLVye0+#2`2l2[}糖!6.gκdVisߎTkH%F:gC*M>.k;Zr&׬22v+vn{ۗ]nl˼c}6ctEi5 b!H292iC(;v-H 3[WP8~̠yF6 +9 +ufZ#R`IHODʵ,jR;*u[g<)\SZ``!oLJgc{53V>KG#m۟#?ѝWZD:gC+"]D^m-kblӚ7:̂O[= 飑ܚnTwGcGo<*fik1:C-i-]кV9ޅ?AHsEhCey׋z|s,ץmG>n]+֠t&9@VY<3ݠ=qWZlZ.}iO;'ڟrYAmooXӡv'QaU=qot{,ݝ^b=}H/ٹ"ꟸvw=xݨz}em;1*J ~ W~w3=bhi{L6Z&wy aOU2Zڝpr3߅Z:Gh[wPJZ.V;ʋEڻB|y鐷szfWݵ#jhxx-[#:m WQ[Ap_8hK>Vtɟ~_:Vt񰞝fcʧ˷j;/3v1#zȃuNƯ}>f:gCUڹk;͸vD`!ekW|;eoH^]{-F\MNum]9)'mM/u^uNHf{r~/GfGPN߷:XtHɆ=gTM򉙷__֬"ッ9m߽jC\a[duYg^u6$1+;r)C,aSJ֪~הr-:ry+Sp9> @@ -6904,31 +6910,20 @@ endobj 574 0 obj << /Filter /FlateDecode -/Length 4803 +/Length 4841 >> stream -x]ێ}VxAbr,FvzwN9DD.3fUK<<,آ -|!_0r!zg._bv_۫VF$~*/]/v  0 A3t.tRr\l7qAPL'8. $֙`ܐ\E 0LS:ۖ,~2m ! [Pi9. -7$78tBp\ezS 0.z3p\zKK,]~}0|B/$J߀d#~1ۀLZ=Lp-qZgW=j9a,G)o ٩̩*OuߦHY]uMg,BGPf=o9k2ll$߮~{9Pb\a~[Dz[ Ha))暺<ϛѸI=]I;uJ]uRF}˰ӵL9嚖wwޫlkboǕ{6;0LQ{qx0ـ& -"#s q橵z;|ђGtUt*dT4TH 'o -vݏNvg#1]ڰ:]̦1)7s:ԙMSCH鉞S7?8|#x]3ipK=*iӕ{Ps{LaQ Xӡw!QZㄢA97՞;ZtU)TB;m#X!tǿV\Pn^iHQuzWι=^ z|񌣍G9zնO&zo{>5D-}dGy۾/W+wWVJB> RB9Bl 4&Qg3Y8>k=MQ.1z,k]{\I 49NdrXn}[I0m\5rXA1փyNc1JcRDg=ͦu_[}1b;_%'as:G+wFYG_ѧ϶yc C1;磋;=l5;{R^ ->nK|: -==t=+_HݪC{_Ԟt}2mct@?Oi< 5զG~SCUO;~`(9BQJO,+Jw

      s:kx&u׾#cжӞ+m<D>=l(vv|]"Y~%[/ck}VS8yk;UIOz;3{ N{0鐸}+s"1Tt~^%"G+NGCl[{;lĽ7P<w9wݷ{?1s^YݐY0-W&=ey[ߪ^?m^=A -=o`ӡsgўlh2fzoN߻fm%7}n_`!DRO"y2s0ѫyNXWZyw6|ӃyNН,jf; FM}zE~4!BO|_/e=Nfz~C`!r|2dOGEZ߃$zud=>_z_t;1O;]󣭷(:CysWL|O]wsS~u7:좹#}i VC -mڽxee)q:<鷤_ד]v쩶qJ_5 m75/kebٻoEk>)mDtI"ӛ]]&U;(?- r:-ϯZwS0soQ:>y)z$;|zy5nE ub`OoH~mܪo9A3mJPMڼQ}nOmcۧ 3UmF?$#4~>rvؓ˰lE}q -O+. R @v56t ++9!Tӹ" $Ssq1UFZ>MdqP墉_. ?È8 edEvاԶcP売nR~[(t>]`"Kq{1IA \5źb3@CӶ[]ԂR(HuMLGssjӹ&ӦKZIwn oT{ +MJ*QeԖCL'Ft0/D)ڠ3Z:f$SŒ.l4[{Te) :Ԇgd72t+#BsK=PZ.ԑ/ԶqzTIUDK' "K'GU'B*ӮZ%ilV񼑨U1\ H[Z\Y^2&}"ݚLJ},%1ˊ*NVڧr%bkb[27;m{Iw[mbW}qdr '6ӋC]a &n4eVv>A͸/ySڪNt ?H[b(Gڌ-T֙d;s@^T1*BH {!i -f_U; +x][,~_1wt@08`8!sap򐿟-Z]=;eLWR]$hYKSJ9wpZ8yCH`71_No_Nu}6Shwrv)FUJi+b4>'bΒ +f۪"p9yI31IP%a]v0D$GAF)QCs:IgR6YEt4)Dty +!$lYiIa)I[MQbU;Y%t%Q[TPZe;u:bO*IM+УH! +:[Yot8I:1%VY-Q'q˓!K\ L'F#jK\8L&]Q'SwAKF“J`Q'IK\2P x{ wVUa-6 @n+i2` +IU-,J,qAҰ)qA$0I8! +6c dB>Q&\{ DlqI\z6' - -$.@D0e[E8؂HQ0ٔsD0W%]0SkQQ݄XK\Ԕ%.O.I\3Nₘa dK: [dK\H:%.H  YfP`\tN<3I\\(T3M0- >4`&9X$.Ht3I\l1H\l|3J\lA'qAVa0Y8tJI\u|8 /i$.Va)o 4ߌd[Z}%"<N_ßϧo_}.uXri=Qj~DF}4ί硌AyÐ2CaײZ(^g?.Ne[͠9%Xs75M,OKY",] 2ti_j"- bT݃y \'ߛ!5=ԺþO. $ڻFz&=s逬V"G$|e\ӓñ;e)WY%C={=}[3 4mP߇_lE#/48ͭY<ckX}=:"|й\9ȭAy,9-Q½Xk2 P{bdwy4G!v^_uR4~iJoصa+qa> qwij<boij{:OA<nĩ<+̔.N'=H<&=8:ѐl߶D{0NocxgO3j c/3<1YKCN]l9̊*NE-;'Spl<!TO?1k*Z 2W bT&]rRy8^ks ~#~̽=&7n5؃y zZy2gu:!Š ]q: jBYT qVl>y$45X=|=~k\QZ&GjsWGQq! iwVx zAy8$_q0 =d{l{\XԲ;cu!Fmw>Kvw42X=0}cwiL/~ <Ψz[<2%{{ɛ3ۑQhg$L4P/qD)׳gc5}_Ϸp,ϣX,vmOtԑ&v[WrFE5j Bh[\VTZ⯿7#[ӵEԽaOzbzwF/_eSu~Zgz8.v:,ݥP{!'o̺l~UhM,\fd谘-NʖNlZl/Tv.Oږ,}ٖS쯾 ^AۡؽU_ۂaɛnT9|3W 8ͯU_iJlcx$?[IGG닶foSZDD/[j s#Vä2W3TX/R%BVnN!Ô=L/mᗽ!SMt>T[7r p/.D>ovX~wɠ%r>/p19))=Ā=U@cm@e:yjң_^)ΚCydָ/uGЛ 3h 0~ }!fuxhkn=@A[v^Ir)k{p`GuqyZH^qu=qH?,[fק=O?~do:b>x0σ5љkK1QOV*<@XlYo\}$~1<RU>پ?~kgI|HjOZz`vl> endobj 576 0 obj << -/Filter /FlateDecode -/Length 4718 ->> -stream -x][q~_V&Y>8A L`6:/J-uX݃nUR$?~,Ԕ*N!~xQCp --jet]`!$g_e_\{G_͐7]UCPNP%&Aq^Py=)I*5v -0æ$̰DAa٠iJ0m%AF)QCdvG{Igc2It0hj%].J: [\RZ9ⴵJK1H:[ȓu@.I.+:آҒ.RV%T q3 .)IMuQ$-^$`#e$<((VóiI`1:؂xآ(3h`^80dD&` I4`OAR:%" [-3WJV2 $. -ƒ@*i |kf* K[  (% KN $. .9o$. .%. .Y$.]"u8$qVA 42`TK\ &F%qkQAwCk2XK\ %z]P=t$.@a["qO`A%.p]1|. :Džy^IBE8.3J\ xWVjI&) x~p4 Z. *(qX$. d<(x.$q*G$q* GF5a -s BҁwK:R!I\lJ\ L>!%.IAON₠ p,Q[l(qA0 AxCl\-%. 1Y+qAp1ft-"t:H\k "& % `tJ\lTK !*81p#w_-m$c/X|/r?Y7iLx\ζ-a#BjFjtc#cMEMl3[fgb1VE[Kk# a3Dcf@׀/05/嗿v_qF)h b:*{ßlgwQO7}= -;4LW$Dz\X]N?oO&&ZZedz> WӼ5;8~ -c|\l]8ڠͪk!HˮɽmSQ\ۨ^|45iA(]jV]n/e(:$zRW.6A{]_}۫[y\lq-U+:W >H2eTzm81p;y4S> Z;P2LCP R5R—F2 ?wo2;h73.d_NS7fҗw+]!2NiR9 RAJAۍΒ -sv̸dH̘mYQ`ێ53wD(.g!+۴`ڎq66Zc(T4cyΆV^A_# -RoQ`䌑1 pYZ(gԼZŦ#uIxRZky:{?c9ӷPkuK2a`ӡf=Ϲf4,U9J^e>=TOp+#{[ثwxGϽu˝Η#3rm͏;s:>>Y_ovdo73z/]7Py0Py|rKiVOO7|F̀gdG4a,<̭IO/$4lו#n4״/crdK|1r͞zviu,wjca:rluwK6s0uYSfoU]Dxm2{k.@ʟF7u_7ߛ-Py$>\Q*ٴ;]|.VՃyN}"2 Nan(רhΩxdO=ty*niOj5beMuN+O'w;"-E7D>\|Y>"=Q۰Xo$fz{yΆ޸T}NBm> ߣDҽmX|~.nW2bǃyNTS[?k@q >%s;~흻+u|ߏyj] 4Az;O})R~==P.ܼg5.zYyΆĴ7$E9"mo0۶5J!#4=c=t=c}wyhl}Zv+OaOV9jwK3V7įQ9ZkDYg_wOforl燒-S>.j9j ۔7Jvpo?Eo(h8M`-+v>'7O]AW 陲r&Or.K}z뾶gF!mAnжNs;_|zgGrVSu>i^8hïz;u!]d2L:wn/C>9c113j7TGS._b=(fUղ. b CZ$7k3WQ|J6>˪ɰcł9^jГa|5`VӶ[]& Zb3k&]/iMvAR~sF)QUFQJ]IYqD N-QGa,@5]*"JsuBM[TzҠNv }4I#׹ccb.֙Ԯqrzr8& SfHJym+v*YN徲z@vݥCKG%gҭkͤ]uyLRN[0_٥K%MlT]ZeRhFY\fke'~EX&.eU=i~;Le"o_{rUTn%"Ӧ~ҺmU#RWU ]Nl*tgmыՑֱi xIq|Z,d_E\Ʀ$_"qIے5]F\ⲫ05ff2 Jj׳ -⺺΍Kj:ۖپ"˭/4G0> `i*}掠a,'K)_e]s(Z&oZusӦFs-h'-۔"UZJ"%bn-b/S4_vNtUZ.x[ΡN՗ԶTd^ffoj*SQ *r$D,V2ɪ˯ -6v܏#"%Vפ9JF&C]Qͻr&=B(9B2VߦJF~ \P&Oi>js -endstream -endobj -577 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 576 0 R -/Resources 4 0 R -/Annots [ 578 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -578 0 obj -<< /Type /Annot /Subtype /Link -/Rect [ 101.433071 713.673057 101.433071 694.923057 ] +/Rect [ 101.433071 270.123057 101.433071 251.373057 ] /BS << /W 0 >> /Dest (cb68-1) >> endobj +577 0 obj +<< +/Filter /FlateDecode +/Length 4725 +>> +stream +x][,~_Qφu `16xYbOʹc?e.UigÞNUF)}Tfw +R"]o?_~HĿ!`PW% s/|ڻum˟u4j^SR>x/-PIe{mrJcT0z4WyA1XN3H0䕙"^*ZϨJK`$2)+q: QGVS^s:ctQ8lt[lYbtLduEo8-]-@W`uE:8]4@"t20ii HNauQ$-N`5Rs:[GA"{AQG:A:DAt\ӊ##a%1Q0rYl18.0 M%%|KR9 fJ GP.9.0\t1=kЮ8.0]CJr\@]c0* kxHs\^X:qwuqw4xW[7swjҎE$ wA!w` iq +n "?fL +q\`*X]ʣřqVʹqb2X.3p\Q5 fjNU:J ,x~p +߄.B8.]ВL c!r\#+18$=9._-3 ++zӁwM&'@/Xs\E \>V-^B`AY' Xhbkbkx"*x.` ~w_`<;ÅY-q*eyvXn֍~35ݪRW~OF:N7Sv!CtW|!C7E3EtW3.N t=+ȮE 4r]hHYBnA8&ӥXա*&#/3ܼMhޜ'6N#K/ qs::.B4ݗ!7s_=uđ icyب N5 )jd\~7Htgn4W6]R!R$9ޙ?ApsAȠF1ΟYun[cѺI*w9;CVnYgYLݻ+#wg7CHC28s~=Mcqh,|ߟצ-{~lȝx+mDmPۊ8s:oO)Hrr} M?Q0|z:cGM<}se(sZ;qwGW|ۺurڴ/:҂F[2'<Ꮌa㫽ڼ__֣}ա>vw\$Vy>sp>)mV ȝyNᱞM>ϣ+yΆ*k;{fQ} 3鐲q+~3xav/jO\vMWW^K*+&wX`ێ+'9^Vkޙth>p ͐pto܁=C|O"#kfHR{9R7aI1f<";w9"ݾ;Yڍ|GZۧ. h_]9}$?S/׹w9R7|w̭hNvݗYpn霾 +q;><'s; a}v5\Nfa=tW}A>#=gݙt;OsG"U+\}B.o{X@OڙtH~.)'O͸1~xm=L\@ob3{ BOݫQsT+尌6PQo~p k8f6~lyΆҸrOvwN0>𘀭g s:;; خ{>O=k`w9Z70d=PTrW3S{oGmW?5醽}D(u3tb |m;9ꮟBdw9#OHw|$x^r+;=E!d%?59-R]}"h>\7ׂxN mryHf _>_qM=݈CDpcJѧw$ovUJ݃I Pc󻱙).#5Q* Jw RZw erB&t+OIvg(6`9̺헋IEWG"RARа꺐sx}/%Fe^^urs0e/*H퟈S9UvIo%FLAwp)KYr"}JcRlR~̉^{Ō9KFqzpf#SK=Z7z&],XoԶrz4q/Un̲*l&~(*J￫G46xH!i.}l^*H&}"ݒD4Y#1HT +8QXn•Pf#P]巉iPseN5p*v;Z/= Yx&6 !WRZٮVa *46h-4<~Y7. Ӝ6VGpFw^ i^2EmiJiDMxK8@g'kKFEJ5ɲy4;϶4g*k6;K=2vy* S1QFkLNpBB9g=V2XI[C1+m7(ⶢ)m|,-J5 +4'g #BЧ+e KņgId?q +endstream +endobj +578 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 577 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj 579 0 obj << /Filter /FlateDecode -/Length 4921 +/Length 4962 >> stream -x][亍~_QAlv䡧f:O}ؿeKe j4zLBQ'U)~tQS -JEa_rq:?)fob]pɋ]uL9_S V`y?h|XAOb b۲"p9y11I`%a]vD$GF)As<gR6YEt4)Dxy -!$dYi!)YMQbU"ċ@;Y%J"v99'2x*Ŵ'UO6Ê$( d gYUFY#Ɣjhu[eŘDdK`dQ1H4.I`b\6NK -'`d?Vi*]jrEdIX` dA ,Y ,Z$,[oA J ĵ)8 , %,\ 씰tܣk}0Xu)HX`i%aZ"%,:NV'+aZed$,N ale2)) p$$,p]8a Z px Aڹ+#ag0 Do ;Y`X dHX:c4j) H&p5*(B80͆S$"!VкH1g%Viӏ_׿O?J!nקPal(JKrԭe[K9kNy]UMz392*mٰeTe6k=E&sdLg?OQ}v|ʷ?|skqPLM ̌CS{:LM7ns"Ӎ[YwS}-L7.A'L3+S*1ݣzl] Қ33#ֶ 1CǡI8=Xۺ+mھOy:vwy܌iC/zֹQ`36 %7ϛ\#AkS8v<'_Ly:k뎡иVղ<\YhUa߸~kz~ -0VӟxBڳT/{γY]q\;cy_vn?7k;c.7[:Ogj~V8z{guo+r!U,ԶϾt_]Y?ĕ5FJ&mv~@dă$@re}n5wsN&m] :Oy63k> -M/j3Ճ殃=? qg;/zYA&"6vmw=}O$=WM=l=:Y, scH^ MOy: =ȯ̲FeBX9:;Yz4X:fv1ffDWqx\ktMb?jjZ7e>`{qd);Yrm".qY>:>!w?<׶>3L2^1Id9k|/S)spJ+ _\UN2a&r-Ho7ʹ=eN. m3ܓN1P},6>ҽ -A6:((gBڞn[gͭ"_F7RĤDxNǖbʁ{Nvӧ24tZVA& y:tT?YI}){ا^楺դCSfAh==iYݠf=yޖդ2)g:g9es혓ur2o9fU(i-y떐˒^@j|>ｇOfo꬟~d'.vg,Eđ?3_i%=p[ٽ#҇Fa#k=W5ŵwVp0w=`dg[}=x([6m)l/pT]qY:͢xmIAҚ90oxX& lBЏh(bWͲ_?Sk=e5kŒ]_O&^g5ݴ0Kiseojkg ̋Y1lK(Vrr -i҆D'5|2NiES|!O#C4Oe&U!#D#B[d".Uk νh7dXZ>&Vsl9ipX f[2^Mz!w".WBF :^7+UDźdE&_/e3 o^/}qQ -Ld4$۲aDwNqc^^]u`%uCPݸ452;۠| {uptWFRlߒI\QѾ (.YK wTO;>b̍KyoJ+`E[~vwWB?yC]DmިoFx2Ֆ˰l{-7jmYlsr讅[]peԫ-+MJؔv׼% 9ѩ^I^Q]/i+m۷[]w+낄^oJ>ΐuJ՟ ѩh-RG_]bw׹+fDj阜*jFY7015UQ8)@HuSLP, v)To&R,'=VوP +x][q~_Vx@ &D]N#鬝| KEIG%%-N)I[  3wL-$%qop qI+@WԥI%.p]В"Dԅ @'?T$.]嬕wuF#q0l1 guRL!J%xW$.]6%.&J\'xFiJ!x |Ru~µ ((K +$q)%.Xc$.e4o1<-l(qlH<1ft-"t:H\MA/q~bwI& B-*`*g.4l-q<]贖 oPh"L$. XM-Hq%.'v%.0A u4!qm'qsDl$.p%.e$.69 $[I\M4R$o(qA +&BStm QC%QG5n.uة':n(؝:_u>-}@4ߚuh/뻁{w(Kv>@<_mv Y瞧G-` d^h _uyrڂr_y:J݃^XU]m Bu=Q/;O4o711Ok=uO^,Yv[FkE;1;78m[6!;۷f#Vo0嗴VWԓeTj7:za+?۹Ww6K5/4DKvi#ۍ8mZx3o[NҞ>͞,ۡڽp{7lM]qPV_ [&Vw֘{e{( fȘ*i^;)Λ/:tnCmv=mS1; B)s[.긐ۊy~T}*nM{I_Crl׽6jf=ok[FxrT'Ǟmʶ+X/e+w9S~< +?ѡpސ`(ѡ =˝Vo (@bُ%B(7żhQngR/ע-Ha!ͷsS򙺴/ʜiQ'Qv.ϓ-lA^b\v!f[q+u%_> vâS__N#M Ww^וTwH=鐚vPB.GvЩ-grͰ⮡݀ b\/QQFֲ%2͒'yG[}lCWZ"y2ϳ!]8=PYPg Ku4u] wP|? 3bQx.ӡ(F8[1%'"kɞKnw2^A5 j3"}o'):!}>wC=9>}0Lvzha;_92C a?jG3D>y:4duOBT|,;{+d]Y+^ᯞlȌ'ڟ?7|6jQ~:?{vsy >aݽwFSWV}Ho?ػ?zzrߨz'^QQw72wP~AƀPe '(ǧGzw|dýOsRrNQ{.ӡOU2ZU% +WW> )ʱ㞽T[=1 8vHz/Oy6䥃}q =gnaW /C%~<O?SA#떫~M m6 }`>|<}e(9zV4ukg#y}ͣv;/|,`KޚZE\ \Rh| GSC_8m^uUX&9Qy%i{0UQZB|WxK,#a#My)?/yQ+ۨ8׈_9-pZvD|܁_^W;{Va~헋'=|گr 8 ȧDZҥtnX}3/5 +Zc6s7K_r|щ&n|B>]eq4墉. bvhÁWU˂ m 4R/h_+w]g*l>oX"[1߽"]|5_V i[-X[ VPG󹳵|V])j(}|zy)QUf;Rv~D A Y]0 QMJ:At\PSŖ5o4X^ݺT0J7F-_b>#nFx8#..] + +zʭ^oE'hgpU̓hSpUf:$vͥC I-vMC*1IUXuE]3\ U15P~[Uje^wpw&;zq=Hjo-|FK%MlTZeRhFoY\Fke' 2iƽ]zӜj> ]Pq*[ʭ+q?ēb}"æhuli]ACǍZvՈԕAuBڰ +]m2nGxZ:26aϗg‡ p.c6%_"qI۔-.#.BqUe+3}%~r]EFm:jl_tE_0ҴG0`i*}XZ O|חuα(2x[ ղl7lurh.zvز- \_)٪2QTLY-14K(R>EoiJmDߤrˌW%[ 9S-e% }*ٶnZ]fkw 3U-ۤ|gyU)UWBtlc&wTB&b4pHY+kBwLd +P6 t*~(gKJ@X +j46+A'c^~_F!|&j$?2 endstream endobj 580 0 obj @@ -7025,7 +7020,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 270.123057 101.433071 251.373057 ] +/Rect [ 101.433071 570.123057 101.433071 551.373057 ] /BS << /W 0 >> @@ -7035,22 +7030,20 @@ endobj 582 0 obj << /Filter /FlateDecode -/Length 4714 +/Length 4847 >> stream -x]ێ}gI@^ KMt7sz$6p*~l{XE9=X@pu.U -)r^!x[!#zetgf;8c[õm?vpiOX'ܛ~_`ڌJZ'ݻ5Kyt[0e,]m] -7,~۴oulu-c9CpuӃŗ^f|ms4|ho7}uW+.Ғa}>:;~)I]FL'٘p$TY6T5a-Jh^<69VB`g޹w7߽0PU=%҃tZ\`cájŻꂈ@.\oGzgwuuDjM[1ѐH{bVUe Rh~sӡ+Qzj,ǎS+G=8GlAhw/k)7fՍy~c"2$nbs5J{T2O.߃;}jOG79zo4XဢKSn*=w>BwD69BW.Eѹ#ҟguO3yh/^ozXo2q55U_I_6J3f2Уm_W=ns8ĮOm6jG5i89WOWgwis&Pdskݖp]BizCE(3xp`c.LmTr'O]'7صƕF+찠_!-ѐhW⦯$ەr[۶lU#k(̼ns8nV36xI~{wkFYy - ɧ[+_%Wxecáu?*oc&:}^Xns4ԺUJX]m_§yybЍy۾gI"[uiO+34M!Nɮ0M7<g1Mڡ柡cD̀jS}[x.;bzGtwߟٿos8ony?(,H-Ȯ^rk.z-E!m6WG~RӮ]A{69o mj9tv:.yCuw^ kC{YoơN0 iyi2{Ȍ2sL9{F?/yK;HBL`;l3KЀծOt`cw%6w7D8A70ŷǦ}?nJe"c.XJ4f۷^֞ey{yƍ1ק´Ź@Iۮjb zi~cO&^"Rw+Zo/BX5' ⽝=_/E׹zv_h NRf嚺z#oi`GV -r7`e;+q]/='jᆍLjgv1ᐼ򵌴ife29vmut?W˻VuKtisB/[Î}+ֳ=(1~#ޜ~7qyzw q%zɫWkf5ژp^~޽^_io} f7ݘp]~fQ~!tg*6!Aԇmyk-5sL]w;}if{ip o~7-:*>r9@m5 -xc0駇1LAQа꼐s8cI5J,A鐪ŘN*? r/N57p(KYFEvWzd?R8Q|7)>FD4ms"Ssq{)(NA+XmhڴqUH6B;ʦ*&ۣҩm\ۦSM7yKx9ZϬ4ʭeQcT,RS1h, jWa@2%]ĦK|Ij֘[RN4<#htx3F$SK=Z7z&)#O3m -i3Z!5q/U|OYΟJ_ib2R zU+Ic]aõ2mKy_0۶ -IH.-66M}%*1"Nۧpe+TWŶ@y"v2T\S m)]VKt ``> /fzq~ȕTe5jH+>)`?;R9;*CTO1U>:㶪3\N^R gLT fXݪ20Q;I3tQPi;QJ5N)A=Mu:v +i%]B>I:[|VZysJgSt`-&E+"l1Nt ]ItN>'D]N:䓵Ji=y`ӊ:(tR|u[e$-?">VI1P^U2P^VQ3P _Z#0+]LPj%n(/1yoQ!bL1,Ny_;#&}zY)?BI_a5oQ)3YCF܍ԠeӍG+a8X aDtE1nyn!se[xWwy/[mLIKHi  wfyG (,:c(#^WnWN Ŋyo]2hߟ~??O^OB)g~_ta]_y3), Uבz,!z\w hj=|#V}dm)_X>3> wPz9,ny:ވ]oCC=ZƨDIӅM;h|``CtKeM]; eV_-el_d?k{<r8bqnB>)Ockk={,~m;IQ.ؾ'sֈ(;G:(/lD;I,oN CMutH~bE8sڗ9?'97CV8ck{--vFm+>t}8#]-ތZd4b܃y z)~s#wmW=\S*{gM<#y}t/=;UWйY)]X;>yLzpu0!\H~ms98|?ly0A/Oޱ={бU$ʸҩ{ #GB8U2E-|Fi[6R{KFโy s{;!.3 +tX bBtR]|? sym9Pt鶜P|sŎ]XO< ڠ Y({f/s331]lIϵd=mib{^k5+û阢?٤Y.蛆!lxmkE^:jnkl +moz?r[~3_> v~$Қ<$ٰAfij7'oGmygo,6SV悑RcƏO?c?z\Wnl,,Cq<obApo7ҰTz5hٔ=wn9L*Cj3A-`Q(ѿR98ў[}GIc-7=d/(;[κs< ׅ(Vn7p5y FYr WhlY bg*X{63QA&͸Oe3ZLq}X>i~y7iܺ^ޔeNU؆ hui}ECǍa|zvՉԍAur>dbӠkeW-Ծ|ikhqL'WpuOgV$(iҡue/-[I4דw #v,/J+X_=OPGI7,2/ۜc˺Vec϶ Z(mIyV։dZl-IRl1E{^iNW&-[g-y[zK&Ax&u=mn]wmϬzdz6I=2v<î0Q;%*q;H+5;&g^g*vv]:e%6>[Af'Ϯ> endobj 584 0 obj << -/Filter /FlateDecode -/Length 4834 ->> -stream -x]َ$q}g7%$0$ۀ%ACOm F_Wz3$+r֨dO+#D`2K_~/bLNjSS.7 䣻 ve\{G_͔7]=N!JP)msSyA[LIR н* JI*ADAa* 4I* J+ءR("kvG{Igc2It0NK4y]t[\RZ94tl u`%]-]-@WuEy%]KH%T ^g\VI:'lZQNAK8#Άjxt[esŘ@%0% -$0!L I$`(RX4QVD>-UőjBDX[@ka!+q"qݒJZ % 3k' ,(PJXpwJ\`AA ֵ ,hRX%$. )` ,qq:Z k -xH\^C/q25Q5S Ơk2xא(Gxdw`%.|-wu'iդc8>Q&¸E+O$qb8.3J\0 xW[ԒMR8.'q0i8`~tE]TQ- 0 O*ID]$-qxRC%.]LIUZ Q'\; Dl@MQ``5F`` \ LIp[)J\&b" 8ZUy3u:$.&LZA/q~bwI& B-*`*g.4l-q<]贖 oPh"V^I\kI4#(qA$?(q V`JQ[@x$.M,sDl$.r3J\#l1H\lz3H\l'qAR~b7Y8tJI\tzӐތ$Oz^o E8MI$7NH=7p3ބG/"7.ft]x^\` VZ+ deg# -0!lĘI L,VJ (/19ԇ<0g70,}]sdv#/?}{.?ɑ  -$tqc'f&)'R3R]?,l:rc]9n\?(NXc}`xl&?!]-ښdy>VLXB݁< Am6{.mk$w/& ptbC3? J-z -ĺH*/>]@s ^vӘ8~?w?^3i{ï?S\d~kPankhѽ.SQWfmWԺ|,YtTliJ2k͞ZΗV?Tt˿|Z,2xTQ\)#R7p7їZAPFC~n'C> Ns?$d(.ңy2ϳ+]rt۽SPD=B^CˮyˏQdBn@aiAY&#_1 3zm$qȨ@h-X|#tȥ]}d2L[LY)"zՊݪD']mbn_of".Ųg۰k*7 IKܪsZ~}.w:_֌ír_nNcps|jW-iol^^?}qC* PgsPr /UU]M6XK۹ܞԹ<o9۽{/s C?3ma]*=cZ3;lf\_mO_/GZI4Lq|?Iw>fݭۦbHw6_$*#7,oƣmsynpl|{T #u8Ȗ,%xe/zcȿEOgg`KS4a7NyTgR[ PbƁQiQW/kvᶽ]~'[!k(cZ~{E2a\C/UѴu-rн,3˺{Ωi=]ѳ7@hk~dC۾M#[>bQ'+k3*gl ~#jQۧ63TFkh>#93a-Yh=zg>G.%7P|@ǧb'iQx.ӡpo>x[yDFuzYEH|i2i֯^ 3OcG+!l bj O<}чxﳀ-HsyAjr͑e7Xj~D>fϝcigu23zow}Py} v~lWβ+mu%'#gyQ^N{zGN?3|"Zg9t:y0Qm7wy!6OWoF/帅xo6y$>\Q*ln<wJѬz2ӡdDj9cv|1{|@;vFOy:<7DCsS'ѿOwDNy6ju`m)L w [ w/ ;=8gyVGu^uR=Lr@_zxm/=j=aHgq|4x9_acf$Fj>2}W~»{'U프W]U|Wݺふr̮gu.-gnt~ǩq҆_~4f8ro~7 bv(@壪eg SSZW^ƕd7*l~'\ DN|jҋߞ'\j -V i[-X[ ݽPu5bm֦MXMNw_ҚuvAvR~gs)QUf;Rv~D N Y]/ga,@.tv-S-k*-LiP6 u/ uQ|\{k;ܘ;⨎&~ v++녶+jxiKSah7U)3OBٮZ%<6xHW!4k.Bl^:*!=nM][l%횬:&Jkb>+{*F&vo+qաTľr[/5ȵ[0_<(fRIUgVY'l[Zى|lLqo\4g3|[%,}~B//œq*[ʭ+q?XēbV"æhuli]ACǍZvՈԕAuBڰ -]m2nGxZ:2_7mž/m9>ίP-Vᢿ\ƦmJvE⊓)Z2]F\ⲫ05Vf2 Jjӳw庺΍KtԦپ"w% l`}ie`Wb/#ګci%> -endobj -586 0 obj -<< /Type /Annot /Subtype /Link -/Rect [ 101.433071 536.373057 101.433071 517.623057 ] +/Rect [ 101.433071 142.623057 101.433071 123.873057 ] /BS << /W 0 >> /Dest (cb74-1) >> endobj +585 0 obj +<< +/Filter /FlateDecode +/Length 4736 +>> +stream +x]ێ丑}ϯg#~f60@/ᇮ)5xeR %ʫw#wzE +S,Fx{肽Bva\#j)iTF>x/,P :FKS 2k&˩`Q*03RUf(/ 2ZϨR `0F+F'P)9Udu:zpH+9]s6p:[lYb1th-*xuJrfuQh$-N`Bq: [ 8xj[n-t( -h|-;Ѓ%p$L0c` hx@ h[qh [ z.-: -HqְEq 5"J 48. \)8.`\@rqjp'9.`]m@v  F + xWkdu8h4.:`eP! xWa8.0]1:?j xWY\7rwUF9 #Xo +;[@`Ni pA-wei CtX h>VQLE-ҹqbX.3p\0* ,xWjԜ+UX.q0H8`|tY]D  -) 0 +"IX$qxC9.p] Vk xW=8._-ӧB)8xWH0 +#K&Γ@ `/Xq\tpXpl9. buxq!8. +h8. +e%ovz[v~`` 3v?rXzgkÇ; u(c;09_S:ʗu/Uz9餞5,[R'˛mSNҏyS4:5]9/oOz?OM6rA70MT@\:_,Cb,J!(kH5֌WlSS/K.`-ނ^1fEbݮҙ百5wHƐj+Tk6s:[/?7i߳\Wϗ;Vi_fLΘnAۇmu|Lߜק7PfFDY_ 7{eu.33 ۾TjKi%̈aske$F5BO nKYEyjܣm9Oöt;kYcVLo|@jT#/ِ.rᕤk= jZ6CƼ} _BI%?)淚č'+?Ɩ>F˟B&KhOٙtԻzjjdĭk}}Ow,Y e4o~ƪA`NGa_ӡ_-c*$lqz^ԖXd-Ys2FWe?Lo<m]d[u>Aư>y>dے~Y+U-6~s.-xٟuߟ3)C%{z+Qs62;eYh9"z#/hcJ-OMygu;g=bs6;>[D8#ѝz6w9ޕ?zApsFNϨC_md/k +Gw[I!Bhs64}?v~a͹2̧U8nݙZ\YX![?y:"kc%3y௾.+ټ VQZ`ٳT3P{O}7z{UѵcI\\gb=}p޹o {yNЃk}vuҊyn(NwWZ,!'djVm,u|/#ۮZuhWqD;4v}yΆZ{ +-H~:>s(k +&sl{ޭTlbYO41]3l{R+\hju \+# EiƠH2s:ʓfI;}򙒿.+?eQgm l>oՙtH==g&y۷5@+; IV#sG#{ ѽvd1Ti|{1Һ3k='$&ˣӽN?sٕ=f~xal^ܸ. RўWgZb㕶P BI+9ǝBͩC'F{L;Vs_"OQ˶ mh1p)L v]bRA?c>9|loS6ڀÈH[PL3Btr-ŴYf|)%!,'4ur’P,v-UqELGJ\f몓UW͹']PnoKJDʨ6 br;1ۅ~'ҩ 3V&aH@29]L¦fsK*1|1@]\lYiߪ~.ŎZ nJxX{b]gR&B]7(x)RZ8BL2&f)1vRQ)f/+:i|I[U>c/H75VUV}LIeXeF]\Y E2P~[6wU=dw[.s[-%ە0q`3R!EDJaR(Bo8NqY:7.?_aNi"~8-i˒G?sShǕl2.HFN1mbTBe*/bJZАq*6%(ĞR̠2kk-uXU#5gۦ ӡNb4형A}98 Eː|N#JZtIo2>)cla&.$W=oTVuPtΔa>uWQ% Fօƅ=w}6٥@LYVK4/[1G_ uRC\{:;9k,jVP l]IEitH|FlrsT-|)约m*m*nΛF-ξ\()/sg))u6˲h{.C\LEfW)GΔ:p HFrwsCzyc%H%9x0 xN6og* HиBTq]6e[OƿDq +endstream +endobj +586 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 585 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj 587 0 obj << /Filter /FlateDecode -/Length 4924 +/Length 4893 >> stream -x]ێ$q}g`!_AKᇝm F>JKմ42HD02+S_~R1/5EX?V.N^g8M ~ 粎)`'R9;*CTO1UN1gI3|tƭUfΘ$̰.jVeav +x]]$}_Qφ,aw1?Lܶ1}aO(SR22+P}BGG!2K_~/9=cpO/j^_I(?7V.N^'8M ׷ .y˟~uu}5Sh珤rv)FUJi+b4>'41gI3|tmUfΘ$̰.jUeav f죠 -vh!9kSIgR6YEt4)Dty -!$lYiIa)I[MQbU`tKJv99'2t*Ŵ'UNVaEaBt峨-*#,lqt ocJj5ZybLt`%0$ - -$01N.'Ivr%LʓJ4`\Q4tFKD`l.HL`5lqX$.l ,֩%.[tpaqm -N kX.{uF ڵ. ,x:$.p]kQSXdu8*J\XFF ɤ$.p]wM uq88swWF5 h -r8[@Cghl2K$.]5 tA '#F\XI%.]8*+q> H\SK:6YI\äH\6i芺< Z2 O*ID]$-qxRC%.],qA*oQ[l2 VXV'e4fXҁwY%)qA$0I8! -6c dB>Q&{ DlqI\z6' - -$.@D0e[E8؂HQ0ٔsDèJ`Aע.A1 XK\Ԕ%.O.I\3Nₘa pES2%-%.@ $[ J\L.3( ࡱPK:h$.H.L*J\e&RЄl{ fQ[wdh$.H e$.6i%. - ⓸ 0Q,qh:$.:aiXLdOXoF -!-nIo$]-&; rL ~Hߌb3Iҁw p&"[io@>">vI(PoS - oŜILL,SpPj% [q=STp)If, 9z1Q˟.dFPJ;WX&c=oӷ8Vۦ5S- ܑi  V@ P'bl+(. ي{n2hO?_~?c>]oVioqXmr3Ųz|vr+-]}x;n234Bs6^nW;4c}L970Fg~~>-AX"1H%*_ۿ\sޅ+U(l~ZNSvNvx;˭ wYtj\2 HG j u Qo$1DTr"D2VL;Jd28!!\C/Zkw -’ ]|,+@&Zsm +ќ+{ǦJ;#\C~5vDn[I_a6mۺ^n"t[%su^186cR6hFF3a0Ӄ7mkQ;&"Ǔ^Pj51 -_!z=\]d72Z8ImH`vl:y]RxZ<yړu^yگ}kF`uE ?mH;7ʓŶcC z{A3>ĉyޙ{;zmeJP)瞫o0m~AꟸodC}gg| -u:g:ޟu0;avr{12EOy9ddR_lG!w<+@M=^r>ȥ~~z}*w>[?<j o,kaw4~-> -,uvLtsu^k㞙]{;ciGyݻGe>7ygr;:Z 9}>:!W?|_ۯm}f,\_u7Oy9Dǚ9[ѐ6 ^|g_XTFc|"p#6??7cCkH1|:/܃|LZW2EGṻgmHhS`;dO͊5v4_<NwQb/ I[G4\~1pocy FK#KJ~^l-sҶw}PC (+j#f="Yu{ s7aѾZzܾg}in'Xz($=x|N:¡)m١GaB@3! mߑ\"ƙ"js3>e\ϕq-O GCLElE(|?1 -Ɏv̬ƌ3I=Uqqc*pwIem ݹb^h,zAeuz<?'=0,琉sJ萘> =0LO{osou746O> JM.ӵkɢ>Lc CG78(};[\K0z!nQu< -=F%}|~]nPFnaAg68,r@5p]?'-tD6)&#=YenOگbճG<{:׆ehܴycӲ)kWYxJs~_.<8\G&mRWSWzXyR:M n,)zs=L#?R&gpf5$.QE Q~W*9A\$?֖-L`XNF{,OG ZφZS-{w,Q3赘^MzkdL!oޠe{X[ń~-T.6ڣ5mB6i6l: ]pjSutj2ˌMk6!͓ ]w60Mf^)p -$ZN.b5f*RWu)6d7ߍ=FbƵVƬwm%vG\|Zn'ҥtOf*|5HKQf/Cc'veåcl㥓mR6dLs5HRꚘ(OJ.TtžA}!vTj[]wsql3 .|ފcsj']lTv3&솁{ةLltld6b dtnþzrwSTpOlwW$hw:*7Ca-$@NГO #vn7]e,X=O//PWI7;#i#ҞJDg%Rhɶs8~vlddnRK*[}Wo{e!GWO3k^g:HOɄGtƖ,8ћK,5p\:#Rs%'LUQ eޡ -T}\-+!iN2A卩jsIH[EzA2R:F˜t#.'45F +vh!9kSӃ3z +),"t:Ig^K<|tk甤-Φ(l*Q[LVEb,l-*(-鲝|NΉ J1muF'kzuQ-A,`H: [~$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a +c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& +%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ +CĜ"52cX8Dmѓٝd?vgL׿Weh%C|a`2#h Xb,{(1Us7Km62 n?ld,rc%hOZ*X%krDL탖me>b2' >m İhFW4^|V/7ނ ;ƞF֣:t(eO-M| + xDil64Qn7. Ŋy]2iL_?t~z?r?~_/k\{dqH濴\?׿Յ*KnCy]y+z(KRmQ=-ْQhÏCE{ƨGoo/i βZIqfC<5x%`}M>}2Cֱ0j2tT"dR,.{2ϳWCVEVYϼ{}^ֆ^:ɬ(n>p_HeGݺvPj(=P9vqj@ CH *Z 2a|ėlM7$uL=? MF=tH=jv֨Q?(`5[Gb{1i Г+yDZk5J_Gu23zf1Qk^Y ڐ{cyu :XCKEe؈3m#ng?6񽄓y 8~ˏ?qyW/EƟRG{2( J3.dRвY!յj_4|^wly1ֳgZֱ4fhcu!FmCR]1wt;4FugTF-sSfȈa1<~f10|YCSouc{~sywv<4]K$zcǦĶiR{)aqe)쿊;`mo7'z]{9:ԮM*=7;OI;4k7Zg7{4/#!<<@/uF!;.B>K/12'ew6e=Yl'}z:-s Ced^{3[N3w2ϓ,#Sչ#5xFKtSzYRvIO//aDאgd0OI~g)#* 5glȋ>?4-/~|-<;,yHeȍY7/zN#*ï9yd'A;̪P<~e.ϳ0g&ԑDd*H᭗9x_xĦ}[W<)n;1d'<ĐcOFd;#6st=vs c/>jwbDms2ӡN\9^VDгq|vToC+={k%+Z4'<M>Ms?Y;x)W昩%ݏݽh Eo=WMv:Nve16r餄D-uJ\1WyźªWrF. o+qӷU,hwиcqMnrV&67 VFٮWƄ0Bw}+:Z;, f2 =odQ+yܨqJg2tRLSm0qXW4y׮gWkJT7-C&6 F[ ^lMK[GˣUe:ۧ++WO:2KVa$@J~ǻR]삅tii]e, B`/xNJwPGI7,2/ۜcc/uv,{9}h­.8F4lK+uUN. SUJզdn)-Nb)ӞJs6i:hɶs8:SX2 s7)mmvl{epݐ#SճMw{ΜguR՟Si>&j5|J!C}Mtm> @@ -7162,31 +7146,24 @@ endobj 590 0 obj << /Filter /FlateDecode -/Length 4725 +/Length 4866 >> stream -x]Y~_,>1^ <f󐿟(Uj{cnU(?KY C;s|<}:[) ۳VF# |ʻ um;gGSҞ@*QEԌ{err)ȩ`F T0(Ux3S gTR`u0Dvpht\*:i=8o.98-6 -,l`s:[ӂt(Ndt]tQ6cX]N:%`ւI9X`S:(tN'lduj8-GADe8PA& -q0kTqsV[ Xl1p\z: -Z) -p8.G0D ]]O01xCr:A׬.@'=ޛSk!`s\]f@' >  0 A3t.tRr\l7qAPL'8. $AqA0n W 4&8.@br\X:آ EqAE qIMqAQd @ qAMe8.f j&x̸zs\ lpQXlq NzlQp\fnِ֛@g]L q\7rk{ l@z-V6d <3 _Z#Aepl*Ra?f0F<$#w_5^I6~&==.E򟄃R@Et-qa,aJ}FId#0ѿRݼZ`7IhX[fzEw'tT6vd -lx?~\{:+>a6.0=yLk-HDiݷmّyT|?&ûttZNDi4m5}c8818?,>F2NE\Pj[0 teS7O?|nhVL|xn:7.1>ɦ4P7M(nLl W'+?zɦ r!ٱYp -N[?;log!\As4o_!ywd'oC>>ꕚm'4Hs$(VO rq)KHQB^ߕ4 sTa<-cp{?2*ysY7qGF"MKσT!x pG愺3jZi6DLeŦ@ȡk& - -$SNT*!{OչNѣku&*~4bB}yZwc3_[^MhzY63|fy{pi={ע},dܬ9{ݽ>6WCXAp+%ݝ!j }ћx/;A -gq;gs7.)xsSO4±"x(ckkZ]r|oJb;FKڇQu-9a5y΃WMۍ}y >n>v#.Ն=M9t]KM]%+sٙpkOw,]iehiEՖ3Py}5jnׯuɣVO8s]ؙhUG\l 71x+HlM/x%0Nج~DK\P]4]ڍm.z'f՝y~>2S>5oq}ꯜWMV{ǕѝyލH -. Tz3K};w; nÿ\zwDl^| -C?b;B;:9tW 2WwoWݾޙp݈ ^}%!Ë٠gD-=0УmߖW{ܙpg/lV -'7^Q-s8oW. bu_+xRBw9B/W)ZxO7n(wvq?>!7?j][\{w97o$ەr3MtXꪑ5W -Bs8V 6xI~ޭmٯSXA՝yڍ/B4p(; a?&Oc%:ݙƱC#EP/P_/5y*%l㶍/\FӲ׹b;;aT.$..U[J}1ϠOpi{bzm:&$Tu-+ۯes84 bIݯsygKݮk < N4/L+>lIpV@dn|unzr]4Q{4STwnLO0&h(u㧼ZMEԶm{4m{-Ry+ޒ.mى6wRgٲn3;϶4L5UTlv.g{mq_PKDmJ#;9pML Mh)`?'R9;*CTO1UN1gI3|t]"p9yI31IP%a]ZaI*J+ءR(tON)lh$SN{-BI9ҒS8 Dl1)ZIawKJv99'2t*t3O>Y$֓6Ì ( l gQ[UFY#Ɣjhv[eŘDlK `lQ1H4/I`b\6N"K 'hd?Vi茖*]j0sElI\` lA -Y ,-XЭSYK\`N qL%q (e ,8ׂ;%. ]L(qZk] +XuZI\֢-`d%.p]Uw1 8 +III\&)'q%@ sJ\k28q&H\L%F]P=tJ\&D˟0VN9H\:aD]tDžy /O:,qbx.3I\ U"$3Ct(6ӯ?c=_LYJi +d Gq6 -DRd! |s7R?,?m>cDŽ3ru*h0u6͆ C\ܪo?Ŋ9X/vƟ?|0zSʅ|כ/@m2ϘGhu9j;"*xGO>.nKeJڞ_Q';c\Y}#UpO^/G~dc7sӿZD p#cUރ/Yluo@+*uh(]FR ewnl9.e_>jkk2fqJ۵ ~hOe +/Ӷsrɰyγ; 둿t:? ;RU䍈+@Gn~fHN=f5MGD401=tv7s}]y#%FniY`Ha*mjqFA}/붌^ O_A8K:@:JBC߱:OcuIbGx8cs(")Jy:ėGl4ƭƈ0wXRm5Gm%݃umt. ^ݘe7s3c}e1i1ҽǒF[/K/y_eL+/y6 ݰR9ye!GKuk'ztX5aʇX>[vY0]v`cuQ&B##Ko}g;uU6=7ˌډYu )v_,6mGWcnoˮi㎓Eucs=ImRLY%CLoXCN_ n}u3sÕ6Dͅ\ʍypUfRBmtHɆ=gd#i6 4>wX鐺~bE8xuZ½`]+Nֈέj+ׅss; >t}݇?ynԲb܃uͷcn=}jv}ղrfy}G2yփu }a'Nsdnjta}޺6c҃;u˹~H\tԲcL@/O^=Xлso8ZîVT +Vf6ڼ{yǍh2܏l2t?vJ`C}|;z绲^ өoN| U<%`<Roʁ|!6)@`Cص%{5ZU +eo#3D#j]i]ܻ:fj\5%[3K1yHh~J| '{!vzϓ4 I<4JQ]ߕd{n=P|RV_ 08.7'u.>V|;Ƶ~Spm k[Zv꺜c}Z!Tu2>٤Ye kO"@6zm@j rA]k'l +uw|-m LX~=<-=KEv'/g\ IzMgs.GzP 9(3Cz sŝysܯx0=Ї y^#)p5lBy./9Q!M[M|'ct&]5˻~i)z ]`~;XRgP=h{y*dA_N;W1 t[p삀0Ny,i}}47[gC}Fdwsǂ5٫I/bz}Zr)>T! :^7+UL诅uU{4n.ta3NeMdyKx9[;JD)6UkTYfTnR_Kqm$Silz6jY*\+k9At9|J^5WwS:mjdEz$#֏k1$mvܘ+]]vQ(;W(_DžIut)=hYe +ߤ*͉J*KEK@9Sd% v^Vunw]m4\7$TjCܙ YT)P;u*qFK]v:#Rs%' UQӋeޠ +T}\-+s +42A;zKIH[Ez7Grvi>)?fm endstream endobj 591 0 obj @@ -7203,24 +7180,25 @@ endobj 592 0 obj << /Filter /FlateDecode -/Length 4753 +/Length 4800 >> stream -x]َ%9}_qGKx $4, T4 gzIgR5E2tnFx Ng^}WRHz1Ooo¿buտopw(LN'[0L.Ϸ?~q:)%o N!JP)msSyA&$` dh -0Rt -f1QPEa)hU%a&I3trAPi;QJEdnptFO>&D]N#鬝| KEIG%%-N)I[ %OEMf;,um^Um]a;r:?}u5h/vkY~0L : -GݠFC.¡¢jbW7(toʣiC\1]dP2gz1ϣ+C$ۡKtŤ$&>?W oGAږWVӏݵ&&eU'Si#uR&a:y8t!^Y(X`kNzvUCRs暡}$=#l+A+ыyǁj/i#'^qGkTF*c2^ 9GaAKr{yElz1ϣ!Ǧ EgCAp,3_p>_l9uOW;gGVRf>@#u ڼ˛y-á86+Oc< < 9a[濶/嗲>t\8=eS`7qgykeo1lvv?~Z8r/3h_W^hh'{nw*V1reS`|OM 2h+6xAn Ћy'/*7#Ϣ#O"9D™{b݂.]áhOK }&ޟ_lSϫlceQI^80CqE5c>:k>Ѥ6[D`K4Ejy9.$W Nح0I%~ iLg`(-49Ptc^,Sr3)w̞zyud3*|^'5:v~Yvh0"!Ǧ[NX1.BdNxqQJk۽ wDω-*#{օZ:AЕ@Gܧ޿5/#vM3u,XqfAzd l4bC8LNp?Y'so odo-tsoN,zESmF:ޮV{!gn\ Hif[})Ճ k*x\{t|DQ)h)œ#.y8C^;?OgG.j}ˇ!/y8c=y "{ʳ^eoesꭶbC{nP[ףhx5Goc<qY-[L:u}:Og|q<8L)u~T3gOwbFgdZCI$ -rW.!~-<?vSߕL)nuQQ֣aL.HZ9$?y[\yp~1ϣ!^;$ -~Mo_sͫCϧINZ6ŷ/S6}sɯ nZ^/Crɔ5嗣=iY6loI~mdҝB%]IgNj_ʯ_],M>5#|~WhE?]$ڡ1 odO 01uZ>t|`h\i w%ÌTId[!rzsդ1oՑ7ԮqrzvVqT /M/?ah+gpU̓?heV *^;:$y@Shi;w*f{騄L5uJڹTc늺*f -+\ U15P~^Uje^wpw&;{q=էZn"|b~,4QukufH>gqmI3< gV(K4_7:rǍla*L/{ Nh&ֱu u7kjU#RWU ]a'6F3@4x2?oڄ=_8>/-Vo.c6%߻"qI۔-.#.BqUe+3}%l?]a #6i/r+$mL4~`i*}a,'Km:| ZƞAN-EN[%+"[UZ&J"%b_GKMӮDߤrˌW%[ 9֩ƒQ>wRKil[7.k5C|LU6)_;saAJU~Ne˘Ikl,Bm8^vG5;&V߄& E:WtEoI%%6eͩNP*7e"7vg -f$W +x]ێ8r}ϯFK5a6ᇪ]5f J))j9Bu"H1DF>+_$=Ř/'5/XdY+ +Gw6L!9þ/;׺>)%o;N!JP)msSyAKLIR е* JI*ADAa* 4I* J+ءR("kvG{Igc2It0NK4y]t[\RZ94tl u`%]-]-@WuEy%]KH%T Zg\VI:'lZQAAK8#Άjxv[esŘ@`%0% + $0!L I$`(RX4QVD>-UőjBDX[P@ka!+q"qݒJZ % 3k' ,(PJXpwJ\`AA ֵ ,hRX%$. 𮵨)` ,qq:Z k +xH\QC/q25Q5K 栕k2xא(Gxdw`%.zd["qO`I%.p]1|.M:Džy^IBe%.p]g?aE58X%xW$.p] Nap$.6i芺4 Z2`T0HZJ\Xޓx"=h$._0Nʀ)$xWi*˦>D `/H\#M)/qO +:|O8ve:B$.c=%k #-p-%.M1I\G<^tL1E]N B K1%.O.I\3$qAHSE,ES4%-p%. D[ J\MDXK%)3Į&4&$.p$.@`a-֑171&ǛA₤` <> ơSJ₤#MC`^r%.HV!D'd=ǛADEuNS-8 &IybI\x3J\7&V8Xu{w|aH ºni3DqG+}׀×{sMЗc~vPJ0.<:p\}N斿\/.e,|.2rrs\wu|g{qϱ2/6Teuq~?co ;NnqkKڝ<oKgkg[s!gS9Rv>^3[]>/erkCYmo aݮu>?~V„snlޜcl֬8e,. +Bl2a G:wM=U{l˨O?}y܏?h`c lJ rv~> ^ pFWq{ўØID/=\QsO伽Cm9W饡yw#{d[v-9!AνȟջLҕ"wy!lr둵+{yB dVn +GLʑglXC1 uHY]:rq${.FvE_sd>xO +.!qoo#XCގ9dXZn|ڎ-\񎴲m‡F^ɯ>kooNoXgC+KV^yFZG|ӕ7̂O[=14HnT'#50by:nO~4'z=bUcu>ΧqDwA컁fӡyGw<iu٘}v07#b;m#;oI Jxγo^?O׻yɫ; 3dW/^[\C뒌Lz!s_USPuW3|g~nˍMl{=VPOox hЍw RtΚzگ*_|ܻ?Xw=xߨz +9")g~5 RF !Q\P=>t{8>=/G۾v[IM;|cu aOU2Z2X<Q1~{zvOx +rx_ߩ=2ss!gҠ˃uy;j #;8)]C÷#bɮ~'mi~<w)랼Vk*:(ȿ{Z?ee ׹q=+ш`C1s^;IQ;IY{WGf 6_Q{Ol(;ѨK9D#38* +>-kݍe}|i`݃>\z\p™l ^cIuJQr׮}[[}ٗ ybKg3CW(y:|xXq7Vwqic|:;mzΗYl, zȃuQ;wc#2|G<SǼs~,3jNdy:}򊿚o| #yY%WKWS(O8}öy|϶&{<ZwjHق#;܋~>bgʤ@j:}u;ٰI>1˚@Old(*ˇG׿epmmFثnwˊ";0-\x6cpJ~g4[{/-Ϗm):575heviMܼj->2K{cӲ -(_0Ya$_հryaWqҜ=Mtm0ܱ|f~/=yZeǵVÍ^NLl Bi׸B^hVqT /MfVLJyMR{;jܬu'r_YZٮt}騄LtNR1IZ+ꪘ)O^h]Jtu:U󺃻mb_:֯v/K^h3ci]k6@ +Mh=l +$Vo!0_{Y?(G*{Q-L֕_b7,:m:XV4uܘUWKI]TWm/t;5v=6#ѱi |hδ} +06mK;%h[ҡ%UARv fLdHzVwй|h2۟UtE?1ѴG0q_LeR{za,'Km>úؼkl7lurhzvت-\(٪ѲPTLY=c(6Z|QP}&[ӮډU[V-Ρ]j%/kW)Ȯۦue=wA? v endstream endobj 593 0 obj @@ -7239,7 +7217,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 371.373057 101.433071 352.623057 ] +/Rect [ 101.433071 713.673057 101.433071 694.923057 ] /BS << /W 0 >> @@ -7249,21 +7227,25 @@ endobj 595 0 obj << /Filter /FlateDecode -/Length 4727 +/Length 4861 >> stream -x]ێ}VHVy 0ym{¿1bT_oZ.I@~/']_N_y}6Ch{I4ི*B4 *kuֳ J*A`״TEafI3t^Pi;QJLFi;84tF.DEN{#Y[-A1lQiIgaJ%-H:b'IaADA` DlQNiIi10 ->,uF"%,I# -传3)El#t K>a4ItYtDAC%G @ $0좗xhHNbҰ1rEl-H ql1Lؖ t*j |J;  3ƥXJQSb{ K K%J!-`ǁt KZy ad$.@XLJX)@c$.`𮱸i 5lQ7X- X 0CgH6%X𮎘1 tN '=Z\hA;%.]LT$q>3w5at]mw7X A۠+bX.hH\YxPL" i @ƃ*qbz8D8b=P0VpVe4zXҁwQMӦ' ^NtpDpm%. - u=K\z2Fo` \  Qp [)J\&Bd[ZU93u:%.LZA/q~H0:[0T$.T4\i'[xi-qA0ޠ234֒hjI*3ݐ\E 0LS:V,~2G,qA&-7!fZoz -$. M4RD4,qeZo ")7m$֛^ȰEuNS-8 MsD :֛AXo£C!7.ft]xN\` VZ+deH+ F bnC -܋ʋ1Mk$1h3 N`ZR+1lx Srǜ|Ɉa˚&dؿ; 6F򏆃0fW&-o's"d! |$O2j-NAd$05VOYZ}*wfyCGmP49gNV\c1%lw_>< : ׿|t=s:|.ܣy_Dl&y/M}^KT'.S|\uaބLj6ӵL,\723AYԭ>~ӯ?!3l_נ.,Jon:vWPs|sx?Ԕd&.KN).~/v96Gz쏛z^g -ԋsUU~(޹wߌo/sdGs ZAUuإoj_ájõŦ^yKrv.SFӆv2Fݷ]΅ܼH^u\P|3D3o!T/x˽@Bdk!+Z+ - -:te>*2z*NӗGLN^ѳp6Fi-7f՝y:sWNJ=$n!8,s?k<gN乛Ge['w|fn82784h[ݗp-4 iM:݇@y [qB}wR=?OSFBK׻z΍܃Ao68V_ss8nUoh޿le?VD-= УmߗW+@qg!6Cˏm6jGx4v ~ JKuO-m@]_YEha޹-s8k_3W;T12wɲ|ޣ&OO{- #k+h[HܗpH܈lWmor;#º7WR6d1֝yPc-=ޭ4(mhٴk>Fy -+} 3P5QR^Ak3ݍ}y}e>˲l^u:磋[ݗp݈>|xzWq.yY<fs4۾gI"[uyO+34O!Nٮ0O7>g)Mڡ_cB͈j1Wɻ⧣;}ߝ3/؍{Dz )|#W]sAg^nE/m67Fyn] 'yɏ `o mj9tv:.\xԡ;DN7FX'-ΘFs8Loxž`32nuGS.^kN)p?Ϋ5曹?4bk/qFiSįS v9~FlVיִo=q+oajo{덏]t界+nE؏v]&i̶ol=rtyƝ1算¼ť@IۮjVb fm~cM,uU>s8nkL}{'5жў+m+(n<ѽOfw9o{Zt]wOlgֈ^(Oﳎck>)OCY*TYܤߧV w4y'o>6,<ݟuic7}Czg!2n|7{: -lW{b+h|ܙph܈yYΐ{q+&>YݮsP~u3:.좹#X}C"3Ц݊s8nCJo}Y xODS. ڤ#Sώs:'(bI +9ǃf?Tٳ*G"L\L?IGRw='R`E9,SGUbا$бN646Most~ L Btz)Nw=YaS6CX 6m-fkR. g{t:4bzt;o /'TKEsQu*2jEjs!\I]N ftf7ɺ -Ct1Dn*͖%UYcnjJ:llIQ?.@kܘr\FbRfBj-*^4=Ľ~̲tPJH4HU$"7R+wuXj;mK{_0۶JHH.-66M}%*1낺"Nۧpe+TTWŶ@e&v2T\ m)]ΗVKt[`> /ƽ8A?Jب2a5 PŕF_FqoM>A&͸?N4gȚt:ŴH[?cQ-L֙ҙa8e4B W5h(1 _sͮ*町0.Vhk6bSk45-co/]+G}S'%C5\Vᢽ\:%"q)Z6MF\ⲩ0Vff&@Osj.7"]Rqfۢl& \`j/ڂYƙ=Wd# I K+-7d)n~Y:ʔ[}gl_2BQHWo4KNO)凋WWR.xE~Ov%Ov˯.Σf9TN1ŨP)mSA&,`θ* T0UEm 3LNR }TZmu0D9g~ +pztFO!eE]NG#鬝BtkIOtx휒t%]-6X%`IJ[ ]-@WuE%]9QS)(?dtZOش# +3%(ElVIgaßOxSFmՒcu/1 E QFD$qqr8LK.I,`R\VBX3Z"`wAbauf'q5 $.g%.`[H\`ANe-q: 3kSpXP.%.\ t1ܣk}0XЮu)H\`i%qZ'wVQ02W'0H\L&%%qk"Q'A+q&H37xxe$.p]L@?J/+q{茕Ma3?aL&rwuB< ^tYDe%.]g?aF5x𮶘%xW$.] ^a$.6i芺< Z2`T8HZJ\޳r{DlH\: [aL#XSH:aIU*f xM B$I Q $7!+0K\%`NS9I\ lH\ lA q")kD.Dɦ *邙R]&LZA/q~pIv [0T$.T4%\i؂ [Di-qA2Ѡ$234֒ps֙ID&Xi)ElMH\Ŷ,6uz'qAJIₔ`QF`֛Q€` "> +ơSJ€֛I\qI$qA +M,qmf ;:؂) &Ib @$q 7ы[֛Q. ft]DA\`VZ+degw cn U ȗH2q*Z +xm8a}[Tp3SFf 辭9z2l/?v0 LFw{Dͷ)w%jcfiFfa£퇕0En#KR2+Cdyke[xI"^"#\+y/v~"ԋ=郍mdҡa#>I43ߙ VX#" HcrĿt.V풙Ncr4˯o@_~Fݖ\/y+)ݐʮ:5cISҫie)6mm"wl"yfy_i cXZw-%;B9W?}oOۧ5 J6Qp_HeGݺvP(=Pz"TO0{*Z 2Ww~w,Qvɹ{H=zhlk2)6v=ؓyDZk5J\pg 5 ,mȽP^7XPS~wȢlx߈3bsdpddOy6uqGiy"5ƀ8 +7Ҍ lVH{u-#|Z0$sX۪u/_g:S4c6>.2cx@x'!{{̟k`N`tPi;Gs.F/x޻}~2ϓ,cMHҴ.Y.*KölIHlKHB̆Lǯ >7SCGˀĂ$o͹Ny6y1<=lwünyZy! +. tח=/?qeTC0Oyu>B{:J=fÿ#=(\?rRy?Ry:C>9sL|7HZWx=k;|6K3toGk7э]dƇ9ِé+!~~Bh~\ z>`夳c^rBePആI@ۃz8|kmH ,ҩj/,_^22M,(շn*Y,7m;b7OT&-_M^mmKfj0/biæ~r.'&m'Mt;b$Lt&];9ER-8i:Jt#XP:n">wUԋ.~9N;opZYXCAvy))P~ÊGkk(Ej"[N +VLW^[ iUhXO ULBŪb=m ]LӬkZYw oTkG(kQջF5eF&5eI.Uv̦gFTZ\ EL[OŖ*zҡNe7vS7ҏ1l}*1ܘv.~(+Bm:^4* *SB*|5HIWBcNXI.]:ƆY/Hn[I˘aϗ6с*\2uS+Jڧthaq %0wVf y%d]a.v]4ˋ +!`yye`}19@FMƥa$m'Km 6rVec϶ Z(mIyV։dZl-IRl1E{^iNW&-[g-y[zK&Ax&u=mn]wmzdz6I=2v<îA񘨝*q-%5<{%WkBwLZ5lUQΖؤ9@ +46;Agdj}D?6ݥ>O{Rp endstream endobj 596 0 obj @@ -7273,81 +7255,79 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 595 0 R /Resources 4 0 R +/Annots [ 597 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 597 0 obj << -/Filter /FlateDecode -/Length 4741 ->> -stream -x][q~_Vx} p.836<+7IfdkAnUR$?~,l}UNHz1Oۏ.j -N_NU+ -Gw6L!9Vc~qe}5SJhwWVB A9AR -* MLIR V`$ c0RvJ0M -f䂠 -vh!A^=Lu:vӒ.M{%t8M$l!zDl11XI`A$Aa ElQ^iIR$u :Cr*IM+00H>:[rIgt$x0[ ntH DA&!LE & -J4`ȧ U:%" -8X [3WHk` H\`-l1d%.`[Z$.[RIK\`paqm$qJI εN ,H=H\`y#qZ^ ޵޵9El%.;NVG+qwVAb 0p%.V&&*&` uax84AZ)#qw /q2 wA!Nv` V+q -  xW',œ[M:&/qui=.[O8.*+q> +wJ-$%qop qַI+@WԥI%.p]В"Dԅ @'?T$.]嬕wuF#q0m9 guRL!Jc%xW$.]^6%.&J\'xFiJ!x |Ru~µ ((K -$q)%.Xc$.e4oq{[q@`)&" ؏W%7S kQAhR%.^j'v$.i $؂"q)xN8ӅNk -%.&bXDWK:RόD`` u4!qƇ7Nl~6GH o71&7Ix|$'v%.CIG7 I\y(qA -Mlyf lqpQDlӔy N~$ɰmpfrhQ/ -ceh|V-%{;(i1=rUKZT_9])8mNu/liy~gy-3,kY/6zJ[yS=cvkFk[^nH_ڹ -amhVs'[i/-cshɖAQGx~SmQ]ssÞe<[c^xO({-*pMBbK46a ^rctE{r;?%1rgϤX]a|;=D_^'P8b~eO;Rvz9dw<8A (78[y[m?eǦKei~?ZOrV<@<>G{FǕ칼SA3T'uho|uh2"Ryt:C/=o9v8kEiŃQdl]x,.jmU^;huqqJ*Up'<Zk*1MVQYBr}d5hR/eզ3uI5riWu5~[}s3}%%7LG=PK9ws#Ϲf4=UdOeZ9ut :F[|:3#w+<ߧG K~ؽqm8 u03Fׯ<\wP?dC}?-b[vL󷶲*wh=̷-WXwv1\C}C ܫo[ѥAOwc:PoEWu s7>s{}ÝfvJ͏kQdC}_MW],y3;8\xn9x#e^$kú苠<έO/mʑb7G[ڧŖps=wAhY|h -{x7q6|iʎunZv^<^N;?g6wP5D,"%syp:yͣa|ܵ_Dڄ!; p:VqM|z_.#m}c >8D"dGCb%O<]!-|޽]qmtg[ ҝ͝vQ7]| uT<}"2+Nan(hΩxd3z2á੸U)?{#7{[}GdCnKQ]t#_W櫭0g鉎ֆdž̝|'AoM{y 6+lxڤ{ڰFʷ\^[v<続z|Qy8wn6 bw~3W;b!Ng<BFS2|#o{vHrwٟ7m]?kD9aW2 a ZN?LnUHo;_kk}[nph ]9v+86pWa/n{qU&> +AhK{˝8wM;A|oanTkMrI>%>^J~jdhCD{wm OVx]^>i!]8Ǩ,:L:w̿ZSKU~@|e)hχ0CUGS/‡Γ &'9YX>Vv0TaJM|G|p~WaؘzŘ+V̭W.b>?N\f -Vф@{CjP uj^[.l]iMvAv-}|\x-QMfR qD Nբ è񡫳0V QKj:AtJiThbϚjwS:ml/n kd#֏K1Z7f#]ůԮsrz6qT/]ʞ SJ -פ<)>v_Jxn6FoCRh -=]:ٱtTBz&ݖB:t $c) uMVq(TTŮAu!v6Ujy=ݵr7|š3Ux  X+bj+0Bw}:[;ԏ}I+K^uOV4.tz뼎4n]Ǖ@%Ta6@]cO*:nԳN5n vއ4mqwU/6G[Ǧ/󥭍㓵j.2vKu(W/В2b,C[09VҺq(,5\ n_ڮ̎EWYnŐ./ƂI=^> -endobj -599 0 obj -<< /Type /Annot /Subtype /Link -/Rect [ 101.433071 627.273057 101.433071 608.523057 ] +/Rect [ 101.433071 273.873057 101.433071 255.123057 ] /BS << /W 0 >> /Dest (cb83-1) >> endobj +598 0 obj +<< +/Filter /FlateDecode +/Length 4726 +>> +stream +x][,~_Qφu `16xYbOʹc?e.UigÞNUF)}Tfw +R"]o?_~HĿ!`PW% s/|ڻum˟u4j^SR>x/-PIe{mrJcT0z4WyA1XN3H0䕙"^*ZϨJK`$2)+q: QGVS^s:ctQ8lt[lYbtLduEo8-]-@W`uE:8]4@"t20ii HNauQ$-N`5Rs:[GA"{AQG:A:DAt\ӊ##a%1Q0rYl18.0 M%%|KR9 fJ GP.9.0\t1=kЮ8.0]CJr\@]c0* kxHs\^X:qwuqw4xW[7swjҎE$ wA!w` iq +n "?fL +q\`*X]ʣřqVʹqb2X.3p\Q5 fjNU:J ,x~p +߄.B8.]ВL c!r\#+18$=9._-3 ++zӁwM&'@/Xs\E \>V-^B`AY' Xhbkbkx"*x.` ~w_`<;ÅY-q*eyvXn֍~35ݪRW~OF:N7Sv!CtW|!C7E3EtW3.N t=+ȮE 4r]hHYBnA8&ӥXա*&#/3ܼMhޜ'6N#K/ qs::.B4ݗ!7s_=uđ icyب N5 )jd\~7Htgn4W6]R!R$9ޙ?ApsAȠF1ΟYun[cѺI*w9;CVnYgYLݻ+#wg7CHC28s~=Mcqh,|ߟצ-{~lȝx+mDmPۊ8s:oO)Hrr} M?Q0|z:cGM<}se(sZ;qwGW|ۺurڴ/:҂F[2'<Ꮌa㫽ڼ__֣}ա>vw\$Vy>sp>)mV ȝyNᱞM>ϣ+yΆ*k;{fQ} 3鐲q+~3xav/jO\vMWW^K*+&wX`ێ+'9^Vkޙth>p ͐pto܁=C|O"#kfHR{9R7aI1f<";w9"ݾ;Yڍ|GZۧ. h_]9}$?S/׹w9R7|w̭hNvݗYpn霾 +q;><'s; a}v5\Nfa=tW}A>#=gݙt;OsG"U+\}B.o{X@OڙtH~.)'O͸1~xm=L\@ob3{ BOݫQsT+尌6PQo~p k8f6~lyΆҸrOvwN0>𘀭g s:;; خ{>O=k`w9Z70d=PTrW3S{oGmW?5醽}D(u3tb |m;9ꮟBdw9#OHw|$x^r+;=E!d%?59-R]}"h>\7ׂxN mryHf _>_qM=݈CDpcJѧw$ovUJ݃I Pc󻱙).#5Q* Jw RZw erB&t+OIvg(6`9̺헋IEWG"RARа꺐sx}/%Fe^^urs0e/*H퟈S9UvIo%FLAwp)KYr"}JcRlR~̉^{Ō9KFqzpf#SK=Z7z&],XoԶrz4q/Un̲*l&~(*J￫G46xH!i.}l^*H&}"ݒD4Y#1HT +8QXn•Pf#P]巉iPseN5p*v;Z/= Yx&6 !WRZٮVa *46h-4<~Y7. Ӝ6VGpFw^ i^2EmiJiDMxK8@g'kKFEJ5ɲy4;϶4g*k6;K=2vy* S1QFkLNpBB9g=V2XI[C1+m7(ⶢ)m|,-J5 +4'g #BЧ+e Kņg|O +endstream +endobj +599 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 598 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj 600 0 obj << /Filter /FlateDecode -/Length 4916 +/Length 4918 >> stream -x]M丑ȳ, ƎS9]65 HPJY]ng)I!S_~'9=cpۏ.j^O(oW\!T`71\.g.6j$rv)FQHi+b4>' 1gI5|tmEj$Θ$԰.jeavj -zh("9kSу$3z -),"d:If^K<|d$k$.Φ(t*Q]LVEb`,t(.*(-ɲ|NΉ J1meF'k$zeXQ.A,ʠH2 ]~$xۘZ nd(.|L.*&%LI$`\rIbb 'rx* X] X ]V(.6; . q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZe8Yk8.:A`e2)) x$$.p]8a Z xx Aڹ+#qgQ7x. X Cfl2pK$.] kl5锃OIGX\XCx.6*+q> ;wN-d%qo qI+@WI$.]ВD @'?T%.]孕 w#ʠMF5a -k Bw K2R1K\mJ\"$q BrS1H\ .( QDtqI\z6' . .p$.G0e [  "SL6c$ fJt-d:J\k KM ^DP2$.`H\hJ$Nt!Zd A I2;4bIZ9Eqf 0(q "M0(. 0?l{  D#ʠNₔ IₔQF`(qAVYd @)%qA q`]R$.V!D'lśQ젋"ʠ ,[pM$ d'qA$q ěŔ@x3`&Iޅg$.MxRl@>?"$f coS -܋*9IL@MD)Ylj% pœ})8D) 3wb^Tcc.( ɘn[c6I?EC(6D]I Z\n$?s~XiIuF\(n|0Q!(F|`h*?P!_-Mm%p5S=}E%*S`/xm(c!Mp}* -c |BUtK-Z vԇ~d~z(ʷh?~NuXopkp7CKWoK[䵣OMX^w,vEWz.EVu.~QNgշ~>XB:vɹk%G@6绐_զCsm`4P =.,C<Փm po g-~W^zm6tX,|sm>>``ig43aenc5ե9t4{xy?4ʶ:o˜3IٶJ>εy:w<_=^;Vgv] 2aP_6mGqLU>(:a5u6U`RF6O~h:6&0$U>Ÿ cʓE!0cC x9smZ;'; 629(:zeJPM=suo0;}~bu1tllt Y(~Pۜrn:H٣oErݸ3}d=yI}Cޖy$+@ލ^lt>ȥ8*o>;|ӓm՟YhZ}g3_ү '8mcfLTz_83H;?j6y7}7Oy:Me158fyڞ|A{4t|Cx_}0N2~$m"ϵy:D5?r{!mA:|gjlWlthdgCn8ȇ>o\^Fwц'ܼ6$߻' 橼 S-./:P[,l'-blxaM:"u=9RG9_ohmni\d٥Mћ{z~ntuhYt,[2n]? ]{vwosrm_Ijj[EiLf>\f 7qF:3[:r]ӛi'KI~2ye/e=T4fޛDɠ Y{dgɗ/)-sf/uӂvr-`yetQ9̏g:iVoÚޱ{m0[mɶRwe6تu{ü3&e;%5i=^;iZ6Io|'ԩ>ρ1eitGDk;G.$?[).K\8]|#曾!Xr@k[}kݽatpJKW^ ~\DGzڥrg>G}ǜIC28B|;Z;[Cay: QQk75gy VYrpctENڃw踷d#sVsҶN@ee^9m&0: -ہd_}8I}}l{W^DKmz򼵯RvGVؙ@+.--7?7Sn9_.zږsAb5V9X9[]KcQE:Q\aCX|!S<~s*[/k \nZ\Ũ 0Qw|m'YtO_ǰ.!9*Ikpe+$::]IN?Z7v(:ěp-/? !%/R cۅ] A1.Uhe7fX=A<ڌNzEo,ebRLP&\ -;wxaoxXb~[zqUM'7Ӆ^Tlk]t+]p[;t.~ZרVfRZMk$.B7v0MfN Skr'.b7f*Z7]uᅲEF:@mUb1Ż{G\|/VTK/OXfg𭔘|ЮAWW&6[H<4q.3aK'%'mVd<T#unkDa>+yJv7(-U͂fp^wf\aM/|-͍Toҋj]+슁zqѷR\Wkcr0/2iǽ]r)ۜP2# hCOok6)?eD +x][,~_1˺_ lHyB9gm:`!?_[VW_fw}ćLWIRӧԭQW_)/Z%bL)/X\dUISGw&r>寿kG]Hk宿|&5"cT * rNgT^ T1%N3\ڮUfVȨ"06(V% +fRv(-%!Zri%|L: +#|)NENgaKRq:[Vr:bM duE`8]-I.+:"T.R%d q N)MУH>0: [tgtXt gBLoԻ49آu99 +@KMr$6ȱI G:9a} +ӊ##ac`Eeu$qѰ 8.0hk8.0`[ p\`@V&qZ< 3%kP.8.0\tkЮs\`*qQp\`Fqi Ъ8+B(9.]wu@4Xv7rw V{ l48>- X 0C K8.p]01}l%TLUPg-,@e8.p]g/0j xWԜt8.q  0 %]VL1r\%qFa!# ) @B"w1' ;R뇟._~/@K~w<0zz1.ez't~Y>6z7>uiOyϴ2J"/*erc4zPCagCʾ-mXC.Ӭ4$}X4ϵC,oA]V6;5t@\5ti\{jl8;6FHWdLdN2\; SU2~gS5C*ZTzOy4*K~~Iڷt&:{cȼ`y ;W?i .K>;5 Z^vhDlcn +MDٲ0yCW/="<_ukV>QչoNO> a}=5'C{s=F8٧}<\GgwvV?Mm<%&^6l+,6}>3ocO#cyn>Iu6TzqMŐl.xk+84KPm]݊U{I_CmW{~2rm[vվ:DaL o&vV}MQfݳߥ 7l\G;>mnNyբ;tڋ It] rWgsj;Ӆ S#l6. gP!;jQn>=Gɡ͸9 )Aˡt~:o6A2kHk9la;9g>jY_nIFM\GCo8+dž8l7k-_jmڊF昙ikZnmF8<jSo^t[h#}}Ckk;{'<B]OK8yV oGܿ c@(BU{l#};>xaMŜ69ҙ =PTɣ ^g,]z=_➂;NZ, %a]h4dC>י]DJkj{VgW6ŗ! +e,=syo)ϠuV&6Ut|Pް{Z?%% <@KM<s^f)ſ:b={KO@iH:zdGCiGM9L7FhgѴ(0" Ke뮩25<<#zU0AFG]pܒ7R)Йt;M~zn+3|(̪.o' +ޟAN/~n.o/Ӽ>Mil/rz{޿ٳx7Pê~|JDӁWo"h*ͤcu#gk $fLYf/?颒|A>e\fq墉_.teֶ$z/ Ev)Ɣƕs#v6ߕlt%M3Bj-Kf1|5^vCۧm7lNB{Z]盰޻Nu_5vAfR:ܪxW*3QJ]IYvbD #J[[4fwFNXdkT1ۅM7Ֆ +5UlYS|3AxFv1 #]|]T2v+lMrqIWHW Mw*Ii6}C,2:?QRbE +):g]BoVIWֱ -m.Bl/%H[H;uyDRĺBW+yok ֶitiJ +:X:Mgڐ|n+Jچth2⢿).Sla&/}S*4Mg0ߺr-$Mتд1>K i*}饵b$KM:|CC^{9k..zvز \_-Eet,zPls\z)ԘI=VNt}UZojdjz8V;RX222RR"[meU6C|LeV)_;SaՁKU1 +Fs2z!ni> @@ -7376,19 +7356,25 @@ endobj 603 0 obj << /Filter /FlateDecode -/Length 4786 +/Length 4914 >> stream -x]ێ}VH@Y <I\H}F fT#qjL-$%qop qA+@WԥA%.p]В"Dԅ@?T$.]$.]e:BH\: [aLYSH:aIU*$ 'R3R[6_2=VOzx@i>/&(2&b:wfyCGm=P29 @@&Wb1l;˿?Oчs_~_ ׿p` ->a;e6S#>7fҗO[]ϓNvŨФL~cZF{T|N0|x S;LFh^ey ^&jo vǦ+}e7?oi#yõUWX| 3vW&kuג.1elMzTG϶1NqZ)Vl)w[g]=}"Mۋy >f}uW+.g o{X9Nfž􀗳3u<=г~:WP"Z{&ys8TmD~`޹wߌoT{+{[ayJ]>貭P`H^n?ǓhYi/w9oaf?5tKR>]2~ͧ՛S9nlҡ`'>\Q*=ٴ]ڍe~W~# 7f՝y~~"2dn(yhUT|js8n"M9V84s_C w;860?l-jw9j7?^ĭUrܖu>/'+{ 3MI"[uyOJC-5ͮK>,>;x:&Ԍ^yúx.;bhsFc?빳egOߙp ~PcYTZ㑇z)容(shBiXJ<6Fyn%֮ z^A{v9mCl=qa)Rb㰬y% we1:iw4oM=<+ ,+ֹQu?effr6܍~^vHl86oj:o:ͺ5u-j|f)QUF̨Tbk? I~JYeWa,@5]*$JsBM[TZҠN6 h|p7#׹(}"ÍY/'gHl◓ Bj׸B=.$VnGҤً~,|S*\fh[!OikW<6xH\+X --k.B,o/>nM][l&eM!2IUuE]g -+S U15P~UT56šGU{k Ex'6ۋ3c] a &n42h씏/_ f8r&'O^>i_'{c9:UTnL;"Æ e:0-j^Rʠjе6dbSk4q7#ھi͡ʇpoMgV$r6Ck ˈ ^(.YY633WR>oyWP]07"_R6l .0 ^ռ4G0~Ledi*}zcYZ OxuΡs(P-أ䴡\ ;eزM ٬2QTLY-14xQlP}&R^񋴹2Uo8C;RV_2 -2sWm)Ȗuye=۰B2K +R1O'5EX]Y+'sH# lb& K_Σf9TN1ŨP)mSA&,`θ* T0UEm 3LNR }TZmu0D9g~ +pztFO!eE]NG#鬝BtkIOtx휒t%]-6X%`IJ[ ]-@WuE%]9QS)(?dtZOش# +3%(ElVIgaI6$VC*%-D'` :_b`AxIq d'\X<D&Ʌ%JCgDVV+`Nk` H\`-l1J\`hnZ uJ ,f* ,צ$.\@)K\`)qbG ,X`$.]RwJ޵9El%.;NV'+qZad$.@NaXLJJ5I9 xDL.NV5MfnH\ƙ q2 wA!^` V+q +   B7ӯ_ӧӟM)~󝦿i.u\yMg(E+bwf'ڐetǸEo?CvY}a\B1;rgy~1#?w>\NO^WaibmKNt6y"-=Ee[Nt-G-\}L;vޖ?wmtrP΄,=ʎk3qT-6UoKK~',oQ0QӼe*j?٤Y>蛆!lxmmķ'J/Jڅ ]`fS`m~+뾨~ʟ몟觙mնƈg>IB;\.o!C]zyD1f2RꟼjmSigMcqYsm">~#?cn"9r(`87{RAUq(s'Vä26}^zjA$qо[UhmE/"tXk۝=rzmA9Lrڪ5pڅ(ޝcF/ZYa23Q׵ҍO/Q qEծ/^f2SYnZ"HA<e0{VQF^-mtOPI|Ҥ K%mT|Nnű觖~C=tFuF~tXaU3/QEGۉ^ 1栘Gr-#:NyL Q-ZfI0~m 5TMdѶsł9ފjҋ^“&\f +8M t +} ++вr8. OUFO*|5HWBcNXI.]:ƆY/Hn[I˘"qEI3,#.xdnL$w+,.XA\fyUVZ 44~xxC$mޤo\FFxԖ˰ls- :xZY=ۂ>4zhVLz%畺*[UZ'F*k%jSXU'K]Wi{9^ TnZd[9co)[,Y๛ʶuuu=fnH葩&Cؙ R@h-/U)pEylwD^ 19kUz`ل7(m+:XΖؤ luS~DEj:XKAoE[Y[?A} endstream endobj 604 0 obj @@ -7398,80 +7384,82 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 603 0 R /Resources 4 0 R +/Annots [ 605 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 605 0 obj << -/Filter /FlateDecode -/Length 4778 ->> -stream -x]Y$9~_QH}HVHKZ1bAiEZxWfF;N*#|ß?luBh1oo/]N_N1UISGw&r1囟]5ϣZr$5"cT * rNgT^ 41%N3\ڮUfVȨ"06(V% -fRv(-%!Zri%|L: -#|)NENgaKRq:[Vr:bM duE`8]-I.+:"T.R%d q N)M0I>0: [tgtXp:3!FfjFl:XV[h[d` %t&m9mX@$l>TiY1Qb:bh؂[5Z8.0[+oT…5[ (PJpwr\`@5k h9.0]cwANV[` ¨h8.]dw14Uz cXr\`:` -`uA`  ,xW;4Iqj=H6B,ӆ&4 xW%L̘[ wUD$TǙq / }w1Q x9. ̨U35*$q\8oBI@%!S8.hIs\YX&auAHC9.]Lޕ ˵+N HOy}Pظ1Ew[+eJ-ʨz9}b)T_=]ҪE ,YW̫ J/i)h,){`]Ӵzt|_z#*Ó6U4ϞhŊiL f%zCkxsyvcT=N kdTYtK.G=%Z4oMtsyui-ë; G<#B39~.?GژM-f6F=>DkYN|X=0ÃCHۼ:*y.!r?|"iq y9SÀ.5f:s.8?[=[m ^|<+ʓy z?\zpƁfP4QJOE.cZέĕiU|Zm*(˜+2m,Pm/is_lOȘi+jnL7ؤt1w+iR6x_ڏ `&?]uXB+)7~mٶXmhm'igs>p6[/(F~c 2ݮ?e\۔Y1nӲqYsmߛg -m?ִk| omO:؛ʍqAgg9H}!r9e=Cyϵzk9>8K=O:v~7vQcEd.^حch`9`'2mmA,p4[:آB^TG;aSyd۸K})m9 -\0Fetm=Me|嗯,{Hl( P!1MtF`mXЊ\ jQ -zF;w#dC!mopuUѕ{B YͲZe.A_E}{]4hs٧P{I+C5'<R0 -M׼e7xkvyP΍@Zn~IFMwz2áٍ*Ybq8m#}郋'<j>.nV5<Ѵq+d[mTfynUƛi(Í]ѳ7!Sqgymg嫷@W3#1:g T"2ncQ#=3cG+!l Ǖ-GGOy8Ǣw^EwE{[^<~"^ƤA3>yWtGIZ{>b(cS98_|;nini:6J+[·v)rco_iM;y_kx諻Owުϴca: }-]l wK6(dC~z4@հuyU`g޹wߌod_@Cꑒ)tѾ<*%«{y=ON;7qo5(~]ޛzamDrx Sa/\U>1(^nUU);sZ\ʏub+icwe>MSivP_3_^Wv W/tx8\ʯ{fSa܆U}wx*U(_D!]}|Qj73v^ińNj^=r#?5Zfq_.pˈ폗IXVUi*@H˔ YGZ(Uj6z53*fZLB1y= -S|36a/Ўi{=X9Z(Xj7u6.lSC״: ݹ']PYJ_X)UeԤlb[?1ۅ~!kC[3'a@-]¦+S=ktnc_0F_bznJx8Fb\\`RUB3QvtiUUF'pMJ̓( E WM0[Aj'(Q?7e" 0CAo?]f'/ -endstream -endobj -606 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 605 0 R -/Resources 4 0 R -/Annots [ 607 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -607 0 obj -<< /Type /Annot /Subtype /Link -/Rect [ 101.433071 461.373057 101.433071 442.623057 ] +/Rect [ 101.433071 123.873057 101.433071 105.123057 ] /BS << /W 0 >> /Dest (cb89-1) >> endobj +606 0 obj +<< +/Filter /FlateDecode +/Length 4704 +>> +stream +x]ێ}VxAH8ȃ nF0`!SxUݳw0;*^JaU+C;st"o);z{肽Dre\#j)i|O*QEԌ{err-ȩ`F T0(Uxת3S gTR`u0Dvpht\*:i=8o.98-6 +,l`s:[ӂt(Ndt]tQ6cX]N:%`ւI9X`S:(tN'lduj8-?GADe8PA& +q0kTqsV\[ Xl1p\z: -Z) -p8.G0D ]]O01xCr:A׬.@'=ޛSk!`s\]f@' >  0 A3t.tRr\l7qAPL'8. $AqA0n W 4&8.@br\X:آ EqAE qIMqAQd @ qAMe8.f j&x̸zs\ lpQXlq NzlQp\fnِ֛@g]L q\ 7rk{ l@z-V6d <3 _Z#Aepl*Ra?fV0E<&#w%H6~|?7c,H8cj +@Et-qa9ZIKX9FFa0e7dNBڛ镍֩~=JT= P:0wfyEVpp 計B1. +Hͻ Fl͗Rd>+vOo_OIS `+JȲ 0 +xqyA!gwPʽokVg &,Wj֧ߏX0ٮfT8edY׌vȏ*kQ^7Tʰˈ(s,KB }z+K7soe1 nK]E}jQw̌6ɔTV[R}yΆT%vC $Xs.ܖYpW۶Al?-HH#KNIk|Vs1d|߷bmS|[Ȥh3(pm ps:d]ͭ5P֭'@,h˺ +7PX|?cbQؗt(g}X^r'k.T~O+e_\קö LmwT?HA͝yNIl]d9?ìViߟ3C%䳏 V>G<ۗl~eiiWD}ӳժejyi0̌O=jV_Ymٛx;v#3o|v{ {F"Zm_w9r}_[D8-ѝz86_w9ޕ?zApsFȨCi_mdֶ7ʞA3CHCjB=M\K걄h3oOhiPXvihK>j Ows:4WkAsoj{|R_n odw9rc܇smq^_wm;i87>ks:Qb*Iy=cDb;\ww崑*o o +qyNv{ޓ9jw|]L{L$_c0oOZOlIHpU@Rt^qmw1|"SwwOϧێL"xK7vSzz758SZ7e͟rBb>)?=~Q1;=tnCxhpaN:3tHIMrlXy9sN5).:e:8-˒"ͷ\Nq%2[̭ q=ѱSL'a6PX&4y\M. +23ZhKVbZoM+fGپ)t͡MgR%pQ.C2%_"qEI˔.UF\ԅⲪ0f Jrӓ +MuUALf뢓l* \`]_YW0F?$ǀPTq> +endobj 608 0 obj << /Filter /FlateDecode -/Length 4675 +/Length 4908 >> stream -x]Ms$@C^ v{=6q; C%.CIG727֛X 6 qA!DuAS-8 M$+qA>73DD/b^o1]u $L8zW ^ʘWQ(PoS - oĜ54XYF/f VJL(/1k<3c0-,hh5?wOwchci -$ CqA&;LRBHlDHH ZnH09xz3z*h֣ % C\ޝɊk2/Ɲp 0ztJ9'munTRe?8LG r@͙|a~^[y[FOL}KW]SҖ~q:XwRveci}q9 -5en}U^rXހ\n8FH0T8]ːꇳ ˨ۀDf-SY{s.O5tZa^ϩ9oNӕk0s{iY ݜ/@Dkn`wg]Yz C91ՑLr>r9}Rʼz!GajokR{較y:zT]snz 'lf?l[Ao 2edbu髠¢ 5G +oYX>dr У lߖW -b|_~ibbTq(Yh(6qm"J C">H"Ũ6!k~ ڗƫGvj -L#x}ZyX;i7pOny|L4;JMnp~ I7@m9'1(zs(%k*BȰs8˱V 2$U?ΛVsHAF-=[Yh1苲oS^A+˙F:Cx_1:zvkP|B:CF~ë5J۲X§esbaCw9nǞ/J&Iʀnա#ݯhм\4O̻2.ȋŧ2i^ 5#m!+9T@t9t_Qǡe[SE:GCݗ ]F)#Fx<4JA-zhZ^(a\ 08!PO+H~`/:CCl=qaiRb";6IfxNZ֝1i;s8LoDž_:3 -nuGܵS5kN)p \UF}<#a8Fv%z~2~yuߍܬY?*:]%"{[;Wφ“mxF!}s #2 s4$|-u#ʼn#ye29vkut?W-[6e;owGzƨ瞋o0+m n[Yp'wd+G9~k|mޝ0k+fs Xtg!s#zɫ얹g%3@XM=^s8oR~xw\^k?<s4,kj; -fE- |;~޲_3{sgV>Gp_y7x:Cwe19حtǵMnhCԿڿ_8Y? dqoHs8Dގ5_s,Q֏ ^YϿy>ϳv{ޗ3]yq:GCcyYzjrǮW|O]w#nfv\Eswgwؐ 9;;?'ʭ]T5>O\M.6(赬;'?/6S7x 4mT&}Usuבh:+{i,`O';4:ftl/J|ίS6zD4?'MS~d~ϻSsOS_\)?;eَOc_~9=7844i=>f nZ>l<zi׆&(&m -Tɛp}X8eT)]]a U}۠^7^>,7xaqNmMfm8v \b~]YAlm,>ږՕoԗ$WF͈\h\\ߕj)VB4>zbA^/ՠ'q~cXh:-/l7ŚP50Q7a5wf_ʚri>T]QJ])YqD D-٨=\rDXnjՑ -TlUSfJ:œiȯ@dsDQ8<eUd1 lM|rA(W(WDžڭ^4o9~,*\f?h[!wюIܬy'qc6ttTBLtuT$Uc.uU)OJ.T]Ltud^3nʝ\joma/c8C?4Q۵1a3 čFGqƧSN$dbSk4q7k ұizHpʯ )V_cQsg$rҡUo섩Y633v}|.vˆ|HMgMxB`aI臧׋}2ٗګKei%:㶪3\N^R gLT fXݪ20Q;I3tQPi;QJ5N)A=Mu:v +i%]B>I:[|VZysJgSt`-&E+"l1Nt ]ItN>'D]N:䓵Ji=y`ӊ:(tR|u[e$-$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a +c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& +%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ +CĜ"52cX8Dmѓ+qGLSVi%C|a`2#h Xb,+1Us7Km62 w~Y +SXJ(RT );,"04Kv[s䈘 -|eNl;m İhFeHFJb#ԋ0ȢG3=hz4S' 3I|gGDfC3(hkVp.V풙Ncr4ӯog oQ}W>͟/˵_f8 '<ӽvݭPxIce(o+oeZeT?*u_kr-6|?{Y乗QiZ|4뿟?|w58˪j'eYw|,qw0;7o<賗 qUKw*&eq݃y *„zu{㚴6IfE`mJ"\FF*C8nuݏcync!N {aP9a@REkA& v2-F~@UhcyA_u{Y# +V^կ}$'^ë< =;к{]yTw/:g!Š g@z]ߠcA8kYT 8Vl<Jv6`K8lב87!z~wRd9 uǏ1 + 4Bf+-ҵ` K3' +\|0!y?ƵzS³#\X: s=?Ĩ q{Xۼ+1ރy7xȰʨ7#~.]bʱ~1#4ǙQl43[Ox`u8vtlOϷ{,ޮߕGfk$Zrtԑ};M^cmc`_Y)X g BhެukJOw|?}Jڡ5]¾yy 9'z74-=uc&ϓ8.uz%yV_=7?V6U;j^>dKoSigwO9.ww赽#~#Sdc1}S=q(9]GufwSCF%HCi\eS W+aRV3/<(_ov<hϭ>L٣Ϥeo؛2QK烽/uf-,yz Qnoky FYr!`/_ʜ= bpk"*`ׂmAezZe+NL`ޚcGyy_>}#>_\׸7m[Ni>-ܘE_>-}ґcEo:bx=IPae۶GW׎49)JyRl| mH~tHͻ|ǖ}k1em*.re5^͒'_ybjאTCz s0 zhXgCfyxg"==HDxޏOw@7G^|=s }t(</޳ޛ|ԑDd]9LX~G}/sM*ۺIa݈! 9w#{r<3f&][=ja;{c~X}0ӡq?vst;ݰӻ+w= GwGSEwG3=6>x~~|DxlPEږ~^Gz3 h kJI?apXa>RM̔sYGCٽgv4t/Hl^=W4WPؿjNjMy,@GtV~=NY=҆Mt +'Z4iC?$qnb>{INnű|%gZ9^Z_,*Ig73 +]v_Opع 1 ňdmз|WQ5lVKj"[8W,3識Z&(dL#M t +} ++вr8. +Cݫ*|/5HUf塱<]it _:)!=nK<21y<"Fknkbƕ\}Jmz* ݷr84|z\˰\*͍b~tQm1a7 ŝFߊNM0>ȤrT9cQ< wɝX_&/be*lÆ c:0v=^SƠiw2i52eb d>o=_8z^C]o.S>%Y}JP\ +sle&W\O;b,KuO*+`I[~ vWWF{x}v/&:HڨI߸5d-a}[M{eس-Cnu1ʤg[x^UuhtVb6%[uKiq[Lѥ?pO{+͉Jؤrע% {TOb$ݤUۭ뮳5uCBLU7);saAJU1Q;U +GqKlk<{%WkBwLZ56lU7SΖؤ luShe/lKzo!Z +zSTZ~DFYmCՕ& endstream endobj 609 0 obj @@ -7481,83 +7469,87 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 608 0 R /Resources 4 0 R +/Annots [ 610 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 610 0 obj << -/Filter /FlateDecode -/Length 4740 ->> -stream -x][q~_Vx} p.A9glyWoRZɸ{sUKXRSc -ΗO?¿bqտopg(LN'G0L[]N鿗yL)y/XEv -1UJi+B0 *'41%I3\ Cת3(E'`Uת3L$`N.*`6J:tM%ѓ$QH:k'H;-wQlqIiI`DJ1H:[JtNt]Q啖tN.E"QS1kQnrZ%鴞iEfAg`W.:2O8bfmՒc:؂xآ(3hb^80Q2$vHQbD!XLr$JCgDVG^ba a:bI\` lA -lK@tK*i ,X.TX0$.\@)I\`)qb ,X:o$.]KK\`"-`h%. *H\@]L##qFudbTxDEx,.LV&H+7x8e$. !%.P&.(lJ\:c%.@a["qO`I%.p]1|.M:Džy^IBe%.p]g?aE58X%xW$.p] Nap$.6i芺4 Z2`T0HZJ\Xޓx"=h$._0Nʀ)$xWi*˦>D `/H\#M)/qO -:|Ove:B$.c=%k #-n` "SL6D$qAp1ft-"t:H\MXKM^0:M[0U$.R4E\i'[xi-qA4ޠD2+4jIGQH~bWQL4&$.fI\6:bI\f Fbf )O₤nq蔒 ! 0/y%.HVa-0o $-.-p0oIo$-&{oF f` ^ Do1\u $L~W ^;(F amC -܋*1=4YF/F B6P_ct si Qy!`͌0-}sdv#˟N~{^#eG|X}2 ry&m [FԍԠtc#cMA/Ml3[FzU+E[ཌྷb6JF%޵#y|]/^pƱ=9稱?؄< ӯͿ(*_|vس;(y۱rycZEqVf(cY.\]N,/&&笳9zZe}1=^nki^u9ok. 6!]mk!HɽMjr)uϖ&mt \E5737V]14^ΟC. u]˾˿[>/6vj.us^koSngHCʿB vo̜1NYuS6Nڂ_o8q#tvoֈB`h6_hdagJ|\Ziںf/|eI$;3ehk lVL%[*lg,d~Dc2\Dqᰵ={Mc&xiIiQ23rn}+e^Z1P8b~eO;Rzlx'{:vq/Q=OIb7BX --ޮ܋MbK[a -kh/dƋLv1H<7H%+,0xsy}nqz՘0ra$ڌLTkfDlRKy fz(˓[N? 9mk6,fN_4bЫ -oߜr&`'E/M\|09l߸,ZRq(.xSi\ -T.@JmRڱY Cʱ>YZ_9ջj߂vf`FU+*3y6T~=b[vL󷶲*uh=кgރ{, v1nXCmCtnշЭ̸BOwco:P9X땼^ԒSj7ifaݯ\>G9|*+ -hgl=wy+o-?\`KW|/ڰky&IqSVۗ$[|uH#-\ߘjbK|9r͞;?h!hQ|tac?"m1>Ҏ;Sf.ݒ5?tƟ3 T -=q0ӡj' -W杻GFk~w; TuO<gC8PvU*>PzǑpg[ǓhQ$tHX':_B3Z﫺yzft)^{S -vн1ćJ;J -ˠQ~oU=Pw0"_̊S~~1k|hΩxd=лT*ҔR==^t?Bl;*-E7@W[aXϘ! OWñ IvY>W3.@LdO剟2I~Zc#l!SOOێcݷ>dr]>f-}OW>2ÕxO9: ʯG ,NL~nհt,aϓWX/9{|~qTt&;V7rR)>̟r8^?M[6TGS/oY!AL bE&l 6LiҺI=l,R5 BZ̭W.b~SMl> {4bm tB5Tņ=O6o]绰>v5a[ ڵM1jQwj2;Քm@ wM̦FOZT ILWJsmBK{T{ҡncxAHzk#֏K1Z7Jx99j3N.] -*Fm:^#~'L*3*\2~+N徱I=)CwfQ t[c eF50[q%7Ńb>& -۴b{ZWqc]ub)ucPݴ>ĦAh;!z92`ϗ6lUu/H\qҾCKfȈP\nLXIzơ\p1|i2;]eCv &=VF?<=d_gK7(m ci#?˾m -endstream -endobj -611 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 610 0 R -/Resources 4 0 R -/Annots [ 612 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -612 0 obj -<< /Type /Annot /Subtype /Link -/Rect [ 101.433071 713.673057 101.433071 694.923057 ] +/Rect [ 101.433071 438.873057 101.433071 420.123057 ] /BS << /W 0 >> /Dest (cb92-1) >> endobj +611 0 obj +<< +/Filter /FlateDecode +/Length 4773 +>> +stream +x]ێ}gyH8 Nc#)I$KRK3b<*^aDIs%r |I +7X\Y+sH lb& .ỵf9ϿH*gbT^Pe!Fム +z@sT0Ggܵ* T0UEmUf:((%`rAA=Mu:vi%]B>I:[|VZysJgSt`-&E+"l1,l-*(-|NΉ J1]O*IM+00H! +:[Yot8t ocJl54ZybLt`%0$ + $01.'Ivp%LʃJ4`\Q4tFKD`l.HL`5lq$. l ,֩%.[tpaqm +N kX.{uF ڵ. ,x:$.p]kSX`u8*J\FF $.p]wM 9h%.p]ik (Gxew`%.z-wu'iՠSxN>Q¼E/:,qbx.3I\ c2t۝yލhuU-9 +VfVʼ[yFi6S;%4>p`g4n+geHg;'?/>; k-3ᐺ9Oخ_؞,s=oˆ`w9Z7^/d#Pjjp%^GzҹũL7]#Bů{^Bnj1[(3Kgq6Y;'?<s8_y=QTz㑇F)SI֛{8 +7+k[i!5jYVD=HK; 鶏k=Clwm KYZv꾜culI?+qc6u 1@wgaz_dAy֯bQ7ƺ#~*]bʫgoڽgVR4w^ըg$L/]+ +o_v6V5y ]~ V=W}ɘ[i19WrE4b#Q/1u! jƑ۟aqJОkawLnVSOi=1Sit}%Oj%"45h'45gޮXFBZUY9"5科jl2Q˜z~WW[ΙWi)Vk07^)kjM}-aakCȖ4jQiE ^tNӹ.glC0`ѣ & +n&`9"_Oim(>fnC'eZ +&g6vn #3?eرs ݯ5:EOLcs_ {Rj'S.Dsع67$T,+7kxroF ֗?/d;UMSł9Sՠg1}- v +O +l7*&BŪkb=Q.4a5wf_ҚȆrBRT)QUfQJ}IYqD \٨4&a*@r5].$KubMZ\zҠnSxAvalL9ls)4eUb1Wɻ:䣐7P@ -+jxiRz9fU*%ЮB(ҮZ%47xI\*8--.c,/H=.cyDR i*}0V“v ˺3]zeܳiSnq1ʤex^+Eet*Zb,69[閱IX}&R;Q WiܲUoVs8:RV_2 sWk)m]u̚!yeW)GΔ:Hʿ1S j5vƸJ!C}&2B#w+X 18kUxل(U$/gJl} ͩH1D>e"}ܒӛ裦Qi9:~#o>g> +endstream +endobj +612 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 611 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj 613 0 obj << /Filter /FlateDecode -/Length 4918 +/Length 4944 >> stream -x]Y$q~_Q6}`@aavZk`}Lȣ{ZN3#xY,}WNR?~)zꦰZ8yC`71_oo_ouL9o_S V`y?h|XAOb b۲"p9y11I`%a]vD$GF)As<gR6YEt4)Dxy -!$dYi!)YMQbU"ċ@;Y%J"v99'2x*Ŵ'UO6Ê$( d gYUFY#Ɣjhu[eŘDdK`dQ1H4.I`b\6NK -'`d?Vi*]jrEdIX` dA ,Y ,Z$,[oA J ĵ)8 , %,\ 씰tܣk}0Xu)HX`i%aZ"%,:NV'+aZed$,N ale2)) p$$,p]8a Z px Aڹ+#ag0 Do ;Y`X dHX:c4j) 2j&UgNU\EMKŮ˹.g^z,Ӻ:yui,&SLqq ˆڲAXNlldTeLRdRtmA6_z VX A7YR"-uV -72YbOZV`L Ŀ2U_;lߎ<%C,Қ=33;{XX:Vft7C.( x~Kv[w4Mw:Og'Ӟ^s?"\7mKH94{f팲pv'K}dӭk/qG헹MFܙ^t{Kw-DZHVo:vZ Jkc?\JJ89zq^OК>C0ouO։5^lh}1wتq)f'`Z>lwo}ZoO}wB;R{Oz__bc_v%:Yۉ>wtp+f(tyZ{l<{ -dV8z{gu+r!U,ԶϾ,uzPVy6AG;;<%ikSoQЬ,o-b|f>>xcE!0c%>.x^r\6gzγY=a?`݉n.XdسXmo/PNʭ{}76ou1Mں™u^ty^YVP9S=Xn:H٘H?|ƩϽcE/y:<ɤ>YDfڮSܷD? -w[pG/g.y: >ɥ-ݱyU^y|:f$ }lΌcә_t|쿶r3Q:7ǛMivWG |wqӿ7y:;Meckqqĵ=M Vw|Rmat׵8F,I3V,r읎fi ՕxgyVq\ϙW^lOr~v6oyϏVo6q Y9գRj^do1B{q- Uc7>c?ˇ^t{}&q{EE8ys,}4.L`e= >iND[T-Ů?Z1 ߤ#\ӛ_( =6s[.Cڙi,MQXgDIv|~"GksUU=GWG4Sl#LW䅿yյMX$a% [:j.Ii"im;ҧm;e UHP},Hfm$ Yh{:I䕓w>`u+b/[Ɵm,852/ln+Twά,L[f|ek4Lj2ǾD]Vkd -llU뽖oav湎aF Etf6:(RǕֲou={dݖ/sAr^HŎ-׵nay7e(F=9ٜs -歮ҿˬ]l}oEUvYwaccV]=խ/7_eY:˚҇sI1O7c#)l6Uwu9kutQ}ܭF9'ҝ܂yv;aRNq:Օ?n<(_jcӡg!as&.S rhz$q:zg>t;4OAu!GƤa= 4- k@cnI:&2ӁlCee^ֺG})tΓ Gا>I)%W|w5סF ᡂpX-u;o7yt [냅C|9jpسw?Uy;Rsv:~Hi2jWu UqrS>E=t8 GEm9I/(vS"']5=W箇cCtM6ÑN/?,OK.kvLU^/G~VUTXĒgi y==*BmȃɳnO_ǰnɫ -A6t4=>NK:]INrOrƽco|vL7MyF5/ -} -qe6rR^:> 0_aiVfHP\hLN$wZV:NҀve16I t[馱cH5XuF&iXɉ -:7S~]-UZgA3sN ;_99tllecs#L?N:٨ P\WkCr r>nmXo(ҹ2_>nTC ӰuE;}FHڨĶl8S/5}׮WWkIT7.'CF6tL3oaϷytk -7|8Mg|gM⎊-\gXEFq:]dz񩠔ans}MWZ+ްӼӼG}9@ʩm`Dm'Sm ۶ؒ keڳKnumQSSWiNF4UiXe -K2$j)6S54%z>+aSڭ;^ls<7GzK&xFumnwml gz5).{ڙ YT)بe* q5%ys\6#Rs%'LUQӷ"Mtr!MB*Üd `IH"}%7їDכ(W +x]ۊ$}gJyH`d`X#쮍$?}"+ouu;vUD^2OȪΒW% FN!D1y+/X$*{O>Z>ǯ.ZW5蔴_>eT*!5v^YǨp1r*aQf0`90JF`6^* T0CFC*!X h褝q:%'C'tZOi%sNg`Br: [4Fp:bt`uE9- +]-@W`uE8!9]ԓVN ;٠tRNԬ# + 3wLREqoqI +@I8.]В$ @'?9.p]aw`5a2c$ӁwDs:>r\4mr\< TN.)z8.pQ@չ / ,V[7`V` \ LQf-9.M!qZ95fu:9.L%Aq~"w4[0T8.T4ϜI'xIqAP ADNp\$Aqf 7q "M0%- ?l[  D```MqAQd @ qA2`\R8.Z Dnjۨśh`` Ȍ[pMsEEqAtq ě%@g 68x'7rZW8b @s+d O;#(2Gdoy|t{d2քa7W3}'k6^\jF SEW$,V0]f4"vĈ<Nᴶjz_=Z=֪䳫Eu˗* c)F*c,#͌u2σ 2eCYJsVG9OC;Ud|߱KK2kyN?[we5Ĉ(;AP6bed]<̊6ɔ3̟)FrKYL]MQT+oG<TˇBxĚ3޶2V]}Ɏ2<ؑ/pr1d~kS|)c`;B≮ˡ][GJ8B|Ȓ-} bYWC3B|?cՄbvQx2ϣО(lw+u%RA},ƞJ}?#e_קö dVÉi{/ 陠}p;!Ǟb]dǜ_ac}Ψ̇jGz;Q)i}p=+jг]Բw=ZTlFgiJxS$eosm {.!v|1-nnfk=?ѐ}7/ѷfu{2áy]7;W쌌~uՀЗ"{qmѺŭOJ2d<ح;=Rϼ&3nV|'Ww돂]![x:XYK^5/m dC恿ƳꦵǷ Q뻵Q\z'<jzk}Û7WPꯣs^;ݟp=Xw=yߨz 9")et7q/ +X>;<#k=ǧ6N|+ǧGzhۇ.wK}9MNp;P{ +-L~Q>WgL[ߩZe=S+Qut;\C}!]ugwu|"kxxk|D-fI5/}6[}h맯)Ϡu~M/m0 }^q>J|K<<\Qrh.FD'<G ~?>{H@iMu4<lߥ ayQ\y~je*<׻'}0XMMQB+1(ҽ;10:S"On :LUeѧ}렀-(O"_|_'<⁇uow}uS*ogccsĪ +[O +lRNhBU{hrk6d%]w /VVJo(EUtgTR[R1~-JY]^0 .t¦˥S +-k,-LiPס6<#Km^ՍRL{־ÍZ /ԑ/ԶqzPwVq /MJ|Yd2?SRbt MZ%46xHU1\ H[ڮ}{!pbԵҮ:<"JKb>+{(F&/ q֡jEĮrK/%mm_v/4QL&VvN )4qї$.A͸ϗ\40BNKzSKe|y1?y\rBd^pRL*:l:27 --hR_]4b/)eePYж6ĪBWIݵ>XMS].vܤMU8/t]8mJ֨.#NBqUe 3 }%~w΍StM}EKX'}Fƅ=wW{6ٕ@JUK녑/-O뜣feen䴡\ 81IC˖ؾRSdJDQ2QdD_lr9[itŁm%_}&GҶڈJKzK:@oW'ZKFUjZJ]dͲ2^0> @@ -7586,19 +7578,29 @@ endobj 616 0 obj << /Filter /FlateDecode -/Length 4786 +/Length 4791 >> stream -x]ێ}VH@Y <I\H}F fT#qjL-$%qop qA+@WԥA%.p]В"Dԅ@?T$.]$.]e:BH\: [aLYSH:aIU*$ 'R3R[6_2=VOzx@i>/&(2&b:wfyCGm=P29 @@&Wb1l;˿?Oчs_~_ ׿p` ->a;e6S#>7fҗO[]ϓNvŨФL~cZF{T|N0|x S;LFh^ey ^&jo vǦ+}e7?oi#yõUWX| 3vW&kuג.1elMzTG϶1NqZ)Vl)w[g]=}"Mۋy >f}uW+.g o{X9Nfž􀗳3u<=г~:WP"Z{&ys8TmD~`޹wߌoT{+{[ayJ]>貭P`H^n?ǓhYi/w9oaf?5tKR>]2~ͧ՛S9nlҡ`'>\Q*=ٴ]ڍe~W~# 7f՝y~~"2dn(yhUT|js8n"M9V84s_C w;860?l-jw9j7?^ĭUrܖu>/'+{ 3MI"[uyOJC-5ͮK>,>;x:&Ԍ^yúx.;bhsFc?빳egOߙp ~PcYTZ㑇z)容(shBiXJ<6Fyn%֮ z^A{v9mCl=qa)Rb㰬y% we1:iw4oM=<+ ,+ֹQu?effr6܍~^vHl86oj:o:ͺ5u-j|f)QUF̨Tbk? I~JYeWa,@5]*$JsBM[TZҠN6 h|p7#׹(}"ÍY/'gHl◓ Bj׸B=.$VnGҤً~,|S*\fh[!OikW<6xH\+X --k.B,o/>nM][l&eM!2IUuE]g -+S U15P~UT56šGU{k Ex'6ۋ3c] a &n42h씏/_ f8r&'O^>i_'{c9:UTnL;"Æ e:0-j^Rʠjе6dbSk4q7#ھi͡ʇpoMgV$r6Ck ˈ ^(.YY633WR>oyWP]07"_R6l .0 ^ռ4G0~Ledi*}zcYZ OxuΡs(P-أ䴡\ ;eزM ٬2QTLY-14xQlP}&R^񋴹2Uo8C;RV_2 -2sWm)Ȗuye=۰ +*`6J:Fi?8=H:ɢ.BtN!:S'I`JK:[vNI:l.uŤh%]-ɂ.+:آҒ.䜨ЩVg|VI:'lZQA +QϢxGҁ') jIa1щ:؂آb(3h"^88lD&%$0)O.F+р~r!G-UŻ 1հa:b؂X [XZ$.[oA …J Ƶ)8 ,(PXpwJ\`AQ ֵ> ,h׺$.]봒wEMQ[` J\V(qb 0p$.V&wMRN5K栕wGk28q&H\L%F]P=tJ\&D˟0VN9H\:aD]tDžy /O:,qbx.3I\ ;/㟿ӿ^/'NO_痿u},\܆z|u~fk7]0hߣ}^cC k^}V?\de4 %߱u| .s>cf߃Nʴڨz5Ů@_zTH_.(f;:`9wd2>fA.rNÌy.6*sکp<z1ޝ 5G}C'M>?<$qM}="evn<~=\bU2f:F:O8b_q]nB15^:)ss E ).{u \Z=VBM@C\enkֈ:HRx(/lF5x݊`q uih۽0D~DH;HqdCX;V/ZƉ:G}[v*oNصale7ӷ! xdCxN⼯dvx7jA1:OkwSe4j)hq3"ua5c~[vM;<]c\G:~&YOy6;q?"Ͻ'SuN vcғ;u_sU"#rv6q^ˌZf8o,>=dCqLaWaSs #GtYqXEi󽈿g~.3}a3[w﵃Upӡ +W3" +-{k:-ў{}ǘI{[kzȔCTvC? rT?.DjӸO8ϻd0˒CȱMQ8z;A GX + ^ tL 7-3{ąMt9y-p㾬ϿGjy8pbm&2qم#<7eqgos^۠|$p#,cf\zkνUd2j͛χts9-qumPK{rَ-!n{ ofe_~Uެs9Гue `w+eu;w'ݡz7Qe?Р̶1^rfPϻE.cz88lI#btFfvK.^6/, eSY{hPYnZYmuOJͥeSʒ`ya҇Ͱt \N]fV!MЗ7\YRW: 4)t&];5W^J-߂`l: #XTNjta>^1h?.N;ӳw$\^֖-[e7lXkZ^0-Kko$Ij![Ro,Q3識z&[dLd/ULBnU{4\]ײ&<.oΚMUdגm@\'AtTma0; Skr-'nҚo#[ԫnJMD6G/bҷVlwm&vG\Y +-kxҘ05;gMJS^h Eg~Mv:Nve16r餄DtJ\1WyźªWrFv]VnoSիv}kC7.m5@m2W,lnSIV~3&솁[ةβLZqo]2g7)V)(K_e:nTc Ӹu%+}N:)o6m8F]S/+:n k׫N쵤n }!]-?/@kǦ/󥭝7\.Sپ$_Y}IVQ\nL$Is=PP_0.m׹򦫬Aloi~ӼG0㾘 i&}16“\e[slI=ڲlC eԫ-*aSڭ+^l > endobj 618 0 obj << -/Filter /FlateDecode -/Length 4751 ->> -stream -x]ێ$q}gK~ =H0 ȖAˆm F:-QYj=UK0xxd2UU"޾|"89"J J>w$0At׷ .o?uu"%[RY#B A:F0*DyF@ST0V`Mq*a* c2[U:(˩`J.0*%aR:"5)'<9VǤ Щ91tIx]t$s)k%-I:/p8.buqkL [ [2p\@$]]X؂H0Z XkET +0+ p[0T8.T$FdlAq"] j؂hエ#V^r\kIYIqA^Pq V`JV[@h8.M,sXl1r\f Fآؤf I؂$08tRr\TzS[ 0.i9.HFb%3n $ [BV[4%f܂;q:[t$i9.@&"zvK z3]Ls\ 7rk{ u쎁:̭얁b -잁4XYF`ZRIv@ ',O "okIO`.?;eG!@ȩ-+ ѷBbf`CڐY -DX,Lxȍ?DzT ɥ[,"4Kv[shr@Lm|4;8<o+&T,b}GL09jwo?"(||ZW>˵+N 0'<ӾvQ]l\ҘMvL'R\߁M9jkKNQY|3~_?AWS_RаsY~ O;Py5MGϥ<lw9MnqB\"꧛;!0{jGM3Z4滼<[47cw@yEF1W|sޛ]~1oZ -5̈́6FĽҾDkYN|[F!lm^vG<k~do4Ը !v]2KwtbΜSgl;q:znͨѨWlhq&D͠h2S1X-Vʴ&>6eLB[=6gl~ ;1G=鐻O>25nzf.ă?,=-3kCB'&A)GÅ -~_ 3sUՍ%=smr{3R2Ӑ+s3JїζZ9k-?jFWg|z˲V!M6 --׹ū%vhEuzKJ|i_}SCfK;L]Gln*m9kisn1޳CALFX'5jS򽶕챡ɷoGeuץlRC҇u+o`sCen믣6vW:\)s?4жwj8c;~?eWKu\_AX`}g~zvf? 6޲]{2?~cm5T8!ɷ/n^ʣ&oًGt/i2[ƥV_NVZ];l %jL(7pMgg9H}Ρʼ,2! 뼹㡯]zky<8K=O:v~qQcE>6]*[Dgx6o[C - ͽ`oLQO}B`*;84q*ϓ,]yOۯr#ٛ1:%6TMxa5}xS ^ AII.5Ue:^'c;L[Z?ðEz|IV~sekKPfCڳVOV2GGlNy#bJAJiY7>|;2b\xYofo#o8BkЍЏ"ɨT.ZOy:]^wfu۾*~jt=ttqͲ}Ï/Oct#"΍oӦK_ֽ>rNH 㭵pqF'oOlqdC~U#zLzawo"u03OuwP8dgCe܏3>yofynji'd?xp.ӡ |_a]n?2ψ{OtgcωܲsM;vJnY|t:C_=~EQ}|unʡZvܙ#;yQQN􎞥;쿃aG#'<vμp~~7wxCꑒ*tѾ<φ*%«Gy#Q<7qo5(E)8ڈ~R$p_/>1(^nUU)^\y3g+eԎV|Gd"8'Ǽ혵[p<_55N nT~[Q(MSz+C4VnRٱ&g~ -Uy/Wk -s7%(zG.#yE][89|,+Uv Y\(Uj6z5o7[*fVLB1= -S|36a/Ўi{=X9V(Xjv6.lSC״: ݹ']Po\ղ`TjRWShl0V ٖ.tvaӕ\RŞ5UwS:MlgdA@Xb#ԯk1=wZ7z#]m#..0] -*Fm(;^4* *7 U&%_m^ &^;i:󀲡ܥBhIOR7yH<"FkjkbƕPV#P]巕PuUwb߸m^ m[,&ZIkf^ 솁[)g|탌qo?_47p>FYH^[_Z6Ѝ[Wq&OcTa6PہXŞU4y\끯m.;ה1jQn q;оrijYzk -csp):+Jڧth2b,C[29V\O۱+ 5\ a]}܊! B`3^[5VV0F{x~/&:HڨIFikIR/9&?SoP+ cϴ ZňA{*[UZ'F*k%j/٪[r#b.i7Js{oRukђizdObImOil[]]g =2=ۤ|g,y].U;!*Pc*m{p? lFγW{%cMaA_Mx"+_%610[Af'(?7e"E0CAo?d6'oK[ -endstream -endobj -619 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 618 0 R -/Resources 4 0 R -/Annots [ 620 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -620 0 obj -<< /Type /Annot /Subtype /Link -/Rect [ 101.433071 461.373057 101.433071 442.623057 ] +/Rect [ 101.433071 236.373057 101.433071 217.623057 ] /BS << /W 0 >> /Dest (cb98-1) >> endobj +619 0 obj +<< +/Filter /FlateDecode +/Length 4661 +>> +stream +x][$~_Qφu plcfjm~%lsEfS(RRWo D;~t[C^$/.I`jﮯ_/6EN+{IEFུ*B%aT +u)[S I\`9  +pÐWfpC{E +nh=R~(-%#hFpt.DYNyΓEᜳ|Q*NgUD2s:_3thNdt]t\6#9RաGgt8i#/H |!p:5>Ի4Y'V_h_wKhEM ` + yo8 +rs<`N+/FBeuDh_4 ؖ dT-I8.0 \)9.0`\q\`@Rs EwNs\`@w )qw%/0`GaT0x(9. .*Cq"t j!y>h8. 𮶸nj+5դH6B,,ӆLh%X> *Dq婢cuQ(g-jY("p\`q8^`DX29xW(9.] A(`|J. +CwAKB0 @RDqbx8p\:bq tLF*Sp:ThaNޕG x7 8:p\`q $%tX8x e:B8.@`-њ B }/9.8.a>ZtNA׬.@<ޓP8.\Jtz @"K q\#|AWC9SA6tS゠ A e:qFh%Q՜dg 9BE M0S:&ۖL~04ctn B/Zj 4D _q\)L4D0qeo obh\oz "M$7N\o f`M 4lk#Ӂw: p&"[nn/A#>!81^MHp/F+ $7͑ؤ286kaJ%ٴ"'ܳOmcf&#!/sZ,/?c__  hn[CC+1i>b:@c-9/?L< 7pxL0}rMteLԉ9ĕ&^sq%&äӏ_~Oѧ_%%oT Ϧ_y~/n+e,GyԿQO4 ^'Q7C +oMY6qz'UU!/i +!&H |3y_ήTDܼʩis6u,tg'3Z7{YNӡy=ţ7:Ĭ65[8ū=bޝ?ܷʑ[z61iZX'@mlN8v\ R<3auWgj9Fx%|lle4HۑY=5.- xu鐹&:{|lZF"is6Ԛ|곱x TQo }Ēϒz0_z,_6s6tȻ|nT"n4deQ_reDX?FFrqh,|ח.{߾oxTjjI +ĝvPJ-Hhzr]u[EVV/Dž4?w'KX6h==w(.^Ԅr鐷񜾛:Ӳ/Giv>-{$N+H5ė>eȻN!6OĔ{u$o9yԧ(~xz:ǎ|x^Rǁ5˽36C߾xsY;q>vG&Vx2<Nӡjc;[fQ} tHxZlB_'/}gIe|ۑ>$kX;mΆV!ڂ={D_蟙M2i Hm2[{otHȆ=g&y˚- ;mN}dyj5' +~ N!x#V}O(CӮ,'{lߛw];mNƍta5[rM5tH9צLfn>6C'ڭ'օ>ozlq֝6C%&(1hh)>Y?qPftȧ틜}}*$5z3"<{ِ6bLkyU{Gk{YZ{=}bgwڜϭ><_|$sĸ;mN{U_xj;^CY=Hj=y}Ywڜ}SܑL +:Wбx$(lH\?$"Wp7&롵l\c mӽOlwڜ wU3*zjWѦy[\q4 [絀9J7vwe7IWoObJk-tHr ur?OqOoѰVa/%'-> +D7l r!HV~zȹkHpEIѧko?T o琢Re=$=v!՚ 6O;,O_3$BSYw5~2륤iO N]?936`=̚]R{tڜHu>^^OARP`9liS)5r,ƇiӫXH""rv%FLཝ$?r.R`^ľBc9nfi ʹ_ҩ8ݽj]}0+X}ڲpSlv.XSG]Jչ*,UeosMxದҴh>U]-4N"di*ĈnF̧&4f7vd Cr1cD [n<--KPMcJ PGԧmʛ>"M8ehpgRUz)m+WH +Ms"J5,gS-<ERiOzT/fO+:Հ"_6ե/mKɔO[JH*k>fIUA]' +S.WŶ@u"~U|1r*v;_[/-rYx6 !_,]X# νcd܈{2 sXm,u7{mq\pD܎diwSv[mXZf4q\놯J칤* ZXje+[W%ym}?4p^ᠽ3uH6Q*ZthI78hO悱z6q3H?Maҵ&HlB`'&^4Na~{=.$-^Xf8t2k:ȝP9i)AN5AFX,\4. YVOn42q`kɗJִm[Tm[ʦDK@w'kKFZ"Zd4vmmPuTV3;+=w6]ց+L +uKS ԤSPhShR#ms%HΕWBs2Fz- +EV4zw͢doX0Jsr 2Œ)!!T}*8l .:yT^*654OK +endstream +endobj +620 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 619 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj 621 0 obj << /Filter /FlateDecode -/Length 4848 +/Length 4980 >> stream -x]M丑ȳI?Ç50 c]65{ؿL Q2\OS$$_C>+|hc -ޞ/?~<)8JEQZ09|t3NpɋߖuL)y_b $B0 *'t1%I3\ƮUf֘(" 4U f: (%`nt/錞|L&FM>XKEIgaKJK:[VI:b)Ia yRHb0:IEtEQ[WZ%\֊!uFE"%鴞I+ -䃠3+Dlq#b#Bj5yu"-l1&XQ[0[T`M$0!L6+4h&Ɇ@ &SxhHgau lA `$qm-"qnJZZ…JRVJISb K K6z KV+ ,x5El%.;N#I\`Uw 8+QI\`&*+q „5HXq)#qkQb489- X 3$q  xW'?aM&wu4-Fy' x$.p]g? xW<jI\8LoVKJ1J\%#q"Dԅ @'8Tޅ{OxrDx{Dlh$.@\Nʀ)$xWḭ*ݦ>d QG;>):?I\%` VS%.1[2H\`Jѷ=-?`)&k%.c?QtL1E]N B\{)bK\r$q̀N[ B-X*M 2t Ȗ.tZK\ lA4(qA4L$.^C-(qA~ʡX&i)ElMH\ɛm'q6?lb#` 9+qA&o71fo -$.HO9L4R$4V˼ߌ$Rob'D>7EMIX$7Nߌ ~ytx%0"2MD^x]@|&+cqF1c@UL(p/Us -Hbfbg5[R+1m'Cό!w2aYXDmыFk~9=dFPJ[WX&ao)3Ie a#u!u#5hqNe#0r{jOg"hU`GJ& REtPg+9v̇fw?0zrik_ b_g\Y^e9f}Psf_XVeٖs;.-~_{ɁU_uSrCۯC{[K{lbk;_Ni ]^S榛;V[7 ׆m) -~Rti)HiB;W?z^ }z vOu!i]Y[e[2tsfA6Z݃u ":/3. Q/Kbj3w|r))J*VF:OP{_WV:P@f/,˴02̮^r#>/ =Bzyնd:h<zo 6 $o̾eb n}Z{0|l?Wb|{!v'}*~yW2MQmN`gCىk- Q]"67_[OX]\Mlx!q'iHrC;"-Fm[oD|DփurmƇ - ߒ_M}9ҟ] ȭl17e?»S!z,gz<ZţYW_GnycY -0zO{=VP_} .7.%ͮ,nu<@Ѓuac5$e˙w4mfhYnCW]\EsBnjjQ5x ~ȡ0|EjlYLy<\4J!63$ՑxY -jsD**G4m%;Wyn%6 z@gy:$ߎQ!mky-.m \J,\ECц1:j,uȘv:OV8X5082\x].1x[Qo2 y Q-o43[/x`u/ѣ~ y:f.yiH"ecǦĶRs_E%eG9[eke9uu `uq)]F.lo=ɥkIJ<Rwεx&u׹#ж3c?(f'<oG|s캔A.2ltRS}.Uil:i]RxNE{<:Oĝ=<vƊ=]]sYȋ>O\P? Owk[' Oy],n<<"oǚ9[hHge?<;Y3\ߗޗ3 -ʃu q'gguCx~t[s NԼbU|:+csq=6ߝ?7cC"3Ԧˇtɇj~g/= zֆyTl7Lo,_Z̓!o~'ʭST->!d/ I[GyDe]>9zaϧCYf]<ڽ~ifÁ6ut g|8\{Rw#5>2uJͿ|]z3xmW52Kb#+_F2/wUS~WwxܞnS"u;j׵ϥ߷qK'ҵ~A Gvsuj=ccs6q3w^-S"پ|ټݑX篵^D1r6v$]7Ƚec׏FUpvO2׽zXR@{ݒ0 {!?upE+ qӮJ}?&( ׿K w-;5+^a>c\2+V&.S1_Y;*7m3k2O]w Mc}pik tyuq&Q9*!*N.5lޠΈ\2? TS^襊8zoB7+kGGڲ9* SK_<&Ѹڛ\j|Ƃ5^sդgq~)^h-/wŚPu_҆wa3f_˚rmi*T]QI]-&ĶyD Nզ-&٬\ɶrDXnn͵ -TUSnJ:6¢ʐֈq)Ik^Nζo'Үsrz\H&K',*˯Rk<僶 R.$&^:VmC/ˆK0KG%ϤJ[Hِ1yHռLR.X/lw*+`E [oF?yg}]YڨI߸u,KR*~y|E]}Z[ /Z(^m.Mm-nZE TC갔GqB)|6ϊ_Vע%jpwlddnRKRm̺a!GWs#kZg:HOɄGmu C%*z=F\:#Rs%N ޠH -25ZRb!iN2A}yMIː씃ޘ*4"}R~ƞ8C +x][,~_1u@0ؐ`8!9gm:`!?_ukuuO0Yt.ҧO%G~/93/_ObV_JHY +'+ |ʻ }߾8kGSҞD*'QEԌ{errBcT0zZar*a +* mkUKé`3*)`TB:"ъI;98q:%'C'tZOi%sNg`Br: [4Fp:bt`uE9- +މ.+:".` ЉZlZp:)' ljVNr)ℍX-ӰӁ'!0UBKNgaRް:؂@9"(#h"^8@y? G*8P!N{рv2.z)1`:آ@+؂h [hZ8.Р[#@o …  4(Phpwr\A ) 4hW8.]mwFNV[` As\`Z +qb) Ыp8.V&wUUSƠwEP2q\LF]P=tJs\& ޕ3V q\`2X]Ǚq /OҹqbX.3p\0* ,xWjԜ+UX.q0I`~tY]D  -) 0 O"IX$qxC9.p]LVk xW=8.@\-3NB)8xWH0 +#K&Γ@ `(Xq\tXpm9. buxq)8. +h8. + d%ovy[v}`` "E dSp\z ^tNMY]Nz 7bqRS?Qq̀N |-*`*Bd$lAq"] (؂h゠VNp\kIAqA0nP 4&8.@br\X:آ EqAE qIMqAQd @ qAMe8.f j&x̸zs\ lQXlAq NzlQp\fa֛-@Mnwm3q:."Sq.Dd˭zg2Њ3;k1[܋ʳ{Kk$vfbekiJ)mE[Tp3FF 辮9Z2lWO|?E)+?BJm_a%]p_ޓ)AyӍG a8X9 0DLJ7Xc}hl&ߜB<r떯k^6'^ fY*A4&EyKZvNg2ziu%ty^y2\2i[Yڭ6vm*6|g;²~?;imuey Ƹ _?[Fn.=%Oj0!AׯmEߠԕ_[ίKSØQ݊y RVQtYcl&ّG",e DMF 3]rp6FcS.Ǵy8L]v'cГ_}>(zk0b29?3Ocx * `tMq %bg<~[k$>5p9.LMpU߰E?WmtIKm6fot85q˱]x~iv;߶Űe4t o +DC?C}~B_"EW3%ڗkMHgcۺ)Z;wc%W=scPPY8N΁=; \>c[nW`Нqq(Yv ^)G<>MT<6ΘcbR&үY}W4fRY_~?濱Kg{7PF +bA (kf9mmm6S>&Iw(3է˞ȬhL9ۦ(~!rS)6om"ۑz,!5!Yk嚍s3XeEuvy/K!b$%^wݵ>'n= ߽dK:2`~ƪIX1(_"au9kwHc/y4 7'cq{p^#)mC/G޲nv?V!C~m+uz_k*n&r\v"^~K֊Z~yg iKVɥwK~a$}ٙ#L BYI&F Tܙ^왺MIF3ӓ"*MzFlL{|eY. OqLmy+^4?gj~[(tz\1#DN'bjd7I+WM{hXj Z(Xb7V׹&]wݹ'Pޗ^*UtgTR[R1hά譳0 .trbl)_S57Sugd#BK1=^Z7j%#_O3m +a zʭ ^ԇ* "wv3U*%IV *^::4%%`c iNc1HR,+ꪘ(re/TĶBu!nv:TݛYdw[mbW^\v/K(&RI+QgVY'lkZى|lq/OiS*zjiI GY<%ĪBWIy/k ־i|K)dz}q +}spN)+Jڦth2/]Y0WR]O+4]ta]3m.Ԋ. B`_W0F=dWFI+Wk/ #i%<^ӥ[^9Gxmen䴡B 1IC˖ؾRSdJDQ2QdD_lr9[qKjq`kLѤ?}T'ھW*-[f-ξN5 Դuee=w0"SѲUʻ3vT'^ێHN'sC_MFnγW){%}Mh-TMx"^WtE[E660[Aj'(}VLBRCOShi}~ 7e endstream endobj 622 0 obj @@ -7682,82 +7693,75 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 621 0 R /Resources 4 0 R +/Annots [ 623 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 623 0 obj << -/Filter /FlateDecode -/Length 4701 ->> -stream -x]Y~_>1 8A`6|Eѽ`vZU<ǏŒW/$ F!DE -K)fIz{肽~"Vyw}MzgȫbtJ>eT*!5v^YǨ9̰(Tyab -f -0C/Rap*!J -!cbt8 QEV硓^q:獴9g3F!9-V#8l1:xN`vZ:آלމ.+:".` ЉRlZp:) ljVAr)ℍX-ӰӁ'!0UBKNgaRް:؂@9"(3h ^8@y? G*8P!{рv0.z)1`:آ@+؂h [hZ8.Р[#@o …  4(Phpwr\A ) 4hW8.]mwFNV[` As\`Z -qb) 0p8.VwUUKwEP2q\ z]P=tJs\ ޕ3V q\`2`X]G3.?{ߗHY6.m._ <&mE YCFX)FFb)r僜 f g&VAbcm;ϛ - >65r/u]v eL -a{4/>\c]lxçϿӟ1Z^.Ra/䘆;ٍ28k)ceK2 -MqMeIg2J0@i)꓍ڕ2eΧ';]SW1Pަ嫿]?zcۏ'ӟkӋitvyN_ C[s6o Jԍ)ҭ]mӽai?R,ەd}:)eN^ض[_jɼ.e&h)Cu|;Ft!flN4B1(8bm u zOLa:***]‚~Lur)-©5 I%7񷿯lf %u @OAX._*l$jD#'\xDpaw={c6O41L-J=Sfe+=d>Ne^913w.m=vUL=OWt|;rӸ7a`\(l)~?N8vWDt5?t^t^Df/fAn`D -vBzL`VYld -tlvޱ-[?Ι-*QOu?/ -֮8vagNs9nޚSeNo[I1/? lM鯡>~u+5o֛}5Ͻ8YTkR9 RAJAӌN/̙vD t|mY1qGFRlصyd*2kmDk(qh=lh` wuk(!gQmdHi?lӑI١:)zt 6o{[gj,|il"s:Ԫm|^oyG5CkV{V'{2]gí/쭳W^u-˝Χ#3rmՏ;s:m~Wo,Y/V}+v Lk}_չ⯠?`ӡrϼ:OiVwOWZ}FcՀ#dmX-I"G>BHdm`ӡpo|>kt $7tۦX?|_3ĜS{}&%;! T5-Mh<9v`?0=o7߽0WPU=% 3W+mb> R񛰛=ty3wJ&?o?E:`.W61Уs6$Ɲ; vܶa:ۺkb#4>c=t=c-#4(m9H?idW -js:o({?)Dos:Gξ,k>wOfrljCjt&j9j6acxomJ^ngL×eosˢ@1b4b'S5 v(<*#秮HzWDOGƲg陲[Dy0jt粤gP*ctFt\:.NCLiM!wi ]+8~s^)?3;,0Nώ6,KGtܽpaއsufG|Ah#0Ա3EHл4Ŕ4.2g8Ǘ$*_T^c{PL(e اvX -fƏ|lt"9Nӎ3Btr)֋ANbzNt)t[MX3.H:xtbzuVf8 ս;rQw(2e@L'Ft0/D.`05:} $SŜ.l4[FʗTf):gd&75sDq.v4yEhpŚ2b=V6C"J)<~2:B)1O M_j%47xI1\Hkڦm D%u鱙Fc6H\, ꊘ(,OV(mL\eZQ*s-V+ڊ}qIg{K 6Ӌ !WRJծVa *4yvuq+KZ+:iIi,y:Da Uu&nW2zY8(!LFLCU,CMk3:TצfsJYTm+*UR7=c7#cSRIt~ -mspN%+JZthj2-MZ63VR7PhhUg2eMh 64a~xz}O&<HZH_[iiI R.9:'oRn.NNյ04lSVjlVi^( -]@&Mnʖ%8OQo{ڶR:ѶiܼoIȶpu,d`d]YΫiꙊ.R>E \"!2Է`6kӋaEpb^ބ&4rwX2"c%mMdZ / P}EST~/- -Iu -4|Ezc;PUWjrz 5PY$S -endstream -endobj -624 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 623 0 R -/Resources 4 0 R -/Annots [ 625 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -625 0 obj -<< /Type /Annot /Subtype /Link -/Rect [ 101.433071 713.673057 101.433071 694.923057 ] +/Rect [ 101.433071 502.623057 101.433071 483.873057 ] /BS << /W 0 >> /Dest (cb101-1) >> endobj +624 0 obj +<< +/Filter /FlateDecode +/Length 4869 +>> +stream +x]]q}_̏p Ly!%%ԭ]촪Q*KjI~~/bLדSWJ'w֊tѝ C^O9>)%o;sVB A9AR +* .* JI*ADAaV` $AF)QC5N^=Lu:vӒ.M{%t8M$l!zDl11XI`w芢(Kvr)!nuFEkzruQ$-^$`H: [? +wJ-$%q"npF qַI+@WԥI%.p]В"Dԅ @'8T$.]嬕w!uF#q0m9`uRL!Jc%xW$.ݼlJ\C(q  |)%.IAO N₠ p,Q[(dS b ؂ADS҈l\Dɦ$.c?J:o@ע.B!ЄXK\1%.O9\f@Iₐ` XhK: [dK\H:%.  ]W`^t>3J\O9T;M0- 0>y$.MlsDl$.f Fb qARI)ơSJ₤#$.(qA +Mly qA":؂) &IybI\(q 7ы)ALw]3I:."S/qDd+g2g3 +밶)jĜ=4YF/f B6P_c9STpX3c'0-}sbv؜۟O}{~S2eG#@( In[TLRBHlDHH Z\nH,yae9 to[ xHl͂dؾY Va(c!T*O'ub΁Cf>Klɸ_N~ӿFNOJ:_gy\!boӅlmk9eq$Ȗ&mf}:AU~YeҎt^ԩmΟpOk@(sTJ>wǪ_zز*JW7 s.ZW+Qjpːڃw݀D;-SY{s.o*4!3 o``g)vCP:XFF#ma9~ ˯_NCۀ>et]m_tKW9 98W!hVˍ}Y1@;@Lֽǒ.1^,sY}e}a8/W܇U]R9!׉32ױ:Oգc13.2|9񸜏e5mvX:Vu=jʨxdd}˨2:φ*s={ݣa|̨OJ9;t)<RGL-B_16j{Ѹ{͎Euαem;-q0n.wCaޥRLIEӧzӡF _ n}urv}m3Ĺמ ٔ{aUm,̤H=Vz#p"ib̼}Y3w.VPZy6D1Ϊ{OJ r|ewdy:߈U?;hjbW}Ōς˭>a̱U'?X{#v=rzϬvcT"pN;h| xӡF|:F㕓aʞ"v@oY헅X^#˾K:φ\:vka]nB1xj`XփuזI +GGPt9(rQ29G6g;rL2^2uih/(<RoĪ/BXh'=s|h֟p/9`׊5bs-ua9}bgy:ľ:1;|e ȯ6w@`Cߍ8#ݓNvW= Ǥw\<ߗs.m s;8|?lǀlgQŧGtqo8ZîEegCQamf{;mZff*Ccy(Wpγ߸`q5S=2R$"[p+Ũ&)B:OԃǕCukm]SlrA9؃uc6rokjW+N կr1#T㺷u :ԔNn,Uspnj3̶bs`#Y[(:O_cFiM I<4JAmʎ=8 +7Ҍ 9hZfn̯ua=Qo2y6$1kBO95=.m \jٕu9b}!Fm~ߕ2Kv[w42t>/vgA_:3*Sne%}gE*!*VuEYj?mg}eks +uv h17Ǘ~/}{͖`|Z7ccn`(S=wKgpΞy wwyuů_aspyMyێvr^9bse双 3s`[~@Wd|.%˸-mY}n>/6eny"7KY>Cp^Sڲ}W}lG?`q!Zw[k6و돹 >+l?ǂ:4.W}6xdM/=rgs3rc;0&)5~kM*.Ka%߽8<[qʱ0ލ)Wpl5}9|k6BG6mʼo bX:?+j,r#>>й M#x6SO8KcvM B_ue^tr ė-KܴQ.3.گ0e(4-s ۯ'_I)ΐQYutq>,/Z;(cReAH1_yG*hA9w & q.UktC삽bXҺ _ZW?W&wZ~v3ZȖ Bz+g&{d#Lq aox`xSbB*]\:߅t:͆5 5n("J]jSջF5eF&udj$.'AM٨gXD\$[ZsmB+{T=MP9^]؆.DZ9l縿 7f#_N.] +*вv8.A?ajVY~x +פyM R-wf徱IzY.B,J(In[I˘dbӠkeqW-y{>Ѝ/[Vဟcپ$Y8E-VQSlef$魯>O|(l0"ڮ򦫬+0iiZ#z/&:Q{~vbYOrׇmͱ|P'oPk˲g[ӧF-hu1ʤW[ +8)U٪ӺP4LUYk1TRqZLѥv|T)ۭ+^l sgzKFAy&^VٶoZ]W3; ^mJ>̝ΐuJ՟ ѱd 5`- V{pW,5rw빒mFJxOUA7@&|"VۡjItTP9WK%!wL~Ao/* Jru>)?? +& +endstream +endobj +625 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 624 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj 626 0 obj << /Filter /FlateDecode -/Length 4862 +/Length 4751 >> stream -x]Y$ɑ~_ς }Ê=@YI=ttI,5><-<,颻307H/}WNR?~)z?ꢰߵrq:?)fobpɛ?}L9_S V`y?h|XAOŜ%eEr b8cJú햕!I,K+ȡR"(xOJ)lȋh$SN{-BI9CS8 Dd1)Z!vK֕DdQAisrNeTi3O>Y$֓mZE -Q"xijG') j!1щ<ȂŗȢb ;h"\08l&%$0)O.F+~r!G -UŻ !Րa">2$V ÷%셷b@|)Ge -bnLIJ"sLOD`>3EɌmݷ7;?vg8R)?Bi_a5n1H=}HHH?s~XIItF^2?#?03os*rD탖ev]Iˊ)4N>/D.>%evRh \VȌjِk Pn_>݀Rs]2,ix~?b1?+i^}Z?c|? --|\/}k6΅u;pk;`}^}˺^]NWl}f򍲏Te6k=E&sdli}M?FYҔ.bA~09&03jߵD?(Ot3&1'2ݸAt7x2btxt"=~am>VYe3=o}͐rYe֬^\dG5uϱ90Ƒd2]!l|ٴ;DC/zyQd[01 %?Zh3=zmy -p~g>-3 (^ϵg>f8-8VG v<~nvyNJY$J)][>OgkBm&^$Yzc-a(gMjW_GzDŮ,}zqgYRIAGg߼V{YI"j%D :"6gf6E0JF}C] x,es<%kCX0d7 Ϗmf2bYvvڎWm(m ' ֽs fgo[mA]L.pb2 }gʱXkĂ/y6 vkc̞gG n5}(ｩ>n|=ᦳo͋}cSttwD\pLwq>Og'5O:"m=9|EMcn[(sJu<Ei9XeKjN\=[.vcxէj8t-V6c!4{~5}zuf(2EӏE;aQKtQtТ܃waӲ2o KlQ}\H:HC{Y,L -ʙns/X.:7_]TES׵_Atqw_ !}wVSƲ|y_qPd\dSh|ՎKֺZlhYec+ sU+mGZ7r˨6pd-ZqfK%bY3yތ8.{JͲu)0y̨ D7߁))z7L|]fc< f.<ƤTH* cvg& Yf_Ɔ/3*?[ LI":6>ھɋ&ym/,h[ eUF!ȼ0Lg r%ZL<(_zT -A笷SX3w ֞jȔ3+vGC?գӻwCGiCtT|gi݀|]2e!۷Mz<ǘv15kd\pToV:0ӱ_äeg^ -5 -dE=L8S~GGm9-(vhP[&'k\5=宇fÐtM-N=,Om)Y[ň~KTlN6ʣ\ɦЉMt:͖5-qôvT:UkTY&TnT_[qm&Suhl|jtLLՐ\kk;|[Z5WwQ/R=l&SAJn̆yvb'|ZWDm䤺t*}aYitB;CoTBAfRtel䵒8=4q-S,חNJhOZ7Les@ǚ52AXOJNTULɾmz& ovrhɱ#Km\f(͍d2T'd1b F_ ֆN帀cd}~+nXoy6#g?nTC ӰuE枌~_CHPm0q ;YWkh~׮wWkKT7.'CF6tL3o]K[owtXh -vp:v|gC⊚v3#.d.JL2H>IS=RP_0.mfЕV5Ali>i^#뾈 jF}vcDm'Sm sl{5ƲlC 6ʨw[x>դQ4MUZ1Vҭq[Lѩ|U=_iKVע% 9Se%@ wVvnz;  =2Uߴ|g}ԪJNd8j5+B8%VysZɶ"Rk%|&,UQo0Ex#3Pݲom -JAԦT~M) -P*o&EQi,*fHUdCPNP%ʹ!㼠z)$` dh +0Rt +f1QPEa)hV%a&I3trAPi;QJEdnt/|L&FY;@iIｋ`KJK:[&RAybU `t芢(Kvp)!uFEkzpuXQ$-^$`H: [?;wN-$%qop qA+@WԥA%.p]В"Dԅ@?T$.]嬕wuF#ql5 guPL!Jc%xW$.]6%.&J\xFiH!x |Ru~ ((K +$q!%.Xc$.e4o1<-l(qlH<1ft-"t:H\ ؊E/q~`wI& B-X*`+g.4l-q<]贖 oPh"L$.XC-Hq%.v%.2A u4!q懃m'qsDl$.p%.e$.69 $[I\M4R$o(qA +&Bs]Z޹CX'g>dx!TQ*Tuv6Oj]rÃ5uz;;{÷!]%}r5T~˾obAZtGTx/sT0Jm(A9Oۍ(-#H]=S]ֲóp y a|6ϛrK'xhf`ӥiv}Td'͙g2= =׏Ee֍OTekέ&b,:+{4}"0gH)y'g7Ep<}0|EUBW&X(幟jeY%}3X=5rΞӪb[X&m®{_FA>:^`=WI٬f y76sTQ?΍8*#e⦘Y!r1E{dNydRڝ3fFoE̗$7fҗ/ԕ}ڞK^3,ڭ, {C:uelC{(Ä.v2/lQfd;يY;j +;ޮ3mg2+ڴ΂msD}=WSݍjw@u#\C*{Zs.qb+ĸmn_ ,=:q%MywvLu{c{ܳ*fk1:O}-a5]zd4;}γ+82Pa^-n.^ֶ5vrO-T:Ssu~žsyfO׻vfw7R+>'WWfG%fV/^k2WOy:dk=~olj(#xsuw[p%mu.]gb=}Hչ\?Y'U`C.CfD_M\KhR;qŵwm̮^4.:K۾tZI ;su~ƭ2u]kB?o.ʱk~}b++ziRw?>57suyj 3;:]wtW Moe˗'N;Hf3jm)c<)Ϡ랼Vs*:(ȿzZ?ee-eUrthrg#u }᜿yt(e[c{VJGhQNy:g*"X";#꽘3?\g?v^unvOpq1k5G87o; g9boNXqae6գV~ˢ/yڮl)u∼|y6׹:O99#.U>lϜŽqPme&ns+3V|ȓu Q*q|lf9-@? ·8Y{~UUZh0qNrgV9@\yWx`[hve㕝>.0[V<+jLQGuяmZXdo~S; ?s83=p־a\9մ|:B8hoz8ҕ%]I׍a?R?D,OLE'xyQYM9h 1`NY8}T-ҥ`aH˒pf1?WΆRIacǂ5^ՠ'16+v:~j/lڪNBuĆ=_P7a5:M)kB7{ڥMzJSet2ԕuBΓ ]w4M̪f_y0 +crDXnjՙ +TlUSfJuYI=Q|=@k;ܘvqTWb]\JB۵[Q54)_?ai?0U)3OB_ЎZ'6x>HW!i4V.Bl?^:*(R3!:wa&5*z!~_إF+YgDJ 1*h~lX5U^-WKJ<@H5[&5(sBΖ J~M6K^ endstream endobj 627 0 obj @@ -7776,7 +7780,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 240.123057 101.433071 221.373057 ] +/Rect [ 101.433071 770.673057 101.433071 751.923057 ] /BS << /W 0 >> @@ -7786,20 +7790,31 @@ endobj 629 0 obj << /Filter /FlateDecode -/Length 4787 +/Length 4941 >> stream -x]ێ}VH@Y <I\H}F fT#qjL-$%qop qA+@WԥA%.p]В"Dԅ@?T$.]$.]e:BH\: [aLYSH:aIU*$ 'R3R[6_2=VOzx@i>/&(2&b:wfyCGm=P29 @@&Wb1l;˿?Oчs_~_ ׿p` ->a;e6S#>7fҗO[]ϓNvŨФL~cZF{T|N0|x S;LFh^ey ^&jo vǦ+}e7?oi#yõUWX| 3vW&kuג.1elMzTG϶1NqZ)Vl)w[g]=}"Mۋy >f}uW+.g o{X9Nfž􀗳3u<=г~:WP"Z{&ys8TmD~`޹wߌoT{+{[ayJ]>貭P`H^n?ǓhYi/w9oaf?5tKR>]2~ͧ՛S9nlҡ`'>\Q*=ٴ]ڍe~W~# 7f՝y~~"2dn(yhUT|js8n"M9V84s_C w;860?l-jw9j7?^ĭUrܖu>/'+{ 3MI"[uyOJC-5ͮK>,>;x:&Ԍ^yúx.;bhsFc?빳egOߙp ~PcYTZ㑇z)容(shBiXJ<6Fyn%֮ z^A{v9mCl=qa)Rb㰬y% we1:iw4oM=<+ ,+ֹQu?effr6܍~^vHl86oj:o:ͺ5u-j|f)QUF̨Tbk? I~JYeWa,@5]*$JsBM[TZҠN6 h|p7#׹(}"ÍY/'gHl◓ Bj׸B=.$VnGҤً~,|S*\fh[!OikW<6xH\+X --k.B,o/>nM][l&eM!2IUuE]g -+S U15P~UT56šGU{k Ex'6ۋ3c] a &n42h씏/_ f8r&'O^>i_'{c9:UTnL;"Æ e:0-j^Rʠjе6dbSk4q7#ھi͡ʇpoMgV$r6Ck ˈ ^(.YY633WR>oyWP]07"_R6l .0 ^ռ4G0~Ledi*}zcYZ OxuΡs(P-أ䴡\ ;eزM ٬2QTLY-14xQlP}&R^񋴹2Uo8C;RV_2 -2sWm)Ȗuye=۰#eJTFfe5+# +*}UNHz1O/j +N_I(7V&C0L׷ .y~q:)%okVB A9AR +* MLIR V`$ c0RvJ0M +f䂠 +vh!At/錞|L&FY;@iI&ｋ`KJK:[&RAybU ;IEtEQ[WZ%;D]N:䢵Ji=9`ӊ:(t\uYe$-Ip6(VGUVK:[ $` :_ba +^)&!LE & +J4`ȧ U:%" +8X [#WHk` H\`-l1d%.`[Z$.[RIK\`paqm$qJI εN ,H=H\`y#qZ^ ޵޵9El%.;NVG+qwVAb Ыp%.V&&*&` +uax84A)#qw /q2 wA!N` V+q +  xW'L˜[M:&/qui-b:Ѹ.^/74:?_Z:754X(0^]uҐ&#t! =_yNڧgYc9u&;﬷Gy/lD5xފ`qA¤4M/ 6"һ#ytȱe +=>esڗ9u[Nk ]+N1p`K煝6W 9Z<bړywٽYsy4.kF8. z7jAs'NgwйY)X$xA2IONy:$߉c{r6qˌZbaE}ŷ^P1={nzkX4qXԍφ^:Ϭ8^߳|@;@_HeGݺvP(=Pz"TO0{*Z 2i+?6,FU4MROy6_wvV^խ}$'ܻ۽`Oy:Ǯ^()kpvksZg]3C40ּ2D!;B5{]ߠcAM[#+eFy`k'g~dOy:ǯ#;J$ϐT=?Cw@1d|QAf\lAfW2pe~m< zAr|y:$ǸVXn =e5pew^7աUa=h,umӈvyOy6Lӝ]a>szk`XqFe;}7]bʱ~޻;- Fc<#a +V3 +oίi~y:,vmOtԙ&B m +K9eUk|{=XOK6%/kKOOOwhkY <<ֆ9R[6_oqp٣͒~)fowFؖUXgȏ, -3v;vu҆?*ž=,=e[o3"_L+\~O.3z}X|e[U:kSՑ1١z[V}d-ؖEOBi_0|]|Qmr,s .R⿎%`Ó^ql_k_>jCqV+q|g5oK|f"|4UWƂ^C_/Ιwr}݃;xԚ6]Zzᰎq rRxq^0`*({6|2Pi{ .qUG$ }Q#S?~'&;>zzn6UFc1pņL,jXL\05[ҔA0gL9k=w20cFs(Z(7עαF>i˲,eXڗ{ǔb +1'=IPeyLh;?4>HzX#~Pػz2!>cJr;7okN@RGҾ]Y򤝑{;Z+G7vIɅD0C:]Z_,,E 򪈣]v+@#jenOT 4nRAސ?W[-H&ùbA^oŹjҋ87Cr)Cw*&t[bujg6.lsi5 ; MkQջF5eF&u5ej$nAE:Ysuga@.tv-S=kt/n쑜leǵ8?5ZE.Hⷋ Bj׹B +=.&KCЬ|*i +פyM Rd~+cNrX$h +=-saKG%ϤR7eLR5/T#X75qƕ\]Jtm:*ݵr7|z\c\*Fq~tQm1a7 ŝFߊN,cdҌ{R9cOx(K_i~߿^z<4n]L#'̩6l.ֱu m75{MB}ĦAh<-־|ikj.xsp)ʊUNڧthɰUe+33 y%~]as]삅vi]e, B`/xyie`}1ڛK[ò,ү/ۜc˃uv,{9}hЂVL{%R*E TC/٪[Jb. ҜxM\nZd[8Co)[,繛zJ[eۺi]wm =2U=ۤ|;saAJUN`zLԤ5|נރC(]LȶFޝxd#RJxM莉UAoMx"W7Jْ>[Af'|mX,B2b@ޘ((-woaI?hl endstream endobj 630 0 obj @@ -7809,82 +7824,71 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 629 0 R /Resources 4 0 R +/Annots [ 631 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 631 0 obj << -/Filter /FlateDecode -/Length 4776 ->> -stream -x][q~_Vx?؉^FX!?_QIԳ tb"EiU")<]o_~)89"ZQN>,a -əo]yL)y_XEv -1UJi+B0 *'41%I3\ C[UT0* KAۭ* 4I* J+ءR("kvӽ3z1$t:Igi%].J:-.)-lqHI:B6IaV:bb.$Aa ElQ^iIR$u :Cr*IM+0I>:[rIgt~$x0Z ntHtDA&!LE & -J4`ȧ U:%" -8X [#WHk` H\`-l1d%.`[Z$.[RIK\`paqm$qJI εN ,H=H\`y#qZ^ ޵޵9El%.;NVG+qwVAb Ыp%.V&&*&` -uax84A)#qw /q2 wA!N` V+q -  xW'L˜[M:&/qui-WQ1P^U2P^VA3P _^#0+]LPj%n(/1p¼4nQy!`Ό0,}[sdNy,!&W&o[8̦s!u4lYuea+Lec+!ϫUܓK',"0LۦJqF\"[#v< -l墳5uhݤ6M`Gݖ_7cm(P@ aȧm͈о69ikɖ~r}}ݶo0=ܖJf?e_=;ToGfKWd|xMsRˈs[1V -7r i2"r?l=|jCvG|)Hwcӥ u"'I;^\, a]^ ِħW}B`snٜ$ }^=S/tgf[MOl֢z˧初ñVJ3 a,I~<9g l4bЫ -pDJ y~[3 ^g\o}.T +ޘUOwgMfBuheל$Hô>acskn}"Q2xux`Zi~sdC{hhgY { y AwQK/O`Aə k\CAZ²~X{Oǘ?xTC~՟Sߙ7R$ l !;tfrQh8J3GwJևyCW]Y@=Hsy`?o Ich+dpm|%1ul})KޖzSer}|y#w>!ݴ:uz|L;Vvs{P2Ŷptڏrw,iGfgT ;Zg8Pu ;wsq;lH=R"B l z䙙'\?Cm}pF^oC9w^ cj;Lrzez^gy>Em*~טxR˗_#Ur^4y%=1`}̧i|5rPԗWt[N^nhmtߑ{R6"I0+/*KvΎ9h_Pq(E7jۣUGS/o'AL:9|U,*@Ô)Tt@Wjk8nj"k6W,뭘[&]8r)| {4bm t[bCol]L]iMsOxZR~s-zר&QI]M:Z? E~jфl홳0V QKj:AtJiThbϚ)66 0X?)1eץWj}.Hⷋ Bj׹B -Qhr8. -C݃LIyM R~+K'rX$h -=.B/Bz&ݖyl!\6C1I5XuC]3U45(-N׆S2VnƝo82fo+w|Fk1C?Jب6a7 ŝF߲N kdҌ{咧9cVn1E_/t2y7iܺ3%xR -۰b{ZWqc]ub)ucPݴubӠk͎EWYnŐ!/ƂI=^?ߋɾ6joҷQFxKls͏=ʲس-C1:HcVREuhtVb6%8^ --ҿvc4'W&-[g-ΡN-̏zJ[eۺiYwmC3{dz6I.{ؙvT'_?t(? -([#+Խ&tD֪o&ACQْNsj8PޟB2R70 Joû>?s. -endstream -endobj -632 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 631 0 R -/Resources 4 0 R -/Annots [ 633 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -633 0 obj -<< /Type /Annot /Subtype /Link -/Rect [ 101.433071 461.373057 101.433071 442.623057 ] +/Rect [ 101.433071 311.373057 101.433071 292.623057 ] /BS << /W 0 >> /Dest (cb107-1) >> endobj +632 0 obj +<< +/Filter /FlateDecode +/Length 4702 +>> +stream +x][,~_Qφu am⇁Oʹҳ0އ)+uIe䥲aOӧ+#t>} +E*K*!zG/_/Rx+oH1?۫U{% >Z6/4j^sR>x/-PIe{mrJcT0z4WyA1XN3H0䕙"^*ZϨJK`$2)+q: QGVS^s:ctQ8lt[lYbtLduEo8-]-@W`uE:8]4@"t20ii HNauQ$-N`5Rs:[?GA"{AQG:A:DAt\ӊ##a%1Q0rYl18.0 M%%|KR9 fJ GP.9.0\t1=kЮ8.0]CJr\@]c0* kxHs\^X:qwuqw4xW[7swjҎE$ wA!w` iq +n "?fL +q\`*X]ʣřqVʹqb2X.3p\Q5 fjNU:J ,x~p +߄.B8.]ВL c!r\#+18$=9._-3 ++zӁwM&'@/Xs\E \>V-^B`AY' Xhbkbkx"*x.` K,I_._~F_^/NӿV_Fy_Y[9Mg/ְ~e ;M*QwS8 6.]uo]HdK;e+4mBK}Y+kp]PނY +Ŕ6?.{#Ïzs>foC;leC2^1&s˘yi՝yN gwAUnr|{ټ:(m7P3P}է}Çf^oSdphc\g_Fg՗ܽڙt]?n9GwAKhgdt-t.ՎGl~ڴeoOMoehNJQ/PJ-Lhzz]u{E^V/rY_}ڬP2-bYOVQG[]ַp/9~};L~Q|3T#: FxƿA(CmEv9F r[Nn1?; +Wd6-K;m[w(GI.v92qwcx+!!Jmt_ӡtÿܻhRvҪȏ]h(BXںvsÅU갚bpufIbI~RzX&m]:9Xmڗ{iPu-RpGްy`Eڙl h7}P;.[﹏ΎzӔFFL+^ٿ*Jpgӡjc⿘wwqDmt 3鐲+~3߸{.Dgյϒʊ)]7V-ض#.Г=;9ZkoG=gO^|DlI[@jٲZHK.jѰqFy|7;F>_lvs:D{ȏtw97Ӆг>l嚲jܛN+˺Rc{yN}Opsqރ_W};i8@ug!wZ"I{R\3E'9}w#IM~?Ǿ#xν3ِ7|w̭hNZ m煅{KmW =s:>|~iW;qw9}gWS߫S,Ljfyzfr{>#s:}٧G"U+\]$EXQhg!9<sH~XAo͸1~xm=L\@o}b37=jFEQ2B"~wܰ6#~jFjcPz`_> +endobj 634 0 obj << /Filter /FlateDecode -/Length 4832 +/Length 4899 >> stream -x]ێ}yb `x'00ӻc# C~?HRK3NJb-ɳ#w|xtrAV_oR?X]IUޝO;şOyyVCNI{CR=཰*B%fT+.1FN37,Uf,FKTE4 -fh=vH%!C;NBTyWNy#tqp lQHNgaN[9آ5Ew"  -'$z1"t")aNaFagt -8a#-V 4l1t }lUivk%E)oXls lq4$^8@y? G*8P!{рv0.z)1`:آ@+؂h [hZ8.Р[#@o …  4(Phpwr\A ) 4hW8.]mwFMV[` As\`Z -qb) 0p8.VwUU.sPs\`8 UV( xW8.P`.(lr\A!,wec4j!: ,xW qfޢ\w4 xTqJ OREq"nDq  bX.hIq\/<&au~$ A w#+80{XlAq\:L[fN#XSp:aNG x7M O8.`q f; \!cun ,( c+آ+؂DCl\-9. !q1*sjtts\%XK % `tp\#lTh -9A6t゠` A -Xe:q<4֒jNgDZg qC -9.4JL` hOZl[ bV[5r3p\lQBq\l -؂(ܐd @ qAMe8.LqAM,yKMqA4"DauASd-8 MsEEqAt.73DDϦBZoz6]޵L8z- ^ʐVPoeS oٜ54XYf VM/11DSTp}]sbzؘӗp{z]Δ!60 Tp[DHQ%ǜH*Y禎)AS- fou=}ϧ7.(,_{o ,m;r+û:Y1@!1aӗoѻºkoddSYKyı寞'5yM_m)9c͇Nivm?u8;]~?D1]P_wߜn]O K\S⦫W%% n#CJ͇¡@2/A2,Y:̒i:]kڥüS)NӕkPs{Sn "Uc6.,=0B0':rING#_#Pݨ2-e^HQus8Z -:o:z~^΄Unt^剠7YGm+mA -&`gáz@**(hC0C(. cCԢs =ʻmyu_ 6_(V-F5)A <*ub9Z*8D.;o ɕU0 dm!t_!z\x֐QPAsՃwrG/Ǭ4)wC4.j]\I6/跐ᐸ4}$ٮؖr#Lu[Ds|]E֝u}9:JcRg#yV}x;r; z ,[xWJrѺк/Woξ"mgǒ8`tGPP_#.5y*%l$iܱXAНug勒I2[uH+:2z^C'] \S4@DŽjӮ#_WA;ڭJUݑ?6n6v+8`CbʽYh6r(eȈ+GTz㑻Fɋ]M+WSU84+p&Zy -$߱`g!z Cl=qaiRMEa9dw.*am裓ϯ|N;cvWpވ`=_=:3 -nuGfbv)_絈zm'IHsy>0]˼C]^'p{`gw#7w=O5GA+460'27}/*+nEG.X+SDO9u/ˊes44ڝ9קn¼ǹ@-KW5+vjss&}Us8nkrO}{5жџ+}+(&;;ףz-eл;JF+#)u}_*Ǻ:q>;UIOF[<:CFw HPamXD2v2p; 'mpF&}u #2p s4$|F3 e29vkut;W-[67]#M9jJ/[Vw9:7 Y -((ދeδߟ_u'JYo+ȼ#YpȤlE*enY `VSw#ţW;wWZyw:GCȯ~fYWV3cI,j9ǯ[kfrO]ww Ww3˼5Yp;92uֻ/O;DHNKGY^W_A7:CX5Gː=i՞stg!w#zcw\ZFhEtϓWxn ”7 Ko,I-Abz?}AIvmNq:o[k 乏tjS(ת_K8q:0Gd~R>(n2lI:IhIOb0ajO_tzvz˲1]Oš]ˬ?0W8aLq14@q\}d'Z_iןSS5Me+4fzl-ycԾYLwD6r2\Pqf}ʆ*'>sز]dilq. 8AЌ &u:wfOoN{^R8A_]f |uyf9ޯ ,Lo8Dquڍ׋>K9{l폄KC<SG[?aOiB׾%pd-[a1lN.T@қ E>Ӌ Facyf~_ߧZjzHoIotG{_%8rϧ5Èi^eCGQ2:" CKj[N<売jR}[Q - Č5\ՋANʺ0US+6C4lkUK-.)u $RVy2ׄN{3+M/*MU41*V-%뀘:Nrb_Ҵ`V=Q -L-K9Ft9l)_KV5o4P;]H;8|S@RnF-5u&6zm\!ljnҤi S#U*M̓?HS!^ҎIܬy'QcƷdLDttXK$Uc.uU(OJ*mLudNnʝTjom`/ٱ^IXɈRhFY\fkexcdǽ~:e7Uep4ʒ7ɜZ>2q%*[ʭ31dաa8J!Be7 -h~\)צUKIYTV-ևD*tԤgȼtlu8Fp@/tsg$Rҡ5Tm䄱Y633v}С\䀄P7in6]d*HІ'3{^/dWf@Vjg*x·n~X}>2y[ն4{9mj(F4jSKOjlv(*]@&MnV%_q`{טI=mNtTܢljx-Y -g߮N5 UjZI]ds=0"SѪEɻ3\3!2uQ"81-\2#Rr%Lh-VLx"n+HSӫjQt[0Fsb oSwSrBTL/O) 靯^H>S4}+#$) +x][ʑ~_Qφ#%ˁcX0Y>L,}࿿_$Uw{(4=]KdD))K_~~/bL嗋SK.2 䣻 ze__]w]G_͔7]YdCPN`%˹)zSX2eA):1Ș("İݲ0AĂ: (% "Fi7y(K<'I"/xN>vZ{#Aă,dcxXoȃ,&+d1Nxȃ,+-\D"/b[QnrZ%|ӊ<(g W.<2BN8bfmAc<K`\e%)3uG?2h1daV`m?A9$úh'pyD~ +#(cGѪo>].}GD4wO?}Oxৗ˟M)_7TAqʹZFrV/4Y"mr;fyl׶[Q(ȝ:_~)XRfu12_aԗ A_?.3쒤yCGC^|{)=+% R88kFʼlaٺbN\,c;ǭ=inBcq!3DVm A61[~o~Hw,횵aZݝ5~tn-(2eYM<aiw_󱥬 '۲||3J}QYE2LsMS.<:Yf^6~ JkGJannW.sԬlaՂC~V-^rيʍmRnlW⼊.mt׍UwZ|%͛/ʴ~Aݷ]glm&vOGVKU׬IoYڕwVe\+;6ۜmS:oJ?0VuUDSDRkU f#0I%e5tXK?i?hlEZt/G);ދv~J6jh7PC&?:E;oC8> +٭cnrѴl;o<ˇ|yT 4O`EBu7]ZǘD|wz^^p wN̾zu0K+,蝬$yz>~^c~I2$ШXM_>>m=Ctc=#7;5c{gxΪe!~Y|oKSJ.=twoZ>䬁)͖Msuwߤ 0_<\Pwo~+[6xcI/;WI۲l}Q{0ٛlej"#go{N=z6G~M+2+Tzj2{:^!luځ5& +k36㺺|Yefy։3i_u]Y;3Oqqߺc=!? Kgtiw1tԪzͭ>?!}gVy/l93)G=f y:/</VtUFV|[J#5Zw WwQ}YW8)mA x'<Đ%Z,Y|ڏ-lpGZ#~M ޜ;D7 +iz{:q?w\{zWzǺw6?<8}vgo}*x#1b)X:b1߼rpG4:O'īE9+J &~tG/={>_SZ=0RbNJnBIyukAdoW£74n~C,V1~oyqMz +bxoTۋ#2ss!gҤ˓uf ]W{>~;ŗ!N?<쟾#<][o{a-Sw=ϟ22N߆qx8KMٌdsѽv;9b={L-VD 4EQNy6/N%iGrH7F.iQPaUnж;S`o kq9[)8hi;ȁ #gz8gN CmX*>L|ϯ+Em%G-,ϬI~p跦k~4-\֫y|m=NPk밵j'ݴCy r{ϒ.fYzf>Zj9^|x|}w%N49diєF~$ad&.Umt=[n0uZ>(qe4\ߕj|R3"jz%դ2'\* +YA˶[C#-Qu5"<|#V{ 9 #UХ]*vBJud5U; E JcV~g5>Ys&HT˥RN .b5W-jت&Jsu>>&9l&9"*v~c6QzqA(V(W\'ڮJKr6,4>U*#O-ڮZ'<7+y+ꐤMԥC>KG%gЭVNe="T5YWd=Q!]#ʯ+rթT]m}מx2 6t|OqYGlk&Zщ|lLZqo^2g3|=,}sA:nTE SuEW2xߚQutDC7+Pqc:V]5`/%uEP]=5vdS]hiok ^۴{ep|VZE?\ƳmIvM⊋%\2]E\05VbCTճԛr_EFm?eW endstream endobj 635 0 obj @@ -7894,127 +7898,139 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 634 0 R /Resources 4 0 R +/Annots [ 636 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 636 0 obj << -/Filter /FlateDecode -/Length 4660 ->> -stream -x]Y$9~_QHk|jX!!. 1bAEiၿG4j2G9YTW/VSzt"EprEVJ J>' Br:.䯗o~v4j]TֈCQ%29vQy%Ĕ8pjTaSt -fX#0ؠR`r* JIءHkft NN+c҉TМUNq$.r: [\9┵kbto$-:l"l"-K.EkY]N:-p43 -ӰKXlqFjNg`O8bdfmQeu1EQf ^8@ lҖ#FtL†`8 SxHV [[,f.-&Y -Hq1E[qZ2) J9.0 \)9.0`\rqp'8.0`]v5VI ,xdu( 5J ,xHs\QX:Fq(-VwCXs\d.(lr\:m8.@aB-wUiP1y xWE KB83oBy8.p],T}F +wJJ'qopBPeuI# Z`2IX]d,$P ZB$ H(,pE2)r\4l1Zs\4lq<ov{[v`a |5ːd9?v etqR)ק:;F=u+eόv>ci)W~J?suϦ?W},7T6%\}/IXqˌ -+2x@xPOz3,V=DZ*tY^{K{:\ jVuNکs6ܡpWYCÈ8ML6y|ס4֣v{@eޭ ū2NۂP) Fg;O0UG`/3T>M Bv Y٦v< LZ0QGdFuZ`/ Yh=lhu;~=h -r+z~QW1m`ӡpo|>kMt=:73HO}M_8_nIN9u/}dݝfVJE_DUcyNm_.+.{fм8t=ϛyõWWX<o6wA>+qI<\s:ʣq.mr iȮ\?R"n\._ި/yfw3f +9l[Ao}0wbo7Io{QtOL(˫k@`!vǟ=VZVPr0ɿC[=tݹ9QXR^AF9th=揾˯1g}E}}3{c;?X: -2sV6Q{,PK] {oSJ>p9u,[bn GzٝYqdFH噁W5;pz -gx@K -t){ޏS6j(<:˹,s؆'2IKSZ/rz [^ChJ)W/uLKwGryU>](g\պt$pƪ2L*wO!t>>E%f -Q&~ЃK,#XbI8~,J*H 9~Lp:`f=o]FfYY|P1#DNbjj_0㕯iU -}V`˸+VFvBʮ&ֶأu }שnKZ.̥9Q*eΨTb81ۅ~!KYݨ݃0 ٚ.tvaӍ:R-k*=LiP7v<#}4J=ͪ#ҔS(c-c.֙įԮqtztVq /MJ1fѱ@Jye+v*YN徲z@vݥBKEɤ'ҭkM]uyDR> -endobj -638 0 obj -<< /Type /Annot /Subtype /Link -/Rect [ 101.433071 713.673057 101.433071 694.923057 ] +/Rect [ 101.433071 558.873057 101.433071 540.123057 ] /BS << /W 0 >> /Dest (cb110-1) >> endobj -639 0 obj +637 0 obj << /Filter /FlateDecode -/Length 4930 +/Length 4913 >> stream -x][$m~_NY !FFv{wls!?U%b]fvN EQ)VZ~~/9=cpOoj^_)(7V.N^'"8M .yuu}7ShWb9;+XO1VĂ>:㶬1\N^bA gLX bXݲ20Q;1tQ`i9QJA5O)@A=My<ijv -i%^B>I<Y|VZysJAgSx`ȃ,&E+"d1Nx ȃ,*(-|NΉ J1myF'kzM+0I! -<YYAox8H<1%aZVY-3EdƲp۞;_|'8)?B)_a5o HB:$D]H X\n$$o?$$:jc_(?)"ΩBZu%:/+.:kucq+4zت2cv@ZoiF$}6W5ZU7zo}Z=O}wB;R{Hz_{j^ljcقs;8+NavkW,fm'wE߱_tV|V+{vZa E}g1tVl R>:]5vmf+o+k܅*ʛ::ڋuOw$)W7V(!bhuod>1k,t|5T, yq+JdSd9.SLV,$_kĂavgwü`LF=eJBuov`{y7ĭǠ.I[C8΋u:qzyfXAEmszuvfcbvr{1e#X,$d;6vme'=Wzxrb\/т߽>iK[d:Og'_X,Y;3VŢN4M'|γY;_jhuwMb?{o`20=tyYqln.X〈>,w\P au;׶>3LYH/瘤?ku"c͏-Ǟh6 ^]|gjl5#X$ggphd^˘S=z* O6]#?e?؋6qf,ESyj]w<%4ۿo_')Z4@')eK-cl{*2l ^ cge\˸䠓d9TJjf$FLB\WHm}un. J׵_VK,e-eljqW$pHiYd_3_/zez5lֈt]tjWEDZVe :QP3QB͊]u^nlSz wd]u)q*8Mz]Gz2= dޱ8׵8]7LgIòE6zշˇrZnݗ]u8Gq2 yP)n.EUkuɋ#y-\j#Da< 0L V8LjRgEc.Т9R9+Q>LcΤ1[I{!St> }[wN.ۦ_=c0VqҺ,Xv/0taÆN*YTr&F{vb'7yO}%°xաoxjLxXsH0$:;}dfj6sQ9]y>MSv-ыuΦ> h\RNCrSf%,7j߱{{4}Φ=/yKapT -Ygy1d{>gCsrZVYm90(vV"'&Y!{]G6cmB$rb[Kªފ)i%2o,b]MŇ,13ݴ$JKboBW 9g!3cLϷPNDT\Ҥ nUw:1)t&];5˗ J-?Hb:rrvLO7D/rV*d~$x'i2_n  -} -qe6rR^:^?aiV4IP|Юۯz'6y$N ub/ԥcl6Z(OJ7Les@ǚ52AXOJNTUtɾmz: ovrhɱ͸]f(͍d2T;d1b F_ ֆN c_d}r+nXo(y2ѩ7iغ"sOF{.{P*-F4~'j ͏{-DuȦіi[ s|i(MVpy;kWTtpaq%0wVbANI~ǧti;u7˛2 -V!ayy% 7"r+ SOr֗ؒkeڳ-KnumQSSWiNhpb2ZUKq[Lѩ|V=)KVע% 9ѩ^ŒI^Q]/i+m۷[] uABLU7%߅Y;s! ?%S?lh-RG_]b79Εl3"5W{tLZ5},+(WJ :̩M&|TaPUo~&š |I +x]],}_QφI1xp1fL,=2%E*#ީ1{]P(R7%r |IM++)VEF?Hv%OvӯN_g3@*gbT^Pe)Fム +zBsT0GgVaK*I* 뢶[U&j'`> +*`6J:Fi?8=H:ɢ.BtN!:S'I`JK:[vNI:l.uŤh%]-ɂ.+:آҒ.䜨ЩVg|VI:'lZQN +QϢxGҁ') jIa1щ:؂Ηآb(#h"^88lD&%$0)O.F+р~r!G-UŻ 1հa:b؂X [XZ$.[oA …J Ƶ)8 ,(PXpwJ\`AQ ֵ> ,h׺$.]봒wENQ[` J\V(qb Ыp$.V&wMRN5SƠwGk28q&H\L%F]P=tJ\&Dӟ0VN9H\:D]tDžq /O:,qbx.3I\0 -8D̙)R#3Ct=I6㯧_`=_ n[E4TW,!#bFjFFb퇕0LGn`D# X3wirD탖mv_Iޝl[3%-R 1&h$ܙDfCx]U|:+vGAƟ?xw?}z=?o4M_wYrk:C,h^33<׆tkIGy[^Rg.#Ӿu`ŖeiL?O;2%>eDze_\X_:3(\i`x]cY9lbe4nD<(!PHZ˦ٿ*(!e y:TCrg"!p )_s5 ?R."{|a%L0!FL3뎳~뵼5C%? ˿;|#Vdm)?X|,f|ǡPsXZt{F͵6Q CD{e4y64폷M^*k ?_/j/ } r8v=yX?B:c=Oc[^/촍eW2b<φXw#|q#]-ތZv@{0ӡz9r֑Y.o=ǸFtHA<nĩ{0ӡzzuճZU zfFs:]yvuq: jBY~gm#Y[(=كy z:׸M + I7?,y__FK:^ z3[Q2و\n[G7;:l^`j|Pҳ[3s:WDZVm W|>8a ԝcX)wtx:bO7k;rϰUs;]`fS`Vw̷7~lzqkq3%WX._W9qV.e7WF]m q@1F8: tr`wSܔЖo,\ƥ^(ò m +sT# +o.P[%'p.Cۇ){? LyUxk=4rΖSs-7jk6:ةȖr!rSդ1'Mv +&:3koUU{4\]Y״&&Po^ R5,3*7)[OrߨZCg6=5:} +$N]Nb4z*TgݔuZ.l'һQ~\iJ 7f#䣐wPB -+xR:qYet5?SoRbA):_Jhl6I\8ŞK0c+)s\#j놺&& +i\Ʌ7(N߆W}+C7.5UeK(&ZIf^v@ +]ihmT[>A&͸Ne3Zq}> i~=9ϰ ?e'DLNGkly5J!C],ĶFs}d#RJxMY &Ao+XQr&a+ӜL2ʆPTZ +z /*-ȧ j\ endstream endobj -640 0 obj +638 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 639 0 R +/Contents 637 0 R /Resources 4 0 R -/Annots [ 641 0 R ] +/Annots [ 639 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -641 0 obj +639 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 240.123057 101.433071 221.373057 ] +/Rect [ 101.433071 108.873057 101.433071 90.123057 ] /BS << /W 0 >> /Dest (cb113-1) >> endobj +640 0 obj +<< +/Filter /FlateDecode +/Length 4683 +>> +stream +x][8~_H|)$HaB<BH }JǗ8N{vLʗsY"!D `/H\# )/qO +:|ve:B$.c=$k #-.` "SL6D$qAp1ft-"t:H\ XK ^0:M[0T$.T4D\i'[xi-qA4ޠD234֒hjIGיQH~`WQ 4&$.@bI\X:bI\f Fbf )O₤nq蔒 ! 0.y%.HVa%0n $-.-p0nIXo$-&{^oF f` ^ D^o1\u $LzW ^+(F anC +܋*154XYF/F 0B6P_ck Qy!`Όo2aXJk|_;3&}z)?˜g ޷[h '-WR5J fSB$ں7;l_}:_Meci9AfѧN?oo\|z=}TʽKL.0\?8pvc+_ϟ~ixء/46-%-gA"X4(Z־33m=51nN  }äShwʕ_\j +F!n ӷ~cmi鳛^.ӵuTP.#ӎve|!Rl򰬯k=KFH*@]un5 M`5K@c'5/t%nBzgawf[XM7\Esw3ojҾL~k#uxMil7z,fuՕqxV2ʌ1jv9ʪٰu.ԩ:K[^bh zFν6C¥c׹~Ϭ=6YЦr:T7z +RMt%hJ֩%g=3zuX .sF;22Q'F^͵>)OZyOB+t9rO292MOp|5} j^WE + +G ʑgF 5HX㬗=p ={;u5ue2/l\uƓ.}l)G#73ѐg7|Ⱦ'ükzv1|RZX4?cmLWćFw^O>jW IE1ݗp+s ^ljw-Z>j|3n2̂O[<>䞕ܚ9nw܏}ya|g׼>gT׆;}λqG;ush&ugn tÃf炘#:Ġg,my_ep+5>)/Aq?m4s84cמ=z<ѻ7WjGxrd{+E^k1S +2Ww927wUw7<&6{8Mmv_áv#oxϪc\gb=}Hѹu<ߙhuqםύg͐=萹&.%XF4M32:z:T6fϏv|/#[ڲKVy ?UhigBoQW+=BK pl/TbEO}41]GR}yv1օ=g~GJдhy{tI_mDmR[y>t=jcanSAǗ+ +'̷ӗ>7P֏]]s4}ֳvV)$E_gF +JGh(;UG[mƫ^̙(Q릧;.k[5<ݝ>\Zue ܛ3 Gy`Xrt'0޲w~}iQUeѦ| \?ْ9+{܇i^|s8|mxXqWwYx}tvBΗlLW2cvGs4D>ٿ*sJpgájcwwiDmၨrAѽy _?wժM|ƣ |ֽؙ͓p]o˨]+oD{ 3И6ӕЋo}5e!7+˺R_Ǯ ods8{wN?~2i_{3AN}-} ֺ3ᐻ3]44qOK#}UpݝݕG~#"={g!uW,}{n}/s+z{~PLGìVm@<3s|7<8v<«ěI6 |z~I"(CL/O0WJkU޾h'WucW]}]ߥyoyyʉ+39??o^>>+Mu7^r.â~< +=\2|C:IQYҹذs<ǒj:#RQ|dbJ?t۟z*~;y~$S*e CSZ7c*󋠯w],ʉxbA^/|jГD|1l3@jkMP5Ul3tJ*,MiMhrBR>-[ר"QH]NY:J? I~rф,<0f QIr:At9\PRŚ5喯TX^m4Iڌ1&C+UlpcQUvrAH*W( +mSnGUR C34JHy +DzU+YFj徰I-)ԴMs +fQ tKb3id:UnۙϦ;|Vma 5_:ִ.4|M5ĞS h[m؈MѶiwCxZ82M6|0R +2VS)WNВi2-MZ63VR+,\4n_ڪ:ͶEgxMh &VfF?xUs\`0Ss:Qr\`,Pp8.&tY]2q4 `V8. ?9.p]i8.p]i:BAs\: [fLYR)8xW*0J#M O8.^#%tpXx e:b^Қa \ }[)r\&!q1*sZfu:9.LŊD/q̀N |-*`*A3t -.tJq\4l7qAL'9. $֙`H"&Xi)YlMp\Imq?Xlb` YqA:-7!-5fZoz -8.҉&s\NJ -XojqeZo "I7cm$֛h`` Ȍ[p֛`'N`\Zo f` lk#Ӂw: p&<[nm/A?!81^ Hp/f+ $7ؠ286jiJ%ٰ33NG9t #y>V#hq %#10z*G1 `,_`cY`f[4ub'@~4ĿpPG+1r٘aw><_K)Mg -ߍk3>5LѽrݧQ71vZbMys~6?<)ps|UmoLfW~S D8$^,X@6wKn d,wpu,x!KWڵņ[c_[gm.faۖ;O{#Ϥ'wv9ذZ%$@ 崮5+v7!8.?\W?^"@r_ӡҬrS| M=j4?i=m:e3<{q4XHK, Ѻ/кd>G/?-gVЦ_Cj~\o˽'#&!Զ>υ3,S{}cw l.3G~J<973}чx/;#7-8=;,yåUXm5 uٙtZr*,7~UD(zؙl(w7qDq~^W qa8l+.3P]uqY| {_s#{}0oMi79GbVUe ߩCw g/Qzj,ǎM:l1ć JǚKJ_MYu_ӡngDL)~|19ja,Z?9e5s6uv+Ptk4s'_S @ng!tÿ\z"y6/Z1nGGcAB~'FzkyNލ[Wr< ҳY'zw|ǝyN TckQljWeGmvFs6 vn "?m\- B9B7v_gdk^P$ y&䧹Zxt;y?=njDîMlb{ws:$nMI+޷m9FaU#k(̼s:V36xM~GwkFxԺ՝yΆZ5QV^@os:G,k>w;9CF|tq ~ëջ6pCw9}SDVj Mqȴmk#L OY|LvgQ3zeœw=C⧃;}^>?}g!~PcY[C|\YftBJmo5JMowuOؙtH^QAlr%.eu\J98LSֆ;ơN0 ڙt`=yw}zgdF{9}n<꥝\$!~&W6 ?4`k/vFioxzs RZw erB?]?)ߎu7 elY}qÙHj8O:_:{uF'k>^9LAQа꺐s8njnI]Zl"mK$Uc*VuE(,OV(mD\e2Rn/ؗWbo)|ކ+b-lW+k0BW}yv~5~X7.^iNtmeKy1?󸖅-t։a8e4BmگbjZPq65ĞS h[m؈uVԴ]޺V,kNK7j(E{; UGuJ6E*%S:F7q˦X-VR>oڮTWsѸ钪i-:ˆh-ب81zu&<P{rcIZp馗eΡkȃP)GɩCfrbmL`JMM*E d}ɍr wVŧoۖmFmYTnD-};YS_202.RSSR6Ӻl{mnTC\Lefg)ߑsEToPDm'Mטܝ8ĤC Mh<뱒yD$JښI^ۊV>[-=L(ҜEHBҧÑ2td A& +x][%9r~?ӵ1_(STF^}ݜ2 +}T]?")<?~)8"Opw(LN'g&0L~ }۟su}7SJhwWfB A9R +, ]LIbA Ж $ cRvJM b +rhȃ t/|L&FY;@i&ｋ KJK<Y&RAybU" @;IE"(Kvr)!nyFEkzrM+00H><YrIAgxK HXSK<6IIX0I#m ++ҤR8.`HX/<$ya!i ƓB*a½' 0D (HX#M)/aO +<|"OvdOpj84)ο[~ic er=pfovn,4"}n1ç>([ٮ_Em;GgLW?z?ZTgq ^-6k^JGG_-#3ZPqӴՔ_^y-&[pj 46 +_Ϳf6n%ur +ӭ1?FɆCC;X ;K޳7Xx蹝RG=G}0΢";k8xj=5tQOƺ#nn]BGmFr[{la.p5{hʖvgܑ8Vv1Z^wȲ?fٹg~Ḳf\:Ƿǯgfo.ߵY[/픾rK/өQEJF*ewF1>˽{'4_sBgx,#."[̽`R^]5rKmwmx0G2́˞8֋{ދ-J@E>L:Xd5g>CA*/!R <eɎ'qMd{ÐSY\7zBRyb3)y .)I7gW2 C]j 3C0uH?b`]j_/ڈ>)UMQ`{gmZ&~\M?'26#Nt.Ʊ&/o'k?΄%֟w͈~2(@7M9jȱxG7%6e;v/r#2N=uViuP6Cܬ5\Fz؀"l  TPl_Rz]j*:ߒ'+D(G'!)ؠ\| h68fWiպ­䧪֜ $N -T]= Sz!ar*b7a w=NWm8}.pӠbԌ2dmPC~]U WoxW' A9U>~Z>0%H^E,OyWkdцWqN%ӕ#\|ƨIJ['mE[}P{a)N'\jf~xW0ɛRzJngnUagDlk 6l; gVqwHιLo5Us ҐYD6O9V*ϣp>EC;[" +NNidl'eA!ZNB m8.`DR9-r"F=~㮇ߞI>(M)A0v%m +[B/SY,Ͼ3+mnQXx2-CmEj&o?3_TZ=[Dr~ECE2l|>J6|$ß8;%]IgN|/Iq|Xb)Ko,29rȯ7>2QۤvBfUնHם +SKZ7kgN Wz]3*l>h@DMd=g).W| e[)96UwF6T|^Uo*z: )kB7GǍ㳑*RT.҉BPR])Y8 M JQsfb,D\*&[ZsuB-[T4DincU@{tGe56ֱFlRڐ_o.] +D۵[Q5{i05 O3TJe_K5> ]ܬ䵒zC4VSjtTByZjlETC*1HUXuJf+XUkdWMuEnr:U73wWmd_':⚏uv;/Gvl4cI# +H1z(4rL.S~|&q߲3qЈ^)}2?otc9oFU0[Wޓ"ϸ/:m:YVk~ܘUW KI]TWnOtMT͗M3XoK[:W|b +}wp6|m.\2]E\ⲻajdoRUS?]ta_ƣf -+}ä<^<ȾVhמZ; +x2K>2yj[{9mjЂVvت-\S*Mp*b(2ZQKqjLѨ5QJtMYnx-ޜCj%k,kW*жwݠ&ojܦ=sg3:HV+!:dIkl@*z !>=PF\xd"RJ;a8&VIt*Jإ)@X +j06+A|W=P *_FcAi@~!O+m endstream endobj 643 0 obj @@ -8024,215 +8040,219 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 642 0 R /Resources 4 0 R +/Annots [ 644 0 R 645 0 R 646 0 R 647 0 R 648 0 R 649 0 R 650 0 R 651 0 R 652 0 R 653 0 R 654 0 R 655 0 R 656 0 R 657 0 R 658 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 644 0 obj << -/Filter /FlateDecode -/Length 5011 ->> -stream -x]K$9nDs€~mxm,|ޅc`}T̈g2ԃOBR2;sI/?]~XſbPo -Wg9J(TO?9˟~smw]티L)٠ -X֑ -CTX41BbϷ1䠱 {V-@ k,JH -Yἵ*Xf -31_T^%LLxCx YBNx)'! E*H%⡝2dueYlN2dfW9[Ld5s&6IaDbRxDʃ,xY?8(嬌V/,9 UdAk#d)jd4 ).5 g -\ D  ǒ4 N%pԐda\Y! hX@Y<eXe[e뢆VRaraJESb' K!z K%vV!ʃ,0` \& K& a5,@a԰b|VlY)@%1H0p4A>Xaw=a  w!Aw VyҰDÂuӟ2V5,]}*qeBX4,]LTaA>xkX0Sk`OQ ɅYÂ"1hUEor\ KSӰK@ kX -dPѰSsNtsNÂ! A ψ2հ34bIZ㱕83kX9q5,0A Ty0aGasTd% Y6%L YiXPl4&kXZ ˈ7=kXq)fְEOěI%EQyNSQ-0 &IE kXPbx3kX7&KT0g$, #I/~{\fWo,;*${Ub6!l"&`܇뇟.__/;/?3/歬{V~\>+[pؖrT^>LgB5 ]y{-Mi{:~~ZNƮl(He;%̷G+j sKfh3ug~uG-M~f7G1՛4fguwΓyo>[2od9e *("$5}[+n-mfga}u qV~+ȭϻFAB4 pdv*`΢Vh~\{vwZ9/SY #)E A4ߧHJSnHZ4;&>DKڀ8ϭupxՐmxi*kطݯ] ߩٞ.r -*e.D2i/[ӅQZNkkﯰ4}6'E+{$ >>[] Q>ɣ+R9ʙ항wS@\#`.^Mïv+wh֭ w#2eU3;M)R@E1(.'t}/tyj="+XeUW7n:wYuC @{ICZJ4pJ)Cړy9CeL%`no,-L32unÄel6مs92=M {ٻܻ%oN@΂܆G-TXv[{ؐT,ww͈w[0M̑VWdc<ʏCL;v42|SYG1YP?ˡGynvಧwR(!u.d.Ө6-frrVjauVyq UĜ{8{'I\rݓy=%Ę₅n3ªmqu-mŴb}<*)LSJrm_=u ݕW*L|+S߄{B_i=7hM^S =yPQN8HDz,OEd=K[]z'l|*?sygo ZJҺ?AЦU# )D㔦} AlWEgX#7.HypOr/DΎydCE%;^ l| Cz<$9{#+,>$;> -endobj -646 0 obj -<< /Type /Annot /Subtype /Link -/Rect [ 101.433071 510.123057 101.433071 491.373057 ] +/Rect [ 101.433071 416.373057 101.433071 397.623057 ] /BS << /W 0 >> /Dest (cb116-1) >> endobj -647 0 obj +645 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 491.176036 99.933071 472.426036 ] +/Rect [ 99.933071 397.426036 99.933071 378.676036 ] /BS << /W 0 >> /Dest (cb116-2) >> endobj -648 0 obj +646 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 472.229014 99.933071 453.479014 ] +/Rect [ 99.933071 378.479014 99.933071 359.729014 ] /BS << /W 0 >> /Dest (cb116-3) >> endobj -649 0 obj +647 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 434.334971 99.933071 415.584971 ] +/Rect [ 99.933071 340.584971 99.933071 321.834971 ] /BS << /W 0 >> /Dest (cb116-4) >> endobj -650 0 obj +648 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 415.387950 99.933071 396.637950 ] +/Rect [ 99.933071 321.637950 99.933071 302.887950 ] /BS << /W 0 >> /Dest (cb116-5) >> endobj -651 0 obj +649 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 396.440928 99.933071 377.690928 ] +/Rect [ 99.933071 302.690928 99.933071 283.940928 ] /BS << /W 0 >> /Dest (cb116-6) >> endobj -652 0 obj +650 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 377.493907 99.933071 358.743907 ] +/Rect [ 99.933071 283.743907 99.933071 264.993907 ] /BS << /W 0 >> /Dest (cb116-7) >> endobj -653 0 obj +651 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 358.546885 99.933071 339.796885 ] +/Rect [ 99.933071 264.796885 99.933071 246.046885 ] /BS << /W 0 >> /Dest (cb116-8) >> endobj -654 0 obj +652 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 320.652842 99.933071 301.902842 ] +/Rect [ 99.933071 226.902842 99.933071 208.152842 ] /BS << /W 0 >> /Dest (cb116-9) >> endobj -655 0 obj +653 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 282.758799 99.933071 264.008799 ] +/Rect [ 99.933071 189.008799 99.933071 170.258799 ] /BS << /W 0 >> /Dest (cb116-10) >> endobj -656 0 obj +654 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 263.811778 99.933071 245.061778 ] +/Rect [ 99.933071 170.061778 99.933071 151.311778 ] /BS << /W 0 >> /Dest (cb116-11) >> endobj -657 0 obj +655 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 244.864756 99.933071 226.114756 ] +/Rect [ 99.933071 151.114756 99.933071 132.364756 ] /BS << /W 0 >> /Dest (cb116-12) >> endobj -658 0 obj +656 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 225.917735 99.933071 207.167735 ] +/Rect [ 99.933071 132.167735 99.933071 113.417735 ] /BS << /W 0 >> /Dest (cb116-13) >> endobj -659 0 obj +657 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 206.970714 99.933071 188.220714 ] +/Rect [ 99.933071 113.220714 99.933071 94.470714 ] /BS << /W 0 >> /Dest (cb116-14) >> endobj -660 0 obj +658 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 188.023692 99.933071 169.273692 ] +/Rect [ 99.933071 94.273692 99.933071 75.523692 ] /BS << /W 0 >> /Dest (cb116-15) >> endobj +659 0 obj +<< +/Filter /FlateDecode +/Length 4421 +>> +stream +x\K$I ׯ3aKB+J4bEZ8*WeNOҎa#3˝-~qٙK|tdM +jEe)d+1OBdR > ./?mw]8듰L)٠ +X֑ +CTX,1BbϷ1䠱 {V-@ k,JH +Yἵ*Xf +31_T^%LLxCx YBNx)'! E*H%⡝2dueYlN2dfW9[Ld5s&6II1)<Y EA@k<,rVՋw%d>ʃ,| |,6E AFpIYp次pJ/p,I<4 YG AjXC1f]@Hհ 2.aASyŸ+~ -cѰ wHÂ|f kX5pb5,] AqH4,@|3tU^1aAf K4,kX `aAlJJQÂX,xHT^4$ Bd<‰5,@bm +aA򐅼װ yȂAd8djyY`.j}@2 )DcЪƋVy<4,H BӰpz F% x5,HU4,@(2#3x ְ.xiX=dA6aAUf B5[3TQ *M ʃ, ?Rl PD ְ g/fְ gװ)fҰXȂOÂb4Y8xjXP\FYԛYÂB&Jo.+e/f^UȽƻґ;~3T m֖!:Q =w}VRz +(sM~fIъ M?@{3ryG1:E>>^ ;'YGSۉmԦўyݑ8o:_ʑw9Y;&S#泻;DkC9=aL5,Gnby?m@ǡbBaܜ؀C&[bQ܇ $o{ae'.ȑ="9Ya[ơ.0<okag6M{VJדNJ?(ˉ3-MpnV,.d|Q)eoRﵾ6Kw&F"vg;KKNQR$;xb̤obW >7Wzxy5x,6R<蝇̲+-- /| ru1gId}]ɚ‹K'm#[Y!I4w`ƅ.o&c©DG?m6=[LfK/ +|ϯ-Kgy2i{`y +d)j}|%UZ>rPtWXM>dirVzǤդ6 si.9B|C9Kz| ~<tVyۃ6* Ob WO6qgX]lhIdu5֖ڿf;#7q>:R;Y\+jʒ4Qmo'l9)%r w~.<ُCzBҖ5T^eV9CjqrTK^JjݟNzy;ĢyEAo#jnVcD:Ki"iD&NdsZi5m%vJdž ,'УyHĚq;N݁U0ȑvꫭOI2gsX[z.V|߂E'wyWMYB=Qѥyr %qOdrSudumM27{Hm]GJ(}:-mup])zwC}?]۝}nk.r<=ԙY3L[Yݺ6O~+yէ6>odi~{ځ`Xe,H_|@p Wti+~ tzZok[^oӬcֈ#r7z;ƮcuNlG|6ЛPZo4~s_ƅ/}uNz `~g.}5E~*|߇㰽G;WCΩAUw6|ϻ9Y^y0FU!gZ>R߰鎆qZ/XQؒlig/ȃм Ťsoy^ݷͰcq}~>僧d$Z}]ݲٞ`H (LwMSøZze*ķ<ޭ) KݔT#gGo9rw=u#9w\vgw5&5|{m?b}Gdmy" TF\*gy/+[b׶UźG~/HV^R6kMl|[ɰpM~9ɷGBF~},vp.{ɔ-v8N $;jhj߮旉"zFwK[V|G6^.`w'yn;w [dyc{b}ViG 5E{iNIҩ}mhfvkB͐+BvhTZ()w+tJ+&>nr(n r +=q_N!) +Dl <|k6{&*S?8&%1f'o4cG48\Jfg}dQ ]cꤲJO@ǖu@XOʙhnC7 y'n2رe&N^q'oK l|MmA& 0F_*ykG'q8q/O5y +^ +8mߝr^\⸷-| ydMH YLDˣmh^n#ܙ'M +-DKfДpT> +endobj 661 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 169.076671 99.933071 150.326671 ] +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] /BS << /W 0 >> @@ -8243,7 +8263,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 150.129649 99.933071 131.379649 ] +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] /BS << /W 0 >> @@ -8254,7 +8274,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 131.182628 99.933071 112.432628 ] +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] /BS << /W 0 >> @@ -8265,7 +8285,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 112.235606 99.933071 93.485606 ] +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] /BS << /W 0 >> @@ -8276,7 +8296,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 93.288585 99.933071 74.538585 ] +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] /BS << /W 0 >> @@ -8285,146 +8305,118 @@ endobj endobj 666 0 obj << -/Filter /FlateDecode -/Length 3977 ->> -stream -x\[\ ~_1H"u?4(P Ѵ(zNQG3Ý^g EIfk2;sIwkRW[*pt @ɤ|ǧ;{\?~}w]8VXL&lPX,Ha`R!* XƂ!KV\rX -+C U O5p%$,pZA,3y炉Pzxޙ/*/xD&&vibb!k<,Xd j<”Ƌ"YY|NdNQxʃ,6Z -P2+ٜ%`B&9`Qؤ,ц K 5AƏNJ9+ŻɒxxXAl>B #aOp񬁀d8sPb8%``8Yw, sUd,hadLЖa-mq𖭋bZ K9ȅ) KN  wOPB`8G K쬆 %BOY` L0pM0pn5,a԰b|VlY K"7p5,`g5,U. $djXx' 0HK4,]WZK԰ w]b\hXTaA>x5,]G|.a8$ ga*[rְ wK^Dac3D%CrEaA" "p" "p2Y({ ׀U|ɪHa5pT4,] $5,Yװ f6%aA,<|*/< !Td 6Jְ yBkX`ȂLQ ɅYÂ"1hUEor\ KiXZd8x#钆<Y* 쑙k<YdkXL<4, ԰ *3Z QKBԙYÂHa&RA)(~PlQykXr3kX3dkX۔z3iXP,dAƧaAHa`'3qY_{le޶c{}Ӷ砾.ɛwlwJs6I،K$nnkj@>߼jb- oxHe&5tQJ-ι~3x osUxqkzme&|ؕo:}(-I8͒϶Wѷ=pkB{b.FwOg;~ǼLk^f"3j~E>\$cqtWh&h17=Xb[TjVxmH>\giDS2=‡MHj+TZ^ iΒi5RfuâRГj m֖Ǧ;1ҟf=XGB*tYCkxm?yf,IVP=EXOdf9{K.Ok#obw -譭 $fqrTKn}I[=߇Ob:<.U526iu.C"5u"HVl5Y\VklYM_2t*\p@^q"ɧ6r3rMWW99\KW_dXcLe잼'?og6y:W-YB=Qѥyr 'ױ=mҮWu3l-2w{H}]GmMJ(}:-upC%zwS?3Pm]xr>gX֕6y{lF6_kDw!KQtgti+~ tz|Zږ}qDc6Wo'#x| /'Uҹ~_j e>>7~|7{۞?'ߟqr~P"1u'Ϩ -n 9A$W+j !u}Œ',"&iM %yM|ox*&D<$ex7z6FU[C4%`ϴ[|VjM -P?N["?;?@8? -=/kP]L:o}CB42#~6C+Ʈ!IG_˕7 ,C;f!cKValj=Q¨̛B|],yoĭ98}ϑ{ޏ|XGysE]]ZLkxumt8/_&;F6R9l]&W_{?ZoY/4-Pֳߠ 䧃|2< Ab{kXB)-Zl{;O $؆}5?n D$6M3K-l=!` ym;oY-pItP]!:loӲ׈sJ>T׮FPePCo96>)A!~mЌeFݐx+B:vm0v*Vyv-]Siꔇi9KG,{ -yA<$]!) -DZlL**fK0I7y갦i]R6 %^@wQ-TxRO+u,Lt*Ǹ1uSCc,Z|F3]c{Xmt٭5iI{p1b2֭8ZJ#_VMuWú+񢭌#Ȗh$@a54WggˑKfރʳ%uܼG ę-\(:hO= qy~]"O(h\?+<g%LD698O`یesnŪK0<]K?PoTBfwN!v'q*S -endstream -endobj -667 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 666 0 R -/Resources 4 0 R -/Annots [ 668 0 R 669 0 R 670 0 R 671 0 R 672 0 R 673 0 R 674 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -668 0 obj -<< /Type /Annot /Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] /BS << /W 0 >> /Dest (cb116-21) >> endobj -669 0 obj +667 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] /BS << /W 0 >> /Dest (cb116-22) >> endobj -670 0 obj +668 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] /BS << /W 0 >> /Dest (cb116-23) >> endobj -671 0 obj +669 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] /BS << /W 0 >> /Dest (cb116-24) >> endobj -672 0 obj +670 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] /BS << /W 0 >> /Dest (cb116-25) >> endobj -673 0 obj +671 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 662.437950 101.433071 643.687950 ] +/Rect [ 101.433071 567.702842 101.433071 548.952842 ] /BS << /W 0 >> /Dest (cb117-1) >> endobj -674 0 obj +672 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 289.190928 101.433071 270.440928 ] +/Rect [ 101.433071 194.455821 101.433071 175.705821 ] /BS << /W 0 >> /Dest (cb120-1) >> endobj -675 0 obj +673 0 obj << /Filter /FlateDecode -/Length 4752 +/Length 4933 >> stream -x][$7~_1Hi|)ߤ - " .:ၿW]]=Ndv|)>Wy=l?sIΗ'3`_-JS%pTK|?KYONXױg7 1rJ&(^a0BTXNb) bD1䠱 9V{V.YXÖ5:cT1D)<GsqE%lr)&j2CxYB1V,x|N/BQy5^,) -/CXWVyDc5^S(HLNys&L!{o4Smz$Ťd&Y7NyBxSΊ:nox8HAL.BqIDő.2e \.5p%LKp xYE ,UyҰ;ȂxYy <Ж`-x-b5,[26jXhX>GҰraJEN <@4,@]Ӱv=azFz*5,:Nfaw5I v5,L.gaw]6aw]p A[.awa e5B@Xs^469%-XZM6aAڌSye WZlEÂB5,]gְ?aEuX5p׺b4,] AdhXmdJ.`iXUx2HC'8TÂ^4,]װ w !QygaඊO#XRh<றa5& "pM bb@ QӰ fJJQÂX xT^p4,HRyiXz*d ,9 ,4,@D0[M E R԰H6BaA -r\ MDbar)5,O.iX1aA*a);DB Z ,5,.#ˌF%jG̬aA8qa&RANH~l"QyҰ gfְ gӰfҰȂOÂbaqѰ،|ӑK7H->r4,(YBY4oI7N/BWHÂ#Y7ѫ[ͤnwC2i<."Өa.o"r{ ̜qfuzVu{Z%u|9GR7 &2],`Zn/1a¼$"!ảY?(6}OԝǶIӘmW0NPCĵQAΈL7dneqKx9 2;q9R -J1|ɤޤ?;g9_y E-}vNXyI)>0TF:2xCy*_Rz&[.P9z^jN yq>>\JPQWB*|S~/ٶ_ ҟPߜ0 MD~cIﺟ|8/'ϛ|i @Rcy ^xM5_^yqYo0ZNVd/ƥ oʜ,VNdg_/=.޹,KNogz0),[F諵|\s U D۵lMNoY֪ak,6-Z#[$ZC# k]sRK8bHȓD=ת,У3 wr=;>o,\}M0c,+}\O)Qhp=[hsmCןo.jW\gc+{Ymy/ ;lAC:/-@YNj@eKL#MPM`YFM֣Ҭq[)1ܪ Uik4SC:M3î[ 6y]nyX׹9/5>%!.B g-DdG=֑]>>=aUMj*GA>hօO6n:p|@v? du-#54OrY={e]:W' ޼EۢR1T:sϮ'ny]g v0l -kxJާ2_gYY}q" lfZd-Nf}R&l,rvs5ܲ[qG,X}a3)Ybwvo5 ޼kXٵ,Vְl%}g\=7kv<ymy`X]p5Yz2,zl6ZLE|ٯewjygW77⸧JΖGi> = -wCޖ>d[|mpHGWGl?_QH{#"k)E=܊z~lLrhzވP}>,nDطst#gR8A?_x~MEn`i7ΨQ$?iĔgRah2'uE8uk*寝o6 #ǙhLw]bz4aiY3/XcMS&"Ets<3?,OM烚y{ކOt-.'Jή] L -h8 2Es]}>Lf8b]hU`i|}ܱBDhdBGV/Wg;q4HhpTIbn5y,?Ⱛ.b]Ίoe]yx9[>T~PnkiI_y!TJ >O -o0idv5~L͐+BrKkTZ(}Wh0&~5o8)zQ= e':=`^ǝh:r%w :?6YC_ǝxMJڎs%1  - W{ }f,oM*\2KY4+.:tpɉRtXd+1 e'],?ɩܗa_ʦBAl촬Q~{}y_DڡS%tq}_Oj;4|rkЂVF5jK ;F[uF-&S\5gUKtҕ]Ynx=Z= -Ҝ%{,Z;FIhiw[mb4#25Zؕ|wh_ y< 5䝯?dr'bk:J+{tLILKr!j?W+Fc -P?c믩!/I̿h׷oClS +x][$I~_–y"00g"g_d%*̸ٳ=/̺w$r |t|RS +>џrq:ϟH`71_Nguȓ~'41gI3|tmUfΘ$̰.jUeav +f죠 +vh!9kSӃ3z +),"t:Ig^K<|tk甤-Φ(l*Q[LVEb,l-*(-鲝|NΉ J1muF'kzuQ-A,`H: [$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a +c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& +%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ +CĜ"52cX8D}1+|ge6< R4zd!/'D+M װ]"QAb_rR4b͚Ƥ&~9aJ}O;0ђ&U H~DGe oT"5ʊpӪ`9+c]1ԭK eWyNaneNX(C("RL6x !.Gҫ4m +R2PB؇^rB]:=ޑ{ydRN?m$ȫm xc1y#~|om9Av_ye@ 6 9( t&gsʢѝML0\Wɳu]>T[= +k{A<_VhmiuQh7;[#: g5I4hhvNrK]Vi[O^)JӆU| {4(-W@IK}/w=i`J;lhmxD-*߮Z~jߡ~7kd{(kZTQ>EW[G tQW+朞3U_e-?y6ᵼZtZkXBiYx% 4nvLer/p<'|jUu遷c +vR2wI ԜW٥} dOڇn#W>v3+1"gz Yk+KuO8}e&i務|8WJc{$(ЅYhG'DQ+賆F4^Td贶BrxIV~JtsYD.uҏe W+aR.pZUئ:Uk%,|AJϷrT AVn3J]؛2B{烽!qU3/î[Vin&yX9tB K51b}~n~_k>`Z$kk"9Dۤ1y0@rיs\UZX +a岕lt%I `/Y[Wx3=T(>.ѵ"v5nFYVΓtkVjgٔFqc8Arys6h2M9{:XVqx(K\y շҿH |.QEYχo7|f ڒȱԻ.kh;A6~7U˞j+ֹƶ%˵4cQA ۚ/Vcmjf I7J=%.΋z:zPw%KYsX#4m7vBy4ˇG{c(ynjhyV3|'m r$Z{|0!r-kc(IiE,B5"宣Em)зFYwoI7|$x0!y?k5O%u4pYIGMV=}efN#f$.ܠIX}ÑWDWК^<Zcԟ.{6[^d$G?4@3ʣ -5j^ѓ2#[s0?\H8G2+hVB۱<:Zy~Pk~+vzPڱ({"j">;zx?>[_R׽7u&γьcHT/`t4TUHR}biu ZR)yRݗ|4(K*܍y ei?v_WteeY9t&T.\WW􊽼yMw"!.d:~m޹WP_Q<c׏ȼ{qCqyQ7o2;:p0ϣ'oЁ38VZ_䅲Vi8{sJ[KCmv?/K=gG3p<RM6(;lv{_> +1<Y_rj_agp^=vĮ]=s޴v͡}q<BΗ.Η޺jwb+\8JhGry(({ }gA5ͷN`Lt-"="fp>P=|a](^fcu9_{{B]֫)6iE;Me6U͔G7{$ < Agq7ԚroNe77V{7b^.mtS(-*Iz91YIY[7X}sOUB젦\:Ig7 +=T'Dotqعȃb֟tB]UJ'U, O[k(oINDڍj{K;B?|ĦChЃ6xzY=ۃ14FhLFJ]-*mE Tc)l-IR1Ő{^NW&-f-y8ZFK&Ax.u#mmnYwmϬnFdF6I*{(je'DJLNGkly˫J!C+:$\# 19kU^ل(m+WΖؤ l > endobj -677 0 obj +675 0 obj << /Type /Annot /Subtype /Link @@ -8435,60 +8427,95 @@ endobj /Dest (cb121-1) >> endobj -678 0 obj +676 0 obj << /Filter /FlateDecode -/Length 4591 +/Length 4764 >> stream -x]K$qׯM ae4l,t詝م+`}L>23*+g4=ꪌ#bs̕fJ)O/4EOWJ -xE5q&? )foc>_k87똫r/n)F -+E), -+ CYcA !5`kJq4nF b29%RyUxOJϚ)lʋh5sSlxy -!LFy 3i<.E Td):!vKޕTd@Fe7U^RL{%?iX `q -8cC0p9Tyaqr&9  E id5,U'aа2ٔHDawm94,`rw'aw-۠ae w!^ VYa, 2Id iXMBiYK7Mxʼ.H5, YȐXd6fx/R[:]VXؓu>h#>ᱏ -F]l_`f]0O~?}xw=GĉHXL|ËA[>{|_@ 5V}?wWʄޅ𼟟J3M:ZD3;?-uk_aehyy0^+)85vqvmPU]2dŕn8*/*Zm:?PhKn)[{a?R|\ȽdZQ!2y{0Q˸iёt8m m[ZxY;7B-/Kq k 8E -d5M"zziWAJiwrJ2RquVM{47y0pRß/ց+#S6s9}6jS}MʔJK?Yh_h섢Ң1UG}@iQ}2mCwGCaiji JK-ٯyqfZx۫g[y9xNl8#sʪ -٬UmJ!ϛFNѯ}^,xw+K`VP Z\Az EB,vӂ -wz_ϺR6dOX7.UY, [CI07zft_>ggٳЫy߸|'u}f9WOL=uޚAGw&nhZ|H0=^ױvu_5 e4/WyqhJkۍig< -|=Wyfx߽+s -w7+l_r7ӻ[31Ɓ'9>Ǹl;*jec~5Oy՘I@*= COxF ";cSHd7lŭþmW=q'Cz-<='6BS>YVOld>'cX33Qˡ:>cجs;{nm93-/AUEj.k=:GäUgͨ=)h|ڇV{ qOCiSz_>^ۤ¹_X 'nbSKH'b`p(c>#{r`ߵ }>'Փv~ݦ_}X]ꛊz8al]*vp+M_/9ç\TuldLL&|?}/9s58y+6Նj~?&;=:F*l) =;Y獤 p 4x _erkJMy`k7]gT nKEEyHa9j0Kx~y]fS!V趥(L CfzHgYx[ Ҁ<~rÊ)lQHr 3͉UnuIT3XsS\^s+%A"L)f?'ɇ݃TևN~ݓ{R,#شn8mIxZ>D^`PFZMa\cX!f0{&4)4Q$i e{Cq4HCwlc侧ЉMQuf0-k`#nݖRTծFsPQ}- N -vQ_Qma&w/T[\)E-曥b+z\5ERSB ]Q.$qMfkJvfb'?_|TJD7ȉt|>Ԭ4F~PU|0\JnOVH uXӀ216e)t[馱uP@ki^aU? +G"U!]'+rӷuɡaHFkv[YxKONV@:s!IG$VKYV3r3e̷xW1븥a:PSc\iNB4b2ZUKqR[Lѩ?Uh++EK@~tGGd%B cF^Uھo^]W0 Rw%_;]ZSvBLbfu0Jiyq㽒H+{2r9Fg]g0cT_Gj!LVPjjW6cTQ' 'Ao #93y[m׃` +x][,~_Qφu20?1fه6KaB[*2ϔaNӧ+#t>}2U**c +^o?\~HĿbuopW%mN% Br:Mc˟~u:j]TֈCQ%29vQy%p)q*v +0æ8̰ZGFaA* T0C%Ci)Y 9VǤ Щ91tIx]t$s)k%- + C5(z(g[k{6W6ڴuuEО%Kb؃YyDiLMAIJOkbYovO?\~?}ݧ?.oQk׹r}+׺\F$B"4E*j9-eڷd/K9]TW~':Jszo+VG6Z_]~i !䞬GF^ZL {kduTi댦b_*=gd')˽Uz>n~QHym8\u}Ď%zx抗e.,w=HiObW ҬiVs;eKrCΌ0Q#+e+n}l1BBMU{xcn!w›< 1dMb!ɦl?zT>fp|K'ܭ0y!m,MV +C*vG'ͷ%jL(y{֞΋g\~8Y͝gczSiTMaP牶Ly[8gGzvF uk+Jh*Fy.oq둝{}N=5dYc7ȺomHŠ +(h_Pm'_<ِGϵ o7 *vY)M/ k*oAE_/m\wg9ݐcwm}$hf{;~rݽU޺4j,ddTLuS[<@|,>W1Lmcmv BC6TlBy:]><㹗_Ρ}Y<(庞G[;6*9Zrx3lHj+xbܳ'8M|e0G]y{>$CNw<ċgu5di_:3\_l)a!/h}; u2ӡj?x}/D^/8&wyQ^qX;:p2ӡ`鑝3{;8eq2f L+۰97a}d=? q@Hݧy `]NmPvY7[Z;@w2ӡ`=K֛Nΰs)&v驝}ӆڙCg8 KNy:_'/=zjw\c{\;I+Dhs2! ~8FG{=ϊ[M[-sDs ~xklgêa//=lgy9Eu>eq:W5a~Eҡ&^5P5˗E8 5/qXEBo~6-Be :?I*s[Ջ㩬{tۏTXPz+h(+Iv wrlis7%d> -8z:L2bkqb d70biNi\=l8^Z>-}j6:ʚ3ݖ!rzKN”+LghǴPn+Cu]mGi|6ǦSC״S՚YJZTm]- F&u5e.Y̦zN]ɶtcD ZO*|7C6S41"Mep76uBo&KdfѹBIye~+F徱Z@ͥBhKEɤ'm[C yDRC.-23-Cvu1btƞ$pcVVG2YePm%[m|Ǒmb.nֈnIKVע% 79=e%##c&=mv]w6l7TlnCVT'؏ކ*m=8b쯕lWDZXCXcdPx PcPT<>[-=RP9Y _P5}7׷S)i#u|Ž endstream endobj -679 0 obj +677 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 678 0 R +/Contents 676 0 R /Resources 4 0 R -/Annots [ 680 0 R 681 0 R ] +/Annots [ 678 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -680 0 obj +678 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 713.673057 101.433071 694.923057 ] +/Rect [ 101.433071 570.123057 101.433071 551.373057 ] /BS << /W 0 >> /Dest (cb124-1) >> endobj +679 0 obj +<< +/Filter /FlateDecode +/Length 4781 +>> +stream +x][,~_QφI~e` /~0,}zmxJ]"QYY}g]BOBL*|_rzI)ய?^~%z%梨ZxCI`71\/o/oA/Zu;|$pn%nzE#%0;^Z {6W63uuej"-L~0W4Xax0 ͆O"V>mTZXw%3hӏ_}鿀Oo?B73=>0ggP"-U_k;7W?[=e,e4{4ikW#(;m>iMR?_?O[uOASb\/?j9BmrWw5 ^nRa9w'֭۝ff]4\B1K6+j!Iw?s 1M1$Hކ'ZbPn[wtUή# QW3XeiJT[cwZJ@_v3kqh8V' Akod,%|ȿ tb_Ni#;Z߰C|e#u +-Mu0Oo-be'_P*mB; Z76~6v%z4)e'y˩Kњ_7kL%b߯|_|ЋBHڃugtg>{pVr +Bm 쭀llNVAF~n"rwd'YUvtzF޼ziv9SpFq5T؎O2rkB̦xyJ7s)#4z@" Zes'< Gh_BVYIAw^E]6iݦ}/w76\ȱԻ.ͤc$hfc;Սi[^~}ko)NMӐ켃: qoT{ kK]tjw%[Ys[;!0X"8{=l^~9gআu3~Wzʊ6Heľug{|.ϳ!1Cs=Y~B{w +wQ[Nš=(y搴-iXxv?|cDEg%|#W+A23^&!ݔő7D7ݓy1+#,{s.d$tH˾܎k~+3j^ѓ2#9Uz▭FF݌1G@ۈ={h;īs5y~FG`!z9Xn56wZ"Kztؼ">O2T)n3we7vfyDZ/Ž{Dg'<]g#cݫG3fLT#ǐs}LGQPU"Zgύ,e< ՖZNɓ]ʢye<ʎc0J';beН8Sm{ezjzlhJDZ"!!dt#tyNy:T:O0#謗F?0tu/GdC/yRjow7wrOO=[OO79{C~i~7luډ9t#{Qoz<φT]uQ|rLxB}hVIqcI%.'G^0C=(+?fsAc:&پM"s(ɑ +u_-A1w?FeoC. 5 ++QZ_atQy[^Ϋ"x~J)ϑ5]s/ټƞ>Liî~rV.番m@kp m|Nnűz#g9 X:(t#*EgygUɴ!~)N;7#&azYN3&<~Q8^Z-[6:]ͩȖ֊!rSբNBOWBv(X[ń~/T!6٣0t:ͺ5uj,}tr+yר.̨ܥz? ׋ F:Y)05 .t"SJ#kn Ye찖Hځe׭}Í _/8~p z\hY]ːҙ`7 &3*|/uH9jTBcNYI.]:ƎY/HH˘T{C:wsq=N Fy 07k,&V< >2&x{ىD:4^z)Ӝ9j:cGYH;]\q:[έ1/Rb M؇ hui}CCǍa|Fv5ԝAur>dbӡkeɋ=Ҿzi[:Y \cJ"qEIǔ3,#.xdaL$w+,.XAvܘfyMVZ 44o~&6HکK߹7d-a{[hwxeس=Ccns1ʤid <5٦6QtL5Y/16BRZD/S _=D{%RmђpujddR7R&uʚ!aDjd⿏5ϴ j?e'Dq 4&j5e/B8 %5p㽒H+5;gFl;~-+I9@ +4v;AƲ!/#-orY +z)|'ylo +endstream +endobj +680 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 679 0 R +/Resources 4 0 R +/Annots [ 681 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj 681 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 160.426036 101.433071 141.676036 ] +/Rect [ 101.433071 573.873057 101.433071 555.123057 ] /BS << /W 0 >> @@ -8498,16 +8525,23 @@ endobj 682 0 obj << /Filter /FlateDecode -/Length 4592 +/Length 4741 >> stream -x][ܶ~_2E( hZ}8 I %^$jǮ)J3 g5g KdTJ9:_ޝ~:iƿbqS_hʛ?c*foc8?vL|7-U9k7"bQ{ ,UBsXGeEA9y1$p۲2İѐĂ&(j- &rV$5*lȋh%s*D2HB>I<,>k#3eKoГb*kvMdLf.sY7s]xlAiO3ꄞk,; .zBMC46M -[y40 Oe)ـ3ٗ78m[&MZ,~[Np_ږvMm.ޓlн- }Ɇ,=^ҫmu=xeSսi/6m*:qsܶ,>g]]ǵ>lke/0Gc;_bO.sBc\'-e+/ mzk=MfIC6K}~-GG{reA}o.vvuy9ӊ.Jׂmϣ/g]M]q3wm%r&U~5гy^U2q! dtWVah;irnP{+7Fjߴ]U=_}o<2︙n'i"q&sC(s-'SX%/"lQ?{ÿp)?~G`G)>%ISc>:Ai>/idq覹yKO/i im̹GP[SE*F\ڵ TnT_S6P@gM0fV3'bD-]$KRJ=ktWw)^]x`#%wt5[4/'O'vG!Xx(on(ҩtYi|"?AoTFrajz%7yꐤ>l(;泣1t[ꦱuP@ cI6!aHUTɾz* fpwаy$fqG6y[W l&ZI'[F^@:s!Љv^N&ӏ2Y- ceAGlq_?W;O +x][,~_1˺_lH~0Þ=gmžqZVY]vJRUSI֨ +U"=?~8}t;&>ӿyYV{bY#B A:0,Dy@SX Mq,a +B c2[V:(˱ J.0,%!R<"5)'<9VǤ ੠91xIx]x$s)k%ǃ,,X 0ރ (Lh%8J> *&a$Tƙ~ - }w1P p9, U#5*$qXw +߄p]L1rX%aFa!#GRDabxOxtpX"ayDam>`UH x]`aܕ2$ ":Q/_Woqu\>x\?ϒO6DZR'S..4nMv*|z˨Aޚŵ\mC-ꠥ)6ίy~Oo=ف4BhD,sDz|ҮMjۨt0_c4s*UR :rP]FE A1.w1E1q KֆM'ZbEW[78t*kv-)I NoǢ_6c оYi)wdh1[ݶohRIrdi=9l_CAKOdd ,/-".2^u}#-ٳSZSuw?٦6_6gV]z~FyյA=(us;b%z*se.zLU_K^izmCܮ¬,wa-8u%oAEUoSt.Gaݞ]ݥvzD˺pV\ҡ+og=飓>~~ZKZ_ƌ5UܜOћG\3n +5~㭳3'miK7c*wI[##fQ{ZzGo;J:]g==뵝6MZ9߼P#GWm[9W)n_ֳ^7jMVku5>,u䇱jRybY|4_ocy~{tcrډEa,˧ υ`-`퍞9xMoΏa*⑗6;ڏu^_`D=Q/8&wƒyΣco02_{a +<=z-;Cfҗvp0KIiiܑ_ ;8;kb7m^;c;Cp4`=`?KWyמ]:טwҊ<69<jO ++.pp^ϳi)~,lÂA"O}r8$Wܱа=^嬦#m(coE:}+X*5w37$+U˴^WDu?@W~u~O.k붃v+7Pn#GS$ +]=@kTB|ls):=Jo6ZI#7Ա =.BQ_*J&=nK4*!Uxɪy]#U4 +:5W~^uU'[e^ Zv>,NFq>_y`3\?J:*]0B'w}[:;ɸ)s8Mg(xd1R"ͷɞGI.㸖 -ty{ A2}/D%n3`Ui]6k=eR5U;]@u2fqb d>6}^nMm AVp36LC}H!#nBq;Td+1!JI~;P]FЭ<ۇٱJ˭ 6XUci%#'۽k jF}aDmSM6|$B]C,3=ӂ5zhaW7سnVڪ:P4MVZ+1T|VՒ[Y-StOhD7ZoRukђi9ɞŒ1wڞTڶn {d*{6I"{IYL\WBT/c*mi=0W"쯕lWDZX!12(f4^g0uPT4>[lnSaNnVW˼ nM雰 #HşIDIS endstream endobj 683 0 obj @@ -8526,7 +8560,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 324.123057 101.433071 305.373057 ] +/Rect [ 101.433071 558.873057 101.433071 540.123057 ] /BS << /W 0 >> @@ -8536,19 +8570,29 @@ endobj 685 0 obj << /Filter /FlateDecode -/Length 4506 +/Length 4776 >> stream -x]K$ȳ15 , 76=t0ja?*BP0#cQ]I}LjJ)௷._<ojL1E33=_/uժ5tGfybQ`iRX( 1g1(z1|N$ 6 1YbhĂ&SXFCcyD{3$5*lȋh%s*DoHB$,xYx%d.E NHH d"%,pA띄h-8HX^ aBL-a W8`vJXQu| -8FKXΡȃ,p` ʙ$,]gtw1 +ʦ%,]wm tx% AZwA8h1BH VY'aSa5˟0Vʤ$, I0Dh\в2!d IX@]gZ kVj56k $,;(@ohJ$, .`JXUX$yQcJXX޳9 pW{="d%,@\0*m ,,Z,aA)aALI[ B*$,YOg j% ^*$,8k%, dѷ=,pq! "E d*e%,V%^*EK(aA^a)6`/&xᒄ<%,`HXH%\Ȃ [D#aAѠ&2+4PI‚PQL4"&$,}xM`&9"8dy$,H Xm%,o~3JX5dA'aAAq,a`<%,&aiLdOoF ,EAMY$7N/@9o& f`^<Hߌqp2Iw &"[io;$h@/am 4U 4H2*Fx0a9}!bL1-<ܝb| g夬5Ji -f}  ٛ -s1w p=fcFV¢6vBwc`OicU:E }0]Gc]Ioe%61PH5dV;bŎ"Iˋ |A5ʸlyb}>W)8(`9t? >Oڇ2;vi" e|}^۴x{?屙)Zh[ח_}1!7^-m}aMWd*GilZ~\d2G5ÅV])iV*W93z lg-+zy?Wa{4jPGo0[&`hOqUnS:=#Xd pg5jzsqU{^a([f5OF8x2l\٬S[_YR_E"w9z tz6\d7q?T͊;=qg{[$oV%mÙ *Ʀ_~˳{mV־5cٖy1.;z:i:^k묷Qe6yo2p*{)tyZҋO)6S[Ʊe n84a q=z[ÄU04;ΠZer(pݷ^};zע#9ݑCl6˜dT Yh{yY(z[DKYWuojŦv[uֱulo\?'U_K]zm ØPOqS{W֮#Nrll9a4Xh#}%]-Oyw5_;yHV3sMy~35_FS' QDrnNP@- bt洙 -Ŵ5l=ۢuPnCZOjTByTIK`1oQC ْ);t-j~0=VY"q6#V`5)y"~Myas.s0ClMvsz3gMTPu% 8;WI 77?h_(-v3_ C/ܧAL)# pՏ8W6hS}dg‘=KyZ8g !y_ZǮe;Xv{[?88< u˺XێKMƣwO'Tw<;l_=v zxKc5Uك<ڸt^p^ o5_6+5_=憏 t[y6oSV;/4yEgXs0o7*V\=/g:wsyqs_?,pf5s׿AwR}oMZsr4tx/{Ϫ;8dsqG]qv^R%Gq闺Әr 3v7}[otxSJ 6"utX)ɵI©|^wm73$g5;8t*:8N'tV~MO=~;yqSvNOzy4\K6)>& -6boЏe{Cqz Ҟ:*ƚB'6Gՙ9 u3U򥕵] BFZ7; E ~klj|BLՑ|+k9t֨Y*RWU]% asDqK/4[4om&v녢P:Vh7n#'SpcYi|q@5*#O`|s)?Nxn6VI#=4.cQ_&i5Ǖq5rs-S~0@MZN}m: E tc)ժZʈbN˨iҔHU®,[W-αN-L-}mu]#SݫѮ=sg3:HrbR; 7YW;Bx:4YD=;F14UZަ(Üޝ٠y7Qz 6 - +x][,~_QφIw g1ه>=6Ka ns):I\%` l[1[2H\`Iѷ<-> ؂HQ0yUIZEt Z0k Z" % `t$. `H\hӰAtZh` A Xez%qfh%jIGיQH~PQ 4&$.@bI\X:bI\f Fbf )؂O₤aq蔒 ! 0.y%.HVa%0n $-!-0nIXo$-&{^oF f`^ vx%0"2MD^x]@|&+#8c@seg@F7 `&VыVJ6P_cuiܢC72aXdr &_SV4_av5o=e(6} R7Q˖ɏ]6vl6*`1AR=x(NXcu`x?AZ{jJ<_Vs7FKu;ƾ^,سѶ՟C A{ +Ė`vbf+,zl +:H&o?]@ŊuϾ]#Ә(~?>'(ZF/s\rֿ#T [˫IoSH/k9mzlSB9Om~ױ}>mW<+X0Ak1׹,_R:UuRqσ +TҸ|NPǽ ];45K R!+;Pm[_l4'COw +p )w!Ny6a}c#:{tDȈ4шj rPwraf`߾G]e^LڱűmkZrѵN'Ļo>^uRxe2rn꛽;NV/C*Sc\mضrP|Sۡ6!ڦ'ueWhY,}&*6GPx |/Gv~ʾ:O_e;ToGf3m|!^b^G[3 +\Ql^A>5Ol-mm^ngƝm>ί:J_nsnGXr~Ǎ6Wn.3c;bAyiVdlw m<1۱{cc^'+OqWӻkW{fvۏZ?: +gn|9R_o󢓏m<Z5{adĒ(1DCx^BvNYaJ||6UXi8wm [˾=.X8"%{)f${v~I}&΁żtw=dm\伽!a +:6= d:u5LRgss85>'%b߯x|_ל׋jHiĵKCtP-bP (6A'')TifI|(,(_j3soo8nFga};ю'ڸ=z|ؿ6Ҟ7Hҳ_lHwbٗ89ȽP:#^=i/3RS-nhd$]9JF['` hthqy#~׆P NQfkT)n3woǍƧi7{t(<5)6L=(X5}#f >;z8>ok^=6Vf2gúAyLEU[_K|u5di_:M@\_l';n]}ɷ3l 8y6韡w?Ɏ:er$^گnܧyMDZ"s@C+#u2ӡ8x}Gg$Jܭ{'<c_`fy =~#'C'VҷNpcg~4gwPyhݹmv7~~(~ >t/DZ6u~(x'<zg}ɝR~x"9Npn=n=upnP;s>yi~qΑQ{4̝>esZwS~B<qLȤKu]wQsK-yܨqF͎EWYnŐ!/ƂI=^_d_GK7(m ci#> @@ -8577,17 +8621,15 @@ endobj 688 0 obj << /Filter /FlateDecode -/Length 4514 +/Length 4596 >> stream -x\K$ȳ^b6 `CuM x"$1"Y3wP]I}J7r]p&G桱R6T{&lr>ev붎zSk.^YL.9ۨ*XǤ3b bL 1 y_V GV>;X՘ykUD+<MғΤR}Uy< L.:WMJ)G%V4^,YY(d )XY|Ae⡝ -dwYlN`b-D*gK.GxΙ *3 -FJYyȒl*` 1RyvƋL*YlN`% |Ά' | - |r  5ցBHIC a<*iXFLXvU;d̒yӂݏ5,n[ϟ|NYqp@+#0l{@,!|O"),n,$B1mn+2$f62􋥂BRe}s]ք5WٛQ^w=~#d/oV>:/>]{;vSxG|~_w?v^.'`?q XVF:oѭӣT>/t=kY,'mkyg2ۧ}zYrf[O=㷮~CRsc"ڱr]iMRxV >EֿP"q :$~%:o -cQ:;DmN3camiF~FMvKMi%`ͭ3O>:qI[7vaCXǖNY\/2w縮.{}З'┹ 8ݯ,oŧe>bԵa-G{I)۽6]_5]zven?m>oq[);뿏ehv|`uD_MqH˞~ڴl̔aN&c-,Cz\Ie\f=6}y~3GȸlP?5Ɂ 9::;u3彞ɤ<{nGfk3}CvNg VmZ6/yocwĻŰ S:BZ7w3 ^5bAE5х8dDL˿]v5$s "-FaMV~_so;+ߞ˽T!TyՎi[@A1Րo(pCCeЮ2~Z*ly[Il^p[ZTc5>1KT'|?brƻ~"INyssWdzQr?o& -cG*nuP`&o;E~m8` )p3xI#~RϨ{2/ˋ%5)dz ~W~ȱHݻA 'ԹC>T:3|Ǥl& IpH,<6XuxG|6cXvT xɝ5l7ZߗmW S}GVE7<U{cu>MSz ԉ22b<-۳mjLho{y<5-ʥ^^; ';`|8[V/t'_$V ~)7q9ox ߇6<g%wV"ZcV+}Gu>qO#yd۞@^roHZΐ*%[#[f~+mGF(;;^X9߽G"nĺ/{;7<3_pثB}xX!frG2nb(|ng$gŻd,01Vt7ɞ<K8Dsœg {JzS]ZBA0 ;)B |a5b!H4^N!=_rkkqX*ReV]S +g̗=9bC%ak[iI~Ĭ+l'A;NT^,05;o>8.7{̧ A*I@4(ϲB].R_X<(=4 - z]<[^7 a]?+%v!$ʯ3,9q;i`$aq״ yG;6ړKdnv&S0$O}m>[:ՓdZ}œ:&,wo ~rk.8@ ?uC,NF= ؟dWfؽaq^Ӭn'n \ISzf yő|mf^C /HRAe W$  ţN6bCNY~ܗxi?ɣfeӝF! A6LNvZ7(B{z}WSL>:x:5Ǵ}1'S}N {a$9sjԂ6Gjk(;Ntŀ ls)պZڈI<,>k#yde\MXi Z$>;@iϧϾ/ />5}z_뵭qh68|hXh^kϣMzZ@Ez.h_deuv#eЮק?;KYl΂mcB_U-*nTvr'hs3{eNwڏLkty['HsC8nw˴nL~uW;q,jXy6U_ks6zۢtZEg=`lZh&p-zBɺC&')*7m*/+ګ~+m^ήrmea6mz-83߾\ۧ˸0}w&:؂kgMw.ͪo5kfG=!Oj~FJKSSE(C^e.X9qm$fc:g~8oF c;vb"OUdy^,c.Ұ~cArxG{o6ak}t:5>f#Sj;WoY|yrs\ثN>] ?d.hmV~<&s8ʭmnz>KOF1|Aouieo/Lc'o []ɮyL[Oq{*:ynQǨ6N^O3ᔩ~T2#<~+6~ ?[lYud^ϫ|t_Tju<1/㱓?aS[=qkўo|x]ֳ\WLl6Ƨ!gT.yܟi@vw!/{m>S|CӶ\j2>zSeH295.ȸ('?Bulg%9>8:IyLJS\tO&ɘ?Gܛ6}c(s{~Vj1^djt^ta~&>c1(o ǫ;Gwy[!qwy=SD2*Sg6u)mFaV2'Z:lW\-[ BVmJ] wfnK6֭EV?wh]TaX͗b&6ݷ j>eMzH_UxuR3>YAܤ$¿].%TDŽ:g>UtZP`Fy>GW:df{qS?tuV ir˔j[[~,nv7lqy&WE\8{22l>mpJmHs߶T-&p~s?E>:LH;$O,^ád]eR*g%^+C 8}//H(y:➷+\Zvs<ː8.e>w0]u^ ZZ(FbݑbK:s7N zgXNt5B;kMmࡱcE`0[z_W*kb5`Sm~~^rY"sG:.;#}u^'ikx>ZH|V5]srq%CҾywyu|=? } J/;:o~X<[.Ǣ <>pgW7rهqGI/`V?ZxAv8g|Y܊QK43gyFI$/[v_mFHXsK/_$Qd&֯ELkGgTy-|{:w:W0V& +Tֱ@D`dViIz(|G4 7D=u7Ȗ<߷U>LoemyxBn>T~kSkiNsPS}+ BN$?խi1;b#HVN =r5-{4!put3 !9]')nk&S|Q(Vh\o&NNzˠ7LF7 *|2/K?f'4CG4`(Lgg} t؎:lc'uӱr&&d]yGr>U3r/QiRb.S#KvQ\N!NLvȹzfS8ktG#M7ZT)/̝<=>UfS;wLcj> @@ -8616,20 +8658,18 @@ endobj 691 0 obj << /Filter /FlateDecode -/Length 2788 +/Length 3514 >> stream -x[$S̳a咪t1\xBփ& 󐯟zZ$g3*T-~R^/<󮔚]ow{SaWw/]5xy]1ty﮸V~j |SS\rHT*JT1CLD-T0#f 0jL3,BTfe -3BT0ט A`i :] ' ޥRC ρT]gRJ0X3]-ћ Ӓ.M*T[BtN%[]`$LWZ̨B'%G]bQERV&)e %IT[J`:-ӁQs)dU3]-!d:؂g HN XAq1 cE+Tg9+@Yq@C< -l ʥ:آ 4T`,P-@A[0(pkR=c&>1( 3@A\- ȅ+Usd,P@=3(1vJb,PpW c` tt2^2cXFB)X`n(b-TwC- QcBb,8Gh4!e,~]P4Ƃ포iRcAw}Q]u>cɺ(;Re,.6*e,.Y x50Dp+vjw}X] <o \ꪓZ -cAwX]II.;8g, e,H.X] CCuEK`,@\-YV]awEre,Hn6 RnP `C R1WsN -t.9#cA"EuŲ1 vUka,h9 \iz[.4?0؂H$s1䘐aT.W2pMu: r63 rw-\b,yc,`0`+r% 2g:[d3 ҅{Ƃ` AƂ -$ءKbΤ噅Xr-Td,2A RRl& 0?-َH~l"͡:آ J -, XP c,\  qD /71`]|0THȺZ ` J-|tb[B5ƂR7 c 䛈@ifn ӁLc -7ٲ^ޘqeig'F@^Vr$zh3YDO Bxp;}Z!c,dŲ0D#=nc}ooO#@k+,P1ѷkBp[>n4iCfwyr~wۊ]-|Y-HWOhpkB.8RT68as?"/n_?|?m^_rC~=p 5vQQQ'<5iq;H&a,MuEomuoζ׋-e簫_xvy;ƸY?.~{;XhُK|Hi?}Z㽋edcte#׍N\c{eU=ϺJw]9ɂVy7K{u:&9!Tq "8:zZ&_:'FIb nm 7Ym 䵁OsVoo7yhuu|)}^o&?{6ri{=y vD (6cmi{c'[Zs{ ~ym۪B.FO[{ -aD$| 22+lˮZGݴcEHB/5uL2Gq{q'9QJ8ug֝ {Et7=ecס!/!uCz/}v~ܛ꣋t1i5DŽؘ'"nDBzӆeZ~H6^wLQKkitu-clCۣegqj3) nALj -V.q/S*,.k9LCEFRbf'mmyVy16 y:^ߠ;j;I![v')sYo|b9aQPR + K><ْc"x 1%[x7[vC(*@P,6 AL%6$i(@)5썄5`#[%hHqoƅ5,]*ְwI`AD% îj@&EK๨aAbLkX7%]ҰbDÂ! \E"sItsNÂD٠`5,@F-xbK4,HLI5,R<а)ŶװM9* RRn& R,dIf7Bd|dLI5,g%ԛ$/K4,lQoS6s(f԰ dHQTdAҔ&:iY(9Ro& fDF RoF3Iw @V-Gg:33'[# EꙁI=4,SPO VtV=6_cr |D`13rn!{1n/?xB=g8$ P=og⩊^չ,c"^w< +Qr_7#nu d<PIW(_pG02dV6~wiR,9W}8|_}0wχ`aK_~w~{oTp |<>Oum'뵜V#^A﷙kקe]nFu+4W7.ѺYF1#N*SWQU3ƅJ&W6ܰ;JLƱnY}cβ盛/L[li-\?絏s}t4i[t6I{'hfc#dK彝[vߘ~{}޸ǣٲ4n}$zlw\ vzh+fz>ĥ=6r,?{EU)eH$DVQtPփذBQXu{7@eV+lT啍*)p]n˯RTSZ<)j]e|I׵'y~˽>B}էmSyĔ蘏dY\SF֗>^{{<_\^kU.)_\nyVrCyJ \sk;&{7v}rY}V}:q}kYX!bdpr͕\SKVdqL(s1x 89N 2IǕօA[&'u^#XZގiS%i< ;շ]!NmS 3 15C/~ +tP{14 S7^=Zx;v%k&3{ |Tz7ӛ<{Ԓ/WpF+OhZ^8&UHNnLuD'qmv/ҿnwlCl+ cKv:@X۟36! n/wWły9t|ɱkܕG滼}TS[dh7C0 }odZ=~>0G)"+oY;}9~9^8َԱuC#Yy_8I.7bwH2 4f =Mx-czsg{8.9v_!vOKa.7Иo4xYȡy@vhԗoP;TͰm:c\<$gH-dӘmt1lE6@4h}d +밶-K~JD?k%-׳% 9g%B Nѓ|mٮݢq 1̟|w1SW'!.tE&wŦ!R^W~Vr~"J敠#6tt^ȷTòUoupmsF9 B ތT,1Kқʋ:h>6'أ. endstream endobj 692 0 obj @@ -8646,23 +8686,22 @@ endobj 693 0 obj << /Filter /FlateDecode -/Length 4368 +/Length 4509 >> stream -x\Y$G~_HN$+ B<^EZxEVefTU1㱽qowE_8SșRjNt|<}:Y梱Wgg)j* !\t?KONqgojMeK6* -uAahr1) XƂ1#+C %j,AU F‘U!ώ4p5f,pZA,Q -E3T_U^eB0)NUREd:!KtDVA -%kYB -VA_rxxh*Y`]EAx5X ʫْˑm4`5s&6É&d^dű D#•fK}?=9}I?ȇ0 =D\ tGVhI[Ӗ4!\[ "V"O'$ HwG9$9$ϕ< \jjG6cjָ+]؞6Ѓ2׹e-]ۡn5vZdm'F\tIn+ur%sӁ1Iޚ#2s6 YaB䘦$QPRMhPTS;~/oG9dv>!z;|o%/qrB[~;|o=y!v{NȉJEyk\ִξ<׬%}ng\Zy|Ri -^CRe}vWW^=G!cpʼY^rZ[ى뼏Z}^}式Z}^]9ۜH?wmὒ!*J(.wO?ů? ןY h!u4Zx@a˿z;nb^ -sili՗/pG2;B}m)+eW~벮2K6n\ v@q_mr)ef^IH+fl{j/li&a >~Xw i<8N --Iuik8ߒ#krع}}wIK؋%15dYֵEXb02oqv*Grݺye؏2w[}=+F.kzː3ps/z&?SK_~gQleuri QLe'[ #\dBmΘtxԀJy_]|/֋<wmMXIG}E5҅8-oaqW+p_Z1'l k2]L ;f"i=2p{a|_J%/>oａ}}w7#`7Z[\NϏe}òEV . L턷,/"^(dBtYz:ŒĦi?z}]v4X +sJ7 'v9>h64dWñfoA{XĺEWw[۹rܩw wsXr:9_]usJ:Aʸʳ[=K|!{ȿ9e~{/&aGio吝upny=VFv)ׅQٔQKDc*n'|2qQ5y/{2ϱ͋2 4/ʨyQFnXF-?`u;bVE&X_Q$>^.%4U]€mckb9DEЯ?!muLqJ YoqLBp ^qHX#zF~ɝ]9dvV} - l9%Q8nwm !.IwE#YH]~d(zVf$߯{tfcm y6J]ڏ]{@M8Op;'ž1@bM)֝lϽ4Z³t~2T׮PuPco96>)$@ 9b tCѮv -rRۭűSy*k횟LSe(^]D]2,W}$Kgcmv)8~4ql'VMOw2tUhv?]"*#Oh?d^IlVIꐦGyr9r*tG롱 ULs1H ؒݰAfX) &9S~ڐqhd scIN;$9w!W|'^c=MI&d8(LѧFu?YL?N=RpP5exD_,~ہ~`,=?e÷8k[5yYL.9ۨ*XǤ3b bLYbP-QcA (1eYbHcA WcVXBUy\4 JO;JUe\/24^5)X4AXxDGd5dPK%`Ud%!v+UTd:W +-&sDfPyXQ,ƪ K kY?8C.EYWwiYϤ &_C I øaP/P/PA_T:Ӏ X)iHd!\YB% ,(aASа m ֢aAܒNÂ%뒆 1J"  T5,԰ tܳbn4,@jX@PSA@G\ p785, .װj`I؊X % 3\k0hX@]1sw}^zIX5B@a3a*ܟVƕ4,]W0}*qeBƥT5,]8aA>x5,]5pj5,] Qq4,3tU^5aA 4,8TÂ܅{$஍!hX<װq xXʚFjRhә3΢X@ooU ,*{9i1Y鬺m` 'E`>ddŲ D#…bؿ~{8sS6"/R4fWqm' "9{YkۮE#(btduEwZZ&'1A~: Y@F#8$1v'yIPgWS;~Oo1џeS Um<Ωvp.%JTcy IֺjJfbY7, p[2gϽ,ޝ7&4[t?XFwݦbBV7!+LӴѝ$JJ jjGm$ #uxFY9OȤޤ-XX(bkom- 9/,ȷ~f I q7[ӒF:j|򼡼fϩs=u=/uSA~Ck}HyqY)Z :?8t_~ͯ᯿BP2"Ŀ[ z׏s_Qq&(  +wﭽҫ/_n}Mkǥw. 3t zog,h1,mD+~ON_zky`W t~[U&G2Hz߭N]g4[/OBZc|TS{Z{Kk7I+:1M{w!1v6S59$ci3dzyTZ娴XlskYӪn9Nz;i{Y럄%&} ZNf~Zm߯r)1ʭU׽^8!s<￭;tHڅwiR/yr&1>nE/?$gj+ay>]B. b|"Md^ck}]sabL12_'4I o|γ|/:5bi'^ՌG␷>67߼p<qSw^ =ĖIaMV>"Ñk&2 __o#m Yi1~Uv'RRUgej7W[4njȷS!~*ЮVZ w?dm=vj$8Mқ糓P]8oyr +U^XYdTL"مctЄKAyg+uVУvȸ.>8];|K`}}w7#e`7Z[\ZNf}òEV . Lm,/"X1>_;6˃ZY^G+ M>{&~eeSǰU|f>EFMoD /{o JvgΫP_(9q,y`nLi's8ǽi,!݊,zlg'(2`"tXL{;n_JXJ=wZ޷'[ᕻ𗤧r>{~g_s=R"7#-rVo ‰Y}$s>Hg_v=GNEϿ\k<0Ѿ8rg`݇`Ɛ#.[t; Y\p3ha P|sz'~G*U!sxx׮tOZ̈vz#~ESll]s -}>vkT|-1'#Sl ק5źㅚ2ϣz+[&q2.J0۸'?.RRD3Af֎ȍNp]I8y{"h ׏/iPh,+DḶGp>b(8$Yv68+$`1n=uy5T&q.U>F<mST*"ٛvЂj%DŽИ'ߊ;#~e{ӄ|1k|B,ݐhB:rkkqTʬZ(CWh'[gZ-ӿ1׶g+7!Klj6vӓ bLj.]UX7 TAeio o$iipgY.Y/WRAwP=.- dhn0 yRvt08ڝ4IqW yG;lw2o7;)@a'>5r_v.2847C%y}Hw/<+vغ!KOj;|v'e#O+l0iV{I7 $ƩCAt B3 +d~L<>8N8R.pX&/L|M≋N.yQQ<l#&d'9"0y4ݬl(DA>ȆNFEg/<ȩh'Ic<c>mrҘm +jQvJ;N-.SZuUKy(ge(1YIgeFF99:;KX($k*͒m0h +fdjgxVY~+]+N+2K8jr9>-)CTu\KQ0͎Ҍ.6C4 +^ZuH)@ +0wvkj}6cToϕg{Nf_̀ endstream endobj 694 0 obj @@ -8692,7 +8731,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 212.807453 101.433071 194.057453 ] +/Rect [ 101.433071 100.307453 101.433071 81.557453 ] /BS << /W 0 >> @@ -8702,19 +8741,17 @@ endobj 697 0 obj << /Filter /FlateDecode -/Length 2895 +/Length 3420 >> stream -x͚Id )l`dR6 !FYÃAø琯?{Z^{CQS%R DDrׇ7 -%m5NM-^%]-t}c)K>^Mqx˿mCk9rTBPrT *bqT)Rbʎ*s#`F*^U`<0Cܫ̈S n8*&R8IϞ.rȵ -t\ ('t-St -[R#t $V%O[TjtHru%"ixWuu2kRAG{]R!O|S\v)GaK\lIB lQy:p"I٭vK%Ƣ`= [dA1 E Z= -ڂ"bKAs+`K@(v-cD؂ - D`KTX [<pcJ= 3cRz, <+`t݋u%@]њ=+@]tut U<(+LcFcV5Jwc%Xn,8\] ؃@ݘ DcQcXG  $?-EXBDX p9{ -\[X]X>W̸o1ˁsn J<$p 5z,H. NjOrl C` p&kZ  ,E8UՕGbq ġ 2y,.%%E`q tضΞF(% -{:p4ܵccA.&c ǂ\5Rǂ:|.ǂB$ -uhҪǂa豠D؂c"ѷ(lA$ z,()#ìzC-qXPT `ǂ` EFD枎a ltcXP#lA4豠Ɗ,3%1՞N걠j*z,6A R:Lx,X< A4I걠hfXP+l=7-, D| `a`:"+ͨ /-߬ Mxξm-, –Mٷ`Mez,h9[Y= @޽oM dt."䛈lܞTjguo M8[+{qZ΀_ˑK̲f*L zEgf- BݏcVwT~+_syvSV[_aĆN/.h>P4LgNvoѥx> 4ܸ"y5|F ڌ:Ң T//pÊtYR7DE*1]_|?}ݟ -'z x^wt0Í^ri1z'sχuN=YJ^M7{hQ=uۖ^_~s˳ 8FuX򌏽_OZjp)w}_cznS*|Rn< >VO/y㵽]/xθذxcw÷ʹ-G;*!OGżO:{$[%r=D<<Խos(?LNtns[۹ݟ~{@X/ w}3yjˈ}o!:u ݾw_n0"X>Pdw\ޗ3mSnk.1ޭ/w1yym}~S?X_{XlwtسgH%o)"oׄԜ}2CZZU/owܾ}};j_ȒZ~[o~satyy612t+~ؗgSH/^qmMDcGxmtn!14>f od>2؞b9Jy P׺Y1ӽ8jjL]a:u,˲O .VnԾ]EZeՆ4cAt#z8ԻV,/fGvGQz;zKcʨUgg~2]]xG!-egqkL~M>\8ŏTiRwU(KC\i˔ڧ -[,wT!5lXK,AloyVyQoXˬL2|v/7cNe Rg1bCXUH 7iI҇M;ƺWM۸:sbV, B^ m߇?+k= +x՜[\S̳A IL&rsN_f+l4UuU"Rsλ=-%.^T)N.⏻Nؓ5Q>J咳B]JkT0#f!9We!DK33XrsUX*j̆*x{SC % zt\*ЅL٥,!KW]J)K'%V,]-1xK[Kt pbo` ̖.TCW` : +/G t!dSIJlI>VS["{t [/KNDΥtu`"l!b` &"%sK(g'ĂvRXRF'ft,-QEErMl* ` +X,`-$lA[X,`V|  paX .$ ȅ+U 2i],lA],0RwYX .3j:X::-gb̪&GxRb@].;AX .E܂],KBbŁ?] $l`- CGl9BZb "krd `L]u!cčuQv!j Tl gX;DTXԖ Tł"o . X悇뚺|-bAw%X(|IL]vp`0vył"W bAw 1u Y,@^:O w} [:p\-$pWæłU@b tȂbA*jbA:|.9\GC,S[$$֮r- 2&X eXՀ?؂LbHJXc~ jkSW bA\X;M, X,`X,@(r[[d[,@ ] +d +2X$҉}fXP$9M-`` R:LX,f;Z,MlsLl( J!ndlz؂bAil{57I,`]~X,X7ł*%"E1uIS5-&dl* jJ, f`<(q+d]db.Dfk=33[YtYFVV<3CeI*E>&gLXO#wȈ%MV, Av_(w_{f9)ka)-g,;9!ӸRa3 ~onw0{jzW4|ؿ_ֳͤmck8@ Ooo/bd}5cҳ:NZ0I݄ͮk?]ƌfdIi㱃-xb/mq HbpB+wlܥuE s`BNqz4w#T +w_x/k9ֿl2)[ߋlF9LZKlaZݥ[֠mol={8l?JW۰9o>_~zm;.r( _QL^!%3zXs!0F$'^ҦݹЙ !bW"YWN:̇rχ[ejl;WeJw. 9bh:SR5 9y!3FxsnHQ > O`sB3m44OYudg#zFzozU{_*,\q:~*{Zٖm>WS9mm+w)wc Gm|rg%d|_*_LK=3d҉|ν':^hR'L~Wچ1mu%#zuJ\6X|p:pZ*'>5tNi[Cm=>;j?n}OvP!{8ϻ<kIzS{}\xЦ),j.ߊKm_>7~b^&.Tq:@ׇ"..q!qtX[ے +vaӒΡd}}Kݍ֏>l cC) XPoWSѠeGMq`? O 1I'd}v &<-JM>ܚjKx2vil%H'CtW5-̮fMZ9r3DYnk-ʽTUkapu.} 2F475L<3ڗoLxE+qw1`f!Ovq_6TXMK<˛ ݥq5:ѵǃ4SX#$p7+t{>bGi&y.Z;{WXdV=~-a8RśA/dc{k;-HRkj$$T4}I R2<vV2ps6z[15;Z-=m.>^n?|gu9F\e֭~E5-ͺrt|@ endstream endobj 698 0 obj @@ -8731,25 +8768,27 @@ endobj 699 0 obj << /Filter /FlateDecode -/Length 4817 +/Length 4776 >> stream -x][$m~_NY!F9<ٱX!?U%Uٵ;>"u(VUٳeS%E:_>̔ZbuQٿo -gk(M3|R . m.eO:=l8O)d*`VSJ.D! FHhJJ bsYae)Yg%1l IaY93FAC³aPzxN1WT^&b"+S1dG%c5^,Y"dY\N^%⠝2dueYL4V?T^xc[ sTdk"d1)j4 p)MTi ಟ(SP2QJ^WD$ 97%PԐ[B\Y|! ,(aőװm ֢aܒ)V%c 1s$ < T4,\԰tI!: <`Sx'k4, Xmp[4, .iXY`Qr6peCp%,*/MAaw]qpבP&Q. $djX<5,@cCXaAڂOids͘>W&qoX4,],T^Â|f VTaAZZw+FÂE4,9LX&k`*LaAX'$*/M0$ax2C5,],EÂ5{ "pY|v n48 x]cRѰ wy԰ &&a; b5,ŀO AÂd@,Y(Kְ 9Ӱ 9ȂADS\ "E dS.DA/)'٤aAJ4a) 2^ᒆ70[OwzM3 i)}p.Uag -~/k]BqswQ>sǹ[ 4R8sO86hRL v枹li7w,QrJی{6.wꇦEvkcKc|:ZV[Fj۞˚pDuMeD Cb4I3Uceq?Cn>4퐵Yg};7|@hߎY5Yب*wfel|P,V+m7n(-WXAZp(ꤥEꖶlKo뙶h2~M+:*Q5ѣZ{q5)χGeb;2Vn}n1n} -^V(d^Zt{m ӅD6þ~UU[gl]r×PC߃DBC4|eI.^^o+-m$`ΈeI2!tn, o:{ |I=j^W"> ]Ӫ+ ;`A&Pd@ r'X|u\6s6YBn"-踹mvWCZ?%qui_oE4u(sR!IY[>̢wS8X|")>qe˼b1qW|࿕3~ڷ[gekfumXl]nZث]"WEYѱ:bECl7yѬ@5}µ̆g|iGe%Xr8]i4[Ld)i; #W_q*ɎOT޶cu*ml&€ya=K]#,ZVY!uSo#->fŦ "P#7-`Gt'~Jfiƃk+^MV]gdk~w3\bů9&>$~z?A\v\5]aIv[֌7u}[Y/7n՛LwϥFrCcqKܸo7 yV7u ir٥> r_pq -rfɶiU|f}-ȗ^jySᇇc׈:O 53O7]Ձ2ѸG"ln )dg>$>tVIys -5ݓyf ߌ'\. -pՉAeG]FÞhDwcI]uqRuVL+뒘[ -E[SMtBN d";5MO5rSHZni-JTUKe] -"U?GodCϵn܎x9!E>Rf_: 0$zn'g3ePSnk6?"t*#O`?y\N7;y$IuHӀ4 -uٔJ}aW3]c+P# 2cM:!c$&MeEr΢z;vHr3n!]ޮFԅd6:dgj7:!@aTr֎Nq8^N:en-sBFY([׉Ҟ4tp[WdA2#l(5u94쭤j;WС nzpxh2`ϗ c7p!>̔ZbuQo +Gk(M#|R .m.ew:k]TJt6Y䧔S2Aa ++)%ŠvKX#$rg%A%1ȹ2߳ +pɒƂ !N0E(=j +Ӱ wJaA"n&@o50]W&Srְ wKN“@&հ`<ġD.aAཆkaʃ,>; ׀U|dBw k<1hXljX\ְN1TRbCȧaA2 @ʃ,HS%kXdiXdAȠa"XDjzY`.j~@@)" RǠUݔZelҰ %[ KMNa~pI% R,p M!2x ְ.xjXdA4aAvYf4`F. Uk<2gf 2ʼnCE &4*&4,p4,@diʃ,>9;N79CgM7@D|'5,gf䛎4,_r5,( DmͤaA!<Ȃ(~ LB txB9 @^Ȝo&u +IwF p|oHtf3;[؋*{9i1Y`Yu'Ea kfN< D=bؿq{,S~6;)` +f +Az6 + ӭ,5nuעOAFZ +tl/k:\;ĵMPOb$r@tCaI"vyEPǠGWC;~O0џdCeYSUx.Ssm,{(hsɖS$fYEQWh]Ɋ1&݆l(1­ɜ>#lh6$鈚,+ e݆[rlN EՆ:u zt5?r +ʮQwȳNқ9/"K;O +,F,7{s7T'/]l/x#uկ*Wi!KQ%>cawYJ_Pշz  MD~Jo}<c c\6k(74 nߏp>f]  N\}.AsiɵƥpB"4p>7)l+Ѻ6Й7.==s*LoKYV.r-246>,mMfƖVuZV[Fj۞˚pDuMeD Cb4I3Uceq?Cn>4퐵Yg};7|@hߎY5Yب*wfel|P,V+m7nz/-WXAZp(ꤥEꖶlK/뙶h2~M+:*Q5\ѣZ{q9)χGeb;2Vn}.1n} +^V(d^Zt{n ӅD6޿*TcpdF[׶jH{HhԐl]! {*\ 9 *6zU/]^Nw~7߼ԖN-ha8‡66S,y<}EXF\$|6z/FUkQUi/i{_՞tH9v NR F#;|hYUmz]^M2gOM^ y[ e>=a1MjQs +mi7VM9> 0"Ez?.ay/͜h).oP۬H :nnjۧՐ~Ilb+?l8IJ!K~m>`r/Tft'h*%pVO hͦCᡋ>qcGȧeT˟0 /[~[/-I6ֵbJq'.7r[YZmuĪ/YU`G̥5D]C76K7'k9hvaX®㚶+}cl[Y~ӧZ\XpGS#+|[*\|Hk[rš=&.$$Bc庼g3:g"ʕkgYMeUc]\^[n}!Cͨ|XV\b*/qy5Gg/,:f}rWۜγz .~D|3YmcRv(DYĝMd3ly8k49_V +V~!˿w|h/šYFLIX\t,V$ڢѦe2v"C0:|?wC0#|hcq]-rŔk3i>&>,$~z>?.Ë֨.䓪r+[V&FzSH|XX[n7Bz,!&%3ǰOXj "y(G~h6l&[kgjl|꥖7o~7?u~-X` MzWn}JzhfC~9[H![{|4-NF;i >Lf8n'CGh~hdZ!_8wQ3=Go&MyU L8$Yv48*^%[o1Ft7ȎO +ױ#~eZӄ|1k!Q/WZ9t:BKQ4QNį>b|&}Mvv)-a` $ыv;9a/'HOpFg3TNe,u$ f'$鱣iFY.RY/D Jy^klE*t/7;xɶ[]'35tDӄ@w)C]5YCowcIN}-?6߈і̦['L_Fg8( їJnщ_>'VC]N;deE?:=[h^ǝh:r%7Fn#ͣlhq^Өn#\I C:fi|܌{mp|5?nI 9\cI>&qEǒ.9QQ\ːl%&줫'9"K?x4YtQ" <ЯvϞE<;EROzח}CC-/| g-hu!mTPSjUmpibj2ťZSKqVzL1?HM9+]AJܕvۊף% 9љQǒYEYSi}(AC8"S3]Wk|G}VԝcPMDc&xu.Ȼ 1&Y~. :C4ޏW+F} +PgKcꗉSE~7󫚒9ظINlk endstream endobj 700 0 obj @@ -8778,27 +8817,24 @@ endobj 702 0 obj << /Filter /FlateDecode -/Length 4755 +/Length 4689 >> stream -x]ێ}I@Y ;1q;EDZDwۭ*^Jat>+}_z1oϗoOߝ¿1`TOpglN>Y@aə/'/?y}6CJhwsVYB A9ARsCyASLIR KU6E'`5& -3MKU&h+`N.*`6J:%#<K:I.@tDV;-wQYҒUXAyB-&tNt]Q啖t.AbKQnpHI:lÈB' l%Q[)#XI:0ZMݤHK:[ VtDAC%LMJ$`" 6(i!D&$ 3Z"RY/1ib1rEld%. [@"b,I\@`[ H\@[Vi/qpa@R@AF풍^J %BNQ[` HX.i$.] ##qzu`bTXJ\`&` -ua$ ,x84swSF 5x Do -q;[@`ΐ(l0pK$.p]0 cl5蘼#OԥA0nʃ>I\H}F fT#qjL-$%qop qA+@WԥA%.p]В"Dԅ@?T$.]$.]e:BH\: [aLYSH:aIU*$ Ʉaa5GKF+ɮq >=l? aLm_av5N<:ZЎGd#BjFjtFb3acTOm@&B|c; -#̶i(NJegNV\ca ?|{o?Lc|INƎ~)z~k_hۺ{:€) MtiݔץlG]?YV$ty4[?s H>Oа}Y^rXހ J'ҕ.dewptu5ժ/P=\@.rᗣLy9jy@pn!p YZh'*t{i׺CuS Dx 92x#ZLar7HsxE  fXngá97MO8l-"^)n ҳ7qܚ"w=6Fk/tI{Wz d~1?osX;{iD]:wun+l.~Ts8Tf\ZU~gwOe흍w9Z͆wZ¼܊$WP;/38op_áO&|p:42Hft}n0II~Ac?׵sj/}f:|VJ/jl!x_!x#`xt}мؗp-/ڪ+,>Fnqnƕd뱤yL[:2-?k +Ot+OGz~Eٍy/cWwbV}<:;|d&.RAx9;QGz܏}^g -XDr/dpetgáOHS(0D=͹Agע} z3_vm)J"e6Zw1!+;A7d:u{gmUoPտd 鞄sQ˫k -b=s8nl^ -y:<A_{. 6\ @C4B9B7{.<-}{Q*k|e?Z0ҳhrHܙhHqw@m噦(zs(Ś+ - ocXw9BXkw+J^wk[&VP@lugávzk1Fٙph現"W;860?!ڝyڰ_}/7*%nyY\XAНyix\w=鵷4ԲXcAʸgŧ4= 5#W+r1T@t9t?빳?}g!x_,tAˊ*1-V-{XRVǥυaYJDz錄heȯrz顝y -+ֹQu?effr4܍~^" y 3[QHi>]{3 -?Ot`gw#6+w7=qvzc}y%㊲[㑯 Ҕy"Yֵ3и3ڿj0[\&vq?Xv]H}ݙpH~ou{ жў+m2D^ݙh(NWZt]wWlg[ υRvzLo3I6#_*5U`cOiw97}wJ`qy zy&oɸ|4,ގ7l7P;EQեذs܎jڡWMM{=diQM9hSM -bkSOU˲$ 4 OInPT 'W~W&w%[ƪ}^ Bz)g=qWS/6C -mEx, \``yif`>JU¥IJ,C|PokZGiCvv1ʤe8^-Yet*Zb(6)[iJM oi{6iseƫUq8vvddRRR-l{fa!yes#c皧:H ѱmlj@);{p͛dYhx/-PIe{mrJcT0zҴVyA1XN3H0Y"^*ZϨJK`$2)+:q: QGVS^s:ctQ8lt[lYbtLduEo8-]-@W`uE:8]4@"t2ii HNauQ$-N`5Rs:[?GA"{AQG:A:DAt\ӊ##a%1Q0sYl18.0M%%|KR9 fJ GP.9.0\t1=kЮ8.0]CJr\@]cP0* kxHs\QX:qwuqw4xW[\rwjҎE$ wA!w` iqn "?fN +q\`*`X]ʣǙy^ʹqb2X.3p\XQ5 VjNU:J ,x~p +X߄.B8.]ВL c!r\X#+18$=9._-3 ++FӁwM&'@/Xs\E \>V-^B`AY' Xhbkbkx"*xlx[6> O0o1*sZfu:9.bqb)09..q\3SqS,E"hxN8ӅN) -9.: tЈ%՜d3H"&4&8.`r\&V[% B) [)D [q\M4Doj2śh$Mx̼ƥxs\ X(i̼'!;q:[t$ s) @ M oz6]޵L8@ ϖ%zg23 X[ٔbl@|S& `&"جU(d Vp>)*8x(vɏWS,(8Sii#V|0JLB,IFXT9閌ӛrUr4NV[2&NJI¿}wPg+.9rؘ0i{~~w޽̑')IJiW*W!Pee@Er;R TڋMe&^Η>??m濓te>gֵ<_-0y 4Fvƪ<W S,/%uaZ~zX;snz2>uelX^Cn\z nrnm۴K.Pݶ{ )˞A G&JDfǃudD:א܏ZݾE[2Q9h*Ws7Z5t +>Xp<F&tk?GuOuR_y|y$ABu9Z;#k f u\#h$=ͬ[̄д延چcH}skSЊa;~i?=4#Vz_W4zsAO]]sKvo +hcVgx4 wnMu&}7\qݓC>]I![Z\H=he™CScOnC { URj^i8/XG~h7[ff" }Gpᐹum;dcֿ+3q,̣?z96g=׉W|nNW=lAֵ~pv}h ǻua-jUL[=\֬|Zאn6-.5oS:GC50mԜVt2sw٨+|ǽlco3Xph3 F=E9E.Kt[0V|Du`!v}4%V.}:{ ]*nX=e?ؾ;po5(vo93xPvtݒ\ksLm>YFm;ډ{`_>`!s>MX+o ~u{{dO}~/n-_UQ/Q]9r|͂)v;.k5wbu;ϷtXۛbpme8dxJqOWgPڲ#_|umn_u/%;oo5#gJ;ll)ߑMs8D]n*ٔ17Puǝ:Cn_wn7yF]zuUNJ6Fܓ%WK*WS{ڰm /|}R;fR}!ֽ#>-;C |Bh.:CoMy/k;Ts8D~'HΤO2g5#7Xp~I፟ڴig< +y1b:GCo|OZ@y:Czԇ\~wd&.c $`!,}jv}aoW}?e8\`!'SFQbg M3e9N}gn3IM6kG bP2vl^Q[dFW/O77酭&`R' ^7<ѼQ_)YKOr-[wFhBٜ5e{TzSX:WT3p^>pZK_Yizdn*Efb\ qbD'FMQKoCr1cD'ܚ-#KPՔ +uJ3fOn4R䱖^ OLדLi[B Vhv8Ȋ*M[.05,( +[y +{Q=IEV +|-t`/$S>n)]zl!mK$Uc)VuE(,OV(8]ׅiTɜjnKU +wb_F\{K yZب'|*ֲvdRJ8Nӷ$V?N2Q靪Ao/ZЅ[v%KoF,,ӦjjhUemFCYǵnjuY=TAUѶB[]L3<:6u|q8IVᠽ3uI>7M(K:8hasX-[ٞt}ڡ0\AFCSuTٶ,)شmäړƅ=wO}6ڋ KBxLnyXsNy*mfԩQ] ZmV e慢d2J>j[+l/ST?ڞNUn^dd[8zu,d`d]TK,[Ϋ ZͮJ̝K.?S&DK,ԤPzФFns=WΈ\I{& cWۆ P}EPZ%L*Ҝ\e0srJCBEWGҫӽTljh~>~ } endstream endobj 703 0 obj @@ -8815,19 +8851,25 @@ endobj 704 0 obj << /Filter /FlateDecode -/Length 4886 +/Length 5035 >> stream -x][q~_Vx?8"N`aώ`6:/Jj9vc33*^ǯW4Stx颦~jEar:?)$g_p'ZW3v׿*S!('TJ[Aq^Py=)I*ڪ̠dLTfX -nU fIR \TZmu0DY#贛<:K:'I.@tN>vZҥ{#Ғ-dctXo-&+l1$"l-+-钝\D.Ab[QnrZ%鴞iEfAg`W.:2O8bfmՒc:؂xآ(3hb^80Q2$vHQbD!XLr$JCgDVG^ba a:bI\` lA -lK@tK*i ,X.TX0$.\@)I\`)qb ,X:o$.]KK\`"-`h%. *H\@]L##qFudbTxDExQ&A+qwC$ 5N kx h -qr8[@Cg(l2K$.p]9 tL^'Ҥz\I{$.p]8*+q> H\SK:6II\äH\6i芺4 Z2 O*ID]$-qxRC%.]$q*ga-6 @i+i2` -IU#,J$q۔(q  |)%.IAO N₠ p,Q[(dS b ؂ADS҈l\Dɦ$.c=^tL1E]N B XK\1%.O.I\3$qAHSE)DN ҅Nk -%.&bXK%)^gF "CE 0MS:Ëm'q?Xlb#`u$qAQaQF`כA₤` "> ơSJ₤#֛$.f Y&x¼Mz3H\8( hJ¼'a vtD$y%.@&"zqK z3]LK\ 7Jk{u񙬌⎁:Vq@{ᭂg@F7 `&VыpPj%n(/1p¼oQy!gL辮9Z2l˟.|/o;eG#@ȩ In[(Me%jCjfifV"7VBW.r5W ɥXև59 &HA˶v}:Ig3}ѶhA-| - xDil2AAX(Z%bżO_/;i8Gx~O~v)E?;.-k\;y|.Յ*KnCy]i+z(K\WM9bkM? ZfڧkPT%a ` 8>kp-9@X4}]$j%Ó6Ҵ JϞlŊفLO/j;kvl]"f|.!9J78#.lQd; 0Fg}5MOh.o*7 7#O\lfc68%ܾgX\MFڹd4jr6B]8půqvbEw6qm\wel붍Xn֟ߋ]]k5NKd/\go\۠a9 43~/qx1K=| D`?:t*8C>1p wʕg 7)WۍRnO*c!C^w7 FnƦ K*%{)槨)9Dz{,? ;-jMˣKz%h&E,@C$},e[븎1D9-/fiW 2N3MDPiArƝ;y2ϓ,EwueIsލB`f:=%얇e lʨ13rrtflutx 5֋uˋ.qFggT-a !Ψ4y&PBM4bCG)p`ѧnl h6DO 2˦mt|f_R2=;( -M'< Ih8P}!4euLr.;/m6FӗyZdVm]K9jsTvuH]8*p,ĚydC,!JNVb[,x0=|n,6|ڄ|cn75F}Y[ԲבH]kڗ^v\PoaʺxkGNy:ǠFF[ae]??K, fz6jufmp ip?[wFiSU -»I@ܚݾꪇWpޢH[' /w#lyԨG!PQѵZ7{|l9o1KNVxcU\|t;vW/:{VG܆Ͱt:X8i_|p43 ьʒ.äsNu?T7H(~4P4c)ǘ<緽,\4Oܽ#fQղ80 SSZ7c;,7JJ6~ # Bz+֫I/bƄ8WSXO -lUm {4avojzu+OsJxZ;JE)Uzר*QJ]IY8 E~Jфnm0 QMJ:At\PSŖ5o4X;^ݺ#ʖk1cb.Ll Bj׸B^hr8& tfB*\2*}Usם}ez@Shi!T\HϤ[S[I.!*yźJT셪U(NWS2;Znʝ8jo-|޲cQЏ&6zVY'l{Z)e&qo?_3> ",}-~B./Q-L֕d5񤘿ɦ鄆:ob[ZWP1_Sˮ2^ZvbSkzoC/@kǦ9Җv~mr -}sp6|'m.Z2]F\ⲫ05Vf2 Jj׳庺.Ktl_tVtI/t_iZ#㾘 `i*}掠a,'Kmsl>&^&oZ枭AN-EN[%+"[UZE TC/JGB)}O~Tj'~T&-[<^l \ZZKFAUJ--mݴxk jmR~>2w<îIkl@Km"PJ_~/bL始SWr. 䣻lBr& I\0TV}F ,wd]mw78 Im +eiR)F xd$.T0HZJ\0IUZ OQ0yЫ̛)е( qA4k "& )K@ 4I\tTh$Nt!Zh A Xez%q,4֒jIF*3]E 0MS2N,~2GAHM^nF b.F ͼ $]I\,qh2$.H:biH˼ތ$O $..(.p0oIXo$.&ތzypx%0$3Mx^x]& c^qF1b@U (p/Uc +Hbjbe5YP+1lh s􉇨<`3c70-}[slv'. {?/(  +$ qgǿޕ97RWK0[V /n?tYYJapO Ɗd+u}w*>hYGI.慨sp1Jۍ`mX4s@VlVڶ N,_8AM?SE>Pa<|: hӏ_O?@_K)sٙo\/XL ~toX?5y 2NJSC{C=99D%ooi^2Uלn[dZn@鷗aY=| n\S:ű%>yI+_y:@z5~v δUְ"mӾ T0w*0$Mv@|̳YCm$r4ue4LX7C +⨏p6 +eoMki"ǰFSj{??wgϤ'<Ky.'CȕMf\";9<8HC;9=׳q~>{QKl604?bC\COa-ֆ^:Ϭ8^|}.3-΀m(5<ғe WERr€ւLʕ~/޴;D\x+iGU4MRϕy:_knmf( nGu76ܯ>'<Z}6rk5!Uad! 7Uu]~5%[3+efy`O }6Ȟ,t>_G#JhgH=?CHDFGQq!5;-^[ 0kg'UFUe ǵzv!#;lqakRK,ϸ)G =?ah{Xڴ۲+1@d(`M/ֹQX7uffrlh67sgԅ띶 ^5 -ϗ?T:hQ}} {NlW犯Gfk$ZW9Vo:`oXIRá1S.twKXзe?1ewb^ϗޫ/-=QqΓӍY99{IY q^^Fne EWOy6Dѱֱn{VwF.Gq-2һY}AV#pcd? $ٸk=6Ѣo~Ow,nkCq{!~cu%{ 'h?7Um.S;֮N+ܗ&}cqroјeqn G[m%mֽ~SmyGei}3ýVs~~iޯ asVb-u< fCWZg绗ӿv샆tj>˓IWv}oc?1 ^:F%ly'\a6N[NytX\פ):! 1Pma'C^V>5Xqދ+L*}cػg ^Xܹ#daDMG[&)ƺ7)̪H0uXtKX븍E9(bSXB/krH잓5-=GrqU'2>7uiq灮lPq}28]~ӡg<҈9K/rxY<[ձ_YGP2AjB25.p.˖F*w@Fi[/@y7([Pe"HZ'06?["iYOjy_F, edy`ô@c^V6xʹR|\aCYm*^6ŗ3?u9Yyx;&1ӔʒäKNu?\7l|v>p #XTNjN4/4|U).HH&[wsQ!V SsZ7cΡc˧Tl9qnXHDIդq˕o +$W MVDMTl ĭ|Ollk^"ͩ1MLתj,S*TWs6NB"$~jՄlr6j491V Q˗j>!v-6R劽h=UPuvc|9l([? mUd1Q=ₐuPB'ZVoK㥧u ST3U| CW<7[xoCRh +=/.B,/,t[cTe,=^&FdPג3i\UUdנJz6UjyZ=7|ɡ·[7}[ 5V 6ғj֮7b i$ة|L/L~Z[{Y/-~BÁg;nTc Ӹu-Yfx29OMlӆ%bߓuy]EC0^\ub9ucPݤ<>dɦAhz$ކ^l׎M77JWpol7WV%rn!% +WK`ꚭ̀䍴 +b̍ȗ˨Y^uM+wWL7VJ?)?0 endstream endobj 705 0 obj @@ -8846,7 +8888,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 401.373057 101.433071 382.623057 ] +/Rect [ 101.433071 307.623057 101.433071 288.873057 ] /BS << /W 0 >> @@ -8856,20 +8898,20 @@ endobj 707 0 obj << /Filter /FlateDecode -/Length 4737 +/Length 4670 >> stream -x]ێ}g+~?8"Nac# C~?HR3vv0;*^JbIjɳ;C;s|<}:[cޞ0~2`@G;?_sH?eyVCNI{2z{aUJHͨW1*'b -fXoY<01XN3RQz0Cyi8̐zF%JVC1Z1:iAwN"I8փFZb+V1̺(ҹqQi ,x8. ޕӁw E`9.A -@A8.]В^xL I @ƃ@q½G xWX9.p]a:آq tX̚F:t]!1Ü+8nr8*p\Dw(C܀cqXP- XQqWE+qW!(}[)r\&B4ocUN<{3K = !K G؂q\"sN'a l B'%ADtxh%1ԜΈ *r\e&ٶ`&9hk8.Af آLMqAQ!ơ(p\uエ16jh`E` Ȭ[p`'N`\o f`M lk#Ӂw: p&"[no/@#>!81^ ʦ ʳ9M{$6i3 B)6_cf S3O', F)?|٘)?X 2Pm}Kvh9B3Z禎)As- u>‹OcG -ؾAbU^`CUb'@q0¿}Pg+h9$_b3l=xo?0zto0}Nak/5`@o2랖e/)WY樂nnemdǤ965φ2iǪ.5Y>xȹn,lщ/Bo?:|cD:ADwW%x_k0m@3TY2| 7Z,aS8A<aff6E~6sUծ-{ 6%LrW1Yh V')1#!ܮif4}%&Ĕ_".+$Yq Q.KS쿐;w9M|gr"IvW[z\K5±h˴+4P=`PA*ؾ:CN qTT0x5)˜ξ:CNh?z p̌ڦa>y~9&T/Aԇ)L(*c -Ŭ~;_JΗuHu=Lqs8UzC>۩LG% -] m˹fcYy]k+mPVMFC6PWcDRSPWpWjwC9鍐5"J7,?w}yOQ(e$KC`_!/xk%2ٟ+{"TϑԟUم]s8]C2c#̺9Fz㛇 N!ٔ2C2{WsqWx皗tvp?_sYa1s4$qڛk K+Oavr?;7PIr}ݨs8Tޖ|!̛ŧh%[7s8v{zK*;ru¾tn]{nqOws)I2׊ڸ̣ݭ>\c2$݇휡qL7z֧}b;KهtcBiͶ̇)rOt<-us8|DF1M6GcG{<&VmrdGt9G9㕹;fV۟7~UdtE^Yh;YwnWQuqF쾗w\s8TDWMqAoJGzcw*I}uq-9ݻSPvܒ.(lnS:w/nI]WpH4痣\-US ^wǕ:GCyZ4\Q/E!zG_v< ;25Wѱz:{9j@}Yp ^}'!VK|IeɓkmZ7ꖿ@:CN<{(~yW<Oft9}S]"6u@(Ɂ0Hms{s8xMyXǬ4)wCSte=5Pa.Wۿ1ᐸ7}${ܶLO0mk ޑcs8iv+$[{֦6jg6\oI- -hi:Ck_<&Oc%^}nXv\_áv'zG\xk]J؛]mI,|^ȇv9vB(<@3uLo}KCi5fD+Rzʋez -3jFTo,x'p{ޠ𻓛e+ȏD< -MLĶמOC_T2(a`Liҧ^kY_sgy=Dnĭ_&_pN?-܌% dH/rD} /LKq"34qqi5M[ruiY'M!Oe;5 zscX~/ڷsĞ KsXMۧ# ҋ] }<~I+5~*7Ҽ¤`.i'͐?-mbfjup(J[FEv!%1Ƶg\-eƈ\HY:fZ^ r7†AGb]ڠekXjAv-*V&#й*,ӡdsYt^^NVgVCʣDibT,RK 1e߉ܴd=6I2L)s9Ft9l)_JZ5摯TPc4K}z5Y#BKK3Z^N֔X'ҶrzTIEDKOXYޅib4R}fvf/]aÍ4%%/%`'-ˈ-dȈl^"BK,+Day| -WRF* qӖ -Μ$p*v;ؗt.|^FfZq~ȝTΈRJϣ8N7"x4Y{9ui,(F4jsK;5Y4;B,+-la8KLQ?БtV Z:+nU6=^t ,g'jKFh"5βufwgrjd*j5*yݳv:Mց+L upFz9p'81%\:#s%'L`^o&* K*A&A`hRa$0GAe40VkQC4xAYB6V9B$㍤*#6o-Rtന-6E'"l,l-:h#S>'"Q)j|rNK:c6Ì (,l gQ[V9Bt bJlev;팤H`%$ + R$1*ʖ$)J$)+I4`Wrxi58 [< -+`$q$.pXr8--8-l$.p[&H\@0SK\.r,q:p%.p`]烕v q:2Z:3I\@]gtFV)i k& k#Q栓kxג ( +Eo +;[@`: ИpK$.] slLA5 '2=.[2!d ?DIhP* 4Us[b$1i3Y f Bi6_ckfX.2cZsLJk~;owz͐)?P_a، . Q a#u1OFt+Fb+3a];}*>B!"P8ZO_ *hFp6˶ RӬwNh5X/ O?~?>ZS7}p[2tː:7B;W?׿\8EhΩo_YEVO㵬z?6x)Q g*`s@!-( n+H js]Y_P3Nw|- +8;+kMs4"Z7jjאmnK+k:b$$;GTLjzD=n=ۍ("6bq>I>V@raxvڌݵ]Xۗe~6{'Ѧlu G>\n;Y^u|3Z%_׸@ܒC},֡G+henA-ams8U=f+{WCς^x?ɈOI+YȝuH~!Cތ _}O>u~b?O*ݚ3t(^]̯XbB4m"9"7|;/#~쏝|:ViO!mew9Ok_W=Yht +ʆd.Lm~qlz\u_Z#aWMms9}Yk76lQ L}WPϷPv5lݺ+O4δȸ"ɍ҈*Q7t+SWQoTnAV;{VC2ƭLk(#m~_Y&H\AWb+Zu{QrKۻzs4҆xۿ 9e?> ¹nzgáu>յ[fx&h6$.ͪ[f>~6˶qBb>&e %-s8m=y7;zڟcqp]{W4Do:"#ZAŤYph.ü]>]Ikz"}vy3ⱵX{jk> \㟛 s44 Q}"9mZ'w[<uf =0;;Qy"F髽ɩ;)/]F j>p|g!v}6'>L:GC\ܸ_ݭ 17xgȗ@X.mqQٴ6Xg"s8n<+Gf[#mK wU;[fv9 +|Tݙ{ ~VPʞs8n:fFm_CkU.]yQC:l>3蟙j}U>:GCnQn_o8Z'šֽϳ4Jkx!Vons3 w={+|=3KB!ow_áwQg>Z.V:mػUҺxˤcپ's8DmHO>Ϯ $}>3^ +ou t[χo%|sLi=IkH; y}1+x߇C?ᚯ'єm: q|͆-^>O|'D~Yp=~K\57x2xn/96G#!xutv]>;;v1=DRAe FE6Pȡnp.?=,ˆeHMT]:%˾#~_d7mcVSbn-.Cݕ!PӲ]CZ@-ewhk +Wqc6q^&iy S>D+U&-3|0 UNX0L  ҭfReLs5T#45q?+PW#pIgNߦ*^O oNиcqS6kv2,lԋ S=$vɘp2 0'}u6v|8M2iŽ~: ˜uf|Δ}Ne2um:슝v.Uئ Zb?M[z"Z45M˅~C& 83bsdizq8+[Up/iҹiI>&qTNK:dYEFqN'ff@򓴮/ +WQݤiMWp\`xdI臧> (FMՊ,ua5ǝAS{99Ԙ\ p2i> stream -x]Y丑~_;Xw nᇮ15~ؿ_H!*Re r Օ"_J)@.ZEo*oW)*orH=\T1{˾Ͽs]\9X,r*X,m^h}X(b bH1('/ YVq[V6XdѐXED -X `Q -8#%, s) Xr&9 댎pJXYU atEٔܵIܵ&@E5$, rwVZA(hB@Y'aSnk2̟Vʤ$,]0}"/+1º(+Bwa L,wx]cw7x M yY霒 X -+$"/*(`4P p=KX;'aAj# KV5a -kΪH!`%pW%,]6$, -^ $R9 aA<|"/(\{ DdHV$aAY+aA.T6@] $pi7JLf&81Ѐ^* 4*9 IL@LD)YU0 60gU:D&31G+v}wGw|Ŕ)+?T_a، n8v 0ws4+Y!* ڈGX5p掁=S0e+d}sC#||,k6HoC sݯ(Q_7N'+Ю̓J`l;Xqٲ,"Ѵ*.E9O_/;G_.~_.B_ 燲0t[.kY,7ÿ_ʇm6U~Y8<ܫ뮽cz/^Zi "ੱ|j=5)(61кajjyhsSqUwBf6SyWOy6%FO=`,2]z&9fP}MfDͺk7|K^y{C\Y<,Tƨhzi"G5^XfHӴq}nU܅fy7cV`{ -NNa;mǝq'ӜRXs(CL=W4[g3㒤5>ߚ5hthT돖ڶW-mTvp^k[LUmi+V\PIBcGyi}wЂ -ӧ_;^i̎8襰lִGa\/ٞQOܲf|ѓuM3}_":nw=}K$S!zX?z:ui}gǑYz' ޳dЃ,k^i+t<_cf915Dg٤{YMuSy7~;nlZ5rn988֦/yK]C[GKK;Sn]7/Gyi}_=gqfg^|g-8rYo˙h~:O9O?;U0ۂ|ee̩n|έO6iiѲ s~ьavo^;mkRS}t{}4H;wUGsŲ|Ǯ/\e WXZoj:ϦitN|ZG[b$2bL%/teV{Ɋs#'Nhv"#kL쥟tv"K3h5KffF>bf6̴YkO3/3Tn י)3Ve,t<xG-Ցq }@)Bmf%ii 4mMZS4Eo6tOx(GW:piem?̣;suNc}}6;JKAEus?|ҳ.o:Mx;q֮Yir?Sӟt;m߰Xj7㾷UX=f7W3uoU9b a(M3t8`r%,K{99mQ%4sf>[Bs)\Dzo&n9]jӠ_<$|{L0La!)cyW~gҎL&3 ԜZj /N_,&ɤxz"'[.N@m/|Ե- v݀Q$oض49 ?Z_RIr{"j%ke2CRn -UNBWbkVl~K]wlcuB#V3n)nH}^T]+uBJd$n.M&YTj\ E,LZ*|:6nݶ䯬ֈv̻u9mLA[xx+_/> -} -D׵[I7}iT~ Kݦ RyJUf%:$veb:ۏEiJDJؔvūޒ9ӭd%@ }JVڶoZ] jVoJ>ΐuJ)bR{= 5講P!_:)u7׹+fDJ ӡ9 ,+5URxKo!`No2AӗM)!T/#]_O|gpZ +x][ȑ~_Qφye`  g1ه56Ka2 B%uԘ=M.E%嗑! +?hIO1zEM)+%VE'wՊt] v!/v._W3vUdCPNP%ʹ)㼠z)$` dh +0Rt +f1QPEa)hU%a&I3trAPi;QJEdnptFO>&D]N#鬝| KEIG%%-N)I[ I&L Bt)6˯?b_LYJiB|i`!8}˂ʿb! |N6"n-.Il$gQ"sXJM1&w949 BHA˶vW~$[]sj۰\t uqv@;|F (l:xdTFhU7. Ŋ9C4ݸ/㟿O^/, _nb&7:laAͺk,e M kz~ K;~@)Qy +aAuʧ`K@ +[;jCˆ]Cg8 :C;?|f@etUa4BC)wqrγ;HuphrcagYqaI5J_F֭6tՆ.S`o?x9V;?vhNsvb׵OfQCT49ĽsutzE6u6djA/?>Ժ +;LR9sĹ2GVίk~C NF}tHqMmG1NˏH3m8̄9?."{xp?WyF-mePG 5g`޿_>Ylbρjb};qhDNюdCAz8?¿B3k>i:?h=th_4?㞬th~n_9U*L}u">c5w[ރwŏa&|,ȳl裃8ߑޓNܹr;H1:OO˹"9rv6q^r0΢A/O^=Y{pc8ZîEegCQamf"wq#ڴTAt(=`q5S=2R$UdAs+Ũ&C:\gChlukm]SlrA9ؓuc6rkjW+N կr1#Tu :ԔNn,UsgmΓGBfWP#oedu1&yGweGٞ~YWDiƅlvH{}-3|n̯ua=Q;Hp:O1kBO95=.m \jٕu9b}!Fm~ߕ3Kv[w4"Yޓu 7؝~ <Ψz0-qs%7{ג"]sx\ [xFt+:*X%(=Y{`;]Vxl:~3Dl7 +r)İ_a߸\5nɻ \ϻl{dCAΖ{eҽZo+c!7fϹ̩Ml(\ «ڭn7 ՓuQw:v\31jw=Fd)ٖƽ'vX=ϴQZ.xN_+G +idgCe{OzQ[A=ݏVD9jsӗqޛצvc8s.;Yw 1{aRU +߉|#f, $ٸk;6٢;ח96OSS~;dO +ȵewCͽ>ȻۗF>6< s|8>sƥ_aw6ns-׎8Gݞ=w3w{/[D٢қ_]~_ڷ˨soC"ȷ3^Sqυn='5:ꨒ_|SHoRV4{mn}J]5ۯF?<ՙ^ +}8v[}W|%4Lg# 8w/Q8W>5k8tz5s~o< ~0K|y7FEޢT0o6NDE'<ܱ`0GCoي8nO*姇=V" +PIY|{Ic<Ԥ{=N6GkcOǍoGm&v\\ZnGҥ'L*vT43OA*Nlⵓ7!B/ܥChQ 3c+)sT$c- uM)q%jbנw;]Nμfpw.;߸8M.|F8C?NبΘRNoE\gkc8cdҊ{R9D&oɼQ<`^Ǎjla|%˯'Uئ b:0^]ub%ucPݴ\4mgmb d>ul=zryqQ?Ʈ}I&q%Z2"x8dn HIs}P;`aD>]G}MWY9 V!aҼӴG0㾘 FMƥIJ,ЯۚcN֖es϶ OZcIcpSUuhtb6ZuK9(z)K=4':>*~S6[W-9N-MJmߴWv =2U۔|;s! ?%cj[^׬o YjuJ+=a8&V_-E:VKjI>Nsj *o^-WKBU/Z9AiiaϮ'_P endstream endobj 710 0 obj @@ -8922,7 +8965,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 288.873057 101.433071 270.123057 ] +/Rect [ 101.433071 101.373057 101.433071 82.623057 ] /BS << /W 0 >> @@ -8932,21 +8975,17 @@ endobj 712 0 obj << /Filter /FlateDecode -/Length 4504 +/Length 4651 >> stream -x]ێ}gy)ހ10yi{lyP/J-vxޖx)ŒԔgO%$t?}8cɨ -gR ֛(np(g'לɟO|r2t)N`I#9]s:-& l1Hp:B;NgaZ:آӜ ˳:".Ot;)aNaDct -Xa-F 4l!q:{f8Вآ#V[( [` 8P q$ȓX@0s@68)Ő@KB@h[a"qqݒ %!- 3% 4(P -hpwr\A * 4hWh&)8. ` qqk pxHq\^Cq2(U^USsƠ渀PxW(Gxbxw`9.|A-wenji }>V̸E+qb.s\0* xWjԜ+U.q0H8`~tY]D-) 0 ƒIX$qxC9.]L Fk ,xWV[WÖpV+$zӁwp ލ&E^zstpXpn8.pbuq\z:x -Z) -p8.G0 ]]lqlg,chUNgy90K <= !K $q\lPS!* 88̙ŋ >9J2lL{zd? aLM0 T@wx-:ZF a=y.#%hqE#1rXSqľX#̶itP9VL1|ZaR雯W響C?87:vw:'1]ʌmSF[JҤ\)_>Un#n9_~->jwrGU~`z3Шv|Gͧ|{r#Z {Hs8^oᷖk4-:'oR |pk[ӖIgPjceߣ`̶Q֗p(#ZO4(R^KRKu -`iFV̈ty<2^\^k@ l|, ]Pחp۹]OWYuqADn]v]&ԽKH Mv9/x%O5\CeE)w稊5hwO1vv;fh_)R[Xg!%.{}y;7x6}(FgxFk pmҡ2jb~^HDzd"kqz1Ywfl6d3@ӖK]ԢPTd;y妳EMNVݟ*Wu5ju+}fq?TTj]%LWF,5)eĈ.'FHE:3^jMBD9]HĦK3\NK֐ZR}nxF6,uqjb{ nJx9#O1M -ajb/ -^4# ${'0Yg,q/N4QV˸ieK|}_&[uqh¸>nmdCCr|ok>{K +x]Y$9~_QHk|/iHaA!k^>3G:#rvVMUF?pVW D;~x[CoJVE$0^hw 䯗?yu"F뻤"#|^ZF0*k:F)ȩ`i0b +fցQa+TE"N3TQ) ;Id4SV84tZ CtIYp(*"` 9-`p:[4Z'2[`tRqhEda +N)aM0I3: [kt8x3ZuF,l-|-;0D%&t0t7 h90RAGFKc` a:b"q\`4lA - lK@ tK2* r.̔0 8.0\@)r\`qb{ XX9.0]Cq\`一 '-0`GaT0x(9. .*Cq"t j)y1h8. 8nj+5դHB,,ӆ&4 ,xWEL̘[ wU@(G3,s De8.]g/0j ,xWԜtX.q  0 %]V!p\`%qfa!y ) @Bw1G xWZc8.p]Ip{Xl1As\: [fLYR)8xW*0J#M O8.^{q:| [ Xl!Oqװhqװ.DT.l|@"`2":chUNtts\= LŊR"`s\]f@a +D9-p9. R [ r\t@$K9g 9\E 0Li)YlMp\IM9KS8.h9.6S9. J'qh:)9.* qe7HěqK lpQXlq NB vtHDR8.x=$R`&Nޅg8.Mx\l/A?!E]1^]2^V]3 #0epU(d $-8a\}j1gN2bXsdf%ٸ>/|{ߗ_ +eOARa#V8}`{ҦJ}F)Ȗt]?foSLz4;l__ƵMFhr[F~/׿pׯ }KM.0}Zxl._R_m:19:S573=0Ĵ@h MVwfyK[OMSCc$$-ڝrcSCel:Dе Fr+ujOzNi^&S9!r3Tf-jeFbDcGY5xve6xbjiЄSD 篫pkL7b:nC({8Y|%Vtag,{k=Moj͘ps&] ;!mb{iaԋ9 ٰpUlfk0odVɜ7hws;g;[(}@fک=G51]G^^+օt;cyN`zO2Y9qBVw)9ttZs?:9:&3Yr~3cdjc}ƿ!9h2 MfWL3Si >Sۚ4y2gY2G7%'7\{lHm_uL3[|c&FBs\顊giVƕO#yN_>Xw(dƳEWgY%TZDtf۾{kp;!ԣ ++7Y}/&ly,ㇾAcGA| Ӗ߯ҿeMyΆ4YӜCꌥ~g5tO:imy,;މWlsj!-yNYO+׸ǃyNծCEv(3pn(0v[X'xun֔V!3M=7eQ-+٦}MtVu y(IwQ˧G{;l(s>ߡmz3t_tL}ݵTQos]=h9[{}},л#nxw!<;D8[kh`\>0>bYWROLO Դӭ +:>iȮf+?}eǔtڃyNfp뉀%;u,Krh&y4=tֿ3SkM[Oy/ ]3&EV;e\Kǻ_s-,U/b!_f1*皷ڏ;?wK0ZaPc;kw;gG jzOxylŻkk6z7F3;>[z +wuQsٮFm~W:%b\y먔_:lUrvɰl"K/$%K'+-z*3d$;P[<*߻"ӆ&\5}z?m7ݓF UkUWu~8r`$7 w^Ûݘ>i8ua֍ +o72t9|Vnl>Exqj?H&oD Dkگ"HC*wV]Wr2XRM;5ʴySڸcƱ98tIO~UM5wv#FL$AqN?e)TNXd7OiX +OIj&9[dNd3Btj)Ng/ig t)e!RX3.5e{Tɦ4bztV; 5rQu,2攥C#]W2M̢oz-*3 +Ct1cD n*͖%UYcnjJ FԧV1C~h.@봙uVb*~XϤ+k)x104,ɑibᇢN=YFj宰q-״Ms) fRA2ԥfҦټDRHBEJˉ%i!<^jC7?,s#ʃP)4c'Zh# 5۔R*E d}Mr gVŧҿ-m^)h^q<oȶpdMY|\H4YuڜUC\Lef)G* +!*m0QFkLNpBiTOY;ZrE$5;#VLx"+^lQt_0KA; fkÂP9)TqTT*=h|2#y endstream endobj 713 0 obj @@ -8963,30 +9002,28 @@ endobj 714 0 obj << /Filter /FlateDecode -/Length 5038 +/Length 4919 >> stream -x][$9~_QHk|HÑ]3 BH K35ͪ_,J|_JĘw/R'X\UISGw.L!9KZǟ\Zr},kD!HǰXRA;ϰbJ b`]İ):1֑aEalPfJCe9P$PZJAF3<儇=Jtby<43F`S/ ｋBx8exŚ8, pY4^, RqdKZ15OK'\4Fr,X ӆ4&4 pW%?fMsX*bX^*@̺>qXpT|F UsXSs3<Ȅeac3c^ONYQJi -@'LC0|wY !#u! !`ne!BrEGmE>Du>s:"D?(^֡*'|OkEs@-Dw+vvüW3~[N5T\E-OK,Y,_G,㲜:yeiT)&m8ʸe2YNdddnGLRdR}7|{γ0] '3= D0-u)V -WY$+@/LǗ&%#:Ogv nEL=N&,5 KPSSH0&ҧY] ot>Wl |qE:3uGܽ͌RV8Z;,Tn -p6|^CV'}_J+#=Ww?>wIZ"XHVhl:ԙvZMJocE%%y=Ҽ`Ly6?!+u`'<5XwΆf4m4H[{+^~_֓Lcu) As{H|_@,{Y~,[pnT 3͎dp}ڹج@:8H4?)Uo<G --0q"IGޖWb2cUɵ>Z'-Wޖ`W֜J7ttإ=Y,`Q |`ra}nub"n_fymH[b-3 jh8Ydq,ddws{rlGzγY9د5ӌOqb0/X>֙ɌGjnC);YxPjݫ eD(=7ߠ7ՌԆ(#tydIiHesߓ +ɦ޽:Y,`/hǙVyq:f`GkQY;VĢG|Y~ڽ3{ܣuvʏW_we-x.cMntVһK,Gߖ8┇zǵM}n;ߩܿz!_$qcJ#q-ǭݢgY%ys3WU^[ -n=#iK;W,^yy?Z˜ʉgSJ^&+ e{~ۭ-M)͚7?FpOy:K;N"K.3\뤳gf3ƝyZO3U܊Kh#v -)$SZ$ulO>nYnYgB2=9bܒC,w #0C?=\OLe%{b-oˬsX,j<jU~j[8*m.5yJ}}>^UߥsfG^el49\k|~h cjsؾkDC]Y]:N}-;`kFػS7tp^jَAtRRWeɻ3imuy,<5t:\e-_Z۸R9pUdsn-]{s{}$i>eFq9U@Kz*">Y#>0v]^kEtH#%A͓ .> &/dqN6wUn[-jL6m>{V΋0g\=6P{& -oix`D&a܈ir2ڴXDmM5VUmՍ>椆Ǡ`-Ϧ1>ql0SE~_ 2(Q8#a kY~vUӹhK. -V1od5FkwJVvӛjw1"˘n?|;>d*:-){'yqAUVŗcGU9zZ*MqV0k>4JcU&U5=K>d>;z/Pٖxe!cv/d Q$gb({[VdnpA$T֏#c>QV|o]ʴ2{ 5ZP_jWK'--;HBtk$ MAESd[YtotkfKG鷦v4CJZ>!C]75m1Of-H|'fHKC]r5g*RqTMMCa&v3U --=dH>.yC5ra7zE]+q..0 -Q!vr^5c Kq;TNS>(M**o[qlv&gӏAֲ{! -<`jT"3wL-d%qo qA+@WA$.]ВD@?T%.]孕 w#`MF5a +c BҁwFK:R1K\4mJ\" L!!$.YAOԅ^₨ ,Q[\tIh`5Fh` \  YpSL6Ъ.!EеK(qAnT%.ZjHr$.i'qA̰CELEC2%-p%. $[ J\L*3( 0Cc-tN:3I\\U+M0- ?`&9X$.Hr3I\l1H\lz3J\l'qAVa 7Y8tJI\uz8 0.i$.Va%0n ތd[<\Q[4ea܂;I[Lvh$.&Va8r,hm@  RY|hdcb嗿÷~o叿R@֯7z5]ߦ0[f h=}j9p .uLZ~g1Yf^ cXySYQä8-rҼME;K_鷗4އ%LLcYރ/Q,m wC-VVwa~ ]ob;A䯶=ס½ZO6t_Oҽܯ%)믢ߦr_X>u2X<{`ɖ 'pGu,%=Ǭpq|f6az\ʌes6DmPLRkfٿ*iPu,Pyy0FκWW);+Wb+.YWt׽1x'.;qgIub +smE=W*h +Z/͐U2qdE!эG"sݓ:D,}V3Y$MFk>/B&R9RN#⌏n%5[AdʬHT8:gm_ewOD9m{WP}=Ͱ][WPz9,;> ݵ(?w8tclgGhN{3~зSfss:>Zr&=)>?/qPgtS/w$/Pv¼ԕK,> +syN_;Vhٞ{~zNsZoSjϮ<[1Ԛ +FeW2b>ֳgB:.⹜cu|_hCWbc4ueȘ~"{00}/W¨;}]/]bŻ,y~&W51hj^S3ߟuvNlWיִ7;] +Voڿs}µXcحc7."`FOq<RP؎ +$;H]QʸO0a0q]p\t& AƯݗn#B̉ +QqPw5H26gJcY籜T*S}5O!xS̞ {XtO0TH6t5"1_ӥذs_Nq$7!rݫAOb:7 v +O +lw*&Kb5qM'զ MXMMY&.7QJ烖JUeԗC\'AtoT)ڡ3v$WN.b4_{*Teͥ) 6ՆdcMHG1l8*1ܘv&~(+/Bʭ^L C*NJyUH9sUBc塲Z@Ҳ1V +LHO[SIY1y<"Jsb>+P#P] +巙PKeA3Znʝo\kk:4[e/8^LO&6v2&l(.-6Ȥve&C^?ˡkyܨrLg2:1= EX huji}ACǍa|ZvՈԕAuromĦBhZoo]+VG}&-7j,W\mJ"qEI۔3,#.xdfL$6=xWX]07.mӹ6l .`yyf`> i*}zc$'KxuαW(P-˲gӆFs-cIS6%RWdJDQ2UdXl +S,'b)/=ڈJXrˌW%[ ݩIJ]KilY]f+ 3U-_|;<]AJU~HNRLNGk5B8:<> endobj 716 0 obj << +/Filter /FlateDecode +/Length 4726 +>> +stream +x]Yȍ~_Fqƀw/`؇.F>ߏ$1%eхJq0dHW4Stt~jEar:?1)$g]r,v/.YW3v׿~b)X ,rn +8/0Ĕ$p mYbPNbA 2& +1,m1L$ N., 6J<xMJd `$xi޻(si"% $,[% JY ^,( JKd'"Kg\VI<'۴"+ +3+DdqVg! G' 1 +j 1DdK` SJ‚#MC`]r%,HV!D'd=A‚D!DyAS-0 &IybIX|3JX0&"zqK rK@&Ed%,MDRn. >3((@o *{ +9i1YF/mh ӸEa>3d² D-b_xG8SV4ߒ.oՔ#d ;  RR˦ W w^ Yf`&"UИ+EYeE۲_Yȃ‡Yw~8~{'pʼnž>\v뗃"yGM~~zÿiH('4__VS\ƯeC7zC/eEEim1|溙D76rE. +'ToRoNi1ZC,+U: ]yMQy+*.Yױ嗕cJ:(^04zjY>+V8t{M\nǬ>n8x8Bc: +XK45 x' gHT6!^gմKm]X$"X?|!b,qjlUbyv4Q%C]uXUy~Ec2D\EzTi9r^稶Sr3ƲcCYG +iJ58 5;|Tѡ6-.MwhMFcݷ&E!BRnz18t ZA!ߔM|ci=K#h&Ƽr|N +5-m .}9հV +*^Uqͮԩa}_ilKg=wtw}gqzwZNzuzbĝh!"?k9p 뛩kM'Qz6|IpHW>2*KNΊ;57 J/EP|N2q(E'X|vI L,Ukt;n0uI$(|T Gh`ARG DzKѫI2 @lM>ԡ{4 dm@t[dCU͇6Nlײ& ӹG]Э]SD*=^5 TjTWK 6Ovߩ4a25>u&jHʥZN .bҚk3Zث.J7um8- kDqIS\8؍oGm%vX\5hv9n/o͟4+gpȓ?hj&G F^*i:$i@Seu͎Q t[馱uP@ cI!aHTUtɮۂtm::z0wd߰m$6#iv[vl&I'ռ]l v +a-jm߱R?E&yOuOlVc2/tm=uF50 [ѓēdrJlf `ue]ǍzuՁ AuDu8M3]CϝK['PIU*\e<]uhW\tp q16ˡ%[9vT8.0/mQwcӕG1AlNjaci! g{6RO|闗|S]]C-;=ۂ4zhAFjJ7vJ:Jk-*/ժZ򈣨bNӨi7JSgorhɶȍT/b(XQ훖}Wo{A]#SիMw{֎xȳT pԤ56C$PFW{%cOUA"CS jICzLVPcjSE::Aoo Jˇr_l 3 A +endstream +endobj +717 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 716 0 R +/Resources 4 0 R +/Annots [ 718 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +718 0 obj +<< /Type /Annot /Subtype /Link -/Rect [ 101.433071 146.373057 101.433071 127.623057 ] +/Rect [ 101.433071 612.273057 101.433071 593.523057 ] /BS << /W 0 >> /Dest (cb154-1) >> endobj -717 0 obj -<< -/Filter /FlateDecode -/Length 4571 ->> -stream -x]ێ}gy)ހ10yifϡ$^DZ잙fUK<<,բ< |.'9xI S,.F7u,`9rteg,ȳBJOos0Q38eTV80UfPS R3*349ת3ĩ` 1*)`TB:"bt n9AV砓Nq:H`5l1AHNg`Dq: [Ղt(N`t]atA&x"VN 3tRԬ# -dS -Xl1Z(Na Ӂ'v3Uѭ:؂@Y"(#hqrn#@<ʇ `q Ct9.C'Az7q\qכ゠֛X16hכ@EauNS`-8 ME XכXo£gC>7.ft]x\` ϖ[ qx+NF `neC܋ʱ1k$6h3`ZR -6l h SQYa.d xyQdS|N_<`=ӻHYp -@t-qb9ZnI+u%As-.;?,,,u>NQH^hۃ4VC90k1Y|c4X`"*R(_AĿshRjcNʜ߼?}?} -yw\+_\BF~טoLCWeNn>_6\^SNYM*7o_7_Eb;41¼‹o/2J75S-QFsxWhJk -`DO0!2ٻ.2i8Zby3^chŠ󕱕wj;veu;X yidpG/I(z<5g*iiǁ*7c`L})X=> a XK%/APT̆} EMV,tˎ`RGFddj\s9 j B:-e+3VMTSdWyʾlFoZuecmKo+N}8]']vǴi  =VeQ)civizd˵ +SU{ 7PV1mbVJy>hWVtS&5"8tC]_q_yfI YuqADn]v]&Խ3||g3y/Kd,?WfňPM;ʣU[lܙph -U"~w;ߕyF}sy:ޖm$ʸY+jgn6f*o`wnc2rMjs8}l wpF_߉}gkݧ2{,s8|xFK5c}jwN] ޱ3ڙpDių淣8?݇@ѻYդcqwgG=k|0.rw,k<t"3q=&|3]C;=tnp1rx4[**Y+B2w~bD#\ Un&O@.trbͥS.%kH-_L)P>7<#hxk5FNb{ nJx9#N1M -ajb/ -^TIOTa42! _RIYlZn3\I[5t.cn/>nN[l!̋$c)uY),OZ(MB\4y2++\n̝Olo.|^ƉZqOy+UbH >4Z3;3h2ȸr4NsJj,y|t4+Ben],V;$æ*h/iMBCǕJvQ=AeBSڰ ]%u2Ҵbvd7ež.u9TII*\ԷK_tLH\ŤeJ UF\ԅⲪ0fF@֕䦏S:U]TnDEGeN.$pu}QL4,a{x=gmQ=Kji(̈́Kxiyxoi\ƞNNŵEJK9+$[T&L$%dfسOQ?-m^ɍh^4eoIgpvDI}Il;KIu\ClLEfV){Δ:p JCtw:Uh2Vܰv>1 -endstream -endobj -718 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 717 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj 719 0 obj << /Filter /FlateDecode -/Length 4797 +/Length 4676 >> stream -x]]q}_L ~ ^6<ݱ pED>g;VIS[W4V1始SWJ{wʆ䣻 v!/v.;fHUCPNP%&Aq^Py=ST0kR`MI*a* AR` J* J+ءR(k:Nd `$NK4x]tsik-bt'%`$]-]-@WuEy%]hKЩRg\$RN$00H>:[rIGH:-?<((Vg7)Ғcu/1E/QfАyI` H6J,`bl$рIn>Hi茖lqKL@X\Q[(Y K-֪%. UK\@ \$. 0.Eo%. P.$. p.;%. .{休@ddwPSX@:KZ ,xH\QC/q2kX p. $qK<7x8e$.]c@?J'+q=t$.@cAX"q'iՠc8>Q¼E/$qQ xT#qjt]mw78 A#m -uiP)F xd$.T0HZJ\pIUHUa-kô4A0*t]Bw۔,0Q8 -6h'B>Q; DlJ\zH2F`` B  I#p RL6dyЫΛ!е qAv+`-5DLz @C$.i+qAHSE!DN ҅Nk -%.&bXK%Uy%.9T+M0- 0>y$.M,sDl!g%.f Fb qARI!ơSJ₤#֛J\yכQD -M,yf Y:؂) &Iyb yכQXo"S17.ft]D^`VZ+ de+(f ) -b@|ILL,pPj% ]p=STp1L}[sLh=??]~OdFPJ[W&ao'R41ggd#BԠ1閍3aNDŽSkoU>|x[2Lf'@q¿tPG+9v̇bw~ }z_to㱟mr3|?ߦZ; _29ې8˸Q7ֱ94Bk6ܮv+i2zl]ũF;-O9Kd:0=V=[-xw_|H[r-p*s= צXnA:ͩө~6〣q;>Xl -k Q$1DTr "D2fLgk&uURLp=s:m}_cg٨vhhya K#xwm{#VvMyf˽>嵶 3k+&_ۼF:Cv5vDn[I_am}p/pakGW|]vF:CNLڏxX!@1QcM7:#ݍtM_[zɾHAFIP(rW9jv @ټ?W:Ŗzz,ۯ 2:E-f [A-CFCi;'GOR*9ib6 _Hby aOdC9¶c5$uW4mdh^CW]\Mc:@Ljj;]G~ŃvȯJ3$՞xQ -l!g^f|Q@f\l%;gn%֯_Xz]A2=1*1-V-.zXVǥEa9tw.*m裓Ϸfc9'-ΘFƴ{9w"[wlXqFeԝn񈻷]b[Qm2 yuQ7 ӭylGB+bQK=s:oǯ[kfvOT]w ޛ{e>Wygs:|NJ]]sȋ:܌w\ԗwwC"n d,K<ƣߐ>Xt܎5?r,ѐ֏ ^Y|ngp/},g*1<Ws64[.lgGxϩnJy'uW8wPw.Gl~8x֯ Ms:C`k5}\myrgUlgϓ=Wnܯo!3,r{i;툔ƌX?˟sCk4CKVfn|q"FXYz's:Kw{^jQ5okR&YrzʚIc\u:bţ=ոqquOYnPcIx鐸s-7zoKA~棴صw^ӎ߾G `Ql!1 $!^6ү߳ةO^a ߊ+.9!#rx!<,{0(L?o2 0v3^]֧eJywq -פym*$yn6񼓸7ֱRht tTBLt뱙uT$c. uM)OJ.Tn巙xӵ -דyZ7|F\W4{[ Ux+ XO2jn:N&DoE\gkcl4${Rܜ!g>xMZ@tIJN #(]`Z)-&pA l1BkN`VQ: [U面tHN t]ntA1֤.@ǽKtB0l*RNIb %SEҁ'rUѭ)&uO1;KQFDqt 5E+ HvNQ4 aG:)("Pm)&Ph\R[T( [P`Ԋ@  +ty(R\@0S\[MqJUN HQ\XIq*- +hRI` Lqؑ)wh.ʀCKq¤ ޕk 4xW:L1AEqJ[fn4\R\RKKq?CKq{褢'cn +?bLR\`£H]`¡ʼnqVf@qbR.S\gQ%+fjJ2p x~p`ߘ. ).0]В0LB cR\`ˍRX.p{HlQ^R\: [bLYe\)(x 0rM ). ^z͂s8tpHe868e:آ5 *x -JJ -p(.GMp! [)R\&c>hMq3ZYɼ]:p8bAqb)1)..Q\3` +)-p). x [ R\Gi9K)1xmYt).0A $u4Aq'ۆ?6:آ{MOqErIqMGqA[d @qNqA`\xS\GAo: -. +-p1nI7N4oz f ބGO|7.ft]x ބgKk3ZcɌ̭dʀ{1[92gA1F"0d*i?0fLM >Z)6~&/9=}1dҏ00 d@wx,:ZA a-u.#hqJE#1凙0*_>`/!4+f[2*NJgpP'+h>|`XKs?~͇FN?scR_cQ.LbT.k>W۩\s kWϛΓykOu׍Ǥ.~V)q;e4H}N05 9Y*`5tJ)ߏ߰lFe + 4$xfCXf05[عOshQnxʞtŎ _UA,5;Kpf1;@Yଳрe i E%/JO^\oǍ6A猒k  +ROI:2ordLg&>^62zuۦA1˼^JH#FN"yfaʳձj>˩NX%#][`jJY[`睍4WX9lhs84n;wỗ@(hk]ڨ|\:[HmG7v{\Z z5z`Qf9!C=*ޓ3LȺT\n~*\oux1:gvY6&nuFsӫOML|(sZ.4GCc{-c]Ac3 +2Wph3_ F2".5uq2XջV[*"Dv9bw|{ckb۷+FŬdB ++R86$DwB׃X/.Mu9Զ1QgRG.1"38(l9׾=b\AiPgáwG~w7A4dwPw=|{?;:s8:n{W ;֟K\ڠ gn>ѹȦ=fhjGs45Oz,!ZO<Ҷ~BF UG=z-#Qse;]We+ to⣵.ذ޾:Cﶏk2Ƕ9Z.gO ػUԼGCf\oz]S=5u<-@һ)VP\;;h[Ξ97ﱌ# +;o#O_QvQγvMwï_ѐi_U]WEІw<6\5ME|]U(vWp53Rm YE_i|:k[|@MQ7)[fɎ񔌺:)JztǪ.kP5bk'[':~C<A⫯%U_]vEhhӋTaO!1+ǭgBƍgVυssE&148KM;_i޷::IbGwtPϧ۪&Z3)#"̲ 8ױЖTc'W&}&MoR 橐/LQӊ8=gbk=SӑͦlPe K]PW+b="pa6n:Qu*+]՝[ U}2өRJe2*dI%sOr"_tjnc' \.rr"Mg3\.KՐZR|nxB6$uq jp>6@k+ȅr2:"~>G6+IЫ:o{^Rq C3^M*LF>![+G"qlfjͬڕUs 2f#ҹfҪ* ɼHROE}00uwO&44S{>|cQ  B\{*;9ehBjVR_ML}Qd"d<]NR wVr٧(_6uF4uEx4eoIepvx)}IOl];Ku)lym=vmmb-)/̢Mw4YT2!—:1QkTo-8DMUj:۹eF$J+;V; EWTzv:Nu @ +E&H154P>t1T4a{|w\]4'S endstream endobj 720 0 obj @@ -9084,22 +9121,28 @@ endobj 721 0 obj << /Filter /FlateDecode -/Length 4758 +/Length 4972 >> stream -x]Yȍ~_FqLa -ə௯7_/uL)yEv -1VKi+B0 ,'\bJ b@1(E' V[V&hXC'VCDQD<&{gc2It0NK4y]xY\RZ94xl Cy`%^,I/BXWyEy%^KH%T q3M.Z$֓mZAAK"8ij'Άjxv[esŘ@"`%0% $ 0!L I `(RP4QVD> -UőjB"DXYP@k!!+aE %xKJ{ ,b* ,FOX@.L)IX`)ab ,P:o$,]KKX`֢ȃ,0` JX@]UFF;V&&*&0aZ k.A]㔑2 w!N V{Maܟ0VKX:bD^tƅy -O$aQY p%,OFZwIJE$,9LoV0]&bwKFxIE  IKX0P ZȦ͢[+[bM~%ƾhVjaef!QVFm#VpV~߻OyjzYAc/޲;4GPͲoXpsu΂cj1q +iL\XF}\kYx沆b@{^صE;#uwe~v"Cʒ;/_BVœ[EUrR:YѬǠFF[a;/G+[ųVxY~߳r޻:Hha]xvsY|:wLcĿHy]K=W, ¹;wQx.&ERG7{͜#+;WѬ,Lj bX2dW٢.1˘KOb񪗦fufHkOeh>C"[bxC.dă{oxr(kL%3}+G<{b,3.YE#OK,)ܲՓmu'owa]vpz27xZºj= -ߐk yOu ti⇍CQYetVި_UC-xC{8c!hboPM9i i2!d?Ifrj[KJ{P)%rj㼑|xܷT`IB6:w,Q-^Mz!Zd3_E*5H}`xHVuD%F6TѼwUo*z: )kB7{ #U;"JSEFUJJ: TI =_74MFwڞrHҚ#jت&J3uZB n([dyݘ F~ v ++mn%GQC,,4ާU*#O>TMogVROuHҀv!T3Uc+jRAǚU2CXOʞ讑]5TuvugȾbkOu5o_v6_ٱHfӏF6zYGlk&Zщ_U$>mHmmn䴩B Z6Qcp}ThNp*b(2ZQK(j)ԘQkRQnx5Z5r9vudh]JBM뾋vAM"SժM7[掸TLUpԤ56}TE!/ -us%یHɕ=iY"]SrKOB* E9B4Rj9w):'#:" +x]ێ$q}g ۀ =C0?lKz fdF^w]fݕA&3K+9=cpOoj^_I(?'V.N^'8M ~ :㶪3\N^R gLT fXݪ20Q;I3tQPi;QJ5N)Ӄ3z +),"t:Ig^K<|tk甤-Φ(l*Q[LVEb;Y%t%Q[TPZe;u:bO*IM+00H! +:[Yot8t ocJl54ZybLt`%0$ + $01N.'Ivr%LʓJ4`\Q4tFKD`l.HL`5lq$. l ,֩%.[tpaqm +N kX.{uF ڵ. ,x:$.p]kSXdu8*J\FF ɤ$.p]wM uq8h+#qgQb4x9- X 3V6%xpœ[M: quy=.[Cx.wAIpj$.]m%xW$.] ^a$.tE]TNI- '$.Nd<)ġ.{ wVUa-6 @i+i2` +IU#,J,qA۔ D$q  BrS1H\! QAAY$.@`=ek  "F-.` "lA(qlJ9 XW%]0SkQQW%.ZjJ' +$.i'qA̰SE)DN ҅Nk -%.H&aXK%SL$& +%.4JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@U2P^x((/Me +*Z +xm8a}[Tp)R#3Ct=I6/~o/);eFPR;W&c=o[آL1 )1Us7Km62 ݷVT2 +bpO)a!/m}sS#b|ol+#Vo$7p[rcbzAg?v{&`dث>hF4 MDai\?3Y>`<"€46E}[%ݧtbާo|tnß~ӿ^n'Y58w>]\>r]Ҿ,2<˽]:AL2N$qkک_!kL=}?ϟ++aZo/ќ 75 "s0P-=ڮmYjc([bӍI*+8X伾u:ZiB9'Ô,UafKΝbg*VGHm#v~mmf(tˬ\!+}$'l9ch'Um;EҶ ־8Fʈ޿NRC+i3 izϖ^#Ua1'tsev1Oiҋ_K.m9 wC#;RڳC03 ^P^Q]{vJbc^RvMPouwHq᫷Cj샆lk> ul붍 +ft.q)X%;>޴A~3cRoQ|_pd[pmf)΍1A?[CU&i陯KyuCiycyӀ`7neŅ[Aح0Iez`fR ʦ%'SQ(ѿv<_hYn1fR+s |iYzz r-'KJ-:MK wChM fUrp{Xqc)r~- eApl:=Yғ;$& ?$ydֹ.#SZxgHi-y~V}z!1a?̌6q-lhu{5=&%==WQ&]6Mπy)˓Ҏqy>.Vd#5KHy +aX}zbm~1ϓzcѨ_M:v +\o 4nwqg2T-LC[< >xdc:f΃ԛ6~_;6\L.'ŋOj9޶i7*'P9Prƛy-ӡ3t,M<">xz+qAhx|r@h.~t 3\;(Ի_t;[x_lX8\=ufBթź`{rp''^X@t~s]9 i,w,z׶/2($'7eUX{](pޱ"0rg2/6+/nXeBXMػ[1CNl~?(vR[T)v૕_j1{V)m ϷP-UH6&z2;2)t&]:VwrmZA˝ŞeŒ2?4Ulߺl u b1 ņdfI-U74ކTMd!rSդ1}sAr)t8 {bmPظj7ݶ ]L]״XɚK Q*J}鵨ڻF5eF&5eI=n;Uv̦gFoɵtDn)ͷ-UYsnJMكU,l([?tJ 7f#|ܼk3_o> +} ++вr8.{'L*wv*|5H{wUf;Cc'veݥclԭVReLs5HZꚘ(OJ.TTžAu%v6Uj[]wrql#%V.|>csj%]lTv2&솁kة=d'qފ3:yQ?Khg?nTc Ӹu%枌A&]7Ta6Lh.֩ ͏{MBMі?>^l̷Mw󥭍j.xspv|gE⊒v3,#.xdnL$u=PX]0.m׹fyUVZ 44~q_LuQ{rikIR[.[%{eܳ-Snu1ʤg[x^UQ4LUY+1V’vKiq{)K{QiMZ*z-y[zK&Ax&u=mn]ww =2U=ߤ|gy])U_vBtmv:Zc78їDțlwD^ 19kU Ps+~ߢ-+Ioa+Ӝ/*{eC]FZ*wY +z}OTZ~j_f7e endstream endobj 722 0 obj @@ -9118,7 +9161,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 713.673057 101.433071 694.923057 ] +/Rect [ 101.433071 401.373057 101.433071 382.623057 ] /BS << /W 0 >> @@ -9128,22 +9171,20 @@ endobj 724 0 obj << /Filter /FlateDecode -/Length 4812 +/Length 4691 >> stream -x]]q}_V&Y?8q wf󐿟CHG̝VISW4V1始S7U+cPBr&uϼ!%o4r*A4 *.Xc3lNR kLTf 3LVR \TZmu0DYKFi7xttF>&D]N#vZҥ{%%-N[$l<)Q[L $l1$"l-+- .EkE]N:"tZ$QAAK8RFlt G!FadQG;>):?I\%` VC%.1[2H\`Hѷ<->`!&k%.c=^t 1E]N B\k!bK\r$q̀N[ B-* 2t Ȗ.tZK\ lA4(qA4L$.Z]-(qA~ȡ&Xi)ElMH\ɋm'q?Xlb#` 9+qA&/71f^o -$.H9L4R$4V˼ތ$RXob'D>7EMI$7Nތ zytx%0"2MD^x]@|&+c^qF1c@UL(p/Us -Hbfbe5[R+1m'Cό!_d´뚣b؟xW81SV~4E|i`!ָ|h=B;ZAS- ]fS=}>;/0daUU;M=6}-mtllaWiZñ0ocЍBi.;Uj^oȕk{Hl!q$s:$naeTHHzKR2UQСQEԖS;n%u(Aw?c8:wRve6 \ uf;VKCHS2758.? ijsG%?tqfpa񝲃6ZcuN혰Fn Q_TG>Bs:ėaދ  t>Ku¼L =n97ry]+CPo6q7>>Xt ~>|%>dr/ Qr_kQŶ˫kJF,={$P{P_}".|4*%,uܱȇs6سE$Ipݭ:|My'lF^|*w tLQmuկx.rhsfc?뵳eߧws:˅.vb#XV$xQ -jk.,ˌ8 -;ai+C94p+~uZ'OuNƃ9nǥ@-W5+vs?gK?*Re9Rwnܓzh { ~Yhϕ>HكuN{;{^ˮK,s 6yyrLg3I?ęկBM}j5"<:gCb~|>*:X%"W+gCѶ~vܰQ{oD9wS}8rn?ߖ+cVGsղ{']#Mcs76's:t8:>[/XM-sxrѝ0k+'ޏWD,z鐹I=يCv< Epl:gCpɥ{5}׼|"6=Xtɯ²Fd*X@{_9-53'*{虃>n}U|{9vbwGs!'uֻ/;DXNKY^y0 i;F?p,Q֏ ^Yz>ϳv{K˙`ӡq'GgC9{#83,n9Fhۇv<:Cνv;!~1S/o\К⺧/pwӹ=c]+װ.~||/z;!]󻤢"0cuj-*X1Tev0i/:!7QM9hK~uPGU۲1 /InPT'W>W&wZ~U⹟XKqz5I|5b3A˶[]&ńn)TtMllGծMXM]&.8-7QUZ*kT3*U+%:NvߩҴ`V=Ʒ0 Z.rvM:Rj*=LiPX;^}4IC~ :#ǹ(c"ÍYogLlⷋ Bi׸B=.$nGҤy;feT43A -λvNf;}e+eݥC8R(I=6.cy*yź3\Ʌ5P~NUkwWmb_Cq_`X2mtlgr&6zv2&l(.6${29C$|xy2__ ~ܨrL=Y~{{<(os/:mXFMc+ -7mU#RRWU˅! -]޺^{Ǧ9!i(:X~98MG%_Y8EKVQf H~~ˇ #!5mn7]dU"'M3{^d_f@Vj7.d)~~X}]Aj[ MZ(Vm*ImNZE TCOJW^ -5h?v|Tj':>*~Q6[<^@9Sd% vVlyn;?wWv[dZ5(=3wuT+Sᨭdr"`#K<\g;Ẅ\ ?cD*hmń7(Ҿ56mVxIu -j4 hJ? zRѥ*b'SC-C]d +x]ێ}gy)ހ $Aagc# `!CxUj]ffwۭ**J}_ %B嗋JJL6x{U*`x]/l?_:EN+{Ǥ"#|^ZF0*k:F!ȩ`i0b +fցQa+3WE"N3TQ) ;Id4SV8ttZ CtIYp(*"` 9-`p:[4z'2[`tRqhEda +N)aM00H3: [kt8x3[uF,l-|-;0D%&t0t7 h90RAGFKc` a:b"q\`4lA - lK@ tK2* r.̔0 8.0\@)r\`qb{ XX9.0]Cq\`一Ơ&-0`GaT0x(9. .*Cq"t j4xW[Jqw5iq"?ˇq=tp\ƄFXqiP!: ,xW By83oB99.]8*q>x9.]e9xW(9.] A( %]V!p\`%qL c!r\pޕ xWV[L ӖV` +Nޕ +#Rq&qI0P +@"z8.pQB9mqXP-"8.9. d +7 RL&B$[| Y]Ny 'W8.@.%&= x% `t8.`p\W$FdlAq"] h؂h゠L'9.F.t$S8.D +9.4A du4q'%ۖ$?H6:b,q\Nf آL J؂(Ha2q |S) D#o"cm4.回H"DauASd-8 &؉9آ#q\KfaMD@Hg 68x7rZWqv@z-|+d V]3 ߔ#0ep*Jxfp[}j3O1-}9j1P>O^a,)CiB|i#"V8|0J B,G$#|F*薌KaM}iamxgW48֡: RҤ.hm l6_"&m>^o|ѻ? T߾-hێߣm7n DSYPӴ=仒ʷS r4n8}lKhWPlMRG5(T\w|ajK}?ﾻCTz O +fUy fHq@u}wg0d{߾'CJ"TvN?ǴJ?FLa ȔѧA=Zd|NPQ!oB񆆽i۷r>?f*S<0έyuN4}i^lavߙt(^tWw}5_5Dns:D; qf6t2 QXXt3<]^7Qm! Lm1vkzо\q>ڷy_rkxoXl5+1hrCJBso R9:CXswcIJѯx?qY07nq5_g5oK4?^hSЊ¶9VҞu7]uY=Hֻ!\jʆh6M^nȆԬ !9dž0{rSLqҹނ<1w^G^sv%}iλ'C[m;>.k'~Ҿ3acf QǤC JD>^n40cuZ_JM2-fc,0/*HVF9U|Io$FL$Fq?eiT.XdW/b_X!ǟ4nlm>Tjm)$s!3/cFNP843nbufkԖ ֊bed#slvWŚ=* tbzu\Vf8 /حϬ4O17{W"3QHm.Y81 #R YͨR݄!J1 [nl͖TUcjJ GԧW57sDs*viXFτKe&Vz\!m^+4MEdKd S3;}7Eg@*n՝YNj宰q=ײMw) fBĔO[JH.k>fIUA]' +SlvWŶ@y"v2U3nϭؗW%kn,|wRZoWwa *4vXMuطM1f*lPuk$Rҡ%TF(6jv'Ij60"mfۦl8B`n jw'0F^/dg@j/VZ,I R3lf96=T23%ȩS4h1HC6N)&;͎d2J>j[#l/STmOvTJ'vTܬlj7{-ξ%K,kk)Ւ&龳6AW#SYYCwdt\7P_GMm1;9p-{ +:J+"yC1+mg(⺢iy|#&_-JuTiNV0 T6}Jm^,CHRKC:nd ;\ endstream endobj 725 0 obj @@ -9160,30 +9201,20 @@ endobj 726 0 obj << /Filter /FlateDecode -/Length 4821 +/Length 4926 >> stream -x]Yq~_Q#}`%^ k%V~Id>fU5.F"2Wo4Stp ~jEar:?0)$g\p|諙RF럿g)X ,rn -8/p)I,ڲĠĂdLXbX -nY bIbA \XZAmyDY#<%ѓ$H -UőjB"DXYP@k!!+aE %xKJ{ ,b* ,FOX@.\)IX`)ab ,P:o$,]KKX`֢ȃ,p` JX@]UFFXuz +QIX@]IX@]D^05 EnqHX@]CKXG?J'+a=xJX&D O@I%,p]a>&qaB˓>IXTV|F "wEx]mw78 F aۤ\WI%,p]QxRH"G'0D ,HX#M)/aO -<|"Ovd;@i?Q5~_Z%Zm5ZV mڞnD`s\oSNRni7_닆{zЭ zv_^iv:@gRp窼O{t=lTlH[S L]봔 -Xӗnv*^ uhβTy!QdGsDmXV[l1̺ږ+@{^wlw0,Cm5=f+YTgzeyJ~׬]}SNs|7 7 }54Zsyny[<̥Meo뺕oJFw\)^(:/Yf羝j̺byn`?w~ 3cү]},:D;˶oy7d={r>,j613n `$=kksMŦ].k_dL_/˛.e;_7>gCч+[vGT_ѝyWf]ۨڗdve\5}VBCSi$ːF䞞iwf}* -o~#or;:z_"77myG?m쩼d7-|`㪼!MpĄ' tR/BlT w% ,<.Т{>M1O{/sT)9L}Oc9=Ԟ_d~O{Gi 2iiٺWߠMR4u?6)b^"![}A8d{ZUdmRO$+:͚9"_+M qNy]:֩}xZۼھL-rڙaUR%rۜC0L兾5!q.^28*M|?ǰEg’u|Ţ>bf,M)=rTLq9s:Z?WAvgh,7y[O2)vKʮ39 -VH \EnZݘ~޻iƋB(WtNy/v]/z4v(r66"~=uQb\,K_fkumݖK;f]O2OSX6>ZҫS7rNy4>YݶjE-3X6_Vufgo ;x^YxwrwtcqdXqG[.ꝘW<~ym /˘7/Yw ?:屚ǫ\CgnK{O][kn_]P^א˺| htyu;+ʺ% -Nr][yz:~m7ώhm!z+/;偧_8Wz:gN;y[ⷛOGzy:燯,];x<` -k3Icf!Me-ߣ=vyqayuqz\X2ددKObj s5> k=1a-dGtwS%bL>=ˌ#jVs:|3Op{K~Oy8K SEk/Փm7bnj|bdsP&Be%:owb5hI"6 h~6GiV9W'^L[crWp6ט+LjU;,rfuQHW=?~cM6^ Xk_vKi$ 坒<\"[v5|}3M~dya8xbs;AM>Y$֓6Ì ( l gQ[UFY#Ɣjhv[eŘDlK `lQ1H4/I`b\6N"K 'hd?Vi茖*]j0sElI\` lA -Y ,-XЭSYK\`N qL%q (e ,8ׂ;%. ]L(qZk] +XuZI\֢-`d%.p]Uw1 8 +III\&)'q%@ sJ\k28q&H\L%F]P=tJ\&D˟0VN9H\:aD]tDžy /O:,qbx.3I\ m6eʦ0S4A;U>`1B26Z7T(*ObŜo|KO?^~?ݧ`~z_r?|ƫOk~]_82 CPVzn}ㆲKR*y+{lvhzګpg~ +ێyR&!Z\/׀cwXٮ!26^ͯآ8HayKm*iP=YWGZރZcחBpsfs!|Q){ö<\CϿ!==! =?<Y5ɣD\SߏHFWp٭'ٯcwBR읳Jr6{!~e1/и.A~x{\/Za}ٔ9\cQBhuγ!ל_+4UFAnc$ifDX#׭אNX CMwNy:Īرz2N|9J\-v9a׊5bp`+ׅ{{;>Ϟt=g}y$èeĸ'<Ǹ_*QMGۈ]·q0 k*kyuŏq&|,>g=YgF{O:7;sA= Ǥ'w\'<,DG +5@l賗͆qzY|zy:O1f]KC_N}6Tyfamf"v= 8k|dC +W33\c p(͸JAf2pe~m<Ο zArzy:$ߏq<zʑqamkR˞n9ևbTцfcn뮘FĴ {γadyȰʨc?I.1q{;-] [xFt+:*X%(>e>=Y{,vmt;Xg1'b2Mj7v+K;%z'ykwmywz:Oʃ-ej\^QNs{*s*:f4[_45J6†j6ƾvknfȯt:yͮcsw5F_.<ֈ,%Ҹ!Fr^dŻTgYi_ %&}w\۱y`xAI:S5Ie_ݿ;j,njsog+;hwRycȇYFw>L!r +{;m];fs(8KPCgv۫+6@1?y]8yŇGm'X:ܶSP}ّҞ I?3`@I! mxm}]ԅŗ=Q:0lƼv-ʰn}Dqu}Cd&5aE3zRf]W`6:?߫]Cnpgl_wd6~:Fpk ÎQ=j}_ 2K|n9$)rHj6^ +rC|` y tJr?&8X΃ata;Wohl|EZG]*GΆ sTۇ){TLzҁÞ)wdS,-ѡ7-+=M*&cM fUrXz藰~c*rPvh1XmLUdmPArg:vxrrԍr<8YI6뒿u3_c.~z0DՐs]By 9mKV,IZ!A%<{A"hdAL-OUyd} {;=ږ}jS'8*\3# 0*ґ"/kkm+/e‚y?oN*eS$L2 , =-Z|Cگ4gLOoaQB"'1_᤬utq,߲S+EC,~: #XTNjD;I*b,~]KR v$\ު֖-CQe7@X\=A z7TjtxS-Ƿ B z+W^E3iUhP؄A{C VXw]l\Gu u -k"{Q&J-jSջF5eF&dI.Uv̦gFTZ\ E,HV*zҡnSs T_obsDv-LUknFxxfb]|JWqe6qR/]SufLIy~;k'qyh$h{Y.c,NJ(OJ7eLs5HZꚘ(q%jbߠw;}^΂fp.;߸8t}0_QLO.6v3&솁[ةaLZqo]2MP…GY(]X q[ƭ+1_ I1}XiÄ1bzY_qc_^]ub%ucPݴ\4mgmb dtl=_zsUසu/W$h_ҡuUo-[I4ד #v,o]"- ;;+{^_<ɡ6jo7.m7FFxԖ˰lk- :yZ[=ۂ>5zhVLz睺*[uZF*k-jSXU;Nb)oӞJs6eݺhɶs8~wlddnRK*}nuCBLU7%G\g:HOɄԿe [8U!*R#s?W͈\ 19kU oPck~=\-+!iNm2A;K$e"}婥77EwЧ?'C-d endstream endobj 727 0 obj @@ -9202,7 +9233,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 570.123057 101.433071 551.373057 ] +/Rect [ 101.433071 176.373057 101.433071 157.623057 ] /BS << /W 0 >> @@ -9212,26 +9243,21 @@ endobj 729 0 obj << /Filter /FlateDecode -/Length 4717 +/Length 4690 >> stream -x]ێ}gI@^ <fϡ$^D.LfUK<<, -|)ײ>8O9#O1יuFc\05u_\5# *i?*M èTB2sN˨p!p*aVzr0Co8JyFai'i -0C99̐8F%JVC֤4E[Ndg}P9SNK#9]謵s: [LbւMq: [Ȓ`uEyG ˳:".Pgךw~St N'egMbuQ$-V`!8N0gFINg`RN:؂@Y"(#qrAiN{9P>t9h@i$$tJrD@m9& [4F.-4` p\@[& l tEV i9. .(P -8Hq\@`]2Vq\@]r\@]Rp\D` qر# %)a8.@vX U^h 4xW9Luq*[fn2Bq\J+qҁ wA!w` )u -n +?fL:wGIg-Z xq\`Oq8Ì8.0]I9xW 8.0] p8.I貺Љ= ZR`:Hq'r\`+ +4V[+ @aˌi8P` -N=Bqi@y ``/Xq\`stpXpm8.pbuE;q.P8[H) -p8.G ]]hO0Y8cCr::@׬C'Skcs\q̀Nj \-*`*꼂g$lq<]+oYtz-GD#\(FJtFbaw}u++,V+ ,0Z";r+$ :Z1@ee>K,2w/_?|?F._J5~w6㵑5i7FW?V]BO29桦N1狿vP:;3ޛQ1&Rq}w8H!ckk ai\K{(=&VHj~e]Zs.uJti5tZ؛9lruaO <|xŨ -SIgz(2nOhlgd_3vdXE)!Vů$w9պ/z%t'=rB3Z|27[u# RVQ8\sG5)ncU>]uI=_C$rhK -{<~+׾<׆gt퀋*{>su?TϤFn#xcrv9ֽ#=Kfϣ^Amy; U?ݽj|3(ί_ݷBT<%mitV\`gӡjûj∳@n\Gzg wsu*ڴ~=1׏NA-X}])9cF^Ϧn -6ݎ{cMݤ݈HQwŗ(pSvsVݗtj#i8%r-ϢUS ^}BDv9B7&Ey ҟf5Ovt{h>fd.kwo-ܿޙt݈ ^}%!fóY+>O{`Ey۾-.W ={ܙtgO/lVbS|T_[ڥ/Pl6ڕ3UX\zs*|'I;k/j;#]j:&g3aw'?}{TS!|2kj]\Y@LBn[y>' ;ݙtx =yf!=ݮhr4];&64]D4q^5=ް+:?mvhlg=5/t; n_,tAqeFRjG]sgS7ۨkv<^ -j$ 3鐼R٪=xK\j*sqx% we]}4;aڙt`=iw}zg$F쏘Sކ[%zi'Ic LUF?a:y?z6(} v9~7b ~'G$ jԾi=+fE؎z]&qol=gY; ~g%?mq.pw7ʞM,uEew9R7It!cD n,r9/YCjbJ:oQq>N6@k+ܨv1:"~Ǥ6+IЫT^i\04,didRrU*c3Tmf͵ԮK:1[II7-6VMV]HE1ˌ,'se-TW&Cy".v oĦ[qOy+UbH >4Z3;?~,qo.4Ȩd<^6(Ԟϵ4Xf_es/--ˢjQvr(\dRdJD2dDlc,{\)M+M+v6f-QvL gWNֹٗTd4^[ ɆI/{ۍ +x]ێ丑}ϯgC16腱0PU=ecQxP/Bz]N)yxAIIuN@JOoRx+oH1;?]Iª肽 vi_{Gݵie1QE2ZὶQ9%p1r*a=iZ<̠,u`Tf,UfhS gTJdu0D8V…#)91yRVq(s6p:-6J,lHr:B&xN`qF:آ7։.+:"T.ac bu:|X괴c$SJX`Ӱ:(tN'mdu9-?NƇVFFq: [` :c` x#@c G:ZA.zTiŒ(BH [c`&qqݒ% 3%k# (Ppwr\`@5i hPp!%9. 1` qQ 5Jz a9.@ +q\一:H⸀c +`u^`  -.Jqw5iq"?˻q{  U3VB8.]}. +̸E+ \w1Q ,x8. ̨ U35*% r\8oBI@E!cX.hIs\YX&au^HC9.p]Lޕ xWV[LÖpV` +Nޕ +=Rqi@ `9.pDq\ࢄ.s/!,V[pE41p\5l1Zs\5lq<o6<- lqLHqZ9-]xOSEr8.)G؂q"4V_qHUa6hdԼ>:q)`I6\TN؝OOQM=.''~eEF}|'֓>>O4SSN?:ht:tw4}6i|2QH[1:#Ĥ^@u0EPUm*`EN rO D[7~Q:;SNgD7еS{jc:e&oo?^+qӇwn\!^$vxk@hO~fy ZDsS&+3=sƏ]KW$FM_`ˡiWL3Si >Sۚ4y2gY2G7%'7\Z^D=ts9twDG1Vp6=td`ˡq.yBp塚|A6V`mms5Ԛ55Ԯ!KܖVrnc1uy #Fӕ|A3+JVGtt0зҼՇ_˥ջ18d%6vWJdbAh=rhU-\_f'+?ggK.@d)09cyHC?_` Cތ㈆Y$}>N?rHiҡxuRG͚dz\Ѵ{7r>W; +79{9g [ͶF˼}" rM)i;q7GA\;J݌csѿwGY;6]E:r(<>#: >G;r(Y|؝fd7{\ z\k;y~r^6`!W'5$pQ3=Vk7/lo]ɷwTђQiKy-%xRZaڎ[UfFfw$;]0՞pP{ +ȴ w $Fozߠ T=ǩca 7O[$HrҺ35LS}Orܺ ~ʷSݍ=4mPkXt77l9mǤCӾwG"=ms!I +9\. ^e-3tc{2yn*Hb܌Q'p;-mIH$e)TNXd/Oia,-Cmդ6gK̰̉MX1#DNtRI64 Lgb]Z ik5XR(XSG Jӹ*,MiosKrCҴb.*Efbڜt~bD/7FE:^KQD%]ˍM7fKO*Ԭ1|5B݄lhI&.@kf*~YϤ+k)xҴ2ahfY'?R-<ÁW=YFj宰q-6VP )`m/$>nI]Zl&mK$Uc.VuE(,OV(mL\e2RnoؗWiobo)| +b-lW+k0BW}yvJE:ȸ0icuā3*mzYHG|F?彩y\pLdicpP62lXf4y<>d)ĞS h[m؈uVi!|Z82:a&_1iWlNi:S{S$R:CKɈP6jȶ~j¤ƍHNmY6\E.iOڂIƙ=wd# I [+-xN9fA> stream -x][q~_#@\Ë8yWHZ={8fUKc)~tQS -JEQ_rq:?)fob_pɓ_諙rF_)T*~ Ĝ%UEr -f8cJ0úVaI*J+ءR(tON)lh$SN{-BI9ҒS8 Dl1)ZIawKJv99'2t*Ŵ'UNVaDBt峨-*#,lqt ocJh54ZybLt%0$ -$01N.'Ivr%LʓJ4`\Q4tFKD`l.HL`5lq$. l ,֩%.[tpaqm -N kX.{uF ڵ. ,x:$.p]kSXdu8*J\FF ɤ$.p]wM 1h%.p]ik (Gxp`%.| ,wu'iդSxN>Q'qa˓!K\ L'̨F3jK\8L&]Q'SwAKF“J`Q'IK\2P x{ wVUa-6 @a+i2` -IU=,J,qAҴ)qA$0I8! -6c dB>Q&\{ DlqI\z6' - -$.@D0e[\E\8؂HQ0ٔsDW%]0SkQQ݄XK\Ԕ0%.O.I\3Nₘa dK: [dK\H:%.H  UfP`ZtN:3I\\(T+M0- ?`&9X$.Hr3I\l1H\lz3J\lA'qAVa0Y8tJI\uz8 0.i$.Va%0n ތd[p>WX#dS_!FGۚ,˂Z~-r-0e}ԶSmAsy~"iBܺ)ttqNuҬ8,zڡm/K?6nF?[th<*G86 Uzu j9%3ljӂ9F("c@hg@8r;6c=GO3/3BI7~֙BY͔U2t#<BlBVoV|ǻ{ȭ=m܀[m Δu'/_9씸̊I. :mE֠#bX{H2,݂2?`vO}st䷼kfS`V,S8kY+mCX|2{TϺϨ#y>3˸X8FNrԃf8U70^:1S&D5d| -sTCuJ)]n͓B^ns!Ô=L}P=KOM`wNlCMkEwiw]9o:hK*97Xfq@䠠= R"g<ȁ6p'2=c2TZdGKPZ1OFfD\s)l% .j6.;٧ -0:tX<φh&O݀˭, -o, vawo8vcnjH[IØX7_vPbE[u'< AhUbJmK#ovkIX7>Ͻ]~͸-ݶo벌^ʩUاMY&'<*1Nn{21tZ8 -ʧ;sy I! |yyǂ2t?ǶR^?pHx̢;vqc݃y+#?ֱw<0RZ'`:G=s2ӡ8>m  C8+^4xyWOy:ǫ?_!z>Cmlwb_ʾw̻м9WJȖy~~=x4 -y:ǘ]hx^zcQ_]48dgCV6&z`:^>e"E6] P#N<d\s.A!,QXM͇ t73 r@pyŴԪ jsG'~(?2d$[`#guy/mtOPީ{uUH6kp}1_=IYk7X}Y৖jE/5ZnKJxMrm\q2/y'I|T,)*`ǔOjGkk(-NDoX"g[1^MzdLÁM tC ˈ ^(.Y[2+i' -Ku FХ:קY^tV$-;++{?<C$mޤ\FFxԖ˰ls-=ʲlC eԳ- &D]N#| KEIG%%-N)I[ 'R3R[6_w]XXY|@pɃ"f@Gm=d2;r+-@ba2oї˟_}q61,3sܩ>44mrŴ\9O͎RwKOe2tL|=׽/Wlw~?~Yd'XgG +U总:= 8azN7]i0v[hp+ˮMCl;~ꆈɱ{)׬ +?H]i=] }/ck4E s6ctK$jƵŽ8ַDdt-rS|Yok~}auig,TG^-rlKᄜ'NR~}29yΆ/%=Ǭc?"s|f6cz\ʌeu0u߻ɨxg}oBPu,Pu{ýa|3u9RvW,i+.YWt׽1x'(q9'vίM&v ({wލh̗fH*5t (g? }ueG6B qykBV龲tkm>93(G>>R9RwVgQ8^lͿs<\ 7s:D#QG␿ھɸs: <aش3l>|Ƴ \F/5?4-'RmoM~0K;}BwK-J6:ݓh;s:4t4 b;$zW:sYwX cI>_oߍԧ'bI +r_&=st#P1)^ޑ#I,oxIsH$K]ĪpOss6_;Vhř)'9ַ:)7]ٵn܋ִ|^ظ|OB@;=}dv1 SGZENg?9i#y}OY9vknkLUe_=E $YK;VѢ;K~O;3֊o߀b +$;H]w2kg +̯г +Q +[3퟾?K4i6K*DqYXȪU&$ibsN߱XN,K ?ä_溙=c݃+_.~|[ߘ|ɯԻzr k~CCTt&=6n_DKM5PWUL/.ds_ 3iLS8ro9ĄAqU-tIXe7poRҺ=:­++w-?Ȏp?U,8߽,⋃|5b3@i[-X[ńn-T&6T-|Vyi% ; oTk{(o+E5,3*U+)kP'AtT)ЙUz-Ge$RI'n1\=jز͔uk fi/ecDq)J_pcVQMvqAHW(WDž[Q54i2fP'pUgB*I]Jجe#qCR h +--k.B,o/tkb )k2&IR+8SXiʕ\]Btu2]-}7.u~-P0_qb^K%MlTZeL )4qѷQ\FkeumI38Lou~ ]X^2FU0[b>wƃ"Æ 1ob[ZWPqc_Sˮ2Z.t TmY˸;[׊Ցyoߴ {P/)V.c6%_YI۔-P\ +Slaf$6}xW\`nDMGmEx, \`/xyia`>JUƥƲ,_^9^EjY=[64kA Q&-ۜJdjlY;b+S4_yK;+J-3^lushwZKFAy*ٺnZ]f+ j晪ͭR>ό)OuR1c{&j;[^E!_(yJ+5;V mEWwْoBA*4&z mzR1f7иKz[OƟv"O endstream endobj 732 0 obj @@ -9280,72 +9302,77 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 731 0 R /Resources 4 0 R -/Annots [ 733 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 733 0 obj << +/Filter /FlateDecode +/Length 4737 +>> +stream +x]ێ$q}gK+6 C ݵ^+?}dfTfV̪$y=]Kd0U2W KdTJ9~|*z⢨FST'b6.?:jUgVS1ŨPi*F냠 +FsT0GUEA9yI3$p۪2̰ѐ&(j-`&rV$5*lЙh%s*D2HB>I:->k#:❶OxSf3k#:؂آc(3H1/I`cT-I$`S(I,`SVhf((:k$"px +8[3WIga +H\l$.p`[Z$.p[H\Mpaq] +$qJYuN H=J\+q:JAudu5El%.;*g(qw1U eSx&MxF,.*A'qw-H+7xzm%. %$.PGxp`%.zu1eH\&c4JkOee"<.[xYI\$q8^aExqX%xج%.] ^A`}SF.+SwAKVJ'0 +@2F*qAbyI\:⒕q tœFSH:6aI:f xM BdM@(J\c d B>QQCAYP$ Xr Z⬕ Z؂AD*Dbz[1? ؂HQ0JH1xUR]H +KJK I\3lTKJ3At3Fda A M2+4rIZґ<3I\((%.4A u4!qƇm/q$HsDlq$.Hr$.H Xm%.69ߌd [I\uP&K\Nk I7-I\yf ;|)0o oF 2EMY$`'I`$qA$q 䛈-f >$xi7JLV&8cAkeXgA#0e +U( 4m8a}f71-}9z1wش??]~; +Xs.o*2Lۖ ~s7ҀM76K1|m/dX63h/RrA:_VqޖF>Ł`8_xƞ7.nHf~?a>]O~wbDA8iy3 *ZS^'9|SYί~𚺼c.momC 6&6,l 籭鷧Goqnzu{3R6%)7o}yPoS{m;qS6'̓Y +vx (A!A8Jhms'w|4og3x/+a^F@wIGq?_!W'n>8P'ŕWfVSKarn˻q"Mu׏6|k_c?kaǟk,2o?~?i\q܌o.뇹_˭}6vf7~kfSX0ݗ sdĕ:JK*Ggy?w}]cs?*P ޫFn=Vch}sD,~˖O:'M0jkڥq!gS~~C051 {7 μ.)ehklY~edYB6R[޶A稶*{T{cR9u{7őF{kmŹYuܑGxtlL|IE7 BǢϳgwaAx; <L2.u ª;$ 9 u$ &\h˸$dLK˙6-W5/d~yҲi9]Aܩωby\{l5\fmm}f&_Fb@pċO*yiRf`WNh̓|${h嚽wiY鐼5^'wbl]~,uN=de& 91;=QҐ* θ+db26gJ'<A,JKѿ3w*YZn:)z]8ĝƪGzӡu?VxpsC|X_Jt|Y0 wcJ"?9y! W;W[xh?c]/ӌx!sp{@ }+9}-vlC-:) +\۷>t(ۏN0Jn]R3OtT?vWOʨ;YP6rn9j +쨝SY2նÙ'>n[k:+;|L8/`dCX ?c}gϴ\Oy:Ĉ;C"=+d8{{ Z9:OփOlwx$'jYLE,(w;?l۲_`5rӤDt cFk + + +(8'vM{Ҳ݇"t-ļ QȢqI~n@tX29XW:kn"pl>0gavs`o<ĤC:>/6$/f_)\i׃A{M/9iʱ:$e,/5M|eҎL&SkwjosA|gb.s.&ba캈%+'ALO:p~[[d!YUv F%Wz~O׻VC`zŘ:VwI*4Sp& X7+Ӄoz讋-U{ \> _8 vAn-}|zmz&sQI}-8 E~kӄla0I*˵ ]rskTlR).5 p\ohvR'ioOm&vG\}(tCMtKӕ+L*<*|28~;K'X$.c/PIn[H yLR5zhA4js?vJU.. UZզ0Wn)wD/StGOqT8*aSۭ+^\ N-L,zIWe۾iw]mmP7$Tj~SC#X-?e'Ĥ~;j2YWO!߱) [#+Խ' "t4U PcTFZ-=a+x][elȩ"77EmƩտB)?O4 +endstream +endobj +734 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 733 0 R +/Resources 4 0 R +/Annots [ 735 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +735 0 obj +<< /Type /Annot /Subtype /Link -/Rect [ 101.433071 423.873057 101.433071 405.123057 ] +/Rect [ 101.433071 627.273057 101.433071 608.523057 ] /BS << /W 0 >> /Dest (cb163-1) >> endobj -734 0 obj -<< -/Filter /FlateDecode -/Length 4749 ->> -stream -x][q~_V~ p. sf󐿟HR3kgЧ[Uȏ U;S;sx"&ooR?Y]@G]_wH]ȫbtJ_~H*'QEԌ{err)ȩ`F T0(Ux3S gTR`u0Dvrht锜\*:i=9o.N98-6 -,l`s:[ӂt(Ndt]tQO6cX]N:%dւI9Y`S:(tN'lduj8-V'̸E+OҹqbX.3p\0* ,xWjԜ+UX.q0I8`~tY]D  -) 0 O"IX$qxC9.p]LVk xW=8._-3NB)8xWH0 -#M O8.`q f; \cun± ,( pc+آ+xSl\-9.M!q1*sj -tts\ཙ0K = )K G؂q)(xN8ӅNJ -9.*`DSs:#:3p\q V`JV[@br\X:آ ``37=Qx|D&s\N Xo*qeZo Xobnjۨ]Zoz -. --p"3nIXo8-* si8.&'c3R[2_wXYÿZ},7 L @`$? XauHJf\Ŋ9Z/6^x~ -}y aou-aol.4Yda3_1&E;yúL\klgshuDz2sXǪf]8ٛmiX`bXށئD!%u!փBYuY)t]d-)[p]oѕt5$vhPfun7R{[_l݃a/p\^p0ـ#dW),h5?lRC@;ۢOӏFYbulK#Ď9b]n#m㟬N)CMGU %G|]\iˈK{Ze>14 !s,yMonjarQ|e>U$S/<w_Џͣa8z'FzknK|{/+;{":t;x -Y{n!=Zvk,3+] 6&ݡGoб&z )w=CUOO;Y;}yNXAˊ[5i -x`0ِ mj9uv:.x!;N{Y\]1 's:Lx=ugF=عSœ=zN.p?Ϋ7 XڋQy Yvs|$X (Voajķ}ƼVx낽4eHc>rt-+>> -endobj 736 0 obj << /Filter /FlateDecode -/Length 3800 +/Length 4668 >> stream -x\ˮ#+6`d_@E AFp'8~NJR;׆jTh\R,-%6'pt D@ɤ|ǧNO>;g[)%z? *&rJ6(uB0)UtX!KU\rT0ϊ* RU`O5p%$E,pZUC,3yE炉31_T]%LLtCt [BNt)'Ma EH%1:EeteU[lN2dfUW9KLd5s&갢0I1):[ E@k:-OJ9+&KN}bU[0[l`%|Jg|&Ù>)Fñ$:ӈ,l 5& [+W*qy؂ϤqmhѸ@lӸl]Ը@0j\@`\ʑ5. P.T4. p.;5. .{Ҹ׸@9j\@]bg5.`.j:k\v42i\]r6i\],#qfQ` ٲ .@%5H0x\>Xqw=qb?Vq=t4.@c#,Ѹ w]S4ʸ\2OF\Yeb,.i\Ϭq8z x<:_!h\8@7,ꊱ%g x5.66IT]2Ӹdl,P "xh\6i\:Bk\:,[eM#X5փ)4x:̰Z+nS゘D0 -̦5.BOEqAP-X֦P$[{ -4.@D`Cn`  RԸLfraָ FUEor] Ki\XK k\ -lRѸd\9؂ [D9qAѠg2ո{I c+̬qAh$TԸ;M0- 0?`&9P` r [L [i\Pl4&k\Z ozָRYBMlu[(~3i\P( h*ʺ'a vte5.@&"z5%etx70"2MDނxCB|+81ߪ ,*9 =4Yf VtVMX/1siLQE!g$Y,}sbt9?/=ϖLY8KiF|e ; v|/gnSf9f`c+LfZ~ܯ8NƆu>+l(C d$-o -\8g=`><$͇wΛ΂ΝmYT_m.e~9ɧU~Ҷ[ kS\E;|hjӞo1?_lħg`JqM,)X% W)~XTd0.a{NbG~5QzDsZl]]kN[{ĎO?QO˩;<WI/E O͆HѸADZ&;%"2=hlAj$ؖq7l<;O. -# r{!orjU?0[KjF+@tHjg7%\u^sǧmK ݭɦ%dj_isWq=el=tpY -(X0u@qwfvMSҸ_5{f4 :۱mGL7#9}6\V= ɒҺu v D7wZ+!/Mwy8ގMk)B2z}u-=ۄiXwgWIky<@+\U/}uucӖ]9)kw@?my@i.uHy圗;pהVہk;&Sti6wΣ!nǚ9[3٪y՞ϝ'^y9+h|A\áN3\D̶M2T/bΩO.jӊs~EF?ggw+~l=:;gxM/FFhC̓7xzVb,_U]e.걇xp7y8W:~,evgsJN(lē䇉#ʢFùhH;"no%w}ff>so%i=ϲVD K7OpYa2<~Λb1o#t_CҬ2yJH?SEhRaq/oܺLYw6Uؖ <~ˆǽ{uۉtA]ӎp]hpCxF2:7aO^!y`ZrpK>MLv-"NFq:tXe3c'm~d#䔺*"i<f7vZ6(Fxy}&ǺDڨIFi06ӥi9txhX{Ԃ4zh4jk0vU:F*k-jS\aY8ZLѥ?#YiYeZD- -#S:KX2+8nR%.mnH쑩EKιΔuJϒ q?(G.6ay}K~9IĿ`PJ J>,0Ati߾8{ZGHkοUֈCQ%29vQy%p)q*v +0æ8̰ZGFaA* T0C%Ci)Y 9VǤ Щ91tIx]t$s)k%-4oH4<&cD:7VyE%#eLҙ9N +V\s7 +{>03~Sv?~BY@:12iY7ui.msMW yiyUx\S١s۶Ğ8m]J~N|7Q^ +mm_G)`tfB/0! ^A +5Ŝ"\Rݴ):9S2.˜iAr=YhDn]btQ*(Ē8tKc}c@J]GEťzԭ`jYk2hhWphjP-4s84n?gu7:#jVnį4!6-_tg!v}4%} aVL[";L|KĐ?[Wp^Gg% Zo}{=U>˷pKtqq>g:WĬ\:G̛g6;@γ }۾?bkv9zͺƱ%xrvӥ?rL#ڦH;~k7|Y@iwGG;䑙+sK;,֝~l>3րs8nz7q/e +#}dtС߲1cDoEcuimHFWU߱]7vXɧ s4uSo߳8KXF^uw?uΆ͌K+5:CԆ^~ki<-]AgS>5-Ҋ!ڊv97%o9Gsa:b(~{Z7f<}fYFm-#s8d?F|/:GЇ6\5]U~Pѐ)6hez_lg/:|M16)VκcNM/yߓzէm qr^h٧k9`-rxC<fk_kKwX4̹6{?ǐѣmCĻXwdv9ֽ{F6g>gy~U;; U~co;786~.u+~aaz/jO^{轤qBٓԂm;7W*lZw9ZR}!ֽ{2s7}}'93dJqZHg}zzdg!uoMy/k#2:GCdx'Hn3y6w;{;v=oRxgm3 %O1Gs8no[!xGqgáq?] ={5QCroj;G2u>]";Yhȍ~߳vq^_W}?e\:CmOF . H3g'9}gnOw$RO#. ;;^$Vأwص\V_g-z˷kbgw9b7ٍ=F^ tМvW.ѭUx(=w[WF:~ܳ#ݑgYp{{>K%SoX}*$:Cc9ɯ+ >֌ @}61dz:C~gU *zB(sފ-oq4TyU0"8 SfxE68Fy9P#<_`kM!%C?|U6C~dp=#9+Tuy[м JCppX†ycT'wcĞ\+0_N~xWW'}Jڞy?jH~(UeбPsx /f`__u}m092 ǓJVϤp}Q&~9巸ZFl;Y8~\VUv 9~Lƕڕ]߮ce)d\f\^ +5p0㑯8_lҲ턭XIn.&ֶأj&ӮSdKYp /'4kz +,*ebTRWJuYd[̮XdkT1ˉ-7Ց +TlUSfJG4W{9"M8<ee$3lMrr)WHWGlxiXfw@T43A +vsD徲z@ʒR!TRQ23ҵ&ReDR1/T%XUUq?+P#\ +嗉TKc^z&;_8W|z^" 4Zծ5F0B7}eVv}&^N?eN>x;fE=_^jv]ǵl+Nt%o$; EX jKhUle]AC]ǵ&|m[uوTAURk}HĺBW+Czƭ/]/VGѱi ДC3&Xz98Mgڒ|&Q.ږth&q@OC`jM̀Ԯ[:&EMٶSp\`C艭=wO}4ٗګJei%<^jC?=k92y[s2LurhPil6jlhY(*]@&1XtpőP}&R;Qeūޒpd+Y}<]4E6oN.\mVJ̝k.*?C&DP,V9ew'zFzd)CXcdPۂ /Pm9UZ%L*ќe0crHÐCEWiTlj]NR( endstream endobj 737 0 obj @@ -9362,20 +9389,23 @@ endobj 738 0 obj << /Filter /FlateDecode -/Length 3198 +/Length 3543 >> stream -x[M$ 賁) b drXwm=9籺$9ClQ%QD4LyI Z|y:?Qoq(lS9Ԑc/-jϩ_wE[zӿs -׷*Ju(#9ԚrqD% wO5r$ -5쉠Q,5CTx"{(ȕAbF/,PZOݕUbM9*1GOC)%7O&%w,CEȓAV=Y.\\tI'%:ݑ5j P:ܛ+QQ(ܘɓ2|]" -T#KХP d~<x"sm͉֤ѓeRW]0]AAyTk#8H@j=H@9HY0A,cE p 8AT$a l+ t+ԣ BM܊x\\R Aqu9qvYZ,<..3teq1plqw9R@qf5Z# MK+1x7e [)S@IR?f]PH=d=.@c!!- wc4*֋ϕ+,-b) Bd.y\XQ+' Eސ=.;o!\ו@5 2x<.*I\Y pq8P -x{w)3{\P$H{\t<.@^։i$“w)b=xv -xWM JU 5 `@<.(MBx\P:Aϕr reEx\:t゚ qAM)BȾt.=.E<.`?zBkW Z%`)`/|tY j. {]d{\L=.h ]f! Bc/ S{2!g6 4 &<.f;{\62Y<.h-vy\tI<.o~z\ S &{\I<.@\~y\ЙωE.%#EqeISw&ɓ蒺x\Kfi#ws3y2.2q -o"/llz3VȀX{f@ _#P;VS,Fr |L8vd -ܡblU~9V5~|ןO_{?w_m'eG}#k1۩cN0k2;Aӣ.ȵ܃۩^NƶcG;䵣͠3_O,`Gz,(\ Z{9~oXT,kt#/xD5~v8טjl;EfƎv\֌>TmCUyŷC >ő5 oE]Wj5C \Vׇٝ&Z{yKjΏ_=Xgg`7c{ YWϏ_>#f~ { >7>/|& _%~g)~OlTзU4ϯN_~ca>cyr{OYnr}v]<}GUrk2uwk>v8¼j_,E/T]n6z> \n6o_on=o+;1cfV}۾Qw^Oe~ogtu1ԭ,:l k˽^6 52Qbo eפ*CO_>\nm%O֣o^f7n'zNZVf #G7fSHRN#dئ}]У!>ۊnouyo/m\vvuӥFc^v=fԔWm`ٷg9s yaޟ/n=^={_l4Ͱ̓5~h]5mH([p-‚'), -_i%qG"kuWsZ8)y9[s֣}X~\4]LbWjkN2皚b$3mkYMne؂BhLߡU*l_L{:؜H/uij@sZZ{FN}%Y{Z$#MX)lgri(+_3PJ4g .;sƣ^jv-lrɂnufHaFac$۪7u<%ײEf Ԃyinl,?^8:7ky ݰ^'Z`b[2^K4V]K:̃(FQ4AMuH4/v*X2FhL2k6 -S)0ۂmXq\F(:}W΁): Gy+cq9|eX -G c{l;: Ť `4b:am͵R9BvVPW+̖x&@ٺs]Us}zjcc=aR̔cߗĎ{?IHljoIp*|3_zL5߸*\!߿uryx>"n䴽fVQ5my@zG(m" +x͜ߋ$篘geIU`Cpa &[8!~-{3]RS%MϺϗev&"/ON֤`o)X?7Lp%p(J&S!dIc> `w=bf.t DcAw]AS4he\.QcAw]b\ˆ+l\EcAwHcAwϬ7^cAw!Rk:pb5pyCXw0 7,\WcK  ,yfD%Gr ccj,.{X]4Dp2U[({kòU4Uc=H]0Úܵ6ܕ &d^cAlJJQcA,:|.\B,U[8$֦P -Ƃa RLqȾl-5d&f)D0.zp2t.i,H BXX x#c,E&{d$ BƂa Ag2X$Zӱ}fX9I5`` R:Lh,f;h,MlsTl r r-zMo&d| Fd8tj,(.cYc֥7ƂBMlu[(~3i,( [RU[4e݂IoN._XcAQYc 7ѫGYI=.wC44j,lxCB~+8zb`ހتX*g=zh3Q=5@XYi"$曇qO?Z~KW~`k?}8n2y{;V,fkK۵^-QLmoeޡ߸! >L]6b}n6>}9zN~;ߒ·;}U~n 7\i\}ߖk2jmIKilcOڷY0Η~uWx}@&羚Y9+L73<0\;~b +K7Ͻ u&ؼ`kZYŗ8ն؜,myxŃ_ys̷y;+̡qO#?qU~N:ª« J}mVƵqOO`}uޜ'NpiEL͙8;famkb)POCnJPU铎uw}:ys>};e\cQ\|$m +5RߚC3J5ʼCNF>Uc+?wpgv~ngNI-|eM'' /em ̇+[; +jW?Ōa;t/8MՒ)xz ÝuޜWyw#j^yQ̒k{{p y%mnB8tԵ~+G:oΣn>vnLٙcށ##.7ښ=4ޱYC<1Uہgs3 `:o+?e,?Se;dKP۵C_JykEފ̷xHc<ȴޗC죺MO.M*}wq8-~OD:tn^Io +hyB'yS3׏n3b|0Ѥ|Ń2;%Sz7od[/mKe[XaUA%uu(SNȽ~i'׭֟ԗ#w퇭0CpO<':my9TQĮN[֝\(ھ;cqZyjbpLǓ+ldsvg_/$s`Eq)ֶՂMv{)sI +noKkB}Cj5ym-DkNJ5;qX+ mWb e{bGvujg .lCe}rB4KT<^m`TiPK 6OrR_4c2~5yoHʕZN]Njf*RW-u))Wdm$_~ֈv/2umSR:tVP]ongKSCYe"4gy㸹<دz'6x?H<66S/; K8^؁)ttAJ5O uM,X9 +m5uqhw;C[pYtnΧQڌ;yl| +/K`Y,k']mvA ci|fLӯ%y +M$',w/|}}o6Z֝xd|XWm B^6TohqܫZ5 uad eŖ޹{zsj.e:!<4+)C:쇊a;iC/8$} C!ut-w1A +L0ӲG1wfr+@ M4JۍOr-Y.#ڢaQKr.FW +S]5P4\@fMqVe㬎Rj9E:tg bg%J5lZFwNl/rɬXI*;k=ݐ3S۫CW5kg3:hrrP]"O>9F0kp4:J'"d a&'B7 bh Z-l~ਐkr .l$YlS#.Pf 8 endstream endobj 739 0 obj @@ -9392,23 +9422,18 @@ endobj 740 0 obj << /Filter /FlateDecode -/Length 4786 +/Length 3198 >> stream -x]ێ$q}gK>X0`ȒA ݵ#?udVdeVOk;^ 3i?Ȩr t|:}>iƿbqQog)*orH.z1_wǜ9X*r*T*m^h}T(41gI3|$Kת3('/`YUqת 3l4$`> -*aZ:tƫNRYEL9"o$]V!$txC%l! El):IaEdA` ЕDlAI9 N1]'紤3Fy`Ӊ:x)DAgaK>:❶OxSղw;팤H`%$ -)%l%lr%lʊbt %p@gDNOAbg` sElq$.p KN%E%|K fj ץ@8P.%.p\tQu>X hQ -8#%. s)` ,qQ9uFG  7`Tp$.VMIK\@]4I\@]1NZ&H37xzm%. %$.PGxp`%.|u0eH\&c|lLA5 '2=.-zYI\$q8^aFxq%xج%.] ^A`~SF.+SwAKVJ'0 -@2F*qAbzI\:⒕q tp[*m FXҁwYiSY`0P! -D*$.YCOk/qAxP-I*$.8k%. dѷ<-> ؂HQ0JHcUIJt-t&J\#)LFTK\W.I\33$qA̰"q","sIg` l BgD$ ZXK%i^g& šp4&$.bK\X:[Tp3SFf!okm$ӯ0_줠iO'tk ~8!2]hZ4 #u)Ǫ.PA9l%V+-mn^n^U/0П2zoT"5Ίp3`9x(cCm0[H84ˡHX#4 TЍcsNC 8b^=״t%\@~*XZuMBZ z-U7 -GBMݫ#$ˑ:;_HvކOCn:ocso s7ѥXܮƎoZ"{Ҽ뭝iLUSF燌Q5vr0σ @Jq9bz"2Zj$m B2/iDh.Bւ^<0wXìZqg,?t<ZM^kWdu7PFNYl[t;j(0B9+QXʪMGgF[թA*,h1K\7P_RC<tcWQ_rTMR0* yZ9-¬6\֑nވ[@.wOGhh cW,_/FWx`AU38`C8xh1˭Q;6t=f$ou<Zw{zO6"z~$](["it^@+3y[=%նC4,{\i۴ƅh|,ϣ!8ގE⽊gq0~*^߅|A7g{M|߲ytVߚq!c]eO;-TCa|i#wN5ױ<c<]c&\ 5Gڱc}]rm wK6(`C({zƟ3|v"eyhJ;`?1=7]O(ȨJ=R'-`y8TDWO^=r} $Mx,!vv>󰆮 -)?Nh)/ݿG՛5s9~%7uY`kgTI;;RiTP4*ͪ<HYؑYq -so5_~nΩxdo3z0ϣ7<i*O==~7p݉/W.&:߰_g0=fDDGkcCF m<zwUﾒЛOÏ{QW鞄6Qm.nW}<؝x6j77}=h(6z'q{.$6¿}j|eMo\98̆$;0>Tpu\(_hm9 üW=? M/f*}i't,{rWҗ/zIns|0|u2z~!6\ S(gr~I/9Rek|#Sɔ5獜@[MA_GO.:LrPꡋ8zů'~ b~TŽG"N^ YG ŵ5l|.ȕf!rs-kef1')7_f -A {4b B=TŖ=ORo]>vq[ պUBU{&sQI}M8 ">_JEQS'a@.trͥ6RJ=k=MPwu GD~#ՏK1Z7Jx9yjLԾsz 6q/]S*fDIyC R|{ꕰo6FyhCR=]&ƆٱLBz&ݖB:t $c)6 uMVq(TžAu!v^ʂ[]wF!V*b~tm nH;qN;4^N9i:o sfoH;ωMՍ-lօx e領XVmؤW4yځgםkJ4(mе =o/^l̗MKWǧ*\e:קP$8iҡ%;dX(. -sla&ru=OP8kt]G}Ҋ! B`7^+ {^_<ɡzK7(m ci#?)5ԞS- Wz/)oU$j#QdGs5J bj*IEjHoA I95XjGQFDP#\Q$+"$ɑ +^|jƇjù; Z*Mt zuT]8,{Ón/|+|FY͈!|/||n}^L@KSwOlTзU4ϯN_O?0|">#>= >/9oy~3[pdޛ|py7*bX^"Hmf|>m߾zWv<ct(6}򽞶ά:OwcK[Yzu\֖{k{l,kdhˮIU(L}KPKğ)GzⱝZovݲ?WNͺFnzͦҝGȎMƻGC|e^۸[oQen|K3Ǽz̨)Rͳomry~)ATo?ӎd#fl1s:)岨q>#Iu2lvg99VO?ʇ&C#K,Wf~Ѥ^o$D_[ttxL]7D1eZ4+ootf6MmI*ˍ{ Cل}*ô?]_{Pi!&z.g}؈%ia'kgf-e}zvk +{?a%Poh[_Oz RXd- ܿlK\v9El&@׵hq_SxLNj(:v@7k^?梁U vޠh c#W9/4GӷQ¹=r}>f9MeIOin zzniK4S9?f=:65o{pGkek'Jg%Z*gj6j|_>2@dcx\.[7ʬ)-ef%x9ۈEƟ`036z@B${L/bl2.#wi&k~V9N!soi)s߰b60Dڽy^5RL46EE/A)pfܦ:6M=U{JƎT:t +rg;;afEv:y' $qQnd{w9ʍ61<ba |S,9o7Z~S<--H]}}=S^ֲó'OW<ߥA>ϣo>kޯ)xY$P66]zaH 2dNiU i$De5ݎ+ZT={m{# Hdr +#;ܧ>}?-<,4/XyZ*m*;u9؆1{8=qzMߓܘI_>ԥ}#kUF b9 (kfp;(+TlbEʔr?uUZS%LFPVz+{0$uZPT3gκdVieŦ3u6];~G<TˇBtY Zs.,w-z-Be; +2gDO/ⷙ ]\ZcɟDf|CsyqCZmY{(Vq@n7y] (l93(p#f< +xLYOݺ #u}"=s:r(4g&qq_۶xRX ?;;wC.{2[zgW#o)H#[~ޏ,ET/ v16CR={W|W^~-hz|9l}j<&k\SZ䙙ܖ%n-vjS}ڏcm+e<k:[ UW]*hށ6ojztք; K(i\)QUf;Rv~D/J*E:^Ga,@.tvMS-k*-LiP6 u[~EZ#ʖs1hRZ7f%]UOl:k\\^/]UUK Yd6?RRfCSߎZ%UMGm.|]? &WfFڽɾxK+WK/'JxC??cm-T˲4hzvزM \_)٬2PTLY-14K>(R1EoiJmD_rˈW%[ 9S-e% }*ٺn]Fkw -2U-[|w&T/^t7=8%g]4ϳV6&t@֪]Dz /PcEWTy-)ka)j?P_vP= > +endobj +744 0 obj +<< /Type /Annot /Subtype /Link /Rect [ 101.433071 593.554475 101.433071 574.804475 ] @@ -9434,55 +9499,25 @@ endobj /Dest (cb166-1) >> endobj -743 0 obj -<< -/Filter /FlateDecode -/Length 4530 ->> -stream -x]ێ丑}ϯg# ^60`ڋrl,j a) Q*;Bu"x '!K_/Z=Řۏ.j -N_)(U+&cPBr& 叿m]G_͔7]%,M!JP)Mʹ)㼠z-$` ح* T0Ud* T0C'VCD Q֒tM%ѓ$QH:ti޻(,lqIiI`*I[, 3J\r(q v`JQ[@`~fI\6:BJ\(qA(#qA₤` "> S%.CIG727 6 qA!DuAS-8 M$+qA>73DD/bo1]u $L~W ^ʘwQ(PoS - oĜ=4YF/f VJL(/19STp1LX}sbSlΏ/_~/( In[ M3Ie a#u!u#5hqIe#r}Z ^toHl͂bؾ9(CdvW**Oub΁Kf>%6ָ/OR˯ghM/iЩ'<Ԕo2A旟at0Y}ڙg\Xʽjɷ2ǎms\ޜկ|?}ZD3ALwxؾށ᷀@Bvo+_-. o3gdN-ӻak|%a0mRnĞ5nVe[f0Ȝ$Z"dgC{6x3Q=:zMZW]r9aKAǂj׸A;wcxOq΢bsV]oP;f1it61kc3nKbv>W0}82aQ#nn33Ĕcy/ެnwz7DHne~XCxߧ_Rlܬ8˞tH{&\) /v0;cp<;(f''<G-c~ NHz5'A ϠOlWVA6nRS}ۄ욆f+o+k܅*ʛ'<AQ>\os"14t~ٛ-"6g)MjQ>uYqN6xGc1픑6;=;2LWt7lǣzeOBZ}̋j.NQuCboe^ڪ3cQ嵷1s?^xzu>.Zژ{Yj匝pFa=s_{c&m -<*L3ˆnym2T8$,C,L\埴LAU.4oۮQj륱jUt6ŗst9KS8iF9Cۢ"42SQS+ZAHsvL`o;aUԋ.~ 8 eu!UvC<4$WOb\h\\j/j!*g_ Bz+w&)q7S6CloW<kRLBźbc=:؆wa3f_˚vA4JDi>6UGר&#fTjRWK m"Silz6kY+l+j9At\J^5ՑtSl/n, 5~\sZE.ζoҮsrz\H&KK)',*gpM|жA*1ٯz'ym6z7ֱhzY6\:Y>^:*|&VJʆCej놺&Vǧq%jbנw;][{kwb߸Cq mvVvF5o;cnH;q]ʉǾ${Rܜ!g>xke_{zǍjlaܓ忖O_O¶lXF]c/*7U'ZR7M˅!]# K7n(Y\ƮI\ݥCk (.Y[23w҆>oTP]0"_RfyUVAL7l54~xy}/&Q{qi,m'K\e9tujm[{Ԃ4zhaWL{*[uZE TC/갔;(St_H;>+m)ۭEK ݩ^ŒQy^Im/IUۮnvC|LU6%G\g:HWɄ؏(:WTb6Ȼϕl3"5W{tLH~l%>쾂5U\-)7g=o9TLyQB2b{QޘEPZγaB)_ t;D -endstream -endobj -744 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 743 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj 745 0 obj << /Filter /FlateDecode -/Length 4213 +/Length 4458 >> stream -x\Y~_1D(^\!NAhJIVwJcǫJUZaw=aZ w!Q/ V{|аDÂuOiq& "pOU24-l\JUÂE -D.hX7Ȩ^ÂuZwVÂE5,;@7,\WUck)D.`kX,lllHNC5,H]aA k eʃ,x P׀UbŪHkm$.M Rf/@@*kX -sҰ U J> قY*P& PXjѰ {װ {ȂAT:T]ATLD䘰V5^d+๬aAdKװo\ҰbHÂ\! BE"S<*s l P眆CT_LVdh%jGEÂBpa;M ʃ, `lG fYB$ J,Y7y5,ӰdLְ0TWaEÂ,)q[Cfְd(QTdAT&a tx JԔxY4,@&*zH~3XL4iX 7Qj{{ ,,ꉁFV{zf`GR &v%H`:X/1:`r$!#g̋ Bu?Yl9׷/ goDR4+`{6 #ӽ-5Ԣ/'AƶctKPB6A Hwg1$wJu.zN5r ǘd5:ԃlsta[:m]ֳK`Gt[[lli"aemGG^uIn.+֘ur%ŧqC!IGԽeL8(>Tt*‡ -Z1Ͷc:I>TԹ9ԎKO"Kus>~PPvz@^ ބ_%~bO>?<#bR~ { gd+9KO,SrbSh%<'w7[6n)ŖwN}z} δ -և>]R3 ͼO5~Rl߄< iwTJO_|?|?aNZa uko,--,JzBkeqe{YW%ڀALUx<8))|qRݺhzkڹ6sdɧdNN6j6Gힺw",댗U?qBP }/M}'2N[\/rS״}$iδ ar YsZȕ@&Zvmt)ͱbuV۴5mӸ鄾/sGD/(o8G:>(Ho杹6:{/g6p*!n2"'g? ^/S3H 3HѸd_Mo#eE3lDێjW=,covyVhu' ׽oN&۟!9M9M~9s!.% -ktqo"ŹnSis盺->ĩe!{Y/-ơQMQhw\blz-d{lEɉj>9?찙ZT/_C0N:*V +Zy>u:7bP5zҚhk?tg]T3.]C 3??LM;w_b[t5[ti'Fm7SΑsO%E*߮{B!΄e^!no;tw[Q{2;~pzKʮ'\>?PQn$ oxUj~.f1"}[BH^8 S~ܵeI[RT[DwTp;|EP]QW7ۭ^_l? t̂_ـLvGH sz|Cwz}}~ ^6&wpT=1Ϟ+moΛMl³?Ogn$ʑ<]؟ć7>5"wYi3ОBMV<5&OxQ~k0$(OEFZmC?\wB_=gf=tO~w?O|x;gO<35bvg~J@5źePFP_ //kOac.I~<|H!ͳ'L\?1.Igp]?l>pػ3d{О2\&Vܑ̫ƭd~R1aJČc@m瀳d #ъ&SCuiRuNE"^N6쩏*҇vЂj-AhI!M+ۇ&sYX#hW{;t9TZ(CWhOܒak[r4"qۍqb$1q/KWBI`w8<탣R4plVIꐦGyr9r*tG롱 ULs1H ؒAfX) &9W~ܐqjc䄻1$a;>߉hOf/}Ivd9 N -63a//}R..rpY&/̔|C⊛Δ.yrP\ l#&;d'is QFeY$֓6ÈB'( l gQ[UFYt ocJh54ZybLt%0$ +$01N.'Ivr%LʓJ4`\Q4tFKD`l.HL`5lq$. l ,֩%.[tpaqm +N kX.{uF ڵ. ,x:$.p]kSXdu8*J\FF ɤ$.p]wM 1h%.p]ik (Gxp`%.| ,wu'iդSxN>Q'qa˓!K\ L'̨F3jK\8L&]Q'SwAKF“J`Q'IK\2P x{ wVUa-6 @a+i2` +IU=,J,qAҴ)qA$0I8! +6c dB>Q&\{ DlqI\z6' - -$.@D0e[\E\8؂HQ0ٔsDW%]0SkQQ݄XK\Ԕ0%.O.I\3Nₘa dK: [dK\H:%.H  UfP`ZtN:3I\\(T+M0- ?`&9X$.Hr3I\l1H\lz3J\lA'qAVa0Y8tJI\uz8 0.i$.Va%0n ތd[.=^=KּՆijdS{X|2ѶkRvfOfQG؛U2]G<VwҺfVsZ2P΀RޗB[joȝ6;qLH҅u}o5B Ncy׃[h?GSE#G[D6#"kGEd<ݢF(n<"oĄ;8^[Y.;Qo}~_~>6y F9 {m[Lbπc1 |=[avkE~0áFzs>5e\k>i0Iww=ph{+b$xe?-\5H䦷pȽ~Z# 4mP?~J}u`Ә;Zy4ckIGGPt=iw#P FDّ=ڗyD f#bIbyێ4p¼4"G?o"=ӣ<;V/ZƉo:G}}Z}C9kʼn1湶yamԦ/BA<=Nj>=yͨewĸ<Ǹw:G:rv5 >1;W9ݳ=+~k4Hˏd}}փy }Fs乷T]AftauKr{;H1<OsI"s0Nosxg3qzY|z<5Z'QƕNl9?9V߲O܈6-#F*C}y +y8x`quz!dKTZ ¯SsYd4`n=o,ϣ!_k`'`5[Gb{̽{Mn;hc`Cص%g5Zpg WO u#T㺗u :Ԕߝ:TFc#k'g{ܓבnR`Hx^jTv|QAf\leBګk3pe~m< zAry8$_qzȞqa-kRn9VbTц]+iyWL#b:ܱ{0ϣa:{~ׯaQouG\&1Ĕcy^wVR4ǙQhg$L4?㡂_)=& ?<{~W~K +MomF^cmc`_a߸w, v tz_Ȏ1&o)nڽ1.ZOX:Os.KK2m9a3tᶜ⹧6qcGJ{vKOWtϛy +A9PvAg}^WsVw(y̜wDjw{ae/F uI(myeqTvֶ$qqI쟫[]%ϒWw>~9%z4k[N +ҦśInۣ̂Y'gz\=cm:#,s9IB.sxP\-p=?JQ [DU#SKXQ:tsTު]bexGQ-L֕dt}:(s﫰 &4~6{MB}ĦAh</[ }'ơK,VpuOgV$(iҡue/-[I4דw #v,/J+X_=wOPGI7+,2/ۜctQoP+˲g[ӇF-cIS϶$RWeJD2UeXm +K$z)K=y4'z+aʭ3^l $N- endstream endobj 746 0 obj @@ -9492,13 +9527,49 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 745 0 R /Resources 4 0 R -/Annots [ 747 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 747 0 obj << +/Filter /FlateDecode +/Length 4211 +>> +stream +x\Y~_1L(^a`@yƒ`@C~b7YIj*:*r۝-~>u3Ԝ|y{zw&G?梱ogg)j* !\p?K'o7&̢`rFU.(M>&kX#ftdeAD1 +]8*ّƂƬ[ % +^h4w&5^&erijRJh<,Z"djgCՓCTC9 |RN`!K!Ap*JY@ aAEÂ%[xK% bZ 7D@.\jXةaA"ܳbn4,@jX@SA8@G\ p785, .kXaҰb|)VbIA  #enஏkX@]O>iXG1V]@Hհ<4,`ƣ,Ѱ w]ESbhe\IÂuSyո +q -Rհ w , 2װ w]@x]հ wQ7D ơа8 UyZ X [$*/8Ӱ`l,P pjX6aAZB٣ K(^5!lFjRh#wș%"+‚Pݏ=l4[~K$9A +}ߞlQ&A~2ݑ`=Z4$ؖ{Ö`it1Z&A~8al;DN\ɃEϩv4^NSAzm΁.l\zvnkk-M$ (+.eCYd>t n|h>$騚ŇCEPA=9vL'҇C:={y_%rT?e7kx M9|O +,V,{{bAJ@>s)%'6&Posyq5mHRlI}W>}nDlGAߗL;ͼak}HOe-51̫ +XGMaW/NPN +W2D}ķhd>>x{ ϭuZG 6zFk5~£/y~91'O:, ~yux(Ƽ{;oVQ2@qSاRt)b}S9Ϻ;=.s&嫅ޥ>׶>c~iyb_qǮK[mkknmRM^Ӽ>3j?5ۮ6$ /UCgc_$'diVWui]bڬ Oaȴ/[sIO{vȐ}#zYir%Bn9-™!]n!uTqn[f}_m:Vmno4tJsX]է6qM{o4c:˜ù ۹'Nt]柎/qD. +[ygq^ y?v]#d8?O!rW rA9|ha9w;ˢmhjF h\Xgeͮ#oQ}d<$y#8ǘ)G9/DZ{8ĥAm=зX8-qJba>-ֹ{0r|Seǐ8V̵;d/+84C#7vi +B?"KM]Ϙl(9Qg76^KtӋvI'^ߺ7RيaX+NGF +5c&T]Zm-jƥ q[r&w_~oLM;w_b[t5[tiGFmSΑsO%E*߮{B^ b"Gpo{gH!/ur>!΄e^!z皯;tw[Q{2;~pzKʮG\>PQn$^oxUj~.f1"}[BH^8 S~ܵeI[RT[DwTq;|?GP]QW7ۭ^_l? t̂_ـL~vGH sz|Cwz}}~#^6&wpT=1ž+mooΛMh“?Ogn$ʑ<]؟ć7>5"wYi3ОBMV<5&xQ~k0$(OEFZmC?\wB_=gg=tO,ޟzv‘t y6'=bz(1uǀ$gG.XAGM.$ѥ0oE0mST*յ!T[аBJOm`VgbD]夶[GRy*k횟LWe(^]w>_&bĆqKm~)҈In7[lj6vד bLj.]UN'*2KjN±9[%IzCV<|Vg6T2Aϵ 5cKv!g`$.8\aCrюɒǸv>Hrwj!W|'^Zb=]I&ۑd8(LчF:Љ_7? 2㩥9烬iHVY_:~ǽhn2{ʝd~O]'DO'ٕ6voy{4 콥Wԡ xxiq2j>~)B +r9,fJ>!qMgJ 9(.ńuJRN2T4Eą(#2L4+ +%pr`rrҺGz0u@>HXS.rN_{N 0ͅQA- I6D14iceJkj)bR*CQZ%=j)(JwsuvdQhIT-C=۞2h +fejgxh^>>ӣ?$ĕ2$jr9kKJWe*h}U$r&P6;~S.qYV)[u'\{Ug;lB2V-Bl> +endobj +749 0 obj +<< /Type /Annot /Subtype /Link /Rect [ 101.433071 265.954475 101.433071 247.204475 ] @@ -9508,39 +9579,34 @@ endobj /Dest (cb169-1) >> endobj -748 0 obj +750 0 obj << /Filter /FlateDecode /Length 3991 >> stream -x\Yo$~_1L~ p"N`A;Y<+vH -WjGXGge&"O?Ȥ@W[l.*kp[bBɤ\LJ]m{tl8NXM)QPX,^a`Rr!*h XƂ!sV\rX +x\K$@AFc 3kX/*U3;d0;]Ue/-lM%E>>Ȥ@W[l.*p[bBɤ\LJ]m{tl8NXM)QPX,^a`Rr!*h XƂ!sV\rX +C sV.YXÖ%aʃ ³D(=j; ׀ciBwb5p( "pWܦ1 e A4,MI)jX OEaA" KANakS|$Ys$Y2hX[M E R԰Hfraְ | Zxљ*/g)+ 2^pIe R,8*k< YdkXHŒ21ECc=8~zAW|[t<]׵cqOWPV{j!s=2jФuu[`W]kKNֳ$msA[Rtef* 'bwkZdl|届rdde?}cg=3WY#5օ1ydcZ "c'ō&[OmC ߠ L>b8bŊB-mۻ齝 X{b4 }^^>_>b1k)l%bPUM)~Ys]dL W/7PSF=?v"_d&G\YTχß-,J㙥_m- ~-Q vYtŅV_ b#,~XsY00˷cD#Qk{3~$9/^s*oJ_6sIf ښ5) -eZLo36\iɓeyY(riW:;icrXJgc",S;KlAS^g?{LD~'Scn.S'h+fCTtyl;݇ǔ~-}Py, 9BnM~L8<6Ƽ۲OYkwqv9M12GL4 -[u1"7尖B>^]ff,6̶R-ˣH<$78^4"F r -,> E;sDo*ZǯyVw%]>C{~!wWt8籢lvHbW\{}Gq0Gg &@:ɭ;uE9|M1׷ލTGBY讫qڞH&:ݺuno5IMM@ m g!GFl}l@'8F6^1Lm&[kocZ_@̦V#C&9\_&V9YVOƮdy!A6~]yn;Ή4M7ȎY> ǎ39ld;|#c=YL?IQvc8( чJn}LNJ[yh~u۳ewulݐgO&/7E1؏Dt< <چf ݏ;754Am0t8]7]gpxi27a/-NTb -rp|ĕ4.\vSG\̃r 6bAΓtՋbj2ŵ[SK]qVzL1?̚t%yWY[y-ٜX= --ν;GKhsvm2xGdJ[8k,{YZS+!6&|}!,HIȓ\WDZd a{JV^FΘjQԻR4; ׀ciBwb5p( "pWܦ1 e A4,MI)jX OEaA" KANakS|$Ys$Y2hX[M E R԰Hfraְ | Zxљ*/g)+ 2^pIe R,8*k< YdkXH:/εg{>WENʱCECGO2 3Ry͇UKXuo +uo"BnQPp5~͗2/rG<+e OOqUGIׂx78U廎~i};v7o|sU$\?o;@zGr:ʎu?}2`s<׿I3x`׿q聈'B[[ n-~O ߍyvF[in7xcũoZv&zѶhIF{M#|'Zs<4.T J*u\ō9=,BUNj?EqVi;^Up"Uk;';dwUHbQd|Y;[:O^Ӥozݟw]w?US,-sjc^ԭ߯?1XJ~ׯdϋ|UηkOXN7su]7_+_iG(xl)?gr hS;y:dY\e4}V*-=cȕv<[F-"ϞyqV:.=&W,~134.,u^Kw?<\1y؍}>w6b6Ĉ@ZKǶ}lyLGǒ/t{y>䇼/cSl̻-XHoCd.D3- Y0]7-r\k)Le,_oblI/ٲ<SPLrEӻ+)b pkҫ.Z?yJ^ةg58[‹3)IqyEq+:Xo'N(ᚯDN v:'xC{|bz,a}\\Tsˑ{}8L} k2 ݭ[w9fVdpm>2bc$:y1(dl6٪X{|g}Çj}A3bmn{x605Urvb0=+d$rF׏bqNɔ}K8Z?p|tFMrlv%6L3s]Blz(!6%Pv 8:^%[O1in7yNں4m%iR16T.uIҩ}64c3;5yl!fHەN!juw*Vyt-MCa>w+ae:#-Y})OvΈC~: Lo&iN4ePSnl4yG_"t O`܎>$r6;y;갦ieS6;fR ]cꤲ.D:vؒmNkX9 9tS~ؐ@}h's}A;fr;n.owFbj2ŵ[SK]qVzL1?Ϛt%yWY[y-ٜX= +-ν;GKhsvm2xGdJ[8k,{YZS+!6&|}!,HIȓ\WDZd a{JV^FΘjQԻR4> endobj -750 0 obj +752 0 obj << /Type /Annot /Subtype /Link @@ -9551,7 +9617,7 @@ endobj /Dest (cb172-1) >> endobj -751 0 obj +753 0 obj << /Type /Annot /Subtype /Link @@ -9562,42 +9628,42 @@ endobj /Dest (cb174-1) >> endobj -752 0 obj +754 0 obj << /Filter /FlateDecode -/Length 4874 +/Length 4871 >> stream -x][$9~_QHk| $ $#!FЊiEZx8/efTeUM0%t昳WJ)@wOZEX]hʛ?Up~;cs9;g똳U9k_EN+Xޫ+!, diϊr bI`%(gea!1LQ` 9ZAM3^(=H V%^*EK(aA KE/a^$aϐ1C, dK<YdKXO d i-aA6 % .9Ldo"mv(aA&ᢈ<) x$d$,!p$,xHoF1]$L@ V5Gg23qęČzb@{[E1g#I21kmLŴ&,٧9E`{f<ȌeA{1+Ŗؿv 6}zYɔwJ` f7Jdcᰄ:,DCHXI7[1|_ZdH283ed\ pw^~m<*|(#!/ArX -sCKWz'i5s#bSRu]se}λˊe/xa~Dž~h4ph}_揿?c^OSZ 4=/5MhdlqЄ9XM#-Tǥ+=n^*=k]E c0D/}:׉V>a6wßԜ ̈́Jy}CWX˼:O֗êڮͣNkCguI=c:6E]F_iv|q9couWdK|zlR0S݆e R263Mҝ _RV - #X1M;G9!ϣu -8hT(.[z댨{Bz]T/]^_~?P*ʰ)\V:WC@3g65l*_[50ExIjeɦ,zF6ӫu7mu;mW^-u];9g]wWkn1ʒYQNF] }u~%嵆(M0UwO8MyC&Ƶ ?/m,p8CqFd@oܝu4s -hr? -?S^|j/}k|#t2DV7kr֚P7b~;og rW}3#IX7M:~Han7,.2E5,od8[M@ܰnqU֛k(Z7 K*ggMMYaJp-mBꗓm>Tc a뺰}au2Ba -ZbEsOkpnƏ𩴑6kYtu.SUqìonfYg3\g2Ƹ˵袵׺(ȣgPF߽m[!X&+wH1-| nNÚoAz׾2\5Rlrr~9ݓZgi,y3^7u;덯[jĿk9X=KPeiTh<ߥL]KCM߯c|Ynfʼ:' sU^hSr֥D]˭ 򄝭K,~&J# )99%b&GLԿ-UuWwH焨Lt9wc2@ʥ"o3U~ -ǯd+.{mU!8g}E?C^bTƗ/{gAI2迆[!r@s`$pye+̛Mfp]mǦݷM.ёd[(Nе:jYPв/2w!g &u^7}h)C$8wy&1(c){$O*5MTV<ڝa2lmA_GcP[^5bh2$m<'(QBe\PtEG9gTf*?ou~{ȋ uJ/f:Xʫ4Ѧ|H&@[}Y$j͏DL{_/ϗ:O@)0 -Y4fb($#BqlxfLNXi|V/.܁Hd-a|\q #G/E">LJF}^rCI_|>ni3DT;s3/WLcLʜHD!9DZq&3ɬvo8:B $Uu"goR=kZ6صk_Qď<#ǤTPj_߽gg Xh4ኟ]~`N'{xd:_\-OVM> WWTk@־]A㺟!' k/ϭ]Nu[n6юlr"뛼f -!C6Q5%8`xʔk@y~ ?( Q|[b`T?N_ PjPFG:̩Y浅rLS(:d7#`C,F9296luD6#[wzR7S#~ pdw94R0[gs 7..3)o\y{Vȕח"j'2KիEv;q4HsxH6NOD'ꩻA1^0]YufVi:o/'t7ojM5§l47 ;շ}Bϓ@W5MΟfߑS3$r+'.'\mTUseK]2i63Ou -S_vQ(VhLo&NNzˠN7,F7LSyCݤq5:k%Q$ M t{鮱uRD cM6:!cLMt7Ⱦۊ<}z; f2wбm&>_N6߈і̦Z'luFgqPoVkG'~T}Lq/6gg ve2?Nt}{eʲ[vl]睌w$O/hiA6i>n4쭤j:w&Élf e|܌ {tmp-lIy8LƖ|[:dad;gi -}MnhlsӍVF1 拹a2sy% 罊 -`jN}}`L'S] ˾縒3hwh妵纓3p-hu1DMZ-NVhzj2$j)vbP>kϳҕY ngsctzdhaݩ4JFMn{AC06s_~q׺9[sƟYTL1j/2X8彊 Qb bH1('/ YVq{V6XdѐXED + OQ JH‚1hUR\H +[JXK@ IX3dR[J3Nt3F‚d! A M2;4bIZ83IX((v%,2A y0!a懃m/asDdq$,Hr$,H Xm%,mr%,㓰 M0doZ$aAv&Bw<$Jxwv)yY3w1 !<"v?%Y5;;^և뼻XbQw\XNp/Z_cj6:]&>u}E^ݞ匽:]).)뱙KLҢS.[t1HuX 0Ɩ4Iw2tD7W=KfZq|((⺣:{cPf7)GۭnJi辡xA[g21`Y(>̊f[u6uz&c\.Z~Үzy,FճU~Mƣ]Ե449waVjks0]_q9;P>aO)&=0+lHƓ|2x%T]ƕ 5AW|Ds\Ner&NY޿?0q:N^lÌ*Omʧna;d)E21[aH4|t  QEc-JʁbNRK/?-tKgf*I䯌6|o5ka((~D܁e8|z;Q$dDGu_/<4?8e Af>CMJ1O<'?SrD<̙M:_0:M8ZUp:i>ØjWI3(ΠHRU'{-[e]qϻu*X^;A3|L:J {}[{vpրKY*itG&T0jpNp%H=d[{/ڵd=YzB :uny^k}ls&'2n~kjr?_ksU^S"C V+}nLɾ귎H%FCQp u9@o?etÜu~͡kIo^[)jt?%쁢ӪAvC? :?b4!cˆ_Gd?ᙻuN.e`p35ڐGygC.eoYi uo>:ػP|2cmnTjƕC}B_Sdg}^h_ҹܳD4²Kv"OۖѫC<٠g u 1d&Mwδ/?#j=5ɳz6)/e _oS(oB0m8:rw'K[Hμ#& שM)5+5K$_a_`,A<8o'~`f䤇 *?|l4~.P;|1MW^VLuHߴ0;*ڎ/~p~_A[Q'Mx RϬ/RS2!&J&:{u +BHiJ<\vdi'rNG,15wZS +0YOytIP*;_TU +䩠 endstream endobj -753 0 obj +755 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 752 0 R +/Contents 754 0 R /Resources 4 0 R -/Annots [ 754 0 R 755 0 R 756 0 R 757 0 R 758 0 R 759 0 R 760 0 R ] +/Annots [ 756 0 R 757 0 R 758 0 R 759 0 R 760 0 R 761 0 R 762 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -754 0 obj +756 0 obj << /Type /Annot /Subtype /Link @@ -9608,7 +9674,7 @@ endobj /Dest (cb176-1) >> endobj -755 0 obj +757 0 obj << /Type /Annot /Subtype /Link @@ -9619,7 +9685,7 @@ endobj /Dest (cb179-1) >> endobj -756 0 obj +758 0 obj << /Type /Annot /Subtype /Link @@ -9630,7 +9696,7 @@ endobj /Dest (cb179-2) >> endobj -757 0 obj +759 0 obj << /Type /Annot /Subtype /Link @@ -9641,7 +9707,7 @@ endobj /Dest (cb179-3) >> endobj -758 0 obj +760 0 obj << /Type /Annot /Subtype /Link @@ -9652,7 +9718,7 @@ endobj /Dest (cb179-4) >> endobj -759 0 obj +761 0 obj << /Type /Annot /Subtype /Link @@ -9663,7 +9729,7 @@ endobj /Dest (cb179-5) >> endobj -760 0 obj +762 0 obj << /Type /Annot /Subtype /Link @@ -9674,45 +9740,43 @@ endobj /Dest (cb180-1) >> endobj -761 0 obj +763 0 obj << /Filter /FlateDecode -/Length 4697 +/Length 4696 >> stream -x\Y%m~?< %Q`̃qAzܶ 0C~>JKU3۷BQGJ*{&|e_fkr.)jMe)-q2!dR . n?:L)p˛؛S -Xd -BTX 1BbGV\rX -+C #@ ,k,aKH -䰎HAbN`"5&K4&&jbb!k<,xLIE'Y\N^%⠝2dueY(xśP2+QNsLޓƳئWyXQ,BQy%xrCƏNrVV[ sUdk"d5 -2K  g -\ 5p%%i8ɂ K!rUd5,C^eXpTxd 1I9 S*x`vjXXI!: <`sxgK0p{Tyax  2r`V 0jX[1.gҰ.kX]T^2X^!h9 E `(Cj4=,X s^4f p?eM%jX6cT^16AʺhXpT^Â|f iXSkhXRykX_AA  "0"V R԰Hfraְ 39U^& RbWl5,^d,z F% x5,H`hXWdCd,dAa"]հ ;ȂhPÂ2v4,^xLdFBE LR<а#a6?lb aANYÂ!#alSIÂB0Y8xDta֥7)(ͤaAa<Ȃ(&IE -kXPbfְa#,ͤwC2i<."ӨanDd 3eǙVȀVI=3 Ce*c"&,OU9$̜d˂=([|ӧ_ՓcalK]0+SۃY -,+UD/U1RbZz&bs[!HmԱcl,fG]+}!idM0IMoĹk}P&u6B+|W:/Nju'Wv !+_EA4 H[~W8r7=q^ž׺M?ײ?ziZ_ʕoxi/IVc["S~fˬo?nv"BUV^6oa })Y\VUqVFxdcQ"ױ%ǍvǪ[rtMc':w2Olr7J"Rdei֧kWM״9-poն e&۫핛qqsx^o>}}A#k S`1,k`貭9 COWב"JMQp &@KK%v:/'xdӃH -6o]ލ6i\\ ٛYhMx-^ö=J,k[ -laF:U|Gz]To]ޘo@V<@sa+<K5oe],oۻ: `=Hg(} 7֖R0#Lݔ:_"D"2l`4?[rX[ă&׉ڝ@gU'3ӎg}:xIr\O}WBGZ}纗+%h /2WCᲈ !~?L-ļ3&8"hB |Hp:.A&@5&: q*24宆CO(9e0lXƋrB ߔ4TM4C-6E$ʓ\Oocu{B -#-n:Xʛ)ncu~9%G%"Glh-6CdSNy9ǙǞ/WL$BY2XxD1",)4,+6&3ɬۤ~+"9Tk#u[J6jOxC g}]>^5% y`E!eJZG¯n{+s y4R)]S:$G:Î\h/նgX&|RZBulzAd<yfa[Xm@P{yy#3"W-sldldȼ0'k@t0 RVS୼G=JS|Q%d.9g+vz VI_>9f ( mSnVݗq - (bݼV3Oߛ)SRyHӪ+kfE\uso$-ϱZP5SgV)m.8R@&Mt˱ǒ. 캻݆=6Gկ[9ߡכe6 :d6ka}j .y?&&1q_վZ>&qm}a52\szΘj&HYklݿ}+xhMŃήEMivH5rnIvݚ{ldMj=o4|f>:kDGy^:kva]]ӗFz˖C|lzT}Lɻ__mkqLkdxe-2:L}vmn#YwiL9ly6gxqlxC$9=ݲfe@sl秉{m+~vslvS~+➗rxȒ=(ɀ[߯/ݥei\3E񵩳enϛФ|msMQLzC^|z<ךn°9mx楬;8]o f޴<$ƿ%ea~Z/UF#C&3B tQ3#YFOƮdl.vQBl28hpTK&b8in7y|桫.b}Vui[ =]ǂZSM:OBN d.'Ӭ'bnĽ\i外[[ }R/G4?DsWBLmNk|ܒ%sMyw ^NŃ~ -I)VPh7n'g2ꬪl4ya]_"t OMJ>:1F'6;y;갦ѳ*N/ySX^@P'MTxR{Wc[Bީ3Ltq{}mi䌥1B 6:QshNp5Zo15Z8ZJ=?Ϛt%yV⡬<^|liFKfڝʣoc߼y4 Ҩ%_¿W֎T'!6oQK3Ԕc|I0qFsx"J0d`qZ!uH)@9 -0w:Ml͡B6VQ> %DWR?ꃋ]D +x\K%qޟ_qD 0@&0!U9|n>sFx.*>WEvu3+2[sIϗO?Ȥ@WKln*Ml ? +'Jp)Oow;?7ֱggJΆބޤU"V&%Š`h,;>Ƃ\VXbxNYbdYcA [BRX uD*w +51WT^&71 Vc Y1d %Xfx}N/B=?{> ec`_r^BPgY""$|c7 + Ejp7c`1[>>_ I;${m)MjB #]Suf~4YeEpČEW^yw>^<}8!wӤ'o Y~<}_N. +Al@o`׿q聈RDօneD( O?/RhǓLSMr^K7q4[f~7wq>ӮʯB\ByGSn(p'{LNi mR*%ڈd=0U>4%KbD/`=nѹyRecH Q٤',Kհ>}}\E8 hҿ]u}ia믶mp-3^mmޏߗ@~{zߍ[cpN먍aYCm}IzbwPo1"8_Z/!tcLw5y8cl'DT=~nm6uY~0y{̜Ōڤzy5lkأIJmYeTϭEId4мTf+=PU򶽫Ӑ +vctO7~7ymm) 3tpM%B/b Cp(aA󃁸(иL %>I<_iK`rث tqf`x]u~2;zSi$ \m1%y*٧{/!}վw{R["w5.+mλ>ӮB;a#&Y,p0ȇ4 `/jPSiRlCO0wrH=(CA;^j8dSvh8 +5m('MIC9܄N3t b]IG_yhs269|%jhaޕ;r4^== ˍQv:E\^!I)X$ʞ6x=V^Qr4윾{~Y"B0q϶b3D6گ'?hsyrD<,%Ӊ_wM:)oʒHòroj)[k1ØPM:龹1*J?<[ϱtk>lߞ}XY^VR~d+j˯ǽ2xpр KY*"е>cIBx+i:\m| \iRmW,/Yǖt?A ݿY3 K'`%7lazHIA1r>> =#.r~>F&(|F s2D# i;{4sk1Ju\RSfpf `X7g#C撳~b;mScrh86%f}o7+k5Ҝ=?>!q:bnVd%YXM:wMFNbݲHZ%p \1u}n^‹)jdDL},Im Jos4Z ՛ZO{x^f#/πsLVZi#GϳGs4m+=d:?%k<e;4{Qϐ ^w:SQҔϲ>q65U5yicۿd^kX{31֧mo'>^Cm'ơZ&\s.c5ikfUF?ڷY<\fT#[햴k׭g&NDOJ÷m#PϯvoKtTyk^^_{祭6o-5}ldol9d͇؎zvGǔu>߶_ǴF\:WR+ӯm1uƴf=q!ms&?DL 햽vy[f =v~G6"g=Ƕo="y)率,ك2 ] +!X__̕_?#[ΑH_:] M׶|>$/Mq9ͧsv. ;߆w9m^ʚ`MLl{Y2Y1S/Vq &3f2,r<6M*֞Ԭ,A"^qYT'Ǔ<OQ%gn$b<<KmavJ/郡rxm?^Em4R?j*0S+˰K +5=edJv!@Xb%&3AˎGŻdi"#qg vgi[YEЭSU|,5մ$TJ >O +rR_Qk1?͚|ra!fH˕VN!]Njg*RyT-MCa>w+&Fȷ-Y>ה'q$類a`fz3Ovra/Ϊ*,F*B + ݤnt"kJ鱣k={픺7ŏt{鮱 uRDO' cK:Y cL&M}CrT΢=v9v|ɩϸ/ty{7:6ޓsduo7:C0 }Z;:WXdǽrnhV>5GY({?/0,~QG ױuC=|>1?H)6b_6l(5t?܄<Vv;Dvtġpxi2;7a/ xvG +7pp|ĝ.\vSE̍v 6bAΝtՋ0vөm9>owh姵{3-xs3DͣZ ̝rm:mhhdk:j)bP2k:̳ҕYnx=Z= +91:%{,Zkw*ю}m0xGdJZ8| ^Y;NR> endobj -763 0 obj +765 0 obj << /Type /Annot /Subtype /Link @@ -9723,7 +9787,7 @@ endobj /Dest (cb182-1) >> endobj -764 0 obj +766 0 obj << /Type /Annot /Subtype /Link @@ -9734,7 +9798,7 @@ endobj /Dest (cb182-2) >> endobj -765 0 obj +767 0 obj << /Type /Annot /Subtype /Link @@ -9745,7 +9809,7 @@ endobj /Dest (cb182-3) >> endobj -766 0 obj +768 0 obj << /Type /Annot /Subtype /Link @@ -9756,7 +9820,7 @@ endobj /Dest (cb182-4) >> endobj -767 0 obj +769 0 obj << /Type /Annot /Subtype /Link @@ -9767,7 +9831,7 @@ endobj /Dest (cb182-5) >> endobj -768 0 obj +770 0 obj << /Type /Annot /Subtype /Link @@ -9778,50 +9842,27 @@ endobj /Dest (cb183-1) >> endobj -769 0 obj -<< -/Filter /FlateDecode -/Length 2687 ->> -stream -x]dϯk咪!1`EȐ/6͎5sW}t;z9JJ="W1J9aQ׸+'Nj.J|h.r6z(o?~o/՚_7%gDUD9DT; V1[gUVKd*a!*0C-{}VU7LT^`"TCL&=1].*e|LR6=UR *"lLt hR:JV˰%`v*؂UHtU]Ō*tRry.Ua:]TGaR&[Ju%Sbf:p"j.xkhޭ"l !,>#@HErb%ƀA uV0 -R Fgf] *%Zb$P[ KuE1h-X -[)cXI -ޚX.q$c,P [2(`'cpX U+@]5/%l`ѩ/X`zɌcVa&JwCc,0p7dT|P C`'7wX D=tA 20DpWħA+KMGu'~Yv>X]TX]0'j`,WLP "c p9/غTWR " ,N -HBua#y PƂx ܕX]1=T[5mO#Xu@ -wcɕ d,H Ba,Qp`,H\91*!䣺PY @XU آ!0[20 "p#lvD +Ռ DŽ| t)k+X9Ş+pz޵pf@獱 WWa,QJ@dt f,@ %D%dI pB#T3I3 cAZX7A RRl& >-َH~l"͡:آ J -, {囙 -lAXP%&3Љ0T_oc,_|0THVM-̌`KDBuAS%~ &!.PX0&"zz%PZu+t."XMD,7fg\YZY荁g+2Uw^Ld%[Pz"'&OUv83Knp Ct?rYMߨv܏;~ߔ?lZڍ1ܗ7_u8Ă<xb9eQ226?`b^g㧜|^Gripg|uiRoZl=`qǣ~_^{cN:m+_Mvgn{szVϟ;_:~9z\uٟҗ~W/j-cz\¾ֈe7y% p8 =Ix^Z8gTicuGdp;s?={oxpQݑq+oyh0/_;"$hٶY}^-WyxqMo[(6">S܄磌w!occMdr>rgcopĨڞ?:&BLYF/Οv^4LAFRpֺᯊ"BY`ߒ1ui -e{ݐ[}ި]WEeU4cAl]7"Z 9˪Dlԫ]7Z|[+G2>Ӕյ'}Nin.>"ũ@_kDs߄'uCPoO3'+$ -uyeJܟSf*6ȸ{*O*O:f[u9=Η/B7c˔-\y Rb?v7\ҍ@wSV݉q*6{,e)NUNJ{{=߅`Gqw2Ai7;[0@a'Fo{S,?N'c'uqۏ1T<$$HW(_:.yqw$kzAp" `}uc a2kAP?09\alu aG {fGQЍ[:Bg)bJ\g:2&1oDK:n> -endobj 771 0 obj << /Filter /FlateDecode -/Length 4233 +/Length 2686 >> stream -x\K$9ׯ3&a;V{`xI Bzkw@i gڎE;?Lw&|_aRs㉖ ZEc9q^!}NO_}wKɻx3EU" VK>&܂%j Fk b`8pdUc1\`9<B<'ݒJe\/%evYbx Yb%g"d,dPK%@&ːC;*&P"gjXb-&G%#S\b ,sKoR6x$A[Y?8C.ňV/(8!Md- PN % | W.\,.s`׸p@<, Y"' ,5y%T xȂY< Ж--Su-K.$ 7@.\ZXiaA"ܳbn,,,,`ni \ 0p780pa-,UaRBlaw}` 0pG,ڹ>}hka{|-i*?#V+5YX|&..CFBˋKZXب ,‚u;:_‚E-,;, Gp]WXX%oav -,,/<‚^-,H]!XXH{Ld [X<HV@ -% [<.Q$l,_,, `oaA*ԜxHL^Zp-,Bd<™-,@bPCཅC  #XCmb Y)ZX$[Je DŽz Zx/%M^e r[RI,,9 WȂP[R<2s l 眅Cd_Pe&;4jI1IY,,(I-,@R<b;ZX&YBd JRn J,M7 2> *Ed YXP]Aĥԛ‚&J<#nkHRof *CA$MՈ[`MKW$fiMd@z3XL4YX ԛlڞ1#?E*b7bo5 ؋*g<4,K2O <6 /1>`z!c,YY~Yxz>Ͽ~(A -}?k"?\^`kb;hIx㞎4!Z+Vȏ' H1s:MLsI+yTԹ9Ԏ+cjIW=G7CL4]ۛ[k )#[?*5*krXlPe=Yĝ Mޅ4Ow1mp!] &4eLڅB:=ڱ{L]_ ڙk`Au)>ߏ,XX)bٟS} -d/K9O)~dE8Y]*n|uˁVUJT}z_ -^!:u#ߓnWwysYoU!'vW4|SGˁiwysy5}Bޝ@|V^KӥQ/wN?Ęޟ9\K 9a54nl^*9@5B"Sg3JnLgoH[+:oֶj ~I~nt5[zPmhӔ}ZɚZ&::%s5|vl.&BsëaQL_sIA"&w]iMm)9hE?'b#S6.#X^V=791 7nG.MY.j~]iwѶnx'wzl=xS6v8߯_зpRk}KWa=ЦҰ)? !me*m7ݭ#{ ^_k&;[v=<_oM\25˜7kzS_/&V|ZP܍e6|&XiMǧ|8߅#c:/]xQsi_+zlG/橓Mikӷw8QnonuǴEƭvW%?[z#Nnj]"(3/Rvp9_CrKU>jrw!W|'^dq'dOc) 0FG@'y[:q/6C>:r/o6_qO-Ydr'Y׉#lѳIve>ki{o8u~wAi& ^8ja/y@ -z9,|VCJ-\#.T)NLqH=PAR*0yPC%*Kz|k/l/qTwIz/p^ +x]dϯk咪!CpE` Mccz \9GzafG=RU̻RjNv~>nr|5 +Ų/@5. kϯKpMerY"QU+Qr1UC`FYa +fX +P^Uf썩`11@t>IOLKJu:өGtեba:-g[7-%3]-T2l Jt`w-3]Uk1 +\uAEU{7QX.$Rl*K!wg[BFulAq1 cE+Tg9+@Yq@C< +l Rlj` *0–`Xa0(pkR=c&>1( 3@A\- V +*X.=3(1vJb,PpW chIutt2^2cpXUu؇{ŅRP GeTwC (`!1`8Gh4!e,y]P%iRcAw}Q]u>cƉbO2Dp2Dp,`É "'5Ӂ>Ta,.X<o .U'ƂKP]vH0v8 8+cAw%2$pW a-q tp[V]XawEre,Hn;6 RnP `C R1WsN +t.9#cA"EuŲ1 vUka,h9 \iz[]h~`"cHJ5c,1!ì2] +d +t>3lGg,@. +w-\b,yc,U p3- B=cA  cA Yf%1LgXP,*2MiT[ OK#c$Hsh4ƂRBK7 cA)%H`,lff,[1TIɌ8t" -,U&R0_Gھ[1ػs񨷷cޘӺiijݙ^E9޶Nlw_ν^:q]m%˟0w˘ož5bqsG9\&Htq,׼NUr~O^'\lw8dq!0m[0LN<;6s9tmֽc_G6sWeCD~\꽿w;--=߷bR>cӲ}=%FjݙN:K 7Z4|GXdb)~<—6-;. +e#.q~7(]ÃyXٿu\cDf؛1j襶珎-ы]g) S!/|lbP8XǷlL]a:u~Y^7e9?%nV7*mW|U}vu.F!XDD׍jbj-Q:o$jGD׍;JQ̦4enu-clSۧ{qj+Q7IxۓLj +}B];E~RT58<2ެ4;i9Ӡge|cϮ勐 ;2e؉{~c.h  I.5wi{tA-`x=ڇ3C.n-؟b_fw8CXxmL~*sq[7x]f&~Bx}޵Q>8t-V2u:JZyCkaiR̶!N7m] +m}-%hE:.GTAka}zg1wirФCz[c`M:ǥ}q9zisƻt=AtZ]aݣfgvj]vi?(. .oݦt6ӲY#י몌I몤ђ(9ɬ9bBdim=6kj=m} æ!iF2ŧ_Ŀ/íտ_M#jY<&%%0r5|Fߕ=a9J 7(+Wͪ! xʖ_BhsKۿ}i zK: ݯڏ]2| endstream endobj 772 0 obj @@ -9831,13 +9872,45 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 771 0 R /Resources 4 0 R -/Annots [ 773 0 R 774 0 R 775 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 773 0 obj << +/Filter /FlateDecode +/Length 4231 +>> +stream +x\K$@ AaV>̨Ȗ0]Ǘ9U΄+RjN||8}<ђ#_kho%J<BKt~<ΎKg_jM%) +`b\r1,V1bfGV\KX/@م#B [,jpAb๸$(=Yb  쓅pCf6D;,X ߃烅lHK,,]W1 Z\‚u3yuq7Z^\J‚F,,]g`GD ة-pJD.haaqH,,8뚼P-‚,y /T$&//p$gax!$.jaAR ‚%Fc K(5!lFRX<.9Xwr we۴ e!ba\{ R,,HCg҂haA&" Ala륆Z,,-, eRo<,p>`ȂL R*9&cЪK~)pm +x.[X3/؊HdaϱB؊⑙[<Yd[XL<,,( *3ءQKBIbaAHha&A?(6Q<"[XPrXXP +d-,oJ-,YYXP)-&[X‚ +M .,@7Qq[Cz3[XPD(& iFPo,^,5%7H3Po"7ԛ<. +dx]d\Dfk,RqĀ{yd@^V<3 HDeYyjmLG'}D{fɲȊ`dv6uzY;)?Q0 k +k8A!(&E~ 3"to pMvjш"#:8=U]it5CV)EDO(P^cmt渓%^R޳?ߧ|/ >3^r>S%)'%p?ULK+ⓗ孪|Mە~~c{DR@Pr"WX,Ϙ'иyylLwf,+-3mI"m߭t][c9.%E/!ڿclAMSnim/s&krj,^*XL!wziY\dlNI FfsF1m~}'uu7uܒ#䠹X‹LD`5nzYt/t߸I[4ei1ևot+;UDۺ_a?*qg N]͟\ z~|^BIq7-]gjƆMB>Kænt'>s3XʷO8zv#.!.lx}=&|oMoo|6qx/sVz|rM}Ń<WXOiYw\BH>ދg>r7:d3o?8$?)ɊWg";.q_S)uV?yњx3t{wr\&P'촂uc<ң:5)Gk;{:'lOAs-;{::{뿮FMn!ΝzOE5_k?G^p>tSoZoHe|MŃ_#m|覞򵞞;GjB۵{zW؏<7q1[z,!=ן UN~!y(*5}6tgMi_Kj~Ÿl!Et=H=4,lg u|hpxe_cHyaP(g-,ؙ~Z!m#l>8rmJn9XR1VWyD\ͷQ->:جub]×fxJP@, Iy.,ϣ +캙\S;?ѳvh `&u e /~)I~T׮A J:a'$oSaWVWbģ] dFRy*k횟LWe(ޠ]ԩNWпr`0lME?/#'ݳ{l'VP쮧A;ȅLj.]UNgn* +/KsjN"9{%izÖV<|V2 Cc;R'u,3R &9W~ܑqj1YrwGMN^0*K,_$ivs2E&yc#h$/v_gY;S|^GgYo8fu4lݑN&o+wp8F=+؟dWfؽa+ٝ&n \MSzf J#z0Mtp2yang5$e:BK5aԓ ՋMd.u sCwZ[j8 =0;=icvDN=:}P5u,Lljhi9ڃwjhT셑И.*jݶQOʝo.@N#.SںuSKyw騭2Uҡw-EyfˑKtA2tqnw۳ZOALiv¿Ď8ժWkWQ&]*)CX^y[?L0!PvNd[G0 5T_ݭ)טRvB;YJEynȫ2=0 JQY +endstream +endobj +774 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 773 0 R +/Resources 4 0 R +/Annots [ 775 0 R 776 0 R 777 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +775 0 obj +<< /Type /Annot /Subtype /Link /Rect [ 101.433071 488.554475 101.433071 469.804475 ] @@ -9847,7 +9920,7 @@ endobj /Dest (cb185-1) >> endobj -774 0 obj +776 0 obj << /Type /Annot /Subtype /Link @@ -9858,7 +9931,7 @@ endobj /Dest (cb186-1) >> endobj -775 0 obj +777 0 obj << /Type /Annot /Subtype /Link @@ -9869,36 +9942,40 @@ endobj /Dest (cb188-1) >> endobj -776 0 obj +778 0 obj << /Filter /FlateDecode /Length 3943 >> stream -x\Y$ ~_,K"u ?8`x;0n{lyGU.1:At:(D-~?uٙK|<=;XOmJ,'\9 -I%9?mw]8򣰘L)٠ -X֑ -CTX,1Bb{V\rX -+C h*' brr8oʃ sD(=j'x xh( Y`]YAxL(YlNy6s&[ְ>PyI%h'7p5,`g5,U. $djXkX `aAlJJQÂX,xT^4$ Bd<‰5,@`m -aA򐅼װ yȂAD8DjzY`.j~@2 )DcЪƋVy<4,H bar)K@ kX -dhXd\9Ȃ [D9aAѠgdjX$TJ5,Mi)UdLhXd;hX&Y(9{I79CoM7BD|VÂ2M/%7)~[(J4,( YBY4oI7N/B_XÂY7ѫ%,fRPL4jX 䛈lxCB|3dYX@o٪ ,URk+9Z4,sT8VtV-X/1aR}KTpf$,p Ftsь.4[ct O9<|R+e$El7 &bm/EDHekMDAöL]"Op(O /DnyUo5)qFrbqޝϋ+t޽ :` O}}^^Ӽw>/.kL-jx}@T|6hpx~{?}߿_?{ ZOx$7bx,<~y|Ꮿک^…ؽbSeDY[* G*^5HaD6~(tȄJmU?P|2O+Q_WqJO_xqb !!lbK6H esgޏkq~^WY_mXbk1NlvO7ዖj`Q7]m/iE|y5g:ݏIԅT`&;{]*̀XWm>!۷oMڊNͤN[6Ϯ3I~9Y' dW%$vWyW 2lekV  }m)KVlI 8u^Zl_␩ᕾ= rkk_xxkoѐջO;/eƋu$=II~kS9H -gve8xhA2vb'UuuLHULͮ-\*VL,?٬b~7lr\m8_?<߂|yǡ< G1$HswIOx<-pٹF6-5q79+MŬV' ;֘{N(WUvK 3]^87pڲU]}`'.7ktMOvzrOg <~-Z=d&ܴK|=jc{Wp|lt.eRIG.#wDԝ}>A=Ma "M+,Sx),maSIӝ}>ž-e9#?b'(Wu^eQj"7%ozV0XpTov 7j쎛m!\G$$mUMr|\!YL{ 2esi{B=8:z g2ghkmۻC[ȍ8/#ATrwĮmu =zf+;ɽ˓]෈wm%g. %:V#xA\Nw)-LH$\Jh ̶5z2BDdY5n%üz(HXJ'yn;oqMİ'iAq@W].:7mkӴ׈sJGPMvMBN eNmC36]1bnĽ]i頶[G }RoG4?DN+^:ɷL>bݒ%W{md7~G<wOCHJ0†fz3q;9a/rS\6v@ETAq7)ye\I7;y;갦iR6;e6Ie=&T-ud36!0 nʏ3tW Od;ȱcLN}ǝNCJ#\SG\̃r 6bAΓtՋjx5DS#04>k%H3a; kt(P+nŪKz.>?Tg~\ B2I(_+Ef6dǙj6%? +x\[, ~_1WJI !B0y8{:!?Ӛڜ$TJJt;[~'39|ɚ,~jEeW +gg9J(TO|Ÿ˵Oޔ ~',&rJ6(uB0)VtK,EcA 4`89: +ɱƂ[ e&\0J;sE%\.8WL1dǐ%4^,1[YrxP$ ω4^,) +/CXWVyF4^!JfVy &d"3I*MIym(*^daj` z G `(ch  z8Yϓx%+8ZK԰ w]b\hX8HÂ|f 'װ wx]հ w7 `!аq%g p5,)lld`HNC5,]EÂܵHÂܵGA^5mFjRh ɂY*pb XB%kXuG>$#Ѓ,By.>1GTGՇx^GG_7_귿?<G[8",_>In:sx˷NPN.6ט*p%\.oҦ$,bx p#͆]kǥ0 *e쫷Uӗ_~T|2ᗟ/DYQ^FFO_xsb !!jbK6H e]{+>yܯU/~o3G 5e.cw&|rT,2 E"H/7s-QخClfTW~N.\s5i&R,:k1H>dcc{bV&v2l&-txuVh.Œrêܯک²ʼ~MG?o_rU&)XG8 +!tDZm]AR8s-;}\&xFz^6;r1f#}k.Lݮ-*] &6_lVm]v96\[0ηaG/s}8ˤ}tC$YznSeߐnu=;]ݦk޴n#vS7O.gU[|=`ÞB-ܱt[r}W_堯@aJ:Snzdǹ9fVvuNwnG?6a鞞䚭/g M<<p:v7Xa?Ikۅ.}07ag^u]]v`=' yyU}t׶:v-:eݯznw~T׮FPePCo96>)I!~nЌeA!hWz;t9haTZ()+˒T'vG,{cm^Sቓ| +Ii&VMo%2 g;eRSkv.7*S8&%̫9 @48Ͷ\JfW}l؎l'au,3r%.0LyGrɢ[=q'9|^i츓犆c;R6&>${;N9B&ys%wo$ߕN'Nozy +^>15rel縷-y=KdNn=/?.϶[8ǽ_gw;tA0u0]hLC\iq2?vo恽]R_!yKu9̓GH>/CJ#\KG\rLvbA Ջn\F%Mcv*&iXfNZv(Bٽ~7ch:&x:e_3'RyX g -xwBͳ[kIvbhƈ[j)bRj:2]2n?FD# +9:;[X2+T-ӎs~~ڞe$nMQZZ qy>Ɉ]"O˩lRyucEJ֙lr5c`P+nŪKzn>?Tg~\ B2I(_+Ef6dǙj'k Y endstream endobj -777 0 obj +779 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 776 0 R +/Contents 778 0 R /Resources 4 0 R -/Annots [ 778 0 R 779 0 R 780 0 R ] +/Annots [ 780 0 R 781 0 R 782 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -778 0 obj +780 0 obj << /Type /Annot /Subtype /Link @@ -9909,7 +9986,7 @@ endobj /Dest (cb189-1) >> endobj -779 0 obj +781 0 obj << /Type /Annot /Subtype /Link @@ -9920,7 +9997,7 @@ endobj /Dest (cb191-1) >> endobj -780 0 obj +782 0 obj << /Type /Annot /Subtype /Link @@ -9931,40 +10008,41 @@ endobj /Dest (cb192-1) >> endobj -781 0 obj +783 0 obj << /Filter /FlateDecode -/Length 4519 +/Length 4574 >> stream -x\[,9~_QHc| ߤ,+!v@>5 ԃ4/efTVvO^ir/pp3U+R/?\^_*hʛ~Up}MqrgۘU9k1)FVK'W1ZV0 -SYbA Ҟ!% kJQ4nFC b2rȃ Yg -Pzx֨"/gxΩx# -!$"- %^,.8- MIY,^,$ HωHetiϳ+aNH! -< YYAﴕx~$p»ୖig$,Fy/! E A^‚A,Y(Uv9IX-dqJX-dA a" oxY`. "E d*e" 8A/X"Z%L FR؊8K8\bgH‚! \ElE*YD@  ,%,H6ءq%i>g& šp4"&$,aKX8<$pi7Jg{ L|Lb@z=V1eح3_>#Ie -b*Fi E5(:2_?I[{IsT,XZmIN炷kЌNy_Eq~Pt.݁-1fnH[G69v~1O:Mx}]&ֹ6V~ 7c;F)r,zʄX=;$P|Ɓ7$J_(H?i0-ym>Nʾtn= \4/%3pA2pj^/%FG K\-YnsSP%]a7f'9ɗG%^m6c>K Yq=Oswb" _QdbyCl~4ryoيH!Xg~>iHˇ(G*g xrRG,Kjvr)#[+'r-w¼~2-d멊i6:G)ض`itDkkTJݰJ&ɺݱ*ۓq!v_%~쇆wߖ_ػގ%W'65zkEC|rǢJU} K,sefo3~uy nښ[Ow񝠇w+<^cn_4͋)8sm>ymd!oAzlVJ='X<|cuSͽ=OqcklZ6:cCz{zANsDf_2( -]Gޮ?bJC߉c򱥞k,+:L˻FlC\Cjo\y6陰U{Y~57t-1#?(CLߐؚ-F-3To+zz!y~J\yл(ez;6o'yV7 r=9K(2t 85NڑidbNzZ,o৤wfMZ_L&/+lt!' -roBI LuLzhKyl[yq?S\Gm?ZJUre`<{L%kr(>4A\wt8>$'4 [j~m@W].:3-k㴜Gú-EgZWMVwʝ[; I .+ݺ&,fOƏ/ z EW{}bF4?DRW@Mwx#n5i#.'GX}3~;9a/SS^i4@TFP7)~(A7;y:ꐤj̎c6;$-gVIe=&T5td3Q7!0 n/+wWd;ȡcL} loec-M?Aۍ& 0F_ -ykG'~^8Lqo]6g|#8/X,s ~~>o;NƯK'zFn3-M?&YCǭFs=4AMD?t8m7]kܤ@m6c^M8~D -y:(scKN]Uǖ.٩! -s(N!JL6yzp'")=j|rNKив2!d 6%, 6IX`+aAHrA‚5xD^PD dX@.,BCDP%71|Z`2e]4O<`\%}mwt(`p +#r;ԓ}]gzϻˊ +SrB>jP:6# uu4i:ݝtίp}]gzϻ8yi^ Sy EWNlw\Ab?"#^$+ he9 h1HVHNܤnAtlӏ}0Cm&7f{W!Tԙ(x +l#jBHorM_ЩNDhk4b(@|b\ e?4mgͣ/Rt. +`iG!o+0\ o<ЌNy7բȩ_m?*xwb?fCL 'Ocֹ|k9h~^c}y>l"nlz% O,-K0Uf-9\P h%ͤegE FA_-ן믛l +Nĉֶm.lͺ_mnnIwrbHeъMdoQ˱^԰fAĿ}8*}u=ۺzd ovY}[fcO5 f2cmgxMaxrkW4gIv6uaԼF6N%yh7,Q eGrtO=Rv] ?4!.p[N"g]b*{iYzNSxϕ.Kw lqۼ]G^>nȅn7^vX7.G4ծuFOȰȂxHWd{'2#.( u 1?__uy[>1myaޜhcXKx=G1Ƀ_1iiW4{e}:Sm2£"ߡ-S_iҷ΢X% Awcʫ i|1V m"W첆vR7-áv}FtGLӦ0yk_6J>ҰNxx16h~x7z4LkmyHo~X8v(Rq^.vʄRX=];P|F›`W*'7U@@_Ǐ0-u}>~p*p~&_V:~)=0}>Zq;}mR67* 5\bݵJqcmn_q+p;|yĉ{?Xg3GcjĐkl8wgy!6+Õ6)zM_ߊ&(MR9o'4,yw;Yyst&2­A6n#?;KBGpgyhf,?({ly|4+]߷54ml5;af5۹~&9ڙuuC\Μ-a[O(Č>ժ=My{Σ;V8Ōg3}> @ǵhu9[q69Pܖp\G~뗅o^)p5S'AG~/G7g՚Uŵ޸㠧u}䁙5מ鿚3Z7Vt-FX1=Pm>k^b[5>Qc?uѶ^֚=uSO;i3~?ɳz#*AYn~dS^PCRbvd6Xsӳު +LA{¦?^L&/6BN] ˅@&G> 3~},2qF]-W~drYo7GߺiIF|tX g0{2^+Sꫤ\ +] in;zn-5y *. b}Vq#iݖ"R;m];MBNe$nnC6], z ElWG}boF4?DRW@M-G~#ڵk2? +Znxx8/~`f䤇 jLMU$A*|2I՘}J顣I0GI]&nLB{޺klET6cn1HuXMNfkX9u "9}wUdL:vw[8}V6ڒSdݘl" +<`vt7 ɤvsyOgRse6\Gl[W$Wd~%a#v&dF[߬NxMZsg:ȶ5nҌ? 6Zݛq`/-8~E +rpύ#: +n:tpNq1i<$[9OUӼ.0/8fbjdIJA7*rh2S˜Or֗qaCC},7ApZbщFϓR&mE tc)nM-eIR1Š}ִw+ϻvmyvhhc$ܻSits:- aDzto¿gSuZR 1i5+r)`"4>ǵ}EJ晰Ke^ȏPr%NB)hU[YK]eT_8MȨUUjJ(_X endstream endobj -782 0 obj +784 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 781 0 R +/Contents 783 0 R /Resources 4 0 R -/Annots [ 783 0 R 784 0 R 785 0 R 786 0 R ] +/Annots [ 785 0 R 786 0 R 787 0 R 788 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -783 0 obj +785 0 obj << /Type /Annot /Subtype /Link @@ -9975,7 +10053,7 @@ endobj /Dest (cb194-1) >> endobj -784 0 obj +786 0 obj << /Type /Annot /Subtype /Link @@ -9986,7 +10064,7 @@ endobj /Dest (cb195-1) >> endobj -785 0 obj +787 0 obj << /Type /Annot /Subtype /Link @@ -9997,7 +10075,7 @@ endobj /Dest (cb197-1) >> endobj -786 0 obj +788 0 obj << /Type /Annot /Subtype /Link @@ -10008,37 +10086,42 @@ endobj /Dest (cb198-1) >> endobj -787 0 obj +789 0 obj << /Filter /FlateDecode -/Length 4757 +/Length 4800 >> stream -x]ێ$;}gIh? B< i}i;@1%2b9r7ES)x޾pQSp -JEQZQN>Y`3_.o.u}5SJhw";r*ATM!n1%I3\ C[UT0* KAۭ* 4I* J+ءR("kvӽ3z1$t:Igi%].J:-.)-lqHI:B6IaV:bb.$Aa ElQ^iIR$u :Cr*IM+Q$-^$`H: [?):?I\%` l[1[2H\`Jٷ<-> ؂LQ0yUIZEt 0k "^% `t$. T$.T4E\i؂$[di-qA4٠D234֒p#יQH~ʩ4&$.Ŷ,6u: FQaQF`37Id|$姜&K\N) XoqכQd֛X q qA"␢:؂) q Nz$,b>su>ޯ~=WmE -VѺ_{?6} `.獘3 ڜ0SգM&O`n,+^.ŊvGک1wǿw`~z'J97:o-a^䵜Kܣyo$tdy &>ג.1 dϬ/Xx˾} ?ŖRmid@nox?Sea\ڿb)Aah eY;xobm_?WJGtγ #4}\>Lg4Ѥ"wPeguUtQ'|tuB\u 8_sva~[{s5gV߯Gi6j~GdYz+Y"EY_}ba] -;Q6y:O^ONy:4SkI@G1hu*5Q{/?7桛6D+-֭Ξ' wyӡ81٬_F<1p_ˉ1$EAEan9"z'CU:φ({kVDxFk1_3zWQ3Bl7^ M<hvΌg,T4Mzy:?(Ol6]"[-Y cg{HMRy:+_t߻SPݝm{C qYT|rdCqHmvc -gN(:޸7"`X>#yrhWOm6"f'!3Նac|z~:φV:QW; G8bfls/E%,Vq`̍gwxF\@ܴw=Խڸ{(=WPzgtxڎvѰٯE=Jkst=Jmϖ\CqA;V R7 婏y+=~iG}t=Jc'|<:k999gTU8Cw"w0'T>lzGy&OJ!qs$yoH 9'1_oqE6z2!?sYVX^o96x,[⸍Ҿ6!nSiov|<>'}\=}byf$mv;}xOضS֗{>=;Tvy=|:Wd|.y[gT\__1>vu"-v6R'?+V1zSdyuƖYU_'Ky F~ՏaY/8nݮmC66na|Gc;gʋMLuVc~;Zۨu<h{tG4Y۸)~[xbEq90cf'是J?/pf|)O9l~2-O(.π^~N-tόChr8g3y]sżJPcȟc~:G7l>|̨M| -ٹ:.\ۥyǥp]0QA0I|aM&Ǜ4⇩2HE nJcŅ;I0NSL[ȲSu@II@@2TBN?ގCݘm})J#)#w=\͞3W֖WxT>//哩N> -|%Щ3\'ىOeyY}܇}yi!qrFp0i[Jќ_oO_ᬂ5d>iƫKSȇӈ0XZ!|xYH qY٥&=` 6߲,2{Vܧ8l?\|9TI6ݫ)!]ANQYutq,J-G|a>j>ߘ],(EIͰUEpuD}K8 EU 4Dhm߆:ij| ZȖp!jzW^87S6C$^7+kmuņ=:\绰]ײ&<.֎7Q -MU"î2ˌJMj6 I.U& fӳQǭXD\"[ZsmB+{T=MPϫ}ٍmU|9e۵8Vl]vqA(:W(WDžQutiU*ˇUgpM WMv:$y@Set _:*|&Vyl%e.cyyź3U4BU@w]VnkTkwb߸CqOlvV&6vFٮwƄ0Bw}+w=Ȥv˥Ls:u|.ϲQxB_yܨqJg|tz<)GWa &4hue]ECǍa|M^KƠiu2i52ϸmbKdvl=_zssUසuOW$r>CKUo-[;i -b,ȗO*+w 7LwVF;z},mޤo\n,KR[.9kv,=ے=(^m)xTeND2UePmKrQRh9E{QiNt|Tlnx-[-rΡߝ%[.絛zI[e۾iwm6{fz5).{Ou]T);!:J1Q'hTB@m<\xd#RJxOUA?&$E`M?4$WKJ luS$\j!/9\-/B)?C_Q +x][$q~_ςSK lk1~m0s G~Yyʊ]m/ȪW4St|墖wՊt] q?%/q.fI).!JP)msKyA[LIR ^`$ c0RvJ0M +f䂠 +vh!At/^|L&FY@iIｋ`KJK:[&RAybU ;IEtEQ[WZ%D]N:⢵Ji8`ӊ:( \uYe$-Ip6(VgUVK:[ $` _ba +^̠%&!L E  +J4`[ȧ U:%" +8X [3WHk` +H\`-l1d%.`[Z$.[RIK\`paqm$qJI εN ,H=H\`y#qZ^ ޵޵5El%.;.VG+qwVAb 0 p%.V&*&` uax8܂rwSF2^e(1BX3V4%8NX9 ZtL^'Ң<.[xy' x wAQpH\bt]mw78 E#ۢ+ҢR8.hH\UxQL" i @ƋB*qbyOxrJ\:bq tœF(t]1’THxn^6%.! L.>ҒBC'k'qAP8P-HK)J\ lH\ lA q"%iDbz[1? ؂HQ0ycft-"t:H\-XȥI/q~0:M[0U$.RD\i؂ [Di-qA4ѠDd^I\$\-H<3J\/9T&RЄl; D#`u$qA&QaQF`3A₤` "> K%.CIG䛆$.f Y|)0o9 $-!-0oI7NH}73o"b7]u $L@Vg23; +밶[ +܋*{ +s$qf"^5 +Vⶁ"'O|kf &!9(f[˯߰^_ ҄ +$ Cq#64XTmH, "l,,xuac+LƢ62!sv )`d&֧<49 &HA˶~$[le>CҌ =su@A*+T9m9ɘ#)PvV>hstL}w4X-&el2ys#=x~룄~Gة~w׿?~g ˿"u7?h\wQL\XDt۶ʛ܇a[_jrwB;qٌwL_~q7vق$h+!6"ܝ-[-CCLu4JV[YwZ#p`oTRnIn-} !m{+U CLj;qM$ aa-=>2_m MͶ~AܷK Mq' u}[YfD  +OJ.;$=WJII0!NZҔx{ݫg~z5 KyˌTnB&le3e6Negݻfcrȅ*7G]8E64v8uęˉ=pT3mAOtsVY3GCӗ:eae6_R #$rH|>C3?6 !m;}%џM;eNl*m pć&)׃!\CqL9qy cK7mz?[Sm{>Y'c7oD&CS+u޼ "}y9T?/" 7ӻ'c}bodWC=؛b&\mW9k5fع8o |J¾rͷ6޳C{ɾǡ>l˧exK> m Vl;6 On`]e{v],=m]ݎ7;}k?f^5j۵OQ1,c[pv.ös>?a}H0Uw4jo+S[XoG6j}l֣C>bϛzNjM_q5k04̝9|UyjmXy䧠g?9g󞧫{uw)mZ~SU_CۍZׇ̟y)ˊ_yv3nbgK0z-(elT{i=]sVدo"tuDcK8 G"wؚKKbjql~Z|,VȖa֎!jzW|m\l *&t{b fGu!si6 l8 C3[Sͻ2RVqD A lc06 Q/Z9AtjkT⨚)9K/fsDq+λ}Ud1;! v+kB^4`dJK3:ljtfo徳IFY.B,J(IH˘GY_(; ]N#[q:[έ1_Q8-ބ}0!FC(:n k VRw]˅nMіyo{ c3ҶC76c׬\ơcI&q%Z2".xda HIw}P`aDCGcM7Y V!aҼӴG0ǽ N]Ʋ,o/cK~&Po˲g{3-hs1ʤqTli[(:]@MVkn)wE/S _DGvۊף% ݩQǒQy^KiM}n!~DjTs̝δ j?e'Dq~'j[KP>U;Pd[#O9+c!kU?בM"=V#WKJ l S+͹!/CNbsAi$f 7 +) endstream endobj -788 0 obj +790 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 787 0 R +/Contents 789 0 R /Resources 4 0 R -/Annots [ 789 0 R 790 0 R ] +/Annots [ 791 0 R 792 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -789 0 obj +791 0 obj << /Type /Annot /Subtype /Link @@ -10049,7 +10132,7 @@ endobj /Dest (cb201-1) >> endobj -790 0 obj +792 0 obj << /Type /Annot /Subtype /Link @@ -10060,43 +10143,39 @@ endobj /Dest (cb202-1) >> endobj -791 0 obj +793 0 obj << /Filter /FlateDecode -/Length 4070 +/Length 4069 >> stream -x\K$mׯ 1"/` , fkw$V>cd2U]3#<$`̲W7e&"_o?]~I]T7%N&s$L*x}_]k^)%:QXM)QPX,^a`Rr!*h XƂ!3+A .9h,e!dU K5İ%$e rXG 1{l0JYsqE%lr{`5^11Ɛ5CPjYe&Y"dѓʃ,.'dqNQxʃ,jM(Y(|9 -&dIYklӫWMив1 pkXϬa0 : pzDjܵ!hXs0 oLWC%g p4,@6$*/հ`ly^4,] -kXH{TdiX'LN#sH9" ܂ݏc6wmc|˧_ՓcaRkɱ xex -ɶ$B!RBZb;t!nu|{!lԕn^ -{*|!YR"do>_\>_\LgԲyU!_kt^]B}>\;eӓ޺|׿?_ jݷO b#7$Ƽтmc遈DFnb+GZҖxB轟dO_vGq/Go?~ʪDDSYb[ -VI}.[%~]U h27"c[]\%H$aں|96Ux8KVO5&Ok~$GL䠹<98ѵ*Gb2v5g49z7MMa}EƬr1uC}Y=^;vx|\Dy@{r9\jkg8nsew].P]ן>y,Ioy..^+7VߴEz̯c=2Z;@ICN6fϞ}] ӆCh<8c`Kk{!k}ͧ5 - aƫ`MG'.m|I|vPO'l{u;j`I[F;N1b;aF{Uw?ZJ燺:xFe~q岶[_qμmbo~&~Vsr'VrC&ljb@k>TZob'GQdXpuS͸> y)+jE??/lw+v);aܔ8Lӱ -ueK-6sWC~iPd&Ht7bZiFRNwπXJu \OГ}~1roSĽ&ޝ*CKYmoT[vQ h}DzMx[de7o3tmQ!iAzw䱉"7(֝crgb}>k~>}~b9]l&-taspm$-ͭ'*r;%+E}?Q>tOsΞwѶ,Jc{ώAϨ*nsF9a5[?,EW0t,ǩުyûpW=<7{@,`0˟F(cbO*QWN"܋: ފBӃq|S&/࡮ vS,OAm=ӻjsWm̢?|;qKczoۭ ut_bT7ivJ9j^vj.h=Knq ZG-?-o8ݤT -فvv|_s̡D1f:VPe_t{^pI~{׿m̮ﱖeb{k$R<7~xX~Tһo0̿w#QW#ؑ'yޫM^9;?GȺãZ"%y9ȱWd4gjVe pS{ c Fwg5:fXc,Q35KklwzY\ ߶}lUY߄yj/G/%ooN/uBc{p/2R%g/&"X!3 -Y#؎iŖcK 3*Qnwz#_&V,'cY^Ʒ8D ׶sUÙHtc呡8CUuv֥e;oL* v _*z˱!Bܓ%!{Myw".'N%$uXAJ˸iˤU4y ^ߠ" O`y2$⛃WJuXӀ4.) ]e3)tG롱uQBO' 5cOY g`J.0LeGr᪁d.Ƹv4v{IC1bxd1'dG# 0F_*{@'q:qo?_js>8yN z+ٮYy?:8hغ#L!?I/i6 ll58܂<Bvtfő|̀]8L占..2O! +i:C:얎X2a\'y -/s-K!~xuNX :0uҲGD:}P_VXPT_/r_;54Lט.V]yvk :)wn(\F6FL]غugUKiUaݕİJUeRQKқ4Yq#niwR* +x\K$mׯ E/`!`d`` X0[#5#㕙yit%HFfZ|_fgr.)嗋5)X-vM,'\9\%J)^_.p67qWoJޅ~I9%V:RX!| ++:% FHJK bYaeAYbXcA WBRXBUy2Wx.G睉x.yGdbb+&cu/@ƃ,L9iY(UyD/A! +)ñ$ :Ӏ,d 5$ Y ְXaw=a  w!AO V{ Fd YaAqg Rof +Yԛ(-L,)ʃ,H$ԛ@'!/aAQͬa ԛ#,fR 4pi԰7jLgf8zb`U=2^DXHDezj +걁"&lOU9$̜dnG1ѝfrG_78?qZj-9v~LQa"DB>"D*SHXln"$B1mn/2$2͋Ra(uꈑ!%B^^e tF-ky?*k_,~q`ͼ\6=D$ϗ?}ç"[[LQHKOOh|ik.CH?[Y}_q6GXmV5ĩU5/m6~{ªgm.e$0m]zeM2JLJaqU= k)ݞufՖiӏb/\emշx㿦#ζbo&49Ye$.صxkwU*-7^V^CQ5XpuS͸tokE?݇[*V W-);a)qcʖZl氯. ɀMՑ@ rވjIu;=b9+";1p=q|h@OQK7:xwb/WlA^xR}^hn{wܷu:lG#&k"]~f8ln-*=-Q[U<6QaҺw^w&)?sNP8۷/-fBk'y<6jOz<ÔkGuQ?9{ՏF۲*==#=;r>ݮ儉Bl${x}/wtZzF` Fܳ]Pk'v&.R)GN-ycŞ-׾ghiߠ|2vMK[ݝ8ii短m5Nt[ckuA+_^p"~v~sK +L<%_ .ncv}M>▉W".* v4Z*z˱!bܓ%!{mb7D]OKHJ0†nz+q9i/rW\1x0> endobj -793 0 obj +795 0 obj << /Type /Annot /Subtype /Link @@ -10107,7 +10186,7 @@ endobj /Dest (cb204-1) >> endobj -794 0 obj +796 0 obj << /Type /Annot /Subtype /Link @@ -10118,46 +10197,36 @@ endobj /Dest (cb205-1) >> endobj -795 0 obj +797 0 obj << /Filter /FlateDecode -/Length 4094 +/Length 4092 >> stream -x\Y#~ׯsExb0yXl;F3;,hQ,:-{$}b_fkr.)L -梲+%N&s8O&R<>oGgJΆ/?I9% - -E+LJ.DKX#$vg%%1ع2߳ -pɲƂ,AT!f &BQ9kb.MNyobb+&c -Y K̤ 4^,>zRy5^,) -/CXWVy"YW %3 @,Y8M%kXdiXdAȠa"S,o5=,05?`ȂHQ ɅYÂ"1hUEgr\ MjX\dz F% x5,HhXWdCd,dAa"]հ ;ȂhPÂ2HC#5YÂHa 2M ʃ, ?l D aANͬaAΐőӰ)fҰdAħaAh$Lְ0f䛎5,|3kXP$Gݯ;^y}^]V/9"rYO5~R:/Olp{{UF"3CugW:zˊ>_xP=ޑۢx1yw_y8|@2^p~E c? *^&|v/ /H1N* H;#|o[pTy̓9^6~jm\WN9/讬ZTyۆSNsUTQ__2xt ͱLrESSkl,]-T$: -oݢqщ|aMdoW lk.Ӥم=z:_?ԕS[k1\Z?Fq^_~o3umfW ߟݛ -~Hj|7);وD+>ϋCC\L_dHdxK>Y50Dh 'ᨢDeATbDNjb]G7H!H}bB:Zc[]m.C~^e&t94QEԃz/n@.åa%\ \'7 >!H6em@/7Ď5X.&亯ic|[9x>ۮ#y>b"Nl}J͓ۼĜI|\他I^1z_7`Ki o}'nzm{pqkOnkŵ|HIh\.6+EZmsb{x=euCu?c~/cjb>?; -w7==nqiWD$ܣfF[פ g{nZ5GdJ?W;,pYם"[d\WMnEeXj> x41f'zCُɀb] 9p~As-}ªV)~zZN4Ͷޞ۹?=+Y\&=KzXڋf(y Ù.Nیus/6s^3M/_ɧe$O\j|$Z&?L[9n6h{o[=G=+dKfr~nx4YyݣzM;^;}-Rs>?X}A-=ŝxbkÎIϩ/סU تWY]GGv2!_1!1RlE[=/ҼKR(uYnWVgULoTVXϮޗ|ԕDBTV9hwWVG| _YN_B熳HYWἻzgƀ19+ۉ*9fk2_VeUn,F6|lBj;5\폾+RUx{ CWwc}:Z}:r͞]`N[Ҫo7;H}d3^Πl^VzUV{~nmM#ay$!r쀮'u1 >ɗg۷V㕞~ڏԱ0ө^9Vc̣1C \6PuRͤQ :mLuj+Ϊ҈)&UaݕİJܵqђPX9l9bɬ{Pyswo{\S8#S®%gG}Jkj%d05䝯?F9F`u$Ki}nJ^+YgvExWKиrneb,.iXϬa0z p<:_!hXs0oY+Ɩ5,]װ^ $QyccjXpEÂܵHÂܵGA^5*gHa5pT4,]q$5,Qװ f6%aA,<|*/\ !Td 6Jְ yBkX Fd YaAqg p.%7)P|3iXP(* h*ʹ&!:iY|a Jof f DDI-wC2i<."Өa.o"r{ ̒qfb`U-X`/URk+9Z4,sTp`: ,0\}ZKT3sE Ft?rٌ4;~[8/:<|V+ecMqb 2u.+I\v^Uȧ?)ɿ/\l޻wyu޻wyCHlKyơϫu^eE /S<}jjȾys@v(7x_poO<~Zڐ;,]5Q!j4᳴x1^|AڏvR }?OEy-Gڄ]sg!:Sku:|{Ewe]Uע*6\2w;[Eez,yy8 2{jnuNߺE^ɼ߮f+f[\Iu ?{up~+S[k1\Z?Fq^_~o3umfW ?Û +4S$j% "q9s6"+>ϋCC\Ȣ)TdHl0}ֳjƥ0Dh 'mEo2QYW;1&\)-R_P>vshc6w_?lC2`OI۷E7[֞1vŋkw EqXh݋jI^ωY2sڦCG!yT8~ ۸qCSNKNNO''n5Ӫm]6bhG]ikAOpZ+}hvXu5;Eȸ>݊8|,hb:N$Cُɀb] 9p~aZ6Se;"R xL4z{&oVfq`.aIh/]Fyo$g8~3ͽK}m演g"Qߛ1]_O˺1Iz~=3rI6Lr..mtn_?G=+dKfr~nx4YyݣzM;^;}-v˥(T}Ty?Rq W\WZ|[z;a*S5_PC6 U [5q_5(Ʉ|ńHnH.YXK e]YmU1G{?SYmc=bzS_{_IWV>*ȹXEzgO08chw}vRe:7D,B ݕ;|2}}߻c&S=+IoUV&nr8zomϧVY-6߲߭cfWlͷ+rK{^נ>vuw?&QQORGNٳ IWzKZfG飏̚{V^qJ@jۭ)`7,$D);&O ~/]euRi|6p s +RZTKcZ4zJp6eݕ|D7oװ۶X_p6 <~l$Oe<@6Xwҳ2ѪXّ/ ,rE짯>k+9~1ɏIX!3#Yci'deK86>Now(z7moD +=ۓeָF㳡v(!vAv8;>Ivdb2${ȝJc{./uWչe{[.iR>T׮FPePCo96>)A!~nЌe31wCѮv +tP۵ة4ZٵtOQSWhŵ&Xdm5bi7~G<xIi&VMo%2 g;eRS4y,D?CETA0)yk^IlVI+=aMl˥4lv՗Vi/;Zmz*]<[V7a]?+WB`IÔ7)gG51Yt1$ǁ+9wސw|'cK~L 0F+ցN#to>_R_!yBKu9̓G%!q%MK렸\&,Sb$C"?[A2rrIͮCwZ]!0IFE&r'@q uNzP;54Ƣrјo.V]yvk :)wf(\f;mLuj+Ϊ҈)&UaݕİJܵq(l9bɬ{PyN۹=.)H®%gG}Jkj%d05Dꏽ#0:4>k%H3a; gt(O3O݊U<\}ZdnS-mׂиL*ϴY~]&Y^9(ԿbN endstream endobj -796 0 obj +798 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 795 0 R +/Contents 797 0 R /Resources 4 0 R -/Annots [ 797 0 R 798 0 R 799 0 R 800 0 R ] +/Annots [ 799 0 R 800 0 R 801 0 R 802 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -797 0 obj +799 0 obj << /Type /Annot /Subtype /Link @@ -10168,7 +10237,7 @@ endobj /Dest (cb207-1) >> endobj -798 0 obj +800 0 obj << /Type /Annot /Subtype /Link @@ -10179,7 +10248,7 @@ endobj /Dest (cb208-1) >> endobj -799 0 obj +801 0 obj << /Type /Annot /Subtype /Link @@ -10190,7 +10259,7 @@ endobj /Dest (cb210-1) >> endobj -800 0 obj +802 0 obj << /Type /Annot /Subtype /Link @@ -10201,36 +10270,39 @@ endobj /Dest (cb211-1) >> endobj -801 0 obj +803 0 obj << /Filter /FlateDecode -/Length 4831 +/Length 4914 >> stream -x]ێ$q}g%xz`/eCOʹ}`Ȭ작\;%H#3c -.?_¿buտopW(,N''ذL׷ .o?ҒB'k'qAP8P-H8K)J\ lH\ l q<%ix.` R-3>oqb\þF)QdʃQw|<EKH*aݵRwumu;ãy~]wlSCKp9)#zTWv#7~_ߦ*#z-ʑ@2Ϸlbu}2F_wrœV|XXFѫMr[u,k;2۵^8m}8+z ='H1yu;B/1Y,.}B4/%%*VdC뱟WGNwy4HC%=\OD]rfL8}~~mejA~e4P2y.ӡwuo?nGݽ'Zcin=U?wեf?tSƄ:r>.:Gw\COLwj}gp󣻾pv?w<}FMx|H)_Eʹ x'LG:y;-=~hD{.ϳtHXpQyyU{ר&QI]M8 Ejфlaû0V QKj:AtJiThbϚjwS:ml/ri9lEmUpc6Q]vqAH:W(W7 -PnGҥ!֮WTᚔ' G=^ &^w(uH~No(;ٱtTBz&ݖJ:t $c- uMVq(TTŮAm%v6Ujy=ݵr7|šs;Ux b~tQm nH;eqoԯ}I+K^uOV1ԣ4]:nTc Ӹu%W2Ai3 : |M=^SƠiG}8Mvw Mo`/mm|bf -csp%:+Nڗth q1ˡ-[ɀ+i]8.7/mQ_fǢ,bH؎cJOob3ڛm,ү/ۚcaujea] Z]g+ X)U٪ҺP4LUY+1T|V%8Oѥ{ڍ:э7iܺ5o6ȍpuldd~ݤS*Mj{A=SճMGxhH`,Ԥ56'(w9l#"5V2քXZ4/ل7(cPT_r&PPe[EMm"(M%|G +x][$~_QφI`w eه}lx*Rt/[Os*#t I>E(3UEK)x~rQKp +#jEaq:?%$g]rLvӯ.[Wv׿e%T *rn 8/^Ĕ$p mUfPNR 2& +3,m3L$`N.*`6J:t-%ы$QH:kH;-wQlqIiI`DJ1H:[JtNt]Q啖t..E"QS1ĭ(htZ/ش3 +䃠3+DlqVIga ៤O8bfmՒc:؂xآ(3ha^8P2$vHQbB!XLr $JCgDVG^ba a:bI\` lA -lK@tK*i ,X.TX0$.\@)I\`)qb ,X:o$.]KK\`"-`h%. *H\@]L##qFubbTxDEx,.,V&H+7x8e$. !%.P.(lJ\:c%.@a["qO`E%.p]1|.-:Džy^^IBe%.p]g`E58X%xW$.p] Nap$.h芺 Z2`^THZJ\Xޓx"=h$._0.ʀ)$xWi*˦>D `/H\#-)/qO +:|/ve:B$.c$k #X-p-%.-1I\G<^t,1E]N BK1%./.I\3$qAHSE,EK4%-p%. D[ J\MDXK%)3®&4&$.p$.@`a-֑171&ǛA₤` <> ơSJ₤#MC`^r%.HV!D'd=ǛADEuNS-8 &IybI\x3J\7&[TpX3cF&L wb$ϗ_`/;e-y x'0%G0l^B +LN] fҍ).߇44c u(j[CW!;]Ulmb04iA.>= +%UOE!}凜[f } pw#Ʊ?-iĸ0}g7x~ϊ/uo Gh@`4E e[Jhx8Psѿ9m:'']E1`hy7s<i?^nSG͘= 3[1di^IH!)6ސAR?;{TkwM5{#LlTv8~K~f0ln/*Tak';1 d#\'A\7;##< |cpÅ'Ƃ iIŠ +Kvcm)x'< :Jk,. G5d0%:fY9 [t?1ռ3~u$PG1zyL'< Q&E|}Y>ڸCo𵯹ĊvH3yf.Uf>̆VFZu= RZKRmclꐃf4̑{FBϣBYE\!}۶ 59yR 3 ׼_Yhxu8JnqF?$qΓyhڪr&DLz%Ϟ@IFGØxyn+8 rx_QcDtߪ_|>r[;ͺVc0-)PywyǾhºWG|<3QђG4L\PFt<;c9D5p?ިm\|a4E>Oy:iysm=۳Iؙ=iG}wWt~_Tգ6rqhA)o3s}mgKޖz4ܘ?ŖQ4 >{gQv.ӡGtcv١Lړ :8\gCh6q b9?]=lc9f'86pjO$=㧞Cr1*wP$m!)TZttQ0A}+:V)ʛηhSĦUޤ-ߥMy<85ʯoiNHj aQj:<U{ר&QI]M8 EjфlaŻ0V QKj:AtJiThbϚjwS:ml/ri_戲Ż#VqoGm&v!\\(CMUKr~Ư/QSkRfES3ٯz%<7xI7!4v.B_:*!=nKzl%lTcj놺&f +Ӹrjbנw;]NʼZ]wF\V*免f1C?Jبa7 ŝF߲N;kdҊ{咗9c |e ]P\F50[Wq%L' +Uئ 44~Ӻ35{M 6 Fۡg܁6bsdul}qi*\e:ۗP$8i_ҡ%3dX(. +Sle&ru=OPXk]G}܊! \`;^+M+{?Eei7JD7ߤr׼% 79֩Q1wROil[7뮫uhuC|LU6)?;⁡R/O)BM:XcO=8akyJ;"ud ñ*h 1ل7(cPTy19[RbVP7d^cjCE(No_J>5o#V[(- endstream endobj -802 0 obj +804 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 801 0 R +/Contents 803 0 R /Resources 4 0 R -/Annots [ 803 0 R 804 0 R ] +/Annots [ 805 0 R 806 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -803 0 obj +805 0 obj << /Type /Annot /Subtype /Link @@ -10241,7 +10313,7 @@ endobj /Dest (cb213-1) >> endobj -804 0 obj +806 0 obj << /Type /Annot /Subtype /Link @@ -10252,39 +10324,40 @@ endobj /Dest (cb214-1) >> endobj -805 0 obj +807 0 obj << /Filter /FlateDecode -/Length 4539 +/Length 4504 >> stream -x\Y$m~_Q6 =X0` h`S`X#`f{zwN*8$#ٙjsI/?\̒bsQٿo -Wk(-{&\ח ]/?>R/" -eWX!,)V XƂ!#+A *9h,Ae!dU K4İ%$e A w -φ%BQ9\\Qy <~l,1Ɛ5APxKd4d!ƋGoTdq9y vːޕUd1XWJ&Ry Kg^aGH1)<Y EAx~4p"[nox8HA_C!IQ젅qIBő.2e \. 5p%,Kp xYE , /aw 4,8x-[4,[2jXdl԰p!Ѱq}a•끝x.{Ұu}N =z<ְx$ m4,Ua԰uِu !@{kX@]-rw]0N:rQ81j6=,X s^ 8%-ʞZ-6aA 󩼲+Z^lEÂE.3kX_Qk="ZW!hXwX, k*,aA‹@8հ`D.{Ѱ wM^Â5GAköU48  k<1hX65, .kXdNÂi))E b1!Syquа  KAJa5,Hx4,H eаR,o<,p> ȂLQ ْ )DcЪƋn p2x6iX-VRKƦװpaϒ@l 쐙k< YdkXL\l PD aAΎͬaAΐa|ͤaA1ąd aA# /oPoSmͤaA!<Ȃ(z"dq4,(1r5,@zz$Lqp7 "3&2[7ސgVO 7 G؋h3I=4,sTO VF=60_ctIQECB̉Y-9f3z>\~{\UOEP[+lW`b\ 1O1/Y!* ި"W|^式>%,ܔI(Pp9 Q7A|0/'@Mt6)Sq)GFg]~?z|~'gҗay;쫿[\m;/<<7oy}sz?ݗ:v8icy]j]BgSx꓏u1\SW$8͍4!7 h뮽m5mgygBi޽ݶ}6Ye+6cOn&Sm]s ۵yNU[}>ߚ?ha hi{݂W1v,z==^ʹ3Zx~׎1xOR?`ek^XoKSirhZa~`mgItoOV(^W1ؽ=2] e@^Lv\~{c}9`8,bc)#\{Ayz/GotowI_Yvv ;gj_bzw<Wtc"7qsՎm~Q6αX drQӔ~F9ϪŇW - _i3۹*^) ڐ um J7Vc*c[^O=W[oX?ljooǩY\cۯ՚"*>ߓ5qiZ?#e 'WѐE,z }iRvb}T몣'&w*%gjr멾A_BOU6^3O3瓲Vjda=~ -uXi}]iqc[{Zۺ'F&Wro&*So:癝U9iQlzv&V#(Nkn(t瓡c;{<^O]ch f?ymR~nc5td3ϊ :`rcߩ(V}n#euǏE/bMgbuYqu {H~r ߄}-i^BecܰqȝO͝-n.fVICك}u{K0ME]?l/n8j5Խ%SbM3۷F3rp%y n+^9y$7!c6..m\lyWP̽Vs; -JriW.zE?J/j]5-yL/" -875ȑ'WnDZo3z6=͂`z}'=[Ox)o@9խ?6'[>o""[lp6o->r+JY%[tͷOs=o?c֩c6Wo AY|>|rIob>۷~}'Йë:n9}\??Pg?~}vcicxň;{;y 罰KÜq58n닏ƭS=swy|U6vpӋo5XF7Nuuk>Pm9ig9>sToL׽KKKL?C7lsCNݰ9q# nqy w˯?9M7o8?؇)&nG&~#[26Y;o@c'N%$uXaBw=IbAfˤUi=BETFp)~mƼ䭒$=!Ml+eS>+DiϠ;ZmBeJAjǖl 2CXJI4]L7aˆ< c3&V{Nr"iX;Pc\xdv'dgF  0F_*ցNQun2-.0|pGo^2˲E.t5;3 lݐe$@BNF ؟dgнaq^n&v \I S:f Hd63`/x~H -r9̓gH!qMgH 9(.ńeJRN2T4ąH#O0+ -)r`rҲGD}0u@HXST_/r勾yX^=?5fjA 飂g I6@14ice[WK]qVFN1*CAZ%=lɏ(HwNsufdVhQT-}=^2h -gfjfph.{YNV<ߺ@M6y담MB.DYYDș`7+u^(3Puzb%Mw__udIP}'n}ĥ"sқ͝X/O>mP; & +x\[$ˍ~_Qφ/~0b㇞g)2.LUvtÙ+($')2;2%"]o?\~%梲PZ-1LiI%/_.}-Dg_E~I9%VXBXRr!*h,1B"GGVTrX ++C O#@ ,i,aKH +a1*" Kңsvx69`5^Yb!k<,d h'!ި; ׀mi$q@ +5x]cRѰ w9ljX\ְ.Ȃ1RRbCʧaA2 @ʃ,H$K%kXdiXdAʠa2XdjyY.j}@@%" RǠUݒZelҰ %ZMa~tI% R,* -!3x ְ.xjXdA6aAvUf4 B53©&4*&4,}A2GAHÂYÂ!3N&כIÂb 2> 3FÂb3MG`_r5,(ޠD#כIÂB% EQyISQ-0 &IE +iXPbz3kX4&2zH sn(@&Ef5,MdZmo!!?ә+ά@o@lU *g5zh1QY樞 izl` Urr.Бw*I>$QR̷}>\r޷}>JV?Yi5'd{&y. wm|q?| mPڤXOǥEhtӧ(N E@n{8 mPFqs9\;}^5s9@q?~4˹̠">s@9nl:p:|'/x~:ImJQd !ԯ=~pRN7߃2R2qC]tc>ߚ6>j PWp3,LƦq#w^jg06Oϴx}oovn5uti{)LyƘ1?ls\"0zCP:7陔Z-y!vݫVvvk׾izRo_emkkkm?F;6-3WE$X(cWŘ[o6/MWyj_wiϓx+^u6N|Nu>[a~gFvU>vV몣'&w*%gjr멾A_BOU6^3f'eC;{ngǵ/zVJ=V鹵-IDncQ7̠t( E{QWkn(t瓡c;{<^O]ch f?ymR~nc5td3ϊ :`[xM_}[}9?Bm:i7Y枉=eŁvl7r*6 +[Ӽ^_Ǽaz;NyIUO3WzˊZկD;z[b&O@xWŚKVnM -n➞پ5a[e[y{Dw<-܄lF\qq)dGp]] :Jy(^+й{kHd+|ln%||Oo/j]v4-yL/"}qMNHܓ݅qd{MO {sIjJ{_t+nxnn#nyټPkWʛ7]7\7[MÍ͛ߖ\Msp|67_MwOջu?oX,%x1bg0C$'Np`} vV`iw3am}qTeo`\Ư;*^b>qF5j[58!yjI>~\z;ezSSSSoC7lsCNasoFLqq7 +g_9co怟0 6e>֋C~~787kZz5!.-f2N=W-ߵRu4i66yK目vVD%񣮪b8 +֌'\حxw༱c{78T ͡p=V5cT׮3PePCo9 BN +vQߙ>4//oX;vSHڮhg5?E_UOۑh(wM~%؉r Ii&V]Ow2)wUakv?P~4\__1$7y$IuHӀ4 +uٔJ}&Q3CcPc%u3RMMr!O9تɢƸvHr.!W|'j`=]?I&ٙd8(LїJuS}}L_.59g[~̲hrX3- YF2~c~#_؉c#ll78k+aPp]gL8!vZ{m3z0緀tp!*yvk :m3i.@36FL]غugUKi 2U-#ȖHt4WgfˑKfeAwqnݣU, qffv __w>SU'!6Ϸ!PMBkc0QG#9?+99̱&Y~5. u\Vp5RGw֧MиL\*='ߠտyJ?F 5 endstream endobj -806 0 obj +808 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 805 0 R +/Contents 807 0 R /Resources 4 0 R -/Annots [ 807 0 R 808 0 R ] +/Annots [ 809 0 R 810 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -807 0 obj +809 0 obj << /Type /Annot /Subtype /Link @@ -10295,7 +10368,7 @@ endobj /Dest (cb217-1) >> endobj -808 0 obj +810 0 obj << /Type /Annot /Subtype /Link @@ -10306,37 +10379,34 @@ endobj /Dest (cb218-1) >> endobj -809 0 obj +811 0 obj << /Filter /FlateDecode -/Length 2863 +/Length 2862 >> stream -x[ Ss+H݀ -b4)>8ۜqsvt/{Cj$DDj/ Ɵjm%f{Q(ooq]҅IKHrM7&JK?O._l>×ZˑןLJ-jPJ)SvT5O3RѨ3`XU^`F, -fpKQ1DDG)dLztC-6WW=HE9k!眪SؒK%*y:آR˰E-tDNst-=]ZUuu :"y:QX\]-Rsu% EO'EtDRѢ[H%cQW[b-TDP0.y mQ=*AVR܊!.!ؒ4{$-uuEz,[cl* Uxn{,Vpa&y,WjV•sX .½x,PWR cL =Awx,Ppa=`U0{,X+y,Pp7VR -Ƃ-Օ -ƄGvnp7& ܍8J] $l`=`.t" ωi*pmcAwb\] \0Nb<$px,H.Y=;jX]ԞcAw7$pH<` Lp]WZ=$pX  + @C=dp{X]J" 2KcNL#Y A -Oc=KTǂ ڶ dcAZ)cAnR>WǂB$ -uhҪǂa豠D؂c2ٷ[[(lA$ z,()ìzC-qXPlTz|tc̀cAi[Qc؂$c2]=[ z,;4jILS:z, &4AJW[ X+?(6Q:"I=ܬ j-՛cA#؂cA,MXCG䱠qEc걠 DmlfX$( ijN܂I7A'OaKl걠lfX4&2zHZYp75ӁL\DfWV8{b@@o؋ݪgZLT5Vdr E>wL>GTPgb~|ן/_c/N"aw(0kG@ MPt6Z&]l,0yaN8J?-fYgmPyt&؟6shH' ϗcw~l'pRusvZק[?|d'g"Oy ÷6. ]mLM=3Osvdti?!ER6׍"& v|ss5' 0<  -t}>&zA^B">xpB1bGZ!gxtny/5x?n"xCQ# b.VޠQw/λ}\ fc6CxŨ4Sf_¨#Fn?Pl#{!n%Bmtnzh?,9Fm`G;3ߋ)!/j*S1!vv8o|VB0 inv{>)S,>uðTJwgEbT[ѱN9ԻV,/f7a펤]usReg~2]]xG!-#$YmZ"~ މTiRwU(KC\i˔p> -eV*Ґyåf^A,6WrtG1c'2enAj,uCl3X -8 W~i"Nf?((tEusmSǸZ4[ (*LsqYI^Hd>wm}pF4[qpYN|Yĕ5[:qve6-;i2u)Z.4.etnk]?)kdc'gar`ҁ!}\L:Ke˱^34%d$934fjGi :viоQ \@F]6z,ݦ|֧eR9ŔtZWeLbZW%ߵ~7% PZݹ̧rՑ!R~l=w: 33y[kIعk_IyZHTsCԾ[/Zg%'"d T -Ol}h+oqίCvj?eR~R)V%H!vc {x:B_ +xM +l@e 2p Axmry;V f5MVWȧȚ *Z[zoJ"[.vxta\ R,ϳ˵Wۿ%rt'SRKTR +ĔUGlST4꽪 m5y*1VGUahaW5 RqTL#!*q +=]kDO'rQNZ9FlIJ2l,`KE<]-]-` ebO$VU]]jH)*B9$:D)GaK\lIB lQ<8Dkt X,Ga !Kb)A[TJЪգ@-h)a 4q@@$ a"r]l $4X [m@[ U@\I ĕcp@\;=p/ ԕvEkX (wEp-p`c@]a* EEX? +!J ܍c` pu% c1܍wrpI~:[XcAwasb +\[X]X>W̸97 F%  |V`|=$p;w96X] c!0\յ@V *HJ#8P<dpǂ "quEjX:HVEӁXaO mz,z,YpXVJXA䱠 ruEz,@b걠D"1z,( eX 4F +[)z,Bm Jʨ0.P p*t\<[1{,@-*c,]X3cXPlAx,VjDf XL:f5d j23y,ZS锬ά ` *M`cNJM9HRF+7ǂZaKifX X(K=y,h\QoFXzz,hB7Q9q$[Y<4- )-H`Mez,h9[Y= @=VoM dt.27z= ?*ЛGb*V#0eU(cnOU;왵C6"5l&hv;|/?g{j?)/f+HlXn*) +L3}-fBiD#7316vl05\:P]K?R"aFv׵/Z'r7RػQذV£~[9-~-tjK$+E;"i9v<.YRn#]m_7߾]WzC_(r;kC!޻Mmzl~xM)Ӷ]h{?o9()o1k:\n{N3DF;EjV=t_6[c;酓}=%Xoq}z{eqWLf~2|,r9א:plCPZi䅹;/9gGFXz(,es,IlR-n7Yn77Ws{ɳ>@# ojG%$O|-L?c/}RϗR&B:8r b jLO,_>p-b۷~6Fi`on;]J#=?m%:bf&<>K7o["4FS͒c_v3؞b"90S١mg,ӽ8jcL]a:u,o˲^7 +ϥOԎ{W}vQ^t,F!MX䈮#|EkbjvqH:ڵ]7[+UF:om})եwdb/1B?V5*7NxP0iKi&+(u[;ĕL) +c]f%" g:\ʎabsϓz3Zfe|q%Aw3v.SK?np姓xڙF&e^=~8v>2VLm;]| Ʀ2őn7[0@a'FvqA'@8q/۾!GVeahͲ_mzIHq$^w2AAD G,¨ l7}<ƅ:o ޒAyhWaspȲLlG"[fnطKaNUXudnɗK\YӹCqk\lӲ c~]BlbI#RN6veS,MzvN8Fqxu?L=L:>Oto>uȽNXsи,V*O*Œj)~ dewh endstream endobj -810 0 obj +812 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 809 0 R +/Contents 811 0 R /Resources 4 0 R -/Annots [ 811 0 R ] +/Annots [ 813 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -811 0 obj +813 0 obj << /Type /Annot /Subtype /Link @@ -10347,61 +10417,21 @@ endobj /Dest (cb219-1) >> endobj -812 0 obj +814 0 obj << /Filter /FlateDecode -/Length 3997 +/Length 3998 >> stream -x\K$ 賁^Ⴭ,6Q]XUYAT,ȏßBΔRs-~ꤱOGg)j* !\xͩZaw=aZ w!Q/ V{|аDÂuOiq& "pLʫeX\[XٸD4,]gѰoQ2:_!jXw0oYʫR4,]װY$QyccQjXHUÂܵ1 p]Ba4Uc=Bw k<வjX65,H hX `aA*djIÂT-x(T^28d Bdy1Vv _||Ra1bigkߝ}%煀| %~4k7%CT-}-Oo~?~|u<m}:2 EŊ>/Ƿ?]ЃMzpE )n"ܔqϛy5 F_C-_x-yp,˚л3!+EhFk w]6_(>_{Zx>qa ڴvX{8{[[Y#EV# )0(ه5Ч{o'(-~W^qX<ğ}\эoI|JsOK"NZu~a+o<{4#|m|fFtϗ^?pN[0Lu=f԰mJ[}[jɖMuf>o]`fk#p-֖^ݺ0.ck=5t-<ɹHxNv> -=>_ڦo},]c; on"n:4]y<V`{a{_}]Q,K5M5Ȭhz+sDk9\Ix_^_2Y~,o,]Y~K 5T~#3 Yo+/>mQmv#ng6TrGe*=yҽF9l_ 4PV2Jed +nú FS_1܇}ucCEGћ:d.lQY:RڰlyOnlQ삜V߶>D^[iU>·#Pg'FQkÛW7kxo羈/6\oW|փWmvZ91V7ĎXԅ^f ]­~ht9?U [x—,.V8bLi󹫸Q7pcNOzrIgƾ^]mg}v/pu]ݓdlnVg,6[;p=3nA +|=qCp3^nq/#:G{M0y_aPGcr[DrGHć55;:d!"#! E/v+ٜtX+r'i{ qd]M7\Ugy}oQ$/ ē{M; kd|7rʂm.(>t?~ǥ)ҿF=^>bn>R{4ĵm*y~1aȏ$ק5ú+[>E roi'6PIhMF.L'L4+'L\h(L:tpHhr8}4|} dPh;V2=Go[br*1uA $`1Vt7ɞ>TK8Tsbb:OtGʏ;u M&sŬCcgbDCv9t:rKkqTRe^Z*CWh'Qg~,U}It̵-ox:D8펝tXacw=I A.vˤP\L4~"*#O;p4\gA^I@,(OYa.Yi/W"Ϡ;VTa2Aϵ 5cMv!g`$ڮ8\qEzpYrhwGIc?9 -SKl%${;LbI0=Z:{] 2-Z!tǏ* ׁx-Yf2~L/6I$2ecǽxMr;Knp%1N -]WG!ܹ |MV8i0SQ43)\BFq*:S쐲az֟TK2OLNk"(< ֕>_^ϞE#QR:Ov֧##m{a934fiA飂Ze@R:bhF딖˺Yڈj> -endobj -814 0 obj -<< -/Filter /FlateDecode -/Length 5430 ->> -stream -x]K$qׯ0t`%C-5_2̨JVM ltd$"tg??8əKt~ɚ[$>;Kɰ+1G!dRaㄿ6}q5;{SJ}$ -&,+II%٤9*Ib)ZDI bPɬ%A >+IbJ. -ɑ1\$9 9VM (x%ͱhygb.i i.y--9vZZ11FZA.ii YY- PIK%`4s -ZZ,S Y]YM,6Z`d"5 i޲Ҝ3 jF:)&%ChiZZ,?ZpCY^Fwii YOAt>BAFpIILYCX:yA)jHd!\5 BYA aAEÂ%[xKE bZ 7H@.ThXةaAb' P7pn5,@jX@A(@G\p784, .װjQ9[ % L `а -z^zQ(XBXw V{a -3n uO@+r0petVKhqeܢhX]awY`E0pXj- |0p~kXu0oYV-9kX]װV $QӒ"9 հ waދk9 "p5 5,_4 [eLY5)4ua- km*D஘M b@@/kX3R԰ 4|jZ4xf YjdD6%aA%xaA.Lq@] l)2v~3"00F9q J}q'. MY@i1nѢs=Rߘ_I~v#\_"O[Me-iq"sGӘP`ľ}pk^t]hژ#̆0X>jYUѸW?zi^Ji/2+hIŵkou2`jw7f m魜T%wͲu>6oonAK6e>LdG"ۃvi-yk"=Ua ko{Æl,[Km(uk6]xm2Tk^S QmAgYϹ.WV1Q3ǗU#*Nm^bC˰(fh$Dv9+܇֔eg&nvl&{Ț2TQڡ -h -e)]vӑ7e㲜9R1Qw05˥ ow(ު1o-6& -Svug],˼gG%' -,C,ϣ$;񛾃aX+̄ lLrnC, f=n&Ho_}.9YKѢ\M̃<Ϸ "'(ujaxͺ{w칫rw&]m;do᯦hV)mh9eq%) -⬺QTDvvN2Fnۥ+1_Lv{ə&{>f U5cAH0K 734V݊]#p -~Mq$y c&Vn2[7|yVF-FvJvŘxX{cPVFyn/pt=vV2Ϩ29Wz`9ʛR@Kr8ޭr{Ko@Gwϩ4 7-!ynn(wUD޸hcyUIrM"O[;6Os4!'ZFwq˸ȤXȿJ~;ݲHvގmwisC,@PVK>͡-(R>&7e(ɍ_KeF&l#tM׉)zn&mYo}[]`<ݖ['tqԲk9yS}j-y;nM~M,md0?,ޟ- M6;_咿A)ST;Ǔ8͗oLJ~~X')d.C_m+ ^aڒ)ۜ~m@?lr?+9S=6Uݞ,oo6)6Q}#.Rw)pa<$`;"n!{q]tq!6s]y}jÖRPsQszh4*9[P'zR?عh8Lw&ظH9Bz=ҸTjZ_DYT= -DMnȽs?d^͝+J;lj<^O ]/ UBo3MP _U⨩j/OK%26yH==6!%o\.}{l-wkk.7Cc55kd}VD; 27UX9 UYuέ܅v~z'cNgk5l%繒,¬>PX ~TPlŪt_(SA GU?! $T/,^d:5Tx֛PN +dx]TI`V[[ǫtfgQw ,7"[؋l= 5i5,I5@ZYuQλOr*2rf<Ȋ Tc1o@=çNYe߈i̶CԵIA.L7״%]F<Rc}\ӱ,.C]ۥnz# Xn1Nѝ$lwHuzv5tE1 PHkt29eٻ;[5'[NeGaG9^auIn.+Ƙuʲ&hG\$}HQ5uo9+݇-9);DCIA]Mh=F%rT@Aٕu>y1Vv _||Ra1bigkߝ}%煀| %~j!*>/X?tֺÇx[ж>iʋ "b Fw?]ЃMzpE )n"ܔqϛy5 F_C-_x-yp,˚3!+EhFk w]6_$>_{Zx>qa ڴvX{8{[[Y#EV# )0(ه5Чo'(-~W^qX<ğ}\эoI|JsOK"NZu~a+o<{4#|m|fFtϗ^?pN[0Lu=g԰mJ[}[jɖMuf>o]`fk#p-֖^ݺ0.ck=5t-<ɹHxNv> =>_ڦo},]c; on"n:4]y<V`q{_}]Q,K5M5Ȭhz+sDk9\Ix_^_2Y~,o,]Y~K 5T~#3 Yo+/>mQmv#ng6TrGe*=yҽF9l_ 4PV2Jed +nú FS_1܇}mcCEGћ:d.lQY:RڰlyOnlQ삜V߶>D^[iU>·#Pg'FQkÛW7kxo羈/6\oW|փWmvV91V7ĎXԅ^f ]­~ht9?U [x—,.V8bLi󹫸Q7pcNOzrIgƾ^]mg}v/pu]ݓdlnVg,6[;p=3nA +|=qCp3^nq/#:G{M0y_aPGcr[DzGHć55;:d!"#! E/v+ٜtX+r'i{ qd]M7\Ugy}wҨhP|&E52w>Nt9eh{fdx_/Bm a7m_=6>a](+D\ܞ̣-d~@1a9KC IO]D+dO] ӥIK91]g1׈ [Jǝ{SݺZJA]rLyRH|Ǝ 9b3tG!WB:T8f*2/S +3IEσ$sa:7~G<"Hv^:N$ ;eRQ(.Bhv?rP8.ŏͳ $iip0y+Vgb+0c&u3RmWMr"O=U8{,9q;i`$1㎟vw%6ڒKdnv&S1$O}l.pqO_-}{:GeO@ǿ{ }p&Ӈ]+L^)(Δ.yq!Nd8֩JMvH0=Or*%NDahYtQAȆNJEgr(c`LSC;Mӑs‘OzN 0ՉQA-E NVD14iuJe,mER5Ť*- #F9+i'70 +(9)9jɢВzPiJNM{=aT$NkbGsZm'ĕ55|h/ҳ%%`P25r5_̯=T! +`ԧDj!gNv| +Eo7d{wZQj ut endstream endobj 815 0 obj @@ -10411,13 +10441,51 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 814 0 R /Resources 4 0 R -/Annots [ 816 0 R 817 0 R 818 0 R 819 0 R 820 0 R 821 0 R 822 0 R 823 0 R 824 0 R 825 0 R 826 0 R 827 0 R 828 0 R 829 0 R 830 0 R 831 0 R 832 0 R 833 0 R 834 0 R 835 0 R 836 0 R 837 0 R 838 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 816 0 obj << +/Filter /FlateDecode +/Length 5429 +>> +stream +x]K$qׯ0ۀ !=n FdfFUjzGexg{3 #|;[L\ROO$X=?'YJ]? !$ +'yyٛRw|$Q0)dYI*H.(I&%QIKђ 'OJJf- bYI#PraT O$ +'%YἵjD+iMDG-;sEMKHski!ȱҊ1rpNKcŽjiBNZZ,!ASdhejd:-%ii6O afP0I1)iDEM,d!ҀRh2 NKc}"5 552K O e +\ 4 Œ4!; ,LQC ai%Ұ xȂ Y< Ж--4,[.jXjX!GҰ rJE N @=iXװ vaArVN5 @5,:rа٤aw1U=@WjX@]-iX@]`Դd0W,7p׳pד@Q Ǫpº;Y# PpK4,`+0ʘZK԰.Դb\B+l\EP   ,װ.Rki]հXqp4,}3BuմblYf iX06~ ^4,]!hXi%daa*cΪHwCki]kSѰ wljX|ְx^ÂɔXSӢ3kX, R %Ұ)d ,{ ,p4,G`Y)jX$3iX8"CjiћjZFKDiXXd z F% iX +dPѰd\KsNt朆CxdeFa,4bI4FV̬aAhU԰&RM, ?l~l"Q K`Ұ g/fְ gװ)fҰXOÂb7Y8Ҭհxӓof J7)㶄(fҰda(jdTq LB t"d4,(1J5,x:%%Ltp IK3&<[-^N,gVg ,a[) 셵J꜁JN@LD90HtV6_cÄS?E 63'yɂaA[̱d W]ӯ_`|LAE n pejqTJ!RYtiM)-[ Efg"RpuY Y/'en3$O_ǿ7ғ-$^ 0OpIs͟_~孄K@^%p_TuN' +Yf?.M, duε,5Ԧ2{Ay ]v s6h$KKW7`?5%_4w+$ekoTSQbZ ޾f>Msn.pץ[ n F^/iZ¿"5ͬЈZ&tX)(-˧@gt"792ݭԕ ^j,ZTU=]F b]b-v.|ER z%;TY?K<c(.n'HAS'xb_;Tp˓zՌFx_?[k_T M` +ǍCe2++c])|Gߏ "Qj0B3>WfN&E88$Rqq"^٣X5-_QhdE܂( 3cyT#BbM5,J"Jog,M%Wa %ApY9d1#Hkmp=et+ d\ #(U8>%,4ˏ!dKI#eF1(yB JQ<fj?a ge& +:܈S%x[⫍A^ucP?wKXB?PJ{YDK(]+pxs4ܝU܀Ts6iMo.+oy#WvsZф,g +$k?,{83i܇uc6)C֔R. vjUpԇ4GS,K̅ܽAҲ=/̬[o]սnߞO{aObUb r^ؕ ц|)t͑<[x_.-nxCVŏNx{no6Q0O]J^=wUחGF[eI끈^)AQk. HH+Kh)g/ <̀d9 +K8kﯚZ`v`Yv:yf%/Uvn"r8\^Xz8 +Zn67l,9bK5mM̪G ] pvF;SlVh^$\>rc<V57n)Ym+Zyz-.{߮C{,"׭(,NF $@xG^AW){tWmඐ$W -y9tvy_*#@elQG0E_94]3r|γZ62h1HnW+|s2 +7ku|!yF)x2Qޔ\nC}y: A&G\z:u8K|N]7g5_axo skv3G"RgEJ#ma}ݺرyҜ 82{i[Ib95f+hu}s_ESH̏*t kf0aJD={7P)2 {%̇ z$h zJ$HLZ{mzlQ96gm} T77|jsy@)S҈ P\Uss gFŶbcAfcSIX|ŗ!/5= S?K w3z\tu V."z^noItpV.K,1&hI20p \G+;>0캊{OE90Va^/v &r9RvepE =-dyWuO6)cu߶+6kup[:oWۼѤB︯^u!>Ox.X=~p;sI1|pO ʹdȗB"wgs8Zy!$/›,xSÇ:Wmv:?_a-YT?ϕ,d fiuE0B^`IR]fq_O;U3_K/^;?yOn\츷 -|d> +endobj +818 0 obj +<< /Type /Annot /Subtype /Link /Rect [ 101.433071 766.923057 101.433071 748.173057 ] @@ -10427,7 +10495,7 @@ endobj /Dest (cb221-1) >> endobj -817 0 obj +819 0 obj << /Type /Annot /Subtype /Link @@ -10438,7 +10506,7 @@ endobj /Dest (cb221-2) >> endobj -818 0 obj +820 0 obj << /Type /Annot /Subtype /Link @@ -10449,7 +10517,7 @@ endobj /Dest (cb221-3) >> endobj -819 0 obj +821 0 obj << /Type /Annot /Subtype /Link @@ -10460,7 +10528,7 @@ endobj /Dest (cb221-4) >> endobj -820 0 obj +822 0 obj << /Type /Annot /Subtype /Link @@ -10471,7 +10539,7 @@ endobj /Dest (cb221-5) >> endobj -821 0 obj +823 0 obj << /Type /Annot /Subtype /Link @@ -10482,7 +10550,7 @@ endobj /Dest (cb221-6) >> endobj -822 0 obj +824 0 obj << /Type /Annot /Subtype /Link @@ -10493,7 +10561,7 @@ endobj /Dest (cb221-7) >> endobj -823 0 obj +825 0 obj << /Type /Annot /Subtype /Link @@ -10504,7 +10572,7 @@ endobj /Dest (cb221-8) >> endobj -824 0 obj +826 0 obj << /Type /Annot /Subtype /Link @@ -10515,7 +10583,7 @@ endobj /Dest (cb221-9) >> endobj -825 0 obj +827 0 obj << /Type /Annot /Subtype /Link @@ -10526,7 +10594,7 @@ endobj /Dest (cb221-10) >> endobj -826 0 obj +828 0 obj << /Type /Annot /Subtype /Link @@ -10537,7 +10605,7 @@ endobj /Dest (cb221-11) >> endobj -827 0 obj +829 0 obj << /Type /Annot /Subtype /Link @@ -10548,7 +10616,7 @@ endobj /Dest (cb221-12) >> endobj -828 0 obj +830 0 obj << /Type /Annot /Subtype /Link @@ -10559,7 +10627,7 @@ endobj /Dest (cb221-13) >> endobj -829 0 obj +831 0 obj << /Type /Annot /Subtype /Link @@ -10570,7 +10638,7 @@ endobj /Dest (cb221-14) >> endobj -830 0 obj +832 0 obj << /Type /Annot /Subtype /Link @@ -10581,7 +10649,7 @@ endobj /Dest (cb221-15) >> endobj -831 0 obj +833 0 obj << /Type /Annot /Subtype /Link @@ -10592,7 +10660,7 @@ endobj /Dest (cb221-16) >> endobj -832 0 obj +834 0 obj << /Type /Annot /Subtype /Link @@ -10603,7 +10671,7 @@ endobj /Dest (cb221-17) >> endobj -833 0 obj +835 0 obj << /Type /Annot /Subtype /Link @@ -10614,7 +10682,7 @@ endobj /Dest (cb221-18) >> endobj -834 0 obj +836 0 obj << /Type /Annot /Subtype /Link @@ -10625,7 +10693,7 @@ endobj /Dest (cb221-19) >> endobj -835 0 obj +837 0 obj << /Type /Annot /Subtype /Link @@ -10636,7 +10704,7 @@ endobj /Dest (cb221-20) >> endobj -836 0 obj +838 0 obj << /Type /Annot /Subtype /Link @@ -10647,7 +10715,7 @@ endobj /Dest (cb221-21) >> endobj -837 0 obj +839 0 obj << /Type /Annot /Subtype /Link @@ -10658,7 +10726,7 @@ endobj /Dest (cb221-22) >> endobj -838 0 obj +840 0 obj << /Type /Annot /Subtype /Link @@ -10669,36 +10737,38 @@ endobj /Dest (cb221-23) >> endobj -839 0 obj +841 0 obj << /Filter /FlateDecode -/Length 3623 +/Length 3621 >> stream -x[K# WleVb`x;rUvl9cwף%';u`ȏdu _z+])5'9>>HYz ;x$E_SJr!Κs_՚_+K3EU"+Fs`%pZ,de!D1$b -`ɞ/YbbA _c6X D&KPzxTj&/sx.e[RJX<,xD/Bldd K(-^,ک@XW1yyWZDL^J.@L{alQؤ ^,b5y%2ǐEks)n&/B<Ȃͷ $B9YrK N BNrf BNR0y DI,5yXX̐%[X@[XX[-,`୐O0b ” e` Ѕg 1 R edaw1A@GǾeOU;LV\(,,n($p7d|-,n+rwC`awda hka=x-,d. - w}E3|h|‚g7Zv>jaA"P ,"j w=#R[<,,] H,,@|s`&:XX`a$1ycGC-,H]jaARd wI<%XX{+:tĸ̈بYI(Rn1yII" *!گk yMX7n!ou~e!Ac !="$3ƞc!Vzq ٨Hvߖ_!$7Mn|8|?e<-@ߏo}zzFޯ IKi|GoL̜唷)P2 yX?co͡D'n0SEDtߐYЯa8agS٭:Nipηj 7Tc#Ұ˭} lTS=[fوmx -U4,7Q||q89j濛vQtެg}+STW^_ ٭WȻ)n4/innImw O_&ewe/^O?(To@_M"]([dV^Z'aP @n'q UsbWMbJM~*}d6 {}n]<Yn7)ww0)}|b&N|vǵ7ӒEqƢ -;M2?6|JkXxf0yHO7Xh-EiY]Y^R~Չ ?muݢVe -Y[Y临85~k5p/UoggoU6w@Ӛ9̢PPI }Z渷&Wlf7fSu jmѥ&>_͗Gy ߓ3~ņOf<*_vm;mt7tmIqHMc3Owk|]>dxZK[d)Y3DyBnI.Yt11fboY?}?rS{ j:Z;;LN~L /olx^N[OwLC9t '+ә{"{3vs\_kR1ex4%Zutp%Lј'EsZvbA΋tի2oZScJ#Ƀ'#S7rS<7ϋ֝t쮓aOIuQI:ǿ"ޕRsÁ\Ǯ_GO]5x|.r:>v:ÿc1ZS[e \rh*X`r1nV1b ׬ 1h P V,5BX,kA`|t JO/xJ e|٥,>zW]J)'%V/BEA-^,Ld %ː%@;*&P"o*XɫQ(Xy"lM< + %Q&D`~-p"r.֠EBYY(' ANq€PIb@(Il@I&^0A(BE&p 8@ta h+ p+T BL\XX\R 촰plau9`avYJ,,,.3F<@)[X ]Q`؊  ` `Enn,,n,,8pt`-,@/%DயO/5YX`L^u>CBΧT-,]* w`CD DgDj!ZXsp oLUG "p,,@vT$&/;`y ^-,H]$. Y ׀5|ɪx]a%‚հiaAJ RWsNJ!3yɡ-,Bd<"Y,,@b*baAC ȂdzdfyY`.f} @2W9&cЪK 6y<-,YB+pz N% x^,,U,,@(r% 3x ɶ.x[XPdA6haA Uf" QKBOHbaA4UnJHi `?(6Q^u%xQ ~][;Js# yg(pQ^4#",ps,jB/A; uɮh.r#67?^˾zwy߷?U9(y.$ۯ~(\ߙ!9)S*8+Y#d@$yw]&/"7zNXcC>ʂ~ é>#np" FN:wù R~"W0ؒǛؐ/f[P:H^/4QMbm#j['hY=D}lȗ=wSqs7ܬ˳˨UKjEj?ij ίΦA@>#](-2+/'NNO☷ڛ7v!Ĕ +yո mlx]Y0wK"o7/0)}|b&L'b>]7xnfZn8sQܦ~MϙRcc>l-P<߲Bz>HEl2~"RoCkDaQUbu4k+C/xF.j -{NWhYs4׃Y +*w_:OgAg{rf3gP < MsTTc5n}<67|O. 6>5^Qy\U'vINV㔚V^%/,ö8Kޘ䧃-Yd;d%KsNH=PLent|TNwya_FwQVeqN(k9xb&Ҳ$oe{}U_ y[%ɤjէ 4hU5cCdA: ԧl/=~3HٯNѫ̡k~2MPA;-I^/->B/d7^SY&\O_"?b6zljD^B^&5*f[# qPy /äͯٚo^I+= K^컨O+uܘRTޚi1sSCc.^|G3]ck6P:uQݢ=P :m̘L jZ#_VMuW+骯#Ȗx$@q5> endobj -841 0 obj +843 0 obj << /Type /Annot /Subtype /Link @@ -10709,7 +10779,7 @@ endobj /Dest (cb221-24) >> endobj -842 0 obj +844 0 obj << /Type /Annot /Subtype /Link @@ -10720,7 +10790,7 @@ endobj /Dest (cb221-25) >> endobj -843 0 obj +845 0 obj << /Type /Annot /Subtype /Link @@ -10731,7 +10801,7 @@ endobj /Dest (cb221-26) >> endobj -844 0 obj +846 0 obj << /Type /Annot /Subtype /Link @@ -10742,7 +10812,7 @@ endobj /Dest (cb221-27) >> endobj -845 0 obj +847 0 obj << /Type /Annot /Subtype /Link @@ -10753,7 +10823,7 @@ endobj /Dest (cb221-28) >> endobj -846 0 obj +848 0 obj << /Type /Annot /Subtype /Link @@ -10764,7 +10834,7 @@ endobj /Dest (cb221-29) >> endobj -847 0 obj +849 0 obj << /Type /Annot /Subtype /Link @@ -10775,7 +10845,7 @@ endobj /Dest (cb221-30) >> endobj -848 0 obj +850 0 obj << /Type /Annot /Subtype /Link @@ -10786,7 +10856,7 @@ endobj /Dest (cb221-31) >> endobj -849 0 obj +851 0 obj << /Type /Annot /Subtype /Link @@ -10797,36 +10867,41 @@ endobj /Dest (cb222-1) >> endobj -850 0 obj +852 0 obj << /Filter /FlateDecode -/Length 4345 +/Length 4344 >> stream -x\K$ s+HÇY v^lu*=v`'.R"?*U'2;sIϗ'kRWKl.*M,'\9?I%O']şN_mw]8L)٠ -X֑ -CTX 1BbGV\rX -+C *' brr8oʃ sD(=j'x xh( Y`]YAxL(YlN6s&[ְ>a PyI!h+7p5,`g5,U. $djXkX `aAlJJQÂX,xT^4$ Bd<‰5,@`m -aA򐅼װ yȂAD8DjzY`.j~@2 )DcЪƋVy<4,H bar)K@ kX -dhXd\9Ȃ [D9aAѠgdjX$TJ5,Mi)UdLhXd;hX&Y(9{I79CoM7BD|VÂ2M/%7)~[(J4,( YBY4oI7N/B_XÂY7ѫ[YͤnwC2i<."Өa.o"r{ ̒qfuzVu{Z%u|%GR7 &2],`:nX/1>`²4oQECš -}9F1zز?7_{_;eGl#1۾`?kD~9#2ݑ 0\Xw-*rȈN,iKGV+}!\KOM4tBtG81:={9}81 PIX֤*]؞6PC21˺ubn;՘iyIֺ8wRL; 1&憒ܖ,s+oƄykB3O3ޝeS1!L(ⰖLM(&ԩcУMWQW"uw>~Q@v!uYo_~f_:&OZ:߫T'{YC:ޫ%!'BCF92>,&kjtH6ǖU>Rz&*[>p9/z^șS~Ck=EUe0*KE__T!o)]sR6VPԯޜ0> \W1${7N7yֺۧ_z( (|.:R>~/NWIO5~My""gOw^{ JvjBʊn-0ou|\J[ۯm4.5M)߯{~ܵYe8VmWYaоSyDV{Yg*ǹ]X2\kB2 N$!kT]e Ukr$vW^ NMYE>mund?SE/{z8..VG?Ua ~_[ُڽ<{՟q?~ۣ[}3m\Ae*% nN>Z_0Ħk$gXeZHHr>$ ~*hu$jS5YYk]nUm}qt^v]Z#󭞛$:mCY#Yޯ<44lW997yq^>Rv z\g>m9icaó?M*hgrI`9ף5Ts&:tkb~x /E dquQMtӒ_wI - YC =d~\] 0ca;ϙ#j*D}v]:93;HߪGI}(g7:֮#[-ȩ(tݺnuL-Y)(NΡ<7Nl8njg?5ߥ7\4|Z3ǔZkoP)O^sū$А6{{`;|ػ:?6 ys3IЀ;[%Fq*~O{Fad\ȭl{s[k1y[LFsC훐 3C}؎{Cb2yIQn6 =qR (wÌ-gOY9蟉BXWM3p1~S .tr\Rv9F=[ϵ-rb V7Mem0tK*Ol#.#$ "ѸV;EmnaT<]ѐo&P(-;7,XD~@,@Sj]Ya6hr~dxۡUsXOj nkpC}cq Uyiiݖ{&i6甝(,߀;|H-šfUci۫z>/PyK>콗_TqŊѶcَق8%-m,(㵋5 :t_$hX;} Sn.}=YtԄWh/m7퇵I} 0mO>,jMȆdYΖصirU}W{%XVދ!Di/j|_5}=$A=+d qj{[hr2rWR@l:^Ė>HЪɃX}_:Vݑ,ƭdyS6^.JMf9 hpTIvd'b8 {n8yI@W].:7M+4׈=IʫfZSMb&JVOyRHrt@ĶӬ 17C^r -rR˭>Sʣji S.Sp-vXj_d\<ٍ?/>+lh7ij2)7U5Mw TN_wWщf'o4cG48\Jfg}lt؆:lKDݛj?u',y/19F`{iku<•'La"Z r15^UW+Vl ;DKX#$|d%%12 N1|r +!),g!֪<b+<Lң\|Qy <#21 Nc Y1d : KpVA4^,ɪ%ų>YCH_Xdxi@@, Uy +kX@D3iX@@[hX@[iX@[.jX@\i5, . T4, `.;5, .=iX@@] +kX@]5, .0p5UdkXt42iX]r6iX]װj`Q؊9[ e  |4,`rw}^zQX5B@Xa3a +?ŧV5,]1}*qoeb,.*Ұ wY`5,]GX5pb5,] Aq4,f骼blYÂ,y +$*/Ӱ`l,P "p{Ѱ wm Ұ w-#Qyװq xp[ŧkfXwMEÂܕeSÂೆ +̦5,łOEaA @ʃ,X֦P$Y{ ,4,@D`C Y)jX$30kXBD>jMNksIÂ`)v 2NaHaϱ@XL5,5,@ sdY jX}FXKBYÂHa&RAIH~l"QykXt3kX3dkX۔|3iXP,dAħaAHa`mrO9ĚkIzF2NH!G*7kBfB* +yܐ 3XO}ᳰa~#I~~o~Λ~iu-[i2ππr|'ᲫaI)W;J?iŸ)9OYD] epkvUݮ-RHY߭eV歎 }V_ikeI3eUsoUU6lǪ*:,{wx3j/Lŵ8 KkRh3X!pۉ$>xͱlwM䟓=Wb1hǢ-mڜyx|6~OCOpeqǿ_u&pUتɳWIVY[=*7cXZ4P^OFi謕ClzOr{}U]կZ{ݏ$C0PsAÇ#W2Z_ph?jk#cеjo$i'̪~Y8laubqs܏sy)SK7qMkخʦ_ 75&\dSΙK<ӭ r 5T&ؒ-ǭE5Q8#OKo͟Gw!khPܠAzv^9Bfl] l4x9bM(K's:‡[6io̰FuD|9[׃ݼ5}ۭ X%;39ƉGmV'2˚}VkrrQk*kxfoz}=lP7a{W!opP0 cwĨ5Nu=Oi/ۈƝ:rˀhnp}p~&WrxxoCBL8o#O3jfawv3Zn@vlU(uU437.2A')oa=Aݓ\;"'.`uӤX֦C$6"=MN <ؐ)kûi[K Јh= Ңc{p}͂Eb =eo&7Gz \5v \ >176\e'vmgm>yNى Ώ" +j[5=֟gs޸{uK (aW[Hm;[Ѽh-S܂vx͂<^X #a@U'!4f?/D߱ P qV3[FRwy0kLãҺoThmyٶzq99cǶ i {}To]{7> ]Qh'zȍU<dzENj w5!ܗ]F5봶*KUu!aZwt HL6g}>,Q+\ţޮ ݴ־'y;16ô}:XfHw7#y(gy8[bצU"k7^}֗`Yy/<]qX~JF䧓"x,mkj]]IXx%[F#C&bIJl~X!ftGOz(!64ho粣Q&ّHSw%]uq4Ot^#^N'*iM5"m4*Z>!I! ۚfLfO&/ {)I-L^*i~2LrWBLiM>b}ݒ%smd7@wOz\X: LNvˠTl4yY.P:U~qMJ^Y0F'⛝ULuXӀ4Nr)uU ]cꤲ.uo:vؒ]NkX9m r!9Cw`{gMz;v>g'R6ޓsdegOl" +<`vtw굯ɴrT9OˍHN^4GYo=~~9eغ!+|/I5bwyAvy :<쭤:w&ÉzGfeع rImprAФ<\$&q%Eǒ.".Fq9uXd1 NE~b +#2;7huS4_ ;-yv=ȱyP;wLj> endobj -852 0 obj +854 0 obj << /Type /Annot /Subtype /Link @@ -10837,41 +10912,35 @@ endobj /Dest (cb225-1) >> endobj -853 0 obj +855 0 obj << /Filter /FlateDecode -/Length 4380 +/Length 4378 >> stream -x\K sWXU` @< 8l{'A0`琿!ӭnAv0;-,ɖdτ,lM%E>_=}w"bu1Ζ8`K|26cW8{Ǟ)%:{rJVWX!\ -+Z% FHxJK bsYae9Yge1l IaY<B)<Lңs\\Qy <6XWL1dǐ%/@`IA9iY| kYS^, ExJfVy<)y {x֚*MI9)Y' @,Y8M%kXdiXdAȠa"S,o5=,05?`ȂHQ ɅYÂ"1hUEgr\ MGհpz F% x5,HU4,QdCd,dAa"]հ ;ȂhPÂ2HF. Uk<&3PQ 2M ʃ, ?l D aANͬaAΐőӰ)fҰdAħaAh$Lְ0f䛎5,_J5,(o"S(fҰ0d QTdAT&!:iY\a Jof f DDI-wC2i<."Өa.o"r{Lgf8Z1 @o٪ ؋*5J &2ժU0-e"&էDa gfN`D-+8 9=b %"`Wfbw""Eť&" a[] yEbPfZ"O(UI³S)eU[oJyᆐa!o5~[!Sey0a=e8r8XuM9NHҐB98<}Q1zgs2NbV8p!%^5Շevi}h*[Gߞ~}~x>}93!9,u\i~߿?|yenT$q^-!O%~aBSQIkfhЃ4_\N$ oudnuR&b:O[He.-~',EtĈlp3RȩY@ciĮB[I a`O]w}m ۯmY|X#T,L))c]7IJ&. Y -f 6vl.vyͿ鲴ㆎ@mc222^l[cdߧ[Vcp1ny#6c}` em᡹l[C81^Q`gҺ -cuW7)DBkŎzqVf몾i6fC8 ZtY*oϝabip8^*84)惩-oqш8}'pF`Cz>Ȳ7-0lW4*@#GBJ na1 r-ޯ?KIqi^d pBtԠUs"A<S"l|׿.{0"̹|N0_ yk^}TlBͤ2V-z 79ǾO}ccׇ9Wن0nן{}s42HjIh?)ҢT`9m.;L[&'SNJqSGo?\ZӚ.&M9"ܫ{"f܏MK9FUoJ~LSױD@+-w>踮uƿ7ޮmb4o*]Zվ?z| Yc qᡏS*Yx4VP+#y̫:[H3Tܥěg6=, ;/7s'rù#Rד^{ -ڎW-)jm(?ކ+z#z -!sDs l]^҅B!wW ۍC,}A=j=o[ڇl16rH`E}jfzۑއF搋2+}ݍ3܈/7ݪ6~ܸ9,?}=^k-c{SV澣$x -藅P=oyD5{"6}ylDN%_݅}Ɉr~ RjSWʲ lL~}a=5 J5-'t~DPr?"- -[]qx,/Ou%7D,%Ae)׶e-!>/4uy8*%,O~J䠾JJnK+~_u?:^KMSb+Yn< OύFgj&7z?]0CʋO KgP7.7YoYtMGr2v1 XZ\9&QԥAyq2|O/WeAm amߝ􌩝3@1ED><ך#E\NWzNoA"yɃ<;mxnoq2,޾BqXؒ_N޳Bf bJ @D^mlB]ܙTybɲz2v!UlXec>`xl= İ'0]';Xy⽩.vb}Tuik -E{SPUBF en.'աî31WC֮v -rR-SʽktS)^]@7+!_?C<؍/֕-:tPMo$aFSSkV<+PUg`<߯$⛍VH uXӀ)5e3)t[릱uP@O' cMY aH*LeEr檁dڸvvm+2l%:I'|d P/zkC'yA\؝L;q/c譼hh%~u9kغ"'I.$˛*@t<~'ۆj wnkݩ{mip fA3 -b d~{uqƠJq9̝|ĕ4G܅놎0a钭'iy -/s C!Е6bh؏lIJE"r 2R„O2/ۙv {95zhFjݖa+m5i=(\FFLUtjVU-St?GMqWø+qVƭ'^| hΩzKfލʽܼa=2-Z>gSuZ՟bs} j;?r%Ci>k%H3a; {Oʻu^(PzBSR -0GJr ..]y3gy`"cK%J(C` +x\[, ~_1UU I!L0y3>;unLxm/9˞RI_Ige&"/?~TKr˱N^ggJΆOޤU"V&%Š`h,;޳Ƃ\VXbxNYbdYcA [BRX uD*w +51WT^&71 Vc Y1d %Xfx}N/B=DazQlIz*5,:oװRҰp#avr& 2 u GK>5,` Xvrw] awa Ha{װDÂܵǟ@+cs>WMив1 pװ wY`4,]qRkJ4,( YBY4oI7N/BWXÂY7ѫ%,fRPL4jX 䛈lܞ!!>әY2άV p%Jj̀#E2GjcLKjـx si,QEC™,-}9z3J>?N_<=?ϦJY0~Q . +pex*&!~߈."B*]D P\Jn""b>صW$eu8-Q.o.)< y=Ry]Qet^nVr05m^=l}6c}\(//e XwX[XHߔL$ / đ.wvy='$h勓 [U?p\.ĴKCSq4 ::şŴO}Iğ~ߐ:.\?27b*8鐧?B~)}ᨤ5?[A]N$ oudnuR&b:O[He.-~',EtĈlp3RȩY@ciĮB[I a`O]w}m ۯmYX#T,L))c]7IJ&. Y +f 6vl.vyͿ鲴ㆎ@mc222^l[cdߧ[Vcp1ny#6c}` em᡹l[C81^Q`gҺ -cuW7)DBkŎzqVf몾i6fC8 ZtY*oϝabip8^*84)惩-oqш8}'pF`Cz>Ȳ7-0lW4*@#GBJ na1 r-ޯ?KIqi^d pBtԠUs"A<S"l|o?^9"s.Ӽ>AxBW'[yPc3c.f;r(,߂c}~NKk5ԴuP߶T^{={ko/wXo_f!i<++Bz$ނ8%d7^ 4d^'s'X0J$r}bβj 6P a\-)il9OYb7lU}\{Dk8qn7U&jFĞcӒ:eQg&8a-u,/ +g=>-:k0>ꍷk-2 J=/vo^7}oeC$9F\xㇵ7Ɣ_17:JHkV!v: 23wigfM=Cˍ2o;pHTe»}{Knzm?ވ+|[[tPUv }G.>uyZۖa [vM=%"Xz߄h졇vd(9'î!;9" Ji_w 7y iM7.@KfA2Z{('ު¾0SﺰlfEo__Ox͂j G Ǻ7I!];gߏH~Wܯ2.F] KIyiCʵtYKϋ=] cJ{m >S,+}|.59~|۵oh*gOouy|~ӲJe,sǙzɍAvs:L!S’Y=5ԍM[2]Ѵ]÷8WI%ui4@^ܻ4ӢKwa{t[Ckmۏ8=cj P:y9,ϵfHmb~lH^ N8^,6lb= DF䗓z,#ض.n["c?%&?PW#C&w&2F~z.pX!g{]lr(!VAض;$[O14LɎ)I!~Nuhf6kLՐ+BvhTjrZ(}nWh!MJG׏kPm)vviueK~9+(T~3u{Ԕ&3TF>Xn&%>f#4cC4`9lJfG}LJ{ֺilET6S H5XmFiX9 +:94S~Yj6Y6n'dž/#92&owJLobNrw56@:DI^W?v'N韧s>8!z+,{/|0|;jhI&ofJln36ZC;ǝ{w^[چqGb:Ȯ~LBl7/}]|"1Rb\.s~$!q%M.wạ#.Aq9LXd+1 IE~\Fȥ<8tM 80qҲGaA{Զ06ө~v;]Cm,?oANwZbс{A'J[MZQS).ݪZgUKQaܕ0Jܵqע%0sꫣ޲ŒYűwro+m?7箧yXwAbLw #3TVg_߂mOo#0jPZɾ"Rk%LSne]0m0T}ޭ:Ѯ4\sf*$KWY^XRFI?A endstream endobj -854 0 obj +856 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 853 0 R +/Contents 855 0 R /Resources 4 0 R -/Annots [ 855 0 R 856 0 R ] +/Annots [ 857 0 R 858 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -855 0 obj +857 0 obj << /Type /Annot /Subtype /Link @@ -10882,7 +10951,7 @@ endobj /Dest (cb228-1) >> endobj -856 0 obj +858 0 obj << /Type /Annot /Subtype /Link @@ -10893,38 +10962,42 @@ endobj /Dest (cb231-1) >> endobj -857 0 obj +859 0 obj << /Filter /FlateDecode -/Length 4385 +/Length 4384 >> stream -x\K$ ˒H^ 8C~>Jt̎"(#jw\RO'kRW[l.*M,'\9%J)Now97:}_>M)ѻpL)٠ -X֑ -CTX,1BbGV\rX -+C *' brr8oʃ sD(=j'x xh( Y`]YAxL(YlN6s&[ְ>!daw} z G `(cl  z:Y ރI f< p?ŧV5,]}*qoeb,.iXϬa0 z p":_!hXs0 oY+Ɩ5,]װQ $QyccjXEÂܵHÂܵGA^5mFjRhʌVDhԒPc+ufְ s4*jX7A Ty0aGa(sTd Y6L YiXPl4&kXZ ˨7=kXz3kXPȢDm(fҰ0d HQTdAT&:iY|a JRof fDF d7z\ ȤL@V-7$g:3Kř ꑁ"Z%|FR &*SU0U ,0a9}"!!f$,p Fvkьi>=~ROڏG)/n*$쪄5}DT?ȐXdvHfxVQe}q7;9#ľBj|S:[B --o,$ydC}D5W$ Ş[Ȫ"ZQ-,o NuKGɍЭw?>´OOmqq~ՕHi[C%`a ߆z֦57[Aׅc (I]…[C[٭Q"$1u9|kȬ`^[۲k/!91%0Bu2xdɺ5 W, <3`r@2Pld]~ ߯o07 gP"+ҵ")UX˫` Ѭ$ i;lq 'e|>lلU>O[.;9bw.;emluoP%aAvg$#CmN5W{p9GjFp/8|\bF}MJ"x|}"*} ޛ>@Ob.gvV'0CRI))}Jķ\>K#L>͌oFY6Ce.. ޷9$9t809qr0lA"ŒpK*qrt_끫eIn"is;pnkXd+vo8|rCZ 8>p+(JcK_v rxZþ`HxC?O<CR7_7kXmH("̹~NPXXZV?&{A4+bIexW0p^/7>rKTYt&mj/)ozOۯIXGxŊB8[QMtVUޣ)%v^ ݬ!z_~kB4q155m(CtТZ-Qo>Zvvb96 _c*ܓ74^VwZn* n>y0}<σ&^`/,O[n<@8V<vaz59䩞gE'uX"<!Ţ]ˣUncN{_mH~E/sz6}l߯:rWk6W&->voKtجS+7V]R:Nle辷旵5ԶLVtgW9<4_u,Xt{/nؓNsD4}SL~_Y-xG mlq!v.[2@aIMjdT؜=L_\mia0\2ބ{xse&h}F7DZ=&~m{s˴idžz}QUƽ79\Cgڏ[jcܖ>ܞ׎MS^Q='qI{pm5۝f_ee#{tsÊj}oƎS~٢IhsM(v \CrvcPy?><|+RudkUDCau%ֳ f?Zd#BֻT꣎R|mgCUcG^ӛn'gIEnB!HRJqiěJ}1BևpW+ȣ"T_vzjƭv;ޱ=0JIjz3.p]o] -|ɍ-۽~Vv7*z'Ә2}%^{>;W}t1CY)W\}-J{#Α5l*֝YmJ;>VbmS- /JF䧓e<2d!m]OrrزoIȞчZ7ymkD5ebɲzkJ/Ȇ֫Eǀ<7ɎD GdM'/(vAϪs>Myx9aZSTކjEh4 U:5}CB⧶ ΟvM^\vSHn-JU]Ke:xv*$ߠ3qK͓r -=qN!) -Dl jMUpFW*B -IjL"[%Q5 8N.RY_.[no5N*4:xlɮ[]' 5t 9tS~ڐj}&s}A;fr;.owF{~n =ڍ& 0F*ykG'>q8q/N5y -^,˝6_'>;qo;Zd"Fn3=O?.YCOxͣZsgb:Ⱦn}k&\!^vŻ%i -rpFH>OCJ.#.Aq9MXd1 IE~dbJ#Gn R`/͓<ЯvU<@;i Nz=P}9P&ߣ o.fyt[yRnͤ-PtLqRWU-S ü+]aޕxh+㶈׳% P9ѲYŹwhIvsh{C82S;CWk|g;uZzxZ^=T@!,߁8OG#/sx"J晰lrUO`یi5zb%LQЀ9{8 ߅VŭB2I(_}HfƦd*(isR  +x\[, ~_1J NLy3>k;Tun58gٳR]T*T=lɹϧ_N֤`\T_YN&s8,J&Sgaw}aw}BPyI%h0p׳P Ǫpt`5,@ϓx%+O%jX.cT^1.ABX4,]*Ұ wY`AD#DjuX pyCа` ߌ0]W-9kX%aH!9 "հ wދkkiʃ,k*>dXx]km*D஄M b@@,kX3R԰  R> ɂY*pb XB%kX`r4QECBIY=l9}z'RXq_݀+SUXI.U !k !`q=t!n˹p[!ԕo.wrVGç}Qt$`[XHj"@!4 kfDIvy=(UE% +ZP?X4 NuKGɍЭw?zWL?Xo_vW~Zw^k&۹e:TmXZimJ< ~\S}y]89B \x9HȨ< Is\÷H +չu.-k[S" +#\g(cG[íH jy29i3: +ͮn &G>*= vyK6no~}7\8YI}]^kof]\$aHdg[wlxXm~w?)a&y8m܏wwv&o/kg{*a ;|:& 'js ڣG͇q=U3߇xy3{WlRzߌc|0V}w!=:>XJLNS"t\gTof|0rа.tAnwq=n8=wΑ$ɡqoa^)LJ[Ryox_\-koMrIdae!'cؽ-r"ˍi>$T+WPǖB^8aYg}%4puг~#W y:>P5o_}?߬aM!(,29-{@ackYTѬn&yz]iP'y܀;|oQgQ\I@þ߇=i{o&!^`Ee+ A,^lE5Y'WyĦMx͂0t,^Ϸ}]>5!P ıԴI/'k aCj .D a\VKh E>,,,|^[rOްxZik֊1,YR5?x<`V:ě}/v{tuEKWu:įp9j?n>IBKp[;p{¶;v7NqzF^÷ R> <aqmrCMU~][ÖŒ]hqC>#}^/{q3ͼZ>c]mCks;r0-a^@:ud9I y P8PrDZ7'e}lwB}y +};JLUs=d^'55s e&g˭۱=Cu<@ồKU{?#\W9JV=#vCg8gt~8Gw﫩Gk6ΆƎ:7g^q#OΒ܄C ꥔17L4coޭ֯VGEyrɍ[+v=rc!{"(a +g\Nᨩ,{apj+nTU.6O1e\J0|v*b +!5SZBF#)JS9kH']U;?ӳ~/wr}?#%a[R_,$O' +yd27B\?>5`eߒǑ=m5?n< ֈk +=;eָ,_8 W"E'yn;oىD;M7ȞTyͽ մhtjh-p't9)m?횼,s3$Jk.':Z;zwɻ]>dxd1&do{M!@a>Ur֎N}>p2-^N?j<-W9Y;m?O|;qo;Zd"Fn3=O?.YCOxͣZsgb:Ⱦn}k&\!^vZ%i +rpFH>OCJ.#.Aq9MXd1 IE~dbJ#Gn R`/͓<ЯvU<@;i Nz=P}9P&ߣ o.fyt[yRnͤ-PtLqRWU-S Oü+]aޕxh+㶈׳% P9ѲYŹwhIvsh{C82S;CWk|g;uZzxZ^=T@!,߁8OG#/sx"J晰lrUO`یi5zb%LQЀ9{8 ߅VŭB2I(_}HfƦd*(ysR endstream endobj -858 0 obj +860 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 857 0 R +/Contents 859 0 R /Resources 4 0 R -/Annots [ 859 0 R ] +/Annots [ 861 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -859 0 obj +861 0 obj << /Type /Annot /Subtype /Link @@ -10935,42 +11008,41 @@ endobj /Dest (cb234-1) >> endobj -860 0 obj +862 0 obj << /Filter /FlateDecode -/Length 4887 +/Length 4884 >> stream -x][\~_QD !$ bvE{'Qut9.ng:.E~tT;ZyWfgr.)`M -#~R8:WbOBdR >mOuuw]8QXL&lPX,Ha`R!* XƂ!=+A .9h,g!qrgc1\ Ia9 9VAL^`"5w&K5]pc!K(iYc0"dHVAiY[ְ>!daw} z G `(cl  z:Y ރI4f< p?ŧV5,]1}*qoeb,.iXϬa0 z p":_!hXs0 oY+Ɩ5,]װQ $QyccjXEÂܵHÂܵGA^5mFjRh`ȂLQ ɅYÂ"cЪƋVy<4,H BӰk)K@ kX -dhXPdGfdAa2]Ӱ {ȂlPÂ3VjX$T:3kX9I5,` Ty0aGA,~2GA -aA^YÂ!^ئ7Bd|VÂ2֛5,_z3kXPb%ⷅ7!K@ -0 MƋְ(ͬa 7ѫ[Y֛I.dx]dQ<`V[[oHtfgVw ,7 [؋h= 5i1Q5@XYuλOU9$̜dnc c_qSmqR4f!8@L7dL׸%]J<&2@'c5+}ym+=6QOH&H7FL `|V@T\;De%z12M4q\Mvcm( %A5Yϭ,>+ tdMZzwNbCYOC^t&soo|QKg8,4Y+|ߜ=T'{^y!977s礜X(oCƇɚh#טB]/t}-*>p9ԑ3uWui_5]K]0EN@$.>t7/hO[2~l8+ m~<~h 4~[䐓 -]ZAK}jퟖ?G[ ZMO;wygAcklƥjn|ֹ yN$y NT>,*9KroҪ+hǢ]mF*M]'lkzkYz-=/z7쮕* ǫzn~khm뿍CtXi4dɯҦs ugЯt\Ǿ#;/e}Ҽ~mpUq2ɜ7m5kY Oإ2֛}9-ϋE^'-wEa36#чD:9K'=6t㊉BPڷt.ﱮ)gXd9?'+!yAZu^ZV@!Prš`K]FuyW~JꁯAI :౷Wʿ,|BK,18%f - 75U5DGGⵉoo.XjrCͪR}2(N7y(qK -"/ۣ; p]kL;zr=-ttbANY7>C1R vvHM7L.pۘ}-cS%/Y@A%ٝuޞ9%062`@*,ek3c1ϒaP)`čw/q1sJcV//0 CNc0h4G'!ܘ8R* ޷y{ڑRqfj,|xm[ԴyBfVrqlb!S׍o4laKiD{A-rϽ,WgK&P"}YA8q!5v8ۙu'erj_1<ˆYuxR%ys.@/]TRi׋#TbDz\T_:oX5g);]7w_36F'7ܒPtÌ9֯K4ہ3ckksnk7oɛ>fbK,ڞTN֥&h5lVڇ%3QK'p_7dQة` -V]TxvVv߅/*,X16fCݘ]o,ڵcݓv6y{;WfVdRgbUKꌻ[7^6ӵ9?2Gmk bF?yΛ␆3ܷ kmin=v Lyq3~W{/׈'nF }Ft vxLɞeF!/%_'vEI 7]D|檷9 &dcl;]:oǕY-'"F}D}F5Nn[ZD1z`m|#:>%bJxB#ʉS vA.$:mO3.g$y[ lлoVj7TJ&RČ(hls՞_t%9MYVN^}-H1!vxN} Y. fr 'hX7wy;_ŨǿY7:om>R ߈˕ ; p4Ӆ6Z56[d+DԌnO#_rm6<.JMfG< 7ɎD {dM'uAϪs>Myx:[RTܲٚj.6MBN dK;;ۚfLfO&wrSHZni-JTUKe:xv'{K,\<ٍOyù#/KDl jMUpF3TNwD|J鱣kpFI].n\Jy^klET6Si HuX]NkX9m r"9Cw`{gMz;v>g{]dxd1:dI& 0F*ykG'9>'"C s6bhvo>W9{wl]H&;ry#v'dGЬq'Q`o%]GP׹31 NdMẄ́+F=ҹHmpһ&ᐜq<!85'):B:짊xa;y -91?Li<sӍVG1A -L0ӲGC{>>0vөT:CsޡMG=1R ^=6:QshN[pmbj2ťZSKqVzN15YJ ]YiE-QOliΎ= --ε;GIj}߼E4 đQ-J^;Z<.Dsgbs+iku\jr a&'.6cj+=zb!=OVЀ S ^!,_^!Iz\+AxFɫ- +x][~_D l$@"Xa;N8y?եKU/3g;.R"?R*9ٙK|<}:|>Xꡲr2(TOt_ǹ_ޔ = +ɤ +e)LJ>DKX#$g%%12 N1|r +!),g!֪<b+<Lң\|Qy <#21 Nc Y1d : KpVA4^,ɪ)ñ$ :Ӏ,d 5$ Y ְXaw=a  w!AO V{NcL $&ŧqeCYKI\Ql(6'(%8flCQN] h=}_s%U +ʮIwȋNۤoǜ/ F<+beߜ}sg:dK9/87xcBCMy(p7YS|dS˲EEew.A_:rnV򵞢.+߼?z` \_ $w?61lƒū̚-ichm;wb @@׈Tmv9xfokzmcn>(ļcCa#6Hy]dkkuF,"־uZKr|qڷ]mLHqiAyZti6%愵2-*]KU45\@1$km'f;u$pW3XGLS!%Xrc3 +YxyU*y"uDX7Tr7?XfuI>b'ʼZ %\QQh.]U^e5{c= {p 'YN!ra~)Wj;;$ASJ&dmmLW1), ܒ:oϜr0 j2ӵߘ]g0{xILI0F̻ ˗9vxԍ1yDa+ߗ{WC^!I4fnL|)[Vۼ=H83yvX>6-jp<!3+c6)qOcQ%49OJ^tE_ ³%KKs>J 8Jz;`x29Al5}퇯\naDT<\9@p ˗B*)4E_*\cY._ՎKv_7hQ[jIܝ~n}nf#Nns(a%Su1 V59 ڵ]aM3\K?lBmKe*'zRgV}6+_C͎(k TΛIY2(Tt0yRo{a^.cU;\A}XFMuD|OX]@on̮7pڀIz;HGnPW%<]pI +!Б`)[@wy; vixȶjc3[ѭf6]ql+*{IbFq_49nj/nh,r+'> ;c䈹/v&Q.OG ~`r:)0L֢GڟdQR:jiqBi|F"WocdC2( e lbBz^JʕrTa)N𧃤1]otZY!#w|-DpMI +.\BxV-2"jF'/d6Zb%&3AˎGśdGv"=N &Ѻ vgչi[YF<-mO*UnlM5&JVOyRHmM3&Y {)A-L^*i~2LrWB;MGؓ\=qMS}mܑE + {"Mvr^5*fMO*B +Immit"k%Q5 8N.RY_.[n/5N*4:xɮ[]' 5t 9tS~Zj&sA;fr3.oowF<[~n $|zgqPOܼ{iit9OKRtKo4Pǁlp>qo;Z+|'Y!o6(58<쭤:w&Épxh'2_:7#` ݐ\zפ<3nG#$&$EGHTsx:,Cbs']"?S!5)G<avn("Hi~f7wZV(Bؽxcvhԧ&x:c\?CGyh;4ۢ'95FjF'jՖami .@[LMTkj#ΪR)ﳦ<+]a++׳% P9QYŹv(I}h{C82S;]K|GTB+ԝerS[lrw> endobj -862 0 obj +864 0 obj << /Type /Annot /Subtype /Link @@ -10981,7 +11053,7 @@ endobj /Dest (cb237-1) >> endobj -863 0 obj +865 0 obj << /Type /Annot /Subtype /Link @@ -10992,7 +11064,7 @@ endobj /Dest (cb237-2) >> endobj -864 0 obj +866 0 obj << /Type /Annot /Subtype /Link @@ -11003,7 +11075,7 @@ endobj /Dest (cb237-3) >> endobj -865 0 obj +867 0 obj << /Type /Annot /Subtype /Link @@ -11014,7 +11086,7 @@ endobj /Dest (cb237-4) >> endobj -866 0 obj +868 0 obj << /Type /Annot /Subtype /Link @@ -11025,7 +11097,7 @@ endobj /Dest (cb237-5) >> endobj -867 0 obj +869 0 obj << /Type /Annot /Subtype /Link @@ -11036,7 +11108,7 @@ endobj /Dest (cb237-6) >> endobj -868 0 obj +870 0 obj << /Type /Annot /Subtype /Link @@ -11047,7 +11119,7 @@ endobj /Dest (cb237-7) >> endobj -869 0 obj +871 0 obj << /Type /Annot /Subtype /Link @@ -11058,7 +11130,7 @@ endobj /Dest (cb237-8) >> endobj -870 0 obj +872 0 obj << /Type /Annot /Subtype /Link @@ -11069,7 +11141,7 @@ endobj /Dest (cb237-9) >> endobj -871 0 obj +873 0 obj << /Type /Annot /Subtype /Link @@ -11080,7 +11152,7 @@ endobj /Dest (cb237-10) >> endobj -872 0 obj +874 0 obj << /Type /Annot /Subtype /Link @@ -11091,7 +11163,7 @@ endobj /Dest (cb237-11) >> endobj -873 0 obj +875 0 obj << /Type /Annot /Subtype /Link @@ -11102,7 +11174,7 @@ endobj /Dest (cb237-12) >> endobj -874 0 obj +876 0 obj << /Type /Annot /Subtype /Link @@ -11113,7 +11185,7 @@ endobj /Dest (cb237-13) >> endobj -875 0 obj +877 0 obj << /Type /Annot /Subtype /Link @@ -11124,7 +11196,7 @@ endobj /Dest (cb237-14) >> endobj -876 0 obj +878 0 obj << /Type /Annot /Subtype /Link @@ -11135,32 +11207,35 @@ endobj /Dest (cb237-15) >> endobj -877 0 obj +879 0 obj << /Filter /FlateDecode /Length 3166 >> stream -x͛K$ )l2%zb`x;rXO6guݜ5bgԃEQ?Qx$|Ojm%BQ[M ~#I [z|g.4M%r-xÿc -ˏBTQRfGc-`Ir*0CZUO3$*`)U fSش8H#&"WCH2=]!ז+Œ<sEFOBYآSآQ<le™T {[]-` eqVE\]j׺D21(b]f)G`K&m(St [?P.:5fT Ga !3(<R$R UGT[R@j$q)B&آ=p-` 7X fؒ=0h+ -豀[=0 3c\x,` <0`t1݋uYsX.K e@]ftut +{,p#b%Հ8 +!J Mc` pu%`wMJcIRX@  c{{,@c!!-XnlX9 ZX[Xn>WB,3osn B >0>`EM ܍Ӂ15X.Xp o!Bյ@V -KcV@$qu% 8P<dpcAwI:5y,@^3J w)b=KTǂ ڲ dcAZ)cAnR>WcA!ruEx,@b걠$)y,( eX ?؂LcHjXP4c?zB-Ⱡ XBŤXK< x,( `x,RjBf"lA.t1z, XPS.3K՞NcA,UXi&H` 0cmX6:* jMݬ j-Ħ7ǂFǂF9XcA$ 0/mY=4&7smlⱠ lQ( ijμ<]-ǂ7o"w7{\j<4{,l=Zj;ЫX[#{Z̀_#0;˚S,PFr E>&WL8>GTPfb70-sbD/?xo?NODdXM0Uؚ퀇f! :fDi,nf$b,8salw&k)D gDNY &ዓtc1;|rN'yΧrFF(|:_nHp6VOl$~@`Ҏے],ƧqcjF)nv2¿{}OOb6+lw/_뷇i}믟i rfYkր Wǭ߿>Y {|W܆'uOTRB*o8^ll l|˰&ExN@J?Ƽ.bQ:8ͼ[j^m=tVzqY}v*Hn~X6ݭ;di9^&B>$ Dcco؝u߀a/m4T8q qIbTsݠ̗K *Å=硦ߏ{yA&|QZCMy Ñt{(6;MAEۘ<гqz_Ir~e 3QKoϛӈHzRO#%+wcnDT}-Qg9V7;#NZEE=aۣҧ?oώw7(l`f>`1^$+a& IZ0uW -yvT'W}O(r:x*iҼamUϧ߁ͼ=V7{p?Y@h_{d0ëa{9nܞ2ec6hgǕXƱEO^z?JoM=HC+U^6I0[pM\Sǃ"X$;&ܿhKb/8d%˒NmqcIX},7x;{;uQ3k=-xfg Ί7ői교8I'S-_J]% DCƋQmH"c~Ni`2j$=dk#z8tTں)3Թ;Gk!_F5%nҕ2f?8u*!4eJK2;O!5l_g\jvbssϝxRf]b%Aw;..[Hh42F<ahw.|6['lN)}}:Kdފp-s5ٖ=so,+2__9?9-`x]mz1maS,=:kiqhWN.4B7E^<.8`.q]:u<$\ҡT(.۴L ȵz_֡`kX䩓̮MwvK^ K\;mg8FqM}t}HW1R.Xsx;wzh̩1S 9XctYm/kegb2b6ZwvR9ŔzZQNuTUYkx#[e͒#,TfIېiH)jzU!sT+X+X%N ՜=aÖH]F^\~VL%/&WǂB$ -uhҪǂa豠D؂c2ٷ=-w,Ԧ걠r ׮BcA)BŤXK< X=[0U<`) +5"3t [d{,@ ǂa A5V23y, +$\lY=TRE&i 0>N fW[$ǂZm7ǂZaKiⱠlA籠Q&{,ơ#Xиbc7ǂ&&xμmmY<4- )-H3o$7A'OaKl걠li#jLEf=MdޞTj;ЛGb*Gr `&v5XVdr E>7L>GTPfb70-sb@o|NN#EmM0Uؚ퀇f! :fDiHC73K1v_h2,6vgc$guJ0Ql _k =>gtg|~[!wot7OZ'F +gTl~@`Ҏ"ے],qcjF)iv2Coޜq *<~7Coޝ~ʶ7>2,TCkր"лׯxkOo>)(v^~V܆:W OTZB*ßpE?;^ll laϪǛ$Q%Y/yi' v%Yvw2u` Jgrȉy)՗SYFr7@TkBڦ}aG,d}w.eR//!|=4uC?6ј:o@aÑ(|*{M$1nP%D^(&9wݕ=wPKO!Z%}GI봇|phh_t^uC={l '=ϫ)IAy$j32"=RzDl5cYt~nʳ~AIǢnDT [r ݣnvFbכj8{¶G6JWox{t%IJfZ ,nztdvh^D;sQ|E`GujxoW|Aᖓ%-HK9=H.ˇɷU=_~6X}gأ=,9q}Y8W9^0JoM=HC+U^6O4-T/o8&_LpQG3&ܿhK;LuIL'ڿѸͱטXԫYn vvf[=P _aJfg ΊOYh[!-MqnSL:>tܘI|lx9΀m2d$9sjBk.:کv١ӾP \@F]6Z,ݦWn^*#_WOuT:*W-He͒#,TgI۾w_mm4$̔ftS1sR+ ,ElB5g'lؒȋ<~Vr{"J֞0AEo=iT&Z#^5UIvb[E{k=ڎeH5 endstream endobj -878 0 obj +880 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 877 0 R +/Contents 879 0 R /Resources 4 0 R -/Annots [ 879 0 R 880 0 R 881 0 R 882 0 R 883 0 R ] +/Annots [ 881 0 R 882 0 R 883 0 R 884 0 R 885 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -879 0 obj +881 0 obj << /Type /Annot /Subtype /Link @@ -11171,7 +11246,7 @@ endobj /Dest (cb237-16) >> endobj -880 0 obj +882 0 obj << /Type /Annot /Subtype /Link @@ -11182,7 +11257,7 @@ endobj /Dest (cb237-17) >> endobj -881 0 obj +883 0 obj << /Type /Annot /Subtype /Link @@ -11193,7 +11268,7 @@ endobj /Dest (cb237-18) >> endobj -882 0 obj +884 0 obj << /Type /Annot /Subtype /Link @@ -11204,7 +11279,7 @@ endobj /Dest (cb237-19) >> endobj -883 0 obj +885 0 obj << /Type /Annot /Subtype /Link @@ -11215,49 +11290,27 @@ endobj /Dest (cb238-1) >> endobj -884 0 obj +886 0 obj << /Filter /FlateDecode /Length 3336 >> stream -x[K$ 賁%z1r9v<6QUXݜݙ]9xvvKE~Tpyrp|yp$ơoI๸Z^T\i)|禨_O?|uױM8GZ!QXLR|2X ,`J)ؚłp{VjXcB  F,--<{A<3EPzx1\[l&JxD.)XrΩZ<,`dI[`*kZ=/R%/`dQX\ ^,٧f K"-AƏN$*ŻSx XA,1C_ 'da@,ql@rP ` 8b^ , sMdP,`adLЖa-} }bz K5ȅ)5 KN  w/PR`f K %BKY`J0p/0pn-,:abƂ` ܍ S"7p7&-,`n-,87. $dZXx^$ ЙHK,,H ZP[ wCB ]ȹYXTdaA>x-,H@b$.da$ a&9j wKDa+C -GjaA"7 2p'" 2p3YF ׀5|ɪHa>`-p,,] "X-,Yp WvlaAn<|&/;ŃY&pa XFZXP"d-,( ekٷ=,0s@2W%eǠUpm*xXXP -;`aR-,;I,,4WՈȂ$d`aA٠5V2{Iⱗ}frv*ZX7NHi `l`mɃ,‚Zl7B装Mo ,,,h>;I-,罅-T7#[Xf~[D~2Ɂ\a}D)9v]qY:Is9fSyJq7dzXkeʆzfs̽~ʬv6$,lNtQ^D׽Dmކ砱a;mtv@`Re4B1PqD~{ћ?hYqCſ2OrwOE@Yq}Dmn2lJ> {#j?тt7:۽\0iӁȏ.nd߿_ ٫IۆgT > -jХ\fEV] -T˖dC$cZKNVx?nt7zdl]RćݜOjYXd4plNՅ(ϙ+8e -]D~}ìߨrN.XlUa/{D!vyĝ~wrד~f̼'BÌv9]MMJ+`R1H4[i$q淁 "ZpO{v R`&quȺp5$9WtOjE< rh./].ucQ1;1ET:E0)&nβ?=~yaǣh':7y3͞An/rn0x -y5 G04L&CEtc F3ҵY{+Ҙ!F6BAOźxBYuT]!\! -SՀmIvS R2U/^ -TARfu׃g &]sЃ<П^_yxP'OUSĄ:ϦR/cq:Ka8싔LrkԂmZWB҃bh~feȔfC-}R9Ţ5L%&*;"̖h&@IsY%A˺Iv?6K2S;+0'! -E߈5g`˗Z -Wu46{ySpLK"\hff͛Szl ˍMg?"[E.3I[+X?cJ/a -endstream -endobj -885 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 884 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -886 0 obj -<< -/Filter /FlateDecode -/Length 3182 ->> -stream -x[Mϯ$>!|&`@!?8͏y+[!.v,lN8{ -W5Z[z?}8yWO/qs_I൸Z)K>?v/tӿo Z1?HŕZOD A(%WJLrpbkL5RѨ5DPCcDTh (jP#L5BK!zOePīJ$\3rmQY,d". )0Ys9TLKj>0Y.)z&.*0Y.StaFd*A}`&.Je 2_K}E\"Bp )T BddA$>2@/'ZIFn,ARt3 X@je,ksZ0-9ͭ0 x43&]KeE2.]Pqt* lUߪqpg\ `\Y(8W p/ +)GqwEg\]*k.X-B΍qAb 3jd\A0S3x7$.ĸ\p]*kηZ$.h)2.,|PYqpd*qA(ʠe\5iqAEbd\P"tAk7]@ ](tAȸLjSe\PRz Ve]-k*¸u\E3.;K@ Ȃ2.( T`*r5"3g]d3.@ Y j.X̞qfh%aj&Soʸjv*2.@` 2`\vb\XPt jܬ j.GM[oCd| dqȼg\Bz3*ĥ7+&M,H6ɶ, Bʠ F&؉2tMmY z=,tL3`̖=7g\XmY鎁&̭t{1[gAFP+˚U|L8oQeCYu!,\sbL?|N;e|#Y1ڱaߟ`, ~\eA6RC0}űߚC^;Jome?XNizz򴡫ӫef; 􇽎eMJfA|0΁Gl,K[c0{(anCm6ʬ͎{7pw٭P+*p-GY\=7>[qdM[fsCP|=*;݇2Nu}//\KxAX:y@>d7vl|/; l?x +x7čgK' OK9 ȗ{ Yq'h೩Su/y~77;֏ߝ/\?xkOkR  oiޚxrƪUxm7׽5^] ?ZX;lb6Jv{W<맶oϘ6:t9z2Zϴaģ^ݮzne+zgv- p^$|ʛp=4Us}[ғ;טo;,haj0WBYrnz |'mQzh9tK]!??ƠGHn1Ct#9k̍=:vp"1vuYYz G,3:ˡC^z(=ܣrkh7ǖZ?k)H{"#G[}ϨN"#<{XHΨ@2v"lp, -dwRF뺾wޛý.׻𼽥އ40lN# Յh)Y~l cB7l8?d?~a:Nz;b/(U>~zwq৓T.Ϻ4yd`SRJJr\q=cVǝaawfur -r6UeW_ Lߚ[pԡO7tyStaQ6m8?^.vkT5Yb`)&F9 :lj@>Z1S=u8rm#D9Re6,TY.u`-!+v|/yK ty,W4\oew/Y(.wJi<"t);?V#5Ҏ:,B)gw{aaCb7f rϪ$[8LQذC 44]^zpXYΧ.săz7OlzȂjlb /}Nv}\ c3өOsQRl%6YV8e߿NzO[o}&Wv2~3l60F uM<׺G04Le uc2#Ί3c&뭌ΡcC+m]2YSywVtMj^)nFMsȽiz_kk%5Ub+Xb {FgoC<"I}1C'qTmsfЬKؓX>u=vH{:FD1ج 0KqV*3XO>*ӈiP3̖d&@iwzWəKV*){l[oy.ELz,=,ء[Ȭ;!g5ҿQkCE5|᧽% S_}7AeV(yڥO3_o -м-T%վP3/Fy{` +x[K$ 賁%zH8!FzsGUIbusfgvٙ.zPRMJɻ<Bg%Rh!PqXzŸ~=_6]k9tGa1RK`5| +%lrpbk b‘YbpbA  +1K{VX#T V#DM ^H.Crm^(\8`9jK%fo S-/CMd+%B;U&kR&kK[\mɃGar1xdɃ,|xY?8jxk&O%caY Y|-BXRȂؒ܊x1X@@$P, 5y[X@D%2YX@@[XX@[-XX@[![X@\-, . ,, `.;-, .ܽXX@@]J9ZX@]-, .q0p-Md[Xtt*YX] +XX]Q`؊z g  B+>H0p7&Lݘ|c?dka=x,,@g."- wCC3|hBm‚ g 7Zv!faA"P "j w!R[N`&9&Pb jݬ +Y6eY,,h 㳰$M0PߌlaR‚FMl meY,,h YRY45oIo,^,-goV f`<,qp75 "3&2[ko ?Uv<1ބjx`/U1 w># s($܂=ǪFT~;O>=|OƏF'Lccj8A!"͊|"3!`z[b?I-:둎`t5Q[ɦ5EYҪ;D^.UQפPK;~/uK&N|0Ɓ&.%j!ZceUƿ*=*kr7Y5bPA#Yϣ.Z i:a-s qŰjPU6TQ;DmCٴI]^C-Xzs%Ueڙs`;NvЛ:o+8XX+`ٯ|B3e)#xs秜ޞ YTƎȑ㟰|p7އ߀"g)m !o-zhO~w n]w|ެ"8eT~&|OK{;LEٟuVDI>C]n[WqoyXlӼ㲍7e<Sw7ކw/&{|scW]4i/}*08'e ևqO&9ЖK[|OA?&Ǯ+.K'iNqtC6<=܌z_6{rW~;O?LuYٜ%s2>]x}-< + G6=sՋ躷tضom+ӆLi{/ =!%ZO#dZ +ǪMK%'~=P+ }?/CN_ }(X,9ޛGf.˦,ސ.{Ѿ{RVVtÍwްF! M.D~uqk' Jߕ^N6Ag_f,)njRr~\xiFڧLJ#$6 l2{޻yu{6CuW'Ɂ"{W-r!OGSuyZuA-ZΧ(|jRjhMj5\'$;?f,U?CYzr2Re֪i_,S:o.*,#,9\k_;儜vZX0=M$$WeQKkܝTIIUZoNQI'갥eU +L +tgULK HM8ôIX~9MSK4]>A{.ry2W=YM ye~5Kw5? >wW`VOBB]g9Կk/hm> ȗ mE>P]͚72> stream -x\K$ 賁- l d|fsG(=ݳcHDQGRUhRJ)Of_j4_њhk*>/F6MWGԚ~&VK.9*Xz㒳Ia%`j,spa#5U =B mX֘5:cT1!xl\4K*Ui<V% %Vc5^,ц`4d d Oި&aP5SA@5,]oMְ wFN;LVWѰ w]1AÂu!@>5,]-rw]4NÂu% `( Ǩpt`5,@y 0␖hX")> ZlIÂܵۧb34-ؔ@5,]gѰ : "pzDjܵ "pyC԰X$ -tU^]L-EÂ,9 S$*//0$ax1C5,H]aA轆 kY|q n48 x]crհ w)ljX2\Ѱ.Ȃ4,HՀOaA6 D@ʃ,! X/עaAv;aAv)j}dA,5,-aA [J\baj5,/.iX1AÂ\! \E8dB$ Z ,5,(LFDhԒP ̢aA iTQ *M ʃ, ?TlG PD AÂREÂR 3N&՛YÂj 2> I 3FÂj M4,_RY4,ޠDmͬaA %"EQyISUzdq5hXPSzhX4&2zHPn@&Ef4,@&2[7ޘBgQO 7"G؋h3I=4,KRO VF=60_ca 'yD`1dZd[dn~9|{?ǯImDrR4vUym' 2 /5mԢOAFtdOk:b:\ ID(Pn1s:ILsI+yԹ9ԎGlg9&@%#ѭHwa{4έ.=zӴr&k? 5 -KrXĬPe5gqeB6!IG262 aB䘦$QPRMhPTS;~Ooq\q\'!/:ԛ9'+X[9ߛ|ݗr^p7{s?ݞr YN ְPڧ!}O߾?P?<cl7m7'o:`+vh|gl]|H}hg|!Β|~3iC*uIYkҡMƓ$ўi|My%^U1FU]1NJm4SX?d6[]1h;)5k>q]cX˩[C')7eutj?IqAkrdwIee;!ldKUr=?̽o'*2O4ν}Z hxUuc!uqOSkzhrx^ci?Xk9g([( (PdӲBI Of1g͵~G;ڬQX@RcZjGNzOZxUaeⷱ*Ә:7lg^K{>Ʈs5Y9Ű{3uI_@>?w٢Эz[[BR2cu:kF՝ȫ C>y_r'ю˧qb6{yϯk/K^g{={DZ-+vfO5eN jK6G˾qoɻ1d<}snx]\?u2eC 3ģKܨenjuVn3.e1.iR]n6ݰ?7^=5kEζ* ȏ5r8mF:GŶylR68rF5wsGrxFG9 Z"qF`?cqxP9ǛX'>p+se>Yk͙?]>I1O:V│c9P4wRg뜚 -&q;5)^{OMc{nDW=uV;>eN׳kT:b=2s g"{Py=yRum} [J3Mֶҹj߰.'NZ dɕw!N2G;NK矟}wr2=ŝ-GYݦ[aya۵TVKNVƮ_}_OAONO8Sޞb? i§ 8qOkݮU -(z]!- W' "nk]mFLLJknuPwl,WN"m31ȭFǠasַ -Ϲ nrQ 婘>! F KҾ?}\շvc*ldze^os6_?o[$|f'BU9#am=|h&:zC j`Gz,om w|~ =OO~$’8(rF.tײŒlϐ/r tb匦>򥋼?m\0ɷ+DܙL7dzMY|o!JL,3}m d9YFhtcQ衺4Ct:+ -u7OL'J/X BAslH ;;Cl]ǒ†FűSy*ʚLSe(^Dƙ]]G5צq;In_ -+LdӓD/bLj.*&N qP yڅ äٚoZIM6W7=/xzBC.2y~-:C:ѐ)&Sdrz?ȭ4h4~ rhU.Hlȁ֕C y۪Qt. E}ʶ.gځhҧ^)-nl._Ov/~=}τstLJ-'"j D+%LD98t5&hGQjb"1V"PCy5KP&BDC2(U%YH.bpب@Jd2sL%5,AT=AZ,C Z +tN# +]]ʠ>0YZU>ʢO.Ud!*CDar!]OʠKLIJ$ZEx LKE ` ]|ɌAxq@,iH VqZ29-E ĖV@) FޗƸ wmd\2.Ypd\VJf\ )eĸx EeE2.@b횴ʸD"12.( e`\. ܅ Sd\&s2.()c=2Y5UBa\P:LŁqR"K dA]* 03Y.H Ӆ,5Bd jXefϸ34֒05ufe\P5;K LSRtM0.b;1.M,s HRF[nVB#7 2>ggi28d3.hbq֛qA&x$nd[oMKBBeIS#q NzdĦ Zζެ f`n T[o]M d]dqnDfě +3.tzVe +3 _[#Met*mE>p}ڷ2ܡ`ά:~9V1ymO_{?w_k,HA0O0k_WdO`M 6RC0X ֎o!76d',"}vPW ^=njjYracYR0Y! psX.%J#P`C2kqf.p*{E(·|C;ixl.ؼB|rU~ +vpL}hӫefK_"Ru9?^{ٝ6ۿK΂/O9?^|B +o= q/|/GRg%^wx>|\|6uŶ4ϯߟ͟w|} O/G|Sq}_;ÿgڳ=k"*AuܪF)ޚMuoͧtwBϳ@-N4ۡRG~*|5:] O`3#]E3mW뼞mCvʽ3M}8/7m>́cOᦹ>-טo;,nhaj0WBYrnz |'mQzh9tK]!??ƠGHn1Ct#9k̍=:ovp"1vuYYz G,3:ˡC^z(>{Gn8돯-~ПS+m;حE>G6o@[QDGxb+Qe&0D؎NY;!o#0YwvÍ'uz{on^ԟ {*}H;I\]vi^z0)tÆ3OfDC*v\u9 .|k7 Xu/~֥a#X$5H1iXbc鴸§z;([~Bt9L{7H5AKu؜v RHwC7m8~V'yaz݄†}&WJ;xfGc9lf Γ;;\; 2n>?K)l_G# ~v \h\AfS梤lsKmܳp/|ױuǣl'Lf'믄dgl`ԍ*7y<ƍu=a2hLˆ eG+D淎͚o2:fĎa pwudMJY5Cq{7{lK;5!FM݇BfK#VL4W=ދR`o5썶;}ҟ^yC'OcN|;9eYl'3YR }tCz(Fu`wb0?Yc:aJTfNПvK}T>*;f-Leί3URض޷=f ]䕙Xz(Y9CYwBB]0Qk(ל!j‹mk䓟O{K"n(W +AeV(yڥO3_o +м-T%վP3/Fm{r endstream endobj 889 0 obj @@ -11302,26 +11358,23 @@ endobj 890 0 obj << /Filter /FlateDecode -/Length 4317 +/Length 4326 >> stream -x\K$ȳ%Xa~65 }GeHdeDu횚 `PG(2=~ ppԜ|ɻ, >Ysvj*rA ]s:'5 >+咳U 9J2X)8b bH 1Xc,@ U!F́-U -rɃ ,^ .-KW]JIc"'Exd %&Ēej -duY|UrR ɫ=/zqR lLv)e!KRMddaX‚A@Ƀ,֮R-Y(F r,,,@Dj@mb Y)ZX$s2[X%!V-^d+laAȥ\4\b‚\! pEDD/@ / J,-,( LxhPcyfpr*ZXmLHi `&ba$HsLd!a Jn J,G `of ,,,>9 -,罅5䛑-,|XXP#DgJIlaAe"QLdAT} LB tx Ԕ4, @, 7Y.J2Y<."da.o"r{f8Y1^o5K o͚jd &2˒̪*eE%s%MVl Ft?rZO?}=o/?i`IkƊ\6#ՠkBRtS!ny"Cb9 iw-h\tרczϻuwU%'!{w#|ǎIa!N{:O!Xfx\w8#a|D:]yO繢ׄPsTժgKӺe1hY؜oOvtѩWըq 2Hw>U2"\ݪ~׫Ua2eYʕ}\B!yҷVB$ GucÅc~sz $Cܐ)kN.[BOkJEH -!Sæߠ,1`&_$ -;=]{;eZteYʌWzupѺ+w3cFC~zJ+Ɣ[YF=1=l^Oǒ[o"ޓ`gNȡ[6\P!(,/ekfoNn~ǸcZPCPbaF}Elc{S kϿajօik͟;gd1Cʜc/;'.L-=ؚ-jzy<`uARFq1G,Hz9] 8rh'*}>m -ABsڏ ݽXduK VsyÈUE0ɼ/U(~l'r`2?nn/JAJ)qcɎ_I1o̢&7CK[5g*3Nfz0'aZS䧛o\Z< [|#}|͡pD%K.ʗA\lgw?EXM#Aw4^]nr}߆}ٓ>vK"ٲ]Cs-99=Pއ>z};-z:=%?j|* fmuqL~;lq}^- 𹹾qfL e`G vx|"5 3Hއ bnV u1s4X 쓣O%Iaw ^kهCM r-c fv)Sx Z80yI\ylk|ccD}.kx=xƷLK~;kXpG -_!nftsdIdJ$Q+#ps{ǨFH=F.?O"0k=szxzbyv)ޏ˯\9y$1Ik蹤q1 -B5ͰqTT38} |c]>E_ޓ8a]d[`Z=n^@jb=b]ةc]>^1P26xDaFvVr_k1#k{߲:8)`i]3BFzO?u -E^Q;-PUjїG©Y2Zv'_|x?JT~']~/TWi1=7L#z-i>RvOU_}jzރ RY:qOKrZD~71iı`uGV7,*/@%9YrY[ir[R*% Y\[6#wVܱ.ګC@cw}akɎ~<&$ښ/h f}Ƅ:W\+4lX*6fԭUqyDw7i2b?NnƗeI^6̸xJc88oug}@VwˤW?@8uC=~T9H֓8D1coݭzަSx -B2k߅I -YjeYJ(]c +x\K$ ׯ˂l 1>Lbz >ST*BŇiz:CP(ORTe;jtVr<>)_jt[XLr-tLPLiɗ||:MSv:{ћֲw'b`J-&.(L)>e[X#U Fl5i, +B {V k(,g!֪<bc ^d25w&+5^&xSxfK%ƃ,1Ԣ2d 9XY|-A⡝*duUYlN`R1y&jV9gl3a ZdP Ǫpt`5,@ 0HK4,H]ZW[ְ w]f\˹iXTAÂ|V kX. Rk IÂbAH,Yb 6-aA%xaA)LsȾ\ BdLm1jXPRF=jM-kWsEÂRA(v2NaPaE J,p L5,H5,@ sTY jXP}EШ%j-ՙUÂTQ *M ʃ, ?Tl' PD KHQÂZ=UÂZ!^&՛EÂf! 2> ͆d YaAs/ެ`QoSLfѰEȒ<Ȃ)~ LB tx5,h9SY5,@zz$P,qp75 "3zV[o*tf'Л[# E*ꙁR@LT5`:X/Ä<0Y --"QsnBد?}@=769)`v +Ay6 ~jщ #:8ا5U]t1C ID(Pn)s:IsI+yԹ9Ԏ'l9&@ ѭHwa{vͭv.%zVciM֦jJnbE7"*pk2UW;ʄ&ymB䇍eL(l*&du„*zo)OkI4РEϩv4⸔ӿBYϺC^t277{sߙeW;O,W,7{s7T'/ox3ǻ=ܗ??@mX!}χo?翠~|xwֺ_:o-o߈3?7s;𛗿7awv& +YbCC8*uw)M"I=Kx]:x$8:?K&H",J;4ag?ȴ/->mu9BeG;.^~:kȋYM1X0Cc qrj2~g_cI\ee;!llMr{BvYN>"D಴OﷲmqSӶ]w_q!/㞦ײN{}XcuV4sXޔQ,Mt'QJɄ}@hƞ5-HVέU=坞nч'ۘY?lm^41Js|ΥXi:&viLR3=PeӢ{5ǪY9Ű{3uI_@>ْ۟Эdt;W /C(c;t}ROΕW{n>w ^]_V_+[c[QVu͞6kF˜@Ԧlp돎}]wc@x2j#>Lܾ.~7e:8~mm=VsUg:GQ_Ր^g]f5csu]ӤrMwyû|nra2ob{j\CmUS64/ko| >㴍CƁkLok!4 ic=Or9-;f_e϶ykw ?~\3:Ym$֒XKgE^ +p, +;&r DŸt@ؖ\YcV;t bsNO'z̓թ8`(=q읧o:&%'_d?}&պKr,S$UO/ucih,Į3m2@ϖ3 +rOKv +bn}dy= +=T'q.Us_T&iÖR<kA B6{ c}ApG|gy|kXXِ׸B:~hiT꼵(CWh'qzWrMDj쵭nx:8?_x+?Fp[WdcF2rmGF^u u+iP0]LBIXQЛy1';54 +Hrk"FۖINŀ ,ƈemjbRNrWܕKrR P\9rɪв{P;h{ˈS<3S;oK/¿p֋IѕCU9C"m*F祯3a;L G/Ex=C yۚUt. E}.ghҧ^(nb/> endobj 892 0 obj << +/Filter /FlateDecode +/Length 4317 +>> +stream +x\K$ȳ%X 0vჁ6 :Ƣf2Pd2˞ `PG(2=~ ppԜ|ɻ,>Ysvj*rI ]s:_w'5 <+咳U 9J2X)8b bH 1Xc,@ U!F́-U +rɃ ,^ .-KW]JIc"'Exd %&Ēej +duY|UrR ɫ=/zqR lLv)e!KRMddaX‚A@Ƀ,֮R-Y(F r,,,@Dj@mb Y)ZX$s2[X%!V-^d+laAȥ\4\b‚\! pEDD/@ / J,-,( LxhPcyfpr*ZXmLHi `&ba$HsLd!a Jn J,G `of ,,,>9 -,罅5䛑-,|XXP#DgJIlaAe"QLdAT} LB tx Ԕ4, @, 7Y.J2Y<."da.o"r{f8Y1^o5K o͚jd &2˒̪*eE%s%MVl Ft?rZN~=N_~*e'&H7R rm8F0A3a4 !Q!r] ťB#lE*s@0y),%[7y'YW%Ѹ(g%!膯Qn`w<$K7ywYi!OBX/yM!JG! B5~G!7N{:O!O_~/Xfx\w8#a|D:]yzy5?\:kU#YҴn6s ڧp6S7w*3]tո1G5j 󝢥zqj~Wj3>e d$.j˲+R}.C?,o/HhQƆ /Nǜ.}sqH!?R@a]*qC煞ה B`̇MAYc`j='MH + v{,*w}cʲuWnqf^,ه,~$W)z]cz)"%!j|E'>ϜCTmX_ajօik͟;_fd1Cʜc/;'.L-=ؚ-jzy<`uARFq1G,Hz9] 8rh'*}>m +ABsڏ ݽXduK VsyÈUE0ɼ/U(~l'r`2?nn/JAJ)qcɎ_I1o̢&7CK[5g*3Nfz0'aZS䧛o\Z< [|#}|~\t8 ^ .|6;꟢n;O79oCznI%lYܜRVCzKI DUV>=ўGc}>LEaC_k&{8VK>Fݍ\8ajs3ϲ#Let<Y>{ R܅ zCR_17L+ 9 +zQ'\ˤx u0PѻXL5}!_ y&13;q_)RZ<OcwO$.1ľil5T.F/I.jCz-0~7}rHv5rñ.(P0h~#N{g;[+FoɏvۑxqownJzS MG.!m#rǺPJXҎE}/z}~i'~쫾pjIנ=<^R+^Kݟji՗n&m}2B߷>G@Ӓ\h=8Micz.ql7X PI/GNVblVJfGWb͈wGp?j}!]_Gm;9Bs f!C$ZYߵ1/m#k@|= M8u%pn;eG!m|^ Q]CgfZ)ŏӻe{ 3A=|l?R{G,=3ΛtYO2p~gG+$/i zm狥m:Nz8ro`PXƑN`#m?ǮFwwsJm:ADzޅ@R-WiuA\:qOD'iա´mr>"^Nn/&U>TnFPuP c d}haUӷG Gl&chU֮k~e5u*ChfJi}fKkd7x9 _Nֲbnz3q^V*EUؚWAUi&ϮW$7y갥ym;+> +endobj +894 0 obj +<< /Type /Annot /Subtype /Link /Rect [ 101.433071 766.923057 101.433071 748.173057 ] @@ -11347,7 +11434,7 @@ endobj /Dest (cb241-1) >> endobj -893 0 obj +895 0 obj << /Type /Annot /Subtype /Link @@ -11358,7 +11445,7 @@ endobj /Dest (cb241-2) >> endobj -894 0 obj +896 0 obj << /Type /Annot /Subtype /Link @@ -11369,7 +11456,7 @@ endobj /Dest (cb241-3) >> endobj -895 0 obj +897 0 obj << /Type /Annot /Subtype /Link @@ -11380,7 +11467,7 @@ endobj /Dest (cb241-4) >> endobj -896 0 obj +898 0 obj << /Type /Annot /Subtype /Link @@ -11391,7 +11478,7 @@ endobj /Dest (cb241-5) >> endobj -897 0 obj +899 0 obj << /Type /Annot /Subtype /Link @@ -11402,7 +11489,7 @@ endobj /Dest (cb241-6) >> endobj -898 0 obj +900 0 obj << /Type /Annot /Subtype /Link @@ -11413,7 +11500,7 @@ endobj /Dest (cb241-7) >> endobj -899 0 obj +901 0 obj << /Type /Annot /Subtype /Link @@ -11424,7 +11511,7 @@ endobj /Dest (cb241-8) >> endobj -900 0 obj +902 0 obj << /Type /Annot /Subtype /Link @@ -11435,7 +11522,7 @@ endobj /Dest (cb241-9) >> endobj -901 0 obj +903 0 obj << /Type /Annot /Subtype /Link @@ -11446,7 +11533,7 @@ endobj /Dest (cb241-10) >> endobj -902 0 obj +904 0 obj << /Type /Annot /Subtype /Link @@ -11457,7 +11544,7 @@ endobj /Dest (cb241-11) >> endobj -903 0 obj +905 0 obj << /Type /Annot /Subtype /Link @@ -11468,7 +11555,7 @@ endobj /Dest (cb241-12) >> endobj -904 0 obj +906 0 obj << /Type /Annot /Subtype /Link @@ -11479,7 +11566,7 @@ endobj /Dest (cb241-13) >> endobj -905 0 obj +907 0 obj << /Type /Annot /Subtype /Link @@ -11490,7 +11577,7 @@ endobj /Dest (cb241-14) >> endobj -906 0 obj +908 0 obj << /Type /Annot /Subtype /Link @@ -11501,7 +11588,7 @@ endobj /Dest (cb241-15) >> endobj -907 0 obj +909 0 obj << /Type /Annot /Subtype /Link @@ -11512,7 +11599,7 @@ endobj /Dest (cb241-16) >> endobj -908 0 obj +910 0 obj << /Type /Annot /Subtype /Link @@ -11523,7 +11610,7 @@ endobj /Dest (cb241-17) >> endobj -909 0 obj +911 0 obj << /Type /Annot /Subtype /Link @@ -11534,7 +11621,7 @@ endobj /Dest (cb241-18) >> endobj -910 0 obj +912 0 obj << /Type /Annot /Subtype /Link @@ -11545,1602 +11632,1589 @@ endobj /Dest (cb242-1) >> endobj -911 0 obj +913 0 obj << /Title (CIS v1.6 Benchmark - Self-Assessment Guide - Rancher v2.6) /Dest [ 6 0 R /XYZ 85.009843 502.818898 0 ] /Count 141 -/First 912 0 R -/Last 1048 0 R -/Parent 1053 0 R ->> -endobj -912 0 obj -<< -/Title (CIS v1.6 Kubernetes Benchmark - Rancher v2.6 with Kubernetes v1.18 to v1.21) -/Dest [ 304 0 R /XYZ 84.259843 784.970079 0 ] -/Count 2 -/First 913 0 R -/Last 914 0 R -/Parent 911 0 R -/Next 915 0 R ->> -endobj -913 0 obj -<< -/Title (Overview) -/Dest [ 304 0 R /XYZ 84.259843 704.822079 0 ] -/Count 0 -/Parent 912 0 R -/Next 914 0 R +/First 914 0 R +/Last 1050 0 R +/Parent 1055 0 R >> endobj 914 0 obj << -/Title (Testing controls methodology) -/Dest [ 304 0 R /XYZ 84.259843 166.076079 0 ] -/Count 0 -/Prev 913 0 R -/Parent 912 0 R +/Title (CIS v1.6 Kubernetes Benchmark - Rancher v2.6 with Kubernetes v1.18 to v1.21) +/Dest [ 304 0 R /XYZ 84.259843 784.970079 0 ] +/Count 2 +/First 915 0 R +/Last 916 0 R +/Parent 913 0 R +/Next 917 0 R >> endobj 915 0 obj << -/Title (Controls) -/Dest [ 309 0 R /XYZ 84.259843 608.631496 0 ] +/Title (Overview) +/Dest [ 304 0 R /XYZ 84.259843 704.822079 0 ] /Count 0 -/Prev 912 0 R -/Parent 911 0 R +/Parent 914 0 R /Next 916 0 R >> endobj 916 0 obj << -/Title (1.1 Master Node Configuration Files) -/Dest [ 313 0 R /XYZ 41.740157 784.430079 0 ] -/Count 21 +/Title (Testing controls methodology) +/Dest [ 304 0 R /XYZ 84.259843 166.076079 0 ] +/Count 0 /Prev 915 0 R -/First 917 0 R -/Last 937 0 R -/Parent 911 0 R -/Next 938 0 R +/Parent 914 0 R >> endobj 917 0 obj << -/Title (1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 313 0 R /XYZ 84.259843 684.651496 0 ] +/Title (Controls) +/Dest [ 309 0 R /XYZ 84.259843 612.381496 0 ] /Count 0 -/Parent 916 0 R +/Prev 914 0 R +/Parent 913 0 R /Next 918 0 R >> endobj 918 0 obj << -/Title (1.1.2 Ensure that the API server pod specification file ownership is set to root:root \(Automated\)) -/Dest [ 313 0 R /XYZ 84.259843 553.851496 0 ] -/Count 0 +/Title (1.1 Master Node Configuration Files) +/Dest [ 313 0 R /XYZ 41.740157 784.430079 0 ] +/Count 21 /Prev 917 0 R -/Parent 916 0 R -/Next 919 0 R +/First 919 0 R +/Last 939 0 R +/Parent 913 0 R +/Next 940 0 R >> endobj 919 0 obj << -/Title (1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 313 0 R /XYZ 84.259843 423.051496 0 ] +/Title (1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 313 0 R /XYZ 84.259843 684.651496 0 ] /Count 0 -/Prev 918 0 R -/Parent 916 0 R +/Parent 918 0 R /Next 920 0 R >> endobj 920 0 obj << -/Title (1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root \(Automated\)) -/Dest [ 313 0 R /XYZ 84.259843 277.251496 0 ] +/Title (1.1.2 Ensure that the API server pod specification file ownership is set to root:root \(Automated\)) +/Dest [ 313 0 R /XYZ 84.259843 553.851496 0 ] /Count 0 /Prev 919 0 R -/Parent 916 0 R +/Parent 918 0 R /Next 921 0 R >> endobj 921 0 obj << -/Title (1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 313 0 R /XYZ 84.259843 146.451496 0 ] +/Title (1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 313 0 R /XYZ 84.259843 423.051496 0 ] /Count 0 /Prev 920 0 R -/Parent 916 0 R +/Parent 918 0 R /Next 922 0 R >> endobj 922 0 obj << -/Title (1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root \(Automated\)) -/Dest [ 315 0 R /XYZ 84.259843 739.970079 0 ] +/Title (1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root \(Automated\)) +/Dest [ 313 0 R /XYZ 84.259843 277.251496 0 ] /Count 0 /Prev 921 0 R -/Parent 916 0 R +/Parent 918 0 R /Next 923 0 R >> endobj 923 0 obj << -/Title (1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 315 0 R /XYZ 84.259843 609.170079 0 ] +/Title (1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 313 0 R /XYZ 84.259843 146.451496 0 ] /Count 0 /Prev 922 0 R -/Parent 916 0 R +/Parent 918 0 R /Next 924 0 R >> endobj 924 0 obj << -/Title (1.1.8 Ensure that the etcd pod specification file ownership is set to root:root \(Automated\)) -/Dest [ 315 0 R /XYZ 84.259843 478.370079 0 ] +/Title (1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root \(Automated\)) +/Dest [ 315 0 R /XYZ 84.259843 739.970079 0 ] /Count 0 /Prev 923 0 R -/Parent 916 0 R +/Parent 918 0 R /Next 925 0 R >> endobj 925 0 obj << -/Title (1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive \(Manual\)) -/Dest [ 315 0 R /XYZ 84.259843 347.570079 0 ] +/Title (1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 315 0 R /XYZ 84.259843 609.170079 0 ] /Count 0 /Prev 924 0 R -/Parent 916 0 R +/Parent 918 0 R /Next 926 0 R >> endobj 926 0 obj << -/Title (1.1.10 Ensure that the Container Network Interface file ownership is set to root:root \(Manual\)) -/Dest [ 315 0 R /XYZ 84.259843 170.823057 0 ] +/Title (1.1.8 Ensure that the etcd pod specification file ownership is set to root:root \(Automated\)) +/Dest [ 315 0 R /XYZ 84.259843 478.370079 0 ] /Count 0 /Prev 925 0 R -/Parent 916 0 R +/Parent 918 0 R /Next 927 0 R >> endobj 927 0 obj << -/Title (1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 318 0 R /XYZ 84.259843 694.023057 0 ] +/Title (1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive \(Manual\)) +/Dest [ 315 0 R /XYZ 84.259843 347.570079 0 ] /Count 0 /Prev 926 0 R -/Parent 916 0 R +/Parent 918 0 R /Next 928 0 R >> endobj 928 0 obj << -/Title (1.1.14 Ensure that the admin.conf file ownership is set to root:root \(Automated\)) -/Dest [ 318 0 R /XYZ 84.259843 578.223057 0 ] +/Title (1.1.10 Ensure that the Container Network Interface file ownership is set to root:root \(Manual\)) +/Dest [ 315 0 R /XYZ 84.259843 170.823057 0 ] /Count 0 /Prev 927 0 R -/Parent 916 0 R +/Parent 918 0 R /Next 929 0 R >> endobj 929 0 obj << -/Title (1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 318 0 R /XYZ 84.259843 462.423057 0 ] +/Title (1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive \(Automated\)) +/Dest [ 318 0 R /XYZ 84.259843 694.023057 0 ] /Count 0 /Prev 928 0 R -/Parent 916 0 R +/Parent 918 0 R /Next 930 0 R >> endobj 930 0 obj << -/Title (1.1.16 Ensure that the scheduler.conf file ownership is set to root:root \(Automated\)) -/Dest [ 318 0 R /XYZ 84.259843 331.623057 0 ] +/Title (1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd \(Automated\)) +/Dest [ 318 0 R /XYZ 84.259843 365.776036 0 ] /Count 0 /Prev 929 0 R -/Parent 916 0 R +/Parent 918 0 R /Next 931 0 R >> endobj 931 0 obj << -/Title (1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 318 0 R /XYZ 84.259843 200.823057 0 ] +/Title (1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 323 0 R /XYZ 84.259843 702.470079 0 ] /Count 0 /Prev 930 0 R -/Parent 916 0 R +/Parent 918 0 R /Next 932 0 R >> endobj 932 0 obj << -/Title (1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root \(Automated\)) -/Dest [ 321 0 R /XYZ 84.259843 799.370079 0 ] +/Title (1.1.14 Ensure that the admin.conf file ownership is set to root:root \(Automated\)) +/Dest [ 323 0 R /XYZ 84.259843 586.670079 0 ] /Count 0 /Prev 931 0 R -/Parent 916 0 R +/Parent 918 0 R /Next 933 0 R >> endobj 933 0 obj << -/Title (1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root \(Automated\)) -/Dest [ 321 0 R /XYZ 84.259843 668.570079 0 ] +/Title (1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 323 0 R /XYZ 84.259843 470.870079 0 ] /Count 0 /Prev 932 0 R -/Parent 916 0 R +/Parent 918 0 R /Next 934 0 R >> endobj 934 0 obj << -/Title (1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 345 0 R /XYZ 84.259843 184.188585 0 ] +/Title (1.1.16 Ensure that the scheduler.conf file ownership is set to root:root \(Automated\)) +/Dest [ 323 0 R /XYZ 84.259843 340.070079 0 ] /Count 0 /Prev 933 0 R -/Parent 916 0 R +/Parent 918 0 R /Next 935 0 R >> endobj 935 0 obj << -/Title (1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 \(Automated\)) -/Dest [ 436 0 R /XYZ 84.259843 702.470079 0 ] +/Title (1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 323 0 R /XYZ 84.259843 209.270079 0 ] /Count 0 /Prev 934 0 R -/Parent 916 0 R +/Parent 918 0 R /Next 936 0 R >> endobj 936 0 obj << -/Title (1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive \(Automated\)) -/Dest [ 499 0 R /XYZ 84.259843 563.129014 0 ] +/Title (1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root \(Automated\)) +/Dest [ 325 0 R /XYZ 84.259843 799.370079 0 ] /Count 0 /Prev 935 0 R -/Parent 916 0 R +/Parent 918 0 R /Next 937 0 R >> endobj 937 0 obj << -/Title (1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd \(Automated\)) -/Dest [ 499 0 R /XYZ 84.259843 234.881993 0 ] +/Title (1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root \(Automated\)) +/Dest [ 325 0 R /XYZ 84.259843 668.570079 0 ] /Count 0 /Prev 936 0 R -/Parent 916 0 R +/Parent 918 0 R +/Next 938 0 R >> endobj 938 0 obj << -/Title (1.2 API Server) -/Dest [ 508 0 R /XYZ 41.740157 784.430079 0 ] -/Count 35 -/Prev 916 0 R -/First 939 0 R -/Last 973 0 R -/Parent 911 0 R -/Next 974 0 R +/Title (1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 349 0 R /XYZ 84.259843 184.188585 0 ] +/Count 0 +/Prev 937 0 R +/Parent 918 0 R +/Next 939 0 R >> endobj 939 0 obj << -/Title (1.2.1 Ensure that the --anonymous-auth argument is set to false \(Automated\)) -/Dest [ 508 0 R /XYZ 84.259843 720.651496 0 ] +/Title (1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 \(Automated\)) +/Dest [ 440 0 R /XYZ 84.259843 702.470079 0 ] /Count 0 -/Parent 938 0 R -/Next 940 0 R +/Prev 938 0 R +/Parent 918 0 R >> endobj 940 0 obj << -/Title (1.2.2 Ensure that the --basic-auth-file argument is not set \(Automated\)) -/Dest [ 511 0 R /XYZ 84.259843 277.220079 0 ] -/Count 0 -/Prev 939 0 R -/Parent 938 0 R -/Next 941 0 R +/Title (1.2 API Server) +/Dest [ 508 0 R /XYZ 41.740157 784.430079 0 ] +/Count 35 +/Prev 918 0 R +/First 941 0 R +/Last 975 0 R +/Parent 913 0 R +/Next 976 0 R >> endobj 941 0 obj << -/Title (1.2.3 Ensure that the --token-auth-file parameter is not set \(Automated\)) -/Dest [ 516 0 R /XYZ 84.259843 558.470079 0 ] +/Title (1.2.1 Ensure that the --anonymous-auth argument is set to false \(Automated\)) +/Dest [ 508 0 R /XYZ 84.259843 720.651496 0 ] /Count 0 -/Prev 940 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 942 0 R >> endobj 942 0 obj << -/Title (1.2.4 Ensure that the --kubelet-https argument is set to true \(Automated\)) -/Dest [ 521 0 R /XYZ 84.259843 799.370079 0 ] +/Title (1.2.2 Ensure that the --basic-auth-file argument is not set \(Automated\)) +/Dest [ 511 0 R /XYZ 84.259843 295.970079 0 ] /Count 0 /Prev 941 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 943 0 R >> endobj 943 0 obj << -/Title (1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate \(Automated\)) -/Dest [ 524 0 R /XYZ 84.259843 352.220079 0 ] +/Title (1.2.3 Ensure that the --token-auth-file parameter is not set \(Automated\)) +/Dest [ 516 0 R /XYZ 84.259843 595.970079 0 ] /Count 0 /Prev 942 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 944 0 R >> endobj 944 0 obj << -/Title (1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate \(Automated\)) -/Dest [ 529 0 R /XYZ 84.259843 558.470079 0 ] +/Title (1.2.4 Ensure that the --kubelet-https argument is set to true \(Automated\)) +/Dest [ 519 0 R /XYZ 84.259843 164.720079 0 ] /Count 0 /Prev 943 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 945 0 R >> endobj 945 0 obj << -/Title (1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow \(Automated\)) -/Dest [ 534 0 R /XYZ 84.259843 799.370079 0 ] +/Title (1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate \(Automated\)) +/Dest [ 524 0 R /XYZ 84.259843 427.220079 0 ] /Count 0 /Prev 944 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 946 0 R >> endobj 946 0 obj << -/Title (1.2.8 Ensure that the --authorization-mode argument includes Node \(Automated\)) -/Dest [ 537 0 R /XYZ 84.259843 352.220079 0 ] +/Title (1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate \(Automated\)) +/Dest [ 529 0 R /XYZ 84.259843 652.220079 0 ] /Count 0 /Prev 945 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 947 0 R >> endobj 947 0 obj << -/Title (1.2.9 Ensure that the --authorization-mode argument includes RBAC \(Automated\)) -/Dest [ 542 0 R /XYZ 84.259843 633.470079 0 ] +/Title (1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow \(Automated\)) +/Dest [ 532 0 R /XYZ 84.259843 183.470079 0 ] /Count 0 /Prev 946 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 948 0 R >> endobj 948 0 obj << -/Title (1.2.10 Ensure that the admission control plugin EventRateLimit is set \(Automated\)) -/Dest [ 545 0 R /XYZ 84.259843 183.470079 0 ] +/Title (1.2.8 Ensure that the --authorization-mode argument includes Node \(Automated\)) +/Dest [ 537 0 R /XYZ 84.259843 464.720079 0 ] /Count 0 /Prev 947 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 949 0 R >> endobj 949 0 obj << -/Title (1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set \(Automated\)) -/Dest [ 550 0 R /XYZ 84.259843 352.220079 0 ] +/Title (1.2.9 Ensure that the --authorization-mode argument includes RBAC \(Automated\)) +/Dest [ 542 0 R /XYZ 84.259843 745.970079 0 ] /Count 0 /Prev 948 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 950 0 R >> endobj 950 0 obj << -/Title (1.2.12 Ensure that the admission control plugin AlwaysPullImages is set \(Manual\)) -/Dest [ 555 0 R /XYZ 84.259843 520.970079 0 ] +/Title (1.2.10 Ensure that the admission control plugin EventRateLimit is set \(Automated\)) +/Dest [ 545 0 R /XYZ 84.259843 314.720079 0 ] /Count 0 /Prev 949 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 951 0 R >> endobj 951 0 obj << -/Title (1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used \(Manual\)) -/Dest [ 555 0 R /XYZ 84.259843 314.223057 0 ] +/Title (1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set \(Automated\)) +/Dest [ 550 0 R /XYZ 84.259843 520.970079 0 ] /Count 0 /Prev 950 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 952 0 R >> endobj 952 0 obj << -/Title (1.2.14 Ensure that the admission control plugin ServiceAccount is set \(Automated\)) -/Dest [ 559 0 R /XYZ 84.259843 799.370079 0 ] +/Title (1.2.12 Ensure that the admission control plugin AlwaysPullImages is set \(Manual\)) +/Dest [ 555 0 R /XYZ 84.259843 708.470079 0 ] /Count 0 /Prev 951 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 953 0 R >> endobj 953 0 obj << -/Title (1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set \(Automated\)) -/Dest [ 562 0 R /XYZ 84.259843 314.720079 0 ] +/Title (1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used \(Manual\)) +/Dest [ 555 0 R /XYZ 84.259843 501.723057 0 ] /Count 0 /Prev 952 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 954 0 R >> endobj 954 0 obj << -/Title (1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set \(Automated\)) -/Dest [ 567 0 R /XYZ 84.259843 558.470079 0 ] +/Title (1.2.14 Ensure that the admission control plugin ServiceAccount is set \(Automated\)) +/Dest [ 555 0 R /XYZ 84.259843 264.976036 0 ] /Count 0 /Prev 953 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 955 0 R >> endobj 955 0 obj << -/Title (1.2.17 Ensure that the admission control plugin NodeRestriction is set \(Automated\)) -/Dest [ 572 0 R /XYZ 84.259843 708.470079 0 ] +/Title (1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set \(Automated\)) +/Dest [ 562 0 R /XYZ 84.259843 520.970079 0 ] /Count 0 /Prev 954 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 956 0 R >> endobj 956 0 obj << -/Title (1.2.18 Ensure that the --insecure-bind-address argument is not set \(Automated\)) -/Dest [ 575 0 R /XYZ 84.259843 145.970079 0 ] +/Title (1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set \(Automated\)) +/Dest [ 567 0 R /XYZ 84.259843 799.370079 0 ] /Count 0 /Prev 955 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 957 0 R >> endobj 957 0 obj << -/Title (1.2.19 Ensure that the --insecure-port argument is set to 0 \(Automated\)) -/Dest [ 580 0 R /XYZ 84.259843 427.220079 0 ] +/Title (1.2.17 Ensure that the admission control plugin NodeRestriction is set \(Automated\)) +/Dest [ 570 0 R /XYZ 84.259843 258.470079 0 ] /Count 0 /Prev 956 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 958 0 R >> endobj 958 0 obj << -/Title (1.2.20 Ensure that the --secure-port argument is not set to 0 \(Automated\)) -/Dest [ 585 0 R /XYZ 84.259843 708.470079 0 ] +/Title (1.2.18 Ensure that the --insecure-bind-address argument is not set \(Automated\)) +/Dest [ 575 0 R /XYZ 84.259843 427.220079 0 ] /Count 0 /Prev 957 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 959 0 R >> endobj 959 0 obj << -/Title (1.2.21 Ensure that the --profiling argument is set to false \(Automated\)) -/Dest [ 588 0 R /XYZ 84.259843 258.470079 0 ] +/Title (1.2.19 Ensure that the --insecure-port argument is set to 0 \(Automated\)) +/Dest [ 580 0 R /XYZ 84.259843 727.220079 0 ] /Count 0 /Prev 958 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 960 0 R >> endobj 960 0 obj << -/Title (1.2.22 Ensure that the --audit-log-path argument is set \(Automated\)) -/Dest [ 593 0 R /XYZ 84.259843 558.470079 0 ] +/Title (1.2.20 Ensure that the --secure-port argument is not set to 0 \(Automated\)) +/Dest [ 583 0 R /XYZ 84.259843 314.720079 0 ] /Count 0 /Prev 959 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 961 0 R >> endobj 961 0 obj << -/Title (1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate \(Automated\)) -/Dest [ 598 0 R /XYZ 84.259843 799.370079 0 ] +/Title (1.2.21 Ensure that the --profiling argument is set to false \(Automated\)) +/Dest [ 588 0 R /XYZ 84.259843 595.970079 0 ] /Count 0 /Prev 960 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 962 0 R >> endobj 962 0 obj << -/Title (1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate \(Automated\)) -/Dest [ 601 0 R /XYZ 84.259843 352.220079 0 ] +/Title (1.2.22 Ensure that the --audit-log-path argument is set \(Automated\)) +/Dest [ 591 0 R /XYZ 84.259843 183.470079 0 ] /Count 0 /Prev 961 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 963 0 R >> endobj 963 0 obj << -/Title (1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate \(Automated\)) -/Dest [ 606 0 R /XYZ 84.259843 633.470079 0 ] +/Title (1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate \(Automated\)) +/Dest [ 596 0 R /XYZ 84.259843 445.970079 0 ] /Count 0 /Prev 962 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 964 0 R >> endobj 964 0 obj << -/Title (1.2.26 Ensure that the --request-timeout argument is set as appropriate \(Automated\)) -/Dest [ 609 0 R /XYZ 84.259843 183.470079 0 ] +/Title (1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate \(Automated\)) +/Dest [ 601 0 R /XYZ 84.259843 727.220079 0 ] /Count 0 /Prev 963 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 965 0 R >> endobj 965 0 obj << -/Title (1.2.27 Ensure that the --service-account-lookup argument is set to true \(Automated\)) -/Dest [ 614 0 R /XYZ 84.259843 408.470079 0 ] +/Title (1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate \(Automated\)) +/Dest [ 604 0 R /XYZ 84.259843 295.970079 0 ] /Count 0 /Prev 964 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 966 0 R >> endobj 966 0 obj << -/Title (1.2.28 Ensure that the --service-account-key-file argument is set as appropriate \(Automated\)) -/Dest [ 619 0 R /XYZ 84.259843 633.470079 0 ] +/Title (1.2.26 Ensure that the --request-timeout argument is set as appropriate \(Automated\)) +/Dest [ 609 0 R /XYZ 84.259843 595.970079 0 ] /Count 0 /Prev 965 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 967 0 R >> endobj 967 0 obj << -/Title (1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate \(Automated\)) -/Dest [ 622 0 R /XYZ 84.259843 183.470079 0 ] +/Title (1.2.27 Ensure that the --service-account-lookup argument is set to true \(Automated\)) +/Dest [ 612 0 R /XYZ 84.259843 164.720079 0 ] /Count 0 /Prev 966 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 968 0 R >> endobj 968 0 obj << -/Title (1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate \(Automated\)) -/Dest [ 627 0 R /XYZ 84.259843 427.220079 0 ] +/Title (1.2.28 Ensure that the --service-account-key-file argument is set as appropriate \(Automated\)) +/Dest [ 617 0 R /XYZ 84.259843 408.470079 0 ] /Count 0 /Prev 967 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 969 0 R >> endobj 969 0 obj << -/Title (1.2.31 Ensure that the --client-ca-file argument is set as appropriate \(Automated\)) -/Dest [ 632 0 R /XYZ 84.259843 633.470079 0 ] +/Title (1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate \(Automated\)) +/Dest [ 622 0 R /XYZ 84.259843 689.720079 0 ] /Count 0 /Prev 968 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 970 0 R >> endobj 970 0 obj << -/Title (1.2.32 Ensure that the --etcd-cafile argument is set as appropriate \(Automated\)) -/Dest [ 635 0 R /XYZ 84.259843 183.470079 0 ] +/Title (1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate \(Automated\)) +/Dest [ 625 0 R /XYZ 84.259843 239.720079 0 ] /Count 0 /Prev 969 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 971 0 R >> endobj 971 0 obj << -/Title (1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate \(Automated\)) -/Dest [ 640 0 R /XYZ 84.259843 427.220079 0 ] +/Title (1.2.31 Ensure that the --client-ca-file argument is set as appropriate \(Automated\)) +/Dest [ 630 0 R /XYZ 84.259843 483.470079 0 ] /Count 0 /Prev 970 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 972 0 R >> endobj 972 0 obj << -/Title (1.2.34 Ensure that encryption providers are appropriately configured \(Automated\)) -/Dest [ 645 0 R /XYZ 84.259843 670.970079 0 ] +/Title (1.2.32 Ensure that the --etcd-cafile argument is set as appropriate \(Automated\)) +/Dest [ 635 0 R /XYZ 84.259843 745.970079 0 ] /Count 0 /Prev 971 0 R -/Parent 938 0 R +/Parent 940 0 R /Next 973 0 R >> endobj 973 0 obj << -/Title (1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers \(Automated\)) -/Dest [ 667 0 R /XYZ 84.259843 506.287950 0 ] +/Title (1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate \(Automated\)) +/Dest [ 638 0 R /XYZ 84.259843 295.970079 0 ] /Count 0 /Prev 972 0 R -/Parent 938 0 R +/Parent 940 0 R +/Next 974 0 R >> endobj 974 0 obj << -/Title (1.3 Controller Manager) -/Dest [ 676 0 R /XYZ 41.740157 784.430079 0 ] -/Count 7 -/Prev 938 0 R -/First 975 0 R -/Last 981 0 R -/Parent 911 0 R -/Next 982 0 R +/Title (1.2.34 Ensure that encryption providers are appropriately configured \(Automated\)) +/Dest [ 643 0 R /XYZ 84.259843 577.220079 0 ] +/Count 0 +/Prev 973 0 R +/Parent 940 0 R +/Next 975 0 R >> endobj 975 0 obj << -/Title (1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate \(Automated\)) -/Dest [ 676 0 R /XYZ 84.259843 720.651496 0 ] +/Title (1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers \(Automated\)) +/Dest [ 660 0 R /XYZ 84.259843 411.552842 0 ] /Count 0 -/Parent 974 0 R -/Next 976 0 R +/Prev 974 0 R +/Parent 940 0 R >> endobj 976 0 obj << -/Title (1.3.2 Ensure that the --profiling argument is set to false \(Automated\)) -/Dest [ 676 0 R /XYZ 84.259843 167.404475 0 ] -/Count 0 -/Prev 975 0 R -/Parent 974 0 R -/Next 977 0 R +/Title (1.3 Controller Manager) +/Dest [ 674 0 R /XYZ 41.740157 784.430079 0 ] +/Count 7 +/Prev 940 0 R +/First 977 0 R +/Last 983 0 R +/Parent 913 0 R +/Next 984 0 R >> endobj 977 0 obj << -/Title (1.3.3 Ensure that the --use-service-account-credentials argument is set to true \(Automated\)) -/Dest [ 679 0 R /XYZ 84.259843 332.523057 0 ] +/Title (1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate \(Automated\)) +/Dest [ 674 0 R /XYZ 84.259843 720.651496 0 ] /Count 0 -/Prev 976 0 R -/Parent 974 0 R +/Parent 976 0 R /Next 978 0 R >> endobj 978 0 obj << -/Title (1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate \(Automated\)) -/Dest [ 683 0 R /XYZ 84.259843 511.220079 0 ] +/Title (1.3.2 Ensure that the --profiling argument is set to false \(Automated\)) +/Dest [ 677 0 R /XYZ 84.259843 727.220079 0 ] /Count 0 /Prev 977 0 R -/Parent 974 0 R +/Parent 976 0 R /Next 979 0 R >> endobj 979 0 obj << -/Title (1.3.5 Ensure that the --root-ca-file argument is set as appropriate \(Automated\)) -/Dest [ 686 0 R /XYZ 84.259843 670.970079 0 ] +/Title (1.3.3 Ensure that the --use-service-account-credentials argument is set to true \(Automated\)) +/Dest [ 680 0 R /XYZ 84.259843 745.970079 0 ] /Count 0 /Prev 978 0 R -/Parent 974 0 R +/Parent 976 0 R /Next 980 0 R >> endobj 980 0 obj << -/Title (1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true \(Automated\)) -/Dest [ 689 0 R /XYZ 84.259843 799.370079 0 ] +/Title (1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate \(Automated\)) +/Dest [ 683 0 R /XYZ 84.259843 745.970079 0 ] /Count 0 /Prev 979 0 R -/Parent 974 0 R +/Parent 976 0 R /Next 981 0 R >> endobj 981 0 obj << -/Title (1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 \(Automated\)) -/Dest [ 689 0 R /XYZ 84.259843 596.570079 0 ] +/Title (1.3.5 Ensure that the --root-ca-file argument is set as appropriate \(Automated\)) +/Dest [ 686 0 R /XYZ 84.259843 727.220079 0 ] /Count 0 /Prev 980 0 R -/Parent 974 0 R +/Parent 976 0 R +/Next 982 0 R >> endobj 982 0 obj << -/Title (1.4 Scheduler) -/Dest [ 694 0 R /XYZ 41.740157 784.430079 0 ] -/Count 2 -/Prev 974 0 R -/First 983 0 R -/Last 984 0 R -/Parent 911 0 R -/Next 985 0 R +/Title (1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true \(Automated\)) +/Dest [ 689 0 R /XYZ 84.259843 727.220079 0 ] +/Count 0 +/Prev 981 0 R +/Parent 976 0 R +/Next 983 0 R >> endobj 983 0 obj << -/Title (1.4.1 Ensure that the --profiling argument is set to false \(Automated\)) -/Dest [ 694 0 R /XYZ 84.259843 720.651496 0 ] +/Title (1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 \(Automated\)) +/Dest [ 689 0 R /XYZ 84.259843 524.420079 0 ] /Count 0 -/Parent 982 0 R -/Next 984 0 R +/Prev 982 0 R +/Parent 976 0 R >> endobj 984 0 obj << -/Title (1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 \(Automated\)) -/Dest [ 694 0 R /XYZ 84.259843 369.904475 0 ] -/Count 0 -/Prev 983 0 R -/Parent 982 0 R +/Title (1.4 Scheduler) +/Dest [ 694 0 R /XYZ 41.740157 784.430079 0 ] +/Count 2 +/Prev 976 0 R +/First 985 0 R +/Last 986 0 R +/Parent 913 0 R +/Next 987 0 R >> endobj 985 0 obj << -/Title (2 Etcd Node Configuration Files) -/Dest [ 700 0 R /XYZ 41.740157 784.430079 0 ] -/Count 7 -/Prev 982 0 R -/First 986 0 R -/Last 992 0 R -/Parent 911 0 R -/Next 993 0 R +/Title (1.4.1 Ensure that the --profiling argument is set to false \(Automated\)) +/Dest [ 694 0 R /XYZ 84.259843 720.651496 0 ] +/Count 0 +/Parent 984 0 R +/Next 986 0 R >> endobj 986 0 obj << -/Title (2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate \(Automated\)) -/Dest [ 700 0 R /XYZ 84.259843 684.651496 0 ] +/Title (1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 \(Automated\)) +/Dest [ 694 0 R /XYZ 84.259843 257.404475 0 ] /Count 0 -/Parent 985 0 R -/Next 987 0 R +/Prev 985 0 R +/Parent 984 0 R >> endobj 987 0 obj << -/Title (2.2 Ensure that the --client-cert-auth argument is set to true \(Automated\)) -/Dest [ 705 0 R /XYZ 84.259843 558.470079 0 ] -/Count 0 -/Prev 986 0 R -/Parent 985 0 R -/Next 988 0 R +/Title (2 Etcd Node Configuration Files) +/Dest [ 700 0 R /XYZ 41.740157 784.430079 0 ] +/Count 7 +/Prev 984 0 R +/First 988 0 R +/Last 994 0 R +/Parent 913 0 R +/Next 995 0 R >> endobj 988 0 obj << -/Title (2.3 Ensure that the --auto-tls argument is not set to true \(Automated\)) -/Dest [ 710 0 R /XYZ 84.259843 445.970079 0 ] +/Title (2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate \(Automated\)) +/Dest [ 700 0 R /XYZ 84.259843 684.651496 0 ] /Count 0 -/Prev 987 0 R -/Parent 985 0 R +/Parent 987 0 R /Next 989 0 R >> endobj 989 0 obj << -/Title (2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate \(Automated\)) -/Dest [ 715 0 R /XYZ 84.259843 333.470079 0 ] +/Title (2.2 Ensure that the --client-cert-auth argument is set to true \(Automated\)) +/Dest [ 705 0 R /XYZ 84.259843 464.720079 0 ] /Count 0 /Prev 988 0 R -/Parent 985 0 R +/Parent 987 0 R /Next 990 0 R >> endobj 990 0 obj << -/Title (2.5 Ensure that the --peer-client-cert-auth argument is set to true \(Automated\)) -/Dest [ 720 0 R /XYZ 84.259843 183.470079 0 ] +/Title (2.3 Ensure that the --auto-tls argument is not set to true \(Automated\)) +/Dest [ 710 0 R /XYZ 84.259843 258.470079 0 ] /Count 0 /Prev 989 0 R -/Parent 985 0 R +/Parent 987 0 R /Next 991 0 R >> endobj 991 0 obj << -/Title (2.6 Ensure that the --peer-auto-tls argument is not set to true \(Automated\)) -/Dest [ 727 0 R /XYZ 84.259843 727.220079 0 ] +/Title (2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate \(Automated\)) +/Dest [ 717 0 R /XYZ 84.259843 799.370079 0 ] /Count 0 /Prev 990 0 R -/Parent 985 0 R +/Parent 987 0 R /Next 992 0 R >> endobj 992 0 obj << -/Title (2.7 Ensure that a unique Certificate Authority is used for etcd \(Automated\)) -/Dest [ 732 0 R /XYZ 84.259843 595.970079 0 ] +/Title (2.5 Ensure that the --peer-client-cert-auth argument is set to true \(Automated\)) +/Dest [ 722 0 R /XYZ 84.259843 558.470079 0 ] /Count 0 /Prev 991 0 R -/Parent 985 0 R +/Parent 987 0 R +/Next 993 0 R >> endobj 993 0 obj << -/Title (3.1 Authentication and Authorization) -/Dest [ 739 0 R /XYZ 41.740157 784.430079 0 ] -/Count 1 -/Prev 985 0 R -/First 994 0 R -/Last 994 0 R -/Parent 911 0 R -/Next 995 0 R +/Title (2.6 Ensure that the --peer-auto-tls argument is not set to true \(Automated\)) +/Dest [ 727 0 R /XYZ 84.259843 333.470079 0 ] +/Count 0 +/Prev 992 0 R +/Parent 987 0 R +/Next 994 0 R >> endobj 994 0 obj << -/Title (3.1.1 Client certificate authentication should not be used for users \(Manual\)) -/Dest [ 739 0 R /XYZ 84.259843 684.651496 0 ] +/Title (2.7 Ensure that a unique Certificate Authority is used for etcd \(Automated\)) +/Dest [ 734 0 R /XYZ 84.259843 799.370079 0 ] /Count 0 -/Parent 993 0 R +/Prev 993 0 R +/Parent 987 0 R >> endobj 995 0 obj << -/Title (3.2 Logging) +/Title (3.1 Authentication and Authorization) /Dest [ 741 0 R /XYZ 41.740157 784.430079 0 ] -/Count 2 -/Prev 993 0 R +/Count 1 +/Prev 987 0 R /First 996 0 R -/Last 997 0 R -/Parent 911 0 R -/Next 998 0 R +/Last 996 0 R +/Parent 913 0 R +/Next 997 0 R >> endobj 996 0 obj << -/Title (3.2.1 Ensure that a minimal audit policy is created \(Automated\)) -/Dest [ 741 0 R /XYZ 84.259843 720.651496 0 ] +/Title (3.1.1 Client certificate authentication should not be used for users \(Manual\)) +/Dest [ 741 0 R /XYZ 84.259843 684.651496 0 ] /Count 0 /Parent 995 0 R -/Next 997 0 R >> endobj 997 0 obj << -/Title (3.2.2 Ensure that the audit policy covers key security concerns \(Manual\)) -/Dest [ 744 0 R /XYZ 84.259843 314.720079 0 ] -/Count 0 -/Prev 996 0 R -/Parent 995 0 R +/Title (3.2 Logging) +/Dest [ 743 0 R /XYZ 41.740157 784.430079 0 ] +/Count 2 +/Prev 995 0 R +/First 998 0 R +/Last 999 0 R +/Parent 913 0 R +/Next 1000 0 R >> endobj 998 0 obj << -/Title (4.1 Worker Node Configuration Files) -/Dest [ 746 0 R /XYZ 41.740157 784.430079 0 ] -/Count 10 -/Prev 995 0 R -/First 999 0 R -/Last 1008 0 R -/Parent 911 0 R -/Next 1009 0 R +/Title (3.2.1 Ensure that a minimal audit policy is created \(Automated\)) +/Dest [ 743 0 R /XYZ 84.259843 720.651496 0 ] +/Count 0 +/Parent 997 0 R +/Next 999 0 R >> endobj 999 0 obj << -/Title (4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 746 0 R /XYZ 84.259843 684.651496 0 ] +/Title (3.2.2 Ensure that the audit policy covers key security concerns \(Manual\)) +/Dest [ 746 0 R /XYZ 84.259843 333.470079 0 ] /Count 0 -/Parent 998 0 R -/Next 1000 0 R +/Prev 998 0 R +/Parent 997 0 R >> endobj 1000 0 obj << -/Title (4.1.2 Ensure that the kubelet service file ownership is set to root:root \(Automated\)) -/Dest [ 746 0 R /XYZ 84.259843 553.851496 0 ] -/Count 0 -/Prev 999 0 R -/Parent 998 0 R -/Next 1001 0 R +/Title (4.1 Worker Node Configuration Files) +/Dest [ 748 0 R /XYZ 41.740157 784.430079 0 ] +/Count 10 +/Prev 997 0 R +/First 1001 0 R +/Last 1010 0 R +/Parent 913 0 R +/Next 1011 0 R >> endobj 1001 0 obj << -/Title (4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 746 0 R /XYZ 84.259843 423.051496 0 ] +/Title (4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 748 0 R /XYZ 84.259843 684.651496 0 ] /Count 0 -/Prev 1000 0 R -/Parent 998 0 R +/Parent 1000 0 R /Next 1002 0 R >> endobj 1002 0 obj << -/Title (4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root \(Automated\)) -/Dest [ 749 0 R /XYZ 84.259843 763.220079 0 ] +/Title (4.1.2 Ensure that the kubelet service file ownership is set to root:root \(Automated\)) +/Dest [ 748 0 R /XYZ 84.259843 553.851496 0 ] /Count 0 /Prev 1001 0 R -/Parent 998 0 R +/Parent 1000 0 R /Next 1003 0 R >> endobj 1003 0 obj << -/Title (4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 749 0 R /XYZ 84.259843 454.079014 0 ] +/Title (4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 748 0 R /XYZ 84.259843 423.051496 0 ] /Count 0 /Prev 1002 0 R -/Parent 998 0 R +/Parent 1000 0 R /Next 1004 0 R >> endobj 1004 0 obj << -/Title (4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root \(Automated\)) -/Dest [ 749 0 R /XYZ 84.259843 163.687950 0 ] +/Title (4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root \(Automated\)) +/Dest [ 751 0 R /XYZ 84.259843 763.220079 0 ] /Count 0 /Prev 1003 0 R -/Parent 998 0 R +/Parent 1000 0 R /Next 1005 0 R >> endobj 1005 0 obj << -/Title (4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 753 0 R /XYZ 84.259843 519.629014 0 ] +/Title (4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 751 0 R /XYZ 84.259843 454.079014 0 ] /Count 0 /Prev 1004 0 R -/Parent 998 0 R +/Parent 1000 0 R /Next 1006 0 R >> endobj 1006 0 obj << -/Title (4.1.8 Ensure that the client certificate authorities file ownership is set to root:root \(Automated\)) -/Dest [ 762 0 R /XYZ 84.259843 799.370079 0 ] +/Title (4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root \(Automated\)) +/Dest [ 751 0 R /XYZ 84.259843 163.687950 0 ] /Count 0 /Prev 1005 0 R -/Parent 998 0 R +/Parent 1000 0 R /Next 1007 0 R >> endobj 1007 0 obj << -/Title (4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive \(Automated\)) -/Dest [ 762 0 R /XYZ 84.259843 383.493907 0 ] +/Title (4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 755 0 R /XYZ 84.259843 519.629014 0 ] /Count 0 /Prev 1006 0 R -/Parent 998 0 R +/Parent 1000 0 R /Next 1008 0 R >> endobj 1008 0 obj << -/Title (4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root \(Automated\)) -/Dest [ 762 0 R /XYZ 84.259843 195.693907 0 ] +/Title (4.1.8 Ensure that the client certificate authorities file ownership is set to root:root \(Automated\)) +/Dest [ 764 0 R /XYZ 84.259843 799.370079 0 ] /Count 0 /Prev 1007 0 R -/Parent 998 0 R +/Parent 1000 0 R +/Next 1009 0 R >> endobj 1009 0 obj << -/Title (4.2 Kubelet) -/Dest [ 772 0 R /XYZ 41.740157 784.430079 0 ] -/Count 13 -/Prev 998 0 R -/First 1010 0 R -/Last 1022 0 R -/Parent 911 0 R -/Next 1023 0 R +/Title (4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive \(Automated\)) +/Dest [ 764 0 R /XYZ 84.259843 383.493907 0 ] +/Count 0 +/Prev 1008 0 R +/Parent 1000 0 R +/Next 1010 0 R >> endobj 1010 0 obj << -/Title (4.2.1 Ensure that the anonymous-auth argument is set to false \(Automated\)) -/Dest [ 772 0 R /XYZ 84.259843 720.651496 0 ] +/Title (4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root \(Automated\)) +/Dest [ 764 0 R /XYZ 84.259843 195.693907 0 ] /Count 0 -/Parent 1009 0 R -/Next 1011 0 R +/Prev 1009 0 R +/Parent 1000 0 R >> endobj 1011 0 obj << -/Title (4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow \(Automated\)) -/Dest [ 772 0 R /XYZ 84.259843 332.207453 0 ] -/Count 0 -/Prev 1010 0 R -/Parent 1009 0 R -/Next 1012 0 R +/Title (4.2 Kubelet) +/Dest [ 774 0 R /XYZ 41.740157 784.430079 0 ] +/Count 13 +/Prev 1000 0 R +/First 1012 0 R +/Last 1024 0 R +/Parent 913 0 R +/Next 1025 0 R >> endobj 1012 0 obj << -/Title (4.2.3 Ensure that the --client-ca-file argument is set as appropriate \(Automated\)) -/Dest [ 777 0 R /XYZ 84.259843 675.273057 0 ] +/Title (4.2.1 Ensure that the anonymous-auth argument is set to false \(Automated\)) +/Dest [ 774 0 R /XYZ 84.259843 720.651496 0 ] /Count 0 -/Prev 1011 0 R -/Parent 1009 0 R +/Parent 1011 0 R /Next 1013 0 R >> endobj 1013 0 obj << -/Title (4.2.4 Ensure that the --read-only-port argument is set to 0 \(Automated\)) -/Dest [ 777 0 R /XYZ 84.259843 301.829014 0 ] +/Title (4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow \(Automated\)) +/Dest [ 774 0 R /XYZ 84.259843 332.207453 0 ] /Count 0 /Prev 1012 0 R -/Parent 1009 0 R +/Parent 1011 0 R /Next 1014 0 R >> endobj 1014 0 obj << -/Title (4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 \(Automated\)) -/Dest [ 782 0 R /XYZ 84.259843 641.326036 0 ] +/Title (4.2.3 Ensure that the --client-ca-file argument is set as appropriate \(Automated\)) +/Dest [ 779 0 R /XYZ 84.259843 675.273057 0 ] /Count 0 /Prev 1013 0 R -/Parent 1009 0 R +/Parent 1011 0 R /Next 1015 0 R >> endobj 1015 0 obj << -/Title (4.2.6 Ensure that the --protect-kernel-defaults argument is set to true \(Automated\)) -/Dest [ 788 0 R /XYZ 84.259843 445.970079 0 ] +/Title (4.2.4 Ensure that the --read-only-port argument is set to 0 \(Automated\)) +/Dest [ 779 0 R /XYZ 84.259843 301.829014 0 ] /Count 0 /Prev 1014 0 R -/Parent 1009 0 R +/Parent 1011 0 R /Next 1016 0 R >> endobj 1016 0 obj << -/Title (4.2.7 Ensure that the --make-iptables-util-chains argument is set to true \(Automated\)) -/Dest [ 792 0 R /XYZ 84.259843 799.370079 0 ] +/Title (4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 \(Automated\)) +/Dest [ 784 0 R /XYZ 84.259843 641.326036 0 ] /Count 0 /Prev 1015 0 R -/Parent 1009 0 R +/Parent 1011 0 R /Next 1017 0 R >> endobj 1017 0 obj << -/Title (4.2.8 Ensure that the --hostname-override argument is not set \(Manual\)) -/Dest [ 792 0 R /XYZ 84.259843 425.926036 0 ] +/Title (4.2.6 Ensure that the --protect-kernel-defaults argument is set to true \(Automated\)) +/Dest [ 790 0 R /XYZ 84.259843 445.970079 0 ] /Count 0 /Prev 1016 0 R -/Parent 1009 0 R +/Parent 1011 0 R /Next 1018 0 R >> endobj 1018 0 obj << -/Title (4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture \(Automated\)) -/Dest [ 792 0 R /XYZ 84.259843 208.126036 0 ] +/Title (4.2.7 Ensure that the --make-iptables-util-chains argument is set to true \(Automated\)) +/Dest [ 794 0 R /XYZ 84.259843 799.370079 0 ] /Count 0 /Prev 1017 0 R -/Parent 1009 0 R +/Parent 1011 0 R /Next 1019 0 R >> endobj 1019 0 obj << -/Title (4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate \(Automated\)) -/Dest [ 796 0 R /XYZ 84.259843 542.326036 0 ] +/Title (4.2.8 Ensure that the --hostname-override argument is not set \(Manual\)) +/Dest [ 794 0 R /XYZ 84.259843 425.926036 0 ] /Count 0 /Prev 1018 0 R -/Parent 1009 0 R +/Parent 1011 0 R /Next 1020 0 R >> endobj 1020 0 obj << -/Title (4.2.11 Ensure that the --rotate-certificates argument is not set to false \(Automated\)) -/Dest [ 796 0 R /XYZ 84.259843 138.881993 0 ] +/Title (4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture \(Automated\)) +/Dest [ 794 0 R /XYZ 84.259843 208.126036 0 ] /Count 0 /Prev 1019 0 R -/Parent 1009 0 R +/Parent 1011 0 R /Next 1021 0 R >> endobj 1021 0 obj << -/Title (4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true \(Automated\)) -/Dest [ 806 0 R /XYZ 84.259843 670.970079 0 ] +/Title (4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate \(Automated\)) +/Dest [ 798 0 R /XYZ 84.259843 542.326036 0 ] /Count 0 /Prev 1020 0 R -/Parent 1009 0 R +/Parent 1011 0 R /Next 1022 0 R >> endobj 1022 0 obj << -/Title (4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers \(Automated\)) -/Dest [ 806 0 R /XYZ 84.259843 392.223057 0 ] +/Title (4.2.11 Ensure that the --rotate-certificates argument is not set to false \(Automated\)) +/Dest [ 798 0 R /XYZ 84.259843 138.881993 0 ] /Count 0 /Prev 1021 0 R -/Parent 1009 0 R +/Parent 1011 0 R +/Next 1023 0 R >> endobj 1023 0 obj << -/Title (5.1 RBAC and Service Accounts) -/Dest [ 813 0 R /XYZ 41.740157 784.430079 0 ] -/Count 6 -/Prev 1009 0 R -/First 1024 0 R -/Last 1029 0 R -/Parent 911 0 R -/Next 1030 0 R +/Title (4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true \(Automated\)) +/Dest [ 808 0 R /XYZ 84.259843 670.970079 0 ] +/Count 0 +/Prev 1022 0 R +/Parent 1011 0 R +/Next 1024 0 R >> endobj 1024 0 obj << -/Title (5.1.1 Ensure that the cluster-admin role is only used where required \(Manual\)) -/Dest [ 813 0 R /XYZ 84.259843 684.651496 0 ] +/Title (4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers \(Automated\)) +/Dest [ 808 0 R /XYZ 84.259843 392.223057 0 ] /Count 0 -/Parent 1023 0 R -/Next 1025 0 R +/Prev 1023 0 R +/Parent 1011 0 R >> endobj 1025 0 obj << -/Title (5.1.2 Minimize access to secrets \(Manual\)) -/Dest [ 813 0 R /XYZ 84.259843 523.851496 0 ] -/Count 0 -/Prev 1024 0 R -/Parent 1023 0 R -/Next 1026 0 R +/Title (5.1 RBAC and Service Accounts) +/Dest [ 815 0 R /XYZ 41.740157 784.430079 0 ] +/Count 6 +/Prev 1011 0 R +/First 1026 0 R +/Last 1031 0 R +/Parent 913 0 R +/Next 1032 0 R >> endobj 1026 0 obj << -/Title (5.1.3 Minimize wildcard use in Roles and ClusterRoles \(Manual\)) -/Dest [ 813 0 R /XYZ 84.259843 423.051496 0 ] +/Title (5.1.1 Ensure that the cluster-admin role is only used where required \(Manual\)) +/Dest [ 815 0 R /XYZ 84.259843 684.651496 0 ] /Count 0 -/Prev 1025 0 R -/Parent 1023 0 R +/Parent 1025 0 R /Next 1027 0 R >> endobj 1027 0 obj << -/Title (5.1.4 Minimize access to create pods \(Manual\)) -/Dest [ 813 0 R /XYZ 84.259843 307.251496 0 ] +/Title (5.1.2 Minimize access to secrets \(Manual\)) +/Dest [ 815 0 R /XYZ 84.259843 523.851496 0 ] /Count 0 /Prev 1026 0 R -/Parent 1023 0 R +/Parent 1025 0 R /Next 1028 0 R >> endobj 1028 0 obj << -/Title (5.1.5 Ensure that default service accounts are not actively used. \(Automated\)) -/Dest [ 813 0 R /XYZ 84.259843 206.451496 0 ] +/Title (5.1.3 Minimize wildcard use in Roles and ClusterRoles \(Manual\)) +/Dest [ 815 0 R /XYZ 84.259843 423.051496 0 ] /Count 0 /Prev 1027 0 R -/Parent 1023 0 R +/Parent 1025 0 R /Next 1029 0 R >> endobj 1029 0 obj << -/Title (5.1.6 Ensure that Service Account Tokens are only mounted where necessary \(Manual\)) -/Dest [ 840 0 R /XYZ 84.259843 449.446885 0 ] +/Title (5.1.4 Minimize access to create pods \(Manual\)) +/Dest [ 815 0 R /XYZ 84.259843 307.251496 0 ] /Count 0 /Prev 1028 0 R -/Parent 1023 0 R +/Parent 1025 0 R +/Next 1030 0 R >> endobj 1030 0 obj << -/Title (5.2 Pod Security Policies) -/Dest [ 851 0 R /XYZ 41.740157 784.430079 0 ] -/Count 9 -/Prev 1023 0 R -/First 1031 0 R -/Last 1039 0 R -/Parent 911 0 R -/Next 1040 0 R +/Title (5.1.5 Ensure that default service accounts are not actively used. \(Automated\)) +/Dest [ 815 0 R /XYZ 84.259843 206.451496 0 ] +/Count 0 +/Prev 1029 0 R +/Parent 1025 0 R +/Next 1031 0 R >> endobj 1031 0 obj << -/Title (5.2.1 Minimize the admission of privileged containers \(Manual\)) -/Dest [ 851 0 R /XYZ 84.259843 720.651496 0 ] +/Title (5.1.6 Ensure that Service Account Tokens are only mounted where necessary \(Manual\)) +/Dest [ 842 0 R /XYZ 84.259843 449.446885 0 ] /Count 0 -/Parent 1030 0 R -/Next 1032 0 R +/Prev 1030 0 R +/Parent 1025 0 R >> endobj 1032 0 obj << -/Title (5.2.2 Minimize the admission of containers wishing to share the host process ID namespace \(Automated\)) -/Dest [ 851 0 R /XYZ 84.259843 589.851496 0 ] -/Count 0 -/Prev 1031 0 R -/Parent 1030 0 R -/Next 1033 0 R +/Title (5.2 Pod Security Policies) +/Dest [ 853 0 R /XYZ 41.740157 784.430079 0 ] +/Count 9 +/Prev 1025 0 R +/First 1033 0 R +/Last 1041 0 R +/Parent 913 0 R +/Next 1042 0 R >> endobj 1033 0 obj << -/Title (5.2.3 Minimize the admission of containers wishing to share the host IPC namespace \(Automated\)) -/Dest [ 851 0 R /XYZ 84.259843 238.710432 0 ] +/Title (5.2.1 Minimize the admission of privileged containers \(Manual\)) +/Dest [ 853 0 R /XYZ 84.259843 720.651496 0 ] /Count 0 -/Prev 1032 0 R -/Parent 1030 0 R +/Parent 1032 0 R /Next 1034 0 R >> endobj 1034 0 obj << -/Title (5.2.4 Minimize the admission of containers wishing to share the host network namespace \(Automated\)) -/Dest [ 854 0 R /XYZ 84.259843 603.629014 0 ] +/Title (5.2.2 Minimize the admission of containers wishing to share the host process ID namespace \(Automated\)) +/Dest [ 853 0 R /XYZ 84.259843 589.851496 0 ] /Count 0 /Prev 1033 0 R -/Parent 1030 0 R +/Parent 1032 0 R /Next 1035 0 R >> endobj 1035 0 obj << -/Title (5.2.5 Minimize the admission of containers with allowPrivilegeEscalation \(Automated\)) -/Dest [ 854 0 R /XYZ 84.259843 252.487950 0 ] +/Title (5.2.3 Minimize the admission of containers wishing to share the host IPC namespace \(Automated\)) +/Dest [ 853 0 R /XYZ 84.259843 238.710432 0 ] /Count 0 /Prev 1034 0 R -/Parent 1030 0 R +/Parent 1032 0 R /Next 1036 0 R >> endobj 1036 0 obj << -/Title (5.2.6 Minimize the admission of root containers \(Manual\)) -/Dest [ 858 0 R /XYZ 84.259843 584.681993 0 ] +/Title (5.2.4 Minimize the admission of containers wishing to share the host network namespace \(Automated\)) +/Dest [ 856 0 R /XYZ 84.259843 603.629014 0 ] /Count 0 /Prev 1035 0 R -/Parent 1030 0 R +/Parent 1032 0 R /Next 1037 0 R >> endobj 1037 0 obj << -/Title (5.2.7 Minimize the admission of containers with the NET_RAW capability \(Manual\)) -/Dest [ 858 0 R /XYZ 84.259843 453.881993 0 ] +/Title (5.2.5 Minimize the admission of containers with allowPrivilegeEscalation \(Automated\)) +/Dest [ 856 0 R /XYZ 84.259843 252.487950 0 ] /Count 0 /Prev 1036 0 R -/Parent 1030 0 R +/Parent 1032 0 R /Next 1038 0 R >> endobj 1038 0 obj << -/Title (5.2.8 Minimize the admission of containers with added capabilities \(Manual\)) -/Dest [ 858 0 R /XYZ 84.259843 323.081993 0 ] +/Title (5.2.6 Minimize the admission of root containers \(Manual\)) +/Dest [ 860 0 R /XYZ 84.259843 584.681993 0 ] /Count 0 /Prev 1037 0 R -/Parent 1030 0 R +/Parent 1032 0 R /Next 1039 0 R >> endobj 1039 0 obj << -/Title (5.2.9 Minimize the admission of containers with capabilities assigned \(Manual\)) -/Dest [ 858 0 R /XYZ 84.259843 207.281993 0 ] +/Title (5.2.7 Minimize the admission of containers with the NET_RAW capability \(Manual\)) +/Dest [ 860 0 R /XYZ 84.259843 453.881993 0 ] /Count 0 /Prev 1038 0 R -/Parent 1030 0 R +/Parent 1032 0 R +/Next 1040 0 R >> endobj 1040 0 obj << -/Title (5.3 Network Policies and CNI) -/Dest [ 861 0 R /XYZ 41.740157 784.430079 0 ] -/Count 2 -/Prev 1030 0 R -/First 1041 0 R -/Last 1042 0 R -/Parent 911 0 R -/Next 1043 0 R +/Title (5.2.8 Minimize the admission of containers with added capabilities \(Manual\)) +/Dest [ 860 0 R /XYZ 84.259843 323.081993 0 ] +/Count 0 +/Prev 1039 0 R +/Parent 1032 0 R +/Next 1041 0 R >> endobj 1041 0 obj << -/Title (5.3.1 Ensure that the CNI in use supports Network Policies \(Manual\)) -/Dest [ 861 0 R /XYZ 84.259843 684.651496 0 ] +/Title (5.2.9 Minimize the admission of containers with capabilities assigned \(Manual\)) +/Dest [ 860 0 R /XYZ 84.259843 207.281993 0 ] /Count 0 -/Parent 1040 0 R -/Next 1042 0 R +/Prev 1040 0 R +/Parent 1032 0 R >> endobj 1042 0 obj << -/Title (5.3.2 Ensure that all Namespaces have Network Policies defined \(Automated\)) -/Dest [ 861 0 R /XYZ 84.259843 538.851496 0 ] -/Count 0 -/Prev 1041 0 R -/Parent 1040 0 R +/Title (5.3 Network Policies and CNI) +/Dest [ 863 0 R /XYZ 41.740157 784.430079 0 ] +/Count 2 +/Prev 1032 0 R +/First 1043 0 R +/Last 1044 0 R +/Parent 913 0 R +/Next 1045 0 R >> endobj 1043 0 obj << -/Title (5.4 Secrets Management) -/Dest [ 885 0 R /XYZ 41.740157 784.430079 0 ] -/Count 2 -/Prev 1040 0 R -/First 1044 0 R -/Last 1045 0 R -/Parent 911 0 R -/Next 1046 0 R +/Title (5.3.1 Ensure that the CNI in use supports Network Policies \(Manual\)) +/Dest [ 863 0 R /XYZ 84.259843 684.651496 0 ] +/Count 0 +/Parent 1042 0 R +/Next 1044 0 R >> endobj 1044 0 obj << -/Title (5.4.1 Prefer using secrets as files over secrets as environment variables \(Manual\)) -/Dest [ 885 0 R /XYZ 84.259843 684.651496 0 ] +/Title (5.3.2 Ensure that all Namespaces have Network Policies defined \(Automated\)) +/Dest [ 863 0 R /XYZ 84.259843 538.851496 0 ] /Count 0 -/Parent 1043 0 R -/Next 1045 0 R +/Prev 1043 0 R +/Parent 1042 0 R >> endobj 1045 0 obj << -/Title (5.4.2 Consider external secret storage \(Manual\)) -/Dest [ 885 0 R /XYZ 84.259843 568.851496 0 ] -/Count 0 -/Prev 1044 0 R -/Parent 1043 0 R +/Title (5.4 Secrets Management) +/Dest [ 887 0 R /XYZ 41.740157 784.430079 0 ] +/Count 2 +/Prev 1042 0 R +/First 1046 0 R +/Last 1047 0 R +/Parent 913 0 R +/Next 1048 0 R >> endobj 1046 0 obj << -/Title (5.5 Extensible Admission Control) -/Dest [ 887 0 R /XYZ 41.740157 784.430079 0 ] -/Count 1 -/Prev 1043 0 R -/First 1047 0 R -/Last 1047 0 R -/Parent 911 0 R -/Next 1048 0 R +/Title (5.4.1 Prefer using secrets as files over secrets as environment variables \(Manual\)) +/Dest [ 887 0 R /XYZ 84.259843 684.651496 0 ] +/Count 0 +/Parent 1045 0 R +/Next 1047 0 R >> endobj 1047 0 obj << -/Title (5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller \(Manual\)) -/Dest [ 887 0 R /XYZ 84.259843 684.651496 0 ] +/Title (5.4.2 Consider external secret storage \(Manual\)) +/Dest [ 887 0 R /XYZ 84.259843 568.851496 0 ] /Count 0 -/Parent 1046 0 R +/Prev 1046 0 R +/Parent 1045 0 R >> endobj 1048 0 obj << -/Title (5.7 General Policies) +/Title (5.5 Extensible Admission Control) /Dest [ 889 0 R /XYZ 41.740157 784.430079 0 ] -/Count 4 -/Prev 1046 0 R +/Count 1 +/Prev 1045 0 R /First 1049 0 R -/Last 1052 0 R -/Parent 911 0 R +/Last 1049 0 R +/Parent 913 0 R +/Next 1050 0 R >> endobj 1049 0 obj << -/Title (5.7.1 Create administrative boundaries between resources using namespaces \(Manual\)) -/Dest [ 889 0 R /XYZ 84.259843 720.651496 0 ] +/Title (5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller \(Manual\)) +/Dest [ 889 0 R /XYZ 84.259843 684.651496 0 ] /Count 0 /Parent 1048 0 R -/Next 1050 0 R >> endobj 1050 0 obj << -/Title (5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions \(Manual\)) -/Dest [ 889 0 R /XYZ 84.259843 604.851496 0 ] -/Count 0 -/Prev 1049 0 R -/Parent 1048 0 R -/Next 1051 0 R +/Title (5.7 General Policies) +/Dest [ 891 0 R /XYZ 41.740157 784.430079 0 ] +/Count 4 +/Prev 1048 0 R +/First 1051 0 R +/Last 1054 0 R +/Parent 913 0 R >> endobj 1051 0 obj << -/Title (5.7.3 Apply Security Context to Your Pods and Containers \(Manual\)) -/Dest [ 889 0 R /XYZ 84.259843 324.051496 0 ] +/Title (5.7.1 Create administrative boundaries between resources using namespaces \(Manual\)) +/Dest [ 891 0 R /XYZ 84.259843 720.651496 0 ] /Count 0 -/Prev 1050 0 R -/Parent 1048 0 R +/Parent 1050 0 R /Next 1052 0 R >> endobj 1052 0 obj << -/Title (5.7.4 The default namespace should not be used \(Automated\)) -/Dest [ 889 0 R /XYZ 84.259843 193.251496 0 ] +/Title (5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions \(Manual\)) +/Dest [ 891 0 R /XYZ 84.259843 604.851496 0 ] /Count 0 /Prev 1051 0 R -/Parent 1048 0 R +/Parent 1050 0 R +/Next 1053 0 R >> endobj 1053 0 obj << -/Count 142 -/First 911 0 R -/Last 911 0 R +/Title (5.7.3 Apply Security Context to Your Pods and Containers \(Manual\)) +/Dest [ 891 0 R /XYZ 84.259843 324.051496 0 ] +/Count 0 +/Prev 1052 0 R +/Parent 1050 0 R +/Next 1054 0 R >> endobj 1054 0 obj << -/Length1 41004 -/Filter /FlateDecode -/Length 7588 +/Title (5.7.4 The default namespace should not be used \(Automated\)) +/Dest [ 891 0 R /XYZ 84.259843 193.251496 0 ] +/Count 0 +/Prev 1053 0 R +/Parent 1050 0 R >> -stream -x| xUut;YH',-11QZM`D!Ȓ@XAM @aDp\*qЙhԘp{F6K5;Sc')A k*<Ex©3g9Q}Ss -@S2u¼7OOɍZ?͠Ta}.lR9.ǶOl#>Q09qx/a̜ -C -Fj3sJ·w@򳋅Es[> 4zy)} D)T ׼y#C*>vkz޽r!;~P?LA9z!B~Z6D#cVV&mbC^[Ka5@.,tUvlC嵿tݠFXkc?Rx{oVk%^wO#}Z%~[ F3o*?W*֏+_&KWd/9J'x ~t?5` ^8H/ K8q|8J|\sv* -_;8_X8cv]j9=.pwXq{.VQJqsi+,0iK.>&=mɄ9n 6p -TQ럱J+>݈ʏK8(xqOfuwi I{lY*s*3REi.$M -;evi9ev|R%}-/Y"=q\ţ]Rq\1+.|8qN#nBgq9>j/=: -q_Sq -\9Na N+8g78>&=c9.lҨPIp2GgFpφ9'8bᐈi  8pW&ۈ=DZǻrHw;@.f 2|-7pͱWOԫ{I=#,aĴL,rÌ)f)%ؽQnnF욊]:{.9!ubR=xYD8r h3ځ\jH!2#Mts oN1 -aCs141:cG5pph[h` 8Z%M64rTD9Ez(jײIB7d6xuf5p-lΦ*yT:;ʄnT jY -pl(Q-G7h8LcfN #xzEy1[,biC+7!8,DA Ep 4Vq/|E_=ka'/NV%B0jHa3Q=?϶ 1.F]"G %t y< E"H Ѕ{kF`7Fסf ;iYTb O -1V-~ `67}/,ME좈e\(*Ί'̢$&*D{?m#4:oD3vV}ХyCHms, -bHL`]bN!CD/xW9==X!e -+\&]ç 7_+]|zV_A2,,DFE*F`"̑Qks}h]^2H9*1an0gL M 5>S3`ۛ -fVZo$RΑoߚ 6\tL|Bzp7MHO3.-5X\#/`ע/?WniqÜJ76 ~7zX:򔨰.wfz|n'YB1M,&::!F+ kvʨc `hQ1GOņTo4>xS=ԓaVJDJdJT'%:%_/y|ѾȬ,OVtVLVBaŠҨROi򄪄 m]:uȎ̎dGFFz -F.ZYz˙N~!4#-,M55V?^ܐ}dWO/vL!]^=GUBrB8hW*$&ZZGe;%(. nZ<*jI" -#"ލ!~/\jHV]MP -WAqlU|0EMGLt~aIM_2Cª͵V 'y]Y/f"|/Lt}n,\g `0JJ@ySu&-U<ڪՐ1tSm1lJvrUTZ?roi |KVWxUvnʟ)[;>E_wher^c`b#ԝT} h ;viG~][ieNsk/_[yv6?$lݶRټuJw",տ6@U>!:Ab)A5g2f dd7S51* ʱ3/JR,,-Hbl0e2;4r]n>tޕΕP܌}F+Vru؇qk@%gMnҝxWsWK_c_S_s_'$͝ɮQI踄敖W AM-V Da' GaLHNHRIҤ򤪤IBξ=Rۃ,Uwz ee;?7sϷo;,;8zoH-GbcO`X70b$G7i+Y9VI =~Z̤c:mj!K:i@E.TV꫗vJ[6Wؼ}!{-[i }};l9k,2][T}j6+pTY ~nuTSsyb`DŽ]9۶)T?ouܭJ1dɗǙ 7d@/ FΞ^% =wG~t =Ci#Wn`QX(V -KuNAQ'2+ ;ϒ0I(`1EɄL6`٧l<Bo+>h`:^HPP\NM #18KԪX[Fm<}Ye5Nk屧/0$EQl:VVB)g> f>hi>ͥ,jC}PQ7Q >9hS9Def;y͞=}Q(EtUg-Ҿ(4K;-[>Ek}c҂ۭwZ_>Q @$]qdLuJi:io(ͤud0 S:4` t04:da@`3wI~9-dӧ̙EfL$P4UZjaT mZO7?_jV-no?ZDͭ ZCޡ)oZ}CMkmZ ,Dju\8bٖaxFVj5OFC!@=v^"ZSH `CH#<@;j$FC;xuJΙ2sfQ)fzά(SQS#37gMWk -̄9fQ˹yR3F[ӦoDy8f!ϐra><A(tR2-Ue&meX:Ϧj5meߚ J8V;/Ƹ~ByO54Q`1> -endstream endobj 1055 0 obj << -/Length1 7648 -/Filter /FlateDecode -/Length 4714 +/Count 142 +/First 913 0 R +/Last 913 0 R >> -stream -x9yxSU眛&-Pڴ P&鞦M=ݒ%;m)tR"oTe(::q ysޟ}{9wo9#fQ e\Xм`tUQ3O+qj{a z|}L|E[p߮J5k;@ն@ahٿgc!{E/Ee>;Yvn^LY,BsޅGV T@_GqW0 #?EO2+))A Y \B)~y~m -!/-:nXݦ -ZpvdB9s&LZ>=*E{eǏew2|i a=J$%NNV0f%k& Bd5вmQdkANFi$9wПȉJ*aym1;"P9{ 1g_gA0;y^^~cԁ1lT'$ҍIQ}D -!5*hT܍aB Ff?HB&Z# T,xcoDh.gR`Ky`ȃjn@Ь& ;lۗO Ǘ^=ނr}bfq!iB -= _. Lg A$@+p :N -Ňyz ;* .6w -_^%,{ED}>#|vxIx_s򈦈E<nWfCY~IF\HdOϟ1Tf\nqPhS"\d⤚Qk34:r'B$FQJ-zO2gi+}aBW-;S$/7cGe,x.XЗu -].QCX(,+*LIDI#pI醙 9c2XHfH%s]}]m^p(NEtp.wFJ j15Qjظ,"Jkj8щwʎ#'u<܎O:RT3D ed7+ߝ8mVn߾h]CL-2T=P1;Pk.ЏD# Fd_u;D`؂+oY:V#qp*N2K(/U(g峅xVXCNb,x?U 3O]?">E/ >A(f|D"1Q9+.Ui]݇HY*5 f)G~+mʚ56ۚ>!հb8E/u!aĢp2| - -9QL"6](Idgk7L`miWq ޼^a[33T(<hhjH7E#װZ8>h5g8ΟW&EzHsp{[ sdy+Zsl{4z"g4 'Rbl1inc_/sn3 -yOyF,hɾ^JXFs5jW{vEyǦՑn}Iii$f9>N\\'2P]/.`]@š#)/Ӏͤ"4h -w&8>UXUضVhLo#*uwQCxEgكr3먯WSdNަ'6FsxnHň._\к9 gZm7׻]덆ρV x'r1\]?/:2B*"cvlvmi/Lr\.<k>w_#6H%/Rhk;)1yu1l/U195Y0fki֭xJc26P0oc#WXjqaJMNBQvTn;Z|ƿhw6Ky;b 9Dw&ʘ'cZo7[y:#FH8lx8&D% Nj*d)dTztf6ؗfr;ÛlyY"p͝QzeV]Q8 hfG.r5@A(5_;yl?Ya:c*&jv0P!OYcن@͵55xTegU`8=C(~{GN0cI5Ԛ1 oZi9uut`c8am,spţsQ .Mr{bJWAA#U%`7ܳdI$XNa Ɉ&U_9d4z&!& '褃Btzn7(5#J}Td /odqjzte*e+T}IКoyu4YEN5L.㚜8Qł[p]d[m9;V֙6],rۛ^*a9Į`r3r[6Kg74F5mi*6RV+U]Mݙjwit.NeiuCVNNmK -;D!wjHZ,9%@cZqmi -RJҊ|"\#y2RJL+*FCv]YULĵ3y4k Xc6w䦯9%>oWz+Z%;^wTéL̓5E4xuWW?T}_dMT]>("83DB*lRULӃL&K+u2df #Y5fK3>h: 5˹A,M ީ {Q6t>[2Y?~Q_ p[#K +~tX Rޣ5Pmf/蜯 g5ׁ̓As7@j\;}f^pqR^p?(~grS<; a0 kʊnduK; &˳{g%]nM@J0!q$+yS}ⳁ^oX5jwʥJ/Ovo,*h*Mzo2ox:o@B:iU~r1[zx j7nY?+]nv5?#EjL5~:ϕD+;qRW!Nw)%R*L(S793TOkҳ<9INu\!G -4KMKI s:Ue "䩉XOɅO Y K 2۶Z9ui뉯Է怪YDP4Tpod*@4WXBOukt㳼A0Ƴx|n˖#?sŀsN #AOCJ3X&wmZ_Xۦu;sGYo OǑEF/|b{㖣Oōq8`)y8ێq~ݎwl؉^fP xd}J&䞖=~Չn׏tuj/io 7gB EB4] }iз ȀV>4PjCh" -u!rH 0e~cY-Uh>}f*,< bG" -endstream endobj 1056 0 obj << +/Length1 41004 +/Filter /FlateDecode +/Length 7589 +>> +stream +x| xUut;YH',-11 EB$!`B'AIT&d 0Ȍ +88L@f:cLnx9ֽrι{?R R23[1i& ǩ=x~sg7;@>x>|- `wbkͷSF'N+KX-NSE@7T^7y\L`ySgξ}/{6eꌅy3 *ϟ}7*zSTKsr> @pFEiY3s+ ,\R{ϬSy `=m&s3|Pu'<\G PɕMƎKIEfJ H[&*DC +4i#w# `QD|77(|;FLv)XVx[ +_p rߧe)s*`i +:iO(N(svx{̦1f0[xqpD'[yZ#j5nQ`,gz‹:tСC:tСC:tСC:tСC:tСC:tСC:tСC:tСC:tСC:to%2Ckmԯ9)e]twj, + Ca4@Lߪ~=6zzt= 0洶^9~7ADtj*r<|ht(^*W:4׊|oxUx~5_/_=^io.xqwӻp'Ǘ8݁8*[%Iun |0\|nMz. 7p 帾*@Zϱ*+Se{*Kgt8*XQ>Q8KxXŧ8YSZquO||n,[eʜʌTQ+IS+Ž|]Zqดc G_KHs\bTEr|̊ ,8߄8m¢&ӄcYgDtHiT*q1d8&|؂9ǙM8΄IX 1.lPIs2}GkFr׆#8'9jЈi `U8 +rG!ӄDZ?ǻtHw9Ό@Nf 2|/rN&&vbtˆf=0663$L6cF {{*vꕺb$ՋILLJwcf)>f1&Ihzr1 #I\@7i1 0*q T`.NANm 梕c%X +h֖`4s4Qf +G\HBEN^& =8Z)/"X:g;~u6T `̣7V&p QR8E` j>As>YqxP%֊ų[,ϊbKíXi]}M! +jE(#-a8PE/~I2,$߲u_YCWr ?<6:Fխ3'qӒK*HgdL!0FV6(CtI'tI'tI'tI'tI'tI'tI'tI'tI't鿟L4A.(~DwoƔhWt|SJW Px$7Ns~zKqtL`(TKOڨDn(f^8f\514ǰ( +{Gۥto8lÆ5o- ta7 PE 6ºc.`$qm}]@sL3Cl(Gؚ׸ 51"NOo<~uMb҇x> a0.|y^e2lYe;ag}"L齠w^Ȇ^RES6ʄ#Si9s-:?0~} ھ3]P5woKwm/[/U$`/.HmՖ5^Kp/-I@kpvU%:<gY,-@0Md12\ļ*rB6N ڼy]8o w`L׾-*b#~Gn9zt#ڸx7݃w3{-dHoUlR>Y@6;`'DA]Sf7  вZiIQ 4T2|(}Q2 Q5|# zcQ;n?kX@C`>0"hY0,SY/,9cJ)[%,<+l*1Vhb1cz~U⯅>jydd͍$v=04+OJQv"EI`uKaFp;hZf:d}4ӥ]r 0d`hmb;2^Z-)c3l/"g֭]rŕZN|^z +!U0gv˶:=g}}E0źTig[`X־!,R.*ip5``xT@fCzdàZ_c6.=zedW^&]xa~?~ܐ!l3u`q>>H+>Wu&Rv1-4l$ޚOvp_GGe13Tͷyl5{if((l^ͯ+,9h)fYlÐ?>{KZk 5B g4ϨV H|R-K%ybP=;HƑ8A$QD.8@ x,J2n),Lw1B F:cG: ]<6Ǣ &$.1DyxL Jً2Y/I Vɫ X{=ڣ&M,>uw]g?~}>{͠yyKi>qJ&I>#}-WK/_U$㾌`5 QQ0&sdb\Zi+a 61d +7@Lx!hdcscGM/ ¯)'0s(*)9$۷?CB MoKK WX--nr}a!ODf^KOCޠUZU[(&{7POa9h]!rYu][k_b 0*(Ti=ߘjזdfoz2JHLJDOE"}Q>/ɊΊJ(LXQYU)^SPp-!k{ّQٞ¨BOaȥQK=KCo:s{c/ĐzEw>QgZ~bKrl¿_'}|0iDrNl}duϞUz / /VUue*S] U#8jhw^6~)>s`-|ixExu:-rZisbxy Y֫Y/w!{utnvű9XXZAJ ; t.u`uIk-[O aadh~vjʡȥՑ:6 vobݿLk[N;w>KxHxƝ9l Spי˗m|8ƕ*ɵIuv4QkYw K#p[cOFRˆ"EH?/wdcwSUn8[Uptpn5LчASA,i>`9{S&7_XRWP+l_*<<ةo׵;3??M$` ]x[1Kf*כ hTݲIuf-jy5d8ٜqC8 t ۮR!\.[lzj?j&˒u55^'7'#!Pu/ V&Z&&(0RݹNg_WF2сlvڵvQ&ͮ1vʽuu^w-a[C¦͛mk)-~ RBYatYc~$ؚ3Uskhn$},cHHvz8QKBx&EI]%]%GsI@FYbLffU')eNFh6-B{DLJ $IݔB0U)H˄273B^yQpP<( f1AL >K>f[pX&=%6zn|I:dxx .^L x1b ޿_k9U';K-[ +-7s 4oH[!^(]dHa6]"h_0apYJ#-bv.IDMV[ϭjfn[b4j~45C u:ք5(TsDmwlb(K %JTb.XKKl%bGuص0o= {uh=5WxӗyԷy#Bny'ïFځ^d3KzIV@t(`V U'($E Kuu}ƃc-Hy%f+s͖bmwes,T=Ｕ7bQՠ8c%\){t>nən$7b DsנdgkpbdbT'):.aiyeeCUBdlF цa-F'=T4":ZR(o ` KsBY٤uOnGޘVβ5S<%&mC?<WlH{Ng.z?WJMf16Ur`H% ^g4 "IQz*VW /z [KKMw-e#7n@.gwy8m9}c1zg~jHf6 3oQB<ۧnkk?숰%gcۄ⟪M;U=^"f ?8$ $ANڏ.![:g(o-"<* %JaV&(DFzW9`1Y&%Y_+(ɆP1S"0bylNJr2b,E +Xʰ΃rTF|V|VZ/^kEUkz 077CMbvS?vC|AZa ThsWT6lj@>1!t)rTq5‰ԔBNaj>Zvܠj&'ijo/c XCP.G:EE`< ~yPC!ZC﷮7BTnrwT + Z)(ئe]WTS#v2|Iɢ(6agO厢]FB8>@PWLSݭ0L:~F,RMј!fOt6>S]JFHcL7u2UM5uGSTX6XlVTڜT_ݫw׼%z>N^ဪζG&-p%lWnhBn5a/813@:ܲnI2M0 Bݞ]vez^nV-N;E2.kC!LPh#I7jA0yٖNbld[^'˃{ +a!́i0a.x & x R(7Zx` Et́)3;YԾ'D1VVB)g> f1i>ͥ,jC}RQ7Q >9hS9Def;y͞=u(EtUg-Ҿ(4K'M[?Uk}c҂r~eSi]}baꗏl1P= #FiY>Ӿ)hݺSNZf@J3i $ 2x [UDd00sș; BA$PԞS[S"\3z&hwFQ[ +a qڦsLigЇ/5pGU7?D˭[_ƶ9-֩ŶI TNE~Fsm>ܩ-zPFKZRCj:utkο0<#+t'#~! Q;/@i{Lo{kyDzHd5L#=@;x"U}A(R2-Ue!meX:Ϧj5eߖƝ qv^;qSN97?gHFGDDM)> +endstream +endobj +1057 0 obj +<< +/Length1 7648 +/Filter /FlateDecode +/Length 4712 +>> +stream +x9yxSU眛&-PhZHYӄ(rtO&͞nItInPR"ouFD}*OE2 ~CGE8qDܼ߹IK|{[o;)h1Ho.)vW;V!4^]dv,(; S])jnBn_/.A(l5+=*A9{%ˏewr|i a=J y%NFV%0f%k#B9d5mQd~kFNF)$9wПȉJ*`y1;$Q<9{ 2g_gA10;x^~cԎ1l"T'D҅IQ}H -!5*h܅`B Ff?HB&ZXp*u61 +7"4E 3)2\ +A5h ZhN PhV VUl]p6˧~k~KڎGoA9>CWCI&ny/ALa1_ R킇''87|_وyDcƈ"x7iis,[T?R@#fM$WP*3Mx`.'8PiS"\dccdQk5:r, B$ZQZc ]e(ՖԉLn[VZInN,Aiixs2]U¡/\:<3ܑ%ja,WXF(9_;#/ 3]%sB(HNg%B"-vuyq#8Νw#V`eupT֨RFKfQjkg_o]{_glq9}RKm0#IEJ<]LWKAxb] QYrɣY2fevB8Гhc͵pǑ7 [pv|E-\Ej66UJf % +E|Pj+>)`_㾪bkԧڧEoQ$$M r@7IBUXhVgm16|Jd65KouQnKsktՑaQLzeKÚe/plFׂ #4"49XJ -uMMz +%NQo>m4[!$He87KtnZjKҮ,k4*ҭ/.))GȖ vZ 3uEEr h8t ptBĀ&A%SLJ5PUk5dz9R*L'ynuhK?Wv> 7 +[QJkm}Rmidg/F. \x%  rh'{Bp2 +*B Rh;tVgկr8Ub*,q\zjVl6BSgi4|C} caƩB}Q` jУ8ZH9A )'TU*&C{κ:kZgV&WYѝM'ylEO.[iVR-x;Sr(iFI7AA nw$*r::zAd#y!X&ǰ1r%?qg2꯷_/y~s{t8>G[&qc6[m5qׯTt{Ho2ŧx{nz!۳^A1\̆(xסC=;G;;wȘ7?O)]p# G,8<`\(46|{o=dyQHfZ 5{U*k˖ܟPw׷foJulaMʹb xo9i +NZ#ЎTޤxp#pj9dVVðFO> h Rɋ<T=[[{#.z^F!=[K&GULNE"=jFl_Z~u+9}L7n u2PC-.L)tIQ(ʎJmg5qR+wn>sܦO{F$] +Τ7V"GxYqz۰fڷdLͶDsq5Wg G /Ǥ3IVM,lb|BWvVa}xS-7ӒY"JL3KTqԆ%ٚ9Q1luPJq8!GWOz^GVڨ؁J D|SZlBasMuu ,CYYC!v7_lL GA3"|@RfD 3Ovn&t()#NX\c(fAh>\h>r+⾇Kӳ죘UĈFUq,>Q\l!rLaC2 ggگ;t„ibaqq:`~m큭d}CeMg@%f&9$Jͥ}~_!$ #~ds2hZ:޹fj#>*gYJfrn`ҥ4ϷY6ri^]^MZZ MVp &'Ni&\wVs.A@E(u n&.\>(`BXkM+܈\͒9EE9%b4 )+ ΆƮ 4bBZHKҲ{惴:֡[H+;給@\A\mo"Ԑ; M5e$la͖(`hɸBWFBlWVQ{q-' &h,͚$ +x|SsvܑU]ug!J1 =~)l)xedMbz6(e;z|1yV( ]OC薶C֏_Ԫ H"w_)2*hMry\$. 'a5:(CY5Feh 0/οs_s\\σ~0$dOCo̢B<qҎIo81YG'~n\56?I"^TAl כ#EE#VhQ +ڝr"@ G7Jޤ$o{ :x[y Λ=ЩΐN:}@y)܃̒)Z[zVO +s7bgKnnO+Ss%JڃDǿȃ{JFc +LSS+(P t7+0y,&%ۦ*OvDST,WQ|2RoIzY\$2jNdY +;yj"Sr!SBVb2Ca6{vyii*m4Vox]*szj2-٠jV7Qϗ.K[k8J`?ǰxg o< ,A>%(ݲHjXG1c(85>ͱtHxmӐ)fǰt=ںi]3GOQx[oqqd1K X,枯DqCNpF".GvJ^qiwn6@6v3HA!^x:;`|~I"^O>t8u[]j oC?M7rз-@WCah--D p<2 ~ԎZQB|]0 m  0=hH5+*h`_4+PDػX 7knc- +m06қe໐@ [8Bs*5АOoNK .x_|oLCpC*S>ԼZk?5G" +endstream +endobj +1058 0 obj +<< /Length1 47128 /Filter /FlateDecode -/Length 11769 +/Length 11768 >> stream x} xEhUw2353IH0<W $0 s1bVA nD֋.rO$XoΡNwUPBH - 3e㫞$Xҷw_}p?+< B{~0!/oCΌYЭx?|Œ H'dxvmsyF݄affrD|^5xv9 myyOr7%'\y}"﷜g异M}jfwj~i\KT)>$ӼA>ReֆmWFߓ|u$]H2Y$~e+9 1A b 1A b 1A b 1A b 1A b 1A b 1A b 1A b 1A b o*v#S$?<<+D~/A$t%I2 !-d$G;.R[xAҊ#|(n>/&/ k~WË+(itUpՑGj۠&CPjR aZ khvݴUn{`M#Ra5.0Qy/N|`z]%]]{[D3 @čeKBqڒ]:a٢N^ e,D,Sͧ)ďe2JhY7DL0KYzĩ׼@8tRYϝ杼j60:;OjV7J u `:YT7Blf)Pw<֞_OUs^,3bf 5KiX !b[^'b[p/~ 8'48+'ƀo ր77j ޜpZK>pJgpD~r"|'֧ᓏZ8 y?R }.V~,Xϵ>~>jGȟWm[bN290f-[emaf-̨0MTSL`s`(h Q&77ˋWBu"/3`Bc~ѣhnT20n0# ,`X䁡7Z!7Zan>  A^8z`@W }xx_/@Z( pz]jZ0Dz:yD@8xO'=ytCU@%rx^r;{xnW:v)rl:Et; -@vmvmBz"d h7L Ӡe:2M4HwC b-j!PD z `@ZyjR<)g<$!?'-?|:o<! qxN;_qH{-rSH1`D]&"@WpxDQj&b@rs&{9uM'޻m!Rډ䯄d#f@bfC ?Eld O"-lGc05q9Md4gjێh2r/yk!Y9;f[msTWyqVj+@=d !E@+Ֆ#~nd4î[]֑-֋޶glg +ϱqYsMstŝc01a c01a c01a c01a c01 }^[=AZG$q͖M U4bu+.`N\~~G⪫ɦ 9KHe^O(տ_f-ZT)~} zD'EWf`&bUױ95Mvf!_,!ЬUZpy$}E'uѽKv{=C)(u -CelN8)[O˧wckd++8hG!}:Yw/gz~ƿ -d?M;t'gF%+I x U޵UgKP}qDI:}u62[nSNuPOY`һ~XI3h3g77DD̠l:.3&+HAZE]a ٮkjDNț眯9fN8ww&6t&vF?+~ž7%"Y$UJ%ry"q,sZ*9ġ4~קFDa5#q/woaq9s'[\-h$%N ؂HhKrr{OBDg!)nYTG.B,wPͺMgh2םS]?kӮ;>xg@×Ya+2(҆x*52|JU|uZuU/!./僀'Ӳ\ujQ8}tJXxu6?|^jIQKRs/ {{BT=uI7=iG~|:M!y`g_4+ S..>uM -_ScP:0"AaVvNaNmIR5A>`M)ǺנyG|( ;]* F-Zux~~)l**Q\|GbI]TeqtTYvsd}U 4g+)lU|%&N#5!Wr1R[ۑM'?ϿD6<|8.?81v灊i'KgJ[.@v6n됪^kF~ NF`vm^۱89q>@YLS$p?X#;+X\NBDgʏ7o(-X-3 /yiPJXf}G~㋊}BOI7*іYEԪ4R-z cF?j3+*fUTfm|7UnjʲϾeЛG9H~*́O2JBB]r --I Eݔщl2.Q=좪-Hn&yȠMDuh~wQg4ZhK=SʒRTAyP'-mb`gۻF ك"m%;*L!UH' "R$-Ȱ5ǂW"!**7R5\,U - -(6]S5 W% -Bv4i::g35RtpԨ$RW 2\qZz_j0RoQ'ORls|zRks}je%__^%o7ػ״ɇC &ҧ~8ewYXX>L]?^ۆP7{ћ>ӈɐH8ܧD)Q%K9d4B9&[hTR:_I W-PhaΤ.J2F;ͩS_߂Sa]BJa(?Xc-1~|oA[n$K'>cZXF6I.qF]%3ZFUorj >fW CbE+~5uӆvn%nxBAF䩚o4x~} Ә =͔09h\!~tc!('!!-/|W#]IN)-rF쨻S}CӋ甈 O=-Q2XJHa%_%~rIf&eQM^Y?M_6_<m|`=-VĈ5# (}#|UJ]lGkajt@G?%ՌP͆OuٺC7 h #x &I R'[lpRnWOfId9֋ Ԇ|6N+b|VnGCKgBsh?ϤwH.?B=βAsUrX> Ynr]+#,RKlONg,,2MN CDCfXP;*FGz^5(G帨]Lf|,ՙSs5ڰ 2na#-#ɬRf`˴eӬRm$)TGraJspm>1Nm^W{PLKD/y'tߢVm'NDR-y/T?qZXGł6ou~\N1j0Pկ^Cp:RbD'E=gI߰N8f6RʦX੔Iv3/LBbRgU^4H<ٶ[=nbPa=QdBdR9t|J(]h{Y%MwQk}b܌7zbzr$'9S} LIH>#BvےJ;{K5#$ wTu$eq͓*|LLzHNL'%%''y|}ý}CJ%4%gM>s#eM2odpyt #:zT:B%~GKˇF,G={&y*ҚO۰/}]񾞸ݭlujfXwx,\DH#ݡ Fh˥/3"TIF_jY ]Cʭy0tW, ,laÍ*]fbbB쒇0]i\o/{_a08swq6] w=y'#1bX6F5bg:]VcWI$[&kJ+)#cGólKwt>J?[`(6 -nVnCա(fk26&+-%d}1:Vf s۬[ n6\tz[q:Fg@](ו@ZvXC j)ӓRiDLRE}Eo]iҨqƅQ,†">2(I!vl̐l6nˌ5S!V!T7U gSo(W qb>#TPUֺJ+su;x8nʺCU6vn[\渣a$DOg٠==B=3^* fۺ3xg<á'O >z%Jț.-)mH`BZQ޴EivU\ҋ]Zݡ\4V+6s[GX\uq~7͛g3vvzaЀu][J ohߞSR}4\IV7؎:*MG+.hI.3d圏R]7Ľي LL/z5 ͛={vUHŮb -z[^iv||xQ#X8~#2EYqDclH@%Yzىەkg]?"Y+zr$kwՅ +zj"ÞE/ana3JiNsO<\NGq"ՏK@csEyu7*! < -HR/k7+-N?]:}WffcS)͙En QqDD#svn5oe#~8a Oa;{57WHxB1F?J\wȶ*%40[If'sgJ,g$]Ŵ QFJUGst mA5C,[4.֩;+5i.MqxmyŠR]<'7FR\ڴ *]G69ԝN'7ҽt~`t{:uV F""!Ւh4Mwu%oNsğĚ;z֥`p[E ~9Sw(PHF]\*~Ⱦ3}C'(d؈{ݲny |ǻj/ g$P%|.+gl1H={?y\"t-]_ @F=OG~ Eȕ&&ɾ3!d/|odsmF݅&S"Y8]jItMCi;St)q[$r9XE?c"fi]O_j—X$OgcXK567 EH3i1_HDqw&\jf E&ښ y,J?b{0BZ] -Q -6E6a_t?ԨIPscs;tB`Q!}PDsIF?(4=9ѫ(j:vxpV Z>Sv,.ǝx7|maK qբ\1ptl1cʺ+盒yH[rkefp1;UuЭVծ;yz-ɞHt`Mftvulsms{=cum=P3k\.,͖?16BǕNXܓDmw }1g3z~|݄O0:)M{өsZ?J|MFynOb0#6Nm14t4WcFj,̬af /g kwNO:Ğg8]N6xXD'*g'7N1W&n։*fnޱwO@?FOb7Hz"Rd'c"Am'|2RΘNf/4 nޥXUh]&gTfYo4%r?ң?+N]??X 2Wtr57El[k(G<`m!@AZ64lC1b+Et1+JV++u+@_#zN}\ԋaLoڏݏ,#:οq#Feh Qȿ7|̃+8R]M1| ڒYjkup\ڙu]ծ.5,Wg Õh}um)yZd)&E -Vj\c[Q=}ևlKjۖ9a4ź͆Q_^I!8>R>g_Y6o!P?:f+ cb+{<\( -Xh^g"}T+꩚N@jJMEYɓ"|:NIXG) -=eX+-jkM \^asAATl,EI⍀Z(hȶ@(GRmY(5J)I:v|ξWQ>7~&?]/Lѷt:7t>{~,]좃OœC9i^:g*qsrb+47ga0': ;]NUפGB/jZ3yg:(Otq0Xj6_vXraztZ9cN+Q:pfᚏzWZZjKk Oͳ;Io:(you+QcŎJ\\vle`i^حTƫ֗/9fuaz|xtk!Td}#oJ@؅y/[ׁB>u<I Hx6pMQ tթ{?s+~F -F)2fDzܢk.\p5|u6;IyxEC%P/FBP_ *EkH-+ rO ēdsd%z*ST{w }X+`ÇH"ĔgnZB;pUi0Z oȝ]:.(HKkJK?q楹Q JfV% -#̋A-#Pڠed,b'v+t^&tۑxIS&ec;w-\jL%'%G5j -4⸼L4XuҖrb3k܅1H͉fV)_#u5iݠ+&Lb/\泷S{kYϻ/HAZZdxg|m+I.$<޲wa M -oh%B{kԅ;SCru+TW+b`jjL31WG/kw!g(E$$m\JUޡgWS'bCz*y֦KNWJib7LK9`! 4޼ćwkF4ڧHnV]sHg6^$G#e#2L&s̯O@IFWE6sl^f#Ee~< ^z>ܤj6Ufu"]xvފ A-e@`4WO/[j{Kgv y(qT,[(ʵ-IG,;!RTROb"u, L - 6yUa +3hqL/3$JJfDڣTS|3>-EY35lc%d/67T4lnM^W>۰aٿC1=Si޸apyUSYUC8+Vb, GD%ʣOj qyMqA̫s y`_䗸beF,El9U4]sËDɳ 7ɡ(!_RӞ޹\6?o^4k]4E[v ne%}ӷtG"HtcL/W觔+`Cnt\r^r]x#D~pnD1)h^#yHAD RtEM(DF!KB:n@tb|}ߌF?G_9ıG!zqc/}TK(U<,+5c&Y6~VlBXN.YɲI%ex=iV4lrLl3di[N1"o=lBB!3o/̖c 8xFI[۵Hse4 p||VI_2E)"y^8gIwO/ϟ ٦FjUL2${"lCMkrfC`M`E"߱PeK8t6-zH)0ȶf})=I"U=CXf/mhhOHiSK[I5J 2؈xI<*1:36ڑHsYm^ϰ'W'er^A>Hͻ 54xdC}y AF|i^ Ul2 ^k6Y+v:.$`H,kלA b 1A b 1A b 1A b 1A b 1A b 1A b 1A b 1A b 1A b7@c;KgzKj"F\X AEޤ?La2#S- iEڑk@|> 7iy×^5E` Yȍ#o k{me V!y CF(|d5OVӿ_k;pȈnڪwAc +x){<U'L>z0냮-DaƲ% !8mIj.lXl'2id"24ɬeY&,ԃRkkuY:,NN^Syf' +Q+JOEXg:`ojfi!6o;kϯ9/n +1%4,߀Pw-p- +B_BQ ? QyeA}]Pc@MD۷[|k_kG|_Wpo8-K%  8%Z8i"?9>MaI-|>|q]p+?glZx? GpO~$^ދp*C xB"H[av!Q +ÛޘAkjW^}6+{$u{le'K8Kv x /Sx>xyi{-J6Ouz|2BPv(w);EREg+ke>!)! kְ5i{ t 8-\fзAw[?hrY.=KFWa7U832[^R~ TfЎG PR-~E#v8f&*UWw0'.?#qdP%2'/_E-?r=wɓy]0{Nfun1*nr;̐/a͋h֪_-~8K,VѻB3 X ?m_ddM2Φh:s|V3oow爕$H^*ZD%8O"$r>_:M]-T)'H(Hf ۧ,X0uS]bD|,ͤ4jh3qohX"ft6Cr~_ "^خ|l׵D5 H"VMs3a;th:XC xU]?a QNC,p%S9W<89UqkKr|^Ӂa#^"аոFǻ7߹-.4ZZ'GOLHHHlAZ$H% 'ORI7,yiqu +*^ja#_g}Tߊ;fy&34~΂)DiW<3|K,ΰiCUJy{\x>*:}*ߗAiYc5qm>%,~<:M}>G t%鹍i==!Ğ_:՛ڴf#{}cg}>Ѓ<⳯ae)F:&)1Pu NB0e;D6$bI~&ckмQk Aɝ.~:~\VpT#BHVWx,;9ľ* Z3ĕywu*Li^+L^lʟq it~\fߟAC;@m۴VZh-IH TԪJ +WU)6=$BeXZiك&yRg?"mz=PwIc5;SPZRBouH~W5PxS\'ZA{Oz}qw#DM6Q8ES,TPj&YJzGS,̑J,O'H!3FH }Ƈ4DC(%{,#?EEكn!'bihˬ"jUn*;ѫ۠eu7COJ΄$gFe6z7"Eޡ \ɱpFFn疡F#2s^粀;̙>m,`4 I-^8:ϐ}=Ä1Ə5f[{̙3**U*e~eg_~ٲW#FW$e?@'FeoWd%]T.VVS–"n`]D6svQ$s[d&q:j`ͨ3kO-%Ş)ieI)*Eiizڠsr6JN w{w#gJłQVSxU*]icxNC)  d؋Ac+T[RUUkCKTP +ٮ)KTf蚅+] !;@ |QLDxFEFcQjTJZUsuƫGO8-EZk=h}~ 編aR'E9d>C9}>}/h/7]k{C!r\D` QASeXȲ,K,JW.qmlݽM@iMdH$G^rS_JZ ĥٜzbb_uY|~-AZB4*H)ώ褅ECZ(QgM% qǎ}T̩/ob.֋v |ogP\,1ז?Ȍ7JQǠ-IHͥ1vmv}-Jog#j$fuMi8z#Js- 79|O3!1 :?iiC\C7ZJ7\Eۿ@\kq?j#T7y@Gdig՞tfJ4q.{?1nٓU`sN]T#NUvϾsJą(S,s%C鰒GٯcmA$`3x`_pهM&q⬟&կf/sR|ǶhcfErQ́a]FcbDH䚑>^*.6juwE505:PTMijFq f}ܧlݡe R-EJRi)ݫܧn$dMjH>BR>C+gUj%3Z|9ygW;_o֟bug٠]͹IB*9PPQO7.ٕu{%6H'ȳhG&OtCy !3\׀Qn#A=`#r\.y&N3>̩9ZZ@mXO֏YdVf)3Ve2iVm6`~p9Z0tp@_m6RL'A6U/rܫ=?%YkoQaӿGbXΏ}6JA _CB' "<`yE иJ-bYY7:Y.sPRlW}u8N"$oX'K|r3e)eS,VSTJ${; bh&D!H13*g$tl-doPNjlps!xD:>%.jҎRJz;(GUo>1nĉ= 1=K +?R\$$~K!umIOW_%=[|VH;:I>B^&H $'&Ry޾!i%_Q&9OB|БSLQTA_솅E ]n =GM*!?տˏU%FCQ#go=<iMŠ'mXx_OV׺WJ3d I;<VOk9(#RJ=יK*;2<GcG&˂3Cssls  B+O[X\bbbߖ-m[`[p[Ut""j9qff4)Qw;{FVlw⿖.w7zϏ u̧ +"vfА%rriAgPZ(;N #0SͼSġF5گjtt|MN6/;y ./VvD{63*fqy"L%*Mai_I`~lR 1qBeD#m s f + $DHTx@ j}I_):j&BC>Lw$rёPGGBҗj*R$/5Ү!<\Wy+ +̆qF.VY1~1j!vC}VY.M7=/0^AĮ膻򞼓1q,ˋy13sjDHPܫy$k-Lǔ#Gj%[;{:Cp7+7PPm~VFh ɖm>͘ib+ͅmm-j^d{e7^gxI.fIC= 3zQ .΋Jy-J5VDZ]_4Ih~̢t>բ7.E4EaiTLȨlaCXj z$֐KBqQfH6Ac?`FԿeF[_zGDB ]*u c7+Å8o _*o(ѪHk]%9ሺq<x7e]!*IODn-C.`s0]ulP C3m3Tp'B |%I\ ܔ6$0!(poڢei;Ҫ..csP\~9lco,yPkǸzm}ͳC;P;0h@Ⱥ-n|cw7oO)˿MG>V`nB$lGdwPģ~I$rGS)slҊdlE +&Hp͞=*PCtb~uO[4;>P(_,AJY墬N"1q~V6$,5qɕr=q95BO=rca"0704''x.8Nj% 1rUĹJ@:QmY$i +ϟq+31)i"8"~Ƒ9;7J͚7?l0ؿ=yD+dr]$Da_g%;d[eN +-Ť`ɹr%3U bZqeڇona%ƪ9:!-[Tz4&8UtaL)L\.AƓ#).Nm#N[Ev{omV^u?x0=SW:+FM#|eƐjEo4T:7u9Ob͎?T=R0ԭ"J)Wч;y(Vd`$# {w̿..A?dߙ!r2lxnYMAr:*eY[n\Ϛ[7(Pti{mT{'V]~Iӽ񅙯ö/LJ|vuǪ~³/Tݤ,̈N&)b7)ыr}\΃hCQ.W=y pcKwMM S;q]0=-E~c,e#,̥i%ܦܦη,{CuTI>]֗ІBmF>~?=׼W.Qj?bXzꞧSH?shJڋdd_2r72dFZ6\B)doXHP$:Oá)h:8fWyqTWFt֓*vv[.@І!噋2e>i)ܽ4%ϕ=/8$VQgpi"C'^LLqᬟ=%i?aL{Iٝz>H"Re}h&R!.n#lV%꽜U?U{K|Oxhє%܅ V,XP +[,NK/fÆgAx[ Mk$%Ub88-z9rT134ʮӧ5Kheq'Bf ѳ1lߥd"ctcI_i֘/$;?sJ5 ͢`mRD6Ҹjty@Z8j6aune]MCq͕3>s٣%/kG{)gXO'3} 7qk]|s3V7^L\QW?X,r+:J"5]#Es~N0򁁶OS I -iRHgJև"v~Օd%] |^/A G'bRTW r0nmWGtGt~D_ݏ8rOVW^#h\m57ӍJdG4}㨁  >Fw.&N>km,Foi :8rI.̺jWK[OG_~pm>:6QʊH-i"k+WfrR1ʭ(>CGm[ӰEyA{ZbfC/h/ޤz} )3_FŠ7@1c1b +z]\N4jy>FXTM'dsWTEURꦢI_E$2,j5&V{.0;xi'?'Bt t;Aw:1xφ;`,їꏑe S^ _%pD?pJ??9ڠb*6 xhFBWh- Mld @eV`#Rux`kmZ^U^դ^QhQvJzJ;j|M>g+ߨk?ԮRSh[b::[Žu?{Y.vAIiw~\Qšܜ4/r38lvp 930c .êk#w5 L3 '8LeMb,5ST/;,Te=j:]ֱ͜FP8G pGܫz--yKE5Yޤ7޼:}bbcl%..VW;mMyt/VjUKow:q~ΰK = <]õS*7%]kżWr} !JN$ih c &mTѽq_A##pVjncYnP5EZ˚YZk:@g<kڗP͉xriޯw5 FT'IDIn9=)=;>\0buw$wbJpC37y-Ii*4օ7[nXN@n.yBMw~j tn58(r+UߒS +~EtߠiLmC2t~2W ~]V:u{|o{XRHHOgq )dIF}.yr5&˓#5 oq\Xnxs`W&cbxZuOiKq5˜T{I$D3N+q锯Fz]nЕud[ig&v_LJwa[HAݩ_|mȵ,E -I{2cgʖ,@pt 6~˱2He*67t& /FjmXְ_ܡMô_o0O\xe X~+{b1WԿϣ\Qj~'Wz5ؼi䦸 Ήsչ<@]K\@U\12yHzT]"p*.ɹKslن ݛkPK忐ׯAEiO\.^FZ/m.m-˄Q2Kt@޾[?Kd$z1?ʗ+KSp_Qamjz7Uc:.]9/]hn<Ǒx"?I͈[pd7"CϘDTL‘< )G +"oQih#%!7 :1> žoFt/\Gأ81HCԗ>Iw*OϚ1,?x +Y6xl,'rެd٤24dY6x&\2k,&˦e>s&e3ɚI3ȲY3ҙ,mrIWnD}7E3{H +iAZal yPsc9(Y,ߩDY endstream endobj -1057 0 obj +1059 0 obj << /Length1 17264 /Filter /FlateDecode /Length 12304 >> stream -x|yxTŶo {s;ݝN$B&4<a<*C &P"ǃA<!=9\q@#z= -݉N]VZހ0B;̔=/ ӫw~ ;:dx.FAc 8h_Cf4nh:oB|qS,j "DҦ/1o,s ̘h!aCm1wi&Ews ˞ ' ~ p9'̂]0urvlDüO.?_õM s-\;03G-r(#@HD\VdBϞ?Q]~"!-bhd<'cYބ=Fzkg&.HYPQC8WL -~%UBxN](-̎tRwrꄳDA@⅒ -p8h -ޏ7A)rMM([ +/ -ʊYTxW%qJk}*D+ edš{Rl -ү=ch?i=t\F2؎ke?:Q5uóQZ-uA~"ET< -{&M$Fh"Z~1 &߹s߷5MYJ0kG|*}w7}X g\[wB!ROG}>.^N0`halv^prx!Ty N޽k|}M;ufӖZ(I7t"Z -B+ѧtk-atjVb)kp'?/W0te&'}ŏf#1}쨰FG}х.?\\PAK\Fdٌʠ3otF1Z)q*SE⡓DF'ыLt|. v:FOA t#}8->AG0:a>etftN1:0Dsshmb?%eh]C̷u =b~L{Dp1 :1@_$`;h$څ\pn!v@sNٌf "Nh&2̀3M4-B-E;ŎiJ01NS*v8B>1|="g4DF/zvfh,1Mil -@=0hF@QF¬DinF]:g waj0/NmQ+pnͧb&h6SsPv&* dgTdw@0訁VgTNTFuTPQ s8t)Y(E~5?ux83%d֭E#}uÇ ` -Uz@-pmמ,ߠ-t0gPRxC^| z[(p :e<_ -G2 z~_CF6sVT-*CpM1p =Րd:wzۊU \9C& M.86?:.\n[8 FehGB ltFl\GtDm8 aAW)Wh{ ` vm_K>rH+V4~YpȢG}ulG>cj+?l{jr9u?u"/>z<O墑TONtR\95=)َ͛賮dIIuj1j|sr]|3ܪqygfp$SvfFSc.>.'b/Y͙;p𬒺5E;f*Y[ !4hNI]qJJ5%u8o9͝=`ZVzGL;'}5d\3{0\HIYs:eR8X-fvh4t AfdvsN¢lN7P2+mq^_V%Q%5(BNוi -aJ-mΖϛ w"⺡ ԃK+7}O37 Fbm^::cP\[ qU  $ &k:!:1io&L!msپEl_.ζ⡋PұSY ^8x +i7g -+ӿp4@ke :a+ ->EGVYkQ50 kG#^]/dKpUX<_tRv 8ۉW΀r4=z( 6m>pB#tD>Q Pt0Q(M'*u|?x<kk:hbJ}v9(!^_Z~CioɵCs:H)v}p6iI=Şk -f&x9%R ZUxCa^0 m3$V1˗ib]kxixFX<r@0Q!{%厠H$J{* g`G&^2&љ1:#geV m$X| -6}wጓ?EjjjN=VY!3cz7Z&>@oXC-2VJ1*+*+= b@fěA5rrHK7f MM7f|4c;Sv߿e׌.`qIe^:W_-TBY~#P -"ȓ 8@iR7.^Fǁ$a`o)9dM#oy}Hdfs ? 2QT&2{h1<81{c`ҚYhUu%_+k1L],굛cWn?o\Y+W؝,-^lI19QUe붌X+x8}Sէ''亿8*8j$T7԰R'UFUU$ctCOͭ6í7T=,@2cm|XiLee>'RL ,.m&ز{hVֱVA*$j1YHv=NIR4m $,-G>=*P4c+i; -IvB^X"<zD7&*cDpi#%ۗ/}e;w|V -$a  TK)"2ؐ p&ڪR(xy7/_s?5J^ïI[s5aYuBѷkل]l›;PrVÃ2"SY4H>w -w~tHmF1RzCeXE׉KfKc?<`C5>ZtZBs~ -=G鑺jS&y -{'hlNY7lt{z+72DT3D(-l*ӓE8ɠD:u{ v{YF)ɀd;0v4ؽɆY@º5m8O545h 4X,b{Cx%n`gUh"Tf8Jlas9sV3ߪa/;5m.ؖ=77-oYOngomV>mvA^zydovGۅ?ex '/f~UZDA"DQ@>Gk5J"iY AF4,Vh6WUS)*2rDA'K(xL0x2 "o1"n%lݻGXܨRUJ1V;&L!"2yŌtҼ|ц+5S!L[+>]fŏ?~쪕Y|_W2~cTe]G ?R7ֽ`?ScRܨ?:^I[*u*",ÀҥNpwEA웝#9]fqsP'N/}{\}3ygd_X!U֢J:fe%dx]_FՒiZ;OAH܋j]q_<'T~8jz.q4*U,eBmJ&r>2lhy T3ĉ#<8xp%^'.+̠~ L)wqD$ qRI.:.ӂr\e+PI ;Kǯk$[>V29ْ˥x -z^kysGF9:B;GF`vg'qn8e'AW+QSZ~)>tPφJw-G'4Kf4.:1A&a2J)eD"oJ;Hr҅}>X:J, -Q>);̀p,5nigߠtIh)JPǍlHl -|#%wPʔ#2HaMUIRU KU m0T0&iKUۉsbu*.]nOlK:YMFy!}#!V%͇*v_o%hحOC@[aQz02}&*V wEO҉ &8KnO(RDfˋRYuI@TI AT(1 !C -RxCg{z^{ d%nw]:DbhLlʓ1dw'< &):>E,U6@#RHG #űXy2JWo4, KtA1aaSܞ4>6 |.JO\5dP@z~hE (#=X Iz`{C\ \އ!,K)ܟClKLI/?IOMY1+vx!NJV|,B4XS )ҧYn}ْJV,NqF;ϫΫ,* -XFB7у:m"rɂs>e^lMS-S 3gdZMRLD@KIotxXd/-P~;"{㣶%q#֑i-~S#/ (8՛6VO/%}%; zcT8{;:22F\fպ24HtYz[ˈ]ۤJ^:77e@C>kn(NIMUj\Mjjg]ar9Y2x#_ҹ[^v}o/xͦ GN?\Xz{B,|dᴅزrWķw>fIva26qNNan(pt̬+sT#eh,##CV+cb%!O=XzOYۦjcQUǺ:хϚ~<9BĨ'(z| y7JGJG-}4Zt<TZZxQ~ ϰ moW3iKda@{vg.w I\Dd(3˔*S=FD }6}_.>ʅPQݯ阺UEW;=m+3]t,yG؁8gtM]hzz jn^2#~]Vo$ʢ P(%D[Cc.+\-ׯiA'|H>VA% -_yYDz_ꄍkWﱐ c7&/a/N|ev>`AnaH͂ J6tL%a2҉Ѭ%7tD7 }$kCh,W4kw֙Iǔ,PvEIݵo>v2V֑3|̧ DEvs|8X]FوBdҙ(¼Zoџ:Ԗaf jIܚy"~dei]]E{Զ'doyi\ja^0QG[Eu:&ZcI &Js[e( LG<[yxcIrO)ztqHgZZji0mǔ6Bt,H&|RYm: >*dʾKN*]v_ri6w5vEqqp )C,:%NDp &m,KR/nhW'eIDQ‰Kt)Yd1y\(n.-E.%&IrWŗpş13<Y?e3EGJPK#-2A` (נF g1 s@@pvr]{NO&IirKSyykv!OШs8`n=)qGzS>NEyû6Wk2 O<]7ߞ^* ⅒-$|(QF2pֱaBX6Ro<>>\zn_5xy0'Vĵz"5h߯ɏ ⣂qUf|֪` -bHd'KIAyO -npH4DkR径tw!ۦ|ٸ7[3t g/K=бC7El_p||}Viŋ{*"+02 -DȊ)PJt/hޭA 1zV2d&,>sL  XyKlH&!|)LoWU~2) -.6hpn§>x0Gƻ狞,s|.y$$i7 sc>a0D.~F0oxH GH[X_tGأ?'AܮnM-lփTu*LU K4INp`ryWr%'qr"hMR:Abp4Q[ECJI^j/+ $[̕rLOWoFGYt0K,T{TbV݄'?b&d!vSd8S]FV% -a'u20e~~Zvk -tj2e+Ձ I=z0,d~`$ -ԩ*V櫲fj"qh+ YЎ<ϒKdI@P1HUuDUp"L` p]cp[nI-߶YK\l~s:JԆN qY6{Nb4Nɘo 3"L>n5 ZFѴ)~a<~'{ҺrF5X٦A,[bUlnۘ`J0w6pu9'3Ȅ]0ur65pq'ZNE^~{E¹.X؝X~}v;yF $G .+2 +Ds  I( ME#9y~&1G;3uC&Ȃ$@Y *ftc4D/""7tzbC1hdgvU;lS'%4 J8oPA{W~ J1pn:PnBe]\E|UPVϢu(PPSAZyc(#.޻88&?eS~?H@xLj6:v\+!ԂjTs~ҳ~虧HP>UҦ2iFO-2zw=(62zcQ精1І[(:O +i}E/MFPw}`bD^F_cV*{2nJ:m/ﲊ/']Vחſ./%ӿ0&/Xa }^lctVo,V33*isJFz0}DW ^tpNi9(/e 2/}J1RF׬k]m*FO +-yrq^N]fK}]A\l1]3ǎ +ltOxG]tDqp:/etN:t:qNgtŌN2:Y)n:INdt8Dqұkc4NG1:ч#ćF3:чӡ FiB?>h ]_؏Ѿ[L Upqpw6}0*>hO'2V_OzLb/3UB˗g}&%3<ͫ>_Г@B[49 b5-\:f3l@] 8d073ij8MZvօN!b&>l'UB;qr+bxiGMh" ƛ74_4XYe,zӘd=ad7QFl#Yጆ1b =8 h#Y ͧEt$S}!vjmZsk>+dg6D3Ud ;J AG \=*p2 ʌJеĨh9$@NBq=.^'C K-鈟)%+m,Mx>]Ugғ8j lhd-os>78³KۺGcq/ Gy% \V8a2z¶ @S +迈2tm!Wk +M詖 VH@,6$p]lpyY %Kv9rۅid0:/C#8 'UTAf3bdGr%$m[#Op- +}NBm8F&sdk^-Fp?e@'@2-0L\P-lzZ kN2&Hs퍲a(ZH^>$ {n0KFj3MGEB0Y8(đK)Y~rwyK S&^]TU5M}J}UDD?lVݍLѦѦ3̵5(Emn=da+=ck Y=>ݾcB'|ەZu#lҢsE̴TZ*1j9ےR[RqQk#MMMbs#lZ@Z +[FQ:BAo% YCmtkg_N@xѴ (EH\NQ]yYo5F"#]b6 N pc9{>7ן-0 ɠVBx2=Zq4ycVͬإ5n11qSfbƈ&lVM/Ro;ZOu;'-b_]מbq`oY щn{Y\a-A$""&Ƙ@pnʩg?r y'kkܼfXs6'dVVf$9V||Bfh%+;3 :L/f.wO?5i껧)Cvxš[7L+?,~^X8ad:w<3u6}5)E`Eۺ:~fn= +GnrH_;;*16AuϚcޔlMYWdD̤:H5x.h5xbƮpL^pnո'\ +ՙ +al1/P1W -θ 䆸*i +Ņ m5Yggee8\OK6~h'SOkUA}&/5n)"BZϦUΌ)^wW +zc{+t\7cu_y/NfabA.71Z+]pҨ4%a\~%DjvdIȥ+. jqmθxŖM^juMU +W]-87_+c\M[7#9.˖مqZ5лdka.ܖo;_^._HNƔC>/Z ϫTiS *IV +3 z]Qi&s(N(pq3S(^f WHb[oۗ9x"JA)8!ELR%EP#y4O<9Oy!hBCD;HVFU:%NrS=La_0 ^UfXp7zg߭-km$zEzEItSgW|ecR@UYTU3B;DY0ѣ`]/`6L녑3PvV?y 6J^L^/>]Jƾpɟa͵'pK,ߐ{iW1cx]zQ_7ʡv貘]UqR㕎!7;@[@5rrHK7f MM7f|4c;Sv߿eֲ׌nF'|w8٥rSջ[,1PLgo,{70,`/QjGT/Wa܊ L#]5[@ħD%X(O&:=ߝu^:W_-TB0K(^AE')p,Fͭ\oi[$I2sDiGZ)&\*`~uPUTNMx%emֹmD¤heѦ꼕K6Wζп PMlV8Ɉ:bM0LH3/3Ⱦ/L*ۦuL59X_XǞf X)[ 4d>#ى;%G HѠ7Nt~βpЃ!z}! +T@QX 6pA#*'YzagD J¥kH8p&_n_68/q紴!~OCcz7x Gf>'ƭS ݽ(m>zŁƍ# Q>`o [E +ĤNj2"нN^5${oZRfQJ4 )Ɏ vO!s&,6@Fms3%R\Rb/qH ,LjYʬl'\ 4lT2gʕs攔?]5s^þ7E۲-ƶI{ܶmS۶o~.葷A&[jwd72Ѽz!/@]Pk(P$( +:/U(ثRy xM\AU$-ST=(ƀ2ʁj +2x/\EfT@ dIYe<GGf6C7Zڭ$-{@<YRuUJ{UܡbzdmhE-B)Am.G~Wvͬ?>կVmzdrϮ#Yυ)^i@X4Xqa/:lh}?MAm!A:Y;T.jwww.hGnkm/0GQ( G4*yrG (+$]ts5΃^ez5=ήFQ }vGypZOe*O\f֙A L)wqD$ qRE.i:.Sr\e@H%5MM\vR|+lR<JZ5Umv*-lg!#]?E{8簓 +jk(H)*Gwd/:H(ETgC%;ᖣS%i7@Y Jd0RqLg"eID7%$9^F i_<"y2.ON03 03 eM8Oz¶r $[Z_'-/77g i"Y4ؔr% k&r_,6cx΀V:)[eJ UP0`V$ )R%&|x*%*F}DE9:.wJG]ΡYJW,æRC<Ȁ>ָf5qVȯ4֧A]yH@=@@>ebd+JULFޜ'S|%w$rWy)&d$ X*(<ϔ :AoaWĔb [I3-:-W Ui\B,)ݖ҈j-O06:]Wzk_Z[oo\Ņ8} ^}p![JZ\KX έb͎$ WYREUtcW+r2H-Ur. ߕ?}=„ݹi1ի7ٺg_W j4YV`F.0j3P|FZҨ !GKLR]9)-R!+~rXWnM: _C1^Iw(LD}]0PUR^AT!^DkN*HUk]uRƛΚc fsm&;SL: +qZڅM~<Xӧ-v[?qC3m]l&^ubn>LF^{juAdh &VtDV|Uuˮ*+~,Ty+ՉnU!S]ΉMM䱩 +Y.MusGQe$22紝9c1q'T_Y~6^ |{GΌs}F󿒓?.ncRj=q'̣"}&)`_&wdZSE,%#k6zhy>ڐuUj ^6i,}ouooBLI,i|&9fQOz̆9g>اA Ƈu6n.yݻuE u< [DG">@BGRT9iM ⎎r3L<,p 8[+&m~A OUGU +fT5!CDE2`/2 *WP <4 |QJ?K5 s/pq%MhgbT!cDSO^1QIyLҍf +J7]}aǐ":J)ÔQ"x ea }\X{\i 4ҸTtٽisV}ה Ҡ!w|t^CJ֫%@g|=܏N҃ ݥ]> a_BOlhW(]bNx}ID|Boz͊YpqRg駑E* HO—>eϲup|Uu9urh4~^p^|fPQ2rE7ʕu FK K1|<#Zg +3 uқ) kI#Κ3xO?"^wXE Km Ki2F&m#:GF=$_7jAP`d'l&%觟$_THYJw&7P=Iy/pv +7t( +fx%{k6M8:vᢲ=cH# - +>S_߹wme浫W^%ֲ~(;gb.|~ m\@O_ʼnT-uYAp9f$DF:Q2v&Vm\r>m >pNW'd~h + +=[15M:` ~0;"AGme!rwhju'{ ! I18w+W c;N~M=]S̠cJWnX7w Rsk;mws+SIΙ?>s 좟##:wڹOY>aen#lDAEhsLa^nm0lOB +|j0EC?9R4fYYV_{^!uI]Ն7Z*[_42~7CF!C H@$DTuşxyL8x>.za?yb#1B%"+ZM1M1 ^76UV,Doq|ӯ*n?}׫\-~ͲuSst=N Ich[0ˠÒ1[ •  pcaQP]J&"f)d:YL*JX&.%&rwqF g1 +sh?HPs\^*RRT}^h3ϕ.%B0yJ}EhUV^QYU5j{yNER vg ;a/{ Fs]j}aѲZW?-GaҤܼ +Wv:7U/VYY8-s!P#ܛ=]=sqĻ?x 3˟y|3Ϭ޼I/]Ϛ?}4N؍;F +#`\3|~TcQj.z۹ b{0rWͷWJxt})I>þxpj ul-^7{[#cv 9:w~hqwk̜:$7xq8]rW`\&QY1NU:JiE-sxg%N6a3r!Uiʦ]MdRħ„V}K_[w0Cі"h,|^ydn/{ɒ;wO.8'LB~=g &! Cd(bQ(D}dm6yE +UA$^BҸ#.8<vM[nh1`ܦSyfZY:Ir3pλ(9qD[=w] hH8H]6ģxܑċrɐC)GPr }B]aRmNf,qnqT|RQ}Y #<&FjI{bO&ę2.VK?+Tȭ-y.x;ױ[^߿omnא[II+~Ad  S'oiUNWA:'H6_,(0$X#qJ1S2dMn@;tBXIJP:t B G5h]N#vU(ZLt$qЍ=_d0Y0eZ*.:`h/3K^]c<t; ykЩb0!Ďbzf 䋂[~gBY?.;zz+s{\?|` lccVtqSŨ >!,b_+F"Ll,4HQ/߸h{/HQ~߳}ވPY;̂CQX]{'⤹72,a_Є;l +v q?=Ou柏I p.^?r̂cGs|gC_o*6]ъǪ~Y[AAݼQ u|ӻ wEB_`%D B=fh&z NDS!fAPʀ#=EPEd@l!wZ/44EZk3þTQo͆FpTw22C3e>=SYp_ <Ɲ]Z/Ap|(P9pZTd{o{YNw>Ac ?.qrvvB +#bhBp @E.{"a@$gT7½ q;~sv=~򣓧ԩKRg<:mJ;yA ?6ާW endstream endobj -1058 0 obj +1060 0 obj << /Type /FontDescriptor -/FontName /EREYAA+DejaVuSans +/FontName /SXAKMW+DejaVuSans /FontFamily (DejaVu Sans) /Flags 4 /FontBBox [ 0 -14 557 560 ] @@ -13150,24 +13224,24 @@ endobj /CapHeight 560 /StemV 80 /StemH 80 -/FontFile2 1054 0 R +/FontFile2 1056 0 R >> endobj -1059 0 obj +1061 0 obj << /Type /Font /Subtype /CIDFontType2 -/BaseFont /EREYAA+DejaVuSans +/BaseFont /SXAKMW+DejaVuSans /CIDSystemInfo << /Registry (Adobe) /Ordering (Identity) /Supplement 0 >> /W [ 3 [ 317 ] 16 [ 360 317 ] 20 [ 636 636 ] 25 [ 636 ] 36 [ 684 686 698 ] 42 [ 774 ] 44 [ 294 ] 53 [ 694 634 ] 68 [ 612 ] 70 [ 549 634 615 352 ] 75 [ 633 277 ] 78 [ 579 277 974 633 611 ] 85 [ 411 520 392 633 591 ] ] -/FontDescriptor 1058 0 R +/FontDescriptor 1060 0 R >> endobj -1060 0 obj +1062 0 obj << /Length 744 >> @@ -13223,20 +13297,20 @@ end end endstream endobj -1061 0 obj +1063 0 obj << /Type /Font /Subtype /Type0 -/BaseFont /EREYAA+DejaVuSans +/BaseFont /SXAKMW+DejaVuSans /Encoding /Identity-H -/DescendantFonts [ 1059 0 R ] -/ToUnicode 1060 0 R +/DescendantFonts [ 1061 0 R ] +/ToUnicode 1062 0 R >> endobj -1062 0 obj +1064 0 obj << /Type /FontDescriptor -/FontName /CHSCVX+Poppins +/FontName /YFABGK+Poppins /FontFamily (Poppins) /Flags 4 /FontBBox [ -27 -132 753 704 ] @@ -13246,24 +13320,24 @@ endobj /CapHeight 704 /StemV 80 /StemH 80 -/FontFile2 1055 0 R +/FontFile2 1057 0 R >> endobj -1063 0 obj +1065 0 obj << /Type /Font /Subtype /CIDFontType2 -/BaseFont /CHSCVX+Poppins +/BaseFont /YFABGK+Poppins /CIDSystemInfo << /Registry (Adobe) /Ordering (Identity) /Supplement 0 >> /W [ 3 [ 266 ] 5 [ 291 ] 7 [ 621 ] 10 [ 158 453 453 485 ] 15 [ 197 550 209 475 627 319 574 588 628 627 634 545 630 629 212 ] 32 [ 722 ] 36 [ 673 612 771 706 512 503 777 691 245 ] 46 [ 598 431 860 702 785 578 787 607 586 540 674 675 975 ] 60 [ 583 540 422 ] 64 [ 422 ] 66 [ 732 256 675 675 606 675 619 328 675 639 245 247 514 245 1029 639 639 675 675 372 521 363 639 560 819 478 562 454 ] 95 [ 290 ] 204 [ 218 ] ] -/FontDescriptor 1062 0 R +/FontDescriptor 1064 0 R >> endobj -1064 0 obj +1066 0 obj << /Length 1430 >> @@ -13330,8 +13404,8 @@ endcodespacerange <005d> <007a> <002f> <004c> <003a> <0057> -<001c> <0039> <005c> <0079> +<001c> <0039> <005b> <0078> <0027> <0044> <0032> <004f> @@ -13347,9 +13421,9 @@ endcodespacerange <004d> <006a> <0054> <0071> <000a> <0027> +<005f> <007c> <0012> <002f> <000d> <002a> -<005f> <007c> <0020> <003d> <0042> <005f> <0043> <0060> @@ -13368,20 +13442,20 @@ end end endstream endobj -1065 0 obj +1067 0 obj << /Type /Font /Subtype /Type0 -/BaseFont /CHSCVX+Poppins +/BaseFont /YFABGK+Poppins /Encoding /Identity-H -/DescendantFonts [ 1063 0 R ] -/ToUnicode 1064 0 R +/DescendantFonts [ 1065 0 R ] +/ToUnicode 1066 0 R >> endobj -1066 0 obj +1068 0 obj << /Type /FontDescriptor -/FontName /QVTIIS+DejaVuSans +/FontName /PPVKZX+DejaVuSans /FontFamily (DejaVu Sans) /Flags 4 /FontBBox [ -9 -92 733 729 ] @@ -13391,24 +13465,24 @@ endobj /CapHeight 729 /StemV 80 /StemH 80 -/FontFile2 1056 0 R +/FontFile2 1058 0 R >> endobj -1067 0 obj +1069 0 obj << /Type /Font /Subtype /CIDFontType2 -/BaseFont /QVTIIS+DejaVuSans +/BaseFont /PPVKZX+DejaVuSans /CIDSystemInfo << /Registry (Adobe) /Ordering (Identity) /Supplement 0 >> /W [ 3 [ 348 ] 11 [ 457 457 ] 16 [ 415 379 365 695 695 695 695 695 695 695 695 695 695 399 ] 36 [ 773 762 733 830 683 ] 44 [ 372 ] 46 [ 774 637 995 836 ] 51 [ 732 ] 53 [ 770 720 682 ] 57 [ 773 1103 ] 60 [ 724 ] 66 [ 500 ] 68 [ 674 715 592 715 678 435 715 711 342 ] 78 [ 665 342 1041 711 687 715 715 493 595 478 711 651 923 645 651 582 ] 5038 [ 741 ] ] -/FontDescriptor 1066 0 R +/FontDescriptor 1068 0 R >> endobj -1068 0 obj +1070 0 obj << /Length 1182 >> @@ -13470,10 +13544,10 @@ endcodespacerange <0049> <0066> <0030> <004d> <0013> <0030> +<005c> <0079> <0010> <002d> <002e> <004b> <0045> <0062> -<005c> <0079> <005d> <007a> <0035> <0052> <0025> <0042> @@ -13495,20 +13569,20 @@ end end endstream endobj -1069 0 obj +1071 0 obj << /Type /Font /Subtype /Type0 -/BaseFont /QVTIIS+DejaVuSans +/BaseFont /PPVKZX+DejaVuSans /Encoding /Identity-H -/DescendantFonts [ 1067 0 R ] -/ToUnicode 1068 0 R +/DescendantFonts [ 1069 0 R ] +/ToUnicode 1070 0 R >> endobj -1070 0 obj +1072 0 obj << /Type /FontDescriptor -/FontName /YKWSLN+DejaVuSansMono +/FontName /MWAATU+DejaVuSansMono /FontFamily (DejaVu Sans Mono) /Flags 4 /FontBBox [ 0 -155 598 728 ] @@ -13518,24 +13592,24 @@ endobj /CapHeight 728 /StemV 80 /StemH 80 -/FontFile2 1057 0 R +/FontFile2 1059 0 R >> endobj -1071 0 obj +1073 0 obj << /Type /Font /Subtype /CIDFontType2 -/BaseFont /YKWSLN+DejaVuSansMono +/BaseFont /MWAATU+DejaVuSansMono /CIDSystemInfo << /Registry (Adobe) /Ordering (Identity) /Supplement 0 >> /W [ 3 [ 602 602 602 602 602 602 602 602 602 602 602 ] 15 [ 602 602 601 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 601 602 602 602 602 602 602 602 602 ] 46 [ 602 602 602 601 602 602 602 602 602 602 602 602 602 602 602 ] 62 [ 602 602 602 ] 66 [ 601 ] 68 [ 601 601 601 601 601 602 602 602 601 602 601 601 601 602 601 601 602 601 601 601 601 602 601 602 602 602 602 602 602 ] ] -/FontDescriptor 1070 0 R +/FontDescriptor 1072 0 R >> endobj -1072 0 obj +1074 0 obj << /Length 1570 >> @@ -13583,13 +13657,17 @@ endcodespacerange <0038> <0055> <001d> <003a> <002a> <0047> +<0059> <0076> +<000a> <0027> +<001a> <0037> +<0013> <0030> +<0054> <0071> <004e> <006b> <0042> <005f> <005a> <0077> <0011> <002e> <0006> <0023> <0004> <0021> -<0059> <0076> <0037> <0054> <004a> <0067> <005c> <0079> @@ -13611,13 +13689,10 @@ endcodespacerange <002f> <004c> <000d> <002a> <005f> <007c> -<000a> <0027> <0015> <0032> <0009> <0026> -<0054> <0071> <0019> <0036> <0017> <0034> -<0013> <0030> <002b> <0048> <0036> <0053> <0028> <0045> @@ -13625,22 +13700,21 @@ endcodespacerange <0032> <004f> <0029> <0046> <003f> <005c> -<001a> <0037> -<0018> <0035> -<001b> <0038> -<0016> <0033> <0022> <003f> -<0026> <0043> -<003a> <0057> -<000f> <002c> -<003c> <0059> -<001c> <0039> +<005d> <007a> +<0016> <0033> <003b> <0058> +<000f> <002c> +<0025> <0042> +<0026> <0043> +<001c> <0039> +<003a> <0057> +<001b> <0038> +<0018> <0035> +<003c> <0059> +<004d> <006a> <0039> <0056> <0034> <0051> -<0025> <0042> -<005d> <007a> -<004d> <006a> <0023> <0040> <002e> <004b> endbfchar @@ -13650,1107 +13724,1109 @@ end end endstream endobj -1073 0 obj +1075 0 obj << /Type /Font /Subtype /Type0 -/BaseFont /YKWSLN+DejaVuSansMono +/BaseFont /MWAATU+DejaVuSansMono /Encoding /Identity-H -/DescendantFonts [ 1071 0 R ] -/ToUnicode 1072 0 R +/DescendantFonts [ 1073 0 R ] +/ToUnicode 1074 0 R >> endobj -1074 0 obj +1076 0 obj << -/EREYAA 1061 0 R -/CHSCVX 1065 0 R -/QVTIIS 1069 0 R -/YKWSLN 1073 0 R +/SXAKMW 1063 0 R +/YFABGK 1067 0 R +/PPVKZX 1071 0 R +/MWAATU 1075 0 R >> endobj xref -0 1075 +0 1077 0000000000 65535 f 0000000015 00000 n -0000001104 00000 n -0000001238 00000 n -0000040577 00000 n -0000040711 00000 n -0000043403 00000 n -0000043602 00000 n -0000047323 00000 n -0000047729 00000 n -0000047930 00000 n -0000048133 00000 n -0000048268 00000 n -0000048404 00000 n -0000048562 00000 n -0000048721 00000 n -0000048954 00000 n -0000049188 00000 n -0000049403 00000 n -0000049619 00000 n -0000049860 00000 n -0000050102 00000 n -0000050325 00000 n -0000050549 00000 n -0000050781 00000 n -0000051014 00000 n -0000051228 00000 n -0000051443 00000 n -0000051670 00000 n -0000051898 00000 n -0000052107 00000 n -0000052317 00000 n -0000052546 00000 n -0000052776 00000 n -0000052987 00000 n -0000053199 00000 n -0000053414 00000 n -0000053629 00000 n -0000057395 00000 n -0000057860 00000 n -0000058057 00000 n -0000058255 00000 n -0000058474 00000 n -0000058694 00000 n -0000058895 00000 n -0000059097 00000 n -0000059325 00000 n -0000059554 00000 n -0000059764 00000 n -0000059975 00000 n -0000060190 00000 n -0000060406 00000 n -0000060637 00000 n -0000060869 00000 n -0000061072 00000 n -0000061276 00000 n -0000061495 00000 n -0000061715 00000 n -0000061916 00000 n -0000062118 00000 n -0000062255 00000 n -0000062393 00000 n -0000062587 00000 n -0000062782 00000 n -0000062972 00000 n -0000063163 00000 n -0000063354 00000 n -0000063546 00000 n -0000063738 00000 n -0000063931 00000 n -0000064170 00000 n -0000064410 00000 n -0000064625 00000 n -0000064841 00000 n -0000065048 00000 n -0000065255 00000 n -0000068823 00000 n -0000069301 00000 n -0000069497 00000 n -0000069694 00000 n -0000069890 00000 n -0000070087 00000 n -0000070286 00000 n -0000070486 00000 n -0000070686 00000 n -0000070887 00000 n -0000071085 00000 n -0000071284 00000 n -0000071518 00000 n -0000071753 00000 n -0000071952 00000 n -0000072152 00000 n -0000072355 00000 n -0000072559 00000 n -0000072761 00000 n -0000072964 00000 n -0000073164 00000 n -0000073365 00000 n -0000073561 00000 n -0000073758 00000 n -0000073947 00000 n -0000074138 00000 n -0000074330 00000 n -0000074523 00000 n -0000074713 00000 n -0000074904 00000 n -0000075090 00000 n -0000075277 00000 n -0000075489 00000 n -0000075702 00000 n -0000075917 00000 n -0000076133 00000 n -0000076346 00000 n -0000076559 00000 n -0000080257 00000 n -0000080760 00000 n -0000080962 00000 n -0000081165 00000 n -0000081367 00000 n -0000081570 00000 n -0000081781 00000 n -0000081993 00000 n -0000082214 00000 n -0000082436 00000 n -0000082665 00000 n -0000082895 00000 n -0000083096 00000 n -0000083298 00000 n -0000083496 00000 n -0000083695 00000 n -0000083908 00000 n -0000084122 00000 n -0000084321 00000 n -0000084521 00000 n -0000084732 00000 n -0000084944 00000 n -0000085090 00000 n -0000085237 00000 n -0000085451 00000 n -0000085666 00000 n -0000085858 00000 n -0000086051 00000 n -0000086262 00000 n -0000086474 00000 n -0000086693 00000 n -0000086913 00000 n -0000087112 00000 n -0000087312 00000 n -0000087520 00000 n -0000087729 00000 n -0000087925 00000 n -0000088121 00000 n -0000091980 00000 n -0000092451 00000 n -0000092588 00000 n -0000092726 00000 n -0000092918 00000 n -0000093111 00000 n -0000093310 00000 n -0000093510 00000 n -0000093667 00000 n -0000093825 00000 n -0000094038 00000 n -0000094252 00000 n -0000094448 00000 n -0000094645 00000 n -0000094837 00000 n -0000095030 00000 n -0000095253 00000 n -0000095477 00000 n -0000095678 00000 n -0000095880 00000 n -0000096077 00000 n -0000096275 00000 n -0000096472 00000 n -0000096670 00000 n -0000096830 00000 n -0000096991 00000 n -0000097188 00000 n -0000097386 00000 n -0000097521 00000 n -0000097657 00000 n -0000097840 00000 n -0000098024 00000 n -0000098216 00000 n -0000098409 00000 n -0000102247 00000 n -0000102734 00000 n -0000102893 00000 n -0000103053 00000 n -0000103274 00000 n -0000103496 00000 n -0000103699 00000 n -0000103903 00000 n -0000104126 00000 n -0000104350 00000 n -0000104554 00000 n -0000104759 00000 n -0000104990 00000 n -0000105222 00000 n -0000105435 00000 n -0000105649 00000 n -0000105878 00000 n -0000106108 00000 n -0000106326 00000 n -0000106545 00000 n -0000106781 00000 n -0000107018 00000 n -0000107236 00000 n -0000107455 00000 n -0000107590 00000 n -0000107726 00000 n -0000107919 00000 n -0000108113 00000 n -0000108324 00000 n -0000108536 00000 n -0000108739 00000 n -0000108943 00000 n -0000109134 00000 n -0000109326 00000 n -0000109540 00000 n -0000109754 00000 n -0000113833 00000 n -0000114320 00000 n -0000114523 00000 n -0000114727 00000 n -0000114932 00000 n -0000115138 00000 n -0000115328 00000 n -0000115519 00000 n -0000115756 00000 n -0000115994 00000 n -0000116225 00000 n -0000116457 00000 n -0000116661 00000 n -0000116866 00000 n -0000117074 00000 n -0000117283 00000 n -0000117491 00000 n -0000117700 00000 n -0000117853 00000 n -0000118007 00000 n -0000118204 00000 n -0000118402 00000 n -0000118563 00000 n -0000118725 00000 n -0000118907 00000 n -0000119090 00000 n -0000119255 00000 n -0000119421 00000 n -0000119618 00000 n -0000119816 00000 n -0000120018 00000 n -0000120221 00000 n -0000120370 00000 n -0000120520 00000 n -0000120702 00000 n -0000120885 00000 n -0000124723 00000 n -0000125194 00000 n -0000125415 00000 n -0000125637 00000 n -0000125851 00000 n -0000126066 00000 n -0000126284 00000 n -0000126503 00000 n -0000126707 00000 n -0000126912 00000 n -0000127088 00000 n -0000127265 00000 n -0000127464 00000 n -0000127664 00000 n -0000127859 00000 n -0000128055 00000 n -0000128253 00000 n -0000128452 00000 n -0000128604 00000 n -0000128757 00000 n -0000128944 00000 n -0000129132 00000 n -0000129326 00000 n -0000129521 00000 n -0000129667 00000 n -0000129814 00000 n -0000130016 00000 n -0000130219 00000 n -0000130386 00000 n -0000130554 00000 n -0000130710 00000 n -0000130867 00000 n -0000131074 00000 n -0000131282 00000 n -0000133585 00000 n -0000133880 00000 n -0000134024 00000 n -0000134169 00000 n -0000134371 00000 n -0000134574 00000 n -0000134788 00000 n -0000135003 00000 n -0000135188 00000 n -0000135374 00000 n -0000135552 00000 n -0000135731 00000 n -0000140534 00000 n -0000140773 00000 n -0000141029 00000 n -0000141236 00000 n -0000141442 00000 n -0000145032 00000 n -0000145263 00000 n -0000145460 00000 n -0000145649 00000 n -0000149334 00000 n -0000149537 00000 n -0000153277 00000 n -0000153500 00000 n -0000153634 00000 n -0000157398 00000 n -0000157621 00000 n -0000157755 00000 n -0000162461 00000 n -0000162852 00000 n -0000162986 00000 n -0000163118 00000 n -0000163250 00000 n -0000163382 00000 n -0000163514 00000 n -0000163646 00000 n -0000163778 00000 n -0000163910 00000 n -0000164042 00000 n -0000164175 00000 n -0000164308 00000 n -0000164441 00000 n -0000164574 00000 n -0000164707 00000 n -0000164840 00000 n -0000164973 00000 n -0000165106 00000 n -0000165239 00000 n -0000165372 00000 n -0000165505 00000 n -0000165637 00000 n -0000165768 00000 n -0000170770 00000 n -0000171169 00000 n -0000171302 00000 n -0000171435 00000 n -0000171568 00000 n -0000171701 00000 n -0000171834 00000 n -0000171967 00000 n -0000172100 00000 n -0000172233 00000 n -0000172366 00000 n -0000172499 00000 n -0000172632 00000 n -0000172765 00000 n -0000172898 00000 n -0000173031 00000 n -0000173164 00000 n -0000173297 00000 n -0000173430 00000 n -0000173563 00000 n -0000173696 00000 n -0000173829 00000 n -0000173962 00000 n -0000174095 00000 n -0000174229 00000 n -0000179035 00000 n -0000179498 00000 n -0000179632 00000 n -0000179764 00000 n -0000179896 00000 n -0000180028 00000 n -0000180160 00000 n -0000180292 00000 n -0000180424 00000 n -0000180556 00000 n -0000180688 00000 n -0000180821 00000 n -0000180954 00000 n -0000181087 00000 n -0000181220 00000 n -0000181353 00000 n -0000181486 00000 n -0000181619 00000 n -0000181752 00000 n -0000181885 00000 n -0000182018 00000 n -0000182151 00000 n -0000182284 00000 n -0000182417 00000 n -0000182550 00000 n -0000182683 00000 n -0000182816 00000 n -0000182949 00000 n -0000183082 00000 n -0000183215 00000 n -0000183348 00000 n -0000183481 00000 n -0000183613 00000 n -0000188611 00000 n -0000189074 00000 n -0000189207 00000 n -0000189340 00000 n -0000189473 00000 n -0000189606 00000 n -0000189739 00000 n -0000189872 00000 n -0000190005 00000 n -0000190138 00000 n -0000190271 00000 n -0000190404 00000 n -0000190537 00000 n -0000190670 00000 n -0000190803 00000 n -0000190936 00000 n -0000191069 00000 n -0000191202 00000 n -0000191335 00000 n -0000191468 00000 n -0000191601 00000 n -0000191734 00000 n -0000191867 00000 n -0000192000 00000 n -0000192133 00000 n -0000192266 00000 n -0000192399 00000 n -0000192532 00000 n -0000192665 00000 n -0000192798 00000 n -0000192931 00000 n -0000193064 00000 n -0000193198 00000 n -0000197785 00000 n -0000198176 00000 n -0000198311 00000 n -0000198444 00000 n -0000198577 00000 n -0000198710 00000 n -0000198843 00000 n -0000198976 00000 n -0000199109 00000 n -0000199242 00000 n -0000199375 00000 n -0000199509 00000 n -0000199643 00000 n -0000199777 00000 n -0000199911 00000 n -0000200045 00000 n -0000200179 00000 n -0000200313 00000 n -0000200447 00000 n -0000200581 00000 n -0000200715 00000 n -0000200849 00000 n -0000200983 00000 n -0000201116 00000 n -0000206097 00000 n -0000206608 00000 n -0000206742 00000 n -0000206876 00000 n -0000207010 00000 n -0000207144 00000 n -0000207278 00000 n -0000207412 00000 n -0000207546 00000 n -0000207680 00000 n -0000207814 00000 n -0000207948 00000 n -0000208082 00000 n -0000208216 00000 n -0000208350 00000 n -0000208484 00000 n -0000208618 00000 n -0000208752 00000 n -0000208886 00000 n -0000209020 00000 n -0000209154 00000 n -0000209288 00000 n -0000209422 00000 n -0000209556 00000 n -0000209690 00000 n -0000209824 00000 n -0000209958 00000 n -0000210092 00000 n -0000210226 00000 n -0000210360 00000 n -0000210494 00000 n -0000210628 00000 n -0000210762 00000 n -0000210896 00000 n -0000211030 00000 n -0000211164 00000 n -0000211298 00000 n -0000211431 00000 n -0000211563 00000 n -0000215574 00000 n -0000215821 00000 n -0000215955 00000 n -0000216089 00000 n -0000216224 00000 n -0000216359 00000 n -0000219555 00000 n -0000219778 00000 n -0000219913 00000 n -0000224854 00000 n -0000225077 00000 n -0000225212 00000 n -0000230250 00000 n -0000230473 00000 n -0000230607 00000 n -0000235414 00000 n -0000235617 00000 n -0000240561 00000 n -0000240784 00000 n -0000240919 00000 n -0000245691 00000 n -0000245894 00000 n -0000250695 00000 n -0000250918 00000 n -0000251053 00000 n -0000256050 00000 n -0000256273 00000 n -0000256408 00000 n -0000261217 00000 n -0000261420 00000 n -0000266288 00000 n -0000266511 00000 n -0000266646 00000 n -0000271495 00000 n -0000271698 00000 n -0000276574 00000 n -0000276797 00000 n -0000276932 00000 n -0000281905 00000 n -0000282128 00000 n -0000282263 00000 n -0000287124 00000 n -0000287327 00000 n -0000292165 00000 n -0000292388 00000 n -0000292523 00000 n -0000297432 00000 n -0000297635 00000 n -0000302594 00000 n -0000302817 00000 n -0000302952 00000 n -0000307972 00000 n -0000308195 00000 n -0000308330 00000 n -0000313147 00000 n -0000313350 00000 n -0000317920 00000 n -0000318151 00000 n -0000318286 00000 n -0000318420 00000 n -0000323269 00000 n -0000323492 00000 n -0000323627 00000 n -0000328610 00000 n -0000328833 00000 n -0000328968 00000 n -0000333776 00000 n -0000333979 00000 n -0000339042 00000 n -0000339265 00000 n -0000339400 00000 n -0000344189 00000 n -0000344392 00000 n -0000349443 00000 n -0000349666 00000 n -0000349801 00000 n -0000354679 00000 n -0000354882 00000 n -0000359675 00000 n -0000359898 00000 n -0000360033 00000 n -0000365029 00000 n -0000365252 00000 n -0000365387 00000 n -0000370176 00000 n -0000370379 00000 n -0000375288 00000 n -0000375511 00000 n -0000375646 00000 n -0000380645 00000 n -0000380868 00000 n -0000381002 00000 n -0000385802 00000 n -0000386005 00000 n -0000390833 00000 n -0000391056 00000 n -0000391191 00000 n -0000395993 00000 n -0000396196 00000 n -0000401012 00000 n -0000401235 00000 n -0000401370 00000 n -0000406361 00000 n -0000406584 00000 n -0000406719 00000 n -0000411580 00000 n -0000411783 00000 n -0000416636 00000 n -0000416859 00000 n -0000416994 00000 n -0000421744 00000 n -0000421947 00000 n -0000426762 00000 n -0000426985 00000 n -0000427120 00000 n -0000432113 00000 n -0000432336 00000 n -0000432471 00000 n -0000437332 00000 n -0000437535 00000 n -0000442361 00000 n -0000442584 00000 n -0000442719 00000 n -0000447642 00000 n -0000447845 00000 n -0000452621 00000 n -0000452844 00000 n -0000452980 00000 n -0000457917 00000 n -0000458140 00000 n -0000458276 00000 n -0000463138 00000 n -0000463341 00000 n -0000468192 00000 n -0000468415 00000 n -0000468551 00000 n -0000473458 00000 n -0000473661 00000 n -0000478396 00000 n -0000478619 00000 n -0000478755 00000 n -0000483760 00000 n -0000483983 00000 n -0000484119 00000 n -0000488919 00000 n -0000489122 00000 n -0000494208 00000 n -0000494583 00000 n -0000494719 00000 n -0000494853 00000 n -0000494987 00000 n -0000495121 00000 n -0000495255 00000 n -0000495389 00000 n -0000495523 00000 n -0000495657 00000 n -0000495791 00000 n -0000495926 00000 n -0000496061 00000 n -0000496196 00000 n -0000496331 00000 n -0000496466 00000 n -0000496601 00000 n -0000496736 00000 n -0000496871 00000 n -0000497006 00000 n -0000497140 00000 n -0000497273 00000 n -0000501325 00000 n -0000501596 00000 n -0000501731 00000 n -0000501866 00000 n -0000502001 00000 n -0000502136 00000 n -0000502271 00000 n -0000502407 00000 n -0000502543 00000 n -0000507370 00000 n -0000507593 00000 n -0000507729 00000 n -0000512395 00000 n -0000512626 00000 n -0000512762 00000 n -0000512898 00000 n -0000517565 00000 n -0000517788 00000 n -0000517924 00000 n -0000522505 00000 n -0000522728 00000 n -0000522864 00000 n -0000527453 00000 n -0000527676 00000 n -0000527812 00000 n -0000530675 00000 n -0000530878 00000 n -0000535321 00000 n -0000535552 00000 n -0000535688 00000 n -0000535824 00000 n -0000538794 00000 n -0000538997 00000 n -0000543889 00000 n -0000544112 00000 n -0000544248 00000 n -0000549078 00000 n -0000549281 00000 n -0000554242 00000 n -0000554465 00000 n -0000554601 00000 n -0000559413 00000 n -0000559616 00000 n -0000564613 00000 n -0000564836 00000 n -0000564972 00000 n -0000569551 00000 n -0000569754 00000 n -0000574867 00000 n -0000575090 00000 n -0000575226 00000 n -0000579872 00000 n -0000580075 00000 n -0000584947 00000 n -0000585150 00000 n -0000589983 00000 n -0000590206 00000 n -0000590342 00000 n -0000595229 00000 n -0000595432 00000 n -0000600328 00000 n -0000600551 00000 n -0000600687 00000 n -0000605479 00000 n -0000605682 00000 n -0000610693 00000 n -0000610916 00000 n -0000611052 00000 n -0000615876 00000 n -0000616079 00000 n -0000619954 00000 n -0000620157 00000 n -0000623430 00000 n -0000623633 00000 n -0000628494 00000 n -0000628717 00000 n -0000628853 00000 n -0000633458 00000 n -0000633661 00000 n -0000637949 00000 n -0000638172 00000 n -0000638308 00000 n -0000642374 00000 n -0000642605 00000 n -0000642741 00000 n -0000642877 00000 n -0000647826 00000 n -0000648097 00000 n -0000648233 00000 n -0000648369 00000 n -0000648503 00000 n -0000648637 00000 n -0000648771 00000 n -0000648905 00000 n -0000649041 00000 n -0000653813 00000 n -0000654076 00000 n -0000654212 00000 n -0000654346 00000 n -0000654480 00000 n -0000654614 00000 n -0000654748 00000 n -0000654884 00000 n -0000657646 00000 n -0000657849 00000 n -0000662157 00000 n -0000662396 00000 n -0000662532 00000 n -0000662668 00000 n -0000662803 00000 n -0000666821 00000 n -0000667060 00000 n -0000667196 00000 n -0000667332 00000 n -0000667468 00000 n -0000672062 00000 n -0000672309 00000 n -0000672445 00000 n -0000672581 00000 n -0000672717 00000 n -0000672853 00000 n -0000677685 00000 n -0000677916 00000 n -0000678052 00000 n -0000678188 00000 n -0000682333 00000 n -0000682564 00000 n -0000682700 00000 n -0000682836 00000 n -0000687005 00000 n -0000687252 00000 n -0000687388 00000 n -0000687524 00000 n -0000687660 00000 n -0000687796 00000 n -0000692702 00000 n -0000692933 00000 n -0000693069 00000 n -0000693205 00000 n -0000697819 00000 n -0000698050 00000 n -0000698186 00000 n -0000698322 00000 n -0000701260 00000 n -0000701483 00000 n -0000701619 00000 n -0000705691 00000 n -0000705894 00000 n -0000711399 00000 n -0000711798 00000 n -0000711934 00000 n -0000712068 00000 n -0000712202 00000 n -0000712336 00000 n -0000712470 00000 n -0000712604 00000 n -0000712738 00000 n -0000712872 00000 n -0000713006 00000 n -0000713141 00000 n -0000713276 00000 n -0000713411 00000 n -0000713546 00000 n -0000713681 00000 n -0000713816 00000 n -0000713951 00000 n -0000714086 00000 n -0000714221 00000 n -0000714356 00000 n -0000714491 00000 n -0000714626 00000 n -0000714761 00000 n -0000714895 00000 n -0000718593 00000 n -0000718880 00000 n -0000719015 00000 n -0000719150 00000 n -0000719285 00000 n -0000719420 00000 n -0000719555 00000 n -0000719690 00000 n -0000719825 00000 n -0000719960 00000 n -0000720096 00000 n -0000724516 00000 n -0000724739 00000 n -0000724875 00000 n -0000729330 00000 n -0000729561 00000 n -0000729697 00000 n -0000729833 00000 n -0000734293 00000 n -0000734516 00000 n -0000734652 00000 n -0000739614 00000 n -0000739949 00000 n -0000740085 00000 n -0000740219 00000 n -0000740353 00000 n -0000740487 00000 n -0000740621 00000 n -0000740755 00000 n -0000740889 00000 n -0000741023 00000 n -0000741157 00000 n -0000741292 00000 n -0000741427 00000 n -0000741562 00000 n -0000741697 00000 n -0000741831 00000 n -0000741964 00000 n -0000745205 00000 n -0000745460 00000 n -0000745595 00000 n -0000745730 00000 n -0000745865 00000 n -0000746000 00000 n -0000746136 00000 n -0000749547 00000 n -0000749750 00000 n -0000753007 00000 n -0000753210 00000 n -0000757610 00000 n -0000757813 00000 n -0000762205 00000 n -0000762572 00000 n -0000762708 00000 n -0000762842 00000 n -0000762976 00000 n -0000763110 00000 n -0000763244 00000 n -0000763378 00000 n -0000763512 00000 n -0000763646 00000 n -0000763780 00000 n -0000763915 00000 n -0000764050 00000 n -0000764185 00000 n -0000764320 00000 n -0000764455 00000 n -0000764590 00000 n -0000764725 00000 n -0000764860 00000 n -0000764995 00000 n -0000765131 00000 n -0000765323 00000 n -0000765545 00000 n -0000765671 00000 n -0000765817 00000 n -0000765957 00000 n -0000766154 00000 n -0000766388 00000 n -0000766619 00000 n -0000766875 00000 n -0000767114 00000 n -0000767361 00000 n -0000767591 00000 n -0000767833 00000 n -0000768058 00000 n -0000768302 00000 n -0000768530 00000 n -0000768761 00000 n -0000768975 00000 n -0000769210 00000 n -0000769428 00000 n -0000769672 00000 n -0000769899 00000 n -0000770131 00000 n -0000770378 00000 n -0000770597 00000 n -0000770832 00000 n -0000771036 00000 n -0000771212 00000 n -0000771407 00000 n -0000771612 00000 n -0000771818 00000 n -0000772025 00000 n -0000772279 00000 n -0000772509 00000 n -0000772732 00000 n -0000772943 00000 n -0000773154 00000 n -0000773369 00000 n -0000773585 00000 n -0000773799 00000 n -0000774049 00000 n -0000774264 00000 n -0000774483 00000 n -0000774701 00000 n -0000774917 00000 n -0000775129 00000 n -0000775334 00000 n -0000775541 00000 n -0000775746 00000 n -0000775947 00000 n -0000776174 00000 n -0000776404 00000 n -0000776633 00000 n -0000776850 00000 n -0000777067 00000 n -0000777293 00000 n -0000777529 00000 n -0000777773 00000 n -0000777989 00000 n -0000778202 00000 n -0000778430 00000 n -0000778644 00000 n -0000778856 00000 n -0000779039 00000 n -0000779253 00000 n -0000779457 00000 n -0000779682 00000 n -0000779915 00000 n -0000780128 00000 n -0000780350 00000 n -0000780547 00000 n -0000780721 00000 n -0000780911 00000 n -0000781108 00000 n -0000781300 00000 n -0000781511 00000 n -0000781719 00000 n -0000781923 00000 n -0000782158 00000 n -0000782371 00000 n -0000782580 00000 n -0000782775 00000 n -0000782972 00000 n -0000783155 00000 n -0000783327 00000 n -0000783510 00000 n -0000783702 00000 n -0000783901 00000 n -0000784123 00000 n -0000784343 00000 n -0000784583 00000 n -0000784805 00000 n -0000785053 00000 n -0000785284 00000 n -0000785530 00000 n -0000785766 00000 n -0000786019 00000 n -0000786241 00000 n -0000786418 00000 n -0000786614 00000 n -0000786841 00000 n -0000787060 00000 n -0000787269 00000 n -0000787501 00000 n -0000787722 00000 n -0000787945 00000 n -0000788153 00000 n -0000788408 00000 n -0000788656 00000 n -0000788879 00000 n -0000789106 00000 n -0000789318 00000 n -0000789513 00000 n -0000789713 00000 n -0000789892 00000 n -0000790092 00000 n -0000790275 00000 n -0000790490 00000 n -0000790695 00000 n -0000790886 00000 n -0000791071 00000 n -0000791310 00000 n -0000791542 00000 n -0000791778 00000 n -0000792000 00000 n -0000792194 00000 n -0000792411 00000 n -0000792624 00000 n -0000792825 00000 n -0000793019 00000 n -0000793209 00000 n -0000793406 00000 n -0000793594 00000 n -0000793799 00000 n -0000793969 00000 n -0000794167 00000 n -0000794362 00000 n -0000794533 00000 n -0000794738 00000 n -0000794971 00000 n -0000795174 00000 n -0000795355 00000 n -0000795419 00000 n -0000803098 00000 n -0000807902 00000 n -0000819763 00000 n -0000832159 00000 n -0000832393 00000 n -0000832797 00000 n -0000833595 00000 n -0000833748 00000 n -0000833979 00000 n -0000834576 00000 n -0000836061 00000 n -0000836211 00000 n -0000836446 00000 n -0000836985 00000 n -0000838222 00000 n -0000838375 00000 n -0000838619 00000 n -0000839214 00000 n -0000840839 00000 n -0000840996 00000 n +0000001112 00000 n +0000001246 00000 n +0000040647 00000 n +0000040781 00000 n +0000043473 00000 n +0000043672 00000 n +0000047406 00000 n +0000047812 00000 n +0000048013 00000 n +0000048216 00000 n +0000048351 00000 n +0000048487 00000 n +0000048645 00000 n +0000048804 00000 n +0000049037 00000 n +0000049271 00000 n +0000049486 00000 n +0000049702 00000 n +0000049943 00000 n +0000050185 00000 n +0000050408 00000 n +0000050632 00000 n +0000050864 00000 n +0000051097 00000 n +0000051311 00000 n +0000051526 00000 n +0000051753 00000 n +0000051981 00000 n +0000052190 00000 n +0000052400 00000 n +0000052629 00000 n +0000052859 00000 n +0000053070 00000 n +0000053282 00000 n +0000053501 00000 n +0000053720 00000 n +0000057475 00000 n +0000057940 00000 n +0000058141 00000 n +0000058343 00000 n +0000058558 00000 n +0000058774 00000 n +0000058971 00000 n +0000059169 00000 n +0000059388 00000 n +0000059608 00000 n +0000059809 00000 n +0000060011 00000 n +0000060239 00000 n +0000060468 00000 n +0000060678 00000 n +0000060889 00000 n +0000061104 00000 n +0000061320 00000 n +0000061551 00000 n +0000061783 00000 n +0000061986 00000 n +0000062190 00000 n +0000062327 00000 n +0000062465 00000 n +0000062659 00000 n +0000062854 00000 n +0000063044 00000 n +0000063235 00000 n +0000063426 00000 n +0000063618 00000 n +0000063810 00000 n +0000064003 00000 n +0000064242 00000 n +0000064482 00000 n +0000064697 00000 n +0000064913 00000 n +0000065120 00000 n +0000065327 00000 n +0000068893 00000 n +0000069371 00000 n +0000069567 00000 n +0000069764 00000 n +0000069960 00000 n +0000070157 00000 n +0000070356 00000 n +0000070556 00000 n +0000070756 00000 n +0000070957 00000 n +0000071155 00000 n +0000071354 00000 n +0000071588 00000 n +0000071823 00000 n +0000072022 00000 n +0000072222 00000 n +0000072425 00000 n +0000072629 00000 n +0000072831 00000 n +0000073034 00000 n +0000073234 00000 n +0000073435 00000 n +0000073631 00000 n +0000073828 00000 n +0000074017 00000 n +0000074208 00000 n +0000074400 00000 n +0000074593 00000 n +0000074783 00000 n +0000074974 00000 n +0000075160 00000 n +0000075347 00000 n +0000075559 00000 n +0000075772 00000 n +0000075987 00000 n +0000076203 00000 n +0000076416 00000 n +0000076629 00000 n +0000080328 00000 n +0000080831 00000 n +0000081033 00000 n +0000081236 00000 n +0000081438 00000 n +0000081641 00000 n +0000081852 00000 n +0000082064 00000 n +0000082285 00000 n +0000082507 00000 n +0000082736 00000 n +0000082966 00000 n +0000083167 00000 n +0000083369 00000 n +0000083567 00000 n +0000083766 00000 n +0000083979 00000 n +0000084193 00000 n +0000084392 00000 n +0000084592 00000 n +0000084803 00000 n +0000085015 00000 n +0000085161 00000 n +0000085308 00000 n +0000085522 00000 n +0000085737 00000 n +0000085929 00000 n +0000086122 00000 n +0000086333 00000 n +0000086545 00000 n +0000086764 00000 n +0000086984 00000 n +0000087183 00000 n +0000087383 00000 n +0000087591 00000 n +0000087800 00000 n +0000087996 00000 n +0000088192 00000 n +0000092056 00000 n +0000092527 00000 n +0000092664 00000 n +0000092802 00000 n +0000092994 00000 n +0000093187 00000 n +0000093386 00000 n +0000093586 00000 n +0000093743 00000 n +0000093901 00000 n +0000094114 00000 n +0000094328 00000 n +0000094524 00000 n +0000094721 00000 n +0000094913 00000 n +0000095106 00000 n +0000095329 00000 n +0000095553 00000 n +0000095754 00000 n +0000095956 00000 n +0000096153 00000 n +0000096351 00000 n +0000096548 00000 n +0000096746 00000 n +0000096906 00000 n +0000097067 00000 n +0000097264 00000 n +0000097462 00000 n +0000097597 00000 n +0000097733 00000 n +0000097916 00000 n +0000098100 00000 n +0000098292 00000 n +0000098485 00000 n +0000102326 00000 n +0000102813 00000 n +0000102972 00000 n +0000103132 00000 n +0000103353 00000 n +0000103575 00000 n +0000103778 00000 n +0000103982 00000 n +0000104205 00000 n +0000104429 00000 n +0000104633 00000 n +0000104838 00000 n +0000105069 00000 n +0000105301 00000 n +0000105514 00000 n +0000105728 00000 n +0000105957 00000 n +0000106187 00000 n +0000106405 00000 n +0000106624 00000 n +0000106860 00000 n +0000107097 00000 n +0000107315 00000 n +0000107534 00000 n +0000107669 00000 n +0000107805 00000 n +0000107998 00000 n +0000108192 00000 n +0000108403 00000 n +0000108615 00000 n +0000108818 00000 n +0000109022 00000 n +0000109213 00000 n +0000109405 00000 n +0000109619 00000 n +0000109833 00000 n +0000113909 00000 n +0000114396 00000 n +0000114599 00000 n +0000114803 00000 n +0000115008 00000 n +0000115214 00000 n +0000115404 00000 n +0000115595 00000 n +0000115832 00000 n +0000116070 00000 n +0000116301 00000 n +0000116533 00000 n +0000116737 00000 n +0000116942 00000 n +0000117150 00000 n +0000117359 00000 n +0000117567 00000 n +0000117776 00000 n +0000117929 00000 n +0000118083 00000 n +0000118280 00000 n +0000118478 00000 n +0000118639 00000 n +0000118801 00000 n +0000118983 00000 n +0000119166 00000 n +0000119331 00000 n +0000119497 00000 n +0000119694 00000 n +0000119892 00000 n +0000120094 00000 n +0000120297 00000 n +0000120446 00000 n +0000120596 00000 n +0000120778 00000 n +0000120961 00000 n +0000124800 00000 n +0000125271 00000 n +0000125492 00000 n +0000125714 00000 n +0000125928 00000 n +0000126143 00000 n +0000126361 00000 n +0000126580 00000 n +0000126784 00000 n +0000126989 00000 n +0000127165 00000 n +0000127342 00000 n +0000127541 00000 n +0000127741 00000 n +0000127936 00000 n +0000128132 00000 n +0000128330 00000 n +0000128529 00000 n +0000128681 00000 n +0000128834 00000 n +0000129021 00000 n +0000129209 00000 n +0000129403 00000 n +0000129598 00000 n +0000129744 00000 n +0000129891 00000 n +0000130093 00000 n +0000130296 00000 n +0000130463 00000 n +0000130631 00000 n +0000130787 00000 n +0000130944 00000 n +0000131151 00000 n +0000131359 00000 n +0000133666 00000 n +0000133961 00000 n +0000134105 00000 n +0000134250 00000 n +0000134452 00000 n +0000134655 00000 n +0000134869 00000 n +0000135084 00000 n +0000135269 00000 n +0000135455 00000 n +0000135633 00000 n +0000135812 00000 n +0000140610 00000 n +0000140849 00000 n +0000141105 00000 n +0000141312 00000 n +0000141518 00000 n +0000145091 00000 n +0000145322 00000 n +0000145519 00000 n +0000145708 00000 n +0000149393 00000 n +0000149596 00000 n +0000153335 00000 n +0000153558 00000 n +0000153692 00000 n +0000157714 00000 n +0000157953 00000 n +0000158087 00000 n +0000158221 00000 n +0000158355 00000 n +0000161968 00000 n +0000162171 00000 n +0000166877 00000 n +0000167268 00000 n +0000167402 00000 n +0000167534 00000 n +0000167666 00000 n +0000167798 00000 n +0000167930 00000 n +0000168062 00000 n +0000168194 00000 n +0000168326 00000 n +0000168458 00000 n +0000168591 00000 n +0000168724 00000 n +0000168857 00000 n +0000168990 00000 n +0000169123 00000 n +0000169256 00000 n +0000169389 00000 n +0000169522 00000 n +0000169655 00000 n +0000169788 00000 n +0000169921 00000 n +0000170053 00000 n +0000170184 00000 n +0000175185 00000 n +0000175584 00000 n +0000175717 00000 n +0000175850 00000 n +0000175983 00000 n +0000176116 00000 n +0000176249 00000 n +0000176382 00000 n +0000176515 00000 n +0000176648 00000 n +0000176781 00000 n +0000176914 00000 n +0000177047 00000 n +0000177180 00000 n +0000177313 00000 n +0000177446 00000 n +0000177579 00000 n +0000177712 00000 n +0000177845 00000 n +0000177978 00000 n +0000178111 00000 n +0000178244 00000 n +0000178377 00000 n +0000178510 00000 n +0000178645 00000 n +0000183449 00000 n +0000183912 00000 n +0000184047 00000 n +0000184180 00000 n +0000184313 00000 n +0000184446 00000 n +0000184579 00000 n +0000184712 00000 n +0000184845 00000 n +0000184978 00000 n +0000185111 00000 n +0000185245 00000 n +0000185379 00000 n +0000185513 00000 n +0000185647 00000 n +0000185781 00000 n +0000185915 00000 n +0000186049 00000 n +0000186183 00000 n +0000186317 00000 n +0000186451 00000 n +0000186585 00000 n +0000186719 00000 n +0000186853 00000 n +0000186987 00000 n +0000187121 00000 n +0000187255 00000 n +0000187389 00000 n +0000187523 00000 n +0000187657 00000 n +0000187791 00000 n +0000187925 00000 n +0000188058 00000 n +0000193055 00000 n +0000193518 00000 n +0000193652 00000 n +0000193786 00000 n +0000193920 00000 n +0000194054 00000 n +0000194188 00000 n +0000194322 00000 n +0000194456 00000 n +0000194590 00000 n +0000194724 00000 n +0000194858 00000 n +0000194992 00000 n +0000195126 00000 n +0000195260 00000 n +0000195394 00000 n +0000195528 00000 n +0000195662 00000 n +0000195796 00000 n +0000195930 00000 n +0000196064 00000 n +0000196198 00000 n +0000196332 00000 n +0000196466 00000 n +0000196600 00000 n +0000196734 00000 n +0000196868 00000 n +0000197002 00000 n +0000197136 00000 n +0000197270 00000 n +0000197404 00000 n +0000197538 00000 n +0000197673 00000 n +0000202259 00000 n +0000202650 00000 n +0000202785 00000 n +0000202918 00000 n +0000203051 00000 n +0000203184 00000 n +0000203317 00000 n +0000203450 00000 n +0000203583 00000 n +0000203716 00000 n +0000203849 00000 n +0000203983 00000 n +0000204117 00000 n +0000204251 00000 n +0000204385 00000 n +0000204519 00000 n +0000204653 00000 n +0000204787 00000 n +0000204921 00000 n +0000205055 00000 n +0000205189 00000 n +0000205323 00000 n +0000205457 00000 n +0000205590 00000 n +0000210570 00000 n +0000211081 00000 n +0000211215 00000 n +0000211349 00000 n +0000211483 00000 n +0000211617 00000 n +0000211751 00000 n +0000211885 00000 n +0000212019 00000 n +0000212153 00000 n +0000212287 00000 n +0000212421 00000 n +0000212555 00000 n +0000212689 00000 n +0000212823 00000 n +0000212957 00000 n +0000213091 00000 n +0000213225 00000 n +0000213359 00000 n +0000213493 00000 n +0000213627 00000 n +0000213761 00000 n +0000213895 00000 n +0000214029 00000 n +0000214163 00000 n +0000214297 00000 n +0000214431 00000 n +0000214565 00000 n +0000214699 00000 n +0000214833 00000 n +0000214967 00000 n +0000215101 00000 n +0000215235 00000 n +0000215369 00000 n +0000215503 00000 n +0000215637 00000 n +0000215771 00000 n +0000215904 00000 n +0000216036 00000 n +0000219278 00000 n +0000219517 00000 n +0000219651 00000 n +0000219785 00000 n +0000219920 00000 n +0000224952 00000 n +0000225175 00000 n +0000225310 00000 n +0000230303 00000 n +0000230526 00000 n +0000230661 00000 n +0000235447 00000 n +0000235650 00000 n +0000240649 00000 n +0000240872 00000 n +0000241007 00000 n +0000245852 00000 n +0000246055 00000 n +0000250970 00000 n +0000251193 00000 n +0000251328 00000 n +0000256189 00000 n +0000256412 00000 n +0000256547 00000 n +0000261310 00000 n +0000261513 00000 n +0000266505 00000 n +0000266728 00000 n +0000266863 00000 n +0000271838 00000 n +0000272041 00000 n +0000276936 00000 n +0000277159 00000 n +0000277294 00000 n +0000282231 00000 n +0000282454 00000 n +0000282589 00000 n +0000287403 00000 n +0000287606 00000 n +0000292603 00000 n +0000292826 00000 n +0000292961 00000 n +0000297965 00000 n +0000298188 00000 n +0000298323 00000 n +0000303231 00000 n +0000303434 00000 n +0000308403 00000 n +0000308626 00000 n +0000308761 00000 n +0000313532 00000 n +0000313735 00000 n +0000318047 00000 n +0000318278 00000 n +0000318413 00000 n +0000318548 00000 n +0000323431 00000 n +0000323654 00000 n +0000323789 00000 n +0000328814 00000 n +0000329037 00000 n +0000329172 00000 n +0000334040 00000 n +0000334243 00000 n +0000339339 00000 n +0000339562 00000 n +0000339697 00000 n +0000344581 00000 n +0000344784 00000 n +0000349796 00000 n +0000350019 00000 n +0000350154 00000 n +0000355070 00000 n +0000355293 00000 n +0000355428 00000 n +0000360228 00000 n +0000360431 00000 n +0000365468 00000 n +0000365691 00000 n +0000365826 00000 n +0000370748 00000 n +0000370971 00000 n +0000371106 00000 n +0000375917 00000 n +0000376120 00000 n +0000381088 00000 n +0000381311 00000 n +0000381446 00000 n +0000386387 00000 n +0000386590 00000 n +0000391465 00000 n +0000391688 00000 n +0000391823 00000 n +0000396759 00000 n +0000396982 00000 n +0000397117 00000 n +0000401918 00000 n +0000402121 00000 n +0000407114 00000 n +0000407337 00000 n +0000407472 00000 n +0000412461 00000 n +0000412684 00000 n +0000412819 00000 n +0000417598 00000 n +0000417801 00000 n +0000422784 00000 n +0000423007 00000 n +0000423142 00000 n +0000427990 00000 n +0000428193 00000 n +0000433212 00000 n +0000433435 00000 n +0000433570 00000 n +0000438436 00000 n +0000438659 00000 n +0000438794 00000 n +0000443530 00000 n +0000443733 00000 n +0000448788 00000 n +0000449011 00000 n +0000449147 00000 n +0000454091 00000 n +0000454294 00000 n +0000459120 00000 n +0000459343 00000 n +0000459479 00000 n +0000464495 00000 n +0000464718 00000 n +0000464854 00000 n +0000469631 00000 n +0000469834 00000 n +0000474808 00000 n +0000475031 00000 n +0000475167 00000 n +0000480155 00000 n +0000480378 00000 n +0000480513 00000 n +0000485271 00000 n +0000485474 00000 n +0000490551 00000 n +0000490886 00000 n +0000491022 00000 n +0000491156 00000 n +0000491290 00000 n +0000491424 00000 n +0000491558 00000 n +0000491692 00000 n +0000491826 00000 n +0000491960 00000 n +0000492094 00000 n +0000492229 00000 n +0000492364 00000 n +0000492499 00000 n +0000492634 00000 n +0000492768 00000 n +0000492901 00000 n +0000497397 00000 n +0000497708 00000 n +0000497843 00000 n +0000497978 00000 n +0000498113 00000 n +0000498248 00000 n +0000498383 00000 n +0000498518 00000 n +0000498653 00000 n +0000498788 00000 n +0000498923 00000 n +0000499058 00000 n +0000499194 00000 n +0000499330 00000 n +0000504338 00000 n +0000504561 00000 n +0000504697 00000 n +0000509536 00000 n +0000509759 00000 n +0000509895 00000 n +0000514751 00000 n +0000514974 00000 n +0000515110 00000 n +0000519926 00000 n +0000520149 00000 n +0000520285 00000 n +0000525136 00000 n +0000525359 00000 n +0000525495 00000 n +0000530166 00000 n +0000530389 00000 n +0000530525 00000 n +0000534114 00000 n +0000534317 00000 n +0000538901 00000 n +0000539132 00000 n +0000539268 00000 n +0000539403 00000 n +0000542898 00000 n +0000543101 00000 n +0000547952 00000 n +0000548175 00000 n +0000548311 00000 n +0000553075 00000 n +0000553278 00000 n +0000558388 00000 n +0000558611 00000 n +0000558747 00000 n +0000563492 00000 n +0000563695 00000 n +0000568822 00000 n +0000569045 00000 n +0000569180 00000 n +0000573906 00000 n +0000574109 00000 n +0000579103 00000 n +0000579306 00000 n +0000584107 00000 n +0000584330 00000 n +0000584466 00000 n +0000589217 00000 n +0000589420 00000 n +0000594467 00000 n +0000594690 00000 n +0000594826 00000 n +0000599592 00000 n +0000599795 00000 n +0000604796 00000 n +0000605019 00000 n +0000605155 00000 n +0000609920 00000 n +0000610123 00000 n +0000614957 00000 n +0000615160 00000 n +0000619972 00000 n +0000620195 00000 n +0000620331 00000 n +0000625074 00000 n +0000625277 00000 n +0000628895 00000 n +0000629098 00000 n +0000632371 00000 n +0000632574 00000 n +0000637611 00000 n +0000637834 00000 n +0000637970 00000 n +0000642503 00000 n +0000642706 00000 n +0000646992 00000 n +0000647215 00000 n +0000647351 00000 n +0000651417 00000 n +0000651648 00000 n +0000651784 00000 n +0000651920 00000 n +0000656866 00000 n +0000657137 00000 n +0000657273 00000 n +0000657409 00000 n +0000657543 00000 n +0000657677 00000 n +0000657811 00000 n +0000657945 00000 n +0000658081 00000 n +0000662852 00000 n +0000663115 00000 n +0000663251 00000 n +0000663385 00000 n +0000663519 00000 n +0000663653 00000 n +0000663787 00000 n +0000663923 00000 n +0000666684 00000 n +0000666887 00000 n +0000671193 00000 n +0000671432 00000 n +0000671568 00000 n +0000671704 00000 n +0000671839 00000 n +0000675857 00000 n +0000676096 00000 n +0000676232 00000 n +0000676368 00000 n +0000676504 00000 n +0000681153 00000 n +0000681400 00000 n +0000681536 00000 n +0000681672 00000 n +0000681808 00000 n +0000681944 00000 n +0000686819 00000 n +0000687050 00000 n +0000687186 00000 n +0000687322 00000 n +0000691466 00000 n +0000691697 00000 n +0000691833 00000 n +0000691969 00000 n +0000696136 00000 n +0000696383 00000 n +0000696519 00000 n +0000696655 00000 n +0000696791 00000 n +0000696927 00000 n +0000701916 00000 n +0000702147 00000 n +0000702283 00000 n +0000702419 00000 n +0000706998 00000 n +0000707229 00000 n +0000707365 00000 n +0000707501 00000 n +0000710438 00000 n +0000710661 00000 n +0000710797 00000 n +0000714870 00000 n +0000715073 00000 n +0000720577 00000 n +0000720976 00000 n +0000721112 00000 n +0000721246 00000 n +0000721380 00000 n +0000721514 00000 n +0000721648 00000 n +0000721782 00000 n +0000721916 00000 n +0000722050 00000 n +0000722184 00000 n +0000722319 00000 n +0000722454 00000 n +0000722589 00000 n +0000722724 00000 n +0000722859 00000 n +0000722994 00000 n +0000723129 00000 n +0000723264 00000 n +0000723399 00000 n +0000723534 00000 n +0000723669 00000 n +0000723804 00000 n +0000723939 00000 n +0000724073 00000 n +0000727769 00000 n +0000728056 00000 n +0000728191 00000 n +0000728326 00000 n +0000728461 00000 n +0000728596 00000 n +0000728731 00000 n +0000728866 00000 n +0000729001 00000 n +0000729136 00000 n +0000729272 00000 n +0000733691 00000 n +0000733914 00000 n +0000734050 00000 n +0000738503 00000 n +0000738734 00000 n +0000738870 00000 n +0000739006 00000 n +0000743465 00000 n +0000743688 00000 n +0000743824 00000 n +0000748783 00000 n +0000749118 00000 n +0000749254 00000 n +0000749388 00000 n +0000749522 00000 n +0000749656 00000 n +0000749790 00000 n +0000749924 00000 n +0000750058 00000 n +0000750192 00000 n +0000750326 00000 n +0000750461 00000 n +0000750596 00000 n +0000750731 00000 n +0000750866 00000 n +0000751000 00000 n +0000751133 00000 n +0000754374 00000 n +0000754629 00000 n +0000754764 00000 n +0000754899 00000 n +0000755034 00000 n +0000755169 00000 n +0000755305 00000 n +0000758716 00000 n +0000758919 00000 n +0000762176 00000 n +0000762379 00000 n +0000766780 00000 n +0000766983 00000 n +0000771375 00000 n +0000771742 00000 n +0000771878 00000 n +0000772012 00000 n +0000772146 00000 n +0000772280 00000 n +0000772414 00000 n +0000772548 00000 n +0000772682 00000 n +0000772816 00000 n +0000772950 00000 n +0000773085 00000 n +0000773220 00000 n +0000773355 00000 n +0000773490 00000 n +0000773625 00000 n +0000773760 00000 n +0000773895 00000 n +0000774030 00000 n +0000774165 00000 n +0000774301 00000 n +0000774493 00000 n +0000774715 00000 n +0000774841 00000 n +0000774987 00000 n +0000775127 00000 n +0000775324 00000 n +0000775558 00000 n +0000775789 00000 n +0000776045 00000 n +0000776284 00000 n +0000776531 00000 n +0000776761 00000 n +0000777003 00000 n +0000777228 00000 n +0000777472 00000 n +0000777700 00000 n +0000777935 00000 n +0000778153 00000 n +0000778384 00000 n +0000778598 00000 n +0000778833 00000 n +0000779051 00000 n +0000779295 00000 n +0000779522 00000 n +0000779754 00000 n +0000780001 00000 n +0000780206 00000 n +0000780382 00000 n +0000780577 00000 n +0000780782 00000 n +0000780988 00000 n +0000781195 00000 n +0000781449 00000 n +0000781679 00000 n +0000781902 00000 n +0000782113 00000 n +0000782324 00000 n +0000782539 00000 n +0000782755 00000 n +0000782969 00000 n +0000783219 00000 n +0000783434 00000 n +0000783653 00000 n +0000783871 00000 n +0000784087 00000 n +0000784299 00000 n +0000784504 00000 n +0000784711 00000 n +0000784916 00000 n +0000785117 00000 n +0000785344 00000 n +0000785574 00000 n +0000785803 00000 n +0000786020 00000 n +0000786237 00000 n +0000786463 00000 n +0000786699 00000 n +0000786943 00000 n +0000787159 00000 n +0000787372 00000 n +0000787600 00000 n +0000787814 00000 n +0000788026 00000 n +0000788209 00000 n +0000788423 00000 n +0000788627 00000 n +0000788852 00000 n +0000789085 00000 n +0000789298 00000 n +0000789520 00000 n +0000789717 00000 n +0000789891 00000 n +0000790081 00000 n +0000790278 00000 n +0000790470 00000 n +0000790681 00000 n +0000790889 00000 n +0000791093 00000 n +0000791328 00000 n +0000791541 00000 n +0000791750 00000 n +0000791945 00000 n +0000792142 00000 n +0000792325 00000 n +0000792498 00000 n +0000792681 00000 n +0000792873 00000 n +0000793074 00000 n +0000793298 00000 n +0000793520 00000 n +0000793761 00000 n +0000793984 00000 n +0000794233 00000 n +0000794465 00000 n +0000794712 00000 n +0000794949 00000 n +0000795203 00000 n +0000795426 00000 n +0000795604 00000 n +0000795800 00000 n +0000796027 00000 n +0000796246 00000 n +0000796455 00000 n +0000796687 00000 n +0000796908 00000 n +0000797131 00000 n +0000797339 00000 n +0000797594 00000 n +0000797842 00000 n +0000798065 00000 n +0000798292 00000 n +0000798504 00000 n +0000798699 00000 n +0000798899 00000 n +0000799078 00000 n +0000799278 00000 n +0000799461 00000 n +0000799676 00000 n +0000799881 00000 n +0000800072 00000 n +0000800257 00000 n +0000800496 00000 n +0000800728 00000 n +0000800964 00000 n +0000801186 00000 n +0000801380 00000 n +0000801597 00000 n +0000801810 00000 n +0000802011 00000 n +0000802205 00000 n +0000802395 00000 n +0000802592 00000 n +0000802780 00000 n +0000802985 00000 n +0000803155 00000 n +0000803353 00000 n +0000803548 00000 n +0000803719 00000 n +0000803924 00000 n +0000804157 00000 n +0000804360 00000 n +0000804541 00000 n +0000804605 00000 n +0000812285 00000 n +0000817087 00000 n +0000828947 00000 n +0000841343 00000 n +0000841577 00000 n +0000841981 00000 n +0000842779 00000 n +0000842932 00000 n +0000843163 00000 n +0000843760 00000 n +0000845245 00000 n +0000845395 00000 n +0000845630 00000 n +0000846169 00000 n +0000847406 00000 n +0000847559 00000 n +0000847803 00000 n +0000848398 00000 n +0000850023 00000 n +0000850180 00000 n trailer << -/Size 1075 +/Size 1077 /Root 3 0 R /Info 2 0 R >> startxref -841088 +850272 %%EOF diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/_index.md b/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/_index.md index 913d6594f3c..b1eba5740d7 100644 --- a/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/_index.md +++ b/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/_index.md @@ -29,7 +29,7 @@ Rancher and RKE install Kubernetes services via Docker containers. Configuration Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher are provided for testing. When performing the tests, you will need access to the Docker command line on the hosts of all three RKE roles. The commands also make use of the [kubectl](https://kubernetes.io/docs/tasks/tools/) (with a valid configuration file) and [jq](https://stedolan.github.io/jq/) tools, which are required in the testing and evaluation of test results. -> NOTE: For the moment only `automated` tests (previously called `scored`) are covered in this guide. +> NOTE: Only `automated` tests (previously called `scored`) are covered in this guide. ### Controls ## 1.1 Master Node Configuration Files @@ -137,13 +137,75 @@ chown root:root stat -c %U:%G ``` +### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the below command: +ps -ef | grep etcd Run the below command (based on the etcd data directory found above). For example, +chmod 700 /var/lib/etcd + +**Audit:** + +```bash +stat -c %a /node/var/lib/etcd +``` + +**Expected Result**: + +```console +'700' is equal to '700' +``` + +**Returned Value**: + +```console +700 +``` + +### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the below command: +ps -ef | grep etcd +Run the below command (based on the etcd data directory found above). +For example, chown etcd:etcd /var/lib/etcd + +A system service account is required for etcd data directory ownership. +Refer to Rancher's hardening guide for more details on how to configure this ownership. + +**Audit:** + +```bash +stat -c %U:%G /node/var/lib/etcd +``` + +**Expected Result**: + +```console +'etcd:etcd' is present +``` + +**Returned Value**: + +```console +etcd:etcd +``` + ### 1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Automated) **Result:** Not Applicable **Remediation:** -Cluster provisioned by RKE does not store the Kubernetes default kubeconfig credentials file on the nodes. +Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. ### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) @@ -151,7 +213,7 @@ Cluster provisioned by RKE does not store the Kubernetes default kubeconfig cred **Result:** Not Applicable **Remediation:** -Cluster provisioned by RKE does not store the Kubernetes default kubeconfig credentials file on the nodes. +Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. ### 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated) @@ -457,68 +519,6 @@ exit true ``` -### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the below command: -ps -ef | grep etcd Run the below command (based on the etcd data directory found above). For example, -chmod 700 /var/lib/etcd - -**Audit:** - -```bash -stat -c %a /node/var/lib/etcd -``` - -**Expected Result**: - -```console -'700' is equal to '700' -``` - -**Returned Value**: - -```console -700 -``` - -### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) - - -**Result:** pass - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the below command: -ps -ef | grep etcd -Run the below command (based on the etcd data directory found above). -For example, chown etcd:etcd /var/lib/etcd - -A system service account is required for etcd data directory ownership. -Refer to Rancher's hardening guide for more details on how to configure this ownership. - -**Audit:** - -```bash -stat -c %U:%G /node/var/lib/etcd -``` - -**Expected Result**: - -```console -'etcd:etcd' is present -``` - -**Returned Value**: - -```console -etcd:etcd -``` - ## 1.2 API Server ### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) @@ -545,7 +545,7 @@ on the master node and set the below parameter. **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.2 Ensure that the --basic-auth-file argument is not set (Automated) @@ -573,7 +573,7 @@ on the master node and remove the --basic-auth-file= parameter. **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.3 Ensure that the --token-auth-file parameter is not set (Automated) @@ -601,7 +601,7 @@ on the master node and remove the --token-auth-file= parameter. **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) @@ -628,7 +628,7 @@ on the master node and remove the --kubelet-https parameter. **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) @@ -659,7 +659,7 @@ kubelet client certificate and key parameters as below. **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) @@ -689,7 +689,7 @@ the apiserver and kubelets. Then, edit the API server pod specification file **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) @@ -718,7 +718,7 @@ One such example could be as below. **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) @@ -746,7 +746,7 @@ on the master node and set the --authorization-mode parameter to a value that in **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) @@ -775,7 +775,7 @@ for example: **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Automated) @@ -805,7 +805,7 @@ and set the below parameters. **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) @@ -833,7 +833,7 @@ value that does not include AlwaysAdmit. **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) @@ -896,7 +896,7 @@ value that does not include ServiceAccount. **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) @@ -924,7 +924,7 @@ ensure it does not include NamespaceLifecycle. **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set (Automated) @@ -955,7 +955,7 @@ Then restart the API Server. **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.17 Ensure that the admission control plugin NodeRestriction is set (Automated) @@ -985,7 +985,7 @@ value that includes NodeRestriction. **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.18 Ensure that the --insecure-bind-address argument is not set (Automated) @@ -1012,7 +1012,7 @@ on the master node and remove the --insecure-bind-address parameter. **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.19 Ensure that the --insecure-port argument is set to 0 (Automated) @@ -1040,7 +1040,7 @@ on the master node and set the below parameter. **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.20 Ensure that the --secure-port argument is not set to 0 (Automated) @@ -1068,7 +1068,7 @@ set it to a different (non-zero) desired port. **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.21 Ensure that the --profiling argument is set to false (Automated) @@ -1096,7 +1096,7 @@ on the master node and set the below parameter. **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.22 Ensure that the --audit-log-path argument is set (Automated) @@ -1125,7 +1125,7 @@ file where you would like audit logs to be written, for example: **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) @@ -1153,7 +1153,7 @@ on the master node and set the --audit-log-maxage parameter to 30 or as an appro **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) @@ -1182,7 +1182,7 @@ value. **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) @@ -1211,7 +1211,7 @@ For example, to set it as 100 MB: **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.26 Ensure that the --request-timeout argument is set as appropriate (Automated) @@ -1240,7 +1240,7 @@ For example, **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.27 Ensure that the --service-account-lookup argument is set to true (Automated) @@ -1270,7 +1270,7 @@ that the default takes effect. **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.28 Ensure that the --service-account-key-file argument is set as appropriate (Automated) @@ -1299,7 +1299,7 @@ to the public key file for service accounts: **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) @@ -1329,7 +1329,7 @@ on the master node and set the etcd certificate and key file parameters. **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) @@ -1359,7 +1359,7 @@ on the master node and set the TLS certificate and private key file parameters. **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.31 Ensure that the --client-ca-file argument is set as appropriate (Automated) @@ -1388,7 +1388,7 @@ on the master node and set the client certificate authority file. **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.32 Ensure that the --etcd-cafile argument is set as appropriate (Automated) @@ -1417,7 +1417,7 @@ on the master node and set the etcd certificate authority file parameter. **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate (Automated) @@ -1445,7 +1445,7 @@ on the master node and set the --encryption-provider-config parameter to the pat **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 1.2.34 Ensure that encryption providers are appropriately configured (Automated) @@ -1552,7 +1552,7 @@ for example: **Returned Value**: ```console -root 6684 6662 1 13:04 ? 00:00:12 kube-controller-manager --profiling=false --cluster-cidr=10.42.0.0/16 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --address=0.0.0.0 --leader-elect=true --node-monitor-grace-period=40s --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --configure-cloud-routes=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --terminated-pod-gc-threshold=1000 --allow-untagged-cloud=true --use-service-account-credentials=true +root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true ``` ### 1.3.2 Ensure that the --profiling argument is set to false (Automated) @@ -1580,7 +1580,7 @@ on the master node and set the below parameter. **Returned Value**: ```console -root 6684 6662 1 13:04 ? 00:00:12 kube-controller-manager --profiling=false --cluster-cidr=10.42.0.0/16 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --address=0.0.0.0 --leader-elect=true --node-monitor-grace-period=40s --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --configure-cloud-routes=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --terminated-pod-gc-threshold=1000 --allow-untagged-cloud=true --use-service-account-credentials=true +root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true ``` ### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) @@ -1608,7 +1608,7 @@ on the master node to set the below parameter. **Returned Value**: ```console -root 6684 6662 1 13:04 ? 00:00:12 kube-controller-manager --profiling=false --cluster-cidr=10.42.0.0/16 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --address=0.0.0.0 --leader-elect=true --node-monitor-grace-period=40s --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --configure-cloud-routes=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --terminated-pod-gc-threshold=1000 --allow-untagged-cloud=true --use-service-account-credentials=true +root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true ``` ### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) @@ -1637,7 +1637,7 @@ to the private key file for service accounts. **Returned Value**: ```console -root 6684 6662 1 13:04 ? 00:00:12 kube-controller-manager --profiling=false --cluster-cidr=10.42.0.0/16 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --address=0.0.0.0 --leader-elect=true --node-monitor-grace-period=40s --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --configure-cloud-routes=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --terminated-pod-gc-threshold=1000 --allow-untagged-cloud=true --use-service-account-credentials=true +root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true ``` ### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) @@ -1665,7 +1665,7 @@ on the master node and set the --root-ca-file parameter to the certificate bundl **Returned Value**: ```console -root 6684 6662 1 13:04 ? 00:00:12 kube-controller-manager --profiling=false --cluster-cidr=10.42.0.0/16 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --address=0.0.0.0 --leader-elect=true --node-monitor-grace-period=40s --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --configure-cloud-routes=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --terminated-pod-gc-threshold=1000 --allow-untagged-cloud=true --use-service-account-credentials=true +root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true ``` ### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) @@ -1698,13 +1698,13 @@ on the master node and ensure the correct value for the --bind-address parameter **Expected Result**: ```console -'--bind-address' is not present OR '--bind-address' is not present +'127.0.0.1' is equal to '127.0.0.1' OR '--bind-address' is not present ``` **Returned Value**: ```console -root 6684 6662 1 13:04 ? 00:00:12 kube-controller-manager --profiling=false --cluster-cidr=10.42.0.0/16 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --address=0.0.0.0 --leader-elect=true --node-monitor-grace-period=40s --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --configure-cloud-routes=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --terminated-pod-gc-threshold=1000 --allow-untagged-cloud=true --use-service-account-credentials=true +root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true ``` ## 1.4 Scheduler @@ -1733,7 +1733,7 @@ on the master node and set the below parameter. **Returned Value**: ```console -root 6889 6870 0 13:04 ? 00:00:02 kube-scheduler --leader-elect=true --profiling=false --v=2 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --address=0.0.0.0 +root 121587 121567 0 12:27 ? 00:00:12 kube-scheduler --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --address=127.0.0.1 --leader-elect=true --profiling=false --v=2 --bind-address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 ``` ### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) @@ -1754,13 +1754,13 @@ on the master node and ensure the correct value for the --bind-address parameter **Expected Result**: ```console -'--bind-address' is not present OR '--bind-address' is not present +'127.0.0.1' is equal to '127.0.0.1' OR '--bind-address' is not present ``` **Returned Value**: ```console -root 6889 6870 0 13:04 ? 00:00:02 kube-scheduler --leader-elect=true --profiling=false --v=2 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --address=0.0.0.0 +root 121587 121567 0 12:27 ? 00:00:12 kube-scheduler --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --address=127.0.0.1 --leader-elect=true --profiling=false --v=2 --bind-address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 ``` ## 2 Etcd Node Configuration Files @@ -1791,7 +1791,7 @@ on the master node and set the below parameters. **Returned Value**: ```console -etcd 6259 6237 1 13:03 ? 00:00:13 /usr/local/bin/etcd --listen-peer-urls=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-client-cert-auth=true --heartbeat-interval=500 --name=etcd- --initial-cluster=etcd-=https://:2380 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --listen-client-urls=https://:2379 --initial-advertise-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --client-cert-auth=true --enable-v2=true --election-timeout=5000 --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --initial-cluster-state=new --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --advertise-client-urls=https://:2379 root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 root 24183 24165 1 13:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 2 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json ``` ### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) @@ -1819,7 +1819,7 @@ node and set the below parameter. **Returned Value**: ```console -etcd 6259 6237 1 13:03 ? 00:00:13 /usr/local/bin/etcd --listen-peer-urls=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-client-cert-auth=true --heartbeat-interval=500 --name=etcd- --initial-cluster=etcd-=https://:2380 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --listen-client-urls=https://:2379 --initial-advertise-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --client-cert-auth=true --enable-v2=true --election-timeout=5000 --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --initial-cluster-state=new --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --advertise-client-urls=https://:2379 root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 root 24183 24165 1 13:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 2 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json ``` ### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) @@ -1847,7 +1847,7 @@ node and either remove the --auto-tls parameter or set it to false. **Returned Value**: ```console -etcd 6259 6237 1 13:03 ? 00:00:13 /usr/local/bin/etcd --listen-peer-urls=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-client-cert-auth=true --heartbeat-interval=500 --name=etcd- --initial-cluster=etcd-=https://:2380 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --listen-client-urls=https://:2379 --initial-advertise-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --client-cert-auth=true --enable-v2=true --election-timeout=5000 --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --initial-cluster-state=new --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --advertise-client-urls=https://:2379 root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 root 24183 24165 1 13:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 1 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json ``` ### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) @@ -1878,7 +1878,7 @@ master node and set the below parameters. **Returned Value**: ```console -etcd 6259 6237 1 13:03 ? 00:00:13 /usr/local/bin/etcd --listen-peer-urls=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-client-cert-auth=true --heartbeat-interval=500 --name=etcd- --initial-cluster=etcd-=https://:2380 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --listen-client-urls=https://:2379 --initial-advertise-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --client-cert-auth=true --enable-v2=true --election-timeout=5000 --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --initial-cluster-state=new --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --advertise-client-urls=https://:2379 root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 root 24183 24165 1 13:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 5 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json ``` ### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) @@ -1906,7 +1906,7 @@ node and set the below parameter. **Returned Value**: ```console -etcd 6259 6237 1 13:03 ? 00:00:13 /usr/local/bin/etcd --listen-peer-urls=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-client-cert-auth=true --heartbeat-interval=500 --name=etcd- --initial-cluster=etcd-=https://:2380 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --listen-client-urls=https://:2379 --initial-advertise-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --client-cert-auth=true --enable-v2=true --election-timeout=5000 --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --initial-cluster-state=new --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --advertise-client-urls=https://:2379 root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 root 24183 24165 1 13:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 4 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json ``` ### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) @@ -1934,7 +1934,7 @@ node and either remove the --peer-auto-tls parameter or set it to false. **Returned Value**: ```console -etcd 6259 6237 1 13:03 ? 00:00:13 /usr/local/bin/etcd --listen-peer-urls=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-client-cert-auth=true --heartbeat-interval=500 --name=etcd- --initial-cluster=etcd-=https://:2380 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --listen-client-urls=https://:2379 --initial-advertise-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --client-cert-auth=true --enable-v2=true --election-timeout=5000 --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --initial-cluster-state=new --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --advertise-client-urls=https://:2379 root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 root 24183 24165 2 13:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 4 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json ``` ### 2.7 Ensure that a unique Certificate Authority is used for etcd (Automated) @@ -1965,7 +1965,7 @@ master node and set the below parameter. **Returned Value**: ```console -etcd 6259 6237 1 13:03 ? 00:00:13 /usr/local/bin/etcd --listen-peer-urls=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-client-cert-auth=true --heartbeat-interval=500 --name=etcd- --initial-cluster=etcd-=https://:2380 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --listen-client-urls=https://:2379 --initial-advertise-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --client-cert-auth=true --enable-v2=true --election-timeout=5000 --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --initial-cluster-state=new --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --advertise-client-urls=https://:2379 root 6465 6444 8 13:04 ? 00:01:02 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 root 24183 24165 2 13:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 3 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json ``` ## 3.1 Authentication and Authorization @@ -2002,7 +2002,7 @@ Create an audit policy file for your cluster. **Returned Value**: ```console -root 6465 6444 8 13:04 ? 00:01:03 kube-apiserver --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --service-node-port-range=30000-32767 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --secure-port=6443 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --storage-backend=etcd3 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --advertise-address= --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --authorization-mode=Node,RBAC --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --profiling=false --service-account-issuer=rke --allow-privileged=true --insecure-port=0 --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --bind-address=0.0.0.0 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --audit-log-maxsize=100 --audit-log-format=json --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --audit-log-maxage=30 --audit-log-maxbackup=10 +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json ``` ### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) @@ -2392,7 +2392,7 @@ systemctl restart kubelet.service **Returned Value**: ```console -UID PID PPID C STIME TTY TIME CMD root 7101 7078 3 13:04 ? 00:00:23 kubelet --streaming-connection-idle-timeout=30m --cluster-dns=10.43.0.10 --pod-infra-container-image=rancher/mirrored-pause:3.4.1 --node-ip= --network-plugin=cni --event-qps=0 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --cni-bin-dir=/opt/cni/bin --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --v=2 --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --hostname-override= --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-.pem --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cluster-domain=cluster.local --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet--key.pem --authentication-token-webhook=true --cni-conf-dir=/etc/cni/net.d --cgroups-per-qos=True --make-iptables-util-chains=true --read-only-port=0 --fail-swap-on=false --anonymous-auth=false --protect-kernel-defaults=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --address=0.0.0.0 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +UID PID PPID C STIME TTY TIME CMD root 121813 121792 4 12:27 ? 00:03:37 kubelet --fail-swap-on=false --resolv-conf=/etc/resolv.conf --authorization-mode=Webhook --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --v=2 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --make-iptables-util-chains=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --hostname-override= --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-.pem --network-plugin=cni --streaming-connection-idle-timeout=30m --root-dir=/var/lib/kubelet --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --protect-kernel-defaults=true --cloud-provider= --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet--key.pem --cgroups-per-qos=True --cni-bin-dir=/opt/cni/bin --cni-conf-dir=/etc/cni/net.d --pod-infra-container-image=rancher/mirrored-pause:3.5 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --anonymous-auth=false --authentication-token-webhook=true --node-ip= --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --read-only-port=0 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf ``` ### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) @@ -2581,7 +2581,7 @@ systemctl restart kubelet.service **Returned Value**: ```console -UID PID PPID C STIME TTY TIME CMD root 7101 7078 3 13:04 ? 00:00:23 kubelet --streaming-connection-idle-timeout=30m --cluster-dns=10.43.0.10 --pod-infra-container-image=rancher/mirrored-pause:3.4.1 --node-ip= --network-plugin=cni --event-qps=0 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --cni-bin-dir=/opt/cni/bin --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --v=2 --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --hostname-override= --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-.pem --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cluster-domain=cluster.local --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet--key.pem --authentication-token-webhook=true --cni-conf-dir=/etc/cni/net.d --cgroups-per-qos=True --make-iptables-util-chains=true --read-only-port=0 --fail-swap-on=false --anonymous-auth=false --protect-kernel-defaults=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --address=0.0.0.0 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +UID PID PPID C STIME TTY TIME CMD root 121813 121792 4 12:27 ? 00:03:37 kubelet --fail-swap-on=false --resolv-conf=/etc/resolv.conf --authorization-mode=Webhook --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --v=2 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --make-iptables-util-chains=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --hostname-override= --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-.pem --network-plugin=cni --streaming-connection-idle-timeout=30m --root-dir=/var/lib/kubelet --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --protect-kernel-defaults=true --cloud-provider= --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet--key.pem --cgroups-per-qos=True --cni-bin-dir=/opt/cni/bin --cni-conf-dir=/etc/cni/net.d --pod-infra-container-image=rancher/mirrored-pause:3.5 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --anonymous-auth=false --authentication-token-webhook=true --node-ip= --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --read-only-port=0 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf ``` ### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Automated) diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf index 2df9a1dae27..c61b5c4abc1 100644 --- a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf +++ b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf @@ -3,25 +3,25 @@ 1 0 obj << /Type /Pages -/Kids [ 6 0 R 8 0 R 30 0 R 45 0 R 53 0 R 67 0 R 77 0 R 99 0 R 129 0 R 169 0 R 204 0 R 241 0 R 280 0 R 320 0 R 360 0 R 400 0 R 435 0 R 475 0 R 515 0 R 538 0 R 572 0 R ] -/Count 21 +/Kids [ 6 0 R 8 0 R 30 0 R 45 0 R 53 0 R 67 0 R 77 0 R 99 0 R 129 0 R 164 0 R 194 0 R 232 0 R 270 0 R 310 0 R 350 0 R 390 0 R 425 0 R 464 0 R 499 0 R 534 0 R 557 0 R 591 0 R ] +/Count 22 >> endobj 2 0 obj << /Title (Hardening Guide with CIS v1.6 Benchmark) /Creator (pandoc) -/Producer (WeasyPrint 54.1) +/Producer (WeasyPrint 54.2) >> endobj 3 0 obj << /Type /Catalog /Pages 1 0 R -/Outlines 600 0 R +/Outlines 611 0 R /Names << /Dests << -/Names [ (TOC) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (cb1) [ 45 0 R /XYZ 84.259843 441.572079 0 ] (cb1-1) [ 45 0 R /XYZ 101.433071 439.875057 0 ] (cb1-2) [ 45 0 R /XYZ 99.933071 420.928036 0 ] (cb1-3) [ 45 0 R /XYZ 99.933071 401.981014 0 ] (cb1-4) [ 45 0 R /XYZ 99.933071 383.033993 0 ] (cb1-5) [ 45 0 R /XYZ 99.933071 364.086971 0 ] (cb10) [ 400 0 R /XYZ 84.259843 697.970079 0 ] (cb10-1) [ 400 0 R /XYZ 101.433071 696.273057 0 ] (cb10-10) [ 400 0 R /XYZ 99.933071 525.749864 0 ] (cb10-100) [ 475 0 R /XYZ 99.933071 249.709434 0 ] (cb10-101) [ 475 0 R /XYZ 99.933071 230.762413 0 ] (cb10-102) [ 475 0 R /XYZ 99.933071 211.815391 0 ] (cb10-103) [ 475 0 R /XYZ 99.933071 192.868370 0 ] (cb10-104) [ 475 0 R /XYZ 99.933071 173.921348 0 ] (cb10-105) [ 475 0 R /XYZ 99.933071 154.974327 0 ] (cb10-106) [ 475 0 R /XYZ 99.933071 136.027305 0 ] (cb10-107) [ 475 0 R /XYZ 99.933071 117.080284 0 ] (cb10-108) [ 475 0 R /XYZ 99.933071 98.133262 0 ] (cb10-109) [ 515 0 R /XYZ 99.933071 799.173057 0 ] (cb10-11) [ 400 0 R /XYZ 99.933071 506.802842 0 ] (cb10-110) [ 515 0 R /XYZ 99.933071 780.226036 0 ] (cb10-111) [ 515 0 R /XYZ 99.933071 761.279014 0 ] (cb10-112) [ 515 0 R /XYZ 99.933071 742.331993 0 ] (cb10-113) [ 515 0 R /XYZ 99.933071 723.384971 0 ] (cb10-114) [ 515 0 R /XYZ 99.933071 704.437950 0 ] (cb10-115) [ 515 0 R /XYZ 99.933071 685.490928 0 ] (cb10-116) [ 515 0 R /XYZ 99.933071 666.543907 0 ] (cb10-117) [ 515 0 R /XYZ 99.933071 647.596885 0 ] (cb10-118) [ 515 0 R /XYZ 99.933071 533.914756 0 ] (cb10-119) [ 515 0 R /XYZ 99.933071 514.967735 0 ] (cb10-12) [ 400 0 R /XYZ 99.933071 487.855821 0 ] (cb10-120) [ 515 0 R /XYZ 99.933071 496.020714 0 ] (cb10-121) [ 515 0 R /XYZ 99.933071 477.073692 0 ] (cb10-122) [ 515 0 R /XYZ 99.933071 458.126671 0 ] (cb10-123) [ 515 0 R /XYZ 99.933071 439.179649 0 ] (cb10-124) [ 515 0 R /XYZ 99.933071 420.232628 0 ] (cb10-13) [ 400 0 R /XYZ 99.933071 468.908799 0 ] (cb10-14) [ 400 0 R /XYZ 99.933071 449.961778 0 ] (cb10-15) [ 400 0 R /XYZ 99.933071 431.014756 0 ] (cb10-16) [ 400 0 R /XYZ 99.933071 412.067735 0 ] (cb10-17) [ 400 0 R /XYZ 99.933071 393.120714 0 ] (cb10-18) [ 400 0 R /XYZ 99.933071 374.173692 0 ] (cb10-19) [ 400 0 R /XYZ 99.933071 355.226671 0 ] (cb10-2) [ 400 0 R /XYZ 99.933071 677.326036 0 ] (cb10-20) [ 400 0 R /XYZ 99.933071 336.279649 0 ] (cb10-21) [ 400 0 R /XYZ 99.933071 317.332628 0 ] (cb10-22) [ 400 0 R /XYZ 99.933071 298.385606 0 ] (cb10-23) [ 400 0 R /XYZ 99.933071 279.438585 0 ] (cb10-24) [ 400 0 R /XYZ 99.933071 260.491563 0 ] (cb10-25) [ 400 0 R /XYZ 99.933071 241.544542 0 ] (cb10-26) [ 400 0 R /XYZ 99.933071 222.597520 0 ] (cb10-27) [ 400 0 R /XYZ 99.933071 203.650499 0 ] (cb10-28) [ 400 0 R /XYZ 99.933071 184.703477 0 ] (cb10-29) [ 400 0 R /XYZ 99.933071 165.756456 0 ] (cb10-3) [ 400 0 R /XYZ 99.933071 658.379014 0 ] (cb10-30) [ 400 0 R /XYZ 99.933071 127.862413 0 ] (cb10-31) [ 400 0 R /XYZ 99.933071 108.915391 0 ] (cb10-32) [ 400 0 R /XYZ 99.933071 89.968370 0 ] (cb10-33) [ 435 0 R /XYZ 99.933071 799.173057 0 ] (cb10-34) [ 435 0 R /XYZ 99.933071 780.226036 0 ] (cb10-35) [ 435 0 R /XYZ 99.933071 761.279014 0 ] (cb10-36) [ 435 0 R /XYZ 99.933071 742.331993 0 ] (cb10-37) [ 435 0 R /XYZ 99.933071 723.384971 0 ] (cb10-38) [ 435 0 R /XYZ 99.933071 704.437950 0 ] (cb10-39) [ 435 0 R /XYZ 99.933071 685.490928 0 ] (cb10-4) [ 400 0 R /XYZ 99.933071 639.431993 0 ] (cb10-40) [ 435 0 R /XYZ 99.933071 666.543907 0 ] (cb10-41) [ 435 0 R /XYZ 99.933071 647.596885 0 ] (cb10-42) [ 435 0 R /XYZ 99.933071 628.649864 0 ] (cb10-43) [ 435 0 R /XYZ 99.933071 609.702842 0 ] (cb10-44) [ 435 0 R /XYZ 99.933071 590.755821 0 ] (cb10-45) [ 435 0 R /XYZ 99.933071 571.808799 0 ] (cb10-46) [ 435 0 R /XYZ 99.933071 552.861778 0 ] (cb10-47) [ 435 0 R /XYZ 99.933071 533.914756 0 ] (cb10-48) [ 435 0 R /XYZ 99.933071 514.967735 0 ] (cb10-49) [ 435 0 R /XYZ 99.933071 496.020714 0 ] (cb10-5) [ 400 0 R /XYZ 99.933071 620.484971 0 ] (cb10-50) [ 435 0 R /XYZ 99.933071 477.073692 0 ] (cb10-51) [ 435 0 R /XYZ 99.933071 458.126671 0 ] (cb10-52) [ 435 0 R /XYZ 99.933071 439.179649 0 ] (cb10-53) [ 435 0 R /XYZ 99.933071 420.232628 0 ] (cb10-54) [ 435 0 R /XYZ 99.933071 401.285606 0 ] (cb10-55) [ 435 0 R /XYZ 99.933071 382.338585 0 ] (cb10-56) [ 435 0 R /XYZ 99.933071 363.391563 0 ] (cb10-57) [ 435 0 R /XYZ 99.933071 344.444542 0 ] (cb10-58) [ 435 0 R /XYZ 99.933071 325.497520 0 ] (cb10-59) [ 435 0 R /XYZ 99.933071 306.550499 0 ] (cb10-6) [ 400 0 R /XYZ 99.933071 601.537950 0 ] (cb10-60) [ 435 0 R /XYZ 99.933071 287.603477 0 ] (cb10-61) [ 435 0 R /XYZ 99.933071 268.656456 0 ] (cb10-62) [ 435 0 R /XYZ 99.933071 249.709434 0 ] (cb10-63) [ 435 0 R /XYZ 99.933071 230.762413 0 ] (cb10-64) [ 435 0 R /XYZ 99.933071 211.815391 0 ] (cb10-65) [ 435 0 R /XYZ 99.933071 192.868370 0 ] (cb10-66) [ 435 0 R /XYZ 99.933071 173.921348 0 ] (cb10-67) [ 435 0 R /XYZ 99.933071 154.974327 0 ] (cb10-68) [ 435 0 R /XYZ 99.933071 136.027305 0 ] (cb10-69) [ 435 0 R /XYZ 99.933071 117.080284 0 ] (cb10-7) [ 400 0 R /XYZ 99.933071 582.590928 0 ] (cb10-70) [ 435 0 R /XYZ 99.933071 98.133262 0 ] (cb10-71) [ 475 0 R /XYZ 99.933071 799.173057 0 ] (cb10-72) [ 475 0 R /XYZ 99.933071 780.226036 0 ] (cb10-73) [ 475 0 R /XYZ 99.933071 761.279014 0 ] (cb10-74) [ 475 0 R /XYZ 99.933071 742.331993 0 ] (cb10-75) [ 475 0 R /XYZ 99.933071 723.384971 0 ] (cb10-76) [ 475 0 R /XYZ 99.933071 704.437950 0 ] (cb10-77) [ 475 0 R /XYZ 99.933071 685.490928 0 ] (cb10-78) [ 475 0 R /XYZ 99.933071 666.543907 0 ] (cb10-79) [ 475 0 R /XYZ 99.933071 647.596885 0 ] (cb10-8) [ 400 0 R /XYZ 99.933071 563.643907 0 ] (cb10-80) [ 475 0 R /XYZ 99.933071 628.649864 0 ] (cb10-81) [ 475 0 R /XYZ 99.933071 609.702842 0 ] (cb10-82) [ 475 0 R /XYZ 99.933071 590.755821 0 ] (cb10-83) [ 475 0 R /XYZ 99.933071 571.808799 0 ] (cb10-84) [ 475 0 R /XYZ 99.933071 552.861778 0 ] (cb10-85) [ 475 0 R /XYZ 99.933071 533.914756 0 ] (cb10-86) [ 475 0 R /XYZ 99.933071 514.967735 0 ] (cb10-87) [ 475 0 R /XYZ 99.933071 496.020714 0 ] (cb10-88) [ 475 0 R /XYZ 99.933071 477.073692 0 ] (cb10-89) [ 475 0 R /XYZ 99.933071 458.126671 0 ] (cb10-9) [ 400 0 R /XYZ 99.933071 544.696885 0 ] (cb10-90) [ 475 0 R /XYZ 99.933071 439.179649 0 ] (cb10-91) [ 475 0 R /XYZ 99.933071 420.232628 0 ] (cb10-92) [ 475 0 R /XYZ 99.933071 401.285606 0 ] (cb10-93) [ 475 0 R /XYZ 99.933071 382.338585 0 ] (cb10-94) [ 475 0 R /XYZ 99.933071 363.391563 0 ] (cb10-95) [ 475 0 R /XYZ 99.933071 344.444542 0 ] (cb10-96) [ 475 0 R /XYZ 99.933071 325.497520 0 ] (cb10-97) [ 475 0 R /XYZ 99.933071 306.550499 0 ] (cb10-98) [ 475 0 R /XYZ 99.933071 287.603477 0 ] (cb10-99) [ 475 0 R /XYZ 99.933071 268.656456 0 ] (cb11) [ 515 0 R /XYZ 84.259843 179.686628 0 ] (cb11-1) [ 515 0 R /XYZ 101.433071 177.989606 0 ] (cb11-10) [ 538 0 R /XYZ 99.933071 723.384971 0 ] (cb11-11) [ 538 0 R /XYZ 99.933071 704.437950 0 ] (cb11-12) [ 538 0 R /XYZ 99.933071 685.490928 0 ] (cb11-13) [ 538 0 R /XYZ 99.933071 666.543907 0 ] (cb11-14) [ 538 0 R /XYZ 99.933071 647.596885 0 ] (cb11-15) [ 538 0 R /XYZ 99.933071 628.649864 0 ] (cb11-16) [ 538 0 R /XYZ 99.933071 609.702842 0 ] (cb11-17) [ 538 0 R /XYZ 99.933071 590.755821 0 ] (cb11-18) [ 538 0 R /XYZ 99.933071 571.808799 0 ] (cb11-19) [ 538 0 R /XYZ 99.933071 552.861778 0 ] (cb11-2) [ 515 0 R /XYZ 99.933071 159.042585 0 ] (cb11-20) [ 538 0 R /XYZ 99.933071 533.914756 0 ] (cb11-21) [ 538 0 R /XYZ 99.933071 514.967735 0 ] (cb11-22) [ 538 0 R /XYZ 99.933071 496.020714 0 ] (cb11-23) [ 538 0 R /XYZ 99.933071 477.073692 0 ] (cb11-24) [ 538 0 R /XYZ 99.933071 458.126671 0 ] (cb11-25) [ 538 0 R /XYZ 99.933071 439.179649 0 ] (cb11-26) [ 538 0 R /XYZ 99.933071 420.232628 0 ] (cb11-3) [ 515 0 R /XYZ 99.933071 140.095563 0 ] (cb11-4) [ 515 0 R /XYZ 99.933071 121.148542 0 ] (cb11-5) [ 515 0 R /XYZ 99.933071 102.201520 0 ] (cb11-6) [ 538 0 R /XYZ 99.933071 799.173057 0 ] (cb11-7) [ 538 0 R /XYZ 99.933071 780.226036 0 ] (cb11-8) [ 538 0 R /XYZ 99.933071 761.279014 0 ] (cb11-9) [ 538 0 R /XYZ 99.933071 742.331993 0 ] (cb12) [ 538 0 R /XYZ 84.259843 294.539606 0 ] (cb12-1) [ 538 0 R /XYZ 101.433071 292.842585 0 ] (cb12-10) [ 538 0 R /XYZ 99.933071 122.319391 0 ] (cb12-11) [ 538 0 R /XYZ 99.933071 103.372370 0 ] (cb12-12) [ 572 0 R /XYZ 99.933071 799.173057 0 ] (cb12-13) [ 572 0 R /XYZ 99.933071 780.226036 0 ] (cb12-14) [ 572 0 R /XYZ 99.933071 761.279014 0 ] (cb12-15) [ 572 0 R /XYZ 99.933071 742.331993 0 ] (cb12-16) [ 572 0 R /XYZ 99.933071 723.384971 0 ] (cb12-17) [ 572 0 R /XYZ 99.933071 704.437950 0 ] (cb12-18) [ 572 0 R /XYZ 99.933071 685.490928 0 ] (cb12-19) [ 572 0 R /XYZ 99.933071 666.543907 0 ] (cb12-2) [ 538 0 R /XYZ 99.933071 273.895563 0 ] (cb12-20) [ 572 0 R /XYZ 99.933071 628.649864 0 ] (cb12-21) [ 572 0 R /XYZ 99.933071 590.755821 0 ] (cb12-22) [ 572 0 R /XYZ 99.933071 571.808799 0 ] (cb12-23) [ 572 0 R /XYZ 99.933071 552.861778 0 ] (cb12-3) [ 538 0 R /XYZ 99.933071 254.948542 0 ] (cb12-4) [ 538 0 R /XYZ 99.933071 236.001520 0 ] (cb12-5) [ 538 0 R /XYZ 99.933071 217.054499 0 ] (cb12-6) [ 538 0 R /XYZ 99.933071 198.107477 0 ] (cb12-7) [ 538 0 R /XYZ 99.933071 179.160456 0 ] (cb12-8) [ 538 0 R /XYZ 99.933071 160.213434 0 ] (cb12-9) [ 538 0 R /XYZ 99.933071 141.266413 0 ] (cb2) [ 53 0 R /XYZ 84.259843 753.620079 0 ] (cb2-1) [ 53 0 R /XYZ 101.433071 751.923057 0 ] (cb2-2) [ 53 0 R /XYZ 99.933071 732.976036 0 ] (cb3) [ 53 0 R /XYZ 84.259843 654.779014 0 ] (cb3-1) [ 53 0 R /XYZ 101.433071 653.081993 0 ] (cb3-2) [ 53 0 R /XYZ 99.933071 634.134971 0 ] (cb3-3) [ 53 0 R /XYZ 99.933071 615.187950 0 ] (cb3-4) [ 53 0 R /XYZ 99.933071 596.240928 0 ] (cb4) [ 53 0 R /XYZ 84.259843 282.344928 0 ] (cb4-1) [ 53 0 R /XYZ 101.433071 280.647907 0 ] (cb5) [ 53 0 R /XYZ 84.259843 217.647907 0 ] (cb5-1) [ 53 0 R /XYZ 101.433071 215.950885 0 ] (cb5-2) [ 53 0 R /XYZ 99.933071 197.003864 0 ] (cb5-3) [ 53 0 R /XYZ 99.933071 178.056842 0 ] (cb5-4) [ 53 0 R /XYZ 99.933071 159.109821 0 ] (cb5-5) [ 53 0 R /XYZ 99.933071 140.162799 0 ] (cb6) [ 67 0 R /XYZ 84.259843 749.870079 0 ] (cb6-1) [ 67 0 R /XYZ 101.433071 748.173057 0 ] (cb6-2) [ 67 0 R /XYZ 99.933071 729.226036 0 ] (cb6-3) [ 67 0 R /XYZ 99.933071 710.279014 0 ] (cb6-4) [ 67 0 R /XYZ 99.933071 672.384971 0 ] (cb6-5) [ 67 0 R /XYZ 99.933071 634.490928 0 ] (cb7) [ 77 0 R /XYZ 84.259843 716.781496 0 ] (cb7-1) [ 77 0 R /XYZ 101.433071 715.084475 0 ] (cb7-10) [ 77 0 R /XYZ 99.933071 544.561281 0 ] (cb7-11) [ 77 0 R /XYZ 99.933071 525.614260 0 ] (cb7-12) [ 77 0 R /XYZ 99.933071 506.667238 0 ] (cb7-13) [ 77 0 R /XYZ 99.933071 487.720217 0 ] (cb7-14) [ 77 0 R /XYZ 99.933071 468.773195 0 ] (cb7-2) [ 77 0 R /XYZ 99.933071 696.137453 0 ] (cb7-3) [ 77 0 R /XYZ 99.933071 677.190432 0 ] (cb7-4) [ 77 0 R /XYZ 99.933071 658.243410 0 ] (cb7-5) [ 77 0 R /XYZ 99.933071 639.296389 0 ] (cb7-6) [ 77 0 R /XYZ 99.933071 620.349367 0 ] (cb7-7) [ 77 0 R /XYZ 99.933071 601.402346 0 ] (cb7-8) [ 77 0 R /XYZ 99.933071 582.455324 0 ] (cb7-9) [ 77 0 R /XYZ 99.933071 563.508303 0 ] (cb8) [ 77 0 R /XYZ 84.259843 372.023195 0 ] (cb8-1) [ 77 0 R /XYZ 101.433071 370.326174 0 ] (cb8-2) [ 77 0 R /XYZ 99.933071 351.379152 0 ] (cb8-3) [ 77 0 R /XYZ 99.933071 332.432131 0 ] (cb8-4) [ 77 0 R /XYZ 99.933071 294.538088 0 ] (cb8-5) [ 77 0 R /XYZ 99.933071 275.591066 0 ] (cb9) [ 99 0 R /XYZ 84.259843 652.281496 0 ] (cb9-1) [ 99 0 R /XYZ 101.433071 650.584475 0 ] (cb9-10) [ 99 0 R /XYZ 99.933071 423.220217 0 ] (cb9-100) [ 204 0 R /XYZ 99.933071 780.226036 0 ] (cb9-101) [ 204 0 R /XYZ 99.933071 761.279014 0 ] (cb9-102) [ 204 0 R /XYZ 99.933071 742.331993 0 ] (cb9-103) [ 204 0 R /XYZ 99.933071 723.384971 0 ] (cb9-104) [ 204 0 R /XYZ 99.933071 704.437950 0 ] (cb9-105) [ 204 0 R /XYZ 99.933071 685.490928 0 ] (cb9-106) [ 204 0 R /XYZ 99.933071 666.543907 0 ] (cb9-107) [ 204 0 R /XYZ 99.933071 609.702842 0 ] (cb9-108) [ 204 0 R /XYZ 99.933071 590.755821 0 ] (cb9-109) [ 204 0 R /XYZ 99.933071 571.808799 0 ] (cb9-11) [ 99 0 R /XYZ 99.933071 404.273195 0 ] (cb9-110) [ 204 0 R /XYZ 99.933071 552.861778 0 ] (cb9-111) [ 204 0 R /XYZ 99.933071 533.914756 0 ] (cb9-112) [ 204 0 R /XYZ 99.933071 514.967735 0 ] (cb9-113) [ 204 0 R /XYZ 99.933071 496.020714 0 ] (cb9-114) [ 204 0 R /XYZ 99.933071 477.073692 0 ] (cb9-115) [ 204 0 R /XYZ 99.933071 458.126671 0 ] (cb9-116) [ 204 0 R /XYZ 99.933071 439.179649 0 ] (cb9-117) [ 204 0 R /XYZ 99.933071 420.232628 0 ] (cb9-118) [ 204 0 R /XYZ 99.933071 401.285606 0 ] (cb9-119) [ 204 0 R /XYZ 99.933071 382.338585 0 ] (cb9-12) [ 99 0 R /XYZ 99.933071 385.326174 0 ] (cb9-120) [ 204 0 R /XYZ 99.933071 363.391563 0 ] (cb9-121) [ 204 0 R /XYZ 99.933071 344.444542 0 ] (cb9-122) [ 204 0 R /XYZ 99.933071 325.497520 0 ] (cb9-123) [ 204 0 R /XYZ 99.933071 306.550499 0 ] (cb9-124) [ 204 0 R /XYZ 99.933071 287.603477 0 ] (cb9-125) [ 204 0 R /XYZ 99.933071 249.709434 0 ] (cb9-126) [ 204 0 R /XYZ 99.933071 230.762413 0 ] (cb9-127) [ 204 0 R /XYZ 99.933071 211.815391 0 ] (cb9-128) [ 204 0 R /XYZ 99.933071 192.868370 0 ] (cb9-129) [ 204 0 R /XYZ 99.933071 173.921348 0 ] (cb9-13) [ 99 0 R /XYZ 99.933071 366.379152 0 ] (cb9-130) [ 204 0 R /XYZ 99.933071 154.974327 0 ] (cb9-131) [ 204 0 R /XYZ 99.933071 136.027305 0 ] (cb9-132) [ 204 0 R /XYZ 99.933071 117.080284 0 ] (cb9-133) [ 204 0 R /XYZ 99.933071 98.133262 0 ] (cb9-134) [ 241 0 R /XYZ 99.933071 799.173057 0 ] (cb9-135) [ 241 0 R /XYZ 99.933071 780.226036 0 ] (cb9-136) [ 241 0 R /XYZ 99.933071 742.331993 0 ] (cb9-137) [ 241 0 R /XYZ 99.933071 723.384971 0 ] (cb9-138) [ 241 0 R /XYZ 99.933071 704.437950 0 ] (cb9-139) [ 241 0 R /XYZ 99.933071 685.490928 0 ] (cb9-14) [ 99 0 R /XYZ 99.933071 347.432131 0 ] (cb9-140) [ 241 0 R /XYZ 99.933071 666.543907 0 ] (cb9-141) [ 241 0 R /XYZ 99.933071 647.596885 0 ] (cb9-142) [ 241 0 R /XYZ 99.933071 628.649864 0 ] (cb9-143) [ 241 0 R /XYZ 99.933071 609.702842 0 ] (cb9-144) [ 241 0 R /XYZ 99.933071 590.755821 0 ] (cb9-145) [ 241 0 R /XYZ 99.933071 571.808799 0 ] (cb9-146) [ 241 0 R /XYZ 99.933071 552.861778 0 ] (cb9-147) [ 241 0 R /XYZ 99.933071 533.914756 0 ] (cb9-148) [ 241 0 R /XYZ 99.933071 514.967735 0 ] (cb9-149) [ 241 0 R /XYZ 99.933071 496.020714 0 ] (cb9-15) [ 99 0 R /XYZ 99.933071 328.485109 0 ] (cb9-150) [ 241 0 R /XYZ 99.933071 477.073692 0 ] (cb9-151) [ 241 0 R /XYZ 99.933071 458.126671 0 ] (cb9-152) [ 241 0 R /XYZ 99.933071 439.179649 0 ] (cb9-153) [ 241 0 R /XYZ 99.933071 420.232628 0 ] (cb9-154) [ 241 0 R /XYZ 99.933071 401.285606 0 ] (cb9-155) [ 241 0 R /XYZ 99.933071 382.338585 0 ] (cb9-156) [ 241 0 R /XYZ 99.933071 363.391563 0 ] (cb9-157) [ 241 0 R /XYZ 99.933071 344.444542 0 ] (cb9-158) [ 241 0 R /XYZ 99.933071 325.497520 0 ] (cb9-159) [ 241 0 R /XYZ 99.933071 306.550499 0 ] (cb9-16) [ 99 0 R /XYZ 99.933071 309.538088 0 ] (cb9-160) [ 241 0 R /XYZ 99.933071 287.603477 0 ] (cb9-161) [ 241 0 R /XYZ 99.933071 268.656456 0 ] (cb9-162) [ 241 0 R /XYZ 99.933071 249.709434 0 ] (cb9-163) [ 241 0 R /XYZ 99.933071 230.762413 0 ] (cb9-164) [ 241 0 R /XYZ 99.933071 211.815391 0 ] (cb9-165) [ 241 0 R /XYZ 99.933071 192.868370 0 ] (cb9-166) [ 241 0 R /XYZ 99.933071 173.921348 0 ] (cb9-167) [ 241 0 R /XYZ 99.933071 154.974327 0 ] (cb9-168) [ 241 0 R /XYZ 99.933071 136.027305 0 ] (cb9-169) [ 241 0 R /XYZ 99.933071 117.080284 0 ] (cb9-17) [ 99 0 R /XYZ 99.933071 290.591066 0 ] (cb9-170) [ 241 0 R /XYZ 99.933071 98.133262 0 ] (cb9-171) [ 280 0 R /XYZ 99.933071 799.173057 0 ] (cb9-172) [ 280 0 R /XYZ 99.933071 780.226036 0 ] (cb9-173) [ 280 0 R /XYZ 99.933071 761.279014 0 ] (cb9-174) [ 280 0 R /XYZ 99.933071 742.331993 0 ] (cb9-175) [ 280 0 R /XYZ 99.933071 723.384971 0 ] (cb9-176) [ 280 0 R /XYZ 99.933071 704.437950 0 ] (cb9-177) [ 280 0 R /XYZ 99.933071 685.490928 0 ] (cb9-178) [ 280 0 R /XYZ 99.933071 666.543907 0 ] (cb9-179) [ 280 0 R /XYZ 99.933071 647.596885 0 ] (cb9-18) [ 99 0 R /XYZ 99.933071 271.644045 0 ] (cb9-180) [ 280 0 R /XYZ 99.933071 628.649864 0 ] (cb9-181) [ 280 0 R /XYZ 99.933071 609.702842 0 ] (cb9-182) [ 280 0 R /XYZ 99.933071 590.755821 0 ] (cb9-183) [ 280 0 R /XYZ 99.933071 571.808799 0 ] (cb9-184) [ 280 0 R /XYZ 99.933071 552.861778 0 ] (cb9-185) [ 280 0 R /XYZ 99.933071 533.914756 0 ] (cb9-186) [ 280 0 R /XYZ 99.933071 514.967735 0 ] (cb9-187) [ 280 0 R /XYZ 99.933071 496.020714 0 ] (cb9-188) [ 280 0 R /XYZ 99.933071 477.073692 0 ] (cb9-189) [ 280 0 R /XYZ 99.933071 458.126671 0 ] (cb9-19) [ 99 0 R /XYZ 99.933071 252.697023 0 ] (cb9-190) [ 280 0 R /XYZ 99.933071 439.179649 0 ] (cb9-191) [ 280 0 R /XYZ 99.933071 420.232628 0 ] (cb9-192) [ 280 0 R /XYZ 99.933071 401.285606 0 ] (cb9-193) [ 280 0 R /XYZ 99.933071 382.338585 0 ] (cb9-194) [ 280 0 R /XYZ 99.933071 363.391563 0 ] (cb9-195) [ 280 0 R /XYZ 99.933071 344.444542 0 ] (cb9-196) [ 280 0 R /XYZ 99.933071 325.497520 0 ] (cb9-197) [ 280 0 R /XYZ 99.933071 306.550499 0 ] (cb9-198) [ 280 0 R /XYZ 99.933071 287.603477 0 ] (cb9-199) [ 280 0 R /XYZ 99.933071 268.656456 0 ] (cb9-2) [ 99 0 R /XYZ 99.933071 612.690432 0 ] (cb9-20) [ 99 0 R /XYZ 99.933071 233.750002 0 ] (cb9-200) [ 280 0 R /XYZ 99.933071 249.709434 0 ] (cb9-201) [ 280 0 R /XYZ 99.933071 230.762413 0 ] (cb9-202) [ 280 0 R /XYZ 99.933071 211.815391 0 ] (cb9-203) [ 280 0 R /XYZ 99.933071 192.868370 0 ] (cb9-204) [ 280 0 R /XYZ 99.933071 173.921348 0 ] (cb9-205) [ 280 0 R /XYZ 99.933071 154.974327 0 ] (cb9-206) [ 280 0 R /XYZ 99.933071 136.027305 0 ] (cb9-207) [ 280 0 R /XYZ 99.933071 117.080284 0 ] (cb9-208) [ 280 0 R /XYZ 99.933071 98.133262 0 ] (cb9-209) [ 320 0 R /XYZ 99.933071 799.173057 0 ] (cb9-21) [ 99 0 R /XYZ 99.933071 214.802980 0 ] (cb9-210) [ 320 0 R /XYZ 99.933071 780.226036 0 ] (cb9-211) [ 320 0 R /XYZ 99.933071 761.279014 0 ] (cb9-212) [ 320 0 R /XYZ 99.933071 742.331993 0 ] (cb9-213) [ 320 0 R /XYZ 99.933071 723.384971 0 ] (cb9-214) [ 320 0 R /XYZ 99.933071 704.437950 0 ] (cb9-215) [ 320 0 R /XYZ 99.933071 685.490928 0 ] (cb9-216) [ 320 0 R /XYZ 99.933071 666.543907 0 ] (cb9-217) [ 320 0 R /XYZ 99.933071 647.596885 0 ] (cb9-218) [ 320 0 R /XYZ 99.933071 628.649864 0 ] (cb9-219) [ 320 0 R /XYZ 99.933071 609.702842 0 ] (cb9-22) [ 99 0 R /XYZ 99.933071 195.855959 0 ] (cb9-220) [ 320 0 R /XYZ 99.933071 590.755821 0 ] (cb9-221) [ 320 0 R /XYZ 99.933071 571.808799 0 ] (cb9-222) [ 320 0 R /XYZ 99.933071 552.861778 0 ] (cb9-223) [ 320 0 R /XYZ 99.933071 533.914756 0 ] (cb9-224) [ 320 0 R /XYZ 99.933071 514.967735 0 ] (cb9-225) [ 320 0 R /XYZ 99.933071 496.020714 0 ] (cb9-226) [ 320 0 R /XYZ 99.933071 477.073692 0 ] (cb9-227) [ 320 0 R /XYZ 99.933071 458.126671 0 ] (cb9-228) [ 320 0 R /XYZ 99.933071 439.179649 0 ] (cb9-229) [ 320 0 R /XYZ 99.933071 420.232628 0 ] (cb9-23) [ 99 0 R /XYZ 99.933071 176.908937 0 ] (cb9-230) [ 320 0 R /XYZ 99.933071 401.285606 0 ] (cb9-231) [ 320 0 R /XYZ 99.933071 382.338585 0 ] (cb9-232) [ 320 0 R /XYZ 99.933071 363.391563 0 ] (cb9-233) [ 320 0 R /XYZ 99.933071 344.444542 0 ] (cb9-234) [ 320 0 R /XYZ 99.933071 325.497520 0 ] (cb9-235) [ 320 0 R /XYZ 99.933071 306.550499 0 ] (cb9-236) [ 320 0 R /XYZ 99.933071 287.603477 0 ] (cb9-237) [ 320 0 R /XYZ 99.933071 268.656456 0 ] (cb9-238) [ 320 0 R /XYZ 99.933071 249.709434 0 ] (cb9-239) [ 320 0 R /XYZ 99.933071 230.762413 0 ] (cb9-24) [ 99 0 R /XYZ 99.933071 157.961916 0 ] (cb9-240) [ 320 0 R /XYZ 99.933071 211.815391 0 ] (cb9-241) [ 320 0 R /XYZ 99.933071 192.868370 0 ] (cb9-242) [ 320 0 R /XYZ 99.933071 173.921348 0 ] (cb9-243) [ 320 0 R /XYZ 99.933071 154.974327 0 ] (cb9-244) [ 320 0 R /XYZ 99.933071 136.027305 0 ] (cb9-245) [ 320 0 R /XYZ 99.933071 117.080284 0 ] (cb9-246) [ 320 0 R /XYZ 99.933071 98.133262 0 ] (cb9-247) [ 360 0 R /XYZ 99.933071 799.173057 0 ] (cb9-248) [ 360 0 R /XYZ 99.933071 780.226036 0 ] (cb9-249) [ 360 0 R /XYZ 99.933071 761.279014 0 ] (cb9-25) [ 99 0 R /XYZ 99.933071 139.014895 0 ] (cb9-250) [ 360 0 R /XYZ 99.933071 742.331993 0 ] (cb9-251) [ 360 0 R /XYZ 99.933071 723.384971 0 ] (cb9-252) [ 360 0 R /XYZ 99.933071 704.437950 0 ] (cb9-253) [ 360 0 R /XYZ 99.933071 685.490928 0 ] (cb9-254) [ 360 0 R /XYZ 99.933071 666.543907 0 ] (cb9-255) [ 360 0 R /XYZ 99.933071 647.596885 0 ] (cb9-256) [ 360 0 R /XYZ 99.933071 628.649864 0 ] (cb9-257) [ 360 0 R /XYZ 99.933071 609.702842 0 ] (cb9-258) [ 360 0 R /XYZ 99.933071 590.755821 0 ] (cb9-259) [ 360 0 R /XYZ 99.933071 571.808799 0 ] (cb9-26) [ 99 0 R /XYZ 99.933071 120.067873 0 ] (cb9-260) [ 360 0 R /XYZ 99.933071 552.861778 0 ] (cb9-261) [ 360 0 R /XYZ 99.933071 533.914756 0 ] (cb9-262) [ 360 0 R /XYZ 99.933071 514.967735 0 ] (cb9-263) [ 360 0 R /XYZ 99.933071 496.020714 0 ] (cb9-264) [ 360 0 R /XYZ 99.933071 477.073692 0 ] (cb9-265) [ 360 0 R /XYZ 99.933071 458.126671 0 ] (cb9-266) [ 360 0 R /XYZ 99.933071 439.179649 0 ] (cb9-267) [ 360 0 R /XYZ 99.933071 420.232628 0 ] (cb9-268) [ 360 0 R /XYZ 99.933071 401.285606 0 ] (cb9-269) [ 360 0 R /XYZ 99.933071 382.338585 0 ] (cb9-27) [ 99 0 R /XYZ 99.933071 101.120852 0 ] (cb9-270) [ 360 0 R /XYZ 99.933071 363.391563 0 ] (cb9-271) [ 360 0 R /XYZ 99.933071 344.444542 0 ] (cb9-272) [ 360 0 R /XYZ 99.933071 325.497520 0 ] (cb9-273) [ 360 0 R /XYZ 99.933071 306.550499 0 ] (cb9-274) [ 360 0 R /XYZ 99.933071 287.603477 0 ] (cb9-275) [ 360 0 R /XYZ 99.933071 268.656456 0 ] (cb9-276) [ 360 0 R /XYZ 99.933071 249.709434 0 ] (cb9-277) [ 360 0 R /XYZ 99.933071 230.762413 0 ] (cb9-278) [ 360 0 R /XYZ 99.933071 211.815391 0 ] (cb9-279) [ 360 0 R /XYZ 99.933071 192.868370 0 ] (cb9-28) [ 129 0 R /XYZ 99.933071 799.173057 0 ] (cb9-280) [ 360 0 R /XYZ 99.933071 173.921348 0 ] (cb9-281) [ 360 0 R /XYZ 99.933071 154.974327 0 ] (cb9-282) [ 360 0 R /XYZ 99.933071 136.027305 0 ] (cb9-283) [ 360 0 R /XYZ 99.933071 117.080284 0 ] (cb9-284) [ 360 0 R /XYZ 99.933071 98.133262 0 ] (cb9-29) [ 129 0 R /XYZ 99.933071 780.226036 0 ] (cb9-3) [ 99 0 R /XYZ 99.933071 574.796389 0 ] (cb9-30) [ 129 0 R /XYZ 99.933071 761.279014 0 ] (cb9-31) [ 129 0 R /XYZ 99.933071 742.331993 0 ] (cb9-32) [ 129 0 R /XYZ 99.933071 723.384971 0 ] (cb9-33) [ 129 0 R /XYZ 99.933071 704.437950 0 ] (cb9-34) [ 129 0 R /XYZ 99.933071 685.490928 0 ] (cb9-35) [ 129 0 R /XYZ 99.933071 666.543907 0 ] (cb9-36) [ 129 0 R /XYZ 99.933071 647.596885 0 ] (cb9-37) [ 129 0 R /XYZ 99.933071 628.649864 0 ] (cb9-38) [ 129 0 R /XYZ 99.933071 609.702842 0 ] (cb9-39) [ 129 0 R /XYZ 99.933071 590.755821 0 ] (cb9-4) [ 99 0 R /XYZ 99.933071 555.849367 0 ] (cb9-40) [ 129 0 R /XYZ 99.933071 571.808799 0 ] (cb9-41) [ 129 0 R /XYZ 99.933071 552.861778 0 ] (cb9-42) [ 129 0 R /XYZ 99.933071 533.914756 0 ] (cb9-43) [ 129 0 R /XYZ 99.933071 514.967735 0 ] (cb9-44) [ 129 0 R /XYZ 99.933071 496.020714 0 ] (cb9-45) [ 129 0 R /XYZ 99.933071 477.073692 0 ] (cb9-46) [ 129 0 R /XYZ 99.933071 458.126671 0 ] (cb9-47) [ 129 0 R /XYZ 99.933071 439.179649 0 ] (cb9-48) [ 129 0 R /XYZ 99.933071 420.232628 0 ] (cb9-49) [ 129 0 R /XYZ 99.933071 401.285606 0 ] (cb9-5) [ 99 0 R /XYZ 99.933071 536.902346 0 ] (cb9-50) [ 129 0 R /XYZ 99.933071 382.338585 0 ] (cb9-51) [ 129 0 R /XYZ 99.933071 363.391563 0 ] (cb9-52) [ 129 0 R /XYZ 99.933071 344.444542 0 ] (cb9-53) [ 129 0 R /XYZ 99.933071 325.497520 0 ] (cb9-54) [ 129 0 R /XYZ 99.933071 306.550499 0 ] (cb9-55) [ 129 0 R /XYZ 99.933071 287.603477 0 ] (cb9-56) [ 129 0 R /XYZ 99.933071 268.656456 0 ] (cb9-57) [ 129 0 R /XYZ 99.933071 249.709434 0 ] (cb9-58) [ 129 0 R /XYZ 99.933071 230.762413 0 ] (cb9-59) [ 129 0 R /XYZ 99.933071 211.815391 0 ] (cb9-6) [ 99 0 R /XYZ 99.933071 499.008303 0 ] (cb9-60) [ 129 0 R /XYZ 99.933071 192.868370 0 ] (cb9-61) [ 129 0 R /XYZ 99.933071 173.921348 0 ] (cb9-62) [ 129 0 R /XYZ 99.933071 154.974327 0 ] (cb9-63) [ 129 0 R /XYZ 99.933071 136.027305 0 ] (cb9-64) [ 129 0 R /XYZ 99.933071 117.080284 0 ] (cb9-65) [ 129 0 R /XYZ 99.933071 98.133262 0 ] (cb9-66) [ 169 0 R /XYZ 99.933071 799.173057 0 ] (cb9-67) [ 169 0 R /XYZ 99.933071 780.226036 0 ] (cb9-68) [ 169 0 R /XYZ 99.933071 761.279014 0 ] (cb9-69) [ 169 0 R /XYZ 99.933071 742.331993 0 ] (cb9-7) [ 99 0 R /XYZ 99.933071 480.061281 0 ] (cb9-70) [ 169 0 R /XYZ 99.933071 723.384971 0 ] (cb9-71) [ 169 0 R /XYZ 99.933071 704.437950 0 ] (cb9-72) [ 169 0 R /XYZ 99.933071 685.490928 0 ] (cb9-73) [ 169 0 R /XYZ 99.933071 666.543907 0 ] (cb9-74) [ 169 0 R /XYZ 99.933071 647.596885 0 ] (cb9-75) [ 169 0 R /XYZ 99.933071 628.649864 0 ] (cb9-76) [ 169 0 R /XYZ 99.933071 514.967735 0 ] (cb9-77) [ 169 0 R /XYZ 99.933071 496.020714 0 ] (cb9-78) [ 169 0 R /XYZ 99.933071 477.073692 0 ] (cb9-79) [ 169 0 R /XYZ 99.933071 458.126671 0 ] (cb9-8) [ 99 0 R /XYZ 99.933071 461.114260 0 ] (cb9-80) [ 169 0 R /XYZ 99.933071 439.179649 0 ] (cb9-81) [ 169 0 R /XYZ 99.933071 420.232628 0 ] (cb9-82) [ 169 0 R /XYZ 99.933071 401.285606 0 ] (cb9-83) [ 169 0 R /XYZ 99.933071 382.338585 0 ] (cb9-84) [ 169 0 R /XYZ 99.933071 363.391563 0 ] (cb9-85) [ 169 0 R /XYZ 99.933071 344.444542 0 ] (cb9-86) [ 169 0 R /XYZ 99.933071 325.497520 0 ] (cb9-87) [ 169 0 R /XYZ 99.933071 306.550499 0 ] (cb9-88) [ 169 0 R /XYZ 99.933071 287.603477 0 ] (cb9-89) [ 169 0 R /XYZ 99.933071 268.656456 0 ] (cb9-9) [ 99 0 R /XYZ 99.933071 442.167238 0 ] (cb9-90) [ 169 0 R /XYZ 99.933071 249.709434 0 ] (cb9-91) [ 169 0 R /XYZ 99.933071 230.762413 0 ] (cb9-92) [ 169 0 R /XYZ 99.933071 211.815391 0 ] (cb9-93) [ 169 0 R /XYZ 99.933071 192.868370 0 ] (cb9-94) [ 169 0 R /XYZ 99.933071 173.921348 0 ] (cb9-95) [ 169 0 R /XYZ 99.933071 154.974327 0 ] (cb9-96) [ 169 0 R /XYZ 99.933071 136.027305 0 ] (cb9-97) [ 169 0 R /XYZ 99.933071 117.080284 0 ] (cb9-98) [ 169 0 R /XYZ 99.933071 98.133262 0 ] (cb9-99) [ 204 0 R /XYZ 99.933071 799.173057 0 ] (configure-default-service-account) [ 53 0 R /XYZ 84.259843 561.590928 0 ] (configure-etcd-user-and-group) [ 45 0 R /XYZ 84.259843 283.686971 0 ] (configure-kernel-runtime-parameters) [ 45 0 R /XYZ 84.259843 539.222079 0 ] (configure-network-policy) [ 67 0 R /XYZ 84.259843 599.840928 0 ] (contentsbox) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (create-etcd-user-and-group) [ 45 0 R /XYZ 84.259843 169.788971 0 ] (ensure-that-all-namespaces-have-network-policies-defined) [ 67 0 R /XYZ 84.259843 564.092928 0 ] (header_bottom_text) [ 6 0 R /XYZ 85.009843 422.718898 0 ] (known-issues) [ 45 0 R /XYZ 84.259843 799.370079 0 ] (overview) [ 30 0 R /XYZ 84.259843 272.631496 0 ] (reference-hardened-cloud-config-configuration) [ 515 0 R /XYZ 84.259843 385.582628 0 ] (reference-hardened-cloud-config-for-red-hat-enterprise-linux-8-rhel-8-and-ubuntu-20.04-lts) [ 538 0 R /XYZ 84.259843 360.287606 0 ] (reference-hardened-cloud-config-for-suse-linux-enterprise-server-15-sles-15-and-opensuse-leap-15) [ 515 0 R /XYZ 84.259843 245.434628 0 ] (reference-hardened-rke-cluster.yml-configuration) [ 77 0 R /XYZ 84.259843 191.441066 0 ] (reference-hardened-rke-template-configuration) [ 400 0 R /XYZ 84.259843 799.370079 0 ] (set-automountserviceaccounttoken-to-false-for-default-service-accounts) [ 53 0 R /XYZ 84.259843 522.092928 0 ] (title-block-header) [ 6 0 R /XYZ 84.259843 502.818898 0 ] ] +/Names [ (TOC) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (cb1) [ 45 0 R /XYZ 84.259843 441.572079 0 ] (cb1-1) [ 45 0 R /XYZ 101.433071 439.875057 0 ] (cb1-2) [ 45 0 R /XYZ 99.933071 420.928036 0 ] (cb1-3) [ 45 0 R /XYZ 99.933071 401.981014 0 ] (cb1-4) [ 45 0 R /XYZ 99.933071 383.033993 0 ] (cb1-5) [ 45 0 R /XYZ 99.933071 364.086971 0 ] (cb10) [ 390 0 R /XYZ 84.259843 416.811778 0 ] (cb10-1) [ 390 0 R /XYZ 101.433071 415.114756 0 ] (cb10-10) [ 390 0 R /XYZ 99.933071 244.591563 0 ] (cb10-100) [ 499 0 R /XYZ 99.933071 590.755821 0 ] (cb10-101) [ 499 0 R /XYZ 99.933071 571.808799 0 ] (cb10-102) [ 499 0 R /XYZ 99.933071 552.861778 0 ] (cb10-103) [ 499 0 R /XYZ 99.933071 533.914756 0 ] (cb10-104) [ 499 0 R /XYZ 99.933071 514.967735 0 ] (cb10-105) [ 499 0 R /XYZ 99.933071 496.020714 0 ] (cb10-106) [ 499 0 R /XYZ 99.933071 477.073692 0 ] (cb10-107) [ 499 0 R /XYZ 99.933071 458.126671 0 ] (cb10-108) [ 499 0 R /XYZ 99.933071 439.179649 0 ] (cb10-109) [ 499 0 R /XYZ 99.933071 420.232628 0 ] (cb10-11) [ 390 0 R /XYZ 99.933071 225.644542 0 ] (cb10-110) [ 499 0 R /XYZ 99.933071 401.285606 0 ] (cb10-111) [ 499 0 R /XYZ 99.933071 382.338585 0 ] (cb10-112) [ 499 0 R /XYZ 99.933071 363.391563 0 ] (cb10-113) [ 499 0 R /XYZ 99.933071 344.444542 0 ] (cb10-114) [ 499 0 R /XYZ 99.933071 325.497520 0 ] (cb10-115) [ 499 0 R /XYZ 99.933071 306.550499 0 ] (cb10-116) [ 499 0 R /XYZ 99.933071 287.603477 0 ] (cb10-117) [ 499 0 R /XYZ 99.933071 173.921348 0 ] (cb10-118) [ 499 0 R /XYZ 99.933071 154.974327 0 ] (cb10-119) [ 499 0 R /XYZ 99.933071 136.027305 0 ] (cb10-12) [ 390 0 R /XYZ 99.933071 206.697520 0 ] (cb10-120) [ 499 0 R /XYZ 99.933071 117.080284 0 ] (cb10-121) [ 499 0 R /XYZ 99.933071 98.133262 0 ] (cb10-122) [ 534 0 R /XYZ 99.933071 799.173057 0 ] (cb10-123) [ 534 0 R /XYZ 99.933071 685.490928 0 ] (cb10-124) [ 534 0 R /XYZ 99.933071 666.543907 0 ] (cb10-125) [ 534 0 R /XYZ 99.933071 647.596885 0 ] (cb10-126) [ 534 0 R /XYZ 99.933071 628.649864 0 ] (cb10-127) [ 534 0 R /XYZ 99.933071 609.702842 0 ] (cb10-128) [ 534 0 R /XYZ 99.933071 590.755821 0 ] (cb10-129) [ 534 0 R /XYZ 99.933071 571.808799 0 ] (cb10-13) [ 390 0 R /XYZ 99.933071 187.750499 0 ] (cb10-14) [ 390 0 R /XYZ 99.933071 168.803477 0 ] (cb10-15) [ 390 0 R /XYZ 99.933071 149.856456 0 ] (cb10-16) [ 390 0 R /XYZ 99.933071 130.909434 0 ] (cb10-17) [ 390 0 R /XYZ 99.933071 111.962413 0 ] (cb10-18) [ 390 0 R /XYZ 99.933071 93.015391 0 ] (cb10-19) [ 425 0 R /XYZ 99.933071 799.173057 0 ] (cb10-2) [ 390 0 R /XYZ 99.933071 396.167735 0 ] (cb10-20) [ 425 0 R /XYZ 99.933071 780.226036 0 ] (cb10-21) [ 425 0 R /XYZ 99.933071 761.279014 0 ] (cb10-22) [ 425 0 R /XYZ 99.933071 742.331993 0 ] (cb10-23) [ 425 0 R /XYZ 99.933071 723.384971 0 ] (cb10-24) [ 425 0 R /XYZ 99.933071 704.437950 0 ] (cb10-25) [ 425 0 R /XYZ 99.933071 685.490928 0 ] (cb10-26) [ 425 0 R /XYZ 99.933071 666.543907 0 ] (cb10-27) [ 425 0 R /XYZ 99.933071 647.596885 0 ] (cb10-28) [ 425 0 R /XYZ 99.933071 628.649864 0 ] (cb10-29) [ 425 0 R /XYZ 99.933071 609.702842 0 ] (cb10-3) [ 390 0 R /XYZ 99.933071 377.220714 0 ] (cb10-30) [ 425 0 R /XYZ 99.933071 571.808799 0 ] (cb10-31) [ 425 0 R /XYZ 99.933071 552.861778 0 ] (cb10-32) [ 425 0 R /XYZ 99.933071 533.914756 0 ] (cb10-33) [ 425 0 R /XYZ 99.933071 514.967735 0 ] (cb10-34) [ 425 0 R /XYZ 99.933071 496.020714 0 ] (cb10-35) [ 425 0 R /XYZ 99.933071 477.073692 0 ] (cb10-36) [ 425 0 R /XYZ 99.933071 458.126671 0 ] (cb10-37) [ 425 0 R /XYZ 99.933071 439.179649 0 ] (cb10-38) [ 425 0 R /XYZ 99.933071 420.232628 0 ] (cb10-39) [ 425 0 R /XYZ 99.933071 401.285606 0 ] (cb10-4) [ 390 0 R /XYZ 99.933071 358.273692 0 ] (cb10-40) [ 425 0 R /XYZ 99.933071 382.338585 0 ] (cb10-41) [ 425 0 R /XYZ 99.933071 363.391563 0 ] (cb10-42) [ 425 0 R /XYZ 99.933071 344.444542 0 ] (cb10-43) [ 425 0 R /XYZ 99.933071 325.497520 0 ] (cb10-44) [ 425 0 R /XYZ 99.933071 306.550499 0 ] (cb10-45) [ 425 0 R /XYZ 99.933071 287.603477 0 ] (cb10-46) [ 425 0 R /XYZ 99.933071 268.656456 0 ] (cb10-47) [ 425 0 R /XYZ 99.933071 249.709434 0 ] (cb10-48) [ 425 0 R /XYZ 99.933071 230.762413 0 ] (cb10-49) [ 425 0 R /XYZ 99.933071 211.815391 0 ] (cb10-5) [ 390 0 R /XYZ 99.933071 339.326671 0 ] (cb10-50) [ 425 0 R /XYZ 99.933071 192.868370 0 ] (cb10-51) [ 425 0 R /XYZ 99.933071 173.921348 0 ] (cb10-52) [ 425 0 R /XYZ 99.933071 154.974327 0 ] (cb10-53) [ 425 0 R /XYZ 99.933071 136.027305 0 ] (cb10-54) [ 425 0 R /XYZ 99.933071 117.080284 0 ] (cb10-55) [ 425 0 R /XYZ 99.933071 98.133262 0 ] (cb10-56) [ 464 0 R /XYZ 99.933071 799.173057 0 ] (cb10-57) [ 464 0 R /XYZ 99.933071 780.226036 0 ] (cb10-58) [ 464 0 R /XYZ 99.933071 761.279014 0 ] (cb10-59) [ 464 0 R /XYZ 99.933071 742.331993 0 ] (cb10-6) [ 390 0 R /XYZ 99.933071 320.379649 0 ] (cb10-60) [ 464 0 R /XYZ 99.933071 723.384971 0 ] (cb10-61) [ 464 0 R /XYZ 99.933071 704.437950 0 ] (cb10-62) [ 464 0 R /XYZ 99.933071 685.490928 0 ] (cb10-63) [ 464 0 R /XYZ 99.933071 666.543907 0 ] (cb10-64) [ 464 0 R /XYZ 99.933071 647.596885 0 ] (cb10-65) [ 464 0 R /XYZ 99.933071 628.649864 0 ] (cb10-66) [ 464 0 R /XYZ 99.933071 609.702842 0 ] (cb10-67) [ 464 0 R /XYZ 99.933071 590.755821 0 ] (cb10-68) [ 464 0 R /XYZ 99.933071 571.808799 0 ] (cb10-69) [ 464 0 R /XYZ 99.933071 552.861778 0 ] (cb10-7) [ 390 0 R /XYZ 99.933071 301.432628 0 ] (cb10-70) [ 464 0 R /XYZ 99.933071 533.914756 0 ] (cb10-71) [ 464 0 R /XYZ 99.933071 514.967735 0 ] (cb10-72) [ 464 0 R /XYZ 99.933071 496.020714 0 ] (cb10-73) [ 464 0 R /XYZ 99.933071 477.073692 0 ] (cb10-74) [ 464 0 R /XYZ 99.933071 458.126671 0 ] (cb10-75) [ 464 0 R /XYZ 99.933071 439.179649 0 ] (cb10-76) [ 464 0 R /XYZ 99.933071 420.232628 0 ] (cb10-77) [ 464 0 R /XYZ 99.933071 401.285606 0 ] (cb10-78) [ 464 0 R /XYZ 99.933071 382.338585 0 ] (cb10-79) [ 464 0 R /XYZ 99.933071 363.391563 0 ] (cb10-8) [ 390 0 R /XYZ 99.933071 282.485606 0 ] (cb10-80) [ 464 0 R /XYZ 99.933071 344.444542 0 ] (cb10-81) [ 464 0 R /XYZ 99.933071 325.497520 0 ] (cb10-82) [ 464 0 R /XYZ 99.933071 306.550499 0 ] (cb10-83) [ 464 0 R /XYZ 99.933071 287.603477 0 ] (cb10-84) [ 464 0 R /XYZ 99.933071 268.656456 0 ] (cb10-85) [ 464 0 R /XYZ 99.933071 249.709434 0 ] (cb10-86) [ 464 0 R /XYZ 99.933071 230.762413 0 ] (cb10-87) [ 464 0 R /XYZ 99.933071 117.080284 0 ] (cb10-88) [ 464 0 R /XYZ 99.933071 98.133262 0 ] (cb10-89) [ 499 0 R /XYZ 99.933071 799.173057 0 ] (cb10-9) [ 390 0 R /XYZ 99.933071 263.538585 0 ] (cb10-90) [ 499 0 R /XYZ 99.933071 780.226036 0 ] (cb10-91) [ 499 0 R /XYZ 99.933071 761.279014 0 ] (cb10-92) [ 499 0 R /XYZ 99.933071 742.331993 0 ] (cb10-93) [ 499 0 R /XYZ 99.933071 723.384971 0 ] (cb10-94) [ 499 0 R /XYZ 99.933071 704.437950 0 ] (cb10-95) [ 499 0 R /XYZ 99.933071 685.490928 0 ] (cb10-96) [ 499 0 R /XYZ 99.933071 666.543907 0 ] (cb10-97) [ 499 0 R /XYZ 99.933071 647.596885 0 ] (cb10-98) [ 499 0 R /XYZ 99.933071 628.649864 0 ] (cb10-99) [ 499 0 R /XYZ 99.933071 609.702842 0 ] (cb11) [ 534 0 R /XYZ 84.259843 331.262799 0 ] (cb11-1) [ 534 0 R /XYZ 101.433071 329.565778 0 ] (cb11-10) [ 534 0 R /XYZ 99.933071 159.042585 0 ] (cb11-11) [ 534 0 R /XYZ 99.933071 140.095563 0 ] (cb11-12) [ 534 0 R /XYZ 99.933071 121.148542 0 ] (cb11-13) [ 534 0 R /XYZ 99.933071 102.201520 0 ] (cb11-14) [ 557 0 R /XYZ 99.933071 799.173057 0 ] (cb11-15) [ 557 0 R /XYZ 99.933071 780.226036 0 ] (cb11-16) [ 557 0 R /XYZ 99.933071 761.279014 0 ] (cb11-17) [ 557 0 R /XYZ 99.933071 742.331993 0 ] (cb11-18) [ 557 0 R /XYZ 99.933071 723.384971 0 ] (cb11-19) [ 557 0 R /XYZ 99.933071 704.437950 0 ] (cb11-2) [ 534 0 R /XYZ 99.933071 310.618756 0 ] (cb11-20) [ 557 0 R /XYZ 99.933071 685.490928 0 ] (cb11-21) [ 557 0 R /XYZ 99.933071 666.543907 0 ] (cb11-22) [ 557 0 R /XYZ 99.933071 647.596885 0 ] (cb11-23) [ 557 0 R /XYZ 99.933071 628.649864 0 ] (cb11-24) [ 557 0 R /XYZ 99.933071 609.702842 0 ] (cb11-25) [ 557 0 R /XYZ 99.933071 590.755821 0 ] (cb11-26) [ 557 0 R /XYZ 99.933071 571.808799 0 ] (cb11-3) [ 534 0 R /XYZ 99.933071 291.671735 0 ] (cb11-4) [ 534 0 R /XYZ 99.933071 272.724714 0 ] (cb11-5) [ 534 0 R /XYZ 99.933071 253.777692 0 ] (cb11-6) [ 534 0 R /XYZ 99.933071 234.830671 0 ] (cb11-7) [ 534 0 R /XYZ 99.933071 215.883649 0 ] (cb11-8) [ 534 0 R /XYZ 99.933071 196.936628 0 ] (cb11-9) [ 534 0 R /XYZ 99.933071 177.989606 0 ] (cb12) [ 557 0 R /XYZ 84.259843 446.115778 0 ] (cb12-1) [ 557 0 R /XYZ 101.433071 444.418756 0 ] (cb12-10) [ 557 0 R /XYZ 99.933071 273.895563 0 ] (cb12-11) [ 557 0 R /XYZ 99.933071 254.948542 0 ] (cb12-12) [ 557 0 R /XYZ 99.933071 236.001520 0 ] (cb12-13) [ 557 0 R /XYZ 99.933071 217.054499 0 ] (cb12-14) [ 557 0 R /XYZ 99.933071 198.107477 0 ] (cb12-15) [ 557 0 R /XYZ 99.933071 179.160456 0 ] (cb12-16) [ 557 0 R /XYZ 99.933071 160.213434 0 ] (cb12-17) [ 557 0 R /XYZ 99.933071 141.266413 0 ] (cb12-18) [ 557 0 R /XYZ 99.933071 122.319391 0 ] (cb12-19) [ 557 0 R /XYZ 99.933071 103.372370 0 ] (cb12-2) [ 557 0 R /XYZ 99.933071 425.471735 0 ] (cb12-20) [ 591 0 R /XYZ 99.933071 780.226036 0 ] (cb12-21) [ 591 0 R /XYZ 99.933071 742.331993 0 ] (cb12-22) [ 591 0 R /XYZ 99.933071 723.384971 0 ] (cb12-23) [ 591 0 R /XYZ 99.933071 704.437950 0 ] (cb12-3) [ 557 0 R /XYZ 99.933071 406.524714 0 ] (cb12-4) [ 557 0 R /XYZ 99.933071 387.577692 0 ] (cb12-5) [ 557 0 R /XYZ 99.933071 368.630671 0 ] (cb12-6) [ 557 0 R /XYZ 99.933071 349.683649 0 ] (cb12-7) [ 557 0 R /XYZ 99.933071 330.736628 0 ] (cb12-8) [ 557 0 R /XYZ 99.933071 311.789606 0 ] (cb12-9) [ 557 0 R /XYZ 99.933071 292.842585 0 ] (cb2) [ 53 0 R /XYZ 84.259843 753.620079 0 ] (cb2-1) [ 53 0 R /XYZ 101.433071 751.923057 0 ] (cb2-2) [ 53 0 R /XYZ 99.933071 732.976036 0 ] (cb3) [ 53 0 R /XYZ 84.259843 654.779014 0 ] (cb3-1) [ 53 0 R /XYZ 101.433071 653.081993 0 ] (cb3-2) [ 53 0 R /XYZ 99.933071 634.134971 0 ] (cb3-3) [ 53 0 R /XYZ 99.933071 615.187950 0 ] (cb3-4) [ 53 0 R /XYZ 99.933071 596.240928 0 ] (cb4) [ 53 0 R /XYZ 84.259843 282.344928 0 ] (cb4-1) [ 53 0 R /XYZ 101.433071 280.647907 0 ] (cb5) [ 53 0 R /XYZ 84.259843 217.647907 0 ] (cb5-1) [ 53 0 R /XYZ 101.433071 215.950885 0 ] (cb5-2) [ 53 0 R /XYZ 99.933071 197.003864 0 ] (cb5-3) [ 53 0 R /XYZ 99.933071 178.056842 0 ] (cb5-4) [ 53 0 R /XYZ 99.933071 159.109821 0 ] (cb5-5) [ 53 0 R /XYZ 99.933071 140.162799 0 ] (cb6) [ 67 0 R /XYZ 84.259843 749.870079 0 ] (cb6-1) [ 67 0 R /XYZ 101.433071 748.173057 0 ] (cb6-2) [ 67 0 R /XYZ 99.933071 729.226036 0 ] (cb6-3) [ 67 0 R /XYZ 99.933071 710.279014 0 ] (cb6-4) [ 67 0 R /XYZ 99.933071 672.384971 0 ] (cb6-5) [ 67 0 R /XYZ 99.933071 634.490928 0 ] (cb7) [ 77 0 R /XYZ 84.259843 716.781496 0 ] (cb7-1) [ 77 0 R /XYZ 101.433071 715.084475 0 ] (cb7-10) [ 77 0 R /XYZ 99.933071 544.561281 0 ] (cb7-11) [ 77 0 R /XYZ 99.933071 525.614260 0 ] (cb7-12) [ 77 0 R /XYZ 99.933071 506.667238 0 ] (cb7-13) [ 77 0 R /XYZ 99.933071 487.720217 0 ] (cb7-14) [ 77 0 R /XYZ 99.933071 468.773195 0 ] (cb7-2) [ 77 0 R /XYZ 99.933071 696.137453 0 ] (cb7-3) [ 77 0 R /XYZ 99.933071 677.190432 0 ] (cb7-4) [ 77 0 R /XYZ 99.933071 658.243410 0 ] (cb7-5) [ 77 0 R /XYZ 99.933071 639.296389 0 ] (cb7-6) [ 77 0 R /XYZ 99.933071 620.349367 0 ] (cb7-7) [ 77 0 R /XYZ 99.933071 601.402346 0 ] (cb7-8) [ 77 0 R /XYZ 99.933071 582.455324 0 ] (cb7-9) [ 77 0 R /XYZ 99.933071 563.508303 0 ] (cb8) [ 77 0 R /XYZ 84.259843 372.023195 0 ] (cb8-1) [ 77 0 R /XYZ 101.433071 370.326174 0 ] (cb8-2) [ 77 0 R /XYZ 99.933071 351.379152 0 ] (cb8-3) [ 77 0 R /XYZ 99.933071 332.432131 0 ] (cb8-4) [ 77 0 R /XYZ 99.933071 294.538088 0 ] (cb8-5) [ 77 0 R /XYZ 99.933071 275.591066 0 ] (cb9) [ 99 0 R /XYZ 84.259843 652.281496 0 ] (cb9-1) [ 99 0 R /XYZ 101.433071 650.584475 0 ] (cb9-10) [ 99 0 R /XYZ 99.933071 423.220217 0 ] (cb9-100) [ 194 0 R /XYZ 99.933071 590.755821 0 ] (cb9-101) [ 194 0 R /XYZ 99.933071 571.808799 0 ] (cb9-102) [ 194 0 R /XYZ 99.933071 552.861778 0 ] (cb9-103) [ 194 0 R /XYZ 99.933071 533.914756 0 ] (cb9-104) [ 194 0 R /XYZ 99.933071 514.967735 0 ] (cb9-105) [ 194 0 R /XYZ 99.933071 496.020714 0 ] (cb9-106) [ 194 0 R /XYZ 99.933071 477.073692 0 ] (cb9-107) [ 194 0 R /XYZ 99.933071 458.126671 0 ] (cb9-108) [ 194 0 R /XYZ 99.933071 439.179649 0 ] (cb9-109) [ 194 0 R /XYZ 99.933071 420.232628 0 ] (cb9-11) [ 99 0 R /XYZ 99.933071 404.273195 0 ] (cb9-110) [ 194 0 R /XYZ 99.933071 401.285606 0 ] (cb9-111) [ 194 0 R /XYZ 99.933071 344.444542 0 ] (cb9-112) [ 194 0 R /XYZ 99.933071 325.497520 0 ] (cb9-113) [ 194 0 R /XYZ 99.933071 306.550499 0 ] (cb9-114) [ 194 0 R /XYZ 99.933071 287.603477 0 ] (cb9-115) [ 194 0 R /XYZ 99.933071 268.656456 0 ] (cb9-116) [ 194 0 R /XYZ 99.933071 249.709434 0 ] (cb9-117) [ 194 0 R /XYZ 99.933071 230.762413 0 ] (cb9-118) [ 194 0 R /XYZ 99.933071 211.815391 0 ] (cb9-119) [ 194 0 R /XYZ 99.933071 192.868370 0 ] (cb9-12) [ 99 0 R /XYZ 99.933071 385.326174 0 ] (cb9-120) [ 194 0 R /XYZ 99.933071 173.921348 0 ] (cb9-121) [ 194 0 R /XYZ 99.933071 154.974327 0 ] (cb9-122) [ 194 0 R /XYZ 99.933071 136.027305 0 ] (cb9-123) [ 194 0 R /XYZ 99.933071 117.080284 0 ] (cb9-124) [ 194 0 R /XYZ 99.933071 98.133262 0 ] (cb9-125) [ 232 0 R /XYZ 99.933071 799.173057 0 ] (cb9-126) [ 232 0 R /XYZ 99.933071 780.226036 0 ] (cb9-127) [ 232 0 R /XYZ 99.933071 761.279014 0 ] (cb9-128) [ 232 0 R /XYZ 99.933071 742.331993 0 ] (cb9-129) [ 232 0 R /XYZ 99.933071 704.437950 0 ] (cb9-13) [ 99 0 R /XYZ 99.933071 366.379152 0 ] (cb9-130) [ 232 0 R /XYZ 99.933071 685.490928 0 ] (cb9-131) [ 232 0 R /XYZ 99.933071 666.543907 0 ] (cb9-132) [ 232 0 R /XYZ 99.933071 647.596885 0 ] (cb9-133) [ 232 0 R /XYZ 99.933071 628.649864 0 ] (cb9-134) [ 232 0 R /XYZ 99.933071 609.702842 0 ] (cb9-135) [ 232 0 R /XYZ 99.933071 590.755821 0 ] (cb9-136) [ 232 0 R /XYZ 99.933071 571.808799 0 ] (cb9-137) [ 232 0 R /XYZ 99.933071 552.861778 0 ] (cb9-138) [ 232 0 R /XYZ 99.933071 533.914756 0 ] (cb9-139) [ 232 0 R /XYZ 99.933071 514.967735 0 ] (cb9-14) [ 99 0 R /XYZ 99.933071 347.432131 0 ] (cb9-140) [ 232 0 R /XYZ 99.933071 477.073692 0 ] (cb9-141) [ 232 0 R /XYZ 99.933071 458.126671 0 ] (cb9-142) [ 232 0 R /XYZ 99.933071 439.179649 0 ] (cb9-143) [ 232 0 R /XYZ 99.933071 420.232628 0 ] (cb9-144) [ 232 0 R /XYZ 99.933071 401.285606 0 ] (cb9-145) [ 232 0 R /XYZ 99.933071 382.338585 0 ] (cb9-146) [ 232 0 R /XYZ 99.933071 363.391563 0 ] (cb9-147) [ 232 0 R /XYZ 99.933071 344.444542 0 ] (cb9-148) [ 232 0 R /XYZ 99.933071 325.497520 0 ] (cb9-149) [ 232 0 R /XYZ 99.933071 306.550499 0 ] (cb9-15) [ 99 0 R /XYZ 99.933071 328.485109 0 ] (cb9-150) [ 232 0 R /XYZ 99.933071 287.603477 0 ] (cb9-151) [ 232 0 R /XYZ 99.933071 268.656456 0 ] (cb9-152) [ 232 0 R /XYZ 99.933071 249.709434 0 ] (cb9-153) [ 232 0 R /XYZ 99.933071 230.762413 0 ] (cb9-154) [ 232 0 R /XYZ 99.933071 211.815391 0 ] (cb9-155) [ 232 0 R /XYZ 99.933071 192.868370 0 ] (cb9-156) [ 232 0 R /XYZ 99.933071 173.921348 0 ] (cb9-157) [ 232 0 R /XYZ 99.933071 154.974327 0 ] (cb9-158) [ 232 0 R /XYZ 99.933071 136.027305 0 ] (cb9-159) [ 232 0 R /XYZ 99.933071 117.080284 0 ] (cb9-16) [ 99 0 R /XYZ 99.933071 309.538088 0 ] (cb9-160) [ 232 0 R /XYZ 99.933071 98.133262 0 ] (cb9-161) [ 270 0 R /XYZ 99.933071 799.173057 0 ] (cb9-162) [ 270 0 R /XYZ 99.933071 780.226036 0 ] (cb9-163) [ 270 0 R /XYZ 99.933071 761.279014 0 ] (cb9-164) [ 270 0 R /XYZ 99.933071 742.331993 0 ] (cb9-165) [ 270 0 R /XYZ 99.933071 723.384971 0 ] (cb9-166) [ 270 0 R /XYZ 99.933071 704.437950 0 ] (cb9-167) [ 270 0 R /XYZ 99.933071 685.490928 0 ] (cb9-168) [ 270 0 R /XYZ 99.933071 666.543907 0 ] (cb9-169) [ 270 0 R /XYZ 99.933071 647.596885 0 ] (cb9-17) [ 99 0 R /XYZ 99.933071 290.591066 0 ] (cb9-170) [ 270 0 R /XYZ 99.933071 628.649864 0 ] (cb9-171) [ 270 0 R /XYZ 99.933071 609.702842 0 ] (cb9-172) [ 270 0 R /XYZ 99.933071 590.755821 0 ] (cb9-173) [ 270 0 R /XYZ 99.933071 571.808799 0 ] (cb9-174) [ 270 0 R /XYZ 99.933071 552.861778 0 ] (cb9-175) [ 270 0 R /XYZ 99.933071 533.914756 0 ] (cb9-176) [ 270 0 R /XYZ 99.933071 514.967735 0 ] (cb9-177) [ 270 0 R /XYZ 99.933071 496.020714 0 ] (cb9-178) [ 270 0 R /XYZ 99.933071 477.073692 0 ] (cb9-179) [ 270 0 R /XYZ 99.933071 458.126671 0 ] (cb9-18) [ 99 0 R /XYZ 99.933071 271.644045 0 ] (cb9-180) [ 270 0 R /XYZ 99.933071 439.179649 0 ] (cb9-181) [ 270 0 R /XYZ 99.933071 420.232628 0 ] (cb9-182) [ 270 0 R /XYZ 99.933071 401.285606 0 ] (cb9-183) [ 270 0 R /XYZ 99.933071 382.338585 0 ] (cb9-184) [ 270 0 R /XYZ 99.933071 363.391563 0 ] (cb9-185) [ 270 0 R /XYZ 99.933071 344.444542 0 ] (cb9-186) [ 270 0 R /XYZ 99.933071 325.497520 0 ] (cb9-187) [ 270 0 R /XYZ 99.933071 306.550499 0 ] (cb9-188) [ 270 0 R /XYZ 99.933071 287.603477 0 ] (cb9-189) [ 270 0 R /XYZ 99.933071 268.656456 0 ] (cb9-19) [ 99 0 R /XYZ 99.933071 252.697023 0 ] (cb9-190) [ 270 0 R /XYZ 99.933071 249.709434 0 ] (cb9-191) [ 270 0 R /XYZ 99.933071 230.762413 0 ] (cb9-192) [ 270 0 R /XYZ 99.933071 211.815391 0 ] (cb9-193) [ 270 0 R /XYZ 99.933071 192.868370 0 ] (cb9-194) [ 270 0 R /XYZ 99.933071 173.921348 0 ] (cb9-195) [ 270 0 R /XYZ 99.933071 154.974327 0 ] (cb9-196) [ 270 0 R /XYZ 99.933071 136.027305 0 ] (cb9-197) [ 270 0 R /XYZ 99.933071 117.080284 0 ] (cb9-198) [ 270 0 R /XYZ 99.933071 98.133262 0 ] (cb9-199) [ 310 0 R /XYZ 99.933071 799.173057 0 ] (cb9-2) [ 99 0 R /XYZ 99.933071 612.690432 0 ] (cb9-20) [ 99 0 R /XYZ 99.933071 233.750002 0 ] (cb9-200) [ 310 0 R /XYZ 99.933071 780.226036 0 ] (cb9-201) [ 310 0 R /XYZ 99.933071 761.279014 0 ] (cb9-202) [ 310 0 R /XYZ 99.933071 742.331993 0 ] (cb9-203) [ 310 0 R /XYZ 99.933071 723.384971 0 ] (cb9-204) [ 310 0 R /XYZ 99.933071 704.437950 0 ] (cb9-205) [ 310 0 R /XYZ 99.933071 685.490928 0 ] (cb9-206) [ 310 0 R /XYZ 99.933071 666.543907 0 ] (cb9-207) [ 310 0 R /XYZ 99.933071 647.596885 0 ] (cb9-208) [ 310 0 R /XYZ 99.933071 628.649864 0 ] (cb9-209) [ 310 0 R /XYZ 99.933071 609.702842 0 ] (cb9-21) [ 99 0 R /XYZ 99.933071 214.802980 0 ] (cb9-210) [ 310 0 R /XYZ 99.933071 590.755821 0 ] (cb9-211) [ 310 0 R /XYZ 99.933071 571.808799 0 ] (cb9-212) [ 310 0 R /XYZ 99.933071 552.861778 0 ] (cb9-213) [ 310 0 R /XYZ 99.933071 533.914756 0 ] (cb9-214) [ 310 0 R /XYZ 99.933071 514.967735 0 ] (cb9-215) [ 310 0 R /XYZ 99.933071 496.020714 0 ] (cb9-216) [ 310 0 R /XYZ 99.933071 477.073692 0 ] (cb9-217) [ 310 0 R /XYZ 99.933071 458.126671 0 ] (cb9-218) [ 310 0 R /XYZ 99.933071 439.179649 0 ] (cb9-219) [ 310 0 R /XYZ 99.933071 420.232628 0 ] (cb9-22) [ 99 0 R /XYZ 99.933071 195.855959 0 ] (cb9-220) [ 310 0 R /XYZ 99.933071 401.285606 0 ] (cb9-221) [ 310 0 R /XYZ 99.933071 382.338585 0 ] (cb9-222) [ 310 0 R /XYZ 99.933071 363.391563 0 ] (cb9-223) [ 310 0 R /XYZ 99.933071 344.444542 0 ] (cb9-224) [ 310 0 R /XYZ 99.933071 325.497520 0 ] (cb9-225) [ 310 0 R /XYZ 99.933071 306.550499 0 ] (cb9-226) [ 310 0 R /XYZ 99.933071 287.603477 0 ] (cb9-227) [ 310 0 R /XYZ 99.933071 268.656456 0 ] (cb9-228) [ 310 0 R /XYZ 99.933071 249.709434 0 ] (cb9-229) [ 310 0 R /XYZ 99.933071 230.762413 0 ] (cb9-23) [ 99 0 R /XYZ 99.933071 176.908937 0 ] (cb9-230) [ 310 0 R /XYZ 99.933071 211.815391 0 ] (cb9-231) [ 310 0 R /XYZ 99.933071 192.868370 0 ] (cb9-232) [ 310 0 R /XYZ 99.933071 173.921348 0 ] (cb9-233) [ 310 0 R /XYZ 99.933071 154.974327 0 ] (cb9-234) [ 310 0 R /XYZ 99.933071 136.027305 0 ] (cb9-235) [ 310 0 R /XYZ 99.933071 117.080284 0 ] (cb9-236) [ 310 0 R /XYZ 99.933071 98.133262 0 ] (cb9-237) [ 350 0 R /XYZ 99.933071 799.173057 0 ] (cb9-238) [ 350 0 R /XYZ 99.933071 780.226036 0 ] (cb9-239) [ 350 0 R /XYZ 99.933071 761.279014 0 ] (cb9-24) [ 99 0 R /XYZ 99.933071 157.961916 0 ] (cb9-240) [ 350 0 R /XYZ 99.933071 742.331993 0 ] (cb9-241) [ 350 0 R /XYZ 99.933071 723.384971 0 ] (cb9-242) [ 350 0 R /XYZ 99.933071 704.437950 0 ] (cb9-243) [ 350 0 R /XYZ 99.933071 685.490928 0 ] (cb9-244) [ 350 0 R /XYZ 99.933071 666.543907 0 ] (cb9-245) [ 350 0 R /XYZ 99.933071 647.596885 0 ] (cb9-246) [ 350 0 R /XYZ 99.933071 628.649864 0 ] (cb9-247) [ 350 0 R /XYZ 99.933071 609.702842 0 ] (cb9-248) [ 350 0 R /XYZ 99.933071 590.755821 0 ] (cb9-249) [ 350 0 R /XYZ 99.933071 571.808799 0 ] (cb9-25) [ 99 0 R /XYZ 99.933071 139.014895 0 ] (cb9-250) [ 350 0 R /XYZ 99.933071 552.861778 0 ] (cb9-251) [ 350 0 R /XYZ 99.933071 533.914756 0 ] (cb9-252) [ 350 0 R /XYZ 99.933071 514.967735 0 ] (cb9-253) [ 350 0 R /XYZ 99.933071 496.020714 0 ] (cb9-254) [ 350 0 R /XYZ 99.933071 477.073692 0 ] (cb9-255) [ 350 0 R /XYZ 99.933071 458.126671 0 ] (cb9-256) [ 350 0 R /XYZ 99.933071 439.179649 0 ] (cb9-257) [ 350 0 R /XYZ 99.933071 420.232628 0 ] (cb9-258) [ 350 0 R /XYZ 99.933071 401.285606 0 ] (cb9-259) [ 350 0 R /XYZ 99.933071 382.338585 0 ] (cb9-26) [ 99 0 R /XYZ 99.933071 120.067873 0 ] (cb9-260) [ 350 0 R /XYZ 99.933071 363.391563 0 ] (cb9-261) [ 350 0 R /XYZ 99.933071 344.444542 0 ] (cb9-262) [ 350 0 R /XYZ 99.933071 325.497520 0 ] (cb9-263) [ 350 0 R /XYZ 99.933071 306.550499 0 ] (cb9-264) [ 350 0 R /XYZ 99.933071 287.603477 0 ] (cb9-265) [ 350 0 R /XYZ 99.933071 268.656456 0 ] (cb9-266) [ 350 0 R /XYZ 99.933071 249.709434 0 ] (cb9-267) [ 350 0 R /XYZ 99.933071 230.762413 0 ] (cb9-268) [ 350 0 R /XYZ 99.933071 211.815391 0 ] (cb9-269) [ 350 0 R /XYZ 99.933071 192.868370 0 ] (cb9-27) [ 99 0 R /XYZ 99.933071 101.120852 0 ] (cb9-270) [ 350 0 R /XYZ 99.933071 173.921348 0 ] (cb9-271) [ 350 0 R /XYZ 99.933071 154.974327 0 ] (cb9-272) [ 350 0 R /XYZ 99.933071 136.027305 0 ] (cb9-273) [ 350 0 R /XYZ 99.933071 117.080284 0 ] (cb9-274) [ 350 0 R /XYZ 99.933071 98.133262 0 ] (cb9-275) [ 390 0 R /XYZ 99.933071 799.173057 0 ] (cb9-276) [ 390 0 R /XYZ 99.933071 780.226036 0 ] (cb9-277) [ 390 0 R /XYZ 99.933071 761.279014 0 ] (cb9-278) [ 390 0 R /XYZ 99.933071 742.331993 0 ] (cb9-279) [ 390 0 R /XYZ 99.933071 723.384971 0 ] (cb9-28) [ 129 0 R /XYZ 99.933071 799.173057 0 ] (cb9-280) [ 390 0 R /XYZ 99.933071 704.437950 0 ] (cb9-281) [ 390 0 R /XYZ 99.933071 685.490928 0 ] (cb9-282) [ 390 0 R /XYZ 99.933071 666.543907 0 ] (cb9-283) [ 390 0 R /XYZ 99.933071 647.596885 0 ] (cb9-284) [ 390 0 R /XYZ 99.933071 628.649864 0 ] (cb9-285) [ 390 0 R /XYZ 99.933071 609.702842 0 ] (cb9-286) [ 390 0 R /XYZ 99.933071 590.755821 0 ] (cb9-287) [ 390 0 R /XYZ 99.933071 571.808799 0 ] (cb9-288) [ 390 0 R /XYZ 99.933071 552.861778 0 ] (cb9-29) [ 129 0 R /XYZ 99.933071 780.226036 0 ] (cb9-3) [ 99 0 R /XYZ 99.933071 574.796389 0 ] (cb9-30) [ 129 0 R /XYZ 99.933071 761.279014 0 ] (cb9-31) [ 129 0 R /XYZ 99.933071 742.331993 0 ] (cb9-32) [ 129 0 R /XYZ 99.933071 723.384971 0 ] (cb9-33) [ 129 0 R /XYZ 99.933071 704.437950 0 ] (cb9-34) [ 129 0 R /XYZ 99.933071 685.490928 0 ] (cb9-35) [ 129 0 R /XYZ 99.933071 666.543907 0 ] (cb9-36) [ 129 0 R /XYZ 99.933071 647.596885 0 ] (cb9-37) [ 129 0 R /XYZ 99.933071 628.649864 0 ] (cb9-38) [ 129 0 R /XYZ 99.933071 609.702842 0 ] (cb9-39) [ 129 0 R /XYZ 99.933071 590.755821 0 ] (cb9-4) [ 99 0 R /XYZ 99.933071 555.849367 0 ] (cb9-40) [ 129 0 R /XYZ 99.933071 571.808799 0 ] (cb9-41) [ 129 0 R /XYZ 99.933071 552.861778 0 ] (cb9-42) [ 129 0 R /XYZ 99.933071 533.914756 0 ] (cb9-43) [ 129 0 R /XYZ 99.933071 514.967735 0 ] (cb9-44) [ 129 0 R /XYZ 99.933071 496.020714 0 ] (cb9-45) [ 129 0 R /XYZ 99.933071 477.073692 0 ] (cb9-46) [ 129 0 R /XYZ 99.933071 458.126671 0 ] (cb9-47) [ 129 0 R /XYZ 99.933071 439.179649 0 ] (cb9-48) [ 129 0 R /XYZ 99.933071 420.232628 0 ] (cb9-49) [ 129 0 R /XYZ 99.933071 401.285606 0 ] (cb9-5) [ 99 0 R /XYZ 99.933071 536.902346 0 ] (cb9-50) [ 129 0 R /XYZ 99.933071 382.338585 0 ] (cb9-51) [ 129 0 R /XYZ 99.933071 363.391563 0 ] (cb9-52) [ 129 0 R /XYZ 99.933071 344.444542 0 ] (cb9-53) [ 129 0 R /XYZ 99.933071 325.497520 0 ] (cb9-54) [ 129 0 R /XYZ 99.933071 306.550499 0 ] (cb9-55) [ 129 0 R /XYZ 99.933071 287.603477 0 ] (cb9-56) [ 129 0 R /XYZ 99.933071 173.921348 0 ] (cb9-57) [ 129 0 R /XYZ 99.933071 154.974327 0 ] (cb9-58) [ 129 0 R /XYZ 99.933071 136.027305 0 ] (cb9-59) [ 129 0 R /XYZ 99.933071 117.080284 0 ] (cb9-6) [ 99 0 R /XYZ 99.933071 499.008303 0 ] (cb9-60) [ 129 0 R /XYZ 99.933071 98.133262 0 ] (cb9-61) [ 164 0 R /XYZ 99.933071 799.173057 0 ] (cb9-62) [ 164 0 R /XYZ 99.933071 780.226036 0 ] (cb9-63) [ 164 0 R /XYZ 99.933071 761.279014 0 ] (cb9-64) [ 164 0 R /XYZ 99.933071 742.331993 0 ] (cb9-65) [ 164 0 R /XYZ 99.933071 723.384971 0 ] (cb9-66) [ 164 0 R /XYZ 99.933071 704.437950 0 ] (cb9-67) [ 164 0 R /XYZ 99.933071 685.490928 0 ] (cb9-68) [ 164 0 R /XYZ 99.933071 571.808799 0 ] (cb9-69) [ 164 0 R /XYZ 99.933071 552.861778 0 ] (cb9-7) [ 99 0 R /XYZ 99.933071 480.061281 0 ] (cb9-70) [ 164 0 R /XYZ 99.933071 533.914756 0 ] (cb9-71) [ 164 0 R /XYZ 99.933071 514.967735 0 ] (cb9-72) [ 164 0 R /XYZ 99.933071 496.020714 0 ] (cb9-73) [ 164 0 R /XYZ 99.933071 477.073692 0 ] (cb9-74) [ 164 0 R /XYZ 99.933071 458.126671 0 ] (cb9-75) [ 164 0 R /XYZ 99.933071 439.179649 0 ] (cb9-76) [ 164 0 R /XYZ 99.933071 420.232628 0 ] (cb9-77) [ 164 0 R /XYZ 99.933071 401.285606 0 ] (cb9-78) [ 164 0 R /XYZ 99.933071 382.338585 0 ] (cb9-79) [ 164 0 R /XYZ 99.933071 363.391563 0 ] (cb9-8) [ 99 0 R /XYZ 99.933071 461.114260 0 ] (cb9-80) [ 164 0 R /XYZ 99.933071 249.709434 0 ] (cb9-81) [ 164 0 R /XYZ 99.933071 230.762413 0 ] (cb9-82) [ 164 0 R /XYZ 99.933071 211.815391 0 ] (cb9-83) [ 164 0 R /XYZ 99.933071 192.868370 0 ] (cb9-84) [ 164 0 R /XYZ 99.933071 173.921348 0 ] (cb9-85) [ 164 0 R /XYZ 99.933071 154.974327 0 ] (cb9-86) [ 164 0 R /XYZ 99.933071 136.027305 0 ] (cb9-87) [ 164 0 R /XYZ 99.933071 117.080284 0 ] (cb9-88) [ 164 0 R /XYZ 99.933071 98.133262 0 ] (cb9-89) [ 194 0 R /XYZ 99.933071 799.173057 0 ] (cb9-9) [ 99 0 R /XYZ 99.933071 442.167238 0 ] (cb9-90) [ 194 0 R /XYZ 99.933071 780.226036 0 ] (cb9-91) [ 194 0 R /XYZ 99.933071 761.279014 0 ] (cb9-92) [ 194 0 R /XYZ 99.933071 742.331993 0 ] (cb9-93) [ 194 0 R /XYZ 99.933071 723.384971 0 ] (cb9-94) [ 194 0 R /XYZ 99.933071 704.437950 0 ] (cb9-95) [ 194 0 R /XYZ 99.933071 685.490928 0 ] (cb9-96) [ 194 0 R /XYZ 99.933071 666.543907 0 ] (cb9-97) [ 194 0 R /XYZ 99.933071 647.596885 0 ] (cb9-98) [ 194 0 R /XYZ 99.933071 628.649864 0 ] (cb9-99) [ 194 0 R /XYZ 99.933071 609.702842 0 ] (configure-default-service-account) [ 53 0 R /XYZ 84.259843 561.590928 0 ] (configure-etcd-user-and-group) [ 45 0 R /XYZ 84.259843 283.686971 0 ] (configure-kernel-runtime-parameters) [ 45 0 R /XYZ 84.259843 539.222079 0 ] (configure-network-policy) [ 67 0 R /XYZ 84.259843 599.840928 0 ] (contentsbox) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (create-etcd-user-and-group) [ 45 0 R /XYZ 84.259843 169.788971 0 ] (ensure-that-all-namespaces-have-network-policies-defined) [ 67 0 R /XYZ 84.259843 564.092928 0 ] (header_bottom_text) [ 6 0 R /XYZ 85.009843 422.718898 0 ] (known-issues) [ 45 0 R /XYZ 84.259843 799.370079 0 ] (overview) [ 30 0 R /XYZ 84.259843 272.631496 0 ] (reference-hardened-cloud-config-configuration) [ 534 0 R /XYZ 84.259843 537.158799 0 ] (reference-hardened-cloud-config-for-red-hat-enterprise-linux-8-rhel-8-and-ubuntu-20.04-lts) [ 557 0 R /XYZ 84.259843 511.863778 0 ] (reference-hardened-cloud-config-for-suse-linux-enterprise-server-15-sles-15-and-opensuse-leap-15) [ 534 0 R /XYZ 84.259843 397.010799 0 ] (reference-hardened-rke-cluster.yml-configuration) [ 77 0 R /XYZ 84.259843 191.441066 0 ] (reference-hardened-rke-template-configuration) [ 390 0 R /XYZ 84.259843 518.211778 0 ] (set-automountserviceaccounttoken-to-false-for-default-service-accounts) [ 53 0 R /XYZ 84.259843 522.092928 0 ] (title-block-header) [ 6 0 R /XYZ 84.259843 502.818898 0 ] ] >> >> >> @@ -42,22 +42,22 @@ endobj >> /Shading << >> -/Font 621 0 R +/Font 632 0 R >> endobj 5 0 obj << /Filter /FlateDecode -/Length 2579 +/Length 2578 >> stream -xˎd 602%R^I N"b\AOqy:UT?.tw9⑨Yz-V/oONj=|b5؊.j˩ ^4ϧ}q5Bk%|2 kLT *JT9ZS.DUb#T0#WK0Úg Q`Fј +xˎd 602%R^8 ;0 dad1.'8~~*]럋IDHGRU,x{Η7' 5 ~wCw|b5؊.j˩ ^4ϧ|v5Bk%|Ǯ2 kLT *JT9ZS.DUb#T0#WK0Úg Q`Fј fĖ+QE1P 3MDs(t)-5ŚN5j1Gk &2lLze[PlI^*lIFt[]NuEDkrs3kЉW%!0]!7갣H]-Er:ؒU)l1ZnM}whd [RFu lZBc@5XK \9@VeH-+2DRd P- #FbعT[c&؂%2(hknMZd,P$pa0(^@\Rc,P0WNt+cKb,P`W cjQ UŕT[cX`Fb%jJHX`nr1wSEݔ,r)Kb,0p7Y*p] $t%e,BBZXȞBV 2Gu-Ċ'b) TX]  2ݘ0dpyCf,;-DR]  2 ,%D P] pXAXP]XP]ɪCCuE=1 ۖi$AHtD0Ӂ"1pMƂR 9c ȂcAq XP@J@;3T YT[cд9cAMESb, e`,@FZDMwd YfXPsA=YeWX jP PKǦg,CO `t j-*E2sI6c2]bd,[ 2xrTE QKbΤיXVBO MPiT[ O/3c(sh6Mg,p-Ic|כ lAXФ&3Љ071`_z -Mxd6-ެ`KFBuIS#LB :1]-cA+כX4&2zz$ެ db:pia,@&2[V +3^q:=17##{*=3HfBO VB E>fL>GTP3l~|O_A=_'ej֥\ow~~\?&s;Qeц2=cb7 }᧞<<|dW髾Z;uRpޞ_=po R$bE)hcr4ٯѯ[.!A~qx6= DzTcӉu?aj^T3`9YwP'tֶ\2"ގXKF;)\Pz"\ЏO@^`}i}[Dzoݩ;UIMX[:hvYRcz1!+w|\zӥָw, 6>"lƞ\ϲ#`bl`@\DqʼJBv9ExZ{޶ys-IYqY1Hhu_LGqzAx`zki -6놶]7\~TU6a~6'^?̩+K8Mߧ.n?-燄՗g*PVcvL7ڔs.u"ˉ_ɸa1~[_>f6DJץm2ex";&mW`57Ax9!)W;/VH u,YR䟷 WT)9ޠ(jf }oN$2clwX} ߡ;{nSkuHMx܋)3Y e8OW~/;ܪY`%n}Lv>:W҈ԥf[[7[mw?{{u\҉)}ޥtKh9zy {t&9kknR_:}PAGLlޱ1-;:s%i鼯ʜļJy;"̖t&@yw纞NVϙK:)Sql{D )+3uY~YClX:N00D7XoGqfL>GTP3l~|췟OF=O'ej֥\ov~~\?$s;Qeц2=cb7 }᧞<<||tU_- }F8OTOoN}_bO?BEhc9m]n_}?U>uy~}e?" $ȴ|70f\'wqQ_7u~:q'L+W*ؑ{,'.ږKF+w}'ŗ*_O q0 ȋ/W}[Dzo;UIMX[:hvYRcz1!+|\zӥָ{, 6>"lƞ\ϲ#`bl`@\HqʼJBv9ExZ{޶ys-IYqY1Hhu_LGqzAx`zki +6놶]7\~PU6a~6'^?̩+K8Mߧ.n?-՗g*PVcvL7ڔs.u"ˉ_ɸa1~[_>f6DJץm2ex";&mW`57Ax9!)W;/VH u,YR䟷 WT)9ޠ(jf }oN$2clwX} ߡ;{nSkuHMx܋)3Y e8OW~/;ܪY`%n}Lv>:W҈ԥf[[7[mw?y{u\҉)}ޥtKh9zy {t&9kknR_:}PAGLlޱ1-;:s%e鼯ʜļJy;"̖t&@yw纞NVϙK:)Sql{D )+3uY~IClX:N00D7XoGq> stream -xMo$+l`$@8}r6)n)4YoMj$!ZwUdU=$5-EwIN)r~8}:5zE`{;¿ƻ՛}^tԫ):j6艭GzzaQ"uPkжX芭GT?޲ߘl(%C=Q樊tF4ND>НND'ud(Euw5NEMI DAʝHX ꜯW@#^JTQ DAP=6ΣG~e1"AatQ2iMD`y0|@yr< DAǒfByЃ<m#ՏK< (21NDx-*ŞчΈ&щ!GщD6!e]H]EQ? Jt4XpԹ n4^] -:жu="ʑ[4&[!;Bw":F׹*ʺD*5yv"N?zars KD>a?K.Msc< -բm pȑ[-d*0G`y=t)uyH2ָ٣PE p|"ՏK< (ND'DoEDECgDщD݉Dt"w[{aa ެ.bv=^?o:xo\s{2i( aym>wN>Q*)k@GQ;\ۚ2غӐDHcDnzUn5i:k˖ԑʽNUӎއ5bZ\un[bk\#]Rm1U&\PC@͵JP7 Oe9';=Cт&'jL5Tf5x2Ug{]+6,zhE@m!\:V/T}t[1B@vLRmnU2EU;AX U*,h(wyrlA:x6w-O FՎIeF7f's{ɐVӶM.˰TF^KmmqzYǍjisq%3>)ذ8Y։Z m7kǧ+kKfPEs A6txbȼ47`_mziUp8t=K&4%ޥ Z>\݂Q:{&Y -З;L-{Y4]mi8iaitE:}rMMG mv; 9v)^Pe=69o-85i{N]ՄӺP4Uf1>mĩDY n]nɶ r<:-^2ug7qK[o'}va8HM-t/k%nan=(Z%N -]54}792MD頋vztO N˪;sjonwra,>'g˦ /9 +xMo$+l`e #6@ +!?Ş&iRZ$]k=d%(N?5[Oj^џ8n&zbN-'j]p>~/uźoN'iz|2U'Y|XC6Y˧hZC//m!5+Yk:x HA 2tkX'p$ :(ͅZ}Gm'CX-=H/?Vb<8JĵNj٣P6 ]ȑ[-eֱd'U3yզzDy2]XQ"zyPzH}&D-'< :fb":uED'r3Dt"FQ|FwDt":}n}DY(f_EQ? $%#\tT!ʷYiɵ5TQ DAP=6 ]F#Տ,iLCy.J&ረ̃`QKtQСPE F="ʑhQ ND'DobCgDщD݉Dt"j](E(׈Za7 '.rs KDW$ nG +?4X0&Gۦ`y#Տ7&[!;Bw":F7>Kػ(DQ:7@S-+>TQ DAP6ΣGD9Rx˒d< + dꎈJ @tˤM$p, Hp =>/?D4΍!(TM7x0=rd;Bw":F7>KꯢMII)u+M$p, vn4] +:jѶ3~eIcECuQ2HU p|;C!<% *y0bnT?/@F0@w"db":ZT *z.F:#ND'ohotGND'W:_EY(_EQF48NIGO10#\.vn"chGC[ 1qt%)vn GZm:<9Rx~cECuQ2HU #!n I"4{ȃActC~ <cE!щDע}h":};ND_t]֟>takX7K:$]OGo?|ӏ[PJ?s;_44_dԙ;2W/9-mH5dzE+(Y_wm:%۰KՐnB+s9ǐu]R?`טG/Bh +Pn?^Xϡj.'SDĢ՟Ab za΍<¼VXM9K.;sc$vBpR%Eu2T8@gdLpkXzBj;Uf 'I,aeǸ +=.?_Tt~IGDOmH,y1{#]~EgWS,0'/-ϻwܯ*+ {a2Ly=<[̷-/^s[ou*mK} +}tR~򉊕6UqYYt'x*$S㫷epa3\[IjڶcqoNTkL.H&gZG.WE_f6CWMmjiތ6_GS4|iߔb8tfG>ȔVjId۲A>IY[? +ܱLִu ׶&B:'rkjtLQMЩT_[TEwv>dͬiS-$ڮ#Ov52[ħy +M-mѮ4q<JjU1|*A?iyP69)Vc"4V˿7< ZIńG줰d$Cu\/En 1x:ˤZ Bz̵{eju&)Ƨ͕( rDzo|/doRWgACf{c˸ ׁ5_󶰹k~NX6v DM +,4zɕ6;KOeXor^7J_j=}:nT-L[+1I٘Ć ϲNjh10_;>]^[6.cikGUF楹rhȍK+ráY^0IG)/.]!83R褅a*l(s̢m&NN N,x8{C%mjo=m`Em^_amͱK9r- ٶa4xk(Oxt&օM5)հl#N(Ŷ`7Ǭ zJ8-vvKm> @@ -325,22 +329,23 @@ endobj 29 0 obj << /Filter /FlateDecode -/Length 4946 +/Length 4947 >> stream -x]K$qׯ# 2 F3m F"+I3#{V ;f0{62)"/O_NfJyp1?'5`K >MzVr_gǞTJt6#O)d*`VSJ.DKXP#$re%A%5ȹ2߲ -pɒƂ!N0E8=j'\ !TtD/YÂ䠋wN Z LŢVS԰H6BaA -1xUE7Vy<4,H&,V쥦װ?qaϒ@XЙk< ]dkXN%v);lMg=hDc/'Aw葁בGt1#  E#W M皎n3T/e7:қbF)ߗӟ/%K󙚵ќ0JŊgr'B3 2$rØ e'ʘ ƬX{ԹR\; |raBɅ8b[F ~'Y/f}Ԥ -_N|KI6窪|>Ab:]ʑyЅYGIE|孋7ȵ׿eE hs,>s]/l҅Yt-w3K-F=bzCWsv_Cا ^6]D.iхô4ges:j"a̍=" {Q+ˁGVEQ#םxޱGvBēO$foӅx"_A/=_أ ;Ca밆x ?>]X.0j =|"~}?=s - }g4[{ta -=B}N<أ ;w!}~}i9з|{=bwх໌׻vO5C|c.߅7v?l\gQآb ̏+|/c|2>bL<~-82?6&O v?7Je.5^nc?l6/Ɣeް\Z]dۛy?vOHGoObCϲBCzY~Hg[n=s?o2Bs=,dž::O+I~G[oYޡ_Ưn/-q.wTmɕt|5/bҚ?iɽ4|o8|ǡfU_m\~|޹j==.8 d]TЛnC5+6Uk_xɼo1>Z#Vy(n=n+]ȂD/ּRQgkyfܮ G84?;7Ǚ*+ͶShݝ={Vjk!4nDNcY[^}>{x|8U쟷~`J}YrFn6r\}6Coѓ|6OsJs~kE훩u㍽xgû'PǍ/׵w¾W~q˴5"5}gYk?>쭸@s>b.YV?_-ΖS/`+lN?њoZ$7|>êu-mr] ]If!8K^^Z^_sazG1xI!d.s6q0 342SS~ebD0AWr٨\rnX(*n|qpP&NHg^%T -ZȨ 3y #$c*/HƓs+=-} 8_5_^,od Mo4539zі2Q?mCfiȶÛJ,2G"k?PC4DڹMqg[2[o&yUlXu $9 7%[o1lFLɎ>"\;.]gEXD8kUH]RQCB-N -rRߘ*Q7݈&qSH:nZRzSxv_s.jHk"^x9jSHб„zFΦK\]Ҭ4$Ш8h;zەݑ6Μ>u:LC װu ˕Ξ$+ :6fC[ǝxMvӁ AmJb>dRY/<[#vqߡմ* mp;%,D⊇%\rF\H٠&'' -s F<ˬ]ibZ`//`r2(zsc6hoԫ6ØO2mg=dyQ{594zkAÅQAe@R օhҚTum-YRj=EUz:Ȩ4'r׺% 9uLzɬТQƹj{fPW$f5Qj +Q#acDazQdw<ְ8y$ 2r 0jX\\FlH%@ 55, 0A[.awaeB@Xs^ p,JM&K԰ wmFT^lǕ'cѰ wPy p5,OXQk=Vjܵ p}Cа0Y4`}Aꪼ2 Xr`L4!ɠհ w "p5,]Ch{TtiX 3FÂb34,@]~3kXP~[?^~3?)k], _Nh&]o%z[Y:&Izd`'uG3]H~ztBӹaیKٍ.칎fQxJBuԹsti>S57q|SXqLDh_@N|sBs5y:w[ v'8Z.,3r\;\@[lK6@r䂠7ŌS/_Tc)3\U/'^#ׁ^LK9>/0(ɻȟubwXvmò4݇buKY0nnfŨGZxhjv@vH9taK Sæ^c>={ -=s挶lNGM$G$`~>je9зª=W#0j|;`Cx6__ }/]+5a{tax(V]oנ_ =|z7|5ѷ|{=bwх&|5ix%-*/?/?A :dLO nB8fyadͿۘyO9<1e7,ןqA`&sG_?(qI^lzY2W|C/rK|gT[MFBv%V}T5՘}ZtXb^|y%?Ycw|7;-?5N2wRץj-վ5E_z>VZ=-Ɯ7 ~/84߬꫍kϏ;Tgdk՘ +zmӡ?tŦ'l6|ӕuz_g\Af4S<Ύhh(淈ITiAMc9m16&9$3ṡ#z٩%U-<6fX j]>+m⸉ϡ/5^2[ֈU<"[O +xW& < 5js;sY;kώ6qJ9Zw|޺ռ/&{ >SG֖Cŵzǭ.?ظe_֡FMP[$߷n9Ĝ{ĪZCuQfsxc3>?.;_?8}n}E%b$_f+%pbhͷJ-{t>aպouO6K.Go?mx%s_/G/}- +r/t0Dn =ȣFO_Pο_h{9X`8Iuh )n)21"+nlTI.P9_P~7O8~LlhPE]dO`_ a&"a@T^r>sTbL%3fغo<8DydJ9̺g*8U:NyWXh<ݫnVMխZYmjsVMMࣤ?_MlgA-i-" y +Jﲆ{7=b=|hQ<\I˞0 ZL$oA9DM/Κd3aDU%>S!' +Ɂ-BJȣo^9^x[j<6 Zx}kMݕn|F"A1D=&r61sCb&~ ObLlJ&_ȯ녽_^Q_T O;9.|$zh;M6 bmuڀt +¶2x6)kqCz|B=8vWssom>}693:_[/ l9|e^<͒So|fG/*kVx:# -%}J5gtL-UfwMk uC_ŵNylAayC2֢7x7F~aONk砋֙5}lq+tKҥ/,GyA~"B3*%_s;4<~X +Hҟ1~zZMɍ?aio8{MLo817&s '>+X 'rGګF!wk7f4v4;ƛ}Kߣ=V7$p|(pk6}徨҉ R9󻢲d{k9J#sK/Nf[~}9BS%MLή^to%LO[j,.'L+tOx|0TkPo7 ivn+D֛.d~+pr*!VAIwA [u5NlKY:%#izU.*zkeyTiPGPBw&En7bDm\夎[F~kT9^])hל1:#GƚHn'^NZ%v2:t0$z!ҩ)WW4+?ߠ"4*# / +W}IG'IzlC,>V˦rVfgmpRcj1m˺FfiX)*iR:j0mhE&cΫ$qO75}\x6Z9si]LbN0zɵZ:K믽ȴri^?ڎvewd3':~];5lr%㷳Jle#w}lq^St`#mCP۸ٵu τeȼ56}]jwh5B\}I> }IR(.ńk6 )'igI\B|;2+EWl ) (JEX+ *06ө~e[s/jv5Y^ԞoMN/Zp!sTPsmTiäuhp&1Ur[ulqVZOѩ2*͉AF%nƲܺnɷ(tN:G^2+(nT#}mqڞ35*{MGڨJ_zG!/*OőqlO2٣&Yt` ![FmŨ&=j+r.oߧf~~2;qsZP endstream endobj 30 0 obj @@ -516,24 +521,22 @@ endobj /Length 5107 >> stream -x\I$9ׯ3R7 !"`ئġH^"3#L+i;bIgşw+L)5':_>u&G;6K7dzMt5x̄Mt~9KyO?8sǝ5y(\rQih.(M1}LJSrKUk1cSTKԚy_6eMlHkƬ49 >Vm#(xE ygRmm.{-2贶jRJhm^bNk%:" +x\Y%7~?<#㥼I DEbar Bw>_u{݉h2m\Ujiwşw+L)5':_>u&G;6K7dzMt5xĄMt~9Ky?9sǝ5y(\rQih.(M1}LJSrKUk1cSTKԚy_6eMlHkƬ49 >Vm#(xE ygRmm.{-2贶jRJhm^bNk%:" %km ^|AkC:Ui+U6buZ[ &BUْ˱hb jmΙ jvKm%뵶^6D ezE}& @^lN`% |Ά' |  |r  5֡; /UKaA7hXx4,@[hXdӰ oɺaAMaA→HÂȅ)U 07;5,]laAꆘ$ p7p7T X  pkXaҰb|)VbI e=4, ஏX湁>Zaw=a  w!Q V{a3a*ܟVƕ4,]W>!qeBƥT5,]8aA>x5,]ੵ6jX0hXfmZ X [$j[60$aXġ$.{հ wm AÂܵGm/x נ VV@ k4wUÂeaALE0h{ R!SsNjцOmKQÂlA, P& XjѰ {װ {AD:Djz^`.j~@@2S*9&c֖)paAdȥLװo8\Ұl͑l L̵6^dkXHmiXP[ -'pZoe7,_s+_˴%vC|Z/t=7_3ۘ9l! (+ ߡ? -[l<5.B<^luZx>7ekzgƾ8N-|ƇErQQ/,xy4aR~=8w[}]M9ڮQ(k&שŊp]WyΣ+z8Cd ޹ %u,"!P0g%oVWar/z<72U+Lx~~zf r`! | -HaBfI=}}-_föX=|z0B*ch)%'2C^ ;W;.N:}J_(bxٜS潷nM&џuj0+f=tiMT-JpLunب Ǡ埄֘ibHE>U}^&ncj7r|襝޾?OoR~> -+ľ_n5}/&IdL)kۦc^tKs#?Rf2;`Z -?4YssOy6@/sm޹E[jm}v}`kcW9N>K|r+J#sY*p,c/gL1*qB_5X!; 3>?Lj1l5t_%i;zo=9vtu.1L~s`5j{;U3>l@;o ׀><; -=(";4;3CK7'*ư ظ8ʼnn (BNXE?f@QY.jth+|; kIY Vj9a9χ,E>o ~bzfvӹ:o6/o{e^ ;Ovܪb)Q0urdFHg {.GNݴ&i ƥ>ϊEn9:);._פasJ-[ <_>WkNukvlnj5Q<UgpWn\: ^JQ{Ψ>#5o,#Ⱦ\{{ #>췔CJ{i㉚-oTH+80uܱ!\Eg+[}^[|Ӧ蠻]9YچzǺVwY)G#Cxyv2ף*%u7ǁ*t"+7 W -]|;nhǠo+RO ~ы5nr)g]MN.9v@Uۙg}܌;|u}gݳo[* Yj-BA _|r))s܁/!*}_/NgsΏ>ݒs3έu=Y;SѶ[G-ױg#,}i5 ۳]y-V3(~lq^7^Fs#(dNJ⟘)ц{#߈Ǎ%,9ȕoz^;rE{K4θcى^sKDǶ{˝mtXxAv/Cn!P㵷v8?JscjõqvrLG1W?f/tҽ[>bYv#,z x\ʴ#ˋvj_uI=Y>Gerb_N)dA2O;"7@.'K;C40ľ{7~MWl -=;yָFOUyqH9x&1VL7ɞ:??2D&q.E> u"^N6/*?$ՇETiA0U5;BhI!]N -C9څ|tCq_)I̮K~2M=!xvշߨ{ĆsKWr4v$bV+l'A;N{T3MTؚ3Pg.՜r䭐$= !M|;aR^tCbc4cKv!g`$8LeC|ƱU%'=q'9 |<421N,d6'do d 0F_r߭dǽ~Zܜsʑ㏥ȝ{~8uՏ{;lݐ'A2jǶDO'ٕyo0ivn  ]<1$o/;)@Ku3zץs \K>!qŷNV#.䠸نM6H9=OR"0hY9t- B59V0zo,:}P_$u,tjX.r/wJh #ș[c6*evk7D9)uf(\f;m;OubYV\T)SLߥbZI{;OZz9:;dQhITwN;M۹=ed$np5{G}WkSpe~ -\>,(%%`)2QxDZkr&r6;ؼ 1TޭZuI @)L; VSEx࠷7Q+V9?j\K +%á&4jxLhXp5,@di^B$ Jn J/z `of /4,65,Z +7=iX}fѰ|)okHof *Em/oI7NZ[/5%73o"WKͬ 6."Ӥa.o"r{ X8,jz#|Z2^x ,s$h6YV VZ6_ct$KT 3KEVl Bt?ry[rZ/>OJY`'!SWffK ]Xl:tVvc6pyp[3s,kH~ṋQ|7/H9߯__bO)w'7"5/_ Jo_lkUkEqMAqD<6:&a4cy a_c1QIqU1Y)`[ZD[I)xʒ>B4`%5~jElk mwyA%NR8:x+SaY2[/^-ݴj뙽)BF!7f YGY\Abqwb˴ ֚Dw|m)t_;W7)woo6>ܴ-j&bme!s&ϋ [MǹVznʯp$αv= 9trkPN;pWY|u_CmE_]`Kq |Wy1zيk-]쳮b!fw+/ۯ~Lw9̣fs=4]VѶǦ--tu`W=Pn`n9HÃj+?Ȋ4kxC< 1H [SGpODT@< 1%SLG{˵QԂbE8݀JpLunب Ǡ埄֘ibHE>U}^&ncj7r|襝޾?OoR~>+ľ_n5}/& IdL)kۦc^tKs#?Rf2;`Z +?4YssOy6@/sm޹E[jm}v}`kcW9N>K|r+J#sY*p,c/gL1n}k_{[p8a3LY'dלD]K!C|} #_%SXeP>oEwq^/YUǡqkeIP@3`>}޸$n}EbxF>Puɸt!~l PWpݯaDvHi|qcX/~۴u{;bOE:J ec}&IWk2*7^,J6 䎲;R :tC;(T`U TkEICl"MI|Rl~]{1=RXh;iDzg +|~'UnU1 q(:]l92#W#nZGcg"ĔtgkRB09U-nJ[v+5:5Qub7Gjn(*dzn8+7.|E=gTx7mxtvEis_ +d|_==߅SrPd[!F^ hyDM7w*GK:_l +^•->c-ziStݮ,mC=AYKc]+,m#!jSS< ;Q:qA:ʕ\`+[A7cзG)s݉?E7N\9󔳮&lk;Ҫ̊>nƝ{>o +bhYw-ׄ, ]U߅/> ۔9DJHjt39nGnIIVXU¬h[ǭOIoͳs>fᴌ}.o_lntq|VZ+VB88z//G t2B'OhCZo[FQFJ@7vek/D\R:ͽ3X}v߷;\(a=ѱrg1^<ːbȾ>2T3xmN\pm{ݣQՏYw;]󟴼tX/0˯Eb&n!Wz.2Ȯc7ŃEݿ'DdRpQم\|F +ӎ m?g}%s>ލ_G|:BDd^5nńv+1uAw8;%IGMΏO ѥIK9~B {JItvZLAΡzRHB|gev5cc*ݐhW} +rRkš<*k풟LSe^]D-7*ܒkxi7@"8/ +Ibr^&Lf +TAeY~t}y5'y+$IOuHqp*yج":~q؆*D&: ؒݰAfX)3&9S~ِ'qlhd scIN;_$9;w+l/c=MI&d8(Lїw@'bf97q/7Crci2:r➯':ݿαqoZd|Ǫ~_>[wSꋤ1uN e^E}N {a9skЂ6Fn('NLŀ ls)n],ˊ*> stream -x]K$qׯ和 0 @ {- ; fY+3̨^FwUF ~A2s?ɹח/\I_-?7Lp%pYL*xx\smw]L)٠ -X֑ -CTXb) bĞ1䠱 {VёU O5p%$,pZA,3y炉Pzxޙ/*/xD&&vibb!k<,Xd j<”Ƌ"YY|NdNQxʃ,6Z -P2+ٜm0!Y MRyQ,ц K 5AƏNJ9+&KN}bY0Yl`% |Jg |&Ù>)ñ$ :Ӏ,d 5$ Y3WA*ayȂAϤam֢anaoٺap!հ#kX@\RѰ԰IR^awհD X!IIby 0v5,հ>[ְ>d0I[<7p5,`g5,U. $djX' ИK4,]W9 2.aASyŸ+Z6.ƢaAQ  <װ wSk#ˌVxhPc+yfְ s4*jXiLH `B$A$?H6]d:f[JuQ;Ug+f率TiMw.&5!IS:oٹߡ$M֧뼹^3 8%Ug+f'Ӥ}[H{߾ X:uNo<w?_G^/?d6O'"G$_:zLX{Ƶ>q^zeiBkq;<[d-tA_Fg.jm0HၡLj:~ewFoo)|w9`'e:lsԩ)O-9kATltjL 5> p+h_i p2t~~g1 CuڔW/@9MAZjX w?7!;1]@-Y5K-uC䭉Tc۬26>Y`mۼ}Y g tYxMn6r)M?bzcAx{e异"C^GU y-9Z/$E@G*_z8ea7"'_-{:$v\ sbQ(nSU q4ѫW(]?oaˀ"[Gr =/M܃;Y:9:ݓCANv DD~l ݝی=>;'GkGIJ[s&ucR BNN&dN?m=eVOձ3fGv_Ni87עSo1)$wGG ,xky/?˟~a^aN[_ͥeTഷd=#n37),>R0u]7FoτRږ̮GuT^6aHlΡuި[x鞦տ^vӸ׬I'c%lc*4wXa{?Mi; -@;ձqTVW4YQ~euk[}m07rgy_:;s>>Ҏ(&=ޝ/7p}ڳSc|ogx.:΍~}| <EmQb3Qv ɱGbZU>Wc6hryxo}OVa]1sjhRv4Q'ƌ<}KAmM0MLxN`ul?ǜNVn&y|3vdH%ңmݓu"\IȀeiE=&Sc9`IO8Ik=%{S $aȢN-QN>G%hW8VvT;ٜ r̤o6ǣ{܇-lT{s'Bξl!uN3zJOC9npN_F)!9$/Gd]JBU>_-⚼զ-v5hgzTL<+onn}n\w_Sy:_k<( H{b{J8k{=?O ҅B"L'n6"F?9#/IWOT0V9j -KJWgrJCv[mz.Շm'Y>|W/X[z(kXe*Wy+DYW7j֗K_"I^Q?_EP1.Y[]f+9v1/:V ׯŮgjrgʾ$R~ogv\5VM)TұBDd{kJ!Zb%&3AˎGŇd1vn=7y/.b}V/tK{G*okM5zi4 U:5}@Bz(olk1?\!q/WZ9rQ˵%}R/G4?DN+^Lt#-Yc- ;/}&KHJ0†fz3v;9a/eUfɛ/Syݤ$WULuXӀ4N%0:vJy^klCT6Si Huؒ]NkX9m rqCr>UE7{rq&>sdRbu2Ȓ 6M!@a~6[;:IuL2\vnSGrf9:rE?.|ev[7ٓ{XI<ӈ}LDˣlhM쭤:w&ÉzGfN=ܱ{vs@(/jRb\ᒯSå~Q\N!FL1ȹz硐b -#nzS4_ ;-y?yz}"6ڡS?~cB퀧S^e9T`lwhEܣ䌩1B \6:QshNpmbj2ŵZSKj)bP6k:̣ҕQnx=ZٜӸ;;JX2+8T%ю}mm$ԎjPST+.+C\"O}6 ay%i<-i<]q%q=a8 &EFy̘jk^XS3`^jj[reTQDOfyn{\,ԟR +x]K$9nDs0l/<^]`COkFYQzD33݀P HJhwOfgr.)˯kRWKl.*M,'\9\%J)^.]m븫7DodRNUV&%ŠKX#$|d%%12 N1|r +!),g!֪<b+<Lң\|Qy <#21 Nc Y1d : KpVA4^,ɪXaw=a  w!A V{ ɂY*pb XB%kXKT3s,(//+ecM? xej{\Wc∄s !`q]t!n˵q[!;MHƊ*uI֡#/yjYGS{һkvxhIJ'IbRq 4՞Jd}λ5݀ p^ SR{һkvx2?M+G^GG?_YIfd|"rDhu#_Aʄo\wYyeW6k[9-ˣ_?0߃,;E3AĖKjt RPͶ;zAvc9U.~ʯ0E"L㍀avɦ.C Alq9vd +_$l"d2X䘸eCKL@XiZvClJQ&ŇcR8h d1w7u-o1,yehz;ߜ. k,I#,QM#٨:7J뢒~(tye]eU_?TIu\&N=2Tle2%v~N3^r~q LP'4f/yA?Wk7"p7:}NAwyZӻۍ.]5a +49CdtRT''nSsN2t:ۗLSSTZr!d_e:WۙZ9 =ž p+h_i p2t~qg1 CuڔW/@9MAZjX w?7!;1]@-Y5K-uC䭉Tc۬26>Y`mۼ}Y g tYxMn6r)M?bzcAx{e异"C^GU y-9Z/$E@G*_z8ea7"'_-{:$v\ sbQ(nSU q4ѫW(]?oaˀ"[Gr =/M܃;Y:9:mwZwɡ Lm';~""?ӆΌmkÝ#pw#ݤHvl%9:W1)!''eCt2'aV2C'ģeX/bśkѩSszxD#e#xRO??O:i뫹Lu'N.)UyL6M) +*gWom?rzSgr1r]hC]) +݇ +6Pg|&ŗY +ntF3j柲7?=7[ޯNzmMf߲b^n|"56|WguSrGڱ~פǻ/[{v6}̰ 66l?R1|<م_\ǹ?o^璼"ߣm^58Jsf>.459vHLa'*z&8 ]6_0}3c[uMNF=ĘQo) &X ~өʍu$OzƎl6Dz{^" ,dyl7/=' iGӷdo*$9 YU©=ɐ:(@&'?2[l['|3h+=:@*;leB(%HsQjcTn}R.*ȅuțM icrbiam;85pN^t6n9gr<3&|3Pv?]yssTus; %G{NvD^AA'gyOhyϱ[s:p +h)]A/􇊻>,$[{|vOm#b4)3yDE[ cPʯ~uV;o+4di іޭR}jv{uz NJRوUrBdKuU!zf}᯽+UZ:0\eovwױBfa~-v=Sk< T% +8|C=Q?jNէꗎ"jFw$[Vz(!6A \v48*>$K0HSw}1]uq4,?E|[STu5մm$TJ>N +i`v4j~siĽ\iE-JTUKe:x2JBiXj_dy,C0 \8oa` f"Mvr^˪*LF7_*B +/II,5F'27;y;갦i%K`tlt؆:l%nu,ӱr&&MmCr>UE7{r6SqyqF|d1:d& 0F*֎Nr}L/^YoP煯?W,~ێc<{2yk>IcOyAvy UIu;tA]0t8}7]hLC|i2_:6a/nN%@M*\̷goJx2%TgosW&ӒuqW20MNg]70cT_ jŪ%sWSߺ/&z7 tsf/(f endstream endobj 53 0 obj @@ -782,25 +790,33 @@ endobj 66 0 obj << /Filter /FlateDecode -/Length 4925 +/Length 4895 >> stream -x\[$m~_V u  lǃ!Ù<$X}ά"K*q3ԜzŚ-kg?ǫMt5x !\v_Cy?qw] (\rQaU -+FIa%gZ5ĈiXG1V]@Hհ<4,dƣ,Ѱ w]ESbhe\IÂuSyո +q -Rհ w , 2װ w]@x]հ wQ7D ơа8 UyZ X [$*/8Ӱ`l,P pjX6aAZB٣ K(^5!lFjRhU;d̒yaAǞcN˷/H?S886֞Wxe|p FP8RYDHA,FSLXL$c$z?ZhR;3mm06  -I~ iO`̽BHy~|7~ GZ*;>k߸p.}>}l;i*J9mS;W}˯?AbT"ϘǯSm١wc'Zs*@|DWd2k׿ݿ۴KU1G+>8u(\𕵋`V쾰ϰ\d8ɗh"HZ2i&SY؇j E;5hrKKpDYhIkow/.A=Փ3=/ @ -bm`8q'~r_bHwc?'ݥ͗kU,KtN7z2*WB|';$a1 ԥ{#QTЅ8EsIn rW8*t;^3yr]h -X}SB뫠ΰeEf ;vE<7G`~ Wc[ -n;{OMm ǧbˑũ~9/:<ܚNHލ?ݪ}\ElBwmVk˙^ƳG-#[u߯xJqX@y %|j:vyeHnTs=]|NC鲟EϘsnX6V.<J֓2?B&F P -θ0} oCmhRjne@^Rth—gdv -~$=36\Nt# b~[H\<7#KσؚK?! WEB.e˅?2mOŞxi?̕"GǃR*WidBe*szjǵ*Q3*BGV-Uow?{^gjeib}9C.IoҹZ[SPJW=ZWۭzo߮n_O\$MaNvyeESԉ^UE/]wj{SuuavCe/wY)N9Z.GVsLkwUWڦif^hv[cq}׽b.%֛-LQ;Ot~&zUC7/"r\2+|zގx4 ;)簕&ik>dgt\6>qq[h/52ǷkhƗ^mA:Y,>uHȼx tU)C_/}~rJ,֯W^_RciQ9|NMkr'{dM_]wOd6'~UV?'*]@/|2 l|:r?8Փi(5mc~TH^Sz+.KeYky,mTLz$m?e ,ēďo| 8c_BOazM[?aX#ɺ޴3:8?D`GVjzϸ[NYçxm{) 9 -3GH&k{Yv{ƳR}?󙺋N{vz6{ULmz^vWvoWVMO+ ->U*Oe?a\u$ts{]jW~ك7ȪN7{6Ϳ]{.<uO)l^R۾zڢ=Okw!CGO?7~6]-֡=Lno592\3|o<]-Q/qs悽)uZUmnoLY]MsR,;>?JACx ﹭% X^oIb|x8b)B}gmU_Sړ>jl;u%ҝ]Wg){8xyhe.ڇ=,+󗿮 xW~>@5Y7Ho7˃{boXɤsGv]BFA$3qi\wiu{f7?Ca?s|" -#ۓyָ̟ vx9JC\͘s9!+qOrCuiRuN0veÖRCE}]o-~0 ;)E!~ccz#88̡k~2]=xv6eN"Fl?趶EoH#'rvXBA;N\/w~kO E86y$IOuHӀ<r93莳VT2Aϵ 5cMv!g`$..7qۊ<#TKN{Nr&yXKc^xkdv/2ގl7/&S0$O}k 2-.4C-JǸduP$_.tǽh2˓d~G'<7voy{4 L7 $ƩCAu B3xhq2_k/ ݐ.rpX&/̔|SO)b 8S"C,?IS8eɣfԝV!NA 䁜h]ɣj/"L>o:x:5ô>9'\И+ ș1K ZH2-'DyQE{p1c2eXWK[qQGM1*CQZ%y{RP;jH;i W%r'mI BLE4=DZda(\ !:ׇU.} -PZ85[4ra":p[:YW +x\[$~_Qφ1 ֻͮt9cB"34]RE(q3ԜzŚ-kgl?ǫMt5x !\v_CyuvzSk.^YL.9ۨ*XǤ3Xb bL 1 y_V GV>;X՘ykUD+<MғΤR}Uy< L.:WMJ)G%V4^,YY(d )XY|Ae⡝ +dwYlN`b-D*gK.GxΙ *#ʃ,0>A øaP/P/PA_T:Ӏ X)iHd!Dʃ,CaASа m ޢaAܒNÂ%뒆 1J"  T5,԰ tY 1y `7PIn g5, n X  pa5,U 0iX_1aw}aw}F +Py K27pG5, '4,U. $djX|`2QhX")1 2ԤaAj\ƕKjXHTAÂ| kX. SkhXP(.5,@` Ty0aÛa6?lb KaA)EÂR ^&7BT|T V +4,@\~hXP~[<%nkHT,%ʃ,($7N/A_IÂ7(3DE +7. +dx]TI`V[ǫtfgQ;[Ֆ"[eg`GR;˒Ԯ*Ϊm E=FLXOE9d^dEX瘧;- syU?(8^6܂Q8T~hǭm7 ^2L[m.͂Bҥ}BڣY*$H.~߿zӯH1ZK~7v+~7U̕9mS;7~w`bSWn,t3&+To[cvC>U؉ +(-,UÀRfwoO]18B_ѭaѡsNCW.Y>>pM4'_ iyucĵMq4wk|AkВז/.A=Փ3=/ @ -bm`8q?OleYbHwc?'.K5n*%:'݈e=+!񓍎аҏ=Ǒ_u18t!yQy7#0 +kfZ7/\ϳ+_]1K|zWw{TȌaǮ<$O +Spl16`V.拫c\ԑԶ,Np|*ƺyqߝ9]‾ݽ֜[)ݓwO7oms2}~E_9.Wi-]y=~}(qmr,Q.<i9_~+CXg@>)\5 p>r|`wrwSZ]?sg)/DM:ltiڿIJ~ٹJ.Dⷤws7fAU@.&.phMM6 UxߵCwQ7S_RX׋4;8J +`_*G9{e=o{d-۰ۣ>WYĺݟϯ(MHѕ'/Xьf + 9ZwbԊRG@PMzO더0 0j ?mp||#ύH QMx +B6n +ಛ.eΕ?mOxe?̕P.$F7 +YN}!ת UP4.޴g궇TRܭq`ݮz=cW֮ #~r=/Lzd.>սCy(Gm2ںX=S!n7nBcykF\!Ҝ'V"lҧIIq|q m[ O:߮ +B;_zTgq?J? !jUΧd|}|u{'q)u,Xc{}I񛎥97Q s#[l꺻xw{t$[9x'#㯎S=6zo\>7OHtOuH䩇OV(걡]zL{=>kW)Lݮi +ӷ6~w7mN49OuX} +KlZx7k_}z*/{ ;M^a`iȇ1rf"VxKڬ\b*mCy֌_\P\|_4b|w֦9cPp&o]Oj^ЭrqFB'E̩&=_]^н?;N=YE>Tߙ󙺋N{zv{MLmz^Wvo7VMO +쾣tU~¦ǹ^{Id7pOU1xo/zmK>Cy ?鞢SW>8}gQo1kz 8?+e~'= ܘQplw;{z{&\cn<\kF}ΛOto;K]`oEJkkUddow=|)kwiNvV/ऽyLRлC{nE e ֗r#vŸX"5xʃP?t so\6o*?ӧvЂjgаB]7OM0 p :j?O!.ylqX*Z(CWh7`S*bĆsKNlnk[v4"q.1+glj(ļ\Iͥ +i8@ETFr}y4/±9[%IzCyPy} G3ʩ;B8919yѺGv_EN=:}P$u,tjhi{8rNAީ1WF3Cc9>*e[OiD14iceJ밮j)bR&5UJ:70 +(9y%BKr<3tڴv϶W Y9,}$vvV:o!Q >Aے0~hi{y=y%P6;.1CL?V]p&uˮom[Esࢷ'uz׳nZ'Ƥ endstream endobj 67 0 obj @@ -918,24 +934,24 @@ endobj 76 0 obj << /Filter /FlateDecode -/Length 5585 +/Length 5546 >> stream -x]K$qׯ% , Z zaCO}L>23jg0U$ɶgXN)|L)O/5'osH(N1{6__N?uM9gi)F㕢"cI)~;a9kE`Gv/`sZ`Rq/`EZذGa1j12)ZQfʈz)Vgc2^e6ZxaJQ+  I+A:Y)K֕2bZYĬeӾ?Dd2k'$ %9jxdVFW+Nx))Ļɐ,O6BBʓ !kXH|& fTaZLwFE5,9L&k`jYLNI,9 0 O&IԲ8 հ w1g px" p0 Pr AViq@ - k,4wYÂܕiSÂ`pB4,cа d2|jYkX a)SND^9 /4,@D0e[M E R԰H6̬aA7Vl԰ F0[ KM Na~pI2 ^*`*CdY [D(V A K2Ѱ34rIZ+c#yfҰ q$T԰nLHЏ$^$?H6e$f4-}Y^;+B 8:#+{+jn>܇>ׅr34몙VpS#^(5tifY#ǟxXY ǕDِ1g!I`@(C3;Qb6N A݆n[+H7FCBR|{[Si;(z$#"-.ES0s`or#' -:W"&7(N)!Qfx*{+]Lc]L*Wz n%Y 켑^1ـ  Ʋӷ?Ⱦ¿1^/< !~$Cvr;Nao$5ȓ3eG*GҠмLNR EI*3N@v>˩}Eb\^A\8AT`? Fy'CT֔#܎hШ%|])4g|O $O ki,}B/C3eɦL -cEZ~W)}./͟<>^Ws}|uҞwQ8I f XU0Wo_-nBf|E1Xd|F>${G[ +;|vsX -<{*3^>V66e us,Jce?RrGwgcPyݠ4qCc'.gMV]heGNj`/&dd!DG|d wUy?0sQ5y\[s!qSFuTecp[y?JC10'~5I׍~AHywՙʲԮj˴jj52(yƭQ곺!AN:GYݿmmwUy7FHUS -\ -4$<n6")C|YsW&H:G$AfCF?.js%>o,=ϝG Ρ\A88j!'9yMgbj'!Dew궥UD֡kڪяJ>gϋ"pbrY*^D^6[xWĔdW c׿aBտ9#nS 38BWxi_Rvx9IRY˯U{c^K\MrLZ8 D#l|_r.=j^5 ݮ-O,=hՏ>Ls=BtỪ'9}|U?^5~_p^[uz9uN"uz9չnqu7u;7ۥ}$o ]8].^v/ea[-UaKOî]^Pjܝ u]aHE6=D˲V~:7FymkkUsmntza؞R/.enMQUXOqlMnf^DCbM ND ql.ˋibJ #ۓߕxjٯv}|~5/qlǪ#Ă`&G[& e2)%&;gY3~YN_"^}Y&zMY$Gwyi|^5c#=~+asSRZ  -{Idb/. Bthy3[KB_9ː\uӏvv{vvڐ]wc,'+pVM>-gXiRm+U6FLtK -OG43oVmо[q<0Áj|`O&L4Z;zNiXFvw4Y@,A>cbCПQ$lUxyg1;Nf,M .fJڞ0PU]wt fm3Qrˡ}m6RxZ;s}}wMu3G#yOxl:LYZr/뭷_} Wz-vplVZx6}yds;/eH8KE۞tWH˱oh _$LO FQ_$  -Er.>\ mw,jA1FJLYux˪eG3r_2GS~G[~s[:#WKTקۋq;Vo6h'+mLE؍u)99_Hy[vrJ$:QmV7hTݢ8' $im;Ѿ„ؓR;Bu&wÛ_1aLZW"}w-J`w›njWDYNQ$g(O?}?@oLMNx39) WmxՌm'VuWC]KD:U# `Dځ(KhAS\nQP:o".5~WԷ<*:7=6dy++|@-}{wW; juaϭ4{N=_YQnS(+{eC hyt$n i睸fD[n5"T'0AWnxҳEĞ,tZ" r8Curg)d9%xV9B\>Dv9;}d=1l:k5ˏM[++D vOћ.dw?M| 2Vbog{!ْ~O4Cw,^g]Al.E-m/*UnMUb4ʍM!.'M3ɝ31UC\)I}ni7MTUs|g:&xvR냏`rU#9M툗扝rQyw0HFNKU.'fɍ Qyͤdu띈o6ZH#=4aMQvfGydtMb+ ܴC56kd*#T&F͔_VΧoM,}kCΗƭ\m6_2,j',/Ui @;rֆNkMdڌ{9T9GIX.ZEGI9Jln36g}6˭:qC{}6t$.Á:Kd e#|n=:8tCrnJ˨OI|GRvCE|ס9[)9vD/ -/C!_qfǦ+bx!0_ƆeW(L{}C6hoԗ&x:װ*-Ujm{Ԃ=՗FjՖ)Wڪ:Q4TZk1VR8R-ԿV{Vڭ3^@~4Gg-L --Tiywm03zdjz5{K|G]P֞ -MqLr\Q=r& aU Ӱpk1uLLd|\04U[^-uH @Y0_v/jYi_H$&oZ:)q +x]K9rׯC2/`0x<^c@CFŢe`}L>23Ju &x| l{6RϗϧNfOybuSƿp!g!Pb. mnǟO_:즜R4JQFy?|P9kE`Gv/`sZ`Rq/`EZذGa1j12)ZQfʈz)Vgc2^e6ZxaJQ+  I+A:Y)K֕2bZYĬeӾ?Dd2k'$ %9jxdVFW+Nx))Ļɐ$f4-}^^;+B *tF#VlOW0uGr.$UΗ/ofZ!UNVx)V*Ԙ-eSy+ĵ!cnB% ^1QfKw$:um> " iOWԕn_} IuOG8l$:U:c H6 +ߢ?vy՟G&+ +:W"&7(N)!QFx*{+]Lc]L*Wz n%Y 켐^1ـ  2w?O~@wNC .]>wr3E$2q{#A)+r]V9?E +39Ime'dv;,vĸr׻?q!Q]h/f#hO8&Φdvv@SF-W\^)4Ƶ]BZZ?q߶˫ř}ݲd a᱈"-~W)}./Eq~?^ޯwV2đHM21jj ru~ + ̚Z7vSU`9d:-Ư`&]2QYmiwUy;Ѱujb/XGvozjH0ƻc%L/FߏP^#}׼0^vR*oGT&e *p^R$Wl}1B%2m-W9KO1WBk˪G{mq tGȞ4|W$[P/ǫFw+kN/BYx|W|_7N/{WSrѼ:׍>}tf9{䋁 +°԰V~,ke*,+Y~iX JsNtj6 ɾgh^|vY]Y/>^(-Rp߭j固E˂ckK*6EV5`b/_<)6y> In6e18u5c'vY>L\3Ole[h5Y7Sz㼆߬ya|`d}>TXڄHu$L&$}uB݋P9}}/^˰?D A0K0:=,PϫflDܗgwe<,nCjOע A4x|?pQ_!u/ LEA-:/ge#4b Y+{Cnw__].ۮpXN+n )dي)c‡I ˱1;Mu!-mv?S9!ݒ~y{ [pUZ kz9x/rIS/=,mgˢ֯#k _'#^Uب5]M_2_?73t\37iA!1|:Eeǣ!N9pZ; |D< &K#OY>qgc,X9֍xXxG%wW^_mw _6.Iq;c"8cTצݑ"Lmh'U8RDDzį~qOf)P)fGۓe}6CO)8aOПC0F\t)|[u^{6~\dc/^J iO/3T^kN'}&l%5S!KfTBjۋybf2}6|h'+mLE؍u)99_G9y]vrJ/=$u +1LmШEVA|o^ݎ„RAu1"wÛ?aLZW|wM{J`w›njWDYvh$[|˿8R#& +^PQ~M]c6jFPք +*[@85 mlh#1DYZG@ "FrE(Rw%A}Y}NWX79&,99[<_iFF>+۫y|5aϭ4{N=LYU^w +4vWp 4] gM|m,?\畗G~AY>];,_WP"8:;*z^=ۗk=\5ʚi;fF x\} gFNO1^MOZ'J TrUgHC`fnhKgHm+9ʩmֵP2?ueC{(a|-ϖnmauٹx7phIF(s&i1BzS?HF#Ǜ9|Cur~)dYߒOr~:+dd!.ŶQ]N)o$?'ԓ _FZMεcӦns +5ݓdA&ZBc`xHd]'gY.s9QtvP}A-Y׵*] ֕FSQ}})1i2[59?t&jHܞ9t9-؞JjtS.TJp} _a$@յIݸr*OW4t{T9dkV(PU\Xn&%w"k!P5 wvGE16eQmO7:pӚ aT,nsvO8ywkغ"#.t'Y~7H%6dZC儙IuӁ>iV:}@vtA2b dV7}o!9r%H62CyhwhQnQيM1ȱ&zGU5 aR/>̎MWZy4ތ Eo+Qbj/,Bmި#PT*a}*GUjm{Ԃ=h5j~+mi(\f*+OaVR8R-ԿV{Vڭ#^@~4'[,Zk7*'}:ڞH葩/¿/uBY{-361PiGw0bDNÔunqg211V~;3 +qTyzlWzLN?3BDN*oC# zh:cVS'zB endstream endobj 77 0 obj @@ -1177,22 +1193,27 @@ endobj 98 0 obj << /Filter /FlateDecode -/Length 5342 +/Length 5338 >> stream -x]]q}_./?_@` n/Ewmy)JTjwg~vUd%aDFcE53G5&_XࢊZ]_/:jU'N"bQ{!)#I'$yb>I(bR,m"̠3$$%(M0FCR0G!hab D -iƫFR5*lfҜS!FJ*Fgm4[!Rl!` NiŦ褴[,Z' i ]IL-:h#e|NDbZFN1mӬ'純fQ4 [YL-i+9BŔoN;#ybm$1 %$ -)%l%lr%lʊbt %p -ieY؂ 8[,9 ؖ t68-i$.p \%.p`\I\@RsS҅G X`%.p]G)H\ASL-`GLrx%. .J\^UaXQ6%-qwm$qwm Etxz܂4rwVZAE wA!^` VHN, `Ui ڠ41K\6udԇ_hQ4\|\雌\ζ$(\CHb[a[?`%̲l6_s~?ɪϳ:l3c㔇\*u{[rK~[uc[hM[k­vg?¬WMd^$gP5||}E??Ϙq" E^$LBį0?X]ӌyV7doRYvJ6m]ga O\hao y֍:ͻn#a"( jY -:6>SG0aaqnٟۈ6@>v]?#Z!it>4yJy"]yxy" xOK #Z8썼 - ̈ҥ~ᔧUhM7-ӧ.,T9UqYf+kԙ 2lH;6i2eua,{@/19LxQ9]a79<xa Dn?˾4?ʼ ǃVN<5'u;c_}ᔺ?~^upIZ6ʼgݕ}i/'yj-*wIX\к) xq9.Đ;)4aEoU.>虢_Tonszޞƕi5<< 1lX+8F\ qZEe4;{Y:?-yQ9nk:+i1YN;u -dVrٴzǻYs) P(`9&o2O(v.w6AkJƮ4 :VC0 Őg0X.l˖R<;kcj[Q(g"9&D!,;tD,{`;o[So}L/ N;`a@|+s'u#dG,x'<ums]bs?'_7a1A;s*OcoZ:5%ygpz[5> ͏5Y/ihe_?ҙ_AfegJWtq6ż(wվG3N;VŬҲN~a]w=c8<1Yu9tjp:*tB\n)TiztFD}uveH]U|zDw{fC +x]]$;r}_Q WW/0 6 |0vfc}P>232kN3ݕ!)8 +)*sW"R1UJEI MQyCׯ,pQm ~.쯗??Ks*`3'S1ŨW1Z`n1g) fHIfPN^Jdmp&ea!) f죐d40Vk1 h"g4U@)RYLH3JiΩx#eBIJ#6R-i) KQJ 4bStRZ-[$ҲS>'"1-#MiV{sZJ3Fy`Ӊi(tRB-A,ﴕl!Hi bJZnO '5LAW4IKȳ1>c&rm :y2įcO.F>]FxghlzC!$0~z/_P/b4&_3ncⳝ|$>Ϻp\S +sY|hmY?}.mv"mQn?i6oڮ !iN ^Z>4vyu@Os+~?Ϙq" E^$LBį083Ɂ_ +3n ,!O빝 >OmZۺ̟+ o_ e֍:ͻn#a"( jY +:V>SG0aaqnٟۈ6@>v]?#Z!it>4yJy"]yxy" xOK #Z8썼 + ̈ҥ~ᔧUhM7-ӧ.,T9UqYf+kԙ 2lH;6i2eua,{@/19LxQ9]a79<xa DnȾ4?ʼ ǃVN<5'u;c_}ᔺ?~YupIZ6ʼgݕ}i/'yj-*wIX\к) xq9.Đ;)4aEoU.>虢_Tonszޞƕi5<< 1lX+8F\ qZEe4;{Y:?/yQ9nk:+i1YN;u +dVrٴzǻYp) P(`9&o2O(v.w6AkJƮ4 :VC0 Őg0X.l˖R<;kcj[Q(g"9&D!,;tD,{`;o[So}L?/ N;`a@|+s'u#dG,x'<ums]bs?'_7a1A;s*OcoZ:5%ygpz[5> ͏5Y/ihe_?ҙ_AfegJWtq6ż(wվG3N;VŬҲN~a]w=c8<1Yu9tjp:*tB\n)TiztFD}uveH]U|zDw{fC V+/%AX[^~3 (3=~ -GSΓ:"-{hQɂд$}͡JN'=Z1uO @>hs1Ѻ90cKi5 7&G;<weE%VT<M } 03KIjI^PPW|zUfa$ʻ!Cl`č ߅X*o4i}ykɼ<-+)CɋYT^ilm8^F}Mb L#Z7)p:r.3txJ x9PtH3@4^qNFпǀ|#2y%G@<<@l$ƇoE%ćam8A7gQ[Pv9^D`7ޢNܬJ -z< 7pZ*tV('o'uIsА{O[Vq\2&/a:b#3AZ\B,e}Rye#ݷ֢R-H}Ix}jQ- - 2BgݞSyy~cV0ZTR`zr_v+~8-B7g 4@pBTss:D]hQI j/`SC,~ x?-P_QtRi 5o|AhYIа5A۲ᠭc$ί?ǼjwU6^"vV'uV_@X'oy#X-*)7AjSCh?mC0%@ٞFyRy E~=!d4.2﷝l[1l}vV"He;QcDMVyESfJ>ըת;[]iS#-ڏ=DdQ ܸr.N< e2h[2.1,^UoXg:GNP(y>4K}d|~ha$;o}'U7#+4aN|1VSA=sU )ytzs?U҃-6̦ЯQ-q~/+#Sה1G_[. oGKst/ [-E] m bv̑G"ӎ8-ɧA;p=;AUM'zX* f+~-Y_B3Ňj3@⡘Bt -P][>*5]ftfơ; oTWQ_8RkuܤlB"еhBgI*5 ]|siTlRW͵).dfi2|Dq)upc7c mįܾs&NKcM׬2>OTᛔ|0 ^ f/i:$Gf#E16̎Gm3ܭҡ9bJ݊$_"qYT".Bq9Te 3c%~CQfǢŐ!/ƂɌ=^ɡzK7(m7Fxԕ˰lc+꼽ZYn=ׂ=ňAڜR-*E tc)jY'b)cKWZ#W&/[G-αߝ9[,YzNWeۺiYwmmP7$Tw5M-#-?eä'ٔlu -BmdҰ5JF]kBw(rNG_J,|0UXVZ@X4=QݵmBN ˖qЛ9aI? +GSΓ:"-{hQɂд$}͡JN'=Z1uO @>hs1Ѻ90cKi5 7&G;<weE%VT<M } 03KIjI^PPW|zUfa$ʻ!Cl`č ߅X*o4i}ykɼ<-+)CɋYT^ilm8^F}Mb L#Z7)p:r.3txJ~x?8PtH3@4^qNFпǀ|#2y%G@<<@l$ƇoE%?ćam8A7gQ[Pv9^D`7ޢNܬJ +z< 7pZ*tV('o'uIsА{O[Vq\2&/a:b#3AZ\B,e}Rye#ݷ֢R-H}Ix}jQ- + 2BgݞSyy~cV0ZTR`zr_v+~8-B7g 4@pBTss:D]hQI jǧ@)!h?B[{Jv(/G(N:4ʚj> @h{rmYpV1jyUc^ Z*Lrr; :+/m  )!HmԶ!EQl?<<pZT2p}N}nv}f>ivVjƋ2􀝨1O+O<")weE%jk뭮灴[Ǟ[ +w"\(n\9EgZ'ul|ԃ2~Gj*C3P#T'?uRK6>f2>ytd?OA07Ev*GyEJ̑46q{պUԢjZdn0*79[P'AtŸt-Й-}5>} +$jr'n1\o=[UsmnJKYiYѮ~\@k؍vCG!\(on(xҘjS5U&e) 5HW¾F塱I-QHQv c{fL-wkthARC#451SXmƕPW#& ʯ q7WUwиuㆿ0_2ZO.Ս +V 솁kWom۷d҈{R9;8_3FGwSܧqqB`Oj.eiסH\q>#절P\nLXIkzƮG&Fiԇٱ*+w1dAƋ`2cya`wlrFM:Jۍ,u2,/ۘʤ:ooV|ϵ F-hq1bt6gcTeJ@2]eXm +ZmrIlb.~ֈ~앰EK@~sw{K&AF&UٶnZ]Gp =2]or~}gtKOY0 j2|6e*[BY4,i> stream -x]ɎW\`aJfKIKHF/[9kDFcO'X],?_g)*orH#'b6 ]_N_ks*`?#ȩb^eq{A9K"#YEfPN^ 6 3EFQ6D0dѰXE D -2U@If -),"d&ZI -7,O`H2[!Ғ KQӢ $Ţv KJ 蠍$NDYLF^䜖d(l:QF -QYϢ x$sW') rvIaDlAK `l1H$1*ʖ$)J$)+I4`Wrxi58 [< -+`$q$.pXr8--8-l$.p[&H\@0SK\.r,q:p%.p`]烕v q:2Z:MQ[` ʙ$. 3:J\@]t#+qZUA`Eٔ޵I޵.@E>$. xswVZAE wA!^` V{Ȭ7Sak2ܟЧVʤ$.]|,+QBE-+Bw᨜ L d @i-qA6 MK_x3I\xC0XUy0nR8a.dq%βߙ!h6ڈlԞ^7h$gjy&¤qp U!Ot6iОw2C w7l첿tĈ3*䓀kbϤ֨oVkyבlL$9@q%>?zB<0M2X^˔k]lpte&3Ij^L,/pېe2d6;sZ"x&xW'inwr `?hi]7_;sz^D U! pB;.dlz邁 ܺ&u%TP1 y2jգ%cQßS] ]uН9t# U!˄uοĭԠX!\ )-S`BZsD9KD X -6nC=c V+&dS@ ._cyǐ9 dIA^u!RPw#|W^BsmGq -0wkv%fR89MN7w&MDwc6M>g|7M>s|6Ġ]Zy-ɏ!8sz٣B$WŻ1y9IIѢ=QN)HYOGԨv[NxR8`M>Yz_;U!%n= jT1Xr(UӘoۙvs:id-~{&73Һ:ű=NqG}Nei)N|0aT-XoЕS|XAP?G[Q{;CO  Gz 9sjpMׅi -v'?9L_G7@ޛ_`*q љ_DH -Y9,LK(K?q]v``kq T[kvlS9 ˛t^8p,kO8jG}q`0x[t8s:>F$Wqh˞8p&,6'F&uSgޢ1[Oo+p]jz?l5o?}mR8`HXB> x=gF}g{KB6 (5:sEgL.gƲ^DJPē 7wR8H( okօv,X|Ga6mFR+soBZuW:Û ˻p-vCHV90Nxbܲ.shrwhr> o?49s%ީeOܪgK31jB]wD9 G/~օ<&Gj(C:c#goU1M69G}i#\MpM: EB~C{MMEfY}NAͤŤqq*_K}[دܷ9I%k |d3:_|ڍtx[օcϙQ{ߙ]Axʄ4]rx'u^B 7]n0t&ۜ/`Mq=;rTfZ X,`G w6g'u'{Ѫ.`ey=050;~zaDtgT+ˮz⨾oM@ݠ7cT{}&ejY6)Gl[ -BX4Gr;W0? 0"3_i+ehDvUb|?k w..y#(~&p-~pP?|I%<ͼ#_>CvdJB?\?4F7M,_4̏'gs^y>7$!Lۯދݥ]qQ+}5כ;_~< ƄGcZ`d~zd~nRv)p&Rݰ)n&Dג%%HUg/ymQb}ꋘ_+*Ψ\S}Yj; I.ʻV\S|.'1nTRSͥ) .ՊҖ:FmG+yCqmknx9a!䣐7о@Ot}kr /-'k4: - -_Sy_ UHU+fM^WR*T.nT;ƊپLB~&ݚ*.=bT%uLa~*WZP~Y%7;}^‚}[r'?WU0_/cd~*dku0BKn4$Zى˯IriqsyQxpGG_yws?W?nue [u{2VoLomDKdZ^_P_SS׍KNSTi[vɶBՌx|j4}tPEp?.S-qYKl -Ͳ ȾZl?M%EFk2jnuI[˂yM+~svJJ5OƩT\e9ny)t鼭\\ rZh.zv2P*iBt4]c)J,OZ5hkR+|jj{8t嬱dB]St%m,eo{!E!-}s7[ * Dg9sB6R4v<g2G_Cs:^ ۂV/o j|rUx} L4 rMCE#QqJ\VS':* +x]]}_ρUQ,$0$!p7C~N-YnU۳a^Wtt$˶9kDFc'3XL?_g)*orH \T1{no﵍9[sƟUTL1j/2T8A彊 QĜ%,7('/YUq*  I*aha֢h"g*уFmu:sNHIU'IGgm$/iI_ȥ(|qiQ_lNEb:Y%t%Q_tFe|ND.CSLj|rNK:c6ÈB'(,| gQ_V9B+Ŕjyt;팤H%$ +RKeK %J ؔ$+ +9J<ഁ/ueY8_,9 ؖ t68-i$.p \%.p`\I\@RsSp8J\@Rw-qw/`GLrx%. . qlJZڤIڈ txz\k+qw- q?Z/+q=tI\)D5O`+eRxI>Qhqaܢ !K\TN}& +J\!RK:YK\2H$.@|SF.+SwAKVDaDE  @J# w޳s&=d%.@^0*m zXҁwY)qA,I8[ B"c C'± j<(K$qk]ND _D _2H\@e[E|A(qLL$qA1 Vu :%.Bs)0%.+N$. f"qBJ3It3Fd A Me-q"4hjIGIDAq(q f`JQ_@x%.MLsD|q$.Ht3I\|J\l|3J\5|A'qAAq,qh:%.&aiIKo& Әob'7G" ,[p`'I$qAIo"7\$L8|4 ^3$hPGl 4*ks$qnbfj +ⲁ"OU"bf|Â9R)v]?N{O_~5wxby،]t6j!|ƆyqҀE7v6/f2 yV[!HcO ;MSTĹ@@)-s'^M¿p0oDsBZ}~?~rN?<96уVui_OE)̿iEv{;4s<ߧ; 1<Mi|b4EC)`^.\4}i~N݇5ΒWyi@S|1xx"AcuΏ*c|N8lAA%|$ ɝHLA&f: ;˧_7z^u6 ۦ{ӄ J|)rT&%Bјq@l3zѪ /οTv&]|?Wmߝ"af\LtۜSuw2&[9"YWlUJT4YO)72]ۀkYnɸz{=%enS;Fo2ژagyB+\ї4otSm-[@lxob$ 5PSmm1_iJPI,t>lo- 6- Zxqtaa8|$xJ +x_d(u>mRg=Dgd n",i- I!WqUWqw]2ދ=ZU!R{ |ƤL][9 xW2 c6 yF.UǺZ\c,W-w7tۼ92z73)x-n*7mȊ229x-dsJoIګ2o@pCT9PIm6G\ڴӮf9p=D_ U%pBj$P3PA`|$Γz=}[0uu4%oc6ǁn"2WBwUɴ DM/y+-P.nSdB26r%`) T-V-6!h^JS4==a Kj~u]W" }vzU&E[k;B+wS \wbm*~Po@zsSj4,}`ܞ+/}]{{}PφK#c`iKcCho UlfN^G6eQhjfoo5߿S +'RԨv[Ax8`M>Yz/ǃ𪒒7Jl?5[*ӘM5,x7(26va:kqߞD4#+}mP{}A=ΚAZƃq &̪؂<W wBp'ao?z$lHcaǑt80, νr麒R8C0+P wk>nnس|[[ퟀ47؃6ǁ4Fg~ !dpgZ"}iN ZOf6A@!h~:zzη J_u{}y`o/ &`<o mAǏo Ul'偽(#6ǁgޢ1["[tcdwۻ7Lv{a38-~A!q+7c+gy ``oIe7{p6Zm9+7+y3h}]8)?"9N;~fyͺnPeO,lޟ=Mo]Z5z(xk?]8m]hC|Vdl1G*xGHrܯ;ߦ]nl4+%8|>{[[M] v2_KaY>UGB(qx UG .*݆c3wguL&`AsK!fql^.)+ &~_Wooc8HĖA.x|Mӵh-mӵY3M÷Ȳc;:o_>V7׵k?;Bw.ez}Kj/p{$8LGol +1r˺o=*GV['g36gAs|ںWm>z>!C~/車mO) ^ U%̻zvzg[P@wΏh0^m"%zZ"=w{}[Y淞cV8 %E67)ln +u!8ş;gۈ\@~^pJ?^lvڴ4ߒ˱*w$w0aLi3creS箹>f*Sžy)|`$ЋsAǟk)"͟ Ssd*|H젘󯺞@.ྨmI畞Η_/W1QvrXV,aL/ט_ؤ|+>!\NHm儋ᦘwr,B uS"kCX]o4_t#jݭMWʩJZ]eq*W/%kP'At9 t955VU +˥ r|XK4_\YRmxA6,fhW~]yslkNx9P/\}^+ty8/_Lv CK*|2L,GK%<6xH> @@ -1868,7 +1886,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] /BS << /W 0 >> @@ -1879,7 +1897,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] /BS << /W 0 >> @@ -1890,7 +1908,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] /BS << /W 0 >> @@ -1901,7 +1919,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] /BS << /W 0 >> @@ -1912,7 +1930,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] /BS << /W 0 >> @@ -1921,92 +1939,99 @@ endobj endobj 163 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb9-61) +/Filter /FlateDecode +/Length 4884 >> +stream +x]]8}_/haahh؁bf؇;U3,apZ̔oUVt +KGG!9lşL%E>|dM +M%V/YN&s8,J&S[TpH3s,辭9bte{iq?qu! te1:ڙIȓp-6D*8o1ݖs.c!zRp*mT8m{\i5ݏwOￗܭݟԁº :4n6;@W&;A1jqex<vmsn #cZ \|c&o304KaOܪ9-ggT,򊷆0c..XGDL2֑5nGpvk.;A-l:iһ9 u%; +eԕnX>ʛ_?_% uo!t/.H`hEb^OxKtPh͐c6/Vo>+fY'Nki +O; 0PjtnDD#x.;nslӹInQ3iU9cW=ܰ|sŗ٭CdYֲ5,[l"/)'h]~ +y>0˃.`~J]8BP;l"vKvq)0,o-+ +]pWWGF>#ZE3+< ͸~#)eeuknr'&1#P q }nc6ǁѕ[ YAQ3\l_||=ñT˹s]lky? +{>qZva8p 3pVݵ N]}nZ[4&?2_KeY/:jp[|9lIKyl`)e%y*JvUz3 Mvkk(;2X쓤p{tm8ɛ|ᙀ[U2w9N1*=ز X]dWG+Yp +bc6ǁX@Q[UE;wwÞwkoUZqvS^7fsIbgoU 'JMw@Xn (1ߑ7hs 3SA֕Vo[/m%mA/|)y.Ly&V#KjӞD[}YR[ \o4Kj0@,V#bU%U֋=YR[}YR[{+ݢw7hs<S|fRͺ/zOXcKhgXVCiӞxk][-WVi6\R9H<%o&HW|.u{nKodYޖ H*?rzk=FbE(/{mU.1oA[ײʊYuk1)%=*y)b>G p.jՅs˫y +75՛_qG0LC={/pϟYL\d/32r""88)72+^l\;[16NFb$ ڼnjwa9}VJʇz$Yaj`.1?EQ Zv˪Zz/"F"v.I +\`S?}W# ]HzX2X"+t|+!V!\N}儋C$/°ڮE,_e}YZC\u_u= ҵUʷjzd9U4ԒC"z9)l=5(^/\[R)Zn>[h=Z+ )WdS$ƈs-mp7—<BRJ+lԝ]Hԗ_U&_/TTgAJ2Mn^rm8wJ }{lBtkkNJuOHZX(O^hnוx3l,wƝ8wAo;o*|&6 sd{fN8RX N:Z;I^.Lq_N> -/Dest (cb9-62) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 163 0 R +/Resources 4 0 R +/Annots [ 165 0 R 166 0 R 167 0 R 168 0 R 169 0 R 170 0 R 171 0 R 172 0 R 173 0 R 174 0 R 175 0 R 176 0 R 177 0 R 178 0 R 179 0 R 180 0 R 181 0 R 182 0 R 183 0 R 184 0 R 185 0 R 186 0 R 187 0 R 188 0 R 189 0 R 190 0 R 191 0 R 192 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 165 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] /BS << /W 0 >> -/Dest (cb9-63) +/Dest (cb9-61) >> endobj 166 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] /BS << /W 0 >> -/Dest (cb9-64) +/Dest (cb9-62) >> endobj 167 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-63) +>> +endobj +168 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-64) +>> +endobj +169 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] /BS << /W 0 >> /Dest (cb9-65) >> endobj -168 0 obj -<< -/Filter /FlateDecode -/Length 5056 ->> -stream -x]MܸseH?$X,@``OlMy)JiQXUd%H%s_R]~|*z)O?.*orH (|_6寿{cV|$G*2!!{AH -Fs`κ>) `6 I f 3l4NJ&($ ;ZL!9B*уf -),Eh4"3HiY|lY)oRlq` bl)aEd!-+iEmL䜘SL}^D4c6ILÈB'(Ybl񤭔FᏔSFMaщi/1 E QFb^8ƨ\N"H6eb$lʅ% mfDawAb2ai,lA `u$qm"qnF:m…ZR -NJYSbG K>X K. Kh xbl%.;*2$.p]2:J\FV)i x&$.p]1iQa k=nAk+qZghBfI, `=V҂U)Ŵ4%.)LFT ]f 8 b-*`*R3 l-q<]#qAޠ&234֒hj)i^g& ]E 0LSi4!q^,~2GL-)Y^n& R-V[ M^oF -$.:(v%.#Mk IXoZ'q%74֛X 6Sf ;ᢈiNS-8 M`N7p3ބG/n $^oFq3IJ3 Mx^x}&'&^q&q@z=Vq@{1[Eq@|y$nL,Sw 0"hq@ᏹnOU"&3w_K6z!m?&?{i1? kCft7JM9tQM1/FFb*tY fgf3֋AWQm=VR8oWeƞ60S}\-s'^Va4Wۡݘ뻟.oD>_wߘwMU\KbGr:ۤoMXj+(ܨC\:}[}FLD {Œ1WŠN$bkU?܊qO ~Vz sn~}ބ}u^T|vx;@C҉B' 8N5B}R]&^e5a`PvGtNӥIPmu% #>]9܅}y$h-aϷeɰ#fѠy@dDy^U%Ck~Xz#,?7pu 9OW~`we(ΛMSw4nOMϿ}X筰9q{*m&oek"דv^|jZ;v6VFLkKs%nݿ?dt3d"B_rȬ*\v;e Ia-CPq7:۲s_f7A!Xh],yI߁w\?8"c:oLKJ߷ma`qנ/^W'6e2ZuS gR[Q)X~t9 ] n.UD 3Mϲz+v$ .}8uLkÐ)neU2\W] Yqd!'MØy$,Cpjۺim7ن^ -l}[_G E%ǘy9@> G .*݆k3O(o H ޷.ǘiN_]ɫGN6[L.ΐCЊI;9<,&C'=_2ɽеđAs_(uyc"72ו md~%{nT;&b1@߿3[U}Q{("cs]y^gXCdiy͝ѱܜ&4e5Zetއi`4ޤ8+Q`saGd)c Qfю1{qޜ$hL!',fvb,V{uRPH*y.5V4 )X1t=A^ REc^3U%踙kLXꑺ9nux'Ϭ^j=Xzkk'\ ~c:cbWگ㪒C>n!bH'Dcvv(q'αrέ^>s^XeȠlOó Cqc:zXwxʺБ)]%m9aR9DA@SQ9Oot|UɗQ;rD>vDEпaqk;[m D혲F ZU#*}]k^'ilz{O;be~xy8"W YU%l@_Ё^X@okyz뗧o 9 @W;?pJ:v$t>:} -aLp!xʘy F<~yH*: GVB3¿T x'#â֕#tH@},t׿ˀ_Ahn`Cu Ň2઒:[q$t>:߅1xc-kS;t?re'rTZ0=yj|L67{&+-Atɦy-u4w! eeתwV}PxΠyyƒAZ~EN x# zlb61gN)aL=󕿾4a <7\_М>2sCSD|jb1?]ylݾ'1/ # bBvPeq`FƋ*osWzkOݰ/jQ>*P!4|(f1g/)B5Ňb3Kͻ({BT%?ssmәK^'|ZJE)ݫUZ[QcTR_rqE~K)7a*@r5_.E7kOŚ+-buJF4C1\@kNtc⣐/\}^+*Nz"4f&U*e~W!_YJxlVZyt+f2I tkb+idMۊTyעV@ -xI\Fke'~Q~.Lq.LӜ%o'd vwdC.cdmܺ34 EXM#ElҒ4yچݢb/9MePSS[_ڰ -]kiGi|i,͡p.ӒF˔|mg]t:(-Myle&6=ڮEF%-infۢl& \`j/ڂRV^#>`i*}nXZ Ot֗uΡe.-TˢfQurnubEmJ]*-E tc)jY;Nb+S,-^^ ]^.x[q;䬾ddծR"vl{mn-3Ջr^3vn:)W3`|d 33!?]j4w2G[C9" H MQd5>)ұp h7oKE;ݥڈ[:V O?b -endstream -endobj -169 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 168 0 R -/Resources 4 0 R -/Annots [ 170 0 R 171 0 R 172 0 R 173 0 R 174 0 R 175 0 R 176 0 R 177 0 R 178 0 R 179 0 R 180 0 R 181 0 R 182 0 R 183 0 R 184 0 R 185 0 R 186 0 R 187 0 R 188 0 R 189 0 R 190 0 R 191 0 R 192 0 R 193 0 R 194 0 R 195 0 R 196 0 R 197 0 R 198 0 R 199 0 R 200 0 R 201 0 R 202 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj 170 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] /BS << /W 0 >> @@ -2017,7 +2042,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] /BS << /W 0 >> @@ -2028,7 +2053,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] /BS << /W 0 >> @@ -2039,7 +2064,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] /BS << /W 0 >> @@ -2050,7 +2075,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] /BS << /W 0 >> @@ -2061,7 +2086,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] /BS << /W 0 >> @@ -2072,7 +2097,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] /BS << /W 0 >> @@ -2083,7 +2108,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] /BS << /W 0 >> @@ -2094,7 +2119,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] /BS << /W 0 >> @@ -2105,7 +2130,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] /BS << /W 0 >> @@ -2116,7 +2141,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] /BS << /W 0 >> @@ -2127,7 +2152,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] /BS << /W 0 >> @@ -2138,7 +2163,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] /BS << /W 0 >> @@ -2149,7 +2174,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] /BS << /W 0 >> @@ -2160,7 +2185,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] /BS << /W 0 >> @@ -2171,7 +2196,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] /BS << /W 0 >> @@ -2182,7 +2207,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] /BS << /W 0 >> @@ -2193,7 +2218,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] /BS << /W 0 >> @@ -2204,7 +2229,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] /BS << /W 0 >> @@ -2215,7 +2240,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] /BS << /W 0 >> @@ -2226,7 +2251,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] /BS << /W 0 >> @@ -2237,7 +2262,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] /BS << /W 0 >> @@ -2248,7 +2273,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] /BS << /W 0 >> @@ -2257,159 +2282,151 @@ endobj endobj 193 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb9-89) +/Filter /FlateDecode +/Length 5023 >> +stream +x]ߋ$~ +K/X` 3 w=kXEVJ̌T@ݕ!}T2;sI^~Xſb* ~R:Wb_@ɤ|׷ ~m.okw])b2)dRTPd)E!|JQtXV1Bb1A >+Eb'G1|rA WBR[AL^)sD zʼ31_Բ2VFdbbVVL1d!K(iel2”V! Ejd9V ,CXWV ieL(Y-+(9}Ld2LmZ%Ťym(jd dVF_+NJ9+&KN+ jd55 2K L3g |.S" | cIu(N%pԐda\ Pa CTаx& h˰ p˶8 xE  1ĥY”%`tOPB`8G K쬆 %ZY` L0pM0pkXa԰b|VlY%9H0p܂湁>Xaw=a  w!A V{yҰDÂuO@+rPZVKqebhXpTaA>x5,]GZpb5,] Aq4,3tղblYÂ,y @,Ӱ`l,P "phX6iXeװq 0m9`XʀAZpT4,]q$5,Qװ f6%aA,eԲhp4,HR 'ְ)TC^Â! B }dCDL.aTMNk,% RbW4,@.e2&x#ᒆe5,H`hXWdGd9Ȃ [D(sNÂ! A 2հ$Z+c+yfְ s4*jXiLHAЏ$A$?H6ekXt3kX3dkX۔|3iXP,dAħaAHa`ejXP\FYK7,Mxʼ-%L,!ZY4eoY|a Jof f DD. d7\ ȤwF p|[oH,gVW ,7K o5 I]4,sTW VQ謺l`x է~*|fNrӂݷcFw_|M+eGIL_nc(ڙȓ=<"D*8/pp>ȐXdvf;_d +4GJ_L?ސZ 0cO O|HbZT`'&^˫t4жNnxsz{+G ~??1u)V}H|k*vM3uvV\ϵǷHa;r?0  ߱[n9oo珟֖a0!occyG`A߱4bH6cWmN621XOQ4U'CV}S7zי̮c f=bp:@a5~=˒+bs="i ˊ +-;ܺ! PJo& {?21IvuPTG yLiiN&W`xgŘI +RC~fu8S/Ol"O(|<41˪՞{hݩ[)֝q?dtr<qjs?ix4ҙîg1-b*w ,&$rKc9)%F})vxFgsqJ[BqI7lbQG$yNc.leח>\֍HEx[]](E/+{ɞYs?<bxk٠3|#o.Z"jzxO6s}{^۩'3ӞI:Mdy,0RqG&9s %@INɧT[K$۸kx{- ^my&X⑺xΣ.2G"Ȫ?~<*,𾯁𹅿{T yIu?GSi4,ǧm$n7ɄƳ.޷yF/a{l=6J5Q1sÑW2ŏTntUs'5>^}_Ϥ{xNNC>f ZOG4r# BD:: C oYPf(Ɗ]@,/P[:w7s+Cϊt"s(v<؁?"hq-Oߗ*Gbn߸|nPcumkgDE^奒,i(Zy/r:CY#`{Xn=dQjHUAwlі' y!uFu-s'ȢAlA\R DHbv:R9wf0 R8իF1]φ0N0n?MYkr_tP"sS:ZJ׾_s[#|G xO5~0YN]HѺۆ!D(9ay$9or=|Ksvb*~l0Lx,cCwJY5C?D0>Q('A(?.nG}D63c=\o keZx1.h1p0r+w f{4Wb\Lr(QgI6qjl]Se:*7wt(i5A(;CͧQWˋ9 <,`4]9RGvAJ DO2sLڹęqNпR1Ib?t|T{%Y.]k +8r0]t78h0E釜=yӟa@ܮĺLRlF<\O=s^;Q +;ՙǝ=&ꄮx#nK:uy6NFr<19g*fKi@5"Z$+4\I1^dܣX[DՕ-" +n8-yb'S5);,q +n?T69"F=+[ +r9ȍ, W\*4}ݥ,[bmBj]>sйNO:_/薶7*צzh U5ԚM!^/ +[hwZSo\ [R)׋Zon-4MV+/"b+ifj戥qMk?"vKHJ` z"u6r,ԔPajV!+oPUgน,-WK'27y=H==6am`$픚U mVn:z*U<kkVau|VD[@w 94S~[9C΢=vrl֓SӸC+url%B|Zgq }u6tei</i$'QGGgן7?mC ߰uE=|Q$7Ub6s n^n`5]CPJ{bXư#fQ72u3-V,vI9NJvp2Z\kWRuq(e1o]el%dIz{U]ta\RƋ훮.*fwZV(B{z}gcBmިo=ݘPT.{wusZL%Eo5/lswʕ:Jk-*SLwQJ-XG:Ziz]]iz-Q Boi;ldVhnT^jRu^EDva ¿̝f@UO+./_#G.!m>s45JF]{: ;>uPP l_@YY`Vp/yÿy!]&I;I,_EStzas81 +endstream endobj 194 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb9-90) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 193 0 R +/Resources 4 0 R +/Annots [ 195 0 R 196 0 R 197 0 R 198 0 R 199 0 R 200 0 R 201 0 R 202 0 R 203 0 R 204 0 R 205 0 R 206 0 R 207 0 R 208 0 R 209 0 R 210 0 R 211 0 R 212 0 R 213 0 R 214 0 R 215 0 R 216 0 R 217 0 R 218 0 R 219 0 R 220 0 R 221 0 R 222 0 R 223 0 R 224 0 R 225 0 R 226 0 R 227 0 R 228 0 R 229 0 R 230 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 195 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] /BS << /W 0 >> -/Dest (cb9-91) +/Dest (cb9-89) >> endobj 196 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] /BS << /W 0 >> -/Dest (cb9-92) +/Dest (cb9-90) >> endobj 197 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] /BS << /W 0 >> -/Dest (cb9-93) +/Dest (cb9-91) >> endobj 198 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] /BS << /W 0 >> -/Dest (cb9-94) +/Dest (cb9-92) >> endobj 199 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] /BS << /W 0 >> -/Dest (cb9-95) +/Dest (cb9-93) >> endobj 200 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] /BS << /W 0 >> -/Dest (cb9-96) +/Dest (cb9-94) >> endobj 201 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] /BS << /W 0 >> -/Dest (cb9-97) +/Dest (cb9-95) >> endobj 202 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-96) +>> +endobj +203 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-97) +>> +endobj +204 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] /BS << /W 0 >> /Dest (cb9-98) >> endobj -203 0 obj -<< -/Filter /FlateDecode -/Length 4851 ->> -stream -x]K$9ׯ3~I!-1̀P/әU]ӋrZ=]a;#/"l]-~q/39凋5)X%pu  I%o]˿u՛Rwb2)d*`YG -+QaEgh,{޲Ƃ}VXb'G[V>9XÕykU &ӣ\|Qy <#21 Nc Y1d : KpVA4^,ɪgaw}aw} Py`  ynkX]>jXC1F]@Hհ^xћ*/璆)+v 2^pIc R,*k<YdkXH<4, ԰ ,3Z ࡑK5[3PQ d@JY@?l D ְ g/fְ gװ)fҰXȂOÂb0Y8xjXP\FYK7,Mxʸ-%L,!ʃ,2nI7N/B_XÂY7ѫSYͤNwC2i<."Өa.o"r{ ̒qfuz|:e`VI3_ɑI2GunLgi E<L>ST3s,s1S6?_~{._~RgڏGI _n1L%r>SGHeI7\L}2LAUuY]dv_ ?l "9vD}g7X /؉/>]0fh 79s~_׿qO_.w?Ƶ~̓6 )P֢Mi&[3%>K>O|FTvp hb!6@X Yx+*בDy[@x.h]ke[姥`(Un(Uy( [AЉLjyilGQ16Ѓ(~q)h@kURJO9 CDeu|0 zpaf^xk^*<;.V_fB*ίHlԓjH؞U99<ҜTMFoSIMf"sHJ#fH:[bQg#%*6,]t:T4Fe-nhڴ4PfyÛQ+m/:N5f'M]9 -}@97Ο)R5ɃCsyAaR#< x/U!FiqC?cDbN2eQvψ9" -wQuid|_ jk2;kr͐ء+H -lms=zݶira(YY .~9%c&wZu82u 5ד!"u+=LmoWҰwsV(s]ySZw/s}ƩtEW $՗G7̜d -]Gx/:X4)ۓ+t;:FIsCvϦA,BK/[04szqitS #WEE Ǝ0(HDu -9 - `*TyP[AM- Js\S`oܴ0"ʲLv-6@{:fFhVKVA])ˍ[c ʴW8vy;ݕ\lJtE}Đ acձ:1`, cw _g_(AvFw9퀌RDV#=h KeoZxldHc'ǪGAѻۢ;4/{c0^%Jwy݃uʭ-z],;h1_٦=JU=F},I{ٛF^}iVR_A~ -*d1DHŨD뜧eݓjނ/wT"R9`hX$.䜾!*FCMV$!B "ʎ{FDZ:QEDOlLpO5Sͱ:QM8xnoUC::]uyT!/dICޤ%}sOiω}&2Μn}y|S.ǖ1RӃ2I)W-,, -V[; +ek;wz=FH}CA`m{:1,£n[XxƗN qe}k{JCa*xX]k8V؝a]d};PWItGqw+:1\ 9GOrtl2zʹ1_},aꜧIIF/`äw}bt<9:X<*VrLO.'O}OpO%QwLNoKz5+YNnD'G0^l YԽvީYOXAr,/?T|3 eTH\'V䷋ -?HduE{$S%);},q -i~h2ԮVo7Vݖ,Oorx64]. -҉s<+吆D;n&#K9]ܠV֧Aܖ7*GZzi4U:5]!^/ -ۚx7bnĽ\iE-7R/窥,l{+G5ɷ& cR$G@5Rnzk%$t†fz#v;9^fjʭ04MדoP:U~pMJWMdlvFzZ8Ns١\Jfr*t{c e=&T%ud?+GmBv39tS~[g9CE7{رm$q'vy{7kul&v,i47`<[%IlAy?.y -^HN#w/v^͏{wl]GO&_y\64k~yng`o%]GP׹#1}8}7]h|nf}prT4ڤ83f|ĕ]:쇊p2KS rIzGUkdznC4^ oZ(B?=ZȱvhԷLt*˸>+m=ۢaQr1mtT 7F[ܴ9F-&SnO^J={:ZFMYiy-Qhi~:;dVhqݩ> -endobj 205 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] /BS << /W 0 >> @@ -2420,7 +2437,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] /BS << /W 0 >> @@ -2431,7 +2448,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] /BS << /W 0 >> @@ -2442,7 +2459,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] /BS << /W 0 >> @@ -2453,7 +2470,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] /BS << /W 0 >> @@ -2464,7 +2481,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] /BS << /W 0 >> @@ -2475,7 +2492,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] /BS << /W 0 >> @@ -2486,7 +2503,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] /BS << /W 0 >> @@ -2497,7 +2514,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] /BS << /W 0 >> @@ -2508,7 +2525,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] /BS << /W 0 >> @@ -2519,7 +2536,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] /BS << /W 0 >> @@ -2530,7 +2547,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] /BS << /W 0 >> @@ -2541,7 +2558,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] /BS << /W 0 >> @@ -2552,7 +2569,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] /BS << /W 0 >> @@ -2563,7 +2580,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] /BS << /W 0 >> @@ -2574,7 +2591,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] /BS << /W 0 >> @@ -2585,7 +2602,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] /BS << /W 0 >> @@ -2596,7 +2613,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] /BS << /W 0 >> @@ -2607,7 +2624,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] /BS << /W 0 >> @@ -2618,7 +2635,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] /BS << /W 0 >> @@ -2629,7 +2646,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] /BS << /W 0 >> @@ -2640,7 +2657,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] /BS << /W 0 >> @@ -2651,7 +2668,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] /BS << /W 0 >> @@ -2662,7 +2679,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] /BS << /W 0 >> @@ -2673,7 +2690,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] /BS << /W 0 >> @@ -2684,7 +2701,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] /BS << /W 0 >> @@ -2693,149 +2710,142 @@ endobj endobj 231 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb9-125) +/Filter /FlateDecode +/Length 4449 >> +stream +x]ߋ$~bU/~ÑB>?_Ꞛ^Inٛ*I]]%}U%t_rԜɻ=M%V;x&/E'%pvƐ6cӟ~s5_~P%g V]!&kX#f rCj bH`YbLb ՘ yA{AG%(=Y@.Q٥,UR dՓŋ%xEd '&ej +dA*&UvW%k^-l0` ^,j Kd,CNDΥ5fd"d !Ƀ,0!AANq€PIb@(Il@I^ C(B&"&p 8@a h+-0V|% x+ rIbarѕ e` p0Pc +0`$ B2Ƀ,Sa 䳅0 +0YXB) `d "}@AB w! {[X\@XbaAR34Q‚ܥ(CƸT-,]8* w`G D.1<R‚E-,@wp7G]Uk)D.`)XX/|БC-,H]jaAlaAzAc `a0l1`x]Oz n‚! +",,HՃ%haA D@Ƀ,֮r-Y8 r,,,@D*!6ȂbY)ZX$sXXcB>Z\ɀkWlaAR`[Xw.YX1# WȂba\+#Ȃ DYXPdA4haA YfC#-x3EP d@JY>lG Dc Gf|}SlaA'aq𼷰RAK7=MxƸ4T,!Ƀ,1nI7N/AP‚7ћSElNwc2Y<."da.o"r{,qsz#|9eVٜ3_͑I̲$snL洁"+L>ST !gY1,}9b|e~O_=L3eY&QH07M Mn"$!|M"EH,Γn*$\1m=/̄`fz2L`*N/Vr/og9 risUBRHcR\b'^/¿{w0o헃~廯?>[ ^I~C77\h=~=]>c=_߭\u#Uy>]m"C6:o ->$_+4@ %?0:u$,R賙u6D*d4tg qL; nvƯ Ip;GQ3FJ71\NAcsQtף@MoaFngØLosh(I*e_㘅u'q׎C\s47,X0[})TJGXIJ>zf_=*4-w6[}ڪK-i +l쾫}uΈ1#Bk16Kc?^,\ Yi>߬iYmmݖz/Ȧ+[{{-snQ~-4"|mqWEFx]iJ)(qjF~`}Ucr)}K qi>o]U LU1v9j7}b^W7,]&Av$4{~sd]7s-z=ྍwU9Ӣ;Kf*]9qa99AY[Qfc,µ,<,X"g9+a>Hp +4+,bHDgܗ5fz%[Kʬfg.e=cS^Ns)ѐ5Nep4X~+u|J9C45#ԢG9ݲY6*ziRoԜOzПNjO/?Ot"}F홗8D^ݐOzdmԆ]ݖ9!UӓqtFҾzADDd}zh&)|(15A\R!xMʆvEUG[ِs#>p[RMٚj xvjl%A = 5:@v!֑Az:bTR6/,]KWAt4S=뚜HZ~O'AtE~>l VغHN.~/ 5* F TNU䙾.g-WMtlvZI#=uK$y);r}voWVAe=&T5zd#7!p{W~^9c%{.Աy$nqݡ7dK֮_Mr-7`Dn( <ǠgbaDom]x-BydzxIdLe)~<e`o%#(uHr]7wO-@fqؗKn۰eפ8, |ĕ]\:púHS;xz_FSk'n)"yoZWBzxj"6ڡSGj0v<]e9<c{ %GjYxSiMpobn2ZSR1BitҕGnx=Zű;RǒŠvR޲w1d$-_ū¿׌KlUL3T#<ᨅ2*/)CDR)׹?q=8;N}&:`njwjx)Y`_L`扜~5UԿogO4W'Ͽ2 +endstream endobj 232 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb9-126) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 231 0 R +/Resources 4 0 R +/Annots [ 233 0 R 234 0 R 235 0 R 236 0 R 237 0 R 238 0 R 239 0 R 240 0 R 241 0 R 242 0 R 243 0 R 244 0 R 245 0 R 246 0 R 247 0 R 248 0 R 249 0 R 250 0 R 251 0 R 252 0 R 253 0 R 254 0 R 255 0 R 256 0 R 257 0 R 258 0 R 259 0 R 260 0 R 261 0 R 262 0 R 263 0 R 264 0 R 265 0 R 266 0 R 267 0 R 268 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 233 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] /BS << /W 0 >> -/Dest (cb9-127) +/Dest (cb9-125) >> endobj 234 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] /BS << /W 0 >> -/Dest (cb9-128) +/Dest (cb9-126) >> endobj 235 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] /BS << /W 0 >> -/Dest (cb9-129) +/Dest (cb9-127) >> endobj 236 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] /BS << /W 0 >> -/Dest (cb9-130) +/Dest (cb9-128) >> endobj 237 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] /BS << /W 0 >> -/Dest (cb9-131) +/Dest (cb9-129) >> endobj 238 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] /BS << /W 0 >> -/Dest (cb9-132) +/Dest (cb9-130) >> endobj 239 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-131) +>> +endobj +240 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-132) +>> +endobj +241 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] /BS << /W 0 >> /Dest (cb9-133) >> endobj -240 0 obj -<< -/Filter /FlateDecode -/Length 4260 ->> -stream -x]A$m賁%( CMbdfX琿%ݭ5j̫"?QJ?#H-o?~>yWǟfa K:ťPOJJM \ݎOst?()'U VJkX#|*$18F1X1K[VX#T V#DM ^H.CXM^/h\.Rx圓X<,`dI[<$eBɃ,Q -YY"S @.1yg,^%0 -"KB-^.oɃGHYOAD>Z<,HTD o)XYb,l o!@̐ŗlA<).YKq\#[  QRȂX\x1X@@$P, 5y*[X@D%2YX@@[FokC[X@@\ ]ZX@\vZX@]{rĒ-, .q0p5MdA(YX] -XX]QVuE ܍Ƃ!$ ^1haw#la:x3B@da" p7T O\-,H 0ɫ.h[hم ,,H]XXwQ #X !YX 0uM^uXXhaFaHbCG -GjaAbxdODdg=&D ׀5|Ha>}d䢄(@@(8ZX]-%[X!‚AH,Y]*Y(F J,,,@Dj@mN 9?`ȂH laAI1hMP,,\ p^` J,p 09-^,-,@ ^H,-,(efoaFh%j^bapv*ZX7LHi `G'L~04AJlaHXX Yo|XXP=dAgaAila`<-,A0ߌlaRbaA%&xV:,T, !Ƀ,$7N/CX‚7o"7Sb ,pi7o" -3):3c c2^VxΑ̤R5 -ff &\Oc*;R%+܂9Vo?b=N?fɔOubEbWny-D^$Q!J݄ 5Bb(p["E*s@0b`*ʶ]kJ]y -节9D*_CR4@F)Q?~8/~;ȍќ~:_O}Mx;o#@+O?~a9̵ag@RVh{*/)1ftyӪ|e)qrKo*w{F7ߴS2Ac[{z.SZ˚=p׊PQn0+N9L_/(/qQ>Fʻ6:o4@w xK^PA"D 1W8-2 -KO+o_C u3XC6z ]K ̦c~j:1UT}A|k3@6\oxnn&c.b*暫ssEUYFoǪfg^wtN)9+Ϣ:1m1<28*ipr9¬:sX =W8ֵMn׉HD{}q"rlHa9cܗm=I̘GOJ:\tO9 "#+cGH |GhjEuc k+d~2Ye۠Sl׸g&uc,\УXE$. -l 7Y8jNĀZ_pɑhw>sV8_3#,1dèzwsb83UBl 7Y8#)JJtY(Zl 7Y8fHG51i҈Yw\v-<6\E“D~;n0-}JLu|Bu02 GsslË~09SUcW=6UtXfEˎpI>d(O -bҹ -^_Sݯ!/#.m2 OW՚n{! B_pa1Y<5q!F:IhΧzwa5}tݙ]jچfÍ\&zf*1~Q~3cӸ4\{.x+)Аc@-fF{oXȻ$Aǵ'4;=e NL#0OWaYtQSUcb\a{$e*X0 GO+&0۝r %ϥܿVn2|nwqT!ksU:1Ģ;yܙq@}\M ڙߑ6Y0]>d_f68Z/>BXcoEoGt?-ҷ/Krh^M18=Y3z΅߾_cS_*~۷OVZ)=}lSy-g˾Lʫ ^S^U Z>/1O= -Gӥ,iUoXwj.GKz=LSҋǛϋa~:xAkIOd5N^,]:s%)9^pJ26Z?jznahwW/ Dᖬo]Xzj8Zr%&3y,=ptKCsYnec vGՅl,9Nh&U -ljڍhvjj%A 7=q`jz҅(#q/W[9v2˭OKRjmDٺ:IWA[tRCm M0F`}!7o褋rs2k}; sRԨ8S0(euw8}GرuGG2==Y&zr#vA>85od:w$M9 IoWZ̗f/^͐դ:Gې|;- r*f|(n&NLc#]*? mk0;>і f|0Ѻeb"Jީ#R;TZn9МwP G=\c -xw3с*[@F5FO,MVkjYXL-SlԿNUh|SVF-Q؝v~+cI1hyݩFmm<o-2[tS%{w.uVd0lGbP(PxzpaR]q6rcK0c"_"`Q.f>OF -g9Yǟ5oN zE.>)%Ւv  -endstream -endobj -241 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 240 0 R -/Resources 4 0 R -/Annots [ 242 0 R 243 0 R 244 0 R 245 0 R 246 0 R 247 0 R 248 0 R 249 0 R 250 0 R 251 0 R 252 0 R 253 0 R 254 0 R 255 0 R 256 0 R 257 0 R 258 0 R 259 0 R 260 0 R 261 0 R 262 0 R 263 0 R 264 0 R 265 0 R 266 0 R 267 0 R 268 0 R 269 0 R 270 0 R 271 0 R 272 0 R 273 0 R 274 0 R 275 0 R 276 0 R 277 0 R 278 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj 242 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] /BS << /W 0 >> @@ -2846,7 +2856,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] /BS << /W 0 >> @@ -2857,7 +2867,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] /BS << /W 0 >> @@ -2868,7 +2878,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] /BS << /W 0 >> @@ -2879,7 +2889,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] /BS << /W 0 >> @@ -2890,7 +2900,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] /BS << /W 0 >> @@ -2901,7 +2911,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] /BS << /W 0 >> @@ -2912,7 +2922,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] /BS << /W 0 >> @@ -2923,7 +2933,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] /BS << /W 0 >> @@ -2934,7 +2944,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] /BS << /W 0 >> @@ -2945,7 +2955,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] /BS << /W 0 >> @@ -2956,7 +2966,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] /BS << /W 0 >> @@ -2967,7 +2977,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] /BS << /W 0 >> @@ -2978,7 +2988,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] /BS << /W 0 >> @@ -2989,7 +2999,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] /BS << /W 0 >> @@ -3000,7 +3010,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] /BS << /W 0 >> @@ -3011,7 +3021,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] /BS << /W 0 >> @@ -3022,7 +3032,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] /BS << /W 0 >> @@ -3033,7 +3043,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] /BS << /W 0 >> @@ -3044,7 +3054,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] /BS << /W 0 >> @@ -3055,7 +3065,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] /BS << /W 0 >> @@ -3066,7 +3076,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] /BS << /W 0 >> @@ -3077,7 +3087,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] /BS << /W 0 >> @@ -3088,7 +3098,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] /BS << /W 0 >> @@ -3099,7 +3109,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] /BS << /W 0 >> @@ -3110,7 +3120,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] /BS << /W 0 >> @@ -3121,7 +3131,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] /BS << /W 0 >> @@ -3130,159 +3140,146 @@ endobj endobj 269 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb9-161) +/Filter /FlateDecode +/Length 4154 >> +stream +x]ߋ$ ~￢-ٖ!C `H!w^SuL{" 3%U*,ׄW%<~J:ťPg%PqX_c_~wN8FWk!,&W V2X)Rb+WbAT85@ ,` .YbbAPS1XC7y3S4x! gRc5yP#rpHUsNbK%fo ! e&D)d +dN5xYкA}x\l*x^\O. x!I&#b"d>UYh0-p"Q15w`dɃ,01C_ da@,ql@r,, +DK! bMs-`yȒ8[H@0 rAj w|&Pqoer$.:* wba0ޡG$n b$.da ,,@G5y*baA腝 + )XX0vqZX>YXkkW2yk:k^a{ߘ3"4eDQtA&"ӑq7qDe=t.{vk9xFGno~(2EMAJ%S˨;-Y˪nOǷZU ]h{}Z;":)m# R-WeNUٍ ffx,2jTS9I*$HW"pn)v~ SobZ;,H>tf/v~T3:d'SmU=peD;>Yg?+ДpNxIR>\ti_0-zyg|8-/<F^hu+):j#bWB|YMi f|wQeSk6}k{ aWycy>cM vXW]ƁnXp~ SܤM<(:r"-<p|+Ø&TCXɼ7I_Љ429ќEiΓL`6/$rNQLuٹ:Q-u'뺹{g @⻋+[}a6*uFoEu" t_# Pq'&P ]?ס prx:Rqs.F:~0F.FXtyX:QsOs +W3l^҅WER-8F 8}޳ x͘.# ع:Q}Rj&oRo'kxq}js/w9#ĄyOd]9We7j^W¯1(8F䏄 $Ip5v ]oob_j"UN`ԕE#zj÷|XLFSctӐ3)=;-l>yfKeOSe|,TC^NII>/}o=)zԓ9ް($@:I*N\?^Y N䧃]D$+{LZ\,IoN}OJ5s&{d=Qr%&3 y,px+1]𸕬;[?ns`V6/x,]RLnմ} TJvpAz<į|F6?XM95$j+gfRTdZWQ֦NoE|S%g@5+Aל\ӊ>7io'_J9OpFG *R*,&'WC7;y;갥e-;+쨯 (KwmzM<[r譮š~:VD߄VrMiC^LUahw%玝O#t=;F|\:6$kӗ}և U0J^ai!7o複CY=EJQLAO7p7|};NԏG"vlݐǞL•IۈmbWrlj1xku{+:i@@f -@fO^!=Iup)+.8WZt8TxS\d1AWy4鳆!KZyvmyB`/sZ7B^gsvhԧ_Ll*-y{Zv7]5EQrVXC \mtZ\ F5x$_w=ss1Z`jF:t +EZ!aHu^hc`DO`یV?GtuJS1œYy _M!e%oO! +endstream endobj 270 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb9-162) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 269 0 R +/Resources 4 0 R +/Annots [ 271 0 R 272 0 R 273 0 R 274 0 R 275 0 R 276 0 R 277 0 R 278 0 R 279 0 R 280 0 R 281 0 R 282 0 R 283 0 R 284 0 R 285 0 R 286 0 R 287 0 R 288 0 R 289 0 R 290 0 R 291 0 R 292 0 R 293 0 R 294 0 R 295 0 R 296 0 R 297 0 R 298 0 R 299 0 R 300 0 R 301 0 R 302 0 R 303 0 R 304 0 R 305 0 R 306 0 R 307 0 R 308 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 271 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] /BS << /W 0 >> -/Dest (cb9-163) +/Dest (cb9-161) >> endobj 272 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] /BS << /W 0 >> -/Dest (cb9-164) +/Dest (cb9-162) >> endobj 273 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] /BS << /W 0 >> -/Dest (cb9-165) +/Dest (cb9-163) >> endobj 274 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] /BS << /W 0 >> -/Dest (cb9-166) +/Dest (cb9-164) >> endobj 275 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] /BS << /W 0 >> -/Dest (cb9-167) +/Dest (cb9-165) >> endobj 276 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] /BS << /W 0 >> -/Dest (cb9-168) +/Dest (cb9-166) >> endobj 277 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] /BS << /W 0 >> -/Dest (cb9-169) +/Dest (cb9-167) >> endobj 278 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-168) +>> +endobj +279 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-169) +>> +endobj +280 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] /BS << /W 0 >> /Dest (cb9-170) >> endobj -279 0 obj -<< -/Filter /FlateDecode -/Length 4524 ->> -stream -x]A$m賁%( ! &1fX琿-ݭQ"%>*&=~ G88Z2_~>r$?K3tKfI矕@ŕb]_O鿷}9Zs 䊔`@+%WJL`kX#|*$18F1X1K[VX#T V#DM ^H.CXM^/h\.Rx圓X<,`dI[<$eBɃ,Q -YY"S @x<KUM^K[^%!/d0`\ ^,٧j K"-AƏN$*"l:Sx XAB!/ق da@,ql@r,, -DK! bMs-`yȒ8[H@0fɃ,T ,, ,2ܲ޲BLoaqI2[X@\R촰RK[X]"4ylaQ|FXE ܍Ƃ`$ 1haw#la w!N {"YX\DZbaAgi R 3yՅZv!jaA"P  5ZX-p7-,H]  H,,@|suM^uXXha$1yc瑇ZX‚ ‚ Aha0m9dx]`aT 2pWæ(!! daWKCgux A.lakW%B‚! R }dCdɜTf JʨǠU6y^(8XXZ &x钅 -Y0U,,@(r[Yd[XL,,Y ZX QPefoa"4jI:S,,NSE 0MPi)MdLXXh,,@beɃ,XX Y7,TYYXP}v&[X{ jԛ-,zS,,Qo3mf2dIHQLdATy LB txԜ fDFo. ֛\. -dx]d\Dfk -3)Zqb \2^DbxHDe)\5@X3xs &\V% w(RKVL FvkivY_O{fY)k?ON:EbWna"/BQ!J] 뢛 -Pp[C؊ Udff<B(۲GJ~(/a59.!)n@F+QYMite_r#3O7O ~O/0~\.Ïk_/\k{n1??GHԠ+2\s]eoa%ԞHǐJ2WG Y-BZXk|NJ Vf4X.,DZ7] u9Q,”9 &쿳,G -FKXs}fTK)Լ_fz~bΞn4WqVn}Δ_mm^6a7×avQ2UUw30s'(8 Umл whZQ&Qg9ԮI~>Q}ԊE"Y'yF|76ѭC0;[7 $h\>18*2OA ?NkY$fwq@ b -pcFULHQԣ~US9 DY0{o1ߎwˆ(E׵tRJ\:~a̫;$T*s3淩:@u)_w,&]~>Q^JN)oETw C^}&Fḩϻd"݁o9Jkc9PH1^.yM9."h9sOFzI5ܝ$Ou9n+fzt\W@H3 R,GZ#ǚsղ^+~&}5xNMΨmMr Wqͤ(=-Ǥ@LQRz!ݮޛ+,ɰn)$QiqqԘ573hWSTu7+˳Cؤ ?yd|:>t~f>1>Nyλo.{2j<~}c=E -?T(9y ^ħϖmlҍUul28홂}:@[Čf[GIୈ\?\H(ӳE>Q䫾߽BFaֈ֯sWb Z7Ysd;_>£l3CƸ0*/^DF˦G It=8f=[-b}`&$f.VyL9jd:YIx&}!:mUf0ղV%ϊDStg尝B$JTM82C sD", Nq}W{3cݡ 14x{) ,轸Ɠeٞ!W'|;Y,>y|qT9P}q>'f⼼NInL6 Β]NBS]cIrX~`WPwm4f}y>8`tvʨejѕ+D;E918#& ~l᥅څ0f!=t{ƁwA_0#az>Ot͠06V0-E#nCl>3GBŦ*pq -'(hܐ1F*=4rXc7s7L!fOCq{jw ,xS~/Ɗ˸K_N ->uiҜ3n{OZ!JVG.՘ 'ǥE7)JқAg\#븼09Nym/Iz=tg=Ij~G'3HB֔~O~=lI}Kh/@%%kRS6?nz6.kW꫗DᖬSJs|*wQRn2cuSc-[zCkmb}T]2ҞjR6T.hvjj-A w !t`5=BH vRTdZWQVW'7hԢsS%g@o {oȯTi -Dd񫿬T=V S+SyK)tzUHuҀ.*.쨯 h[wmzM<[r^ -aM?+GoBv+9uW~ݐW9S0{ܱu$nG -vy7xOVחv}*@a%0lǤ$"o%̡Č_g -zB͟N|vw[71y2IOydm78׼v+#hܑV]74_vZ̯/ԾnCz_ -> -endobj 281 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] /BS << /W 0 >> @@ -3293,7 +3290,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] /BS << /W 0 >> @@ -3304,7 +3301,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] /BS << /W 0 >> @@ -3315,7 +3312,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] /BS << /W 0 >> @@ -3326,7 +3323,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] /BS << /W 0 >> @@ -3337,7 +3334,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] /BS << /W 0 >> @@ -3348,7 +3345,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] /BS << /W 0 >> @@ -3359,7 +3356,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] /BS << /W 0 >> @@ -3370,7 +3367,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] /BS << /W 0 >> @@ -3381,7 +3378,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] /BS << /W 0 >> @@ -3392,7 +3389,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] /BS << /W 0 >> @@ -3403,7 +3400,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] /BS << /W 0 >> @@ -3414,7 +3411,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] /BS << /W 0 >> @@ -3425,7 +3422,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] /BS << /W 0 >> @@ -3436,7 +3433,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] /BS << /W 0 >> @@ -3447,7 +3444,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] /BS << /W 0 >> @@ -3458,7 +3455,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] /BS << /W 0 >> @@ -3469,7 +3466,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] /BS << /W 0 >> @@ -3480,7 +3477,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] /BS << /W 0 >> @@ -3491,7 +3488,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] /BS << /W 0 >> @@ -3502,7 +3499,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] /BS << /W 0 >> @@ -3513,7 +3510,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] /BS << /W 0 >> @@ -3524,7 +3521,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] /BS << /W 0 >> @@ -3535,7 +3532,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] /BS << /W 0 >> @@ -3546,7 +3543,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] /BS << /W 0 >> @@ -3557,7 +3554,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] /BS << /W 0 >> @@ -3568,7 +3565,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] /BS << /W 0 >> @@ -3579,7 +3576,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] /BS << /W 0 >> @@ -3588,158 +3585,156 @@ endobj endobj 309 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb9-199) +/Filter /FlateDecode +/Length 4927 >> +stream +x]߫帑~?y"<,@``B=73 ˝d߯t%٪o{%T>}e5~3'9R1/_oZEX]ow]TPT1{6}[s'9R1Ũ IޫBR0 +3|t֍If3IHJ0\44&eaqR0G!hab ΑҌW4kTHf1-"D+FJ*`Hix㜖`[(`M[,Z' i ]IL-:h#eR>'Ĵ4bӬ'"- CJiAbZBb#qb)0%.+v$.H3Nₘa T̥4[dK\OiH\,l7(qA Qf`F,Ҝ83I\\P*J\aHL)Є~l"` y'qAJ$qAJj+qf kO€b7Y8Ҵ x: 0.9Ld҈7 6Sx3J\lpQ4) x$b fnMx@x3]LRxi7JLNLq&q@z=Vq@{1[Eq@|9F `&"ULH4Z\6_cnSD93EɌaטed{o{~]Y)[~ O.p`y،]RCGUX?F܌4m_dX683\_/" zX,[i +0{|B]0;Sa)*b_ e܉WUt0zVXݘ_nOO?>3oW7zȽ̃4orᙸϷ?~Z"n bf[:‹SP(kg[8)M_䇎[䙆ɞ׾J>\KpKt&#T.K)T7am؆~2GsVbhÄ߲s:iZ+֑s#`hj5ihLsYd?D9_N|ûwƜu:#8> *-iˎ-OMH:PT0vȠH`frrP^9ˀrTj\ +bۂlnE3W#4W Ž bac~]9 4^#"m'܁%3yZud^gR:A 1m B pp_\(BՃd"^]!<ÈD%n)t?Eg@:!4[ȸuΣݏ&;^X/hόn= z B &^,PnWؙӹx"1B3*N/@cbzp(u ީ= IPWVWg=Iw7$1{u<Ǵ *Χm2%MO)cռQ{XowNQ)H&ٲǽb&u,Y8YLgkU~#e3eN_9ҵW@J3z{s0Lef``HI[Z~|9";||& W~;yf#¬ϼޛ_Bx} ibϕgzD[;v(YAɔy0GJ +7sHGޤ]8YW@2k0ɍǍS~`@@ +^(΃jN2j]篁fY^pݵ +Z@i>%AJXȸߤu1dgBiUiF x~1O߃!^ՠ !0+\z΄o{tF8.t`'tA寽8?qFОh7&IpO:ׁ'o Lx + ++7uhNhq8ws:p,~1 uԿFpݨ}hzQ-o9%z rR:Wc%\/2׵g]m}ƺ_s뜸 nA`iCz~uYNUCe5: 3@kOE=[罶IOЙ_>hB 买Xmk:ⵍǼ6AP篓:Tv]9<@ -lͳhő''Ԃ WBmR:P#~9s&w ]=U mh 6hڨ4oǀ8a59@[zhy`cG|Q&+fms_ԹO>sҺkzY6ղ[m>1j[ *Miޛӹ 0~g޺3vf#7jc>A`p>0"AIṀBlX,lcҊ_mxZĎ3kb=9m6syvbgn9Z^Na~K1P!f2ۨ[D':XӚe<`Bgv_$g>rɆWO\VF|yZzV}m m}"cԞ Z!2Gu7s@85 UӀ<C[y͂ {s|i6pA7syvݜh]A BCn\%6Sޚ &uܪвˆDpaH0j =Yrfl0seo9P.t`.5 FcႠl2!1|2=Owa5sX b8sѺ+h{(Kn.D'Bof3['>Z:`hF홀J& +Z߃C6gw`Ѥu yꇹ2ݪo`euh{XǑFFS">gtI)[d|@ZzH WN +8sGێ5j{K`fgeӟdO{7r1Y,$ g2'XhX3o߷DZ%O9Q<+o+)sDބ~ꮺ&rkCXMtݿ䵱= V.J;IKQK\d/9kO&KkaZjDo71߳4_{*\) j FOiO0vcDZ֩Ío7~d|r/ԕ[I74iLKSah.2>}PRfqRv*YF塲Zw~Ac$-gҭk]u*yŦ–\ bkb_7;}^ʂkM*wX{SLln+f觥& :a3 čFߋxkdҌvLse?ׄڙHN +#ѥnIǸq5;#eޑ_'tE-Y=Xᖎ5hN+8c\ȩCEv6/PğڈK:e%O +endstream endobj 310 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb9-200) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 309 0 R +/Resources 4 0 R +/Annots [ 311 0 R 312 0 R 313 0 R 314 0 R 315 0 R 316 0 R 317 0 R 318 0 R 319 0 R 320 0 R 321 0 R 322 0 R 323 0 R 324 0 R 325 0 R 326 0 R 327 0 R 328 0 R 329 0 R 330 0 R 331 0 R 332 0 R 333 0 R 334 0 R 335 0 R 336 0 R 337 0 R 338 0 R 339 0 R 340 0 R 341 0 R 342 0 R 343 0 R 344 0 R 345 0 R 346 0 R 347 0 R 348 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 311 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] /BS << /W 0 >> -/Dest (cb9-201) +/Dest (cb9-199) >> endobj 312 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] /BS << /W 0 >> -/Dest (cb9-202) +/Dest (cb9-200) >> endobj 313 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] /BS << /W 0 >> -/Dest (cb9-203) +/Dest (cb9-201) >> endobj 314 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] /BS << /W 0 >> -/Dest (cb9-204) +/Dest (cb9-202) >> endobj 315 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] /BS << /W 0 >> -/Dest (cb9-205) +/Dest (cb9-203) >> endobj 316 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] /BS << /W 0 >> -/Dest (cb9-206) +/Dest (cb9-204) >> endobj 317 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] /BS << /W 0 >> -/Dest (cb9-207) +/Dest (cb9-205) >> endobj 318 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-206) +>> +endobj +319 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-207) +>> +endobj +320 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] /BS << /W 0 >> /Dest (cb9-208) >> endobj -319 0 obj -<< -/Filter /FlateDecode -/Length 4985 ->> -stream -x]MׯI ~005VX4c`~U*Fg1[9TCRg$#H&S_~'ZĘח/\Ÿ5Gw&jet]f%$g^e\YRF뿾p%&!ɹ%㼐GLIJ.XcǤ3lNJ֘($EA6h0A[) f䂐F)1 (ki-4IbZ@FJ#Z|i)--{4 [\RZJsik[, yB[L $bP;IHblQ^i)-RVLKHS11(H4lFAH3+4H)`ŏpbzM`1i/1E/Qz¼$q aXLF%01-6h$X4ҌlqKL@X\1 P- ql1$. Z$. ЭUIK\@[@0SI\@`\J\@\@)I\@\wJ\@ ]t quy#qvF/qwj%qASL-`Džt$ ,x -X.^`e11* ,xDe%.]0iaA$ ,x8<4rwSF 5x Do -q;[@`G! PbH\:a4j1y xWG4PBE-/$qb" x%./Q #&) x~pX4 0-ZbZZTQ- 0 -/*IĴHZJ\ޓ,1 P4AЧ.ʀ)4ha) THx.%. `#qvI!x |RH'N₠ p,1 `%.c$JQ`` #qA0.}l\xɖ 8x *y"t `( Z": % `Ҵ $؂"q%xR-p%.4%. (+ 0B#DUKiVq%./*J\nHL)Єh~l"` 9+qA(qA(#qf )O₤nq)%qA_r%.Ho"m"f Y࢈iNS-8 &IJ$+qA(q ě)f .4.ýs"(.=}֯ K[&o*!U6smS8`}3sa}r=1V6<Zʨ=47ƾA{m:kdhguV{F}^(^ -| J 9x]⑀ -}`PkgОﲲF'oA͛9@-`PwG:j]m9/cξmyl@lA{'F-k!:׬76s>a呜hy``>L߀%zK:灗 F#nxfe5>σfcy4ǨoC&E۾Yޛ90/LG+ o.w2ߨ0yЂim`7t#`Efϊgz{a}|%Բ:j. -[3<-8ls:UO[(/xSkA!Ce{ml%ᚷVͮL`C=ܑ -Powܳ.0j[`E+ލoT6 9aO - _?Dh>j1jτ5Q1NQ4cFQ{F#AH^{ &w5s Bf>Bw)sk+˿;~~6tȃ=܈څ /\j\N{).70jO1T9I I}5S*:rP6qJfah|Poh3l>Ǟ9{'DF}"<.;7wRWw݉-HP .Gc-]L- Xz=O 87^>![ ů-k_S# q++!*B~^V~𗒋Hxxa~3}E/yQz/YA GLYxUxσܢR8qiXe5>i+Ƃ^b~z w1/.tmXyzQU1'k*ma1:4kBӜ[— nKWQE`e圥Ali'Arߩ\4%i5M3lɗr>ArKsBj5_MPX*^utgG_{mx — oįܮrrzr8* 1Wf U"eYѶ@RMoq_IֱR ^ -=HQvm}騄L%wNTY#)$Uȣ낺"f -SlnWŮ@W;]Nyݕr|mš{K e죘M2|a5 PŕF_Wq]kd҈re 9>'ߛk#}?#b?q -[­qR_+m W5h(1 _۪*眺0.:lĦ@hjjm_j826u]R~8Odp>.cM:$_"qY됎TkE\ⲹauf2 ۛgmj.7/:̶EgM>˫h eZV~wvs`i"}mXZOz2:ɕ;oR5}SFu-lwbƪvڛ,nB,+%ljY8OQokڵR*ѵ⇼\nDr-C}:Us_2 -2j9){y6a!z!=}0[ ? `K;D!?ll4vlq3ycD*h ^'4E޿&[#a -Ҝfp6}"\Y _ -endstream -endobj -320 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 319 0 R -/Resources 4 0 R -/Annots [ 321 0 R 322 0 R 323 0 R 324 0 R 325 0 R 326 0 R 327 0 R 328 0 R 329 0 R 330 0 R 331 0 R 332 0 R 333 0 R 334 0 R 335 0 R 336 0 R 337 0 R 338 0 R 339 0 R 340 0 R 341 0 R 342 0 R 343 0 R 344 0 R 345 0 R 346 0 R 347 0 R 348 0 R 349 0 R 350 0 R 351 0 R 352 0 R 353 0 R 354 0 R 355 0 R 356 0 R 357 0 R 358 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj 321 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] /BS << /W 0 >> @@ -3750,7 +3745,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] /BS << /W 0 >> @@ -3761,7 +3756,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] /BS << /W 0 >> @@ -3772,7 +3767,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] /BS << /W 0 >> @@ -3783,7 +3778,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] /BS << /W 0 >> @@ -3794,7 +3789,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] /BS << /W 0 >> @@ -3805,7 +3800,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] /BS << /W 0 >> @@ -3816,7 +3811,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] /BS << /W 0 >> @@ -3827,7 +3822,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] /BS << /W 0 >> @@ -3838,7 +3833,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] /BS << /W 0 >> @@ -3849,7 +3844,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] /BS << /W 0 >> @@ -3860,7 +3855,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] /BS << /W 0 >> @@ -3871,7 +3866,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] /BS << /W 0 >> @@ -3882,7 +3877,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] /BS << /W 0 >> @@ -3893,7 +3888,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] /BS << /W 0 >> @@ -3904,7 +3899,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] /BS << /W 0 >> @@ -3915,7 +3910,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] /BS << /W 0 >> @@ -3926,7 +3921,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] /BS << /W 0 >> @@ -3937,7 +3932,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] /BS << /W 0 >> @@ -3948,7 +3943,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] /BS << /W 0 >> @@ -3959,7 +3954,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] /BS << /W 0 >> @@ -3970,7 +3965,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] /BS << /W 0 >> @@ -3981,7 +3976,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] /BS << /W 0 >> @@ -3992,7 +3987,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] /BS << /W 0 >> @@ -4003,7 +3998,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] /BS << /W 0 >> @@ -4014,7 +4009,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] /BS << /W 0 >> @@ -4025,7 +4020,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] /BS << /W 0 >> @@ -4036,7 +4031,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] /BS << /W 0 >> @@ -4045,150 +4040,150 @@ endobj endobj 349 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb9-237) +/Filter /FlateDecode +/Length 4954 >> +stream +x]]6}_ρ(J >$,w}ؿܖ,[nΐѩ*IU%gTJ9w}rUM%VSO?.*orH(z_˶_]1Wr8ˑ)F텬,mH^h}QŜ,ᣳϊP,MBV䢡>+C > +YFCcvg + YB6yy&Z)H7R^V!<]|F純](B]l$Eb;YKJbtA)/99'eSgW>i)M00H! +y] 2&spYGV!lm\ƧMC4Rm *Pw#PAAvNy/݁(K6 +#ɜDw|V ACW^6N8ˬj O)aW&9X^f@9>]W:1N@h:wNeiAzdWuY1 ;YR ʜ8 kx"pVoڙj 'z%vyl-2k8(sangoU}8$3gy:KkwE|d9h>Z6 1Øg|&Voke '&>/!umX'}`.:paP<3|>!}&V1v3fC *h@{b20coֺ`M@ڰW6ւKz=yԑ'L"mP<`㧗"_`sc&JM^&J/ Jؐ>.he{P<ʀJ߷&J.Ke?u 'uz=femaeu]Zs|o,g_9$:O҉'[~ <7D=9շfKl.2ZiL4p +^<8+݃ӽ(uV 06Ah. +Q$c2/LX*mMB}l=.;s;p(N#p{cpExA)ʛaCFr958'pj652ĦwmhYz=oS+v+lZ==&rְ^˳*]jE9K;-P0\<{P">k,,Z뾽u_A~&򫼮nB4!Ldħ"5 3RժoY4q?7oԞҍg]6a\)}t>T&~7؜^)K6} /Cd1(kɄ5&ƇhP}VD<8]IN/my 1@'k~c Jo Ӽ_ru4Æoꥏ.A~Lde]AL0*= oR748K `P8"0(syPtf^4<][Gꥏ=%mWD. ʜPr?PJ7sW>G{cˁ2S `CiC"SV'.r͋,,w{6:lVn~ߺJ_ a㮗axXAO:$;@{|Olnu: ŷۏ_z~l3IqVmL^3uޑ>6[-#I')xvb.40_.u=2oߊS2nzo9!Lu)M Ty[\+'_~Z_}w8rX5,$B2>kN7%EU5qеe +ɼw$>Q7-FR֟9mיfKYK|YڦRU]XIF\S})Yq^.B׺TqoFߕKLH˥r͵:RJh.=@Rx!m959\'2u.§׋Bipzm"5,1,iqF2L?,WK#<7kPYI=5]*ꎱb/PI=JmI$Ucl*j2SXʕm.J%W(=}^ƂikKr&:?P6//asd~*,ɼtXSk@ +KBSrsd}z̜%oE dKFwdC/cyu͎[]Vn]%{;x%N&Ѻdqkv^4AMm҇Mе;/^`.х.eZh1צJ\qŤ#Fml̋f+5m#Yq[EF%-yn1m%m\`j/ڊi+}<*28R{M}mSqj%<9˰62yuQ3:9X\ h1ڤEl.F]I[5Z E VkE0n8OoGvoG%tebD-rwz)Y}$V$mnXksnQ$,^|WMs٬Hʟiäc30D4}?X!?]j4q+em á-8|%ZǸ[:Bs[>慜z9T/;?XtZ>yP۷ +endstream endobj 350 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb9-238) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 349 0 R +/Resources 4 0 R +/Annots [ 351 0 R 352 0 R 353 0 R 354 0 R 355 0 R 356 0 R 357 0 R 358 0 R 359 0 R 360 0 R 361 0 R 362 0 R 363 0 R 364 0 R 365 0 R 366 0 R 367 0 R 368 0 R 369 0 R 370 0 R 371 0 R 372 0 R 373 0 R 374 0 R 375 0 R 376 0 R 377 0 R 378 0 R 379 0 R 380 0 R 381 0 R 382 0 R 383 0 R 384 0 R 385 0 R 386 0 R 387 0 R 388 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 351 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] /BS << /W 0 >> -/Dest (cb9-239) +/Dest (cb9-237) >> endobj 352 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] /BS << /W 0 >> -/Dest (cb9-240) +/Dest (cb9-238) >> endobj 353 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] /BS << /W 0 >> -/Dest (cb9-241) +/Dest (cb9-239) >> endobj 354 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] /BS << /W 0 >> -/Dest (cb9-242) +/Dest (cb9-240) >> endobj 355 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] /BS << /W 0 >> -/Dest (cb9-243) +/Dest (cb9-241) >> endobj 356 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] /BS << /W 0 >> -/Dest (cb9-244) +/Dest (cb9-242) >> endobj 357 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] /BS << /W 0 >> -/Dest (cb9-245) +/Dest (cb9-243) >> endobj 358 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-244) +>> +endobj +359 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-245) +>> +endobj +360 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] /BS << /W 0 >> /Dest (cb9-246) >> endobj -359 0 obj -<< -/Filter /FlateDecode -/Length 4962 ->> -stream -x]Ms$@CF'1H㵃`!?5k$jYd||(\5~a_rFcpח/\^ϒcu$_vQyCןY@Qm {쳿^˿:jUgNrbQ{!)#IW1Z`n1g) f"p9y) f8k`hhL0F$aBѰX4#+=Hi֨bZDVJ#R!:㍔U') d @HZlM$.x3I\I#D'L(qAvE` ,[pM`NǛI7ыK(.w}3Ii]xA\ ބg+#391qę [% l5 I\4,SW 0"hq@ᏹnOU"&3w_cv[O/?aˏYV_ X{"6AWj) e2e a{t؈x_tc#1cY fgf3׋H(ȶyTCmYp=z>!^0;SW$:iRs*I2µz"Ve.H*1Q0L{{yd UA֠| Y:PzYE8:l5sl!b.tQ<QF}e7(#Y^Ajt,:.tX Oc9"ĉ- s 6xu6zyEDj6tȏ`[L-yu/NWh`.( O90A d5hA9sPZ^A9>B?-n]x#9qh>#%:AFz[ŬVu[,>B'"[ہy ia<.tɞcχXᷤt]́N}5qԞYM8ViN˞'lه[ >FCX)?tN8LF+\KMU ;P -\Osڨ$]I`óSͤybjL\=DVuwy}5sƽ1Fڼ΢]vi D3R9OWy~$'&?ׅ{~t^ۥ`ҙ7, 3Yg( L~J|9h"oڎ.㻌Wcʸ^W?W -A )uӫǓ:ӼJ7#?&Zutw>+oʸm)0G`2s`{+pݬ<6Σbyf׍+.ǖʄ 6yǺAYR<(k;yHPFm3wE@霧xOuoE7ԮxTh D6 v1b35֔4ٳɜi5&8ߞa]huWFvXޑd>(#g!3r+A 372 ]=++=pRg>Q 8dCz~9t?@inzL\KbZ~a":e3D0 -= ߾7n+GǞ[0|Ԇ -:Yr`.tf7E2XoUg"7APb.07s@y&o }]}F+,ǖ-9>E mU ҦT4ϯuDxVk^~]Ӽ׳6ak&̨mSɤy:$gnZ?sj94 'QkdgPo|FR:R[օ~9Wy-FcpouQ:=LLlBܠ.tY+VnS.׏,5/e숗2jRvقC6@L~񘲼[zF<=Z{1fF> l-I@2^C)>B?>>M#-Knbz&ȡ#ڨ}W8O1½|F16r/XLz*e{u[XBЊ9OUBuc 3ǧffmڹ9J )YF BmiyC[҉&{b׵.|Y:O -3CNǽ>-'PtR4Ț_p:ț3V1Чlϊڸ_d !|ڳRޤÿ́ĺвܿt_ #ҍ'm|\r]is-?#[I{y$oL)١ Οc0{2sxzaSOZg]0|\Xm8^݁G[n9s] ϒ'Zq@ݶ dD|6s '~&W,h:LwۮQ{Ʃn=BDxogR4pZS5}>6yt%^#/g}dgA}fr|B4cqT[ĉ(A[e♯Wp*,)\'@3 V{1n7o\-{ܿ\rY:g&qAO|Z9Ҽfis}Cs/5O~{_$c-\G녿18;)fW]]D0aT1'yZ8nX5>#7+bA`F1߽V.I*TS|(6C -t}V`S+MGkb>t\jztƮ;/TKWQ_)Eֵʨ3*W/9kO"Хhw" Sr'^.b{iTRSͥ) j ƈZJ_— oįܾqzr8醗&4fI*|2,W!_chWUn^*8x! Rcl^&i!?n][l%횬\c*f -+Sbkb_7;}^ʂkM*wX{5ELlQO&XV a &n4h{MʯmI3eCkWdKQwdE??/m4mܺ3W0M;EXM'&6 uku#T55ֆVZC] C+VGMoTn G-UoQ]mJG".BqUe+3}%~w?/:7/6Er]_;WWF{x~`i*}XZ Or֗uΡeJjYԍ=NN͵p45{WlUi(*]@MVe$R>EoiJmDJreƫUptY}$B]"vl{n5CBLuSCw{Ma@U.+&`'38'Kݒa5q%q5;#e^We5~Pc ,4 -U/ȡ"Y׽RBFm%e%O{ -endstream -endobj -360 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 359 0 R -/Resources 4 0 R -/Annots [ 361 0 R 362 0 R 363 0 R 364 0 R 365 0 R 366 0 R 367 0 R 368 0 R 369 0 R 370 0 R 371 0 R 372 0 R 373 0 R 374 0 R 375 0 R 376 0 R 377 0 R 378 0 R 379 0 R 380 0 R 381 0 R 382 0 R 383 0 R 384 0 R 385 0 R 386 0 R 387 0 R 388 0 R 389 0 R 390 0 R 391 0 R 392 0 R 393 0 R 394 0 R 395 0 R 396 0 R 397 0 R 398 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj 361 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] /BS << /W 0 >> @@ -4199,7 +4194,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] /BS << /W 0 >> @@ -4210,7 +4205,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] /BS << /W 0 >> @@ -4221,7 +4216,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] /BS << /W 0 >> @@ -4232,7 +4227,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] /BS << /W 0 >> @@ -4243,7 +4238,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] /BS << /W 0 >> @@ -4254,7 +4249,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] /BS << /W 0 >> @@ -4265,7 +4260,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] /BS << /W 0 >> @@ -4276,7 +4271,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] /BS << /W 0 >> @@ -4287,7 +4282,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] /BS << /W 0 >> @@ -4298,7 +4293,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] /BS << /W 0 >> @@ -4309,7 +4304,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] /BS << /W 0 >> @@ -4320,7 +4315,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] /BS << /W 0 >> @@ -4331,7 +4326,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] /BS << /W 0 >> @@ -4342,7 +4337,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] /BS << /W 0 >> @@ -4353,7 +4348,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] /BS << /W 0 >> @@ -4364,7 +4359,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] /BS << /W 0 >> @@ -4375,7 +4370,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] /BS << /W 0 >> @@ -4386,7 +4381,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] /BS << /W 0 >> @@ -4397,7 +4392,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] /BS << /W 0 >> @@ -4408,7 +4403,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] /BS << /W 0 >> @@ -4419,7 +4414,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] /BS << /W 0 >> @@ -4430,7 +4425,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] /BS << /W 0 >> @@ -4441,7 +4436,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] /BS << /W 0 >> @@ -4452,7 +4447,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] /BS << /W 0 >> @@ -4463,7 +4458,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] /BS << /W 0 >> @@ -4474,7 +4469,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] /BS << /W 0 >> @@ -4485,7 +4480,7 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] /BS << /W 0 >> @@ -4494,157 +4489,197 @@ endobj endobj 389 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb9-275) +/Filter /FlateDecode +/Length 5112 >> +stream +x]]$9r}_Q `20{a]ۆY?GfFU05wʐB"$e=|gN9E:_~>)9OMl )9)RJ4.[\5 iʸ'!;iiL%d f ބG. ěI]. fL@ V 7$gz"Kꊁ̭ꒁbJꚁJ.LDULHF]60_cSD9dư x5hl&_wJY(u!2t5HJB1"f-.nb$bL\?صɰXlpf;^D +]n:Oo#do$ +|aǔ~mfR}\YR1 y08^1VeJ1>LuE7]yJՊJ_gnyYEReun10\ttP qhr`S~ e 6a}"Ve*,\:]=i,z Bp<-~1uf ֳbPu^G9v'.) r,DnAQ/^ + +Lpb1<{5>Fx~.d͝Lx1ׁ@ +<.tnfnDVG)00 7Avywv DF6eJ$@g3ÚxArLu dS{&$WT`ò41 Mzqڏh]>1P=[ Y"Ry9YB9[攷9`&7٤Tc⩱'i|N8r~_}=8{<>Ve||9fgduԹy޷l3a*Z6| ;/m16Wzo#^1WZѿ\MBt!ׁZbdB8D6uC]m#OweVܫpd'cޥ$>,G@@Nԫ*zkqͽPY1Pk#!G'NΎY2hoPuaBc9ĺй}ee .xpc5FyS|//p8fC$M{,͚){ϫM9mePud V~&Zy8Xdَi]Mȕz mǰl+{푉Y_k{^,ojewP-(XBWP#r][;^ Z}^fɓ6*|R_.%)Q~VrtKUSp`GPZ|s luK;\]0ݱE/vtP\mKhp7cVGɏNM;c0.]sg'-Y{m.ΈrW*Zyk;k?/ݫEoI{ܶݴ>}V[mמsk5鿥b.r헥ftޯnwi7.}b +v++uWu%9`/ſcYv%5[7M;70~i_)Wol/Qz{v~ӛ?ʣzmZ[ g?pqm[{6۟!_ ?.76cpܥX`pP@+ɖEo0>0Ѿ= oG2=fs{c[:mCh=S;9nPu(S&K[~K SI~!PvX>c'k2"ZAPR= rO2vf~0>(t^q~S%\ӽQ6`2"8=#y< 9u_!I,Ks:;ِD~]å?] '㰁(-;ȗ!o+=7n񜔳ߺЇYl`߮mz^{ǘq)29(t G?۝\>vjk\MU_An,1<: Xy73 gI + thڝ9 Ns<^YHbg7)WpяAd66?u }j\axgoCdxbo-HRv~t>""2v$t5VWu"EZV> !}eA+e2kga mjejPFVsQuXgyTiy=Ńڡ)YZ-$Y,ʑS/0=t=f!!Ϧ=q]R6ϧ8/;6ҨN ጀIΜ|k y |Csk. 7MK87vr27]h|)bv@,壩eJSa2vY\]?M?5ӕ+bEhb{3E,__b54H}V`S<bt5~̵!Mg/y]rB~+}WRTi]gwF* %g.'E)E:w& +j\)IͷjOj.-LiP\^]I#Ɨkq(}mÍ /@u$6)$%wh\aB^/]U̦IeK CJJy*%U"c׍ceZ@f*f¼ҭk]uyBR8qwdD?':Xވ{ǝl*L&_gÃbz"æ:h-u|MM4b/9meP[S{ahm؉]kpGxٴbud~iߴ zI( R.Vᢿ\rKmJ>wEJ):E\ⲫ07Vf + JjӋw!Qfl. \`_++{?<~q/&2DZJ{i1Vӥ~:9,P-wcW' Zh'妶d}TdJDQ2SdTlZiYmT}&[ҡڈ+zK:@sjwgZK"vRl_7. j晚v9?;TZ3`XnD-u[qw8Fp7$nIakׄ{|n;qBWTG]M[z%FsoBNL*[=DXuIg^jɫ]@_ +endstream endobj 390 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb9-276) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 389 0 R +/Resources 4 0 R +/Annots [ 391 0 R 392 0 R 393 0 R 394 0 R 395 0 R 396 0 R 397 0 R 398 0 R 399 0 R 400 0 R 401 0 R 402 0 R 403 0 R 404 0 R 405 0 R 406 0 R 407 0 R 408 0 R 409 0 R 410 0 R 411 0 R 412 0 R 413 0 R 414 0 R 415 0 R 416 0 R 417 0 R 418 0 R 419 0 R 420 0 R 421 0 R 422 0 R 423 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 391 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] /BS << /W 0 >> -/Dest (cb9-277) +/Dest (cb9-275) >> endobj 392 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] /BS << /W 0 >> -/Dest (cb9-278) +/Dest (cb9-276) >> endobj 393 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] /BS << /W 0 >> -/Dest (cb9-279) +/Dest (cb9-277) >> endobj 394 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] /BS << /W 0 >> -/Dest (cb9-280) +/Dest (cb9-278) >> endobj 395 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] /BS << /W 0 >> -/Dest (cb9-281) +/Dest (cb9-279) >> endobj 396 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] /BS << /W 0 >> -/Dest (cb9-282) +/Dest (cb9-280) >> endobj 397 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] /BS << /W 0 >> -/Dest (cb9-283) +/Dest (cb9-281) >> endobj 398 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-282) +>> +endobj +399 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-283) +>> +endobj +400 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] /BS << /W 0 >> /Dest (cb9-284) >> endobj -399 0 obj -<< -/Filter /FlateDecode -/Length 5083 ->> -stream -x]Ɏ$WY@7`Ѐ-FCcUUYZs3sqwpFVu+*Fh\a?Ȩr t}|UJEI3~MQyC,pQm \_/:jUGN"bQ{!)#I'$yb>I( ؂HQ0JHcJt-%(qA 0R ^pI4C [T$.@WEd.؂ [DH3Fda A Me-qzh%j)43PQ44blMH\ 61`$qAJIₔ`V`ǛQ€a "> d @HZlƛ$.@f ;&xB.x3J\ x(blAДv Nx$b3I\Cfaƛ)(Nw}3Ii]DA\`Vk#$hPG*Nhp/z(h/Ie -U$-Nh/1qmi -CD"?dF Dmѳl{t׿ӯLY1P |Jy&B+f!aᛔ،ĸLk`Ff )Fc`P[.>5ݻ]Y-闃K1Dhl|/-)7ڛ1HpF|%OK72G[ZDHRVǽrٮl)ܿltp!a:UQ鹄荵'.zO=קza(g’l=!yᖯcHv8?5_?_6`G+/tC -*f|z[|Z뢴um'gmy 6]`e=/N2*rȁ~ cvGIcʛzե3U:qFUӮzV8_ՋRٿ*;Ȏ -ᦼaXtIkh1=pM{sOak#Qo5,Ky~ -c5rJy\2 Q 3ǤDt9qMZF%mD 5]z4æA\i@un[Ic٥b#6Oz@(dA[ &%:q\иP 2ЛxؘАxY3yfA!pem6 -{2&{fX@Do̜TB{ -6Sm}`"3eNUbhM<w7fJ6ZbIqPa6=ڗW`:BTgqAoo -l?#.kH{GL:Jc|4:2ypt6q:D^Xm:vC'(Xu>K/ 3 DY#(#Hyd}Zåq؉~ag7-V|/M< N+=$g٤'LFx,O ,D3|ɸMyu$%p$hOMSox r=ѪzQAye;Ttb4"M1ҕO`~{Ri\!ETN|MNxU*yahxX2j~!4ΑZl9qM8y%RZ>N HSb~3F3?@㖝[Ņ]ACD $s:Σb\.%NB嫹;=Ȯ91D(&f+y>z"A8 hό^Y{]H2 Rtt5R޲p:OɒZo -Hq\axxV5MG<x6Q" j'>ܗw^0,G>y*(8MNΎiQu{`!eonS&yꎆ?\VYKayxJ[P[ЛyN t`yI{fz24|phZc"^9吏_xNSl;OQHgo##c#;~>sh= OY@;< Pg$hW7aLRPlz=fg#K{ǖ| FWA<aRyyz4F^H~[.K6紝æéM= (P6O"m <ˋw:4pMhu5,&l<^}y3^?640G/۾l=٬lgױ4oSX`+ysl'ޙ(.QL6%~mt/-Hw T3?A]mto@Wd˚sW f -+b:Ovgv~16ո!(0eL4FnlMZqlN!i]yw|m|?|ֺƩ9gt@!ϡO֮[Yr khLi.@;Z^NzmD>yRYe9Le!sp$>TnҘz@&MaՖm%S M9VS-} 8P:Ts=,_SCyhsŒvD32vo}"N^t{'A̽G"46J/c|#}UsHLDw f0{1?VfI*4S|6Il@⩘_Bv]lcЅufơ: _.J_E)]qVMkV!I\7M̖>wz -$jr'^.b4j*\nJKe8/ mDq-5V: ;Sk]zQ;W{m;^hn47MS>j_U &^;i:$ye0;$-gmVe0_/cM nH;qmx}\v)ݜurt\<^}=֏[6n]Ǟ$ML5Ahi.6 F{i: -} ָ3e|ivV]>8Zqpz]u(WwFq1ᆹ[29ޤ*kt=z7;]e),^x1Lfi^#j `i&}XOr֗qe'xmC,7=ׂ4zhA4u%oJUi(]@MaQn)OD/StFOVX+a˭=^\ ؟N-L,MJ=i}^ǠnH葩j~M#s*?eä~`8:j2YWN!_) Sܟd9NEhd^7jY)NsCi92.yoos&ҙ3jTK^M~ -endstream -endobj -400 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 399 0 R -/Resources 4 0 R -/Annots [ 401 0 R 402 0 R 403 0 R 404 0 R 405 0 R 406 0 R 407 0 R 408 0 R 409 0 R 410 0 R 411 0 R 412 0 R 413 0 R 414 0 R 415 0 R 416 0 R 417 0 R 418 0 R 419 0 R 420 0 R 421 0 R 422 0 R 423 0 R 424 0 R 425 0 R 426 0 R 427 0 R 428 0 R 429 0 R 430 0 R 431 0 R 432 0 R 433 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj 401 0 obj << /Type /Annot /Subtype /Link -/Rect [ 84.259843 724.970079 177.650223 709.970079 ] +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-285) +>> +endobj +402 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-286) +>> +endobj +403 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-287) +>> +endobj +404 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-288) +>> +endobj +405 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 443.811778 177.650223 428.811778 ] /BS << /W 0 >> @@ -4655,636 +4690,464 @@ endobj >> >> endobj -402 0 obj +406 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 696.273057 101.433071 677.523057 ] +/Rect [ 101.433071 415.114756 101.433071 396.364756 ] /BS << /W 0 >> /Dest (cb10-1) >> endobj -403 0 obj +407 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 677.326036 99.933071 658.576036 ] +/Rect [ 99.933071 396.167735 99.933071 377.417735 ] /BS << /W 0 >> /Dest (cb10-2) >> endobj -404 0 obj +408 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 658.379014 99.933071 639.629014 ] +/Rect [ 99.933071 377.220714 99.933071 358.470714 ] /BS << /W 0 >> /Dest (cb10-3) >> endobj -405 0 obj +409 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 639.431993 99.933071 620.681993 ] +/Rect [ 99.933071 358.273692 99.933071 339.523692 ] /BS << /W 0 >> /Dest (cb10-4) >> endobj -406 0 obj +410 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 620.484971 99.933071 601.734971 ] +/Rect [ 99.933071 339.326671 99.933071 320.576671 ] /BS << /W 0 >> /Dest (cb10-5) >> endobj -407 0 obj +411 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 601.537950 99.933071 582.787950 ] +/Rect [ 99.933071 320.379649 99.933071 301.629649 ] /BS << /W 0 >> /Dest (cb10-6) >> endobj -408 0 obj +412 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 582.590928 99.933071 563.840928 ] +/Rect [ 99.933071 301.432628 99.933071 282.682628 ] /BS << /W 0 >> /Dest (cb10-7) >> endobj -409 0 obj +413 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 563.643907 99.933071 544.893907 ] +/Rect [ 99.933071 282.485606 99.933071 263.735606 ] /BS << /W 0 >> /Dest (cb10-8) >> endobj -410 0 obj +414 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 544.696885 99.933071 525.946885 ] +/Rect [ 99.933071 263.538585 99.933071 244.788585 ] /BS << /W 0 >> /Dest (cb10-9) >> endobj -411 0 obj +415 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 525.749864 99.933071 506.999864 ] +/Rect [ 99.933071 244.591563 99.933071 225.841563 ] /BS << /W 0 >> /Dest (cb10-10) >> endobj -412 0 obj +416 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 506.802842 99.933071 488.052842 ] +/Rect [ 99.933071 225.644542 99.933071 206.894542 ] /BS << /W 0 >> /Dest (cb10-11) >> endobj -413 0 obj +417 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 487.855821 99.933071 469.105821 ] +/Rect [ 99.933071 206.697520 99.933071 187.947520 ] /BS << /W 0 >> /Dest (cb10-12) >> endobj -414 0 obj +418 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 468.908799 99.933071 450.158799 ] +/Rect [ 99.933071 187.750499 99.933071 169.000499 ] /BS << /W 0 >> /Dest (cb10-13) >> endobj -415 0 obj +419 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 449.961778 99.933071 431.211778 ] +/Rect [ 99.933071 168.803477 99.933071 150.053477 ] /BS << /W 0 >> /Dest (cb10-14) >> endobj -416 0 obj +420 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 431.014756 99.933071 412.264756 ] +/Rect [ 99.933071 149.856456 99.933071 131.106456 ] /BS << /W 0 >> /Dest (cb10-15) >> endobj -417 0 obj +421 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 412.067735 99.933071 393.317735 ] +/Rect [ 99.933071 130.909434 99.933071 112.159434 ] /BS << /W 0 >> /Dest (cb10-16) >> endobj -418 0 obj +422 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 393.120714 99.933071 374.370714 ] +/Rect [ 99.933071 111.962413 99.933071 93.212413 ] /BS << /W 0 >> /Dest (cb10-17) >> endobj -419 0 obj +423 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 374.173692 99.933071 355.423692 ] +/Rect [ 99.933071 93.015391 99.933071 74.265391 ] /BS << /W 0 >> /Dest (cb10-18) >> endobj -420 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 355.226671 99.933071 336.476671 ] -/BS << -/W 0 ->> -/Dest (cb10-19) ->> -endobj -421 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 336.279649 99.933071 317.529649 ] -/BS << -/W 0 ->> -/Dest (cb10-20) ->> -endobj -422 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 317.332628 99.933071 298.582628 ] -/BS << -/W 0 ->> -/Dest (cb10-21) ->> -endobj -423 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 298.385606 99.933071 279.635606 ] -/BS << -/W 0 ->> -/Dest (cb10-22) ->> -endobj 424 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 279.438585 99.933071 260.688585 ] -/BS << -/W 0 ->> -/Dest (cb10-23) +/Filter /FlateDecode +/Length 4783 >> +stream +x]ߋ8~Ͽ"F+)B`eaazjw9jfiɲ.+wQ]V>²-~~p/395)XJ.&_YN&s*J&S/zqwoJޅ?I9%V:RX!| ++:[,EcA󞕠4`P89ڳ +ɱƂ[e&\05w&K5]pcK(i]c0"tHVAi]`&9*P` r ]7e4,( Ӱh$Lְ0aƥ7,֛X)PfҰ0t QTtATq Lz"t5,(1z3kX0MDjJ z3n(@&Ed5,֛lLgfYqf5c`s2^VIXԤ2G5kiLgմ"&JWba 6iG%4}N#D; D91Z^O7 G~]vjc.gtO~OB>Ap?:`IaUR G5yu2!\-n_돓?M5;#\CGH:2YD/jc"2V[I!޳.Ͻo& ?y4"i#KR׉&L'F2 7ƗQ`˄jt/,EE BXvLجhQJΗu$io/b9ziֽQfDW!lS"C]6_2;I,ed.|)ESGif7[ͷ8N6]iwT_Ni&=pI?(&G/j7$vA븠DB4,Q\قkm>upCH<ϡ\$IXo}\s`P;O4(Ss\leǑ6wEG,I6OgP:U»ͳ;33n ݯR]I\0[:-`Ȼ-tgi1tla +󁇾+3y9yA|Q8y4i9aS+\ƌ=>>u#66tӴ.7]sݳŽ<[K?lQwălF^d0*䳍72qYy"#[o֍|>PB.[sLfEzĥc_JE.WncvzJu\95}W]5yN4cԿ"5:ml"h#]afAk0 "C N`NR;͹ \ǽ]v[^FrfE\!iX{َnN'oeSj kള˝LfzW?ve8/)6y)!*<ۘ3(s B鼫J'=_^hzw-e$K0r|;1tM))hmhp[Ox=ul]Pn9ڶQ/>ʦ69hxDH\Y6Y9!aJ>h4;(sӹ:$~n]`ET%)"Gz;Ng\II_}~ݶXVOGE7YnE4(snD)Û_R3yu>n{V~f%wdx,Y NC1f?wH`j/yƟP䓎Nא)g>xqŞj|!m-@:d96ȉE.TO͹Sql7r?vu3?}. kl\G9@h*s e.1v㶻 F7k4,Ǧ%,7sC@rzZ)$+ Kxb.d_oNQ|q:Ȳܒ_or:=+dL#~,mu ؐLٖ`)ԏ>ԻP@:rC?n|ǽmhL&ߴ+؆MGBvy)7yy ג!kܞ>ȾwLx|m qIٲ[E; )U+)LqWˮhRSouϽ)H.0B.i2UWt]_-+}=ʱ6hoמnL t*Mq}.PG-YZю@J[5Z'Jk5SjLw^J-X{:Viz]Yx-Zޝrwv)bɬb/ݨJ۷l{nEE,J 3v2lVL 1QKi:c|Hܥ4y;DZdGa&'= +F9gtU%drKuY`28ӗOߜiI]s$AoI֩))e>~A +endstream endobj 425 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 260.491563 99.933071 241.741563 ] -/BS << -/W 0 ->> -/Dest (cb10-24) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 424 0 R +/Resources 4 0 R +/Annots [ 426 0 R 427 0 R 428 0 R 429 0 R 430 0 R 431 0 R 432 0 R 433 0 R 434 0 R 435 0 R 436 0 R 437 0 R 438 0 R 439 0 R 440 0 R 441 0 R 442 0 R 443 0 R 444 0 R 445 0 R 446 0 R 447 0 R 448 0 R 449 0 R 450 0 R 451 0 R 452 0 R 453 0 R 454 0 R 455 0 R 456 0 R 457 0 R 458 0 R 459 0 R 460 0 R 461 0 R 462 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 426 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 241.544542 99.933071 222.794542 ] +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] /BS << /W 0 >> -/Dest (cb10-25) +/Dest (cb10-19) >> endobj 427 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 222.597520 99.933071 203.847520 ] +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] /BS << /W 0 >> -/Dest (cb10-26) +/Dest (cb10-20) >> endobj 428 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 203.650499 99.933071 184.900499 ] +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] /BS << /W 0 >> -/Dest (cb10-27) +/Dest (cb10-21) >> endobj 429 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 184.703477 99.933071 165.953477 ] +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] /BS << /W 0 >> -/Dest (cb10-28) +/Dest (cb10-22) >> endobj 430 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 165.756456 99.933071 147.006456 ] +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] /BS << /W 0 >> -/Dest (cb10-29) +/Dest (cb10-23) >> endobj 431 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 127.862413 99.933071 109.112413 ] +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] /BS << /W 0 >> -/Dest (cb10-30) +/Dest (cb10-24) >> endobj 432 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 108.915391 99.933071 90.165391 ] +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] /BS << /W 0 >> -/Dest (cb10-31) +/Dest (cb10-25) >> endobj 433 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 89.968370 99.933071 71.218370 ] +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] /BS << /W 0 >> -/Dest (cb10-32) +/Dest (cb10-26) >> endobj 434 0 obj << -/Filter /FlateDecode -/Length 4531 +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb10-27) >> -stream -x]M$ ˒H}l"9,r{mXRSN\vK,z"Uڝ-~>wٙK|~xdM -=pv @ɤ|~.ϧvRƝ)%zο(,&rJ6(uB0)VtXƂ!-+A .9h,gqrec5\ Ia9 =VAL^`"=j'x xNQxʃ.6Z -P2+ٜm0!Y MRyQ0RL -ChCQy% G'w%t>ʃ.0>BAFpIYp次pJ/p,I<4 ]G AFUyЅ -kX@D3iX@@[hX@[iX@[.jX@\i5, . T4, `.;5, .{Ұװ9jX@]bg5,`.$UtkXt42iX]r6iX]t#ajQ9[ e  iX] z G (ch  z8]`ϓK4,]W0)}he\.QÂuSyŸW-Zٸ4,]gְo0z pFjuX pqCа` 0g*[rְ wK^f K4,8TÂ^4,]4,]{Tt5,@\ҧk,֦aAʰaALBY(h{ bfSRbCȧuа Y KANakSd .但C  "0!VwQ.5,\5,H!"CjMNksIÂ`(v 2^pIc R.*`(2#2x ְ.xiX=tA4aAYf`F.xl%dFBE Mi)UtLhXH4,@diʃ.XÂYÂ^IÂb "> Fd YaAqg /%7)P|3iXP(* h*J&!:i]|a Jof f DDN d7:] Ȥ񀻈L@V-7$g:3Kƙ [) h9 I4,sTg 0:m`x ٧~*̜! #o9\n̏w|?i88?q:H\v C;3y ->"#J2+I7QC1rnReh,:;3ӓq_/2SQu[SJ^t?3Hp;#Þ/;EZ"JQ x-/ - ]Zev]vZc$g47O_|7/͇?h7ߞz|VƌUbDwZgHyVA!*=E܆,ƽ˭>͗/W!z×m~F*l)yA"޳alIZN"4.LVMW^->\[zs9Z\ޫyK -Tcu2шٛ"=Bh 6NkEZKIu%90A\vL8. vwwE%eG{M:Hgl*3t(fzSɔHE*nrDt#;s1r-Xdr1_ 3"1v]-l -kOu$3N7+KTq2q//Wte%/Wr(:lv%$2e73; 7fD79IKN5-*y[]*tnT.za5H^");֌~[}὞zJ61ˌ 1n3&s qyӷ]z"v$q|y.wL8Λ -3}J]t8rhuXeqmj5!soye -!vL0E!q@e%5mkg0J7\[ȫK\?IuhjrӋR=ބƠq\cckܢdp&ƝnS]N @ EWCq / Y$mZ)+nÌi,(Nn4>承O8/SZ[&Ez}WB][p`#1"qupwd^S[qu)Z~ZTidY&ߘp? ," ON XA֞&O>w,BcT]<&sSgnHx񈩟^}rYhHKd㘱1D>@Ke4![uRx\BӅz쎘73~7$q -)[n(/@yP8M彯X(O;^%q\[@7(s&yc0}wӹ1}s`Mc21 ɪ$ ^eX;,'o21kHnj(l$c,kwZBbY΄k9$r)VVtoǷ]nA$9G9&rc)e%m5i5h޿WackU&[bQGVuu憋¸N#@J" gL8ҡk\VԍUU51(9\Ȑ3rļl16!9~ij9lacpJ{v\+*=.mW>&yVD+-h]2qͯpUK]#?X0EIM7fRʣSCqQVOi~[d-Pq9)bx}1YŐ$wO_5IFו('[sG/%J[2m#k/n麹917#i,6N,ǖeKjAt:/bjZ0Oa3_׵Y0'9\2?Hm7+ -.InN~>ȇ*&YV+K -mWP ]bS%Ī3 /;p%>DU7TZַĦzt3-SgΗO'TKkJcqj&+:JZI!~n%njr#q+Wj9tR]R+gR[~VevuʭFWj>b~\X 7~C|:R R:XaCuH}9_f_|B׬49M~_"4 qs)9^q+F鱡k- QPqU ҭԮ:z*U=Kk^a}VD[@u394W~^g=Cʢ=ذ'fq'ge6}};ħi`5Y\?JfLTiuY1Lay"INOO0)x #99?(-Yqۆa܏dEy,_PtDd粡zCǽgq;{-anÎzG]˄OVlo<`_.>[S*Vy<$[JC:;A\7eWa5[)WҚ^$uu]!4xf[W]_7fWZ(J?ܽ~ݯ*ڠQ{j{06ө4]esh[;B^=jA5Ђv<] REuhpvTuW,gR)f}K*Co)+#^@w4?KX2+K7*%Ҷu:ڞY8Gv #}"-J՟it^ yp!,g'ݔ2/qlg2G_a&'_ Fgt_yke -g9;92I(_Dfd:3M[LL? -endstream endobj 435 0 obj << -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 434 0 R -/Resources 4 0 R -/Annots [ 436 0 R 437 0 R 438 0 R 439 0 R 440 0 R 441 0 R 442 0 R 443 0 R 444 0 R 445 0 R 446 0 R 447 0 R 448 0 R 449 0 R 450 0 R 451 0 R 452 0 R 453 0 R 454 0 R 455 0 R 456 0 R 457 0 R 458 0 R 459 0 R 460 0 R 461 0 R 462 0 R 463 0 R 464 0 R 465 0 R 466 0 R 467 0 R 468 0 R 469 0 R 470 0 R 471 0 R 472 0 R 473 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb10-28) >> endobj 436 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] /BS << /W 0 >> -/Dest (cb10-33) +/Dest (cb10-29) >> endobj 437 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] /BS << /W 0 >> -/Dest (cb10-34) +/Dest (cb10-30) >> endobj 438 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] /BS << /W 0 >> -/Dest (cb10-35) +/Dest (cb10-31) >> endobj 439 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] /BS << /W 0 >> -/Dest (cb10-36) +/Dest (cb10-32) >> endobj 440 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] /BS << /W 0 >> -/Dest (cb10-37) +/Dest (cb10-33) >> endobj 441 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] /BS << /W 0 >> -/Dest (cb10-38) +/Dest (cb10-34) >> endobj 442 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] /BS << /W 0 >> -/Dest (cb10-39) +/Dest (cb10-35) >> endobj 443 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] /BS << /W 0 >> -/Dest (cb10-40) +/Dest (cb10-36) >> endobj 444 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] /BS << /W 0 >> -/Dest (cb10-41) +/Dest (cb10-37) >> endobj 445 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] /BS << /W 0 >> -/Dest (cb10-42) +/Dest (cb10-38) >> endobj 446 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb10-43) ->> -endobj -447 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb10-44) ->> -endobj -448 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb10-45) ->> -endobj -449 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb10-46) ->> -endobj -450 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb10-47) ->> -endobj -451 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb10-48) ->> -endobj -452 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb10-49) ->> -endobj -453 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb10-50) ->> -endobj -454 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb10-51) ->> -endobj -455 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb10-52) ->> -endobj -456 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb10-53) ->> -endobj -457 0 obj -<< -/Type /Annot -/Subtype /Link /Rect [ 99.933071 401.285606 99.933071 382.535606 ] /BS << /W 0 >> -/Dest (cb10-54) +/Dest (cb10-39) >> endobj -458 0 obj +447 0 obj << /Type /Annot /Subtype /Link @@ -5292,10 +5155,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-55) +/Dest (cb10-40) >> endobj -459 0 obj +448 0 obj << /Type /Annot /Subtype /Link @@ -5303,10 +5166,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-56) +/Dest (cb10-41) >> endobj -460 0 obj +449 0 obj << /Type /Annot /Subtype /Link @@ -5314,10 +5177,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-57) +/Dest (cb10-42) >> endobj -461 0 obj +450 0 obj << /Type /Annot /Subtype /Link @@ -5325,10 +5188,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-58) +/Dest (cb10-43) >> endobj -462 0 obj +451 0 obj << /Type /Annot /Subtype /Link @@ -5336,10 +5199,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-59) +/Dest (cb10-44) >> endobj -463 0 obj +452 0 obj << /Type /Annot /Subtype /Link @@ -5347,10 +5210,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-60) +/Dest (cb10-45) >> endobj -464 0 obj +453 0 obj << /Type /Annot /Subtype /Link @@ -5358,10 +5221,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-61) +/Dest (cb10-46) >> endobj -465 0 obj +454 0 obj << /Type /Annot /Subtype /Link @@ -5369,10 +5232,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-62) +/Dest (cb10-47) >> endobj -466 0 obj +455 0 obj << /Type /Annot /Subtype /Link @@ -5380,10 +5243,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-63) +/Dest (cb10-48) >> endobj -467 0 obj +456 0 obj << /Type /Annot /Subtype /Link @@ -5391,10 +5254,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-64) +/Dest (cb10-49) >> endobj -468 0 obj +457 0 obj << /Type /Annot /Subtype /Link @@ -5402,10 +5265,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-65) +/Dest (cb10-50) >> endobj -469 0 obj +458 0 obj << /Type /Annot /Subtype /Link @@ -5413,10 +5276,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-66) +/Dest (cb10-51) >> endobj -470 0 obj +459 0 obj << /Type /Annot /Subtype /Link @@ -5424,10 +5287,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-67) +/Dest (cb10-52) >> endobj -471 0 obj +460 0 obj << /Type /Annot /Subtype /Link @@ -5435,10 +5298,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-68) +/Dest (cb10-53) >> endobj -472 0 obj +461 0 obj << /Type /Annot /Subtype /Link @@ -5446,10 +5309,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-69) +/Dest (cb10-54) >> endobj -473 0 obj +462 0 obj << /Type /Annot /Subtype /Link @@ -5457,39 +5320,39 @@ endobj /BS << /W 0 >> -/Dest (cb10-70) +/Dest (cb10-55) >> endobj -474 0 obj +463 0 obj << /Filter /FlateDecode -/Length 4945 +/Length 4628 >> stream -x]Ϗq ,M{`0I :Jz-G`gXd,~UEQZ/0/kro*9^ DWBlr>.ϗKw]Ga2sQa#Ǥ3R4Ԉ9ee -G5jPȎ5|vAcA WbVXBUyPĆ@^h:=iAAFpI  < XCńI_ d :Ӏ,t!iH@\] Cа@6Z4, miX@`]ҰPjX@@\4, @.LhX@\vjX@]Lau)&av)pҰհ w X!ǤaAYÂ4`T 0iX[1jXmа w} Py`#nA]װ w}IX5B@yҰDÂuO@+$ "p1O2z\eR*D.iXOְoQZw/VÂE5,9@7,LWc  X @ iX06q ^4,H]4,H] xzd6ȱNՃ"o)X /؉ ׆Et47[mϗ;$;W?P'$ŌZ)ĈoX;;-ݯod]WϏ˺'ٗo9R5$3v{ /OkA|Fx-V._[+VhnwQ !@9Q qrɜg,H CYY{?o{Bپt&Y7^K+\]]) S31Ә"\McTSjVΌ!<d'~ -?o|7(sC- ^= Fkp&Ƿ^֑sHD y@G.CxG7Da dM'4&sSp`1%sPC9 -0M_90voFzV0~޳y5d: IJܴz ʜ@<\{x[ YtoUV7blvphH<e8WQ"C,+"R/C",sHfΫ~>0Me_n{kl`Gm -| sH4 g+;Rw&6H~g%Tib Gky *;ee3Jc<>VVᎢ[5NC7&(0C _v!qxRyh$⒕ M!Ęy "¯q@9Pb1]g(hV^G'q>O%uw >$/V⸻3$jE@e)_{fP<&)K"z\(wKʧ{:a OOa.'[鑧gudy_81hp<]*Q7Elb>0`vH1"=r׳VZem -5q6OA_4Alg!.XdeҺeŎ+XVnaVu[mbގy7 -5}S](c\CQ綝#QVXԩ^W7ń1 7xoG1nzCD[]#yVz$"LY:ދ OQfpaפdcQ6jglG^(1ו7tn};`3nP=9eI+sѤG9b,ì6g݌l&3izPv9!;_Hh_M維#Vz:ȿn.T؏Ab7 ly;S\4K.m]G\VTZ?:sr쀐#b{V1(s3clkDld{^y3cp-LgDʙ3A .Og8qlܿt.i֋&❈GV#[cJoXs)$w21aAr4EՄc3osdmn%e3Q(oh~۶u$J{?cF_9I#((-]`ٚcEAjՕ> en^ -cW0I䄫a9i+vV۶VZm叡Uq8$e21IגRNogNC]4ԣտMEW5Qh hP~@"H"0?vRz)K r9f˗LyL<%Po㦼hT{Mg옳xF^M_;|‹|$'&AbrJt %مo:7]F y0Mqw;E9INDž8|UG_["UPRމ/tɎ[࢜\}@ӑ[T۟kWf"8r6K-cǡ^Q1tȗL_Ñ_0ۣmf2d2um-FGnԘ|s*?he}ouT&vmQ㦻0n7})(,Cr7!ȿw:]HN߹A5 E1uq/40?_OQ&35v"\/򙢠A?mKǭhOP,rnD>V19>ZކWb"$ےqw| ݯRS%3s/;W8 D57Zַ9M\7pD|YZSU|`VU{FNҨl8)B֪FMRhJ-.j{mTnx-gUfS'nЦ>S|#%9Աٍ.Ȇ|Y)g^OFf;L| SsQy.4竹줞*t[c je=T%5kd? +{J)?/ȳMh[cu[395|ɹN4}[Wš,ϵ,P5XG(F'r B9O2>]v2d/A~"'Q#w_%\ -|d=$'*MC3\6Vkh~,ng`%]CP׸=1}ؑ}3]iՋ-c3;%՛$򽇪.%<]WRtv ⢯]eldHz?CAVwхrI3/nҦ 8ѲGQW]TgP7sOm7&x:˴l> Ju=nQ r1aqhGY^ J[4ZE ls)jLwj/SԿ=QiQIRox-Zޜ|wv.bIVhn0J۶mWo{n#̊92Xܔ|fdVZgZp<:LO[N s9pqX5JF][p@dP* +x]ߋ$ ~￢g[/8,I`N6!.yȿOeZ=Cv..,dD# FH 4`89ec1\ Ia9 9VAL^`":=j'x xNQxʃ,6Z +P2+ٜ-`B&9`0,ц K 5AƏNJ9+&KN}bY| |,6E 0>%ų>YCH_Xdxi@@, ְ4 z G `(ch  z8Y߃Ix%+pʘZK԰ w]T^1.Ǖq^6.ƢaAQ  <װ wSk#ˌVxhjV̬aAh$T԰&RAЏ$A$?H6 x;`'GQuo\O' ~rޔ񷼐Ϗ?ѳsWƇc P79k!gzBce,; +. =#{E@qztF{ڕ蔟g]zl) Už*jFU EvdsA.㙼;6+-(&Zn|>z#UѲmGƋ2M1=L U֏|!9Rnq+"۸R$oŘJ~ckah{{=o,KUHϓD RN;;]>X8]LŒ%G9auʯLH`<,3V8u ˏvpe9Z 9ĘajZIfgdm18jd;Bވӻ 2 w;=$Xttf;u$mnz[9#/J[ (UaeU92L }eQ1#LISh޿Wac,w*ʻzM*m'MVx"2*S#9$.~ o>FOt}iQ0s2X, ΋hvaTVVb |jߨjDܦѧw|HA y~^oRҥK_ +0o]Yy]b%r*ZH!JO& eal5vsuc| ϺቬW'Ir}gmвΥha9`Ks-M佩S&PjDu~85'7gl}B8hgG += zЃ!et>mM8Gҡ1_*;hw'!,oO8F*/D$SuXtMp\-^)a3-2:k:uwyMz u${?):r웑|^OWLapMXFv6/f>kВsc>{y_sut:|6KTۙ>o rW~TOv+޲ᶶ>eltrT@~wxq/+1 ox>?{?_t)g y|ÊTs[\ 0?y\w(ʫNv6XCݢRכ̩koۮiԝeRVyO;rȸy9y+F}a#n6\vMyɖ2-<+$ `ߘh@gLΥ0:ԗa| gq#3:zC=V2->2Bi:uuՎ9j쮕bҺnt2e )OlSIm oeZNjl3rd2'yz5̏m26%MAHwaw:%|gu!3lVV, cgrnJ,#x\4[dGcI?g9YG4gb.Yfܯ"߯#6dy =ԭ:e1?s27'.R&tmkݺ(8_Oq:gMg8E%ѐF\O*g9.[bWMwjNGJo*zSs_'r7*'0ۉ/l/'92?Hն{f HlKR0vZ)ԯ>ԧV&aݒ-,gCUlXeq!e.wɲb![[rM-tb:שSk ҖRzڻ6uBF dS7=)I!~k+&'P^rSHZn[hJT^(SnЦ>I,C7F,կkr T]#cX/'ف{C~9 VPM'RwFv*]ahV'PUg⸙lg\Fdl6zzlZ")5 R^@n=v]S H5X]FӰ'*[ȡˊP 5]gw!dž/=95;9P|%^&[~,d :"@a!/02hm$[eirirs6ȝ2??N|Hy6 [Wޓ_ȃd؆MGBvy)54?}׼T ג!kܞ>ȾwLxxb d>W7þ^R}84Cri +2/jF}OtחtSK{Q79XB ^]6QRm.FVVG4[i펩j['j/S,Կ=zN VMYox-Zޜtv)bɬb_Qy)Iv6ۮ=/%2KpS]s-J՟ig8jvdL#0+$ݔƛ>q;Q8D69j/`}Fwj^Hoe +g9{33'reTQIЛπ$)iy5}2 b endstream endobj -475 0 obj +464 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 474 0 R +/Contents 463 0 R /Resources 4 0 R -/Annots [ 476 0 R 477 0 R 478 0 R 479 0 R 480 0 R 481 0 R 482 0 R 483 0 R 484 0 R 485 0 R 486 0 R 487 0 R 488 0 R 489 0 R 490 0 R 491 0 R 492 0 R 493 0 R 494 0 R 495 0 R 496 0 R 497 0 R 498 0 R 499 0 R 500 0 R 501 0 R 502 0 R 503 0 R 504 0 R 505 0 R 506 0 R 507 0 R 508 0 R 509 0 R 510 0 R 511 0 R 512 0 R 513 0 R ] +/Annots [ 465 0 R 466 0 R 467 0 R 468 0 R 469 0 R 470 0 R 471 0 R 472 0 R 473 0 R 474 0 R 475 0 R 476 0 R 477 0 R 478 0 R 479 0 R 480 0 R 481 0 R 482 0 R 483 0 R 484 0 R 485 0 R 486 0 R 487 0 R 488 0 R 489 0 R 490 0 R 491 0 R 492 0 R 493 0 R 494 0 R 495 0 R 496 0 R 497 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -476 0 obj +465 0 obj << /Type /Annot /Subtype /Link @@ -5497,10 +5360,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-71) +/Dest (cb10-56) >> endobj -477 0 obj +466 0 obj << /Type /Annot /Subtype /Link @@ -5508,10 +5371,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-72) +/Dest (cb10-57) >> endobj -478 0 obj +467 0 obj << /Type /Annot /Subtype /Link @@ -5519,10 +5382,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-73) +/Dest (cb10-58) >> endobj -479 0 obj +468 0 obj << /Type /Annot /Subtype /Link @@ -5530,10 +5393,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-74) +/Dest (cb10-59) >> endobj -480 0 obj +469 0 obj << /Type /Annot /Subtype /Link @@ -5541,10 +5404,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-75) +/Dest (cb10-60) >> endobj -481 0 obj +470 0 obj << /Type /Annot /Subtype /Link @@ -5552,10 +5415,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-76) +/Dest (cb10-61) >> endobj -482 0 obj +471 0 obj << /Type /Annot /Subtype /Link @@ -5563,10 +5426,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-77) +/Dest (cb10-62) >> endobj -483 0 obj +472 0 obj << /Type /Annot /Subtype /Link @@ -5574,10 +5437,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-78) +/Dest (cb10-63) >> endobj -484 0 obj +473 0 obj << /Type /Annot /Subtype /Link @@ -5585,10 +5448,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-79) +/Dest (cb10-64) >> endobj -485 0 obj +474 0 obj << /Type /Annot /Subtype /Link @@ -5596,10 +5459,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-80) +/Dest (cb10-65) >> endobj -486 0 obj +475 0 obj << /Type /Annot /Subtype /Link @@ -5607,10 +5470,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-81) +/Dest (cb10-66) >> endobj -487 0 obj +476 0 obj << /Type /Annot /Subtype /Link @@ -5618,10 +5481,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-82) +/Dest (cb10-67) >> endobj -488 0 obj +477 0 obj << /Type /Annot /Subtype /Link @@ -5629,10 +5492,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-83) +/Dest (cb10-68) >> endobj -489 0 obj +478 0 obj << /Type /Annot /Subtype /Link @@ -5640,10 +5503,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-84) +/Dest (cb10-69) >> endobj -490 0 obj +479 0 obj << /Type /Annot /Subtype /Link @@ -5651,10 +5514,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-85) +/Dest (cb10-70) >> endobj -491 0 obj +480 0 obj << /Type /Annot /Subtype /Link @@ -5662,10 +5525,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-86) +/Dest (cb10-71) >> endobj -492 0 obj +481 0 obj << /Type /Annot /Subtype /Link @@ -5673,10 +5536,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-87) +/Dest (cb10-72) >> endobj -493 0 obj +482 0 obj << /Type /Annot /Subtype /Link @@ -5684,10 +5547,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-88) +/Dest (cb10-73) >> endobj -494 0 obj +483 0 obj << /Type /Annot /Subtype /Link @@ -5695,10 +5558,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-89) +/Dest (cb10-74) >> endobj -495 0 obj +484 0 obj << /Type /Annot /Subtype /Link @@ -5706,10 +5569,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-90) +/Dest (cb10-75) >> endobj -496 0 obj +485 0 obj << /Type /Annot /Subtype /Link @@ -5717,10 +5580,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-91) +/Dest (cb10-76) >> endobj -497 0 obj +486 0 obj << /Type /Annot /Subtype /Link @@ -5728,10 +5591,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-92) +/Dest (cb10-77) >> endobj -498 0 obj +487 0 obj << /Type /Annot /Subtype /Link @@ -5739,10 +5602,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-93) +/Dest (cb10-78) >> endobj -499 0 obj +488 0 obj << /Type /Annot /Subtype /Link @@ -5750,10 +5613,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-94) +/Dest (cb10-79) >> endobj -500 0 obj +489 0 obj << /Type /Annot /Subtype /Link @@ -5761,10 +5624,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-95) +/Dest (cb10-80) >> endobj -501 0 obj +490 0 obj << /Type /Annot /Subtype /Link @@ -5772,10 +5635,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-96) +/Dest (cb10-81) >> endobj -502 0 obj +491 0 obj << /Type /Annot /Subtype /Link @@ -5783,10 +5646,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-97) +/Dest (cb10-82) >> endobj -503 0 obj +492 0 obj << /Type /Annot /Subtype /Link @@ -5794,10 +5657,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-98) +/Dest (cb10-83) >> endobj -504 0 obj +493 0 obj << /Type /Annot /Subtype /Link @@ -5805,10 +5668,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-99) +/Dest (cb10-84) >> endobj -505 0 obj +494 0 obj << /Type /Annot /Subtype /Link @@ -5816,10 +5679,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-100) +/Dest (cb10-85) >> endobj -506 0 obj +495 0 obj << /Type /Annot /Subtype /Link @@ -5827,65 +5690,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-101) +/Dest (cb10-86) >> endobj -507 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb10-102) ->> -endobj -508 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb10-103) ->> -endobj -509 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb10-104) ->> -endobj -510 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb10-105) ->> -endobj -511 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb10-106) ->> -endobj -512 0 obj +496 0 obj << /Type /Annot /Subtype /Link @@ -5893,10 +5701,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-107) +/Dest (cb10-87) >> endobj -513 0 obj +497 0 obj << /Type /Annot /Subtype /Link @@ -5904,45 +5712,50 @@ endobj /BS << /W 0 >> -/Dest (cb10-108) +/Dest (cb10-88) >> endobj -514 0 obj +498 0 obj << /Filter /FlateDecode -/Length 5015 +/Length 5118 >> stream -x]K$qׯCkI> |.MK0z t#3*jzv -4G ~ e??JdTJ9:_~:|*z%⡐џ!Oࢊ'Z=O.˘U9k_DN)Hޫ).,diK`r lI %(%ea!6LQ  >ZM@3^ zh֨"-fhΩx#Ѳ -!$D"- %Z/.8-MI^,F' ^ ]Ih)HˠӖfW>9%1C6HÊ$(,x g^V9Bh bJjvFybm$^0^t `)% l% lr% lʊbt %pڀfNOABg a42IX,xA /hK t68-i$,p\%,p@\IX,a:`%,p@]烕v a:2Z:" @%,:*g(awU9 @VMIKX@]4IX@]DZTXNZ.Hkpג @PGpes`%,: P0K$,]5 R& aiY-FY E$,]gQk4D KXqPohHJ$,]ZX$iQAcaJXPY‚9 pW^\ VX0V@ -3,рZ,aAڔ DNI0`[ B"c A'҂³ j$x@H/I*$,8k%,dַx(aLL$aAFUR\H -HX_J%,z % h$,`HXUe. x-a,]Ќ YkP‚d̠%,/hL$ -ME Li)ExLHXagKX&^' Rn& R/V[ oF /$,:(6%,$$,d3IX OX7" ,[`MD f ffMXbH ppg D2 &,[ɷ^ag#[ŐB[E1f#A 21j -b@a -"w2cYslJ)>~{?Oo*c ;֞͘n* @tC0Hf"ΤݘIb|n̒ep<3g4 O`\yLj.qJ)hٱ>L"(n]m pK"lPYY#8EClgrٲ^дO'@n߰kO_wßf?>ο\O3m"OӢ L4%?Ü7}oy~sI Í L;eu*O˙N^Ln&rcEo!Xo" eNlCO.]7{ˍPNgb8[oѱl^<ςY>~A6(."ץ0|\cz棏IǼ$DO@1'kfe -Ų1ќazdmy:Ty)¤!$Mi!NcxpJe+4gݒ0Av`оV&rNv6^z^4u<^2Յ%<j>`v/¡T -2#*'YhQ~Ky3/Ut6Wkl9Qs\P|咒 -^J~RDZ2O#֥O(9yj8L+'oN23/=^6z ܾ!Ffڸ{I嘐Nh761oKq566ٽޯ:~Ġ]:;ިay󈧇"΀<.F Uhnrluv5c2J* K|7nsި Q*}$DK66-yлC"zs|f=c\дߥum\^gvx/It-?P>чx XF֪|qh^m%au8 . ?/bmjs+}fGh * \< D!UВ ȡQu'I7esj\aN PBB8a!f=X{;U"v 2Jy֎ խ:\ dWkf|!Zv-+~lˎ?Hb~ElЭn7x]tH n23=-0eP/,_н O*nNx ̅TEPȀ&}à沑Ixe9Ǻ$}u2SN˭XXNV:*y/.[\N|ڶ:f4f/=џ9c @mjwdmo]9-'IX.!~dٮӖ{z ;LK*,}Jm{5Lv`)巋R03XP͑W4\ [՟/-u 9Gg_8%"cR Q)v%Ѷ( "AαR0S~[aK"asHJ5:c2bSl":=jejYBMN+~lZYb2-!,` yNZY->zke 8NV]ʲBf",pm3aʬ2( RLJ-фTи{k\h\AdոoبqLqzqJYN DqzqzFzM ok\@]oMҸFNF 1 ؐu .@-K׸.4 u8 E ch + z8[@ߣy p!,Ѹ wmS4jkç&2o˃1k\pT^}i\Ske]Ѹ w7 "иmU`2 Zr $jY$qx0C5.]qAkaZ[<; נ VVZxXV5&e "xWܦ10p@4.LCN)j\AB>,8$Aeei\z>  "EpQ-5. 4.H!"Cje @j& Rj\\j`Lz @K YҸ e؂q\Vfa l Z Dcdh\\]<5.`` Se4qGq$Hs2i\$d a3N`SͤqA6Ad @(3Fl# 0/%d 77)6(fҸ l Q2؂)+|줕E2i\c|5.@|$o&u2I+"2&"[-7 ސ,'+[%JꚁJ.LdUUZ./1p}]C$1-}9jAz|ݸRVZS:q F aktĈg#-hqZt#nb&b"v)X uV_C)o0ݮ +7Ty Kѐ|vz -*ۧ }6vÛ:י_/OO. ?ޟ}DNMMi4RO,rsypO;=1AY~kZ؏p݌l\>WG`.>Gߏc@b49 #6x5sCi)Y%"ۦ?V>1V25E=2 T, +Yrvةs4"KBqǥ'~)X,V1*'l +g}iwm0p*֣;-\e4vGO ȶuԱA'K4)+cB;uPdގ3ɗK#>O\t ʑvض}1 +=W=;m$Glښ42 >1-H .X"9j3YqBӀ4@Jخʍ5r}+7P籛gIg#,ڧs:YB9} xFk7~(ܶs$j :'ZT(J +z n:灢<ڝ /_G|rHP\ ;odݕƲP2xt-7=ht.Y攣q+hg֣G%``4ؽ9p'#t[ #߬c5p&&ں!MҴ{"q$k8bFIv!ݧsH3!4b D +捛,p>` piȑRִ{.$0+o&:灱C;:e?zfɶI(5{z9xztHAn" E2J{Dnvq#Ӂm[Gҁv7n$r_}|fكbyaD]9m&v@ ?1ysC͙f@V{Ml@:̲ŒDf}:hYٲё^y@l} bJ!FDzEKv[D{*:u1tC8HEݪR$͎n{ңEy¦h$ ;u3n5F?㇧&jb +7ERE}YڛT݋[,~l-~(=H s'=N@Xv +~z=vWSS2pSm޷->-ko,ܟufЃu#-[߶mY6j?-9Mq:灤]$ӿ6ݩsfyG kK#>~mzkϑߵiސC@6OcPi +m0?r?ʊ!Q܃ײIuĉ+Vg|O8-vuR.pwV<MgA=\tg oШb`G7_Mނ8]iD3G)?$Ͽ|r٪z$*(Yĝz%$0D&S=r_~d$3Nui5Tꄦx-č|yݿ]] ;~1ϲ 1_ʷ4xԽv{}9~2ZKȇdTq`~Xp\0ofv"_#EPuE8jdSJv!k0\OCՅr5|Ag(G{ÊnrsXȃb5%b3 ;pV[oa +M,CXMo6_ KYʷʩJۊ7F* f㤈nE) 7&_ j\)E7-ԑJϪl uϵG4g`9b|u)2e 7q"}lϗa + +Zo[lfR" S{!*B +XoGs#27xITm0_ѱZ,,h6g@ +xQ\fke'y:O2.n z+#l#{' B_p~ܙrBz2z-wkEXM#t,<  Տ;5f&RVu7=^VXa}8yi|:Xrps]9%QJQA{R6 ٲȶb?Cᥭ #e4E6^ES!om {_={'c"^ϭ^H+R?a9~|'KssfSc-hqb6UmTdFt)zTlZYTcYC;*C;*qSW[<^| B 4_kXYl暾ȶmӲmelH#S3MWk]gZ* '&/$!$rM͒a8+em 1&Y (ͩjrI:@Y™ilVpzϴS!]5d3.'v endstream endobj -515 0 obj +499 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 514 0 R +/Contents 498 0 R /Resources 4 0 R -/Annots [ 516 0 R 517 0 R 518 0 R 519 0 R 520 0 R 521 0 R 522 0 R 523 0 R 524 0 R 525 0 R 526 0 R 527 0 R 528 0 R 529 0 R 530 0 R 531 0 R 532 0 R 533 0 R 534 0 R 535 0 R 536 0 R ] +/Annots [ 500 0 R 501 0 R 502 0 R 503 0 R 504 0 R 505 0 R 506 0 R 507 0 R 508 0 R 509 0 R 510 0 R 511 0 R 512 0 R 513 0 R 514 0 R 515 0 R 516 0 R 517 0 R 518 0 R 519 0 R 520 0 R 521 0 R 522 0 R 523 0 R 524 0 R 525 0 R 526 0 R 527 0 R 528 0 R 529 0 R 530 0 R 531 0 R 532 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -516 0 obj +500 0 obj << /Type /Annot /Subtype /Link @@ -5950,10 +5763,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-109) +/Dest (cb10-89) >> endobj -517 0 obj +501 0 obj << /Type /Annot /Subtype /Link @@ -5961,10 +5774,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-110) +/Dest (cb10-90) >> endobj -518 0 obj +502 0 obj << /Type /Annot /Subtype /Link @@ -5972,10 +5785,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-111) +/Dest (cb10-91) >> endobj -519 0 obj +503 0 obj << /Type /Annot /Subtype /Link @@ -5983,10 +5796,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-112) +/Dest (cb10-92) >> endobj -520 0 obj +504 0 obj << /Type /Annot /Subtype /Link @@ -5994,10 +5807,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-113) +/Dest (cb10-93) >> endobj -521 0 obj +505 0 obj << /Type /Annot /Subtype /Link @@ -6005,10 +5818,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-114) +/Dest (cb10-94) >> endobj -522 0 obj +506 0 obj << /Type /Annot /Subtype /Link @@ -6016,10 +5829,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-115) +/Dest (cb10-95) >> endobj -523 0 obj +507 0 obj << /Type /Annot /Subtype /Link @@ -6027,10 +5840,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-116) +/Dest (cb10-96) >> endobj -524 0 obj +508 0 obj << /Type /Annot /Subtype /Link @@ -6038,10 +5851,65 @@ endobj /BS << /W 0 >> -/Dest (cb10-117) +/Dest (cb10-97) >> endobj -525 0 obj +509 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb10-98) +>> +endobj +510 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb10-99) +>> +endobj +511 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb10-100) +>> +endobj +512 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb10-101) +>> +endobj +513 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb10-102) +>> +endobj +514 0 obj << /Type /Annot /Subtype /Link @@ -6049,10 +5917,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-118) +/Dest (cb10-103) >> endobj -526 0 obj +515 0 obj << /Type /Annot /Subtype /Link @@ -6060,10 +5928,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-119) +/Dest (cb10-104) >> endobj -527 0 obj +516 0 obj << /Type /Annot /Subtype /Link @@ -6071,10 +5939,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-120) +/Dest (cb10-105) >> endobj -528 0 obj +517 0 obj << /Type /Annot /Subtype /Link @@ -6082,10 +5950,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-121) +/Dest (cb10-106) >> endobj -529 0 obj +518 0 obj << /Type /Annot /Subtype /Link @@ -6093,10 +5961,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-122) +/Dest (cb10-107) >> endobj -530 0 obj +519 0 obj << /Type /Annot /Subtype /Link @@ -6104,10 +5972,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-123) +/Dest (cb10-108) >> endobj -531 0 obj +520 0 obj << /Type /Annot /Subtype /Link @@ -6115,21 +5983,357 @@ endobj /BS << /W 0 >> -/Dest (cb10-124) +/Dest (cb10-109) +>> +endobj +521 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb10-110) +>> +endobj +522 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb10-111) +>> +endobj +523 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb10-112) +>> +endobj +524 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb10-113) +>> +endobj +525 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb10-114) +>> +endobj +526 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb10-115) +>> +endobj +527 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb10-116) +>> +endobj +528 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb10-117) +>> +endobj +529 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb10-118) +>> +endobj +530 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb10-119) +>> +endobj +531 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb10-120) >> endobj 532 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 177.989606 101.433071 159.239606 ] +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb10-121) +>> +endobj +533 0 obj +<< +/Filter /FlateDecode +/Length 5065 +>> +stream +x][,~_Qφu Â1p]8CcB[fFUfxJ.!EI6W ~$2*]o?]~hƿcPwW)*orH'b6?6sus*`G&S1Ũ@ i*F@ +F9K$#Yړ"ؠDdmH l8IlhH" }HFci`D9+ЌW$5*lHh%s*D2HB>I4/>k#X `Q +8#%, s() Xr&9 댎pJX*alJZڤI ҢtpztA]뵕l?Z/+a=hIXʔ["a 'i2) OQ JH‚1D Vi 4%,LJK IX3xTH% \'[x#aAޠ&DAKX XC-Hs$,H` R4`KX&^' Rn& R/V[ oF /$,:(v%,$ě$,x3IXFO7" ,[`MD f fnMx@x3]L 4HXěl^x}&GI\1Ѐ^*.h`/U 4c$ql"LA\5Yhq@էy*@"lfɌiA{1;ٖR־ Q\R!8<,s ~ 3`3 S sY ggv)w$^c] S4~V@.-% " +M/qap~/?zv|_>0C^TCoFL7&7|׏|OSVw<> +*)%q4u\QK8h67/1rhy7=s,>2#Z C c?ް xiPLKYB^F0V9RY F!6C&f+>{7sG߄l%̒Փ7"Q!#X\QOpTUE@/Sk6*g՝\V˒ۤ$)}$x}<P( Q*}bB|Eu:T`M9*)T\Q'ܱ6tb*:/4`]j&IcCmp2l>2#z !Yx 7B4RTAWqV<[KՔn=F~Ym\y[d7n]80zs&je,e/>crʿ,~.rdž(dQn[{pܫF~Mn!RWn~ =5!(ftLw/8o\QD +2wFMaRWET#oU`\XOw[T">۴ɝm/}&yWjLQNi[޳Xd?|ӴZƞ_~g^*\TMaQǚ3|fakkuҦ зjK/-)sOZ.{Xݵsaja%` pZe>bSG &ٗcmdždmwPTGAgik%_))yB4f4?%_i'g~1O񻍾OK_ N}nE?ƠF峭9Ʈ<_&nȍ"=o%-`켖t+GZ˩gʓM啗͗HF{csjҐ /To½N}i[ n}{8ӵ;/Xc;?ЏI?(Sǫɂ^Gzim\W5uKÇq۔+1s[<\EL&{9s+,Z7>̞em1gm[yɽ:YF3|}0'C>^rۆvO2Xw4Kф6 =Z.I0|S2#>m')^_Wu^J.;LD}Me 5al+`VsEG19F&z>o8$ny MBwیseFI1H䣽#u#_;(ϯ7> Yޝ/>Y,<" N>x*l\m皙G/ȯ]'QCVLy[hΕyx0 *Esf .N.cO6w_޷Ӿ%yI7%|/KKBy>i7ר\Jںu*IH^S[fmXܴs1{h7 _db;XLsegJKV|cүпlDpֽ}WIIw[Wݨ_eIo Os[n('oQ'-sjg_ +5xDTeB;" lH6dYd|:M'kܜ69e\t2O#ް(Mރ:LTR/]'ג2>yt|Eq`)WGx=Jm%8 r Ew76[nϗшt9&7ڶkhgMcp| B,S.E{q&SxF⨐漣Q0[F'꩹̷#]HCg&pͺmꛘʗZT.'!vӭj0;})|n1_wIŞ+`e:Ә iHb9dhiK].⣐оޜz{rC_F*:T-/ TS>*ŗ͞9=t!i őw.cyLB~ݞ*u)=TuZדtuc͍dUm<}z fRwɡcۜ N:oŰ6U?FF2X5M1H0Vlį[cIv9e/58ޑsŎ[vl]%ϖO'ا͔hil6t;n4-j:uNc dU7xیbwd~l^]C׮P0wi0שJ~Jzޒ9鑳IH sJ#kiivש4 3գ}d,e6RUV0LwPκt +B||4-i5JF[[89?%B>&LU?%Z@X0w+8/_]鏑CE?|3%{QqI^W6/ +endstream +endobj +534 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 533 0 R +/Resources 4 0 R +/Annots [ 535 0 R 536 0 R 537 0 R 538 0 R 539 0 R 540 0 R 541 0 R 542 0 R 543 0 R 544 0 R 545 0 R 546 0 R 547 0 R 548 0 R 549 0 R 550 0 R 551 0 R 552 0 R 553 0 R 554 0 R 555 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +535 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb10-122) +>> +endobj +536 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb10-123) +>> +endobj +537 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb10-124) +>> +endobj +538 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb10-125) +>> +endobj +539 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb10-126) +>> +endobj +540 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb10-127) +>> +endobj +541 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb10-128) +>> +endobj +542 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb10-129) +>> +endobj +543 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 329.565778 101.433071 310.815778 ] /BS << /W 0 >> /Dest (cb11-1) >> endobj -533 0 obj +544 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 310.618756 99.933071 291.868756 ] +/BS << +/W 0 +>> +/Dest (cb11-2) +>> +endobj +545 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 291.671735 99.933071 272.921735 ] +/BS << +/W 0 +>> +/Dest (cb11-3) +>> +endobj +546 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 272.724714 99.933071 253.974714 ] +/BS << +/W 0 +>> +/Dest (cb11-4) +>> +endobj +547 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 253.777692 99.933071 235.027692 ] +/BS << +/W 0 +>> +/Dest (cb11-5) +>> +endobj +548 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 234.830671 99.933071 216.080671 ] +/BS << +/W 0 +>> +/Dest (cb11-6) +>> +endobj +549 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 215.883649 99.933071 197.133649 ] +/BS << +/W 0 +>> +/Dest (cb11-7) +>> +endobj +550 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 196.936628 99.933071 178.186628 ] +/BS << +/W 0 +>> +/Dest (cb11-8) +>> +endobj +551 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 177.989606 99.933071 159.239606 ] +/BS << +/W 0 +>> +/Dest (cb11-9) +>> +endobj +552 0 obj << /Type /Annot /Subtype /Link @@ -6137,10 +6341,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-2) +/Dest (cb11-10) >> endobj -534 0 obj +553 0 obj << /Type /Annot /Subtype /Link @@ -6148,10 +6352,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-3) +/Dest (cb11-11) >> endobj -535 0 obj +554 0 obj << /Type /Annot /Subtype /Link @@ -6159,10 +6363,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-4) +/Dest (cb11-12) >> endobj -536 0 obj +555 0 obj << /Type /Annot /Subtype /Link @@ -6170,43 +6374,43 @@ endobj /BS << /W 0 >> -/Dest (cb11-5) +/Dest (cb11-13) >> endobj -537 0 obj +556 0 obj << /Filter /FlateDecode -/Length 4885 +/Length 4901 >> stream -x][$9 ~_H8GZ!-1gz:suRUgw[t\N%iwa.9w'kr3X\L?_ggC6ѕ(\z˱?;s)ޔUXLmTX,Hahr1) 5b>lYjQcA=+,-@ ]XPÕykU!Wx.FO;2x.{GdR.:WLJ) %4^.х`5t Y%Bʃ.3i ]>iXG1F]@Hհ=x4,@e#,Ѱ w]iq\SyŸW-Zٸ4,]'kX7Q#:_!jXw0ߌp]W-D.`kXQXlHNC5,H] EÂܵHÂܵaʃ.^5*}Hkm.$ ,@A(kX8sҰ  B> قY*4,@`m -ְ {BkX=tAȠa"So5=.p5?@2% rLЪ/yp<5,9 NR5, 4,๠aA.]E E="s l 眆 A 3d5,\M<5, R<аd;jX&]( a3tkXߔ|3kXP,tAħaAHa`QrR@z{>>~im| 'pg^?=;>rۺx?qY"w|5 ò9OL!ikc"oa$mfqvYh$2NPEnK3c( W4tPi:rYh&;n/+T㮾} (@+W_w2&<R/yy}CgQiUd7m?2"씔{o!ˀ0Ww? J9Qǣ2|Y^ -baۂc:"RGCm ŲžyU@a8ec&|͎8@c>8qJL:,;De+}$>sX7&m\8]vvobN7@:4 I=sw{[4y1'VdEVlz؞o彝HqwBJ9(33^ޛb6)_ *ow4} -q5H}" =:DJψz:7lz_Vh# YϾot4B>e,Gf֎@lٿ2hV 1[ee9o0Sou&W;s,wn:i%OѴ<y4Ns& d266\sINYgy]w<Ȣ> j,*`aZ 5oABE]Vs"7_M*ǞyC7cγrm( I*z4Y%h+Vw~:G=YNgxPyQ0X#9]s"h Kgt 0O%|چp!w̰VߎdluM>8E6O,*[j~<^tkzlqAwѹ﵎t!pCHw"dxYM(k yyOVvM'Br0׎TlXqZrA:Ƶ hWoe~k~9l@H\(H_v#{utv#ސ2|FLTINH!=Y4˝>˓K^ktJhnPΝBJW/0+wgZA^=k޹e}'?P̽eɯlBwtR4z|_ -s;OADqo#$ ,3{FO/Myo>(SQ3wcX@ea(ಷT|tMˮ?qw|Aɻ{E+~?/fнQah -t$d311@B ~zM~WTE'7c㋬ %'wExJew97MoXBcɯny]mmƤ4m=eǜresq,,O~0q3L|LyL1RuOR)؜UzLiL,þEeoX^;K7=-2-stct|sAR>yr0J{sG6nͥEpğwy瑃`A=gQ鏻t{G6n\ȿqsiIrDNvieRKʼms鶎[K g,M^yN[9$ va>T -gEh~FU3ncnu EFN咰Brj+y]&IåӆڤBSYYb|ˋ+Me֯P>پ1*Nẹ;?7jQ -N@5i?)ڼnjw!9]+%d]7ۓ/[(l;e__OrzP!,mu!+XXheRC^}ULU"J|zcdyzkL|*K# -XWw2܉qK:Y+e}ZAlMײ>Gp[ZS_Ub]mѠTiXK6f't9)/l:?Xͷ7\)rSHZn-6KVh-UN^Mm4S>G,կKr T[[o6ڐ_O1+c -Dmd_:5sm*tJ+TF䙾\JCW&7yH#=5 Z Ȟ@ώ*t[b d=T%5kd> +GJv+.]غjf [v,dۦowJL[Xޤ%n6bN0:kom$QNO0)za99}?()'^qoZ 8zA9[> Ɏ{Xx^KqGbm8}s]hhxxYb dm}pbUΔZb|\rQC}H7AcnXf 5!Ǜh -y+4^ a\R>̎UWC4^7޴,Q~svUNA{`BmSiL6д#vB. wZ\ 7 i(\f+՘Ni2=1[Lѩ[:ViGMYx-Zѝs:KXZ5Ti{h{#tERLmo¿j@+UN3Yiy4)CEl+2;sIϗO?Iϔb0)d+1BdR > ooH0p湁>Xaw=a  w!A V{ ɂY*pb XB%kXcK5[gf 2G#&i)UdLhX`;hXH֡dΪȀsl*af*ͤJxjŀ6 ?!*dـ+~u,!)*8+"/~ `E_}:꯳qq=O~z=}ZBorw>Og~('%_nc$bEqAs:|/#yߞ~i #Y?l&/yUfDNfXJcFyN}HH֙\zHJ煎eySIx }j>vFjqa_2ZT6Ŧ Ͳ,@d 'MlvoxYFK=dwazwÈoV1vϲyh{.T{y#H=;qTZ@$bt{]*ZJv @A]W68l{6醟ʢ)h y4VY9ϠGe,fnl׆T ,l]psT[O9e=eW @zkdZk .1(:Xݷ~ە(-<^NC|}FLI Ji^jz7V>,t8FI9+5ɻHIS 546sY +4fZ5}}Y??헫"+24Y0wI͟AIfH0}u$ߥ<ޥ;{4_r[~>iThB?MRr0m{os;ww`LRng<<0\;|wckgQhqI\}8]^Riq6{/>A&jos$9{(bxv0atƙI-jBƎ꜓cCѥ0g8m7ԋ!є_4V~Ypeik\60-A+Atr;8yT4ϱ8gg\䦓Dyw <ϣ\ї݇RoE4q;y)oN?Y)YRzhȝ4ſm[ǽmh.ȣ'Cغ@<~'ӆj ͏{?5{M@teeՊ-Hd/V0sQwHy{ h{Ԃ5zhFja+mQiu .@JLU8g2qV[)S2t1ZRnx-ZќS;SX2+8nT)Ҷumkp$la]sͳ-Rտ 6j8jv> endobj -539 0 obj +558 0 obj << /Type /Annot /Subtype /Link @@ -6214,10 +6418,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-6) +/Dest (cb11-14) >> endobj -540 0 obj +559 0 obj << /Type /Annot /Subtype /Link @@ -6225,10 +6429,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-7) +/Dest (cb11-15) >> endobj -541 0 obj +560 0 obj << /Type /Annot /Subtype /Link @@ -6236,10 +6440,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-8) +/Dest (cb11-16) >> endobj -542 0 obj +561 0 obj << /Type /Annot /Subtype /Link @@ -6247,10 +6451,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-9) +/Dest (cb11-17) >> endobj -543 0 obj +562 0 obj << /Type /Annot /Subtype /Link @@ -6258,10 +6462,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-10) +/Dest (cb11-18) >> endobj -544 0 obj +563 0 obj << /Type /Annot /Subtype /Link @@ -6269,10 +6473,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-11) +/Dest (cb11-19) >> endobj -545 0 obj +564 0 obj << /Type /Annot /Subtype /Link @@ -6280,10 +6484,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-12) +/Dest (cb11-20) >> endobj -546 0 obj +565 0 obj << /Type /Annot /Subtype /Link @@ -6291,10 +6495,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-13) +/Dest (cb11-21) >> endobj -547 0 obj +566 0 obj << /Type /Annot /Subtype /Link @@ -6302,10 +6506,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-14) +/Dest (cb11-22) >> endobj -548 0 obj +567 0 obj << /Type /Annot /Subtype /Link @@ -6313,10 +6517,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-15) +/Dest (cb11-23) >> endobj -549 0 obj +568 0 obj << /Type /Annot /Subtype /Link @@ -6324,10 +6528,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-16) +/Dest (cb11-24) >> endobj -550 0 obj +569 0 obj << /Type /Annot /Subtype /Link @@ -6335,10 +6539,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-17) +/Dest (cb11-25) >> endobj -551 0 obj +570 0 obj << /Type /Annot /Subtype /Link @@ -6346,109 +6550,109 @@ endobj /BS << /W 0 >> -/Dest (cb11-18) ->> -endobj -552 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb11-19) ->> -endobj -553 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb11-20) ->> -endobj -554 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb11-21) ->> -endobj -555 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb11-22) ->> -endobj -556 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb11-23) ->> -endobj -557 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb11-24) ->> -endobj -558 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb11-25) ->> -endobj -559 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> /Dest (cb11-26) >> endobj -560 0 obj +571 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 292.842585 101.433071 274.092585 ] +/Rect [ 101.433071 444.418756 101.433071 425.668756 ] /BS << /W 0 >> /Dest (cb12-1) >> endobj -561 0 obj +572 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 425.471735 99.933071 406.721735 ] +/BS << +/W 0 +>> +/Dest (cb12-2) +>> +endobj +573 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 406.524714 99.933071 387.774714 ] +/BS << +/W 0 +>> +/Dest (cb12-3) +>> +endobj +574 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 387.577692 99.933071 368.827692 ] +/BS << +/W 0 +>> +/Dest (cb12-4) +>> +endobj +575 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 368.630671 99.933071 349.880671 ] +/BS << +/W 0 +>> +/Dest (cb12-5) +>> +endobj +576 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 349.683649 99.933071 330.933649 ] +/BS << +/W 0 +>> +/Dest (cb12-6) +>> +endobj +577 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 330.736628 99.933071 311.986628 ] +/BS << +/W 0 +>> +/Dest (cb12-7) +>> +endobj +578 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 311.789606 99.933071 293.039606 ] +/BS << +/W 0 +>> +/Dest (cb12-8) +>> +endobj +579 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 292.842585 99.933071 274.092585 ] +/BS << +/W 0 +>> +/Dest (cb12-9) +>> +endobj +580 0 obj << /Type /Annot /Subtype /Link @@ -6456,10 +6660,10 @@ endobj /BS << /W 0 >> -/Dest (cb12-2) +/Dest (cb12-10) >> endobj -562 0 obj +581 0 obj << /Type /Annot /Subtype /Link @@ -6467,10 +6671,10 @@ endobj /BS << /W 0 >> -/Dest (cb12-3) +/Dest (cb12-11) >> endobj -563 0 obj +582 0 obj << /Type /Annot /Subtype /Link @@ -6478,10 +6682,10 @@ endobj /BS << /W 0 >> -/Dest (cb12-4) +/Dest (cb12-12) >> endobj -564 0 obj +583 0 obj << /Type /Annot /Subtype /Link @@ -6489,10 +6693,10 @@ endobj /BS << /W 0 >> -/Dest (cb12-5) +/Dest (cb12-13) >> endobj -565 0 obj +584 0 obj << /Type /Annot /Subtype /Link @@ -6500,10 +6704,10 @@ endobj /BS << /W 0 >> -/Dest (cb12-6) +/Dest (cb12-14) >> endobj -566 0 obj +585 0 obj << /Type /Annot /Subtype /Link @@ -6511,10 +6715,10 @@ endobj /BS << /W 0 >> -/Dest (cb12-7) +/Dest (cb12-15) >> endobj -567 0 obj +586 0 obj << /Type /Annot /Subtype /Link @@ -6522,10 +6726,10 @@ endobj /BS << /W 0 >> -/Dest (cb12-8) +/Dest (cb12-16) >> endobj -568 0 obj +587 0 obj << /Type /Annot /Subtype /Link @@ -6533,10 +6737,10 @@ endobj /BS << /W 0 >> -/Dest (cb12-9) +/Dest (cb12-17) >> endobj -569 0 obj +588 0 obj << /Type /Annot /Subtype /Link @@ -6544,10 +6748,10 @@ endobj /BS << /W 0 >> -/Dest (cb12-10) +/Dest (cb12-18) >> endobj -570 0 obj +589 0 obj << /Type /Annot /Subtype /Link @@ -6555,51 +6759,37 @@ endobj /BS << /W 0 >> -/Dest (cb12-11) +/Dest (cb12-19) >> endobj -571 0 obj +590 0 obj << /Filter /FlateDecode -/Length 3690 +/Length 3157 >> stream -x\K ϯE 0t`0$F` -*C~>t=XIV L`ɏduK¯"J9]s<"T8\ct]sto1ZSxe \r`U<b2X.V1b 1h P V,U!F$ bP`7yċp0x]¦'ȥRC5y<1"YRJX<,zxDldAP2[ YvY`]AX#r&%ldI>VY"`~,p"r.֠͞EBY| B,>' ANq€PIb@(Il@I^ C(B&"\Y :XX Y X _ފdap!\XX\R 촰plau9`avYJ,-,.3F< -[X ]&-,.(XX:aB)` `Enn>XX !YXCqof]@H`2XXT Z9*5YXT>WeeG)U "p-,]gQKHm w7D `XXtM^ubaA DGjaA"W pGf p Y ׀5|ɪHa񀻞a>W pWæ)+! C,,HE\9YX)KhaA D@Ƀ,$֮r-Y8 r,H,,@F*!6s1,-,RE,,1îZ\ɀkWlaAR-,;M,,XX+dXXPJ@fn ɶ.xDY ZXPBAШ%O֙‚"iha&AЏ?(6Q&p>}!#fY_v>Wo|夬%iaEBWnNP 8W R !njQ!rB`q=tS!nȐXe&$3˕ɼ.*8ٲ>{璕ۺp?Hގ5r9!CR,@B/A˦^FޜF4ln_}wXO_kzKzxBWtir:Ωk7{\I dNQcC>J=VPk"BQZ_ϲhv|ɻ#[!4DkGdŨ52QɃc^NpыP9FlꀵnaBv1/Gp?sZ?NP]WSxϸ+֘ՍTVO@rI\Qf$ 1/@(@T 4>ؔ7š2tL6Z6`VW7!SYWwF -)(&s4beES4-^EwciIncc^e,j`t7j& -o&(;~{OͨHNnj$,'=Н1#asF6Kި,ُ&%r{q!/T4a妩L>K3m滰/fx=]΂ ~zYrv{r^Rn34}8ޛ/-}qyD@1e=F. d͐ey5o2!ubʠk.y -%;Om`(ty=amy9cJM].xwh(L -yZJSf˄*YO*qzl̋Q>R"2Ulr*ä=-攷 JyƔvPo.R =doǩZ&M-CFjYYnݴdžH#J@&q3yn),9&'!gwEQhρ -fT^;쐢yC\1f񴓩y>0^CUizcQ{s{=ȐE.occ^Af}5K}lR\Eld75SWv݌sjJq)bFؘc)O?l'۠.WﳌzWn<>1A7oθCŽdׯ#'Cd0q5Nr ? }Pb s eD#)v A{C}qJizRn~3kBJNش=ӣv'ڝ#ӪtĔ-@5s>ԿPjxV&Y7^/]yikՀ}VZ2?˫v82Z-A_>:&qW,[,Զ 㕑+[z-.vC}WâՍo\OKO}F ~}.C}Oί_kcb0}J|˳@ "F&${G+YZ*Vꢠf8&p K&1^ 7.u4E5"X'Ji< U;5]!dNoS 34Cޯ~t0Ů{1 S7ޠ-{R9uKNk_& !JA~:l+|l7y2k6>P;UgBMJf'o7i:b - *ι_C -w߱ uڲkOAǖL:Y!OʙXnc7 yFK4{r4s8]>dxZj-2h7C0 }Z[;:Kp2+08M4gGt/|:9"tlݐHo6i#vA&d*olx^:w&Ʊ9t n{"vqz^]nR1_ex4%Zutp%Lј'EsZ6bA΋WeVZScJ#Ƀ'#S7rS<7扅EFCvO*rj4S)M奙sxy9ء>O=1R 4fe [;yQi͢-Pt7Z17:mrܥsAm8kob.-l{gssbwcvV`Pl P e_RHLGs$q+AN}&{*O`iVa՛ %COpo=ͬ ֤kٓyd/ +x͛[% ϧ8a`00$kfvWKήװ;̞n.*կ:=|%|*Z[z}|B$¿fSߒLZBk7PZ%_.t5rtGSRKTR +ĔUGlST4꽪 m5y*1VGUahaW5 RqTL#!*q +=]kDO'rQNZ9FlIJ2l,`KE<]-]-` ebO$VU]]jH)*B9$:(LR..–L:ؒآtDRZn!aO`KE]l{Pqc@,%hA V Zz-E< ĖV<1t=#0lQ\W[<@@[x,Vo8{,fqfX @.\y,0WNbJc5{,pWc"` cx,PpWwjfk% +J@Xc1܍wrpI~8[XcAwas4h \1}.qgb<$px,H.Y=;jX]ԞcAw7$p<` Lp]WZ=$pX  + @C=dp{X]J" 2Kcl5`5P)<Kt.Qi 2kۦǂ\LGjhdt\]O +A,W[֡I J-ǂa BBcDnz[.n~,Ԧ걠| r ׮BcA)Rb{,K `t J-X* {:-= ҅cAѠǂ+L C#P{:%3ǂ9X&H` 0cvX&W[$ǂZcA%RXߴ|x,h[y,h q<47z,|z,hB79I|x,h +[BW[45g݂I7A'OaKl걠lfX0&"zHZYp75ӁL DdWV8{b@@o؋ݪgZLd5Vdr EGTPgbٰ,9f1y|ן._{鿗wNE%ɖHln*l+B5 a1#JF2؊ݶɰlf3ۓ/2TIm:Vb!}@Lv+rs1#|KёEc'^C?=\o'vbp#]_~>DWl?ɼg'z~;Z{Zg^~s/zi/GF??7>|{q+B> ep {ʼn]Oc"C6<rHd7ڲ$'WXO(Ü)s_nTS?u7熯pEk9> ;YZsz_"¤rضXE]/laUb9d>m;N(sЈX]?4B RȨs@JJOz^='RctxZ- G9V~9{}>WyS|Rg ,RH[CΗžIpCcm c$ɎrtC'أrr9֞ Q6K^vb m38Nº~88ɽJpptùtѝm|ζsr߾ŮlAUqV8~D loS9d$'(>mutӶ7wK"%a(%&Ot?gkO"TT7 aT3.Z#>n}^a'8ۻbiX[Blgtp|L endstream endobj -572 0 obj +591 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 571 0 R +/Contents 590 0 R /Resources 4 0 R -/Annots [ 573 0 R 574 0 R 575 0 R 576 0 R 577 0 R 578 0 R 579 0 R 580 0 R 581 0 R 582 0 R 583 0 R 584 0 R ] +/Annots [ 592 0 R 593 0 R 594 0 R 595 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -573 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb12-12) ->> -endobj -574 0 obj +592 0 obj << /Type /Annot /Subtype /Link @@ -6607,21 +6797,10 @@ endobj /BS << /W 0 >> -/Dest (cb12-13) +/Dest (cb12-20) >> endobj -575 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb12-14) ->> -endobj -576 0 obj +593 0 obj << /Type /Annot /Subtype /Link @@ -6629,10 +6808,10 @@ endobj /BS << /W 0 >> -/Dest (cb12-15) +/Dest (cb12-21) >> endobj -577 0 obj +594 0 obj << /Type /Annot /Subtype /Link @@ -6640,10 +6819,10 @@ endobj /BS << /W 0 >> -/Dest (cb12-16) +/Dest (cb12-22) >> endobj -578 0 obj +595 0 obj << /Type /Annot /Subtype /Link @@ -6651,379 +6830,319 @@ endobj /BS << /W 0 >> -/Dest (cb12-17) ->> -endobj -579 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb12-18) ->> -endobj -580 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb12-19) ->> -endobj -581 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb12-20) ->> -endobj -582 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb12-21) ->> -endobj -583 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb12-22) ->> -endobj -584 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> /Dest (cb12-23) >> endobj -585 0 obj -<< -/Title (Hardening Guide with CIS v1.6 Benchmark) -/Dest [ 6 0 R /XYZ 85.009843 502.818898 0 ] -/Count 14 -/First 586 0 R -/Last 597 0 R -/Parent 600 0 R ->> -endobj -586 0 obj -<< -/Title (Overview) -/Dest [ 30 0 R /XYZ 84.259843 272.631496 0 ] -/Count 1 -/First 587 0 R -/Last 587 0 R -/Parent 585 0 R -/Next 588 0 R ->> -endobj -587 0 obj -<< -/Title (Known Issues) -/Dest [ 45 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Parent 586 0 R ->> -endobj -588 0 obj -<< -/Title (Configure Kernel Runtime Parameters) -/Dest [ 45 0 R /XYZ 84.259843 539.222079 0 ] -/Count 0 -/Prev 586 0 R -/Parent 585 0 R -/Next 589 0 R ->> -endobj -589 0 obj -<< -/Title (Configure etcd user and group) -/Dest [ 45 0 R /XYZ 84.259843 283.686971 0 ] -/Count 1 -/Prev 588 0 R -/First 590 0 R -/Last 590 0 R -/Parent 585 0 R -/Next 591 0 R ->> -endobj -590 0 obj -<< -/Title (Create etcd user and group) -/Dest [ 45 0 R /XYZ 84.259843 169.788971 0 ] -/Count 0 -/Parent 589 0 R ->> -endobj -591 0 obj -<< -/Title (Configure default Service Account) -/Dest [ 53 0 R /XYZ 84.259843 561.590928 0 ] -/Count 1 -/Prev 589 0 R -/First 592 0 R -/Last 592 0 R -/Parent 585 0 R -/Next 593 0 R ->> -endobj -592 0 obj -<< -/Title (Set automountServiceAccountToken to false for default service accounts) -/Dest [ 53 0 R /XYZ 84.259843 522.092928 0 ] -/Count 0 -/Parent 591 0 R ->> -endobj -593 0 obj -<< -/Title (Configure Network Policy) -/Dest [ 67 0 R /XYZ 84.259843 599.840928 0 ] -/Count 1 -/Prev 591 0 R -/First 594 0 R -/Last 594 0 R -/Parent 585 0 R -/Next 595 0 R ->> -endobj -594 0 obj -<< -/Title (Ensure that all Namespaces have Network Policies defined) -/Dest [ 67 0 R /XYZ 84.259843 564.092928 0 ] -/Count 0 -/Parent 593 0 R ->> -endobj -595 0 obj -<< -/Title (Reference Hardened RKE cluster.yml Configuration) -/Dest [ 77 0 R /XYZ 84.259843 191.441066 0 ] -/Count 0 -/Prev 593 0 R -/Parent 585 0 R -/Next 596 0 R ->> -endobj 596 0 obj << -/Title (Reference Hardened RKE Template Configuration) -/Dest [ 400 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Prev 595 0 R -/Parent 585 0 R -/Next 597 0 R +/Title (Hardening Guide with CIS v1.6 Benchmark) +/Dest [ 6 0 R /XYZ 85.009843 502.818898 0 ] +/Count 14 +/First 597 0 R +/Last 608 0 R +/Parent 611 0 R >> endobj 597 0 obj << -/Title (Reference Hardened cloud-config Configuration) -/Dest [ 515 0 R /XYZ 84.259843 385.582628 0 ] -/Count 2 -/Prev 596 0 R +/Title (Overview) +/Dest [ 30 0 R /XYZ 84.259843 272.631496 0 ] +/Count 1 /First 598 0 R -/Last 599 0 R -/Parent 585 0 R +/Last 598 0 R +/Parent 596 0 R +/Next 599 0 R >> endobj 598 0 obj << -/Title (Reference Hardened cloud-config for SUSE Linux Enterprise Server 15 \(SLES 15\) and openSUSE Leap 15) -/Dest [ 515 0 R /XYZ 84.259843 245.434628 0 ] +/Title (Known Issues) +/Dest [ 45 0 R /XYZ 84.259843 799.370079 0 ] /Count 0 /Parent 597 0 R -/Next 599 0 R >> endobj 599 0 obj << -/Title (Reference Hardened cloud-config for Red Hat Enterprise Linux 8 \(RHEL 8\) and Ubuntu 20.04 LTS) -/Dest [ 538 0 R /XYZ 84.259843 360.287606 0 ] +/Title (Configure Kernel Runtime Parameters) +/Dest [ 45 0 R /XYZ 84.259843 539.222079 0 ] /Count 0 -/Prev 598 0 R -/Parent 597 0 R +/Prev 597 0 R +/Parent 596 0 R +/Next 600 0 R >> endobj 600 0 obj << -/Count 15 -/First 585 0 R -/Last 585 0 R +/Title (Configure etcd user and group) +/Dest [ 45 0 R /XYZ 84.259843 283.686971 0 ] +/Count 1 +/Prev 599 0 R +/First 601 0 R +/Last 601 0 R +/Parent 596 0 R +/Next 602 0 R >> endobj 601 0 obj << +/Title (Create etcd user and group) +/Dest [ 45 0 R /XYZ 84.259843 169.788971 0 ] +/Count 0 +/Parent 600 0 R +>> +endobj +602 0 obj +<< +/Title (Configure default Service Account) +/Dest [ 53 0 R /XYZ 84.259843 561.590928 0 ] +/Count 1 +/Prev 600 0 R +/First 603 0 R +/Last 603 0 R +/Parent 596 0 R +/Next 604 0 R +>> +endobj +603 0 obj +<< +/Title (Set automountServiceAccountToken to false for default service accounts) +/Dest [ 53 0 R /XYZ 84.259843 522.092928 0 ] +/Count 0 +/Parent 602 0 R +>> +endobj +604 0 obj +<< +/Title (Configure Network Policy) +/Dest [ 67 0 R /XYZ 84.259843 599.840928 0 ] +/Count 1 +/Prev 602 0 R +/First 605 0 R +/Last 605 0 R +/Parent 596 0 R +/Next 606 0 R +>> +endobj +605 0 obj +<< +/Title (Ensure that all Namespaces have Network Policies defined) +/Dest [ 67 0 R /XYZ 84.259843 564.092928 0 ] +/Count 0 +/Parent 604 0 R +>> +endobj +606 0 obj +<< +/Title (Reference Hardened RKE cluster.yml Configuration) +/Dest [ 77 0 R /XYZ 84.259843 191.441066 0 ] +/Count 0 +/Prev 604 0 R +/Parent 596 0 R +/Next 607 0 R +>> +endobj +607 0 obj +<< +/Title (Reference Hardened RKE Template Configuration) +/Dest [ 390 0 R /XYZ 84.259843 518.211778 0 ] +/Count 0 +/Prev 606 0 R +/Parent 596 0 R +/Next 608 0 R +>> +endobj +608 0 obj +<< +/Title (Reference Hardened cloud-config Configuration) +/Dest [ 534 0 R /XYZ 84.259843 537.158799 0 ] +/Count 2 +/Prev 607 0 R +/First 609 0 R +/Last 610 0 R +/Parent 596 0 R +>> +endobj +609 0 obj +<< +/Title (Reference Hardened cloud-config for SUSE Linux Enterprise Server 15 \(SLES 15\) and openSUSE Leap 15) +/Dest [ 534 0 R /XYZ 84.259843 397.010799 0 ] +/Count 0 +/Parent 608 0 R +/Next 610 0 R +>> +endobj +610 0 obj +<< +/Title (Reference Hardened cloud-config for Red Hat Enterprise Linux 8 \(RHEL 8\) and Ubuntu 20.04 LTS) +/Dest [ 557 0 R /XYZ 84.259843 511.863778 0 ] +/Count 0 +/Prev 609 0 R +/Parent 608 0 R +>> +endobj +611 0 obj +<< +/Count 15 +/First 596 0 R +/Last 596 0 R +>> +endobj +612 0 obj +<< /Length1 9900 /Filter /FlateDecode -/Length 6558 +/Length 6559 >> stream x:{\UU^py? 8Tt|:)HZj ->2%S35#sd9ff͌:33^Lfn3ݽkǷ׷Q%CBzzCksoCCӆK/J{Sfll) ;npԓ`yaԤ?Do6wz1ispܓ.i ̐S4sY8%E`YԷL8Cj~xjF^vnZ;ΠI%=cGǷ@"|lΜioθ~HZz6Q? {n^{bQa`拊BMMvT{Y ]_V=xC⤮ -_0WP}Qc󚬏L8@/ 6];':fꆶ?/9hYATeI ES8\v% Xmڬ|;!U/]6O~8Ock||)5Pr瘒% g_ٟ ̞|Jg>#&ׁowQ)N;$ GP? +>2%S35#sdy5Ԛ;cnh6ך{0m{݋z|[{}lU2$g>6g694<4mH+?uh/@/бL= GfLMZNCc{'W`^ꏟ67g=iop~8 I0E/>w^]R*E}97DnGgfe熝߾3hzRI|GϘ;'H͙S8-;zs+WK&d͋~q0]**,!L=|Qq^@÷Ԕ d'MpG}}a*h׷Uj?xC⤮ +_0WP}QcL8@/ 6];':fꆶ?/9hYATeI ES8\v5 X'mڬ|;!UO]6O#&ׁowQ)N;$ GP? 1 -{U0@MNo i}c!`&̆BXԦisv0 gt mmmW^[:bP:=<3zB[#zA7f:޶ rXǃЭO'={̘^:$됬4;Zi|H>mZ7<.|ڌ'lOD x–7'xrO-No7W"~WZ7jſ 7~kkZ 65W_ ƫ?OjO{+ioD~rG5R| (xP~i)^~/]Vo']ksBD<+ -;?o)'Z o|]q lxLQ;Wy@c+)1ʟOV|.k  o>ȷ3[l@b&$pc(iQu nXoz+>݌]3=k5O)#?'^Ջ>Al>q?V4*'4c% TbI+\qre=m\Rҥ$K3]ԍ -\,+.B.8K5cBDl8S8: -&0G`jƩ"pI'N08??Oc 28q?>Z`&pC6>JC6|PH)ppC|pkpH |@h*{>';ȗA} O/S__ľf׆fI>x' -nj <{WO#eÞF쑈<>9xw79[wc6_t1Z`H_ >#aJ,b5cH@]r1$ ПKS@8ډW`-E\ -sYɆF* NTrQI,4K=2/]$pxd9*'`/lehV:+`dXԓv @pF@\dpp0'K1.cd|2~r|^ΒKXnSMgBxǔ/1 4 -y .ZstZ{ -L*~P)l@e%؄4 K9L$)?C-P"L x#i^n@ ;4D.vIYpB`M0 -%-&޵RaYl/|)grG!i r)6i [UD6 #޴0@yG2̢V)k` aUoiVy {Rceu-ߢ'&JN]xaV6g3EzQ/v* We>A~]IBېcة&RCy(;r)x\bE4%>pAU/ <`Zjj̶#|3'ĦSHo6]lJeb$;䋾4_'F,m6e^dwX󥽔i"א͘!&x@RVk\m4cDXnxo64ڮkHI83yE|?ؓl1aB,pd2FsH )읋MvO5l!{:{g -BB""Sc=!PO'ψȈ̈-]RZV^"rmlmΥ:dfegEEGt+%G%E&Eh R1$k_: -7{ +kŤ6f;>?oHI9%=;^{QW-kWIV -RV4>09@cgm\O}lAAkj8CI #QfzώzhהV{֓)v㯜?%>~ot4FE$Il =]jmTiaB:I*Ӽ&۩ BCkCQ IB6 uD&z\[۹%yy4f4RIsW:*#i9!ekz4u3}ރg&pNm&`}kHL >$rS/.iwI`;UL vm9{P%ﶴ`W?|̇~%>_ڣkO0d23mfG%>@4ZRi{-MLRaN-,&u0˥Qvd=K.YR~ NvBڶ}񝭕u[^ךN+{qh8SeHWm-3Nf3Y"#׏uKuVq~Vgڹ vEh,9\BlF3Y!3tSΨ,_3x-_leɤKRWKtDZėIU)uT7K#7*Mn+wJcY*\!W'5-Ѱ_ o~oow yǒ%h4Fz2]iٺ_j_C_$L(c_PB .KeH8zmaW}3]ӣIރ5t)QW/!:#(zmt-ף?n6vu}v+;n^>^_`EOO[>ZO5?USm3?Z)g~Gey ?nyw(Kۣ5kF t SPo:Vw1:|G5|:6R(U ejTf.Y|leRGm@yslg#Ta?z/:Vh(PqD(MW̤I3VZIQAMwhDт ~Lb~ 6]+9玷$qOv+  W;:dgvƹ;cTAuFQu|"7ڡ;Lw Vs`sƁs8h_ogoWwn"c+L -K;&II1}Њ]1clԸ݈2PAb%?L4Q{&UUlH=?N:9'ty<6Crn23=#7Wm=u<9ynejVޏ_6r:\JdLgaլ|)KliK:cNEa2:)H,bbȒ^o^Z[5jIYk}Z=@v>A/' aM鵐9ͣ][Tcm7+tvþİ>ʂoQiwkwJjO{4%/@[؎X$=PR@ave:l1n#뜙#\7O<(âvܜb5<5L%JeRT.vJd.10NW! rl80ţl"N3|g3qNFQg28$clRIzjg!he4gV-fQmC§]#왓G9ObFYG}/wĀg{Sw%iJ6 t4YǙ2LR7-&],eR,mL RW:.Qܤ@ 54,np()#d7T" n5m0GYRWM$Xӥa.{ܣx 5͘fJ3{R"/%) eRBRKnlM&fӻƲݺvN'/*/;-/[%ǸtߑuXbx]3_zlgiZiJfIڗ>HN ޖ@emc\͡ V("X 0 N8z&B$jD8 &PBw1A6̅4: -9Tam\%z/yf!չi k&~, hlZFYn<, icWd&$pZ_Hgs?3VRB;̦Qm-1%ItܹsMyh?zIڗ6R~e6c‡/v*Le;j n;錑tRFA: zmZ7<.|ڌlOE xʖ7'xrOmNO7G"wo w7ŊM7~ԃ7jz 65o_kHkzYoT~r5Rr (xP~y)^/ +] +|_{/ssn"xzƷE o |SqolxLQ;Wy@c+)1ȷs[l@b&$pc(iQu nXoz+>ی]3=k5ϸ)#?Ƨ^Ջ>El> V4*'4c% TbI+\Ire=m^Zҥ$K3]ԍ \,1+.B.8K5cBDl8S8: +&0G`jƩ"pI'N08Lc 28q?>Z`!p#6>J#6|XH)ppC|pkpH |Hj*'?ȗA} O/S__ľf׆fI>x' +ό <{WO#eÞF쑈<>9xw79[w{c6_t1Z`H_ >#aJ,b5cH@]r1$ ПKS@8ډW`-E\ +sYɆF* NTrQI,4K=2/]4p5’ 稜#̣Z 4rcURO 7"AV9+I4 +pKpe!‘œ,@$5<%9K.aIN)9 aePp$ld+|p/|NhY9*vi'+2TC#gB/m"Qw= a0._{x32:| @@ 23ir:{z es&TEhN&e=E +9J#5,XChk|xJ]Z$ge!okў1\^؈lVl\0{z`XJ\0ZpBO5IWǿ[O5i{iu7|֚(92N9ӅYĎ}_Fe2$۩,_Wh* %U/ nCalJʥGIBtnJE!rTy &x\Vj5aJ0B3.͜PON#It)r/Ҕ~vNG"!6wو{aa͗Rη\C6chSJm.[*r]j%aAn"VS}`kh#%$d xA>)C)l +T\Nľ}b+&&*R¾}儨p "_ڹrt3=E߁gʸh7X z9xt ǎ㨴#"_cO, +ղX& +vLDBXxU^ U/05؟2BC [HMĤFJAHF,#t4D˩"zϿ(Xu6$_k._RKܼtUWHyEzj3ܦw> 5]層@^:`}uWC$8m]5t}#oPXDiRd~.E#VmY`ٵYחW㬂s.?:UWę^6mg }hUHbT:^pU[שC%mD[Kc˩;ԉK7)) n{Dr];T>)KZC,`ge!3?昽2[l8el?<%*~'sk>tmZ-"&ŀliWl"tP#5fB-I(ξ+w[#[Jҙhn^GUICG>;Φyާ/$pY|  ;a%|J$XgEаP(LRXX`94Lv1pХ.W7)[dȠ@kOC3SM-Mmj4:5;#z"Dƀp#"cb;|366&&OtR<^_ >f}S^TJCe|_޿Kº|k퍲Ig 3rRoW WX Us!1jBtZ 2)-$$&%'D$DzB<0O'["2222bE؛K;u. + + +ϊ( +- ++ +/(-+/rOKgJ&$IM"AbH™tOnzSV?zI/m:w|ҿߔKsJ{'vlU^{cc[4v!llYi^-8|`s `nؾ1قʃqv:AdG0kx3Ȯ)'S퐓_pj|h6 4HTɓ' {փYV/ۈ2P<$tvTyCSMS7gֆ<:&m< LxmɹsK^k=ҳ/ai6fiL-\];G7tUFrByŌJzz ;֥ᵬrIKwHN)rv\OԐڐ߆ ᩐRTWja60B!+ +]A)4Gߑ,3B7e--:3-qŵ| ^i-Vig9нLx6'1^D<3btTb}L7XFא@P-C#|HTO5 ^\8J!w/^]~!&w$ ]vP+Dsѣ͡Kkiyot;}Ι>Z|& + }G7ޜ<- `d6 g^͒K6}ݢY-( xώJ[o?S*]?Mܣq?x +vb&q큒 +(%7)`ĸ t'gYYʜ ]Fha,T**riSRh$+vUqr ltHgq·)u3|.Kqe`UXE1BQڂM|ԩomS(GMeSO_5Y-v-Ih< $da_{q +78Ǚ&ifb7NSU&8 A,Mt)$2YgϜ<ΡU~Zen&W6B>ڰh? ~RwMMm\y)4\Mdi2g0H<ߴtJio05H = CdDE6sj6_ʃ 첸͢XFcP3M I0Og) ltKu,`[^orlgiZiJfIڗ>HN ޖ@emk\͡ V!("X 0 N8z&B$jD8 &PBw1A6̅4: +9Ta\%z/yf!չik&~, hlZFYn<, icWd&$pZ_Hgs?3VRB;̦Qm-1%ItܽsMyh?yIڗ6RAe6c‡/v*Le;j n;錑tRFA: z-yT/.˧R{zqlX>#`flX>'0\͞?F +gυ +r~~tghϻegdڠ\8 _nw_}6=g(Jx k]8tWYڍ4 P endstream endobj -602 0 obj +613 0 obj << /Length1 6944 /Filter /FlateDecode /Length 4153 >> stream -xYyxSו>Y2/l%,xӓ]-YWxȖWy_pb2LiI&MB)k !K҄44̌L &:m:th$'ۄ|_{='#Ftba} 59W>h)Ŏde@B NOOynBC{gKpso B"BM0v:Be/sG? -bݍ3yx_Mt6,BK艹H =GE缿[?a~ =cxed4op7s I -\0OA^2f^H8-y -$>/0 -R }@kGi~ӗi,F?CqAI,B@Lj5?Ϙ>}u^ߛ~(P&Zǯ:XI.bI!J%h5Y&(qHJP6ـ,.rP!#@ <*$/=/Bt -xzgCd9#Gc(@on1X̯ҁIQ}A,!Ў%0 sQ2@1o&h>BQa_x3Z %r|;0PZz^AO(%Iu @ñc~DϨNK -C6Tʐ'v_O}Ϳ+ Ef^j܇)tG܀S6aIXE&#g&/ b J*yԅ2OÈW4r5Pub:rUlq8F3bZJ^XBڸɆMOk~UoGk`"e3 >{Iq8meZlr׸]Ul 8N:gxEYJKVZ 1l Ym-kN9!7YYZcW+cF 2*SJWdS,\UVqIA#fLos -<(=@I%V2eO(Y֩T:Y\[ɫ)wj[[Z-x Sfe1=7xQ``&R`E+)ϵƭNv6\>ph)܀2@5&fyOpQqÂ쒅 ; T -e#]l2Yh;ZV]r@dzZY)8nrYK - _c"l?u̓Mc$!ME@C&aSICyI)aK]iIōm!ɦ,p#w0fFd1`1l]dkNǗ9lS&o;+Q2#nfXF q놊; ^Xo @}a&H$Ԅm0RS[ޟ[Wg3Qz!{ߛQ]f2\KHXSVQ{ ڤ@^&_A\X̛)if\dT_5yL~ϔ̞  ϿW&h5WXgrPBNw@Q'#F\wBxen }tl>#6]\m~9G2Lȏiz3K LNH -c$y3r~5UyqB6;S@R :|v5@67~y>r'>E{,|2RT4bWJ2,uطs[Ahy6cI;?ߝ׻y y: ڤѷkY9q5[|ɷ0YswmI}EbyVbY\U? rV.9-_@.Hfo +xYyxSו>Y2/l%['ɻ,[vWɋŘLiI&MB)kMJ/4!Mffi&I6i:COsmBso=w߽{s9OF!!LEBQmr6+3Ij]ޘ-ΑDB'ۚ=M^6(61{`(Gii՗`G.Cu*OY&OgZ}O ^FJ9:.,,xB {A9ZT^n2!DqGP@軁sJ|e< eB_0 +R }6kG~3i,BD1z@4BOLj5Κ}u^ߛ>(P Zϯ:XHbIJ!Ch Y&(1HJQـ,=?.rQ#@<* /=/t +xzgCd%!Gc(Don1X̯x҉I1}A,!Ў?QDQo&)h!B oQafJ4c&:8vZAaDB-`Xg-JdbTFWF|Qdl"O +:v[WZ]j ܇)tGd܀S6aIΜ~>Wp_svSF&fpLiaN⭷`gOCYP$QRY#$b%o_{]o΍cOxϼv:L)̬ϔ5ajQ0q%zzgu}{8Q-g('?ۛmCj6ď'nhViXe8B(+ˣd˄(9-th&r¦Ic8YP(dZz{p/> 1 &dЛ$dk<*F֑Vj!lS. j6TwMS 1bQ0 )DZr4BT,U?Hc`c*cͭ# [}j\[wcp=COP|@HWT˫@ԬF3O?bhdMvU"hij,uvQiKq!AKj.UOKݒa˳LZ~ǐJr͇R՘ e2Lkp]WSSn|;N^t02[ ~ KŚi*% Òj-ASھ}QUSWT\\. ++/ףwe:uuezFyhɧr,,&1S/*#%E`/*ě׺I&b;=(. >3tGqOGc2kVQ Cw;4Xj)}Q(<<5HvRwV|,daJ\䌄*MP(uOk{SE7dZؘ_;>uTm,MVh2*u\ZׇM3䧝&/QEQPF{rসgBTW,ZG7d۳6?ܗivN;FGinw_=V]a+͖Jzr +Z +E4'> dy z#+paɴwKGG'/Mnz20~ֈB2X-4tC,̉մMMJ}*=3~t^aQZשRDRR[VgM}Kߢ{M~M^G+驣Hds\F*/}ke27hë~A7>ݜc0lq:9M]#-? e> +D$e'N_w?ػktL= Sn۾o*Vo@ ~0\L%Px +n7&=F<gK;nȄVMk[osc/"s 5+-!~Ҳsv?9yV?뷔nol:@8$BaIZ\ 7&ŽA& 43hq%ekiy4 ac =s{z빣ܱ?9!;Z+b hIe8%}.n"S3S:xWh5|>Bg`kxp݇(rV O:Jqim=*2:[x5e5_`@ EF^,kBVodæ?ܵ ?>}H&eo0R2 Ӈ=KpZ-]x%wLhܙ0*ndk N:h'c=y"LۆP%ō.- yǐvCÖ kv9>'=YYRe( r+Jdg㒗- -c@ؤ۠Z3GƷϹ^KzX@J w`Ӟ72[`<+32+˰B$}X!p}v+ϕ+~:A /0F11n92|xˡ'9)SvN[$44P$?Q7 [Qnrɲ'e,T*,[m[ڤ-9lwJ[SR-xӼfe1=7xљo`&rA`E))ϵƭNv6\>t'dk)25&xOHaq⬠; G T +e3Ml6CB-{%a ?d35kpyK1t۟>扄1Rp֠fsfPpѰĢ|W㐕%ĢF㶲|ðdSTR֓|t3K#~e2յg ˜_)e$g+6]Zm~9G3٨ϏiD7eT䛜rwDI:rg*~3]yQ|6+C@?:|v45@6? ~y!>2'>E~{,|2ZX8jUCR2۹-?l8ѝNHp Jxl]5I~Ĭi@-]vGu9Mw퉺}bVbY_V> rV.9-|_@.@o  -Є7u4;#p1L:9˪JW֜BUL. _$S5q$-*k a#t/2Rq!"RBfx6nn7\{㼲ZZh,z۞=44.O{]Xt]sIWK&ԆZP+XD)|ENi.ϷyhVW+ ~ +n)QJYݨzi_3º^; }y]<[yQ1z)) -84lA?B.`DHg~ ?mڠD+9i_me +dSS+OSeJwWbr)2uRUyʵD\D^g\.WY.,YU&(F~v/2Rq!"RBfx6fn7\{㼲FZ`,z۞=44.x]X4]K&ISWK%\5@XR,56ex.u\jpI@4ަcl:*ݹdwkr/pDΩۓDק٠!UJRY&{o;}uN_#/ǑX#}8Fbv~|"&8> _.>pY*+2R +_vhjGŊF$s5>l%<F.jfyL&Ve6ޅdR&Jkf|?F dj|ÏV@d }ǐ x._\]Vہ 4/ *ԏQ+jC (/ =PT@Ӎv?tX#?# A}~A12 v%<j@0uA/k!X @\^kkVDFT2 \JJp@A?C;.>:p^yP `;Q09ÏG45oPUp7Fe endstream endobj -603 0 obj +614 0 obj << /Length1 7204 /Filter /FlateDecode -/Length 4874 +/Length 4875 >> stream -x9kXUוku}.y\^ jA#H-QV1iK'!CmjhjR4k&~Ik-vZ˜~68:1t:c컟k^{`BKKVV>QD -,@ˊ*.ܱ>꟣gYEY[>br~KcE fl-;=g6qWR۸=;o+|4 چΚ߇~ `JSG~wv[_.kohRc4Cg+vaToh=/ K --mӗZ?^V\d 8@pkl)3hA}R*/@/H݄UP>iK%OeH$ -/g,u5 5BM0ht( +YRHN!;QM#{3?XW9GN7ޙzPOySԧfk)?Kr_fƚ)P.m<*(RvPZtHJ`3T@ ltNOF -)V![ Z{^H\DA:$xW ֔z~!6-3]U!SgxzTxzC7nGRWz-)ƊKhƗ0e!!ϖ:σV'g2|awy?~ -Sv6e <:h~݋}n$#2Sm=]؅G#|Ȋka?>hCC20:SWTVa TVq2VtaV{|8p7 .,uqXRl%V,65.YY.WpUqw.;p0&pi.)%]Xh;ܸȌ | 0obq9ns9nvnr?UIL7f(Di(=Rm<-ӆ@@'Xx S^l3O`0;Gْ6a'p,t#=Gmh%Տs)tzR4S4 nF4ւ5C5uu\ң4EC> &}c4ȈFA6̪a)??\;e8v_8[ `^&H"0ZPFo$ :0;9%\߭k6HMIv[uI+ -g%Y'G&ǮB裣vcƘuq[NͯSs%$dg]Y - u1vVBNHd~&W#Z>}Ru;44,Z);_߱t}т5=9,d wTG){[sU5CZ*zXfLЩgh0)#(YV"V%_&ݲ|ʒ:9cs ˯TK& >a1fdPCQddm![k~#E"M:!=]c~?IIѕk3l@ZvtFL';>:A}5l@7?8pBܮ2Wh#IqHsbH${MΜ9YpWaqU߿$3Ok-vE0ԬS]w䅑3˖O$%J +vACM:!l +ckH -+zSxlmѣ=뾺8/%edyS^<#1"aN -܁ufG|c.osE؊ap3#`(*'f !-e$0˿}ŷGoؼi|U(؉J,eɖc(+|m"H/+qFq=&[ta*H fWKJ$^5fϛΛ;G[ޝ\TW\!N~E_}Jǎ>V=#z!wl2,- ѱcv:Oz]rCv  V 0k]zLv\Z :2Y0'+\ zrbIײĎ+uf-?ݣhI xD`vik{Wzm"^cVTTmO ;-DPꔯaR`(a^X>=:*  \j zIKPI\R:sP.bǮFV&K?-rE.eUe1yuN-rMK67Az]ۣtKjTajTe}f96굕G.яi -Dy/i,j bP"$XCaV ,m4ߒo^$UbPry) 񟑢).~[r<֣=ܾ0_/Y][_hXh\h[обQ]6[MGYN(<[s#š - [#*Yk*S8k}ITX޾xw02Tg;d3q(grL7Ɣ=&#>ʒw#_aq1}[<&=,bOjRt%fZKuNruttݪ `x'8;/fPWsg֝;zY,LO?c˯Pzͧbع@v=QdP,{k!6@ebƧ͘:VyO KJ 5e[Q n%fY1I:Fc[t!3WNp̛|GA[6.Z45)*TN!VLMFl>:&ګӋzCtȜ:#$y'E 1X2j\Y9c c T,3<ˠ,ɺd}!٘lJ6}3ՕIOtn.FP!$*"ʪ5 |k+^v#kOCvN"?:o1/ț[0+$ccH6tnFfN Ŋ[C̟c7 -|fs(1jn{'C~S+>  6YQt%8'nS$Ir [x]Ko;S%u/xDYEZMkJPJ4EΨȨSЌ#2y!}Z?4>P<іJ\qAQ4Ja7HZ%Vm].?ΒX>J,̓KG' t zH-rlhl"`{M 1zfQђiY Yo -,sW{$%"%^=OKR\z -T, Edަ|MxEf^-~5FM/`[ͬ3m XA -P uN` $S JYԪ$ ,&vzv5T@#\=?Z|MZmjj*C!pal! -Rbz&*[7Ӻ*tU* -UDy1<0׫fuu?psifc? 7u唄iS{Y? 1ޚa b(J )1C<1Zw1,`#uMjzK -,!>DuI'TVTBƖȨm lo"l/ | +x9kXUוku}.y\^ jA#H-QV1iK'!CljhjR4k6~Ik-vZ˜~68:1t:c컟k^{`BKKVV>QD +,W@ˊ*.ܱ>꟣gYEY[>br~KcE fl-;=k6qWR۸=;o+|4 چΚ߅~`win*р1+_E]T,XƊ-b"{`*gEKsKs[e֏W--+u^L}j+)a,nfσ"eLEhMt6C@=v@4i)V![ Z^H\DA:$xW ֔z~!6-/3ECNtQ7 !jDo_(* [R8CuIy!RS0/)TaʢCKC-u?hOaaO5ϜW' |e32(9{$D@|&9e)\ᓋ ?߆OqyNc2>_b"?2T[yO>|vᑇh~؏3g@_}? Ypo> c7v +w>/.ˏ_$/Ӎ;i`gvȸC6o3at*tl!hK6 o7=bC7aC@ܶ RgL{Ua-UUXC+Dcd"c]X.U$= i!| K]x7e\u2x v5EVƅEVKի>\U+e\!>\n/L \څK +|I7.2B?.3/c</0<>̛kyGk1wbnsw3 +tJƴTO a!Љ)ja2S,2Qo8{ -&$ &x7OG/UOwcgE:,?zyи'c"<&1Pp;J:1<)Lka6 Sx[t;0tE;yfsZ j\-]hMDF`A=k5F6C PcDC(q( i3b`M%2B GX׎bY,bGe4V&؅ H9<[ bm1 , A%d +&%H>шTU!ׅ-51%8YKo0/˄~# .1=˃J| 8|;$h_7`ކq~? +Ǩįv*QҰΚaֳ*_Ȗ T#մf ]QI*9hpiW!+cDIG0v)\=X 3kIf4MqEԿV&M͔ hoYM(bx]Γ+C)EOM?Y<.\hL"bY1uH*_!\L@/C +X&ƂUY+&F3Zł12bpӹD+K + %H7÷(V(pQɒpס^K/ݏU:j$5z`bH[bHfcD-0wXhPpmr,$/bUڜG6bT7 ,Cdh5,z1 m\e c%$f9VϾ"Io'pD +.(tד%BK`):!lBNjӀjm wM-RSxkRV]R+4YIɑɱk<(1fh:SԜhk 9Y~W-!!ntBC].Chssr|zH}O$jݎ+ ;V +=wtWw,]_`MfNjN6,YeQ^);\U͐-d##t*73!L(o3AUyAɗI,/d$N'>k)1$ zO'AXL(6TPYwqneHA#9:91ʵAZH_F -;:#&Ó{lu젾6Пpp8\nWSH4k͑Y$9Y$a&gΜ,K8{8JΉ^ǵUVf"KjVn| ;~șes'~Hx aUNk]Fȕri5$K yfՁw_-<ўu_]2s٩y/W俑G +0'f:Nj>1T෹ QČ"l0\S0S@`2njBo_V};?#7lԴys.yDE%fn2d˱c6_]88 :[St+%%Gwctf\U M#x-eUN.rԈk.+â>cGRӐ;{6@BVޱk;'.U9!;{ܮcf&;.^re,?IRPSL9kYYNbGxʃe:^UNv?z|4DI<"uL0;4=+ =6 A1+K*k*6si{XuWB0)Fy0|Y,QON juZ.qzzz\@vwc.)r9(Rcf M#M+ɥ{\y9"sY*<Ϻ{ r%ZJke=خk :%YG0I5my2ҾHd^a#^foc'4sZ4l|5P( Qiࡈ0lHw~|6_oɷY/*Y1d(MRtOIє 棂q-XQl9 zDHGysB}n_/,.-/4,4.- Yh_X(cdf.-Φ#, +^ ~I~KaM-x}Y +w5)ߵk*S,o_j yڻn@L2\839cʞf|ETFD|eOޙJN~ve5o+wt3jP إ:'Y9[:WH:nou:&ګӋzCtȜ:#$y'E 1X2j\Y9c c L,3ʼˠ,ɺd}!٘lJ6}3ՕIOtn.FP!$*"ʪ5 |k+޼v#kOCvN"?:7-p1$f:LO7#3fz'Mbŭ!Zt>3W9c{AD‹lܽ|G/ʿG{ѩFzOGZs@6YQt%8nS$Ir [x]Kݩκ~2p"YD5%x%"gTJd)hFzD<㐉> ZFj( hK%.븠(׉$o+Ѷ.vˏ_gq],dMn%ɥē:=X$bd4Qd6h0& +ރ VɨIZh4ꆬ7+YQP=q`\Xǎ%).y=*'"2qQC> +&MXi3P/@ i#̦i-f֙ , ]lNhz:h'IC,jUN;w *^XMNE@C>&6WMu5AeaꡐZ[z0nQU1=V{J-SIt Ci +tU* +UDy1<0׫fuu?psifc?s 7u唄iSwY? 1ޚa b(J )1C<1Zw1,`#uMjzK +,!>DuI'TVTBƖȨm lo"l/3} endstream endobj -604 0 obj +615 0 obj << -/Length1 16252 +/Length1 16324 /Filter /FlateDecode -/Length 11592 +/Length 11653 >> stream -x{y|TEo-w۝ҝI !IH -"  $L@ac' A#A#s:;uo||^ԽUw9uS|OBV (phg&y{lt= B=h5hO[P~8z y`PƤ[킁CRg~A*Bx7M=a9LEӓ\w'W DR̛:{y7=S'̟dPחm:kWύqB6yBILgM/Mv L)=uІ&=k ȸD O?59fObs ͝h'~}<[ꖎ3@ -xəIpDslt&1z];3"QkdF@ñ%@C8W ~+T(sǡSx(Â.Uϥ@> G;P)zCKa;} jF5h6ע@MhٝA@P(v4ن.)P;uEEhFAvP Eݽ{oɒ(PQ8^)*}8iƙ帽hސqw*{ԣlrKHXrhQ*c*!|>9='' \7 ɒawE3bSlRZ -x[F1Zh!H7ׁٜb*.ܫ@l:؀P,MvEiUXgLtTd#,j1!Uxd3;tff K+P7WK+M3Ȟi7Lξz]V3톲8eVn l&leD/xV$n` #J$RP7Gi-Ş6bV:mp4 RRT6s:LTN5w5;yfk0n^3_;qŚcɱXPr@YY-d3̎Yٙh%,nd󾚶p<Ē3= DXMC 1$'IgtӲlN¢lJ GI4^NY]Z-XˠIQ&sTFD@D641yp靸rK{8rR!mz TGc *11[Ý(7%͠0@`mfs 쬬l5 ԧomӀ!g|ʾYWzoVv^s¼ܬѣQn3-o9V5-PN|_.C[]Iu^ wտʳE;09B&fZK4b} 5 -w)C! AWƵgPL&mGی!2V Fx*­̽D6Ý@2;ZUJk|7$Y7^č@w4Ml+s2+(\ꁮ9>݌0Fdw5#55@]6X^W fT `$zmE_D -(ZT%wvCv]0lpa6;뾛oCգWj&vS`~{hD$Z77ǷN)gJK_*#w#q ѵBV^:@դhAÍ8qN[ dkZ~;qR~=]fG^vXlu6Y -s)=r 7V/:iW9؝Q Eś60cir篥z?NA)8!ELR%EQ>'4_|9_h H88 g[Ȟkr4w{!hNE ^ 'O%'A~MA Edp3F^ŃN,~}n7rTݠhIQI ̖C|*2NG1#G^͑>"=gfhg$_xgnZ1ySONGtj=;t]lCAү}5Z EP]- -Iq}*JPDmt_`|s3&7N!$yF.wvilξ1SNLܵoߖ[˷o\=a}ŵ46s>ͩ̎UXkK۶=śK_ a.萀*( )@T/DLAENEL6FH5=S SRn`ZR-:9XGX'Wqcp&_ J5q =,6Yr1ixa3ˢF^~t+n-h6k5OOۻfh0 pc#|jϬUd` 2W{(!$^qh;怟6k8kh rI\a8>-Qz1C#'Rk| 3vc[͛W^FГ.oKf_3@Ѕx#^Ƕ:K_۫{AMK%=D@yRbǣX8mԂRIˈx$t*{Z(-bӰ+$ -$2@nݽp%J>g -^7pCG6NiN+6֬iˢy+$ܝSdIub0HANf{ 'Sx#UdB @ Nx-QƠ14Hy'Թ9-7f-}v.eKyƣ (TϺc-P ӣtiMuNm7kD[+?~쪕Y|[VmzdBrϮ%SXy/u͵/֜(R̥!o}*Zn@iRj$g -Qtde iwb1cFߧvůek<<Wkw/ A%n $d4ݐ&;ͩV`~@<0][}x.W\fE,ku፻8$ RF`b҂Ԁ5'w*&{̙OvRr;lR<T%*;UӎM2x ʁc=1B:E8 簓 ;kk()R<:R_*3n>p%P4bP%pXWB:#-H"2)Ql/% J.-^(:\,L>%;̀p@@5,vElF_O_j|{ a'MC%Rdmw}rMA> [ PC`!@ E -Cn|JJ(5$0[xoB<@rIh:%\. ,haS)$@.`0j{d@Yna+$1 Y1j3l7Z P,&[P2<{Υs &8H܎$ȝᤄ̐%.R!.xC v ;w9Fֱ)Ħ;d'[utk Lg2UtCn טj#5@-Z]VV_ZZn$*.‘g\Ė٭ex[sP(}fHXͪB$t .EjI~ A.+x~zￍ {bJͥv](=B7 1U%Z NO  ZtUE.XlӐp%K%Yk1O=cp+,̡Eˬ 0g_:3&^l g;41-kŦ>|h+a]"KgSY: T3V7l/, TY:U}lri69'>-G+|SB\΄pSTe$R`893LL oz}􁱕f?7#ߟV]p!5;Wilgr'E=.d\DJCͻcO==(k$U{n"ggXxM64pVvHূk!na)Ƿh,qp -x# !G̨f~`ѭ6C{o間;aliN~pR\.K+dED -B66m!*e{sp?,5H؃%g~wzVfZSZZ^^Z#m^?d8 gg?|S r?= `\^ -RE~'"!:h.LBEVsKD.+ׯiI ̛|쭒#Z|dc9_ꅍkJؑ[vy C{Www;xD[(R3cR' -(UItb {tn咳s/$dYNz VIzr@tXogTZCtΰ -4k{$zIV7LƠW4&|9PT̠#Vm\ڷv X5nYU)$'=삟:߹WY6v42VpQPvQ{uFʿ4Av!>!:I_hPy -X4 D -kC|kKdkyiK\jПmDO%FP֕{7"{"ΰgS*+iA6dA1"j먹ѸUY - U[kl Y`NK>x/}Q̎o}7~]yGۗIʥ ۧy\V N ٙ@&EۂYKRnNoڮ8' -9,E #bI:YJ!B'Ep#\"p-Mʝig![̑>H!gti>%.ѿm^]b6H6R|l)$+Y>ƮJ ȢU i I~:^`)HK @iQ#>7g"z>tgw'0џVNQL$ q!hYF_`o?]]t#4Ÿ.Լ+׵,=+UHST9UIե|G~x~D~d~T~t~Ls]!WH+ - -u2Q^QYU]St1ZH -<8=v?Oݙ:SˮI&k{c[?_ury(_xo,~;[z?Va -wJwn5eRU8YM=5\s34<*Lx晊8;q>w0a(`7^l0Vch ^Z4|! -=FaEPNO?BSZ9d8;xpj8 l+, pt4EJ/@.]9z09JK׮---#ՓO]i-$uCFla8w_o -ddAA3" tGeU>Q[kο =1#36[PTaNxw7{- <ԩ^G(VHz^yJˑL;ر ^:[ˡ;ZRMΐkF c3U|g|ڬ3T4L8V?s8{v|IOٹ{B%la<⓽ n@$$aB "SiNʷ/F#_0Q""\]rą?@$Jܩiсx{!l:|U`KML4+aVT0p#. -xa2#~C!&R` AF]|b<j1BʞU{;6rZ|x:Y7I3Q,5`L0uY#BT^(Ʉi2p}^;y{p?0;`ֱf: ,L,]썦|&(Qe: -KHEHr\h:)Q{}XLg( E?U.edY0q˪Z..}:`6h73dK]\tНׅ1TMXQPbCq]T.kGOP@v ^J~!UԼu@x=]ʯŠF͙;򱊆g6_ѷ򉪟.l"6lU9 abe1A ~_: ~GCqfz &%Jo0 bEuQ}"ꤩ':"n#n"c]H/h#O{ 5 ?0,Uߓ}a#5l}]?s]ھ!*bWnS |?^ݬFtPo1VN`_uou C\4-FOh*m$șP:26Cp4h2ȿ=-BsPfߣ5_kMdxIؗ*@aZwL{'ڝqPσ{&p_KpS4qw;럗ͭԎ֎*msFԴ1K#8(>6".¾=B ]OĄ(u'fԩOLRgM n~Z/?S +x{y|TEo-w{;4!d# K a¾*/$@D0M%2bQ1ЀD@ 9:;uo||^ԽUw9uS|OB6 (`Ġ}~8շw|P^ 2ҁK= ڱ}??4cmhv)s>0!#Λ~^ـ"Θ7̹߂{gL^ɰ?@0ck.dDB9s @#\Ϛ ' ^bh9oSGe MousB~88oS ŏp?iQ-Y0 -9 ȯ/|bܓGa&Br$"1E7&Q]R~rd=XpNMEc9y:x=륝r jQ!ObX MWH?AӉ K:~ ާyQ,Z)ٙo+tRmwrsDA@i%[|-q [CPJ܂ r(k +܏,z[h{˃4N@iۧ'PF] ^ K%/G|6x6vD%tVCՠyP_z<57dw]_DPQ@+ +P4 +V޻ǭ Dаىݻ؋{SD:ZOa>EKfE݇3.woh)'Feq_;Z[}zN/*oi8ߧvO_}SgnlpnLM>HVcŞQ؁j$`;bP6dU[mIWFZP#z{UR V{D.hvhgw4֕]Fӟ+O*ğphVZْ MozSߡ?fFO7* ,63\m_zZx^+b#o:~9 +w_0^}?cӍzSd%86A)gG]ѳ(PW3 =IFevqF1GQ;=b o}ۇ۫{ķӷa=*Z_S|:8ݡo^Lӿ>}WѽFk}eI|%1їw[ŗV?/%?2.ӝ/Xĝ }^;}:yFZXNhճ*Fz0}viu<0 0}C+A=&&;ݨp=tgRFוXuX1?X? k]]*Ft1D3$K] .1%y/ tQa. +O08 ]0Ο^?kO2:'ftV:y8L3:bFNqS,$F'2:a^`Xh1z +]dcct+PF`Fdqi06-e h>ab?FBo1-Va'i|F{W'4V_OzzMbO3YB˛g&ǫgЉyWb݁wh7F怀sihV]b4s!v@3h:ܘh\N4j)a.Tt&w 4n;Zbڑ[%$=}|C;\Md4L=mgnFf1Ѹd1n%M1 zv1h6HJd8`40F@Y@Cbh>u-#-4 SGғ8juJC{~pPPx%^(t+h-1xz +W@ *G2 (P)l[Kh9gk*G-h@8@ J;jvP"A(gDBSI&PT/e7m7~ #x~ADp Ok : Fg&Ɏ*e7e$m[G&Zt hNF2L,dA; ̈́~B̓++hO&dZ@3h1Zؒō +k;ArHs퍲h*o$D&'%~0zC#s6H;CS"l{?19J.π,V+ǔugtoV۩^FOO}C>uRvƻ&){syE̳n}`m[a{3uN`r䎤SΙYbZcmIXi0D4->sU٪e#je!;).}9NQ"%Esn@D641yp{֍buB([LAAǘTbb;Q!nJAqa5dd@YYčk(~ڦ}<=_z-躲䅹Yƾ#:F-\Z9}576zq }^ s;뚳;4; % wQ~E]JPHCЕ q-.l0I;s&MBa Jorp&t'ζldڒ֭>vu+ |pc3tʜ + +lzoNnFa';˖ٙq.ٚYKYw\ݤvcE-F=)h5,*o-~QZx\:G{,2@^WK-Ǿpɟc.M'p}CVn~Z']ܓ/`o{ 9rnO)sWIՎW: jw%X\4>Ʈ盭hɡ7 %g*[vooxw޿;60sۅ$|o&;ٹjw/hEbc?cK1V}xLBDdrQi:䲥Lmv6k1')@*&J\~}U/g֮C_^vSWl|f=z,\xwX=laGᯣ>j|ݰUꈐtJR#8k6TXdΠh#+[Hk,̎<=vנ#O46(z0C\Cݽ2>`cz׃Ć%|23KȬi!MvYRmg{ҳ85$Kw=4Ľ[}}RLa[j@1B?/7T)>*ui2 ʸoK[GMO#'y,)maBP֡vސ e0!4$F#Z;ma((uƅGPzHOpeK..FN<,v>tј՝' }Rv5b/w裵O8ni>W }xW\fA,kÛws I#P*X4Ԁ5*TRCr{3Ù3UN9ٚåx +JUS.d3|2@b'NqN,ﮪ֠ 4>o)0e@KE$׵$ 㖣WS;͓w@Y JdrqBg"veID7%$9AɥWKGERnU` +}'ILGC|D: 獒n>}ebd+JU\Fߜtb' ;<\V$`X*(<ϔx>na.>~1t7CN dK`kN!:U0nȒmaSm0"efB۫KK~Sk뭟\_Å8}dk r22\W;jK4?agfQ" 1Ŋ\ {`F%g"pW^x~F6 wi1֒-|~{x_@!v@LUC*zKrP/ 5T'QZQ5ͮ YXh8k|-g +.:WmhAۃ;A+sҋ^ܼ4yǾ`78u߷&[oaݚxth &RtDV=11|Uua>+~,u;,o4#9W,\P'S@@2򚤀3Ʌx+Z"͂SE, Kzmu2^ڐuj .s]4ugsQ|f&ot4!a9vQOř s +kgϪ'tyûv5|\z?wvqsDئeB0τGHRCH(FD"X@xܔڠx8ϱ7ـsb8wg<0UtNPuTիz"ÜE&J Ȁ=ȐBQV1UI/K~aਹ[{_07 14FQRʗcQ'G %|Dl$<C&ɥBUugFx )Xi݈L#v σY8|;;,Mge[X-}xmptE''ĒN[ѡ[.ήǢ-\8lXށ`Q(f +Qmn|.l} Q #KO,Ijʗ!rwk4RiB"7ZUVnÆu%eW:>7)T_OR>y/.}N8ɇoxԂÏVPKU6 +",-mYՄ(x??؃G.2/gNRuy;=s]{p>lS&{RmjQզ\8@4#c;Uv\VRR^^RRFϑ^?7o> +wl٣ _oB?E Ǜ Vu:,U;! hJ,P F,A%rSВ7A8$ +F&yYDze%{-d !؀^ٷiحYC9ڛ•ȃ_S^_gџ_!uIoӛn-/M} u+uШ>INXle] /(\غ. 'x>.za?^| b#1"+V+\G-1M1 ^66MV,0D] +ktbӯ*VhJO׸4at5v›8٪Sp!;"8c`Ò1۲·( mpBje!IDQBIdbR@%dUQ{Rb{+*d9rҟʣ:K%͒ѧe29Wmsl_ϱ1$ ˃U)$Yj!I?P',i)" 3Y5v' _UOy̳xGobͬd)CE,m<nլ [G AAת݈{Gw j-ڋ7UHST9UIե8=~'"y)~V{2 vݓӿ0 Fos]j}nъZW5?,GaҤnyg+׳Wluf0iD{WOpZf,UP#ܛ=4gKf_aO?]7^knK>n/`g'm`#/ިqTcj~(e<SJR5jkmz=dk,űT3,V/^u(ZZmq¯,)poKN|~G¤ϟ\ߎeX$%^;ihW;P9>*G*BR@*>$R2ʒ=O@|(o?z o[\U-=xU!5Wf>nF,_wS rtݦ+wv23^FL1[VZt-]_ 3 +dȊ)u0J0hn֨}!g%.6a’r!UnʖgȤJ#O# *>f3?L}mVWz[Ep&L{{>'32e1p0 ri7 s?a! F{gWFʷ?F_0Q""\]|GA$Aޭiсz!l:|U`KhAp1JFc (w bV:rH#J7CPWoFGYt0K_JO)=O6/1jDMVgYLuYE Ujȭ-<;^uξ>I[5dzvՁ D2?@ +O0uNuTzdsdUY')T$SAr55,A#Odzx,xQjY#TD D&V6z}' +ZZay cs|3!zPi2r#.xi ~Z&i2-!FdUǭc!VWl''؁/?#Ֆ5XŦ,K-D*pC1`b-FU^(Ʉi2p}S;muޣ!@8;x `V: "L,]䍢|&(NQe:KHHr\hG(QGQHFg+KrE?1]ɭ+ZaYaU\\di `vh73K]c(P~WwQǠSv(ZCņwW͢wX; +~j[ml =F[p<ϯ̩cW~T<6v1U4<ŕOTpqKMiʑ& Rt7v~ɽRm{7;j0+zGYc) +Duw#Oox#f~= ("݂6t^hRSM$} {o9f#79ލsܣh"7={cQ喋?T=Qŭe47zQ,u#2X( }KhzB3LnB)pG,ʇ{EP@dl!wZO4X4>EZk3Ka_ w7fh 1 TfhwBӏ*atg}wvtkT8Ap|(P9pZL.2PCϷ=, ާh̯:'iwj/.Ԏ֎\7.Moo/e\w # @G43xwзw/H;p<#i&?1y +J쉹(uԹׇ~ mZD endstream endobj -605 0 obj +616 0 obj << /Type /FontDescriptor -/FontName /PDIVRQ+DejaVuSans +/FontName /ICOIPK+DejaVuSans /FontFamily (DejaVu Sans) /Flags 4 /FontBBox [ 0 -14 472 560 ] @@ -7033,24 +7152,24 @@ endobj /CapHeight 560 /StemV 80 /StemH 80 -/FontFile2 601 0 R +/FontFile2 612 0 R >> endobj -606 0 obj +617 0 obj << /Type /Font /Subtype /CIDFontType2 -/BaseFont /PDIVRQ+DejaVuSans +/BaseFont /ICOIPK+DejaVuSans /CIDSystemInfo << /Registry (Adobe) /Ordering (Identity) /Supplement 0 >> /W [ 3 [ 317 ] 17 [ 317 ] 20 [ 636 ] 25 [ 636 ] 37 [ 686 698 ] 42 [ 774 751 294 ] 54 [ 634 ] 68 [ 612 ] 70 [ 549 634 615 ] 74 [ 634 633 277 ] 78 [ 579 ] 80 [ 974 633 611 ] 85 [ 411 520 392 633 591 817 ] ] -/FontDescriptor 605 0 R +/FontDescriptor 616 0 R >> endobj -607 0 obj +618 0 obj << /Length 702 >> @@ -7103,20 +7222,20 @@ end end endstream endobj -608 0 obj +619 0 obj << /Type /Font /Subtype /Type0 -/BaseFont /PDIVRQ+DejaVuSans +/BaseFont /ICOIPK+DejaVuSans /Encoding /Identity-H -/DescendantFonts [ 606 0 R ] -/ToUnicode 607 0 R +/DescendantFonts [ 617 0 R ] +/ToUnicode 618 0 R >> endobj -609 0 obj +620 0 obj << /Type /FontDescriptor -/FontName /VMMSNF+Poppins +/FontName /TGPMTG+Poppins /FontFamily (Poppins) /Flags 4 /FontBBox [ -27 -260 122 795 ] @@ -7126,24 +7245,24 @@ endobj /CapHeight 795 /StemV 80 /StemH 80 -/FontFile2 602 0 R +/FontFile2 613 0 R >> endobj -610 0 obj +621 0 obj << /Type /Font /Subtype /CIDFontType2 -/BaseFont /VMMSNF+Poppins +/BaseFont /TGPMTG+Poppins /CIDSystemInfo << /Registry (Adobe) /Ordering (Identity) /Supplement 0 >> /W [ 3 [ 266 ] 10 [ 158 453 453 ] 15 [ 197 550 209 ] 19 [ 627 319 574 588 628 627 634 545 630 629 212 ] 36 [ 673 612 771 706 512 503 777 691 245 ] 46 [ 598 431 ] 49 [ 702 785 578 ] 53 [ 607 586 540 674 675 975 ] 68 [ 675 675 606 675 619 328 675 639 245 247 514 245 1029 639 639 675 675 372 521 363 639 560 819 478 562 ] 206 [ 379 379 ] 209 [ 411 ] ] -/FontDescriptor 609 0 R +/FontDescriptor 620 0 R >> endobj -611 0 obj +622 0 obj << /Length 1248 >> @@ -7191,7 +7310,8 @@ endcodespacerange <0017> <0034> <0018> <0035> <001a> <0037> -<001c> <0039> +<0015> <0032> +<0013> <0030> <0032> <004f> <0052> <006f> <0049> <0066> @@ -7207,7 +7327,6 @@ endcodespacerange <0028> <0045> <0037> <0054> <0010> <002d> -<0015> <0032> <0045> <0062> <0054> <0071> <000b> <0028> @@ -7216,7 +7335,7 @@ endcodespacerange <001d> <003a> <0039> <0056> <001b> <0038> -<0013> <0030> +<001c> <0039> <0027> <0044> <0029> <0046> <00d1> <2022> @@ -7235,20 +7354,20 @@ end end endstream endobj -612 0 obj +623 0 obj << /Type /Font /Subtype /Type0 -/BaseFont /VMMSNF+Poppins +/BaseFont /TGPMTG+Poppins /Encoding /Identity-H -/DescendantFonts [ 610 0 R ] -/ToUnicode 611 0 R +/DescendantFonts [ 621 0 R ] +/ToUnicode 622 0 R >> endobj -613 0 obj +624 0 obj << /Type /FontDescriptor -/FontName /KLOSSF+DejaVuSansMono +/FontName /WKJFDI+DejaVuSansMono /FontFamily (DejaVu Sans Mono) /Flags 5 /FontBBox [ 0 -14 584 759 ] @@ -7258,24 +7377,24 @@ endobj /CapHeight 759 /StemV 80 /StemH 80 -/FontFile2 603 0 R +/FontFile2 614 0 R >> endobj -614 0 obj +625 0 obj << /Type /Font /Subtype /CIDFontType2 -/BaseFont /KLOSSF+DejaVuSansMono +/BaseFont /WKJFDI+DejaVuSansMono /CIDSystemInfo << /Registry (Adobe) /Ordering (Identity) /Supplement 0 >> /W [ 16 [ 601 601 ] 29 [ 601 ] 36 [ 601 ] 54 [ 601 601 ] 66 [ 601 ] 68 [ 601 ] 70 [ 601 601 601 601 ] 76 [ 601 ] 78 [ 601 601 601 601 601 601 ] 85 [ 601 601 601 601 601 ] 92 [ 601 ] ] -/FontDescriptor 613 0 R +/FontDescriptor 624 0 R >> endobj -615 0 obj +626 0 obj << /Length 674 >> @@ -7326,47 +7445,47 @@ end end endstream endobj -616 0 obj +627 0 obj << /Type /Font /Subtype /Type0 -/BaseFont /KLOSSF+DejaVuSansMono +/BaseFont /WKJFDI+DejaVuSansMono /Encoding /Identity-H -/DescendantFonts [ 614 0 R ] -/ToUnicode 615 0 R +/DescendantFonts [ 625 0 R ] +/ToUnicode 626 0 R >> endobj -617 0 obj +628 0 obj << /Type /FontDescriptor -/FontName /FEHHOP+DejaVuSansMono +/FontName /TGTVMX+DejaVuSansMono /FontFamily (DejaVu Sans Mono) /Flags 4 -/FontBBox [ 0 -14 585 699 ] +/FontBBox [ 0 -235 585 699 ] /ItalicAngle 0 /Ascent 928 /Descent -235 /CapHeight 699 /StemV 80 /StemH 80 -/FontFile2 604 0 R +/FontFile2 615 0 R >> endobj -618 0 obj +629 0 obj << /Type /Font /Subtype /CIDFontType2 -/BaseFont /FEHHOP+DejaVuSansMono +/BaseFont /TGTVMX+DejaVuSansMono /CIDSystemInfo << /Registry (Adobe) /Ordering (Identity) /Supplement 0 >> -/W [ 3 [ 601 602 602 602 602 602 602 602 602 602 ] 14 [ 601 602 601 601 601 601 602 602 601 601 602 602 602 602 601 602 602 ] 32 [ 602 602 ] 36 [ 602 602 602 602 602 602 602 602 602 ] 46 [ 602 602 602 601 602 601 ] 53 [ 602 602 602 602 602 602 ] 60 [ 602 ] 62 [ 602 ] 64 [ 602 ] 66 [ 602 602 602 601 601 601 601 601 602 602 602 602 601 601 602 601 601 602 602 602 601 601 601 602 601 602 601 602 602 602 602 ] ] -/FontDescriptor 617 0 R +/W [ 3 [ 601 602 602 602 602 602 602 602 602 602 602 601 602 601 601 601 601 602 602 601 601 602 602 602 602 601 602 602 ] 32 [ 602 ] 36 [ 602 602 602 602 602 602 602 602 602 ] 46 [ 602 602 602 601 602 601 ] 53 [ 602 602 602 602 602 602 ] 60 [ 602 ] 62 [ 602 ] 64 [ 602 ] 66 [ 602 602 602 601 601 601 601 601 602 602 602 602 601 601 602 601 601 602 602 602 601 601 601 602 601 602 601 602 602 602 602 ] ] +/FontDescriptor 628 0 R >> endobj -619 0 obj +630 0 obj << /Length 1500 >> @@ -7432,15 +7551,14 @@ endcodespacerange <0007> <0024> <000b> <0028> <004d> <006a> -<005f> <007c> -<0054> <0071> -<000a> <0027> +<005e> <007b> <003e> <005b> +<000d> <002a> <0040> <005d> +<000a> <0027> +<0060> <007d> <000c> <0029> <001e> <003b> -<005e> <007b> -<0060> <007d> <005a> <0077> <0031> <004e> <0033> <0050> @@ -7450,6 +7568,7 @@ endcodespacerange <002e> <004b> <000f> <002c> <0035> <0052> +<0054> <0071> <0027> <0044> <0026> <0043> <002f> <004c> @@ -7460,14 +7579,14 @@ endcodespacerange <0019> <0036> <0032> <004f> <003c> <0059> -<0038> <0055> <001a> <0037> +<005f> <007c> +<0038> <0055> <0009> <0026> <0029> <0046> <005d> <007a> <0025> <0042> <0043> <0060> -<0021> <003e> <0008> <0025> endbfchar endcmap @@ -7476,654 +7595,665 @@ end end endstream endobj -620 0 obj +631 0 obj << /Type /Font /Subtype /Type0 -/BaseFont /FEHHOP+DejaVuSansMono +/BaseFont /TGTVMX+DejaVuSansMono /Encoding /Identity-H -/DescendantFonts [ 618 0 R ] -/ToUnicode 619 0 R +/DescendantFonts [ 629 0 R ] +/ToUnicode 630 0 R >> endobj -621 0 obj +632 0 obj << -/PDIVRQ 608 0 R -/VMMSNF 612 0 R -/KLOSSF 616 0 R -/FEHHOP 620 0 R +/ICOIPK 619 0 R +/TGPMTG 623 0 R +/WKJFDI 627 0 R +/TGTVMX 631 0 R >> endobj xref -0 622 +0 633 0000000000 65535 f 0000000015 00000 n -0000000227 00000 n -0000000343 00000 n -0000027063 00000 n -0000027196 00000 n -0000029848 00000 n -0000030047 00000 n -0000033640 00000 n -0000033990 00000 n -0000034124 00000 n -0000034260 00000 n -0000034422 00000 n -0000034585 00000 n -0000034741 00000 n -0000034898 00000 n -0000035055 00000 n -0000035215 00000 n -0000035376 00000 n -0000035537 00000 n -0000035688 00000 n -0000035840 00000 n -0000036015 00000 n -0000036191 00000 n -0000036367 00000 n -0000036539 00000 n -0000036712 00000 n -0000036884 00000 n -0000037057 00000 n -0000037230 00000 n -0000042250 00000 n -0000042554 00000 n -0000042804 00000 n -0000042940 00000 n -0000043103 00000 n -0000043260 00000 n -0000043417 00000 n -0000043578 00000 n -0000043739 00000 n -0000043891 00000 n -0000044064 00000 n -0000044237 00000 n -0000044410 00000 n -0000044672 00000 n -0000044932 00000 n -0000050113 00000 n -0000050368 00000 n -0000050623 00000 n -0000050756 00000 n -0000050887 00000 n -0000051018 00000 n -0000051149 00000 n -0000051280 00000 n -0000056287 00000 n -0000056584 00000 n -0000056717 00000 n -0000056848 00000 n -0000056981 00000 n -0000057112 00000 n -0000057243 00000 n -0000057374 00000 n -0000057507 00000 n -0000057640 00000 n -0000057771 00000 n -0000057902 00000 n -0000058033 00000 n -0000058164 00000 n -0000063163 00000 n -0000063432 00000 n -0000063565 00000 n -0000063696 00000 n -0000063827 00000 n -0000063958 00000 n -0000064089 00000 n -0000064285 00000 n -0000064544 00000 n -0000064775 00000 n -0000070434 00000 n -0000070787 00000 n -0000070920 00000 n -0000071051 00000 n -0000071182 00000 n -0000071313 00000 n -0000071444 00000 n -0000071575 00000 n -0000071706 00000 n -0000071837 00000 n -0000071968 00000 n -0000072100 00000 n -0000072232 00000 n -0000072364 00000 n -0000072496 00000 n -0000072628 00000 n -0000072761 00000 n -0000072892 00000 n -0000073023 00000 n -0000073154 00000 n -0000073285 00000 n -0000073514 00000 n -0000078930 00000 n -0000079367 00000 n -0000079605 00000 n -0000079739 00000 n -0000079871 00000 n -0000080003 00000 n -0000080135 00000 n -0000080267 00000 n -0000080399 00000 n -0000080531 00000 n -0000080663 00000 n -0000080795 00000 n -0000080928 00000 n -0000081061 00000 n -0000081194 00000 n -0000081327 00000 n -0000081460 00000 n -0000081593 00000 n -0000081726 00000 n -0000081859 00000 n -0000081992 00000 n -0000082125 00000 n -0000082258 00000 n -0000082391 00000 n -0000082524 00000 n -0000082657 00000 n -0000082790 00000 n -0000082923 00000 n -0000083056 00000 n -0000083188 00000 n -0000088237 00000 n -0000088756 00000 n -0000088889 00000 n -0000089022 00000 n -0000089155 00000 n -0000089288 00000 n -0000089421 00000 n -0000089554 00000 n -0000089687 00000 n -0000089820 00000 n -0000089953 00000 n -0000090086 00000 n -0000090219 00000 n -0000090352 00000 n -0000090485 00000 n -0000090618 00000 n -0000090751 00000 n -0000090884 00000 n -0000091017 00000 n -0000091150 00000 n -0000091283 00000 n -0000091416 00000 n -0000091549 00000 n -0000091682 00000 n -0000091815 00000 n -0000091948 00000 n -0000092081 00000 n -0000092214 00000 n -0000092347 00000 n -0000092480 00000 n -0000092613 00000 n -0000092746 00000 n -0000092879 00000 n -0000093012 00000 n -0000093145 00000 n -0000093278 00000 n -0000093411 00000 n -0000093544 00000 n -0000093676 00000 n -0000093807 00000 n -0000098938 00000 n -0000099417 00000 n -0000099550 00000 n -0000099683 00000 n -0000099816 00000 n -0000099949 00000 n -0000100082 00000 n -0000100215 00000 n -0000100348 00000 n -0000100481 00000 n -0000100614 00000 n -0000100747 00000 n -0000100880 00000 n -0000101013 00000 n -0000101146 00000 n -0000101279 00000 n -0000101412 00000 n -0000101545 00000 n -0000101678 00000 n -0000101811 00000 n -0000101944 00000 n -0000102077 00000 n -0000102210 00000 n -0000102343 00000 n -0000102476 00000 n -0000102609 00000 n -0000102742 00000 n -0000102875 00000 n -0000103008 00000 n -0000103141 00000 n -0000103274 00000 n -0000103407 00000 n -0000103540 00000 n -0000103672 00000 n -0000103803 00000 n -0000108729 00000 n -0000109224 00000 n -0000109357 00000 n -0000109491 00000 n -0000109625 00000 n -0000109759 00000 n -0000109893 00000 n -0000110027 00000 n -0000110161 00000 n -0000110295 00000 n -0000110429 00000 n -0000110563 00000 n -0000110697 00000 n -0000110831 00000 n -0000110965 00000 n -0000111099 00000 n -0000111233 00000 n -0000111367 00000 n -0000111501 00000 n -0000111635 00000 n -0000111769 00000 n -0000111903 00000 n -0000112037 00000 n -0000112171 00000 n -0000112305 00000 n -0000112439 00000 n -0000112573 00000 n -0000112707 00000 n -0000112841 00000 n -0000112975 00000 n -0000113109 00000 n -0000113243 00000 n -0000113377 00000 n -0000113511 00000 n -0000113645 00000 n -0000113778 00000 n -0000113910 00000 n -0000118245 00000 n -0000118756 00000 n -0000118890 00000 n -0000119024 00000 n -0000119158 00000 n -0000119292 00000 n -0000119426 00000 n -0000119560 00000 n -0000119694 00000 n -0000119828 00000 n -0000119962 00000 n -0000120096 00000 n -0000120230 00000 n -0000120364 00000 n -0000120498 00000 n -0000120632 00000 n -0000120766 00000 n -0000120900 00000 n -0000121034 00000 n -0000121168 00000 n -0000121302 00000 n -0000121436 00000 n -0000121570 00000 n -0000121704 00000 n -0000121838 00000 n -0000121972 00000 n -0000122106 00000 n -0000122240 00000 n -0000122374 00000 n -0000122508 00000 n -0000122642 00000 n -0000122776 00000 n -0000122910 00000 n -0000123044 00000 n -0000123178 00000 n -0000123312 00000 n -0000123446 00000 n -0000123579 00000 n -0000123711 00000 n -0000128310 00000 n -0000128829 00000 n -0000128963 00000 n -0000129097 00000 n -0000129231 00000 n -0000129365 00000 n -0000129499 00000 n -0000129633 00000 n -0000129767 00000 n -0000129901 00000 n -0000130035 00000 n -0000130169 00000 n -0000130303 00000 n -0000130437 00000 n -0000130571 00000 n -0000130705 00000 n -0000130839 00000 n -0000130973 00000 n -0000131107 00000 n -0000131241 00000 n -0000131375 00000 n -0000131509 00000 n -0000131643 00000 n -0000131777 00000 n -0000131911 00000 n -0000132045 00000 n -0000132179 00000 n -0000132313 00000 n -0000132447 00000 n -0000132581 00000 n -0000132715 00000 n -0000132849 00000 n -0000132983 00000 n -0000133117 00000 n -0000133251 00000 n -0000133385 00000 n -0000133519 00000 n -0000133653 00000 n -0000133786 00000 n -0000133918 00000 n -0000138978 00000 n -0000139497 00000 n -0000139631 00000 n -0000139765 00000 n -0000139899 00000 n -0000140033 00000 n -0000140167 00000 n -0000140301 00000 n -0000140435 00000 n -0000140569 00000 n -0000140703 00000 n -0000140837 00000 n -0000140971 00000 n -0000141105 00000 n -0000141239 00000 n -0000141373 00000 n -0000141507 00000 n -0000141641 00000 n -0000141775 00000 n -0000141909 00000 n -0000142043 00000 n -0000142177 00000 n -0000142311 00000 n -0000142445 00000 n -0000142579 00000 n -0000142713 00000 n -0000142847 00000 n -0000142981 00000 n -0000143115 00000 n -0000143249 00000 n -0000143383 00000 n -0000143517 00000 n -0000143651 00000 n -0000143785 00000 n -0000143919 00000 n -0000144053 00000 n -0000144187 00000 n -0000144321 00000 n -0000144454 00000 n -0000144586 00000 n -0000149623 00000 n -0000150142 00000 n -0000150276 00000 n -0000150410 00000 n -0000150544 00000 n -0000150678 00000 n -0000150812 00000 n -0000150946 00000 n -0000151080 00000 n -0000151214 00000 n -0000151348 00000 n -0000151482 00000 n -0000151616 00000 n -0000151750 00000 n -0000151884 00000 n -0000152018 00000 n -0000152152 00000 n -0000152286 00000 n -0000152420 00000 n -0000152554 00000 n -0000152688 00000 n -0000152822 00000 n -0000152956 00000 n -0000153090 00000 n -0000153224 00000 n -0000153358 00000 n -0000153492 00000 n -0000153626 00000 n -0000153760 00000 n -0000153894 00000 n -0000154028 00000 n -0000154162 00000 n -0000154296 00000 n -0000154430 00000 n -0000154564 00000 n -0000154698 00000 n -0000154832 00000 n -0000154966 00000 n -0000155099 00000 n -0000155231 00000 n -0000160389 00000 n -0000160868 00000 n -0000161098 00000 n -0000161233 00000 n -0000161366 00000 n -0000161499 00000 n -0000161632 00000 n -0000161765 00000 n -0000161898 00000 n -0000162031 00000 n -0000162164 00000 n -0000162297 00000 n -0000162431 00000 n -0000162565 00000 n -0000162699 00000 n -0000162833 00000 n -0000162967 00000 n -0000163101 00000 n -0000163235 00000 n -0000163369 00000 n -0000163503 00000 n -0000163637 00000 n -0000163771 00000 n -0000163905 00000 n -0000164039 00000 n -0000164173 00000 n -0000164307 00000 n -0000164441 00000 n -0000164575 00000 n -0000164709 00000 n -0000164843 00000 n -0000164977 00000 n -0000165111 00000 n -0000165244 00000 n -0000165376 00000 n -0000169982 00000 n -0000170501 00000 n -0000170635 00000 n -0000170769 00000 n -0000170903 00000 n -0000171037 00000 n -0000171171 00000 n -0000171305 00000 n -0000171439 00000 n -0000171573 00000 n -0000171707 00000 n -0000171841 00000 n -0000171975 00000 n -0000172109 00000 n -0000172243 00000 n -0000172377 00000 n -0000172511 00000 n -0000172645 00000 n -0000172779 00000 n -0000172913 00000 n -0000173047 00000 n -0000173181 00000 n -0000173315 00000 n -0000173449 00000 n -0000173583 00000 n -0000173717 00000 n -0000173851 00000 n -0000173985 00000 n -0000174119 00000 n -0000174253 00000 n -0000174387 00000 n -0000174521 00000 n -0000174655 00000 n -0000174789 00000 n -0000174923 00000 n -0000175057 00000 n -0000175191 00000 n -0000175325 00000 n -0000175458 00000 n -0000175590 00000 n -0000180610 00000 n -0000181129 00000 n -0000181263 00000 n -0000181397 00000 n -0000181531 00000 n -0000181665 00000 n -0000181799 00000 n -0000181933 00000 n -0000182067 00000 n -0000182201 00000 n -0000182335 00000 n -0000182469 00000 n -0000182603 00000 n -0000182737 00000 n -0000182871 00000 n -0000183005 00000 n -0000183139 00000 n -0000183273 00000 n -0000183407 00000 n -0000183541 00000 n -0000183675 00000 n -0000183809 00000 n -0000183943 00000 n -0000184077 00000 n -0000184211 00000 n -0000184345 00000 n -0000184479 00000 n -0000184613 00000 n -0000184747 00000 n -0000184881 00000 n -0000185015 00000 n -0000185150 00000 n -0000185285 00000 n -0000185420 00000 n -0000185555 00000 n -0000185690 00000 n -0000185825 00000 n -0000185960 00000 n -0000186094 00000 n -0000186227 00000 n -0000191317 00000 n -0000191700 00000 n -0000191835 00000 n -0000191970 00000 n -0000192105 00000 n -0000192240 00000 n -0000192375 00000 n -0000192510 00000 n -0000192645 00000 n -0000192780 00000 n -0000192915 00000 n -0000193050 00000 n -0000193185 00000 n -0000193320 00000 n -0000193455 00000 n -0000193590 00000 n -0000193725 00000 n -0000193860 00000 n -0000193995 00000 n -0000194128 00000 n -0000194261 00000 n -0000194394 00000 n -0000194526 00000 n -0000199486 00000 n -0000199957 00000 n -0000200090 00000 n -0000200223 00000 n -0000200356 00000 n -0000200489 00000 n -0000200623 00000 n -0000200757 00000 n -0000200891 00000 n -0000201025 00000 n -0000201159 00000 n -0000201293 00000 n -0000201427 00000 n -0000201561 00000 n -0000201695 00000 n -0000201829 00000 n -0000201963 00000 n -0000202097 00000 n -0000202231 00000 n -0000202365 00000 n -0000202499 00000 n -0000202633 00000 n -0000202767 00000 n -0000202902 00000 n -0000203035 00000 n -0000203168 00000 n -0000203301 00000 n -0000203434 00000 n -0000203567 00000 n -0000203700 00000 n -0000203833 00000 n -0000203966 00000 n -0000204100 00000 n -0000204233 00000 n -0000207998 00000 n -0000208309 00000 n -0000208443 00000 n -0000208577 00000 n -0000208711 00000 n -0000208845 00000 n -0000208979 00000 n -0000209113 00000 n -0000209247 00000 n -0000209381 00000 n -0000209515 00000 n -0000209649 00000 n -0000209783 00000 n -0000209917 00000 n -0000210088 00000 n -0000210242 00000 n -0000210357 00000 n -0000210523 00000 n -0000210712 00000 n -0000210841 00000 n -0000211034 00000 n -0000211207 00000 n -0000211391 00000 n -0000211550 00000 n -0000211729 00000 n -0000211906 00000 n -0000212098 00000 n -0000212316 00000 n -0000212528 00000 n -0000212590 00000 n -0000219237 00000 n -0000223479 00000 n -0000228442 00000 n -0000240125 00000 n -0000240357 00000 n -0000240747 00000 n -0000241502 00000 n -0000241652 00000 n -0000241881 00000 n -0000242413 00000 n -0000243715 00000 n -0000243862 00000 n -0000244103 00000 n -0000244476 00000 n -0000245203 00000 n -0000245357 00000 n -0000245598 00000 n -0000246199 00000 n -0000247753 00000 n -0000247907 00000 n +0000000235 00000 n +0000000351 00000 n +0000027525 00000 n +0000027658 00000 n +0000030309 00000 n +0000030508 00000 n +0000034100 00000 n +0000034450 00000 n +0000034584 00000 n +0000034720 00000 n +0000034882 00000 n +0000035045 00000 n +0000035201 00000 n +0000035358 00000 n +0000035515 00000 n +0000035675 00000 n +0000035836 00000 n +0000035997 00000 n +0000036148 00000 n +0000036300 00000 n +0000036475 00000 n +0000036651 00000 n +0000036827 00000 n +0000036999 00000 n +0000037172 00000 n +0000037344 00000 n +0000037517 00000 n +0000037690 00000 n +0000042711 00000 n +0000043015 00000 n +0000043265 00000 n +0000043401 00000 n +0000043564 00000 n +0000043721 00000 n +0000043878 00000 n +0000044039 00000 n +0000044200 00000 n +0000044352 00000 n +0000044525 00000 n +0000044698 00000 n +0000044871 00000 n +0000045133 00000 n +0000045393 00000 n +0000050574 00000 n +0000050829 00000 n +0000051084 00000 n +0000051217 00000 n +0000051348 00000 n +0000051479 00000 n +0000051610 00000 n +0000051741 00000 n +0000056745 00000 n +0000057042 00000 n +0000057175 00000 n +0000057306 00000 n +0000057439 00000 n +0000057570 00000 n +0000057701 00000 n +0000057832 00000 n +0000057965 00000 n +0000058098 00000 n +0000058229 00000 n +0000058360 00000 n +0000058491 00000 n +0000058622 00000 n +0000063591 00000 n +0000063860 00000 n +0000063993 00000 n +0000064124 00000 n +0000064255 00000 n +0000064386 00000 n +0000064517 00000 n +0000064713 00000 n +0000064972 00000 n +0000065203 00000 n +0000070823 00000 n +0000071176 00000 n +0000071309 00000 n +0000071440 00000 n +0000071571 00000 n +0000071702 00000 n +0000071833 00000 n +0000071964 00000 n +0000072095 00000 n +0000072226 00000 n +0000072357 00000 n +0000072489 00000 n +0000072621 00000 n +0000072753 00000 n +0000072885 00000 n +0000073017 00000 n +0000073150 00000 n +0000073281 00000 n +0000073412 00000 n +0000073543 00000 n +0000073674 00000 n +0000073903 00000 n +0000079315 00000 n +0000079752 00000 n +0000079990 00000 n +0000080124 00000 n +0000080256 00000 n +0000080388 00000 n +0000080520 00000 n +0000080652 00000 n +0000080784 00000 n +0000080916 00000 n +0000081048 00000 n +0000081180 00000 n +0000081313 00000 n +0000081446 00000 n +0000081579 00000 n +0000081712 00000 n +0000081845 00000 n +0000081978 00000 n +0000082111 00000 n +0000082244 00000 n +0000082377 00000 n +0000082510 00000 n +0000082643 00000 n +0000082776 00000 n +0000082909 00000 n +0000083042 00000 n +0000083175 00000 n +0000083308 00000 n +0000083441 00000 n +0000083573 00000 n +0000088687 00000 n +0000089166 00000 n +0000089299 00000 n +0000089432 00000 n +0000089565 00000 n +0000089698 00000 n +0000089831 00000 n +0000089964 00000 n +0000090097 00000 n +0000090230 00000 n +0000090363 00000 n +0000090496 00000 n +0000090629 00000 n +0000090762 00000 n +0000090895 00000 n +0000091028 00000 n +0000091161 00000 n +0000091294 00000 n +0000091427 00000 n +0000091560 00000 n +0000091693 00000 n +0000091826 00000 n +0000091959 00000 n +0000092092 00000 n +0000092225 00000 n +0000092358 00000 n +0000092491 00000 n +0000092624 00000 n +0000092757 00000 n +0000092890 00000 n +0000093023 00000 n +0000093156 00000 n +0000093289 00000 n +0000093421 00000 n +0000093552 00000 n +0000098511 00000 n +0000098950 00000 n +0000099083 00000 n +0000099216 00000 n +0000099349 00000 n +0000099482 00000 n +0000099615 00000 n +0000099748 00000 n +0000099881 00000 n +0000100014 00000 n +0000100147 00000 n +0000100280 00000 n +0000100413 00000 n +0000100546 00000 n +0000100679 00000 n +0000100812 00000 n +0000100945 00000 n +0000101078 00000 n +0000101211 00000 n +0000101344 00000 n +0000101477 00000 n +0000101610 00000 n +0000101743 00000 n +0000101876 00000 n +0000102009 00000 n +0000102142 00000 n +0000102275 00000 n +0000102408 00000 n +0000102540 00000 n +0000102671 00000 n +0000107769 00000 n +0000108272 00000 n +0000108405 00000 n +0000108538 00000 n +0000108671 00000 n +0000108804 00000 n +0000108937 00000 n +0000109070 00000 n +0000109203 00000 n +0000109336 00000 n +0000109469 00000 n +0000109602 00000 n +0000109735 00000 n +0000109869 00000 n +0000110003 00000 n +0000110137 00000 n +0000110271 00000 n +0000110405 00000 n +0000110539 00000 n +0000110673 00000 n +0000110807 00000 n +0000110941 00000 n +0000111075 00000 n +0000111209 00000 n +0000111343 00000 n +0000111477 00000 n +0000111611 00000 n +0000111745 00000 n +0000111879 00000 n +0000112013 00000 n +0000112147 00000 n +0000112281 00000 n +0000112415 00000 n +0000112549 00000 n +0000112683 00000 n +0000112817 00000 n +0000112950 00000 n +0000113082 00000 n +0000117606 00000 n +0000118109 00000 n +0000118243 00000 n +0000118377 00000 n +0000118511 00000 n +0000118645 00000 n +0000118779 00000 n +0000118913 00000 n +0000119047 00000 n +0000119181 00000 n +0000119315 00000 n +0000119449 00000 n +0000119583 00000 n +0000119717 00000 n +0000119851 00000 n +0000119985 00000 n +0000120119 00000 n +0000120253 00000 n +0000120387 00000 n +0000120521 00000 n +0000120655 00000 n +0000120789 00000 n +0000120923 00000 n +0000121057 00000 n +0000121191 00000 n +0000121325 00000 n +0000121459 00000 n +0000121593 00000 n +0000121727 00000 n +0000121861 00000 n +0000121995 00000 n +0000122129 00000 n +0000122263 00000 n +0000122397 00000 n +0000122531 00000 n +0000122665 00000 n +0000122798 00000 n +0000122930 00000 n +0000127159 00000 n +0000127678 00000 n +0000127812 00000 n +0000127946 00000 n +0000128080 00000 n +0000128214 00000 n +0000128348 00000 n +0000128482 00000 n +0000128616 00000 n +0000128750 00000 n +0000128884 00000 n +0000129018 00000 n +0000129152 00000 n +0000129286 00000 n +0000129420 00000 n +0000129554 00000 n +0000129688 00000 n +0000129822 00000 n +0000129956 00000 n +0000130090 00000 n +0000130224 00000 n +0000130358 00000 n +0000130492 00000 n +0000130626 00000 n +0000130760 00000 n +0000130894 00000 n +0000131028 00000 n +0000131162 00000 n +0000131296 00000 n +0000131430 00000 n +0000131564 00000 n +0000131698 00000 n +0000131832 00000 n +0000131966 00000 n +0000132100 00000 n +0000132234 00000 n +0000132368 00000 n +0000132502 00000 n +0000132635 00000 n +0000132767 00000 n +0000137769 00000 n +0000138288 00000 n +0000138422 00000 n +0000138556 00000 n +0000138690 00000 n +0000138824 00000 n +0000138958 00000 n +0000139092 00000 n +0000139226 00000 n +0000139360 00000 n +0000139494 00000 n +0000139628 00000 n +0000139762 00000 n +0000139896 00000 n +0000140030 00000 n +0000140164 00000 n +0000140298 00000 n +0000140432 00000 n +0000140566 00000 n +0000140700 00000 n +0000140834 00000 n +0000140968 00000 n +0000141102 00000 n +0000141236 00000 n +0000141370 00000 n +0000141504 00000 n +0000141638 00000 n +0000141772 00000 n +0000141906 00000 n +0000142040 00000 n +0000142174 00000 n +0000142308 00000 n +0000142442 00000 n +0000142576 00000 n +0000142710 00000 n +0000142844 00000 n +0000142978 00000 n +0000143112 00000 n +0000143245 00000 n +0000143377 00000 n +0000148406 00000 n +0000148925 00000 n +0000149059 00000 n +0000149193 00000 n +0000149327 00000 n +0000149461 00000 n +0000149595 00000 n +0000149729 00000 n +0000149863 00000 n +0000149997 00000 n +0000150131 00000 n +0000150265 00000 n +0000150399 00000 n +0000150533 00000 n +0000150667 00000 n +0000150801 00000 n +0000150935 00000 n +0000151069 00000 n +0000151203 00000 n +0000151337 00000 n +0000151471 00000 n +0000151605 00000 n +0000151739 00000 n +0000151873 00000 n +0000152007 00000 n +0000152141 00000 n +0000152275 00000 n +0000152409 00000 n +0000152543 00000 n +0000152677 00000 n +0000152811 00000 n +0000152945 00000 n +0000153079 00000 n +0000153213 00000 n +0000153347 00000 n +0000153481 00000 n +0000153615 00000 n +0000153749 00000 n +0000153882 00000 n +0000154014 00000 n +0000159201 00000 n +0000159680 00000 n +0000159814 00000 n +0000159948 00000 n +0000160082 00000 n +0000160216 00000 n +0000160350 00000 n +0000160484 00000 n +0000160618 00000 n +0000160752 00000 n +0000160886 00000 n +0000161020 00000 n +0000161154 00000 n +0000161288 00000 n +0000161422 00000 n +0000161556 00000 n +0000161786 00000 n +0000161921 00000 n +0000162054 00000 n +0000162187 00000 n +0000162320 00000 n +0000162453 00000 n +0000162586 00000 n +0000162719 00000 n +0000162852 00000 n +0000162985 00000 n +0000163119 00000 n +0000163253 00000 n +0000163387 00000 n +0000163521 00000 n +0000163655 00000 n +0000163789 00000 n +0000163923 00000 n +0000164056 00000 n +0000164188 00000 n +0000169046 00000 n +0000169557 00000 n +0000169691 00000 n +0000169825 00000 n +0000169959 00000 n +0000170093 00000 n +0000170227 00000 n +0000170361 00000 n +0000170495 00000 n +0000170629 00000 n +0000170763 00000 n +0000170897 00000 n +0000171031 00000 n +0000171165 00000 n +0000171299 00000 n +0000171433 00000 n +0000171567 00000 n +0000171701 00000 n +0000171835 00000 n +0000171969 00000 n +0000172103 00000 n +0000172237 00000 n +0000172371 00000 n +0000172505 00000 n +0000172639 00000 n +0000172773 00000 n +0000172907 00000 n +0000173041 00000 n +0000173175 00000 n +0000173309 00000 n +0000173443 00000 n +0000173577 00000 n +0000173711 00000 n +0000173845 00000 n +0000173979 00000 n +0000174113 00000 n +0000174247 00000 n +0000174380 00000 n +0000174512 00000 n +0000179215 00000 n +0000179694 00000 n +0000179828 00000 n +0000179962 00000 n +0000180096 00000 n +0000180230 00000 n +0000180364 00000 n +0000180498 00000 n +0000180632 00000 n +0000180766 00000 n +0000180900 00000 n +0000181034 00000 n +0000181168 00000 n +0000181302 00000 n +0000181436 00000 n +0000181570 00000 n +0000181704 00000 n +0000181838 00000 n +0000181972 00000 n +0000182106 00000 n +0000182240 00000 n +0000182374 00000 n +0000182508 00000 n +0000182642 00000 n +0000182776 00000 n +0000182910 00000 n +0000183044 00000 n +0000183178 00000 n +0000183312 00000 n +0000183446 00000 n +0000183580 00000 n +0000183714 00000 n +0000183848 00000 n +0000183981 00000 n +0000184113 00000 n +0000189306 00000 n +0000189785 00000 n +0000189919 00000 n +0000190053 00000 n +0000190187 00000 n +0000190321 00000 n +0000190455 00000 n +0000190589 00000 n +0000190723 00000 n +0000190857 00000 n +0000190991 00000 n +0000191125 00000 n +0000191259 00000 n +0000191394 00000 n +0000191529 00000 n +0000191664 00000 n +0000191799 00000 n +0000191934 00000 n +0000192069 00000 n +0000192204 00000 n +0000192339 00000 n +0000192474 00000 n +0000192609 00000 n +0000192744 00000 n +0000192879 00000 n +0000193014 00000 n +0000193149 00000 n +0000193284 00000 n +0000193419 00000 n +0000193554 00000 n +0000193689 00000 n +0000193824 00000 n +0000193959 00000 n +0000194093 00000 n +0000194226 00000 n +0000199366 00000 n +0000199749 00000 n +0000199884 00000 n +0000200019 00000 n +0000200154 00000 n +0000200289 00000 n +0000200424 00000 n +0000200559 00000 n +0000200694 00000 n +0000200829 00000 n +0000200964 00000 n +0000201097 00000 n +0000201230 00000 n +0000201363 00000 n +0000201496 00000 n +0000201629 00000 n +0000201762 00000 n +0000201895 00000 n +0000202028 00000 n +0000202162 00000 n +0000202296 00000 n +0000202430 00000 n +0000202563 00000 n +0000207539 00000 n +0000208010 00000 n +0000208144 00000 n +0000208278 00000 n +0000208412 00000 n +0000208546 00000 n +0000208680 00000 n +0000208814 00000 n +0000208948 00000 n +0000209082 00000 n +0000209216 00000 n +0000209350 00000 n +0000209484 00000 n +0000209618 00000 n +0000209752 00000 n +0000209887 00000 n +0000210020 00000 n +0000210153 00000 n +0000210286 00000 n +0000210419 00000 n +0000210552 00000 n +0000210685 00000 n +0000210818 00000 n +0000210951 00000 n +0000211085 00000 n +0000211219 00000 n +0000211353 00000 n +0000211487 00000 n +0000211621 00000 n +0000211755 00000 n +0000211889 00000 n +0000212023 00000 n +0000212157 00000 n +0000212290 00000 n +0000215522 00000 n +0000215769 00000 n +0000215903 00000 n +0000216037 00000 n +0000216171 00000 n +0000216305 00000 n +0000216476 00000 n +0000216630 00000 n +0000216745 00000 n +0000216911 00000 n +0000217100 00000 n +0000217229 00000 n +0000217422 00000 n +0000217595 00000 n +0000217779 00000 n +0000217938 00000 n +0000218117 00000 n +0000218294 00000 n +0000218486 00000 n +0000218704 00000 n +0000218916 00000 n +0000218978 00000 n +0000225626 00000 n +0000229868 00000 n +0000234832 00000 n +0000246576 00000 n +0000246808 00000 n +0000247198 00000 n +0000247953 00000 n +0000248103 00000 n +0000248332 00000 n +0000248864 00000 n +0000250166 00000 n +0000250313 00000 n +0000250554 00000 n +0000250927 00000 n +0000251654 00000 n +0000251808 00000 n +0000252050 00000 n +0000252644 00000 n +0000254198 00000 n +0000254352 00000 n trailer << -/Size 622 +/Size 633 /Root 3 0 R /Info 2 0 R >> startxref -247994 +254439 %%EOF diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md index 9ec9b5338dd..51a6df997f8 100644 --- a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md +++ b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md @@ -206,6 +206,7 @@ services: extra_args: feature-gates: RotateKubeletServerCertificate=true tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 + bind-address: 127.0.0.1 extra_binds: [] extra_env: [] win_extra_args: {} @@ -217,6 +218,7 @@ services: image: "" extra_args: tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 + bind-address: 127.0.0.1 extra_binds: [] extra_env: [] win_extra_args: {} @@ -393,7 +395,7 @@ authorization: mode: "" options: {} ignore_docker_version: false -kubernetes_version: v1.18.12-rancher1-1 +kubernetes_version: "" private_registries: [] ingress: provider: "" @@ -530,6 +532,7 @@ rancher_kubernetes_engine_config: scheduler: extra_args: tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 + bind-address: 127.0.0.1 etcd: backup_config: enabled: true @@ -541,10 +544,10 @@ rancher_kubernetes_engine_config: extra_args: election-timeout: 5000 heartbeat-interval: 500 - gid: 52034 retention: 72h snapshot: false uid: 52034 + gid: 52034 kube_api: always_pull_images: false audit_log: @@ -559,6 +562,7 @@ rancher_kubernetes_engine_config: extra_args: feature-gates: RotateKubeletServerCertificate=true tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 + bind-address: 127.0.0.1 kubelet: extra_args: feature-gates: RotateKubeletServerCertificate=true diff --git a/scripts/converters/scripts/results_to_md.sh b/scripts/converters/scripts/results_to_md.sh index 388054cd449..468fed07d79 100755 --- a/scripts/converters/scripts/results_to_md.sh +++ b/scripts/converters/scripts/results_to_md.sh @@ -53,7 +53,7 @@ get_id_text() { get_section_ids() { id=${1} - jq -r --arg id "${id}" '.[] | select(.id==$id) | .checks[].id' ${results_file} + jq -r --arg id "${id}" '.[] | select(.id==$id) | .checks[].id' ${results_file} | sort -V } get_section_desc() { From e803b521b12cd2ee2de543f3241ddbac252536b2 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 15 Mar 2022 11:03:16 -0400 Subject: [PATCH 319/478] Added note to clarify K3s versioning caveat --- content/k3s/latest/en/installation/ha-embedded/_index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/k3s/latest/en/installation/ha-embedded/_index.md b/content/k3s/latest/en/installation/ha-embedded/_index.md index 9d4a1d85cc6..6d4bb7bab49 100644 --- a/content/k3s/latest/en/installation/ha-embedded/_index.md +++ b/content/k3s/latest/en/installation/ha-embedded/_index.md @@ -32,3 +32,5 @@ There are a few config flags that must be the same in all server nodes: ## Existing clusters If you have an existing cluster using the default embedded SQLite database, you can convert it to etcd by simply restarting your K3s server with the `--cluster-init` flag. Once you've done that, you'll be able to add additional instances as described above. + +>**Important:** K3s v1.22.2 and newer support migration from SQLite to etcd. Older versions will create a new empty datastore if you add `--cluster-init` to an existing server. From 8b7209ff3765f91969e32107d17940e692655845 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Tue, 15 Mar 2022 14:32:19 -0700 Subject: [PATCH 320/478] Remove restricted-admin content from 2.0-2.4 --- .../rbac/global-permissions/_index.md | 19 ------------------- 1 file changed, 19 deletions(-) diff --git a/content/rancher/v2.0-v2.4/en/admin-settings/rbac/global-permissions/_index.md b/content/rancher/v2.0-v2.4/en/admin-settings/rbac/global-permissions/_index.md index 0f5e5f00c9d..125c2cbe699 100644 --- a/content/rancher/v2.0-v2.4/en/admin-settings/rbac/global-permissions/_index.md +++ b/content/rancher/v2.0-v2.4/en/admin-settings/rbac/global-permissions/_index.md @@ -27,25 +27,6 @@ This section covers the following topics: - [Configuring global permissions for groups](#configuring-global-permissions-for-groups) - [Refreshing group memberships](#refreshing-group-memberships) -### List of `restricted-admin` Permissions - -The `restricted-admin` permissions are as follows: - -- Has full admin access to all downstream clusters managed by Rancher. -- Has very limited access to the local Kubernetes cluster. Can access Rancher custom resource definitions, but has no access to any Kubernetes native types. -- Can add other users and assign them to clusters outside of the local cluster. -- Can create other restricted admins. -- Cannot grant any permissions in the local cluster they don't currently have. (This is how Kubernetes normally operates) - - -### Changing Global Administrators to Restricted Admins - -If Rancher already has a global administrator, they should change all global administrators over to the new `restricted-admin` role. - -This can be done through **Security > Users** and moving any Administrator role over to Restricted Administrator. - -Signed-in users can change themselves over to the `restricted-admin` if they wish, but they should only do that as the last step, otherwise they won't have the permissions to do so. - # Global Permission Assignment Global permissions for local users are assigned differently than users who log in to Rancher using external authentication. From c08674b59701f66dedeefb728db00523464337d0 Mon Sep 17 00:00:00 2001 From: Thomas MOLINA Date: Wed, 16 Mar 2022 08:38:34 +0100 Subject: [PATCH 321/478] Remove extra }} on server config links --- content/k3s/latest/en/installation/ha/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/k3s/latest/en/installation/ha/_index.md b/content/k3s/latest/en/installation/ha/_index.md index a7bc5491eac..4e5072bfff8 100644 --- a/content/k3s/latest/en/installation/ha/_index.md +++ b/content/k3s/latest/en/installation/ha/_index.md @@ -35,7 +35,7 @@ K3s requires two or more server nodes for this HA configuration. See the [Instal When running the `k3s server` command on these nodes, you must set the `datastore-endpoint` parameter so that K3s knows how to connect to the external datastore. The `token` parameter can also be used to set a deterministic token when adding nodes. When empty, this token will be generated automatically for further use. -For example, a command like the following could be used to install the K3s server with a MySQL database as the external datastore and [set a token]({{}}/k3s/latest/en/installation/install-options/server-config/#cluster-options}}): +For example, a command like the following could be used to install the K3s server with a MySQL database as the external datastore and [set a token]({{}}/k3s/latest/en/installation/install-options/server-config/#cluster-options): ```bash curl -sfL https://get.k3s.io | sh -s - server \ @@ -72,7 +72,7 @@ If the first server node was started without the `--token` CLI flag or `K3S_TOKE cat /var/lib/rancher/k3s/server/token ``` -Additional server nodes can then be added [using the token]({{}}/k3s/latest/en/installation/install-options/server-config/#cluster-options}}): +Additional server nodes can then be added [using the token]({{}}/k3s/latest/en/installation/install-options/server-config/#cluster-options): ```bash curl -sfL https://get.k3s.io | sh -s - server \ From d73b1536405f6398461b5ed909105679bcb6b3c7 Mon Sep 17 00:00:00 2001 From: Wykiki Date: Wed, 16 Mar 2022 09:30:29 +0100 Subject: [PATCH 322/478] Improve restoration process requirements --- .../v2.6/en/backups/migrating-rancher/_index.md | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/backups/migrating-rancher/_index.md b/content/rancher/v2.6/en/backups/migrating-rancher/_index.md index 651c300d66b..4519a25bf96 100644 --- a/content/rancher/v2.6/en/backups/migrating-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/migrating-rancher/_index.md @@ -90,11 +90,23 @@ spec: --from-file=./encryption-provider-config.yaml \ -n cattle-resources-system ``` - -1. Then apply the resource: + +Apply the manifest, and watch for the Restore resources status : + +1. Apply the resource: ``` kubectl apply -f migrationResource.yaml ``` +1. Watch the Restore status: + ``` + kubectl get restore + ``` +1. Watch the restoration logs: + ``` + kubectl logs -n cattle-resources-system --tail 100 -f rancher-backup-xxx-xxx + ``` + +Once the Restore resource has the status `Completed`, you can continue the Rancher installation. ### 3. Install cert-manager From 39e89e5f77dfe6abe2bc725b2e9218852f69f038 Mon Sep 17 00:00:00 2001 From: dhruvmewada15 Date: Wed, 23 Feb 2022 12:33:34 +0530 Subject: [PATCH 323/478] Updated 1.5-hardening-v2.5 guide and Self-Assessment guide --- .../v2.5/en/security/rancher-2.5/1.5-benchmark-2.5/_index.md | 4 ++-- .../v2.5/en/security/rancher-2.5/1.5-hardening-2.5/_index.md | 2 ++ 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.5/en/security/rancher-2.5/1.5-benchmark-2.5/_index.md b/content/rancher/v2.5/en/security/rancher-2.5/1.5-benchmark-2.5/_index.md index 02b34e42fdb..4fed8f40550 100644 --- a/content/rancher/v2.5/en/security/rancher-2.5/1.5-benchmark-2.5/_index.md +++ b/content/rancher/v2.5/en/security/rancher-2.5/1.5-benchmark-2.5/_index.md @@ -1281,7 +1281,7 @@ on the master node and ensure the correct value for the `--bind-address` paramet **Expected result**: ``` -'--bind-address' is present OR '--bind-address' is not present +'--bind-address' argument is set to 127.0.0.1 ``` ### 1.4 Scheduler @@ -1327,7 +1327,7 @@ on the master node and ensure the correct value for the `--bind-address` paramet **Expected result**: ``` -'--bind-address' is present OR '--bind-address' is not present +'--bind-address' argument is set to 127.0.0.1 ``` ## 2 Etcd Node Configuration diff --git a/content/rancher/v2.5/en/security/rancher-2.5/1.5-hardening-2.5/_index.md b/content/rancher/v2.5/en/security/rancher-2.5/1.5-hardening-2.5/_index.md index 26907ab28b6..491aec9c080 100644 --- a/content/rancher/v2.5/en/security/rancher-2.5/1.5-hardening-2.5/_index.md +++ b/content/rancher/v2.5/en/security/rancher-2.5/1.5-hardening-2.5/_index.md @@ -667,6 +667,7 @@ rancher_kubernetes_engine_config: service_node_port_range: 30000-32767 kube_controller: extra_args: + bind-address: 127.0.0.1 address: 127.0.0.1 feature-gates: RotateKubeletServerCertificate=true profiling: 'false' @@ -685,6 +686,7 @@ rancher_kubernetes_engine_config: generate_serving_certificate: true scheduler: extra_args: + bind-address: 127.0.0.1 address: 127.0.0.1 profiling: 'false' ssh_agent_auth: false From 4c5d2b98208bd0acd2cf5654b84590fc4859daaf Mon Sep 17 00:00:00 2001 From: dhruvmewada15 Date: Wed, 16 Mar 2022 18:49:16 +0530 Subject: [PATCH 324/478] Updated 1.6-hardening-v2.5 guide and Self-Assessment guide --- .../en/security/rancher-2.5/1.6-benchmark-2.5/_index.md | 8 ++++---- .../en/security/rancher-2.5/1.6-hardening-2.5/_index.md | 6 ++++++ 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/content/rancher/v2.5/en/security/rancher-2.5/1.6-benchmark-2.5/_index.md b/content/rancher/v2.5/en/security/rancher-2.5/1.6-benchmark-2.5/_index.md index 57b65e5b004..e0dc1e45c5d 100644 --- a/content/rancher/v2.5/en/security/rancher-2.5/1.6-benchmark-2.5/_index.md +++ b/content/rancher/v2.5/en/security/rancher-2.5/1.6-benchmark-2.5/_index.md @@ -1803,13 +1803,13 @@ on the master node and ensure the correct value for the --bind-address parameter **Expected Result**: ```console -'--bind-address' is not present OR '--bind-address' is not present +'--bind-address' argument is set to 127.0.0.1 ``` **Returned Value**: ```console -root 4788 4773 4 16:16 ? 00:00:09 kube-controller-manager --configure-cloud-routes=false --cloud-provider= --service-cluster-ip-range=10.43.0.0/16 --v=2 --pod-eviction-timeout=5m0s --leader-elect=true --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --profiling=false --node-monitor-grace-period=40s --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --address=0.0.0.0 --allow-untagged-cloud=true --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --enable-hostpath-provisioner=false --terminated-pod-gc-threshold=1000 --feature-gates=RotateKubeletServerCertificate=true --use-service-account-credentials=true +root 4788 4773 4 16:16 ? 00:00:09 kube-controller-manager --configure-cloud-routes=false --cloud-provider= --service-cluster-ip-range=10.43.0.0/16 --v=2 --bind-address=127.0.0.1 --pod-eviction-timeout=5m0s --leader-elect=true --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --profiling=false --node-monitor-grace-period=40s --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --address=127.0.0.1 --allow-untagged-cloud=true --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --enable-hostpath-provisioner=false --terminated-pod-gc-threshold=1000 --feature-gates=RotateKubeletServerCertificate=true --use-service-account-credentials=true ``` ## 1.4 Scheduler @@ -1859,13 +1859,13 @@ on the master node and ensure the correct value for the --bind-address parameter **Expected Result**: ```console -'--bind-address' is not present OR '--bind-address' is not present +'--bind-address' argument is set to 127.0.0.1 ``` **Returned Value**: ```console -root 4947 4930 1 16:16 ? 00:00:02 kube-scheduler --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --leader-elect=true --profiling=false --v=2 --address=0.0.0.0 +root 4947 4930 1 16:16 ? 00:00:02 kube-scheduler --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --leader-elect=true --profiling=false --v=2 --address=127.0.0.1 --bind-address=127.0.0.1 ``` ## 2 Etcd Node Configuration Files diff --git a/content/rancher/v2.5/en/security/rancher-2.5/1.6-hardening-2.5/_index.md b/content/rancher/v2.5/en/security/rancher-2.5/1.6-hardening-2.5/_index.md index 0b6497f2e1f..d628bfd8c5a 100644 --- a/content/rancher/v2.5/en/security/rancher-2.5/1.6-hardening-2.5/_index.md +++ b/content/rancher/v2.5/en/security/rancher-2.5/1.6-hardening-2.5/_index.md @@ -511,6 +511,8 @@ rancher_kubernetes_engine_config: kube_controller: extra_args: feature-gates: RotateKubeletServerCertificate=true + bind-address: 127.0.0.1 + address: 127.0.0.1 kubelet: extra_args: feature-gates: RotateKubeletServerCertificate=true @@ -519,6 +521,10 @@ rancher_kubernetes_engine_config: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 fail_swap_on: false generate_serving_certificate: true + scheduler: + extra_args: + bind-address: 127.0.0.1 + address: 127.0.0.1 ssh_agent_auth: false upgrade_strategy: max_unavailable_controlplane: '1' From 500a9e933f1461253ddfd9cd4cc55d09e5795694 Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Wed, 16 Mar 2022 22:34:57 +0100 Subject: [PATCH 325/478] Update scripts/converters/headers/header-2.6.md Co-authored-by: Jen Travinski --- scripts/converters/headers/header-2.6.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/converters/headers/header-2.6.md b/scripts/converters/headers/header-2.6.md index f3d6b8a1333..5f930a99fb1 100755 --- a/scripts/converters/headers/header-2.6.md +++ b/scripts/converters/headers/header-2.6.md @@ -9,7 +9,7 @@ weight: 101 #### Overview -This document is a companion to the Rancher v2.6 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark. +This document is a companion to the [Rancher v2.6 security hardening guide]({{}}/rancher/v2.6/en/security/hardening-guides/). The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark. This guide corresponds to specific versions of the hardening guide, Rancher, CIS Benchmark and Kubernetes: From 391bec677f2d022dcf5889613bcb717f4386a266 Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Wed, 16 Mar 2022 22:35:04 +0100 Subject: [PATCH 326/478] Update scripts/converters/headers/header-k3s.md Co-authored-by: Jen Travinski --- scripts/converters/headers/header-k3s.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/converters/headers/header-k3s.md b/scripts/converters/headers/header-k3s.md index 9bb285229c0..80461cc9c3f 100755 --- a/scripts/converters/headers/header-k3s.md +++ b/scripts/converters/headers/header-k3s.md @@ -7,7 +7,7 @@ weight: 90 #### Overview -This document is a companion to the K3s security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of K3s, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the CIS Kubernetes Benchmark. It is to be used by K3s operators, security teams, auditors, and decision-makers. +This document is a companion to the [K3s security hardening guide]({{}}/k3s/latest/en/security/hardening_guide/). The hardening guide provides prescriptive guidance for hardening a production installation of K3s, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the CIS Kubernetes Benchmark. It is to be used by K3s operators, security teams, auditors, and decision-makers. This guide is specific to the **v1.17**, **v1.18**, **v1.19**, **v1.20** and **v1.21** release line of K3s and the **v1.6** release of the CIS Kubernetes Benchmark. From 16f797dafa1100ebad43878b8fc4373befdb7634 Mon Sep 17 00:00:00 2001 From: Wykiki Date: Thu, 17 Mar 2022 10:29:21 +0100 Subject: [PATCH 327/478] Separate common restoration steps from encryption Co-authored-by: Jiaqi Luo <6218999+jiaqiluo@users.noreply.github.com> --- content/rancher/v2.6/en/backups/migrating-rancher/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/backups/migrating-rancher/_index.md b/content/rancher/v2.6/en/backups/migrating-rancher/_index.md index 4519a25bf96..267cf5e6e9e 100644 --- a/content/rancher/v2.6/en/backups/migrating-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/migrating-rancher/_index.md @@ -97,11 +97,11 @@ Apply the manifest, and watch for the Restore resources status : ``` kubectl apply -f migrationResource.yaml ``` -1. Watch the Restore status: +Watch the Restore status: ``` kubectl get restore ``` -1. Watch the restoration logs: +Watch the restoration logs: ``` kubectl logs -n cattle-resources-system --tail 100 -f rancher-backup-xxx-xxx ``` From 6aaa6d16a8271e15a23710c2c0da6ea7432da8f7 Mon Sep 17 00:00:00 2001 From: Wykiki Date: Thu, 17 Mar 2022 10:30:49 +0100 Subject: [PATCH 328/478] Set apply in common operation section --- content/rancher/v2.6/en/backups/migrating-rancher/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/backups/migrating-rancher/_index.md b/content/rancher/v2.6/en/backups/migrating-rancher/_index.md index 267cf5e6e9e..290f1658dde 100644 --- a/content/rancher/v2.6/en/backups/migrating-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/migrating-rancher/_index.md @@ -93,7 +93,7 @@ spec: Apply the manifest, and watch for the Restore resources status : -1. Apply the resource: +Apply the resource: ``` kubectl apply -f migrationResource.yaml ``` From e55c668fb97a76282c9dad2ee5d8090ecd828005 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 17 Mar 2022 11:03:50 -0700 Subject: [PATCH 329/478] Fix markdown formatting --- .../en/backups/migrating-rancher/_index.md | 38 ++++++++++--------- 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/content/rancher/v2.6/en/backups/migrating-rancher/_index.md b/content/rancher/v2.6/en/backups/migrating-rancher/_index.md index 290f1658dde..5b5e4f3acdd 100644 --- a/content/rancher/v2.6/en/backups/migrating-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/migrating-rancher/_index.md @@ -85,26 +85,28 @@ spec: >**Important:** The field `encryptionConfigSecretName` must be set only if your backup was created with encryption enabled. Provide the name of the Secret containing the encryption config file. If you only have the encryption config file, but don't have a secret created with it in this cluster, use the following steps to create the secret: 1. The encryption configuration file must be named `encryption-provider-config.yaml`, and the `--from-file` flag must be used to create this secret. So save your `EncryptionConfiguration` in a file called `encryption-provider-config.yaml` and run this command: - ``` - kubectl create secret generic encryptionconfig \ - --from-file=./encryption-provider-config.yaml \ - -n cattle-resources-system - ``` +``` +kubectl create secret generic encryptionconfig \ + --from-file=./encryption-provider-config.yaml \ + -n cattle-resources-system +``` -Apply the manifest, and watch for the Restore resources status : +1. Apply the manifest, and watch for the Restore resources status: -Apply the resource: - ``` - kubectl apply -f migrationResource.yaml - ``` -Watch the Restore status: - ``` - kubectl get restore - ``` -Watch the restoration logs: - ``` - kubectl logs -n cattle-resources-system --tail 100 -f rancher-backup-xxx-xxx - ``` + Apply the resource: +``` +kubectl apply -f migrationResource.yaml +``` + + Watch the Restore status: +``` +kubectl get restore +``` + + Watch the restoration logs: +``` +kubectl logs -n cattle-resources-system --tail 100 -f rancher-backup-xxx-xxx +``` Once the Restore resource has the status `Completed`, you can continue the Rancher installation. From fcfa473c212fc9133f7bdd92b21b2323ed37f53f Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Thu, 17 Mar 2022 18:13:26 -0400 Subject: [PATCH 330/478] Updated per feedback --- .../behavior-differences-between-rke1-and-rke2/_index.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md index 28c8d0c741c..556bdc53bc4 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md @@ -9,7 +9,7 @@ RKE1 and RKE2 have several slight behavioral differences to note, and this page ### Control Plane Components -RKE1 uses Docker for deploying and managing control plane components and the container runtime for Kubernetes. By contrast, RKE2 launches control plane components such as static pods that are managed by the kubelet. RKE2's container runtime is containerd, which allows things such as container registry mirroring (RKE1 with Docker does not). +RKE1 uses Docker for deploying and managing control plane components, and it also uses Docker as the container runtime for Kubernetes. By contrast, RKE2 launches control plane components such as static pods that are managed by the kubelet. RKE2's container runtime is containerd, which allows things such as container registry mirroring (RKE1 with Docker does not). ### Cluster API @@ -21,13 +21,13 @@ The following are some specific example configuration changes that may cause the - When editing the cluster and enabling `drain before delete`, the existing control plane nodes and worker are deleted and new nodes are created. -- When nodes are being provisioned and a scale down operation is performed, rather than scaling down directly, nodes are deleted and new nodes are provisioned to reach the desired node count. +- When nodes are being provisioned and a scale down operation is performed, rather than scaling down the desired number of nodes, it is possible that the currently provisioning nodes get deleted and new nodes are provisioned to reach the desired node count. Users who are used to RKE1 provisioning should take note of this new RKE2 behavior which may be unexpected. ### Terminology -You will notice that some terms have changed or gone away going from RKE1 to RKE2. For example, in RKE2, **node templates** have been deprecated, and you can configure your cluster nodes directly. Another example is that the term **node pool** in RKE1 is now known as **machine pool** in RKE2. +You will notice that some terms have changed or gone away going from RKE1 to RKE2. For example, in RKE1 provisioning, you use **node templates**; in RKE2 provisioning, you can configure your cluster nodes directly. Another example is that the term **node pool** in RKE1 is now known as **machine pool** in RKE2. From 3f4883d593b49e0419ae7a17f256258d65a8f0aa Mon Sep 17 00:00:00 2001 From: Roberto Bonafiglia Date: Fri, 18 Mar 2022 11:46:42 +0100 Subject: [PATCH 331/478] Update K3s network installation doc --- .../en/installation/network-options/_index.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/content/k3s/latest/en/installation/network-options/_index.md b/content/k3s/latest/en/installation/network-options/_index.md index 78e734929ea..2ceeaa9a2f8 100644 --- a/content/k3s/latest/en/installation/network-options/_index.md +++ b/content/k3s/latest/en/installation/network-options/_index.md @@ -74,6 +74,8 @@ You should see that IP forwarding is set to true. Dual-stack networking must be configured when the cluster is first created. It cannot be enabled on an existing single-stack cluster. +Dual-stack is supported on k3s v1.21 or above. + To enable dual-stack in k3s, you must provide valid dual-stack `cluster-cidr` and `service-cidr`, and set `disable-network-policy` on all server nodes. Both servers and agents must provide valid dual-stack `node-ip` settings. Node address auto-detection and network policy enforcement are not supported on dual-stack clusters when using the default flannel CNI. Besides, only vxlan backend is supported at the moment. This is an example of a valid configuration: ``` @@ -86,3 +88,18 @@ disable-network-policy: true Note that you can choose whatever `cluster-cidr` and `service-cidr` value, however the `node-ip` values must correspond to the ip addresses of your main interface. Remember to allow ipv6 traffic if you are deploying in a public cloud. If you are using a custom cni plugin, i.e. a cni plugin different from flannel, the previous configuration might not be enough to enable dual-stack in the cni plugin. Please check how to enable dual-stack in its documentation and verify if network policies can be enabled. + +### IPv6 only installation + +IPv6 only setup is supported on k3s v1.22 or above. + +IPv6 only setup requires a similar setup as dual-stack where you must provide a valid IPv6 `node-ip` on both servers and agents. This is an example of a valid configuration: + +``` +node-ip: 2a05:d012:c6f:4611:5c2:5602:eed2:898c +cluster-cidr: 2001:cafe:42:0::/56 +service-cidr: 2001:cafe:42:1::/112 +disable-network-policy: true +``` + +Note that you can specify only one IPv6 `cluster-cidr` value. From 395057b1f66ca7ec61cbd5ec77ec86bb26f4b2bb Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 18 Mar 2022 15:10:48 -0400 Subject: [PATCH 332/478] Documented workaround for Calico probe in 2.6.3 --- .../rancher/v2.6/en/faq/networking/cni-providers/_index.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md index cb8fdb4b278..ea4bbde4872 100644 --- a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md +++ b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md @@ -109,6 +109,12 @@ Calico also provides a stateless IP-in-IP or VXLAN encapsulation mode that can b Kubernetes workers should open TCP port `179` if using BGP or UDP port `4789` if using VXLAN encapsulation. In addition, TCP port `5473` is needed when using Typha. See [the port requirements for user clusters]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/#networking-requirements) for more details. +>**Important:** In Rancher v2.6.3, Calico probes fail on Windows nodes upon RKE2 installation. Note that this issue is resolved in v2.6.4. +> +>- To work around this issue, first navigate to `https:///v3/settings/windows-rke2-install-script`. +> +>- There, change the current setting: `https://raw.githubusercontent.com/rancher/wins/v0.1.3/install.ps1` to this new setting: `https://raw.githubusercontent.com/rancher/rke2/master/windows/rke2-install.ps1`. + ![Calico Diagram]({{}}/img/rancher/calico-diagram.svg) For more information, see the following pages: From 6e36f7a6b45e31451c3e828f1bdbc893d42765e0 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 18 Mar 2022 17:04:02 -0400 Subject: [PATCH 333/478] Updated per feedback --- .../behavior-differences-between-rke1-and-rke2/_index.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md index 556bdc53bc4..99a3f18f370 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/_index.md @@ -9,7 +9,7 @@ RKE1 and RKE2 have several slight behavioral differences to note, and this page ### Control Plane Components -RKE1 uses Docker for deploying and managing control plane components, and it also uses Docker as the container runtime for Kubernetes. By contrast, RKE2 launches control plane components such as static pods that are managed by the kubelet. RKE2's container runtime is containerd, which allows things such as container registry mirroring (RKE1 with Docker does not). +RKE1 uses Docker for deploying and managing control plane components, and it also uses Docker as the container runtime for Kubernetes. By contrast, RKE2 launches control plane components as static pods that are managed by the kubelet. RKE2's container runtime is containerd, which allows things such as container registry mirroring (RKE1 with Docker does not). ### Cluster API @@ -21,13 +21,13 @@ The following are some specific example configuration changes that may cause the - When editing the cluster and enabling `drain before delete`, the existing control plane nodes and worker are deleted and new nodes are created. -- When nodes are being provisioned and a scale down operation is performed, rather than scaling down the desired number of nodes, it is possible that the currently provisioning nodes get deleted and new nodes are provisioned to reach the desired node count. +- When nodes are being provisioned and a scale down operation is performed, rather than scaling down the desired number of nodes, it is possible that the currently provisioning nodes get deleted and new nodes are provisioned to reach the desired node count. Please note that this is a bug in Cluster API, and it will be fixed in an upcoming release. Once fixed, Rancher will update the documentation. Users who are used to RKE1 provisioning should take note of this new RKE2 behavior which may be unexpected. ### Terminology -You will notice that some terms have changed or gone away going from RKE1 to RKE2. For example, in RKE1 provisioning, you use **node templates**; in RKE2 provisioning, you can configure your cluster nodes directly. Another example is that the term **node pool** in RKE1 is now known as **machine pool** in RKE2. +You will notice that some terms have changed or gone away going from RKE1 to RKE2. For example, in RKE1 provisioning, you use **node templates**; in RKE2 provisioning, you can configure your cluster node pools when creating or editing the cluster. Another example is that the term **node pool** in RKE1 is now known as **machine pool** in RKE2. From 814150760a2742f05b236cf579a9fc6df4f4aab1 Mon Sep 17 00:00:00 2001 From: Roberto Bonafiglia Date: Mon, 21 Mar 2022 09:43:46 +0100 Subject: [PATCH 334/478] Update network installation doc --- .../en/installation/network-options/_index.md | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/content/k3s/latest/en/installation/network-options/_index.md b/content/k3s/latest/en/installation/network-options/_index.md index 2ceeaa9a2f8..0889039827e 100644 --- a/content/k3s/latest/en/installation/network-options/_index.md +++ b/content/k3s/latest/en/installation/network-options/_index.md @@ -79,10 +79,7 @@ Dual-stack is supported on k3s v1.21 or above. To enable dual-stack in k3s, you must provide valid dual-stack `cluster-cidr` and `service-cidr`, and set `disable-network-policy` on all server nodes. Both servers and agents must provide valid dual-stack `node-ip` settings. Node address auto-detection and network policy enforcement are not supported on dual-stack clusters when using the default flannel CNI. Besides, only vxlan backend is supported at the moment. This is an example of a valid configuration: ``` -node-ip: 10.0.10.7,2a05:d012:c6f:4611:5c2:5602:eed2:898c -cluster-cidr: 10.42.0.0/16,2001:cafe:42:0::/56 -service-cidr: 10.43.0.0/16,2001:cafe:42:1::/112 -disable-network-policy: true +k3s server --node-ip 10.0.10.7,2a05:d012:c6f:4611:5c2:5602:eed2:898c --cluster-cidr 10.42.0.0/16,2001:cafe:42:0::/56 --service-cidr 10.43.0.0/16,2001:cafe:42:1::/112 --disable-network-policy ``` Note that you can choose whatever `cluster-cidr` and `service-cidr` value, however the `node-ip` values must correspond to the ip addresses of your main interface. Remember to allow ipv6 traffic if you are deploying in a public cloud. @@ -91,15 +88,10 @@ If you are using a custom cni plugin, i.e. a cni plugin different from flannel, ### IPv6 only installation -IPv6 only setup is supported on k3s v1.22 or above. - -IPv6 only setup requires a similar setup as dual-stack where you must provide a valid IPv6 `node-ip` on both servers and agents. This is an example of a valid configuration: +IPv6 only setup is supported on k3s v1.22 or above. As in dual-stack operation, IPv6 node addresses cannot be auto-detected; all nodes must have an explicitly configured IPv6 `node-ip`. This is an example of a valid configuration: ``` -node-ip: 2a05:d012:c6f:4611:5c2:5602:eed2:898c -cluster-cidr: 2001:cafe:42:0::/56 -service-cidr: 2001:cafe:42:1::/112 -disable-network-policy: true +k3s server --node-ip 2a05:d012:c6f:4611:5c2:5602:eed2:898c --cluster-cidr 2001:cafe:42:0::/56 --service-cidr 2001:cafe:42:1::/112 --disable-network-policy ``` Note that you can specify only one IPv6 `cluster-cidr` value. From c840d7fab68abead093eaadb5ddbbaa67700e25e Mon Sep 17 00:00:00 2001 From: Alexandre Pinon <1724149+zaggash@users.noreply.github.com> Date: Mon, 21 Mar 2022 10:48:30 +0100 Subject: [PATCH 335/478] impacted version update firewalld/iptables issue still unresolved on newer releases. --- .../v2.6/en/installation/resources/advanced/firewall/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/resources/advanced/firewall/_index.md b/content/rancher/v2.6/en/installation/resources/advanced/firewall/_index.md index 291cee6d594..69c1afae91d 100644 --- a/content/rancher/v2.6/en/installation/resources/advanced/firewall/_index.md +++ b/content/rancher/v2.6/en/installation/resources/advanced/firewall/_index.md @@ -3,7 +3,7 @@ title: Opening Ports with firewalld weight: 1 --- -> We recommend disabling firewalld. For Kubernetes 1.19, firewalld must be turned off. +> We recommend disabling firewalld. For Kubernetes 1.19.x and higher, firewalld must be turned off. Some distributions of Linux [derived from RHEL,](https://en.wikipedia.org/wiki/Red_Hat_Enterprise_Linux#Rebuilds) including Oracle Linux, may have default firewall rules that block communication with Helm. From 5c59b6ceb9ddd82b492b88d49e49eab9f99d559b Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 21 Mar 2022 10:59:00 -0400 Subject: [PATCH 336/478] Added update to 2.0-2.4 and 2.5 docs also --- .../en/installation/resources/advanced/firewall/_index.md | 2 +- .../v2.5/en/installation/resources/advanced/firewall/_index.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.0-v2.4/en/installation/resources/advanced/firewall/_index.md b/content/rancher/v2.0-v2.4/en/installation/resources/advanced/firewall/_index.md index f3ee9defadd..67c6f880325 100644 --- a/content/rancher/v2.0-v2.4/en/installation/resources/advanced/firewall/_index.md +++ b/content/rancher/v2.0-v2.4/en/installation/resources/advanced/firewall/_index.md @@ -3,7 +3,7 @@ title: Opening Ports with firewalld weight: 1 --- -> We recommend disabling firewalld. For Kubernetes 1.19, firewalld must be turned off. +> We recommend disabling firewalld. For Kubernetes 1.19.x and higher, firewalld must be turned off. Some distributions of Linux [derived from RHEL,](https://en.wikipedia.org/wiki/Red_Hat_Enterprise_Linux#Rebuilds) including Oracle Linux, may have default firewall rules that block communication with Helm. diff --git a/content/rancher/v2.5/en/installation/resources/advanced/firewall/_index.md b/content/rancher/v2.5/en/installation/resources/advanced/firewall/_index.md index b779951aa7b..2ff27022f24 100644 --- a/content/rancher/v2.5/en/installation/resources/advanced/firewall/_index.md +++ b/content/rancher/v2.5/en/installation/resources/advanced/firewall/_index.md @@ -5,7 +5,7 @@ aliases: - /rancher/v2.x/en/installation/resources/advanced/firewall/ --- -> We recommend disabling firewalld. For Kubernetes 1.19, firewalld must be turned off. +> We recommend disabling firewalld. For Kubernetes 1.19.x and higher, firewalld must be turned off. Some distributions of Linux [derived from RHEL,](https://en.wikipedia.org/wiki/Red_Hat_Enterprise_Linux#Rebuilds) including Oracle Linux, may have default firewall rules that block communication with Helm. From 16f29bc3681dcd71467d19d83fb12fbdba1558dc Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Mon, 21 Mar 2022 13:03:00 -0700 Subject: [PATCH 337/478] Respond to feedback on install/upgrade docs PR --- .../install-rancher-on-k8s/_index.md | 2 +- .../single-node-docker/_index.md | 4 +- .../single-node-upgrades/_index.md | 2 +- .../quickstart-manual-setup/_index.md | 62 +++++++++++++++++-- 4 files changed, 61 insertions(+), 9 deletions(-) diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md index a969bd01663..aff2ba86aae 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md @@ -148,7 +148,7 @@ cert-manager-webhook-787858fcdb-nlzsq 1/1 Running 0 2m The exact command to install Rancher differs depending on the certificate configuration. -> **Tip for testing and development:** This final command to install Rancher requires a domain name that forwards traffic to Rancher. If you are using the Helm CLI to set up a proof of concept, you can use a fake domain name when passing the `hostname` option. An example of a fake domain name would be `.sslip.io`, which would expose Rancher on an IP where Rancher would be running. Production installs would require a real domain name. +> **Tip for testing and development:** This final command to install Rancher requires a domain name that forwards traffic to Rancher. If you are using the Helm CLI to set up a proof-of-concept, you can use a fake domain name when passing the `hostname` option. An example of a fake domain name would be `.sslip.io`, which would expose Rancher on an IP where it is running. Production installs would require a real domain name. {{% tabs %}} {{% tab "Rancher-generated Certificates" %}} diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md index e6521e26db2..a52c192fe83 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/_index.md @@ -93,7 +93,7 @@ docker run -d --restart=unless-stopped \ In production environments where you're exposing an app publicly, you would use a certificate signed by a recognized CA so that your user base doesn't encounter security warnings. -The Docker install is not recommended for production. these instructions are provided for testing and development purposes. +The Docker install is not recommended for production. These instructions are provided for testing and development purposes only. > **Prerequisites:** > @@ -129,7 +129,7 @@ docker run -d --restart=unless-stopped \ For production environments, you also have the option of using [Let's Encrypt](https://letsencrypt.org/) certificates. Let's Encrypt uses an http-01 challenge to verify that you have control over your domain. You can confirm that you control the domain by pointing the hostname that you want to use for Rancher access (for example, `rancher.mydomain.com`) to the IP of the machine it is running on. You can bind the hostname to the IP address by creating an A record in DNS. -The Docker install is not recommended for production. These instructions are provided for testing and development purposes. +The Docker install is not recommended for production. These instructions are provided for testing and development purposes only. > **Prerequisites:** > diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md index 31a47c5f896..b3262cc73c5 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md @@ -5,7 +5,7 @@ weight: 1010 The following instructions will guide you through upgrading a Rancher server that was installed with Docker. -> **Docker installs are not supported in production.** We don't support upgrading Docker installs in production environments, and these instructions are provided for testing and development purposes only. If you have already deployed a Docker install in production and need to upgrade to a new Rancher version, we recommend [migrating to the Helm chart install]({{}}/rancher/v2.6/en/backups/migrating-rancher/) before upgrading. +> **Docker installs are not supported in production environments.** These instructions are provided for testing and development purposes only. If you have already deployed a Docker install in production and need to upgrade to a new Rancher version, we recommend [migrating to the Helm chart install]({{}}/rancher/v2.6/en/backups/migrating-rancher/) before upgrading. # Prerequisites diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md index 57c6d4a37cb..70b92903d93 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md @@ -5,11 +5,11 @@ weight: 300 These instructions capture a quick way to set up a proof-of-concept Rancher installation. -These instructions assume you have a Linux virtual machine that you will communicate with from your local workstation. Rancher will be installed on the Linux machine. You will need to retrieve the IP address of that machine to make it so that you can access Rancher from your local workstation. Rancher is designed to manage Kubernetes clusters remotely, so any Kubernetes cluster that Rancher manages in the future will also need to be able to reach this IP address. +These instructions assume you have a Linux virtual machine that you will communicate with from your local workstation. Rancher will be installed on the Linux machine. You will need to retrieve the IP address of that machine so that you can access Rancher from your local workstation. Rancher is designed to manage Kubernetes clusters remotely, so any Kubernetes cluster that Rancher manages in the future will also need to be able to reach this IP address. We don't recommend installing Rancher locally because it creates a networking problem. Installing Rancher on localhost does not allow Rancher to communicate with downstream Kubernetes clusters, so on localhost you wouldn't be able to test Rancher's cluster provisioning or cluster management functionality. -Your Linux machine can be anywhere. It could be an Amazon EC2 instance, a Digital Ocean droplet, or an Azure virtual machine, to name a few examples. (Other Rancher docs often use 'node' as a generic term for all of these.) One possible way to deploy a Linux machine is by setting up an Amazon EC2 instance as shown in [this tutorial.]({{}}/rancher/v2.6/en/installation/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/) +Your Linux machine can be anywhere. It could be an Amazon EC2 instance, a Digital Ocean droplet, or an Azure virtual machine, to name a few examples. Other Rancher docs often use 'node' as a generic term for all of these. One possible way to deploy a Linux machine is by setting up an Amazon EC2 instance as shown in [this tutorial.]({{}}/rancher/v2.6/en/installation/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/) The full installation requirements are [here.]({{}}/rancher/v2.6/en/installation/requirements/) @@ -28,13 +28,36 @@ Save the IP of the Linux machine. The kubeconfig file is important for accessing the Kubernetes cluster. Copy the file at `/etc/rancher/k3s/k3s.yaml` from the Linux machine and save it to your local workstation in the directory `~/.kube/config`. One way to do this is by using the `scp` tool and run this command on your local machine: +{{% tabs %}} +{{% tab "Mac and Linux" %}} + ``` scp root@:/etc/rancher/k3s/k3s.yaml ~/.kube/config ``` +{{% /tab %}} +{{% tab "Windows" %}} + +By default, "scp" is not a recognized command, so we need to install a module first. + +In Windows Powershell: + +``` +Find-Module Posh-SSH +Install-Module Posh-SSH + +## Get the remote kubeconfig file +scp root@:/etc/rancher/k3s/k3s.yaml $env:USERPROFILE\.kube\config +``` +{{% /tab %}} +{{% tabs %}} + ## Edit the Rancher server URL in the kubeconfig -In the kubeconfig file, the server directive is defined as `localhost`. You will need to change the server directive from `localhost` to `:6443`. (The Kubernetes API server will be reached at port 6443, while the Rancher server will be reached at ports 80 and 443.) This edit is needed so that when you run Helm or kubectl commands from your local workstation, you will be able to communicate with the Kubernetes cluster that Rancher will be installed on. +In the kubeconfig file, the server directive is defined as `localhost`. You will need to change the server directive from `localhost` to `:6443`. (The Kubernetes API server will be reached at port 6443, while the Rancher server will be reached at ports 80 and 443.) This edit is needed so that when you run Helm or kubectl commands from your local workstation, you will be able to communicate with the Kubernetes cluster that Rancher will be installed on. + +{{% tabs %}} +{{% tab "Mac and Linux" %}} One way to open the kubeconfig file for editing is to use Vim: @@ -42,7 +65,22 @@ One way to open the kubeconfig file for editing is to use Vim: vi ~/.kube/config ``` -Press `i` to put Vim in insert mode. To save your work, press `Esc`. Then press `:wq` and press `enter`. +Press `i` to put Vim in insert mode. To save your work, press `Esc`. Then press `:wq` and press `Enter`. + +{{% /tab %}} +{{% tab "Windows" %}} + +In Windows Powershell, you can use `notepad.exe` for editing the kubeconfig file: + +``` +notepad.exe $env:USERPROFILE\.kube\config +``` + +Once edited, either press `ctrl+s` or go to `File > Save` to save your work. + + +{{% /tab %}} +{{% tabs %}} ## Install Rancher with Helm @@ -63,9 +101,15 @@ helm install cert-manager jetstack/cert-manager \ --namespace cert-manager \ --create-namespace \ --version v1.5.1 + +# Windows Powershell +helm install cert-manager jetstack/cert-manager \` + --namespace cert-manager \` + --create-namespace \` + --version v1.5.1 ``` -The final command to install Rancher is below. The command requires a domain name that forwards traffic to the Linux machine. For the sake of simplicity in this tutorial, you can use a fake domain name to create your proof of concept. An example of a fake domain name would be `.sslip.io`. +The final command to install Rancher is below. The command requires a domain name that forwards traffic to the Linux machine. For the sake of simplicity in this tutorial, you can use a fake domain name to create your proof-of-concept. An example of a fake domain name would be `.sslip.io`. ``` helm install rancher rancher-latest/rancher \ @@ -73,6 +117,14 @@ helm install rancher rancher-latest/rancher \ --set hostname=.sslip.io \ --set replicas=1 \ --set bootstrapPassword= + +# Windows Powershell +helm install rancher rancher-latest/rancher ` + --namespace cattle-system ` + --set hostname=.sslip.io ` + --set replicas=1 ` + --set bootstrapPassword= +``` ``` Now if you navigate to `.sslip.io` in a web browser, you should see the Rancher UI. From 88715472f35ef1190aadcb70d34928f83a283c00 Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Tue, 22 Mar 2022 10:04:57 +0530 Subject: [PATCH 338/478] Revert "Updating section for git-based chart repositories" --- content/rancher/v2.6/en/helm-charts/_index.md | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/content/rancher/v2.6/en/helm-charts/_index.md b/content/rancher/v2.6/en/helm-charts/_index.md index b5313d0bd54..11704efac48 100644 --- a/content/rancher/v2.6/en/helm-charts/_index.md +++ b/content/rancher/v2.6/en/helm-charts/_index.md @@ -74,14 +74,11 @@ To add a private CA for Helm Chart repositories: [...] ``` -- **Git-based chart repositories**: You must add a base64 encoded copy of the CA certificate in DER format to the spec.caBundle field of the chart repo, such as `openssl x509 -outform der -in ca.pem | base64 -w0`. Click **Edit YAML** for the chart repo and set, as in the following example:
      +- **Git-based chart repositories**: It is not currently possible to add a private CA. For git-based chart repositories with a certificate signed by a private CA, you must disable TLS verification. Click **Edit YAML** for the chart repo, and add the key/value pair as follows: ``` [...] spec: - caBundle: - MIIFXzCCA0egAwIBAgIUWNy8WrvSkgNzV0zdWRP79j9cVcEwDQYJKoZIhvcNAQELBQAwPzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQKDAtNeU9yZywgSW5jLjENMAsGA1UEAwwEcm9vdDAeFw0yMTEyMTQwODMyMTdaFw0yNDEwMDMwODMyMT - ... - nDxZ/tNXt/WPJr/PgEB3hQdInDWYMg7vGO0Oz00G5kWg0sJ0ZTSoA10ZwdjIdGEeKlj1NlPyAqpQ+uDnmx6DW+zqfYtLnc/g6GuLLVPamraqN+gyU8CHwAWPNjZonFN9Vpg0PIk1I2zuOc4EHifoTAXSpnjfzfyAxCaZsnTptimlPFJJqAMj+FfDArGmr4= + insecureSkipTLSVerify: true [...] ``` From 3bd37231687d5a87503d0d6fbc43f8773e9c09d9 Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Tue, 22 Mar 2022 11:10:57 +0530 Subject: [PATCH 339/478] Adding content to certificate rotation sections in v2.5 and v2.6 --- .../certificate-rotation/_index.md | 69 +++++++++++++++++++ .../certificate-rotation/_index.md | 69 +++++++++++++++++++ 2 files changed, 138 insertions(+) diff --git a/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md b/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md index 37aa93ed56f..44fe2820c2b 100644 --- a/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md +++ b/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md @@ -19,3 +19,72 @@ Certificates can be rotated for the following services: - kube-scheduler - kube-controller-manager + +### Certificate Rotation in Rancher v2.2.x + +_Available as of v2.2.0_ + +Rancher launched Kubernetes clusters have the ability to rotate the auto-generated certificates through the UI. + +1. In the **Global** view, navigate to the cluster that you want to rotate certificates. + +2. Select the **⋮ > Rotate Certificates**. + +3. Select which certificates that you want to rotate. + + * Rotate all Service certificates (keep the same CA) + * Rotate an individual service and choose one of the services from the drop down menu + +4. Click **Save**. + +**Results:** The selected certificates will be rotated and the related services will be restarted to start using the new certificate. + +> **Note:** Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher Launched Kubernetes clusters. + + +### Certificate Rotation in Rancher v2.1.x and v2.0.x + +_Available as of v2.0.14 and v2.1.9_ + +Rancher launched Kubernetes clusters have the ability to rotate the auto-generated certificates through the API. + +1. In the **Global** view, navigate to the cluster that you want to rotate certificates. + +2. Select the **⋮ > View in API**. + +3. Click on **RotateCertificates**. + +4. Click on **Show Request**. + +5. Click on **Send Request**. + +**Results:** All Kubernetes certificates will be rotated. + +### Rotating Expired Certificates After Upgrading Older Rancher Versions + +If you are upgrading from Rancher v2.0.13 or earlier, or v2.1.8 or earlier, and your clusters have expired certificates, some manual steps are required to complete the certificate rotation. + +1. For the `controlplane` and `etcd` nodes, log in to each corresponding host and check if the certificate `kube-apiserver-requestheader-ca.pem` is in the following directory: + + ``` + cd /etc/kubernetes/.tmp + ``` + + If the certificate is not in the directory, perform the following commands: + + ``` + cp kube-ca.pem kube-apiserver-requestheader-ca.pem + cp kube-ca-key.pem kube-apiserver-requestheader-ca-key.pem + cp kube-apiserver.pem kube-apiserver-proxy-client.pem + cp kube-apiserver-key.pem kube-apiserver-proxy-client-key.pem + ``` + + If the `.tmp` directory does not exist, you can copy the entire SSL certificate to `.tmp`: + + ``` + cp -r /etc/kubernetes/ssl /etc/kubernetes/.tmp + ``` + +1. Rotate the certificates. For Rancher v2.0.x and v2.1.x, use the [Rancher API.](#certificate-rotation-in-rancher-v2-1-x-and-v2-0-x) For Rancher 2.2.x, [use the UI.](#certificate-rotation-in-rancher-v2-2-x) + +1. After the command is finished, check if the `worker` nodes are Active. If not, log in to each `worker` node and restart the kubelet and proxy. diff --git a/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md b/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md index 8a70bfd34b6..aa500d52c52 100644 --- a/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md @@ -19,3 +19,72 @@ Certificates can be rotated for the following services: > **Note:** For users who didn't rotate their webhook certificates, and they have expired after one year, please see this [page]({{}}/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/) for help. + +### Certificate Rotation in Rancher v2.2.x + +_Available as of v2.2.0_ + +Rancher launched Kubernetes clusters have the ability to rotate the auto-generated certificates through the UI. + +1. In the **Global** view, navigate to the cluster that you want to rotate certificates. + +2. Select the **⋮ > Rotate Certificates**. + +3. Select which certificates that you want to rotate. + + * Rotate all Service certificates (keep the same CA) + * Rotate an individual service and choose one of the services from the drop down menu + +4. Click **Save**. + +**Results:** The selected certificates will be rotated and the related services will be restarted to start using the new certificate. + +> **Note:** Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher Launched Kubernetes clusters. + + +### Certificate Rotation in Rancher v2.1.x and v2.0.x + +_Available as of v2.0.14 and v2.1.9_ + +Rancher launched Kubernetes clusters have the ability to rotate the auto-generated certificates through the API. + +1. In the **Global** view, navigate to the cluster that you want to rotate certificates. + +2. Select the **⋮ > View in API**. + +3. Click on **RotateCertificates**. + +4. Click on **Show Request**. + +5. Click on **Send Request**. + +**Results:** All Kubernetes certificates will be rotated. + +### Rotating Expired Certificates After Upgrading Older Rancher Versions + +If you are upgrading from Rancher v2.0.13 or earlier, or v2.1.8 or earlier, and your clusters have expired certificates, some manual steps are required to complete the certificate rotation. + +1. For the `controlplane` and `etcd` nodes, log in to each corresponding host and check if the certificate `kube-apiserver-requestheader-ca.pem` is in the following directory: + + ``` + cd /etc/kubernetes/.tmp + ``` + + If the certificate is not in the directory, perform the following commands: + + ``` + cp kube-ca.pem kube-apiserver-requestheader-ca.pem + cp kube-ca-key.pem kube-apiserver-requestheader-ca-key.pem + cp kube-apiserver.pem kube-apiserver-proxy-client.pem + cp kube-apiserver-key.pem kube-apiserver-proxy-client-key.pem + ``` + + If the `.tmp` directory does not exist, you can copy the entire SSL certificate to `.tmp`: + + ``` + cp -r /etc/kubernetes/ssl /etc/kubernetes/.tmp + ``` + +1. Rotate the certificates. For Rancher v2.0.x and v2.1.x, use the [Rancher API.](#certificate-rotation-in-rancher-v2-1-x-and-v2-0-x) For Rancher 2.2.x, [use the UI.](#certificate-rotation-in-rancher-v2-2-x) + +1. After the command is finished, check if the `worker` nodes are Active. If not, log in to each `worker` node and restart the kubelet and proxy. From 27f0523b1f7f9bb4f0c8e4129beedf976122e6b8 Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Wed, 23 Mar 2022 10:16:44 +0530 Subject: [PATCH 340/478] Update content/rancher/v2.6/en/helm-charts/_index.md Co-authored-by: Jen Travinski --- content/rancher/v2.6/en/helm-charts/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/helm-charts/_index.md b/content/rancher/v2.6/en/helm-charts/_index.md index 11704efac48..14a53d77e9f 100644 --- a/content/rancher/v2.6/en/helm-charts/_index.md +++ b/content/rancher/v2.6/en/helm-charts/_index.md @@ -74,7 +74,7 @@ To add a private CA for Helm Chart repositories: [...] ``` -- **Git-based chart repositories**: It is not currently possible to add a private CA. For git-based chart repositories with a certificate signed by a private CA, you must disable TLS verification. Click **Edit YAML** for the chart repo, and add the key/value pair as follows: +- **Git-based chart repositories**: It is not currently possible to add a private CA. For git-based chart repositories with a certificate signed by a private CA, you must disable TLS verification. Click **Edit YAML** for the chart repo and add the key/value pair as follows: ``` [...] spec: From a1f4adc249472a61c2b7549e7e5d45780a24e8e3 Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Wed, 23 Mar 2022 10:29:23 +0530 Subject: [PATCH 341/478] Amendments made per review --- .../certificate-rotation/_index.md | 52 +------------------ .../certificate-rotation/_index.md | 52 +------------------ 2 files changed, 2 insertions(+), 102 deletions(-) diff --git a/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md b/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md index 44fe2820c2b..8eba2be2765 100644 --- a/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md +++ b/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md @@ -20,9 +20,7 @@ Certificates can be rotated for the following services: - kube-controller-manager -### Certificate Rotation in Rancher v2.2.x - -_Available as of v2.2.0_ +### Certificate Rotation Rancher launched Kubernetes clusters have the ability to rotate the auto-generated certificates through the UI. @@ -40,51 +38,3 @@ Rancher launched Kubernetes clusters have the ability to rotate the auto-generat **Results:** The selected certificates will be rotated and the related services will be restarted to start using the new certificate. > **Note:** Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher Launched Kubernetes clusters. - - -### Certificate Rotation in Rancher v2.1.x and v2.0.x - -_Available as of v2.0.14 and v2.1.9_ - -Rancher launched Kubernetes clusters have the ability to rotate the auto-generated certificates through the API. - -1. In the **Global** view, navigate to the cluster that you want to rotate certificates. - -2. Select the **⋮ > View in API**. - -3. Click on **RotateCertificates**. - -4. Click on **Show Request**. - -5. Click on **Send Request**. - -**Results:** All Kubernetes certificates will be rotated. - -### Rotating Expired Certificates After Upgrading Older Rancher Versions - -If you are upgrading from Rancher v2.0.13 or earlier, or v2.1.8 or earlier, and your clusters have expired certificates, some manual steps are required to complete the certificate rotation. - -1. For the `controlplane` and `etcd` nodes, log in to each corresponding host and check if the certificate `kube-apiserver-requestheader-ca.pem` is in the following directory: - - ``` - cd /etc/kubernetes/.tmp - ``` - - If the certificate is not in the directory, perform the following commands: - - ``` - cp kube-ca.pem kube-apiserver-requestheader-ca.pem - cp kube-ca-key.pem kube-apiserver-requestheader-ca-key.pem - cp kube-apiserver.pem kube-apiserver-proxy-client.pem - cp kube-apiserver-key.pem kube-apiserver-proxy-client-key.pem - ``` - - If the `.tmp` directory does not exist, you can copy the entire SSL certificate to `.tmp`: - - ``` - cp -r /etc/kubernetes/ssl /etc/kubernetes/.tmp - ``` - -1. Rotate the certificates. For Rancher v2.0.x and v2.1.x, use the [Rancher API.](#certificate-rotation-in-rancher-v2-1-x-and-v2-0-x) For Rancher 2.2.x, [use the UI.](#certificate-rotation-in-rancher-v2-2-x) - -1. After the command is finished, check if the `worker` nodes are Active. If not, log in to each `worker` node and restart the kubelet and proxy. diff --git a/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md b/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md index aa500d52c52..4e0e0488271 100644 --- a/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md @@ -20,9 +20,7 @@ Certificates can be rotated for the following services: > **Note:** For users who didn't rotate their webhook certificates, and they have expired after one year, please see this [page]({{}}/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/) for help. -### Certificate Rotation in Rancher v2.2.x - -_Available as of v2.2.0_ +### Certificate Rotation Rancher launched Kubernetes clusters have the ability to rotate the auto-generated certificates through the UI. @@ -40,51 +38,3 @@ Rancher launched Kubernetes clusters have the ability to rotate the auto-generat **Results:** The selected certificates will be rotated and the related services will be restarted to start using the new certificate. > **Note:** Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher Launched Kubernetes clusters. - - -### Certificate Rotation in Rancher v2.1.x and v2.0.x - -_Available as of v2.0.14 and v2.1.9_ - -Rancher launched Kubernetes clusters have the ability to rotate the auto-generated certificates through the API. - -1. In the **Global** view, navigate to the cluster that you want to rotate certificates. - -2. Select the **⋮ > View in API**. - -3. Click on **RotateCertificates**. - -4. Click on **Show Request**. - -5. Click on **Send Request**. - -**Results:** All Kubernetes certificates will be rotated. - -### Rotating Expired Certificates After Upgrading Older Rancher Versions - -If you are upgrading from Rancher v2.0.13 or earlier, or v2.1.8 or earlier, and your clusters have expired certificates, some manual steps are required to complete the certificate rotation. - -1. For the `controlplane` and `etcd` nodes, log in to each corresponding host and check if the certificate `kube-apiserver-requestheader-ca.pem` is in the following directory: - - ``` - cd /etc/kubernetes/.tmp - ``` - - If the certificate is not in the directory, perform the following commands: - - ``` - cp kube-ca.pem kube-apiserver-requestheader-ca.pem - cp kube-ca-key.pem kube-apiserver-requestheader-ca-key.pem - cp kube-apiserver.pem kube-apiserver-proxy-client.pem - cp kube-apiserver-key.pem kube-apiserver-proxy-client-key.pem - ``` - - If the `.tmp` directory does not exist, you can copy the entire SSL certificate to `.tmp`: - - ``` - cp -r /etc/kubernetes/ssl /etc/kubernetes/.tmp - ``` - -1. Rotate the certificates. For Rancher v2.0.x and v2.1.x, use the [Rancher API.](#certificate-rotation-in-rancher-v2-1-x-and-v2-0-x) For Rancher 2.2.x, [use the UI.](#certificate-rotation-in-rancher-v2-2-x) - -1. After the command is finished, check if the `worker` nodes are Active. If not, log in to each `worker` node and restart the kubelet and proxy. From 36d286ae783ed32119f29f21d31b765c2d0c2080 Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Wed, 23 Mar 2022 13:05:53 +0530 Subject: [PATCH 342/478] Amending installation instructions for rancher --- .../installation/install-rancher-on-k8s/_index.md | 14 ++++++++------ .../installation/install-rancher-on-k8s/_index.md | 12 +++++++----- 2 files changed, 15 insertions(+), 11 deletions(-) diff --git a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md index c9b1d6d8c5d..51e79f6a1c7 100644 --- a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md +++ b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md @@ -6,7 +6,7 @@ aliases: - /rancher/v2.5/en/installation/k8s-install/ - /rancher/v2.5/en/installation/k8s-install/helm-rancher - /rancher/v2.5/en/installation/k8s-install/kubernetes-rke - - /rancher/v2.5/en/installation/ha-server-install + - /rancher/v2.5/en/installation/ha-server-install - /rancher/v2.5/en/installation/install-rancher-on-k8s/install - /rancher/v2.x/en/installation/install-rancher-on-k8s/ --- @@ -24,7 +24,7 @@ In this section, you'll learn how to deploy Rancher on a Kubernetes cluster usin ### Kubernetes Cluster -Set up the Rancher server's local Kubernetes cluster. +Set up the Rancher server's local Kubernetes cluster. Rancher can be installed on any Kubernetes cluster. This cluster can use upstream Kubernetes, or it can use one of Rancher's Kubernetes distributions, or it can be a managed Kubernetes cluster from a provider such as Amazon EKS. @@ -113,7 +113,7 @@ There are three recommended options for the source of the certificate used for T ### 4. Install cert-manager -> You should skip this step if you are bringing your own certificate files (option `ingress.tls.source=secret`), or if you use [TLS termination on an external load balancer]({{}}/rancher/v2.5/en/installation/install-rancher-on-k8s/chart-options/#external-tls-termination). +> You should skip this step if you are bringing your own certificate files (option `ingress.tls.source=secret`), or if you use [TLS termination on an external load balancer]({{}}/rancher/v2.5/en/installation/install-rancher-on-k8s/chart-options/#external-tls-termination). This step is only required to use certificates issued by Rancher's generated CA (`ingress.tls.source=rancher`) or to request Let's Encrypt issued certificates (`ingress.tls.source=letsEncrypt`). @@ -157,6 +157,8 @@ cert-manager-webhook-787858fcdb-nlzsq 1/1 Running 0 2m The exact command to install Rancher differs depending on the certificate configuration. +However, irrespective of the certificate configuration the name of the Rancher installation in the `cattle-system` namespace should always be `rancher`. + {{% tabs %}} {{% tab "Rancher-generated Certificates" %}} @@ -168,7 +170,7 @@ Because `rancher` is the default option for `ingress.tls.source`, we are not spe - Set `hostname` to the DNS record that resolves to your load balancer. - Set `replicas` to the number of replicas to use for the Rancher Deployment. This defaults to 3; if you have less than 3 nodes in your cluster you should reduce it accordingly. - To install a specific Rancher version, use the `--version` flag, example: `--version 2.3.6`. -- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. +- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. ``` helm install rancher rancher-/rancher \ @@ -200,7 +202,7 @@ In the following command, - Set `letsEncrypt.email` to the email address used for communication about your certificate (for example, expiry notices). - Set `letsEncrypt.ingress.class` to whatever your ingress controller is, e.g., `traefik`, `nginx`, `haproxy`, etc. - To install a specific Rancher version, use the `--version` flag, example: `--version 2.3.6`. -- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. +- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. ``` helm install rancher rancher-/rancher \ @@ -234,7 +236,7 @@ Although an entry in the `Subject Alternative Names` is technically required, ha - Set `replicas` to the number of replicas to use for the Rancher Deployment. This defaults to 3; if you have less than 3 nodes in your cluster you should reduce it accordingly. - Set `ingress.tls.source` to `secret`. - To install a specific Rancher version, use the `--version` flag, example: `--version 2.3.6`. -- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. +- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. ``` helm install rancher rancher-/rancher \ diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md index 5d27916781c..6693be891ed 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md @@ -17,7 +17,7 @@ In this section, you'll learn how to deploy Rancher on a Kubernetes cluster usin ### Kubernetes Cluster -Set up the Rancher server's local Kubernetes cluster. +Set up the Rancher server's local Kubernetes cluster. Rancher can be installed on any Kubernetes cluster. This cluster can use upstream Kubernetes, or it can use one of Rancher's Kubernetes distributions, or it can be a managed Kubernetes cluster from a provider such as Amazon EKS. @@ -104,7 +104,7 @@ There are three recommended options for the source of the certificate used for T ### 4. Install cert-manager -> You should skip this step if you are bringing your own certificate files (option `ingress.tls.source=secret`), or if you use [TLS termination on an external load balancer]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/#external-tls-termination). +> You should skip this step if you are bringing your own certificate files (option `ingress.tls.source=secret`), or if you use [TLS termination on an external load balancer]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/#external-tls-termination). This step is only required to use certificates issued by Rancher's generated CA (`ingress.tls.source=rancher`) or to request Let's Encrypt issued certificates (`ingress.tls.source=letsEncrypt`). @@ -148,6 +148,8 @@ cert-manager-webhook-787858fcdb-nlzsq 1/1 Running 0 2m The exact command to install Rancher differs depending on the certificate configuration. +However, irrespective of the certificate configuration the name of the Rancher installation in the `cattle-system` namespace should always be `rancher`. + {{% tabs %}} {{% tab "Rancher-generated Certificates" %}} @@ -158,7 +160,7 @@ Because `rancher` is the default option for `ingress.tls.source`, we are not spe - Set the `hostname` to the DNS name you pointed at your load balancer. - Set the `bootstrapPassword` to something unique for the `admin` user. -- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. +- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. - To install a specific Rancher version, use the `--version` flag, example: `--version 2.3.6` ``` @@ -190,7 +192,7 @@ In the following command, - `ingress.tls.source` is set to `letsEncrypt` - `letsEncrypt.email` is set to the email address used for communication about your certificate (for example, expiry notices) - Set `letsEncrypt.ingress.class` to whatever your ingress controller is, e.g., `traefik`, `nginx`, `haproxy`, etc. -- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. +- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. ``` helm install rancher rancher-/rancher \ @@ -223,7 +225,7 @@ Although an entry in the `Subject Alternative Names` is technically required, ha - Set the `hostname`. - Set the `bootstrapPassword` to something unique for the `admin` user. - Set `ingress.tls.source` to `secret`. -- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. +- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. ``` helm install rancher rancher-/rancher \ From cdc4c4ec3fc250d9cff043fbe81b51389bc8f82b Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Wed, 23 Mar 2022 20:33:17 +0530 Subject: [PATCH 343/478] Update content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md Co-authored-by: Jen Travinski --- .../v2.5/en/cluster-admin/certificate-rotation/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md b/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md index 8eba2be2765..46addbdd478 100644 --- a/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md +++ b/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md @@ -26,7 +26,7 @@ Rancher launched Kubernetes clusters have the ability to rotate the auto-generat 1. In the **Global** view, navigate to the cluster that you want to rotate certificates. -2. Select the **⋮ > Rotate Certificates**. +2. Select **⋮ > Rotate Certificates**. 3. Select which certificates that you want to rotate. From 7ef2fafc8fd662cb3d67a52e6c3fa0e3f1ed471d Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Wed, 23 Mar 2022 20:33:31 +0530 Subject: [PATCH 344/478] Update content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md Co-authored-by: Jen Travinski --- .../v2.5/en/cluster-admin/certificate-rotation/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md b/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md index 46addbdd478..b6ef8802966 100644 --- a/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md +++ b/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md @@ -31,7 +31,7 @@ Rancher launched Kubernetes clusters have the ability to rotate the auto-generat 3. Select which certificates that you want to rotate. * Rotate all Service certificates (keep the same CA) - * Rotate an individual service and choose one of the services from the drop down menu + * Rotate an individual service and choose one of the services from the drop-down menu 4. Click **Save**. From 49d8476b782186e950e7f2c033fabef778c77f32 Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Wed, 23 Mar 2022 20:33:51 +0530 Subject: [PATCH 345/478] Update content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md Co-authored-by: Jen Travinski --- .../v2.5/en/cluster-admin/certificate-rotation/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md b/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md index b6ef8802966..168a7e4094b 100644 --- a/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md +++ b/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md @@ -37,4 +37,4 @@ Rancher launched Kubernetes clusters have the ability to rotate the auto-generat **Results:** The selected certificates will be rotated and the related services will be restarted to start using the new certificate. -> **Note:** Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher Launched Kubernetes clusters. +> **Note:** Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher launched Kubernetes clusters. From c9fb52b8c79b7d4b043f2100525964d42b55a93a Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Wed, 23 Mar 2022 20:34:02 +0530 Subject: [PATCH 346/478] Update content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md Co-authored-by: Jen Travinski --- .../v2.6/en/cluster-admin/certificate-rotation/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md b/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md index 4e0e0488271..1e1d4b11681 100644 --- a/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md @@ -26,7 +26,7 @@ Rancher launched Kubernetes clusters have the ability to rotate the auto-generat 1. In the **Global** view, navigate to the cluster that you want to rotate certificates. -2. Select the **⋮ > Rotate Certificates**. +2. Select **⋮ > Rotate Certificates**. 3. Select which certificates that you want to rotate. From e8076b5746c55e2481b963b7bf7a5d70c6cc94b7 Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Wed, 23 Mar 2022 20:34:16 +0530 Subject: [PATCH 347/478] Update content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md Co-authored-by: Jen Travinski --- .../v2.6/en/cluster-admin/certificate-rotation/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md b/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md index 1e1d4b11681..2f22c2d859f 100644 --- a/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md @@ -31,7 +31,7 @@ Rancher launched Kubernetes clusters have the ability to rotate the auto-generat 3. Select which certificates that you want to rotate. * Rotate all Service certificates (keep the same CA) - * Rotate an individual service and choose one of the services from the drop down menu + * Rotate an individual service and choose one of the services from the drop-down menu 4. Click **Save**. From 6720d564e878341ab4e9c474504501ff832c192f Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Wed, 23 Mar 2022 20:34:26 +0530 Subject: [PATCH 348/478] Update content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md Co-authored-by: Jen Travinski --- .../v2.6/en/cluster-admin/certificate-rotation/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md b/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md index 2f22c2d859f..664af10b1fc 100644 --- a/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md @@ -37,4 +37,4 @@ Rancher launched Kubernetes clusters have the ability to rotate the auto-generat **Results:** The selected certificates will be rotated and the related services will be restarted to start using the new certificate. -> **Note:** Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher Launched Kubernetes clusters. +> **Note:** Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher launched Kubernetes clusters. From 4d8a7b05b47d73013ceae13a00856ce689951afb Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Wed, 23 Mar 2022 20:34:58 +0530 Subject: [PATCH 349/478] Update content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md Co-authored-by: Jen Travinski --- .../v2.6/en/installation/install-rancher-on-k8s/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md index 6693be891ed..123582a8cbf 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md @@ -148,7 +148,7 @@ cert-manager-webhook-787858fcdb-nlzsq 1/1 Running 0 2m The exact command to install Rancher differs depending on the certificate configuration. -However, irrespective of the certificate configuration the name of the Rancher installation in the `cattle-system` namespace should always be `rancher`. +However, irrespective of the certificate configuration, the name of the Rancher installation in the `cattle-system` namespace should always be `rancher`. {{% tabs %}} {{% tab "Rancher-generated Certificates" %}} From 5ba69e73a653b15dd7c356101761849f5f6d629b Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Wed, 23 Mar 2022 20:35:07 +0530 Subject: [PATCH 350/478] Update content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md Co-authored-by: Jen Travinski --- .../v2.5/en/installation/install-rancher-on-k8s/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md index 51e79f6a1c7..b0e02303a79 100644 --- a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md +++ b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md @@ -157,7 +157,7 @@ cert-manager-webhook-787858fcdb-nlzsq 1/1 Running 0 2m The exact command to install Rancher differs depending on the certificate configuration. -However, irrespective of the certificate configuration the name of the Rancher installation in the `cattle-system` namespace should always be `rancher`. +However, irrespective of the certificate configuration, the name of the Rancher installation in the `cattle-system` namespace should always be `rancher`. {{% tabs %}} {{% tab "Rancher-generated Certificates" %}} From 2a0b944d4881c74117f48aa016b0f223ecc572cb Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 23 Mar 2022 14:00:34 -0400 Subject: [PATCH 351/478] Updating cert-manager version for 2.6 docs --- .../v2.6/en/installation/install-rancher-on-k8s/_index.md | 6 ++++-- .../air-gap/install-rancher/_index.md | 8 +++++--- .../air-gap/populate-private-registry/_index.md | 4 +++- .../behind-proxy/install-rancher/_index.md | 6 ++++-- 4 files changed, 16 insertions(+), 8 deletions(-) diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md index 5d27916781c..2d2879fdc8b 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md @@ -104,6 +104,8 @@ There are three recommended options for the source of the certificate used for T ### 4. Install cert-manager +**Note:** New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. + > You should skip this step if you are bringing your own certificate files (option `ingress.tls.source=secret`), or if you use [TLS termination on an external load balancer]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/#external-tls-termination). This step is only required to use certificates issued by Rancher's generated CA (`ingress.tls.source=rancher`) or to request Let's Encrypt issued certificates (`ingress.tls.source=letsEncrypt`). @@ -116,7 +118,7 @@ These instructions are adapted from the [official cert-manager documentation](ht ``` # If you have installed the CRDs manually instead of with the `--set installCRDs=true` option added to your Helm install command, you should upgrade your CRD resources before upgrading the Helm chart: -kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.5.1/cert-manager.crds.yaml +kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.7.1/cert-manager.crds.yaml. # Add the Jetstack Helm repository helm repo add jetstack https://charts.jetstack.io @@ -128,7 +130,7 @@ helm repo update helm install cert-manager jetstack/cert-manager \ --namespace cert-manager \ --create-namespace \ - --version v1.5.1 + --version v1.7.1 ``` Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the cert-manager namespace for running pods: diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/install-rancher/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/install-rancher/_index.md index 8f15d855e8e..a739fd07987 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/install-rancher/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/install-rancher/_index.md @@ -94,8 +94,10 @@ helm repo update Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager). +**Note:** New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. + ```plain -helm fetch jetstack/cert-manager --version v1.5.1 +helm fetch jetstack/cert-manager --version v1.7.1 ``` ### 3. Render the cert-manager template @@ -103,7 +105,7 @@ helm fetch jetstack/cert-manager --version v1.5.1 Render the cert-manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files. ```plain -helm template cert-manager ./cert-manager-v1.5.1.tgz --output-dir . \ +helm template cert-manager ./cert-manager-v1.7.1.tgz --output-dir . \ --namespace cert-manager \ --set image.repository=/quay.io/jetstack/cert-manager-controller \ --set webhook.image.repository=/quay.io/jetstack/cert-manager-webhook \ @@ -115,7 +117,7 @@ helm template cert-manager ./cert-manager-v1.5.1.tgz --output-dir . \ Download the required CRD file for cert-manager: ```plain - curl -L -o cert-manager/cert-manager-crd.yaml https://github.com/jetstack/cert-manager/releases/download/v1.5.1/cert-manager.crds.yaml + curl -L -o cert-manager/cert-manager-crd.yaml https://github.com/jetstack/cert-manager/releases/download/v1.7.1/cert-manager.crds.yaml ``` ### 5. Render the Rancher template diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md index 05b260b3aa5..18c8817f76f 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md @@ -51,6 +51,8 @@ If you will use ARM64 hosts, the registry must support manifests. As of April 20 In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS certificates, you must add the [`cert-manager`](https://hub.helm.sh/charts/jetstack/cert-manager) image to `rancher-images.txt` as well. +**Note:** New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. + 1. Fetch the latest `cert-manager` Helm chart and parse the template for image details: > **Note:** Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.12.0, please see our [upgrade documentation]({{}}/rancher/v2.6/en/installation/resources/upgrading-cert-manager/). @@ -58,7 +60,7 @@ In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS ```plain helm repo add jetstack https://charts.jetstack.io helm repo update - helm fetch jetstack/cert-manager --version v1.5.1 + helm fetch jetstack/cert-manager --version v1.7.1 helm template ./cert-manager-.tgz | awk '$1 ~ /image:/ {print $2}' | sed s/\"//g >> ./rancher-images.txt ``` diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md index 35ceaf1b26a..a5a57c7b6ae 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md @@ -23,15 +23,17 @@ kubectl create namespace cert-manager Install the CustomResourceDefinitions of cert-manager: +**Note:** New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. + ``` -kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.5.1/cert-manager.crds.yaml +kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.7.1/cert-manager.crds.yaml ``` And install it with Helm. Note that cert-manager also needs your proxy configured in case it needs to communicate with Let's Encrypt or other external certificate issuers: ``` helm upgrade --install cert-manager jetstack/cert-manager \ - --namespace cert-manager --version v1.5.1 \ + --namespace cert-manager --version v1.7.1 \ --set http_proxy=http://${proxy_host} \ --set https_proxy=http://${proxy_host} \ --set no_proxy=127.0.0.0/8\\,10.0.0.0/8\\,cattle-system.svc\\,172.16.0.0/12\\,192.168.0.0/16\\,.svc\\,.cluster.local From 5b53637cdcc5990107e79517550176b31b6cc73a Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 23 Mar 2022 14:41:56 -0400 Subject: [PATCH 352/478] Fixed typo --- .../v2.6/en/installation/install-rancher-on-k8s/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md index 2d2879fdc8b..b5d9f5a83fb 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md @@ -118,7 +118,7 @@ These instructions are adapted from the [official cert-manager documentation](ht ``` # If you have installed the CRDs manually instead of with the `--set installCRDs=true` option added to your Helm install command, you should upgrade your CRD resources before upgrading the Helm chart: -kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.7.1/cert-manager.crds.yaml. +kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.7.1/cert-manager.crds.yaml # Add the Jetstack Helm repository helm repo add jetstack https://charts.jetstack.io From 0e81895b91a40963bb1bb828fb49227759337e0e Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 23 Mar 2022 14:44:49 -0400 Subject: [PATCH 353/478] Removed space --- .../v2.6/en/installation/install-rancher-on-k8s/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md index b5d9f5a83fb..a963c18afca 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md @@ -118,7 +118,7 @@ These instructions are adapted from the [official cert-manager documentation](ht ``` # If you have installed the CRDs manually instead of with the `--set installCRDs=true` option added to your Helm install command, you should upgrade your CRD resources before upgrading the Helm chart: -kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.7.1/cert-manager.crds.yaml +kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.7.1/cert-manager.crds.yaml # Add the Jetstack Helm repository helm repo add jetstack https://charts.jetstack.io From d67c9346aff9c13a9e7984a91ee327990fa6fca0 Mon Sep 17 00:00:00 2001 From: Jen Travinski Date: Wed, 23 Mar 2022 16:57:59 -0400 Subject: [PATCH 354/478] Revert "Use the current hostname for baseUrl" --- Dockerfile.dev | 2 +- Dockerfile.prod | 2 +- Dockerfile.staging | 2 +- config.toml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Dockerfile.dev b/Dockerfile.dev index 53225113ca0..af34fcf57dc 100644 --- a/Dockerfile.dev +++ b/Dockerfile.dev @@ -10,4 +10,4 @@ RUN mkdir -p /output /theme/rancher-website-theme && tar -xzf /run/master.tar.gz # Expose default hugo port EXPOSE 9001 -ENTRYPOINT ["hugo", "serve", "--bind=0.0.0.0", "--buildDrafts", "--buildFuture" ] +ENTRYPOINT ["hugo", "serve", "--bind=0.0.0.0", "--buildDrafts", "--buildFuture", "--baseURL=" ] diff --git a/Dockerfile.prod b/Dockerfile.prod index 0a0511d279c..38ba46de614 100644 --- a/Dockerfile.prod +++ b/Dockerfile.prod @@ -16,7 +16,7 @@ COPY .git .git ADD https://github.com/rancherlabs/website-theme/archive/master.tar.gz /run/master.tar.gz RUN mkdir -p /output /theme/rancher-website-theme && tar -xzf /run/master.tar.gz -C /run/node_modules/rancher-website-theme --strip=1 && rm /run/master.tar.gz -RUN ["hugo", "--buildFuture", "--destination=/output"] +RUN ["hugo", "--buildFuture", "--baseURL=https://rancher.com/docs", "--destination=/output"] # Make sure something got built RUN stat /output/index.html diff --git a/Dockerfile.staging b/Dockerfile.staging index ea6ea487cfb..5dc30768635 100644 --- a/Dockerfile.staging +++ b/Dockerfile.staging @@ -16,7 +16,7 @@ COPY .git .git ADD https://github.com/rancherlabs/website-theme/archive/master.tar.gz /run/master.tar.gz RUN mkdir -p /output /theme/rancher-website-theme && tar -xzf /run/master.tar.gz -C /run/node_modules/rancher-website-theme --strip=1 && rm /run/master.tar.gz -RUN ["hugo", "--buildDrafts", "--buildFuture", "--destination=/output"] +RUN ["hugo", "--buildDrafts", "--buildFuture", "--baseURL=https://staging.rancher.com/docs", "--destination=/output"] # Make sure something got built RUN stat /output/index.html diff --git a/config.toml b/config.toml index de5a060aead..35fdfda6e03 100644 --- a/config.toml +++ b/config.toml @@ -1,4 +1,4 @@ -baseURL = ".Permalink" +baseURL = "" languageCode = "en-us" title = "Rancher Labs" From c4b0b3ac90d4ba6395f9c32d8d7ce8fc30785305 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 23 Mar 2022 17:25:15 -0400 Subject: [PATCH 355/478] Added new cert-manager version verbiage in upgrade section --- .../en/installation/install-rancher-on-k8s/upgrades/_index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md index 5c25a7f24b8..0c3f2035148 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md @@ -150,6 +150,8 @@ helm upgrade rancher rancher-/rancher \ If you are currently running the cert-manager whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, then you need to reinstall both Rancher and cert-manager due to the API change in cert-manager v0.11. +>**Note:** New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. + 1. Uninstall Rancher ``` From b2b687ed2f25a78d1ae16078c39c465bb57855ae Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Thu, 24 Mar 2022 10:17:05 +0530 Subject: [PATCH 356/478] Amending RKE clusters section to reflect correct information --- content/rancher/v2.5/en/faq/removing-rancher/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/faq/removing-rancher/_index.md b/content/rancher/v2.5/en/faq/removing-rancher/_index.md index 49c1acde9bc..e05744e7400 100644 --- a/content/rancher/v2.5/en/faq/removing-rancher/_index.md +++ b/content/rancher/v2.5/en/faq/removing-rancher/_index.md @@ -27,7 +27,7 @@ The capability to access a downstream cluster without Rancher depends on the typ - **Registered clusters:** The cluster will be unaffected and you can access the cluster using the same methods that you did before the cluster was registered into Rancher. - **Hosted Kubernetes clusters:** If you created the cluster in a cloud-hosted Kubernetes provider such as EKS, GKE, or AKS, you can continue to manage the cluster using your provider's cloud credentials. -- **RKE clusters:** To access an [RKE cluster,]({{}}/rancher/v2.5/en/cluster-provisioning/rke-clusters/) the cluster must have the [authorized cluster endpoint]({{}}/rancher/v2.5/en/overview/architecture/#4-authorized-cluster-endpoint) enabled, and you must have already downloaded the cluster's kubeconfig file from the Rancher UI. (The authorized cluster endpoint is enabled by default for RKE clusters.) With this endpoint, you can access your cluster with kubectl directly instead of communicating through the Rancher server's [authentication proxy.]({{}}/rancher/v2.5/en/overview/architecture/#1-the-authentication-proxy) For instructions on how to configure kubectl to use the authorized cluster endpoint, refer to the section about directly accessing clusters with [kubectl and the kubeconfig file.]({{}}/rancher/v2.5/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) These clusters will use a snapshot of the authentication as it was configured when Rancher was removed. +- **RKE clusters:** Please note that you will no longer be able to manage the individual Kubernetes components or perform any upgrades on them after the deletion of the Rancher server. However, you can still access the cluster to manage your workloads. To access an [RKE cluster,]({{}}/rancher/v2.5/en/cluster-provisioning/rke-clusters/) the cluster must have the [authorized cluster endpoint]({{}}/rancher/v2.5/en/overview/architecture/#4-authorized-cluster-endpoint) enabled, and you must have already downloaded the cluster's kubeconfig file from the Rancher UI. (The authorized cluster endpoint is enabled by default for RKE clusters.) With this endpoint, you can access your cluster with kubectl directly instead of communicating through the Rancher server's [authentication proxy.]({{}}/rancher/v2.5/en/overview/architecture/#1-the-authentication-proxy) For instructions on how to configure kubectl to use the authorized cluster endpoint, refer to the section about directly accessing clusters with [kubectl and the kubeconfig file.]({{}}/rancher/v2.5/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) These clusters will use a snapshot of the authentication as it was configured when Rancher was removed. ### What if I don't want Rancher anymore? From a43f8c412ea5add4a6ad8306123ca36f308706d0 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Thu, 24 Mar 2022 10:09:11 -0400 Subject: [PATCH 357/478] Updated verbiage per feedback --- .../en/installation/install-rancher-on-k8s/upgrades/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md index 0c3f2035148..841480f6968 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md @@ -148,7 +148,7 @@ helm upgrade rancher rancher-/rancher \ ### Option B: Reinstalling Rancher and cert-manager -If you are currently running the cert-manager whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, then you need to reinstall both Rancher and cert-manager due to the API change in cert-manager v0.11. +If you are currently running the cert-manager whose version is 1.5 or below, and want to upgrade both Rancher and cert-manager to a new version (1.6+ in the case of cert-manager), then you need to re-install both Rancher and cert-manager due to the API change in cert-manager 1.6. This will also be necessary if you are upgrading from a version of cert manager below 0.11 to a version of cert-manager above 0.11. >**Note:** New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. From 995ea50b75e3f34e5302aaf95b03d1dc6ab9a131 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Thu, 24 Mar 2022 11:07:10 -0400 Subject: [PATCH 358/478] Added statement on using scripts to clean up cluster --- .../rancher/v2.6/en/backups/restoring-rancher/_index.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md index 1f20f311720..b818387ff47 100644 --- a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md @@ -5,6 +5,13 @@ weight: 2 A restore is performed by creating a Restore custom resource. +--- +**New Requirement for Restore in HA Rancher:** + +The HA Rancher server is not coming up active when restoring Rancher with a backup taken in v2.6.3. To work around this issue, you must manually clean up the cluster **before** restoring the backup. Two scripts have been created to assist you: one to clean up the cluster, and one to check for any Rancher-related resources in the cluster. Refer [here](https://github.com/rancherlabs/support-tools/tree/master/cleanup-rancher-k8s-resources) for details on the scripts. + +--- + > **Important** > > * Follow the instructions from this page for restoring rancher on the same cluster where it was backed up from. In order to migrate rancher to a new cluster, follow the steps to [migrate rancher.]({{}}/rancher/v2.6/en/backups/migrating-rancher) From de22c88602d95a1ad2a3c85eff056534b8c62ef5 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Thu, 24 Mar 2022 10:27:03 -0700 Subject: [PATCH 359/478] Update content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md Co-authored-by: divya-mohan0209 --- .../single-node-docker/single-node-upgrades/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md index b3262cc73c5..3b03de02a22 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md @@ -9,7 +9,7 @@ The following instructions will guide you through upgrading a Rancher server tha # Prerequisites -- **Review the [known upgrade issues]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/#known-upgrade-issues)** in the Rancher documentation for the most noteworthy issues to consider when upgrading Rancher. A more complete list of known issues for each Rancher version can be found in the release notes on [GitHub](https://github.com/rancher/rancher/releases) and on the [Rancher forums.](https://forums.rancher.com/c/announcements/12) Note that upgrades to or from any chart in the [rancher-alpha repository]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/#helm-chart-repositories/) aren’t supported. +- **Review the [known upgrade issues]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/#known-upgrade-issues)** section in the Rancher documentation for the most noteworthy issues to consider when upgrading Rancher. A more complete list of known issues for each Rancher version can be found in the release notes on [GitHub](https://github.com/rancher/rancher/releases) and on the [Rancher forums](https://forums.rancher.com/c/announcements/12). Note that upgrades to or from any chart in the [rancher-alpha repository]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/#helm-chart-repositories/) aren’t supported. - **For [air gap installs only,]({{}}/rancher/v2.6/en/installation/other-installation-methods/air-gap) collect and populate images for the new Rancher server version**. Follow the guide to [populate your private registry]({{}}/rancher/v2.6/en/installation/other-installation-methods/air-gap/populate-private-registry/) with the images for the Rancher version that you want to upgrade to. # Placeholder Review From c298a54e621f430e2496915dd8d3b63651af89e1 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Thu, 24 Mar 2022 10:27:16 -0700 Subject: [PATCH 360/478] Update content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md Co-authored-by: divya-mohan0209 --- .../deployment/quickstart-manual-setup/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md index 70b92903d93..87d9c75004b 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md @@ -9,7 +9,7 @@ These instructions assume you have a Linux virtual machine that you will communi We don't recommend installing Rancher locally because it creates a networking problem. Installing Rancher on localhost does not allow Rancher to communicate with downstream Kubernetes clusters, so on localhost you wouldn't be able to test Rancher's cluster provisioning or cluster management functionality. -Your Linux machine can be anywhere. It could be an Amazon EC2 instance, a Digital Ocean droplet, or an Azure virtual machine, to name a few examples. Other Rancher docs often use 'node' as a generic term for all of these. One possible way to deploy a Linux machine is by setting up an Amazon EC2 instance as shown in [this tutorial.]({{}}/rancher/v2.6/en/installation/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/) +Your Linux machine can be anywhere. It could be an Amazon EC2 instance, a Digital Ocean droplet, or an Azure virtual machine, to name a few examples. Other Rancher docs often use 'node' as a generic term for all of these. One possible way to deploy a Linux machine is by setting up an Amazon EC2 instance as shown in [this tutorial]({{}}/rancher/v2.6/en/installation/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/). The full installation requirements are [here.]({{}}/rancher/v2.6/en/installation/requirements/) From da261bc4cadd7096b6bdc9002871f7b1116c398a Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Thu, 24 Mar 2022 10:27:29 -0700 Subject: [PATCH 361/478] Update content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md Co-authored-by: divya-mohan0209 --- .../deployment/quickstart-manual-setup/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md index 87d9c75004b..72264e77fcd 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md @@ -11,7 +11,7 @@ We don't recommend installing Rancher locally because it creates a networking pr Your Linux machine can be anywhere. It could be an Amazon EC2 instance, a Digital Ocean droplet, or an Azure virtual machine, to name a few examples. Other Rancher docs often use 'node' as a generic term for all of these. One possible way to deploy a Linux machine is by setting up an Amazon EC2 instance as shown in [this tutorial]({{}}/rancher/v2.6/en/installation/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/). -The full installation requirements are [here.]({{}}/rancher/v2.6/en/installation/requirements/) +The full installation requirements are [here]({{}}/rancher/v2.6/en/installation/requirements/). ## Install K3s on Linux From 35ac8f576af17a6b9744338e57e2c0a95d1d5de2 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Thu, 24 Mar 2022 10:27:46 -0700 Subject: [PATCH 362/478] Update content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md Co-authored-by: divya-mohan0209 --- .../deployment/quickstart-manual-setup/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md index 72264e77fcd..0672d6118f7 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md @@ -16,7 +16,7 @@ The full installation requirements are [here]({{}}/rancher/v2.6/en/inst ## Install K3s on Linux -Install a K3s Kubernetes cluster by running this command on the Linux machine: +Install a K3s cluster by running this command on the Linux machine: ``` curl -sfL https://get.k3s.io | sh -s - server From 3461771a1bc52ed5de03b8c8760c2c21226633c4 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Thu, 24 Mar 2022 10:28:03 -0700 Subject: [PATCH 363/478] Update content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md Co-authored-by: divya-mohan0209 --- .../deployment/quickstart-manual-setup/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md index 0672d6118f7..b620fde38fa 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md @@ -54,7 +54,7 @@ scp root@:/etc/rancher/k3s/k3s.yaml $env:USERPROFILE\.kube\ ## Edit the Rancher server URL in the kubeconfig -In the kubeconfig file, the server directive is defined as `localhost`. You will need to change the server directive from `localhost` to `:6443`. (The Kubernetes API server will be reached at port 6443, while the Rancher server will be reached at ports 80 and 443.) This edit is needed so that when you run Helm or kubectl commands from your local workstation, you will be able to communicate with the Kubernetes cluster that Rancher will be installed on. +In the kubeconfig file, the server directive is defined as `localhost`. You will need to change the server directive from `localhost` to `:6443`. The Kubernetes API server will be reached at port 6443, while the Rancher server will be reached at ports 80 and 443. This edit is needed so that when you run Helm or kubectl commands from your local workstation, you will be able to communicate with the Kubernetes cluster that Rancher will be installed on. {{% tabs %}} {{% tab "Mac and Linux" %}} From 5c7740f1ac71e4217eb68a616a4bd3e822e5d406 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Thu, 24 Mar 2022 10:28:18 -0700 Subject: [PATCH 364/478] Update content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md Co-authored-by: divya-mohan0209 --- .../deployment/quickstart-manual-setup/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md index b620fde38fa..12bec549c0d 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md @@ -84,7 +84,7 @@ Once edited, either press `ctrl+s` or go to `File > Save` to save your work. ## Install Rancher with Helm -Then from your local workstation, run the following commands. You will need to have installed [kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl) and [helm.](https://helm.sh/docs/intro/install/) +Then from your local workstation, run the following commands. You will need to have [kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl) and [helm.](https://helm.sh/docs/intro/install/) installed. ``` helm repo add rancher-latest https://releases.rancher.com/server-charts/latest From 77f0d799c1490943cfc99a69d3c8835bdc9714c0 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Thu, 24 Mar 2022 13:31:50 -0400 Subject: [PATCH 365/478] Added verbiage to upgrading-cert-manager page --- .../en/installation/resources/upgrading-cert-manager/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md b/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md index 3879ab15d1f..122fcebd36d 100644 --- a/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md +++ b/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md @@ -15,7 +15,7 @@ To address these changes, this guide will do two things: 1. Explain the cert-manager API changes and link to cert-manager's official documentation for migrating your data > **Important:** -> If you are currently running the cert-manager whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, you need to reinstall both of them: +> If you are currently running the cert-manager whose version is 1.5 or below, and want to upgrade both Rancher and cert-manager to a new version (1.6+ in the case of cert-manager), then you need to re-install both Rancher and cert-manager due to the API change in cert-manager 1.6. This will also be necessary if you are upgrading from a version of cert manager below 0.11 to a version of cert-manager above 0.11. Follow the steps below: > 1. Take a one-time snapshot of your Kubernetes cluster running Rancher server > 2. Uninstall Rancher, cert-manager, and the CustomResourceDefinition for cert-manager From e7a8b79540b6ce614b0078e113bfedd1b22ddfaf Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Thu, 24 Mar 2022 18:46:05 -0400 Subject: [PATCH 366/478] Updating per feedback --- content/rancher/v2.6/en/backups/restoring-rancher/_index.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md index b818387ff47..0298e5cee38 100644 --- a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md @@ -6,9 +6,11 @@ weight: 2 A restore is performed by creating a Restore custom resource. --- -**New Requirement for Restore in HA Rancher:** +**Caution:** Before performing a restore or rollback, note the following: -The HA Rancher server is not coming up active when restoring Rancher with a backup taken in v2.6.3. To work around this issue, you must manually clean up the cluster **before** restoring the backup. Two scripts have been created to assist you: one to clean up the cluster, and one to check for any Rancher-related resources in the cluster. Refer [here](https://github.com/rancherlabs/support-tools/tree/master/cleanup-rancher-k8s-resources) for details on the scripts. +- In Rancher v2.6.4, the cluster-api module has been upgraded from v0.4.4 to v1.0.2 in which the apiVersion of CAPI CRDs are upgraded from `cluster.x.k8s.io/v1alpha4` to `cluster.x-k8s.io/v1beta1`. This has the effect of causing rollbacks from Rancher v2.6.4 to any previous version of Rancher v2.6.x to fail because the previous version the CRDs needed to roll back are no longer available in v1beta1. + +- To avoid this, the Rancher resource cleanup scripts should be run **before** the restore or rollback is attempted. Specifically, two scripts have been created to assist you: one to clean up the cluster (`cleanup.sh`), and one to check for any Rancher-related resources in the cluster (`verify.sh`). Details on the cleanup script can be found in the [rancherlabs/support-tools repo](https://github.com/rancherlabs/support-tools/tree/master/cleanup-rancher-k8s-resources). --- From 014892459336d6a0f708a42eedf91aa6ad33892e Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Thu, 24 Mar 2022 18:48:25 -0400 Subject: [PATCH 367/478] Fixed typo --- content/rancher/v2.6/en/backups/restoring-rancher/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md index 0298e5cee38..468b179d348 100644 --- a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md @@ -8,7 +8,7 @@ A restore is performed by creating a Restore custom resource. --- **Caution:** Before performing a restore or rollback, note the following: -- In Rancher v2.6.4, the cluster-api module has been upgraded from v0.4.4 to v1.0.2 in which the apiVersion of CAPI CRDs are upgraded from `cluster.x.k8s.io/v1alpha4` to `cluster.x-k8s.io/v1beta1`. This has the effect of causing rollbacks from Rancher v2.6.4 to any previous version of Rancher v2.6.x to fail because the previous version the CRDs needed to roll back are no longer available in v1beta1. +- In Rancher v2.6.4, the cluster-api module has been upgraded from v0.4.4 to v1.0.2 in which the apiVersion of CAPI CRDs are upgraded from `cluster.x-k8s.io/v1alpha4` to `cluster.x-k8s.io/v1beta1`. This has the effect of causing rollbacks from Rancher v2.6.4 to any previous version of Rancher v2.6.x to fail because the previous version the CRDs needed to roll back are no longer available in v1beta1. - To avoid this, the Rancher resource cleanup scripts should be run **before** the restore or rollback is attempted. Specifically, two scripts have been created to assist you: one to clean up the cluster (`cleanup.sh`), and one to check for any Rancher-related resources in the cluster (`verify.sh`). Details on the cleanup script can be found in the [rancherlabs/support-tools repo](https://github.com/rancherlabs/support-tools/tree/master/cleanup-rancher-k8s-resources). From 646e3833ad1ac9d61956bc4601e54befd329f067 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 25 Mar 2022 11:58:34 -0400 Subject: [PATCH 368/478] Updated hardcoded cert-manager versions, added links for upgrade --- .../upgrading-cert-manager/_index.md | 21 ++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md b/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md index 122fcebd36d..d2861317b46 100644 --- a/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md +++ b/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md @@ -87,7 +87,7 @@ In order to upgrade cert-manager, follow these instructions: helm install \ cert-manager jetstack/cert-manager \ --namespace cert-manager \ - --version v0.12.0 + --version vX.Y.Z ``` 1. [Restore back up resources](https://cert-manager.io/docs/tutorials/backup/#restoring-resources) @@ -98,7 +98,7 @@ In order to upgrade cert-manager, follow these instructions: {{% /accordion %}} -### Option B: Upgrade cert-manager in an Air Gap Environment +### Option B: Upgrade cert-manager in an Air-Gapped Environment {{% accordion id="airgap" label="Click to expand" %}} @@ -118,7 +118,7 @@ Before you can perform the upgrade, you must prepare your air gapped environment 1. Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager). ```plain - helm fetch jetstack/cert-manager --version v0.12.0 + helm fetch jetstack/cert-manager --version vX.Y.Z ``` 1. Render the cert manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files. @@ -126,7 +126,7 @@ Before you can perform the upgrade, you must prepare your air gapped environment The Helm 3 command is as follows: ```plain - helm template cert-manager ./cert-manager-v0.12.0.tgz --output-dir . \ + helm template cert-manager ./cert-manager-vX.Y.Z.tgz --output-dir . \ --namespace cert-manager \ --set image.repository=/quay.io/jetstack/cert-manager-controller --set webhook.image.repository=/quay.io/jetstack/cert-manager-webhook @@ -136,7 +136,7 @@ Before you can perform the upgrade, you must prepare your air gapped environment The Helm 2 command is as follows: ```plain - helm template ./cert-manager-v0.12.0.tgz --output-dir . \ + helm template ./cert-manager-vX.Y.Z.tgz --output-dir . \ --name cert-manager --namespace cert-manager \ --set image.repository=/quay.io/jetstack/cert-manager-controller --set webhook.image.repository=/quay.io/jetstack/cert-manager-webhook @@ -146,7 +146,7 @@ Before you can perform the upgrade, you must prepare your air gapped environment 1. Download the required CRD file for cert-manager (old and new) ```plain - curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml + curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-X.Y/deploy/manifests/00-crds.yaml curl -L -o cert-manager/cert-manager-crd-old.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-X.Y/deploy/manifests/00-crds.yaml ``` @@ -167,7 +167,7 @@ Before you can perform the upgrade, you must prepare your air gapped environment ```plain kubectl -n cert-manager \ delete deployment,sa,clusterrole,clusterrolebinding \ - -l 'app=cert-manager' -l 'chart=cert-manager-v0.5.2' + -l 'app=cert-manager' -l 'chart=cert-manager-vX.Y.Z' ``` Delete the CustomResourceDefinition using the link to the version vX.Y you installed @@ -220,6 +220,13 @@ cert-manager-webhook-787858fcdb-nlzsq 1/1 Running 0 2m ## Cert-Manager API change and data migration +--- +_New in v2.6.4_ + +Rancher now supports cert-manager versions 1.6.2 and 1.7.1. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. To read more, see the [cert-manager docs]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/#4-install-cert-manager). For instructions on upgrading cert-manager from version 1.5 to 1.6, see the upstream cert-manager documentation [here](https://cert-manager.io/docs/installation/upgrading/upgrading-1.5-1.6/). For instructions on upgrading cert-manager from version 1.6 to 1.7, see the upstream cert-manager documentation [here](https://cert-manager.io/docs/installation/upgrading/upgrading-1.6-1.7/). + +--- + Cert-manager has deprecated the use of the `certificate.spec.acme.solvers` field and will drop support for it completely in an upcoming release. Per the cert-manager documentation, a new format for configuring ACME certificate resources was introduced in v0.8. Specifically, the challenge solver configuration field was moved. Both the old format and new are supported as of v0.9, but support for the old format will be dropped in an upcoming release of cert-manager. The cert-manager documentation strongly recommends that after upgrading you update your ACME Issuer and Certificate resources to the new format. From 59e123f9df9cf7eaad27e0eec86a250a6a873cae Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 25 Mar 2022 14:32:30 -0400 Subject: [PATCH 369/478] Updated per feedback --- .../installation/install-rancher-on-k8s/upgrades/_index.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md index 841480f6968..cfe481e2b94 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md @@ -150,7 +150,11 @@ helm upgrade rancher rancher-/rancher \ If you are currently running the cert-manager whose version is 1.5 or below, and want to upgrade both Rancher and cert-manager to a new version (1.6+ in the case of cert-manager), then you need to re-install both Rancher and cert-manager due to the API change in cert-manager 1.6. This will also be necessary if you are upgrading from a version of cert manager below 0.11 to a version of cert-manager above 0.11. ->**Note:** New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. +>**Important:** +> +>- New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. +> +>- Note that if you are below version 1.5 and want to go to 1.7, you should first upgrade to 1.6 as an intermediate step. Follow the cert-manager docs [here](https://cert-manager.io/docs/installation/upgrading/upgrading-1.5-1.6/) to do a 1.5 to 1.6 upgrade, and [here](https://cert-manager.io/docs/installation/upgrading/upgrading-1.6-1.7/) to then do a 1.6 to 1.7 upgrade. For more details on upgrading cert-manager, refer to our [documentation]({{}}/rancher/v2.6/en/installation/resources/upgrading-cert-manager). 1. Uninstall Rancher From fd9fb0560da0c55ccee3cb769438386abf770dd0 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 25 Mar 2022 14:46:37 -0400 Subject: [PATCH 370/478] Reverting hardcoded commands --- .../resources/upgrading-cert-manager/_index.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md b/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md index d2861317b46..f3b21f8aed0 100644 --- a/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md +++ b/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md @@ -87,7 +87,7 @@ In order to upgrade cert-manager, follow these instructions: helm install \ cert-manager jetstack/cert-manager \ --namespace cert-manager \ - --version vX.Y.Z + --version v0.12.0 ``` 1. [Restore back up resources](https://cert-manager.io/docs/tutorials/backup/#restoring-resources) @@ -98,7 +98,7 @@ In order to upgrade cert-manager, follow these instructions: {{% /accordion %}} -### Option B: Upgrade cert-manager in an Air-Gapped Environment +### Option B: Upgrade cert-manager in an Air Gap Environment {{% accordion id="airgap" label="Click to expand" %}} @@ -118,7 +118,7 @@ Before you can perform the upgrade, you must prepare your air gapped environment 1. Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager). ```plain - helm fetch jetstack/cert-manager --version vX.Y.Z + helm fetch jetstack/cert-manager --version v0.12.0 ``` 1. Render the cert manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files. @@ -126,7 +126,7 @@ Before you can perform the upgrade, you must prepare your air gapped environment The Helm 3 command is as follows: ```plain - helm template cert-manager ./cert-manager-vX.Y.Z.tgz --output-dir . \ + helm template cert-manager ./cert-manager-v0.12.0.tgz --output-dir . \ --namespace cert-manager \ --set image.repository=/quay.io/jetstack/cert-manager-controller --set webhook.image.repository=/quay.io/jetstack/cert-manager-webhook @@ -136,7 +136,7 @@ Before you can perform the upgrade, you must prepare your air gapped environment The Helm 2 command is as follows: ```plain - helm template ./cert-manager-vX.Y.Z.tgz --output-dir . \ + helm template ./cert-manager-v0.12.0.tgz --output-dir . \ --name cert-manager --namespace cert-manager \ --set image.repository=/quay.io/jetstack/cert-manager-controller --set webhook.image.repository=/quay.io/jetstack/cert-manager-webhook @@ -146,7 +146,7 @@ Before you can perform the upgrade, you must prepare your air gapped environment 1. Download the required CRD file for cert-manager (old and new) ```plain - curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-X.Y/deploy/manifests/00-crds.yaml + curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml curl -L -o cert-manager/cert-manager-crd-old.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-X.Y/deploy/manifests/00-crds.yaml ``` @@ -167,7 +167,7 @@ Before you can perform the upgrade, you must prepare your air gapped environment ```plain kubectl -n cert-manager \ delete deployment,sa,clusterrole,clusterrolebinding \ - -l 'app=cert-manager' -l 'chart=cert-manager-vX.Y.Z' + -l 'app=cert-manager' -l 'chart=cert-manager-v0.5.2' ``` Delete the CustomResourceDefinition using the link to the version vX.Y you installed From be711bf2d7602637f7ac82a8c348646b1d5d55a5 Mon Sep 17 00:00:00 2001 From: Jamie Phillips Date: Mon, 28 Mar 2022 12:44:22 -0400 Subject: [PATCH 371/478] Updating vSphere CSI and CPI information. Currently, what is listed in the docs doesn't match the upstream support matrix for those projects. This updates it to be aligned with that. Signed-off-by: Jamie Phillips --- .../cloud-providers/vsphere/out-of-tree/_index.md | 5 ++++- .../cloud-providers/vsphere/out-of-tree/_index.md | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/cloud-providers/vsphere/out-of-tree/_index.md b/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/cloud-providers/vsphere/out-of-tree/_index.md index 33c3a39e9d8..545d87e0f49 100644 --- a/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/cloud-providers/vsphere/out-of-tree/_index.md +++ b/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/cloud-providers/vsphere/out-of-tree/_index.md @@ -13,7 +13,10 @@ This page covers how to install the Cloud Provider Interface (CPI) and Cloud Sto # Prerequisites -The vSphere version must be 7.0u1 or higher. +The vSphere versions supported: + +* 6.7u3 +* 7.0u1 or higher. The Kubernetes version must be 1.19 or higher. diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/cloud-providers/vsphere/out-of-tree/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/cloud-providers/vsphere/out-of-tree/_index.md index b9ba43c3c29..d9b95fc9b6f 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/cloud-providers/vsphere/out-of-tree/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/cloud-providers/vsphere/out-of-tree/_index.md @@ -10,7 +10,10 @@ This page covers how to install the Cloud Provider Interface (CPI) and Cloud Sto # Prerequisites -The vSphere version must be 7.0u1 or higher. +The vSphere versions supported: + +* 6.7u3 +* 7.0u1 or higher. The Kubernetes version must be 1.19 or higher. From ac8d547c77e6a1b344b5c9c9834632b1b542f17c Mon Sep 17 00:00:00 2001 From: Rafael de Almeida Date: Mon, 28 Mar 2022 18:41:57 -0300 Subject: [PATCH 372/478] Put slash to wrap command line helm --- .../behind-proxy/install-rancher/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md index 35ceaf1b26a..1ce792b0672 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md @@ -64,7 +64,7 @@ And install Rancher with Helm. Rancher also needs a proxy configuration so that helm upgrade --install rancher rancher-latest/rancher \ --namespace cattle-system \ --set hostname=rancher.example.com \ - --set proxy=http://${proxy_host} + --set proxy=http://${proxy_host} \ --set noProxy=127.0.0.0/8\\,10.0.0.0/8\\,cattle-system.svc\\,172.16.0.0/12\\,192.168.0.0/16\\,.svc\\,.cluster.local ``` From cbe1382880714c539ec2d646442865e786df415b Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Wed, 30 Mar 2022 10:30:43 +0530 Subject: [PATCH 373/478] Make amendments to the installation netowrking requirements --- content/rancher/v2.6/en/installation/requirements/_index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/rancher/v2.6/en/installation/requirements/_index.md b/content/rancher/v2.6/en/installation/requirements/_index.md index 3c089d6023c..d7a9168baf5 100644 --- a/content/rancher/v2.6/en/installation/requirements/_index.md +++ b/content/rancher/v2.6/en/installation/requirements/_index.md @@ -170,6 +170,8 @@ Rancher performance depends on etcd in the cluster performance. To ensure optima This section describes the networking requirements for the node(s) where the Rancher server is installed. +> If a server containing Rancher has the `X-Frame-Options=DENY` header, the Ember UI will be completely unreachable on upgrading from the legacy UI. This is because any screen written for the legacy UI is rendered as an embedded iframe within the new Dashboard. + ### Node IP Addresses Each node used should have a static IP configured, regardless of whether you are installing Rancher on a single node or on an HA cluster. In case of DHCP, each node should have a DHCP reservation to make sure the node gets the same IP allocated. From 748e353e21f2d6f3821ec8d444b372946412be56 Mon Sep 17 00:00:00 2001 From: Andy Daniel Date: Wed, 30 Mar 2022 22:16:33 -0400 Subject: [PATCH 374/478] Add Nutanix node-pools This adds Nutanix node-pool doc in coordination for support in 2.6.4. --- .../rke-clusters/node-pools/nutanix/_index.md | 20 ++++ .../nutanix-node-template-config/_index.md | 62 +++++++++++++ .../provisioning-nutanix-clusters/_index.md | 91 +++++++++++++++++++ 3 files changed, 173 insertions(+) create mode 100644 content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/_index.md create mode 100644 content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/nutanix-node-template-config/_index.md create mode 100644 content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/provisioning-nutanix-clusters/_index.md diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/_index.md new file mode 100644 index 00000000000..a5080e62f47 --- /dev/null +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/_index.md @@ -0,0 +1,20 @@ +--- +title: Creating a Nutanix AOS Cluster +shortTitle: Nutanix +description: Use Rancher to create a Nutanix AOS (AHV) cluster. It may consist of groups of VMs with distinct properties which allow for fine-grained control over the sizing of nodes. +metaDescription: Use Rancher to create a Nutanix AOS (AHV) cluster. It may consist of groups of VMs with distinct properties which allow for fine-grained control over the sizing of nodes. +weight: 2225 +--- + +By using Rancher with Nutanix AOS (AHV), you can bring cloud operations on-premises. + +Rancher can provision nodes in AOS (AHV) and install Kubernetes on them. When creating a Kubernetes cluster in AOS, Rancher first provisions the specified number of virtual machines by communicating with the Prism Central API. Then it installs Kubernetes on top of them. + +A Nutanix cluster may consist of multiple groups of VMs with distinct properties, such as the amount of memory or the number of vCPUs. This grouping allows for fine-grained control over the sizing of nodes for each Kubernetes role. + +- [Creating a Nutanix Cluster](#creating-a-nutanix-cluster) +- [Provisioning Storage](#provisioning-storage) + +# Creating a Nutanix Cluster + +In [this section,](./provisioning-nutanix-clusters) you'll learn how to use Rancher to install an [RKE]({{}}/rke/latest/en/) Kubernetes cluster in Nutanix AOS. diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/nutanix-node-template-config/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/nutanix-node-template-config/_index.md new file mode 100644 index 00000000000..55c64c2fc9b --- /dev/null +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/nutanix-node-template-config/_index.md @@ -0,0 +1,62 @@ +--- +title: Nutanix Node Template Configuration +weight: 2 +--- + +- [Account Access](#account-access) +- [Scheduling](#scheduling) +- [Instance Options](#instance-options) +- [Networks](#networks) +- [VM Categories](#vm-categories) +- [cloud-init](#cloud-init) + +# Account Access + +| Parameter | Required | Description | Default +|:-----------------------------|:--------:|:-----------------------------------------------------------------|:----- +| Management Endpoint | * | Hostname/IP address of Prism Central | +| Username | * | Username of the Prism Central user | +| Password | * | Password of the Prism Central user | +| Allow insecure communication | | Set to true to allow insecure SSL communication to Prism Central | False + +# Scheduling + +Choose what Nutanix cluster the virtual machine will be scheduled to. + +| Parameter | Required | Description +|:----------|:--------:|:---------------------------------------------------------------------------- +| Cluster | * | Name of the Nutanix cluster where the VM should be deployed (case sensitive) + +# Instance Options + +In the **Instance Options** section, configure the number of vCPUs, memory, and disk size for the VMs created by this template. + +| Parameter | Required | Description | Default +|:---------------------|:--------:|:--------------------------------------------------------------------------------------------|:------- +| CPUs | | Number of vCPUs allocated to the VM (cores) | 2 +| Memory | | Amount of RAM allocated to the VM (MB) | 2 GB +| Template Image | * | Name of the Disk Image template to clone as the VM's primary disk (must support cloud-init) | +| VM Disk Size | | New size of the VM's primary disk (in GiB) | +| Additional Disk Size | | Size of an additional disk to add to the VM (in GiB) | +| Storage Container | | Storage container _UUID_ in which to provision an additional disk | +| Cloud Config YAML | | Cloud-init to provide to the VM (will be patched with Rancher root user) | +| Network | * | Name(s) of the network(s) to attach to the VM | +| VM Categories | | Name(s) of any categories to be applied to the VM | + +The VM may use any modern Linux operating system that is configured with support for [cloud-init](https://cloudinit.readthedocs.io/en/latest/) using the [Config Drive v2 datasource](https://cloudinit.readthedocs.io/en/latest/topics/datasources/configdrive.html). + +# Networks + +The node template allows a VM to be provisioned with multiple networks. In the **Network** field, you can click **Add** to add any networks available to you in AOS. + +# VM Categories + +A category is a grouping of entities into a key value pair. Typically, VMs are assigned to a category based on some criteria. Policies can then be tied to those entities that are assigned (grouped by) a specific category value. + +# cloud-init + +[Cloud-init](https://cloudinit.readthedocs.io/en/latest/) allows you to initialize your nodes by applying configuration on the first boot. This may involve things such as creating users or authorizing SSH keys. + +To make use of cloud-init initialization, paste a cloud config using valid YAML syntax into the **Cloud Config YAML** field. Refer to the [cloud-init documentation](https://cloudinit.readthedocs.io/en/latest/topics/examples.html) for a commented set of examples of supported cloud config directives. + +Note that cloud-init based network configuration is not recommended and only supported via user data `runcmd` rather than by NoCloud or other network configuration datasources. Nutanix IP Address Management (IPAM) or other DHCP service is recommended. diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/provisioning-nutanix-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/provisioning-nutanix-clusters/_index.md new file mode 100644 index 00000000000..9ad854e1b3b --- /dev/null +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/provisioning-nutanix-clusters/_index.md @@ -0,0 +1,91 @@ +--- +title: Provisioning Kubernetes Clusters in Nutanix AOS +weight: 1 +--- + +In this section, you'll learn how to use Rancher to install an [RKE]({{}}/rke/latest/en/) Kubernetes cluster in Nutanix AOS (AHV). + +First, you will locate Rancher's built-in Nutanix [node driver and activate it]({{}}/rancher/v2.6/en/admin-settings/drivers/node-drivers/#activating-deactivating-node-drivers). + +Then you will create a node template, which Rancher will use to provision nodes in Nutanix AOS. + +Finally, you will create a Nutanix AOS cluster in Rancher, and when configuring the new cluster, you will define node pools for it. Each node pool will have a Kubernetes role of etcd, controlplane, or worker. Rancher will install RKE Kubernetes on the new nodes, and it will set up each node with the Kubernetes role defined by the node pool. + +For details on configuring the Nutanix AOS node template, refer to the [Nutanix AOS node template configuration reference.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/nutanix-node-template-config/) + +For details on configuring RKE Kubernetes clusters in Rancher, refer to the [cluster configuration reference.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/options) + +- [Preparation in Nutanix AOS](#preparation-in-Nutanix AOS) +- [Creating a Nutanix AOS Cluster](#creating-a-Nutanix AOS-cluster) + +# Preparation in Nutanix AOS + +This section describes the requirements for setting up Nutanix AOS so that Rancher can provision VMs and clusters. + +The node templates are documented and tested with Nutanix AOS version 5.20.2 and 6.0.1. + +### Create Credentials in Nutanix AOS + +Before proceeding to create a cluster, you must ensure that you have a Nutanix Prism Central user with admin permissions. When you set up a node template, the template will need to use these credentials. + +### Network Permissions + +It must be ensured that the hosts running the Rancher server are able to establish the following network connections: + +- To the Nutanix Prism Central API (usually port 9440/TCP). +- To port 22/TCP and 2376/TCP on the created VMs + +See [Node Networking Requirements]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/#networking-requirements) for a detailed list of port requirements applicable for creating nodes on an infrastructure provider. + +### VM-VM Anti-Affinity Policies + +Setting up [VM-VM Anti-Affinity Policies](https://portal.nutanix.com/page/documents/details?targetId=AHV-Admin-Guide-v6_1:ahv-vm-anti-affinity-t.html) is recommended. These rules allow VMs assigned the etcd and control-plane roles to operate on separate AHV hosts when they are assigned to different node pools. This practice ensures that the failure of a single physical machine does not affect the availability of those planes. + +# Creating a Nutanix AOS Cluster + +1. [Create a node template ](#1-create-a-node-template) +2. [Create a cluster with node pools using the node template](#2-create-a-cluster-with-node-pools-using-the-node-template) + +### 1. Create a node template + +Creating a [node template]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/#node-templates) for Nutanix AOS will allow Rancher to provision new nodes in Nutanix AOS. Node templates can be reused for other clusters. + +1. Click **☰ > Cluster Management**. +1. Click **RKE1 Configuration > Node Templates**. +1. Click **Create**. +1. Click **Add Template**. +1. Click **Nutanix**. +1. Fill out a node template for Nutanix AOS. For help filling out the form, refer to the Nutanix AOS node template [configuration reference.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/nutanix-node-template-config/). +1. Click **Create**. + +### 2. Create a cluster with node pools using the node template + +Use Rancher to create a Kubernetes cluster in Nutanix AOS. + +1. In the upper left corner, click **☰ > Cluster Management**. +1. On the **Clusters** page, click **Create**. +1. Click **Nutanix**. +1. Enter a **Cluster Name**, then click **Continue**. +1. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user. +1. Use **Cluster Options** to choose the version of Kubernetes that will be installed, what network provider will be used and if you want to enable project network isolation. To see more cluster options, click on **Show advanced options**. For help configuring the cluster, refer to the [RKE cluster configuration reference.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/options) +1. Add one or more node pools to your cluster. Each node pool uses a node template to provision new nodes. For more information about node pools, including best practices for assigning Kubernetes roles to the nodes, see [this section.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/#node-pools) +1. Review your options to confirm they're correct. Then click **Create**. + +**Result:** + +Your cluster is created and assigned a state of **Provisioning**. Rancher is standing up your cluster. + +You can access your cluster after its state is updated to **Active**. + +**Active** clusters are assigned two Projects: + +- `Default`, containing the `default` namespace +- `System`, containing the `cattle-system`, `ingress-nginx`, `kube-public`, and `kube-system` namespaces + + +# Optional Next Steps + +After creating your cluster, you can access it through the Rancher UI. As a best practice, we recommend setting up these alternate ways of accessing your cluster: + +- **Access your cluster with the kubectl CLI:** Follow [these steps]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/kubectl/#accessing-clusters-with-kubectl-on-your-workstation) to access clusters with kubectl on your workstation. In this case, you will be authenticated through the Rancher server’s authentication proxy, then Rancher will connect you to the downstream cluster. This method lets you manage the cluster without the Rancher UI. +- **Access your cluster with the kubectl CLI, using the authorized cluster endpoint:** Follow [these steps]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) to access your cluster with kubectl directly, without authenticating through Rancher. We recommend setting up this alternative method to access your cluster so that in case you can’t connect to Rancher, you can still access the cluster. \ No newline at end of file From 6ee101badc0f4ba1fdd6954ad0c79132ca86a298 Mon Sep 17 00:00:00 2001 From: Derek Nola Date: Fri, 1 Apr 2022 09:54:54 -0700 Subject: [PATCH 375/478] Add info about vxlan on raspberry pi Signed-off-by: Derek Nola --- content/k3s/latest/en/advanced/_index.md | 66 +++++++++++++----------- 1 file changed, 36 insertions(+), 30 deletions(-) diff --git a/content/k3s/latest/en/advanced/_index.md b/content/k3s/latest/en/advanced/_index.md index a4e250cdb7a..907ecf6cead 100644 --- a/content/k3s/latest/en/advanced/_index.md +++ b/content/k3s/latest/en/advanced/_index.md @@ -17,11 +17,11 @@ This section contains advanced information describing the different ways you can - [Node labels and taints](#node-labels-and-taints) - [Starting the server with the installation script](#starting-the-server-with-the-installation-script) - [Additional preparation for Alpine Linux setup](#additional-preparation-for-alpine-linux-setup) +- [Additional preparation for (Red Hat/CentOS) Enterprise Linux](#additional-preparation-for-red-hat/centos-enterprise-linux) +- [Additional preparation for Raspberry Pi OS Setup](#additional-preparation-for-raspberry-pi-os-setup) +- [Enabling vxlan on Ubuntu 21.10+ on Raspberry Pi](#enabling-vxlan-on-ubuntu-21.10+-on-raspberry-pi) - [Running K3d (K3s in Docker) and docker-compose](#running-k3d-k3s-in-docker-and-docker-compose) -- [Enabling legacy iptables on Raspbian Buster](#enabling-legacy-iptables-on-raspbian-buster) -- [Enabling cgroups for Raspbian Buster](#enabling-cgroups-for-raspbian-buster) - [SELinux Support](#selinux-support) -- [Additional preparation for (Red Hat/CentOS) Enterprise Linux](#additional-preparation-for-red-hat-centos-enterprise-linux) - [Enabling Lazy Pulling of eStargz (Experimental)](#enabling-lazy-pulling-of-estargz-experimental) - [Additional Logging Sources](#additional-logging-sources) - [Server and agent tokens](#server-and-agent-tokens) @@ -256,6 +256,39 @@ Then update the config and reboot: update-extlinux reboot ``` +# Additional preparation for (Red Hat/CentOS) Enterprise Linux + +It is recommended to turn off firewalld: +``` +systemctl disable firewalld --now +``` + +If enabled, it is required to disable nm-cloud-setup and reboot the node: +``` +systemctl disable nm-cloud-setup.service nm-cloud-setup.timer +reboot +``` + +# Additional preparation for Raspberry Pi OS Setup +## Enabling legacy iptables on Raspberry Pi OS +Raspberry Pi OS (formerly Raspbian) defaults to using `nftables` instead of `iptables`. **K3S** networking features require `iptables` and do not work with `nftables`. Follow the steps below to switch configure **Buster** to use `legacy iptables`: +``` +sudo iptables -F +sudo update-alternatives --set iptables /usr/sbin/iptables-legacy +sudo update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy +sudo reboot +``` + +## Enabling cgroups for Raspberry Pi OS + +Standard Raspberry Pi OS installations do not start with `cgroups` enabled. **K3S** needs `cgroups` to start the systemd service. `cgroups`can be enabled by appending `cgroup_memory=1 cgroup_enable=memory` to `/boot/cmdline.txt`. + +# Enabling vxlan on Ubuntu 21.10+ on Raspberry Pi + +Starting with Ubuntu 21.10, vxlan support on Raspberry Pi has been moved into a seperate kernel module. +``` +sudo apt install linux-modules-extra-raspi +``` # Running K3d (K3s in Docker) and docker-compose @@ -293,20 +326,6 @@ Alternatively the `docker run` command can also be used: --privileged rancher/k3s:vX.Y.Z -# Enabling legacy iptables on Raspbian Buster - -Raspbian Buster defaults to using `nftables` instead of `iptables`. **K3S** networking features require `iptables` and do not work with `nftables`. Follow the steps below to switch configure **Buster** to use `legacy iptables`: -``` -sudo iptables -F -sudo update-alternatives --set iptables /usr/sbin/iptables-legacy -sudo update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy -sudo reboot -``` - -# Enabling cgroups for Raspbian Buster - -Standard Raspbian Buster installations do not start with `cgroups` enabled. **K3S** needs `cgroups` to start the systemd service. `cgroups`can be enabled by appending `cgroup_memory=1 cgroup_enable=memory` to `/boot/cmdline.txt`. - ### example of /boot/cmdline.txt ``` console=serial0,115200 console=tty1 root=PARTUUID=58b06195-02 rootfstype=ext4 elevator=deadline fsck.repair=yes rootwait cgroup_memory=1 cgroup_enable=memory @@ -365,19 +384,6 @@ Using a custom `--data-dir` under SELinux is not supported. To customize it, you {{%/tab%}} {{% /tabs %}} -# Additional preparation for (Red Hat/CentOS) Enterprise Linux - -It is recommended to turn off firewalld: -``` -systemctl disable firewalld --now -``` - -If enabled, it is required to disable nm-cloud-setup and reboot the node: -``` -systemctl disable nm-cloud-setup.service nm-cloud-setup.timer -reboot -``` - # Enabling Lazy Pulling of eStargz (Experimental) ### What's lazy pulling and eStargz? From 5626f5cb1919043f147021ab043dae4a2fcfd58f Mon Sep 17 00:00:00 2001 From: TianChenjiang Date: Sat, 2 Apr 2022 19:02:15 +0800 Subject: [PATCH 376/478] update support Docker versions URL --- content/rke/latest/en/config-options/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rke/latest/en/config-options/_index.md b/content/rke/latest/en/config-options/_index.md index 30b0383d445..eea8bff7467 100644 --- a/content/rke/latest/en/config-options/_index.md +++ b/content/rke/latest/en/config-options/_index.md @@ -50,7 +50,7 @@ cluster_name: mycluster ### Supported Docker Versions -By default, RKE will check the installed Docker version on all hosts and fail with an error if the version is not supported by Kubernetes. The list of [supported Docker versions](https://github.com/rancher/rke/blob/master/docker/docker.go#L37-L41) are set specifically for each Kubernetes version. To override this behavior, set this option to `true`. +By default, RKE will check the installed Docker version on all hosts and fail with an error if the version is not supported by Kubernetes. The list of [supported Docker versions](https://github.com/rancher/kontainer-driver-metadata/blob/master/rke/k8s_docker_info.go#L3-L15) are set specifically for each Kubernetes version. To override this behavior, set this option to `true`. The default value is `false`. From affd895d8d5a8d7f9f6af83e348514a4ed25a8dd Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Fri, 1 Apr 2022 10:08:22 +0200 Subject: [PATCH 377/478] Update security advisories. Signed-off-by: Guilherme Macedo Co-authored-by: divya-mohan0209 Co-authored-by: Caleb Bron --- content/rancher/v2.6/en/security/cve/_index.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/content/rancher/v2.6/en/security/cve/_index.md b/content/rancher/v2.6/en/security/cve/_index.md index 174acb15bf0..628473bb891 100644 --- a/content/rancher/v2.6/en/security/cve/_index.md +++ b/content/rancher/v2.6/en/security/cve/_index.md @@ -7,6 +7,9 @@ Rancher is committed to informing the community of security issues in our produc | ID | Description | Date | Resolution | |----|-------------|------|------------| +| [GHSA-hwm2-4ph6-w6m5](https://github.com/rancher/rancher/security/advisories/GHSA-hwm2-4ph6-w6m5) | A vulnerability was discovered in versions of Rancher starting 2.0 up to and including 2.6.3. The `restricted` pod security policy (PSP) provided in Rancher deviated from the upstream `restricted` policy provided in Kubernetes on account of which Rancher's PSP had `runAsUser` set to `runAsAny`, while upstream had `runAsUser` set to `MustRunAsNonRoot`. This allowed containers to run as any user, including a privileged user (`root`), even when Rancher's `restricted` policy was enforced on a project or at the cluster level. | 31 Mar 2022 | [Rancher v2.6.4](https://github.com/rancher/rancher/releases/tag/v2.6.4) | +| [CVE-2021-36775](https://github.com/rancher/rancher/security/advisories/GHSA-28g7-896h-695v) | A vulnerability was discovered in Rancher versions up to and including 2.4.17, 2.5.11 and 2.6.2. After removing a `Project Role` associated with a group from the project, the bindings that granted access to cluster-scoped resources for those subjects were not deleted. This was due to an incomplete authorization logic check. A user who was a member of the affected group with authenticated access to Rancher could exploit this vulnerability to access resources they shouldn't have had access to. The exposure level would depend on the original permission level granted to the affected project role. This vulnerability only affected customers using group based authentication in Rancher. | 31 Mar 2022 | [Rancher v2.6.3](https://github.com/rancher/rancher/releases/tag/v2.6.3), [Rancher v2.5.12](https://github.com/rancher/rancher/releases/tag/v2.5.12) and [Rancher v2.4.18](https://github.com/rancher/rancher/releases/tag/v2.4.18) | +| [CVE-2021-36776](https://github.com/rancher/rancher/security/advisories/GHSA-gvh9-xgrq-r8hw) | A vulnerability was discovered in Rancher versions starting 2.5.0 up to and including 2.5.9, that allowed an authenticated user to impersonate any user on a cluster through an API proxy, without requiring knowledge of the impersonated user's credentials. This was due to the API proxy not dropping the impersonation header before sending the request to the Kubernetes API. A malicious user with authenticated access to Rancher could use this to impersonate another user with administrator access in Rancher, thereby gaining administrator level access to the cluster. | 31 Mar 2022 | [Rancher v2.6.0](https://github.com/rancher/rancher/releases/tag/v2.6.0) and [Rancher v2.5.10](https://github.com/rancher/rancher/releases/tag/v2.5.10) | | [CVE-2021-25318](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25318) | A vulnerability was discovered in Rancher versions 2.0 through the aforementioned fixed versions, where users were granted access to resources regardless of the resource's API group. For example, Rancher should have allowed users access to `apps.catalog.cattle.io`, but instead incorrectly gave access to `apps.*`. Resources affected in the **Downstream clusters** and **Rancher management cluster** can be found [here](https://github.com/rancher/rancher/security/advisories/GHSA-f9xf-jq4j-vqw4). There is not a direct mitigation besides upgrading to the patched Rancher versions. | 14 Jul 2021 | [Rancher v2.5.9](https://github.com/rancher/rancher/releases/tag/v2.5.9) and [Rancher v2.4.16](https://github.com/rancher/rancher/releases/tag/v2.4.16) | | [CVE-2021-31999](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31999) | A vulnerability was discovered in Rancher 2.0.0 through the aforementioned patched versions, where a malicious Rancher user could craft an API request directed at the proxy for the Kubernetes API of a managed cluster to gain access to information they do not have access to. This is done by passing the "Impersonate-User" or "Impersonate-Group" header in the Connection header, which is then correctly removed by the proxy. At this point, instead of impersonating the user and their permissions, the request will act as if it was from the Rancher management server and incorrectly return the information. The vulnerability is limited to valid Rancher users with some level of permissions on the cluster. There is not a direct mitigation besides upgrading to the patched Rancher versions. | 14 Jul 2021 | [Rancher v2.5.9](https://github.com/rancher/rancher/releases/tag/v2.5.9) and [Rancher v2.4.16](https://github.com/rancher/rancher/releases/tag/v2.4.16) | | [CVE-2021-25320](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25320) | A vulnerability was discovered in Rancher 2.2.0 through the aforementioned patched versions, where cloud credentials weren't being properly validated through the Rancher API. Specifically through a proxy designed to communicate with cloud providers. Any Rancher user that was logged-in and aware of a cloud-credential ID that was valid for a given cloud provider, could call that cloud provider's API through the proxy API, and the cloud-credential would be attached. The exploit is limited to valid Rancher users. There is not a direct mitigation outside of upgrading to the patched Rancher versions. | 14 Jul 2021 | [Rancher v2.5.9](https://github.com/rancher/rancher/releases/tag/v2.5.9) and [Rancher v2.4.16](https://github.com/rancher/rancher/releases/tag/v2.4.16) | From 7969035048b4cbbf83ffa2e90519f2c3fc72a226 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Mon, 4 Apr 2022 15:19:28 -0700 Subject: [PATCH 378/478] Fix tabs in Helm CLI quickstart --- .../deployment/quickstart-manual-setup/_index.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md index 12bec549c0d..cd8a9fe0e07 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md @@ -49,8 +49,9 @@ Install-Module Posh-SSH ## Get the remote kubeconfig file scp root@:/etc/rancher/k3s/k3s.yaml $env:USERPROFILE\.kube\config ``` -{{% /tab %}} -{{% tabs %}} + +{{% /tab %}} +{{% /tabs %}} ## Edit the Rancher server URL in the kubeconfig @@ -80,7 +81,7 @@ Once edited, either press `ctrl+s` or go to `File > Save` to save your work. {{% /tab %}} -{{% tabs %}} +{{% /tabs %}} ## Install Rancher with Helm @@ -129,8 +130,8 @@ helm install rancher rancher-latest/rancher ` Now if you navigate to `.sslip.io` in a web browser, you should see the Rancher UI. -To make these instructions simple, we used a fake domain name and self-signed certificates to do this installation. For production installs, you would need a high-availability setup with a load balancer, a real domain name and real certificates. +To make these instructions simple, we used a fake domain name and self-signed certificates to do this installation. Therefore, you will probably need to add a security exception to your web browser to see the Rancher UI. Note that for production installs, you would need a high-availability setup with a load balancer, a real domain name and real certificates. These instructions also left out the full installation requirements and other installation options. If you have any issues with these steps, refer to the full [Helm CLI installation docs.]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/) -To launch new Kubernetes clusters with your new Rancher server, you may need to set up cloud credentials in Rancher. For more information, see [Launching Kubernetes clusters with Rancher.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/) \ No newline at end of file +To launch new Kubernetes clusters with your new Rancher server, you may need to set up cloud credentials in Rancher. For more information, see [Launching Kubernetes clusters with Rancher.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/) From 5940e04b404a5366ec0292f3a46d8f17512b1ef1 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Mon, 4 Apr 2022 16:01:56 -0700 Subject: [PATCH 379/478] Revert "Staging to master" --- Dockerfile.dev | 2 +- Dockerfile.prod | 2 +- Dockerfile.staging | 2 +- config.toml | 2 +- .../pod-security-policies/_index.md | 29 +- .../rbac/cluster-project-roles/_index.md | 18 +- content/rancher/v2.6/en/api/_index.md | 17 +- .../en/backups/restoring-rancher/_index.md | 9 - .../en/faq/networking/cni-providers/_index.md | 6 - content/rancher/v2.6/en/helm-charts/_index.md | 3 +- .../install-rancher-on-k8s/_index.md | 8 +- .../install-rancher-on-k8s/upgrades/_index.md | 8 +- .../air-gap/install-rancher/_index.md | 8 +- .../populate-private-registry/_index.md | 4 +- .../behind-proxy/install-rancher/_index.md | 6 +- .../upgrading-cert-manager/_index.md | 9 +- content/rancher/v2.6/en/security/_index.md | 2 +- ...her_v2-6_CIS_v1-6_Benchmark_Assessment.pdf | 14832 ---------------- .../1.6-benchmark-2.6/_index.md | 3098 ---- .../Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf | 8259 --------- .../1.6-hardening-2.6/_index.md | 641 - .../en/security/hardening-guides/_index.md | 56 +- .../v2.6/en/virtualization-admin/_index.md | 2 - scripts/converters/css/style-portrait.css | 4 +- scripts/converters/scripts/results_to_md.sh | 23 +- 25 files changed, 52 insertions(+), 26998 deletions(-) delete mode 100644 content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf delete mode 100644 content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/_index.md delete mode 100644 content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf delete mode 100644 content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md diff --git a/Dockerfile.dev b/Dockerfile.dev index 53225113ca0..af34fcf57dc 100644 --- a/Dockerfile.dev +++ b/Dockerfile.dev @@ -10,4 +10,4 @@ RUN mkdir -p /output /theme/rancher-website-theme && tar -xzf /run/master.tar.gz # Expose default hugo port EXPOSE 9001 -ENTRYPOINT ["hugo", "serve", "--bind=0.0.0.0", "--buildDrafts", "--buildFuture" ] +ENTRYPOINT ["hugo", "serve", "--bind=0.0.0.0", "--buildDrafts", "--buildFuture", "--baseURL=" ] diff --git a/Dockerfile.prod b/Dockerfile.prod index 0a0511d279c..38ba46de614 100644 --- a/Dockerfile.prod +++ b/Dockerfile.prod @@ -16,7 +16,7 @@ COPY .git .git ADD https://github.com/rancherlabs/website-theme/archive/master.tar.gz /run/master.tar.gz RUN mkdir -p /output /theme/rancher-website-theme && tar -xzf /run/master.tar.gz -C /run/node_modules/rancher-website-theme --strip=1 && rm /run/master.tar.gz -RUN ["hugo", "--buildFuture", "--destination=/output"] +RUN ["hugo", "--buildFuture", "--baseURL=https://rancher.com/docs", "--destination=/output"] # Make sure something got built RUN stat /output/index.html diff --git a/Dockerfile.staging b/Dockerfile.staging index ea6ea487cfb..5dc30768635 100644 --- a/Dockerfile.staging +++ b/Dockerfile.staging @@ -16,7 +16,7 @@ COPY .git .git ADD https://github.com/rancherlabs/website-theme/archive/master.tar.gz /run/master.tar.gz RUN mkdir -p /output /theme/rancher-website-theme && tar -xzf /run/master.tar.gz -C /run/node_modules/rancher-website-theme --strip=1 && rm /run/master.tar.gz -RUN ["hugo", "--buildDrafts", "--buildFuture", "--destination=/output"] +RUN ["hugo", "--buildDrafts", "--buildFuture", "--baseURL=https://staging.rancher.com/docs", "--destination=/output"] # Make sure something got built RUN stat /output/index.html diff --git a/config.toml b/config.toml index de5a060aead..35fdfda6e03 100644 --- a/config.toml +++ b/config.toml @@ -1,4 +1,4 @@ -baseURL = ".Permalink" +baseURL = "" languageCode = "en-us" title = "Rancher Labs" diff --git a/content/rancher/v2.6/en/admin-settings/pod-security-policies/_index.md b/content/rancher/v2.6/en/admin-settings/pod-security-policies/_index.md index 9244102623d..2e0d6d70fc3 100644 --- a/content/rancher/v2.6/en/admin-settings/pod-security-policies/_index.md +++ b/content/rancher/v2.6/en/admin-settings/pod-security-policies/_index.md @@ -9,7 +9,6 @@ If a pod does not meet the conditions specified in the PSP, Kubernetes will not - [How PSPs Work](#how-psps-work) - [Default PSPs](#default-psps) - - [Restricted-NoRoot](#restricted-noroot) - [Restricted](#restricted) - [Unrestricted](#unrestricted) - [Creating PSPs](#creating-psps) @@ -29,22 +28,18 @@ PSPs work through inheritance: Any workloads that are already running in a cluster or project before a PSP is assigned will not be checked if it complies with the PSP. Workloads would need to be cloned or upgraded to see if they pass the PSP. -Read more about Pod Security Policies in the [Kubernetes documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/). +Read more about Pod Security Policies in the [Kubernetes Documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/). # Default PSPs -Rancher ships with three default Pod Security Policies (PSPs): the `restricted-noroot`, `restricted` and `unrestricted` policies. +Rancher ships with two default Pod Security Policies (PSPs): the `restricted` and `unrestricted` policies. -### Restricted-NoRoot +### Restricted This policy is based on the Kubernetes [example restricted policy](https://raw.githubusercontent.com/kubernetes/website/master/content/en/examples/policy/restricted-psp.yaml). It significantly restricts what types of pods can be deployed to a cluster or project. This policy: - Prevents pods from running as a privileged user and prevents escalation of privileges. -- Validates that server-required security mechanisms are in place, such as restricting what volumes can be mounted to only the core volume types and preventing root supplemental groups from being added. - -### Restricted - -This policy is a relaxed version of the `restricted-noroot` policy, with almost all the restrictions in place, except for the fact that it allows running containers as a privileged user. +- Validates that server-required security mechanisms are in place (such as restricting what volumes can be mounted to only the core volume types and preventing root supplemental groups from being added. ### Unrestricted @@ -56,9 +51,9 @@ Using Rancher, you can create a Pod Security Policy using our GUI rather than cr ### Requirements -Rancher can only assign PSPs for clusters that are [launched using RKE]({{< baseurl >}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/). +Rancher can only assign PSPs for clusters that are [launched using RKE.]({{< baseurl >}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/) -You must enable PSPs at the cluster level before you can assign them to a project. This can be configured by [editing the cluster]({{}}/rancher/v2.6/en/cluster-admin/editing-clusters/). +You must enable PSPs at the cluster level before you can assign them to a project. This can be configured by [editing the cluster.]({{}}/rancher/v2.6/en/cluster-admin/editing-clusters/) It is a best practice to set PSP at the cluster level. @@ -68,11 +63,19 @@ We recommend adding PSPs during cluster and project creation instead of adding i 1. In the upper left corner, click **☰ > Cluster Management**. 1. In the left navigation bar, click **Pod Security Policies**. -1. Click **Add Policy**. +1. Click **Add policy**. 1. Name the policy. 1. Complete each section of the form. Refer to the [Kubernetes documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) for more information on what each policy does. 1. Click **Create**. # Configuration -The Kubernetes documentation on PSPs is [here](https://kubernetes.io/docs/concepts/policy/pod-security-policy/). +The Kubernetes documentation on PSPs is [here.](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) + + + + + +[1]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems +[2]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces +[3]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#users-and-groups diff --git a/content/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/_index.md b/content/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/_index.md index c2767b8a66f..022b08762ce 100644 --- a/content/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/_index.md +++ b/content/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/_index.md @@ -5,7 +5,7 @@ weight: 1127 Cluster and project roles define user authorization inside a cluster or project. -To manage these roles, +To manage these roles, 1. Click **☰ > Users & Authentication**. 1. In the left navigation bar, click **Roles** and go to the **Cluster** or **Project/Namespaces** tab. @@ -60,8 +60,8 @@ The following table lists the permissions available for the `Manage Nodes` role | SSH Access | ✓ | ✓ | | Delete Nodes | ✓ | ✓ | | Scale Clusters Up and Down | ✓ | * | -***In RKE2, you must have permission to edit a cluster to be able to scale clusters up and down.** -
      +***In RKE2, you must have permission to edit a cluster to be able to scale clusters up and down.** +
      For details on how each cluster role can access Kubernetes resources, you can look them up in the Rancher UI: @@ -81,24 +81,12 @@ To assign a custom role to a new cluster member, you can use the Rancher UI. To To assign the role to a new cluster member, -{{% tabs %}} -{{% tab "Rancher before v2.6.4" %}} 1. Click **☰ > Cluster Management**. 1. Go to the cluster where you want to assign a role to a member and click **Explore**. 1. Click **RBAC > Cluster Members**. 1. Click **Add**. 1. In the **Cluster Permissions** section, choose the custom cluster role that should be assigned to the member. 1. Click **Create**. -{{% /tab %}} -{{% tab "Rancher v2.6.4+" %}} -1. Click **☰ > Cluster Management**. -1. Go to the cluster where you want to assign a role to a member and click **Explore**. -1. Click **Cluster > Cluster Members**. -1. Click **Add**. -1. In the **Cluster Permissions** section, choose the custom cluster role that should be assigned to the member. -1. Click **Create**. -{{% /tab %}} -{{% /tabs %}} **Result:** The member has the assigned role. diff --git a/content/rancher/v2.6/en/api/_index.md b/content/rancher/v2.6/en/api/_index.md index d1cc9cc4454..a4b56bd9478 100644 --- a/content/rancher/v2.6/en/api/_index.md +++ b/content/rancher/v2.6/en/api/_index.md @@ -5,22 +5,7 @@ weight: 24 ## How to use the API -The API has its own user interface accessible from a web browser. This is an easy way to see resources, perform actions, and see the equivalent cURL or HTTP request & response. To access it: - -{{% tabs %}} -{{% tab "Rancher v2.6.4+" %}} - -1. Click on your user avatar in the upper right corner. -1. Click **Account & API Keys**. -1. Under the **API Keys** section, find the **API Endpoint** field and click the link. The link will look something like `https:///v3`, where `` is the fully qualified domain name of your Rancher deployment. - -{{% /tab %}} -{{% tab "Rancher before v2.6.4" %}} - -Go to the URL endpoint at `https:///v3`, where `` is the fully qualified domain name of your Rancher deployment. - -{{% /tab %}} -{{% /tabs %}} +The API has its own user interface accessible from a web browser. This is an easy way to see resources, perform actions, and see the equivalent cURL or HTTP request & response. To access it, click on your user avatar in the upper right corner. Under **API & Keys**, you can find the URL endpoint (`https:///v3`) as well as create [API keys]({{}}/rancher/v2.6/en/user-settings/api-keys/). ## Authentication diff --git a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md index 468b179d348..1f20f311720 100644 --- a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md @@ -5,15 +5,6 @@ weight: 2 A restore is performed by creating a Restore custom resource. ---- -**Caution:** Before performing a restore or rollback, note the following: - -- In Rancher v2.6.4, the cluster-api module has been upgraded from v0.4.4 to v1.0.2 in which the apiVersion of CAPI CRDs are upgraded from `cluster.x-k8s.io/v1alpha4` to `cluster.x-k8s.io/v1beta1`. This has the effect of causing rollbacks from Rancher v2.6.4 to any previous version of Rancher v2.6.x to fail because the previous version the CRDs needed to roll back are no longer available in v1beta1. - -- To avoid this, the Rancher resource cleanup scripts should be run **before** the restore or rollback is attempted. Specifically, two scripts have been created to assist you: one to clean up the cluster (`cleanup.sh`), and one to check for any Rancher-related resources in the cluster (`verify.sh`). Details on the cleanup script can be found in the [rancherlabs/support-tools repo](https://github.com/rancherlabs/support-tools/tree/master/cleanup-rancher-k8s-resources). - ---- - > **Important** > > * Follow the instructions from this page for restoring rancher on the same cluster where it was backed up from. In order to migrate rancher to a new cluster, follow the steps to [migrate rancher.]({{}}/rancher/v2.6/en/backups/migrating-rancher) diff --git a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md index ea4bbde4872..cb8fdb4b278 100644 --- a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md +++ b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md @@ -109,12 +109,6 @@ Calico also provides a stateless IP-in-IP or VXLAN encapsulation mode that can b Kubernetes workers should open TCP port `179` if using BGP or UDP port `4789` if using VXLAN encapsulation. In addition, TCP port `5473` is needed when using Typha. See [the port requirements for user clusters]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/#networking-requirements) for more details. ->**Important:** In Rancher v2.6.3, Calico probes fail on Windows nodes upon RKE2 installation. Note that this issue is resolved in v2.6.4. -> ->- To work around this issue, first navigate to `https:///v3/settings/windows-rke2-install-script`. -> ->- There, change the current setting: `https://raw.githubusercontent.com/rancher/wins/v0.1.3/install.ps1` to this new setting: `https://raw.githubusercontent.com/rancher/rke2/master/windows/rke2-install.ps1`. - ![Calico Diagram]({{}}/img/rancher/calico-diagram.svg) For more information, see the following pages: diff --git a/content/rancher/v2.6/en/helm-charts/_index.md b/content/rancher/v2.6/en/helm-charts/_index.md index d225e2f5854..b5313d0bd54 100644 --- a/content/rancher/v2.6/en/helm-charts/_index.md +++ b/content/rancher/v2.6/en/helm-charts/_index.md @@ -74,8 +74,7 @@ To add a private CA for Helm Chart repositories: [...] ``` - -- **Git-based chart repositories**: It is not currently possible to add a private CA. For git-based chart repositories with a certificate signed by a private CA, you must disable TLS verification. Click **Edit YAML** for the chart repo and add the key/value pair as follows: +- **Git-based chart repositories**: You must add a base64 encoded copy of the CA certificate in DER format to the spec.caBundle field of the chart repo, such as `openssl x509 -outform der -in ca.pem | base64 -w0`. Click **Edit YAML** for the chart repo and set, as in the following example:
      ``` [...] spec: diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md index 5d97210cc95..5776af8f778 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md @@ -104,10 +104,6 @@ There are three recommended options for the source of the certificate used for T ### 4. Install cert-manager -**Note:** New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. - -> You should skip this step if you are bringing your own certificate files (option `ingress.tls.source=secret`), or if you use [TLS termination on an external load balancer]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/#external-tls-termination). - > You should skip this step if you are bringing your own certificate files (option `ingress.tls.source=secret`), or if you use [TLS termination on an external load balancer]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/#external-tls-termination). This step is only required to use certificates issued by Rancher's generated CA (`ingress.tls.source=rancher`) or to request Let's Encrypt issued certificates (`ingress.tls.source=letsEncrypt`). @@ -120,7 +116,7 @@ These instructions are adapted from the [official cert-manager documentation](ht ``` # If you have installed the CRDs manually instead of with the `--set installCRDs=true` option added to your Helm install command, you should upgrade your CRD resources before upgrading the Helm chart: -kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.7.1/cert-manager.crds.yaml +kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.5.1/cert-manager.crds.yaml # Add the Jetstack Helm repository helm repo add jetstack https://charts.jetstack.io @@ -132,7 +128,7 @@ helm repo update helm install cert-manager jetstack/cert-manager \ --namespace cert-manager \ --create-namespace \ - --version v1.7.1 + --version v1.5.1 ``` Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the cert-manager namespace for running pods: diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md index cfe481e2b94..5c25a7f24b8 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md @@ -148,13 +148,7 @@ helm upgrade rancher rancher-/rancher \ ### Option B: Reinstalling Rancher and cert-manager -If you are currently running the cert-manager whose version is 1.5 or below, and want to upgrade both Rancher and cert-manager to a new version (1.6+ in the case of cert-manager), then you need to re-install both Rancher and cert-manager due to the API change in cert-manager 1.6. This will also be necessary if you are upgrading from a version of cert manager below 0.11 to a version of cert-manager above 0.11. - ->**Important:** -> ->- New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. -> ->- Note that if you are below version 1.5 and want to go to 1.7, you should first upgrade to 1.6 as an intermediate step. Follow the cert-manager docs [here](https://cert-manager.io/docs/installation/upgrading/upgrading-1.5-1.6/) to do a 1.5 to 1.6 upgrade, and [here](https://cert-manager.io/docs/installation/upgrading/upgrading-1.6-1.7/) to then do a 1.6 to 1.7 upgrade. For more details on upgrading cert-manager, refer to our [documentation]({{}}/rancher/v2.6/en/installation/resources/upgrading-cert-manager). +If you are currently running the cert-manager whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, then you need to reinstall both Rancher and cert-manager due to the API change in cert-manager v0.11. 1. Uninstall Rancher diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/install-rancher/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/install-rancher/_index.md index a739fd07987..8f15d855e8e 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/install-rancher/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/install-rancher/_index.md @@ -94,10 +94,8 @@ helm repo update Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager). -**Note:** New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. - ```plain -helm fetch jetstack/cert-manager --version v1.7.1 +helm fetch jetstack/cert-manager --version v1.5.1 ``` ### 3. Render the cert-manager template @@ -105,7 +103,7 @@ helm fetch jetstack/cert-manager --version v1.7.1 Render the cert-manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files. ```plain -helm template cert-manager ./cert-manager-v1.7.1.tgz --output-dir . \ +helm template cert-manager ./cert-manager-v1.5.1.tgz --output-dir . \ --namespace cert-manager \ --set image.repository=/quay.io/jetstack/cert-manager-controller \ --set webhook.image.repository=/quay.io/jetstack/cert-manager-webhook \ @@ -117,7 +115,7 @@ helm template cert-manager ./cert-manager-v1.7.1.tgz --output-dir . \ Download the required CRD file for cert-manager: ```plain - curl -L -o cert-manager/cert-manager-crd.yaml https://github.com/jetstack/cert-manager/releases/download/v1.7.1/cert-manager.crds.yaml + curl -L -o cert-manager/cert-manager-crd.yaml https://github.com/jetstack/cert-manager/releases/download/v1.5.1/cert-manager.crds.yaml ``` ### 5. Render the Rancher template diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md index 18c8817f76f..05b260b3aa5 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md @@ -51,8 +51,6 @@ If you will use ARM64 hosts, the registry must support manifests. As of April 20 In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS certificates, you must add the [`cert-manager`](https://hub.helm.sh/charts/jetstack/cert-manager) image to `rancher-images.txt` as well. -**Note:** New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. - 1. Fetch the latest `cert-manager` Helm chart and parse the template for image details: > **Note:** Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.12.0, please see our [upgrade documentation]({{}}/rancher/v2.6/en/installation/resources/upgrading-cert-manager/). @@ -60,7 +58,7 @@ In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS ```plain helm repo add jetstack https://charts.jetstack.io helm repo update - helm fetch jetstack/cert-manager --version v1.7.1 + helm fetch jetstack/cert-manager --version v1.5.1 helm template ./cert-manager-.tgz | awk '$1 ~ /image:/ {print $2}' | sed s/\"//g >> ./rancher-images.txt ``` diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md index a5a57c7b6ae..35ceaf1b26a 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md @@ -23,17 +23,15 @@ kubectl create namespace cert-manager Install the CustomResourceDefinitions of cert-manager: -**Note:** New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. - ``` -kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.7.1/cert-manager.crds.yaml +kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.5.1/cert-manager.crds.yaml ``` And install it with Helm. Note that cert-manager also needs your proxy configured in case it needs to communicate with Let's Encrypt or other external certificate issuers: ``` helm upgrade --install cert-manager jetstack/cert-manager \ - --namespace cert-manager --version v1.7.1 \ + --namespace cert-manager --version v1.5.1 \ --set http_proxy=http://${proxy_host} \ --set https_proxy=http://${proxy_host} \ --set no_proxy=127.0.0.0/8\\,10.0.0.0/8\\,cattle-system.svc\\,172.16.0.0/12\\,192.168.0.0/16\\,.svc\\,.cluster.local diff --git a/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md b/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md index f3b21f8aed0..3879ab15d1f 100644 --- a/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md +++ b/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md @@ -15,7 +15,7 @@ To address these changes, this guide will do two things: 1. Explain the cert-manager API changes and link to cert-manager's official documentation for migrating your data > **Important:** -> If you are currently running the cert-manager whose version is 1.5 or below, and want to upgrade both Rancher and cert-manager to a new version (1.6+ in the case of cert-manager), then you need to re-install both Rancher and cert-manager due to the API change in cert-manager 1.6. This will also be necessary if you are upgrading from a version of cert manager below 0.11 to a version of cert-manager above 0.11. Follow the steps below: +> If you are currently running the cert-manager whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, you need to reinstall both of them: > 1. Take a one-time snapshot of your Kubernetes cluster running Rancher server > 2. Uninstall Rancher, cert-manager, and the CustomResourceDefinition for cert-manager @@ -220,13 +220,6 @@ cert-manager-webhook-787858fcdb-nlzsq 1/1 Running 0 2m ## Cert-Manager API change and data migration ---- -_New in v2.6.4_ - -Rancher now supports cert-manager versions 1.6.2 and 1.7.1. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. To read more, see the [cert-manager docs]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/#4-install-cert-manager). For instructions on upgrading cert-manager from version 1.5 to 1.6, see the upstream cert-manager documentation [here](https://cert-manager.io/docs/installation/upgrading/upgrading-1.5-1.6/). For instructions on upgrading cert-manager from version 1.6 to 1.7, see the upstream cert-manager documentation [here](https://cert-manager.io/docs/installation/upgrading/upgrading-1.6-1.7/). - ---- - Cert-manager has deprecated the use of the `certificate.spec.acme.solvers` field and will drop support for it completely in an upcoming release. Per the cert-manager documentation, a new format for configuring ACME certificate resources was introduced in v0.8. Specifically, the challenge solver configuration field was moved. Both the old format and new are supported as of v0.9, but support for the old format will be dropped in an upcoming release of cert-manager. The cert-manager documentation strongly recommends that after upgrading you update your ACME Issuer and Certificate resources to the new format. diff --git a/content/rancher/v2.6/en/security/_index.md b/content/rancher/v2.6/en/security/_index.md index 0cd5e3dcaf4..1f121f11ed2 100644 --- a/content/rancher/v2.6/en/security/_index.md +++ b/content/rancher/v2.6/en/security/_index.md @@ -11,7 +11,7 @@ weight: 20

      Reporting process

      -

      Please submit possible security issues by emailing security-rancher@suse.com .

      +

      Please submit possible security issues by emailing security@rancher.com .

      Announcements

      diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf b/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf deleted file mode 100644 index f08210f51e6..00000000000 --- a/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf +++ /dev/null @@ -1,14832 +0,0 @@ -%PDF-1.7 -%🖤 -1 0 obj -<< -/Type /Pages -/Kids [ 6 0 R 8 0 R 38 0 R 76 0 R 114 0 R 152 0 R 186 0 R 222 0 R 258 0 R 292 0 R 304 0 R 309 0 R 313 0 R 315 0 R 318 0 R 323 0 R 325 0 R 349 0 R 374 0 R 407 0 R 440 0 R 464 0 R 503 0 R 508 0 R 511 0 R 514 0 R 516 0 R 519 0 R 521 0 R 524 0 R 527 0 R 529 0 R 532 0 R 534 0 R 537 0 R 540 0 R 542 0 R 545 0 R 548 0 R 550 0 R 553 0 R 555 0 R 559 0 R 562 0 R 565 0 R 567 0 R 570 0 R 572 0 R 575 0 R 578 0 R 580 0 R 583 0 R 586 0 R 588 0 R 591 0 R 593 0 R 596 0 R 599 0 R 601 0 R 604 0 R 607 0 R 609 0 R 612 0 R 614 0 R 617 0 R 620 0 R 622 0 R 625 0 R 627 0 R 630 0 R 633 0 R 635 0 R 638 0 R 641 0 R 643 0 R 660 0 R 674 0 R 677 0 R 680 0 R 683 0 R 686 0 R 689 0 R 692 0 R 694 0 R 698 0 R 700 0 R 703 0 R 705 0 R 708 0 R 710 0 R 713 0 R 715 0 R 717 0 R 720 0 R 722 0 R 725 0 R 727 0 R 730 0 R 732 0 R 734 0 R 737 0 R 739 0 R 741 0 R 743 0 R 746 0 R 748 0 R 751 0 R 755 0 R 764 0 R 772 0 R 774 0 R 779 0 R 784 0 R 790 0 R 794 0 R 798 0 R 804 0 R 808 0 R 812 0 R 815 0 R 817 0 R 842 0 R 853 0 R 856 0 R 860 0 R 863 0 R 880 0 R 887 0 R 889 0 R 891 0 R 893 0 R ] -/Count 131 ->> -endobj -2 0 obj -<< -/Title (CIS v1.6 Benchmark - Self-Assessment Guide - Rancher v2.6) -/Creator (pandoc) -/Producer (WeasyPrint 54.2) ->> -endobj -3 0 obj -<< -/Type /Catalog -/Pages 1 0 R -/Outlines 1055 0 R -/Names << -/Dests << -/Names [ (TOC) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (api-server) [ 508 0 R /XYZ 41.740157 784.430079 0 ] (apply-security-context-to-your-pods-and-containers-manual) [ 891 0 R /XYZ 84.259843 324.051496 0 ] (authentication-and-authorization) [ 741 0 R /XYZ 41.740157 784.430079 0 ] (cb1) [ 315 0 R /XYZ 84.259843 207.170079 0 ] (cb1-1) [ 315 0 R /XYZ 101.433071 205.473057 0 ] (cb10) [ 349 0 R /XYZ 84.259843 342.035606 0 ] (cb10-1) [ 349 0 R /XYZ 101.433071 340.338585 0 ] (cb101) [ 622 0 R /XYZ 84.259843 504.320079 0 ] (cb101-1) [ 622 0 R /XYZ 101.433071 502.623057 0 ] (cb104) [ 627 0 R /XYZ 84.259843 772.370079 0 ] (cb104-1) [ 627 0 R /XYZ 101.433071 770.673057 0 ] (cb107) [ 630 0 R /XYZ 84.259843 313.070079 0 ] (cb107-1) [ 630 0 R /XYZ 101.433071 311.373057 0 ] (cb110) [ 635 0 R /XYZ 84.259843 560.570079 0 ] (cb110-1) [ 635 0 R /XYZ 101.433071 558.873057 0 ] (cb113) [ 638 0 R /XYZ 84.259843 110.570079 0 ] (cb113-1) [ 638 0 R /XYZ 101.433071 108.873057 0 ] (cb116) [ 643 0 R /XYZ 84.259843 418.070079 0 ] (cb116-1) [ 643 0 R /XYZ 101.433071 416.373057 0 ] (cb116-10) [ 643 0 R /XYZ 99.933071 189.008799 0 ] (cb116-11) [ 643 0 R /XYZ 99.933071 170.061778 0 ] (cb116-12) [ 643 0 R /XYZ 99.933071 151.114756 0 ] (cb116-13) [ 643 0 R /XYZ 99.933071 132.167735 0 ] (cb116-14) [ 643 0 R /XYZ 99.933071 113.220714 0 ] (cb116-15) [ 643 0 R /XYZ 99.933071 94.273692 0 ] (cb116-16) [ 660 0 R /XYZ 99.933071 799.173057 0 ] (cb116-17) [ 660 0 R /XYZ 99.933071 780.226036 0 ] (cb116-18) [ 660 0 R /XYZ 99.933071 761.279014 0 ] (cb116-19) [ 660 0 R /XYZ 99.933071 742.331993 0 ] (cb116-2) [ 643 0 R /XYZ 99.933071 397.426036 0 ] (cb116-20) [ 660 0 R /XYZ 99.933071 723.384971 0 ] (cb116-21) [ 660 0 R /XYZ 99.933071 704.437950 0 ] (cb116-22) [ 660 0 R /XYZ 99.933071 685.490928 0 ] (cb116-23) [ 660 0 R /XYZ 99.933071 666.543907 0 ] (cb116-24) [ 660 0 R /XYZ 99.933071 647.596885 0 ] (cb116-25) [ 660 0 R /XYZ 99.933071 628.649864 0 ] (cb116-3) [ 643 0 R /XYZ 99.933071 378.479014 0 ] (cb116-4) [ 643 0 R /XYZ 99.933071 340.584971 0 ] (cb116-5) [ 643 0 R /XYZ 99.933071 321.637950 0 ] (cb116-6) [ 643 0 R /XYZ 99.933071 302.690928 0 ] (cb116-7) [ 643 0 R /XYZ 99.933071 283.743907 0 ] (cb116-8) [ 643 0 R /XYZ 99.933071 264.796885 0 ] (cb116-9) [ 643 0 R /XYZ 99.933071 226.902842 0 ] (cb117) [ 660 0 R /XYZ 84.259843 569.399864 0 ] (cb117-1) [ 660 0 R /XYZ 101.433071 567.702842 0 ] (cb120) [ 660 0 R /XYZ 84.259843 196.152842 0 ] (cb120-1) [ 660 0 R /XYZ 101.433071 194.455821 0 ] (cb121) [ 674 0 R /XYZ 84.259843 550.251496 0 ] (cb121-1) [ 674 0 R /XYZ 101.433071 548.554475 0 ] (cb124) [ 677 0 R /XYZ 84.259843 571.820079 0 ] (cb124-1) [ 677 0 R /XYZ 101.433071 570.123057 0 ] (cb127) [ 680 0 R /XYZ 84.259843 575.570079 0 ] (cb127-1) [ 680 0 R /XYZ 101.433071 573.873057 0 ] (cb13) [ 374 0 R /XYZ 84.259843 711.620079 0 ] (cb13-1) [ 374 0 R /XYZ 101.433071 709.923057 0 ] (cb13-10) [ 374 0 R /XYZ 99.933071 501.505821 0 ] (cb13-11) [ 374 0 R /XYZ 99.933071 482.558799 0 ] (cb13-12) [ 374 0 R /XYZ 99.933071 463.611778 0 ] (cb13-13) [ 374 0 R /XYZ 99.933071 444.664756 0 ] (cb13-14) [ 374 0 R /XYZ 99.933071 425.717735 0 ] (cb13-15) [ 374 0 R /XYZ 99.933071 406.770714 0 ] (cb13-16) [ 374 0 R /XYZ 99.933071 387.823692 0 ] (cb13-17) [ 374 0 R /XYZ 99.933071 368.876671 0 ] (cb13-18) [ 374 0 R /XYZ 99.933071 349.929649 0 ] (cb13-19) [ 374 0 R /XYZ 99.933071 330.982628 0 ] (cb13-2) [ 374 0 R /XYZ 99.933071 690.976036 0 ] (cb13-20) [ 374 0 R /XYZ 99.933071 312.035606 0 ] (cb13-21) [ 374 0 R /XYZ 99.933071 293.088585 0 ] (cb13-22) [ 374 0 R /XYZ 99.933071 274.141563 0 ] (cb13-23) [ 374 0 R /XYZ 99.933071 255.194542 0 ] (cb13-24) [ 374 0 R /XYZ 99.933071 236.247520 0 ] (cb13-25) [ 374 0 R /XYZ 99.933071 217.300499 0 ] (cb13-26) [ 374 0 R /XYZ 99.933071 198.353477 0 ] (cb13-27) [ 374 0 R /XYZ 99.933071 179.406456 0 ] (cb13-28) [ 374 0 R /XYZ 99.933071 160.459434 0 ] (cb13-29) [ 374 0 R /XYZ 99.933071 141.512413 0 ] (cb13-3) [ 374 0 R /XYZ 99.933071 672.029014 0 ] (cb13-30) [ 374 0 R /XYZ 99.933071 122.565391 0 ] (cb13-31) [ 374 0 R /XYZ 99.933071 103.618370 0 ] (cb13-32) [ 407 0 R /XYZ 99.933071 799.173057 0 ] (cb13-33) [ 407 0 R /XYZ 99.933071 780.226036 0 ] (cb13-34) [ 407 0 R /XYZ 99.933071 761.279014 0 ] (cb13-35) [ 407 0 R /XYZ 99.933071 742.331993 0 ] (cb13-36) [ 407 0 R /XYZ 99.933071 723.384971 0 ] (cb13-37) [ 407 0 R /XYZ 99.933071 704.437950 0 ] (cb13-38) [ 407 0 R /XYZ 99.933071 685.490928 0 ] (cb13-39) [ 407 0 R /XYZ 99.933071 666.543907 0 ] (cb13-4) [ 374 0 R /XYZ 99.933071 634.134971 0 ] (cb13-40) [ 407 0 R /XYZ 99.933071 647.596885 0 ] (cb13-41) [ 407 0 R /XYZ 99.933071 628.649864 0 ] (cb13-42) [ 407 0 R /XYZ 99.933071 609.702842 0 ] (cb13-43) [ 407 0 R /XYZ 99.933071 590.755821 0 ] (cb13-44) [ 407 0 R /XYZ 99.933071 571.808799 0 ] (cb13-45) [ 407 0 R /XYZ 99.933071 552.861778 0 ] (cb13-46) [ 407 0 R /XYZ 99.933071 533.914756 0 ] (cb13-47) [ 407 0 R /XYZ 99.933071 514.967735 0 ] (cb13-48) [ 407 0 R /XYZ 99.933071 496.020714 0 ] (cb13-49) [ 407 0 R /XYZ 99.933071 477.073692 0 ] (cb13-5) [ 374 0 R /XYZ 99.933071 596.240928 0 ] (cb13-50) [ 407 0 R /XYZ 99.933071 458.126671 0 ] (cb13-51) [ 407 0 R /XYZ 99.933071 439.179649 0 ] (cb13-52) [ 407 0 R /XYZ 99.933071 420.232628 0 ] (cb13-53) [ 407 0 R /XYZ 99.933071 382.338585 0 ] (cb13-54) [ 407 0 R /XYZ 99.933071 363.391563 0 ] (cb13-55) [ 407 0 R /XYZ 99.933071 344.444542 0 ] (cb13-56) [ 407 0 R /XYZ 99.933071 325.497520 0 ] (cb13-57) [ 407 0 R /XYZ 99.933071 306.550499 0 ] (cb13-58) [ 407 0 R /XYZ 99.933071 287.603477 0 ] (cb13-59) [ 407 0 R /XYZ 99.933071 268.656456 0 ] (cb13-6) [ 374 0 R /XYZ 99.933071 577.293907 0 ] (cb13-60) [ 407 0 R /XYZ 99.933071 249.709434 0 ] (cb13-61) [ 407 0 R /XYZ 99.933071 230.762413 0 ] (cb13-7) [ 374 0 R /XYZ 99.933071 558.346885 0 ] (cb13-8) [ 374 0 R /XYZ 99.933071 539.399864 0 ] (cb13-9) [ 374 0 R /XYZ 99.933071 520.452842 0 ] (cb130) [ 683 0 R /XYZ 84.259843 560.570079 0 ] (cb130-1) [ 683 0 R /XYZ 101.433071 558.873057 0 ] (cb133) [ 686 0 R /XYZ 84.259843 556.820079 0 ] (cb133-1) [ 686 0 R /XYZ 101.433071 555.123057 0 ] (cb136) [ 689 0 R /XYZ 84.259843 369.020079 0 ] (cb136-1) [ 689 0 R /XYZ 101.433071 367.323057 0 ] (cb139) [ 694 0 R /XYZ 84.259843 565.251496 0 ] (cb139-1) [ 694 0 R /XYZ 101.433071 563.554475 0 ] (cb14) [ 407 0 R /XYZ 84.259843 171.512413 0 ] (cb14-1) [ 407 0 R /XYZ 101.433071 169.815391 0 ] (cb142) [ 694 0 R /XYZ 84.259843 102.004475 0 ] (cb142-1) [ 694 0 R /XYZ 101.433071 100.307453 0 ] (cb145) [ 700 0 R /XYZ 84.259843 514.251496 0 ] (cb145-1) [ 700 0 R /XYZ 101.433071 512.554475 0 ] (cb148) [ 705 0 R /XYZ 84.259843 309.320079 0 ] (cb148-1) [ 705 0 R /XYZ 101.433071 307.623057 0 ] (cb151) [ 710 0 R /XYZ 84.259843 103.070079 0 ] (cb151-1) [ 710 0 R /XYZ 101.433071 101.373057 0 ] (cb154) [ 717 0 R /XYZ 84.259843 613.970079 0 ] (cb154-1) [ 717 0 R /XYZ 101.433071 612.273057 0 ] (cb157) [ 722 0 R /XYZ 84.259843 403.070079 0 ] (cb157-1) [ 722 0 R /XYZ 101.433071 401.373057 0 ] (cb160) [ 727 0 R /XYZ 84.259843 178.070079 0 ] (cb160-1) [ 727 0 R /XYZ 101.433071 176.373057 0 ] (cb163) [ 734 0 R /XYZ 84.259843 628.970079 0 ] (cb163-1) [ 734 0 R /XYZ 101.433071 627.273057 0 ] (cb166) [ 743 0 R /XYZ 84.259843 595.251496 0 ] (cb166-1) [ 743 0 R /XYZ 101.433071 593.554475 0 ] (cb169) [ 748 0 R /XYZ 84.259843 267.651496 0 ] (cb169-1) [ 748 0 R /XYZ 101.433071 265.954475 0 ] (cb17) [ 440 0 R /XYZ 84.259843 543.320079 0 ] (cb17-1) [ 440 0 R /XYZ 101.433071 541.623057 0 ] (cb17-10) [ 440 0 R /XYZ 99.933071 333.205821 0 ] (cb17-11) [ 440 0 R /XYZ 99.933071 314.258799 0 ] (cb17-12) [ 440 0 R /XYZ 99.933071 295.311778 0 ] (cb17-13) [ 440 0 R /XYZ 99.933071 276.364756 0 ] (cb17-14) [ 440 0 R /XYZ 99.933071 257.417735 0 ] (cb17-15) [ 440 0 R /XYZ 99.933071 238.470714 0 ] (cb17-16) [ 440 0 R /XYZ 99.933071 219.523692 0 ] (cb17-17) [ 440 0 R /XYZ 99.933071 200.576671 0 ] (cb17-18) [ 440 0 R /XYZ 99.933071 181.629649 0 ] (cb17-19) [ 440 0 R /XYZ 99.933071 162.682628 0 ] (cb17-2) [ 440 0 R /XYZ 99.933071 522.676036 0 ] (cb17-20) [ 440 0 R /XYZ 99.933071 143.735606 0 ] (cb17-21) [ 440 0 R /XYZ 99.933071 124.788585 0 ] (cb17-22) [ 440 0 R /XYZ 99.933071 105.841563 0 ] (cb17-23) [ 464 0 R /XYZ 99.933071 799.173057 0 ] (cb17-24) [ 464 0 R /XYZ 99.933071 780.226036 0 ] (cb17-25) [ 464 0 R /XYZ 99.933071 761.279014 0 ] (cb17-26) [ 464 0 R /XYZ 99.933071 742.331993 0 ] (cb17-27) [ 464 0 R /XYZ 99.933071 723.384971 0 ] (cb17-28) [ 464 0 R /XYZ 99.933071 704.437950 0 ] (cb17-29) [ 464 0 R /XYZ 99.933071 685.490928 0 ] (cb17-3) [ 440 0 R /XYZ 99.933071 503.729014 0 ] (cb17-30) [ 464 0 R /XYZ 99.933071 666.543907 0 ] (cb17-31) [ 464 0 R /XYZ 99.933071 647.596885 0 ] (cb17-32) [ 464 0 R /XYZ 99.933071 628.649864 0 ] (cb17-33) [ 464 0 R /XYZ 99.933071 609.702842 0 ] (cb17-34) [ 464 0 R /XYZ 99.933071 590.755821 0 ] (cb17-35) [ 464 0 R /XYZ 99.933071 571.808799 0 ] (cb17-36) [ 464 0 R /XYZ 99.933071 552.861778 0 ] (cb17-37) [ 464 0 R /XYZ 99.933071 533.914756 0 ] (cb17-38) [ 464 0 R /XYZ 99.933071 514.967735 0 ] (cb17-39) [ 464 0 R /XYZ 99.933071 496.020714 0 ] (cb17-4) [ 440 0 R /XYZ 99.933071 465.834971 0 ] (cb17-40) [ 464 0 R /XYZ 99.933071 477.073692 0 ] (cb17-41) [ 464 0 R /XYZ 99.933071 458.126671 0 ] (cb17-42) [ 464 0 R /XYZ 99.933071 439.179649 0 ] (cb17-43) [ 464 0 R /XYZ 99.933071 420.232628 0 ] (cb17-44) [ 464 0 R /XYZ 99.933071 401.285606 0 ] (cb17-45) [ 464 0 R /XYZ 99.933071 382.338585 0 ] (cb17-46) [ 464 0 R /XYZ 99.933071 363.391563 0 ] (cb17-47) [ 464 0 R /XYZ 99.933071 344.444542 0 ] (cb17-48) [ 464 0 R /XYZ 99.933071 325.497520 0 ] (cb17-49) [ 464 0 R /XYZ 99.933071 306.550499 0 ] (cb17-5) [ 440 0 R /XYZ 99.933071 427.940928 0 ] (cb17-50) [ 464 0 R /XYZ 99.933071 287.603477 0 ] (cb17-51) [ 464 0 R /XYZ 99.933071 268.656456 0 ] (cb17-52) [ 464 0 R /XYZ 99.933071 249.709434 0 ] (cb17-53) [ 464 0 R /XYZ 99.933071 211.815391 0 ] (cb17-54) [ 464 0 R /XYZ 99.933071 192.868370 0 ] (cb17-55) [ 464 0 R /XYZ 99.933071 173.921348 0 ] (cb17-56) [ 464 0 R /XYZ 99.933071 154.974327 0 ] (cb17-57) [ 464 0 R /XYZ 99.933071 136.027305 0 ] (cb17-58) [ 464 0 R /XYZ 99.933071 117.080284 0 ] (cb17-59) [ 464 0 R /XYZ 99.933071 98.133262 0 ] (cb17-6) [ 440 0 R /XYZ 99.933071 408.993907 0 ] (cb17-60) [ 503 0 R /XYZ 99.933071 799.173057 0 ] (cb17-61) [ 503 0 R /XYZ 99.933071 780.226036 0 ] (cb17-7) [ 440 0 R /XYZ 99.933071 390.046885 0 ] (cb17-8) [ 440 0 R /XYZ 99.933071 371.099864 0 ] (cb17-9) [ 440 0 R /XYZ 99.933071 352.152842 0 ] (cb172) [ 751 0 R /XYZ 84.259843 607.820079 0 ] (cb172-1) [ 751 0 R /XYZ 101.433071 606.123057 0 ] (cb174) [ 751 0 R /XYZ 84.259843 298.679014 0 ] (cb174-1) [ 751 0 R /XYZ 101.433071 296.981993 0 ] (cb176) [ 755 0 R /XYZ 84.259843 715.370079 0 ] (cb176-1) [ 755 0 R /XYZ 101.433071 713.673057 0 ] (cb179) [ 755 0 R /XYZ 84.259843 375.479014 0 ] (cb179-1) [ 755 0 R /XYZ 101.433071 373.781993 0 ] (cb179-2) [ 755 0 R /XYZ 99.933071 354.834971 0 ] (cb179-3) [ 755 0 R /XYZ 99.933071 335.887950 0 ] (cb179-4) [ 755 0 R /XYZ 99.933071 279.046885 0 ] (cb179-5) [ 755 0 R /XYZ 99.933071 260.099864 0 ] (cb18) [ 503 0 R /XYZ 84.259843 720.976036 0 ] (cb18-1) [ 503 0 R /XYZ 101.433071 719.279014 0 ] (cb180) [ 755 0 R /XYZ 84.259843 200.849864 0 ] (cb180-1) [ 755 0 R /XYZ 101.433071 199.152842 0 ] (cb182) [ 764 0 R /XYZ 84.259843 655.220079 0 ] (cb182-1) [ 764 0 R /XYZ 101.433071 653.523057 0 ] (cb182-2) [ 764 0 R /XYZ 99.933071 634.576036 0 ] (cb182-3) [ 764 0 R /XYZ 99.933071 615.629014 0 ] (cb182-4) [ 764 0 R /XYZ 99.933071 558.787950 0 ] (cb182-5) [ 764 0 R /XYZ 99.933071 539.840928 0 ] (cb183) [ 764 0 R /XYZ 84.259843 480.590928 0 ] (cb183-1) [ 764 0 R /XYZ 101.433071 478.893907 0 ] (cb185) [ 774 0 R /XYZ 84.259843 490.251496 0 ] (cb185-1) [ 774 0 R /XYZ 101.433071 488.554475 0 ] (cb186) [ 774 0 R /XYZ 84.259843 429.304475 0 ] (cb186-1) [ 774 0 R /XYZ 101.433071 427.607453 0 ] (cb188) [ 774 0 R /XYZ 84.259843 116.807453 0 ] (cb188-1) [ 774 0 R /XYZ 101.433071 115.110432 0 ] (cb189) [ 779 0 R /XYZ 84.259843 772.370079 0 ] (cb189-1) [ 779 0 R /XYZ 101.433071 770.673057 0 ] (cb191) [ 779 0 R /XYZ 84.259843 459.873057 0 ] (cb191-1) [ 779 0 R /XYZ 101.433071 458.176036 0 ] (cb192) [ 779 0 R /XYZ 84.259843 398.926036 0 ] (cb192-1) [ 779 0 R /XYZ 101.433071 397.229014 0 ] (cb194) [ 784 0 R /XYZ 84.259843 799.370079 0 ] (cb194-1) [ 784 0 R /XYZ 101.433071 797.673057 0 ] (cb195) [ 784 0 R /XYZ 84.259843 738.423057 0 ] (cb195-1) [ 784 0 R /XYZ 101.433071 736.726036 0 ] (cb197) [ 784 0 R /XYZ 84.259843 410.926036 0 ] (cb197-1) [ 784 0 R /XYZ 101.433071 409.229014 0 ] (cb198) [ 784 0 R /XYZ 84.259843 349.979014 0 ] (cb198-1) [ 784 0 R /XYZ 101.433071 348.281993 0 ] (cb2) [ 318 0 R /XYZ 84.259843 730.370079 0 ] (cb2-1) [ 318 0 R /XYZ 101.433071 728.673057 0 ] (cb201) [ 790 0 R /XYZ 84.259843 230.570079 0 ] (cb201-1) [ 790 0 R /XYZ 101.433071 228.873057 0 ] (cb202) [ 790 0 R /XYZ 84.259843 169.623057 0 ] (cb202-1) [ 790 0 R /XYZ 101.433071 167.926036 0 ] (cb204) [ 794 0 R /XYZ 84.259843 583.970079 0 ] (cb204-1) [ 794 0 R /XYZ 101.433071 582.273057 0 ] (cb205) [ 794 0 R /XYZ 84.259843 523.023057 0 ] (cb205-1) [ 794 0 R /XYZ 101.433071 521.326036 0 ] (cb207) [ 798 0 R /XYZ 84.259843 700.370079 0 ] (cb207-1) [ 798 0 R /XYZ 101.433071 698.673057 0 ] (cb208) [ 798 0 R /XYZ 84.259843 639.423057 0 ] (cb208-1) [ 798 0 R /XYZ 101.433071 637.726036 0 ] (cb21) [ 508 0 R /XYZ 84.259843 565.251496 0 ] (cb21-1) [ 508 0 R /XYZ 101.433071 563.554475 0 ] (cb210) [ 798 0 R /XYZ 84.259843 296.926036 0 ] (cb210-1) [ 798 0 R /XYZ 101.433071 295.229014 0 ] (cb211) [ 798 0 R /XYZ 84.259843 235.979014 0 ] (cb211-1) [ 798 0 R /XYZ 101.433071 234.281993 0 ] (cb213) [ 804 0 R /XYZ 84.259843 640.370079 0 ] (cb213-1) [ 804 0 R /XYZ 101.433071 638.673057 0 ] (cb214) [ 804 0 R /XYZ 84.259843 579.423057 0 ] (cb214-1) [ 804 0 R /XYZ 101.433071 577.726036 0 ] (cb217) [ 808 0 R /XYZ 84.259843 428.570079 0 ] (cb217-1) [ 808 0 R /XYZ 101.433071 426.873057 0 ] (cb218) [ 808 0 R /XYZ 84.259843 131.823057 0 ] (cb218-1) [ 808 0 R /XYZ 101.433071 130.126036 0 ] (cb219) [ 812 0 R /XYZ 84.259843 799.370079 0 ] (cb219-1) [ 812 0 R /XYZ 101.433071 797.673057 0 ] (cb221) [ 817 0 R /XYZ 84.259843 768.620079 0 ] (cb221-1) [ 817 0 R /XYZ 101.433071 766.923057 0 ] (cb221-10) [ 817 0 R /XYZ 99.933071 596.399864 0 ] (cb221-11) [ 817 0 R /XYZ 99.933071 577.452842 0 ] (cb221-12) [ 817 0 R /XYZ 99.933071 482.717735 0 ] (cb221-13) [ 817 0 R /XYZ 99.933071 463.770714 0 ] (cb221-14) [ 817 0 R /XYZ 99.933071 444.823692 0 ] (cb221-15) [ 817 0 R /XYZ 99.933071 425.876671 0 ] (cb221-16) [ 817 0 R /XYZ 99.933071 406.929649 0 ] (cb221-17) [ 817 0 R /XYZ 99.933071 387.982628 0 ] (cb221-18) [ 817 0 R /XYZ 99.933071 350.088585 0 ] (cb221-19) [ 817 0 R /XYZ 99.933071 331.141563 0 ] (cb221-2) [ 817 0 R /XYZ 99.933071 747.976036 0 ] (cb221-20) [ 817 0 R /XYZ 99.933071 198.512413 0 ] (cb221-21) [ 817 0 R /XYZ 99.933071 179.565391 0 ] (cb221-22) [ 817 0 R /XYZ 99.933071 160.618370 0 ] (cb221-23) [ 817 0 R /XYZ 99.933071 103.777305 0 ] (cb221-24) [ 842 0 R /XYZ 99.933071 799.173057 0 ] (cb221-25) [ 842 0 R /XYZ 99.933071 780.226036 0 ] (cb221-26) [ 842 0 R /XYZ 99.933071 761.279014 0 ] (cb221-27) [ 842 0 R /XYZ 99.933071 742.331993 0 ] (cb221-28) [ 842 0 R /XYZ 99.933071 723.384971 0 ] (cb221-29) [ 842 0 R /XYZ 99.933071 704.437950 0 ] (cb221-3) [ 817 0 R /XYZ 99.933071 729.029014 0 ] (cb221-30) [ 842 0 R /XYZ 99.933071 685.490928 0 ] (cb221-31) [ 842 0 R /XYZ 99.933071 666.543907 0 ] (cb221-4) [ 817 0 R /XYZ 99.933071 710.081993 0 ] (cb221-5) [ 817 0 R /XYZ 99.933071 691.134971 0 ] (cb221-6) [ 817 0 R /XYZ 99.933071 672.187950 0 ] (cb221-7) [ 817 0 R /XYZ 99.933071 653.240928 0 ] (cb221-8) [ 817 0 R /XYZ 99.933071 634.293907 0 ] (cb221-9) [ 817 0 R /XYZ 99.933071 615.346885 0 ] (cb222) [ 842 0 R /XYZ 84.259843 607.293907 0 ] (cb222-1) [ 842 0 R /XYZ 101.433071 605.596885 0 ] (cb225) [ 853 0 R /XYZ 84.259843 434.451496 0 ] (cb225-1) [ 853 0 R /XYZ 101.433071 432.754475 0 ] (cb228) [ 856 0 R /XYZ 84.259843 799.370079 0 ] (cb228-1) [ 856 0 R /XYZ 101.433071 797.673057 0 ] (cb231) [ 856 0 R /XYZ 84.259843 448.229014 0 ] (cb231-1) [ 856 0 R /XYZ 101.433071 446.531993 0 ] (cb234) [ 860 0 R /XYZ 84.259843 799.370079 0 ] (cb234-1) [ 860 0 R /XYZ 101.433071 797.673057 0 ] (cb237) [ 863 0 R /XYZ 84.259843 394.701496 0 ] (cb237-1) [ 863 0 R /XYZ 101.433071 393.004475 0 ] (cb237-10) [ 863 0 R /XYZ 99.933071 222.481281 0 ] (cb237-11) [ 863 0 R /XYZ 99.933071 203.534260 0 ] (cb237-12) [ 863 0 R /XYZ 99.933071 165.640217 0 ] (cb237-13) [ 863 0 R /XYZ 99.933071 127.746174 0 ] (cb237-14) [ 863 0 R /XYZ 99.933071 108.799152 0 ] (cb237-15) [ 863 0 R /XYZ 99.933071 89.852131 0 ] (cb237-16) [ 880 0 R /XYZ 99.933071 799.173057 0 ] (cb237-17) [ 880 0 R /XYZ 99.933071 780.226036 0 ] (cb237-18) [ 880 0 R /XYZ 99.933071 761.279014 0 ] (cb237-19) [ 880 0 R /XYZ 99.933071 742.331993 0 ] (cb237-2) [ 863 0 R /XYZ 99.933071 374.057453 0 ] (cb237-3) [ 863 0 R /XYZ 99.933071 355.110432 0 ] (cb237-4) [ 863 0 R /XYZ 99.933071 336.163410 0 ] (cb237-5) [ 863 0 R /XYZ 99.933071 317.216389 0 ] (cb237-6) [ 863 0 R /XYZ 99.933071 298.269367 0 ] (cb237-7) [ 863 0 R /XYZ 99.933071 279.322346 0 ] (cb237-8) [ 863 0 R /XYZ 99.933071 260.375324 0 ] (cb237-9) [ 863 0 R /XYZ 99.933071 241.428303 0 ] (cb238) [ 880 0 R /XYZ 84.259843 683.081993 0 ] (cb238-1) [ 880 0 R /XYZ 101.433071 681.384971 0 ] (cb24) [ 511 0 R /XYZ 84.259843 125.570079 0 ] (cb24-1) [ 511 0 R /XYZ 101.433071 123.873057 0 ] (cb241) [ 893 0 R /XYZ 84.259843 768.620079 0 ] (cb241-1) [ 893 0 R /XYZ 101.433071 766.923057 0 ] (cb241-10) [ 893 0 R /XYZ 99.933071 596.399864 0 ] (cb241-11) [ 893 0 R /XYZ 99.933071 577.452842 0 ] (cb241-12) [ 893 0 R /XYZ 99.933071 520.611778 0 ] (cb241-13) [ 893 0 R /XYZ 99.933071 501.664756 0 ] (cb241-14) [ 893 0 R /XYZ 99.933071 482.717735 0 ] (cb241-15) [ 893 0 R /XYZ 99.933071 463.770714 0 ] (cb241-16) [ 893 0 R /XYZ 99.933071 444.823692 0 ] (cb241-17) [ 893 0 R /XYZ 99.933071 425.876671 0 ] (cb241-18) [ 893 0 R /XYZ 99.933071 406.929649 0 ] (cb241-2) [ 893 0 R /XYZ 99.933071 747.976036 0 ] (cb241-3) [ 893 0 R /XYZ 99.933071 729.029014 0 ] (cb241-4) [ 893 0 R /XYZ 99.933071 710.081993 0 ] (cb241-5) [ 893 0 R /XYZ 99.933071 691.134971 0 ] (cb241-6) [ 893 0 R /XYZ 99.933071 672.187950 0 ] (cb241-7) [ 893 0 R /XYZ 99.933071 653.240928 0 ] (cb241-8) [ 893 0 R /XYZ 99.933071 634.293907 0 ] (cb241-9) [ 893 0 R /XYZ 99.933071 615.346885 0 ] (cb242) [ 893 0 R /XYZ 84.259843 347.679649 0 ] (cb242-1) [ 893 0 R /XYZ 101.433071 345.982628 0 ] (cb27) [ 516 0 R /XYZ 84.259843 425.570079 0 ] (cb27-1) [ 516 0 R /XYZ 101.433071 423.873057 0 ] (cb3) [ 318 0 R /XYZ 84.259843 523.623057 0 ] (cb3-1) [ 318 0 R /XYZ 101.433071 521.926036 0 ] (cb30) [ 521 0 R /XYZ 84.259843 715.370079 0 ] (cb30-1) [ 521 0 R /XYZ 101.433071 713.673057 0 ] (cb33) [ 524 0 R /XYZ 84.259843 211.820079 0 ] (cb33-1) [ 524 0 R /XYZ 101.433071 210.123057 0 ] (cb36) [ 529 0 R /XYZ 84.259843 451.820079 0 ] (cb36-1) [ 529 0 R /XYZ 101.433071 450.123057 0 ] (cb39) [ 534 0 R /XYZ 84.259843 730.370079 0 ] (cb39-1) [ 534 0 R /XYZ 101.433071 728.673057 0 ] (cb42) [ 537 0 R /XYZ 84.259843 294.320079 0 ] (cb42-1) [ 537 0 R /XYZ 101.433071 292.623057 0 ] (cb45) [ 542 0 R /XYZ 84.259843 575.570079 0 ] (cb45-1) [ 542 0 R /XYZ 101.433071 573.873057 0 ] (cb48) [ 545 0 R /XYZ 84.259843 129.320079 0 ] (cb48-1) [ 545 0 R /XYZ 101.433071 127.623057 0 ] (cb51) [ 550 0 R /XYZ 84.259843 350.570079 0 ] (cb51-1) [ 550 0 R /XYZ 101.433071 348.873057 0 ] (cb54) [ 555 0 R /XYZ 84.259843 538.070079 0 ] (cb54-1) [ 555 0 R /XYZ 101.433071 536.373057 0 ] (cb55) [ 555 0 R /XYZ 84.259843 301.323057 0 ] (cb55-1) [ 555 0 R /XYZ 101.433071 299.626036 0 ] (cb56) [ 559 0 R /XYZ 84.259843 799.370079 0 ] (cb56-1) [ 559 0 R /XYZ 101.433071 797.673057 0 ] (cb59) [ 562 0 R /XYZ 84.259843 350.570079 0 ] (cb59-1) [ 562 0 R /XYZ 101.433071 348.873057 0 ] (cb6) [ 318 0 R /XYZ 84.259843 138.376036 0 ] (cb6-1) [ 318 0 R /XYZ 101.433071 136.679014 0 ] (cb62) [ 567 0 R /XYZ 84.259843 598.970079 0 ] (cb62-1) [ 567 0 R /XYZ 101.433071 597.273057 0 ] (cb65) [ 572 0 R /XYZ 84.259843 772.370079 0 ] (cb65-1) [ 572 0 R /XYZ 101.433071 770.673057 0 ] (cb68) [ 575 0 R /XYZ 84.259843 271.820079 0 ] (cb68-1) [ 575 0 R /XYZ 101.433071 270.123057 0 ] (cb71) [ 580 0 R /XYZ 84.259843 571.820079 0 ] (cb71-1) [ 580 0 R /XYZ 101.433071 570.123057 0 ] (cb74) [ 583 0 R /XYZ 84.259843 144.320079 0 ] (cb74-1) [ 583 0 R /XYZ 101.433071 142.623057 0 ] (cb77) [ 588 0 R /XYZ 84.259843 440.570079 0 ] (cb77-1) [ 588 0 R /XYZ 101.433071 438.873057 0 ] (cb80) [ 593 0 R /XYZ 84.259843 715.370079 0 ] (cb80-1) [ 593 0 R /XYZ 101.433071 713.673057 0 ] (cb83) [ 596 0 R /XYZ 84.259843 275.570079 0 ] (cb83-1) [ 596 0 R /XYZ 101.433071 273.873057 0 ] (cb86) [ 601 0 R /XYZ 84.259843 556.820079 0 ] (cb86-1) [ 601 0 R /XYZ 101.433071 555.123057 0 ] (cb89) [ 604 0 R /XYZ 84.259843 125.570079 0 ] (cb89-1) [ 604 0 R /XYZ 101.433071 123.873057 0 ] (cb9) [ 325 0 R /XYZ 84.259843 509.420079 0 ] (cb9-1) [ 325 0 R /XYZ 101.433071 507.723057 0 ] (cb9-10) [ 325 0 R /XYZ 99.933071 318.252842 0 ] (cb9-11) [ 325 0 R /XYZ 99.933071 299.305821 0 ] (cb9-12) [ 325 0 R /XYZ 99.933071 280.358799 0 ] (cb9-13) [ 325 0 R /XYZ 99.933071 261.411778 0 ] (cb9-14) [ 325 0 R /XYZ 99.933071 242.464756 0 ] (cb9-15) [ 325 0 R /XYZ 99.933071 223.517735 0 ] (cb9-16) [ 325 0 R /XYZ 99.933071 204.570714 0 ] (cb9-17) [ 325 0 R /XYZ 99.933071 185.623692 0 ] (cb9-18) [ 325 0 R /XYZ 99.933071 166.676671 0 ] (cb9-19) [ 325 0 R /XYZ 99.933071 147.729649 0 ] (cb9-2) [ 325 0 R /XYZ 99.933071 488.776036 0 ] (cb9-20) [ 325 0 R /XYZ 99.933071 128.782628 0 ] (cb9-21) [ 325 0 R /XYZ 99.933071 109.835606 0 ] (cb9-22) [ 325 0 R /XYZ 99.933071 90.888585 0 ] (cb9-23) [ 349 0 R /XYZ 99.933071 799.173057 0 ] (cb9-24) [ 349 0 R /XYZ 99.933071 780.226036 0 ] (cb9-25) [ 349 0 R /XYZ 99.933071 761.279014 0 ] (cb9-26) [ 349 0 R /XYZ 99.933071 742.331993 0 ] (cb9-27) [ 349 0 R /XYZ 99.933071 723.384971 0 ] (cb9-28) [ 349 0 R /XYZ 99.933071 704.437950 0 ] (cb9-29) [ 349 0 R /XYZ 99.933071 685.490928 0 ] (cb9-3) [ 325 0 R /XYZ 99.933071 469.829014 0 ] (cb9-30) [ 349 0 R /XYZ 99.933071 666.543907 0 ] (cb9-31) [ 349 0 R /XYZ 99.933071 647.596885 0 ] (cb9-32) [ 349 0 R /XYZ 99.933071 628.649864 0 ] (cb9-33) [ 349 0 R /XYZ 99.933071 609.702842 0 ] (cb9-34) [ 349 0 R /XYZ 99.933071 590.755821 0 ] (cb9-35) [ 349 0 R /XYZ 99.933071 571.808799 0 ] (cb9-36) [ 349 0 R /XYZ 99.933071 552.861778 0 ] (cb9-37) [ 349 0 R /XYZ 99.933071 533.914756 0 ] (cb9-38) [ 349 0 R /XYZ 99.933071 514.967735 0 ] (cb9-39) [ 349 0 R /XYZ 99.933071 496.020714 0 ] (cb9-4) [ 325 0 R /XYZ 99.933071 431.934971 0 ] (cb9-40) [ 349 0 R /XYZ 99.933071 477.073692 0 ] (cb9-41) [ 349 0 R /XYZ 99.933071 458.126671 0 ] (cb9-42) [ 349 0 R /XYZ 99.933071 439.179649 0 ] (cb9-43) [ 349 0 R /XYZ 99.933071 420.232628 0 ] (cb9-44) [ 349 0 R /XYZ 99.933071 401.285606 0 ] (cb9-5) [ 325 0 R /XYZ 99.933071 412.987950 0 ] (cb9-6) [ 325 0 R /XYZ 99.933071 394.040928 0 ] (cb9-7) [ 325 0 R /XYZ 99.933071 375.093907 0 ] (cb9-8) [ 325 0 R /XYZ 99.933071 356.146885 0 ] (cb9-9) [ 325 0 R /XYZ 99.933071 337.199864 0 ] (cb92) [ 609 0 R /XYZ 84.259843 440.570079 0 ] (cb92-1) [ 609 0 R /XYZ 101.433071 438.873057 0 ] (cb95) [ 614 0 R /XYZ 84.259843 685.370079 0 ] (cb95-1) [ 614 0 R /XYZ 101.433071 683.673057 0 ] (cb98) [ 617 0 R /XYZ 84.259843 238.070079 0 ] (cb98-1) [ 617 0 R /XYZ 101.433071 236.373057 0 ] (cis-v1.6-kubernetes-benchmark---rancher-v2.6-with-kubernetes-v1.18-to-v1.21) [ 304 0 R /XYZ 84.259843 784.970079 0 ] (client-certificate-authentication-should-not-be-used-for-users-manual) [ 741 0 R /XYZ 84.259843 684.651496 0 ] (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) [ 889 0 R /XYZ 84.259843 684.651496 0 ] (consider-external-secret-storage-manual) [ 887 0 R /XYZ 84.259843 568.851496 0 ] (contentsbox) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (controller-manager) [ 674 0 R /XYZ 41.740157 784.430079 0 ] (controls) [ 309 0 R /XYZ 84.259843 612.381496 0 ] (create-administrative-boundaries-between-resources-using-namespaces-manual) [ 891 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-a-minimal-audit-policy-is-created-automated) [ 743 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated) [ 734 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-all-namespaces-have-network-policies-defined-automated) [ 863 0 R /XYZ 84.259843 538.851496 0 ] (ensure-that-default-service-accounts-are-not-actively-used.-automated) [ 815 0 R /XYZ 84.259843 206.451496 0 ] (ensure-that-encryption-providers-are-appropriately-configured-automated) [ 643 0 R /XYZ 84.259843 577.220079 0 ] (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) [ 842 0 R /XYZ 84.259843 449.446885 0 ] (ensure-that-the---anonymous-auth-argument-is-set-to-false-automated) [ 508 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated) [ 596 0 R /XYZ 84.259843 445.970079 0 ] (ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated) [ 601 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated) [ 604 0 R /XYZ 84.259843 295.970079 0 ] (ensure-that-the---audit-log-path-argument-is-set-automated) [ 591 0 R /XYZ 84.259843 183.470079 0 ] (ensure-that-the---authorization-mode-argument-includes-node-automated) [ 537 0 R /XYZ 84.259843 464.720079 0 ] (ensure-that-the---authorization-mode-argument-includes-rbac-automated) [ 542 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated) [ 532 0 R /XYZ 84.259843 183.470079 0 ] (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) [ 774 0 R /XYZ 84.259843 332.207453 0 ] (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) [ 710 0 R /XYZ 84.259843 258.470079 0 ] (ensure-that-the---basic-auth-file-argument-is-not-set-automated) [ 511 0 R /XYZ 84.259843 295.970079 0 ] (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) [ 689 0 R /XYZ 84.259843 524.420079 0 ] (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) [ 694 0 R /XYZ 84.259843 257.404475 0 ] (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) [ 700 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) [ 630 0 R /XYZ 84.259843 483.470079 0 ] (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) [ 779 0 R /XYZ 84.259843 675.273057 0 ] (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) [ 705 0 R /XYZ 84.259843 464.720079 0 ] (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) [ 638 0 R /XYZ 84.259843 295.970079 0 ] (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) [ 635 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) [ 622 0 R /XYZ 84.259843 689.720079 0 ] (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-automated) [ 794 0 R /XYZ 84.259843 208.126036 0 ] (ensure-that-the---hostname-override-argument-is-not-set-manual) [ 794 0 R /XYZ 84.259843 425.926036 0 ] (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) [ 575 0 R /XYZ 84.259843 427.220079 0 ] (ensure-that-the---insecure-port-argument-is-set-to-0-automated) [ 580 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) [ 751 0 R /XYZ 84.259843 163.687950 0 ] (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 751 0 R /XYZ 84.259843 454.079014 0 ] (ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated) [ 529 0 R /XYZ 84.259843 652.220079 0 ] (ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated) [ 524 0 R /XYZ 84.259843 427.220079 0 ] (ensure-that-the---kubelet-https-argument-is-set-to-true-automated) [ 519 0 R /XYZ 84.259843 164.720079 0 ] (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) [ 794 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) [ 727 0 R /XYZ 84.259843 333.470079 0 ] (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) [ 717 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) [ 722 0 R /XYZ 84.259843 558.470079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated) [ 588 0 R /XYZ 84.259843 595.970079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated-1) [ 677 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated-2) [ 694 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) [ 790 0 R /XYZ 84.259843 445.970079 0 ] (ensure-that-the---read-only-port-argument-is-set-to-0-automated) [ 779 0 R /XYZ 84.259843 301.829014 0 ] (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) [ 609 0 R /XYZ 84.259843 595.970079 0 ] (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) [ 686 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated) [ 798 0 R /XYZ 84.259843 138.881993 0 ] (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) [ 583 0 R /XYZ 84.259843 314.720079 0 ] (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) [ 617 0 R /XYZ 84.259843 408.470079 0 ] (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) [ 612 0 R /XYZ 84.259843 164.720079 0 ] (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) [ 683 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) [ 784 0 R /XYZ 84.259843 641.326036 0 ] (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) [ 674 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) [ 625 0 R /XYZ 84.259843 239.720079 0 ] (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) [ 798 0 R /XYZ 84.259843 542.326036 0 ] (ensure-that-the---token-auth-file-parameter-is-not-set-automated) [ 516 0 R /XYZ 84.259843 595.970079 0 ] (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) [ 680 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) [ 323 0 R /XYZ 84.259843 586.670079 0 ] (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 323 0 R /XYZ 84.259843 702.470079 0 ] (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) [ 550 0 R /XYZ 84.259843 520.970079 0 ] (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) [ 555 0 R /XYZ 84.259843 708.470079 0 ] (ensure-that-the-admission-control-plugin-eventratelimit-is-set-automated) [ 545 0 R /XYZ 84.259843 314.720079 0 ] (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) [ 562 0 R /XYZ 84.259843 520.970079 0 ] (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) [ 570 0 R /XYZ 84.259843 258.470079 0 ] (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) [ 567 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) [ 555 0 R /XYZ 84.259843 501.723057 0 ] (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) [ 555 0 R /XYZ 84.259843 264.976036 0 ] (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) [ 774 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated) [ 660 0 R /XYZ 84.259843 411.552842 0 ] (ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 313 0 R /XYZ 84.259843 553.851496 0 ] (ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 313 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-audit-policy-covers-key-security-concerns-manual) [ 746 0 R /XYZ 84.259843 333.470079 0 ] (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 755 0 R /XYZ 84.259843 519.629014 0 ] (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) [ 764 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) [ 815 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-cni-in-use-supports-network-policies-manual) [ 863 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-container-network-interface-file-ownership-is-set-to-rootroot-manual) [ 315 0 R /XYZ 84.259843 170.823057 0 ] (ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual) [ 315 0 R /XYZ 84.259843 347.570079 0 ] (ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 313 0 R /XYZ 84.259843 277.251496 0 ] (ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 313 0 R /XYZ 84.259843 423.051496 0 ] (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) [ 325 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 323 0 R /XYZ 84.259843 209.270079 0 ] (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) [ 318 0 R /XYZ 84.259843 365.776036 0 ] (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) [ 318 0 R /XYZ 84.259843 694.023057 0 ] (ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 315 0 R /XYZ 84.259843 478.370079 0 ] (ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 315 0 R /XYZ 84.259843 609.170079 0 ] (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) [ 764 0 R /XYZ 84.259843 383.493907 0 ] (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) [ 764 0 R /XYZ 84.259843 195.693907 0 ] (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-automated) [ 808 0 R /XYZ 84.259843 392.223057 0 ] (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) [ 748 0 R /XYZ 84.259843 553.851496 0 ] (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 748 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 349 0 R /XYZ 84.259843 184.188585 0 ] (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) [ 325 0 R /XYZ 84.259843 668.570079 0 ] (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated) [ 440 0 R /XYZ 84.259843 702.470079 0 ] (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-automated) [ 751 0 R /XYZ 84.259843 763.220079 0 ] (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) [ 689 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 315 0 R /XYZ 84.259843 739.970079 0 ] (ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 313 0 R /XYZ 84.259843 146.451496 0 ] (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) [ 323 0 R /XYZ 84.259843 340.070079 0 ] (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 323 0 R /XYZ 84.259843 470.870079 0 ] (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) [ 891 0 R /XYZ 84.259843 604.851496 0 ] (etcd-node-configuration-files) [ 700 0 R /XYZ 41.740157 784.430079 0 ] (extensible-admission-control) [ 889 0 R /XYZ 41.740157 784.430079 0 ] (general-policies) [ 891 0 R /XYZ 41.740157 784.430079 0 ] (header_bottom_text) [ 6 0 R /XYZ 85.009843 392.718898 0 ] (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-automated) [ 748 0 R /XYZ 84.259843 423.051496 0 ] (kubelet) [ 774 0 R /XYZ 41.740157 784.430079 0 ] (logging) [ 743 0 R /XYZ 41.740157 784.430079 0 ] (master-node-configuration-files) [ 313 0 R /XYZ 41.740157 784.430079 0 ] (minimize-access-to-create-pods-manual) [ 815 0 R /XYZ 84.259843 307.251496 0 ] (minimize-access-to-secrets-manual) [ 815 0 R /XYZ 84.259843 523.851496 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) [ 853 0 R /XYZ 84.259843 238.710432 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) [ 856 0 R /XYZ 84.259843 603.629014 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) [ 853 0 R /XYZ 84.259843 589.851496 0 ] (minimize-the-admission-of-containers-with-added-capabilities-manual) [ 860 0 R /XYZ 84.259843 323.081993 0 ] (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) [ 856 0 R /XYZ 84.259843 252.487950 0 ] (minimize-the-admission-of-containers-with-capabilities-assigned-manual) [ 860 0 R /XYZ 84.259843 207.281993 0 ] (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) [ 860 0 R /XYZ 84.259843 453.881993 0 ] (minimize-the-admission-of-privileged-containers-manual) [ 853 0 R /XYZ 84.259843 720.651496 0 ] (minimize-the-admission-of-root-containers-manual) [ 860 0 R /XYZ 84.259843 584.681993 0 ] (minimize-wildcard-use-in-roles-and-clusterroles-manual) [ 815 0 R /XYZ 84.259843 423.051496 0 ] (network-policies-and-cni) [ 863 0 R /XYZ 41.740157 784.430079 0 ] (overview) [ 304 0 R /XYZ 84.259843 704.822079 0 ] (pod-security-policies) [ 853 0 R /XYZ 41.740157 784.430079 0 ] (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) [ 887 0 R /XYZ 84.259843 684.651496 0 ] (rbac-and-service-accounts) [ 815 0 R /XYZ 41.740157 784.430079 0 ] (scheduler) [ 694 0 R /XYZ 41.740157 784.430079 0 ] (secrets-management) [ 887 0 R /XYZ 41.740157 784.430079 0 ] (testing-controls-methodology) [ 304 0 R /XYZ 84.259843 166.076079 0 ] (the-default-namespace-should-not-be-used-automated) [ 891 0 R /XYZ 84.259843 193.251496 0 ] (title-block-header) [ 6 0 R /XYZ 84.259843 502.818898 0 ] (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) [ 808 0 R /XYZ 84.259843 670.970079 0 ] (worker-node-configuration-files) [ 748 0 R /XYZ 41.740157 784.430079 0 ] ] ->> ->> ->> -endobj -4 0 obj -<< -/ExtGState << -/a1.0 << -/ca 1 ->> -/A1.0 << -/CA 1 ->> ->> -/XObject << ->> -/Pattern << ->> -/Shading << ->> -/Font 1076 0 R ->> -endobj -5 0 obj -<< -/Filter /FlateDecode -/Length 2619 ->> -stream -x[Wa咪tc! "d1!v1u.׭CO{n̶II4ς?ZΗק7' 5 =jȱϯ]5ԞS-~w -DMt_C#?%oUͩGk@׃GMMɆ=럹te mGT|r´\D~6,ct3Oi='" 9ۮy-rH6я.'6Z;Ugc)յͅ'cn꿠Έx/.c.I y=NyBp]۸Sd˒"-y&?S9>y5Zk?S|HL[huݖ+:}v_؄wsےmڇy {q^7Ŏ>Pnt;3ϣeNVyei׹Kiw!ۘ͞dh&ۄ0@aF8Nq2q/_OGKSu$*=ˊ7dFirI&-dxd{b=c m_VuoV6uQ/jUh쯃f[:]! w]!ZKۃh샢MؗewfC̥wm -ƖFxSV݇-.Huo['w?x}L.t}Jv|1Nqrߜ1GwK3YGcv}tحC'!t duTne9޸U3X_E>x3[ҙݝz;Y=g.وOO:ds#ڞװeHYCϏǜzz&$u@}\YJCVmW#wߕ<ވ}&lG0UҎEbj }?o׃S ]fRJ=m *^ E:9 H -endstream -endobj -6 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 5 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -7 0 obj -<< -/Filter /FlateDecode -/Length 3661 ->> -stream -x\[ܶ~_C/@Q  $Ѥ-`oq(p6-}onD{4?)?,1̗ǏK'Ȝ69=X&(7~n8Ll'5t0Lٺ㯯C: -i3't%t?Û桇HS6̖Dqp"HtIe:[;_o;7u0ho]w &xqJK:zB!qXI4ȶi7cgjQoiqCs\ 41E;;ߏQ1Br(,,q [Bt\!*5GvFt [BBt??ѽ-Dl~lC(f⦎!*p\>^C4G G[C2x Pm.=vF;Ԁ2yMف.AH#f1Dx]8;Xiڄ`jDŽh {9o-Do! чEeJMчB}Ot/-Do!z GMt8A򗌏%FoMpP fB" L%VdM] -FI;9(2lf"T@g!E&sBe4(:E&la2G{ c de3&ͬpt,$CЙ'CaYV8dVV8d8DCsA}Q8d 19Cf'&}vF0@go8,oJ8: :["qXRO]$`D#40QdgR8 HxĘ(>ptv:CxAJA0xl3"U CgcMT9hrBD M^uFGI0oaBDOqX{ZM :;.È%H*Fm Y0ZVSj5%VS@1dLjJD4:DAA -upBM:{d2CAxh5%1)9!X)#i5%fLRZMLSjJ2n!pL!$ dp:{!fC7 -AgrV)AgCgVSy2*!3?lO N$)u"y*_i5%%XLX c0Ed3Yj -<xjJPjJak5~1VS2ZM#O1`p__VS2G Cg8dLrζD"3fZM:ÊݲVSryəa)DguB""kU^홌B#,P+O(s^W{kWƄbNC6.ŋ}ߝ5K_8`|X0*TFd#te- _ ś}?/>e::W:uGxD͠vޯ-"ڀtLQw囿tsqgl3g|ͣjb|͇2|c+G4,{ʹh>awʹii|.as:ɩ+2{z=%eFDf-`ҙqYfImqָum̦>k0s3fNOީl> D|d:Zu/D9&?ٓeݞidڒVx~;9@3~b-E(oJ3g#4NRT#NOcybYt'$eg!˹?O>Hۑ| NMgxo3ksW,f߷Ϊ9OdG`Oʝ>W^(IQk{[)n5ى\ƒyY}"Aqvާ?Ў]O{ֶ}9 ۯ[sۗV^VL\/ň Eٖ atteGS /#R_їhbC ˛zX-=<.Vapԏv ta/6/R_6w.{| >WC[ILlٝoq/olS1@ٔe'^3>`<ؗp=4-o`N,Ka9̭qaMz[BYqwg1 #Iz*{^Way ]R;:+_e) -sjn9zmUv4 rCJ6f|c?71A.FSZT7\vaWnmbJ\tWw(ĝ8-/A¡X$7Ow6݁4\ahthR!4+V6T -g>T(NJl6x$Ieǀ -lg%_6ttcl@eWTK#l5O˕4U tan|7]OnZV`ݹr睄c ׁ |s~tLv3vŐ: hm{U\1򍪛7i=2__n[8-U^r[HrVljDv{-vU905%33D汶{9uuplZD_s$E8+'q#Nd8٠fqHI)\KiD9ueV6]yB[qCNώG}U9(hK hXA[G|Vsܱ =&9=4'GmN}ņNkh|Sb:J> -endobj -9 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 671.061024 504.679134 638.361024 ] -/BS << -/W 0 ->> -/Dest (cis-v1.6-kubernetes-benchmark---rancher-v2.6-with-kubernetes-v1.18-to-v1.21) ->> -endobj -10 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 488.750423 648.111024 496.429134 633.111024 ] -/BS << -/W 0 ->> -/Dest (cis-v1.6-kubernetes-benchmark---rancher-v2.6-with-kubernetes-v1.18-to-v1.21) ->> -endobj -11 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 626.361024 504.679134 593.661024 ] -/BS << -/W 0 ->> -/Dest (controls) ->> -endobj -12 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 485.690364 618.411024 496.429134 603.411024 ] -/BS << -/W 0 ->> -/Dest (controls) ->> -endobj -13 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 581.661024 504.679134 548.961024 ] -/BS << -/W 0 ->> -/Dest (master-node-configuration-files) ->> -endobj -14 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 485.521907 573.711024 496.429134 558.711024 ] -/BS << -/W 0 ->> -/Dest (master-node-configuration-files) ->> -endobj -15 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 530.961024 498.679134 507.561024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -16 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 510.561024 491.179134 495.561024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -17 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 491.361024 498.679134 467.961024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -18 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 470.961024 491.179134 455.961024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -19 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 451.761024 498.679134 428.361024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -20 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 431.361024 491.179134 416.361024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -21 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 412.161024 498.679134 388.761024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -22 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 391.761024 491.179134 376.761024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -23 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 372.561024 498.679134 349.161024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -24 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 352.161024 491.179134 337.161024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -25 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 332.961024 498.679134 309.561024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -26 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 312.561024 491.179134 297.561024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -27 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 293.361024 498.679134 269.961024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -28 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 272.961024 491.179134 257.961024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -29 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 253.761024 498.679134 230.361024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -30 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 233.361024 491.179134 218.361024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -31 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 214.161024 498.679134 190.761024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual) ->> -endobj -32 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 193.761024 491.179134 178.761024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual) ->> -endobj -33 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 174.561024 498.679134 151.161024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-container-network-interface-file-ownership-is-set-to-rootroot-manual) ->> -endobj -34 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 154.161024 491.179134 139.161024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-container-network-interface-file-ownership-is-set-to-rootroot-manual) ->> -endobj -35 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 134.961024 498.679134 111.561024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) ->> -endobj -36 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 114.561024 491.179134 99.561024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) ->> -endobj -37 0 obj -<< -/Filter /FlateDecode -/Length 3681 ->> -stream -x\[~?< AI&`ȕ%-}41 g LL S! LA@#ɢ3g ,:/&΁7\ L1yЋX1PĠ3ǐDgP A.ML@rc&J61ѻ90Μ$љ!0!ɢ3%,H CB!/:byK!0 :{HrJ6&:ʉcD(?DQ&G1b6G#.`cDgF (:P?$%(e#5ȧlƑ!r6| lA!0A lR9 R1QIHD.)"c1s`Nb`cDgJ1"$13x Rc1A :^dLSD'dKVhKR:(s 13 a@Pl,0Re7EXGd<d%0˔geqKe2ienvD>z^ӗo?}ziYEY>O;~TgL/2z^/jO_~e(ߝ 7h>>y&Ih^n]ȬK;|/?a^d\0Wge|Y7NaGuii2˧sbף?levê-aU͋.fy.GNYIܖ1qb޼wC4'_IQ?(.l2nmYc|L#߇>&nr;+ &d6s%F­1D.oNq{uDݟ0X*bM+>:Vmgզ!qkW"0cAC q8gy-y$n+O$n|kgo_?a.hMԁM֦O_ - VɍKabx4TiUHB*whنl7.C,^pbr/8e,%qVW!^{&ڳeF_yN|ɆpaYmx+tՆUUۑG[5S򧲥>MrӕoוMre8uO |KXag?w8D)ڊRߖ_>8 -M -PMv9[${fi룤>3z1uO~xG(gFYӗhًM}R {a7@~u`XlqNUMi^N-mR&j]OoP4)Wd#$4vD͕ _Bf;>./\)4\崋[ZTjO-]ꔛwda<͵8*k+yJpⴃ+TMggd60N46xmQ[ {:v0|v,vtYl%L6Sijc-uM)ڧQ]ss凕-Tkgwnǖ;Fqj zWe*la+Vϵ.Fߪ]lv$)tqOFkNn,=*TjZk)PI~o[n]JH›b҄-l!!w1 #:}O -B;: -pcs],Æb<^]nH?qTq81%<4){ -%É36*CkRSr줙^#} ;4Bw ̎MW4`89ceώ^}Q9PiKM0JT޾ݸm5κS[ECQS}t~PeNkhBŮb:jiyJ)ydGVVۭ͖MxtG;%,g7iHúZm0BW$߇{ե׏B"sNQr DV!F|}HX2~{Txm%!=o^@LWnҥ"o,A^ ;wW -endstream -endobj -38 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 37 0 R -/Resources 4 0 R -/Annots [ 39 0 R 40 0 R 41 0 R 42 0 R 43 0 R 44 0 R 45 0 R 46 0 R 47 0 R 48 0 R 49 0 R 50 0 R 51 0 R 52 0 R 53 0 R 54 0 R 55 0 R 56 0 R 57 0 R 58 0 R 59 0 R 60 0 R 61 0 R 62 0 R 63 0 R 64 0 R 65 0 R 66 0 R 67 0 R 68 0 R 69 0 R 70 0 R 71 0 R 72 0 R 73 0 R 74 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -39 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 790.370079 498.679134 766.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) ->> -endobj -40 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 769.970079 491.179134 754.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) ->> -endobj -41 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 750.770079 498.679134 727.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -42 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 730.370079 491.179134 715.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -43 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 711.170079 498.679134 687.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -44 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 690.770079 491.179134 675.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -45 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 671.570079 498.679134 648.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -46 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 651.170079 491.179134 636.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -47 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 631.970079 498.679134 608.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -48 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 611.570079 491.179134 596.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -49 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 592.370079 498.679134 568.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -50 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 571.970079 491.179134 556.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -51 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 552.770079 498.679134 529.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -52 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 532.370079 491.179134 517.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -53 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 513.170079 498.679134 489.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) ->> -endobj -54 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 492.770079 491.179134 477.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) ->> -endobj -55 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 473.570079 498.679134 450.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -56 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 453.170079 491.179134 438.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -57 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 433.970079 498.679134 410.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated) ->> -endobj -58 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 413.570079 491.179134 398.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated) ->> -endobj -59 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 394.370079 504.679134 361.670079 ] -/BS << -/W 0 ->> -/Dest (api-server) ->> -endobj -60 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.982112 386.420079 496.429134 371.420079 ] -/BS << -/W 0 ->> -/Dest (api-server) ->> -endobj -61 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 343.670079 498.679134 320.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---anonymous-auth-argument-is-set-to-false-automated) ->> -endobj -62 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 323.270079 491.179134 308.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---anonymous-auth-argument-is-set-to-false-automated) ->> -endobj -63 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 304.070079 498.679134 280.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---basic-auth-file-argument-is-not-set-automated) ->> -endobj -64 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 298.670079 491.179134 283.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---basic-auth-file-argument-is-not-set-automated) ->> -endobj -65 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 264.470079 498.679134 241.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---token-auth-file-parameter-is-not-set-automated) ->> -endobj -66 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 259.070079 491.179134 244.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---token-auth-file-parameter-is-not-set-automated) ->> -endobj -67 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 224.870079 498.679134 201.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubelet-https-argument-is-set-to-true-automated) ->> -endobj -68 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 219.470079 491.179134 204.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubelet-https-argument-is-set-to-true-automated) ->> -endobj -69 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 185.270079 498.679134 161.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated) ->> -endobj -70 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 164.870079 491.179134 149.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated) ->> -endobj -71 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 145.670079 498.679134 122.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated) ->> -endobj -72 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 125.270079 491.179134 110.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated) ->> -endobj -73 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 106.070079 498.679134 82.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated) ->> -endobj -74 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 85.670079 491.179134 70.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated) ->> -endobj -75 0 obj -<< -/Filter /FlateDecode -/Length 3492 ->> -stream -x\ێ}gIV1"m`ր~⥻53ӽ 6JR:: {S8R4'>~yq~!dWϦ>b fhsb Yz̩2|ձ-Zf@V&s|Vf`ŞQhb`UVGWK*aNҫСfK*:FBcTWg1lUL 0`UV'<0Vg.K*:!ҫ -XzUաҫ -΅ҫ -,>{Lk߰njY20e)KVFⴜ"&9u zcZPmU\|l{ar?[W/}n{&[4dwv_|q#wU]=Ow_~_>a{%Pœ S>_=,`^nɤ~oQ{kx#>=PJ7D*CXb16- edQ[n9&嶌̕7*1Q{CAM&z27ccz|GHyHLS%CƲڼy<7x|u^ "^yf#XwlG{j̥-4t8Hjo{~th6L=DV~suFn5}T~;V$CmwϏiG5̵Z-W.g(p4 Z%\SvY%洼%.Ʋˋ>P3/W/&i*!sرm}v}3ֵǺL/cx'8[_ײGsúڷ&z,hjO[;?R_GH L,uX\^Ui}ε Ϝ|sZ?N(hig?>` ˻z@ -n\_5?7?fo_z2s5 zIŴ0Ÿq8~c۫x #L\޻eֽԛ"h;&\tavaM 7Nxtn}ڴm}(Vi] twG:A6ٳ$Փǩ9^55|z5f]<)}0uwq94sgbv7a)l|n] sڍM0$aii1ڳSPcmUR" =7Jt"_?cgsyd1R9F>l&c)s(WZou<)_8ݏ[yxR]^Oݪ~  ICq\x)eluJ_(2Ek; :k2{rI-WSkS=s[z~=9Z+B}7שhA!6tO3 -endstream -endobj -76 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 75 0 R -/Resources 4 0 R -/Annots [ 77 0 R 78 0 R 79 0 R 80 0 R 81 0 R 82 0 R 83 0 R 84 0 R 85 0 R 86 0 R 87 0 R 88 0 R 89 0 R 90 0 R 91 0 R 92 0 R 93 0 R 94 0 R 95 0 R 96 0 R 97 0 R 98 0 R 99 0 R 100 0 R 101 0 R 102 0 R 103 0 R 104 0 R 105 0 R 106 0 R 107 0 R 108 0 R 109 0 R 110 0 R 111 0 R 112 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -77 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 790.370079 498.679134 766.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-includes-node-automated) ->> -endobj -78 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 769.970079 491.179134 754.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-includes-node-automated) ->> -endobj -79 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 750.770079 498.679134 727.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-includes-rbac-automated) ->> -endobj -80 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 730.370079 491.179134 715.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-includes-rbac-automated) ->> -endobj -81 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 711.170079 498.679134 687.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-eventratelimit-is-set-automated) ->> -endobj -82 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 690.770079 491.179134 675.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-eventratelimit-is-set-automated) ->> -endobj -83 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 671.570079 498.679134 648.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) ->> -endobj -84 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 651.170079 491.179134 636.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) ->> -endobj -85 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 631.970079 498.679134 608.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) ->> -endobj -86 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 611.570079 491.179134 596.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) ->> -endobj -87 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 592.370079 498.679134 568.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) ->> -endobj -88 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 571.970079 491.179134 556.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) ->> -endobj -89 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 552.770079 498.679134 529.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) ->> -endobj -90 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 532.370079 491.179134 517.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) ->> -endobj -91 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 513.170079 498.679134 489.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) ->> -endobj -92 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 492.770079 491.179134 477.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) ->> -endobj -93 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 473.570079 498.679134 450.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) ->> -endobj -94 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 453.170079 491.179134 438.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) ->> -endobj -95 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 433.970079 498.679134 410.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) ->> -endobj -96 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 413.570079 491.179134 398.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) ->> -endobj -97 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 394.370079 498.679134 370.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) ->> -endobj -98 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 373.970079 491.179134 358.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) ->> -endobj -99 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 354.770079 498.679134 331.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---insecure-port-argument-is-set-to-0-automated) ->> -endobj -100 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 349.370079 491.179134 334.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---insecure-port-argument-is-set-to-0-automated) ->> -endobj -101 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 315.170079 498.679134 291.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) ->> -endobj -102 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 309.770079 491.179134 294.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) ->> -endobj -103 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 275.570079 498.679134 252.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated) ->> -endobj -104 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 270.170079 491.179134 255.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated) ->> -endobj -105 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 235.970079 498.679134 212.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-path-argument-is-set-automated) ->> -endobj -106 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 230.570079 491.179134 215.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-path-argument-is-set-automated) ->> -endobj -107 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 196.370079 498.679134 172.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated) ->> -endobj -108 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 175.970079 491.179134 160.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated) ->> -endobj -109 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 156.770079 498.679134 133.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated) ->> -endobj -110 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 136.370079 491.179134 121.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated) ->> -endobj -111 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 117.170079 498.679134 93.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated) ->> -endobj -112 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 96.770079 491.179134 81.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated) ->> -endobj -113 0 obj -<< -/Filter /FlateDecode -/Length 3624 ->> -stream -x\݋6￢QTRUIAA}rn1Wr[R.Lf703]TOIV^~\%1O%3!'w|DΗP i:ggYqybX"( zaffaT!LH!̔$?!̈d9P PbO &z " ,bA1bN 1c6'bE "1"3 ,2#lOc&Fj`>eD7.JcQʠxfE RC BB`cX0?(u0X?(uP9JJ@mȌD:(D#2G1:(9:$P`6Fd?(u0PlLvP('Ǥ8)#Tv)JA6Fdf1:(2?$uP@`cDX<CR!B1"C6ibHꠌGƈ^2?2Βa>fLxpYܲZ43YhZG'3t?/i Hœx*rxRLZmkV ΜܳqdшIх"\@钪>4=[[XZwjPO % zU #-.yU+jQij]ߧx%}2^!lAѳ0ȵ\aPv/ʥU aEu}ޕXv޼P\xKK^(ןt>xBj KG -P|@w+t_B%D_B j[rjƼA׌Vs]ӧM XR`0098Ă,L xzH(:70QTȐ9͸>34dN>zC$N02.2Y2G2°+PPg o y"bl`Z 08%4%s.ђ9I9QR%ss&ddS4l}ySNr;9HbډK;cti'v;$w'v2I߉,9Ď8;%GNdQ;YrT؉,9*ĎHNQq'v(܉"9 -wbԇ;SCܝ)x'v=ɫ;S]ډ’Wwb՝)u;Er߉"9N;S$GN쀗$vG@ezu=Wc%_]pZo.̿_C9ob*2ޫz%~tÿ<7>W|b 糯7e@inL4mCL>94me_>=EGu=?oE7fv`>ځpg?z}[`سXo>ؑua۠yL:oTFCЈSDtd΋"L[mȭӧGx3?]俟F0t9u}?8hnk>fc~L͇L=dB2ص>o TiޜںOY ps߆ڰjSkڰ }㵰ȏO3_Yz.v:s9򚍍[%/)(}+ίq}j].9yi~ ?fXcBQ߃-0\N7'f@8_׹o1P|lˇjlR&՝;cj<;~eW5xަ8l[۝!c|I7ӽ[yEh6G]އ~LSR? z!`-,0ft )f*.oMЮ['S۫:Bv~5mҙ/7Yus+D\{_Is&:8q,5v07%("]jn%KÆ~XckՁ2ÆiOi6^RW:-4֗4PS!AiTrE7(וՂ317GŽ+ B:Vq37Jǭi~2\=ڤ*iQB\-lpE<j޹"?(i -O41*AMֺ*Sk^h hf'/ܳi0 R}VK&+t;klAU*Sivc=y,нk -kR}Bd 98{kA;u=w>jroku7i*lxI[#|v1EIRF'r֞~8l?2"RZ_p'Ҷx}~uA֕,LKtbE CXjx*_ݏސ3(HCJ3dOZ[m3 -4I3I%';rǵ8JQ -%Սrʩj bVԍtWQ"ֶԉF8(uMPu3‚1n,YugE@ީ;V=St^sⱞ꼢9#4'G5fFBEߖ15xeq^RcAYkUI[ox};;?},WhThmVm8126B>+='vV7K!o&C<:̒C))aVk#O^,^i%%1LڣO !£\(+ڥ)`k_.ViSE*y7fedb9 -endstream -endobj -114 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 113 0 R -/Resources 4 0 R -/Annots [ 115 0 R 116 0 R 117 0 R 118 0 R 119 0 R 120 0 R 121 0 R 122 0 R 123 0 R 124 0 R 125 0 R 126 0 R 127 0 R 128 0 R 129 0 R 130 0 R 131 0 R 132 0 R 133 0 R 134 0 R 135 0 R 136 0 R 137 0 R 138 0 R 139 0 R 140 0 R 141 0 R 142 0 R 143 0 R 144 0 R 145 0 R 146 0 R 147 0 R 148 0 R 149 0 R 150 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -115 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 790.370079 498.679134 766.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) ->> -endobj -116 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 769.970079 491.179134 754.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) ->> -endobj -117 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 750.770079 498.679134 727.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) ->> -endobj -118 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 730.370079 491.179134 715.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) ->> -endobj -119 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 711.170079 498.679134 687.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) ->> -endobj -120 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 690.770079 491.179134 675.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) ->> -endobj -121 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 671.570079 498.679134 648.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) ->> -endobj -122 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 651.170079 491.179134 636.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) ->> -endobj -123 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 631.970079 498.679134 608.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) ->> -endobj -124 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 611.570079 491.179134 596.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) ->> -endobj -125 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 592.370079 498.679134 568.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) ->> -endobj -126 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 571.970079 491.179134 556.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) ->> -endobj -127 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 552.770079 498.679134 529.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) ->> -endobj -128 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 532.370079 491.179134 517.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) ->> -endobj -129 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 513.170079 498.679134 489.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) ->> -endobj -130 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 492.770079 491.179134 477.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) ->> -endobj -131 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 473.570079 498.679134 450.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-encryption-providers-are-appropriately-configured-automated) ->> -endobj -132 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 453.170079 491.179134 438.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-encryption-providers-are-appropriately-configured-automated) ->> -endobj -133 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 433.970079 498.679134 410.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated) ->> -endobj -134 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 413.570079 491.179134 398.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated) ->> -endobj -135 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 394.370079 504.679134 361.670079 ] -/BS << -/W 0 ->> -/Dest (controller-manager) ->> -endobj -136 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 483.326107 386.420079 496.429134 371.420079 ] -/BS << -/W 0 ->> -/Dest (controller-manager) ->> -endobj -137 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 343.670079 498.679134 320.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) ->> -endobj -138 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 323.270079 491.179134 308.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) ->> -endobj -139 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 304.070079 498.679134 280.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-1) ->> -endobj -140 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 298.670079 491.179134 283.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-1) ->> -endobj -141 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 264.470079 498.679134 241.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) ->> -endobj -142 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 244.070079 491.179134 229.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) ->> -endobj -143 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 224.870079 498.679134 201.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) ->> -endobj -144 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 204.470079 491.179134 189.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) ->> -endobj -145 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 185.270079 498.679134 161.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) ->> -endobj -146 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 164.870079 491.179134 149.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) ->> -endobj -147 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 145.670079 498.679134 122.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) ->> -endobj -148 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 125.270079 491.179134 110.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) ->> -endobj -149 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 106.070079 498.679134 82.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) ->> -endobj -150 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 85.670079 491.179134 70.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) ->> -endobj -151 0 obj -<< -/Filter /FlateDecode -/Length 3789 ->> -stream -x][ ~_1B-@,zE6IKٖHٲ|ٴh|gw"%%j󩡿"c -.Z3I4oW|ɸ뇋Ѥ('}cPHO\~M|b ä)heְ7 -`y,+xb%՜1H &"qmf n I]?7}=`"t:lowϸJCubuqmo` %ںpNFlL.\~[]2Rɇ>Iwi''cp㯞>tlҌwFs$IȇO{W{4=xWO{ƄZ-ȸq^#\)*3Ws]#VAD\p2*a¨2(Mv$h29[#"Di Ad20CZʪ#ZJ#Z^ F\c4p +=o}6otf7ϸ( g,X64B~it& allԥ/c7#<$p8qNmN#G}TQcQ„ѸQyhG}N336q>Z?bL[L 2 Aܗ ֎d43\H1 ଆAR`ͨN+QW#Qz b -۫2*pV;੺p*;w 1w Q:@:jwj=RAQ;H5pFwjpj<;H5pFz w(-(WĹ+pSR;j>eFP*+{O5pSrTw<(8=bAl{8ş)CRs"mvBonzPwoo2.2|+g1\򕸷)Z@omoUܼ4Hݶa̞ ,- -3<5G~s݉㖮6*nNlA..[h#7S}bS^u((#qRI E_)PO3zIѓ'E?ETGݓ'EOj+iCͦ|/Fϗ̻8nʋF\\l!xۑ @_& 0iJ?g{ Խ):F-nuՌZQs0z5?E,QqQ.J8h hV7US 5Uqd"{`˪$-kX[QaS5Wq;q2qS5#nN\ \(6f'u:N1;ݧe$N=) 6iF;#:)zRGh/t{RIW-t%mB#(x$yzkv18^!)L>\o?F"廨灁wRɤ7.w_H޼swW߾!iV[Q,d({o[ -4FAKMML~5z0_ڬgc30nENh{nm ogIǓ- ̰_l弰vKle\S,,2X}93}TgvWX0?Osϭ_wǡKՂ BXSdf/1K݄PtrS"[Gp._3?Dgc&F1T۾ϗAAm2n:/eyrx͖Q:E(M~SEgd}TiyheoAߧ>]u/RTcRY"kLW/^{Fްj|cޔ8B1GC#e4ͱo_WXU m*]4βZs6?K V;\>f|W eL@:e2^3JH35uȯ=A/>@f32GL=NsP&58cs˲ܡ\jz?fQ,-:vcMх =G _ccZk\Pm6uru2}lו]\4NŐ@\]P!wΧ[K#RZ|((jwn-732;ˆG}.sa&W$_YDsx1퓔 Mr^򹷤rcJ Q<~0Z̒\Jm6s`2E"Q bP;m> -endobj -153 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 790.370079 504.679134 757.670079 ] -/BS << -/W 0 ->> -/Dest (scheduler) ->> -endobj -154 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.309749 782.420079 496.429134 767.420079 ] -/BS << -/W 0 ->> -/Dest (scheduler) ->> -endobj -155 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 739.670079 498.679134 716.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-2) ->> -endobj -156 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 734.270079 491.179134 719.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-2) ->> -endobj -157 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 700.070079 498.679134 676.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) ->> -endobj -158 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 679.670079 491.179134 664.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) ->> -endobj -159 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 660.470079 504.679134 627.770079 ] -/BS << -/W 0 ->> -/Dest (etcd-node-configuration-files) ->> -endobj -160 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.237972 652.520079 496.429134 637.520079 ] -/BS << -/W 0 ->> -/Dest (etcd-node-configuration-files) ->> -endobj -161 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 609.770079 498.679134 586.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) ->> -endobj -162 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 589.370079 491.179134 574.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) ->> -endobj -163 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 570.170079 498.679134 546.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) ->> -endobj -164 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 564.770079 491.179134 549.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) ->> -endobj -165 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 530.570079 498.679134 507.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) ->> -endobj -166 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 525.170079 491.179134 510.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) ->> -endobj -167 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 490.970079 498.679134 467.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) ->> -endobj -168 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 470.570079 491.179134 455.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) ->> -endobj -169 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 451.370079 498.679134 427.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) ->> -endobj -170 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 430.970079 491.179134 415.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) ->> -endobj -171 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 411.770079 498.679134 388.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) ->> -endobj -172 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 406.370079 491.179134 391.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) ->> -endobj -173 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 372.170079 498.679134 348.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated) ->> -endobj -174 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 351.770079 491.179134 336.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated) ->> -endobj -175 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 332.570079 504.679134 299.870079 ] -/BS << -/W 0 ->> -/Dest (authentication-and-authorization) ->> -endobj -176 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.986019 324.620079 496.429134 309.620079 ] -/BS << -/W 0 ->> -/Dest (authentication-and-authorization) ->> -endobj -177 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 281.870079 498.679134 258.470079 ] -/BS << -/W 0 ->> -/Dest (client-certificate-authentication-should-not-be-used-for-users-manual) ->> -endobj -178 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 261.470079 491.179134 246.470079 ] -/BS << -/W 0 ->> -/Dest (client-certificate-authentication-should-not-be-used-for-users-manual) ->> -endobj -179 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 242.270079 504.679134 209.570079 ] -/BS << -/W 0 ->> -/Dest (logging) ->> -endobj -180 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.506282 234.320079 496.429134 219.320079 ] -/BS << -/W 0 ->> -/Dest (logging) ->> -endobj -181 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 191.570079 498.679134 168.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-a-minimal-audit-policy-is-created-automated) ->> -endobj -182 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 186.170079 491.179134 171.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-a-minimal-audit-policy-is-created-automated) ->> -endobj -183 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 151.970079 498.679134 128.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-audit-policy-covers-key-security-concerns-manual) ->> -endobj -184 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 146.570079 491.179134 131.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-audit-policy-covers-key-security-concerns-manual) ->> -endobj -185 0 obj -<< -/Filter /FlateDecode -/Length 3766 ->> -stream -x\[~ׯslxrH m}8VqZwt.:'n#9h%7?RHÇǝ8xɿݔMcbv5$*f1rDg$@4bfȶuo':6[Ó y4uڊ܄ "*rk\Cw+)˾ȲRl{M_7+ҿimN"Dp;әpe~a.f2̿ 6t*,4Jvl.nCv> /o~qŝ6'Jm$Iv~to>c7HXV#򖐷JBﱻխ4-:!']n}#\SrؙA9R0_ޭ0tL'.F VÀs`F \0^ǀ3ygIU1]6&ipv@6! c0`,8Uô}0AɦH*ƻr4Lq!ď LV1'ĘC -#7(]*&sq m*&I.+1X&ɨ2Y{&NsR18+]L 1+=8T sD^p skpf%~|g獊blYlRR1 f3%~|Š)짜8$%JJ`˜2{bK1"5 8lUYQ1X)'%~ȃb8cP11%%(35)Cd*%`0xU1 ?gVrRIÄ -Y[ -. +,8D*Ɓ aI0xk٪gk +*& ob%B"Y8'U XyȤb8Gc&˳gV@̈́P5Q3{4gGi2G%~g TgCT'rtY6Bg2['W c#1.k ]&DdGEʀэι]3t(f (+1X [/M#dOϺB: - J5N^ɹҋ Rc{ +?嫐S8+9mI?ijed|U.hWҕ^V~db46Rw;WV-Eo)zOl+n)zK[PSݭԽ-Eo)<!^ƥ(3\vthu<|}R‰[yd)%H?\BG8Jјqfpƙ`sg<2d[Jy6k3zN 8B -d^a,8}r_ -gp >jKi(4>8S(%LPʆXxbN}46R6t% 3 M -KІVaR)F>zb<IB/-1l4U8cS8g S8ge{yqQ8czyqlbggc}8c iCyiC"&8c8c83893=i8D9sp gcXYi X2y(X>VAg"ڳ (a ߬=8~#ƃGg"oݿocy~/aq㕿7߿EG>ȳJ~o9NX -?^WC. Hnr/*"EU9*$=o X4gط<T!g*GmX&0̯r=SEr*rWxl/'sUW^qR rŜ]4{k@X+}_͝]D&{C-S\s~~F tݨ ->uP|Sp'&䪟lYh:džZ~LSߊ 4G$ p*sJLOWb9zo'K9US!5\W~e!0T->δµu%+s<[-mБئ 5:77}bHfPJa6bBY/,Ċm#\xƗ++\2{/{% -/KN4ąBaV4K@J%?IWK\mDeVv]e(hLv1Y4 H?9rPmjo{)m+6፥~˶}-"|[ Z]ԛ- RօM*k=rf,J]t^iF + [+^- -2tdK,MJ\7uv/AH;Sӛ3濧jU -0 jߗ2)F!T~ސ)ȣŒH-HMpްEmPǍ|jFlCz64~O~\j\!2ٲ| -endstream -endobj -186 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 185 0 R -/Resources 4 0 R -/Annots [ 187 0 R 188 0 R 189 0 R 190 0 R 191 0 R 192 0 R 193 0 R 194 0 R 195 0 R 196 0 R 197 0 R 198 0 R 199 0 R 200 0 R 201 0 R 202 0 R 203 0 R 204 0 R 205 0 R 206 0 R 207 0 R 208 0 R 209 0 R 210 0 R 211 0 R 212 0 R 213 0 R 214 0 R 215 0 R 216 0 R 217 0 R 218 0 R 219 0 R 220 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -187 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 790.370079 504.679134 757.670079 ] -/BS << -/W 0 ->> -/Dest (worker-node-configuration-files) ->> -endobj -188 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.434505 782.420079 496.429134 767.420079 ] -/BS << -/W 0 ->> -/Dest (worker-node-configuration-files) ->> -endobj -189 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 739.670079 498.679134 716.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -190 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 719.270079 491.179134 704.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -191 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 700.070079 498.679134 676.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) ->> -endobj -192 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 679.670079 491.179134 664.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) ->> -endobj -193 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 660.470079 498.679134 637.070079 ] -/BS << -/W 0 ->> -/Dest (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -194 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 640.070079 491.179134 625.070079 ] -/BS << -/W 0 ->> -/Dest (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -195 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 620.870079 498.679134 597.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-automated) ->> -endobj -196 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 600.470079 491.179134 585.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-automated) ->> -endobj -197 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 581.270079 498.679134 557.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -198 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 560.870079 491.179134 545.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -199 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 541.670079 498.679134 518.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -200 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 521.270079 491.179134 506.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -201 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 502.070079 498.679134 478.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -202 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 481.670079 491.179134 466.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -203 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 462.470079 498.679134 439.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) ->> -endobj -204 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 442.070079 491.179134 427.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) ->> -endobj -205 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 422.870079 498.679134 399.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) ->> -endobj -206 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 402.470079 491.179134 387.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) ->> -endobj -207 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 383.270079 498.679134 359.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) ->> -endobj -208 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 362.870079 491.179134 347.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) ->> -endobj -209 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 343.670079 504.679134 310.970079 ] -/BS << -/W 0 ->> -/Dest (kubelet) ->> -endobj -210 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 484.911067 335.720079 496.429134 320.720079 ] -/BS << -/W 0 ->> -/Dest (kubelet) ->> -endobj -211 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 292.970079 498.679134 269.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) ->> -endobj -212 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 272.570079 491.179134 257.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) ->> -endobj -213 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 253.370079 498.679134 229.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) ->> -endobj -214 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 232.970079 491.179134 217.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) ->> -endobj -215 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 213.770079 498.679134 190.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) ->> -endobj -216 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 193.370079 491.179134 178.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) ->> -endobj -217 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 174.170079 498.679134 150.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---read-only-port-argument-is-set-to-0-automated) ->> -endobj -218 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 168.770079 491.179134 153.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---read-only-port-argument-is-set-to-0-automated) ->> -endobj -219 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 134.570079 498.679134 111.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) ->> -endobj -220 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 114.170079 491.179134 99.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) ->> -endobj -221 0 obj -<< -/Filter /FlateDecode -/Length 4001 ->> -stream -x\K$ sE @FX֝];PzTYҳ*%RHR=/Йr x|>$)7c -:jlISGET0e0 O!a h0Md$Ɖ%0D&)z9arR6sƤ -샜2!$S <)pFTxSV0>lGYVxq$ξO .h6 2sf` i)q,“s&2!DWY>LFG>B3<?= -G>BwuW37.袟 hY7kk -hbԶ'AZ,>@rlM"oU ^B[t1 ;.YU|qp#g{f?W1O6^ˡn+0 _ugabi11lZor"bamWc:VX r[o~`ꘔ)/,Gw[^ym?WYlq^*Nar#!/jw矋?޿q%F~m;1g31j_ ;ʷj]xO3]7 X5>~[=*]ԽKwu\5ߍ9YcqWxa~kV`}VK  - V4jҌĜT(+e? OjFj=T͠*ҽ F͐,`_V[nqh[gΎ9Zv{lDsxnOxxjwYQ $}o|=6~ -(>J-sļ[=lג'mj5$OTzW#WGy9^m:Ey(8pIji8_UelJd+Yɿm}n$ݰaV i qk;mf ]\6m>.m@3Q2b٩}[&lˀe -0w6U[{Bw%btVBh "h7y6՞P?@yq02O7ͫpSn,v,O-͓LѪgsL{+p"fk9jL}/nrġ,IB2q).$h8Ų|t/~ӚƄ2Ix>P~ ]hK~b S?<\;c|y~nם<Nxs{:zn]L7{"H }Gs;{t=~UiPn~ )Ɗ1a_O}-_>w*'r8|5? -*h'S>lfqH) -_dQFS?fe׍Bѭ:F'>_^w^U- -N}>B oNiX9/n;,"|/rFhW'G5fPl6Qt4ht -Y324R5Š$-MnDoxZ"q^K -֝7^6e,C0*S;юE%3}qƵ -qoa a=s.NٗOWS$F>Yi%Rvoc;P/DW5fNi8|b7}XSM=6>mi -endstream -endobj -222 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 221 0 R -/Resources 4 0 R -/Annots [ 223 0 R 224 0 R 225 0 R 226 0 R 227 0 R 228 0 R 229 0 R 230 0 R 231 0 R 232 0 R 233 0 R 234 0 R 235 0 R 236 0 R 237 0 R 238 0 R 239 0 R 240 0 R 241 0 R 242 0 R 243 0 R 244 0 R 245 0 R 246 0 R 247 0 R 248 0 R 249 0 R 250 0 R 251 0 R 252 0 R 253 0 R 254 0 R 255 0 R 256 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -223 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 790.370079 498.679134 766.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) ->> -endobj -224 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 769.970079 491.179134 754.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) ->> -endobj -225 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 750.770079 498.679134 727.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) ->> -endobj -226 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 730.370079 491.179134 715.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) ->> -endobj -227 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 711.170079 498.679134 687.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---hostname-override-argument-is-not-set-manual) ->> -endobj -228 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 705.770079 491.179134 690.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---hostname-override-argument-is-not-set-manual) ->> -endobj -229 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 671.570079 498.679134 648.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-automated) ->> -endobj -230 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 651.170079 491.179134 636.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-automated) ->> -endobj -231 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 631.970079 498.679134 608.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) ->> -endobj -232 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 611.570079 491.179134 596.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) ->> -endobj -233 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 592.370079 498.679134 568.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated) ->> -endobj -234 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 571.970079 491.179134 556.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated) ->> -endobj -235 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 552.770079 498.679134 529.370079 ] -/BS << -/W 0 ->> -/Dest (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) ->> -endobj -236 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 532.370079 491.179134 517.370079 ] -/BS << -/W 0 ->> -/Dest (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) ->> -endobj -237 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 513.170079 498.679134 489.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-automated) ->> -endobj -238 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 492.770079 491.179134 477.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-automated) ->> -endobj -239 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 473.570079 504.679134 440.870079 ] -/BS << -/W 0 ->> -/Dest (rbac-and-service-accounts) ->> -endobj -240 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 478.154476 465.620079 496.429134 450.620079 ] -/BS << -/W 0 ->> -/Dest (rbac-and-service-accounts) ->> -endobj -241 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 422.870079 498.679134 399.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) ->> -endobj -242 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 402.470079 491.179134 387.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) ->> -endobj -243 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 383.270079 498.679134 359.870079 ] -/BS << -/W 0 ->> -/Dest (minimize-access-to-secrets-manual) ->> -endobj -244 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 377.870079 491.179134 362.870079 ] -/BS << -/W 0 ->> -/Dest (minimize-access-to-secrets-manual) ->> -endobj -245 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 343.670079 498.679134 320.270079 ] -/BS << -/W 0 ->> -/Dest (minimize-wildcard-use-in-roles-and-clusterroles-manual) ->> -endobj -246 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 338.270079 491.179134 323.270079 ] -/BS << -/W 0 ->> -/Dest (minimize-wildcard-use-in-roles-and-clusterroles-manual) ->> -endobj -247 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 304.070079 498.679134 280.670079 ] -/BS << -/W 0 ->> -/Dest (minimize-access-to-create-pods-manual) ->> -endobj -248 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 298.670079 491.179134 283.670079 ] -/BS << -/W 0 ->> -/Dest (minimize-access-to-create-pods-manual) ->> -endobj -249 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 264.470079 498.679134 241.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-default-service-accounts-are-not-actively-used.-automated) ->> -endobj -250 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 244.070079 491.179134 229.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-default-service-accounts-are-not-actively-used.-automated) ->> -endobj -251 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 224.870079 498.679134 201.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) ->> -endobj -252 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 204.470079 491.179134 189.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) ->> -endobj -253 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 185.270079 504.679134 152.570079 ] -/BS << -/W 0 ->> -/Dest (pod-security-policies) ->> -endobj -254 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 478.622493 177.320079 496.429134 162.320079 ] -/BS << -/W 0 ->> -/Dest (pod-security-policies) ->> -endobj -255 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 134.570079 498.679134 111.170079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-privileged-containers-manual) ->> -endobj -256 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 129.170079 491.179134 114.170079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-privileged-containers-manual) ->> -endobj -257 0 obj -<< -/Filter /FlateDecode -/Length 3764 ->> -stream -x]m$>b>,K*1Đl6y%&>k8C~J=z)uճwg~ZUGU%iz{Y'Q!D|y:?iI"ѝ,/1^m8 -#DcOwA+p8E+|vyܔ9[%_~"71/[5ƉSޣ1n_$ - lj -*Y31 ~&T&2*ZG0R*F(LdxXi=A4: 7PT:3{)Qb}M(.)üۙ=*idfFR{@!pʶ(kDX搝&*NH蜟p -(qf -I=*> Q:!RdٓNE~)G*V1`f3fR˳$Ɖ%qlMpjYjbՑ3&9pcS&0=93Y8#NdiCpjmT8csfz"Cs&qxΙ`̇0z9ӱf2sL? hg93&29g"/Zs4\Uf2sfz)IO8EI`grLl"c5LSs&jك ->1p \Z&23 pfӜ39N8ETaij gĪ4 A/3¾Y)Mc$O_<N>[DK)$buyC[;L^MIw8wt}88zE/XB:lt4ehAxWa ɡו9jJH4EHnPU$mZ+U_]g Z0(;a00zEK'-]Tw& 4\$_WCO] ] ^~/ZiH. <5ChP'ۆ;\V橱{%!wC&*<+`|nTq |ף\FF2YG~v_E{9 y>~ΑmE/dõ:>Ƙq=z]kuEo{h"6vm~';r51=j92lXu^`g&ۢ\kh\hYl{X_$3tnxve?6/ڗ21};wFmi's>nުpI6^p6/S_/? G6=FgQu9*5gyb?H+/>X v-1Z}h:I>~|9'(Iщ2For>XGGu[m)_}83&.m 1eR{Pmql8604n[m=r~ehje/bZ+:l~e,|y9zq[>orvRy0۫jꁶd9c~50ʎ6 - e%KET:{IczbM: Yrc uAgJd[h#꺹M[߶Q[&~٭D4钒D-7N:6H݌N,(jRUG6B\" -Ӽ.W{9j{O)<|e<*Hhx5u"r=kd(G]-Ȟ2Vj^2( [<|HꇏV4A.Y{Lvȗ_ 0&Z6\KZˆX47j4@Wu]{ANRC;%NX&}Z ӷDS0;FG3Z\ A?Wl Px2gyT~Vקq,db5Pt=b~dX>um wMb$-M3JoT.prU+©֝+$PP6j -b3Av!l mA-5c0Yrn.]gEs^N֮! -bP bV+JEـ42s|Tb@P.F)_B47SP:~->(Gqj-=\ l) x"?+4'A+ڭpm4ԇ*͂5UPESY7]4 Ϛ$qWZ)M, }b:f e%C VEo Mhu@kl؋O%H͇:t_(h xYyNd^M+S[:48Ndw4l+g$%VSq!FT(Ͳ4 d?J*l%N4"2+. !F\kT;{F8^{6ٕHhM}hXBkv9ui9vs%xj[VĞmj݉ ,@R)SZ -EM}ˊ[|S4'iT'dmdSْ ٷ&Ya9yuEIڂmucT۳6C\vm$_^;[FRV u C?R`{i8y bo7K["eDjb:xn7*`>-)'ut " -endstream -endobj -258 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 257 0 R -/Resources 4 0 R -/Annots [ 259 0 R 260 0 R 261 0 R 262 0 R 263 0 R 264 0 R 265 0 R 266 0 R 267 0 R 268 0 R 269 0 R 270 0 R 271 0 R 272 0 R 273 0 R 274 0 R 275 0 R 276 0 R 277 0 R 278 0 R 279 0 R 280 0 R 281 0 R 282 0 R 283 0 R 284 0 R 285 0 R 286 0 R 287 0 R 288 0 R 289 0 R 290 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -259 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 790.370079 498.679134 766.970079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) ->> -endobj -260 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 769.970079 491.179134 754.970079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) ->> -endobj -261 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 750.770079 498.679134 727.370079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) ->> -endobj -262 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 730.370079 491.179134 715.370079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) ->> -endobj -263 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 711.170079 498.679134 687.770079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) ->> -endobj -264 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 690.770079 491.179134 675.770079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) ->> -endobj -265 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 671.570079 498.679134 648.170079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) ->> -endobj -266 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 651.170079 491.179134 636.170079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) ->> -endobj -267 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 631.970079 498.679134 608.570079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-root-containers-manual) ->> -endobj -268 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 626.570079 491.179134 611.570079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-root-containers-manual) ->> -endobj -269 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 592.370079 498.679134 568.970079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) ->> -endobj -270 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 571.970079 491.179134 556.970079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) ->> -endobj -271 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 552.770079 498.679134 529.370079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-added-capabilities-manual) ->> -endobj -272 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 532.370079 491.179134 517.370079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-added-capabilities-manual) ->> -endobj -273 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 513.170079 498.679134 489.770079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-capabilities-assigned-manual) ->> -endobj -274 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 492.770079 491.179134 477.770079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-capabilities-assigned-manual) ->> -endobj -275 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 473.570079 504.679134 440.870079 ] -/BS << -/W 0 ->> -/Dest (network-policies-and-cni) ->> -endobj -276 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 478.070980 465.620079 496.429134 450.620079 ] -/BS << -/W 0 ->> -/Dest (network-policies-and-cni) ->> -endobj -277 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 422.870079 498.679134 399.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-cni-in-use-supports-network-policies-manual) ->> -endobj -278 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 417.470079 491.179134 402.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-cni-in-use-supports-network-policies-manual) ->> -endobj -279 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 383.270079 498.679134 359.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-all-namespaces-have-network-policies-defined-automated) ->> -endobj -280 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 362.870079 491.179134 347.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-all-namespaces-have-network-policies-defined-automated) ->> -endobj -281 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 343.670079 504.679134 310.970079 ] -/BS << -/W 0 ->> -/Dest (secrets-management) ->> -endobj -282 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 478.118587 335.720079 496.429134 320.720079 ] -/BS << -/W 0 ->> -/Dest (secrets-management) ->> -endobj -283 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 292.970079 498.679134 269.570079 ] -/BS << -/W 0 ->> -/Dest (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) ->> -endobj -284 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 272.570079 491.179134 257.570079 ] -/BS << -/W 0 ->> -/Dest (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) ->> -endobj -285 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 253.370079 498.679134 229.970079 ] -/BS << -/W 0 ->> -/Dest (consider-external-secret-storage-manual) ->> -endobj -286 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 247.970079 491.179134 232.970079 ] -/BS << -/W 0 ->> -/Dest (consider-external-secret-storage-manual) ->> -endobj -287 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 213.770079 504.679134 181.070079 ] -/BS << -/W 0 ->> -/Dest (extensible-admission-control) ->> -endobj -288 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 478.131038 205.820079 496.429134 190.820079 ] -/BS << -/W 0 ->> -/Dest (extensible-admission-control) ->> -endobj -289 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 163.070079 498.679134 139.670079 ] -/BS << -/W 0 ->> -/Dest (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) ->> -endobj -290 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 142.670079 491.179134 127.670079 ] -/BS << -/W 0 ->> -/Dest (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) ->> -endobj -291 0 obj -<< -/Filter /FlateDecode -/Length 2232 ->> -stream -xZ݋$7q,r $w= G&#,YU]y_ɒ/\ρd&璢ӻɚ,4͠>7&4ņ8lbn~;%e_ '73OMSbԔd \1\&McDS+(Zœ8X!q&,a>cI Yf`5 I8ڭJt|Nǿ}:>]HaKNǁj'!3o74(hq Mѳs'4 &33}(ڼMPIx MLbyMH9b>q3]3}Pz*h.tS V ghbr9\r6M6Nc&݉yyYc&݉yQ<;1r;1OK2N;bw'uU@5ڔδvvK<s&/%*w22Vq`~x;}|?_N Wa-\@j ܝoBMA#;V{>o0:7vv]SmK{oQv?,jtx؀Uuͫžj|EԦڦu]8/ }- |$>2 Fsgx<[^xΏuq}Ƀ.vIvl0QkT3ڝ[C{TLjMݛz㎦K-!lrR%6TZ]Yzhq GezJW+&-ެx3sT_a͵ ޺>^u r}PM`,58G>~LŌ'hNPd!A_{!zҧF&Wg9?n'\~i&lc+JWs%^Mx[K *p]}=[arBQU聰8zM;wapVaZ%niQ.٥6(3-&3pHF/(`E+SJASCb;sˬ=9S+d3t2unA<*-?T^6ncF2qQC/p`_۬w2պ/SHa -84_2ДTóR]ԣD`z4xk$G:ӠU nlkjU&Sx*^-RR<0H \KGj-+A$/x$U)YXA8Jh8!zYyk~f!^B)p(FEa^* JˑdG;2:m]R_9=7iJ@Xd]x: J(*]PQ)^4* cԵaeqsp /rI3Rc~31> -endobj -293 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 790.370079 504.679134 757.670079 ] -/BS << -/W 0 ->> -/Dest (general-policies) ->> -endobj -294 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.986019 782.420079 496.429134 767.420079 ] -/BS << -/W 0 ->> -/Dest (general-policies) ->> -endobj -295 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 739.670079 498.679134 716.270079 ] -/BS << -/W 0 ->> -/Dest (create-administrative-boundaries-between-resources-using-namespaces-manual) ->> -endobj -296 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 719.270079 491.179134 704.270079 ] -/BS << -/W 0 ->> -/Dest (create-administrative-boundaries-between-resources-using-namespaces-manual) ->> -endobj -297 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 700.070079 498.679134 676.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) ->> -endobj -298 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 679.670079 491.179134 664.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) ->> -endobj -299 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 660.470079 498.679134 637.070079 ] -/BS << -/W 0 ->> -/Dest (apply-security-context-to-your-pods-and-containers-manual) ->> -endobj -300 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 655.070079 491.179134 640.070079 ] -/BS << -/W 0 ->> -/Dest (apply-security-context-to-your-pods-and-containers-manual) ->> -endobj -301 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 620.870079 498.679134 597.470079 ] -/BS << -/W 0 ->> -/Dest (the-default-namespace-should-not-be-used-automated) ->> -endobj -302 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 615.470079 491.179134 600.470079 ] -/BS << -/W 0 ->> -/Dest (the-default-namespace-should-not-be-used-automated) ->> -endobj -303 0 obj -<< -/Filter /FlateDecode -/Length 4723 ->> -stream -x\ێH}g"!E$ B<ۻB=H >'mgf}.rD:y"2첾*|/9=cpˏ5Eo1oU+'sHlb&mrx)`rv)F +%,)XPGgܞ3p$JPú힕1G -zhA5`xFO!e)/aStVƳƔj5eu[e5ybLt]|&@q LK.10)O.F`d?#4xF3 -xX ]V.Ak 0,gXC0,[fX`NpbX`6ǰrJaZ`' r ,P`Xu)0,]bXLʃ.`@d8*2,p],#ð^abe2))kr pDʋ֠eXc -,swWagQB`jxஶԌ&+3,@8LI+.Ix.`0,@TP^HaxRC.{fX[˰ wCCy&ðu xXdMXR0pWixJ̰ wKdXb!İ -N Âܔc BV䣼03, -ȢM(>yJHdYƃuy r(qb[Kn_X:<9qa7.9-Fe~ߩuy r޼y~\ɠG-w]S9,뎉dsA.s|:.zXh?̇ ;.1~0<qa_\5ay!ox3. ދ凑VE__0;{nyGKҥ_xqa_\5ayš`zg>\Y>b{{t!5 w7iœQoёe x-%3;.$W _.W;J ~~\{\7h+{<̎ ;{_,s;FN~~\{\7h{<̎ ;{_,~󀾟> Zr;N{ 'd\Vt՟~~|JߛR6i{KW7/4i<~VW2ulo9eV_W9^ZVʹ~C6+f;q-o9[~hVuàWSȶx2'nyX9;sm rױvM]w]}7`JQ<0Y/}~z_UPn|W-zΦ OW. r>SԷx=zϸ|͔$IznRܞgK+8yxv}lUEb뽺:,l" 1?ڋ?4yr^5伵r[o㓈ǦjlYL* -Sއm%PvVKbVK'Em0\+ c$u\ ڧa$.ɾ@zTbApMn'uygKӷ1_9-~dZĮ@;Z:P֏}{pӜޔ;2 -2Yei7][qZYf ۲DwN}1]?]u`#uCPݸ ٴ5 -mcVȼ7=a/Nm)U  SٞB$ОuF)₹k6YR^+l8eD9z+m)iy;GZ2Zg7#mkl{p]+SOo¿Ke ѩ% -h_RW]9;"W"wLZuy;W|!D׻ӲSz6a,[n[T4A#o -endstream -endobj -304 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 303 0 R -/Resources 4 0 R -/Annots [ 305 0 R 306 0 R 307 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -305 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 84.259843 740.570079 409.271317 725.570079 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://releases.rancher.com/documents/security/2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf) ->> ->> -endobj -306 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 351.653153 216.824079 461.230790 201.824079 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://www.cisecurity.org/benchmark/kubernetes/) ->> ->> -endobj -307 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 84.259843 201.824079 165.615800 186.824079 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://www.cisecurity.org/benchmark/kubernetes/) ->> ->> -endobj -308 0 obj -<< -/Filter /FlateDecode -/Length 3498 ->> -stream -x[Kϯ$2p 6Q9|n35|!ZԬXV8{|Wjm%]IzCoI๸Z^T\i)|MSw|vqL8GZ!y',&Wj)>dRrĔ V[lbAT8=@ n5Y,1VU!q tj# b -rɃ e(=[\-6W %Z<" ,^s9T-C|x -daeBɃ,xDh -Y]A}x\j5|-}ryKM2y()!K<ȒGGcJFFn,^,16yƷ fK , 8n-W -B ĖV, %qdaDɃ,,, ,2ܲo޲BLoaqfpfas iatRlawDi PR"f +.-,`n-,`n,H&8 YXݘ+swcF8xB]@E‚ ψi e p7T5 -4n-B‚E" pY-,;dhaABx wQ7$ .5yV X ;_$&88R`YXQ/˫+-VS3ʿ Fy槝h/'＝x~;{z;oöX?b:5w{'w9'{|oi} -Z2l ȿ%xC==Ēy䙒'M4EV撹ZǼe_(5G]nɡ#<y4V!GJ{ߡN00rzLwnO<~-p\ūSs esC n\(ZA4B|b){_)xvfE;;`9SM9[vcY+-Pr]:?L&X8`gGZ)4ʝ.9,WL/šZǼ0)io91M sߥP,6RP0H*c-7 >A78R93:Jdy}^c?|:,u |i,)p6ڥ>7^(w{e{嗏mF$&r%=Ӵ4{#Lqrީ](2^KH̖?)NY6NF6ֹ!u -T\(9p,ܻQ*ܙIA׎ڜMk -إ 󀴵l!wVIX6$W7e_ݟ է$&y("O^b[4?4~a?^n=*u)(.pTC{lNՅ(߸3;FC'L+6_~|? / UcM(B<\;XI>b̼G?0i.m=As؍Oc\_9o D,d8:[y5!k5Er ry#ئ8Dת o,ʜ/(}~jR哜1.砑Mj=Ax ]Ns?fsFÑxkA~liZ^u mCKT E"_4,UM#^Ng$.;-i&w_U!4M^ TIKɫZHlNQI'갥eU -L -tg况ULK HM8IX~!Г+_%g\,iλybU˴xS9AƷdq:Yg[) Fl︚Z*XԟTbVw}eޑfDJڝڝ_=g-Y Z֣'WOȶg ^U5,$1/ޭ^߄ BP(R^ a^pUW#yw%7"Ds8&%۳E^f鳇5on)'VkוBh6iU./~kү>3]B -endstream -endobj -309 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 308 0 R -/Resources 4 0 R -/Annots [ 310 0 R 311 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -310 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 84.259843 739.370079 128.273270 724.370079 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://kubernetes.io/docs/tasks/tools/) ->> ->> -endobj -311 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 345.193925 739.370079 356.281327 724.370079 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://stedolan.github.io/jq/) ->> ->> -endobj -312 0 obj -<< -/Filter /FlateDecode -/Length 3610 ->> -stream -x\ߋ$~b 'K/0C&Z\1[\GqoV]PHH3QX\!1 rlqA3eͅq +s w}V 5Z\-x7-.H]  (,.@~suMYsjqAW0)+,.;: EzodODdg= P ak4U#’w} -[2Y\6-.EX-.Up WvlqAn2|,;' @Y pa PXFZ\P"t-.(dkշ=.ps`2W%e`UKtm*dX\P -;`qR"-.;),.4PՈܒ"T`qAՠ5V2{Iڒ}frvR*Z\0NLiʠ hl`m).Zl7BMo .,.h>;)-.C-T7#[\f~[<#neo CŔAM͈[p`'KKllqAYo7/ Torx750%2MTރxSA}f 8yzry{y|ed^4Yl^5@Z0x'ܮ>KTP3kI6{ٌhv>/ ˕#$HAXذO0k+*Lrb/'c[ -v-`]p5ZЋ'l#)Ͷc8 ws&WIϡu,^Na?>5A*iM`8N,mu@vY]8bخ5Z[/ZekUs,Q²}mn|h[8-c yjPU>Tz<ێ4}(>499ԴeK*+w>~1Xvc1v@d)ۿK}fr>~yDiՌ!6|/| >3Wr/xY=r.E` ?ϯcLSvjBkːv2dm߭۰ }A!ʎ8 1f;nڵГՓW+uOѥ7k}׶rߗMr3|ڦlZ[&ﭷ+>‚`bޯ#,-lцwVQ}qJr~𛛬ja6Vn%yeeh^M76mp0bN7U~2%y؏nEՓVi]9_#f9mBs{966NZquێ;ւnLkĉD*++g(sum.;[[z譎o~yoHOvLo9 ݗI`o-[X]ױڎtw븱~ۖ`3]Zu49si3(1Bx8˲=<&;Vَ2fg[}tjuu8sGn٧72~|sy lC'cߟwIao|&|W6]e˒}7V8bgKkՊ^Z6$w?=yW ّC;˳ULa1l8q -V/CfWe߃W$&|= ؀',Տ8 vH4ٵuR 5>9?-Ϧ6@{VXޢQGyru<@^z5܄#w}u ~\M9 C(m -z:8SF3%U83CQ)ՀmjQSR2L/^ -ԁ*#䐦g]wljm1z*jUcb³QZp:AiأQИo*I Š `cui,ˌi2j- #&*VoTK4 -ݹrԒ>{<[Rǎcvmj<ɳ2thQ1c>`?˕P+9ל!,/)\եG둰| ~O[+O)=w|h#,/x[X."[Ey#I[5TG\>Y~r -endstream -endobj -313 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 312 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -314 0 obj -<< -/Filter /FlateDecode -/Length 3664 ->> -stream -x\Mϯ,V 0 @A4VݵҮ[XͰM> EȕRsɻ=-56E~s<"T -8\c|\/N^CjM7v죡PybC9d9 VK1K*-`HP`GUI,`PP -ޛ:" E`dTj.CG9X:fP$KW]J)K''K%t"\K‰P2[ ,֩ :`ɓb-"BK.G]-M6uXQ ]c5uK"tȹc],]:`[ , - -rK  NBNrfBNR'YDX$ ErMp 8 *X\ ,A -݊dqoSA-.`0.$0(T-.`p.;-.`.{SA,%Y\]xW:`[\vtL-..x(X\Yudq|ŅR ŋ !e5x7D }@AB?h1X\T5 rTj w`L]uaqcʎRD.[\bq8! "xҁw)ToqA"o!͑뚺|-- /`S,.;<Ex$$=X @eki$0z [:Z\6-.HYX\Yp q5dqA:|.9CAYX$H]Z,.X8 r  #p}`d\"䘰U-] -dе+Q gqdqR`[\w.Y\БX\+`X\PJ@fnXd[\L:" JdPLDh%ajK'^"ihq v`JS, 0?َ`&9X8n JMof d|TơJ `]~X\Pc-n+'of KDbIS5-8 MKX\PSfi#lwc3Y:.2dq -o"33[YtYꍈ摁"Ze|ud&v%P7 <8z4Q%CF,YY,}sj@?|{?/Cp~kd rK{&HSQZ\$B1m=/ Ċ,#M*抓Xf r=LɂXdl7zͷ3|ywWzLA?4^.;ˈy~~(&ykmMr"MxG~_kwimE^zx߲i}Zڧ_Ytrų}p :Kr0d7iHPjh[|սPUaewܴd߭m=:Umzi2Ode68S۴4 ~L۸_\\q}X}bgQS( 93P~A_igZ?|vJE*Gk;WO7;\am;ˬiV쭿FGF|">:PekGg~:,N6:iXrkftNcm_qI Y'ĶﶳE>;m=Ol `$pߎ->mlixB3c;-=dcoD󔯿~~ qح۬k>n;I#Dc;&>;mG=>eͯ'LoFL[&`(1o?"űO)~x)m#E=~O#EѕۑiDHGFߎ~ڍQtvs7kۗ];~zSθR[Yv~+ީf zw2+!Yj1M>v~=y2pˆ#@8mC7}󯩝m~1sZZslեvy{CrƕzmhS~hun٢Eh1v?\Hr#(THT)Mw1?'\o^ak)/;zcǛäP 7/2npj43L9ruҖz̷Qn̖^7 -´wz%|CYXD9^';)rar.R,r7՛#6Wž,ļ]~Hu?sOy*fn=?mI_=Ayi˱89H<@ Zt#t| -=Rs,UaYX5Ckm'Vͤ=3~3h{Y -۹:nw׾wmKnYy,~˪&Y< iŰt~=wj׷I{SanXR[kH~ -C| xDm ui &"_RUv>(UkdžW&:u*W㵔:fG2 IB?u7AGvhV7i:o /'t{)ZSͺwOjVOy2D!|[ӂi1쫰4G^zr2뭭>S*,? W o.SnF<[nS\2M8/(}%)fv\csYS]\!ͥ -K!VJKy/$ݥAQ⭑fy#H;r>;ۋ7+bdIk$c+u]ӹr q|/{g&w!N;gq3NVA۝| /K`X]N8Fgp) EVkg'}S}̊O%A؉I_,:uNr=}w[79+=ue3 L?TFؼ&qjRgPY 'q'Ί=y܌}-ra}Baex$JZuth%L07a60!NSG)saJ#C'#M72 -R` sBsuy_!TکKgiJ;R^i[1ZhwX䌥1R fe\VsdN[tobnzY32bZ)bH-YFC]mE-qOyΏ=,,WwdǾewi2qY<|=e/XrBeDŽ@-9i|I "vq2|5J'"d g?2dC>jȾzsHf__YZBuT5-.|+L1P,?CvƏ -endstream -endobj -315 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 314 0 R -/Resources 4 0 R -/Annots [ 316 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -316 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 205.473057 101.433071 186.723057 ] -/BS << -/W 0 ->> -/Dest (cb1-1) ->> -endobj -317 0 obj -<< -/Filter /FlateDecode -/Length 3947 ->> -stream -x\[d ~_UU I &<0yϧ:u;}4=dClRI:=~>/59|ˉL -o -gKL%pY>TKtWk7cΔ _{rJVWX!\ -+Z% FHJK bsYae9Yde1l IaY<B)<Lңs\\Qy <6XWL1dǐ%/@`IA9iY| kYS^, ExJfVy<)y {x֚*MI9)Y'9;)79CGNئԛIÂB4Y8xDQo:ְ~)fְxBOԛI% EQyISQz"dq5,(1J5,@zz$Lqp7 "3&2['oHtf3' {zf@_C2GaLKӧ*bfN`d3Ͷ_<}{ǏIY0~ϱb_7&m'H$GHe -iMD(F-E"E2SWƻyQ*X앏od:B݋/ {_wyuޫ;R'9=ռTEY;$2mz] -ڼ}^y;G yv# ":d 'o~>}?~ş1} -=N|-qeNmsWC^~CC&6zl4eч־}\ۖ趍J}kjǩzoǐ'4ioȢ.nu۸xSˏ(L ,[,fo<9"V58)QAwNnև!/*Zv87/YCc+id^7?;MAr$Se_= =,,| _Tf/AAO7Sn^}Z7S˼[.YcxVM -(@`rq3JIZT[{ѻvY|vzXKfw+zqku֎.sn wE>nhvYmk՚=*ʫ-RWf{s깲+mHFL-ՖGK>6-Qr va hGЏ ~л}8c7{X[q}Dr;Ďp0Ǻw{o]`7,w{Y-ui{Sןfj1tTT^/`_TZgu.{efg7)fޯC.ʼnos6[1aK֚~o2\jQ(ّTL[Plo')>9ӽi*=t/ibO {՚2궕D=e[̏R)rjҚZ>cAN5C/b|x>L n0=\L󋒜vXRn_ݦ6ߗ,yrB-khJT^f\r$6Մ7-n.e_2|hv)޲\& %f,21L *;a/H;vY.Kv{Ds]0ƴ*O떤Tu/nEq+x8_Q~/腢.k^WE{qu=y7h G{7ƴýܮ^2m}i/2}5=ul{1cmca9^6ezۇۺMؽS56ۆc]w+n'_g؆y!'ޯ"a`roߔR.;cCBzg搣$OGv#9Ov>Î"fK%;^_GR@PoiynXM^0rzc@ )|vNU}P e[|~Ws r])3;ƿ} mb},WS(fczl@g۷V3=V%` 墵n(!^4pt6Y!3Wc!qW 7rFv.HлCLn+DHՓ,/fU8pv|l=-p$2$;XyIb.N}U]ui[I>Tyծյh"T[ O -rRS욼s7$Jo.']-JU]KeC -%y,c)/v)I~:+P#/ri/rW\qo0mu\Q\oQHw|~?EzT!2sGUO)h0adž נ:@Ki gzcz|;t |w?|_7O?Mo|瘯KZ_o&%V"Sm_77c襦{o¶*XzuW_1D+:ʰ0^6f< "*݀?.ٻ 8-nOA/DڻH{[DؓˌiN*EoP@IY1zDn#56WKtc^k%4IW_v\y^cklǩ[Yc\읯% {Xwq|Z+|cʺ=mʫ+X9OS43rXh}Y)iks?8~(bw:mqK2/\h\~aHBFߋi3><.cqgu|t=|=f";i-Z/{-CfZs֘5xˤif1KF}[Nʡ/ych-iDWnuϮyrV ftOE~^=>Ǿ?m*JS~$S R;VDwA8BcN~^}>Ǿk.,Vcƺ.6^&M|~ -WԈ2HG2F2g)[#Q甉5nqs;1T+?_~wyyv2ı9}r8ig\x QoI(\x!y>NӞ8Ӫ5og`O/+c]mPv+72^uɶi} #]H)\ƻKݴBqg3:flp<')烾چcz'% 6M~q?sBj}G}dtLdrq}Z%!;\bEFXG}D]NPSݷh8}z1v5z~lsvB/O]683X_N\qnJLfG2{IB Pwץ!Ϯ!Or°ޙR}uռx2vil-H'Ct9ϩu-̮fMg -K $jkg.'[3{2NÔ\ e*̳;q+5)nAx9:VPl7 y귋 x\4L]Y>`u0AtmvI߬|98,C#%.qMGJVt"Nq8 Xe35 A~u`*#NFn*&(y>;?Z7Fz&Tޥw_J;l)/i{s-Ok{3(-ds0$-㴵A& EddlJi-KC8Jwbg%j-j{phd1di>Ke&;-۱[=O!Ð4*SC߇9V eD->swPI }M7Kn9+9iJ0N){m= wPSW7اU2/pUG Z~]rCf*oga-zT~; -endstream -endobj -323 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 322 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -324 0 obj -<< -/Filter /FlateDecode -/Length 4631 ->> -stream -x\[$m~_V+ 0XI~00,0Ӟ C~>Jfw9sAOwPR]-s/39zŚ,#>)\d+1/BdR >./?:M)ѻpWa1SAa#Iɇ3b) bĞY bpAcA >+ 1{V>9XÕykU &BQygb.K^1b %8f SN/BdUd9KC;Ee*h+dB*gs%ų>YCH_Xdxi@@, Uy -kX@D3iX@@[hX@[iX@[.jX@\i5, . T4, `.;5, .=iX@@] -kX@]5, .0p5UdkXt42iX]r6iX]װj`Q؊9[ e BK>H0p A]װ}԰b?Va=x4,@c#-Ѱ w]AS|he\.QÂuӧq WZ6.ƢaA"P  "װ w!RkcXKB3TQ V@JY`~d4,M,sTde5,x5,mz3iXP,dAƧaAHa`|@)Opnwk9/e1c׺PPe*]ii:ijRv¶>3V*NR_y]I՞>rI< knù'[y~jȹcÍxMkꛧNLk]7{N޺ SIWh15۹קrP\oaO~Yk?w>i~8q5]F}n~1cT\s5԰nE}:_v91G~Xm{? Z,u-J]|]c~{[ֱ|]y/B֯oFU~-ETBPڷkO)cex[bk1 '`oۺjТ(T%Ylɖrawh??X5skNw~k$jx x -i -D_n(J,K\6#pu~(tyCLW/ʻ&,C-z]UNXV@5.9#mqIEȑҲVW.W:@,]:F@̀`ZrI.qǙR9b:H " r4uqQLD>nG{x#s=<Ԑ,-aN0ME6) [6n96l;Ek -TNGq <Hsu>6hnr'{ rw]=ΧLXK6*%9B9OӢ5YJ4S8\Ꝭ&ZپE_m(*uarH\ܮyq ÒZ;.%r7ڃ},TS"`V]g?U(c_MXy#z^<958o/:\y4#у,lk0r[-vA$"ZV'-7^$Ó?>x,R_Gqa"cs.&z˜1ˢ-Jm> ʍP\g &[QF(6:۪0[tJy·QNf1;1?Ol=#Oǃe]-EPV躺]&G Ѥ -<5=%Oq'vҍwdiXߵ\O^OKNO=ʷܴNNlNJzi_W`,HKd6\ l q&WjiK Yy݆> -endobj -326 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 507.723057 101.433071 488.973057 ] -/BS << -/W 0 ->> -/Dest (cb9-1) ->> -endobj -327 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 488.776036 99.933071 470.026036 ] -/BS << -/W 0 ->> -/Dest (cb9-2) ->> -endobj -328 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 469.829014 99.933071 451.079014 ] -/BS << -/W 0 ->> -/Dest (cb9-3) ->> -endobj -329 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 431.934971 99.933071 413.184971 ] -/BS << -/W 0 ->> -/Dest (cb9-4) ->> -endobj -330 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 412.987950 99.933071 394.237950 ] -/BS << -/W 0 ->> -/Dest (cb9-5) ->> -endobj -331 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 394.040928 99.933071 375.290928 ] -/BS << -/W 0 ->> -/Dest (cb9-6) ->> -endobj -332 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 375.093907 99.933071 356.343907 ] -/BS << -/W 0 ->> -/Dest (cb9-7) ->> -endobj -333 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 356.146885 99.933071 337.396885 ] -/BS << -/W 0 ->> -/Dest (cb9-8) ->> -endobj -334 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 337.199864 99.933071 318.449864 ] -/BS << -/W 0 ->> -/Dest (cb9-9) ->> -endobj -335 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 318.252842 99.933071 299.502842 ] -/BS << -/W 0 ->> -/Dest (cb9-10) ->> -endobj -336 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 299.305821 99.933071 280.555821 ] -/BS << -/W 0 ->> -/Dest (cb9-11) ->> -endobj -337 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 280.358799 99.933071 261.608799 ] -/BS << -/W 0 ->> -/Dest (cb9-12) ->> -endobj -338 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 261.411778 99.933071 242.661778 ] -/BS << -/W 0 ->> -/Dest (cb9-13) ->> -endobj -339 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 242.464756 99.933071 223.714756 ] -/BS << -/W 0 ->> -/Dest (cb9-14) ->> -endobj -340 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 223.517735 99.933071 204.767735 ] -/BS << -/W 0 ->> -/Dest (cb9-15) ->> -endobj -341 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 204.570714 99.933071 185.820714 ] -/BS << -/W 0 ->> -/Dest (cb9-16) ->> -endobj -342 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 185.623692 99.933071 166.873692 ] -/BS << -/W 0 ->> -/Dest (cb9-17) ->> -endobj -343 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 166.676671 99.933071 147.926671 ] -/BS << -/W 0 ->> -/Dest (cb9-18) ->> -endobj -344 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 147.729649 99.933071 128.979649 ] -/BS << -/W 0 ->> -/Dest (cb9-19) ->> -endobj -345 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 128.782628 99.933071 110.032628 ] -/BS << -/W 0 ->> -/Dest (cb9-20) ->> -endobj -346 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 109.835606 99.933071 91.085606 ] -/BS << -/W 0 ->> -/Dest (cb9-21) ->> -endobj -347 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 90.888585 99.933071 72.138585 ] -/BS << -/W 0 ->> -/Dest (cb9-22) ->> -endobj -348 0 obj -<< -/Filter /FlateDecode -/Length 4926 ->> -stream -x][$m~_ `p8 yGuR]xv0;]D$#R29sI/~=Y_?7YJ]ϿHAH&)NrvoN_qgoJ_DeT@.($f稐3R4D1dH -)C@Ʌ-@ i$ -',pZA,Q -ͱѼ31_TZ%B01cъ1rhYX# PIEb* FKctBːڕUd:VᒉTZ攷4opj4 C7JEabRhDEAkY? 8!X68ƐD* `55% |J' |2e |.R - †bI@N`! SԐ 8B\YB! ,aASа m ڢaAܒ-NÂ%뢆 1r$  T4,԰ taI (G p7p7Ti -a &  3`V 0jX]1>gaw}aw} Pi[<7p׳pד@Q Ǫpz8Y߃惆`f<  -ܟb@+r0peLJ+%beb,0p*hX]gְoQ uZw/V"n` !а8 Uiؒ ,y @ iX06q ^4,]!hX4װq h0[Ŧ kfXwMEÂaALRೆ -L5,łOEkְ Y0 KAJakSB$Y$Y2hX[M E R԰Hfr!Ұ qD>Qhћ*-撆)+v 2FaHa͑@pE&{DA 9 ,5,>#ˌVxhjFV̬aAh$T԰fLH `B̏$۬a$HsTd L% Y@7%L YiXPl4&kXZ 7=iX|3kXPEOIÂB4Ȃ(v LB thB% @^]Ȓo&uȤрL@V-3%ꊁ2|d`VI]3_ɑE2GunDge EKT3s,0 BtsQ-S>~9%f1_0݀+S2D16"D*CHX\DHbrZdH,2;3hTzw':,w A7|8vm\yAdeM12YBUޕ.ȿÎr }$H/Le6ҙXv<b$$"+ hl_NrK%ϟ~9OOn?wr'/ڿ3c/e~Y -/^^D/?ߗі !erWle Q3-["[Z۰#cϊHb-3Y͗A9|?K@!EڽA19ăJcLLap "!:Km:RwN4Yo;5=,S9/6= [J9{Dr;zC=ɶA[Ln32l^y$dL::eNZkIPiP=bd'(YbSGMgZv˳N#x$5pE*n*HŷSaT8G[ݥU$UifIAW0;l[N(01y cs|]CZ++>Dy]Y=N%_HPr V|JLjΨ{ 'ֆ]mg|X=vv i-G}ivӮ ,E3nWxZ"$L)(Ÿ#6o%{ĩg@]5X U~82ȓw>YoR>2W#yFI8X{(h rl,b>bcSFJU a͕iI1$zܽ'kk59*{-gd_giMA.k6aTڗڔK=2S6Q4e6䲎|_gABĥQj -p9<ՎI\\"]u<`0ǘwՍ5,%my޳폨^FMrg} ֒CM>ț=wQ5YIxz9V'^ 썋3ǚ| G@tͶ=tu> 4˖8$()Ikv+@Ft!K &nGX3I^'M+HIw$ZJG$#w?-#DKDK񴒶r(4-{B㐳lcLp04>ÀYyʻ#YNhyOhИ\0ǚ|%g$+>Kц|8b;L#)l:Q#gs+qu> )݁Gn +`3l}ݾ};tuv= STZ}D=޿kC`/5&~گ{!X}nV}H[ rƍVM};l25yO99HB:V Gzҫ:g}` xcyݐE'HZkf[粫c) v7t:YqM|wv_,]і6}S{w#U=QuywKVޟ+Ns5zUxuwTC}b:&Iż_y1-z_yt*i\siձw0L[!#Yn6wEa)[V(w}ϲ[A5t]-H= -/q6ҺQikn0i]]Y-W9T8'w-Se >[|Knη: g[O E?VyW:_Xt]|Θ~>^nlU;S%ȸx…FOh桼>3l;̩t5q}mftpBV3QhV@kCo-q8)y`zsalRyA \6KyG]lq5:AcGFQur)ueJ!Si HuXuX Oʹ6!(o!'wSe;nRw|Gq6>Nvη—XT?NFo[9Fw뫜(OK#wV]ik%sOC!{t@(UN-<VnPJP┺]<=IA,_{-j -endstream -endobj -349 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 348 0 R -/Resources 4 0 R -/Annots [ 350 0 R 351 0 R 352 0 R 353 0 R 354 0 R 355 0 R 356 0 R 357 0 R 358 0 R 359 0 R 360 0 R 361 0 R 362 0 R 363 0 R 364 0 R 365 0 R 366 0 R 367 0 R 368 0 R 369 0 R 370 0 R 371 0 R 372 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -350 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-23) ->> -endobj -351 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-24) ->> -endobj -352 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-25) ->> -endobj -353 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-26) ->> -endobj -354 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb9-27) ->> -endobj -355 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-28) ->> -endobj -356 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-29) ->> -endobj -357 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb9-30) ->> -endobj -358 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb9-31) ->> -endobj -359 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb9-32) ->> -endobj -360 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb9-33) ->> -endobj -361 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb9-34) ->> -endobj -362 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-35) ->> -endobj -363 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-36) ->> -endobj -364 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb9-37) ->> -endobj -365 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb9-38) ->> -endobj -366 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb9-39) ->> -endobj -367 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb9-40) ->> -endobj -368 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb9-41) ->> -endobj -369 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb9-42) ->> -endobj -370 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb9-43) ->> -endobj -371 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb9-44) ->> -endobj -372 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 340.338585 101.433071 321.588585 ] -/BS << -/W 0 ->> -/Dest (cb10-1) ->> -endobj -373 0 obj -<< -/Filter /FlateDecode -/Length 4729 ->> -stream -x]K$ȳH" c>腱SmcQc`QzD$3#f]Ȫ RE~!Z|+395)X%6g|R:Wbן@ɤ| ~.⯗mw]󋰘L)٠ -X֑ -CTXb) bĞoY bpAcA >+ 1[V>9XÕykU &BQygb.K^1b %8f SN/BdUd9KC;Ee*h+dB*gsʷ%ų>YCH_Xdxi@@, Uy -kX@D3iX@@[hX@[iX@[.jX@\i5, . T4, `.;5, .=iX@@] -kX@]5, .0p5UdkXt42iX]r6iX]װj`Q؊9[ e BK>H0p܂>Xaw=a  w!AO V{Ne}||M])k?OX|xLm B*"$|W%#!0n"&1n/n+4dҙzoѢKJ!Y7uR"1`J~|_?槯+k rV/ > =`v0s?-6eۏ46R]k?,]5׵+=v6D<ֺBCڇ_YoD[>m沿Кk3qǵUXnk׭&4KkZ燵Q-M:T/VjM8hik?R|ꊿ,zj ӽƥ*eo5޶=}a_h1ѼʢbnPڷ'E]$DD:.p!$@TLm}!uޅ0+`d07CK E ch?>fj{:Koaa+j*_aRw.ia~F|EF&1uϭERl !Wʿ joXV^su( ײm0x̋SWܠ=㢿@^Q"x(䭗޾_[fr+ Ĝ5XdM񰜩<=*}P@@v(NsUG1bZg Y.Sj&{e, -Ng'<:1sXJlQgH:o;ewzuNvamW D -Bsew4!xyBɘX};G6mj`Vva$cL-M8ڃ^e{hf#~L-GltyOMjpc@*Y|x2\ܶ⾜vN6d٦':!}76]h9Yi t}gqθ:ڈd3"Ͷ9~ju>nbaP=V*OpÇC8Qw{𫪧r(z\2BF#&=,yֶ "5#D?YrBxߚ֖$e&[byc3Wkjy4fF#CSw&32ޒ9wet:Oɲ pc?$ -~5"f!bHu]3ô{k.v1rctvM)؟0Xy Nہ9*In۽hR|dUs qY^lanc6G_G -}S_U .Iٶ -mKm}?q|?en[76no{Z'y6=r7%3\=l @M΅цUʳf=^J~d$Y8_E2[ٷA~uCׯ7; P8/)+׾[bGЪɩl[!ꗎ"jFwKƬdI Wb eG!ّhsk%]uq4Op>"\-*UkM5&JVqRH/mM3Q[bnĽ\iE-H^*i~2LrWB:ZI4|R%}m_.'%$tXaC3HSAM -hr^"t O⸛_3F'⛝ULuXӀ4NBFmv֗V)/Kwm&z*M<[VaM?+gmBAݔ_7!gl,Cowcי;9۝l_j`=YL?NYfS|zgqPܼھ'"</y}$'gY/O0%{wlݐH&'d<݈m& Q64kq yT[IuL CwӕfN=c3rI 1@M*\̷> -endobj -375 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 709.923057 101.433071 691.173057 ] -/BS << -/W 0 ->> -/Dest (cb13-1) ->> -endobj -376 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 690.976036 99.933071 672.226036 ] -/BS << -/W 0 ->> -/Dest (cb13-2) ->> -endobj -377 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 672.029014 99.933071 653.279014 ] -/BS << -/W 0 ->> -/Dest (cb13-3) ->> -endobj -378 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 634.134971 99.933071 615.384971 ] -/BS << -/W 0 ->> -/Dest (cb13-4) ->> -endobj -379 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 596.240928 99.933071 577.490928 ] -/BS << -/W 0 ->> -/Dest (cb13-5) ->> -endobj -380 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 577.293907 99.933071 558.543907 ] -/BS << -/W 0 ->> -/Dest (cb13-6) ->> -endobj -381 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 558.346885 99.933071 539.596885 ] -/BS << -/W 0 ->> -/Dest (cb13-7) ->> -endobj -382 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 539.399864 99.933071 520.649864 ] -/BS << -/W 0 ->> -/Dest (cb13-8) ->> -endobj -383 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 520.452842 99.933071 501.702842 ] -/BS << -/W 0 ->> -/Dest (cb13-9) ->> -endobj -384 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 501.505821 99.933071 482.755821 ] -/BS << -/W 0 ->> -/Dest (cb13-10) ->> -endobj -385 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 482.558799 99.933071 463.808799 ] -/BS << -/W 0 ->> -/Dest (cb13-11) ->> -endobj -386 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 463.611778 99.933071 444.861778 ] -/BS << -/W 0 ->> -/Dest (cb13-12) ->> -endobj -387 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 444.664756 99.933071 425.914756 ] -/BS << -/W 0 ->> -/Dest (cb13-13) ->> -endobj -388 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 425.717735 99.933071 406.967735 ] -/BS << -/W 0 ->> -/Dest (cb13-14) ->> -endobj -389 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 406.770714 99.933071 388.020714 ] -/BS << -/W 0 ->> -/Dest (cb13-15) ->> -endobj -390 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 387.823692 99.933071 369.073692 ] -/BS << -/W 0 ->> -/Dest (cb13-16) ->> -endobj -391 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 368.876671 99.933071 350.126671 ] -/BS << -/W 0 ->> -/Dest (cb13-17) ->> -endobj -392 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 349.929649 99.933071 331.179649 ] -/BS << -/W 0 ->> -/Dest (cb13-18) ->> -endobj -393 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 330.982628 99.933071 312.232628 ] -/BS << -/W 0 ->> -/Dest (cb13-19) ->> -endobj -394 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 312.035606 99.933071 293.285606 ] -/BS << -/W 0 ->> -/Dest (cb13-20) ->> -endobj -395 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 293.088585 99.933071 274.338585 ] -/BS << -/W 0 ->> -/Dest (cb13-21) ->> -endobj -396 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 274.141563 99.933071 255.391563 ] -/BS << -/W 0 ->> -/Dest (cb13-22) ->> -endobj -397 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 255.194542 99.933071 236.444542 ] -/BS << -/W 0 ->> -/Dest (cb13-23) ->> -endobj -398 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 236.247520 99.933071 217.497520 ] -/BS << -/W 0 ->> -/Dest (cb13-24) ->> -endobj -399 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 217.300499 99.933071 198.550499 ] -/BS << -/W 0 ->> -/Dest (cb13-25) ->> -endobj -400 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 198.353477 99.933071 179.603477 ] -/BS << -/W 0 ->> -/Dest (cb13-26) ->> -endobj -401 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 179.406456 99.933071 160.656456 ] -/BS << -/W 0 ->> -/Dest (cb13-27) ->> -endobj -402 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 160.459434 99.933071 141.709434 ] -/BS << -/W 0 ->> -/Dest (cb13-28) ->> -endobj -403 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 141.512413 99.933071 122.762413 ] -/BS << -/W 0 ->> -/Dest (cb13-29) ->> -endobj -404 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 122.565391 99.933071 103.815391 ] -/BS << -/W 0 ->> -/Dest (cb13-30) ->> -endobj -405 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 103.618370 99.933071 84.868370 ] -/BS << -/W 0 ->> -/Dest (cb13-31) ->> -endobj -406 0 obj -<< -/Filter /FlateDecode -/Length 4922 ->> -stream -x]]#muH"8)r`zyo=Nzѿ߇^.!GF#L%E>|dM -jEer2g!P2.??:M)ѻp7a1SAa#Iɇ3R4=Y bpAcA >+ 1=@ k,JH -Yἵ*Xf -31_T^%LLxCx YBNx)'! E*H%⡝2dueYlN2dfW9=`B&9`Q,ц K 5A_rVՋw%d>ʃ,| |,6E AFpIYp次pJ/p,I<4 YG AH0p܂6sw}^zQX5B@a3a -?ŧV5,]1|*qoeb,.&*Ұ wY`5,]G5pb5,] Aq4,f骼blYÂ,y 0 $*/Ӱ`l,P "p{Ѱ wm Ұ w-#Qyװq xp[ŧkFXwMEÂܕiSÂೆ -̦5,łOEaA @ʃ,X֦P$Y{ ,4,@D`C Y)jX$30kXBD>jMNksIÂ`*v 2NaHaϱ@L5,5,@ sdY jX}FKBYÂHa&RAIH~l"QykXt3kX3dkX۔|3iXP,dAħaAHa`)vY_O=8JbE|pLmEBH".,.n"$bLܾȐXdvf/2zw'uAyTR#TNy^~4Y,Yi AY&DuLRI 9яDXx3%,o - tYn؈ӯǟ~O?Z7?8˵wULBY# -\TkT!7U7H8̀Mk5cҭew{{Ё$=l8\cj R҄oD$]2do]JZuTȰJ|mk@ve~޴*/ckȿ"t{"\!D~grwc t#!5#$6zu誛nmljSw7v{% --z "S}mIKlFm2ՖG쐦"|Zms@|yanySUjs1>?bVt5>+9ɢ,8\8СyFgWСj}ؓ{|?>B+OJ? 9kD}r N~iR0y2s]ݷJH2wQ["١b"5ٛHIQ} @irao}e|}W'⣰w :l? Euu޶=}g&vto$ |CIuqܵ{b}km۲ܥLpl1V\L8^$;GAa ꃫ~1WeBJ1!n~J$m-mkt]kcw S`=IR{2g_f7hc~<7!lV{$Oq&w֛DSXףAeRIS&d](.i3a#0zYY;204b/cJNyAߑ!<.=-ÛESR32O:`TjϬQ(?&S"֞YlvQzݐr[ݷpz{FmPVeY&y(BПK_`g~b6fv-NDW-6SjtVsz  z:K̜V{P|vu^\a -l #//y.A,lU[ "DI@ᅈ'Ȑa7 =6$s=IR;, &oX:Bh -Q8"Mo ^#6?I -{.{="n7."9<ʑ檼ȫM"6l=~cv^SU^GA薥ϧ( Nbr}꼎][g wJCG$!#wCp!#\w.{74Y)玵dX}*GH0,>0*CU +EX" Bf *yKd펃|*ehhz(cAYE@H;emhVAV'V1Go|>ûB;;Z\ :f;2"bq>ӟ:"ykX$ns2}dJ0Ѭ窼yA*9L#4`=nw6:Q[h&m8ӏaVKSU^F:-K+1D`GYdQ[ѵpGe.nv=}?@a=A};1J3Fs|F -y>jsw(ܰcn}H[/׃`REU%БSU!s!#sHT!㱐rmBR;Lc; -'3ĹzŹIv;nߥmt,ťxHd0)^ᐹFz/S_UxR&ee.rdJ1%Es uX-Ӄ;?->ޖ]W m[_CXV[÷}.OE[A*uиwN}Œ];+UYyu d2 bKE6Qu:L=`\JG87W.]\&GGIǹ)ۻ0bJt%|q ,-fHe{j'|TޕvZ` -rf^  Hgwl($-I)S{, -bϗ:]sָCJ}mwzUw\VT/6qigiMO_az[|~Xmzazjci䅻T.eK܎=rUIzt/ neEx'd]_듣7Ӷ_/:$'Bf6~,mmZ L.._Kk\Wֻa&'~JlұBDd{$ YNoφD qY e{!Yİ'ڡNeֲ}-mAlse}nR赩UHW BF k6 I!vm1?y!Ր+k9vR-6RʽjY5EN)^U-$?G1eֱy#d[͎q -I):VذHFζK"\T\irn{ШMJ)\CE\rt6bA4Ջ<C!yܧٱVb(Ƌavce#"㾈WjFƄOR6P+Wjm{Ԃ=h5jK0v+m:Q4ͮbZeKU-bNۨ0JSbG%Jע%jP9d%BcF^Vھoζ6 {dj{+=;:WZo] q]]"Ol3q4rwk%ud a&'+F9f M9We-ݧe)ÜݭŸeA]&IwH,?S -mO r -endstream -endobj -407 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 406 0 R -/Resources 4 0 R -/Annots [ 408 0 R 409 0 R 410 0 R 411 0 R 412 0 R 413 0 R 414 0 R 415 0 R 416 0 R 417 0 R 418 0 R 419 0 R 420 0 R 421 0 R 422 0 R 423 0 R 424 0 R 425 0 R 426 0 R 427 0 R 428 0 R 429 0 R 430 0 R 431 0 R 432 0 R 433 0 R 434 0 R 435 0 R 436 0 R 437 0 R 438 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -408 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb13-32) ->> -endobj -409 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb13-33) ->> -endobj -410 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb13-34) ->> -endobj -411 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb13-35) ->> -endobj -412 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb13-36) ->> -endobj -413 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb13-37) ->> -endobj -414 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb13-38) ->> -endobj -415 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb13-39) ->> -endobj -416 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb13-40) ->> -endobj -417 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb13-41) ->> -endobj -418 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb13-42) ->> -endobj -419 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb13-43) ->> -endobj -420 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb13-44) ->> -endobj -421 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb13-45) ->> -endobj -422 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb13-46) ->> -endobj -423 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb13-47) ->> -endobj -424 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb13-48) ->> -endobj -425 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb13-49) ->> -endobj -426 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb13-50) ->> -endobj -427 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb13-51) ->> -endobj -428 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb13-52) ->> -endobj -429 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb13-53) ->> -endobj -430 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb13-54) ->> -endobj -431 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb13-55) ->> -endobj -432 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb13-56) ->> -endobj -433 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb13-57) ->> -endobj -434 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb13-58) ->> -endobj -435 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb13-59) ->> -endobj -436 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb13-60) ->> -endobj -437 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb13-61) ->> -endobj -438 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 169.815391 101.433071 151.065391 ] -/BS << -/W 0 ->> -/Dest (cb14-1) ->> -endobj -439 0 obj -<< -/Filter /FlateDecode -/Length 4511 ->> -stream -x\K$ s+HÀ $`` 0rXwv*=];ۋLzPRIp_fgr.)駓5)XWKl*[pv ? -I%/'o897o븳7Db2)d*`YG -+QaEg0R4=_Ƃ}VXb'G׬1|r +!),g!֪<b+<Lң\|Qy <#21 Nc Y1d : KpVA4^,ɪ B-ȯ`oSJ^SV:Me&p'H -Av02>*BDlP #7\<,M< JNH\ʹtxhIJZj#DQjf1ـ+qtU,VH"P,$,o -dZX6Gu4>x=xK}oyo)\eǕNL?r?hw<݀"x\Gϓ8,`="' U4Ɗ%8ڕ>?nLLTD~})9jS@^`n@.Pp?ty7FlYVjݱ*cwɦ{;Lgll;yGb~}˳̹o6d ,vov<_ײ4f{al|ֺ؇L{,6墩}8ߕvu#꿛{[̞$[uhB1 IzuT<4V=r坳ln#@\^ڹHhvym+ޕ[r1:m|utRd$ѲEiZPX9Yc>vҷ(S㞑ɫXl[=ڼ[r qbʗDzw=u[nJwkԥТ$~mǮtq^|?Z ,?O(h+ȴ"<$c(d!{6Hmr,>?&JlcM-MQz$XB1<D@|R.FW]uNv:VYVY#0I~Dڐ(GY:ȇX}GVx?Z"Z oyx64lrɄGڿ[3%qR07L|/ٱ:o|l(cm(laIY N/K-=6⩞U[Mm,3S\mG[Z_Dx̳߭K{G֝.o8S*= AX.>2CU~mDBmiYIesr 4f/[wx(28yw=YFi{+Ѻݻv!#ӽ-/x6uzٽܻǷC(^Wl߷CU0YbiCvSU/9EI"crQ"x(57'Rz>~oZl-A'&[É9s#;rLJa|cRtVA' (F c:cx2wR[[i?<ꔣPeg:Ov{=ewz -v;%ڕ _0~LR}۽g/_@ "f2$ťu4rc+aˠlIX̳nO5bv&z4`;Ty& "I.}FT?'D߃uF5דE/vءpjW//[= -Gͫˍ'oq|#xig@wryU!<3s4ucUG1r+ a,8D.'f)3{V=##<-QNp5i+elɔ/Vo2 -Ǿ9ȶ#ɎyafMrX"׋$wt߮W^R8˻eWnt>,@mNshRuuJaihסE[NFy@\"FWX;FϼWy/78[nogN'y60˲j~:zի^4X62㩜*e{&W7j/K]S|ahzXT'ǓNv1e'/ljd!~|.'T%)9N8nh~h"VUc]eָ,0Ob eGC#;5N &K]uq4Ot#^N*7ZSMvMBN d.'mM3&Y 17C^r -rR˭>Sʣji S.M$_|RsKC}(v㯈Sr -I)VLo&n'g;ePSnk6\/P:U!\k`~ovVI3=vaM(;˥mv֗V)/Kwm&z*M<[VaM?+gmBAݔ_6!gl,CowcΗ;N6߈xOϭAk[|zgqP/ܼ|9L?O5y -^rHN>G3gY_#~u%{wlݐH&/1Fn3=O?.YCr[+hR`o%]GP׹31 NdMWn ̈́;N=ܹ{y68tCrsIy8x̃G#$&$EGHTsx:,Cbs']"?SA0H#M7ZT)0sNFEOvϞU<@;e N=Y h=IpZaщG@;FtE lS)՚ZꈳsA0JWbg%^v[((sɬ\SyF}h{C82S;;KݮV;!./ P˖Xc|+qF^]^H+{t&|u^(SSSzb!NVЀ9{TXo d(o%Iz.Y u eUU -endstream -endobj -440 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 439 0 R -/Resources 4 0 R -/Annots [ 441 0 R 442 0 R 443 0 R 444 0 R 445 0 R 446 0 R 447 0 R 448 0 R 449 0 R 450 0 R 451 0 R 452 0 R 453 0 R 454 0 R 455 0 R 456 0 R 457 0 R 458 0 R 459 0 R 460 0 R 461 0 R 462 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -441 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 541.623057 101.433071 522.873057 ] -/BS << -/W 0 ->> -/Dest (cb17-1) ->> -endobj -442 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 522.676036 99.933071 503.926036 ] -/BS << -/W 0 ->> -/Dest (cb17-2) ->> -endobj -443 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 503.729014 99.933071 484.979014 ] -/BS << -/W 0 ->> -/Dest (cb17-3) ->> -endobj -444 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 465.834971 99.933071 447.084971 ] -/BS << -/W 0 ->> -/Dest (cb17-4) ->> -endobj -445 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 427.940928 99.933071 409.190928 ] -/BS << -/W 0 ->> -/Dest (cb17-5) ->> -endobj -446 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 408.993907 99.933071 390.243907 ] -/BS << -/W 0 ->> -/Dest (cb17-6) ->> -endobj -447 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 390.046885 99.933071 371.296885 ] -/BS << -/W 0 ->> -/Dest (cb17-7) ->> -endobj -448 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 371.099864 99.933071 352.349864 ] -/BS << -/W 0 ->> -/Dest (cb17-8) ->> -endobj -449 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 352.152842 99.933071 333.402842 ] -/BS << -/W 0 ->> -/Dest (cb17-9) ->> -endobj -450 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 333.205821 99.933071 314.455821 ] -/BS << -/W 0 ->> -/Dest (cb17-10) ->> -endobj -451 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 314.258799 99.933071 295.508799 ] -/BS << -/W 0 ->> -/Dest (cb17-11) ->> -endobj -452 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 295.311778 99.933071 276.561778 ] -/BS << -/W 0 ->> -/Dest (cb17-12) ->> -endobj -453 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 276.364756 99.933071 257.614756 ] -/BS << -/W 0 ->> -/Dest (cb17-13) ->> -endobj -454 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 257.417735 99.933071 238.667735 ] -/BS << -/W 0 ->> -/Dest (cb17-14) ->> -endobj -455 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 238.470714 99.933071 219.720714 ] -/BS << -/W 0 ->> -/Dest (cb17-15) ->> -endobj -456 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 219.523692 99.933071 200.773692 ] -/BS << -/W 0 ->> -/Dest (cb17-16) ->> -endobj -457 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 200.576671 99.933071 181.826671 ] -/BS << -/W 0 ->> -/Dest (cb17-17) ->> -endobj -458 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 181.629649 99.933071 162.879649 ] -/BS << -/W 0 ->> -/Dest (cb17-18) ->> -endobj -459 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 162.682628 99.933071 143.932628 ] -/BS << -/W 0 ->> -/Dest (cb17-19) ->> -endobj -460 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 143.735606 99.933071 124.985606 ] -/BS << -/W 0 ->> -/Dest (cb17-20) ->> -endobj -461 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 124.788585 99.933071 106.038585 ] -/BS << -/W 0 ->> -/Dest (cb17-21) ->> -endobj -462 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 105.841563 99.933071 87.091563 ] -/BS << -/W 0 ->> -/Dest (cb17-22) ->> -endobj -463 0 obj -<< -/Filter /FlateDecode -/Length 4905 ->> -stream -x]]$}_qXDQa xF7ugauR "E%GJv/q+gr.)_/]IlTbu1OgC2J(Tاv_7}˟wZƽxSJ_S -X֑b6)y -+:[,EcA N-+AP2k, -+C -іUO.h, -',pZElcQygb.K^c1rxpN1tax%PN/BdUt9Kţw֕Ut:Wp!)oy޲Ld5saQ.rQyЅzG%N0odi<.ާ _CMQx\0dBAɄ>R" |abIuyY!jH@xʃ.T -hX@]| h`-64, m.jX@\i5, .4, @.LhX@\vjX@]{ҰkX@] -9jX@] -jXDTyaѐˤaAIÂ܅y 0v5,հ w}A SK>Hg܂6sw=[aAࣆ0j4@a*3a uӟ@+r0pe +%eb,0piX]gְo0z 3:_ ECa7,LWcK0p5,,lld`HNC5,]LEÂܵLaAڀGA^5mFjRh7wֆqo";uR=aHkcd|*!S2p9Y[_ -83>ݵ?|ZP1-L Fn4eN $T)NE }DYbUu̝bxm5P~!}`pxY jAx8YŐVBŪ(6!MwxDX#d5{wtx,\2w=Y"y7_ݱjEe'0X0}P@/d.@p]Hp+$6HGn-@-d`*i:E-:Szo$0³m G"#"+ܐ,y;-x1dSg1C&uu?&DH>-f{ou{?Vc5-Gٶ*k_ߏ|N&bEn"?&4'[+|'lUL/rlA8n w㚐-EװlEz+n/}3(|qʹ5#`ԗdeG|d~bV.und%zĹrّGZurHr1VӒ dξx&#r]_ae<4n2O-^׫>mg$^7t4J3G-Fմ:Rq[[nm^aw-38[߶3vtQ=R du)7mc2OzD+{ا ̖Q9;:y$ISYw CCܠɗq9v{h#~,i3SeOy{1X"ګ6e`A%jEau?F>*z@n<| vPHqwoΠEQ@<\Ww~mk܇t_>zH!`sq+=^G\t B>~MO/ ;FT?^ץ\Z6v0z] -vD .|VNs9~F{9#YaK伽56G:um4s\ CaFO`zuߦCW04B{2O~G($s]cmGLEY㘣)D;El$oO%DgXB˽`BuOR}rxG朐uuP/%2,u9#ݼg``gիvv?mݗ3Tz"}Ez~,ȭ{޽9 ݢ0u+E93BwRfc͟cYN zgMw}Gc&Kç=#I?_6lL %B9wͨ%239VYۿux-Ďl~S=sݜ>&9h+U?mwLupwCe~(W7m4JNrEc` >:ֽ#9Jo a4\i.i*+k -mr@ؙ,? WTb0e[Mp,5"okP_Ks}׹n>uyzAtK}SKUKb&[h)U*u@B'zQإjMQCļRRN!^rsm\G*R*)׎WhS$|eF6oI) +,/mҨ)/]\hrD} -TA դv߬u'XQ'h=BjeB?.g>_qo+Z+r?6ABn}`]ney:{uhRUuaGtgk ѱiC3$/Zᢿ\ƣ6%tUJ);A\k4VjAԮC?< m^h]tESW\hY(}ڽ>> -endobj -465 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb17-23) ->> -endobj -466 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb17-24) ->> -endobj -467 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb17-25) ->> -endobj -468 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb17-26) ->> -endobj -469 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb17-27) ->> -endobj -470 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb17-28) ->> -endobj -471 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb17-29) ->> -endobj -472 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb17-30) ->> -endobj -473 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb17-31) ->> -endobj -474 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb17-32) ->> -endobj -475 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb17-33) ->> -endobj -476 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb17-34) ->> -endobj -477 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb17-35) ->> -endobj -478 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb17-36) ->> -endobj -479 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb17-37) ->> -endobj -480 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb17-38) ->> -endobj -481 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb17-39) ->> -endobj -482 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb17-40) ->> -endobj -483 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb17-41) ->> -endobj -484 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb17-42) ->> -endobj -485 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb17-43) ->> -endobj -486 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb17-44) ->> -endobj -487 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb17-45) ->> -endobj -488 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb17-46) ->> -endobj -489 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb17-47) ->> -endobj -490 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb17-48) ->> -endobj -491 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb17-49) ->> -endobj -492 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb17-50) ->> -endobj -493 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb17-51) ->> -endobj -494 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb17-52) ->> -endobj -495 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb17-53) ->> -endobj -496 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb17-54) ->> -endobj -497 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb17-55) ->> -endobj -498 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb17-56) ->> -endobj -499 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb17-57) ->> -endobj -500 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb17-58) ->> -endobj -501 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb17-59) ->> -endobj -502 0 obj -<< -/Filter /FlateDecode -/Length 3167 ->> -stream -x[Y ~_1T& @ (0 Xycfa$Z4YGτU9JBIۈK:3i [RBi)|~8:W]s cRKXR -ĔV[lcAT4=@ m5y,1VU!hag5 ǂRqXL#˃ *q -J/rȵ -x\ ('x-Sx -YR#x $V%YTjxHry%"@4W! ZY&VȀV=3 HDgY{j -&{l@_cz zD9ɆPT~9}˿OoNE5B$6p!dMhS6!'L1J"2@8r3ly|k!I(eu[ CIv%)_Hҩ F̓UC(g,{J}/uߩ#O֏eERkz_Wȧ?)ؿ'(_XH"9Ek6k -Eҏ%,}N%-Z^X#}uO"6*Mf#_;}|@ QY-qIYWے$/l(e%wMi TSжŤlV=jg$lp\Pv?j \%m|+V+mo~V7c^]1Fr}1 -\5Vva)iNGHnwM=hvw[{t`sXѰ}IGFzD/~Fz[66Z]鵿ٸG^'$yr|건xV79=NZfԀ@c[K##pڷ{5V{f>9ù/G5ToOދ1~76?iv8+}cv 25q()w :v.8'>Ifl7Q6Ŝ/'l+jC_k7Ҡ"TG谓C K+9INݑtk}CqjiXQuNm]SRڦZ%FcJfnk;tD$?RqFDYJ_& ơ*f9ܡ" !u=WsAVJukcuq)gW}Yt?@w.*[u x\yx u \ԅv+?\ijYXw·\ yǺweKlzK6ׯ}I4l!N -63aoۈ=2Rb\ɓ˒3=X&b]ˆmJv%9Pɯ)Z.2.etuNbX֋uauv%#'g90A}Xƌ:ϧv/GΑ XKؓQИ^]>Pv HiWD14괱b2cZWvR5Ťj:VJLUX[gQ-(e͑-UHzmm$ʔt7Sbgss_Ir(_P_Ѻ|JODYɺT -"<ўf,K5row.vȽmBXh!VV{ݴGCJ:>پ X9 -endstream -endobj -503 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 502 0 R -/Resources 4 0 R -/Annots [ 504 0 R 505 0 R 506 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -504 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb17-60) ->> -endobj -505 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb17-61) ->> -endobj -506 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 719.279014 101.433071 700.529014 ] -/BS << -/W 0 ->> -/Dest (cb18-1) ->> -endobj -507 0 obj -<< -/Filter /FlateDecode -/Length 4957 ->> -stream -x]ۊ%}_ '́cY$փ6ÈB'( l gQ[UFY#Ɣjht[eŘDlAK `lQ1H4/I`b\6N"K hd?Vi茖*]j0rElI\` lA -Y ,-XЭSYK\`N qL%q (e ,8ׂ;%. ] (qZk] -XuZI\"-`d%.p]Uw18 +III\&)'q)@cJ\ƣ 5^ x8$.P.(lJ\:c%.@aAX"qO`A$.]}.:¸Bw1QY p`!e$.>`=J`Aע.A1Sk!aK\(\f@1  0 2t Ȗ.tZK\ lA4(qA2 ̠$. $\-霢uf 0P(q V`JQ[@h%.M,sDlI\f %bؤf +؂O€@aq蔒 q`\z3I\zK$xi'Xo" -#3Yhř[-l=5i3LA5 -Vⶁ"s+NwU"!okn$/?bo_C4HAm_.pk@.4]ӂ\RXv-vabDy`M}˱KEΪӈ56&0Hb[^^n0iot{G3:+/{1QVVA]sjeںD -¡w5zdF\t..eM2"/(Ŵziq sq9 -ViS!R/>t긐C(j^U2p)R@; _9ȸ߸l;39b>| /o6 9( tҾ͍j(Fw5y0І|M(mRmPv*ܬ^Uֻ󼻭+DzE#ZwFzz]Wɚ${6;ޠ z Υrn+O><_+ -+]nP@xnR.)?h`F~ldh]xDkMQ7L܏PZ 4F9SZTQ~KZYԅm۲rF9ʋq-zd{c53cSxff>fy集!lxumq"x~Tc;`ͦVkf\F?6|fgGjV%N<6qWcTǮ.-5Su LJ2KwD7\fIe$m< EBdlf7ϫbi" ]G{Q -vN-gWjkکٛkj8~_l%xMӞg{˦6+aPnYTX)tD_ANP> \c!*e2=)e;솇$u{,,4rՒv~WX~w`%r>O[4DNrXDu[|5v+PYtm;AzP[ aݟQ%y޲Gp'}cn~GC乾*FXغ,o!~ wOyאV }| -NlrW<@zB=2ʱy yp?Q~K/W::"ͧ$7fO߼N$<.ꌋrc{eP@E:syelzheO&tV:52?^"4Y[i+.{@B[.yoV.{\#M ,QL?n~x>_Wf~KRS<R"U@TvSk=3Zrm;*2GԾ끝ű䍑{;ZolOm!3ƇC92Oy8d]m^\Y{( kϸ{ maѠuu4o~Λ1v \CxQ\mlqq+.ODֲ'9Q_Ocqe2/lڶuƓ;!鹤T%G޹<rٓqXϮfc)oH3[~ޏY?YlGzY͐U2;<'<zA\YYEϲUq|5ri+ybf!mg yWu2bcO#dC~01[׼޾AtsϨw\ky1ڎλqDwE@s2áy?]ţ4;7 ;T{F_īK|sm#+ƶFқĔ.oG<ƴǮh({zz]ݕZ<0T -5xfH;Vҽi^^p?}CLy][ήo=8ӈS[ۢ([{E3ۻ<":w.Yj"[ި:V,3赘Z=/iYhM tdbӠke;‹-yk {򢫬%Al /i^i#~LuQ{pikIR[N9Vec϶ Z (mJyf։dZl-IRl1E{^iNW*-[g-y[zK&Ax&u=un^wmzdz6J*{(?e'D LNGklJ!C}*:lwׄ*j*l X_e%6>[AVon峄eϯlHKE -7Ӣx#mI??"; -endstream -endobj -508 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 507 0 R -/Resources 4 0 R -/Annots [ 509 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -509 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 563.554475 101.433071 544.804475 ] -/BS << -/W 0 ->> -/Dest (cb21-1) ->> -endobj -510 0 obj -<< -/Filter /FlateDecode -/Length 4918 ->> -stream -x]]q}_VXI~0p#00ӻc# C~NEDZꞹw{iUX<<,RjJ~/9=cpOOj^_I(?7V.N^'8M .yӟse}6Shrv)FUJi+b4>'41gI3|tƭUfΘ$̰.jVeav -f죠 -vh!9kSӃ3z -),"t:Ig^K<|tk甤-Φ(l*Q[LVEb,l-*(-鲝|NΉ J1uF'kzuQ-A,`H: [~$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a -c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& -%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn 'E93Ejdưpۚ'ɮc/|oNYJj -dtG|A+G1w#5hqt##1ѿrN#7E2s`RâCsf7<&GD>h*^ody>Vۺ5SR-`kiv@Y> -ND1il6ʈו[$`⺷.C4N㟿˿O_N'|w_w|=k:C,h33<׆tkIGy˞\+z~^Di_u`ٖeiL/8%dJ|~ʎeʾؿ;u]@Dy|uie5md'p/y6@aw QGz_7| TF9A/.c{:P/;w<询 zeZsFʱ鐺cex\^}Z}C9k1湵yamԦBgy6ĺxvg⼏G2OZ܍Z6@{0ӡv9r֑Y.o=wq&|Yy:ĩ1pl4dzc{0ϳ<:ְjDW:uﳡb(T簊6Q潈߳'nD~`#6Ps<Jw+B\ᩞ~eR$Ud:z[x*7!XC C>enSlr@{<ZoǮޖ(Y/p(͸JAjU<'pe~m< z@y:$ߎq]zʞmqa-kR9VbTц]iyL#c]ރyŞ,kXqFeԝn񈿖I.17y^wVR4ǙQhg$L4?,㡂_)=> ?Xޮ߅o|=7c1bGQvW7.6˷f'z]sX6cCCkv&Oa6wi=kmz%OB}2 yY;;\&=f^*p큻h -65$7e@ݬTM_͇anW2-u~!-}=2Of!n)rw?Ήͥ"?W>7}W 3N.o6V42uwNСdf/1=`.%K>=˂k'lVä2;TXot͓Bm/K$D{r0e>ry[kw=d+&vCa;[N{/򢫬%Al/i^i^#p&:HڨI߹5d-ay[uv,{9}h-.8F4ls+uUN. SUJզ0gn)-Nb)oӞJsVi:hɶs8:SX2 s7)mv˺l{fpݐ#SճUʇs3:HO ѩ5[^RG.+YԽ^cr֪镾 P}+WΖؤ luSNDj -WKAo7EpI?)J -endstream -endobj -511 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 510 0 R -/Resources 4 0 R -/Annots [ 512 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -512 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 123.873057 101.433071 105.123057 ] -/BS << -/W 0 ->> -/Dest (cb24-1) ->> -endobj -513 0 obj -<< -/Filter /FlateDecode -/Length 4711 ->> -stream -x]ۊ$}gJyH`d X#l$?}"RYQjKTɓQٕ,!9_~9zRER_oR?X]_HUޝ_Nl~iyVCNI{#|^XFR3*ku#e*3L S T`Tfh㥞"P^N3dQI;aVNSrp!f*Zh,lQV[([w` K(H@=`*x9PE:%9"X8&\V[t4h[a2 5@ tkDhq\A0Sp\:8qJ N 4Hs\:qj` qq2h xWK9.0] #qzuʠB -p\`c -`u~𮲸n*+r(Gxbyw`9.|A-wenji CtX >V̸E+ҹqbX.3p\0* ,xWjԜ+UX.q0H8`~tY]D  -) 0 "IX$qxC9.p]LVk xW=8._-3B)8xWH0 -#K&Γ@ `/Xq\tpXpm9. buxq!8. -h8. -e%ovy[v}`` }_OU-!(ж10m sg!Srh突k7o =^Y/ALh^@aU}y}b aW]5"ɖKo/ב\qu]L>mdnKs>jAz Rvyy>dߓ~35=;>sY-xyݟ3C%;䓏6>GEѻ/Ы7܂ӿWmV-k|עɦ%o33>m4Rϓ{VrK<:3o|t{ [F$YZmn_s8Ϋq[;us-ݾߙph^{g1+#b;G̛gV9rh]'B ;hܗhh4~–sgYOݻ+#w<9{0? -6B6C2투m=ݞxd;՝y gWAM ,&G[ݗp݈>o³*z[Bkd.D>ŋzdzyЍF3fI):(3~=m}BK=]G;lk;J[}hTD;4u vOsYV)Eo_GFJGh(; nÿܻhRv a*Ŝy~nz6 -[sÅUjZM\Y(M+EkNGy -#5y痱M>SuoYiuЂF[2'PpE^Z}j6׾<׆uo7}uS+.U^GgG-Tʡ|Ѷˈ]`;vGs8Dm<%,7>gyTW; U~c;786aGkg!ekWd~_Ԟ,Ϋk%WSȻn\mG\''9^{Vonߍ3к!ֽ{"s7I>ݓ蟙M"i Hm"[{o3ᐺ ;(M򊑷/j;vs4D}dyh7-Or0 8ۙpU_i? -xP-ڴg< -l嚲j{Minñ Ƚ; qܻsq^_W};i687kݙpF . 'E'9{:+QBnۙ;tpaiheimFCǕj{N) ʢma#VJeҵbqd:a_/u9TԪl.e:]sS$(i%ɈP\6jLd[Iizߴ]q#RWl[thE[mqbc~MvyP{rc$-Kut23][[SFu-h# 5ۘ,T'B,+%lfIwVŧҟۖmFmYZ*7x[-};QS_202.RSS,mu܆ꙊRk.?)"C=^+}!&4J+ikBw Fk%` q[2tg UHP:K=$S@\zZ*ژN!Љ^G4|~ -endstream -endobj -514 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 513 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -515 0 obj -<< -/Filter /FlateDecode -/Length 4924 ->> -stream -x]۪ʑ}gÑ~p c?z00{ۘ}ߟR^BJ{w]DF\JU%r zEM+S.f/V.N^'8M ׷ .y˟uu}5ShWR9;*CTO1U>:㶪3\N^R gLT fXݪ20Q;I3tQPi;QJ5N)A=Mu:v -i%]B>I:[|VZysJgSt`-&E+"l1Nt ]ItN>'D]N:䓵Ji=y`ӊ:(tR|u[e$-%xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a -c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& -%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ -CĜ"52cX8Dmѓٝdr &_qyռSVjsj -dtG|6iTm, ",ld&hz4S'JAf>4AKS?3,ha@ ͠E}[% ȴXӷKf>b:맟.^/oJAӧY}&,\OuB`m(o+oeZeTZ>-C[T_mdfguV乗Qi*>}|~?9 -8 7.zsYϿswް﷞G?>/ul(Cڥ ]#UH7=! oz"+艬g^׽^֤!ϝdVVfv|l726RpZ8Jy:cC!rCI32a|ėlM7$uL=? MF=tH=juިQ?(`5[Gb{1i Г+yDZk5J_Gu23zf1Qk^Y ڐ{cyu : -j_ǡsEe؈3m͑GBifl{ '<q:g&0$U<^?1d|QAf\leBګj_fiD >'<c\+gxFtKeX%(2~{4=t+w瑧Y:GIW9Vxl:`Ll&vWJ9fvÙzP'%7kCڤ'w?)itF X`wڐN]zbϵUF }]<:<|Rf,~IGZgYLkn7zhS.eE;CkZm{jrTJ5 ]ծ[|u4bIk)I>]9qQ#G7qPpZsc}Ӷ꧑5}ޒ>2Z%g_c1tc#~^cK7~,_,x-b9|iGaVhYAc].[X|6F}Nx =r*;]>0^:e=`. { ˂v+aR֮zzDc.PۥYD{a}&'񆒽!3?d|;^Ւw=OO=u! <`y%QB}l\zᰎ19)hw Ir`ڽqӃ*G+RSw2ϓ,u9ܧ^'<8sֵzSv97npJa0Z I SCGNAy ц#6&W["Q'˵ːK,rcR>6>Qt#qΓye젏PaMY~h<\w`:sRJwaL?n"5Ǒz.!5yacŷ}Mj$Ս׸lk;|7%Oyb[F̍p<2>1Rk:Bt}yBd~su;ey3)!sy3Qe+pGGHODQԷ:WX[cB6ۺIa݉!O|8w'{r<2f&.Eaᝣc8sfGzY͔U2t1zy:މ+chÊȿ =G|m7cQP?Jnޚn=vv{lNǏ-iSy7ZaNˠثV&z4aꨫ^׵>"Gl 0Gzx&,\m9Kj;N_za޻^vt_{g!c.Lc~^{$;ʯ =Cq۰鶟/a~߁BI7љᘯͤӵX}9-U E//J颳 j'S/B s1 Wr=Pe7mI:|5TMdw. B z+֫I1Bl -:؄@{ƻbmPظj6ׅ.lsi5; M;kQջF5eF&5eI.Uv̦gFo]ɵtD[OŖ*zҡNOunH?ƈZLOVlwm$vG!\|ZVn'ҥ1UWahVW_7)1E)z7plⵓ<4q=-saK'%'mVR2&G$c- uMLVӸ U5uoP~[ UZeA3VnƝo\[kzs0_ybsj%]lTzeL )tqѷY\Gkc-'kdҌ{2OszCOw xD?.e7iܺ~&ӯTa6Lh.֩ m7U'R7M˅Mіyo[ }'j.xsp)ʊ%S:ΰUe+3 zT`a]ڮs}EW -!`yye`7{19@FMƥa$m'K|֗mαuv,{9}h­.8F4l%畺*[UZ'F*k%jS(٪['K]Wi{9^ TnZd[9co)[,Y๛ʶuuufnH葩&=cg3:Hy'DjyLNGkk*q/%5p㽒H+5;&g~Q6 |_ )gJlc:ͩN_^!.#-w,~(*-Ua~ha}2?x[K -endstream -endobj -516 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 515 0 R -/Resources 4 0 R -/Annots [ 517 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -517 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 423.873057 101.433071 405.123057 ] -/BS << -/W 0 ->> -/Dest (cb27-1) ->> -endobj -518 0 obj -<< -/Filter /FlateDecode -/Length 4770 ->> -stream -x]]㸑}sQ,La Co}ؿSH%Q/n[U(%w%r |IM++)E>џrq:?)fob8pȓ,賙rF??)T*~ p9K*3VaK*I* 뢶 3LNR }TZmu0D9g~ -h 錞B&FY;ג.O!$->+-'D]NnuF'kzuQ-A,`H: [$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4swWF5 Do -;[@`X PdH\:c4j) p`)e$.>`=VtL)E]NG btb-qRS ?$q̀N; b-*`*g.4l-q<]贖 oPdVAI\kI4s֙ID&Xi)ElMH\Ŷ,6uz'qAJIₔ`QF`֛Q€` <> -ơSJ€֛I\qI$qA -M,qmf ;ᢈ:) &Ib @$q 7ы!D( >$xiXo³ -#3YhřĈz̭b@{1[E1f@F0+ĨU( - p5CTp3S}[sdv%5>Ͽ~o{zU? v0 LFw{xoHLDRd! |&s7Ro,,?m>c/;@݆b!X? VXa Hc!vW*H'um|̗X ;ӯG/Nor<Ҭ| (WYΚf.߃ZeN79}d^txvzf[Zڳ8^=|~ߝtKxp.Ney N<ϛE:s7١K_ʹ\Mu]nN?_a13@uvma D.|GN]s4buTSԛVO^(&{ń^C~4r -iUBe}bqi30@zvV>(GnIQ[A}-w9]ly\FBt~eF~*Fn\ -If=nLCʩǬL+fN&Jg a ҷ8{ue!UqiSCǏW˲,r̷ӗ<7P6>WE;}$ 3($,Yǘ[FR}E8BS"D s4 r廙Ƹ]F8!e==p{Djr.$ݻwwpihՕZV87C+g+COcIGy --y痹O,y]eL3OZ-ZarIW{-׾<׆lz*{cc<.cY9mletY0Vz9{Mgz2~UV=ܙh_wwyDmtcw{7yEwPuѰ㌬G]o/j&#uӭNp%L36|•YCW}q?ۙpU+hyhu{a3+eWZCFc&ߙp]\y'5v -;s84n?^9z+b$S[}lWcaԷñ2rz<3ѐ]}WG谟Ln`l1'b;Ir_"=)=:i>a/aׂ9bs/ya蜾 -qO;o}xݙp>$ !#ORTlϽ'pOVrBZkղvm<ί zYyzw9} -ٛkBֲ.u9x"hx{Wh,uۼ 1Dwgaz_lgAׯaQ7#Z&1Ĕ7kkHWh 3{H^<CC{3 -?Olok~9~7b~|%`1;|~Ҝcmc`;.Xۃj'z'&C&}=SRtZ9l[ˑڐN-{My>ճкYe7R-4,\vg 󖴗eX[[{fgĮ驵U/{Uode-ՄE1N![z\[oϭYZr qn)g^[7a~*r(k[f{r$uH`3 El:5t8=E[/W:/ـ MJ_]6ŀS G]I畜r?T{z^;p} ;\:'$7:v;T'SDsع>7$Vm> -endobj -520 0 obj -<< -/Filter /FlateDecode -/Length 4840 ->> -stream -x][q~_ ؀?8yc# C~ċҥ{f{s}ZD~XE)uNh1o.?_N_N8UISGw&~i\{G]HkTֈCQ%29vQy%p)q*v -0æ8̰ZGFaA* T0C%Ci)Y 9VǤ Щ91tIx]t$s)k%-KTp3cL}9Z2lZ.}{\~Wʟ9O|%ry&mMYCFԌTyэT6]Z fg&_]ԋPAgm;ϧ - >׋y:C#)`^KqDqg3}k@=kM_~/oHiZC1ÈR_?"Ӳ*]TrSu9 2}~6 6ԎLҒ,gˠ|5[os]aʛ9:T.N6(j 4\T1y.uի̗Ttt,`j.4j^WKWtH.2Aɽ&emQ:]adkFvmDZ h/_2;ʷ@KKÔc{<3zIEx]-NMSOq^ܧe&?[# ew6}gB!{ -DCm2 \O"%j$0%܄ ڳFm_W[|:o6Z8UZic"`ϜwK#XH2{<|(7x's_B,hE;g }$lV'ϻ'WGm]$j|HOOf#\gC;!Ǟ ˖^Lqy&ZX7}_|uH2jza'<z҂o+/CvQhV1riy}fƧƚ]ܖ%aT;Gsho)ʱ={SzytCt9;ϗ'<j3=;8ή)]C[#bY];Hծm /C>|~ Y\:|x~nTϟ=ϟO߆|9 ukg#y }ytrQ;qc㹏dpD$D=r2ӡ<uw)hcDvFEEAg1~^XZw==pY -~F4?kt2I.1Vs4k16J6E t)Fћ7f[ٖʢO2AC-϶N:x|w\ׁhw}uW *gccۮe>HZ_lYlKf._ê~{K\b -rCQJ7ܰ꺑3b皊HF sdNs.*YAO 0!Cfq変/ˈeYUV DDS'|jᴵtd},L޻u"Wk1]j[f0󙯦jU -}V`x(VFvBʮ&ֶأhWt }өKZ.֌wVJ(EղLgTRWRhάhI lMJ:Ft\PSŖ5o4X6^ՍiRL;־Í^ ogHl Lj׸B^hr8ʆ&Che -W<@ -)#JhlVzcP6]s*fB Ϥ'ҭk-]uyDR-\WBTlDmU0䷦=8ҋyJ+"eIѪ12(z-o;XUލgKY -j4~C~b^ B4PH;5FzM[; m|@] -endstream -endobj -521 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 520 0 R -/Resources 4 0 R -/Annots [ 522 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -522 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 713.673057 101.433071 694.923057 ] -/BS << -/W 0 ->> -/Dest (cb30-1) ->> -endobj -523 0 obj -<< -/Filter /FlateDecode -/Length 4786 ->> -stream -x]ێ$9}gM|Hi  ӵӻBH >'i;Y]S"ӕDOU.}VJR/ߟ~8)zꢨZ8yCI`71NoN:lOrv)FUJi+b4>'bΒ -f۪"p9yI31IP%a]v0D$GAF)QCs:IgR6YEt4)Dty -!$lYiIa)I[MQbU;Y%t%Q[TPZe;u:bO*IM+00H! -:[Yot8H:1%aVY-Rxd#Y҈:Ɵ?|z/h_iv.uXr헿y+zhk)Ӣ[8^6 CPV? a׶Zh^k?/~ߝ~a ʲLAIY;R# -8Wq|K7/ֵL,_"Ϭ0] 2tD]úѩp<x̾ޛq!==ԾþO. $ڻF~&=Xs逬7ɣD\S_HFWp٥'OcwSTJVב{!zy ֏и.A~ ~N=ƋVG/28ͭU:OckX;ztD -E s(r[#X IuZ{뿰Hu+2 qih۽0D~dH2RM;g<R͍\;V/ZƉ:G}[7Zq#: -<.ӗ]! |`C|v/Sy'{-ݱ{γ]]ȽQRj_F]62C60ּ2D!;B5{]ߠcAM[3ڲ}31ۊ͑'τg;dy:__GwVI!z~F)2;\cp(͸JIf226x^wcus\+g7τrdgl{\XԲ'rUa|=Xۺ+1}.:OC<^yQX|mKL9m%oh ;o#khg$L2߬_bD)׳j伆o}Xgï+w瑧YwsSGrv^cms`_Y)X3_4b#.`>-6%kǂm)+TO>J[VW岏Pl\lSd}?.eS׏6QkkԎk5[*VhPt4+{Ό+3۬]Z˼2n7 [`yUy@3;꜎ئn^s;7kvtpތDA8+HXkQ<DZ+dwQ{IȷcL^xϛ^)yDu9&ƥGZlH8*vhs]u7{}>MqC/eY<n9L*ӉQCB|˴bEc.ТUۥrZ=j0e1j󷥷e!SN.u>޺s-с*wx҃BVm75K,9y}V耟;A\$eP{6#)36tZfe8\$7S׸O}{)7\z9>`R˒idyga(=aAl5 :tI3@`mQu௡(*3 jkhvXC5 -sZqsS>E=8GMm90(v4U"7PT}=謇CtM]@]GX>븬-(p%_/l=J2FZzٳZO6)u93V4iCʟh!3Qu.睚(Zt~Eab)CO:_6 IڪiQvԝ v4pyZ[N*ǒjyw7)N/wC}F'!zE;VLw&44*4S(nޠe{M VXw]l\Gu u -k"k Q&J,T.VUfQI}-ĵqD Jզ٨I0U V.rr-6RJjt/. @`sDr-6*1ܘr.~;(+Bm:^4*L*s*|5HYwBsNXI.]:ƆY/PHn[I˘{C$mޤo\nd-a}b-juv,{%9}j­.8F4jK;uUF*k-jSXU;Nb);iG9Q nx-[-αߝ%[.Y൛ʶ}u5ڞmnH虩]wܙ RSvBtGq#P;T - 2KlkulwD^ 19kU=y oP -T=ZV-VP9 *_TˆPTE&:rj -endstream -endobj -524 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 523 0 R -/Resources 4 0 R -/Annots [ 525 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -525 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 210.123057 101.433071 191.373057 ] -/BS << -/W 0 ->> -/Dest (cb33-1) ->> -endobj -526 0 obj -<< -/Filter /FlateDecode -/Length 4688 ->> -stream -x][~_ρ~؅$ By8ӳ'K8!?lbl='̡UU>}*eK\9k gpR8s\;fD\?Gr#]_sX'Wd!X)_?EVy!T*.29'%TV0\b -f^J3Pyj -0C:)8B%8sRCJ:aE[J'>@tIJN #(]`Z)-&pA l1BkN`VQ: [U面tHN t]ntA1֤.@ǽKtB0l*RFIb %SEҁ'rUޭ)&uO1;KQzDqt 5E+ HvNQ4 aG:)("Pm)&Ph\R[T( [`Ԋ@  -ty(R\@0S\[MqJUN HQ\XIq*- -hRI` Lqؑ)wh.ʀCKq¤ ޕk 4xW: 1AEqJKFn4\R\RKKq?CKq{褢'cn +?OR\`£H]`¡Ɖ~Zf@qbR.S\gQ%+FjJ2p x~p`ߘ. ).0]В0LB cR\`ˍRX.p{HlQ^R\:t[OYe\)(x 0rM ). ^z͂s8tpHe868e:آ5 *x -JJ -p(.GMN` B4lHq5XPJy脣90 0b<0:).pP\y Ϝ 'x Aq ^z2-#4撨jJygz ,` $u4Aq'N `i-h q).H.).6|Q\8lGqAE78tS\|Sj /|S\|S<e|Q\4l1pQHl~ N|D,lAS\MOq 7ѓ!盎 wM3Q:.8a-˷?> 0z977߈-o7~åCwLcRIҤ4}Or)'}|2iˏz[O@1zɔFMtli5l7Ke.]?s}X֞l5s cu-2֯qU[:T(e0Dy i~jppPJvʓt;Xyqu;kYC]q -O0P;r )ѰJ%cl2ms5md,c} gב=imurVz(בV2-{ʒo*aaCf_!lrhv,Qe4x3b?"f}yN>o1Y.R[#նdͥKe 12KoJx++QH1s#wnYzõ3鐻Et޷f|ߙlhV~ 9#fgѡ±_mdi\iŰ`yNm?vTb<2~u7gjGnxrqgadleVH눬 VyڙtWpJ7z,KQ;;q3w⮝gЌ-Q&.%XBҷOhiPݮ٘?(۵#벵S:SUzs:FK=*UnBKZ9gow*b'P{z]jV3鐷s.:ѲڮHz>-o{$7FV\3{|y\^RTWQg{55Ki}'*~|ů4JM13P_:껔lE8+r<ŜynZ: -Zèk:u;}8J_f6g ,1g 2>ǔ.I3W;MX%]V~ƢN2' v%qBG 3g\ns/_;ֽm\ա6#."<{=N -ිm ÌwXٙl;w}-_3t$kXj؝yN_ GDm\3EVZEzs6hqF~j'F޾Hw -rG={ u9w|']O~jզ.,_AouyL q4jb~=~4O԰X0!DN+xILMG6blrB]-',wBJhB^WR'{Dܿ-W-lz]ujV9 U]@өRJe2*dI)sNv!tj^j' .tv!Mg3\NK֐jR|xB6$uqp~6@jk+ȅv1:"~G6+IЫ:o{^Rfŝ#U,3:C*&WJ!ofjͬڕUu 2f#ԹfҪ* ɼHRu WQ% Zԅ=ww}2٦ڳ LxT v~uRUS)]zvPcmJ`Bu -ME x3djؓOQ?5mVɕhViޒ2:wR%ٲl=/;2t1ϔlf.y* fpJkN*4r8vdI$4Jq'ޠTo>tK:VD(_DSSrC& zs 244ܼӳ_1< -endstream -endobj -527 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 526 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -528 0 obj -<< -/Filter /FlateDecode -/Length 4917 ->> -stream -x]]q}_ 5py)J$KTIixӪGxxX(*_rzJ)ஷ/\¿buQoW\!$qٛo7\o?'41gI3|tmUfΘ$̰.jUeav -f죠 -vh!9kSӃ3z -),"t:Ig^K<|tk甤-Φ(l*Q[LVEb,l-*(-鲝|NΉ J1muF'kzuQ-A,`H: [~$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a -c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& -%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ -CĜ"52cX8Dmѓٝd?z &_SV4!00}k41`CژYDlYuae+L%c+@SKR2+Cd^[$Jf_HlO\Y}mho[*a/Vbdg+Vhh|aD6V*FdVze]ސ{cyu :XKEe؈3mڙmifAu#\C;ہ87!z~wRd9 uM_qn2[)b㔽W2pe~m<d.>|ZۺgZֱ4fhcu!@mCR]1v>0} 1ůaQuG\&1ĔcG12bFi 3hg$L4_P/qFkz4݈l5ߕGfk$GJX逩3ju5F(;/iw6RnRu2XOKjxڤo?Dٞ5bYg/a6g紞sm|_g4aKY%v-.J3zݽ漤٫ܘ\[~\XRc,[)v)VY{SKoӝI̥v%O[l nSQm9ji#;lmYmf^l#A9 7__T2WkjcӸeI+߰>syRmxbRmKIyf˒6uhS<&r, ~LAh\qHpf'֗nḠ~kW;oOwmsMʘ0zqfv{̺Ӊ>u ʮ}0W?UvƑTz,u;'.uۊ?V0 ~Y8He~~lN]v)gpUu X e29yn\ux` W:R|jq2ϻn{r7{m*qQ(ln ZΝ[at\t +A%.Pۥr:ў{}GIKP;ʹw=dcK3ڢ=vt opΖVKM7-'َXZ5>r7\e#K̐NE798(Obpcb)CÇ35.y6G0:bYm_oEgg^4_,!_y͊ڔQvE:yelP xbn -%znqi;HqtH|}nm? c;HZWx=k;|6K3toGkBwӰp<2!ZGJc=<G KAa7.bQx.ϳ0[ϰ[i{G`m5!u>Y;G@ ouuA g6ۺIa݉!O9w'{r<`5f&,Eaᝣ8sf>U2lv,F(JZAyhˑ&. tD~ ɪ?T^'pݕ9bjIYy)T jF<cy+feSam\By.U!M MCWzaRM8V_wrR-oW2_zZvtD/Il"N^tۅ޲sa;b.U+V@qcJ'|xQ#x}Fos&osł9ފjҋT&\f -m^i{=] VXu]l\GӛMB6ӹ4D֝GQ&Jص]2ruk$nAE;tfӳ^TZ\ EL[OŖ*zҡnSs #}#֏k1=GZ%.޵oԾsz\hYMTKT]YeF -ߤ7b*lÆ c:0v=^SƠiw2i52mb do=_8zv^W[o.S>%_Y}JP\ -sle&W\O;b,KuO*+`I[~ vWWF{x}s/&:HڨI߸5d-a}[{eس-Cnu1ʤg[x^UuhtVb6%[uKiq[LѥW=IKEK@9֩ŒII]Oil[[]g+k놄oR3v<îk1Q;T -3Klk<{%WkBwLZ5}lU_OΖؤ luS%Je߲lHKE4KAozJﳡ#~}R~W -endstream -endobj -529 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 528 0 R -/Resources 4 0 R -/Annots [ 530 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -530 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 450.123057 101.433071 431.373057 ] -/BS << -/W 0 ->> -/Dest (cb36-1) ->> -endobj -531 0 obj -<< -/Filter /FlateDecode -/Length 4900 ->> -stream -x]M丑ȳ, /|b)Fc%!f(̪ng/܅JET )%}VNR/?~9)z꠨og\!$qٛo'7o?:lHS VPy?h|TAObΒ -f茻VEr -f8cJ0ú* T0CgVCD QY#负=H:ɢ.BtN!:S'I`JK:[vNI:l.uŤh%]-]-@WuE%]9QS)kQ~Z%鴞 ,h׺$.]봒wEMQ[` J\V(qb 8 +III\&)'q%@ sJ\ƣ 5^ x8$.P&.(lJ\:c%.@cAX"qO`I$.]>Q'1¼(O:,qbx.3I\ `?QtL)E]NG btb-qRS¤?Q$q̀N; b-*`)Ad.4lA-q"]贖 ؂hPdvAI\{I sID&i)ElMH\fK\6:b %C$qAJ(#qI(qAVYd @)%qA M$.f [&x¼6~3J\lQDlAДy N~$l1I\CfaŔ@f]L4H\7J{{LLb@z=V1eX3P _#Ie -b*ZiE<8a>U"!o{^ncןJhC|i`2}ktH,!#bFjt##ѿ0rzNϧDŽ3y9a:Z|g4N6͆ C\ܪo?Ŋ9X/vƟ?|0zSʅ|כ/@m2ϘGhu9j;"*xGO>.nKeJ<=Ovcsc\YQύVaxoߏzac9#~?O85KtZ谙;"=V=VdRDvJ7%&v]>jkk2fqJ۵ ~hOe -/ӶsraGY{9`gvF7֞g :F}O9ꎲ⽑\j{H4O, ߳c^㰶ȹ6l; " a a<M+O#JXk,C UqmSCǏ3 -댨-~wU~YeҎ_x2se,z( a6~}<WHV' `Ͻg&oD{(=VP_r0o[a%r7 1Gmyxz`g9åaT7jMov ,&;CXQèzKeis>?W$ӊ~AnXl@uҌ~q|tډ1]>3.U>G11X>[vY0]v`cuQ&B#Ʒ>U:OQ?w2va@`gC1gXlڸdQ~b}v~Gw]6ڛٸ XJ)dmth݉!Aj]p%`8:Qs!W>rcw{wyewPu<RwaG1N`˚m wHP"<"wbU]W }y_:φ`~7r -b@Y^v5d[=:OޝuBWC=VƨDoj@yǃu;WN/=uE쀄-ˆ@n?p!GuI}'޾?i,ù\:φ\,~m(.Xޓ" t}݇?ynԲb܃uͷcn=}jv[jYV9]<{@#d}<:φ{2U7ySs޺6c҃;u˹~H\tԲqxq̖{ }3q,>=z`Cν]]U99ly/lѦeLe~> >p_:Oҝ -vweǽ|ASߜ9oAd1rSyJޓy6ƃוC1mn]S1:O۱k%{5ZU -eot_.W]3B5{]׿Bǂ-ԙwqVl<57t$ GCRGRTwe'ٞ[(mjueVƵ8.7'u.>V|;Ƶ~SzvƶŅK-zu]αso,Z^c6Vw`)KqXNTrJq2N1'ЎGr-jUvA <>|׏P}_ѣly|bAA_jҋ^ۖ&ff{ bmkbb=^ц.ta3feMd%pZ;JD),6UGר&̨ܤlqOrߩڴ3y^1 Skr-'.'ҚoTUsnJMmمEC戲ZLI5܎s%k3N> -} -+вv8.',͟05^X@Tᛔ|ЮA^:ҏIhn6z<4qh{Y6\:ƆY>^:)[g =2U*=2w:CA*UJ&D*,NGkly J!CI2R#w׹+Έ\ ?19kUByل7(5U_6/WJ} :ͩLPypSB0V^ n)MӨ|a2ya>)? -endstream -endobj -532 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 531 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -533 0 obj -<< -/Filter /FlateDecode -/Length 4820 ->> -stream -x][ȑ~_Qφye`  g1هumEJyTu5>]K(/#B*I_~'bLS/dU+ -Gw6 !9}˟u!%oGVB A9AR -*.* JI*ADAaZ` $AF)QC5Ncн3z1$t:Igi%].J:-.)-lqHI:B6IaV:bb.I.+:آҒ.H$t*UNVaEa|tx咨-*#,l!H:!Fa^VY-l1&-|-*x%L%C h%01 h$7OA4tFKD`lq%&V-6ZbJ\`H\`AoIi/qL%qI kX.{uF ڵkI+ k-j:K\vVZ22`VK\ &F%qwMT$qwM €5h%. q8i5dQ78- X Cghl0pK$.p] kl5蘼#OԥAn1ʃ>I\ب F;j I\8 ]QbwAKFƒ`QIK\2P RASҍV6]=7L>3PAcm·y F>#V_ڜ6C'{o>]c_;l x O_~PXJ_E/9|Icae>&EYqlnF87 c9eu#4F{XfJ'mlȳΌz=ձP1~?2n6G3lK;<mhl>N0]Wکd6ߏ<7{áLvP ~KVml^*g^.XxC5&"`a !b^E%Fqh꡶ G@F?çj+/;ͫ6SSdc$lv7A%r&@Ob-! -ףV8hQmUaΤ=tFyry1BVE"g/f>[Uż9A>ϣ@ uK&/qf"g7u& -[B.p>q:li^Wm&3|)靬kpܧ0VOsl9Wv4ʌ_.V<*d-mTt\ڪ^u̼(oa]N:%XŠ!j_,;8NE:φP Ahq!MQcQǟ(e;ee;>âP@ue< ʚl'^*&v(+B~>k̏ $F_UluȬhB;k|z<~k6H=WwPB.;]Ԛ3v6GόX!uuoseeqՉ+i:;f6VnQEyK4&2SCO2y6d:GJzg #[Լf|?rfP<#f'< -ufCgti u}"3sA2#yKm[g<)dbPsuy>r&|Wfvm|ڏ-xGc?Gfćf:v͐T4| x<zʓ:]Բw=ZUmF^&Yi<=ܖaT;G:φXo>ޘx7YyZOy:noշf??YмBڝ+bvVF*3̫-%b9ڶƑ[Wv>)MQ|{>y:4+duw\T/ׯwfw7R+>'WWfG%fV/^k\]2WOy6dwA]Ǐ Q(#vړuw[p%mu.]gb=}Hչo k'<B'U`C.CfD_M\KhR{Eqŵwm̮^4.:K۾tZI ;ⳏsu~ߙ=Bkۻ r__Ŋ@iZnŪ:B|yγ!/\_ķ.rw]ޑ]54}<-_": Q:2A["dCA>tݓ]sanSEǗWO̷ӷylJ ]lDtӡyt(e;IY{W{VJGhQNy:g*"X";#꽘3?/QвL/ςݭlOpq1k5G87o; g9b0{%wp&e6գV~ˢ/yڮl)u∼|y:Yua=:\5~ʇXر<.LR϶&LWfݑ'<fdyG'<Z杻gfZQp| uγ!%\}_7޸C{y_ԙɫ%Ո)nsY uk5>Yz}!{ d''>kfLR[tH=Ȇ=gTM򁙷_^lx!7Yu7=W -o{'<yV:7r X%MN9 -?M, 3͏{jayՋG}Οw&]E6^ ?W|&"'~ay)OD1LXB:'?ɏ('o}Wٔ.S$2d\~yeg칔i9ϏA~w{HW~vTt&V_7j7>\K)~/?8?ih\9J5~RG  Bz-Wң8WS!UlkU<k:[ U]*h~H~:߄~t7 t otk7QʯZ)M5lgTRWJ :Ovߩ4a25~`(HT˥RN.b5Wg*RUMe) 6ցdy&i෸ukDq.<eUpcVQ]MvqA(WHkڭ^',"}#U*e4UH#Qf:$våCKG%gҭͤݐuyLRO9EXM'4~ʺ5{)+텮a'6Fnd܎ȼwnچ=rre~A -06m[kG\mВ*o]Y63wR~*,tnڦMY>\` ;M3{^^d_VK+W[/'JxC??{+.PmvkV'-Zh'TR:-E TCOʰ3(S4vAtUYnx[r=C;;JV_2 -2׮Rj%myevA> -endobj -535 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 728.673057 101.433071 709.923057 ] -/BS << -/W 0 ->> -/Dest (cb39-1) ->> -endobj -536 0 obj -<< -/Filter /FlateDecode -/Length 4862 ->> -stream -x]ێ$9}gM|Hi  5ۻBH >'i;ӳ[ ӕagK_~/9=cp.j^_I(?7V.N^{8M ח .y˟v:)`R9;*CTO1U>:㶪3\N^R gLT fXݪ20Q;I3tQPi;QJ5N)A=Mu:v -i%]B>I:[|VZysJgSt`-&E+"l1Nt ]ItN>'D]N:䓵Ji=y`ӊ:(tR|u[e$-?">VI1P^U2P^VQ3P _Z#0+]LPj%n(/1yoQ!bL1,Ny^~]VvFPR;W&=o@1 *1Us7Km62 n?ld,rc%h!kSJwXcE`h춾:]#b|mlk;IyVL`XzzE#%~gbf֋1cLlm#%S'PS>Sٿf&2;GDfC3(hkV2]%31h_O@__iiw!4vݖN뗼>oeTNҙ~oK]u]<$͠r`oթ/R%o  CD{]~a 2I -h;,/Ŝ8Mr?0麘W8iӳl$=P&Oݝa|ru+O-Q U2HdG.VG[{LO$t!{mq,Zar٤C2$LcpuǜG_&!t25ErkDP $g|NKOlD5xފ`qyi(=1D~ބG;HdC@8V/ZƉ:G}[VP7'Zq0Gy|^iiwwhdCxvoV˗>?yإݨEFyC{2ϣǸ*QMG[\·q0 k*kZyM<#y}\z2áNs٦:@ftcu:_na<&=:yH~ms98|?iFcaE}ŷ^ИH]p=i75Zz8tgCQOgVVfv|-nޡpHeGݺdZwExFtKigNYM/j~y8,vmOtԙm;Mjw/110,Wq Bh-_&oo)it^ ~'L0ZɻsZOT[6_oi0z12*2˵Y5Z*#5f}kW=|ʥts/Yj -ݫV˖*GG4l)Z=J7wP-uZʙg2(&?pE|sm+bO[ڟ-+r- yf#,u9Ｃg6inúow;aH3+b-s[viӎrUs;]`fS`m~Ѭ}Q"?3͡觙zY]&Rm7of3PK缵E3LfY<=s.Ѽ5mYPJKĺumq5ǍQY~ -hEGNynjSJrˍE&v+aR*7zm fZp.SUBۇ){?dۂP{CW|;Dzgz: jy4rףg(/DTP UB@rlQ9Vtxk=v2ϣ!*k}ͣkaN_ ۹%>{[w:$z`vl ߽tOy\y;(챟fRB1 -y4ju.`rLoOΓg?6ۺ"JaJ8aѣǠad ow܁W]mW@:Et5@QtҞwM]bvoGL] at7UᲉ^nLYnusyj_7=ＬMJ6%"u9%X4iC_#p ngbҩIYk7X}Y|ᇖj>EG4Œ_tv,g"N^t˅wع~{񎘄Grݭ3NyLիZ>[?_[C}Fg:Ur\ DΠbj"H]B36[x^`xWbB*V]Wt^ms]f:wf_ӚȺHxZ;J_D)z^5,3*7)[Ov_ZCg6=5:;v -$N.b4z*Tgݔuٍ*l([?tJ 7f#]k#_.> -} -+вr8. -CM -ߤA&͸w2 I V<#%;F50[Wb>b^*lÆ c:0v=^SƠiw2i52mb d>o=_83LWpuOWV$(iҡue/-[I4דw #v,/J+X_=o^ɡ6jo.m #i#QiinՐV'?. -endstream -endobj -537 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 536 0 R -/Resources 4 0 R -/Annots [ 538 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -538 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 292.623057 101.433071 273.873057 ] -/BS << -/W 0 ->> -/Dest (cb42-1) ->> -endobj -539 0 obj -<< -/Filter /FlateDecode -/Length 4739 ->> -stream -x][~_~`! 8!ٶ&<+ґTRώ5zuN]QIW/Z0zt™3A>\׎7OQsHg/_.iq,+STiŜwBB*csXBe)@`qZ T0CK J;3R #T!9'u0k$Y4tR0 A'tJ10f5ib#hEYIl)J`DBa Il J3kMt;?InJqJ'3"uQ$-@`Q\R:[4(x(=1Ze݊+A liR[H [`KHRS$ bkOiE2mp(."aіb%`%uEMq (.P -H(.P`[ P\@Aqj., - 39 -(P.(.P\@t1 -(ЮR\J Nq*^Q\JpGqbI Ы 8+Lz).]鹦@w@Th48jJ%+( Io -1;[@`N* PpK(.0]0clńG-N[2 xwAp<Ì*).0]0SS:𮐁S\` p(.tI]` ,ơ <֛RS\qכ₠8֛X6(כ₠aB` @[p֛`'Jga `m\oz f` tdkҁwZ p&<[jmA?>8=1^ pp/f+G 87Ƞ[2jiJɰ3NGLI >9J2WO|?)KZÿ0m} h,GD#\(F -tFbaC*W0߫X%u Vs,0ZQAFvWr=I :Zq|̗X ki>]o|ᯀч?MxlXr~c~P1i-i)U.qBlhԯƼbz./ԟXӞC.0(p<],y{S~.P?TF5L`M@~I5y26es5uɰK5;odoia%iƨ^v9`ZEB/![H˽!rZK=SW!K=#>$oTLu?ROܾzMA;# ǒ9:}PY@hH\Mu9B7}fl4Depz,!Z2zTgb1}{^lm"w,:SK_s:nFK=*?}W?cH˺K~aTNJc6 ;L%=[AQCfuَRe-'׷ꘀڔKC9fӷ<7P֎2,]:}}օvMRZ߉*_##yW#|D֎ٿ*%ؙtص;}5GԆ?lD: )fkWlv_TO\vMkWWW_K+*v`[G\xו=ը{;?-3'tO|?f6- lɸ6j}yNԍh8#?#o/j;;}w<ywlD: vW}Zvz{mςVWZ{s:n.W5okq⎝yN ta7S&${S]q%3pY_pr܏ݙt{ӷFh?h۩M@3ِ׽F{dwdDVй]%Os:$?s}H~XA铧f?m:f;[Wl; н -GջBjKh eE;wܐ6#@X -y-2R7YmNlT8+pα.'y9}\EggׄNٳ5%.Le5\+rcL ^8ԩy'L0fgFPW/*@LkMAi°Japaup-<7/Íq;E~Ich294<;dpbDp/~ߩ-NÅ֘?CY&ϱxQ6N'囱ʞ SIum^(1A[τZ"poH$ׅËͩw51CYlH!Ae:(K|&Nq?y.K0n`bBRǟ!L)M:ߤl}GDjxϽbBV9835lfKN[ -,7BJhB^UWR'{D|]n:[D)tUw oTZ )oDME֕f>KBfn,#w;0J(uEE,|Ik<.e׺dSJTdm-4 +ЕBU-cV#hߔ ~ɡ_PA}:8Eʔ|QLZth2.UX613$7}_]b]AFCUtLuI6E.ꂵ+ {}4٦ڳLxT vzuiej䔡Q\ =91ZI}6&0u:&"d> -endobj -541 0 obj -<< -/Filter /FlateDecode -/Length 4922 ->> -stream -x][q~_K8``#0ӻc#8/%N"c%U")<]o?_~)89"ZQN>,a -əo7\.yL)yoYEv -1UJi+B0 *'41%I3\ C[UT0* KAۭ* 4I* J+ءR("kvG{Igc2It0NK4y]t[\RZ94tl u`%]-]-@WuEy%]KH%T q3M.Z$֓6Ì l%Q[UFYBt gCl5I\X 'F+j I\8LX&]Q&bwAKF“`Q&IK\2P xSzN~]H&s}yaѺbo-'̓P6|]p(uvNu2XTAuQ/U[IӦM#H BŲ6;L -s9cy)78nWV22Ye6E[]9GŬ -sNwVeLfbzިT]\-TۈNp;FmT-'hU۵gV;vYoyEgĶ2l~f1 ʝ_lrSϥl6?.c}wvd4,0K]aΛ/:tnCmvݍ}S1; B)s[viӝbpeNe}0Cwm+[f^Eev)43R++VYz)9oic%#ˮv柞{z޹9 sw)m~im]I,>]4ul^;9qt, S< -C?ks^EFxgep؂vN<w+L9߼*,4aSIJK46M"%ףNE{r;?%Fʝݎceq=dCD伽C}pL:VΫMT֓:vqOXy=O`Eq.-[謋${n흎#h9w[牟I|v4;G p$k>rn㽓r"8oK7+ ->I|>*J²weEPDSJ.=T"]Qw<{(\kn˿au.CoEn'SoߴM/l2 - 1$y5CٽͶӋdd4eezT[b$py3˞C}dVia7~-+6+Ej0#\CjC !vЩ-grͰya݀ b\/QQfg8ʶ%,yҝ[;jo]$sg.2SC~{'<2ڋ#k%->!}tK_gZ5nύ(#g&3bvQx2ӡXGI0nnA}"Ƒe˜u'V ڬHۺIa|H'38wC#=A_7g†w#vsd>4zJz;Q)h}t=+KV^:l]_+F6F^Yi!<$p$wޒ0;G<φذo>јWnϵ<ßtQ|g.h=}wL'<ލ?zAHsEwlq:"W"{8rlǭOgX(]G[>"uA?쎚!N?y)Ϡ}~O m6 ~i}y6e,9zV4u{g#y}ͣ{$E)w^~?x<|W#4EF('<J˳QGr6FdgqTT}s5 -ڮu7GOkF'wPgkpq@,0ܱz'g>j9_|cbIK/:O'r,\4ۅOd'ALԎ8pjYEv-))g+dHD67W,뭘[&T8WSe*lR2Um {4Z7a5: IkB7{Q&J,RT]vF*u%e$nA*EQIga,@.tv-:R-k*=LiPSQn7#ʖk1RZ7f#]ՙoԮqrzvVqT /Mʻ'L"*\2*Lv*YN徲I=)]w*f gҭk]uyLRV a &n4eVv/ )$V寗 {/K_i~y7ܺ+H<)o):m:Xǖ4uܘeWKJ]TWm/t;5v=v#ѱi |iKd>ڶX9Mgے|'mK:d eWajd@Ԯg -uu-}E[% l`}ie`ׇ}1ٗJUKkXZ O|חuͱP2y[ղl7lurh.zvز- \_)٪ҲPTLY-1tKnq{)TIGvGoreūޒZTKY}(|JEu5!yes̝9ϰ *?y'Dv7jME!_(v[#+& D֪dޠHNJ]|r&=VP9 _wP *Yvz#-LPZ>4&Zm`У -endstream -endobj -542 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 541 0 R -/Resources 4 0 R -/Annots [ 543 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -543 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 573.873057 101.433071 555.123057 ] -/BS << -/W 0 ->> -/Dest (cb45-1) ->> -endobj -544 0 obj -<< -/Filter /FlateDecode -/Length 4929 ->> -stream -x]]$}_QφMa ?b.ݵ6װʔʪ陭5+# -YJ}VFR/?~<)z%ꢨZ8yCH`71OoOrg"!p )_s5 ?R"M<=LP"ܚy6D1ά;Vָy[_s|?/Fy:߈U?;hlbW}Ōς8pK[ky7bכzϨֆ1*|tahhua?RYSWHzW~Ykñ2r`gC~^ 4mP?_?'޾0iLss{<rům')BE@u@eGh]%?yͨEF{ =Ǹw:G:rv5 >1;rg2?{@WhΗ;{``Cߍ8ߑ٩Jܹvc҃+yɟDG0Nosxg3qzY|zeSlrA#7yk빷5JVjjW3.{!QKկLtqGuot,){;{ ud;Fy`#k'gody:__GwVI!z~z)SIg|^GQq! -ieVxߗ `gCrZa='=;cZyܗs=?Ĩ WFcnF<~=YPװʨ7#~.]bʱkw/y;+])Ll43[P/qF˞toX]+?_V{%`Ǧ7cĶ~po/110o\;`moGPODddDHڤobCCkvtoa6ē紞赶nȗwQ/,@Dž';:zy[rN$5=܎KSEkbkiT&5EYպHaiNX#)dKg.KyiZ|rwrm9n)+\#igmq־y aA9PvpSJ͎Kj_f}Mm,}rUgF؟g~6]}Nϰ-}}-O^+i"5J(Yo}g s|8_U՞Ň-x{,bfBݫ z7%L^d,Z^T|:t#XX:,\RB1ƚ'z] 1 t[>WuZ>56͒jak6:F֩ȖT!rSդ1%Mv -qx^`xSbB*V]WtDxs]f:wf_ӚȺrBvRzD-zר&̨ܤlZ? I~jY*\Kk:At9|R5WwS:mjdVl([?ŴZ%^N޵'Ծsz\hYMTKɌ' *Î*|5HсWBcNXI.]:ƆY/Hn[I˘ѫA1 -۰aBwN=hh1]Ϯ:ה1nZ.݇Llt32x27}ž/mm-j.xsp)̊%S:ΰUe+3 zT`a]ڮs}EWYiK ^ӼҼG0 i&}06“\eslYX=ʲlC eԳ- > -endobj -546 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 127.623057 101.433071 108.873057 ] -/BS << -/W 0 ->> -/Dest (cb48-1) ->> -endobj -547 0 obj -<< -/Filter /FlateDecode -/Length 4833 ->> -stream -x]ێ}gyH8 lﮍ`C~?("tٵ;V/%X*!蝹~zRER_oR?X]_HU]/l?_~yyUCNI{=|^XFR3*ku#e*3L S T`Tfh^"P^N3dQI;aVNSrp!f*Zh,lQV[([w` K(H@=`*x9PE:%9"X8&\V[t4h[a2 5@ tkDhq\A0Sp\:8qJ N 4Hs\:qj` qq2h xWK9.0] #qzuʠB -p\`c -`u~𮲸n*+r(Gxbyw`9.|A-wenji CtX >V̸E+ҹqbX.3p\0* ,xWjԜ+UX.q0H8`~tY]D  -) 0 "IX$qxC9.p]LVk xW=8._-3B)8xWH0 -#K&Γ@ `/Xq\tpXpm9. buxq!8. -h8. -e%ovy[v}`` kv/oh?!\=Z1]M&Yޚ<yŇybC_,a橱ֲ[mlm)۬֙mI6>cc[gϥl۵ksO}.~3% J/X[Ƥ߂n>oz} <vVok~ ~tm`{|ۤ񾱵iN-3Y$]jOӯsYjӤQM7XHuȮ~ߕ໺;.N̻n9+ oX<òvܿʎϓ}lbHf~'~灂G"e8L4Pj^|ҏGZ1\]m(d)r|۾q&?"L>$/0uį%?&ޗINǮeJs[6ce5=v_6&|6qqL[SMXcEn]T|ʦ -Lh&z9 zNY8zAPikVG{ҼNr&}}7˴󰽗2]d1[B=5+/׹2H2+bAsU:*…grKݞ0 MAY~=潖ҼpzGq>^v M2t9fۥm#+5nm|RzUȴ} vۏ] +p,ꙗ̝\=f-B@hd-{Ѽ#>s:d:;P)Rm iŻXK*+&wXbہ]ONrܿ`ӡuk{ݱ''tOb?f6}oUl}`!u'pQ<#o_ll嚲j{MwqJ&qY_>F oib3r%UDjeRJIGka':8qo/iSڪNK:H~}19H1OuR HFrwsCzyc%ˈH5;x[1hz]E} *͉E$() T.=-mLi/0Җ,|~F -endstream -endobj -548 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 547 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -549 0 obj -<< -/Filter /FlateDecode -/Length 4894 ->> -stream -x]ێ丑}ϯg#~ c`w/`؇)F}HRY]= Օ%<< R_~/9=cpۏ.j^_I(?7V.N^G8M ׷ .y˟~uu}5Shrv)FUJi+b4>'41gI3|tmUfΘ$̰.jUeav -f죠 -vh!9kSӃ3z -),"t:Ig^K<|tk甤-Φ(l*Q[LVEb,l-*(-鲝|NΉ J1muF'kzuQ-A,`H: [~$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a -c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& -%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ -CĜ"52cX8DmѓٝdrgL׿Weh%C|a`2#h-`CژYDlYuae+L%c+@`,{J` ͒և59"&A˶vz$[F1y!Yy7vq[10h<lm#%S'ŤDi~fY>`a@ ͠E}[%ݧ tbާo|tO?^~?}?^w_\_0bEvï3=}KAfy," i^"?5C;6W*,m?jKm.=w'HG乻t#W6[2Sq7D2IONy:$߉c9z.g~G̨ul4/dPH=l51UKC؜6yfamfGv\FF*C8ֵRwF ]u5->V8siWc3O~r0,\mIC_9Ɗ7Sse^Lugncֽkf]D1 -wiӃȧyusKOy/vRW9LZ6ϝ[aPanMTwK46O>" -%{]*d s/S3)7ILyىx纑n-3X<=}ׅ(^n7k>.Vcx@x'a{ϟtۀby2wH/:] ;un+d'Y6qͼP>w8`ztAēy<.9pBr֏c\grRl4zp#8S|q^>lym4nv{8$jVӤ5GQOy: G?g4Z69 |8mG Xμ2dܾZnyG&)-o9F۹y[W8}JK -vmfɓwfkArA֢G/zm˛1b/lkxj}U/Z9(Zr'$ayQ=^fōFBXP~Cwwrgi~T?תiW,$V~=gnY\ڰ鶟.ES7)UZ7K`iݤcu'gZ;+ƚ^aZ_,*Eg7}Q򪈓]vpع~s1 d7jћZ>(?_[C}F}t&͇sł9ފjҋ!Mv -:Rn^i{=] VXu]l\G;}B6ӹ4D֝GQ&J]2ruk$nAE;tfӳ^TZ\ EL[OŖ*zҡNnH_:ƈZL㵾Vlwm$vG!\|ZVn'ҥ6Ь2z;)?SoRbA)zplⵓ<4q=-saK'%'mVR2&G$c- uMLVӸ U5uoP~[ UZeA3VnƝo\[kz]t0_2QLO.6v2&솁[ة?e4.iXo~`5}]P_;F50[Wb>w夓b*lÆ c:0v=^SƠiw2i52mb do=_8^\o.S>%_Y}JP\ -sle&W\O;b,KuO*+`I[~ vWWF{x}u/&:HڨI߸5d-a}[n{eس-Cnu1ʤg[x^UuhtVb6%[uKiq[LѥW=IKEK@9֩ŒII]Oil[[]g+k놄oR3v<î 1Q;;U -kcKlk<{%WkBwLZ5}{lUYRΖؤ luSaelHKE@KAo/9Jϼn]mr -endstream -endobj -550 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 549 0 R -/Resources 4 0 R -/Annots [ 551 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -551 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 348.873057 101.433071 330.123057 ] -/BS << -/W 0 ->> -/Dest (cb51-1) ->> -endobj -552 0 obj -<< -/Filter /FlateDecode -/Length 4696 ->> -stream -x]ێ}gy)ހ $Aaϡ$^Dnݳc vJaD*d}pO_/sF_brЫǙ:#) -\05u߾{G^UU\)Hw;' -P 1sXFeeK S H\`o8 <0Cz -0C9I -f`vH%!H+F'MgQ)YT`u:Ӻ.tZ9tI$8l!E[-XlQiN`BFa YlVHNtg'bu:᝟0Z N'egMУH1:[0t8xh=[UZh lQ-h|-YЃK(: -8P^ws,|9р -#ZH@ brL%l!\V[t -HqְE@m h@nIqߒ …  ( 48W;9. ]twqjc[ 4xWxWkdui5R8 n8.@vX*/*!չ}Ps\@]ep UF( HY #Xo -1;[@`Ni PXp\`2`c4ت>X xWz4 tqߢ;imw1Pi x9.wQ+5FjNޕ* x~p$ 0uR.t"xq;$ud X.q -5+n-+ @ni8P` -N-Bqa@y ``/Xq\`=u9q :|v868e:B8.c<NN #肄N` SL@q31*t~t1ƼQ7!ß/-'W雞s,۔$_%=[Lw#)w?~6`a U,?1u]`Ti$.ULMS }K爰TD'7?˶XUV]KQD&:xyO3<5- -Fְ\1!e  {\0[o9dAۤ-uВ)OzMF;# ǒźΟ{,^#T1ԝyΆPwy({"epZ,!m  ByTgb1}{]lmʷvCk `:ov_ӡvOMmv~b)ze۫njs_s:mܤo淳δ`;cuPhy#uZAһ- /&g"N;|=:ߪcnjSFǏ -wOrȷoun%eGUrhg[ډE?UGzJGQ[Qv9J7˽.e3h#,ΊiFGteu|kkv9]|S }MT12Hv18s'0^G6G%}~G:p8aі 1x^:x|wk_kú:vEdWk=ףr[Ѷۈ~3cum3ِj7awI^1f c qVw; ՇdN;[wgӡy}t6^NFa*-TӰ ~^zs:٧#tcmg=, 7 -s:$?s}H~XA铷f?:[g}O& 5wCqĸ9ְUru0oO cعTbA\εĈ #Nq?E.dJe7BRN?C.\St51IB$R"3"sqzQwl6d3@ӖKMԢPT+bEwUg0^W?Uj5VJ㞣TJd -YjR ۉ.K&4fWwn>r1ۅM7frKʗ!|1@]\񌬯QvU:mlWQ3b("~Ǥ6+IЫ*7(x) ]3W*LFHʐ{וr7xZIf!$.\l]_ &}$ݜ:DZUY%w!I*T,38RX̕P$#p"6/q -YYrf|.f{slԊ#}:I+GrJX )qї^zkf-ɸvsJjխ,y/|Ͽ.t>m6JdP['z$+{nS U_җ&!JU|M%(ĞR̠2kk)uXU"5Gۦ áN` -.C*G1iҡ%UeA](b$T7*7"ꢣ2E'YU> &Y4La{=6(Ԟ/4_Xf㥺?> -endobj -554 0 obj -<< -/Filter /FlateDecode -/Length 4237 ->> -stream -x\ۊ$}gRyH`d XcnK#af +?}"23*gv$v<]Ul)DӇ59Zk%6M~s<;KDWS,}N]⏧|v綎;{Sk.UL.9ۨ*TEǤ3b -0b&OGU %j* *(pTUّ WcVT֪:D+:MѓΤR}Uu: L.:MWMJ)MGu.KtDV 5]UuK.u+*XlN`b-DBgK.GtΙ + -lXb^`!h:D ez^"xI &_cQVa^8lzH`PXj(рPY`tiD,DJ,%TҸ x`A BOA%xtK: K.`Z 7DP.\j\ܩqAbg X75.@%i\ո!8`G\ x785. .׸jIX % 3U `и>b z ' (ch -z8, X Chx%D5 2ԤqAﺂSuո +V6.qAb -D.h\7QvjMuZ "xqCԸ` gẪ[KѸ wAK^04.8T^5.H]Cи w-!Qu׸q tXʚFjSh:uaM޵6W xM Rf/A5.HL9i\!KQl!,U,I֦Z4.Xd,4.@D`CwQDLD䘐.yS2Z\ָ g2؊ȥL׸o8\Ҹ0sqAq"S<"sMAtsNѠdj\$LrY4.( ` S:`Mh\d;j\&U,!xN7^&Yj&aqո|ӓXo j7)붆fָD(X4Ue݂o4]_I゚E7ѫGͬwc3i:."Ӥq.o"r{ ,qz#V{[e|9GR eIU(U ,8a9}GT g̃X~XRl9ovRV_a鎈|$%uD-n ;?l8CGmE" [ I1{:OBΈy|p:i*ﴕu^ $9F:nWvka cT.ڦ4-@[aϬ "GtP&Tϻ)(yMߜ@+~\ -6Joޟ/_}ϰӛ~gS|~D߷-gHY(eko욣~:t$MG=#VNhZ_n]MT®Nc7ߜ~f-z?WcpZoqn6\貝OsZZmˠ2~7>}]y׎!l1Zpա;zu>5v&5yvׅ:}bɴ[LQp60|ni[^Qqw;?nr;y:r-(\JTXxgCxr[} oWݱz;py&Vĸ_L;_L_}?͙p:D֭gl ?[K n>ײ'xmX`tsczoX>|*LjI#<cch\&uԃgp 4hѧeax"bO }G-NϽk8}ie+d y˳ͭoNZa;,1ʳli^׿IG^a[wsv:?Q`r:߲{{tlmuroؿb^}Xy[v|D)y2 ߴ۩u|u;ll }JN|a /pm&_I<G-w׶[o>rlx4oI}LHΚaqWLxgb0^$3%FЇ 6Z'n BevXuة8{-PMLJX|KJ*jdjĜiQG܃|b -W,ԏ0DJwHQ)otۭXkRTm7pBgy*P7|3un'ܟk|[SL^`y"{5ˋ$obI^.Tw>/=TO'y#mYގ"Q/7?pZw3)M+dǥ=v6a[ n(N{m7_"tzXzŴ#!P+{-م߭5R tߜr<,r?dA'H٭/w7x6K} ipJy7מy(g>y[4Y@Oku+5۫d>Re,?p.kmߟڭP=koM=ŏ'~)bCN1 ׏vEnĢ]vAMݗDrm׏3`{c ׏? -}~XfrG1m*ń* (ld+()8~v.M.M>%t/}TT.. TK 1OrR4a2^? Kw$j/.'Z3G2n ez("̯kĆq+a̵-oAx9E+qO1+ -N# bLi.TX] U!ei go$iipgYa.Yi/WRIwHɄ<IjV 1SXJ)8\q#8XюΒGSw>Jq3w+| /mc]N۱΄p)L&uLq/Nm!z>N{JdFo.-֍XdVrrՅc'AS,7}{4I콤 V -㴡axCxYq2;7s^.C#.ppY.-,[:EE\Fq):&;d񓜊} Fe:۬l(DA^ȆN} -`!}10ӥ]s™/mrҘm. -iQvJ]o. ]6ZSZuJySt2嬤CYnx#Z -#ҝ%G,YYfeǾiwmb4Y-J^v:STi'!WI`&g׹}Vr<g%'LlvW#ihVV:@9 -4g'AE큺v 4.3^AoבeorVNb5 -endstream -endobj -555 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 554 0 R -/Resources 4 0 R -/Annots [ 556 0 R 557 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -556 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 536.373057 101.433071 517.623057 ] -/BS << -/W 0 ->> -/Dest (cb54-1) ->> -endobj -557 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 299.626036 101.433071 280.876036 ] -/BS << -/W 0 ->> -/Dest (cb55-1) ->> -endobj -558 0 obj -<< -/Filter /FlateDecode -/Length 4808 ->> -stream -x][ȑ~_Qφy30?beN1=>/$EYKUit)"//$}UNHz1Oן.?_¿`T]08|tןX`3_/;l_?u )y?b VP97`T^8Ŕ$p ݪ̠dLTfX -ު0A: (%`"Fi7x tF>&D]N#| KEIG%%-N)I[ ;wN-$%qop qA+@WԥA%.p]В"Dԅ@?T$.]嬕wuF#ql5 guPL!Jc%xW$.]6%.&J\xFiH!x |Ru~ ((K -$q!%.Xc$.e4o1<-l(qlH<1ft-"t:H\ ؊E/q~`wI& B-X*`+g.4l-q<]贖 oPh"L$.XC-Hq%.v%.2A u4!q懃m'qsDl$.p%.e$.69 $[I\M4R$o(qA -&B-pe[ ehUn$a(ٸWx:vD\.#=ZF?e=ǭش]ژ|gg`@! Q&;hEw9eب맟._~Oo-gz:=ɝ=7ġɲ?BMb  - 8^f2;=mњOg&89oѡu]GMwdΜKs/Ǝ*o:gk0n[u)Sg:Kg.3>խWf7Ӝv~G]h&n{/\w> -c:qyjS ]}yA_p29'U4FmR:!_܏*&Vm8%UrЬjV[aGvl,.`gg̈́Jq[A'i\mtstVAKU8ٴ0eҹH3њ[&%:bRC"8ƉMs&5na`DQcQǟܕ2e/_ۿj>{ یhUĨ(;V$(fm.Œy_VRg36(˳B~9kc;$NLzۣnmZhc1dw}c0=^ԔG:gCxsRhJ֩[%zͶq}]7ڑWi%7omuFϟ GF5= ;,]˗ՠ}U4~̠yF6 -9 -efAgT]IHODV?-_ctE_Sdll\uBv|H|C/Oo#X!oLJg2,G}d+%#D 7#m۟#?ѝW6>62 W|[-&j-_+FnsS73 >m4V2wErk:QXas:n?}U(O\Kt 鐻2:O쯉շpм;;l6;gW1_?ֶʑ[V6>)9Qm4s64m?vza˹<3}=xUʐݠ?{o drڗddՃuNɻSPuWټ6Q"x+j9jw p:]kh=̥y,փއY7>p`!t'zQ GҘ2j ˈ&{~:Twm,^4wn޶/MsRrN/lXJFKZ]FMyVߞ{no.±5{{b-+zy_U{WH/9vwZfvqu];Rײ=bɮٌ -2A[/ X!x'[.o9˄WO̷ӯy_%{&wy4":Xt;o]k')J}')~?}d%pȈڻ`4G*emQQP^̅(Yf;.k{wksFnvpՕ:F87; g9b0{%F[_v_zT}oYe?O}pP-N7F<8_:Vtfc?Yis|<:;m}ѶcĻXys8>6c* s6Tŝżs>o^);W_#?7^C/H^VfյגJ]7Nv /|ו}Hߍ}к}C½qwϘ˵O&vyl:CN6M; -mYcVJ&?qJޔ2j|>"Xj|>yYn~˓hN̰cCdh}7r.ʹ|(J" i}~,,~v-[wڪFn鮊 e{4 bz;t\քf:tk{(WUd1*%˄P'Azߩ4a25~Q$HTʥ\N^rskT(bWS*m,/1ڬeǥ V^XҮrrz6qT/UWOXYƯ'pE3~T ůG^EV 4B- `/PI.#6CC1IXuA]3)\ -U6U+P~_,UJg^7pw*;[q(3Kn,|76 ;bnW;k0BW}yvwuI;oqCXaUj~`e ][3F0[v'Cǃb~ me 5_:ֲ.4|MĞK h[c؈MѶ!|F82aO6xA{:8Ug|m[:d8haa-d@g -}5nmY6ES.mچI=/l+ڋci!> -endobj -560 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 797.673057 101.433071 778.923057 ] -/BS << -/W 0 ->> -/Dest (cb56-1) ->> -endobj -561 0 obj -<< -/Filter /FlateDecode -/Length 4950 ->> -stream -x]]q}_ 0p $Fa cn<%%VnwӪGxxX(*_rzJ)ஷ/\¿buQoW\!$qٛo7\o?v'I>m %,bzAlzö^X,{6mH C1)31Q`4*ADfC3(hkV2]%31hϗ?߁O'_\_0bEvï3=}KAfy," i^"?5C;6W*,m?jKmQO[d02gz r>si^X_;V9]#?5xG;\Cߝ sw9:Gldf0j;[od\utH9z.g~G̨ul4/da(L$zOy6v[êόJfl[z<Ⰺ6S棈gv.#}a#[wA);O\CqS=Rr€ւL7Ǖq%[=? ŨMF=tH=kvިkud( ~#=q]4݆^}'<c\+g7g{l{\XԲۮrաUa=h,umȘ~.Tgu;z(mFKoWtzõMXrm9zz|s[N[ -v`ZޱC\̣^ ʙg<2A~&Fqs,6L٣Ϥm E]:pΖIwxBy/78ÚK,9y:P\䤨= bN`aٽlл(2==TZFE+yz̡͓ydAڸ/z}3[􍋼:5 $N]nÍ"BQY$t#3LJSZ>FZ+bN>IPͦd0׎6!/t| ãGHAj#\gCjև|}pm||rxD#Eu$-+ص>%Oy=A}tqT۴  dtȴ5rn󼟟>Y{G -{缙wssy3ޱ>Y;. ҿ6ۺIa݉!3O9w'|< -3g)o Iݯ3Caw|d#}dgCVwLCM/<~Y Meѣw A5Mrul"^WC6] З#OG7՛YCCKn[YL]V?(pMrc7r~#~ӸtRݙzÜٳa҆Mr mX4iC_Yp n6MM8V_wr/zZAUŒ?_tvJ*iWEL bѦ;b.U+vRn 81Z>T84ޟTMd!rSդ1}Ar)tS {w*&[buqMm ]LӬkZYw oTkG(7עwj2ˌMk! ]ЙMzS; SkrM'n1Ro=[ԳnJ::ۗؑH_ƈZLZ_pc6Ż6⣐wPB -+xҘ04ITᛔ|ЮAۯz%46x$.ubOܥclI t[汕cI5XuC]U4BU@u]VnoCիVY šq^m2WLlnSj] a .4Vu6v*!Y>A&͸_/e3:oQ/kkyܨqJg2ΙtRLASm0qXW4y׮gWkJT7-C&6 F[ ^lMK[G'*\2uS+Jڧthaq %0wVf y%d]a.v]4ˋ -!`yye`Wbr#ڛK[HOr֗mαVC,ƞmAN=p Q&M=ےJ]*E Tc),٪[Jb.+ҜyMZ*x-Z-αN-L,MzJ[eۺݺ:^Y3\7$Tl~]3vT_h-ݧRG_]b[#9+Խ^cr֪[eޠ r&=a+Ӝ*eC]FZ*ҷY -z}YPTZ~vnI?iEL -endstream -endobj -562 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 561 0 R -/Resources 4 0 R -/Annots [ 563 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -563 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 348.873057 101.433071 330.123057 ] -/BS << -/W 0 ->> -/Dest (cb59-1) ->> -endobj -564 0 obj -<< -/Filter /FlateDecode -/Length 4793 ->> -stream -x][8~_H|)$HaA!H }>c\!#1G=ݩb\8>+}_$=ĘO'5oL1;Y+ -Gw1 lBr& uҐB'c'qAP8P-H8C)J\ lH\ l q Cv%.CIG7 I\qכQd֛X 6YכADEuNS-8 M$ yכQXo£C17.ft]x^` VZ+ de+(F anC -܋*1k$1h3^`ZR+1l'CC>ɄaA뚣% ɮL1RV41500 }ks&l! |$O6"f-NAl$|cf9 nfkI"wfyGGm=d2;r+ @@!3%dӏO~鏀ѧ_~_~;GI7!7}<ӱB9嘕W~oz_qfwh=] t,c,?bvvtD \uH.neSO;z8Yjg7CH\8r~)=VMSq}^Y[}ȝy+ m>'%7]G5- !Xqڙpވ>SA=q˒L:ܦ(?je^S9nӗ<7P֏6,vwE3g7HfVV)$Eǘ3#yW#4Č(}y r廙_V=GUQ>]hG[}w?7EݻwwpkՅ:&pn&|Yr$;L}K0f2壖5Ӿ\ Zl)+{/~y/96p Őpނ=;v>݋_3Ed:ʻ n#pQ=#o__lܙp c7=W>rھʸs8oﴟ^B]ۏ{_/ -\Czֽٕs8nyG!e4; ~?] }sׇk\SW {S]y%3rY_c;>|G#O& {~}^ԧb;I글v?Kq]ퟗ83:FsUuw~+$~q\ޙpHU_߱eOaî3м>Z} -񅫶YZ/2yfr{Fs8}ه{"U+\}B./{X@ڙpH~.U"=bgO͸~x<f}w&.< {s4 Խ=G]! -B"~;w܈6M#g#}^ (}`_ݙphx@E&ֳ߫7ׄٳ5%.,eu\jٕכrx"hCWbe4uۼ31@wgaz_lgAׯbQ7#Zffv)o_kKHWgykQH=C#Vg~2~X_[ݗp݈ -=XuKZ -M;cv9bحc;.X忛i;+* -$}Hy}9<!3LJ!''ϿW}x:rSj}efi&7g.[qmqIN믟XN,TrL -W|7p\9n;A೧!wHN[ncB?T۔U~b~U`J?t!7QM9hS~- bgSղHUv!)+o|؄Odo$"U<׊!rz}+g=ۃ`#_Mq a+xV`˸)V1*V]*t 4֝k ^&J;KKQu2ˌJUJ!TI]NU&tfճ^o~ -ctDn*՞ -5UlYSifJF4ס1l9Ud17QMvrAHW(WDž[Q54i~ffT43CST~];jYFr_YZZ\:Y^:*!}&ݚLʚC*e1늺*Vڧr%bkbW67;]{kwWmb_Cq_dX2eبgRIUgV6@ -MhmZi| 2iƽ~9cI^>i~?NtCyu7:,=緺a6Lh~Һ:ZvՈԕAurkmĦBhZƭ/]+VGپiЖC56BX~:8Mg۔|fE('mS:dXFBq*LͲ~]as]쀹6i]dY$p-?敦=}2ٗګKei%> -endobj -566 0 obj -<< -/Filter /FlateDecode -/Length 5021 ->> -stream -x]]$}_Qφ װ6xa?LL,}aPHeTfVO{(ve>BW?h/9=cpϗ_.j^ῒbPOW\!$qٛoox.yL9_IS VPy?h|TAOhbΒ -f۪"p9yI31IP%a]v0D$GAF)QCs:IgR6YEt4)Dty -!$lYiIa)I[MQbU;Y%t%Q[TPZe;u:bO*IM+0I! -:[Yot8t ocJh54ZybLt%0$ -$01N.'Ivr%LʓJ4`\Q4tFKD`l.HL`5lq$. l ,֩%.[tpaqm -N kX.{uF ڵ. ,x:$.p]kSXdu8*J\FF ɤ$.p]wM 1h%.p]ik (Gxp`%.| ,wu'iդSxN>Q'qa˓!K\ L'̨F3jK\8L&]Q'SwAKF“J`Q'IK\2P x{ wVUa-6 @a+i2` -IU=,J,qAҴ)qA$0I8! -6c dB>Q&<{ DlqI\z6' - -$.@D0e[\E\8؂HQ0ٔsDW%]0SkQQ݄XK\Ԕ0%.O.I\3Nₘa dK: [dK\H:%.H  UfP`ZtN:3I\\(T+M0- ?`&9X$.Hr3I\l1H\lz3J\lA'qAVa0Y8tJI\uz8 0.i$.Va%0n ތd[V=7^/"YԇYp`&Qq&[{6o?] X#&]?|{^/ GпY>,S\ -IwX~WWʥ9-r/~*EF]~Y]򅭜';ܽ.s}^ʥ|~)e?r*TmCoZ1涘wκ4ʭT/Byn? K o!um[ӗv,C9˶`)>*{prRVص#{vޖھJ6ڋ ʁ߄ RgWո]|RmKZ -q".O* -K~N/J~* /}X\l)ϵL{}72߽j6{>2jN)wyҙQϔ<]ƚgknq5tck<#qvl6U=vվ|| F0V_}vr9(>uic nW+ԑ{ih7b}5=1G"s qGzOr_ _⑏h3*W,۹{Yw䞏`͝uO%}q@[%s~T@xhw-(Xw2SN6rU&v5Q[21 L7DO?})F5\ֲtb2q֐c.K=%qDc3VxB(KH(ў>L٣Ϥ4|X DLy`x}]-PL*>cag;ΖmOz QnQn7p5y FYrc/+:@ m%JOD[ 9 :Z-Z콅6ЧCLUCed!=U%0?)];[ sY{bȡ0tnq浏FF]MWʚuXPک`ݯu*vM溴NjK99ٖl]ZɄ;N!\'Ap7=7$UH%2"u쭚!tpnU6[[ioԵZ8z6{k um}ai?2[/nk[VXq,tXl450囓=BCǡɆ8=Xl1Yxq,K#c9y:,]^3Q_5~ Jɱoy3cdČ0ۼ(Ʉ\4F3[/hh}Ȱq< -]<aH^ Ft'<~t#Ga=ɱ#Sg"[>{C\`H{`blϯUŝu_[E6Fw[m6=5r)½5Ϻ\7#Q}.ϓ\qrgQG<^f;/{7mg+;3OݶQtQPv2ϓMz|^v*UOυeSuĬ ^+iHhwõ}d6ia/czS}?TGjňLY%Csyqx22g٪e8Zy~%nHWBL" ѕ={kU[slo.1)5rsy `?[cÇ8z% o|uчT捛y'ύZdp=*i_Cˉޗ~{O(ǷGx{=/,;NKs9]N;P{*-|&?Tۋ#1 qTHƈZLwVlwm$vG!\!oIut)EJ' * <3U&%)kKxSf塱<]it _:)!=nK<21y<"Fknkbƕ\}Jmz* ݷr84|z\ӍV.|F1A?Jب6ʘRNoE\Gkc'2iƽ]~)ӜНFje"_wcvǍjla|&I'2U؆ hui}ECǍa|zvՉԍAur>dbӠke;|k {~qtGe\oS>%_Yx}JP< -sle&W\O;b,GuO*+`I[ vWWF{x}s/&:HڨI߸5d-a[7{eس-Cn1ʤg[x^UuhtVb6%[uKiq[LѥW=IKEK@9֩ŒII]Oil[[]g+k놄oR3vKT_ ѩN:Zc87DyJ;"uׄ*jEل7(U|QΖؤ lu^)^aI iH_g)M=@QiR>).;B -endstream -endobj -567 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 566 0 R -/Resources 4 0 R -/Annots [ 568 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -568 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 597.273057 101.433071 578.523057 ] -/BS << -/W 0 ->> -/Dest (cb62-1) ->> -endobj -569 0 obj -<< -/Filter /FlateDecode -/Length 4809 ->> -stream -x]M丑ȳ6| 0|a,0}?R"B셻P] -! -?iIO1|IM)+%VE~;kEar:?e SH~==WYg3v~*S!('TJ[Aq^Py=)I*ڪ̠dLTfX -nU fIR \TZmu0DY#贛<%ѓ$QH:k'H;-wQlqIiI`DJ1H:[Jtx' [(`JKd'"KЩVg\VI:'lZQAAK8#ΆjjI`1DlK `181P^UL(p/V 7Ĥ2z1keJĴ" ''CCd´ Dmыٝbs~; o{zUɔ&W&ao[_j`%r>hzګ_z9~/Z/upN5E\i?+h! ,}Ǫ_^ ZaCQ]>BW^p0 0|y ͙e\c47`G\6nX5e^FW&cIeV}체Qυ[VO9bŖJN^>2,_<*{=l4~Ef#K,kYl,ζrw0ֱ:!SF=#kݷ>U=`!lAA[:VPu=yͣa|̨OJy~)<REH v\u/[=ۻnrYO]&ڶs/5y Zޗu,fJ*cu7⯯bHs;Z[!r$3G{M'Vίv9,̤H=Vz#vh""ibL}{)DJ+:1Ϊ;mԒ:3&2ٽu FA[=-|f X(AoC pDتړpAj}ˬև1*|t~h;phxdˍ2;_mi2Ȳocwߞ8X{ -ֿ:Búc=觱 Υ;r<rX2IA.X3g9E5"JF>h_,~o3InxIk֥m~;spH> cexD# 7v8qX#:r,_vew;#=X[/{$śQqy84_q߻W:G:rv -SrϘz͝Vyf4{/6e;<܍8#Ͻ%Su҅-_$dqpH~_DG -5@lbaE}Ƿ^b{áƽh NqSs #GB8U6ߊ[ѦeЏl2twJ︯`C -W3< !c.u@REkA&_;-_9,FU4-@:TAr asn#?a5&7ޑ=Xz=vm#F^Myպd |_.W]3B5{YߠcAMR;oqVl<5wp5fV$ϐT=?](3/p(͸ٚi\ 08.7'e.>V|=Ƶ~vsM!GvƶDžK-.Gz86WJ\v[w4"Yރu 7؝~ <Ψzc[<63KLnq޻TJj43[P/qE~cu7r~W~vK -MomF^.v+rLy$Fb'K>?8$ʏ~&}=S Mӵk-lgО;u}k|)㋴zFVvt,kWyāQsbuv]le9\w_UjTwmR1/]>:[^XoC򃣷4ҖjG{vޗC>g`[~Wd|.xNsܿiǨU0v_yAfkfLu++"KKߟ6U?S/vmpz ݾ>]eW|>5R(x +Թ&W}fFT{;Kw"/}WUSfviSz_d?a)w6~ƪY By =ԣ/kי]#j:9+>^+gz9bo#fkjౖ8=sՏUlx3λw oEZ?,O ;mSbl"76+g d~͍gl)dX)+e -Zf?CMa7SLDg4f!6reY+h_gE!iQa3l?|y.OWޜ=My -霟%]IN򲠟[A*R ?Nz~;X\'D$k|Y8zůD=H!jmn1o] SKZWcGjor}Wg𒪅ly -|bA^oŹjҋ8/'Nv9 7*&t[bbC\绰]ײ&&pZ;J_Ei~KGmzר&̨ԤlBm$Si`6=Y+K rKkThb)66 <06G?icPl6PuPB -kx(f'EgpM| ޏIlⵓ7!B/ܥChQ 3c+)sT$c- uM)q%jNŮAu%v6Uz2]k}W.mu~t0_(Џ$]lT[ɘRNE\gkcTcdҊ{9T9cIoQ>8:nTc Ӹu%+Y~oY<(16m.ֱu m75{-B}ĦAh</[ ޱ |hkp_cپ$Y8E-VQn H~l?\쀅ve7]eB`xäI軧׻}1ڛK[Dz,ЯۚcN֖es϶ OZcIcpTeօdZj-QRh1E{QiNt|Tlnx-Z-rΡN-MJi}ڞY7{dz5)y3w:CA*UJ&D,Ԥ5UE!_(ț\ϕl3"5WτZt~l+鶂5U+WKJ :ͩM&ʱ\- vV17+**}R~Qye -endstream -endobj -570 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 569 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -571 0 obj -<< -/Filter /FlateDecode -/Length 4937 ->> -stream -x][q~_Vxր <ٱX!?_EJ= LcUI-wEC)x~|QCp -rAV]08|tןX`3_/;l_u )y?b VP97`T^8Ŕ$p -UfPNR 2& -3,m3L$`N.*`6J:t %у$QH:kH;-wQlqIiI`DJ1H:[JtNt]Q啖t.E"QS1ĥ(7htZش+ -䃠3+DlqVIga Gҁ' 1 -jI`1DlK `D `/H\# )/qO -:|8ve:B$.c=$k #-p-%. 1I\G ơSJ₤#MC`]r%.HV!D'd=ǛADEuNS-8 &IybI\x3J\7&/jE1Q֋>Z-"๵‹-k3B/N!=Z^_.{_h XOǿ7חdBJe~_/K>O[9+hyn*Om\8`-<`EbtzzðШk (|Zti>@VIsفuLO&ʭrw -ΏTeƱ:5]M:+{tH TQ&>ز} -sm8een}rԭ86FjV])nMy]6_m(7ةX]nc -Vlϩl}[aն8?j>׶Z+64d``s!G|I<#"}j4;=R*u*R̈́ D1zVP[WO7& ڔ)cck3uns[fX6q,s:,&f^=:&Ԕ17X}е#;6ZO`n]+ oXvO:òvܛ2#x/d?7[5cF}b~/ ӵ׹7ڍQשּׂe O.߃,YmcXax;n=G.lzxud/s976|.x\ p+úg8]uN@Yv @ڍ7܏E+u;ʍ75e_u&֬حnj&Ĩ(;V$(NHLVye0+#2`2l2[}糖!6.gκdVisߎTkH%F:gC*M>.k;Zr&׬22v+vn{ۗ]nl˼c}6ctEi5 b!H292iC(;v-H 3[WP8~̠yF6 -9 -ufZ#R`IHODʵ,jR;*u[g<)\SZ``!oLJgc{53V>KG#m۟#?ѝWZD:gC+"]D^m-kblӚ7:̂O[= 飑ܚnTwGcGo<*fik1:C-i-]кV9ޅ?AHsEhCey׋z|s,ץmG>n]+֠t&9@VY<3ݠ=qWZlZ.}iO;'ڟrYAmooXӡv'QaU=qot{,ݝ^b=}H/ٹ"ꟸvw=xݨz}em;1*J ~ W~w3=bhi{L6Z&wy aOU2Zڝpr3߅Z:Gh[wPJZ.V;ʋEڻB|y鐷szfWݵ#jhxx-[#:m WQ[Ap_8hK>Vtɟ~_:Vt񰞝fcʧ˷j;/3v1#zȃuNƯ}>f:gCUڹk;͸vD`!ekW|;eoH^]{-F\MNum]9)'mM/u^uNHf{r~/GfGPN߷:XtHɆ=gTM򉙷__֬"ッ9m߽jC\a[duYg^u6$1+;r)C,aSJ֪~הr-:ry+Sp9> -endobj -573 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 770.673057 101.433071 751.923057 ] -/BS << -/W 0 ->> -/Dest (cb65-1) ->> -endobj -574 0 obj -<< -/Filter /FlateDecode -/Length 4841 ->> -stream -x][,~_1wt@08`8!sap򐿟-Z]=;eLWR]$hYKSJ9wpZ8yCH`71_No_Nu}6Shwrv)FUJi+b4>'bΒ -f۪"p9yI31IP%a]v0D$GAF)QCs:IgR6YEt4)Dty -!$lYiIa)I[MQbU;Y%t%Q[TPZe;u:bO*IM+УH! -:[Yot8I:1%VY-Q'q˓!K\ L'F#jK\8L&]Q'SwAKF“J`Q'IK\2P x{ wVUa-6 @n+i2` -IU-,J,qAҰ)qA$0I8! -6c dB>Q&\{ DlqI\z6' - -$.@D0e[E8؂HQ0ٔsD0W%]0SkQQ݄XK\Ԕ%.O.I\3Nₘa dK: [dK\H:%.H  YfP`\tN<3I\\(T3M0- >4`&9X$.Ht3I\l1H\l|3J\lA'qAVa0Y8tJI\u|8 /i$.Va)o 4ߌd[Z}%"<N_ßϧo_}.uXri=Qj~DF}4ί硌AyÐ2CaײZ(^g?.Ne[͠9%Xs75M,OKY",] 2ti_j"- bT݃y \'ߛ!5=ԺþO. $ڻFz&=s逬V"G$|e\ӓñ;e)WY%C={=}[3 4mP߇_lE#/48ͭY<ckX}=:"|й\9ȭAy,9-Q½Xk2 P{bdwy4G!v^_uR4~iJoصa+qa> qwij<boij{:OA<nĩ<+̔.N'=H<&=8:ѐl߶D{0NocxgO3j c/3<1YKCN]l9̊*NE-;'Spl<!TO?1k*Z 2W bT&]rRy8^ks ~#~̽=&7n5؃y zZy2gu:!Š ]q: jBYT qVl>y$45X=|=~k\QZ&GjsWGQq! iwVx zAy8$_q0 =d{l{\XԲ;cu!Fmw>Kvw42X=0}cwiL/~ <Ψz[<2%{{ɛ3ۑQhg$L4P/qD)׳gc5}_Ϸp,ϣX,vmOtԑ&v[WrFE5j Bh[\VTZ⯿7#[ӵEԽaOzbzwF/_eSu~Zgz8.v:,ݥP{!'o̺l~UhM,\fd谘-NʖNlZl/Tv.Oږ,}ٖS쯾 ^AۡؽU_ۂaɛnT9|3W 8ͯU_iJlcx$?[IGG닶foSZDD/[j s#Vä2W3TX/R%BVnN!Ô=L/mᗽ!SMt>T[7r p/.D>ovX~wɠ%r>/p19))=Ā=U@cm@e:yjң_^)ΚCydָ/uGЛ 3h 0~ }!fuxhkn=@A[v^Ir)k{p`GuqyZH^qu=qH?,[fק=O?~do:b>x0σ5љkK1QOV*<@XlYo\}$~1<RU>پ?~kgI|HjOZz`vl> -endobj -576 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 270.123057 101.433071 251.373057 ] -/BS << -/W 0 ->> -/Dest (cb68-1) ->> -endobj -577 0 obj -<< -/Filter /FlateDecode -/Length 4725 ->> -stream -x][,~_Qφu `16xYbOʹc?e.UigÞNUF)}Tfw -R"]o?_~HĿ!`PW% s/|ڻum˟u4j^SR>x/-PIe{mrJcT0z4WyA1XN3H0䕙"^*ZϨJK`$2)+q: QGVS^s:ctQ8lt[lYbtLduEo8-]-@W`uE:8]4@"t20ii HNauQ$-N`5Rs:[GA"{AQG:A:DAt\ӊ##a%1Q0rYl18.0 M%%|KR9 fJ GP.9.0\t1=kЮ8.0]CJr\@]c0* kxHs\^X:qwuqw4xW[7swjҎE$ wA!w` iq -n "?fL -q\`*X]ʣřqVʹqb2X.3p\Q5 fjNU:J ,x~p -߄.B8.]ВL c!r\#+18$=9._-3 -+zӁwM&'@/Xs\E \>V-^B`AY' Xhbkbkx"*x.` ~w_`<;ÅY-q*eyvXn֍~35ݪRW~OF:N7Sv!CtW|!C7E3EtW3.N t=+ȮE 4r]hHYBnA8&ӥXա*&#/3ܼMhޜ'6N#K/ qs::.B4ݗ!7s_=uđ icyب N5 )jd\~7Htgn4W6]R!R$9ޙ?ApsAȠF1ΟYun[cѺI*w9;CVnYgYLݻ+#wg7CHC28s~=Mcqh,|ߟצ-{~lȝx+mDmPۊ8s:oO)Hrr} M?Q0|z:cGM<}se(sZ;qwGW|ۺurڴ/:҂F[2'<Ꮌa㫽ڼ__֣}ա>vw\$Vy>sp>)mV ȝyNᱞM>ϣ+yΆ*k;{fQ} 3鐲q+~3xav/jO\vMWW^K*+&wX`ێ+'9^Vkޙth>p ͐pto܁=C|O"#kfHR{9R7aI1f<";w9"ݾ;Yڍ|GZۧ. h_]9}$?S/׹w9R7|w̭hNvݗYpn霾 -q;><'s; a}v5\Nfa=tW}A>#=gݙt;OsG"U+\}B.o{X@OڙtH~.)'O͸1~xm=L\@ob3{ BOݫQsT+尌6PQo~p k8f6~lyΆҸrOvwN0>𘀭g s:;; خ{>O=k`w9Z70d=PTrW3S{oGmW?5醽}D(u3tb |m;9ꮟBdw9#OHw|$x^r+;=E!d%?59-R]}"h>\7ׂxN mryHf _>_qM=݈CDpcJѧw$ovUJ݃I Pc󻱙).#5Q* Jw RZw erB&t+OIvg(6`9̺헋IEWG"RARа꺐sx}/%Fe^^urs0e/*H퟈S9UvIo%FLAwp)KYr"}JcRlR~̉^{Ō9KFqzpf#SK=Z7z&],XoԶrz4q/Un̲*l&~(*J￫G46xH!i.}l^*H&}"ݒD4Y#1HT -8QXn•Pf#P]巉iPseN5p*v;Z/= Yx&6 !WRZٮVa *46h-4<~Y7. Ӝ6VGpFw^ i^2EmiJiDMxK8@g'kKFEJ5ɲy4;϶4g*k6;K=2vy* S1QFkLNpBB9g=V2XI[C1+m7(ⶢ)m|,-J5 -4'g #BЧ+e KņgId?q -endstream -endobj -578 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 577 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -579 0 obj -<< -/Filter /FlateDecode -/Length 4962 ->> -stream -x][q~_Vx@ &D]N#鬝| KEIG%%-N)I[  3wL-$%qop qI+@WԥI%.p]В"Dԅ @'?T$.]嬕wuF#q0l1 guRL!J%xW$.]6%.&J\'xFiJ!x |Ru~µ ((K -$q)%.Xc$.e4o1<-l(qlH<1ft-"t:H\MA/q~bwI& B-*`*g.4l-q<]贖 oPh"L$. XM-Hq%.'v%.0A u4!qm'qsDl$.p%.e$.69 $[I\M4R$o(qA -&BStm QC%QG5n.uة':n(؝:_u>-}@4ߚuh/뻁{w(Kv>@<_mv Y瞧G-` d^h _uyrڂr_y:J݃^XU]m Bu=Q/;O4o711Ok=uO^,Yv[FkE;1;78m[6!;۷f#Vo0嗴VWԓeTj7:za+?۹Ww6K5/4DKvi#ۍ8mZx3o[NҞ>͞,ۡڽp{7lM]qPV_ [&Vw֘{e{( fȘ*i^;)Λ/:tnCmv=mS1; B)s[.긐ۊy~T}*nM{I_Crl׽6jf=ok[FxrT'Ǟmʶ+X/e+w9S~< -?ѡpސ`(ѡ =˝Vo (@bُ%B(7żhQngR/ע-Ha!ͷsS򙺴/ʜiQ'Qv.ϓ-lA^b\v!f[q+u%_> vâS__N#M Ww^וTwH=鐚vPB.GvЩ-grͰ⮡݀ b\/QQFֲ%2͒'yG[}lCWZ"y2ϳ!]8=PYPg Ku4u] wP|? 3bQx.ӡ(F8[1%'"kɞKnw2^A5 j3"}o'):!}>wC=9>}0Lvzha;_92C a?jG3D>y:4duOBT|,;{+d]Y+^ᯞlȌ'ڟ?7|6jQ~:?{vsy >aݽwFSWV}Ho?ػ?zzrߨz'^QQw72wP~AƀPe '(ǧGzw|dýOsRrNQ{.ӡOU2ZU% -WW> )ʱ㞽T[=1 8vHz/Oy6䥃}q =gnaW /C%~<O?SA#떫~M m6 }`>|<}e(9zV4ukg#y}ͣv;/|,`KޚZE\ \Rh| GSC_8m^uUX&9Qy%i{0UQZB|WxK,#a#My)?/yQ+ۨ8׈_9-pZvD|܁_^W;{Va~헋'=|گr 8 ȧDZҥtnX}3/5 -Zc6s7K_r|щ&n|B>]eq4墉. bvhÁWU˂ m 4R/h_+w]g*l>oX"[1߽"]|5_V i[-X[ VPG󹳵|V])j(}|zy)QUf;Rv~D A Y]0 QMJ:At\PSŖ5o4X^ݺT0J7F-_b>#nFx8#..] - -zʭ^oE'hgpU̓hSpUf:$vͥC I-vMC*1IUXuE]3\ U15P~[Uje^wpw&;zq=Hjo-|FK%MlTZeRhFoY\Fke' 2iƽ]zӜj> ]Pq*[ʭ+q?ēb}"æhuli]ACǍZvՈԕAuBڰ -]m2nGxZ:26aϗg‡ p.c6%_"qI۔-.#.BqUe+3}%~r]EFm:jl_tE_0ҴG0`i*}XZ O|חuα(2x[ ղl7lurh.zvز- \_)٪2QTLY-14K(R>EoiJmDߤrˌW%[ 9S-e% }*ٶnZ]fkw 3U-ۤ|gyU)UWBtlc&wTB&b4pHY+kBwLd -P6 t*~(gKJ@X -j46+A'c^~_F!|&j$?2 -endstream -endobj -580 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 579 0 R -/Resources 4 0 R -/Annots [ 581 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -581 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 570.123057 101.433071 551.373057 ] -/BS << -/W 0 ->> -/Dest (cb71-1) ->> -endobj -582 0 obj -<< -/Filter /FlateDecode -/Length 4847 ->> -stream -x]ێ$9}gM|Hi  V)`?;R9;*CTO1U>:㶪3\N^R gLT fXݪ20Q;I3tQPi;QJ5N)A=Mu:v -i%]B>I:[|VZysJgSt`-&E+"l1Nt ]ItN>'D]N:䓵Ji=y`ӊ:(tR|u[e$-?">VI1P^U2P^VQ3P _Z#0+]LPj%n(/1yoQ!bL1,Ny_;#&}zY)?BI_a5oQ)3YCF܍ԠeӍG+a8X aDtE1nyn!se[xWwy/[mLIKHi  wfyG (,:c(#^WnWN Ŋyo]2hߟ~??O^OB)g~_ta]_y3), Uבz,!z\w hj=|#V}dm)_X>3> wPz9,ny:ވ]oCC=ZƨDIӅM;h|``CtKeM]; eV_-el_d?k{<r8bqnB>)Ockk={,~m;IQ.ؾ'sֈ(;G:(/lD;I,oN CMutH~bE8sڗ9?'97CV8ck{--vFm+>t}8#]-ތZd4b܃y z)~s#wmW=\S*{gM<#y}t/=;UWйY)]X;>yLzpu0!\H~ms98|?ly0A/Oޱ={бU$ʸҩ{ #GB8U2E-|Fi[6R{KFโy s{;!.3 -tX bBtR]|? sym9Pt鶜P|sŎ]XO< ڠ Y({f/s331]lIϵd=mib{^k5+û阢?٤Y.蛆!lxmkE^:jnkl -moz?r[~3_> v~$Қ<$ٰAfij7'oGmygo,6SV悑RcƏO?c?z\Wnl,,Cq<obApo7ҰTz5hٔ=wn9L*Cj3A-`Q(ѿR98ў[}GIc-7=d/(;[κs< ׅ(Vn7p5y FYr WhlY bg*X{63QA&͸Oe3ZLq}X>i~y7iܺ^ޔeNU؆ hui}ECǍa|zvՉԍAur>dbӠkeW-Ծ|ikhqL'WpuOgV$(iҡue/-[I4דw #v,/J+X_=OPGI7,2/ۜc˺Vec϶ Z(mIyV։dZl-IRl1E{^iNW&-[g-y[zK&Ax&u=mn]wmϬzdz6I=2v<î0Q;%*q;H+5;&g^g*vv]:e%6>[Af'Ϯ> -endobj -584 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 142.623057 101.433071 123.873057 ] -/BS << -/W 0 ->> -/Dest (cb74-1) ->> -endobj -585 0 obj -<< -/Filter /FlateDecode -/Length 4736 ->> -stream -x]ێ丑}ϯg#~f60@/ᇮ)5xeR %ʫw#wzE -S,Fx{肽Bva\#j)iTF>x/,P :FKS 2k&˩`Q*03RUf(/ 2ZϨR `0F+F'P)9Udu:zpH+9]s6p:[lYb1th-*xuJrfuQh$-N`Bq: [ 8xj[n-t( -h|-;Ѓ%p$L0c` hx@ h[qh [ z.-: -HqְEq 5"J 48. \)8.`\@rqjp'9.`]m@v  F - xWkdu8h4.:`eP! xWa8.0]1:?j xWY\7rwUF9 #Xo -;[@`Ni pA-wei CtX h>VQLE-ҹqbX.3p\0* ,xWjԜ+UX.q0H8`|tY]D  -) 0 -"IX$qxC9.p] Vk xW=8._-ӧB)8xWH0 -#K&Γ@ `/Xq\tpXpl9. buxq!8. -h8. -e%ovz[v~`` 3v?rXzgkÇ; u(c;09_S:ʗu/Uz9餞5,[R'˛mSNҏyS4:5]9/oOz?OM6rA70MT@\:_,Cb,J!(kH5֌WlSS/K.`-ނ^1fEbݮҙ百5wHƐj+Tk6s:[/?7i߳\Wϗ;Vi_fLΘnAۇmu|Lߜק7PfFDY_ 7{eu.33 ۾TjKi%̈aske$F5BO nKYEyjܣm9Oöt;kYcVLo|@jT#/ِ.rᕤk= jZ6CƼ} _BI%?)淚č'+?Ɩ>F˟B&KhOٙtԻzjjdĭk}}Ow,Y e4o~ƪA`NGa_ӡ_-c*$lqz^ԖXd-Ys2FWe?Lo<m]d[u>Aư>y>dے~Y+U-6~s.-xٟuߟ3)C%{z+Qs62;eYh9"z#/hcJ-OMygu;g=bs6;>[D8#ѝz6w9ޕ?zApsFNϨC_md/k -Gw[I!Bhs64}?v~a͹2̧U8nݙZ\YX![?y:"kc%3y௾.+ټ VQZ`ٳT3P{O}7z{UѵcI\\gb=}p޹o {yNЃk}vuҊyn(NwWZ,!'djVm,u|/#ۮZuhWqD;4v}yΆZ{ --H~:>s(k -&sl{ޭTlbYO41]3l{R+\hju \+# EiƠH2s:ʓfI;}򙒿.+?eQgm l>oՙtH==g&y۷5@+; IV#sG#{ ѽvd1Ti|{1Һ3k='$&ˣӽN?sٕ=f~xal^ܸ. RўWgZb㕶P BI+9ǝBͩC'F{L;Vs_"OQ˶ mh1p)L v]bRA?c>9|loS6ڀÈH[PL3Btr-ŴYf|)%!,'4ur’P,v-UqELGJ\f몓UW͹']PnoKJDʨ6 br;1ۅ~'ҩ 3V&aH@29]L¦fsK*1|1@]\lYiߪ~.ŎZ nJxX{b]gR&B]7(x)RZ8BL2&f)1vRQ)f/+:i|I[U>c/H75VUV}LIeXeF]\Y E2P~[6wU=dw[.s[-%ە0q`3R!EDJaR(Bo8NqY:7.?_aNi"~8-i˒G?sShǕl2.HFN1mbTBe*/bJZАq*6%(ĞR̠2kk-uXU#5gۦ ӡNb4형A}98 Eː|N#JZtIo2>)cla&.$W=oTVuPtΔa>uWQ% Fօƅ=w}6٥@LYVK4/[1G_ uRC\{:;9k,jVP l]IEitH|FlrsT-|)约m*m*nΛF-ξ\()/sg))u6˲h{.C\LEfW)GΔ:p HFrwsCzyc%H%9x0 xN6og* HиBTq]6e[OƿDq -endstream -endobj -586 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 585 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -587 0 obj -<< -/Filter /FlateDecode -/Length 4893 ->> -stream -x]]$}_Qφ,aw1?Lܶ1}aO(SR22+P}BGG!2K_~/9=cpO/j^_I(?7V.N^'8M ׷ .y˟~uu}5Sh珤rv)FUJi+b4>'41gI3|tmUfΘ$̰.jUeav -f죠 -vh!9kSӃ3z -),"t:Ig^K<|tk甤-Φ(l*Q[LVEb,l-*(-鲝|NΉ J1muF'kzuQ-A,`H: [~$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a -c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& -%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ -CĜ"52cX8Dmѓٝd?vgL׿Weh%C|a`2#h Xb,{(1Us7Km62 n?ld,rc%hOZ*X%krDL탖me>b2' >m İhFW4^|V/7ނ ;ƞF֣:t(eO-M| - xDil64Qn7. Ŋy]2iL_?t~z?r?~_/k\{dqH濴\?׿Յ*KnCy]y+z(KRmQ=-ْQhÏCE{ƨGoo/i βZIqfC<5x%`}M>}2Cֱ0j2tT"dR,.{2ϳWCVEVYϼ{}^ֆ^:ɬ(n>p_HeGݺvPj(=P9vqj@ CH *Z 2a|ėlM7$uL=? MF=tH=jv֨Q?(`5[Gb{1i Г+yDZk5J_Gu23zf1Qk^Y ڐ{cyu :XCKEe؈3m#ng?6񽄓y 8~ˏ?qyW/EƟRG{2( J3.dRвY!յj_4|^wly1ֳgZֱ4fhcu!FmCR]1wt;4FugTF-sSfȈa1<~f10|YCSouc{~sywv<4]K$zcǦĶiR{)aqe)쿊;`mo7'z]{9:ԮM*=7;OI;4k7Zg7{4/#!<<@/uF!;.B>K/12'ew6e=Yl'}z:-s Ced^{3[N3w2ϓ,#Sչ#5xFKtSzYRvIO//aDאgd0OI~g)#* 5glȋ>?4-/~|-<;,yHeȍY7/zN#*ï9yd'A;̪P<~e.ϳ0g&ԑDd*H᭗9x_xĦ}[W<)n;1d'<ĐcOFd;#6st=vs c/>jwbDms2ӡN\9^VDгq|vToC+={k%+Z4'<M>Ms?Y;x)W昩%ݏݽh Eo=WMv:Nve16r餄D-uJ\1WyźªWrF. o+qӷU,hwиcqMnrV&67 VFٮWƄ0Bw}+:Z;, f2 =odQ+yܨqJg2tRLSm0qXW4y׮gWkJT7-C&6 F[ ^lMK[GˣUe:ۧ++WO:2KVa$@J~ǻR]삅tii]e, B`/xNJwPGI7,2/ۜcc/uv,{9}h­.8F4lK+uUN. SUJզdn)-Nb)ӞJs6i:hɶs8:SX2 s7)mmvl{epݐ#SճMw{ΜguR՟Si>&j5|J!C}Mtm> -endobj -589 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 438.873057 101.433071 420.123057 ] -/BS << -/W 0 ->> -/Dest (cb77-1) ->> -endobj -590 0 obj -<< -/Filter /FlateDecode -/Length 4866 ->> -stream -x]]ʑ}_Qφ+,kX,fYamw{" eJqizȓ'#C*I~/9=cpϧ_Nj^_):(Y+'sH3 lb& O:ﺎ>)`?'R9;*CTO1UN1gI3|t]"p9yI31IP%a]ZaI*J+ءR(tON)lh$SN{-BI9ҒS8 Dl1)ZIawKJv99'2t*t3O>Y$֓6Ì ( l gQ[UFY#Ɣjhv[eŘDlK `lQ1H4/I`b\6N"K 'hd?Vi茖*]j0sElI\` lA -Y ,-XЭSYK\`N qL%q (e ,8ׂ;%. ]L(qZk] -XuZI\֢-`d%.p]Uw1 8 +III\&)'q%@ sJ\k28q&H\L%F]P=tJ\&D˟0VN9H\:aD]tDžy /O:,qbx.3I\ U"$3Ct(6ӯ?c=_LYJi -d Gq6 -DRd! |s7R?,?m>cDŽ3ru*h0u6͆ C\ܪo?Ŋ9X/vƟ?|0zSʅ|כ/@m2ϘGhu9j;"*xGO>.nKeJڞ_Q';c\Y}#UpO^/G~dc7sӿZD p#cUރ/Yluo@+*uh(]FR ewnl9.e_>jkk2fqJ۵ ~hOe -/Ӷsrɰyγ; 둿t:? ;RU䍈+@Gn~fHN=f5MGD401=tv7s}]y#%FniY`Ha*mjqFA}/붌^ O_A8K:@:JBC߱:OcuIbGx8cs(")Jy:ėGl4ƭƈ0wXRm5Gm%݃umt. ^ݘe7s3c}e1i1ҽǒF[/K/y_eL+/y6 ݰR9ye!GKuk'ztX5aʇX>[vY0]v`cuQ&B##Ko}g;uU6=7ˌډYu )v_,6mGWcnoˮi㎓Eucs=ImRLY%CLoXCN_ n}u3sÕ6Dͅ\ʍypUfRBmtHɆ=gd#i6 4>wX鐺~bE8xuZ½`]+Nֈέj+ׅss; >t}݇?ynԲb܃uͷcn=}jv}ղrfy}G2yփu }a'Nsdnjta}޺6c҃;u˹~H\tԲcL@/O^=Xлso8ZîVT -Vf6ڼ{yǍh2܏l2t?vJ`C}|;z绲^ өoN| U<%`<Roʁ|!6)@`Cص%{5ZU -eo#3D#j]i]ܻ:fj\5%[3K1yHh~J| '{!vzϓ4 I<4JQ]ߕd{n=P|RV_ 08.7'u.>V|;Ƶ~Spm k[Zv꺜c}Z!Tu2>٤Ye kO"@6zm@j rA]k'l -uw|-m LX~=<-=KEv'/g\ IzMgs.GzP 9(3Cz sŝysܯx0=Ї y^#)p5lBy./9Q!M[M|'ct&]5˻~i)z ]`~;XRgP=h{y*dA_N;W1 t[p삀0Ny,i}}47[gC}Fdwsǂ5٫I/bz}Zr)>T! :^7+UL诅uU{4n.ta3NeMdyKx9[;JD)6UkTYfTnR_Kqm$Silz6jY*\+k9At9|J^5WwS:mjdEz$#֏k1$mvܘ+]]vQ(;W(_DžIut)=hYe -ߤ*͉J*KEK@9Sd% v^Vunw]m4\7$TjCܙ YT)P;u*qFK]v:#Rs%' UQӋeޠ -T}\-+s -42A;zKIH[Ez7Grvi>)?fm -endstream -endobj -591 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 590 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -592 0 obj -<< -/Filter /FlateDecode -/Length 4800 ->> -stream -x]ێ8r}ϯFK5a6ᇪ]5f J))j9Bu"H1DF>+_$=Ř/'5/XdY+ -Gw6L!9þ/;׺>)%o;N!JP)msSyAKLIR е* JI*ADAa* 4I* J+ءR("kvG{Igc2It0NK4y]t[\RZ94tl u`%]-]-@WuEy%]KH%T Zg\VI:'lZQAAK8#Άjxv[esŘ@`%0% - $0!L I$`(RX4QVD>-UőjBDX[P@ka!+q"qݒJZ % 3k' ,(PJXpwJ\`AA ֵ ,hRX%$. 𮵨)` ,qq:Z k -xH\QC/q25Q5K 栕k2xא(Gxdw`%.zd["qO`I%.p]1|.M:Džy^IBe%.p]g?aE58X%xW$.p] Nap$.6i芺4 Z2`T0HZJ\Xޓx"=h$._0Nʀ)$xWi*˦>D `/H\#M)/qO -:|O8ve:B$.c=%k #-p-%.M1I\G<^tL1E]N B K1%.O.I\3$qAHSE,ES4%-p%. D[ J\MDXK%)3Į&4&$.p$.@`a-֑171&ǛA₤` <> ơSJ₤#MC`^r%.HV!D'd=ǛADEuNS-8 &IybI\x3J\7&V8Xu{w|aH ºni3DqG+}׀×{sMЗc~vPJ0.<:p\}N斿\/.e,|.2rrs\wu|g{qϱ2/6Teuq~?co ;NnqkKڝ<oKgkg[s!gS9Rv>^3[]>/erkCYmo aݮu>?~V„snlޜcl֬8e,. +Bl2a G:wM=U{l˨O?}y܏?h`c lJ rv~> ^ pFWq{ўØID/=\QsO伽Cm9W饡yw#{d[v-9!AνȟջLҕ"wy!lr둵+{yB dVn -GLʑglXC1 uHY]:rq${.FvE_sd>xO -.!qoo#XCގ9dXZn|ڎ-\񎴲m‡F^ɯ>kooNoXgC+KV^yFZG|ӕ7̂O[=14HnT'#50by:nO~4'z=bUcu>ΧqDwA컁fӡyGw<iu٘}v07#b;m#;oI Jxγo^?O׻yɫ; 3dW/^[\C뒌Lz!s_USPuW3|g~nˍMl{=VPOox hЍw RtΚzگ*_|ܻ?Xw=xߨz -9")g~5 RF !Q\P=>t{8>=/G۾v[IM;|cu aOU2Z2X<Q1~{zvOx -rx_ߩ=2ss!gҠ˃uy;j #;8)]C÷#bɮ~'mi~<w)랼Vk*:(ȿ{Z?ee ׹q=+ш`C1s^;IQ;IY{WGf 6_Q{Ol(;ѨK9D#38* ->-kݍe}|i`݃>\z\p™l ^cIuJQr׮}[[}ٗ ybKg3CW(y:|xXq7Vwqic|:;mzΗYl, zȃuQ;wc#2|G<SǼs~,3jNdy:}򊿚o| #yY%WKWS(O8}öy|϶&{<ZwjHق#;܋~>bgʤ@j:}u;ٰI>1˚@Old(*ˇG׿epmmFثnwˊ";0-\x6cpJ~g4[{/-Ϗm):575heviMܼj->2K{cӲ -(_0Ya$_հryaWqҜ=Mtm0ܱ|f~/=yZeǵVÍ^NLl Bi׸B^hVqT /MfVLJyMR{;jܬu'r_YZٮt}騄LtNR1IZ+ꪘ)O^h]Jtu:U󺃻mb_:֯v/K^h3ci]k6@ -Mh=l +$Vo!0_{Y?(G*{Q-L֕_b7,:m:XV4uܘUWKI]TWm/t;5v=6#ѱi |hδ} -06mK;%h[ҡ%UARv fLdHzVwй|h2۟UtE?1ѴG0q_LeR{za,'Km>úؼkl7lurhzvت-\(٪ѲPTLY=c(6Z|QP}&[ӮډU[V-Ρ]j%/kW)Ȯۦue=wA? v -endstream -endobj -593 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 592 0 R -/Resources 4 0 R -/Annots [ 594 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -594 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 713.673057 101.433071 694.923057 ] -/BS << -/W 0 ->> -/Dest (cb80-1) ->> -endobj -595 0 obj -<< -/Filter /FlateDecode -/Length 4861 ->> -stream -x]]$}_QφIa k?z1C6˝>ʔ[}gl_2BQHWo4KNO)凋WWR.xE~Ov%Ov˯.Σf9TN1ŨP)mSA&,`θ* T0UEm 3LNR }TZmu0D9g~ -pztFO!eE]NG#鬝BtkIOtx휒t%]-6X%`IJ[ ]-@WuE%]9QS)(?dtZOش# -3%(ElVIgaßOxSFmՒcu/1 E QFD$qqr8LK.I,`R\VBX3Z"`wAbauf'q5 $.g%.`[H\`ANe-q: 3kSpXP.%.\ t1ܣk}0XЮu)H\`i%qZ'wVQ02W'0H\L&%%qk"Q'A+q&H37xxe$.p]L@?J/+q{茕Ma3?aL&rwuB< ^tYDe%.]g?aF5x𮶘%xW$.] ^a$.6i芺< Z2`T8HZJ\޳r{DlH\: [aL#XSH:aIU*f xM B$I Q $7!+0K\%`NS9I\ lH\ lA q")kD.Dɦ *邙R]&LZA/q~pIv [0T$.T4%\i؂ [Di-qA2Ѡ$234֒ps֙ID&Xi)ElMH\Ŷ,6uz'qAJIₔ`QF`֛Q€` "> -ơSJ€֛I\qI$qA -M,qmf ;:؂) &Ib @$q 7ы[֛Q. ft]DA\`VZ+degw cn U ȗH2q*Z -xm8a}[Tp3SFf 辭9z2l/?v0 LFw{Dͷ)w%jcfiFfa£퇕0En#KR2+Cdyke[xI"^"#\+y/v~"ԋ=郍mdҡa#>I43ߙ VX#" HcrĿt.V풙Ncr4˯o@_~Fݖ\/y+)ݐʮ:5cISҫie)6mm"wl"yfy_i cXZw-%;B9W?}oOۧ5 J6Qp_HeGݺvP(=Pz"TO0{*Z 2Ww~w,Qvɹ{H=zhlk2)6v=ؓyDZk5J\pg 5 ,mȽP^7XPS~wȢlx߈3bsdpddOy6uqGiy"5ƀ8 -7Ҍ lVH{u-#|Z0$sX۪u/_g:S4c6>.2cx@x'!{{̟k`N`tPi;Gs.F/x޻}~2ϓ,cMHҴ.Y.*KölIHlKHB̆Lǯ >7SCGˀĂ$o͹Ny6y1<=lwünyZy! -. tח=/?qeTC0Oyu>B{:J=fÿ#=(\?rRy?Ry:C>9sL|7HZWx=k;|6K3toGk7э]dƇ9ِé+!~~Bh~\ z>`夳c^rBePആI@ۃz8|kmH ,ҩj/,_^22M,(շn*Y,7m;b7OT&-_M^mmKfj0/biæ~r.'&m'Mt;b$Lt&];9ER-8i:Jt#XP:n">wUԋ.~9N;opZYXCAvy))P~ÊGkk(Ej"[N +VLW^[ iUhXO ULBŪb=m ]LӬkZYw oTkG(kQջF5eF&5eI.Uv̦gFTZ\ EL[OŖ*zҡNe7vS7ҏ1l}*1ܘv.~(+Bm:^4* *SB*|5HIWBcNXI.]:ƆY/Hn[I˘aϗ6с*\2uS+Jڧthaq %0wVf y%d]a.v]4ˋ -!`yye`}19@FMƥa$m'Km 6rVec϶ Z(mIyV։dZl-IRl1E{^iNW&-[g-y[zK&Ax&u=mn]wmzdz6I=2v<îA񘨝*q-%5<{%WkBwLZ5lUQΖؤ9@ -46;Agdj}D?6ݥ>O{Rp -endstream -endobj -596 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 595 0 R -/Resources 4 0 R -/Annots [ 597 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -597 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 273.873057 101.433071 255.123057 ] -/BS << -/W 0 ->> -/Dest (cb83-1) ->> -endobj -598 0 obj -<< -/Filter /FlateDecode -/Length 4726 ->> -stream -x][,~_Qφu `16xYbOʹc?e.UigÞNUF)}Tfw -R"]o?_~HĿ!`PW% s/|ڻum˟u4j^SR>x/-PIe{mrJcT0z4WyA1XN3H0䕙"^*ZϨJK`$2)+q: QGVS^s:ctQ8lt[lYbtLduEo8-]-@W`uE:8]4@"t20ii HNauQ$-N`5Rs:[GA"{AQG:A:DAt\ӊ##a%1Q0rYl18.0 M%%|KR9 fJ GP.9.0\t1=kЮ8.0]CJr\@]c0* kxHs\^X:qwuqw4xW[7swjҎE$ wA!w` iq -n "?fL -q\`*X]ʣřqVʹqb2X.3p\Q5 fjNU:J ,x~p -߄.B8.]ВL c!r\#+18$=9._-3 -+zӁwM&'@/Xs\E \>V-^B`AY' Xhbkbkx"*x.` ~w_`<;ÅY-q*eyvXn֍~35ݪRW~OF:N7Sv!CtW|!C7E3EtW3.N t=+ȮE 4r]hHYBnA8&ӥXա*&#/3ܼMhޜ'6N#K/ qs::.B4ݗ!7s_=uđ icyب N5 )jd\~7Htgn4W6]R!R$9ޙ?ApsAȠF1ΟYun[cѺI*w9;CVnYgYLݻ+#wg7CHC28s~=Mcqh,|ߟצ-{~lȝx+mDmPۊ8s:oO)Hrr} M?Q0|z:cGM<}se(sZ;qwGW|ۺurڴ/:҂F[2'<Ꮌa㫽ڼ__֣}ա>vw\$Vy>sp>)mV ȝyNᱞM>ϣ+yΆ*k;{fQ} 3鐲q+~3xav/jO\vMWW^K*+&wX`ێ+'9^Vkޙth>p ͐pto܁=C|O"#kfHR{9R7aI1f<";w9"ݾ;Yڍ|GZۧ. h_]9}$?S/׹w9R7|w̭hNvݗYpn霾 -q;><'s; a}v5\Nfa=tW}A>#=gݙt;OsG"U+\}B.o{X@OڙtH~.)'O͸1~xm=L\@ob3{ BOݫQsT+尌6PQo~p k8f6~lyΆҸrOvwN0>𘀭g s:;; خ{>O=k`w9Z70d=PTrW3S{oGmW?5醽}D(u3tb |m;9ꮟBdw9#OHw|$x^r+;=E!d%?59-R]}"h>\7ׂxN mryHf _>_qM=݈CDpcJѧw$ovUJ݃I Pc󻱙).#5Q* Jw RZw erB&t+OIvg(6`9̺헋IEWG"RARа꺐sx}/%Fe^^urs0e/*H퟈S9UvIo%FLAwp)KYr"}JcRlR~̉^{Ō9KFqzpf#SK=Z7z&],XoԶrz4q/Un̲*l&~(*J￫G46xH!i.}l^*H&}"ݒD4Y#1HT -8QXn•Pf#P]巉iPseN5p*v;Z/= Yx&6 !WRZٮVa *46h-4<~Y7. Ӝ6VGpFw^ i^2EmiJiDMxK8@g'kKFEJ5ɲy4;϶4g*k6;K=2vy* S1QFkLNpBB9g=V2XI[C1+m7(ⶢ)m|,-J5 -4'g #BЧ+e Kņg|O -endstream -endobj -599 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 598 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -600 0 obj -<< -/Filter /FlateDecode -/Length 4918 ->> -stream -x][,~_1˺_ lHyB9gm:`!?_[VW_fw}ćLWIRӧԭQW_)/Z%bL)/X\dUISGw&r>寿kG]Hk宿|&5"cT * rNgT^ T1%N3\ڮUfVȨ"06(V% -fRv(-%!Zri%|L: -#|)NENgaKRq:[Vr:bM duE`8]-I.+:"T.R%d q N)MУH>0: [tgtXt gBLoԻ49آu99 -@KMr$6ȱI G:9a} -ӊ##ac`Eeu$qѰ 8.0hk8.0`[ p\`@V&qZ< 3%kP.8.0\tkЮs\`*qQp\`Fqi Ъ8+B(9.]wu@4Xv7rw V{ l48>- X 0C K8.p]01}l%TLUPg-,@e8.p]g/0j xWԜt8.q  0 %]VL1r\%qFa!# ) @B"w1' ;R뇟._~/@K~w<0zz1.ez't~Y>6z7>uiOyϴ2J"/*erc4zPCagCʾ-mXC.Ӭ4$}X4ϵC,oA]V6;5t@\5ti\{jl8;6FHWdLdN2\; SU2~gS5C*ZTzOy4*K~~Iڷt&:{cȼ`y ;W?i .K>;5 Z^vhDlcn -MDٲ0yCW/="<_ukV>QչoNO> a}=5'C{s=F8٧}<\GgwvV?Mm<%&^6l+,6}>3ocO#cyn>Iu6TzqMŐl.xk+84KPm]݊U{I_CmW{~2rm[vվ:DaL o&vV}MQfݳߥ 7l\G;>mnNyբ;tڋ It] rWgsj;Ӆ S#l6. gP!;jQn>=Gɡ͸9 )Aˡt~:o6A2kHk9la;9g>jY_nIFM\GCo8+dž8l7k-_jmڊF昙ikZnmF8<jSo^t[h#}}Ckk;{'<B]OK8yV oGܿ c@(BU{l#};>xaMŜ69ҙ =PTɣ ^g,]z=_➂;NZ, %a]h4dC>י]DJkj{VgW6ŗ! -e,=syo)ϠuV&6Ut|Pް{Z?%% <@KM<s^f)ſ:b={KO@iH:zdGCiGM9L7FhgѴ(0" Ke뮩25<<#zU0AFG]pܒ7R)Йt;M~zn+3|(̪.o' -ޟAN/~n.o/Ӽ>Mil/rz{޿ٳx7Pê~|JDӁWo"h*ͤcu#gk $fLYf/?颒|A>e\fq墉_.teֶ$z/ Ev)Ɣƕs#v6ߕlt%M3Bj-Kf1|5^vCۧm7lNB{Z]盰޻Nu_5vAfR:ܪxW*3QJ]IYvbD #J[[4fwFNXdkT1ۅM7Ֆ -5UlYS|3AxFv1 #]|]T2v+lMrqIWHW Mw*Ii6}C,2:?QRbE -):g]BoVIWֱ -m.Bl/%H[H;uyDRĺBW+yok ֶitiJ -:X:Mgڐ|n+Jچth2⢿).Sla&/}S*4Mg0ߺr-$Mتд1>K i*}饵b$KM:|CC^{9k..zvز \_-Eet,zPls\z)ԘI=VNt}UZojdjz8V;RX222RR"[meU6C|LeV)_;SaՁKU1 -Fs2z!ni> -endobj -602 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 555.123057 101.433071 536.373057 ] -/BS << -/W 0 ->> -/Dest (cb86-1) ->> -endobj -603 0 obj -<< -/Filter /FlateDecode -/Length 4914 ->> -stream -x]]$}_Qφ,k.xa}mcaPHedUVuܺ3twe>B2K -R1O'5EX]Y+'sH# lb& K_Σf9TN1ŨP)mSA&,`θ* T0UEm 3LNR }TZmu0D9g~ -pztFO!eE]NG#鬝BtkIOtx휒t%]-6X%`IJ[ ]-@WuE%]9QS)(?dtZOش# -3%(ElVIgaI6$VC*%-D'` :_b`AxIq d'\X<D&Ʌ%JCgDVV+`Nk` H\`-l1J\`hnZ uJ ,f* ,צ$.\@)K\`)qbG ,X`$.]RwJ޵9El%.;NV'+qZad$.@NaXLJJ5I9 xDL.NV5MfnH\ƙ q2 wA!^` V+q -   B7ӯ_ӧӟM)~󝦿i.u\yMg(E+bwf'ڐetǸEo?CvY}a\B1;rgy~1#?w>\NO^WaibmKNt6y"-=Ee[Nt-G-\}L;vޖ?wmtrP΄,=ʎk3qT-6UoKK~',oQ0QӼe*j?٤Y>蛆!lxmmķ'J/Jڅ ]`fS`m~+뾨~ʟ몟觙mնƈg>IB;\.o!C]zyD1f2RꟼjmSigMcqYsm">~#?cn"9r(`87{RAUq(s'Vä26}^zjA$qо[UhmE/"tXk۝=rzmA9Lrڪ5pڅ(ޝcF/ZYa23Q׵ҍO/Q qEծ/^f2SYnZ"HA<e0{VQF^-mtOPI|Ҥ K%mT|Nnű觖~C=tFuF~tXaU3/QEGۉ^ 1栘Gr-#:NyL Q-ZfI0~m 5TMdѶsł9ފjҋ^“&\f -8M t -} -+вr8. OUFO*|5HWBcNXI.]:ƆY/Hn[I˘"qEI3,#.xdnL$w+,.XA\fyUVZ 44~xxC$mޤo\FFxԖ˰ls- :xZY=ۂ>4zhVLz%畺*[UZ'F*k%jSXU'K]Wi{9^ TnZd[9co)[,Y๛ʶuuu=fnH葩&Cؙ R@h-/U)pEylwD^ 19kUz`ل7(m+:XΖؤ luS~DEj:XKAoE[Y[?A} -endstream -endobj -604 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 603 0 R -/Resources 4 0 R -/Annots [ 605 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -605 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 123.873057 101.433071 105.123057 ] -/BS << -/W 0 ->> -/Dest (cb89-1) ->> -endobj -606 0 obj -<< -/Filter /FlateDecode -/Length 4704 ->> -stream -x]ێ}VxAH8ȃ nF0`!SxUݳw0;*^JaU+C;st"o);z{肽Dre\#j)i|O*QEԌ{err-ȩ`F T0(Uxת3S gTR`u0Dvpht\*:i=8o.98-6 -,l`s:[ӂt(Ndt]tQ6cX]N:%`ւI9X`S:(tN'lduj8-?GADe8PA& -q0kTqsV\[ Xl1p\z: -Z) -p8.G0D ]]O01xCr:A׬.@'=ޛSk!`s\]f@' >  0 A3t.tRr\l7qAPL'8. $AqA0n W 4&8.@br\X:آ EqAE qIMqAQd @ qAMe8.f j&x̸zs\ lpQXlq NzlQp\fnِ֛@g]L q\ 7rk{ l@z-V6d <3 _Z#Aepl*Ra?fV0E<&#w%H6~|?7c,H8cj -@Et-qa9ZIKX9FFa0e7dNBڛ镍֩~=JT= P:0wfyEVpp 計B1. -Hͻ Fl͗Rd>+vOo_OIS `+JȲ 0 -xqyA!gwPʽokVg &,Wj֧ߏX0ٮfT8edY׌vȏ*kQ^7Tʰˈ(s,KB }z+K7soe1 nK]E}jQw̌6ɔTV[R}yΆT%vC $Xs.ܖYpW۶Al?-HH#KNIk|Vs1d|߷bmS|[Ȥh3(pm ps:d]ͭ5P֭'@,h˺ -7PX|?cbQؗt(g}X^r'k.T~O+e_\קö LmwT?HA͝yNIl]d9?ìViߟ3C%䳏 V>G<ۗl~eiiWD}ӳժejyi0̌O=jV_Ymٛx;v#3o|v{ {F"Zm_w9r}_[D8-ѝz86_w9ޕ?zApsFȨCi_mdֶ7ʞA3CHCjB=M\K걄h3oOhiPXvihK>j Ows:4WkAsoj{|R_n odw9rc܇smq^_wm;i87>ks:Qb*Iy=cDb;\ww崑*o o -qyNv{ޓ9jw|]L{L$_c0oOZOlIHpU@Rt^qmw1|"SwwOϧێL"xK7vSzz758SZ7e͟rBb>)?=~Q1;=tnCxhpaN:3tHIMrlXy9sN5).:e:8-˒"ͷ\Nq%2[̭ q=ѱSL'a6PX&4y\M. -23ZhKVbZoM+fGپ)t͡MgR%pQ.C2%_"qEI˔.UF\ԅⲪ0f Jrӓ -MuUALf뢓l* \`]_YW0F?$ǀPTq> -endobj -608 0 obj -<< -/Filter /FlateDecode -/Length 4908 ->> -stream -x][$~_1wt@0ؐBÞYp󐿟-Z]sv 㙮ҥTV¿4R1O'5E_I(?/V.N^G8M 7\ou}6Sh{R9;*CTO1U>:㶪3\N^R gLT fXݪ20Q;I3tQPi;QJ5N)A=Mu:v -i%]B>I:[|VZysJgSt`-&E+"l1Nt ]ItN>'D]N:䓵Ji=y`ӊ:(tR|u[e$-$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a -c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& -%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ -CĜ"52cX8Dmѓ+qGLSVi%C|a`2#h Xb,+1Us7Km62 w~Y -SXJ(RT );,"04Kv[s䈘 -|eNl;m İhFeHFJb#ԋ0ȢG3=hz4S' 3I|gGDfC3(hkVp.V풙Ncr4ӯog oQ}W>͟/˵_f8 '<ӽvݭPxIce(o+oeZeT?*u_kr-6|?{Y乗QiZ|4뿟?|w58˪j'eYw|,qw0;7o<賗 qUKw*&eq݃y *„zu{㚴6IfE`mJ"\FF*C8nuݏcync!N {aP9a@REkA& v2-F~@UhcyA_u{Y# -V^կ}$'^ë< =;к{]yTw/:g!Š g@z]ߠcA8kYT 8Vl<Jv6`K8lב87!z~wRd9 uǏ1 + 4Bf+-ҵ` K3' -\|0!y?ƵzS³#\X: s=?Ĩ q{Xۼ+1ރy7xȰʨ7#~.]bʱ~1#4ǙQl43[Ox`u8vtlOϷ{,ޮߕGfk$Zrtԑ};M^cmc`_Y)X g BhެukJOw|?}Jڡ5]¾yy 9'z74-=uc&ϓ8.uz%yV_=7?V6U;j^>dKoSigwO9.ww赽#~#Sdc1}S=q(9]GufwSCF%HCi\eS W+aRV3/<(_ov<hϭ>L٣Ϥeo؛2QK烽/uf-,yz Qnoky FYr!`/_ʜ= bpk"*`ׂmAezZe+NL`ޚcGyy_>}#>_\׸7m[Ni>-ܘE_>-}ґcEo:bx=IPae۶GW׎49)JyRl| mH~tHͻ|ǖ}k1em*.re5^͒'_ybjאTCz s0 zhXgCfyxg"==HDxޏOw@7G^|=s }t(</޳ޛ|ԑDd]9LX~G}/sM*ۺIa݈! 9w#{r<3f&][=ja;{c~X}0ӡq?vst;ݰӻ+w= GwGSEwG3=6>x~~|DxlPEږ~^Gz3 h kJI?apXa>RM̔sYGCٽgv4t/Hl^=W4WPؿjNjMy,@GtV~=NY=҆Mt -'Z4iC?$qnb>{INnű|%gZ9^Z_,*Ig73 -]v_Opع 1 ňdmз|WQ5lVKj"[8W,3識Z&(dL#M t -} -+вr8. -Cݫ*|/5HUf塱<]it _:)!=nK<21y<"Fknkbƕ\}Jmz* ݷr84|z\˰\*͍b~tQm1a7 ŝFߊNM0>ȤrT9cQ< wɝX_&/be*lÆ c:0v=^SƠiw2i52eb d>o=_8z^C]o.S>%Y}JP\ -sle&W\O;b,KuO*+`I[~ vWWF{x}v/&:HڨI߸5d-a}[M{eس-Cnu1ʤg[x^UuhtVb6%[uKiq[Lѥ?pO{+͉Jؤrע% {TOb$ݤUۭ뮳5uCBLU7);saAJU1Q;U -GqKlk<{%WkBwLZ56lU7SΖؤ luShe/lKzo!Z -zSTZ~DFYmCՕ& -endstream -endobj -609 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 608 0 R -/Resources 4 0 R -/Annots [ 610 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -610 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 438.873057 101.433071 420.123057 ] -/BS << -/W 0 ->> -/Dest (cb92-1) ->> -endobj -611 0 obj -<< -/Filter /FlateDecode -/Length 4773 ->> -stream -x]ێ}gyH8 Nc#)I$KRK3b<*^aDIs%r |I +7X\Y+sH lb& .ỵf9ϿH*gbT^Pe!Fム -z@sT0Ggܵ* T0UEmUf:((%`rAA=Mu:vi%]B>I:[|VZysJgSt`-&E+"l1,l-*(-|NΉ J1]O*IM+00H! -:[Yot8t ocJl54ZybLt`%0$ - $01.'Ivp%LʃJ4`\Q4tFKD`l.HL`5lq$. l ,֩%.[tpaqm -N kX.{uF ڵ. ,x:$.p]kSX`u8*J\FF $.p]wM 9h%.p]ik (Gxew`%.z-wu'iՠSxN>Q¼E/:,qbx.3I\ c2t۝yލhuU-9 -VfVʼ[yFi6S;%4>p`g4n+geHg;'?/>; k-3ᐺ9Oخ_؞,s=oˆ`w9Z7^/d#Pjjp%^GzҹũL7]#Bů{^Bnj1[(3Kgq6Y;'?<s8_y=QTz㑇F)SI֛{8 -7+k[i!5jYVD=HK; 鶏k=Clwm KYZv꾜culI?+qc6u 1@wgaz_dAy֯bQ7ƺ#~*]bʫgoڽgVR4w^ըg$L/]+ -o_v6V5y ]~ V=W}ɘ[i19WrE4b#Q/1u! jƑ۟aqJОkawLnVSOi=1Sit}%Oj%"45h'45gޮXFBZUY9"5科jl2Q˜z~WW[ΙWi)Vk07^)kjM}-aakCȖ4jQiE ^tNӹ.glC0`ѣ & +n&`9"_Oim(>fnC'eZ -&g6vn #3?eرs ݯ5:EOLcs_ {Rj'S.Dsع67$T,+7kxroF ֗?/d;UMSł9Sՠg1}- v -O -l7*&BŪkb=Q.4a5wf_ҚȆrBRT)QUfQJ}IYqD \٨4&a*@r5].$KubMZ\zҠnSxAvalL9ls)4eUb1Wɻ:䣐7P@ -+jxiRz9fU*%ЮB(ҮZ%47xI\*8--.c,/H=.cyDR i*}0V“v ˺3]zeܳiSnq1ʤex^+Eet*Zb,69[閱IX}&R;Q WiܲUoVs8:RV_2 sWk)m]u̚!yeW)GΔ:Hʿ1S j5vƸJ!C}&2B#w+X 18kUxل(U$/gJl} ͩH1D>e"}ܒӛ裦Qi9:~#o>g> -endstream -endobj -612 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 611 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -613 0 obj -<< -/Filter /FlateDecode -/Length 4944 ->> -stream -x]ۊ$}gJyH`d`X#쮍$?}"+ouu;vUD^2OȪΒW% FN!D1y+/X$*{O>Z>ǯ.ZW5蔴_>eT*!5v^YǨp1r*aQf0`90JF`6^* T0CFC*!X h褝q:%'C'tZOi%sNg`Br: [4Fp:bt`uE9- -]-@W`uE8!9]ԓVN ;٠tRNԬ# - 3wLREqoqI -@I8.]В$ @'?9.p]aw`5a2c$ӁwDs:>r\4mr\< TN.)z8.pQ@չ / ,V[7`V` \ LQf-9.M!qZ95fu:9.L%Aq~"w4[0T8.T4ϜI'xIqAP ADNp\$Aqf 7q "M0%- ?l[  D```MqAQd @ qA2`\R8.Z Dnjۨśh`` Ȍ[pMsEEqAtq ě%@g 68x'7rZW8b @s+d O;#(2Gdoy|t{d2քa7W3}'k6^\jF SEW$,V0]f4"vĈ<Nᴶjz_=Z=֪䳫Eu˗* c)F*c,#͌u2σ 2eCYJsVG9OC;Ud|߱KK2kyN?[we5Ĉ(;AP6bed]<̊6ɔ3̟)FrKYL]MQT+oG<TˇBxĚ3޶2V]}Ɏ2<ؑ/pr1d~kS|)c`;B≮ˡ][GJ8B|Ȓ-} bYWC3B|?cՄbvQx2ϣО(lw+u%RA},ƞJ}?#e_קö dVÉi{/ 陠}p;!Ǟb]dǜ_ac}Ψ̇jGz;Q)i}p=+jг]Բw=ZTlFgiJxS$eosm {.!v|1-nnfk=?ѐ}7/ѷfu{2áy]7;W쌌~uՀЗ"{qmѺŭOJ2d<ح;=Rϼ&3nV|'Ww돂]![x:XYK^5/m dC恿ƳꦵǷ Q뻵Q\z'<jzk}Û7WPꯣs^;ݟp=Xw=yߨz 9")et7q/ -X>;<#k=ǧ6N|+ǧGzhۇ.wK}9MNp;P{ --L~Q>WgL[ߩZe=S+Qut;\C}!]ugwu|"kxxk|D-fI5/}6[}h맯)Ϡu~M/m0 }^q>J|K<<\Qrh.FD'<G ~?>{H@iMu4<lߥ ayQ\y~je*<׻'}0XMMQB+1(ҽ;10:S"On :LUeѧ}렀-(O"_|_'<⁇uow}uS*ogccsĪ -[O -lRNhBU{hrk6d%]w /VVJo(EUtgTR[R1~-JY]^0 .t¦˥S --k,-LiPס6<#Km^ՍRL{־ÍZ /ԑ/ԶqzPwVq /MJ|Yd2?SRbt MZ%46xHU1\ H[ڮ}{!pbԵҮ:<"JKb>+{(F&/ q֡jEĮrK/%mm_v/4QL&VvN )4qї$.A͸ϗ\40BNKzSKe|y1?y\rBd^pRL*:l:27 --hR_]4b/)eePYж6ĪBWIݵ>XMS].vܤMU8/t]8mJ֨.#NBqUe 3 }%~w΍StM}EKX'}Fƅ=wW{6ٕ@JUK녑/-O뜣feen䴡\ 81IC˖ؾRSdJDQ2QdD_lr9[itŁm%_}&GҶڈJKzK:@oW'ZKFUjZJ]dͲ2^0> -endobj -615 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 683.673057 101.433071 664.923057 ] -/BS << -/W 0 ->> -/Dest (cb95-1) ->> -endobj -616 0 obj -<< -/Filter /FlateDecode -/Length 4791 ->> -stream -x]M$qׯM0ۀ !5^+$#Y5=ӕ$3|| FVU;SJ9wx颦~ju_$Sp}7^W3׿@*gbT^Pe)Fム -zBsT0GgVaK*I* 뢶[U&j'`> -*`6J:Fi?8=H:ɢ.BtN!:S'I`JK:[vNI:l.uŤh%]-ɂ.+:آҒ.䜨ЩVg|VI:'lZQA -QϢxGҁ') jIa1щ:؂آb(3h"^88lD&%$0)O.F+р~r!G-UŻ 1հa:b؂X [XZ$.[oA …J Ƶ)8 ,(PXpwJ\`AQ ֵ> ,h׺$.]봒wEMQ[` J\V(qb 0p$.V&wMRN5K栕wGk28q&H\L%F]P=tJ\&D˟0VN9H\:aD]tDžy /O:,qbx.3I\ ;/㟿ӿ^/'NO_痿u},\܆z|u~fk7]0hߣ}^cC k^}V?\de4 %߱u| .s>cf߃Nʴڨz5Ů@_zTH_.(f;:`9wd2>fA.rNÌy.6*sکp<z1ޝ 5G}C'M>?<$qM}="evn<~=\bU2f:F:O8b_q]nB15^:)ss E ).{u \Z=VBM@C\enkֈ:HRx(/lF5x݊`q uih۽0D~DH;HqdCX;V/ZƉ:G}[v*oNصale7ӷ! xdCxN⼯dvx7jA1:OkwSe4j)hq3"ua5c~[vM;<]c\G:~&YOy6;q?"Ͻ'SuN vcғ;u_sU"#rv6q^ˌZf8o,>=dCqLaWaSs #GtYqXEi󽈿g~.3}a3[w﵃Upӡ -W3" --{k:-ў{}ǘI{[kzȔCTvC? rT?.DjӸO8ϻd0˒CȱMQ8z;A GX - ^ tL 7-3{ąMt9y-p㾬ϿGjy8pbm&2qم#<7eqgos^۠|$p#,cf\zkνUd2j͛χts9-qumPK{rَ-!n{ ofe_~Uެs9Гue `w+eu;w'ݡz7Qe?Р̶1^rfPϻE.cz88lI#btFfvK.^6/, eSY{hPYnZYmuOJͥeSʒ`ya҇Ͱt \N]fV!MЗ7\YRW: 4)t&];5W^J-߂`l: #XTNjta>^1h?.N;ӳw$\^֖-[e7lXkZ^0-Kko$Ij![Ro,Q3識z&[dLd/ULBnU{4\]ײ&<.oΚMUdגm@\'AtTma0; Skr-'nҚo#[ԫnJMD6G/bҷVlwm&vG\Y --kxҘ05;gMJS^h Eg~Mv:Nve16r餄DtJ\1WyźªWrFv]VnoSիv}kC7.m5@m2W,lnSIV~3&솁[ةβLZqo]2g7)V)(K_e:nTc Ӹu%+}N:)o6m8F]S/+:n k׫N쵤n }!]-?/@kǦ/󥭝7\.Sپ$_Y}IVQ\nL$Is=PP_0.m׹򦫬Aloi~ӼG0㾘 i&}16“\e[slI=ڲlC eԫ-*aSڭ+^l > -endobj -618 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 236.373057 101.433071 217.623057 ] -/BS << -/W 0 ->> -/Dest (cb98-1) ->> -endobj -619 0 obj -<< -/Filter /FlateDecode -/Length 4661 ->> -stream -x][$~_Qφu plcfjm~%lsEfS(RRWo D;~t[C^$/.I`jﮯ_/6EN+{IEFུ*B%aT -u)[S I\`9  -pÐWfpC{E -nh=R~(-%#hFpt.DYNyΓEᜳ|Q*NgUD2s:_3thNdt]t\6#9RաGgt8i#/H |!p:5>Ի4Y'V_h_wKhEM ` - yo8 -rs<`N+/FBeuDh_4 ؖ dT-I8.0 \)9.0`\q\`@Rs EwNs\`@w )qw%/0`GaT0x(9. .*Cq"t j!y>h8. 𮶸nj+5դH6B,,ӆLh%X> *Dq婢cuQ(g-jY("p\`q8^`DX29xW(9.] A(`|J. -CwAKB0 @RDqbx8p\:bq tLF*Sp:ThaNޕG x7 8:p\`q $%tX8x e:B8.@`-њ B }/9.8.a>ZtNA׬.@<ޓP8.\Jtz @"K q\#|AWC9SA6tS゠ A e:qFh%Q՜dg 9BE M0S:&ۖL~04ctn B/Zj 4D _q\)L4D0qeo obh\oz "M$7N\o f`M 4lk#Ӂw: p&"[nn/A#>!81^MHp/F+ $7͑ؤ286kaJ%ٴ"'ܳOmcf&#!/sZ,/?c__  hn[CC+1i>b:@c-9/?L< 7pxL0}rMteLԉ9ĕ&^sq%&äӏ_~Oѧ_%%oT Ϧ_y~/n+e,GyԿQO4 ^'Q7C -oMY6qz'UU!/i -!&H |3y_ήTDܼʩis6u,tg'3Z7{YNӡy=ţ7:Ĭ65[8ū=bޝ?ܷʑ[z61iZX'@mlN8v\ R<3auWgj9Fx%|lle4HۑY=5.- xu鐹&:{|lZF"is6Ԛ|곱x TQo }Ēϒz0_z,_6s6tȻ|nT"n4deQ_reDX?FFrqh,|ח.{߾oxTjjI -ĝvPJ-Hhzr]u[EVV/Dž4?w'KX6h==w(.^Ԅr鐷񜾛:Ӳ/Giv>-{$N+H5ė>eȻN!6OĔ{u$o9yԧ(~xz:ǎ|x^Rǁ5˽36C߾xsY;q>vG&Vx2<Nӡjc;[fQ} tHxZlB_'/}gIe|ۑ>$kX;mΆV!ڂ={D_蟙M2i Hm2[{otHȆ=g&y˚- ;mN}dyj5' -~ N!x#V}O(CӮ,'{lߛw];mNƍta5[rM5tH9צLfn>6C'ڭ'օ>ozlq֝6C%&(1hh)>Y?qPftȧ틜}}*$5z3"<{ِ6bLkyU{Gk{YZ{=}bgwڜϭ><_|$sĸ;mN{U_xj;^CY=Hj=y}Ywڜ}SܑL -:Wбx$(lH\?$"Wp7&롵l\c mӽOlwڜ wU3*zjWѦy[\q4 [絀9J7vwe7IWoObJk-tHr ur?OqOoѰVa/%'-> -D7l r!HV~zȹkHpEIѧko?T o琢Re=$=v!՚ 6O;,O_3$BSYw5~2륤iO N]?936`=̚]R{tڜHu>^^OARP`9liS)5r,ƇiӫXH""rv%FLཝ$?r.R`^ľBc9nfi ʹ_ҩ8ݽj]}0+X}ڲpSlv.XSG]Jչ*,UeosMxದҴh>U]-4N"di*ĈnF̧&4f7vd Cr1cD [n<--KPMcJ PGԧmʛ>"M8ehpgRUz)m+WH -Ms"J5,gS-<ERiOzT/fO+:Հ"_6ե/mKɔO[JH*k>fIUA]' -S.WŶ@u"~U|1r*v;_[/-rYx6 !_,]X# νcd܈{2 sXm,u7{mq\pD܎diwSv[mXZf4q\놯J칤* ZXje+[W%ym}?4p^ᠽ3uH6Q*ZthI78hO悱z6q3H?Maҵ&HlB`'&^4Na~{=.$-^Xf8t2k:ȝP9i)AN5AFX,\4. YVOn42q`kɗJִm[Tm[ʦDK@w'kKFZ"Zd4vmmPuTV3;+=w6]ց+L -uKS ԤSPhShR#ms%HΕWBs2Fz- -EV4zw͢doX0Jsr 2Œ)!!T}*8l .:yT^*654OK -endstream -endobj -620 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 619 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -621 0 obj -<< -/Filter /FlateDecode -/Length 4980 ->> -stream -x][,~_1u@0ؐ`8!9gm:`!?_ukuuO0Yt.ҧO%G~/93/_ObV_JHY -'+ |ʻ }߾8kGSҞD*'QEԌ{errBcT0zZar*a -* mkUKé`3*)`TB:"ъI;98q:%'C'tZOi%sNg`Br: [4Fp:bt`uE9- -މ.+:".` ЉZlZp:)' ljVNr)ℍX-ӰӁ'!0UBKNgaRް:؂@9"(#h"^8@y? G*8P!N{рv2.z)1`:آ@+؂h [hZ8.Р[#@o …  4(Phpwr\A ) 4hW8.]mwFNV[` As\`Z -qb) Ыp8.V&wUUSƠwEP2q\LF]P=tJs\& ޕ3V q\`2X]Ǚq /OҹqbX.3p\0* ,xWjԜ+UX.q0I`~tY]D  -) 0 O"IX$qxC9.p]LVk xW=8.@\-3NB)8xWH0 -#K&Γ@ `(Xq\tXpm9. buxq)8. -h8. - d%ovy[v}`` "E dSp\z ^tNMY]Nz 7bqRS?Qq̀N |-*`*Bd$lAq"] (؂h゠VNp\kIAqA0nP 4&8.@br\X:آ EqAE qIMqAQd @ qAMe8.f j&x̸zs\ lQXlAq NzlQp\fa֛-@Mnwm3q:."Sq.Dd˭zg2Њ3;k1[܋ʳ{Kk$vfbekiJ)mE[Tp3FF 辮9Z2lWO|?E)+?BJm_a%]p_ޓ)AyӍG a8X9 0DLJ7Xc}hl&ߜB<r떯k^6'^ fY*A4&EyKZvNg2ziu%ty^y2\2i[Yڭ6vm*6|g;²~?;imuey Ƹ _?[Fn.=%Oj0!AׯmEߠԕ_[ίKSØQ݊y RVQtYcl&ّG",e DMF 3]rp6FcS.Ǵy8L]v'cГ_}>(zk0b29?3Ocx * `tMq %bg<~[k$>5p9.LMpU߰E?WmtIKm6fot85q˱]x~iv;߶Űe4t o -DC?C}~B_"EW3%ڗkMHgcۺ)Z;wc%W=scPPY8N΁=; \>c[nW`Нqq(Yv ^)G<>MT<6ΘcbR&үY}W4fRY_~?濱Kg{7PF -bA (kf9mmm6S>&Iw(3է˞ȬhL9ۦ(~!rS)6om"ۑz,!5!Yk嚍s3XeEuvy/K!b$%^wݵ>'n= ߽dK:2`~ƪIX1(_"au9kwHc/y4 7'cq{p^#)mC/G޲nv?V!C~m+uz_k*n&r\v"^~K֊Z~yg iKVɥwK~a$}ٙ#L BYI&F Tܙ^왺MIF3ӓ"*MzFlL{|eY. OqLmy+^4?gj~[(tz\1#DN'bjd7I+WM{hXj Z(Xb7V׹&]wݹ'Pޗ^*UtgTR[R1hά譳0 .trbl)_S57Sugd#BK1=^Z7j%#_O3m -a zʭ ^ԇ* "wv3U*%IV *^::4%%`c iNc1HR,+ꪘ(re/TĶBu!nv:TݛYdw[mbW^\v/K(&RI+QgVY'lkZى|lq/OiS*zjiI GY<%ĪBWIy/k ־i|K)dz}q -}spN)+Jڦth2/]Y0WR]O+4]ta]3m.Ԋ. B`_W0F=dWFI+Wk/ #i%<^ӥ[^9Gxmen䴡B 1IC˖ؾRSdJDQ2QdD_lr9[qKjq`kLѤ?}T'ھW*-[f-ξN5 Դuee=w0"SѲUʻ3vT'^ێHN'sC_MFnγW){%}Mh-TMx"^WtE[E660[Aj'(}VLBRCOShi}~ 7e -endstream -endobj -622 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 621 0 R -/Resources 4 0 R -/Annots [ 623 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -623 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 502.623057 101.433071 483.873057 ] -/BS << -/W 0 ->> -/Dest (cb101-1) ->> -endobj -624 0 obj -<< -/Filter /FlateDecode -/Length 4869 ->> -stream -x]]q}_̏p Ly!%%ԭ]촪Q*KjI~~/bLדSWJ'w֊tѝ C^O9>)%o;sVB A9AR -* .* JI*ADAaV` $AF)QC5N^=Lu:vӒ.M{%t8M$l!zDl11XI`w芢(Kvr)!nuFEkzruQ$-^$`H: [? +wJ-$%q"npF qַI+@WԥI%.p]В"Dԅ @'8T$.]嬕w!uF#q0m9`uRL!Jc%xW$.ݼlJ\C(q  |)%.IAO N₠ p,Q[(dS b ؂ADS҈l\Dɦ$.c?J:o@ע.B!ЄXK\1%.O9\f@Iₐ` XhK: [dK\H:%.  ]W`^t>3J\O9T;M0- 0>y$.MlsDl$.f Fb qARI)ơSJ₤#$.(qA -Mly qA":؂) &IybI\(q 7ы)ALw]3I:."S/qDd+g2g3 -밶)jĜ=4YF/f B6P_c9STpX3c'0-}sbv؜۟O}{~S2eG#@( In[TLRBHlDHH Z\nH,yae9 to[ xHl͂dؾY Va(c!T*O'ub΁Cf>Klɸ_N~ӿFNOJ:_gy\!boӅlmk9eq$Ȗ&mf}:AU~YeҎt^ԩmΟpOk@(sTJ>wǪ_zز*JW7 s.ZW+Qjpːڃw݀D;-SY{s.o*4!3 o``g)vCP:XFF#ma9~ ˯_NCۀ>et]m_tKW9 98W!hVˍ}Y1@;@Lֽǒ.1^,sY}e}a8/W܇U]R9!׉32ױ:Oգc13.2|9񸜏e5mvX:Vu=jʨxdd}˨2:φ*s={ݣa|̨OJ9;t)<RGL-B_16j{Ѹ{͎Euαem;-q0n.wCaޥRLIEӧzӡF _ n}urv}m3Ĺמ ٔ{aUm,̤H=Vz#p"ib̼}Y3w.VPZy6D1Ϊ{OJ r|ewdy:߈U?;hjbW}Ōς˭>a̱U'?X{#v=rzϬvcT"pN;h| xӡF|:F㕓aʞ"v@oY헅X^#˾K:φ\:vka]nB1xj`XփuזI -GGPt9(rQ29G6g;rL2^2uih/(<RoĪ/BXh'=s|h֟p/9`׊5bs-ua9}bgy:ľ:1;|e ȯ6w@`Cߍ8#ݓNvW= Ǥw\<ߗs.m s;8|?lǀlgQŧGtqo8ZîEegCQamf{;mZff*Ccy(Wpγ߸`q5S=2R$"[p+Ũ&)B:OԃǕCukm]SlrA9؃uc6rokjW+N կr1#T㺷u :ԔNn,Uspnj3̶bs`#Y[(:O_cFiM I<4JAmʎ=8 -7Ҍ 9hZfn̯ua=Qo2y6$1kBO95=.m \jٕu9b}!Fm~ߕ2Kv[w42t>/vgA_:3*Sne%}gE*!*VuEYj?mg}eks -uv h17Ǘ~/}{͖`|Z7ccn`(S=wKgpΞy wwyuů_aspyMyێvr^9bse双 3s`[~@Wd|.%˸-mY}n>/6eny"7KY>Cp^Sڲ}W}lG?`q!Zw[k6و돹 >+l?ǂ:4.W}6xdM/=rgs3rc;0&)5~kM*.Ka%߽8<[qʱ0ލ)Wpl5}9|k6BG6mʼo bX:?+j,r#>>й M#x6SO8KcvM B_ue^tr ė-KܴQ.3.گ0e(4-s ۯ'_I)ΐQYutq>,/Z;(cReAH1_yG*hA9w & q.UktC삽bXҺ _ZW?W&wZ~v3ZȖ Bz+g&{d#Lq aox`xSbB*]\:߅t:͆5 5n("J]jSջF5eF&udj$.'AM٨gXD\$[ZsmB+{T=MP9^]؆.DZ9l縿 7f#_N.] -*вv8.A?ajVY~x -פyM R-wf徱IzY.B,J(In[I˘dbӠkeqW-y{>Ѝ/[Vဟcپ$Y8E-VQSlef$魯>O|(l0"ڮ򦫬+0iiZ#z/&:Q{~vbYOrׇmͱ|P'oPk˲g[ӧF-hu1ʤW[ -8)U٪ӺP4LUYk1TRqZLѥv|T)ۭ+^l sgzKFAy&^VٶoZ]W3; ^mJ>̝ΐuJ՟ ѱd 5`- V{pW,5rw빒mFJxOUA7@&|"VۡjItTP9WK%!wL~Ao/* Jru>)?? -& -endstream -endobj -625 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 624 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -626 0 obj -<< -/Filter /FlateDecode -/Length 4751 ->> -stream -x][ʑ~_Qφ#%1x0ƘekN,} ~/RʋХx.E%! -?iI1zE )%fYGwՊt]b CH}a__]>fHUdCPNP%ʹ!㼠z)$` dh -0Rt -f1QPEa)hV%a&I3trAPi;QJEdnt/|L&FY;@iIｋ`KJK:[&RAybU `t芢(Kvp)!uFEkzpuXQ$-^$`H: [?;wN-$%qop qA+@WԥA%.p]В"Dԅ@?T$.]嬕wuF#ql5 guPL!Jc%xW$.]6%.&J\xFiH!x |Ru~ ((K -$q!%.Xc$.e4o1<-l(qlH<1ft-"t:H\ ؊E/q~`wI& B-X*`+g.4l-q<]贖 oPh"L$.XC-Hq%.v%.2A u4!q懃m'qsDl$.p%.e$.69 $[I\M4R$o(qA -&Bs]Z޹CX'g>dx!TQ*Tuv6Oj]rÃ5uz;;{÷!]%}r5T~˾obAZtGTx/sT0Jm(A9Oۍ(-#H]=S]ֲóp y a|6ϛrK'xhf`ӥiv}Td'͙g2= =׏Ee֍OTekέ&b,:+{4}"0gH)y'g7Ep<}0|EUBW&X(幟jeY%}3X=5rΞӪb[X&m®{_FA>:^`=WI٬f y76sTQ?΍8*#e⦘Y!r1E{dNydRڝ3fFoE̗$7fҗ/ԕ}ڞK^3,ڭ, {C:uelC{(Ä.v2/lQfd;يY;j -;ޮ3mg2+ڴ΂msD}=WSݍjw@u#\C*{Zs.qb+ĸmn_ ,=:q%MywvLu{c{ܳ*fk1:O}-a5]zd4;}γ+82Pa^-n.^ֶ5vrO-T:Ssu~žsyfO׻vfw7R+>'WWfG%fV/^k2WOy:dk=~olj(#xsuw[p%mu.]gb=}Hչ\?Y'U`C.CfD_M\KhR;qŵwm̮^4.:K۾tZI ;su~ƭ2u]kB?o.ʱk~}b++ziRw?>57suyj 3;:]wtW Moe˗'N;Hf3jm)c<)Ϡ랼Vs*:(ȿzZ?ee-eUrthrg#u }᜿yt(e[c{VJGhQNy:g*"X";#꽘3?\g?v^unvOpq1k5G87o; g9boNXqae6գV~ˢ/yڮl)u∼|y6׹:O99#.U>lϜŽqPme&ns+3V|ȓu Q*q|lf9-@? ·8Y{~UUZh0qNrgV9@\yWx`[hve㕝>.0[V<+jLQGuяmZXdo~S; ?s83=p־a\9մ|:B8hoz8ҕ%]I׍a?R?D,OLE'xyQYM9h 1`NY8}T-ҥ`aH˒pf1?WΆRIacǂ5^ՠ'16+v:~j/lڪNBuĆ=_P7a5:M)kB7{ڥMzJSet2ԕuBΓ ]w4M̪f_y0 -crDXnjՙ -TlUSfJuYI=Q|=@k;ܘvqTWb]\JB۵[Q54)_?ai?0U)3OB_ЎZ'6x>HW!i4V.Bl?^:*(R3!:wa&5*z!~_إF+YgDJ 1*h~lX5U^-WKJ<@H5[&5(sBΖ J~M6K^ -endstream -endobj -627 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 626 0 R -/Resources 4 0 R -/Annots [ 628 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -628 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 770.673057 101.433071 751.923057 ] -/BS << -/W 0 ->> -/Dest (cb104-1) ->> -endobj -629 0 obj -<< -/Filter /FlateDecode -/Length 4941 ->> -stream -x]]$}_QφG 5x0YkmL_>#eJTFfe5+# -*}UNHz1O/j -N_I(7V&C0L׷ .y~q:)%okVB A9AR -* MLIR V`$ c0RvJ0M -f䂠 -vh!At/錞|L&FY;@iI&ｋ`KJK:[&RAybU ;IEtEQ[WZ%;D]N:䢵Ji=9`ӊ:(t\uYe$-Ip6(VGUVK:[ $` :_ba -^)&!LE & -J4`ȧ U:%" -8X [#WHk` H\`-l1d%.`[Z$.[RIK\`paqm$qJI εN ,H=H\`y#qZ^ ޵޵9El%.;NVG+qwVAb Ыp%.V&&*&` -uax84A)#qw /q2 wA!N` V+q -  xW'L˜[M:&/qui-b:Ѹ.^/74:?_Z:754X(0^]uҐ&#t! =_yNڧgYc9u&;﬷Gy/lD5xފ`qA¤4M/ 6"һ#ytȱe -=>esڗ9u[Nk ]+N1p`K煝6W 9Z<bړywٽYsy4.kF8. z7jAs'NgwйY)X$xA2IONy:$߉c{r6qˌZbaE}ŷ^P1={nzkX4qXԍφ^:Ϭ8^߳|@;@_HeGݺvP(=Pz"TO0{*Z 2i+?6,FU4MROy6_wvV^խ}$'ܻ۽`Oy:Ǯ^()kpvksZg]3C40ּ2D!;B5{]ߠcAM[#+eFy`k'g~dOy:ǯ#;J$ϐT=?Cw@1d|QAf\lAfW2pe~m< zAr|y:$ǸVXn =e5pew^7աUa=h,umӈvyOy6Lӝ]a>szk`XqFe;}7]bʱ~޻;- Fc<#a -V3 -oίi~y:,vmOtԙ&B m +K9eUk|{=XOK6%/kKOOOwhkY <<ֆ9R[6_oqp٣͒~)fowFؖUXgȏ, -3v;vu҆?*ž=,=e[o3"_L+\~O.3z}X|e[U:kSՑ1١z[V}d-ؖEOBi_0|]|Qmr,s .R⿎%`Ó^ql_k_>jCqV+q|g5oK|f"|4UWƂ^C_/Ιwr}݃;xԚ6]Zzᰎq rRxq^0`*({6|2Pi{ .qUG$ }Q#S?~'&;>zzn6UFc1pņL,jXL\05[ҔA0gL9k=w20cFs(Z(7עαF>i˲,eXڗ{ǔb -1'=IPeyLh;?4>HzX#~Pػz2!>cJr;7okN@RGҾ]Y򤝑{;Z+G7vIɅD0C:]Z_,,E 򪈣]v+@#jenOT 4nRAސ?W[-H&ùbA^oŹjҋ87Cr)Cw*&t[bujg6.lsi5 ; MkQջF5eF&u5ej$nAE:Ysuga@.tv-S=kt/n쑜leǵ8?5ZE.Hⷋ Bj׹B -=.&KCЬ|*i -פyM Rd~+cNrX$h -=-saKG%ϤR7eLR5/T#X75qƕ\]Jtm:*ݵr7|z\c\*Fq~tQm1a7 ŝFߊN,cdҌ{R9cOx(K_i~߿^z<4n]L#'̩6l.ֱu m75{MB}ĦAh<-־|ikj.xsp)ʊUNڧthɰUe+33 y%~]as]삅vi]e, B`/xyie`}1ڛK[ò,ү/ۜc˃uv,{9}hЂVL{%R*E TC/٪[Jb. ҜxM\nZd[8Co)[,繛zJ[eۺi]wm =2U=ۤ|;saAJUN`zLԤ5|נރC(]LȶFޝxd#RJxM莉UAoMx"W7Jْ>[Af'|mX,B2b@ޘ((-woaI?hl -endstream -endobj -630 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 629 0 R -/Resources 4 0 R -/Annots [ 631 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -631 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 311.373057 101.433071 292.623057 ] -/BS << -/W 0 ->> -/Dest (cb107-1) ->> -endobj -632 0 obj -<< -/Filter /FlateDecode -/Length 4702 ->> -stream -x][,~_Qφu am⇁Oʹҳ0އ)+uIe䥲aOӧ+#t>} -E*K*!zG/_/Rx+oH1?۫U{% >Z6/4j^sR>x/-PIe{mrJcT0z4WyA1XN3H0䕙"^*ZϨJK`$2)+q: QGVS^s:ctQ8lt[lYbtLduEo8-]-@W`uE:8]4@"t20ii HNauQ$-N`5Rs:[?GA"{AQG:A:DAt\ӊ##a%1Q0rYl18.0 M%%|KR9 fJ GP.9.0\t1=kЮ8.0]CJr\@]c0* kxHs\^X:qwuqw4xW[7swjҎE$ wA!w` iq -n "?fL -q\`*X]ʣřqVʹqb2X.3p\Q5 fjNU:J ,x~p -߄.B8.]ВL c!r\#+18$=9._-3 -+zӁwM&'@/Xs\E \>V-^B`AY' Xhbkbkx"*x.` K,I_._~F_^/NӿV_Fy_Y[9Mg/ְ~e ;M*QwS8 6.]uo]HdK;e+4mBK}Y+kp]PނY -Ŕ6?.{#Ïzs>foC;leC2^1&s˘yi՝yN gwAUnr|{ټ:(m7P3P}է}Çf^oSdphc\g_Fg՗ܽڙt]?n9GwAKhgdt-t.ՎGl~ڴeoOMoehNJQ/PJ-Lhzz]u{E^V/rY_}ڬP2-bYOVQG[]ַp/9~};L~Q|3T#: FxƿA(CmEv9F r[Nn1?; -Wd6-K;m[w(GI.v92qwcx+!!Jmt_ӡtÿܻhRvҪȏ]h(BXںvsÅU갚bpufIbI~RzX&m]:9Xmڗ{iPu-RpGްy`Eڙl h7}P;.[﹏ΎzӔFFL+^ٿ*Jpgӡjc⿘wwqDmt 3鐲+~3߸{.Dgյϒʊ)]7V-ض#.Г=;9ZkoG=gO^|DlI[@jٲZHK.jѰqFy|7;F>_lvs:D{ȏtw97Ӆг>l嚲jܛN+˺Rc{yN}Opsqރ_W};i8@ug!wZ"I{R\3E'9}w#IM~?Ǿ#xν3ِ7|w̭hNZ m煅{KmW =s:>|~iW;qw9}gWS߫S,Ljfyzfr{>#s:}٧G"U+\]$EXQhg!9<sH~XAo͸1~xm=L\@o}b37=jFEQ2B"~wܰ6#~jFjcPz`_> -endobj -634 0 obj -<< -/Filter /FlateDecode -/Length 4899 ->> -stream -x][ʑ~_Qφ#%ˁcX0Y>L,}࿿_$Uw{(4=]KdD))K_~~/bL嗋SK.2 䣻 ze__]w]G_͔7]YdCPN`%˹)zSX2eA):1Ș("İݲ0AĂ: (% "Fi7y(K<'I"/xN>vZ{#Aă,dcxXoȃ,&+d1Nxȃ,+-\D"/b[QnrZ%|ӊ<(g W.<2BN8bfmAc<K`\e%)3uG?2h1daV`m?A9$úh'pyD~ -#(cGѪo>].}GD4wO?}Oxৗ˟M)_7TAqʹZFrV/4Y"mr;fyl׶[Q(ȝ:_~)XRfu12_aԗ A_?.3쒤yCGC^|{)=+% R88kFʼlaٺbN\,c;ǭ=inBcq!3DVm A61[~o~Hw,횵aZݝ5~tn-(2eYM<aiw_󱥬 '۲||3J}QYE2LsMS.<:Yf^6~ JkGJannW.sԬlaՂC~V-^rيʍmRnlW⼊.mt׍UwZ|%͛/ʴ~Aݷ]glm&vOGVKU׬IoYڕwVe\+;6ۜmS:oJ?0VuUDSDRkU f#0I%e5tXK?i?hlEZt/G);ދv~J6jh7PC&?:E;oC8> -٭cnrѴl;o<ˇ|yT 4O`EBu7]ZǘD|wz^^p wN̾zu0K+,蝬$yz>~^c~I2$ШXM_>>m=Ctc=#7;5c{gxΪe!~Y|oKSJ.=twoZ>䬁)͖Msuwߤ 0_<\Pwo~+[6xcI/;WI۲l}Q{0ٛlej"#go{N=z6G~M+2+Tzj2{:^!luځ5& -k36㺺|Yefy։3i_u]Y;3Oqqߺc=!? Kgtiw1tԪzͭ>?!}gVy/l93)G=f y:/</VtUFV|[J#5Zw WwQ}YW8)mA x'<Đ%Z,Y|ڏ-lpGZ#~M ޜ;D7 -iz{:q?w\{zWzǺw6?<8}vgo}*x#1b)X:b1߼rpG4:O'īE9+J &~tG/={>_SZ=0RbNJnBIyukAdoW£74n~C,V1~oyqMz -bxoTۋ#2ss!gҤ˓uf ]W{>~;ŗ!N?<쟾#<][o{a-Sw=ϟ22N߆qx8KMٌdsѽv;9b={L-VD 4EQNy6/N%iGrH7F.iQPaUnж;S`o kq9[)8hi;ȁ #gz8gN CmX*>L|ϯ+Em%G-,ϬI~p跦k~4-\֫y|m=NPk밵j'ݴCy r{ϒ.fYzf>Zj9^|x|}w%N49diєF~$ad&.Umt=[n0uZ>(qe4\ߕj|R3"jz%դ2'\* -YA˶[C#-Qu5"<|#V{ 9 #UХ]*vBJud5U; E JcV~g5>Ys&HT˥RN .b5W-jت&Jsu>>&9l&9"*v~c6QzqA(V(W\'ڮJKr6,4>U*#O-ڮZ'<7+y+ꐤMԥC>KG%gЭVNe="T5YWd=Q!]#ʯ+rթT]m}מx2 6t|OqYGlk&Zщ|lLZqo^2g3|=,}sA:nTE SuEW2xߚQutDC7+Pqc:V]5`/%uEP]=5vdS]hiok ^۴{ep|VZE?\ƳmIvM⊋%\2]E\05VbCTճԛr_EFm?eW -endstream -endobj -635 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 634 0 R -/Resources 4 0 R -/Annots [ 636 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -636 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 558.873057 101.433071 540.123057 ] -/BS << -/W 0 ->> -/Dest (cb110-1) ->> -endobj -637 0 obj -<< -/Filter /FlateDecode -/Length 4913 ->> -stream -x]],}_QφI1xp1fL,=2%E*#ީ1{]P(R7%r |IM++)VEF?Hv%OvӯN_g3@*gbT^Pe)Fム -zBsT0GgVaK*I* 뢶[U&j'`> -*`6J:Fi?8=H:ɢ.BtN!:S'I`JK:[vNI:l.uŤh%]-ɂ.+:آҒ.䜨ЩVg|VI:'lZQN -QϢxGҁ') jIa1щ:؂Ηآb(#h"^88lD&%$0)O.F+р~r!G-UŻ 1հa:b؂X [XZ$.[oA …J Ƶ)8 ,(PXpwJ\`AQ ֵ> ,h׺$.]봒wENQ[` J\V(qb Ыp$.V&wMRN5SƠwGk28q&H\L%F]P=tJ\&Dӟ0VN9H\:D]tDžq /O:,qbx.3I\0 -8D̙)R#3Ct=I6㯧_`=_ n[E4TW,!#bFjFFb퇕0LGn`D# X3wirD탖mv_Iޝl[3%-R 1&h$ܙDfCx]U|:+vGAƟ?xw?}z=?o4M_wYrk:C,h^33<׆tkIGy[^Rg.#Ӿu`ŖeiL?O;2%>eDze_\X_:3(\i`x]cY9lbe4nD<(!PHZ˦ٿ*(!e y:TCrg"!p )_s5 ?R."{|a%L0!FL3뎳~뵼5C%? ˿;|#Vdm)?X|,f|ǡPsXZt{F͵6Q CD{e4y64폷M^*k ?_/j/ } r8v=yX?B:c=Oc[^/촍eW2b<φXw#|q#]-ތZv@{0ӡz9r֑Y.o=ǸFtHA<nĩ{0ӡzzuճZU zfFs:]yvuq: jBY~gm#Y[(=كy z:׸M - I7?,y__FK:^ z3[Q2و\n[G7;:l^`j|Pҳ[3s:WDZVm W|>8a ԝcX)wtx:bO7k;rϰUs;]`fS`Vw̷7~lzqkq3%WX._W9qV.e7WF]m q@1F8: tr`wSܔЖo,\ƥ^(ò m -sT# -o.P[%'p.Cۇ){? LyUxk=4rΖSs-7jk6:ةȖr!rSդ1'Mv -&:3koUU{4\]Y״&&Po^ R5,3*7)[OrߨZCg6=5:} -$N]Nb4z*TgݔuZ.l'һQ~\iJ 7f#䣐wPB -+xR:qYet5?SoRbA):_Jhl6I\8ŞK0c+)s\#j놺&& -i\Ʌ7(N߆W}+C7.5UeK(&ZIf^v@ -]ihmT[>A&͸Ne3Zq}> i~=9ϰ ?e'DLNGkly5J!C],ĶFs}d#RJxMY &Ao+XQr&a+ӜL2ʆPTZ -z /*-ȧ j\ -endstream -endobj -638 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 637 0 R -/Resources 4 0 R -/Annots [ 639 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -639 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 108.873057 101.433071 90.123057 ] -/BS << -/W 0 ->> -/Dest (cb113-1) ->> -endobj -640 0 obj -<< -/Filter /FlateDecode -/Length 4683 ->> -stream -x][8~_H|)$HaB<BH }JǗ8N{vLʗsY"!D `/H\# )/qO -:|ve:B$.c=$k #-.` "SL6D$qAp1ft-"t:H\ XK ^0:M[0T$.T4D\i'[xi-qA4ޠD234֒hjIGיQH~`WQ 4&$.@bI\X:bI\f Fbf )O₤nq蔒 ! 0.y%.HVa%0n $-.-p0nIXo$-&{^oF f` ^ D^o1\u $LzW ^+(F anC -܋*154XYF/F 0B6P_ck Qy!`Όo2aXJk|_;3&}z)?˜g ޷[h '-WR5J fSB$ں7;l_}:_Meci9AfѧN?oo\|z=}TʽKL.0\?8pvc+_ϟ~ixء/46-%-gA"X4(Z־33m=51nN  }äShwʕ_\j -F!n ӷ~cmi鳛^.ӵuTP.#ӎve|!Rl򰬯k=KFH*@]un5 M`5K@c'5/t%nBzgawf[XM7\Esw3ojҾL~k#uxMil7z,fuՕqxV2ʌ1jv9ʪٰu.ԩ:K[^bh zFν6C¥c׹~Ϭ=6YЦr:T7z -RMt%hJ֩%g=3zuX .sF;22Q'F^͵>)OZyOB+t9rO292MOp|5} j^WE - -G ʑgF 5HX㬗=p ={;u5ue2/l\uƓ.}l)G#73ѐg7|Ⱦ'ükzv1|RZX4?cmLWćFw^O>jW IE1ݗp+s ^ljw-Z>j|3n2̂O[<>䞕ܚ9nw܏}ya|g׼>gT׆;}λqG;ush&ugn tÃf炘#:Ġg,my_ep+5>)/Aq?m4s84cמ=z<ѻ7WjGxrd{+E^k1S -2Ww927wUw7<&6{8Mmv_áv#oxϪc\gb=}Hѹu<ߙhuqםύg͐=萹&.%XF4M32:z:T6fϏv|/#[ڲKVy ?UhigBoQW+=BK pl/TbEO}41]GR}yv1օ=g~GJдhy{tI_mDmR[y>t=jcanSAǗ+ -'̷ӗ>7P֏]]s4}ֳvV)$E_gF -JGh(;UG[mƫ^̙(Q릧;.k[5<ݝ>\Zue ܛ3 Gy`Xrt'0޲w~}iQUeѦ| \?ْ9+{܇i^|s8|mxXqWwYx}tvBΗlLW2cvGs4D>ٿ*sJpgájcwwiDmၨrAѽy _?wժM|ƣ |ֽؙ͓p]o˨]+oD{ 3И6ӕЋo}5e!7+˺R_Ǯ ods8{wN?~2i_{3AN}-} ֺ3ᐻ3]44qOK#}UpݝݕG~#"={g!uW,}{n}/s+z{~PLGìVm@<3s|7<8v<«ěI6 |z~I"(CL/O0WJkU޾h'WucW]}]ߥyoyyʉ+39??o^>>+Mu7^r.â~< -=\2|C:IQYҹذs<ǒj:#RQ|dbJ?t۟z*~;y~$S*e CSZ7c*󋠯w],ʉxbA^/|jГD|1l3@jkMP5Ul3tJ*,MiMhrBR>-[ר"QH]NY:J? I~rф,<0f QIr:At9\PRŚ5喯TX^m4Iڌ1&C+UlpcQUvrAH*W( -mSnGUR C34JHy -DzU+YFj徰I-)ԴMs -fQ tKb3id:UnۙϦ;|Vma 5_:ִ.4|M5ĞS h[m؈MѶiwCxZ82M6|0R -2VS)WNВi2-MZ63VR+,\4n_ڪ:ͶEgxMh &VfF?<YrIAgxK HXSK<6IIX0I#m -+ҤR8.`HX/<$ya!i ƓB*a½' 0D (HX#M)/aO -<|"OvdOpj84)ο[~ic er=pfovn,4"}n1ç>([ٮ_Em;GgLW?z?ZTgq ^-6k^JGG_-#3ZPqӴՔ_^y-&[pj 46 -_Ϳf6n%ur -ӭ1?FɆCC;X ;K޳7Xx蹝RG=G}0΢";k8xj=5tQOƺ#nn]BGmFr[{la.p5{hʖvgܑ8Vv1Z^wȲ?fٹg~Ḳf\:Ƿǯgfo.ߵY[/픾rK/өQEJF*ewF1>˽{'4_sBgx,#."[̽`R^]5rKmwmx0G2́˞8֋{ދ-J@E>L:Xd5g>CA*/!R <eɎ'qMd{ÐSY\7zBRyb3)y .)I7gW2 C]j 3C0uH?b`]j_/ڈ>)UMQ`{gmZ&~\M?'26#Nt.Ʊ&/o'k?΄%֟w͈~2(@7M9jȱxG7%6e;v/r#2N=uViuP6Cܬ5\Fz؀"l  TPl_Rz]j*:ߒ'+D(G'!)ؠ\| h68fWiպ­䧪֜ $N -T]= Sz!ar*b7a w=NWm8}.pӠbԌ2dmPC~]U WoxW' A9U>~Z>0%H^E,OyWkdцWqN%ӕ#\|ƨIJ['mE[}P{a)N'\jf~xW0ɛRzJngnUagDlk 6l; gVqwHιLo5Us ҐYD6O9V*ϣp>EC;[" -NNidl'eA!ZNB m8.`DR9-r"F=~㮇ߞI>(M)A0v%m -[B/SY,Ͼ3+mnQXx2-CmEj&o?3_TZ=[Dr~ECE2l|>J6|$ß8;%]IgN|/Iq|Xb)Ko,29rȯ7>2QۤvBfUնHם -SKZ7kgN Wz]3*l>h@DMd=g).W| e[)96UwF6T|^Uo*z: )kB7GǍ㳑*RT.҉BPR])Y8 M JQsfb,D\*&[ZsuB-[T4DincU@{tGe56ֱFlRڐ_o.] -D۵[Q5{i05 O3TJe_K5> ]ܬ䵒zC4VSjtTByZjlETC*1HUXuJf+XUkdWMuEnr:U73wWmd_':⚏uv;/Gvl4cI# -H1z(4rL.S~|&q߲3qЈ^)}2?otc9oFU0[Wޓ"ϸ/:m:YVk~ܘUW KI]TWnOtMT͗M3XoK[:W|b -}wp6|m.\2]E\ⲻajdoRUS?]ta_ƣf -+}ä<^<ȾVhמZ; -x2K>2yj[{9mjЂVvت-\S*Mp*b(2ZQKqjLѨ5QJtMYnx-ޜCj%k,kW*жwݠ&ojܦ=sg3:HV+!:dIkl@*z !>=PF\xd"RJ;a8&VIt*Jإ)@X -j06+A|W=P *_FcAi@~!O+m -endstream -endobj -643 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 642 0 R -/Resources 4 0 R -/Annots [ 644 0 R 645 0 R 646 0 R 647 0 R 648 0 R 649 0 R 650 0 R 651 0 R 652 0 R 653 0 R 654 0 R 655 0 R 656 0 R 657 0 R 658 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -644 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 416.373057 101.433071 397.623057 ] -/BS << -/W 0 ->> -/Dest (cb116-1) ->> -endobj -645 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 397.426036 99.933071 378.676036 ] -/BS << -/W 0 ->> -/Dest (cb116-2) ->> -endobj -646 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 378.479014 99.933071 359.729014 ] -/BS << -/W 0 ->> -/Dest (cb116-3) ->> -endobj -647 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 340.584971 99.933071 321.834971 ] -/BS << -/W 0 ->> -/Dest (cb116-4) ->> -endobj -648 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 321.637950 99.933071 302.887950 ] -/BS << -/W 0 ->> -/Dest (cb116-5) ->> -endobj -649 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 302.690928 99.933071 283.940928 ] -/BS << -/W 0 ->> -/Dest (cb116-6) ->> -endobj -650 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 283.743907 99.933071 264.993907 ] -/BS << -/W 0 ->> -/Dest (cb116-7) ->> -endobj -651 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 264.796885 99.933071 246.046885 ] -/BS << -/W 0 ->> -/Dest (cb116-8) ->> -endobj -652 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 226.902842 99.933071 208.152842 ] -/BS << -/W 0 ->> -/Dest (cb116-9) ->> -endobj -653 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 189.008799 99.933071 170.258799 ] -/BS << -/W 0 ->> -/Dest (cb116-10) ->> -endobj -654 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 170.061778 99.933071 151.311778 ] -/BS << -/W 0 ->> -/Dest (cb116-11) ->> -endobj -655 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 151.114756 99.933071 132.364756 ] -/BS << -/W 0 ->> -/Dest (cb116-12) ->> -endobj -656 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 132.167735 99.933071 113.417735 ] -/BS << -/W 0 ->> -/Dest (cb116-13) ->> -endobj -657 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 113.220714 99.933071 94.470714 ] -/BS << -/W 0 ->> -/Dest (cb116-14) ->> -endobj -658 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 94.273692 99.933071 75.523692 ] -/BS << -/W 0 ->> -/Dest (cb116-15) ->> -endobj -659 0 obj -<< -/Filter /FlateDecode -/Length 4421 ->> -stream -x\K$I ׯ3aKB+J4bEZ8*WeNOҎa#3˝-~qٙK|tdM -jEe)d+1OBdR > ./?mw]8듰L)٠ -X֑ -CTX,1BbϷ1䠱 {V-@ k,JH -Yἵ*Xf -31_T^%LLxCx YBNx)'! E*H%⡝2dueYlN2dfW9[Ld5s&6II1)<Y EA@k<,rVՋw%d>ʃ,| |,6E AFpIYp次pJ/p,I<4 YG AjXC1f]@Hհ 2.aASyŸ+~ -cѰ wHÂ|f kX5pb5,] AqH4,@|3tU^1aAf K4,kX `aAlJJQÂX,xHT^4$ Bd<‰5,@bm -aA򐅼װ yȂAd8djyY`.j}@2 )DcЪƋVy<4,H BӰpz F% x5,HU4,@(2#3x ְ.xiX=dA6aAUf B5[3TQ *M ʃ, ?Rl PD ְ g/fְ gװ)fҰXȂOÂb4Y8xjXP\FYԛYÂB&Jo.+e/f^UȽƻґ;~3T m֖!:Q =w}VRz -(sM~fIъ M?@{3ryG1:E>>^ ;'YGSۉmԦўyݑ8o:_ʑw9Y;&S#泻;DkC9=aL5,Gnby?m@ǡbBaܜ؀C&[bQ܇ $o{ae'.ȑ="9Ya[ơ.0<okag6M{VJדNJ?(ˉ3-MpnV,.d|Q)eoRﵾ6Kw&F"vg;KKNQR$;xb̤obW >7Wzxy5x,6R<蝇̲+-- /| ru1gId}]ɚ‹K'm#[Y!I4w`ƅ.o&c©DG?m6=[LfK/ -|ϯ-Kgy2i{`y -d)j}|%UZ>rPtWXM>dirVzǤդ6 si.9B|C9Kz| ~<tVyۃ6* Ob WO6qgX]lhIdu5֖ڿf;#7q>:R;Y\+jʒ4Qmo'l9)%r w~.<ُCzBҖ5T^eV9CjqrTK^JjݟNzy;ĢyEAo#jnVcD:Ki"iD&NdsZi5m%vJdž ,'УyHĚq;N݁U0ȑvꫭOI2gsX[z.V|߂E'wyWMYB=Qѥyr %qOdrSudumM27{Hm]GJ(}:-mup])zwC}?]۝}nk.r<=ԙY3L[Yݺ6O~+yէ6>odi~{ځ`Xe,H_|@p Wti+~ tzZok[^oӬcֈ#r7z;ƮcuNlG|6ЛPZo4~s_ƅ/}uNz `~g.}5E~*|߇㰽G;WCΩAUw6|ϻ9Y^y0FU!gZ>R߰鎆qZ/XQؒlig/ȃм Ťsoy^ݷͰcq}~>僧d$Z}]ݲٞ`H (LwMSøZze*ķ<ޭ) KݔT#gGo9rw=u#9w\vgw5&5|{m?b}Gdmy" TF\*gy/+[b׶UźG~/HV^R6kMl|[ɰpM~9ɷGBF~},vp.{ɔ-v8N $;jhj߮旉"zFwK[V|G6^.`w'yn;w [dyc{b}ViG 5E{iNIҩ}mhfvkB͐+BvhTZ()w+tJ+&>nr(n r -=q_N!) -Dl <|k6{&*S?8&%1f'o4cG48\Jfg}dQ ]cꤲJO@ǖu@XOʙhnC7 y'n2رe&N^q'oK l|MmA& 0F_*ykG'q8q/O5y -^ -8mߝr^\⸷-| ydMH YLDˣmh^n#ܙ'M +-DKfДpT> -endobj -661 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb116-16) ->> -endobj -662 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb116-17) ->> -endobj -663 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb116-18) ->> -endobj -664 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb116-19) ->> -endobj -665 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb116-20) ->> -endobj -666 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb116-21) ->> -endobj -667 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb116-22) ->> -endobj -668 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb116-23) ->> -endobj -669 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb116-24) ->> -endobj -670 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb116-25) ->> -endobj -671 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 567.702842 101.433071 548.952842 ] -/BS << -/W 0 ->> -/Dest (cb117-1) ->> -endobj -672 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 194.455821 101.433071 175.705821 ] -/BS << -/W 0 ->> -/Dest (cb120-1) ->> -endobj -673 0 obj -<< -/Filter /FlateDecode -/Length 4933 ->> -stream -x][$I~_–y"00g"g_d%*̸ٳ=/̺w$r |t|RS ->џrq:ϟH`71_Nguȓ~'41gI3|tmUfΘ$̰.jUeav -f죠 -vh!9kSӃ3z -),"t:Ig^K<|tk甤-Φ(l*Q[LVEb,l-*(-鲝|NΉ J1muF'kzuQ-A,`H: [$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a -c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& -%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ -CĜ"52cX8D}1+|ge6< R4zd!/'D+M װ]"QAb_rR4b͚Ƥ&~9aJ}O;0ђ&U H~DGe oT"5ʊpӪ`9+c]1ԭK eWyNaneNX(C("RL6x !.Gҫ4m -R2PB؇^rB]:=ޑ{ydRN?m$ȫm xc1y#~|om9Av_ye@ 6 9( t&gsʢѝML0\Wɳu]>T[= -k{A<_VhmiuQh7;[#: g5I4hhvNrK]Vi[O^)JӆU| {4(-W@IK}/w=i`J;lhmxD-*߮Z~jߡ~7kd{(kZTQ>EW[G tQW+朞3U_e-?y6ᵼZtZkXBiYx% 4nvLer/p<'|jUu遷c -vR2wI ԜW٥} dOڇn#W>v3+1"gz Yk+KuO8}e&i務|8WJc{$(ЅYhG'DQ+賆F4^Td贶BrxIV~JtsYD.uҏe W+aR.pZUئ:Uk%,|AJϷrT AVn3J]؛2B{烽!qU3/î[Vin&yX9tB K51b}~n~_k>`Z$kk"9Dۤ1y0@rיs\UZX -a岕lt%I `/Y[Wx3=T(>.ѵ"v5nFYVΓtkVjgٔFqc8Arys6h2M9{:XVqx(K\y շҿH |.QEYχo7|f ڒȱԻ.kh;A6~7U˞j+ֹƶ%˵4cQA ۚ/Vcmjf I7J=%.΋z:zPw%KYsX#4m7vBy4ˇG{c(ynjhyV3|'m r$Z{|0!r-kc(IiE,B5"宣Em)зFYwoI7|$x0!y?k5O%u4pYIGMV=}efN#f$.ܠIX}ÑWDWК^<Zcԟ.{6[^d$G?4@3ʣ -5j^ѓ2#[s0?\H8G2+hVB۱<:Zy~Pk~+vzPڱ({"j">;zx?>[_R׽7u&γьcHT/`t4TUHR}biu ZR)yRݗ|4(K*܍y ei?v_WteeY9t&T.\WW􊽼yMw"!.d:~m޹WP_Q<c׏ȼ{qCqyQ7o2;:p0ϣ'oЁ38VZ_䅲Vi8{sJ[KCmv?/K=gG3p<RM6(;lv{_> -1<Y_rj_agp^=vĮ]=s޴v͡}q<BΗ.Η޺jwb+\8JhGry(({ }gA5ͷN`Lt-"="fp>P=|a](^fcu9_{{B]֫)6iE;Me6U͔G7{$ < Agq7ԚroNe77V{7b^.mtS(-*Iz91YIY[7X}sOUB젦\:Ig7 -=T'Dotqعȃb֟tB]UJ'U, O[k(oINDڍj{K;B?|ĦChЃ6xzY=ۃ14FhLFJ]-*mE Tc)l-IR1Ő{^NW&-f-y8ZFK&Ax.u#mmnYwmϬnFdF6I*{(je'DJLNGkly˫J!C+:$\# 19kU^ل(m+WΖؤ l > -endobj -675 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 548.554475 101.433071 529.804475 ] -/BS << -/W 0 ->> -/Dest (cb121-1) ->> -endobj -676 0 obj -<< -/Filter /FlateDecode -/Length 4764 ->> -stream -x][,~_Qφu20?1fه6KaB[*2ϔaNӧ+#t>}2U**c -^o?\~HĿbuopW%mN% Br:Mc˟~u:j]TֈCQ%29vQy%p)q*v -0æ8̰ZGFaA* T0C%Ci)Y 9VǤ Щ91tIx]t$s)k%- - C5(z(g[k{6W6ڴuuEО%Kb؃YyDiLMAIJOkbYovO?\~?}ݧ?.oQk׹r}+׺\F$B"4E*j9-eڷd/K9]TW~':Jszo+VG6Z_]~i !䞬GF^ZL {kduTi댦b_*=gd')˽Uz>n~QHym8\u}Ď%zx抗e.,w=HiObW ҬiVs;eKrCΌ0Q#+e+n}l1BBMU{xcn!w›< 1dMb!ɦl?zT>fp|K'ܭ0y!m,MV -C*vG'ͷ%jL(y{֞΋g\~8Y͝gczSiTMaP牶Ly[8gGzvF uk+Jh*Fy.oq둝{}N=5dYc7ȺomHŠ -(h_Pm'_<ِGϵ o7 *vY)M/ k*oAE_/m\wg9ݐcwm}$hf{;~rݽU޺4j,ddTLuS[<@|,>W1Lmcmv BC6TlBy:]><㹗_Ρ}Y<(庞G[;6*9Zrx3lHj+xbܳ'8M|e0G]y{>$CNw<ċgu5di_:3\_l)a!/h}; u2ӡj?x}/D^/8&wyQ^qX;:p2ӡ`鑝3{;8eq2f L+۰97a}d=? q@Hݧy `]NmPvY7[Z;@w2ӡ`=K֛Nΰs)&v驝}ӆڙCg8 KNy:_'/=zjw\c{\;I+Dhs2! ~8FG{=ϊ[M[-sDs ~xklgêa//=lgy9Eu>eq:W5a~Eҡ&^5P5˗E8 5/qXEBo~6-Be :?I*s[Ջ㩬{tۏTXPz+h(+Iv wrlis7%d> -8z:L2bkqb d70biNi\=l8^Z>-}j6:ʚ3ݖ!rzKN”+LghǴPn+Cu]mGi|6ǦSC״S՚YJZTm]- F&u5e.Y̦zN]ɶtcD ZO*|7C6S41"Mep76uBo&KdfѹBIye~+F徱Z@ͥBhKEɤ'm[C yDRC.-23-Cvu1btƞ$pcVVG2YePm%[m|Ǒmb.nֈnIKVע% 79=e%##c&=mv]w6l7TlnCVT'؏ކ*m=8b쯕lWDZXCXcdPx PcPT<>[-=RP9Y _P5}7׷S)i#u|Ž -endstream -endobj -677 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 676 0 R -/Resources 4 0 R -/Annots [ 678 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -678 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 570.123057 101.433071 551.373057 ] -/BS << -/W 0 ->> -/Dest (cb124-1) ->> -endobj -679 0 obj -<< -/Filter /FlateDecode -/Length 4781 ->> -stream -x][,~_QφI~e` /~0,}zmxJ]"QYY}g]BOBL*|_rzI)ய?^~%z%梨ZxCI`71\/o/oA/Zu;|$pn%nzE#%0;^Z {6W63uuej"-L~0W4Xax0 ͆O"V>mTZXw%3hӏ_}鿀Oo?B73=>0ggP"-U_k;7W?[=e,e4{4ikW#(;m>iMR?_?O[uOASb\/?j9BmrWw5 ^nRa9w'֭۝ff]4\B1K6+j!Iw?s 1M1$Hކ'ZbPn[wtUή# QW3XeiJT[cwZJ@_v3kqh8V' Akod,%|ȿ tb_Ni#;Z߰C|e#u +-Mu0Oo-be'_P*mB; Z76~6v%z4)e'y˩Kњ_7kL%b߯|_|ЋBHڃugtg>{pVr -Bm 쭀llNVAF~n"rwd'YUvtzF޼ziv9SpFq5T؎O2rkB̦xyJ7s)#4z@" Zes'< Gh_BVYIAw^E]6iݦ}/w76\ȱԻ.ͤc$hfc;Սi[^~}ko)NMӐ켃: qoT{ kK]tjw%[Ys[;!0X"8{=l^~9gআu3~Wzʊ6Heľug{|.ϳ!1Cs=Y~B{w -wQ[Nš=(y搴-iXxv?|cDEg%|#W+A23^&!ݔő7D7ݓy1+#,{s.d$tH˾܎k~+3j^ѓ2#9Uz▭FF݌1G@ۈ={h;īs5y~FG`!z9Xn56wZ"Kztؼ">O2T)n3we7vfyDZ/Ž{Dg'<]g#cݫG3fLT#ǐs}LGQPU"Zgύ,e< ՖZNɓ]ʢye<ʎc0J';beН8Sm{ezjzlhJDZ"!!dt#tyNy:T:O0#謗F?0tu/GdC/yRjow7wrOO=[OO79{C~i~7luډ9t#{Qoz<φT]uQ|rLxB}hVIqcI%.'G^0C=(+?fsAc:&پM"s(ɑ -u_-A1w?FeoC. 5 -+QZ_atQy[^Ϋ"x~J)ϑ5]s/ټƞ>Liî~rV.番m@kp m|Nnűz#g9 X:(t#*EgygUɴ!~)N;7#&azYN3&<~Q8^Z-[6:]ͩȖ֊!rSբNBOWBv(X[ń~/T!6٣0t:ͺ5uj,}tr+yר.̨ܥz? ׋ F:Y)05 .t"SJ#kn Ye찖Hځe׭}Í _/8~p z\hY]ːҙ`7 &3*|/uH9jTBcNYI.]:ƎY/HH˘T{C:wsq=N Fy 07k,&V< >2&x{ىD:4^z)Ӝ9j:cGYH;]\q:[έ1/Rb M؇ hui}CCǍa|Fv5ԝAur>dbӡkeɋ=Ҿzi[:Y \cJ"qEIǔ3,#.xdaL$w+,.XAvܘfyMVZ 44o~&6HکK߹7d-a{[hwxeس=Ccns1ʤid <5٦6QtL5Y/16BRZD/S _=D{%RmђpujddR7R&uʚ!aDjd⿏5ϴ j?e'Dq 4&j5e/B8 %5p㽒H+5;gFl;~-+I9@ -4v;AƲ!/#-orY -z)|'ylo -endstream -endobj -680 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 679 0 R -/Resources 4 0 R -/Annots [ 681 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -681 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 573.873057 101.433071 555.123057 ] -/BS << -/W 0 ->> -/Dest (cb127-1) ->> -endobj -682 0 obj -<< -/Filter /FlateDecode -/Length 4741 ->> -stream -x][,~_1˺_lH~0Þ=gmžqZVY]vJRUSI֨ -U"=?~8}t;&>ӿyYV{bY#B A:0,Dy@SX Mq,a +B c2[V:(˱ J.0,%!R<"5)'<9VǤ ੠91xIx]x$s)k%ǃ,,X 0ރ (Lh%8J> *&a$Tƙ~ - }w1P p9, U#5*$qXw -߄p]L1rX%aFa!#GRDabxOxtpX"ayDam>`UH x]`aܕ2$ ":Q/_Woqu\>x\?ϒO6DZR'S..4nMv*|z˨Aޚŵ\mC-ꠥ)6ίy~Oo=ف4BhD,sDz|ҮMjۨt0_c4s*UR :rP]FE A1.w1E1q KֆM'ZbEW[78t*kv-)I NoǢ_6c оYi)wdh1[ݶohRIrdi=9l_CAKOdd ,/-".2^u}#-ٳSZSuw?٦6_6gV]z~FyյA=(us;b%z*se.zLU_K^izmCܮ¬,wa-8u%oAEUoSt.Gaݞ]ݥvzD˺pV\ҡ+og=飓>~~ZKZ_ƌ5UܜOћG\3n -5~㭳3'miK7c*wI[##fQ{ZzGo;J:]g==뵝6MZ9߼P#GWm[9W)n_ֳ^7jMVku5>,u䇱jRybY|4_ocy~{tcrډEa,˧ υ`-`퍞9xMoΏa*⑗6;ڏu^_`D=Q/8&wƒyΣco02_{a -<=z-;Cfҗvp0KIiiܑ_ ;8;kb7m^;c;Cp4`=`?KWyמ]:טwҊ<69<jO -+.pp^ϳi)~,lÂA"O}r8$Wܱа=^嬦#m(coE:}+X*5w37$+U˴^WDu?@W~u~O.k붃v+7Pn#GS$ -]=@kTB|ls):=Jo6ZI#7Ա =.BQ_*J&=nK4*!Uxɪy]#U4 -:5W~^uU'[e^ Zv>,NFq>_y`3\?J:*]0B'w}[:;ɸ)s8Mg(xd1R"ͷɞGI.㸖 -ty{ A2}/D%n3`Ui]6k=eR5U;]@u2fqb d>6}^nMm AVp36LC}H!#nBq;Td+1!JI~;P]FЭ<ۇٱJ˭ 6XUci%#'۽k jF}aDmSM6|$B]C,3=ӂ5zhaW7سnVڪ:P4MVZ+1T|VՒ[Y-StOhD7ZoRukђi9ɞŒ1wڞTڶn {d*{6I"{IYL\WBT/c*mi=0W"쯕lWDZX!12(f4^g0uPT4>[lnSaNnVW˼ nM雰 #HşIDIS -endstream -endobj -683 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 682 0 R -/Resources 4 0 R -/Annots [ 684 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -684 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 558.873057 101.433071 540.123057 ] -/BS << -/W 0 ->> -/Dest (cb130-1) ->> -endobj -685 0 obj -<< -/Filter /FlateDecode -/Length 4776 ->> -stream -x][,~_QφIw g1ه>=6Ka ns):I\%` l[1[2H\`Iѷ<-> ؂HQ0yUIZEt Z0k Z" % `t$. `H\hӰAtZh` A Xez%qfh%jIGיQH~PQ 4&$.@bI\X:bI\f Fbf )؂O₤aq蔒 ! 0.y%.HVa%0n $-!-0nIXo$-&{^oF f`^ vx%0"2MD^x]@|&+#8c@seg@F7 `&VыVJ6P_cuiܢC72aXdr &_SV4_av5o=e(6} R7Q˖ɏ]6vl6*`1AR=x(NXcu`x?AZ{jJ<_Vs7FKu;ƾ^,سѶ՟C A{ -Ė`vbf+,zl -:H&o?]@ŊuϾ]#Ә(~?>'(ZF/s\rֿ#T [˫IoSH/k9mzlSB9Om~ױ}>mW<+X0Ak1׹,_R:UuRqσ -TҸ|NPǽ ];45K R!+;Pm[_l4'COw -p )w!Ny6a}c#:{tDȈ4шj rPwraf`߾G]e^LڱűmkZrѵN'Ļo>^uRxe2rn꛽;NV/C*Sc\mضrP|Sۡ6!ڦ'ueWhY,}&*6GPx |/Gv~ʾ:O_e;ToGf3m|!^b^G[3 -\Ql^A>5Ol-mm^ngƝm>ί:J_nsnGXr~Ǎ6Wn.3c;bAyiVdlw m<1۱{cc^'+OqWӻkW{fvۏZ?: +gn|9R_o󢓏m<Z5{adĒ(1DCx^BvNYaJ||6UXi8wm [˾=.X8"%{)f${v~I}&΁żtw=dm\伽!a -:6= d:u5LRgss85>'%b߯x|_ל׋jHiĵKCtP-bP (6A'')TifI|(,(_j3soo8nFga};ю'ڸ=z|ؿ6Ҟ7Hҳ_lHwbٗ89ȽP:#^=i/3RS-nhd$]9JF['` hthqy#~׆P NQfkT)n3woǍƧi7{t(<5)6L=(X5}#f >;z8>ok^=6Vf2gúAyLEU[_K|u5di_:M@\_l';n]}ɷ3l 8y6韡w?Ɏ:er$^گnܧyMDZ"s@C+#u2ӡ8x}Gg$Jܭ{'<c_`fy =~#'C'VҷNpcg~4gwPyhݹmv7~~(~ >t/DZ6u~(x'<zg}ɝR~x"9Npn=n=upnP;s>yi~qΑQ{4̝>esZwS~B<qLȤKu]wQsK-yܨqF͎EWYnŐ!/ƂI=^_d_GK7(m ci#> -endobj -687 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 555.123057 101.433071 536.373057 ] -/BS << -/W 0 ->> -/Dest (cb133-1) ->> -endobj -688 0 obj -<< -/Filter /FlateDecode -/Length 4596 ->> -stream -x\[%~?<,R1ؐ``x&vZV׹Lg9t)U*mKdTJ9:?|U?_g)*orH3\T1{\'똳U9kw"bQ{ ,UsXGtdEA9y1$p;2İѐĂ&(j- &rV$5*lȋh%s*D2HB>I<,>k#yde\MXi Z$>;@iϧϾ/ />5}z_뵭qh68|hXh^kϣMzZ@Ez.h_deuv#eЮק?;KYl΂mcB_U-*nTvr'hs3{eNwڏLkty['HsC8nw˴nL~uW;q,jXy6U_ks6zۢtZEg=`lZh&p-zBɺC&')*7m*/+ګ~+m^ήrmea6mz-83߾\ۧ˸0}w&:؂kgMw.ͪo5kfG=!Oj~FJKSSE(C^e.X9qm$fc:g~8oF c;vb"OUdy^,c.Ұ~cArxG{o6ak}t:5>f#Sj;WoY|yrs\ثN>] ?d.hmV~<&s8ʭmnz>KOF1|Aouieo/Lc'o []ɮyL[Oq{*:ynQǨ6N^O3ᔩ~T2#<~+6~ ?[lYud^ϫ|t_Tju<1/㱓?aS[=qkўo|x]ֳ\WLl6Ƨ!gT.yܟi@vw!/{m>S|CӶ\j2>zSeH295.ȸ('?Bulg%9>8:IyLJS\tO&ɘ?Gܛ6}c(s{~Vj1^djt^ta~&>c1(o ǫ;Gwy[!qwy=SD2*Sg6u)mFaV2'Z:lW\-[ BVmJ] wfnK6֭EV?wh]TaX͗b&6ݷ j>eMzH_UxuR3>YAܤ$¿].%TDŽ:g>UtZP`Fy>GW:df{qS?tuV ir˔j[[~,nv7lqy&WE\8{22l>mpJmHs߶T-&p~s?E>:LH;$O,^ád]eR*g%^+C 8}//H(y:➷+\Zvs<ː8.e>w0]u^ ZZ(FbݑbK:s7N zgXNt5B;kMmࡱcE`0[z_W*kb5`Sm~~^rY"sG:.;#}u^'ikx>ZH|V5]srq%CҾywyu|=? } J/;:o~X<[.Ǣ <>pgW7rهqGI/`V?ZxAv8g|Y܊QK43gyFI$/[v_mFHXsK/_$Qd&֯ELkGgTy-|{:w:W0V& -Tֱ@D`dViIz(|G4 7D=u7Ȗ<߷U>LoemyxBn>T~kSkiNsPS}+ BN$?խi1;b#HVN =r5-{4!put3 !9]')nk&S|Q(Vh\o&NNzˠ7LF7 *|2/K?f'4CG4`(Lgg} t؎:lc'uӱr&&d]yGr>U3r/QiRb.S#KvQ\N!NLvȹzfS8ktG#M7ZT)/̝<=>UfS;wLcj> -endobj -690 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 367.323057 101.433071 348.573057 ] -/BS << -/W 0 ->> -/Dest (cb136-1) ->> -endobj -691 0 obj -<< -/Filter /FlateDecode -/Length 3514 ->> -stream -x\K$ I $``#0rxl9瓪jcf.zD#w$Τc-FeOGg%rH8=p|9]srÿcܑL΁?ca b^aec彉|PXb b($1$' % Kt|1\Qa9 9Y aRxΛM )SVy<I1y !l; p/@lUdYEB؝du%YlNe6>')sYo|b9aQPR - K><ْc"x 1%[x7[vC(*@P,6 AL%6$i(@)5썄5`#[%hHqoƅ5,]*ְwI`AD% îj@&EK๨aAbLkX7%]ҰbDÂ! \E"sItsNÂD٠`5,@F-xbK4,HLI5,R<а)ŶװM9* RRn& R,dIf7Bd|dLI5,g%ԛ$/K4,lQoS6s(f԰ dHQTdAҔ&:iY(9Ro& fDF RoF3Iw @V-Gg:33'[# EꙁI=4,SPO VtV=6_cr |D`13rn!{1n/?xB=g8$ P=og⩊^չ,c"^w< -Qr_7#nu d<PIW(_pG02dV6~wiR,9W}8|_}0wχ`aK_~w~{oTp |<>Oum'뵜V#^A﷙kקe]nFu+4W7.ѺYF1#N*SWQU3ƅJ&W6ܰ;JLƱnY}cβ盛/L[li-\?絏s}t4i[t6I{'hfc#dK彝[vߘ~{}޸ǣٲ4n}$zlw\ vzh+fz>ĥ=6r,?{EU)eH$DVQtPփذBQXu{7@eV+lT啍*)p]n˯RTSZ<)j]e|I׵'y~˽>B}էmSyĔ蘏dY\SF֗>^{{<_\^kU.)_\nyVrCyJ \sk;&{7v}rY}V}:q}kYX!bdpr͕\SKVdqL(s1x 89N 2IǕօA[&'u^#XZގiS%i< ;շ]!NmS 3 15C/~ -tP{14 S7^=Zx;v%k&3{ |Tz7ӛ<{Ԓ/WpF+OhZ^8&UHNnLuD'qmv/ҿnwlCl+ cKv:@X۟36! n/wWły9t|ɱkܕG滼}TS[dh7C0 }odZ=~>0G)"+oY;}9~9^8َԱuC#Yy_8I.7bwH2 4f =Mx-czsg{8.9v_!vOKa.7Иo4xYȡy@vhԗoP;TͰm:c\<$gH-dӘmt1lE6@4h}d -밶-K~JD?k%-׳% 9g%B Nѓ|mٮݢq 1̟|w1SW'!.tE&wŦ!R^W~Vr~"J敠#6tt^ȷTòUoupmsF9 B ތT,1Kқʋ:h>6'أ. -endstream -endobj -692 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 691 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -693 0 obj -<< -/Filter /FlateDecode -/Length 4509 ->> -stream -x][d7~_H1o$@(BNf|sl9]}&2v*_WUn-~r3Ԝxt|&GZCc 9l'&lr>e÷8k[5yYL.9ۨ*XǤ3b bLYbP-QcA (1eYbHcA WcVXBUy\4 JO;JUe\/24^5)X4AXxDGd5dPK%`Ud%!v+UTd:W --&sDfPyXQ,ƪ K kY?8C.EYWwiYϤ &_C I øaP/P/PA_T:Ӏ X)iHd!\YB% ,(aASа m ֢aAܒNÂ%뒆 1J"  T5,԰ tܳbn4,@jX@PSA@G\ p785, .װj`I؊X % 3\k0hX@]1sw}^zIX5B@a3a*ܟVƕ4,]W0}*qeBƥT5,]8aA>x5,]5pj5,] Qq4,3tU^5aA 4,8TÂ܅{$஍!hX<װq xXʚFjRhә3΢X@ooU ,*{9i1Y鬺m` 'E`>ddŲ D#…bؿ~{8sS6"/R4fWqm' "9{YkۮE#(btduEwZZ&'1A~: Y@F#8$1v'yIPgWS;~Oo1џeS Um<Ωvp.%JTcy IֺjJfbY7, p[2gϽ,ޝ7&4[t?XFwݦbBV7!+LӴѝ$JJ jjGm$ #uxFY9OȤޤ-XX(bkom- 9/,ȷ~f I q7[ӒF:j|򼡼fϩs=u=/uSA~Ck}HyqY)Z :?8t_~ͯ᯿BP2"Ŀ[ z׏s_Qq&(  -wﭽҫ/_n}Mkǥw. 3t zog,h1,mD+~ON_zky`W t~[U&G2Hz߭N]g4[/OBZc|TS{Z{Kk7I+:1M{w!1v6S59$ci3dzyTZ娴XlskYӪn9Nz;i{Y럄%&} ZNf~Zm߯r)1ʭU׽^8!s<￭;tHڅwiR/yr&1>nE/?$gj+ay>]B. b|"Md^ck}]sabL12_'4I o|γ|/:5bi'^ՌG␷>67߼p<qSw^ =ĖIaMV>"Ñk&2 __o#m Yi1~Uv'RRUgej7W[4njȷS!~*ЮVZ w?dm=vj$8Mқ糓P]8oyr -U^XYdTL"مctЄKAyg+uVУvȸ.>8];|K`}}w7#e`7Z[\ZNf}òEV . Lm,/"X1>_;6˃ZY^G+ M>{&~eeSǰU|f>EFMoD /{o JvgΫP_(9q,y`nLi's8ǽi,!݊,zlg'(2`"tXL{;n_JXJ=wZ޷'[ᕻ𗤧r>{~g_s=R"7#-rVo ‰Y}$s>Hg_v=GNEϿ\k<0Ѿ8rg`݇`Ɛ#.[t; Y\p3ha P|sz'~G*U!sxx׮tOZ̈vz#~ESll]s -}>vkT|-1'#Sl ק5źㅚ2ϣz+[&q2.J0۸'?.RRD3Af֎ȍNp]I8y{"h ׏/iPh,+DḶGp>b(8$Yv68+$`1n=uy5T&q.U>F<mST*"ٛvЂj%DŽИ'ߊ;#~e{ӄ|1k|B,ݐhB:rkkqTʬZ(CWh'[gZ-ӿ1׶g+7!Klj6vӓ bLj.]UX7 TAeio o$iipgY.Y/WRAwP=.- dhn0 yRvt08ڝ4IqW yG;lw2o7;)@a'>5r_v.2847C%y}Hw/<+vغ!KOj;|v'e#O+l0iV{I7 $ƩCAt B3 -d~L<>8N8R.pX&/L|M≋N.yQQ<l#&d'9"0y4ݬl(DA>ȆNFEg/<ȩh'Ic<c>mrҘm -jQvJ;N-.SZuUKy(ge(1YIgeFF99:;KX($k*͒m0h -fdjgxVY~+]+N+2K8jr9>-)CTu\KQ0͎Ҍ.6C4 -^ZuH)@ -0wvkj}6cToϕg{Nf_̀ -endstream -endobj -694 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 693 0 R -/Resources 4 0 R -/Annots [ 695 0 R 696 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -695 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 563.554475 101.433071 544.804475 ] -/BS << -/W 0 ->> -/Dest (cb139-1) ->> -endobj -696 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 100.307453 101.433071 81.557453 ] -/BS << -/W 0 ->> -/Dest (cb142-1) ->> -endobj -697 0 obj -<< -/Filter /FlateDecode -/Length 3420 ->> -stream -x՜[\S̳A IL&rsN_f+l4UuU"Rsλ=-%.^T)N.⏻Nؓ5Q>J咳B]JkT0#f!9We!DK33XrsUX*j̆*x{SC % zt\*ЅL٥,!KW]J)K'%V,]-1xK[Kt pbo` ̖.TCW` : -/G t!dSIJlI>VS["{t [/KNDΥtu`"l!b` &"%sK(g'ĂvRXRF'ft,-QEErMl* ` -X,`-$lA[X,`V|  paX .$ ȅ+U 2i],lA],0RwYX .3j:X::-gb̪&GxRb@].;AX .E܂],KBbŁ?] $l`- CGl9BZb "krd `L]u!cčuQv!j Tl gX;DTXԖ Tł"o . X悇뚺|-bAw%X(|IL]vp`0vył"W bAw 1u Y,@^:O w} [:p\-$pWæłU@b tȂbA*jbA:|.9\GC,S[$$֮r- 2&X eXՀ?؂LbHJXc~ jkSW bA\X;M, X,`X,@(r[[d[,@ ] -d -2X$҉}fXP$9M-`` R:LX,f;Z,MlsLl( J!ndlz؂bAil{57I,`]~X,X7ł*%"E1uIS5-&dl* jJ, f`<(q+d]db.Dfk=33[YtYFVV<3CeI*E>&gLXO#wȈ%MV, Av_(w_{f9)ka)-g,;9!ӸRa3 ~onw0{jzW4|ؿ_ֳͤmck8@ Ooo/bd}5cҳ:NZ0I݄ͮk?]ƌfdIi㱃-xb/mq HbpB+wlܥuE s`BNqz4w#T -w_x/k9ֿl2)[ߋlF9LZKlaZݥ[֠mol={8l?JW۰9o>_~zm;.r( _QL^!%3zXs!0F$'^ҦݹЙ !bW"YWN:̇rχ[ejl;WeJw. 9bh:SR5 9y!3FxsnHQ > O`sB3m44OYudg#zFzozU{_*,\q:~*{Zٖm>WS9mm+w)wc Gm|rg%d|_*_LK=3d҉|ν':^hR'L~Wچ1mu%#zuJ\6X|p:pZ*'>5tNi[Cm=>;j?n}OvP!{8ϻ<kIzS{}\xЦ),j.ߊKm_>7~b^&.Tq:@ׇ"..q!qtX[ے -vaӒΡd}}Kݍ֏>l cC) XPoWSѠeGMq`? O 1I'd}v &<-JM>ܚjKx2vil%H'CtW5-̮fMZ9r3DYnk-ʽTUkapu.} 2F475L<3ڗoLxE+qw1`f!Ovq_6TXMK<˛ ݥq5:ѵǃ4SX#$p7+t{>bGi&y.Z;{WXdV=~-a8RśA/dc{k;-HRkj$$T4}I R2<vV2ps6z[15;Z-=m.>^n?|gu9F\e֭~E5-ͺrt|@ -endstream -endobj -698 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 697 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -699 0 obj -<< -/Filter /FlateDecode -/Length 4776 ->> -stream -x]K$ׯaz^`v6`tc/))233[x{#RfڣWeS%E:>>̔ZbuQo -Gk(M#|R .m.ew:k]TJt6Y䧔S2Aa -+)%ŠvKX#$rg%A%1ȹ2߳ -pɒƂ !N0E(=j +Ӱ wJaA"n&@o50]W&Srְ wKN“@&հ`<ġD.aAཆkaʃ,>; ׀U|dBw k<1hXljX\ְN1TRbCȧaA2 @ʃ,HS%kXdiXdAȠa"XDjzY`.j~@@)" RǠUݔZelҰ %[ KMNa~pI% R,p M!2x ְ.xjXdA4aAvYf4`F. Uk<2gf 2ʼnCE &4*&4,p4,@diʃ,>9;N79CgM7@D|'5,gf䛎4,_r5,( DmͤaA!<Ȃ(~ LB txB9 @^Ȝo&u -IwF p|oHtf3;[؋*{9i1Y`Yu'Ea kfN< D=bؿq{,S~6;)` -f -Az6 - ӭ,5nuעOAFZ -tl/k:\;ĵMPOb$r@tCaI"vyEPǠGWC;~O0џdCeYSUx.Ssm,{(hsɖS$fYEQWh]Ɋ1&݆l(1­ɜ>#lh6$鈚,+ e݆[rlN EՆ:u zt5?r -ʮQwȳNқ9/"K;O -,F,7{s7T'/]l/x#uկ*Wi!KQ%>cawYJ_Pշz  MD~Jo}<c c\6k(74 nߏp>f]  N\}.AsiɵƥpB"4p>7)l+Ѻ6Й7.==s*LoKYV.r-246>,mMfƖVuZV[Fj۞˚pDuMeD Cb4I3Uceq?Cn>4퐵Yg};7|@hߎY5Yب*wfel|P,V+m7nz/-WXAZp(ꤥEꖶlK/뙶h2~M+:*Q5\ѣZ{q9)χGeb;2Vn}.1n} -^V(d^Zt{n ӅD6޿*TcpdF[׶jH{HhԐl]! {*\ 9 *6zU/]^Nw~7߼ԖN-ha8‡66S,y<}EXF\$|6z/FUkQUi/i{_՞tH9v NR F#;|hYUmz]^M2gOM^ y[ e>=a1MjQs -mi7VM9> 0"Ez?.ay/͜h).oP۬H :nnjۧՐ~Ilb+?l8IJ!K~m>`r/Tft'h*%pVO hͦCᡋ>qcGȧeT˟0 /[~[/-I6ֵbJq'.7r[YZmuĪ/YU`G̥5D]C76K7'k9hvaX®㚶+}cl[Y~ӧZ\XpGS#+|[*\|Hk[rš=&.$$Bc庼g3:g"ʕkgYMeUc]\^[n}!Cͨ|XV\b*/qy5Gg/,:f}rWۜγz .~D|3YmcRv(DYĝMd3ly8k49_V -V~!˿w|h/šYFLIX\t,V$ڢѦe2v"C0:|?wC0#|hcq]-rŔk3i>&>,$~z>?.Ë֨.䓪r+[V&FzSH|XX[n7Bz,!&%3ǰOXj "y(G~h6l&[kgjl|꥖7o~7?u~-X` MzWn}JzhfC~9[H![{|4-NF;i >Lf8n'CGh~hdZ!_8wQ3=Go&MyU L8$Yv48*^%[o1Ft7ȎO -ױ#~eZӄ|1k!Q/WZ9t:BKQ4QNį>b|&}Mvv)-a` $ыv;9a/'HOpFg3TNe,u$ f'$鱣iFY.RY/D Jy^klE*t/7;xɶ[]'35tDӄ@w)C]5YCowcIN}-?6߈і̦['L_Fg8( їJnщ_>'VC]N;deE?:=[h^ǝh:r%7Fn#ͣlhq^Өn#\I C:fi|܌{mp|5?nI 9\cI>&qEǒ.9QQ\ːl%&줫'9"K?x4YtQ" <ЯvϞE<;EROzח}CC-/| g-hu!mTPSjUmpibj2ťZSKqVzL1?HM9+]AJܕvۊף% 9љQǒYEYSi}(AC8"S3]Wk|G}VԝcPMDc&xu.Ȼ 1&Y~. :C4ޏW+F} -PgKcꗉSE~7󫚒9ظINlk -endstream -endobj -700 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 699 0 R -/Resources 4 0 R -/Annots [ 701 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -701 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 512.554475 101.433071 493.804475 ] -/BS << -/W 0 ->> -/Dest (cb145-1) ->> -endobj -702 0 obj -<< -/Filter /FlateDecode -/Length 4689 ->> -stream -x]ێ}gy)ހ$Fag6 ϡZ*ݳkNJaUjϗ -R"x/-PIe{mrJcT0zҴVyA1XN3H0Y"^*ZϨJK`$2)+:q: QGVS^s:ctQ8lt[lYbtLduEo8-]-@W`uE:8]4@"t2ii HNauQ$-N`5Rs:[?GA"{AQG:A:DAt\ӊ##a%1Q0sYl18.0M%%|KR9 fJ GP.9.0\t1=kЮ8.0]CJr\@]cP0* kxHs\QX:qwuqw4xW[\rwjҎE$ wA!w` iqn "?fN -q\`*`X]ʣǙy^ʹqb2X.3p\XQ5 VjNU:J ,x~p -X߄.B8.]ВL c!r\X#+18$=9._-3 -+FӁwM&'@/Xs\E \>V-^B`AY' Xhbkbkx"*xlx[6> O0o1*sZfu:9.bqb)09..q\3SqS,E"hxN8ӅN) -9.: tЈ%՜d3H"&4&8.`r\&V[% B) [)D [q\M4Doj2śh$Mx̼ƥxs\ X(i̼'!;q:[t$ s) @ M oz6]޵L8@ ϖ%zg23 X[ٔbl@|S& `&"جU(d Vp>)*8x(vɏWS,(8Sii#V|0JLB,IFXT9閌ӛrUr4NV[2&NJI¿}wPg+.9rؘ0i{~~w޽̑')IJiW*W!Pee@Er;R TڋMe&^Η>??m濓te>gֵ<_-0y 4Fvƪ<W S,/%uaZ~zX;snz2>uelX^Cn\z nrnm۴K.Pݶ{ )˞A G&JDfǃudD:א܏ZݾE[2Q9h*Ws7Z5t ->Xp<F&tk?GuOuR_y|y$ABu9Z;#k f u\#h$=ͬ[̄д延چcH}skSЊa;~i?=4#Vz_W4zsAO]]sKvo -hcVgx4 wnMu&}7\qݓC>]I![Z\H=he™CScOnC { URj^i8/XG~h7[ff" }Gpᐹum;dcֿ+3q,̣?z96g=׉W|nNW=lAֵ~pv}h ǻua-jUL[=\֬|Zאn6-.5oS:GC50mԜVt2sw٨+|ǽlco3Xph3 F=E9E.Kt[0V|Du`!v}4%V.}:{ ]*nX=e?ؾ;po5(vo93xPvtݒ\ksLm>YFm;ډ{`_>`!s>MX+o ~u{{dO}~/n-_UQ/Q]9r|͂)v;.k5wbu;ϷtXۛbpme8dxJqOWgPڲ#_|umn_u/%;oo5#gJ;ll)ߑMs8D]n*ٔ17Puǝ:Cn_wn7yF]zuUNJ6Fܓ%WK*WS{ڰm /|}R;fR}!ֽ#>-;C |Bh.:CoMy/k;Ts8D~'HΤO2g5#7Xp~I፟ڴig< -y1b:GCo|OZ@y:Czԇ\~wd&.c $`!,}jv}aoW}?e8\`!'SFQbg M3e9N}gn3IM6kG bP2vl^Q[dFW/O77酭&`R' ^7<ѼQ_)YKOr-[wFhBٜ5e{TzSX:WT3p^>pZK_Yizdn*Efb\ qbD'FMQKoCr1cD'ܚ-#KPՔ -uJ3fOn4R䱖^ OLדLi[B Vhv8Ȋ*M[.05,( -[y -{Q=IEV -|-t`/$S>n)]zl!mK$Uc)VuE(,OV(8]ׅiTɜjnKU -wb_F\{K yZب'|*ֲvdRJ8Nӷ$V?N2Q靪Ao/ZЅ[v%KoF,,ӦjjhUemFCYǵnjuY=TAUѶB[]L3<:6u|q8IVᠽ3uI>7M(K:8hasX-[ٞt}ڡ0\AFCSuTٶ,)شmäړƅ=wO}6ڋ KBxLnyXsNy*mfԩQ] ZmV e慢d2J>j[+l/ST?ڞNUn^dd[8zu,d`d]TK,[Ϋ ZͮJ̝K.?S&DK,ԤPzФFns=WΈ\I{& cWۆ P}EPZ%L*Ҝ\e0srJCBEWGҫӽTljh~>~ } -endstream -endobj -703 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 702 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -704 0 obj -<< -/Filter /FlateDecode -/Length 5035 ->> -stream -x]]$}_QφM#5\l`c5nK}LIȬ욞J>"PJ_~/bL始SWr. 䣻lBr& I\0TV}F ,wd]mw78 Im -eiR)F xd$.T0HZJ\0IUZ OQ0yЫ̛)е( qA4k "& )K@ 4I\tTh$Nt!Zh A Xez%q,4֒jIF*3]E 0MS2N,~2GAHM^nF b.F ͼ $]I\,qh2$.H:biH˼ތ$O $..(.p0oIXo$.&ތzypx%0$3Mx^x]& c^qF1b@U (p/Uc -Hbjbe5YP+1lh s􉇨<`3c70-}[slv'. {?/(  -$ qgǿޕ97RWK0[V /n?tYYJapO Ɗd+u}w*>hYGI.慨sp1Jۍ`mX4s@VlVڶ N,_8AM?SE>Pa<|: hӏ_O?@_K)sٙo\/XL ~toX?5y 2NJSC{C=99D%ooi^2Uלn[dZn@鷗aY=| n\S:ű%>yI+_y:@z5~v δUְ"mӾ T0w*0$Mv@|̳YCm$r4ue4LX7C +⨏p6 -eoMki"ǰFSj{??wgϤ'<Ky.'CȕMf\";9<8HC;9=׳q~>{QKl604?bC\COa-ֆ^:Ϭ8^|}.3-΀m(5<ғe WERr€ւLʕ~/޴;D\x+iGU4MRϕy:_knmf( nGu76ܯ>'<Z}6rk5!Uad! 7Uu]~5%[3+efy`O }6Ȟ,t>_G#JhgH=?CHDFGQq!5;-^[ 0kg'UFUe ǵzv!#;lqakRK,ϸ)G =?ah{Xڴ۲+1@d(`M/ֹQX7uffrlh67sgԅ띶 ^5 -ϗ?T:hQ}} {NlW犯Gfk$ZW9Vo:`oXIRá1S.twKXзe?1ewb^ϗޫ/-=QqΓӍY99{IY q^^Fne EWOy6Dѱֱn{VwF.Gq-2һY}AV#pcd? $ٸk=6Ѣo~Ow,nkCq{!~cu%{ 'h?7Um.S;֮N+ܗ&}cqroјeqn G[m%mֽ~SmyGei}3ýVs~~iޯ asVb-u< fCWZg绗ӿv샆tj>˓IWv}oc?1 ^:F%ly'\a6N[NytX\פ):! 1Pma'C^V>5Xqދ+L*}cػg ^Xܹ#daDMG[&)ƺ7)̪H0uXtKX븍E9(bSXB/krH잓5-=GrqU'2>7uiq灮lPq}28]~ӡg<҈9K/rxY<[ձ_YGP2AjB25.p.˖F*w@Fi[/@y7([Pe"HZ'06?["iYOjy_F, edy`ô@c^V6xʹR|\aCYm*^6ŗ3?u9Yyx;&1ӔʒäKNu?\7l|v>p #XTNjN4/4|U).HH&[wsQ!V SsZ7cΡc˧Tl9qnXHDIդq˕o +$W MVDMTl ĭ|Ollk^"ͩ1MLתj,S*TWs6NB"$~jՄlr6j491V Q˗j>!v-6R劽h=UPuvc|9l([? mUd1Q=ₐuPB'ZVoK㥧u ST3U| CW<7[xoCRh -=/.B,/,t[cTe,=^&FdPג3i\UUdנJz6UjyZ=7|ɡ·[7}[ 5V 6ғj֮7b i$ة|L/L~Z[{Y/-~BÁg;nTc Ӹu-Yfx29OMlӆ%bߓuy]EC0^\ub9ucPݤ<>dɦAhz$ކ^l׎M77JWpol7WV%rn!% -WK`ꚭ̀䍴 -b̍ȗ˨Y^uM+wWL7VJ?)?0 -endstream -endobj -705 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 704 0 R -/Resources 4 0 R -/Annots [ 706 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -706 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 307.623057 101.433071 288.873057 ] -/BS << -/W 0 ->> -/Dest (cb148-1) ->> -endobj -707 0 obj -<< -/Filter /FlateDecode -/Length 4670 ->> -stream -x]M丑ȳf6|*gʃEQ)R!*RfV7wR$"#BRҜ5~1/Q)|I5 %f{F6&?*foc8_wȋu٪5)FUJ'W1ZU0 ->* K*A&A`hRa$0GAe40VkQC4xAYB6V9B$㍤*#6o-Rtന-6E'"l,l-:h#S>'"Q)j|rNK:c6Ì (,l gQ[V9Bt bJlev;팤H`%$ - R$1*ʖ$)J$)+I4`Wrxi58 [< -+`$q$.pXr8--8-l$.p[&H\@0SK\.r,q:p%.p`]烕v q:2Z:3I\@]gtFV)i k& k#Q栓kxג ( -Eo -;[@`: ИpK$.] slLA5 '2=.[2!d ?DIhP* 4Us[b$1i3Y f Bi6_ckfX.2cZsLJk~;owz͐)?P_a، . Q a#u1OFt+Fb+3a];}*>B!"P8ZO_ *hFp6˶ RӬwNh5X/ O?~?>ZS7}p[2tː:7B;W?׿\8EhΩo_YEVO㵬z?6x)Q g*`s@!-( n+H js]Y_P3Nw|- -8;+kMs4"Z7jjאmnK+k:b$$;GTLjzD=n=ۍ("6bq>I>V@raxvڌݵ]Xۗe~6{'Ѧlu G>\n;Y^u|3Z%_׸@ܒC},֡G+henA-ams8U=f+{WCς^x?ɈOI+YȝuH~!Cތ _}O>u~b?O*ݚ3t(^]̯XbB4m"9"7|;/#~쏝|:ViO!mew9Ok_W=Yht -ʆd.Lm~qlz\u_Z#aWMms9}Yk76lQ L}WPϷPv5lݺ+O4δȸ"ɍ҈*Q7t+SWQoTnAV;{VC2ƭLk(#m~_Y&H\AWb+Zu{QrKۻzs4҆xۿ 9e?> ¹nzgáu>յ[fx&h6$.ͪ[f>~6˶qBb>&e %-s8m=y7;zڟcqp]{W4Do:"#ZAŤYph.ü]>]Ikz"}vy3ⱵX{jk> \㟛 s44 Q}"9mZ'w[<uf =0;;Qy"F髽ɩ;)/]F j>p|g!v}6'>L:GC\ܸ_ݭ 17xgȗ@X.mqQٴ6Xg"s8n<+Gf[#mK wU;[fv9 -|Tݙ{ ~VPʞs8n:fFm_CkU.]yQC:l>3蟙j}U>:GCnQn_o8Z'šֽϳ4Jkx!Vons3 w={+|=3KB!ow_áwQg>Z.V:mػUҺxˤcپ's8DmHO>Ϯ $}>3^ -ou t[χo%|sLi=IkH; y}1+x߇C?ᚯ'єm: q|͆-^>O|'D~Yp=~K\57x2xn/96G#!xutv]>;;v1=DRAe FE6Pȡnp.?=,ˆeHMT]:%˾#~_d7mcVSbn-.Cݕ!PӲ]CZ@-ewhk -Wqc6q^&iy S>D+U&-3|0 UNX0L  ҭfReLs5T#45q?+PW#pIgNߦ*^O oNиcqS6kv2,lԋ S=$vɘp2 0'}u6v|8M2iŽ~: ˜uf|Δ}Ne2um:슝v.Uئ Zb?M[z"Z45M˅~C& 83bsdizq8+[Up/iҹiI>&qTNK:dYEFqN'ff@򓴮/ -WQݤiMWp\`xdI臧> (FMՊ,ua5ǝAS{99Ԙ\ p2i> -endobj -709 0 obj -<< -/Filter /FlateDecode -/Length 5052 ->> -stream -x][ȑ~_Qφye`  g1ه56Ka2 B%uԘ=M.E%嗑! -?hIO1zEM)+%VE'wՊt] v!/v._W3vUdCPNP%ʹ)㼠z)$` dh -0Rt -f1QPEa)hU%a&I3trAPi;QJEdnptFO>&D]N#鬝| KEIG%%-N)I[ I&L Bt)6˯?b_LYJiB|i`!8}˂ʿb! |N6"n-.Il$gQ"sXJM1&w949 BHA˶vW~$[]sj۰\t uqv@;|F (l:xdTFhU7. Ŋ9C4ݸ/㟿O^/, _nb&7:laAͺk,e M kz~ K;~@)Qy -aAuʧ`K@ -[;jCˆ]Cg8 :C;?|f@etUa4BC)wqrγ;HuphrcagYqaI5J_F֭6tՆ.S`o?x9V;?vhNsvb׵OfQCT49ĽsutzE6u6djA/?>Ժ -;LR9sĹ2GVίk~C NF}tHqMmG1NˏH3m8̄9?."{xp?WyF-mePG 5g`޿_>Ylbρjb};qhDNюdCAz8?¿B3k>i:?h=th_4?㞬th~n_9U*L}u">c5w[ރwŏa&|,ȳl裃8ߑޓNܹr;H1:OO˹"9rv6q^r0΢A/O^=Y{pc8ZîEegCQamf"wq#ڴTAt(=`q5S=2R$UdAs+Ũ&C:\gChlukm]SlrA9ؓuc6rkjW+N կr1#Tu :ԔNn,UsgmΓGBfWP#oedu1&yGweGٞ~YWDiƅlvH{}-3|n̯ua=Q;Hp:O1kBO95=.m \jٕu9b}!Fm~ߕ3Kv[w4"Yޓu 7؝~ <Ψz0-qs%7{ג"]sx\ [xFt+:*X%(=Y{`;]Vxl:~3Dl7 -r)İ_a߸\5nɻ \ϻl{dCAΖ{eҽZo+c!7fϹ̩Ml(\ «ڭn7 ՓuQw:v\31jw=Fd)ٖƽ'vX=ϴQZ.xN_+G -idgCe{OzQ[A=ݏVD9jsӗqޛצvc8s.;Yw 1{aRU -߉|#f, $ٸk;6٢;ח96OSS~;dO -ȵewCͽ>ȻۗF>6< s|8>sƥ_aw6ns-׎8Gݞ=w3w{/[D٢қ_]~_ڷ˨soC"ȷ3^Sqυn='5:ꨒ_|SHoRV4{mn}J]5ۯF?<ՙ^ -}8v[}W|%4Lg# 8w/Q8W>5k8tz5s~o< ~0K|y7FEޢT0o6NDE'<ܱ`0GCoي8nO*姇=V" -PIY|{Ic<Ԥ{=N6GkcOǍoGm&v\\ZnGҥ'L*vT43OA*Nlⵓ7!B/ܥChQ 3c+)sT$c- uM)q%jbנw;]Nμfpw.;߸8M.|F8C?NبΘRNoE\gkc8cdҊ{R9D&oɼQ<`^Ǎjla|%˯'Uئ b:0^]ub%ucPݴ\4mgmb d>ul=zryqQ?Ʈ}I&q%Z2"x8dn HIs}P;`aD>]G}MWY9 V!aҼӴG0㾘 FMƥIJ,ЯۚcN֖es϶ OZcIcpSUuhtb6ZuK9(z)K=4':>*~S6[W-9N-MJmߴWv =2U۔|;s! ?%cj[^׬o YjuJ+=a8&V_-E:VKjI>Nsj *o^-WKBU/Z9AiiaϮ'_P -endstream -endobj -710 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 709 0 R -/Resources 4 0 R -/Annots [ 711 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -711 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 101.373057 101.433071 82.623057 ] -/BS << -/W 0 ->> -/Dest (cb151-1) ->> -endobj -712 0 obj -<< -/Filter /FlateDecode -/Length 4651 ->> -stream -x]Y$9~_QHk|/iHaA!k^>3G:#rvVMUF?pVW D;~x[CoJVE$0^hw 䯗?yu"F뻤"#|^ZF0*k:F)ȩ`i0b -fցQa+TE"N3TQ) ;Id4SV84tZ CtIYp(*"` 9-`p:[4Z'2[`tRqhEda -N)aM0I3: [kt8x3ZuF,l-|-;0D%&t0t7 h90RAGFKc` a:b"q\`4lA - lK@ tK2* r.̔0 8.0\@)r\`qb{ XX9.0]Cq\`一 '-0`GaT0x(9. .*Cq"t j)y1h8. 8nj+5դHB,,ӆ&4 ,xWEL̘[ wU@(G3,s De8.]g/0j ,xWԜtX.q  0 %]V!p\`%qfa!y ) @Bw1G xWZc8.p]Ip{Xl1As\: [fLYR)8xW*0J#M O8.^{q:| [ Xl!Oqװhqװ.DT.l|@"`2":chUNtts\= LŊR"`s\]f@a -D9-p9. R [ r\t@$K9g 9\E 0Li)YlMp\IM9KS8.h9.6S9. J'qh:)9.* qe7HěqK lpQXlq NB vtHDR8.x=$R`&Nޅg8.Mx\l/A?!E]1^]2^V]3 #0epU(d $-8a\}j1gN2bXsdf%ٸ>/|{ߗ_ +eOARa#V8}`{ҦJ}F)Ȗt]?foSLz4;l__ƵMFhr[F~/׿pׯ }KM.0}Zxl._R_m:19:S573=0Ĵ@h MVwfyK[OMSCc$$-ڝrcSCel:Dе Fr+ujOzNi^&S9!r3Tf-jeFbDcGY5xve6xbjiЄSD 篫pkL7b:nC({8Y|%Vtag,{k=Moj͘ps&] ;!mb{iaԋ9 ٰpUlfk0odVɜ7hws;g;[(}@fک=G51]G^^+օt;cyN`zO2Y9qBVw)9ttZs?:9:&3Yr~3cdjc}ƿ!9h2 MfWL3Si >Sۚ4y2gY2G7%'7\{lHm_uL3[|c&FBs\顊giVƕO#yN_>Xw(dƳEWgY%TZDtf۾{kp;!ԣ -+7Y}/&ly,ㇾAcGA| Ӗ߯ҿeMyΆ4YӜCꌥ~g5tO:imy,;މWlsj!-yNYO+׸ǃyNծCEv(3pn(0v[X'xun֔V!3M=7eQ-+٦}MtVu y(IwQ˧G{;l(s>ߡmz3t_tL}ݵTQos]=h9[{}},л#nxw!<;D8[kh`\>0>bYWROLO Դӭ +:>iȮf+?}eǔtڃyNfp뉀%;u,Krh&y4=tֿ3SkM[Oy/ ]3&EV;e\Kǻ_s-,U/b!_f1*皷ڏ;?wK0ZaPc;kw;gG jzOxylŻkk6z7F3;>[z +wuQsٮFm~W:%b\y먔_:lUrvɰl"K/$%K'+-z*3d$;P[<*߻"ӆ&\5}z?m7ݓF UkUWu~8r`$7 w^Ûݘ>i8ua֍ -o72t9|Vnl>Exqj?H&oD Dkگ"HC*wV]Wr2XRM;5ʴySڸcƱ98tIO~UM5wv#FL$AqN?e)TNXd7OiX -OIj&9[dNd3Btj)Ng/ig t)e!RX3.5e{Tɦ4bztV; 5rQu,2攥C#]W2M̢oz-*3 -Ct1cD n*͖%UYcnjJ FԧV1C~h.@봙uVb*~XϤ+k)x104,ɑibᇢN=YFj宰q-״Ms) fRA2ԥfҦټDRHBEJˉ%i!<^jC7?,s#ʃP)4c'Zh# 5۔R*E d}Mr gVŧҿ-m^)h^q<oȶpdMY|\H4YuڜUC\Lef)G* +!*m0QFkLNpBiTOY;ZrE$5;#VLx"+^lQt_0KA; fkÂP9)TqTT*=h|2#y -endstream -endobj -713 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 712 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -714 0 obj -<< -/Filter /FlateDecode -/Length 4919 ->> -stream -x][,~_QφI~cb56gaEVJTF^8]"OBʒ*|_rzH)ஷ/?]¿1bTZ8xCI`71\..y 9o?!T*~ p9K*3n0%p$A`uQۥ* T0CgVCD QY#=H:ɢ.Bt!:C'I`JK:[vNI:l.uŤh%]-]-@WuE%]9QS)(?dtZش# -3%(ElVIgaÏOxSFmՒcu/1 E QF@$qqp8LK.I,`R\VBX3Z"`wAbauf'q5 $.g%.`[H\`ANe-q: 3kSpXP.%.\ t1ܣk}0XЮu)H\`i%qZwVQ02W0H\ &%%qk"QA+q[fnH\ƙ q2 wA!^v` V+q -  3wL-d%qo qA+@WA$.]ВD@?T%.]孕 w#`MF5a -c BҁwFK:R1K\4mJ\" L!!$.YAOԅ^₨ ,Q[\tIh`5Fh` \  YpSL6Ъ.!EеK(qAnT%.ZjHr$.i'qA̰CELEC2%-p%. $[ J\L*3( 0Cc-tN:3I\\U+M0- ?`&9X$.Hr3I\l1H\lz3J\l'qAVa 7Y8tJI\uz8 0.i$.Va%0n ތd[<\Q[4ea܂;I[Lvh$.&Va8r,hm@  RY|hdcb嗿÷~o叿R@֯7z5]ߦ0[f h=}j9p .uLZ~g1Yf^ cXySYQä8-rҼME;K_鷗4އ%LLcYރ/Q,m wC-VVwa~ ]ob;A䯶=ס½ZO6t_Oҽܯ%)믢ߦr_X>u2X<{`ɖ 'pGu,%=Ǭpq|f6az\ʌes6DmPLRkfٿ*iPu,Pyy0FκWW);+Wb+.YWt׽1x'.;qgIub -smE=W*h -Z/͐U2qdE!эG"sݓ:D,}V3Y$MFk>/B&R9RN#⌏n%5[AdʬHT8:gm_ewOD9m{WP}=Ͱ][WPz9,;> ݵ(?w8tclgGhN{3~зSfss:>Zr&=)>?/qPgtS/w$/Pv¼ԕK,> -syN_;Vhٞ{~zNsZoSjϮ<[1Ԛ +FeW2b>ֳgB:.⹜cu|_hCWbc4ueȘ~"{00}/W¨;}]/]bŻ,y~&W51hj^S3ߟuvNlWיִ7;] -Voڿs}µXcحc7."`FOq<RP؎ -$;H]QʸO0a0q]p\t& AƯݗn#B̉ -QqPw5H26gJcY籜T*S}5O!xS̞ {XtO0TH6t5"1_ӥذs_Nq$7!rݫAOb:7 v -O -lw*&Kb5qM'զ MXMMY&.7QJ烖JUeԗC\'AtoT)ڡ3v$WN.b4_{*Teͥ) 6ՆdcMHG1l8*1ܘv&~(+/Bʭ^L C*NJyUH9sUBc塲Z@Ҳ1V -LHO[SIY1y<"Jsb>+P#P] -巙PKeA3Znʝo\kk:4[e/8^LO&6v2&l(.-6Ȥve&C^?ˡkyܨrLg2:1= EX huji}ACǍa|ZvՈԕAuromĦBhZoo]+VG}&-7j,W\mJ"qEI۔3,#.xdfL$6=xWX]07.mӹ6l .`yyf`> i*}zc$'KxuαW(P-˲gӆFs-cIS6%RWdJDQ2UdXl -S,'b)/=ڈJXrˌW%[ ݩIJ]KilY]f+ 3U-_|;<]AJU~HNRLNGk5B8:<> -endobj -716 0 obj -<< -/Filter /FlateDecode -/Length 4726 ->> -stream -x]Yȍ~_Fqƀw/`؇.F>ߏ$1%eхJq0dHW4Stt~jEar:?1)$g]r,v/.YW3v׿~b)X ,rn -8/0Ĕ$p mYbPNbA 2& -1,m1L$ N., 6J<xMJd `$xi޻(si"% $,[% JY ^,( JKd'"Kg\VI<'۴"+ -3+DdqVg! G' 1 -j 1DdK` SJ‚#MC`]r%,HV!D'd=A‚D!DyAS-0 &IybIX|3JX0&"zqK rK@&Ed%,MDRn. >3((@o *{ -9i1YF/mh ӸEa>3d² D-b_xG8SV4ߒ.oՔ#d ;  RR˦ W w^ Yf`&"UИ+EYeE۲_Yȃ‡Yw~8~{'pʼnž>\v뗃"yGM~~zÿiH('4__VS\ƯeC7zC/eEEim1|溙D76rE. -'ToRoNi1ZC,+U: ]yMQy+*.Yױ嗕cJ:(^04zjY>+V8t{M\nǬ>n8x8Bc: -XK45 x' gHT6!^gմKm]X$"X?|!b,qjlUbyv4Q%C]uXUy~Ec2D\EzTi9r^稶Sr3ƲcCYG -iJ58 5;|Tѡ6-.MwhMFcݷ&E!BRnz18t ZA!ߔM|ci=K#h&Ƽr|N -5-m .}9հV -*^Uqͮԩa}_ilKg=wtw}gqzwZNzuzbĝh!"?k9p 뛩kM'Qz6|IpHW>2*KNΊ;57 J/EP|N2q(E'X|vI L,Ukt;n0uI$(|T Gh`ARG DzKѫI2 @lM>ԡ{4 dm@t[dCU͇6Nlײ& ӹG]Э]SD*=^5 TjTWK 6Ovߩ4a25>u&jHʥZN .bҚk3Zث.J7um8- kDqIS\8؍oGm%vX\5hv9n/o͟4+gpȓ?hj&G F^*i:$i@Seu͎Q t[馱uP@ cI!aHTUtɮۂtm::z0wd߰m$6#iv[vl&I'ռ]l v -a-jm߱R?E&yOuOlVc2/tm=uF50 [ѓēdrJlf `ue]ǍzuՁ AuDu8M3]CϝK['PIU*\e<]uhW\tp q16ˡ%[9vT8.0/mQwcӕG1AlNjaci! g{6RO|闗|S]]C-;=ۂ4zhAFjJ7vJ:Jk-*/ժZ򈣨bNӨi7JSgorhɶȍT/b(XQ훖}Wo{A]#SիMw{֎xȳT pԤ56C$PFW{%cOUA"CS jICzLVPcjSE::Aoo Jˇr_l 3 A -endstream -endobj -717 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 716 0 R -/Resources 4 0 R -/Annots [ 718 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -718 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 612.273057 101.433071 593.523057 ] -/BS << -/W 0 ->> -/Dest (cb154-1) ->> -endobj -719 0 obj -<< -/Filter /FlateDecode -/Length 4676 ->> -stream -x]ێ}gyH8 LF0`~%"$ggӪ"yxXU^ }pV/NO9o(1;?י1#) -c.ú/NgBRo?GVy!T*.29'%TV0b -f^J3Pyj -0C:)8B%8sRCJ:aE[J'>@tIJN #(]`Z)-&pA l1BkN`VQ: [U面tHN t]ntA1֤.@ǽKtB0l*RNIb %SEҁ'rUѭ)&uO1;KQFDqt 5E+ HvNQ4 aG:)("Pm)&Ph\R[T( [P`Ԋ@  -ty(R\@0S\[MqJUN HQ\XIq*- -hRI` Lqؑ)wh.ʀCKq¤ ޕk 4xW:L1AEqJ[fn4\R\RKKq?CKq{褢'cn +?bLR\`£H]`¡ʼnqVf@qbR.S\gQ%+fjJ2p x~p`ߘ. ).0]В0LB cR\`ˍRX.p{HlQ^R\: [bLYe\)(x 0rM ). ^z͂s8tpHe868e:آ5 *x -JJ -p(.GMp! [)R\&c>hMq3ZYɼ]:p8bAqb)1)..Q\3` -)-p). x [ R\Gi9K)1xmYt).0A $u4Aq'ۆ?6:آ{MOqErIqMGqA[d @qNqA`\xS\GAo: -. --p1nI7N4oz f ބGO|7.ft]x ބgKk3ZcɌ̭dʀ{1[92gA1F"0d*i?0fLM >Z)6~&/9=}1dҏ00 d@wx,:ZA a-u.#hqJE#1凙0*_>`/!4+f[2*NJgpP'+h>|`XKs?~͇FN?scR_cQ.LbT.k>W۩\s kWϛΓykOu׍Ǥ.~V)q;e4H}N05 9Y*`5tJ)ߏ߰lFe - 4$xfCXf05[عOshQnxʞtŎ _UA,5;Kpf1;@Yଳрe i E%/JO^\oǍ6A猒k  -ROI:2ordLg&>^62zuۦA1˼^JH#FN"yfaʳձj>˩NX%#][`jJY[`睍4WX9lhs84n;wỗ@(hk]ڨ|\:[HmG7v{\Z z5z`Qf9!C=*ޓ3LȺT\n~*\oux1:gvY6&nuFsӫOML|(sZ.4GCc{-c]Ac3 -2Wph3_ F2".5uq2XջV[*"Dv9bw|{ckb۷+FŬdB -+R86$DwB׃X/.Mu9Զ1QgRG.1"38(l9׾=b\AiPgáwG~w7A4dwPw=|{?;:s8:n{W ;֟K\ڠ gn>ѹȦ=fhjGs45Oz,!ZO<Ҷ~BF UG=z-#Qse;]We+ to⣵.ذ޾:Cﶏk2Ƕ9Z.gO ػUԼGCf\oz]S=5u<-@һ)VP\;;h[Ξ97ﱌ# -;o#O_QvQγvMwï_ѐi_U]WEІw<6\5ME|]U(vWp53Rm YE_i|:k[|@MQ7)[fɎ񔌺:)JztǪ.kP5bk'[':~C<A⫯%U_]vEhhӋTaO!1+ǭgBƍgVυssE&148KM;_i޷::IbGwtPϧ۪&Z3)#"̲ 8ױЖTc'W&}&MoR 橐/LQӊ8=gbk=SӑͦlPe K]PW+b="pa6n:Qu*+]՝[ U}2өRJe2*dI%sOr"_tjnc' \.rr"Mg3\.KՐZR|nxB6$uq jp>6@k+ȅr2:"~>G6+IЫ:o{^Rq C3^M*LF>![+G"qlfjͬڕUs 2f#ҹfҪ* ɼHROE}00uwO&44S{>|cQ  B\{*;9ehBjVR_ML}Qd"d<]NR wVr٧(_6uF4uEx4eoIepvx)}IOl];Ku)lym=vmmb-)/̢Mw4YT2!—:1QkTo-8DMUj:۹eF$J+;V; EWTzv:Nu @ -E&H154P>t1T4a{|w\]4'S -endstream -endobj -720 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 719 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -721 0 obj -<< -/Filter /FlateDecode -/Length 4972 ->> -stream -x]ێ$q}g ۀ =C0?lKz fdF^w]fݕA&3K+9=cpOoj^_I(?'V.N^'8M ~ :㶪3\N^R gLT fXݪ20Q;I3tQPi;QJ5N)Ӄ3z -),"t:Ig^K<|tk甤-Φ(l*Q[LVEb;Y%t%Q[TPZe;u:bO*IM+00H! -:[Yot8t ocJl54ZybLt`%0$ - $01N.'Ivr%LʓJ4`\Q4tFKD`l.HL`5lq$. l ,֩%.[tpaqm -N kX.{uF ڵ. ,x:$.p]kSXdu8*J\FF ɤ$.p]wM uq8h+#qgQb4x9- X 3V6%xpœ[M: quy=.[Cx.wAIpj$.]m%xW$.] ^a$.tE]TNI- '$.Nd<)ġ.{ wVUa-6 @i+i2` -IU#,J,qA۔ D$q  BrS1H\! QAAY$.@`=ek  "F-.` "lA(qlJ9 XW%]0SkQQW%.ZjJ' -$.i'qA̰SE)DN ҅Nk -%.H&aXK%SL$& -%.4JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@U2P^x((/Me -*Z -xm8a}[Tp)R#3Ct=I6/~o/);eFPR;W&c=o[آL1 )1Us7Km62 ݷVT2 -bpO)a!/m}sS#b|ol+#Vo$7p[rcbzAg?v{&`dث>hF4 MDai\?3Y>`<"€46E}[%ݧtbާo|tnß~ӿ^n'Y58w>]\>r]Ҿ,2<˽]:AL2N$qkک_!kL=}?ϟ++aZo/ќ 75 "s0P-=ڮmYjc([bӍI*+8X伾u:ZiB9'Ô,UafKΝbg*VGHm#v~mmf(tˬ\!+}$'l9ch'Um;EҶ ־8Fʈ޿NRC+i3 izϖ^#Ua1'tsev1Oiҋ_K.m9 wC#;RڳC03 ^P^Q]{vJbc^RvMPouwHq᫷Cj샆lk> ul붍 -ft.q)X%;>޴A~3cRoQ|_pd[pmf)΍1A?[CU&i陯KyuCiycyӀ`7neŅ[Aح0Iez`fR ʦ%'SQ(ѿv<_hYn1fR+s |iYzz r-'KJ-:MK wChM fUrp{Xqc)r~- eApl:=Yғ;$& ?$ydֹ.#SZxgHi-y~V}z!1a?̌6q-lhu{5=&%==WQ&]6Mπy)˓Ҏqy>.Vd#5KHy -aX}zbm~1ϓzcѨ_M:v -\o 4nwqg2T-LC[< >xdc:f΃ԛ6~_;6\L.'ŋOj9޶i7*'P9Prƛy-ӡ3t,M<">xz+qAhx|r@h.~t 3\;(Ի_t;[x_lX8\=ufBթź`{rp''^X@t~s]9 i,w,z׶/2($'7eUX{](pޱ"0rg2/6+/nXeBXMػ[1CNl~?(vR[T)v૕_j1{V)m ϷP-UH6&z2;2)t&]:VwrmZA˝ŞeŒ2?4Ulߺl u b1 ņdfI-U74ކTMd!rSդ1}sAr)t8 {bmPظj7ݶ ]L]״XɚK Q*J}鵨ڻF5eF&5eI=n;Uv̦gFoɵtDn)ͷ-UYsnJMكU,l([?tJ 7f#|ܼk3_o> -} -+вr8.{'L*wv*|5H{wUf;Cc'veݥclԭVReLs5HZꚘ(OJ.TTžAu%v6Uj[]wrql#%V.|>csj%]lTv2&솁kة=d'qފ3:yQ?Khg?nTc Ӹu%枌A&]7Ta6Lh.֩ ͏{MBMі?>^l̷Mw󥭍j.xspv|gE⊒v3,#.xdnL$u=PX]0.m׹fyUVZ 44~q_LuQ{rikIR[.[%{eܳ-Snu1ʤg[x^UQ4LUY+1V’vKiq{)K{QiMZ*z-y[zK&Ax&u=mn]ww =2U=ߤ|gy])U_vBtmv:Zc78їDțlwD^ 19kU Ps+~ߢ-+Ioa+Ӝ/*{eC]FZ*wY -z}OTZ~j_f7e -endstream -endobj -722 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 721 0 R -/Resources 4 0 R -/Annots [ 723 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -723 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 401.373057 101.433071 382.623057 ] -/BS << -/W 0 ->> -/Dest (cb157-1) ->> -endobj -724 0 obj -<< -/Filter /FlateDecode -/Length 4691 ->> -stream -x]ێ}gy)ހ $Aagc# `!CxUj]ffwۭ**J}_ %B嗋JJL6x{U*`x]/l?_:EN+{Ǥ"#|^ZF0*k:F!ȩ`i0b -fցQa+3WE"N3TQ) ;Id4SV8ttZ CtIYp(*"` 9-`p:[4z'2[`tRqhEda -N)aM00H3: [kt8x3[uF,l-|-;0D%&t0t7 h90RAGFKc` a:b"q\`4lA - lK@ tK2* r.̔0 8.0\@)r\`qb{ XX9.0]Cq\`一Ơ&-0`GaT0x(9. .*Cq"t j4xW[Jqw5iq"?ˇq=tp\ƄFXqiP!: ,xW By83oB99.]8*q>x9.]e9xW(9.] A( %]V!p\`%qL c!r\pޕ xWV[L ӖV` -Nޕ -#Rq&qI0P -@"z8.pQB9mqXP-"8.9. d -7 RL&B$[| Y]Ny 'W8.@.%&= x% `t8.`p\W$FdlAq"] h؂h゠L'9.F.t$S8.D -9.4A du4q'%ۖ$?H6:b,q\Nf آL J؂(Ha2q |S) D#o"cm4.回H"DauASd-8 &؉9آ#q\KfaMD@Hg 68x7rZWqv@z-|+d V]3 ߔ#0ep*Jxfp[}j3O1-}9j1P>O^a,)CiB|i#"V8|0J B,G$#|F*薌KaM}iamxgW48֡: RҤ.hm l6_"&m>^o|ѻ? T߾-hێߣm7n DSYPӴ=仒ʷS r4n8}lKhWPlMRG5(T\w|ajK}?ﾻCTz O -fUy fHq@u}wg0d{߾'CJ"TvN?ǴJ?FLa ȔѧA=Zd|NPQ!oB񆆽i۷r>?f*S<0έyuN4}i^lavߙt(^tWw}5_5Dns:D; qf6t2 QXXt3<]^7Qm! Lm1vkzо\q>ڷy_rkxoXl5+1hrCJBso R9:CXswcIJѯx?qY07nq5_g5oK4?^hSЊ¶9VҞu7]uY=Hֻ!\jʆh6M^nȆԬ !9dž0{rSLqҹނ<1w^G^sv%}iλ'C[m;>.k'~Ҿ3acf QǤC JD>^n40cuZ_JM2-fc,0/*HVF9U|Io$FL$Fq?eiT.XdW/b_X!ǟ4nlm>Tjm)$s!3/cFNP843nbufkԖ ֊bed#slvWŚ=* tbzu\Vf8 /حϬ4O17{W"3QHm.Y81 #R YͨR݄!J1 [nl͖TUcjJ GԧW57sDs*viXFτKe&Vz\!m^+4MEdKd S3;}7Eg@*n՝YNj宰q=ײMw) fBĔO[JH.k>fIUA]' -SlvWŶ@y"v2U3nϭؗW%kn,|wRZoWwa *4vXMuطM1f*lPuk$Rҡ%TF(6jv'Ij60"mfۦl8B`n jw'0F^/dg@j/VZ,I R3lf96=T23%ȩS4h1HC6N)&;͎d2J>j[#l/STmOvTJ'vTܬlj7{-ξ%K,kk)Ւ&龳6AW#SYYCwdt\7P_GMm1;9p-{ -:J+"yC1+mg(⺢iy|#&_-JuTiNV0 T6}Jm^,CHRKC:nd ;\ -endstream -endobj -725 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 724 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -726 0 obj -<< -/Filter /FlateDecode -/Length 4926 ->> -stream -x]],}_QφI1xp}]3mO(SR22nߙ[ "U)~tQS -JEQ _rq:?)fob]pɋ]uL9?)T*~ p9K*3n0%p$A`uQۭ* T0CgVCD QY#负$SHdQH:kZ)sg%-^;$lq6EI` V:bR.dA` ЕDlQAiIsrNeTi3O>Y$֓6Ì ( l gQ[UFY#Ɣjhv[eŘDlK `lQ1H4/I`b\6N"K 'hd?Vi茖*]j0sElI\` lA -Y ,-XЭSYK\`N qL%q (e ,8ׂ;%. ]L(qZk] -XuZI\֢-`d%.p]Uw1 8 +III\&)'q%@ sJ\k28q&H\L%F]P=tJ\&D˟0VN9H\:aD]tDžy /O:,qbx.3I\ m6eʦ0S4A;U>`1B26Z7T(*ObŜo|KO?^~?ݧ`~z_r?|ƫOk~]_82 CPVzn}ㆲKR*y+{lvhzګpg~ +ێyR&!Z\/׀cwXٮ!26^ͯآ8HayKm*iP=YWGZރZcחBpsfs!|Q){ö<\CϿ!==! =?<Y5ɣD\SߏHFWp٭'ٯcwBR읳Jr6{!~e1/и.A~x{\/Za}ٔ9\cQBhuγ!ל_+4UFAnc$ifDX#׭אNX CMwNy:Īرz2N|9J\-v9a׊5bp`+ׅ{{;>Ϟt=g}y$èeĸ'<Ǹ_*QMGۈ]·q0 k*kyuŏq&|,>g=YgF{O:7;sA= Ǥ'w\'<,DG -5@l賗͆qzY|zy:O1f]KC_N}6Tyfamf"v= 8k|dC -W33\c p(͸JAf2pe~m<Ο zArzy:$ߏq<zʑqamkR˞n9ևbTцfcn뮘FĴ {γadyȰʨc?I.1q{;-] [xFt+:*X%(>e>=Y{,vmt;Xg1'b2Mj7v+K;%z'ykwmywz:Oʃ-ej\^QNs{*s*:f4[_45J6†j6ƾvknfȯt:yͮcsw5F_.<ֈ,%Ҹ!Fr^dŻTgYi_ %&}w\۱y`xAI:S5Ie_ݿ;j,njsog+;hwRycȇYFw>L!r -{;m];fs(8KPCgv۫+6@1?y]8yŇGm'X:ܶSP}ّҞ I?3`@I! mxm}]ԅŗ=Q:0lƼv-ʰn}Dqu}Cd&5aE3zRf]W`6:?߫]Cnpgl_wd6~:Fpk ÎQ=j}_ 2K|n9$)rHj6^ -rC|` y tJr?&8X΃ata;Wohl|EZG]*GΆ sTۇ){TLzҁÞ)wdS,-ѡ7-+=M*&cM fUrXz藰~c*rPvh1XmLUdmPArg:vxrrԍr<8YI6뒿u3_c.~z0DՐs]By 9mKV,IZ!A%<{A"hdAL-OUyd} {;=ږ}jS'8*\3# 0*ґ"/kkm+/e‚y?oN*eS$L2 , =-Z|Cگ4gLOoaQB"'1_᤬utq,߲S+EC,~: #XTNjD;I*b,~]KR v$\ު֖-CQe7@X\=A z7TjtxS-Ƿ B z+W^E3iUhP؄A{C VXw]l\Gu u -k"{Q&J-jSջF5eF&dI.Uv̦gFTZ\ E,HV*zҡnSs T_obsDv-LUknFxxfb]|JWqe6qR/]SufLIy~;k'qyh$h{Y.c,NJ(OJ7eLs5HZꚘ(q%jbߠw;}^΂fp.;߸8t}0_QLO.6v3&솁[ةaLZqo]2MP…GY(]X q[ƭ+1_ I1}XiÄ1bzY_qc_^]ub%ucPݴ\4mgmb dtl=_zsUසu/W$h_ҡuUo-[I4ד #v,o]"- ;;+{^_<ɡ6jo7.m7FFxԖ˰lk- :yZ[=ۂ>5zhVLz睺*[uZF*k-jSXU;Nb)oӞJs6eݺhɶs8~wlddnRK*}nuCBLU7%G\g:HOɄԿe [8U!*R#s?W͈\ 19kU oPck~=\-+!iNm2A;K$e"}婥77EwЧ?'C-d -endstream -endobj -727 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 726 0 R -/Resources 4 0 R -/Annots [ 728 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -728 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 176.373057 101.433071 157.623057 ] -/BS << -/W 0 ->> -/Dest (cb160-1) ->> -endobj -729 0 obj -<< -/Filter /FlateDecode -/Length 4690 ->> -stream -x]ێ丑}ϯgC16腱0PU=ecQxP/Bz]N)yxAIIuN@JOoRx+oH1;?]Iª肽 vi_{Gݵie1QE2ZὶQ9%p1r*a=iZ<̠,u`Tf,UfhS gTJdu0D8V…#)91yRVq(s6p:-6J,lHr:B&xN`qF:آ7։.+:"T.ac bu:|X괴c$SJX`Ӱ:(tN'mdu9-?NƇVFFq: [` :c` x#@c G:ZA.zTiŒ(BH [c`&qqݒ% 3%k# (Ppwr\`@5i hPp!%9. 1` qQ 5Jz a9.@ -q\一:H⸀c -`u^`  -.Jqw5iq"?˻q{  U3VB8.]}. -̸E+ \w1Q ,x8. ̨ U35*% r\8oBI@E!cX.hIs\YX&au^HC9.p]Lޕ xWV[LÖpV` -Nޕ -=Rqi@ `9.pDq\ࢄ.s/!,V[pE41p\5l1Zs\5lq<o6<- lqLHqZ9-]xOSEr8.)G؂q"4V_qHUa6hdԼ>:q)`I6\TN؝OOQM=.''~eEF}|'֓>>O4SSN?:ht:tw4}6i|2QH[1:#Ĥ^@u0EPUm*`EN rO D[7~Q:;SNgD7еS{jc:e&oo?^+qӇwn\!^$vxk@hO~fy ZDsS&+3=sƏ]KW$FM_`ˡiWL3Si >Sۚ4y2gY2G7%'7\Z^D=ts9twDG1Vp6=td`ˡq.yBp塚|A6V`mms5Ԛ55Ԯ!KܖVrnc1uy #Fӕ|A3+JVGtt0зҼՇ_˥ջ18d%6vWJdbAh=rhU-\_f'+?ggK.@d)09cyHC?_` Cތ㈆Y$}>N?rHiҡxuRG͚dz\Ѵ{7r>W; -79{9g [ͶF˼}" rM)i;q7GA\;J݌csѿwGY;6]E:r(<>#: >G;r(Y|؝fd7{\ z\k;y~r^6`!W'5$pQ3=Vk7/lo]ɷwTђQiKy-%xRZaڎ[UfFfw$;]0՞pP{ -ȴ w $Fozߠ T=ǩca 7O[$HrҺ35LS}Orܺ ~ʷSݍ=4mPkXt77l9mǤCӾwG"=ms!I +9\. ^e-3tc{2yn*Hb܌Q'p;-mIH$e)TNXd/Oia,-Cmդ6gK̰̉MX1#DNtRI64 Lgb]Z ik5XR(XSG Jӹ*,MiosKrCҴb.*Efbڜt~bD/7FE:^KQD%]ˍM7fKO*Ԭ1|5B݄lhI&.@kf*~YϤ+k)xҴ2ahfY'?R-<ÁW=YFj宰q-6VP )`m/$>nI]Zl&mK$Uc.VuE(,OV(mL\e2RnoؗWiobo)| +b-lW+k0BW}yvJE:ȸ0icuā3*mzYHG|F?彩y\pLdicpP62lXf4y<>d)ĞS h[m؈uVi!|Z82:a&_1iWlNi:S{S$R:CKɈP6jȶ~j¤ƍHNmY6\E.iOڂIƙ=wd# I [+-xN9fA> -endobj -731 0 obj -<< -/Filter /FlateDecode -/Length 4759 ->> -stream -x]]q}_VG  $?,p#0pwF0`J"YJ-uZ7̝V?JaHU;"!<]o?_~!8cŨ]08|tן!$g]_wɓ].RF~*C!('TJ[Aq^Py=ST02VA):I3Ș("̰]0A: (%`"Fi7x4tF>&D]N#| KEIG%%-N)I[ 'R3R[6_w]XXY|@pɃ"f@Gm=d2;r+-@ba2oї˟_}q61,3sܩ>44mrŴ\9O͎RwKOe2tL|=׽/Wlw~?~Yd'XgG -U总:= 8azN7]i0v[hp+ˮMCl;~ꆈɱ{)׬ -?H]i=] }/ck4E s6ctK$jƵŽ8ַDdt-rS|Yok~}auig,TG^-rlKᄜ'NR~}29yΆ/%=Ǭc?"s|f6cz\ʌeu0u߻ɨxg}oBPu,Pu{ýa|3u9RvW,i+.YWt׽1x'(q9'vίM&v ({wލh̗fH*5t (g? }ueG6B qykBV龲tkm>93(G>>R9RwVgQ8^lͿs<\ 7s:D#QG␿ھɸs: <aش3l>|Ƴ \F/5?4-'RmoM~0K;}BwK-J6:ݓh;s:4t4 b;$zW:sYwX cI>_oߍԧ'bI -r_&=st#P1)^ޑ#I,oxIsH$K]ĪpOss6_;Vhř)'9ַ:)7]ٵn܋ִ|^ظ|OB@;=}dv1 SGZENg?9i#y}OY9vknkLUe_=E $YK;VѢ;K~O;3֊o߀b -$;H]w2kg +̯г -Q -[3퟾?K4i6K*DqYXȪU&$ibsN߱XN,K ?ä_溙=c݃+_.~|[ߘ|ɯԻzr k~CCTt&=6n_DKM5PWUL/.ds_ 3iLS8ro9ĄAqU-tIXe7poRҺ=:­++w-?Ȏp?U,8߽,⋃|5b3@i[-X[ńn-T&6T-|Vyi% ; oTk{(o+E5,3*U+)kP'AtT)ЙUz-Ge$RI'n1\=jز͔uk fi/ecDq)J_pcVQMvqAHW(WDž[Q54i2fP'pUgB*I]Jجe#qCR h ---k.B,o/tkb )k2&IR+8SXiʕ\]Btu2]-}7.u~-P0_qb^K%MlTZeL )4qѷQ\FkeumI38Lou~ ]X^2FU0[b>wƃ"Æ 1ob[ZWPqc_Sˮ2Z.t TmY˸;[׊Ցyoߴ {P/)V.c6%_YI۔-P\ -Slaf$6}xW\`nDMGmEx, \`/xyia`>JUƥƲ,_^9^EjY=[64kA Q&-ۜJdjlY;b+S4_yK;+J-3^lushwZKFAy*ٺnZ]f+ j晪ͭR>ό)OuR1c{&j;[^E!_(yJ+5;V mEWwْoBA*4&z mzR1f7иKz[OƟv"O -endstream -endobj -732 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 731 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -733 0 obj -<< -/Filter /FlateDecode -/Length 4737 ->> -stream -x]ێ$q}gK+6 C ݵ^+?}dfTfV̪$y=]Kd0U2W KdTJ9~|*z⢨FST'b6.?:jUgVS1ŨPi*F냠 -FsT0GUEA9yI3$p۪2̰ѐ&(j-`&rV$5*lЙh%s*D2HB>I:->k#:❶OxSf3k#:؂آc(3H1/I`cT-I$`S(I,`SVhf((:k$"px -8[3WIga -H\l$.p`[Z$.p[H\Mpaq] -$qJYuN H=J\+q:JAudu5El%.;*g(qw1U eSx&MxF,.*A'qw-H+7xzm%. %$.PGxp`%.zu1eH\&c4JkOee"<.[xYI\$q8^aExqX%xج%.] ^A`}SF.+SwAKVJ'0 -@2F*qAbyI\:⒕q tœFSH:6aI:f xM BdM@(J\c d B>QQCAYP$ Xr Z⬕ Z؂AD*Dbz[1? ؂HQ0JH1xUR]H -KJK I\3lTKJ3At3Fda A M2+4rIZґ<3I\((%.4A u4!qƇm/q$HsDlq$.Hr$.H Xm%.69ߌd [I\uP&K\Nk I7-I\yf ;|)0o oF 2EMY$`'I`$qA$q 䛈-f >$xi7JLV&8cAkeXgA#0e -U( 4m8a}f71-}9z1wش??]~; -Xs.o*2Lۖ ~s7ҀM76K1|m/dX63h/RrA:_VqޖF>Ł`8_xƞ7.nHf~?a>]O~wbDA8iy3 *ZS^'9|SYί~𚺼c.momC 6&6,l 籭鷧Goqnzu{3R6%)7o}yPoS{m;qS6'̓Y -vx (A!A8Jhms'w|4og3x/+a^F@wIGq?_!W'n>8P'ŕWfVSKarn˻q"Mu׏6|k_c?kaǟk,2o?~?i\q܌o.뇹_˭}6vf7~kfSX0ݗ sdĕ:JK*Ggy?w}]cs?*P ޫFn=Vch}sD,~˖O:'M0jkڥq!gS~~C051 {7 μ.)ehklY~edYB6R[޶A稶*{T{cR9u{7őF{kmŹYuܑGxtlL|IE7 BǢϳgwaAx; <L2.u ª;$ 9 u$ &\h˸$dLK˙6-W5/d~yҲi9]Aܩωby\{l5\fmm}f&_Fb@pċO*yiRf`WNh̓|${h嚽wiY鐼5^'wbl]~,uN=de& 91;=QҐ* θ+db26gJ'<A,JKѿ3w*YZn:)z]8ĝƪGzӡu?VxpsC|X_Jt|Y0 wcJ"?9y! W;W[xh?c]/ӌx!sp{@ }+9}-vlC-:) -\۷>t(ۏN0Jn]R3OtT?vWOʨ;YP6rn9j -쨝SY2նÙ'>n[k:+;|L8/`dCX ?c}gϴ\Oy:Ĉ;C"=+d8{{ Z9:OփOlwx$'jYLE,(w;?l۲_`5rӤDt cFk - - -(8'vM{Ҳ݇"t-ļ QȢqI~n@tX29XW:kn"pl>0gavs`o<ĤC:>/6$/f_)\i׃A{M/9iʱ:$e,/5M|eҎL&SkwjosA|gb.s.&ba캈%+'ALO:p~[[d!YUv F%Wz~O׻VC`zŘ:VwI*4Sp& X7+Ӄoz讋-U{ \> _8 vAn-}|zmz&sQI}-8 E~kӄla0I*˵ ]rskTlR).5 p\ohvR'ioOm&vG\}(tCMtKӕ+L*<*|28~;K'X$.c/PIn[H yLR5zhA4js?vJU.. UZզ0Wn)wD/StGOqT8*aSۭ+^\ N-L,zIWe۾iw]mmP7$Tj~SC#X-?e'Ĥ~;j2YWO!߱) [#+Խ' "t4U PcTFZ-=a+x][elȩ"77EmƩտB)?O4 -endstream -endobj -734 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 733 0 R -/Resources 4 0 R -/Annots [ 735 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -735 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 627.273057 101.433071 608.523057 ] -/BS << -/W 0 ->> -/Dest (cb163-1) ->> -endobj -736 0 obj -<< -/Filter /FlateDecode -/Length 4668 ->> -stream -x]ێ}gyH8 lF0C~?j,QKwώfUE%DYKU"=_>~9IĿ`PJ J>,0Ati߾8{ZGHkοUֈCQ%29vQy%p)q*v -0æ8̰ZGFaA* T0C%Ci)Y 9VǤ Щ91tIx]t$s)k%-4oH4<&cD:7VyE%#eLҙ9N -V\s7 -{>03~Sv?~BY@:12iY7ui.msMW yiyUx\S١s۶Ğ8m]J~N|7Q^ -mm_G)`tfB/0! ^A -5Ŝ"\Rݴ):9S2.˜iAr=YhDn]btQ*(Ē8tKc}c@J]GEťzԭ`jYk2hhWphjP-4s84n?gu7:#jVnį4!6-_tg!v}4%} aVL[";L|KĐ?[Wp^Gg% Zo}{=U>˷pKtqq>g:WĬ\:G̛g6;@γ }۾?bkv9zͺƱ%xrvӥ?rL#ڦH;~k7|Y@iwGG;䑙+sK;,֝~l>3րs8nz7q/e -#}dtС߲1cDoEcuimHFWU߱]7vXɧ s4uSo߳8KXF^uw?uΆ͌K+5:CԆ^~ki<-]AgS>5-Ҋ!ڊv97%o9Gsa:b(~{Z7f<}fYFm-#s8d?F|/:GЇ6\5]U~Pѐ)6hez_lg/:|M16)VκcNM/yߓzէm qr^h٧k9`-rxC<fk_kKwX4̹6{?ǐѣmCĻXwdv9ֽ{F6g>gy~U;; U~co;786~.u+~aaz/jO^{轤qBٓԂm;7W*lZw9ZR}!ֽ{2s7}}'93dJqZHg}zzdg!uoMy/k#2:GCdx'Hn3y6w;{;v=oRxgm3 %O1Gs8no[!xGqgáq?] ={5QCroj;G2u>]";Yhȍ~߳vq^_W}?e\:CmOF . H3g'9}gnOw$RO#. ;;^$Vأwص\V_g-z˷kbgw9b7ٍ=F^ tМvW.ѭUx(=w[WF:~ܳ#ݑgYp{{>K%SoX}*$:Cc9ɯ+ >֌ @}61dz:C~gU *zB(sފ-oq4TyU0"8 SfxE68Fy9P#<_`kM!%C?|U6C~dp=#9+Tuy[м JCppX†ycT'wcĞ\+0_N~xWW'}Jڞy?jH~(UeбPsx /f`__u}m092 ǓJVϤp}Q&~9巸ZFl;Y8~\VUv 9~Lƕڕ]߮ce)d\f\^ -5p0㑯8_lҲ턭XIn.&ֶأj&ӮSdKYp /'4kz +,*ebTRWJuYd[̮XdkT1ˉ-7Ց -TlUSfJG4W{9"M8<ee$3lMrr)WHWGlxiXfw@T43A -vsD徲z@ʒR!TRQ23ҵ&ReDR1/T%XUUq?+P#\ -嗉TKc^z&;_8W|z^" 4Zծ5F0B7}eVv}&^N?eN>x;fE=_^jv]ǵl+Nt%o$; EX jKhUle]AC]ǵ&|m[uوTAURk}HĺBW+Czƭ/]/VGѱi ДC3&Xz98Mgڒ|&Q.ږth&q@OC`jM̀Ԯ[:&EMٶSp\`C艭=wO}4ٗګJei%<^jC?=k92y[s2LurhPil6jlhY(*]@&1XtpőP}&R;Qeūޒpd+Y}<]4E6oN.\mVJ̝k.*?C&DP,V9ew'zFzd)CXcdPۂ /Pm9UZ%L*ќe0crHÐCEWiTlj]NR( -endstream -endobj -737 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 736 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -738 0 obj -<< -/Filter /FlateDecode -/Length 3543 ->> -stream -x͜ߋ$篘geIU`Cpa &[8!~-{3]RS%MϺϗev&"/ON֤`o)X?7Lp%p(J&S!dIc> `w=bf.t DcAw]AS4he\.QcAw]b\ˆ+l\EcAwHcAwϬ7^cAw!Rk:pb5pyCXw0 7,\WcK  ,yfD%Gr ccj,.{X]4Dp2U[({kòU4Uc=H]0Úܵ6ܕ &d^cAlJJQcA,:|.\B,U[8$֦P -Ƃa RLqȾl-5d&f)D0.zp2t.i,H BXX x#c,E&{d$ BƂa Ag2X$Zӱ}fX9I5`` R:Lh,f;h,MlsTl r r-zMo&d| Fd8tj,(.cYc֥7ƂBMlu[(~3i,( [RU[4e݂IoN._XcAQYc 7ѫGYI=.wC44j,lxCB~+8zb`ހتX*g=zh3Q=5@XYi"$曇qO?Z~KW~`k?}8n2y{;V,fkK۵^-QLmoeޡ߸! >L]6b}n6>}9zN~;ߒ·;}U~n 7\i\}ߖk2jmIKilcOڷY0Η~uWx}@&羚Y9+L73<0\;~b -K7Ͻ u&ؼ`kZYŗ8ն؜,myxŃ_ys̷y;+̡qO#?qU~N:ª« J}mVƵqOO`}uޜ'NpiEL͙8;famkb)POCnJPU铎uw}:ys>};e\cQ\|$m -5RߚC3J5ʼCNF>Uc+?wpgv~ngNI-|eM'' /em ̇+[; -jW?Ōa;t/8MՒ)xz ÝuޜWyw#j^yQ̒k{{p y%mnB8tԵ~+G:oΣn>vnLٙcށ##.7ښ=4ޱYC<1Uہgs3 `:o+?e,?Se;dKP۵C_JykEފ̷xHc<ȴޗC죺MO.M*}wq8-~OD:tn^Io -hyB'yS3׏n3b|0Ѥ|Ń2;%Sz7od[/mKe[XaUA%uu(SNȽ~i'׭֟ԗ#w퇭0CpO<':my9TQĮN[֝\(ھ;cqZyjbpLǓ+ldsvg_/$s`Eq)ֶՂMv{)sI -noKkB}Cj5ym-DkNJ5;qX+ mWb e{bGvujg .lCe}rB4KT<^m`TiPK 6OrR_4c2~5yoHʕZN]Njf*RW-u))Wdm$_~ֈv/2umSR:tVP]ongKSCYe"4gy㸹<دz'6x?H<66S/; K8^؁)ttAJ5O uM,X9 -m5uqhw;C[pYtnΧQڌ;yl| -/K`Y,k']mvA ci|fLӯ%y -M$',w/|}}o6Z֝xd|XWm B^6TohqܫZ5 uad eŖ޹{zsj.e:!<4+)C:쇊a;iC/8$} C!ut-w1A -L0ӲG1wfr+@ M4JۍOr-Y.#ڢaQKr.FW -S]5P4\@fMqVe㬎Rj9E:tg bg%J5lZFwNl/rɬXI*;k=ݐ3S۫CW5kg3:hrrP]"O>9F0kp4:J'"d a&'B7 bh Z-l~ਐkr .l$YlS#.Pf 8 -endstream -endobj -739 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 738 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -740 0 obj -<< -/Filter /FlateDecode -/Length 3198 ->> -stream -x[Mda䒪Cp"0`Bbܞ ,sT|y?)5ԞS- Wz/)oU$j#QdGs5J bj*IEjHoA I95XjGQFDP#\Q$+"$ɑ -^|jƇjù; Z*Mt zuT]8,{Ón/|+|FY͈!|/||n}^L@KSwOlTзU4ϯN_O?0|">#>= >/9oy~3[pdޛ|py7*bX^"Hmf|>m߾zWv<ct(6}򽞶ά:OwcK[Yzu\֖{k{l,kdhˮIU(L}KPKğ)GzⱝZovݲ?WNͺFnzͦҝGȎMƻGC|e^۸[oQen|K3Ǽz̨)Rͳomry~)ATo?ӎd#fl1s:)岨q>#Iu2lvg99VO?ʇ&C#K,Wf~Ѥ^o$D_[ttxL]7D1eZ4+ootf6MmI*ˍ{ Cل}*ô?]_{Pi!&z.g}؈%ia'kgf-e}zvk -{?a%Poh[_Oz RXd- ܿlK\v9El&@׵hq_SxLNj(:v@7k^?梁U vޠh c#W9/4GӷQ¹=r}>f9MeIOin zzniK4S9?f=:65o{pGkek'Jg%Z*gj6j|_>2@dcx\.[7ʬ)-ef%x9ۈEƟ`036z@B${L/bl2.#wi&k~V9N!soi)s߰b60Dڽy^5RL46EE/A)pfܦ:6M=U{JƎT:t -rg;;afEv:y' $qQnd{w9ʍ61<ba |S,9o7Z~S<--H]}}=S^ֲó'OW<ߥA>ϣo>kޯ)xY$P66]zaH 2dNiU i$De5ݎ+ZT={m{# Hdr -#;ܧ>}?-<,4/XyZ*m*;u9؆1{8=qzMߓܘI_>ԥ}#kUF b9 (kfp;(+TlbEʔr?uUZS%LFPVz+{0$uZPT3gκdVieŦ3u6];~G<TˇBtY Zs.,w-z-Be; -2gDO/ⷙ ]\ZcɟDf|CsyqCZmY{(Vq@n7y] (l93(p#f< -xLYOݺ #u}"=s:r(4g&qq_۶xRX ?;;wC.{2[zgW#o)H#[~ޏ,ET/ v16CR={W|W^~-hz|9l}j<&k\SZ䙙ܖ%n-vjS}ڏcm+e<k:[ UW]*hށ6ojztք; K(i\)QUf;Rv~D/J*E:^Ga,@.tvMS-k*-LiP6 u[~EZ#ʖs1hRZ7f%]UOl:k\\^/]UUK Yd6?RRfCSߎZ%UMGm.|]? &WfFڽɾxK+WK/'JxC??cm-T˲4hzvزM \_)٬2PTLY-14K>(R1EoiJmD_rˈW%[ 9S-e% }*ٺn]Fkw -2U-[|w&T/^t7=8%g]4ϳV6&t@֪]Dz /PcEWTy-)ka)j?P_vP= > -endobj -744 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 593.554475 101.433071 574.804475 ] -/BS << -/W 0 ->> -/Dest (cb166-1) ->> -endobj -745 0 obj -<< -/Filter /FlateDecode -/Length 4458 ->> -stream -x][+9~ϯ36_$"B0=Bs<ݶIOe+&Lʗr粻g7SJ9w|8}<)zbuQY+'sH6N1{_%Oz/NZg3'SL1*/2TJ[AAP=9K*3n0%p$A`uQۭ* T0CgVCD QY#负$SHdQH:kZ)sg%-^;$lq6EI` V:bR.dA` ЕDlQAiIsrNeTi3O>Y$֓6ÈB'( l gQ[UFYt ocJh54ZybLt%0$ -$01N.'Ivr%LʓJ4`\Q4tFKD`l.HL`5lq$. l ,֩%.[tpaqm -N kX.{uF ڵ. ,x:$.p]kSXdu8*J\FF ɤ$.p]wM 1h%.p]ik (Gxp`%.| ,wu'iդSxN>Q'qa˓!K\ L'̨F3jK\8L&]Q'SwAKF“J`Q'IK\2P x{ wVUa-6 @a+i2` -IU=,J,qAҴ)qA$0I8! -6c dB>Q&\{ DlqI\z6' - -$.@D0e[\E\8؂HQ0ٔsDW%]0SkQQ݄XK\Ԕ0%.O.I\3Nₘa dK: [dK\H:%.H  UfP`ZtN:3I\\(T+M0- ?`&9X$.Hr3I\l1H\lz3J\lA'qAVa0Y8tJI\uz8 0.i$.Va%0n ތd[.=^=KּՆijdS{X|2ѶkRvfOfQG؛U2]G<VwҺfVsZ2P΀RޗB[joȝ6;qLH҅u}o5B Ncy׃[h?GSE#G[D6#"kGEd<ݢF(n<"oĄ;8^[Y.;Qo}~_~>6y F9 {m[Lbπc1 |=[avkE~0áFzs>5e\k>i0Iww=ph{+b$xe?-\5H䦷pȽ~Z# 4mP?~J}u`Ә;Zy4ckIGGPt=iw#P FDّ=ڗyD f#bIbyێ4p¼4"G?o"=ӣ<;V/ZƉo:G}}Z}C9kʼn1湶yamԦ/BA<=Nj>=yͨewĸ<Ǹw:G:rv5 >1;W9ݳ=+~k4Hˏd}}փy }Fs乷T]AftauKr{;H1<OsI"s0Nosxg3qzY|z<5Z'QƕNl9?9V߲O܈6-#F*C}y -y8x`quz!dKTZ ¯SsYd4`n=o,ϣ!_k`'`5[Gb{̽{Mn;hc`Cص%g5Zpg WO u#T㺗u :Ԕߝ:TFc#k'g{ܓבnR`Hx^jTv|QAf\leBګk3pe~m< zAry8$_qzȞqa-kRn9VbTц]+iyWL#b:ܱ{0ϣa:{~ׯaQouG\&1Ĕcy^wVR4ǙQhg$L4?㡂_)=& ?<{~W~K -MomF^cmc`_a߸w, v tz_Ȏ1&o)nڽ1.ZOX:Os.KK2m9a3tᶜ⹧6qcGJ{vKOWtϛy -A9PvAg}^WsVw(y̜wDjw{ae/F uI(myeqTvֶ$qqI쟫[]%ϒWw>~9%z4k[N -ҦśInۣ̂Y'gz\=cm:#,s9IB.sxP\-p=?JQ [DU#SKXQ:tsTު]bexGQ-L֕dt}:(s﫰 &4~6{MB}ĦAh</[ }'ơK,VpuOgV$(iҡue/-[I4דw #v,/J+X_=wOPGI7+,2/ۜctQoP+˲g[ӇF-cIS϶$RWeJD2UeXm -K$z)K=y4'z+aʭ3^l $N- -endstream -endobj -746 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 745 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -747 0 obj -<< -/Filter /FlateDecode -/Length 4211 ->> -stream -x\Y~_1L(^a`@yƒ`@C~b7YIj*:*r۝-~>u3Ԝ|y{zw&G?梱ogg)j* !\p?K'o7&̢`rFU.(M>&kX#ftdeAD1 -]8*ّƂƬ[ % -^h4w&5^&erijRJh<,Z"djgCՓCTC9 |RN`!K!Ap*JY@ aAEÂ%[xK% bZ 7D@.\jXةaA"ܳbn4,@jX@SA8@G\ p785, .kXaҰb|)VbIA  #enஏkX@]O>iXG1V]@Hհ<4,`ƣ,Ѱ w]ESbhe\IÂuSyո +q -Rհ w , 2װ w]@x]հ wQ7D ơа8 UyZ X [$*/8Ӱ`l,P pjX6aAZB٣ K(^5!lFjRh#wș%"+‚Pݏ=l4[~K$9A -}ߞlQ&A~2ݑ`=Z4$ؖ{Ö`it1Z&A~8al;DN\ɃEϩv4^NSAzm΁.l\zvnkk-M$ (+.eCYd>t n|h>$騚ŇCEPA=9vL'҇C:={y_%rT?e7kx M9|O -,V,{{bAJ@>s)%'6&Posyq5mHRlI}W>}nDlGAߗL;ͼak}HOe-51̫ -XGMaW/NPN -W2D}ķhd>>x{ ϭuZG 6zFk5~£/y~91'O:, ~yux(Ƽ{;oVQ2@qSاRt)b}S9Ϻ;=.s&嫅ޥ>׶>c~iyb_qǮK[mkknmRM^Ӽ>3j?5ۮ6$ /UCgc_$'diVWui]bڬ Oaȴ/[sIO{vȐ}#zYir%Bn9-™!]n!uTqn[f}_m:Vmno4tJsX]է6qM{o4c:˜ù ۹'Nt]柎/qD. -[ygq^ y?v]#d8?O!rW rA9|ha9w;ˢmhjF h\Xgeͮ#oQ}d<$y#8ǘ)G9/DZ{8ĥAm=зX8-qJba>-ֹ{0r|Seǐ8V̵;d/+84C#7vi -B?"KM]Ϙl(9Qg76^KtӋvI'^ߺ7RيaX+NGF -5c&T]Zm-jƥ q[r&w_~oLM;w_b[t5[tiGFmSΑsO%E*߮{B^ b"Gpo{gH!/ur>!΄e^!z皯;tw[Q{2;~pzKʮG\>PQn$^oxUj~.f1"}[BH^8 S~ܵeI[RT[DwTq;|?GP]QW7ۭ^_l? t̂_ـL~vGH sz|Cwz}}~#^6&wpT=1ž+mooΛMh“?Ogn$ʑ<]؟ć7>5"wYi3ОBMV<5&xQ~k0$(OEFZmC?\wB_=gg=tO,ޟzv‘t y6'=bz(1uǀ$gG.XAGM.$ѥ0oE0mST*յ!T[аBJOm`VgbD]夶[GRy*k횟LWe(^]w>_&bĆqKm~)҈In7[lj6vד bLj.]UN'*2KjN±9[%IzCV<|Vg6T2Aϵ 5cKv!g`$.8\aCrюɒǸv>Hrwj!W|'^Zb=]I&ۑd8(LчF:Љ_7? 2㩥9烬iHVY_:~ǽhn2{ʝd~O]'DO'ٕ6voy{4 콥Wԡ xxiq2j>~)B -r9,fJ>!qMgJ 9(.ńuJRN2T4Eą(#2L4+ -%pr`rrҺGz0u@>HXS.rN_{N 0ͅQA- I6D14iceJkj)bR*CQZ%=j)(JwsuvdQhIT-C=۞2h -fejgxh^>>ӣ?$ĕ2$jr9kKJWe*h}U$r&P6;~S.qYV)[u'\{Ug;lB2V-Bl> -endobj -749 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 265.954475 101.433071 247.204475 ] -/BS << -/W 0 ->> -/Dest (cb169-1) ->> -endobj -750 0 obj -<< -/Filter /FlateDecode -/Length 3991 ->> -stream -x\K$@AFc 3kX/*U3;d0;]Ue/-lM%E>>Ȥ@W[l.*p[bBɤ\LJ]m{tl8NXM)QPX,^a`Rr!*h XƂ!sV\rX -+C sV.YXÖ%aʃ ³D(=j; ׀ciBwb5p( "pWܦ1 e A4,MI)jX OEaA" KANakS|$Ys$Y2hX[M E R԰Hfraְ | Zxљ*/g)+ 2^pIe R,8*k< YdkXH:/εg{>WENʱCECGO2 3Ry͇UKXuo -uo"BnQPp5~͗2/rG<+e OOqUGIׂx78U廎~i};v7o|sU$\?o;@zGr:ʎu?}2`s<׿I3x`׿q聈'B[[ n-~O ߍyvF[in7xcũoZv&zѶhIF{M#|'Zs<4.T J*u\ō9=,BUNj?EqVi;^Up"Uk;';dwUHbQd|Y;[:O^Ӥozݟw]w?US,-sjc^ԭ߯?1XJ~ׯdϋ|UηkOXN7su]7_+_iG(xl)?gr hS;y:dY\e4}V*-=cȕv<[F-"ϞyqV:.=&W,~134.,u^Kw?<\1y؍}>w6b6Ĉ@ZKǶ}lyLGǒ/t{y>䇼/cSl̻-XHoCd.D3- Y0]7-r\k)Le,_oblI/ٲ<SPLrEӻ+)b pkҫ.Z?yJ^ةg58[‹3)IqyEq+:Xo'N(ᚯDN v:'xC{|bz,a}\\Tsˑ{}8L} k2 ݭ[w9fVdpm>2bc$:y1(dl6٪X{|g}Çj}A3bmn{x605Urvb0=+d$rF׏bqNɔ}K8Z?p|tFMrlv%6L3s]Blz(!6%Pv 8:^%[O1in7yNں4m%iR16T.uIҩ}64c3;5yl!fHەN!juw*Vyt-MCa>w+ae:#-Y})OvΈC~: Lo&iN4ePSnl4yG_"t O`܎>$r6;y;갦ieS6;fR ]cꤲ.D:vؒmNkX9 9tS~ؐ@}h's}A;fr;n.owFbj2ŵ[SK]qVzL1?Ϛt%yWY[y-ٜX= --ν;GKhsvm2xGdJ[8k,{YZS+!6&|}!,HIȓ\WDZd a{JV^FΘjQԻR4> -endobj -752 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 606.123057 101.433071 587.373057 ] -/BS << -/W 0 ->> -/Dest (cb172-1) ->> -endobj -753 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 296.981993 101.433071 278.231993 ] -/BS << -/W 0 ->> -/Dest (cb174-1) ->> -endobj -754 0 obj -<< -/Filter /FlateDecode -/Length 4871 ->> -stream -x]K$9ׯ3?/ H4iEZ8WfFUV?Hg9k|eȨr t|UJEa џ!LpQm >6s_~q׺9[sƟYTL1j/2X8彊 Qb bH1('/ YVq{V6XdѐXED - OQ JH‚1hUR\H -[JXK@ IX3dR[J3Nt3F‚d! A M2;4bIZ83IX((v%,2A y0!a懃m/asDdq$,Hr$,H Xm%,mr%,㓰 M0doZ$aAv&Bw<$Jxwv)yY3w1 !<"v?%Y5;;^և뼻XbQw\XNp/Z_cj6:]&>u}E^ݞ匽:]).)뱙KLҢS.[t1HuX 0Ɩ4Iw2tD7W=KfZq|((⺣:{cPf7)GۭnJi辡xA[g21`Y(>̊f[u6uz&c\.Z~Үzy,FճU~Mƣ]Ե449waVjks0]_q9;P>aO)&=0+lHƓ|2x%T]ƕ 5AW|Ds\Ner&NY޿?0q:N^lÌ*Omʧna;d)E21[aH4|t  QEc-JʁbNRK/?-tKgf*I䯌6|o5ka((~D܁e8|z;Q$dDGu_/<4?8e Af>CMJ1O<'?SrD<̙M:_0:M8ZUp:i>ØjWI3(ΠHRU'{-[e]qϻu*X^;A3|L:J {}[{vpրKY*itG&T0jpNp%H=d[{/ڵd=YzB :uny^k}ls&'2n~kjr?_ksU^S"C V+}nLɾ귎H%FCQp u9@o?etÜu~͡kIo^[)jt?%쁢ӪAvC? :?b4!cˆ_Gd?ᙻuN.e`p35ڐGygC.eoYi uo>:ػP|2cmnTjƕC}B_Sdg}^h_ҹܳD4²Kv"OۖѫC<٠g u 1d&Mwδ/?#j=5ɳz6)/e _oS(oB0m8:rw'K[Hμ#& שM)5+5K$_a_`,A<8o'~`f䤇 *?|l4~.P;|1MW^VLuHߴ0;*ڎ/~p~_A[Q'Mx RϬ/RS2!&J&:{u -BHiJ<\vdi'rNG,15wZS -0YOytIP*;_TU -䩠 -endstream -endobj -755 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 754 0 R -/Resources 4 0 R -/Annots [ 756 0 R 757 0 R 758 0 R 759 0 R 760 0 R 761 0 R 762 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -756 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 713.673057 101.433071 694.923057 ] -/BS << -/W 0 ->> -/Dest (cb176-1) ->> -endobj -757 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 373.781993 101.433071 355.031993 ] -/BS << -/W 0 ->> -/Dest (cb179-1) ->> -endobj -758 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 354.834971 99.933071 336.084971 ] -/BS << -/W 0 ->> -/Dest (cb179-2) ->> -endobj -759 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 335.887950 99.933071 317.137950 ] -/BS << -/W 0 ->> -/Dest (cb179-3) ->> -endobj -760 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 279.046885 99.933071 260.296885 ] -/BS << -/W 0 ->> -/Dest (cb179-4) ->> -endobj -761 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 260.099864 99.933071 241.349864 ] -/BS << -/W 0 ->> -/Dest (cb179-5) ->> -endobj -762 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 199.152842 101.433071 180.402842 ] -/BS << -/W 0 ->> -/Dest (cb180-1) ->> -endobj -763 0 obj -<< -/Filter /FlateDecode -/Length 4696 ->> -stream -x\K%qޟ_qD 0@&0!U9|n>sFx.*>WEvu3+2[sIϗO?Ȥ@WKln*Ml ? -'Jp)Oow;?7ֱggJΆބޤU"V&%Š`h,;>Ƃ\VXbxNYbdYcA [BRX uD*w -51WT^&71 Vc Y1d %Xfx}N/B=?{> ec`_r^BPgY""$|c7 - Ejp7c`1[>>_ I;${m)MjB #]Suf~4YeEpČEW^yw>^<}8!wӤ'o Y~<}_N. -Al@o`׿q聈RDօneD( O?/RhǓLSMr^K7q4[f~7wq>ӮʯB\ByGSn(p'{LNi mR*%ڈd=0U>4%KbD/`=nѹyRecH Q٤',Kհ>}}\E8 hҿ]u}ia믶mp-3^mmޏߗ@~{zߍ[cpN먍aYCm}IzbwPo1"8_Z/!tcLw5y8cl'DT=~nm6uY~0y{̜Ōڤzy5lkأIJmYeTϭEId4мTf+=PU򶽫Ӑ -vctO7~7ymm) 3tpM%B/b Cp(aA󃁸(иL %>I<_iK`rث tqf`x]u~2;zSi$ \m1%y*٧{/!}վw{R["w5.+mλ>ӮB;a#&Y,p0ȇ4 `/jPSiRlCO0wrH=(CA;^j8dSvh8 -5m('MIC9܄N3t b]IG_yhs269|%jhaޕ;r4^== ˍQv:E\^!I)X$ʞ6x=V^Qr4윾{~Y"B0q϶b3D6گ'?hsyrD<,%Ӊ_wM:)oʒHòroj)[k1ØPM:龹1*J?<[ϱtk>lߞ}XY^VR~d+j˯ǽ2xpр KY*"е>cIBx+i:\m| \iRmW,/Yǖt?A ݿY3 K'`%7lazHIA1r>> =#.r~>F&(|F s2D# i;{4sk1Ju\RSfpf `X7g#C撳~b;mScrh86%f}o7+k5Ҝ=?>!q:bnVd%YXM:wMFNbݲHZ%p \1u}n^‹)jdDL},Im Jos4Z ՛ZO{x^f#/πsLVZi#GϳGs4m+=d:?%k<e;4{Qϐ ^w:SQҔϲ>q65U5yicۿd^kX{31֧mo'>^Cm'ơZ&\s.c5ikfUF?ڷY<\fT#[햴k׭g&NDOJ÷m#PϯvoKtTyk^^_{祭6o-5}ldol9d͇؎zvGǔu>߶_ǴF\:WR+ӯm1uƴf=q!ms&?DL 햽vy[f =v~G6"g=Ƕo="y)率,ك2 ] -!X__̕_?#[ΑH_:] M׶|>$/Mq9ͧsv. ;߆w9m^ʚ`MLl{Y2Y1S/Vq &3f2,r<6M*֞Ԭ,A"^qYT'Ǔ<OQ%gn$b<<KmavJ/郡rxm?^Em4R?j*0S+˰K -5=edJv!@Xb%&3AˎGŻdi"#qg vgi[YEЭSU|,5մ$TJ >O -rR_Qk1?͚|ra!fH˕VN!]Njg*RyT-MCa>w+&Fȷ-Y>ה'q$類a`fz3Ovra/Ϊ*,F*B - ݤnt"kJ鱣k={픺7ŏt{鮱 uRDO' cK:Y cL&M}CrT΢=v9v|ɩϸ/ty{7:6ޓsduo7:C0 }Z;:WXdǽrnhV>5GY({?/0,~QG ױuC=|>1?H)6b_6l(5t?܄<Vv;Dvtġpxi2;7a/ xvG -7pp|ĝ.\vSE̍v 6bAΝtՋ0vөm9>owh姵{3-xs3DͣZ ̝rm:mhhdk:j)bP2k:̳ҕYnx=Z= -91:%{,Zkw*ю}m0xGdJZ8| ^Y;NR> -endobj -765 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 653.523057 101.433071 634.773057 ] -/BS << -/W 0 ->> -/Dest (cb182-1) ->> -endobj -766 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 634.576036 99.933071 615.826036 ] -/BS << -/W 0 ->> -/Dest (cb182-2) ->> -endobj -767 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 615.629014 99.933071 596.879014 ] -/BS << -/W 0 ->> -/Dest (cb182-3) ->> -endobj -768 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 558.787950 99.933071 540.037950 ] -/BS << -/W 0 ->> -/Dest (cb182-4) ->> -endobj -769 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 539.840928 99.933071 521.090928 ] -/BS << -/W 0 ->> -/Dest (cb182-5) ->> -endobj -770 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 478.893907 101.433071 460.143907 ] -/BS << -/W 0 ->> -/Dest (cb183-1) ->> -endobj -771 0 obj -<< -/Filter /FlateDecode -/Length 2686 ->> -stream -x]dϯk咪!CpE` Mccz \9GzafG=RU̻RjNv~>nr|5 -Ų/@5. kϯKpMerY"QU+Qr1UC`FYa -fX -P^Uf썩`11@t>IOLKJu:өGtեba:-g[7-%3]-T2l Jt`w-3]Uk1 -\uAEU{7QX.$Rl*K!wg[BFulAq1 cE+Tg9+@Yq@C< -l Rlj` *0–`Xa0(pkR=c&>1( 3@A\- V -*X.=3(1vJb,PpW chIutt2^2cpXUu؇{ŅRP GeTwC (`!1`8Gh4!e,y]P%iRcAw}Q]u>cƉbO2Dp2Dp,`É "'5Ӂ>Ta,.X<o .U'ƂKP]vH0v8 8+cAw%2$pW a-q tp[V]XawEre,Hn;6 RnP `C R1WsN -t.9#cA"EuŲ1 vUka,h9 \iz[]h~`"cHJ5c,1!ì2] -d -t>3lGg,@. -w-\b,yc,U p3- B=cA  cA Yf%1LgXP,*2MiT[ OK#c$Hsh4ƂRBK7 cA)%H`,lff,[1TIɌ8t" -,U&R0_Gھ[1ػs񨷷cޘӺiijݙ^E9޶Nlw_ν^:q]m%˟0w˘ož5bqsG9\&Htq,׼NUr~O^'\lw8dq!0m[0LN<;6s9tmֽc_G6sWeCD~\꽿w;--=߷bR>cӲ}=%FjݙN:K 7Z4|GXdb)~<—6-;. -e#.q~7(]ÃyXٿu\cDf؛1j襶珎-ы]g) S!/|lbP8XǷlL]a:u~Y^7e9?%nV7*mW|U}vu.F!XDD׍jbj-Q:o$jGD׍;JQ̦4enu-clSۧ{qj+Q7IxۓLj -}B];E~RT58<2ެ4;i9Ӡge|cϮ勐 ;2e؉{~c.h  I.5wi{tA-`x=ڇ3C.n-؟b_fw8CXxmL~*sq[7x]f&~Bx}޵Q>8t-V2u:JZyCkaiR̶!N7m] -m}-%hE:.GTAka}zg1wirФCz[c`M:ǥ}q9zisƻt=AtZ]aݣfgvj]vi?(. .oݦt6ӲY#י몌I몤ђ(9ɬ9bBdim=6kj=m} æ!iF2ŧ_Ŀ/íտ_M#jY<&%%0r5|Fߕ=a9J 7(+Wͪ! xʖ_BhsKۿ}i zK: ݯڏ]2| -endstream -endobj -772 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 771 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -773 0 obj -<< -/Filter /FlateDecode -/Length 4231 ->> -stream -x\K$@ AaV>̨Ȗ0]Ǘ9U΄+RjN||8}<ђ#_kho%J<BKt~<ΎKg_jM%) -`b\r1,V1bfGV\KX/@م#B [,jpAb๸$(=Yb  쓅pCf6D;,X ߃烅lHK,,]W1 Z\‚u3yuq7Z^\J‚F,,]g`GD ة-pJD.haaqH,,8뚼P-‚,y /T$&//p$gax!$.jaAR ‚%Fc K(5!lFRX<.9Xwr we۴ e!ba\{ R,,HCg҂haA&" Ala륆Z,,-, eRo<,p>`ȂL R*9&cЪK~)pm -x.[X3/؊HdaϱB؊⑙[<Yd[XL<,,( *3ءQKBIbaAHha&A?(6Q<"[XPrXXP -d-,oJ-,YYXP)-&[X‚ -M .,@7Qq[Cz3[XPD(& iFPo,^,5%7H3Po"7ԛ<. -dx]d\Dfk,RqĀ{yd@^V<3 HDeYyjmLG'}D{fɲȊ`dv6uzY;)?Q0 k -k8A!(&E~ 3"to pMvjш"#:8=U]it5CV)EDO(P^cmt渓%^R޳?ߧ|/ >3^r>S%)'%p?ULK+ⓗ孪|Mە~~c{DR@Pr"WX,Ϙ'иyylLwf,+-3mI"m߭t][c9.%E/!ڿclAMSnim/s&krj,^*XL!wziY\dlNI FfsF1m~}'uu7uܒ#䠹X‹LD`5nzYt/t߸I[4ei1ևot+;UDۺ_a?*qg N]͟\ z~|^BIq7-]gjƆMB>Kænt'>s3XʷO8zv#.!.lx}=&|oMoo|6qx/sVz|rM}Ń<WXOiYw\BH>ދg>r7:d3o?8$?)ɊWg";.q_S)uV?yњx3t{wr\&P'촂uc<ң:5)Gk;{:'lOAs-;{::{뿮FMn!ΝzOE5_k?G^p>tSoZoHe|MŃ_#m|覞򵞞;GjB۵{zW؏<7q1[z,!=ן UN~!y(*5}6tgMi_Kj~Ÿl!Et=H=4,lg u|hpxe_cHyaP(g-,ؙ~Z!m#l>8rmJn9XR1VWyD\ͷQ->:جub]×fxJP@, Iy.,ϣ -캙\S;?ѳvh `&u e /~)I~T׮A J:a'$oSaWVWbģ] dFRy*k횟LWe(ޠ]ԩNWпr`0lME?/#'ݳ{l'VP쮧A;ȅLj.]UNgn* -/KsjN"9{%izÖV<|V2 Cc;R'u,3R &9W~ܑqj1YrwGMN^0*K,_$ivs2E&yc#h$/v_gY;S|^GgYo8fu4lݑN&o+wp8F=+؟dWfؽa+ٝ&n \MSzf J#z0Mtp2yang5$e:BK5aԓ ՋMd.u sCwZ[j8 =0;=icvDN=:}P5u,Lljhi9ڃwjhT셑И.*jݶQOʝo.@N#.SںuSKyw騭2Uҡw-EyfˑKtA2tqnw۳ZOALiv¿Ď8ժWkWQ&]*)CX^y[?L0!PvNd[G0 5T_ݭ)טRvB;YJEynȫ2=0 JQY -endstream -endobj -774 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 773 0 R -/Resources 4 0 R -/Annots [ 775 0 R 776 0 R 777 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -775 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 488.554475 101.433071 469.804475 ] -/BS << -/W 0 ->> -/Dest (cb185-1) ->> -endobj -776 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 427.607453 101.433071 408.857453 ] -/BS << -/W 0 ->> -/Dest (cb186-1) ->> -endobj -777 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 115.110432 101.433071 96.360432 ] -/BS << -/W 0 ->> -/Dest (cb188-1) ->> -endobj -778 0 obj -<< -/Filter /FlateDecode -/Length 3943 ->> -stream -x\[, ~_1WJI !B0y8{:!?Ӛڜ$TJJt;[~'39|ɚ,~jEeW -gg9J(TO|Ÿ˵Oޔ ~',&rJ6(uB0)VtK,EcA 4`89: -ɱƂ[ e&\0J;sE%\.8WL1dǐ%4^,1[YrxP$ ω4^,) -/CXWVyF4^!JfVy &d"3I*MIym(*^daj` z G `(ch  z8Yϓx%+8ZK԰ w]b\hX8HÂ|f 'װ wx]հ w7 `!аq%g p5,)lld`HNC5,]EÂܵHÂܵGA^5mFjRh ɂY*pb XB%kXuG>$#Ѓ,By.>1GTGՇx^GG_7_귿?<G[8",_>In:sx˷NPN.6ט*p%\.oҦ$,bx p#͆]kǥ0 *e쫷Uӗ_~T|2ᗟ/DYQ^FFO_xsb !!jbK6H e]{+>yܯU/~o3G 5e.cw&|rT,2 E"H/7s-QخClfTW~N.\s5i&R,:k1H>dcc{bV&v2l&-txuVh.Œrêܯک²ʼ~MG?o_rU&)XG8 -!tDZm]AR8s-;}\&xFz^6;r1f#}k.Lݮ-*] &6_lVm]v96\[0ηaG/s}8ˤ}tC$YznSeߐnu=;]ݦk޴n#vS7O.gU[|=`ÞB-ܱt[r}W_堯@aJ:Snzdǹ9fVvuNwnG?6a鞞䚭/g M<<p:v7Xa?Ikۅ.}07ag^u]]v`=' yyU}t׶:v-:eݯznw~T׮FPePCo96>)I!~nЌeA!hWz;t9haTZ()+˒T'vG,{cm^Sቓ| -Ii&VMo%2 g;eRSkv.7*S8&%̫9 @48Ͷ\JfW}l؎l'au,3r%.0LyGrɢ[=q'9|^i츓犆c;R6&>${;N9B&ys%wo$ߕN'Nozy -^>15rel縷-y=KdNn=/?.϶[8ǽ_gw;tA0u0]hLC\iq2?vo恽]R_!yKu9̓GH>/CJ#\KG\rLvbA Ջn\F%Mcv*&iXfNZv(Bٽ~7ch:&x:e_3'RyX g -xwBͳ[kIvbhƈ[j)bRj:2]2n?FD# -9:;[X2+T-ӎs~~ڞe$nMQZZ qy>Ɉ]"O˩lRyucEJ֙lr5c`P+nŪKzn>?Tg~\ B2I(_+Ef6dǙj'k Y -endstream -endobj -779 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 778 0 R -/Resources 4 0 R -/Annots [ 780 0 R 781 0 R 782 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -780 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 770.673057 101.433071 751.923057 ] -/BS << -/W 0 ->> -/Dest (cb189-1) ->> -endobj -781 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 458.176036 101.433071 439.426036 ] -/BS << -/W 0 ->> -/Dest (cb191-1) ->> -endobj -782 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 397.229014 101.433071 378.479014 ] -/BS << -/W 0 ->> -/Dest (cb192-1) ->> -endobj -783 0 obj -<< -/Filter /FlateDecode -/Length 4574 ->> -stream -x\[,ɍ~_Qφ Eq30 g1uNYz }ؿOqLUVvOϸaOӧ+(2+UR/?]^_i(779$ .r˹寿c\9X,r*X,m^h}X(,1g1|$K{VXM+A GѸ=+C  I,aha"h"g*@AYB6V9B$*#6Coă,Rxȃ,6E'"dNx ȃ,:h#S>'")=j|rNKив2!d 6%, 6IX`+aAHrA‚5xD^PD dX@.,BCDP%71|Z`2e]4O<`\%}mwt(`p -#r;ԓ}]gzϻˊ -SrB>jP:6# uu4i:ݝtίp}]gzϻ8yi^ Sy EWNlw\Ab?"#^$+ he9 h1HVHNܤnAtlӏ}0Cm&7f{W!Tԙ(x -l#jBHorM_ЩNDhk4b(@|b\ e?4mgͣ/Rt. -`iG!o+0\ o<ЌNy7բȩ_m?*xwb?fCL 'Ocֹ|k9h~^c}y>l"nlz% O,-K0Uf-9\P h%ͤegE FA_-ן믛l -Nĉֶm.lͺ_mnnIwrbHeъMdoQ˱^԰fAĿ}8*}u=ۺzd ovY}[fcO5 f2cmgxMaxrkW4gIv6uaԼF6N%yh7,Q eGrtO=Rv] ?4!.p[N"g]b*{iYzNSxϕ.Kw lqۼ]G^>nȅn7^vX7.G4ծuFOȰȂxHWd{'2#.( u 1?__uy[>1myaޜhcXKx=G1Ƀ_1iiW4{e}:Sm2£"ߡ-S_iҷ΢X% Awcʫ i|1V m"W첆vR7-áv}FtGLӦ0yk_6J>ҰNxx16h~x7z4LkmyHo~X8v(Rq^.vʄRX=];P|F›`W*'7U@@_Ǐ0-u}>~p*p~&_V:~)=0}>Zq;}mR67* 5\bݵJqcmn_q+p;|yĉ{?Xg3GcjĐkl8wgy!6+Õ6)zM_ߊ&(MR9o'4,yw;Yyst&2­A6n#?;KBGpgyhf,?({ly|4+]߷54ml5;af5۹~&9ڙuuC\Μ-a[O(Č>ժ=My{Σ;V8Ōg3}> @ǵhu9[q69Pܖp\G~뗅o^)p5S'AG~/G7g՚Uŵ޸㠧u}䁙5מ鿚3Z7Vt-FX1=Pm>k^b[5>Qc?uѶ^֚=uSO;i3~?ɳz#*AYn~dS^PCRbvd6Xsӳު -LA{¦?^L&/6BN] ˅@&G> 3~},2qF]-W~drYo7GߺiIF|tX g0{2^+Sꫤ\ -] in;zn-5y *. b}Vq#iݖ"R;m];MBNe$nnC6], z ElWG}boF4?DRW@M-G~#ڵk2? -Znxx8/~`f䤇 jLMU$A*|2I՘}J顣I0GI]&nLB{޺klET6cn1HuXMNfkX9u "9}wUdL:vw[8}V6ڒSdݘl" -<`vt7 ɤvsyOgRse6\Gl[W$Wd~%a#v&dF[߬NxMZsg:ȶ5nҌ? 6Zݛq`/-8~E -rpύ#: +n:tpNq1i<$[9OUӼ.0/8fbjdIJA7*rh2S˜Or֗qaCC},7ApZbщFϓR&mE tc)nM-eIR1Š}ִw+ϻvmyvhhc$ܻSits:- aDzto¿gSuZR 1i5+r)`"4>ǵ}EJ晰Ke^ȏPr%NB)hU[YK]eT_8MȨUUjJ(_X -endstream -endobj -784 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 783 0 R -/Resources 4 0 R -/Annots [ 785 0 R 786 0 R 787 0 R 788 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -785 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 797.673057 101.433071 778.923057 ] -/BS << -/W 0 ->> -/Dest (cb194-1) ->> -endobj -786 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 736.726036 101.433071 717.976036 ] -/BS << -/W 0 ->> -/Dest (cb195-1) ->> -endobj -787 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 409.229014 101.433071 390.479014 ] -/BS << -/W 0 ->> -/Dest (cb197-1) ->> -endobj -788 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 348.281993 101.433071 329.531993 ] -/BS << -/W 0 ->> -/Dest (cb198-1) ->> -endobj -789 0 obj -<< -/Filter /FlateDecode -/Length 4800 ->> -stream -x][$q~_ςSK lk1~m0s G~Yyʊ]m/ȪW4St|墖wՊt] q?%/q.fI).!JP)msKyA[LIR ^`$ c0RvJ0M -f䂠 -vh!At/^|L&FY@iIｋ`KJK:[&RAybU ;IEtEQ[WZ%D]N:⢵Ji8`ӊ:( \uYe$-Ip6(VgUVK:[ $` _ba -^̠%&!L E  -J4`[ȧ U:%" -8X [3WHk` -H\`-l1d%.`[Z$.[RIK\`paqm$qJI εN ,H=H\`y#qZ^ ޵޵5El%.;.VG+qwVAb 0 p%.V&*&` uax8܂rwSF2^e(1BX3V4%8NX9 ZtL^'Ң<.[xy' x wAQpH\bt]mw78 E#ۢ+ҢR8.hH\UxQL" i @ƋB*qbyOxrJ\:bq tœF(t]1’THxn^6%.! L.>ҒBC'k'qAP8P-HK)J\ lH\ lA q"%iDbz[1? ؂HQ0ycft-"t:H\-XȥI/q~0:M[0U$.RD\i؂ [Di-qA4ѠDd^I\$\-H<3J\/9T&RЄl; D#`u$qA&QaQF`3A₤` "> K%.CIG䛆$.f Y|)0o9 $-!-0oI7NH}73o"b7]u $L@Vg23; -밶[ -܋*{ -s$qf"^5 -Vⶁ"'O|kf &!9(f[˯߰^_ ҄ -$ Cq#64XTmH, "l,,xuac+LƢ62!sv )`d&֧<49 &HA˶~$[le>CҌ =su@A*+T9m9ɘ#)PvV>hstL}w4X-&el2ys#=x~룄~Gة~w׿?~g ˿"u7?h\wQL\XDt۶ʛ܇a[_jrwB;qٌwL_~q7vق$h+!6"ܝ-[-CCLu4JV[YwZ#p`oTRnIn-} !m{+U CLj;qM$ aa-=>2_m MͶ~AܷK Mq' u}[YfD  -OJ.;$=WJII0!NZҔx{ݫg~z5 KyˌTnB&le3e6Negݻfcrȅ*7G]8E64v8uęˉ=pT3mAOtsVY3GCӗ:eae6_R #$rH|>C3?6 !m;}%џM;eNl*m pć&)׃!\CqL9qy cK7mz?[Sm{>Y'c7oD&CS+u޼ "}y9T?/" 7ӻ'c}bodWC=؛b&\mW9k5fع8o |J¾rͷ6޳C{ɾǡ>l˧exK> m Vl;6 On`]e{v],=m]ݎ7;}k?f^5j۵OQ1,c[pv.ös>?a}H0Uw4jo+S[XoG6j}l֣C>bϛzNjM_q5k04̝9|UyjmXy䧠g?9g󞧫{uw)mZ~SU_CۍZׇ̟y)ˊ_yv3nbgK0z-(elT{i=]sVدo"tuDcK8 G"wؚKKbjql~Z|,VȖa֎!jzW|m\l *&t{b fGu!si6 l8 C3[Sͻ2RVqD A lc06 Q/Z9AtjkT⨚)9K/fsDq+λ}Ud1;! v+kB^4`dJK3:ljtfo徳IFY.B,J(IH˘GY_(; ]N#[q:[έ1_Q8-ބ}0!FC(:n k VRw]˅nMіyo{ c3ҶC76c׬\ơcI&q%Z2".xda HIw}P`aDCGcM7Y V!aҼӴG0ǽ N]Ʋ,o/cK~&Po˲g{3-hs1ʤqTli[(:]@MVkn)wE/S _DGvۊף% ݩQǒQy^KiM}n!~DjTs̝δ j?e'Dq~'j[KP>U;Pd[#O9+c!kU?בM"=V#WKJ l S+͹!/CNbsAi$f 7 -) -endstream -endobj -790 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 789 0 R -/Resources 4 0 R -/Annots [ 791 0 R 792 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -791 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 228.873057 101.433071 210.123057 ] -/BS << -/W 0 ->> -/Dest (cb201-1) ->> -endobj -792 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 167.926036 101.433071 149.176036 ] -/BS << -/W 0 ->> -/Dest (cb202-1) ->> -endobj -793 0 obj -<< -/Filter /FlateDecode -/Length 4069 ->> -stream -x\K$mׯ E/`!`d`` X0[#5#㕙yit%HFfZ|_fgr.)嗋5)X-vM,'\9\%J)^_.p67qWoJޅ~I9%V:RX!| -+:% FHJK bYaeAYbXcA WBRXBUy2Wx.G睉x.yGdbb+&cu/@ƃ,L9iY(UyD/A! +)ñ$ :Ӏ,d 5$ Y ְXaw=a  w!AO V{ Fd YaAqg Rof -Yԛ(-L,)ʃ,H$ԛ@'!/aAQͬa ԛ#,fR 4pi԰7jLgf8zb`U=2^DXHDezj -걁"&lOU9$̜dnG1ѝfrG_78?qZj-9v~LQa"DB>"D*SHXln"$B1mn/2$2͋Ra(uꈑ!%B^^e tF-ky?*k_,~q`ͼ\6=D$ϗ?}ç"[[LQHKOOh|ik.CH?[Y}_q6GXmV5ĩU5/m6~{ªgm.e$0m]zeM2JLJaqU= k)ݞufՖiӏb/\emշx㿦#ζbo&49Ye$.صxkwU*-7^V^CQ5XpuS͸tokE?݇[*V W-);a)qcʖZl氯. ɀMՑ@ rވjIu;=b9+";1p=q|h@OQK7:xwb/WlA^xR}^hn{wܷu:lG#&k"]~f8ln-*=-Q[U<6QaҺw^w&)?sNP8۷/-fBk'y<6jOz<ÔkGuQ?9{ՏF۲*==#=;r>ݮ儉Bl${x}/wtZzF` Fܳ]Pk'v&.R)GN-ycŞ-׾ghiߠ|2vMK[ݝ8ii短m5Nt[ckuA+_^p"~v~sK -L<%_ .ncv}M>▉W".* v4Z*z˱!bܓ%!{mb7D]OKHJ0†nz+q9i/rW\1x0> -endobj -795 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 582.273057 101.433071 563.523057 ] -/BS << -/W 0 ->> -/Dest (cb204-1) ->> -endobj -796 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 521.326036 101.433071 502.576036 ] -/BS << -/W 0 ->> -/Dest (cb205-1) ->> -endobj -797 0 obj -<< -/Filter /FlateDecode -/Length 4092 ->> -stream -x\[c~ׯг I !WKиrneb,.iXϬa0z p<:_!hXs0oY+Ɩ5,]װ^ $QyccjXpEÂܵHÂܵGA^5*gHa5pT4,]q$5,Qװ f6%aA,<|*/\ !Td 6Jְ yBkX Fd YaAqg p.%7)P|3iXP(* h*ʹ&!:iY|a Jof f DDI-wC2i<."Өa.o"r{ ̒qfb`U-X`/URk+9Z4,sTp`: ,0\}ZKT3sE Ft?rٌ4;~[8/:<|V+ecMqb 2u.+I\v^Uȧ?)ɿ/\l޻wyu޻wyCHlKyơϫu^eE /S<}jjȾys@v(7x_poO<~Zڐ;,]5Q!j4᳴x1^|AڏvR }?OEy-Gڄ]sg!:Sku:|{Ewe]Uע*6\2w;[Eez,yy8 2{jnuNߺE^ɼ߮f+f[\Iu ?{up~+S[k1\Z?Fq^_~o3umfW ?Û -4S$j% "q9s6"+>ϋCC\Ȣ)TdHl0}ֳjƥ0Dh 'mEo2QYW;1&\)-R_P>vshc6w_?lC2`OI۷E7[֞1vŋkw EqXh݋jI^ωY2sڦCG!yT8~ ۸qCSNKNNO''n5Ӫm]6bhG]ikAOpZ+}hvXu5;Eȸ>݊8|,hb:N$Cُɀb] 9p~aZ6Se;"R xL4z{&oVfq`.aIh/]Fyo$g8~3ͽK}m演g"Qߛ1]_O˺1Iz~=3rI6Lr..mtn_?G=+dKfr~nx4YyݣzM;^;}-v˥(T}Ty?Rq W\WZ|[z;a*S5_PC6 U [5q_5(Ʉ|ńHnH.YXK e]YmU1G{?SYmc=bzS_{_IWV>*ȹXEzgO08chw}vRe:7D,B ݕ;|2}}߻c&S=+IoUV&nr8zomϧVY-6߲߭cfWlͷ+rK{^נ>vuw?&QQORGNٳ IWzKZfG飏̚{V^qJ@jۭ)`7,$D);&O ~/]euRi|6p s -RZTKcZ4zJp6eݕ|D7oװ۶X_p6 <~l$Oe<@6Xwҳ2ѪXّ/ ,rE짯>k+9~1ɏIX!3#Yci'deK86>Now(z7moD -=ۓeָF㳡v(!vAv8;>Ivdb2${ȝJc{./uWչe{[.iR>T׮FPePCo96>)A!~nЌe31wCѮv -tP۵ة4ZٵtOQSWhŵ&Xdm5bi7~G<xIi&VMo%2 g;eRS4y,D?CETA0)yk^IlVI+=aMl˥4lv՗Vi/;Zmz*]<[V7a]?+WB`IÔ7)gG51Yt1$ǁ+9wސw|'cK~L 0F+ցN#to>_R_!yBKu9̓G%!q%MK렸\&,Sb$C"?[A2rrIͮCwZ]!0IFE&r'@q uNzP;54Ƣrјo.V]yvk :)wf(\f;mLuj+Ϊ҈)&UaݕİJܵq(l9bɬ{PyN۹=.)H®%gG}Jkj%d05Dꏽ#0:4>k%H3a; gt(O3O݊U<\}ZdnS-mׂиL*ϴY~]&Y^9(ԿbN -endstream -endobj -798 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 797 0 R -/Resources 4 0 R -/Annots [ 799 0 R 800 0 R 801 0 R 802 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -799 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 698.673057 101.433071 679.923057 ] -/BS << -/W 0 ->> -/Dest (cb207-1) ->> -endobj -800 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 637.726036 101.433071 618.976036 ] -/BS << -/W 0 ->> -/Dest (cb208-1) ->> -endobj -801 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 295.229014 101.433071 276.479014 ] -/BS << -/W 0 ->> -/Dest (cb210-1) ->> -endobj -802 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 234.281993 101.433071 215.531993 ] -/BS << -/W 0 ->> -/Dest (cb211-1) ->> -endobj -803 0 obj -<< -/Filter /FlateDecode -/Length 4914 ->> -stream -x][$~_QφI`w eه}lx*Rt/[Os*#t I>E(3UEK)x~rQKp -#jEaq:?%$g]rLvӯ.[Wv׿e%T *rn 8/^Ĕ$p mUfPNR 2& -3,m3L$`N.*`6J:t-%ы$QH:kH;-wQlqIiI`DJ1H:[JtNt]Q啖t..E"QS1ĭ(htZ/ش3 -䃠3+DlqVIga ៤O8bfmՒc:؂xآ(3ha^8P2$vHQbB!XLr $JCgDVG^ba a:bI\` lA -lK@tK*i ,X.TX0$.\@)I\`)qb ,X:o$.]KK\`"-`h%. *H\@]L##qFubbTxDEx,.,V&H+7x8e$. !%.P.(lJ\:c%.@a["qO`E%.p]1|.-:Džy^^IBe%.p]g`E58X%xW$.p] Nap$.h芺 Z2`^THZJ\Xޓx"=h$._0.ʀ)$xWi*˦>D `/H\#-)/qO -:|/ve:B$.c$k #X-p-%.-1I\G<^t,1E]N BK1%./.I\3$qAHSE,EK4%-p%. D[ J\MDXK%)3®&4&$.p$.@`a-֑171&ǛA₤` <> ơSJ₤#MC`^r%.HV!D'd=ǛADEuNS-8 &IybI\x3J\7&[TpX3cF&L wb$ϗ_`/;e-y x'0%G0l^B -LN] fҍ).߇44c u(j[CW!;]Ulmb04iA.>= -%UOE!}凜[f } pw#Ʊ?-iĸ0}g7x~ϊ/uo Gh@`4E e[Jhx8Psѿ9m:'']E1`hy7s<i?^nSG͘= 3[1di^IH!)6ސAR?;{TkwM5{#LlTv8~K~f0ln/*Tak';1 d#\'A\7;##< |cpÅ'Ƃ iIŠ -Kvcm)x'< :Jk,. G5d0%:fY9 [t?1ռ3~u$PG1zyL'< Q&E|}Y>ڸCo𵯹ĊvH3yf.Uf>̆VFZu= RZKRmclꐃf4̑{FBϣBYE\!}۶ 59yR 3 ׼_Yhxu8JnqF?$qΓyhڪr&DLz%Ϟ@IFGØxyn+8 rx_QcDtߪ_|>r[;ͺVc0-)PywyǾhºWG|<3QђG4L\PFt<;c9D5p?ިm\|a4E>Oy:iysm=۳Iؙ=iG}wWt~_Tգ6rqhA)o3s}mgKޖz4ܘ?ŖQ4 >{gQv.ӡGtcv١Lړ :8\gCh6q b9?]=lc9f'86pjO$=㧞Cr1*wP$m!)TZttQ0A}+:V)ʛηhSĦUޤ-ߥMy<85ʯoiNHj aQj:<U{ר&QI]M8 EjфlaŻ0V QKj:AtJiThbϚjwS:ml/ri_戲Ż#VqoGm&v!\\(CMUKr~Ư/QSkRfES3ٯz%<7xI7!4v.B_:*!=nKzl%lTcj놺&f -Ӹrjbנw;]NʼZ]wF\V*免f1C?Jبa7 ŝF߲N;kdҊ{咗9c |e ]P\F50[Wq%L' -Uئ 44~Ӻ35{M 6 Fۡg܁6bsdul}qi*\e:ۗP$8i_ҡ%3dX(. -Sle&ru=OPXk]G}܊! \`;^+M+{?Eei7JD7ߤr׼% 79֩Q1wROil[7뮫uhuC|LU6)?;⁡R/O)BM:XcO=8akyJ;"ud ñ*h 1ل7(cPTy19[RbVP7d^cjCE(No_J>5o#V[(- -endstream -endobj -804 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 803 0 R -/Resources 4 0 R -/Annots [ 805 0 R 806 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -805 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 638.673057 101.433071 619.923057 ] -/BS << -/W 0 ->> -/Dest (cb213-1) ->> -endobj -806 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 577.726036 101.433071 558.976036 ] -/BS << -/W 0 ->> -/Dest (cb214-1) ->> -endobj -807 0 obj -<< -/Filter /FlateDecode -/Length 4504 ->> -stream -x\[$ˍ~_Qφ/~0b㇞g)2.LUvtÙ+($')2;2%"]o?\~%梲PZ-1LiI%/_.}-Dg_E~I9%VXBXRr!*h,1B"GGVTrX -+C O#@ ,i,aKH -a1*" Kңsvx69`5^Yb!k<,d h'!ި; ׀mi$q@ -5x]cRѰ w9ljX\ְ.Ȃ1RRbCʧaA2 @ʃ,H$K%kXdiXdAʠa2XdjyY.j}@@%" RǠUݒZelҰ %ZMa~tI% R,* -!3x ְ.xjXdA6aAvUf4 B53©&4*&4,}A2GAHÂYÂ!3N&כIÂb 2> 3FÂb3MG`_r5,(ޠD#כIÂB% EQyISQ-0 &IE -iXPbz3kX4&2zH sn(@&Ef5,MdZmo!!?ә+ά@o@lU *g5zh1QY樞 izl` Urr.Бw*I>$QR̷}>\r޷}>JV?Yi5'd{&y. wm|q?| mPڤXOǥEhtӧ(N E@n{8 mPFqs9\;}^5s9@q?~4˹̠">s@9nl:p:|'/x~:ImJQd !ԯ=~pRN7߃2R2qC]tc>ߚ6>j PWp3,LƦq#w^jg06Oϴx}oovn5uti{)LyƘ1?ls\"0zCP:7陔Z-y!vݫVvvk׾izRo_emkkkm?F;6-3WE$X(cWŘ[o6/MWyj_wiϓx+^u6N|Nu>[a~gFvU>vV몣'&w*%gjr멾A_BOU6^3f'eC;{ngǵ/zVJ=V鹵-IDncQ7̠t( E{QWkn(t瓡c;{<^O]ch f?ymR~nc5td3ϊ :`[xM_}[}9?Bm:i7Y枉=eŁvl7r*6 -[Ӽ^_Ǽaz;NyIUO3WzˊZկD;z[b&O@xWŚKVnM -n➞پ5a[e[y{Dw<-܄lF\qq)dGp]] :Jy(^+й{kHd+|ln%||Oo/j]v4-yL/"}qMNHܓ݅qd{MO {sIjJ{_t+nxnn#nyټPkWʛ7]7\7[MÍ͛ߖ\Msp|67_MwOջu?oX,%x1bg0C$'Np`} vV`iw3am}qTeo`\Ư;*^b>qF5j[58!yjI>~\z;ezSSSSoC7lsCNasoFLqq7 -g_9co怟0 6e>֋C~~787kZz5!.-f2N=W-ߵRu4i66yK目vVD%񣮪b8 -֌'\حxw༱c{78T ͡p=V5cT׮3PePCo9 BN -vQߙ>4//oX;vSHڮhg5?E_UOۑh(wM~%؉r Ii&V]Ow2)wUakv?P~4\__1$7y$IuHӀ4 -uٔJ}&Q3CcPc%u3RMMr!O9تɢƸvHr.!W|'j`=]?I&ٙd8(LїJuS}}L_.59g[~̲hrX3- YF2~c~#_؉c#ll78k+aPp]gL8!vZ{m3z0緀tp!*yvk :m3i.@36FL]غugUKi 2U-#ȖHt4WgfˑKfeAwqnݣU, qffv __w>SU'!6Ϸ!PMBkc0QG#9?+99̱&Y~5. u\Vp5RGw֧MиL\*='ߠտyJ?F 5 -endstream -endobj -808 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 807 0 R -/Resources 4 0 R -/Annots [ 809 0 R 810 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -809 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 426.873057 101.433071 408.123057 ] -/BS << -/W 0 ->> -/Dest (cb217-1) ->> -endobj -810 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 130.126036 101.433071 111.376036 ] -/BS << -/W 0 ->> -/Dest (cb218-1) ->> -endobj -811 0 obj -<< -/Filter /FlateDecode -/Length 2862 ->> -stream -xM +l@e 2p Axmry;V f5MVWȧȚ *Z[zoJ"[.vxta\ R,ϳ˵Wۿ%rt'SRKTR -ĔUGlST4꽪 m5y*1VGUahaW5 RqTL#!*q -=]kDO'rQNZ9FlIJ2l,`KE<]-]-` ebO$VU]]jH)*B9$:D)GaK\lIB lQ<8Dkt X,Ga !Kb)A[TJЪգ@-h)a 4q@@$ a"r]l $4X [m@[ U@\I ĕcp@\;=p/ ԕvEkX (wEp-p`c@]a* EEX? +!J ܍c` pu% c1܍wrpI~:[XcAwasb -\[X]X>W̸97 F%  |V`|=$p;w96X] c!0\յ@V *HJ#8P<dpǂ "quEjX:HVEӁXaO mz,z,YpXVJXA䱠 ruEz,@b걠D"1z,( eX 4F -[)z,Bm Jʨ0.P p*t\<[1{,@-*c,]X3cXPlAx,VjDf XL:f5d j23y,ZS锬ά ` *M`cNJM9HRF+7ǂZaKifX X(K=y,h\QoFXzz,hB7Q9q$[Y<4- )-H`Mez,h9[Y= @=VoM dt.27z= ?*ЛGb*V#0eU(cnOU;왵C6"5l&hv;|/?g{j?)/f+HlXn*) -L3}-fBiD#7316vl05\:P]K?R"aFv׵/Z'r7RػQذV£~[9-~-tjK$+E;"i9v<.YRn#]m_7߾]WzC_(r;kC!޻Mmzl~xM)Ӷ]h{?o9()o1k:\n{N3DF;EjV=t_6[c;酓}=%Xoq}z{eqWLf~2|,r9א:plCPZi䅹;/9gGFXz(,es,IlR-n7Yn77Ws{ɳ>@# ojG%$O|-L?c/}RϗR&B:8r b jLO,_>p-b۷~6Fi`on;]J#=?m%:bf&<>K7o["4FS͒c_v3؞b"90S١mg,ӽ8jcL]a:u,o˲^7 +ϥOԎ{W}vQ^t,F!MX䈮#|EkbjvqH:ڵ]7[+UF:om})եwdb/1B?V5*7NxP0iKi&+(u[;ĕL) -c]f%" g:\ʎabsϓz3Zfe|q%Aw3v.SK?np姓xڙF&e^=~8v>2VLm;]| Ʀ2őn7[0@a'FvqA'@8q/۾!GVeahͲ_mzIHq$^w2AAD G,¨ l7}<ƅ:o ޒAyhWaspȲLlG"[fnطKaNUXudnɗK\YӹCqk\lӲ c~]BlbI#RN6veS,MzvN8Fqxu?L=L:>Oto>uȽNXsи,V*O*Œj)~ dewh -endstream -endobj -812 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 811 0 R -/Resources 4 0 R -/Annots [ 813 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -813 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 797.673057 101.433071 778.923057 ] -/BS << -/W 0 ->> -/Dest (cb219-1) ->> -endobj -814 0 obj -<< -/Filter /FlateDecode -/Length 3998 ->> -stream -x\݋$ ￢ ,$ y,!aw0C.۪*uO,yg$-OßBΔRs-~ꤱOGg)j* !\xͩZaw=aZ w!Q/ V{|аDÂuOiq& "pLʫeX\[XٸD4,]gѰoQ2:_!jXw0oYʫR4,]װY$QyccQjXHUÂܵ1 p]Ba4Uc=Bw k<வjX65,H hX `aA*djIÂT-x(T^28d Bdy1Vv _||Ra1bigkߝ}%煀| %~j!*>/X?tֺÇx[ж>iʋ "b Fw?]ЃMzpE )n"ܔqϛy5 F_C-_x-yp,˚3!+EhFk w]6_$>_{Zx>qa ڴvX{8{[[Y#EV# )0(ه5Чo'(-~W^qX<ğ}\эoI|JsOK"NZu~a+o<{4#|m|fFtϗ^?pN[0Lu=g԰mJ[}[jɖMuf>o]`fk#p-֖^ݺ0.ck=5t-<ɹHxNv> =>_ڦo},]c; on"n:4]y<V`q{_}]Q,K5M5Ȭhz+sDk9\Ix_^_2Y~,o,]Y~K 5T~#3 Yo+/>mQmv#ng6TrGe*=yҽF9l_ 4PV2Jed +nú FS_1܇}mcCEGћ:d.lQY:RڰlyOnlQ삜V߶>D^[iU>·#Pg'FQkÛW7kxo羈/6\oW|փWmvV91V7ĎXԅ^f ]­~ht9?U [x—,.V8bLi󹫸Q7pcNOzrIgƾ^]mg}v/pu]ݓdlnVg,6[;p=3nA +|=qCp3^nq/#:G{M0y_aPGcr[DzGHć55;:d!"#! E/v+ٜtX+r'i{ qd]M7\Ugy}wҨhP|&E52w>Nt9eh{fdx_/Bm a7m_=6>a](+D\ܞ̣-d~@1a9KC IO]D+dO] ӥIK91]g1׈ [Jǝ{SݺZJA]rLyRH|Ǝ 9b3tG!WB:T8f*2/S +3IEσ$sa:7~G<"Hv^:N$ ;eRQ(.Bhv?rP8.ŏͳ $iip0y+Vgb+0c&u3RmWMr"O=U8{,9q;i`$1㎟vw%6ڒKdnv&S1$O}l.pqO_-}{:GeO@ǿ{ }p&Ӈ]+L^)(Δ.yq!Nd8֩JMvH0=Or*%NDahYtQAȆNJEgr(c`LSC;Mӑs‘OzN 0ՉQA-E NVD14iuJe,mER5Ť*- #F9+i'70 -(9)9jɢВzPiJNM{=aT$NkbGsZm'ĕ55|h/ҳ%%`P25r5_̯=T! -`ԧDj!gNv| -Eo7d{wZQj ut -endstream -endobj -815 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 814 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -816 0 obj -<< -/Filter /FlateDecode -/Length 5429 ->> -stream -x]K$qׯ0ۀ !=n FdfFUjzGexg{3 #|;[L\ROO$X=?'YJ]? !$ -'yyٛRw|$Q0)dYI*H.(I&%QIKђ 'OJJf- bYI#PraT O$ -'%YἵjD+iMDG-;sEMKHski!ȱҊ1rpNKcŽjiBNZZ,!ASdhejd:-%ii6O afP0I1)iDEM,d!ҀRh2 NKc}"5 552K O e -\ 4 Œ4!; ,LQC ai%Ұ xȂ Y< Ж--4,[.jXjX!GҰ rJE N @=iXװ vaArVN5 @5,:rа٤aw1U=@WjX@]-iX@]`Դd0W,7p׳pד@Q Ǫpº;Y# PpK4,`+0ʘZK԰.Դb\B+l\EP   ,װ.Rki]հXqp4,}3BuմblYf iX06~ ^4,]!hXi%daa*cΪHwCki]kSѰ wljX|ְx^ÂɔXSӢ3kX, R %Ұ)d ,{ ,p4,G`Y)jX$3iX8"CjiћjZFKDiXXd z F% iX -dPѰd\KsNt朆CxdeFa,4bI4FV̬aAhU԰&RM, ?l~l"Q K`Ұ g/fְ gװ)fҰXOÂb7Y8Ҭհxӓof J7)㶄(fҰda(jdTq LB t"d4,(1J5,x:%%Ltp IK3&<[-^N,gVg ,a[) 셵J꜁JN@LD90HtV6_cÄS?E 63'yɂaA[̱d W]ӯ_`|LAE n pejqTJ!RYtiM)-[ Efg"RpuY Y/'en3$O_ǿ7ғ-$^ 0OpIs͟_~孄K@^%p_TuN' -Yf?.M, duε,5Ԧ2{Ay ]v s6h$KKW7`?5%_4w+$ekoTSQbZ ޾f>Msn.pץ[ n F^/iZ¿"5ͬЈZ&tX)(-˧@gt"792ݭԕ ^j,ZTU=]F b]b-v.|ER z%;TY?K<c(.n'HAS'xb_;Tp˓zՌFx_?[k_T M` -ǍCe2++c])|Gߏ "Qj0B3>WfN&E88$Rqq"^٣X5-_QhdE܂( 3cyT#BbM5,J"Jog,M%Wa %ApY9d1#Hkmp=et+ d\ #(U8>%,4ˏ!dKI#eF1(yB JQ<fj?a ge& -:܈S%x[⫍A^ucP?wKXB?PJ{YDK(]+pxs4ܝU܀Ts6iMo.+oy#WvsZф,g -$k?,{83i܇uc6)C֔R. vjUpԇ4GS,K̅ܽAҲ=/̬[o]սnߞO{aObUb r^ؕ ц|)t͑<[x_.-nxCVŏNx{no6Q0O]J^=wUחGF[eI끈^)AQk. HH+Kh)g/ <̀d9 -K8kﯚZ`v`Yv:yf%/Uvn"r8\^Xz8 -Zn67l,9bK5mM̪G ] pvF;SlVh^$\>rc<V57n)Ym+Zyz-.{߮C{,"׭(,NF $@xG^AW){tWmඐ$W -y9tvy_*#@elQG0E_94]3r|γZ62h1HnW+|s2 -7ku|!yF)x2Qޔ\nC}y: A&G\z:u8K|N]7g5_axo skv3G"RgEJ#ma}ݺرyҜ 82{i[Ib95f+hu}s_ESH̏*t kf0aJD={7P)2 {%̇ z$h zJ$HLZ{mzlQ96gm} T77|jsy@)S҈ P\Uss gFŶbcAfcSIX|ŗ!/5= S?K w3z\tu V."z^noItpV.K,1&hI20p \G+;>0캊{OE90Va^/v &r9RvepE =-dyWuO6)cu߶+6kup[:oWۼѤB︯^u!>Ox.X=~p;sI1|pO ʹdȗB"wgs8Zy!$/›,xSÇ:Wmv:?_a-YT?ϕ,d fiuE0B^`IR]fq_O;U3_K/^;?yOn\츷 -|d> -endobj -818 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 766.923057 101.433071 748.173057 ] -/BS << -/W 0 ->> -/Dest (cb221-1) ->> -endobj -819 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 747.976036 99.933071 729.226036 ] -/BS << -/W 0 ->> -/Dest (cb221-2) ->> -endobj -820 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 729.029014 99.933071 710.279014 ] -/BS << -/W 0 ->> -/Dest (cb221-3) ->> -endobj -821 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 710.081993 99.933071 691.331993 ] -/BS << -/W 0 ->> -/Dest (cb221-4) ->> -endobj -822 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 691.134971 99.933071 672.384971 ] -/BS << -/W 0 ->> -/Dest (cb221-5) ->> -endobj -823 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 672.187950 99.933071 653.437950 ] -/BS << -/W 0 ->> -/Dest (cb221-6) ->> -endobj -824 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 653.240928 99.933071 634.490928 ] -/BS << -/W 0 ->> -/Dest (cb221-7) ->> -endobj -825 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 634.293907 99.933071 615.543907 ] -/BS << -/W 0 ->> -/Dest (cb221-8) ->> -endobj -826 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 615.346885 99.933071 596.596885 ] -/BS << -/W 0 ->> -/Dest (cb221-9) ->> -endobj -827 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 596.399864 99.933071 577.649864 ] -/BS << -/W 0 ->> -/Dest (cb221-10) ->> -endobj -828 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 577.452842 99.933071 558.702842 ] -/BS << -/W 0 ->> -/Dest (cb221-11) ->> -endobj -829 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 482.717735 99.933071 463.967735 ] -/BS << -/W 0 ->> -/Dest (cb221-12) ->> -endobj -830 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 463.770714 99.933071 445.020714 ] -/BS << -/W 0 ->> -/Dest (cb221-13) ->> -endobj -831 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 444.823692 99.933071 426.073692 ] -/BS << -/W 0 ->> -/Dest (cb221-14) ->> -endobj -832 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 425.876671 99.933071 407.126671 ] -/BS << -/W 0 ->> -/Dest (cb221-15) ->> -endobj -833 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 406.929649 99.933071 388.179649 ] -/BS << -/W 0 ->> -/Dest (cb221-16) ->> -endobj -834 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 387.982628 99.933071 369.232628 ] -/BS << -/W 0 ->> -/Dest (cb221-17) ->> -endobj -835 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 350.088585 99.933071 331.338585 ] -/BS << -/W 0 ->> -/Dest (cb221-18) ->> -endobj -836 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 331.141563 99.933071 312.391563 ] -/BS << -/W 0 ->> -/Dest (cb221-19) ->> -endobj -837 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 198.512413 99.933071 179.762413 ] -/BS << -/W 0 ->> -/Dest (cb221-20) ->> -endobj -838 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 179.565391 99.933071 160.815391 ] -/BS << -/W 0 ->> -/Dest (cb221-21) ->> -endobj -839 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 160.618370 99.933071 141.868370 ] -/BS << -/W 0 ->> -/Dest (cb221-22) ->> -endobj -840 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 103.777305 99.933071 85.027305 ] -/BS << -/W 0 ->> -/Dest (cb221-23) ->> -endobj -841 0 obj -<< -/Filter /FlateDecode -/Length 3621 ->> -stream -x[[d ~_U% $ÆBv;6a6C~>t쮓aOIuQI:ǿ"ޕRsÁ\Ǯ_GO]5x|.r:>v:ÿc1ZS[e \rh*X`r1nV1b ׬ 1h P V,5BX,kA`|t JO/xJ e|٥,>zW]J)'%V/BEA-^,Ld %ː%@;*&P"o*XɫQ(Xy"lM< - %Q&D`~-p"r.֠EBYY(' ANq€PIb@(Il@I&^0A(BE&p 8@ta h+ p+T BL\XX\R 촰plau9`avYJ,,,.3F<@)[X ]Q`؊  ` `Enn,,n,,8pt`-,@/%DயO/5YX`L^u>CBΧT-,]* w`CD DgDj!ZXsp oLUG "p,,@vT$&/;`y ^-,H]$. Y ׀5|ɪx]a%‚հiaAJ RWsNJ!3yɡ-,Bd<"Y,,@b*baAC ȂdzdfyY`.f} @2W9&cЪK 6y<-,YB+pz N% x^,,U,,@(r% 3x ɶ.x[XPdA6haA Uf" QKBOHbaA4UnJHi `?(6Q^u%xQ ~][;Js# yg(pQ^4#",ps,jB/A; uɮh.r#67?^˾zwy߷?U9(y.$ۯ~(\ߙ!9)S*8+Y#d@$yw]&/"7zNXcC>ʂ~ é>#np" FN:wù R~"W0ؒǛؐ/f[P:H^/4QMbm#j['hY=D}lȗ=wSqs7ܬ˳˨UKjEj?ij ίΦA@>#](-2+/'NNO☷ڛ7v!Ĕ -yո mlx]Y0wK"o7/0)}|b&L'b>]7xnfZn8sQܦ~MϙRcc>l-P<߲Bz>HEl2~"RoCkDaQUbu4k+C/xF.j -{NWhYs4׃Y -*w_:OgAg{rf3gP < MsTTc5n}<67|O. 6>5^Qy\U'vINV㔚V^%/,ö8Kޘ䧃-Yd;d%KsNH=PLent|TNwya_FwQVeqN(k9xb&Ҳ$oe{}U_ y[%ɤjէ 4hU5cCdA: ԧl/=~3HٯNѫ̡k~2MPA;-I^/->B/d7^SY&\O_"?b6zljD^B^&5*f[# qPy /äͯٚo^I+= K^컨O+uܘRTޚi1sSCc.^|G3]ck6P:uQݢ=P :m̘L jZ#_VMuW+骯#Ȗx$@q5> -endobj -843 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb221-24) ->> -endobj -844 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb221-25) ->> -endobj -845 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb221-26) ->> -endobj -846 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb221-27) ->> -endobj -847 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb221-28) ->> -endobj -848 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb221-29) ->> -endobj -849 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb221-30) ->> -endobj -850 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb221-31) ->> -endobj -851 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 605.596885 101.433071 586.846885 ] -/BS << -/W 0 ->> -/Dest (cb222-1) ->> -endobj -852 0 obj -<< -/Filter /FlateDecode -/Length 4344 ->> -stream -x\K$ s+HÀ $`#rmflrGUQUoٙ"(R;[|'39|xt&梲r2(TOtŸ\NqgoJޅ? ɤ -e)LJ>DKX#$|d%%12 N1|r +!),g!֪<b+<Lң\|Qy <#21 Nc Y1d : KpVA4^,ɪ%ų>YCH_Xdxi@@, Uy -kX@D3iX@@[hX@[iX@[.jX@\i5, . T4, `.;5, .=iX@@] -kX@]5, .0p5UdkXt42iX]r6iX]װj`Q؊9[ e  |4,`rw}^zQX5B@Xa3a -?ŧV5,]1}*qoeb,.*Ұ wY`5,]GX5pb5,] Aq4,f骼blYÂ,y -$*/Ӱ`l,P "p{Ѱ wm Ұ w-#Qyװq xp[ŧkfXwMEÂܕeSÂೆ -̦5,łOEaA @ʃ,X֦P$Y{ ,4,@D`C Y)jX$30kXBD>jMNksIÂ`)v 2NaHaϱ@XL5,5,@ sdY jX}FXKBYÂHa&RAIH~l"QykXt3kX3dkX۔|3iXP,dAħaAHa`mrO9ĚkIzF2NH!G*7kBfB* -yܐ 3XO}ᳰa~#I~~o~Λ~iu-[i2ππr|'ᲫaI)W;J?iŸ)9OYD] epkvUݮ-RHY߭eV歎 }V_ikeI3eUsoUU6lǪ*:,{wx3j/Lŵ8 KkRh3X!pۉ$>xͱlwM䟓=Wb1hǢ-mڜyx|6~OCOpeqǿ_u&pUتɳWIVY[=*7cXZ4P^OFi謕ClzOr{}U]կZ{ݏ$C0PsAÇ#W2Z_ph?jk#cеjo$i'̪~Y8laubqs܏sy)SK7qMkخʦ_ 75&\dSΙK<ӭ r 5T&ؒ-ǭE5Q8#OKo͟Gw!khPܠAzv^9Bfl] l4x9bM(K's:‡[6io̰FuD|9[׃ݼ5}ۭ X%;39ƉGmV'2˚}VkrrQk*kxfoz}=lP7a{W!opP0 cwĨ5Nu=Oi/ۈƝ:rˀhnp}p~&WrxxoCBL8o#O3jfawv3Zn@vlU(uU437.2A')oa=Aݓ\;"'.`uӤX֦C$6"=MN <ؐ)kûi[K Јh= Ңc{p}͂Eb =eo&7Gz \5v \ >176\e'vmgm>yNى Ώ" -j[5=֟gs޸{uK (aW[Hm;[Ѽh-S܂vx͂<^X #a@U'!4f?/D߱ P qV3[FRwy0kLãҺoThmyٶzq99cǶ i {}To]{7> ]Qh'zȍU<dzENj w5!ܗ]F5봶*KUu!aZwt HL6g}>,Q+\ţޮ ݴ־'y;16ô}:XfHw7#y(gy8[bצU"k7^}֗`Yy/<]qX~JF䧓"x,mkj]]IXx%[F#C&bIJl~X!ftGOz(!64ho粣Q&ّHSw%]uq4Ot^#^N'*iM5"m4*Z>!I! ۚfLfO&/ {)I-L^*i~2LrWBLiM>b}ݒ%smd7@wOz\X: LNvˠTl4yY.P:U~qMJ^Y0F'⛝ULuXӀ4Nr)uU ]cꤲ.uo:vؒ]NkX9m r!9Cw`{gMz;v>g'R6ޓsdegOl" -<`vtw굯ɴrT9OˍHN^4GYo=~~9eغ!+|/I5bwyAvy :<쭤:w&ÉzGfeع rImprAФ<\$&q%Eǒ.".Fq9uXd1 NE~b -#2;7huS4_ ;-yv=ȱyP;wLj> -endobj -854 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 432.754475 101.433071 414.004475 ] -/BS << -/W 0 ->> -/Dest (cb225-1) ->> -endobj -855 0 obj -<< -/Filter /FlateDecode -/Length 4378 ->> -stream -x\[, ~_1UU I!L0y3>;unLxm/9˞RI_Ige&"/?~TKr˱N^ggJΆOޤU"V&%Š`h,;޳Ƃ\VXbxNYbdYcA [BRX uD*w -51WT^&71 Vc Y1d %Xfx}N/B=DazQlIz*5,:oװRҰp#avr& 2 u GK>5,` Xvrw] awa Ha{װDÂܵǟ@+cs>WMив1 pװ wY`4,]qRkJ4,( YBY4oI7N/BWXÂY7ѫ%,fRPL4jX 䛈lܞ!!>әY2άV p%Jj̀#E2GjcLKjـx si,QEC™,-}9z3J>?N_<=?ϦJY0~Q . -pex*&!~߈."B*]D P\Jn""b>صW$eu8-Q.o.)< y=Ry]Qet^nVr05m^=l}6c}\(//e XwX[XHߔL$ / đ.wvy='$h勓 [U?p\.ĴKCSq4 ::şŴO}Iğ~ߐ:.\?27b*8鐧?B~)}ᨤ5?[A]N$ oudnuR&b:O[He.-~',EtĈlp3RȩY@ciĮB[I a`O]w}m ۯmYX#T,L))c]7IJ&. Y -f 6vl.vyͿ鲴ㆎ@mc222^l[cdߧ[Vcp1ny#6c}` em᡹l[C81^Q`gҺ -cuW7)DBkŎzqVf몾i6fC8 ZtY*oϝabip8^*84)惩-oqш8}'pF`Cz>Ȳ7-0lW4*@#GBJ na1 r-ޯ?KIqi^d pBtԠUs"A<S"l|o?^9"s.Ӽ>AxBW'[yPc3c.f;r(,߂c}~NKk5ԴuP߶T^{={ko/wXo_f!i<++Bz$ނ8%d7^ 4d^'s'X0J$r}bβj 6P a\-)il9OYb7lU}\{Dk8qn7U&jFĞcӒ:eQg&8a-u,/ -g=>-:k0>ꍷk-2 J=/vo^7}oeC$9F\xㇵ7Ɣ_17:JHkV!v: 23wigfM=Cˍ2o;pHTe»}{Knzm?ވ+|[[tPUv }G.>uyZۖa [vM=%"Xz߄h졇vd(9'î!;9" Ji_w 7y iM7.@KfA2Z{('ު¾0SﺰlfEo__Ox͂j G Ǻ7I!];gߏH~Wܯ2.F] KIyiCʵtYKϋ=] cJ{m >S,+}|.59~|۵oh*gOouy|~ӲJe,sǙzɍAvs:L!S’Y=5ԍM[2]Ѵ]÷8WI%ui4@^ܻ4ӢKwa{t[Ckmۏ8=cj P:y9,ϵfHmb~lH^ N8^,6lb= DF䗓z,#ض.n["c?%&?PW#C&w&2F~z.pX!g{]lr(!VAض;$[O14LɎ)I!~Nuhf6kLՐ+BvhTjrZ(}nWh!MJG׏kPm)vviueK~9+(T~3u{Ԕ&3TF>Xn&%>f#4cC4`9lJfG}LJ{ֺilET6S H5XmFiX9 -:94S~Yj6Y6n'dž/#92&owJLobNrw56@:DI^W?v'N韧s>8!z+,{/|0|;jhI&ofJln36ZC;ǝ{w^[چqGb:Ȯ~LBl7/}]|"1Rb\.s~$!q%M.wạ#.Aq9LXd+1 IE~\Fȥ<8tM 80qҲGaA{Զ06ө~v;]Cm,?oANwZbс{A'J[MZQS).ݪZgUKQaܕ0Jܵqע%0sꫣ޲ŒYűwro+m?7箧yXwAbLw #3TVg_߂mOo#0jPZɾ"Rk%LSne]0m0T}ޭ:Ѯ4\sf*$KWY^XRFI?A -endstream -endobj -856 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 855 0 R -/Resources 4 0 R -/Annots [ 857 0 R 858 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -857 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 797.673057 101.433071 778.923057 ] -/BS << -/W 0 ->> -/Dest (cb228-1) ->> -endobj -858 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 446.531993 101.433071 427.781993 ] -/BS << -/W 0 ->> -/Dest (cb231-1) ->> -endobj -859 0 obj -<< -/Filter /FlateDecode -/Length 4384 ->> -stream -x\[, ~_1J NLy3>k;Tun58gٳR]T*T=lɹϧ_N֤`\T_YN&s8,J&Sgaw}aw}BPyI%h0p׳P Ǫpt`5,@ϓx%+O%jX.cT^1.ABX4,]*Ұ wY`AD#DjuX pyCа` ߌ0]W-9kX%aH!9 "հ wދkkiʃ,k*>dXx]km*D஄M b@@,kX3R԰  R> ɂY*pb XB%kX`r4QECBIY=l9}z'RXq_݀+SUXI.U !k !`q=t!n˹p[!ԕo.wrVGç}Qt$`[XHj"@!4 kfDIvy=(UE% -ZP?X4 NuKGɍЭw?zWL?Xo_vW~Zw^k&۹e:TmXZimJ< ~\S}y]89B \x9HȨ< Is\÷H -չu.-k[S" -#\g(cG[íH jy29i3: -ͮn &G>*= vyK6no~}7\8YI}]^kof]\$aHdg[wlxXm~w?)a&y8m܏wwv&o/kg{*a ;|:& 'js ڣG͇q=U3߇xy3{WlRzߌc|0V}w!=:>XJLNS"t\gTof|0rа.tAnwq=n8=wΑ$ɡqoa^)LJ[Ryox_\-koMrIdae!'cؽ-r"ˍi>$T+WPǖB^8aYg}%4puг~#W y:>P5o_}?߬aM!(,29-{@ackYTѬn&yz]iP'y܀;|oQgQ\I@þ߇=i{o&!^`Ee+ A,^lE5Y'WyĦMx͂0t,^Ϸ}]>5!P ıԴI/'k aCj .D a\VKh E>,,,|^[rOްxZik֊1,YR5?x<`V:ě}/v{tuEKWu:įp9j?n>IBKp[;p{¶;v7NqzF^÷ R> <aqmrCMU~][ÖŒ]hqC>#}^/{q3ͼZ>c]mCks;r0-a^@:ud9I y P8PrDZ7'e}lwB}y +};JLUs=d^'55s e&g˭۱=Cu<@ồKU{?#\W9JV=#vCg8gt~8Gw﫩Gk6ΆƎ:7g^q#OΒ܄C ꥔17L4coޭ֯VGEyrɍ[+v=rc!{"(a -g\Nᨩ,{apj+nTU.6O1e\J0|v*b -!5SZBF#)JS9kH']U;?ӳ~/wr}?#%a[R_,$O' -yd27B\?>5`eߒǑ=m5?n< ֈk -=;eָ,_8 W"E'yn;oىD;M7ȞTyͽ մhtjh-p't9)m?횼,s3$Jk.':Z;zwɻ]>dxd1&do{M!@a>Ur֎N}>p2-^N?j<-W9Y;m?O|;qo;Zd"Fn3=O?.YCOxͣZsgb:Ⱦn}k&\!^vZ%i -rpFH>OCJ.#.Aq9MXd1 IE~dbJ#Gn R`/͓<ЯvU<@;i Nz=P}9P&ߣ o.fyt[yRnͤ-PtLqRWU-S Oü+]aޕxh+㶈׳% P9ѲYŹwhIvsh{C82S;CWk|g;uZzxZ^=T@!,߁8OG#/sx"J晰lrUO`یi5zb%LQЀ9{8 ߅VŭB2I(_}HfƦd*(ysR -endstream -endobj -860 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 859 0 R -/Resources 4 0 R -/Annots [ 861 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -861 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 797.673057 101.433071 778.923057 ] -/BS << -/W 0 ->> -/Dest (cb234-1) ->> -endobj -862 0 obj -<< -/Filter /FlateDecode -/Length 4884 ->> -stream -x][~_D l$@"Xa;N8y?եKU/3g;.R"?R*9ٙK|<}:|>Xꡲr2(TOt_ǹ_ޔ = -ɤ -e)LJ>DKX#$g%%12 N1|r +!),g!֪<b+<Lң\|Qy <#21 Nc Y1d : KpVA4^,ɪ)ñ$ :Ӏ,d 5$ Y ְXaw=a  w!AO V{NcL $&ŧqeCYKI\Ql(6'(%8flCQN] h=}_s%U -ʮIwȋNۤoǜ/ F<+beߜ}sg:dK9/87xcBCMy(p7YS|dS˲EEew.A_:rnV򵞢.+߼?z` \_ $w?61lƒū̚-ichm;wb @@׈Tmv9xfokzmcn>(ļcCa#6Hy]dkkuF,"־uZKr|qڷ]mLHqiAyZti6%愵2-*]KU45\@1$km'f;u$pW3XGLS!%Xrc3 -YxyU*y"uDX7Tr7?XfuI>b'ʼZ %\QQh.]U^e5{c= {p 'YN!ra~)Wj;;$ASJ&dmmLW1), ܒ:oϜr0 j2ӵߘ]g0{xILI0F̻ ˗9vxԍ1yDa+ߗ{WC^!I4fnL|)[Vۼ=H83yvX>6-jp<!3+c6)qOcQ%49OJ^tE_ ³%KKs>J 8Jz;`x29Al5}퇯\naDT<\9@p ˗B*)4E_*\cY._ՎKv_7hQ[jIܝ~n}nf#Nns(a%Su1 V59 ڵ]aM3\K?lBmKe*'zRgV}6+_C͎(k TΛIY2(Tt0yRo{a^.cU;\A}XFMuD|OX]@on̮7pڀIz;HGnPW%<]pI -!Б`)[@wy; vixȶjc3[ѭf6]ql+*{IbFq_49nj/nh,r+'> ;c䈹/v&Q.OG ~`r:)0L֢GڟdQR:jiqBi|F"WocdC2( e lbBz^JʕrTa)N𧃤1]otZY!#w|-DpMI -.\BxV-2"jF'/d6Zb%&3AˎGśdGv"=N &Ѻ vgչi[YF<-mO*UnlM5&JVOyRHmM3&Y {)A-L^*i~2LrWB;MGؓ\=qMS}mܑE - {"Mvr^5*fMO*B -Immit"k%Q5 8N.RY_.[n/5N*4:xɮ[]' 5t 9tS~Zj&sA;fr3.oowF<[~n $|zgqPOܼ{iit9OKRtKo4Pǁlp>qo;Z+|'Y!o6(58<쭤:w&Épxh'2_:7#` ݐ\zפ<3nG#$&$EGHTsx:,Cbs']"?S!5)G<avn("Hi~f7wZV(Bؽxcvhԧ&x:c\?CGyh;4ۢ'95FjF'jՖami .@[LMTkj#ΪR)ﳦ<+]a++׳% P9QYŹv(I}h{C82S;]K|GTB+ԝerS[lrw> -endobj -864 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 393.004475 101.433071 374.254475 ] -/BS << -/W 0 ->> -/Dest (cb237-1) ->> -endobj -865 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 374.057453 99.933071 355.307453 ] -/BS << -/W 0 ->> -/Dest (cb237-2) ->> -endobj -866 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 355.110432 99.933071 336.360432 ] -/BS << -/W 0 ->> -/Dest (cb237-3) ->> -endobj -867 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 336.163410 99.933071 317.413410 ] -/BS << -/W 0 ->> -/Dest (cb237-4) ->> -endobj -868 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 317.216389 99.933071 298.466389 ] -/BS << -/W 0 ->> -/Dest (cb237-5) ->> -endobj -869 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 298.269367 99.933071 279.519367 ] -/BS << -/W 0 ->> -/Dest (cb237-6) ->> -endobj -870 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 279.322346 99.933071 260.572346 ] -/BS << -/W 0 ->> -/Dest (cb237-7) ->> -endobj -871 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 260.375324 99.933071 241.625324 ] -/BS << -/W 0 ->> -/Dest (cb237-8) ->> -endobj -872 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 241.428303 99.933071 222.678303 ] -/BS << -/W 0 ->> -/Dest (cb237-9) ->> -endobj -873 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 222.481281 99.933071 203.731281 ] -/BS << -/W 0 ->> -/Dest (cb237-10) ->> -endobj -874 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 203.534260 99.933071 184.784260 ] -/BS << -/W 0 ->> -/Dest (cb237-11) ->> -endobj -875 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 165.640217 99.933071 146.890217 ] -/BS << -/W 0 ->> -/Dest (cb237-12) ->> -endobj -876 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 127.746174 99.933071 108.996174 ] -/BS << -/W 0 ->> -/Dest (cb237-13) ->> -endobj -877 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 108.799152 99.933071 90.049152 ] -/BS << -/W 0 ->> -/Dest (cb237-14) ->> -endobj -878 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 89.852131 99.933071 71.102131 ] -/BS << -/W 0 ->> -/Dest (cb237-15) ->> -endobj -879 0 obj -<< -/Filter /FlateDecode -/Length 3166 ->> -stream -x͛[$ S̳aRIu`Cpa &M8X!_?t]zF綻&ٙV~g+?U9JӇm%{tf\ R,|?Wk_}ZˑMJ-jPJ)SvTn5O3RѨ3`XUV`F, -fpKQ1DDG)d8={!+qN$䢜ӵsN)lI%ؒX<lQe"YXx["]-` ebO$VU]]jH)*B9$Ħ:( R..–L:ؒآtDR3[n!aO`KE]l{P0qc@,%hA V Zz-E< ĖV<1t=#0lQ\W[<@@[Ex,Vo8{,fqfX @.By,0WNbJc5{,pWc"` cx,PpWw1j@fk% -J@X0c1܍wrpI~:[XXcAwas4h \1|.3o97 B%  |V`|=$p+w96X] c!0XBյ@V *HJ@ 8P<dpǂ "quEjX:L[gN#Y A -Oc=KTǂ ڲ dcAZ)cAnR>WǂB$ -uhҪǂa豠D؂c2ٷ=-w,Ԧ걠r ׮BcA)BŤXK< X=[0U<`) -5"3t [d{,@ ǂa A5V23y, -$\lY=TRE&i 0>N fW[$ǂZm7ǂZaKiⱠlA籠Q&{,ơ#Xиbc7ǂ&&xμmmY<4- )-H3o$7A'OaKl걠li#jLEf=MdޞTj;ЛGb*Gr `&v5XVdr E>7L>GTPfb70-sb@o|NN#EmM0Uؚ퀇f! :fDiHC73K1v_h2,6vgc$guJ0Ql _k =>gtg|~[!wot7OZ'F -gTl~@`Ҏ"ے],qcjF)iv2Coޜq *<~7Coޝ~ʶ7>2,TCkր"лׯxkOo>)(v^~V܆:W OTZB*ßpE?;^ll laϪǛ$Q%Y/yi' v%Yvw2u` Jgrȉy)՗SYFr7@TkBڦ}aG,d}w.eR//!|=4uC?6ј:o@aÑ(|*{M$1nP%D^(&9wݕ=wPKO!Z%}GI봇|phh_t^uC={l '=ϫ)IAy$j32"=RzDl5cYt~nʳ~AIǢnDT [r ݣnvFbכj8{¶G6JWox{t%IJfZ ,nztdvh^D;sQ|E`GujxoW|Aᖓ%-HK9=H.ˇɷU=_~6X}gأ=,9q}Y8W9^0JoM=HC+U^6O4-T/o8&_LpQG3&ܿhK;LuIL'ڿѸͱטXԫYn vvf[=P _aJfg ΊOYh[!-MqnSL:>tܘI|lx9΀m2d$9sjBk.:کv١ӾP \@F]6Z,ݦWn^*#_WOuT:*W-He͒#,TgI۾w_mm4$̔ftS1sR+ ,ElB5g'lؒȋ<~Vr{"J֞0AEo=iT&Z#^5UIvb[E{k=ڎeH5 -endstream -endobj -880 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 879 0 R -/Resources 4 0 R -/Annots [ 881 0 R 882 0 R 883 0 R 884 0 R 885 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -881 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb237-16) ->> -endobj -882 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb237-17) ->> -endobj -883 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb237-18) ->> -endobj -884 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb237-19) ->> -endobj -885 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 681.384971 101.433071 662.634971 ] -/BS << -/W 0 ->> -/Dest (cb238-1) ->> -endobj -886 0 obj -<< -/Filter /FlateDecode -/Length 3336 ->> -stream -x[K$ 賁%zH8!FzsGUIbusfgvٙ.zPRMJɻ<Bg%Rh!PqXzŸ~=_6]k9tGa1RK`5| +%lrpbk b‘YbpbA  -1K{VX#T V#DM ^H.Crm^(\8`9jK%fo S-/CMd+%B;U&kR&kK[\mɃGar1xdɃ,|xY?8jxk&O%caY Y|-BXRȂؒ܊x1X@@$P, 5y[X@D%2YX@@[XX@[-XX@[![X@\-, . ,, `.;-, .ܽXX@@]J9ZX@]-, .q0p-Md[Xtt*YX] -XX]Q`؊z g  B+>H0p7&Lݘ|c?dka=x,,@g."- wCC3|hBm‚ g 7Zv!faA"P "j w!R[N`&9&Pb jݬ -Y6eY,,h 㳰$M0PߌlaR‚FMl meY,,h YRY45oIo,^,-goV f`<,qp75 "3&2[ko ?Uv<1ބjx`/U1 w># s($܂=ǪFT~;O>=|OƏF'Lccj8A!"͊|"3!`z[b?I-:둎`t5Q[ɦ5EYҪ;D^.UQפPK;~/uK&N|0Ɓ&.%j!ZceUƿ*=*kr7Y5bPA#Yϣ.Z i:a-s qŰjPU6TQ;DmCٴI]^C-Xzs%Ueڙs`;NvЛ:o+8XX+`ٯ|B3e)#xs秜ޞ YTƎȑ㟰|p7އ߀"g)m !o-zhO~w n]w|ެ"8eT~&|OK{;LEٟuVDI>C]n[WqoyXlӼ㲍7e<Sw7ކw/&{|scW]4i/}*08'e ևqO&9ЖK[|OA?&Ǯ+.K'iNqtC6<=܌z_6{rW~;O?LuYٜ%s2>]x}-< - G6=sՋ躷tضom+ӆLi{/ =!%ZO#dZ -ǪMK%'~=P+ }?/CN_ }(X,9ޛGf.˦,ސ.{Ѿ{RVVtÍwްF! M.D~uqk' Jߕ^N6Ag_f,)njRr~\xiFڧLJ#$6 l2{޻yu{6CuW'Ɂ"{W-r!OGSuyZuA-ZΧ(|jRjhMj5\'$;?f,U?CYzr2Re֪i_,S:o.*,#,9\k_;儜vZX0=M$$WeQKkܝTIIUZoNQI'갥eU -L -tgULK HM8ôIX~9MSK4]>A{.ry2W=YM ye~5Kw5? >wW`VOBB]g9Կk/hm> ȗ mE>P]͚72> -endobj -888 0 obj -<< -/Filter /FlateDecode -/Length 3182 ->> -stream -x[MdadIUc! 8d0!x1؄8R_}ƞ" x=+JUG%]u8{ -W5Z[z?}8yWO/qw_I൸Z)K>_Ov/~=}τstLJ-'"j D+%LD98t5&hGQjb"1V"PCy5KP&BDC2(U%YH.bpب@Jd2sL%5,AT=AZ,C Z -tN# -]]ʠ>0YZU>ʢO.Ud!*CDar!]OʠKLIJ$ZEx LKE ` ]|ɌAxq@,iH VqZ29-E ĖV@) FޗƸ wmd\2.Ypd\VJf\ )eĸx EeE2.@b횴ʸD"12.( e`\. ܅ Sd\&s2.()c=2Y5UBa\P:LŁqR"K dA]* 03Y.H Ӆ,5Bd jXefϸ34֒05ufe\P5;K LSRtM0.b;1.M,s HRF[nVB#7 2>ggi28d3.hbq֛qA&x$nd[oMKBBeIS#q NzdĦ Zζެ f`n T[o]M d]dqnDfě -3.tzVe -3 _[#Met*mE>p}ڷ2ܡ`ά:~9V1ymO_{?w_k,HA0O0k_WdO`M 6RC0X ֎o!76d',"}vPW ^=njjYracYR0Y! psX.%J#P`C2kqf.p*{E(·|C;ixl.ؼB|rU~ -vpL}hӫefK_"Ru9?^{ٝ6ۿK΂/O9?^|B -o= q/|/GRg%^wx>|\|6uŶ4ϯߟ͟w|} O/G|Sq}_;ÿgڳ=k"*AuܪF)ޚMuoͧtwBϳ@-N4ۡRG~*|5:] O`3#]E3mW뼞mCvʽ3M}8/7m>́cOᦹ>-טo;,nhaj0WBYrnz |'mQzh9tK]!??ƠGHn1Ct#9k̍=:ovp"1vuYYz G,3:ˡC^z(>{Gn8돯-~ПS+m;حE>G6o@[QDGxb+Qe&0D؎NY;!o#0YwvÍ'uz{on^ԟ {*}H;I\]vi^z0)tÆ3OfDC*v\u9 .|k7 Xu/~֥a#X$5H1iXbc鴸§z;([~Bt9L{7H5AKu؜v RHwC7m8~V'yaz݄†}&WJ;xfGc9lf Γ;;\; 2n>?K)l_G# ~v \h\AfS梤lsKmܳp/|ױuǣl'Lf'믄dgl`ԍ*7y<ƍu=a2hLˆ eG+D淎͚o2:fĎa pwudMJY5Cq{7{lK;5!FM݇BfK#VL4W=ދR`o5썶;}ҟ^yC'OcN|;9eYl'3YR }tCz(Fu`wb0?Yc:aJTfNПvK}T>*;f-Leί3URض޷=f ]䕙Xz(Y9CYwBB]0Qk(ל!j‹mk䓟O{K"n(W -AeV(yڥO3_o -м-T%վP3/Fm{r -endstream -endobj -889 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 888 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -890 0 obj -<< -/Filter /FlateDecode -/Length 4326 ->> -stream -x\K$ ׯ˂l 1>Lbz >ST*BŇiz:CP(ORTe;jtVr<>)_jt[XLr-tLPLiɗ||:MSv:{ћֲw'b`J-&.(L)>e[X#U Fl5i, -B {V k(,g!֪<bc ^d25w&+5^&xSxfK%ƃ,1Ԣ2d 9XY|-A⡝*duUYlN`R1y&jV9gl3a ZdP Ǫpt`5,@ 0HK4,H]ZW[ְ w]f\˹iXTAÂ|V kX. Rk IÂbAH,Yb 6-aA%xaA)LsȾ\ BdLm1jXPRF=jM-kWsEÂRA(v2NaPaE J,p L5,H5,@ sTY jXP}EШ%j-ՙUÂTQ *M ʃ, ?Tl' PD KHQÂZ=UÂZ!^&՛EÂf! 2> ͆d YaAs/ެ`QoSLfѰEȒ<Ȃ)~ LB tx5,h9SY5,@zz$P,qp75 "3zV[o*tf'Л[# E*ꙁR@LT5`:X/Ä<0Y --"QsnBد?}@=769)`v -Ay6 ~jщ #:8ا5U]t1C ID(Pn)s:IsI+yԹ9Ԏ'l9&@ ѭHwa{vͭv.%zVciM֦jJnbE7"*pk2UW;ʄ&ymB䇍eL(l*&du„*zo)OkI4РEϩv4⸔ӿBYϺC^t277{sߙeW;O,W,7{s7T'/ox3ǻ=ܗ??@mX!}χo?翠~|xwֺ_:o-o߈3?7s;𛗿7awv& -YbCC8*uw)M"I=Kx]:x$8:?K&H",J;4ag?ȴ/->mu9BeG;.^~:kȋYM1X0Cc qrj2~g_cI\ee;!llMr{BvYN>"D಴OﷲmqSӶ]w_q!/㞦ײN{}XcuV4sXޔQ,Mt'QJɄ}@hƞ5-HVέU=坞nч'ۘY?lm^41Js|ΥXi:&viLR3=PeӢ{5ǪY9Ű{3uI_@>ْ۟Эdt;W /C(c;t}ROΕW{n>w ^]_V_+[c[QVu͞6kF˜@Ԧlp돎}]wc@x2j#>Lܾ.~7e:8~mm=VsUg:GQ_Ր^g]f5csu]ӤrMwyû|nra2ob{j\CmUS64/ko| >㴍CƁkLok!4 ic=Or9-;f_e϶ykw ?~\3:Ym$֒XKgE^ -p, -;&r DŸt@ؖ\YcV;t bsNO'z̓թ8`(=q읧o:&%'_d?}&պKr,S$UO/ucih,Į3m2@ϖ3 -rOKv -bn}dy= -=T'q.Us_T&iÖR<kA B6{ c}ApG|gy|kXXِ׸B:~hiT꼵(CWh'qzWrMDj쵭nx:8?_x+?Fp[WdcF2rmGF^u u+iP0]LBIXQЛy1';54 -Hrk"FۖINŀ ,ƈemjbRNrWܕKrR P\9rɪв{P;h{ˈS<3S;oK/¿p֋IѕCU9C"m*F祯3a;L G/Ex=C yۚUt. E}.ghҧ^(nb/> -endobj -892 0 obj -<< -/Filter /FlateDecode -/Length 4317 ->> -stream -x\K$ȳ%X 0vჁ6 :Ƣf2Pd2˞ `PG(2=~ ppԜ|ɻ,>Ysvj*rI ]s:_w'5 <+咳U 9J2X)8b bH 1Xc,@ U!F́-U -rɃ ,^ .-KW]JIc"'Exd %&Ēej -duY|UrR ɫ=/zqR lLv)e!KRMddaX‚A@Ƀ,֮R-Y(F r,,,@Dj@mb Y)ZX$s2[X%!V-^d+laAȥ\4\b‚\! pEDD/@ / J,-,( LxhPcyfpr*ZXmLHi `&ba$HsLd!a Jn J,G `of ,,,>9 -,罅5䛑-,|XXP#DgJIlaAe"QLdAT} LB tx Ԕ4, @, 7Y.J2Y<."da.o"r{f8Y1^o5K o͚jd &2˒̪*eE%s%MVl Ft?rZN~=N_~*e'&H7R rm8F0A3a4 !Q!r] ťB#lE*s@0y),%[7y'YW%Ѹ(g%!膯Qn`w<$K7ywYi!OBX/yM!JG! B5~G!7N{:O!O_~/Xfx\w8#a|D:]yzy5?\:kU#YҴn6s ڧp6S7w*3]tո1G5j 󝢥zqj~Wj3>e d$.j˲+R}.C?,o/HhQƆ /Nǜ.}sqH!?R@a]*qC煞ה B`̇MAYc`j='MH - v{,*w}cʲuWnqf^,ه,~$W)z]cz)"%!j|E'>ϜCTmX_ajօik͟;_fd1Cʜc/;'.L-=ؚ-jzy<`uARFq1G,Hz9] 8rh'*}>m -ABsڏ ݽXduK VsyÈUE0ɼ/U(~l'r`2?nn/JAJ)qcɎ_I1o̢&7CK[5g*3Nfz0'aZS䧛o\Z< [|#}|~\t8 ^ .|6;꟢n;O79oCznI%lYܜRVCzKI DUV>=ўGc}>LEaC_k&{8VK>Fݍ\8ajs3ϲ#Let<Y>{ R܅ zCR_17L+ 9 -zQ'\ˤx u0PѻXL5}!_ y&13;q_)RZ<OcwO$.1ľil5T.F/I.jCz-0~7}rHv5rñ.(P0h~#N{g;[+FoɏvۑxqownJzS MG.!m#rǺPJXҎE}/z}~i'~쫾pjIנ=<^R+^Kݟji՗n&m}2B߷>G@Ӓ\h=8Micz.ql7X PI/GNVblVJfGWb͈wGp?j}!]_Gm;9Bs f!C$ZYߵ1/m#k@|= M8u%pn;eG!m|^ Q]CgfZ)ŏӻe{ 3A=|l?R{G,=3ΛtYO2p~gG+$/i zm狥m:Nz8ro`PXƑN`#m?ǮFwwsJm:ADzޅ@R-WiuA\:qOD'iա´mr>"^Nn/&U>TnFPuP c d}haUӷG Gl&chU֮k~e5u*ChfJi}fKkd7x9 _Nֲbnz3q^V*EUؚWAUi&ϮW$7y갥ym;+> -endobj -894 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 766.923057 101.433071 748.173057 ] -/BS << -/W 0 ->> -/Dest (cb241-1) ->> -endobj -895 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 747.976036 99.933071 729.226036 ] -/BS << -/W 0 ->> -/Dest (cb241-2) ->> -endobj -896 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 729.029014 99.933071 710.279014 ] -/BS << -/W 0 ->> -/Dest (cb241-3) ->> -endobj -897 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 710.081993 99.933071 691.331993 ] -/BS << -/W 0 ->> -/Dest (cb241-4) ->> -endobj -898 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 691.134971 99.933071 672.384971 ] -/BS << -/W 0 ->> -/Dest (cb241-5) ->> -endobj -899 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 672.187950 99.933071 653.437950 ] -/BS << -/W 0 ->> -/Dest (cb241-6) ->> -endobj -900 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 653.240928 99.933071 634.490928 ] -/BS << -/W 0 ->> -/Dest (cb241-7) ->> -endobj -901 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 634.293907 99.933071 615.543907 ] -/BS << -/W 0 ->> -/Dest (cb241-8) ->> -endobj -902 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 615.346885 99.933071 596.596885 ] -/BS << -/W 0 ->> -/Dest (cb241-9) ->> -endobj -903 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 596.399864 99.933071 577.649864 ] -/BS << -/W 0 ->> -/Dest (cb241-10) ->> -endobj -904 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 577.452842 99.933071 558.702842 ] -/BS << -/W 0 ->> -/Dest (cb241-11) ->> -endobj -905 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 520.611778 99.933071 501.861778 ] -/BS << -/W 0 ->> -/Dest (cb241-12) ->> -endobj -906 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 501.664756 99.933071 482.914756 ] -/BS << -/W 0 ->> -/Dest (cb241-13) ->> -endobj -907 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 482.717735 99.933071 463.967735 ] -/BS << -/W 0 ->> -/Dest (cb241-14) ->> -endobj -908 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 463.770714 99.933071 445.020714 ] -/BS << -/W 0 ->> -/Dest (cb241-15) ->> -endobj -909 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 444.823692 99.933071 426.073692 ] -/BS << -/W 0 ->> -/Dest (cb241-16) ->> -endobj -910 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 425.876671 99.933071 407.126671 ] -/BS << -/W 0 ->> -/Dest (cb241-17) ->> -endobj -911 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 406.929649 99.933071 388.179649 ] -/BS << -/W 0 ->> -/Dest (cb241-18) ->> -endobj -912 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 345.982628 101.433071 327.232628 ] -/BS << -/W 0 ->> -/Dest (cb242-1) ->> -endobj -913 0 obj -<< -/Title (CIS v1.6 Benchmark - Self-Assessment Guide - Rancher v2.6) -/Dest [ 6 0 R /XYZ 85.009843 502.818898 0 ] -/Count 141 -/First 914 0 R -/Last 1050 0 R -/Parent 1055 0 R ->> -endobj -914 0 obj -<< -/Title (CIS v1.6 Kubernetes Benchmark - Rancher v2.6 with Kubernetes v1.18 to v1.21) -/Dest [ 304 0 R /XYZ 84.259843 784.970079 0 ] -/Count 2 -/First 915 0 R -/Last 916 0 R -/Parent 913 0 R -/Next 917 0 R ->> -endobj -915 0 obj -<< -/Title (Overview) -/Dest [ 304 0 R /XYZ 84.259843 704.822079 0 ] -/Count 0 -/Parent 914 0 R -/Next 916 0 R ->> -endobj -916 0 obj -<< -/Title (Testing controls methodology) -/Dest [ 304 0 R /XYZ 84.259843 166.076079 0 ] -/Count 0 -/Prev 915 0 R -/Parent 914 0 R ->> -endobj -917 0 obj -<< -/Title (Controls) -/Dest [ 309 0 R /XYZ 84.259843 612.381496 0 ] -/Count 0 -/Prev 914 0 R -/Parent 913 0 R -/Next 918 0 R ->> -endobj -918 0 obj -<< -/Title (1.1 Master Node Configuration Files) -/Dest [ 313 0 R /XYZ 41.740157 784.430079 0 ] -/Count 21 -/Prev 917 0 R -/First 919 0 R -/Last 939 0 R -/Parent 913 0 R -/Next 940 0 R ->> -endobj -919 0 obj -<< -/Title (1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 313 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 918 0 R -/Next 920 0 R ->> -endobj -920 0 obj -<< -/Title (1.1.2 Ensure that the API server pod specification file ownership is set to root:root \(Automated\)) -/Dest [ 313 0 R /XYZ 84.259843 553.851496 0 ] -/Count 0 -/Prev 919 0 R -/Parent 918 0 R -/Next 921 0 R ->> -endobj -921 0 obj -<< -/Title (1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 313 0 R /XYZ 84.259843 423.051496 0 ] -/Count 0 -/Prev 920 0 R -/Parent 918 0 R -/Next 922 0 R ->> -endobj -922 0 obj -<< -/Title (1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root \(Automated\)) -/Dest [ 313 0 R /XYZ 84.259843 277.251496 0 ] -/Count 0 -/Prev 921 0 R -/Parent 918 0 R -/Next 923 0 R ->> -endobj -923 0 obj -<< -/Title (1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 313 0 R /XYZ 84.259843 146.451496 0 ] -/Count 0 -/Prev 922 0 R -/Parent 918 0 R -/Next 924 0 R ->> -endobj -924 0 obj -<< -/Title (1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root \(Automated\)) -/Dest [ 315 0 R /XYZ 84.259843 739.970079 0 ] -/Count 0 -/Prev 923 0 R -/Parent 918 0 R -/Next 925 0 R ->> -endobj -925 0 obj -<< -/Title (1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 315 0 R /XYZ 84.259843 609.170079 0 ] -/Count 0 -/Prev 924 0 R -/Parent 918 0 R -/Next 926 0 R ->> -endobj -926 0 obj -<< -/Title (1.1.8 Ensure that the etcd pod specification file ownership is set to root:root \(Automated\)) -/Dest [ 315 0 R /XYZ 84.259843 478.370079 0 ] -/Count 0 -/Prev 925 0 R -/Parent 918 0 R -/Next 927 0 R ->> -endobj -927 0 obj -<< -/Title (1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive \(Manual\)) -/Dest [ 315 0 R /XYZ 84.259843 347.570079 0 ] -/Count 0 -/Prev 926 0 R -/Parent 918 0 R -/Next 928 0 R ->> -endobj -928 0 obj -<< -/Title (1.1.10 Ensure that the Container Network Interface file ownership is set to root:root \(Manual\)) -/Dest [ 315 0 R /XYZ 84.259843 170.823057 0 ] -/Count 0 -/Prev 927 0 R -/Parent 918 0 R -/Next 929 0 R ->> -endobj -929 0 obj -<< -/Title (1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive \(Automated\)) -/Dest [ 318 0 R /XYZ 84.259843 694.023057 0 ] -/Count 0 -/Prev 928 0 R -/Parent 918 0 R -/Next 930 0 R ->> -endobj -930 0 obj -<< -/Title (1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd \(Automated\)) -/Dest [ 318 0 R /XYZ 84.259843 365.776036 0 ] -/Count 0 -/Prev 929 0 R -/Parent 918 0 R -/Next 931 0 R ->> -endobj -931 0 obj -<< -/Title (1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 323 0 R /XYZ 84.259843 702.470079 0 ] -/Count 0 -/Prev 930 0 R -/Parent 918 0 R -/Next 932 0 R ->> -endobj -932 0 obj -<< -/Title (1.1.14 Ensure that the admin.conf file ownership is set to root:root \(Automated\)) -/Dest [ 323 0 R /XYZ 84.259843 586.670079 0 ] -/Count 0 -/Prev 931 0 R -/Parent 918 0 R -/Next 933 0 R ->> -endobj -933 0 obj -<< -/Title (1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 323 0 R /XYZ 84.259843 470.870079 0 ] -/Count 0 -/Prev 932 0 R -/Parent 918 0 R -/Next 934 0 R ->> -endobj -934 0 obj -<< -/Title (1.1.16 Ensure that the scheduler.conf file ownership is set to root:root \(Automated\)) -/Dest [ 323 0 R /XYZ 84.259843 340.070079 0 ] -/Count 0 -/Prev 933 0 R -/Parent 918 0 R -/Next 935 0 R ->> -endobj -935 0 obj -<< -/Title (1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 323 0 R /XYZ 84.259843 209.270079 0 ] -/Count 0 -/Prev 934 0 R -/Parent 918 0 R -/Next 936 0 R ->> -endobj -936 0 obj -<< -/Title (1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root \(Automated\)) -/Dest [ 325 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Prev 935 0 R -/Parent 918 0 R -/Next 937 0 R ->> -endobj -937 0 obj -<< -/Title (1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root \(Automated\)) -/Dest [ 325 0 R /XYZ 84.259843 668.570079 0 ] -/Count 0 -/Prev 936 0 R -/Parent 918 0 R -/Next 938 0 R ->> -endobj -938 0 obj -<< -/Title (1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 349 0 R /XYZ 84.259843 184.188585 0 ] -/Count 0 -/Prev 937 0 R -/Parent 918 0 R -/Next 939 0 R ->> -endobj -939 0 obj -<< -/Title (1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 \(Automated\)) -/Dest [ 440 0 R /XYZ 84.259843 702.470079 0 ] -/Count 0 -/Prev 938 0 R -/Parent 918 0 R ->> -endobj -940 0 obj -<< -/Title (1.2 API Server) -/Dest [ 508 0 R /XYZ 41.740157 784.430079 0 ] -/Count 35 -/Prev 918 0 R -/First 941 0 R -/Last 975 0 R -/Parent 913 0 R -/Next 976 0 R ->> -endobj -941 0 obj -<< -/Title (1.2.1 Ensure that the --anonymous-auth argument is set to false \(Automated\)) -/Dest [ 508 0 R /XYZ 84.259843 720.651496 0 ] -/Count 0 -/Parent 940 0 R -/Next 942 0 R ->> -endobj -942 0 obj -<< -/Title (1.2.2 Ensure that the --basic-auth-file argument is not set \(Automated\)) -/Dest [ 511 0 R /XYZ 84.259843 295.970079 0 ] -/Count 0 -/Prev 941 0 R -/Parent 940 0 R -/Next 943 0 R ->> -endobj -943 0 obj -<< -/Title (1.2.3 Ensure that the --token-auth-file parameter is not set \(Automated\)) -/Dest [ 516 0 R /XYZ 84.259843 595.970079 0 ] -/Count 0 -/Prev 942 0 R -/Parent 940 0 R -/Next 944 0 R ->> -endobj -944 0 obj -<< -/Title (1.2.4 Ensure that the --kubelet-https argument is set to true \(Automated\)) -/Dest [ 519 0 R /XYZ 84.259843 164.720079 0 ] -/Count 0 -/Prev 943 0 R -/Parent 940 0 R -/Next 945 0 R ->> -endobj -945 0 obj -<< -/Title (1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate \(Automated\)) -/Dest [ 524 0 R /XYZ 84.259843 427.220079 0 ] -/Count 0 -/Prev 944 0 R -/Parent 940 0 R -/Next 946 0 R ->> -endobj -946 0 obj -<< -/Title (1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate \(Automated\)) -/Dest [ 529 0 R /XYZ 84.259843 652.220079 0 ] -/Count 0 -/Prev 945 0 R -/Parent 940 0 R -/Next 947 0 R ->> -endobj -947 0 obj -<< -/Title (1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow \(Automated\)) -/Dest [ 532 0 R /XYZ 84.259843 183.470079 0 ] -/Count 0 -/Prev 946 0 R -/Parent 940 0 R -/Next 948 0 R ->> -endobj -948 0 obj -<< -/Title (1.2.8 Ensure that the --authorization-mode argument includes Node \(Automated\)) -/Dest [ 537 0 R /XYZ 84.259843 464.720079 0 ] -/Count 0 -/Prev 947 0 R -/Parent 940 0 R -/Next 949 0 R ->> -endobj -949 0 obj -<< -/Title (1.2.9 Ensure that the --authorization-mode argument includes RBAC \(Automated\)) -/Dest [ 542 0 R /XYZ 84.259843 745.970079 0 ] -/Count 0 -/Prev 948 0 R -/Parent 940 0 R -/Next 950 0 R ->> -endobj -950 0 obj -<< -/Title (1.2.10 Ensure that the admission control plugin EventRateLimit is set \(Automated\)) -/Dest [ 545 0 R /XYZ 84.259843 314.720079 0 ] -/Count 0 -/Prev 949 0 R -/Parent 940 0 R -/Next 951 0 R ->> -endobj -951 0 obj -<< -/Title (1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set \(Automated\)) -/Dest [ 550 0 R /XYZ 84.259843 520.970079 0 ] -/Count 0 -/Prev 950 0 R -/Parent 940 0 R -/Next 952 0 R ->> -endobj -952 0 obj -<< -/Title (1.2.12 Ensure that the admission control plugin AlwaysPullImages is set \(Manual\)) -/Dest [ 555 0 R /XYZ 84.259843 708.470079 0 ] -/Count 0 -/Prev 951 0 R -/Parent 940 0 R -/Next 953 0 R ->> -endobj -953 0 obj -<< -/Title (1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used \(Manual\)) -/Dest [ 555 0 R /XYZ 84.259843 501.723057 0 ] -/Count 0 -/Prev 952 0 R -/Parent 940 0 R -/Next 954 0 R ->> -endobj -954 0 obj -<< -/Title (1.2.14 Ensure that the admission control plugin ServiceAccount is set \(Automated\)) -/Dest [ 555 0 R /XYZ 84.259843 264.976036 0 ] -/Count 0 -/Prev 953 0 R -/Parent 940 0 R -/Next 955 0 R ->> -endobj -955 0 obj -<< -/Title (1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set \(Automated\)) -/Dest [ 562 0 R /XYZ 84.259843 520.970079 0 ] -/Count 0 -/Prev 954 0 R -/Parent 940 0 R -/Next 956 0 R ->> -endobj -956 0 obj -<< -/Title (1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set \(Automated\)) -/Dest [ 567 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Prev 955 0 R -/Parent 940 0 R -/Next 957 0 R ->> -endobj -957 0 obj -<< -/Title (1.2.17 Ensure that the admission control plugin NodeRestriction is set \(Automated\)) -/Dest [ 570 0 R /XYZ 84.259843 258.470079 0 ] -/Count 0 -/Prev 956 0 R -/Parent 940 0 R -/Next 958 0 R ->> -endobj -958 0 obj -<< -/Title (1.2.18 Ensure that the --insecure-bind-address argument is not set \(Automated\)) -/Dest [ 575 0 R /XYZ 84.259843 427.220079 0 ] -/Count 0 -/Prev 957 0 R -/Parent 940 0 R -/Next 959 0 R ->> -endobj -959 0 obj -<< -/Title (1.2.19 Ensure that the --insecure-port argument is set to 0 \(Automated\)) -/Dest [ 580 0 R /XYZ 84.259843 727.220079 0 ] -/Count 0 -/Prev 958 0 R -/Parent 940 0 R -/Next 960 0 R ->> -endobj -960 0 obj -<< -/Title (1.2.20 Ensure that the --secure-port argument is not set to 0 \(Automated\)) -/Dest [ 583 0 R /XYZ 84.259843 314.720079 0 ] -/Count 0 -/Prev 959 0 R -/Parent 940 0 R -/Next 961 0 R ->> -endobj -961 0 obj -<< -/Title (1.2.21 Ensure that the --profiling argument is set to false \(Automated\)) -/Dest [ 588 0 R /XYZ 84.259843 595.970079 0 ] -/Count 0 -/Prev 960 0 R -/Parent 940 0 R -/Next 962 0 R ->> -endobj -962 0 obj -<< -/Title (1.2.22 Ensure that the --audit-log-path argument is set \(Automated\)) -/Dest [ 591 0 R /XYZ 84.259843 183.470079 0 ] -/Count 0 -/Prev 961 0 R -/Parent 940 0 R -/Next 963 0 R ->> -endobj -963 0 obj -<< -/Title (1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate \(Automated\)) -/Dest [ 596 0 R /XYZ 84.259843 445.970079 0 ] -/Count 0 -/Prev 962 0 R -/Parent 940 0 R -/Next 964 0 R ->> -endobj -964 0 obj -<< -/Title (1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate \(Automated\)) -/Dest [ 601 0 R /XYZ 84.259843 727.220079 0 ] -/Count 0 -/Prev 963 0 R -/Parent 940 0 R -/Next 965 0 R ->> -endobj -965 0 obj -<< -/Title (1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate \(Automated\)) -/Dest [ 604 0 R /XYZ 84.259843 295.970079 0 ] -/Count 0 -/Prev 964 0 R -/Parent 940 0 R -/Next 966 0 R ->> -endobj -966 0 obj -<< -/Title (1.2.26 Ensure that the --request-timeout argument is set as appropriate \(Automated\)) -/Dest [ 609 0 R /XYZ 84.259843 595.970079 0 ] -/Count 0 -/Prev 965 0 R -/Parent 940 0 R -/Next 967 0 R ->> -endobj -967 0 obj -<< -/Title (1.2.27 Ensure that the --service-account-lookup argument is set to true \(Automated\)) -/Dest [ 612 0 R /XYZ 84.259843 164.720079 0 ] -/Count 0 -/Prev 966 0 R -/Parent 940 0 R -/Next 968 0 R ->> -endobj -968 0 obj -<< -/Title (1.2.28 Ensure that the --service-account-key-file argument is set as appropriate \(Automated\)) -/Dest [ 617 0 R /XYZ 84.259843 408.470079 0 ] -/Count 0 -/Prev 967 0 R -/Parent 940 0 R -/Next 969 0 R ->> -endobj -969 0 obj -<< -/Title (1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate \(Automated\)) -/Dest [ 622 0 R /XYZ 84.259843 689.720079 0 ] -/Count 0 -/Prev 968 0 R -/Parent 940 0 R -/Next 970 0 R ->> -endobj -970 0 obj -<< -/Title (1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate \(Automated\)) -/Dest [ 625 0 R /XYZ 84.259843 239.720079 0 ] -/Count 0 -/Prev 969 0 R -/Parent 940 0 R -/Next 971 0 R ->> -endobj -971 0 obj -<< -/Title (1.2.31 Ensure that the --client-ca-file argument is set as appropriate \(Automated\)) -/Dest [ 630 0 R /XYZ 84.259843 483.470079 0 ] -/Count 0 -/Prev 970 0 R -/Parent 940 0 R -/Next 972 0 R ->> -endobj -972 0 obj -<< -/Title (1.2.32 Ensure that the --etcd-cafile argument is set as appropriate \(Automated\)) -/Dest [ 635 0 R /XYZ 84.259843 745.970079 0 ] -/Count 0 -/Prev 971 0 R -/Parent 940 0 R -/Next 973 0 R ->> -endobj -973 0 obj -<< -/Title (1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate \(Automated\)) -/Dest [ 638 0 R /XYZ 84.259843 295.970079 0 ] -/Count 0 -/Prev 972 0 R -/Parent 940 0 R -/Next 974 0 R ->> -endobj -974 0 obj -<< -/Title (1.2.34 Ensure that encryption providers are appropriately configured \(Automated\)) -/Dest [ 643 0 R /XYZ 84.259843 577.220079 0 ] -/Count 0 -/Prev 973 0 R -/Parent 940 0 R -/Next 975 0 R ->> -endobj -975 0 obj -<< -/Title (1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers \(Automated\)) -/Dest [ 660 0 R /XYZ 84.259843 411.552842 0 ] -/Count 0 -/Prev 974 0 R -/Parent 940 0 R ->> -endobj -976 0 obj -<< -/Title (1.3 Controller Manager) -/Dest [ 674 0 R /XYZ 41.740157 784.430079 0 ] -/Count 7 -/Prev 940 0 R -/First 977 0 R -/Last 983 0 R -/Parent 913 0 R -/Next 984 0 R ->> -endobj -977 0 obj -<< -/Title (1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate \(Automated\)) -/Dest [ 674 0 R /XYZ 84.259843 720.651496 0 ] -/Count 0 -/Parent 976 0 R -/Next 978 0 R ->> -endobj -978 0 obj -<< -/Title (1.3.2 Ensure that the --profiling argument is set to false \(Automated\)) -/Dest [ 677 0 R /XYZ 84.259843 727.220079 0 ] -/Count 0 -/Prev 977 0 R -/Parent 976 0 R -/Next 979 0 R ->> -endobj -979 0 obj -<< -/Title (1.3.3 Ensure that the --use-service-account-credentials argument is set to true \(Automated\)) -/Dest [ 680 0 R /XYZ 84.259843 745.970079 0 ] -/Count 0 -/Prev 978 0 R -/Parent 976 0 R -/Next 980 0 R ->> -endobj -980 0 obj -<< -/Title (1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate \(Automated\)) -/Dest [ 683 0 R /XYZ 84.259843 745.970079 0 ] -/Count 0 -/Prev 979 0 R -/Parent 976 0 R -/Next 981 0 R ->> -endobj -981 0 obj -<< -/Title (1.3.5 Ensure that the --root-ca-file argument is set as appropriate \(Automated\)) -/Dest [ 686 0 R /XYZ 84.259843 727.220079 0 ] -/Count 0 -/Prev 980 0 R -/Parent 976 0 R -/Next 982 0 R ->> -endobj -982 0 obj -<< -/Title (1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true \(Automated\)) -/Dest [ 689 0 R /XYZ 84.259843 727.220079 0 ] -/Count 0 -/Prev 981 0 R -/Parent 976 0 R -/Next 983 0 R ->> -endobj -983 0 obj -<< -/Title (1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 \(Automated\)) -/Dest [ 689 0 R /XYZ 84.259843 524.420079 0 ] -/Count 0 -/Prev 982 0 R -/Parent 976 0 R ->> -endobj -984 0 obj -<< -/Title (1.4 Scheduler) -/Dest [ 694 0 R /XYZ 41.740157 784.430079 0 ] -/Count 2 -/Prev 976 0 R -/First 985 0 R -/Last 986 0 R -/Parent 913 0 R -/Next 987 0 R ->> -endobj -985 0 obj -<< -/Title (1.4.1 Ensure that the --profiling argument is set to false \(Automated\)) -/Dest [ 694 0 R /XYZ 84.259843 720.651496 0 ] -/Count 0 -/Parent 984 0 R -/Next 986 0 R ->> -endobj -986 0 obj -<< -/Title (1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 \(Automated\)) -/Dest [ 694 0 R /XYZ 84.259843 257.404475 0 ] -/Count 0 -/Prev 985 0 R -/Parent 984 0 R ->> -endobj -987 0 obj -<< -/Title (2 Etcd Node Configuration Files) -/Dest [ 700 0 R /XYZ 41.740157 784.430079 0 ] -/Count 7 -/Prev 984 0 R -/First 988 0 R -/Last 994 0 R -/Parent 913 0 R -/Next 995 0 R ->> -endobj -988 0 obj -<< -/Title (2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate \(Automated\)) -/Dest [ 700 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 987 0 R -/Next 989 0 R ->> -endobj -989 0 obj -<< -/Title (2.2 Ensure that the --client-cert-auth argument is set to true \(Automated\)) -/Dest [ 705 0 R /XYZ 84.259843 464.720079 0 ] -/Count 0 -/Prev 988 0 R -/Parent 987 0 R -/Next 990 0 R ->> -endobj -990 0 obj -<< -/Title (2.3 Ensure that the --auto-tls argument is not set to true \(Automated\)) -/Dest [ 710 0 R /XYZ 84.259843 258.470079 0 ] -/Count 0 -/Prev 989 0 R -/Parent 987 0 R -/Next 991 0 R ->> -endobj -991 0 obj -<< -/Title (2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate \(Automated\)) -/Dest [ 717 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Prev 990 0 R -/Parent 987 0 R -/Next 992 0 R ->> -endobj -992 0 obj -<< -/Title (2.5 Ensure that the --peer-client-cert-auth argument is set to true \(Automated\)) -/Dest [ 722 0 R /XYZ 84.259843 558.470079 0 ] -/Count 0 -/Prev 991 0 R -/Parent 987 0 R -/Next 993 0 R ->> -endobj -993 0 obj -<< -/Title (2.6 Ensure that the --peer-auto-tls argument is not set to true \(Automated\)) -/Dest [ 727 0 R /XYZ 84.259843 333.470079 0 ] -/Count 0 -/Prev 992 0 R -/Parent 987 0 R -/Next 994 0 R ->> -endobj -994 0 obj -<< -/Title (2.7 Ensure that a unique Certificate Authority is used for etcd \(Automated\)) -/Dest [ 734 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Prev 993 0 R -/Parent 987 0 R ->> -endobj -995 0 obj -<< -/Title (3.1 Authentication and Authorization) -/Dest [ 741 0 R /XYZ 41.740157 784.430079 0 ] -/Count 1 -/Prev 987 0 R -/First 996 0 R -/Last 996 0 R -/Parent 913 0 R -/Next 997 0 R ->> -endobj -996 0 obj -<< -/Title (3.1.1 Client certificate authentication should not be used for users \(Manual\)) -/Dest [ 741 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 995 0 R ->> -endobj -997 0 obj -<< -/Title (3.2 Logging) -/Dest [ 743 0 R /XYZ 41.740157 784.430079 0 ] -/Count 2 -/Prev 995 0 R -/First 998 0 R -/Last 999 0 R -/Parent 913 0 R -/Next 1000 0 R ->> -endobj -998 0 obj -<< -/Title (3.2.1 Ensure that a minimal audit policy is created \(Automated\)) -/Dest [ 743 0 R /XYZ 84.259843 720.651496 0 ] -/Count 0 -/Parent 997 0 R -/Next 999 0 R ->> -endobj -999 0 obj -<< -/Title (3.2.2 Ensure that the audit policy covers key security concerns \(Manual\)) -/Dest [ 746 0 R /XYZ 84.259843 333.470079 0 ] -/Count 0 -/Prev 998 0 R -/Parent 997 0 R ->> -endobj -1000 0 obj -<< -/Title (4.1 Worker Node Configuration Files) -/Dest [ 748 0 R /XYZ 41.740157 784.430079 0 ] -/Count 10 -/Prev 997 0 R -/First 1001 0 R -/Last 1010 0 R -/Parent 913 0 R -/Next 1011 0 R ->> -endobj -1001 0 obj -<< -/Title (4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 748 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 1000 0 R -/Next 1002 0 R ->> -endobj -1002 0 obj -<< -/Title (4.1.2 Ensure that the kubelet service file ownership is set to root:root \(Automated\)) -/Dest [ 748 0 R /XYZ 84.259843 553.851496 0 ] -/Count 0 -/Prev 1001 0 R -/Parent 1000 0 R -/Next 1003 0 R ->> -endobj -1003 0 obj -<< -/Title (4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 748 0 R /XYZ 84.259843 423.051496 0 ] -/Count 0 -/Prev 1002 0 R -/Parent 1000 0 R -/Next 1004 0 R ->> -endobj -1004 0 obj -<< -/Title (4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root \(Automated\)) -/Dest [ 751 0 R /XYZ 84.259843 763.220079 0 ] -/Count 0 -/Prev 1003 0 R -/Parent 1000 0 R -/Next 1005 0 R ->> -endobj -1005 0 obj -<< -/Title (4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 751 0 R /XYZ 84.259843 454.079014 0 ] -/Count 0 -/Prev 1004 0 R -/Parent 1000 0 R -/Next 1006 0 R ->> -endobj -1006 0 obj -<< -/Title (4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root \(Automated\)) -/Dest [ 751 0 R /XYZ 84.259843 163.687950 0 ] -/Count 0 -/Prev 1005 0 R -/Parent 1000 0 R -/Next 1007 0 R ->> -endobj -1007 0 obj -<< -/Title (4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 755 0 R /XYZ 84.259843 519.629014 0 ] -/Count 0 -/Prev 1006 0 R -/Parent 1000 0 R -/Next 1008 0 R ->> -endobj -1008 0 obj -<< -/Title (4.1.8 Ensure that the client certificate authorities file ownership is set to root:root \(Automated\)) -/Dest [ 764 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Prev 1007 0 R -/Parent 1000 0 R -/Next 1009 0 R ->> -endobj -1009 0 obj -<< -/Title (4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive \(Automated\)) -/Dest [ 764 0 R /XYZ 84.259843 383.493907 0 ] -/Count 0 -/Prev 1008 0 R -/Parent 1000 0 R -/Next 1010 0 R ->> -endobj -1010 0 obj -<< -/Title (4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root \(Automated\)) -/Dest [ 764 0 R /XYZ 84.259843 195.693907 0 ] -/Count 0 -/Prev 1009 0 R -/Parent 1000 0 R ->> -endobj -1011 0 obj -<< -/Title (4.2 Kubelet) -/Dest [ 774 0 R /XYZ 41.740157 784.430079 0 ] -/Count 13 -/Prev 1000 0 R -/First 1012 0 R -/Last 1024 0 R -/Parent 913 0 R -/Next 1025 0 R ->> -endobj -1012 0 obj -<< -/Title (4.2.1 Ensure that the anonymous-auth argument is set to false \(Automated\)) -/Dest [ 774 0 R /XYZ 84.259843 720.651496 0 ] -/Count 0 -/Parent 1011 0 R -/Next 1013 0 R ->> -endobj -1013 0 obj -<< -/Title (4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow \(Automated\)) -/Dest [ 774 0 R /XYZ 84.259843 332.207453 0 ] -/Count 0 -/Prev 1012 0 R -/Parent 1011 0 R -/Next 1014 0 R ->> -endobj -1014 0 obj -<< -/Title (4.2.3 Ensure that the --client-ca-file argument is set as appropriate \(Automated\)) -/Dest [ 779 0 R /XYZ 84.259843 675.273057 0 ] -/Count 0 -/Prev 1013 0 R -/Parent 1011 0 R -/Next 1015 0 R ->> -endobj -1015 0 obj -<< -/Title (4.2.4 Ensure that the --read-only-port argument is set to 0 \(Automated\)) -/Dest [ 779 0 R /XYZ 84.259843 301.829014 0 ] -/Count 0 -/Prev 1014 0 R -/Parent 1011 0 R -/Next 1016 0 R ->> -endobj -1016 0 obj -<< -/Title (4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 \(Automated\)) -/Dest [ 784 0 R /XYZ 84.259843 641.326036 0 ] -/Count 0 -/Prev 1015 0 R -/Parent 1011 0 R -/Next 1017 0 R ->> -endobj -1017 0 obj -<< -/Title (4.2.6 Ensure that the --protect-kernel-defaults argument is set to true \(Automated\)) -/Dest [ 790 0 R /XYZ 84.259843 445.970079 0 ] -/Count 0 -/Prev 1016 0 R -/Parent 1011 0 R -/Next 1018 0 R ->> -endobj -1018 0 obj -<< -/Title (4.2.7 Ensure that the --make-iptables-util-chains argument is set to true \(Automated\)) -/Dest [ 794 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Prev 1017 0 R -/Parent 1011 0 R -/Next 1019 0 R ->> -endobj -1019 0 obj -<< -/Title (4.2.8 Ensure that the --hostname-override argument is not set \(Manual\)) -/Dest [ 794 0 R /XYZ 84.259843 425.926036 0 ] -/Count 0 -/Prev 1018 0 R -/Parent 1011 0 R -/Next 1020 0 R ->> -endobj -1020 0 obj -<< -/Title (4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture \(Automated\)) -/Dest [ 794 0 R /XYZ 84.259843 208.126036 0 ] -/Count 0 -/Prev 1019 0 R -/Parent 1011 0 R -/Next 1021 0 R ->> -endobj -1021 0 obj -<< -/Title (4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate \(Automated\)) -/Dest [ 798 0 R /XYZ 84.259843 542.326036 0 ] -/Count 0 -/Prev 1020 0 R -/Parent 1011 0 R -/Next 1022 0 R ->> -endobj -1022 0 obj -<< -/Title (4.2.11 Ensure that the --rotate-certificates argument is not set to false \(Automated\)) -/Dest [ 798 0 R /XYZ 84.259843 138.881993 0 ] -/Count 0 -/Prev 1021 0 R -/Parent 1011 0 R -/Next 1023 0 R ->> -endobj -1023 0 obj -<< -/Title (4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true \(Automated\)) -/Dest [ 808 0 R /XYZ 84.259843 670.970079 0 ] -/Count 0 -/Prev 1022 0 R -/Parent 1011 0 R -/Next 1024 0 R ->> -endobj -1024 0 obj -<< -/Title (4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers \(Automated\)) -/Dest [ 808 0 R /XYZ 84.259843 392.223057 0 ] -/Count 0 -/Prev 1023 0 R -/Parent 1011 0 R ->> -endobj -1025 0 obj -<< -/Title (5.1 RBAC and Service Accounts) -/Dest [ 815 0 R /XYZ 41.740157 784.430079 0 ] -/Count 6 -/Prev 1011 0 R -/First 1026 0 R -/Last 1031 0 R -/Parent 913 0 R -/Next 1032 0 R ->> -endobj -1026 0 obj -<< -/Title (5.1.1 Ensure that the cluster-admin role is only used where required \(Manual\)) -/Dest [ 815 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 1025 0 R -/Next 1027 0 R ->> -endobj -1027 0 obj -<< -/Title (5.1.2 Minimize access to secrets \(Manual\)) -/Dest [ 815 0 R /XYZ 84.259843 523.851496 0 ] -/Count 0 -/Prev 1026 0 R -/Parent 1025 0 R -/Next 1028 0 R ->> -endobj -1028 0 obj -<< -/Title (5.1.3 Minimize wildcard use in Roles and ClusterRoles \(Manual\)) -/Dest [ 815 0 R /XYZ 84.259843 423.051496 0 ] -/Count 0 -/Prev 1027 0 R -/Parent 1025 0 R -/Next 1029 0 R ->> -endobj -1029 0 obj -<< -/Title (5.1.4 Minimize access to create pods \(Manual\)) -/Dest [ 815 0 R /XYZ 84.259843 307.251496 0 ] -/Count 0 -/Prev 1028 0 R -/Parent 1025 0 R -/Next 1030 0 R ->> -endobj -1030 0 obj -<< -/Title (5.1.5 Ensure that default service accounts are not actively used. \(Automated\)) -/Dest [ 815 0 R /XYZ 84.259843 206.451496 0 ] -/Count 0 -/Prev 1029 0 R -/Parent 1025 0 R -/Next 1031 0 R ->> -endobj -1031 0 obj -<< -/Title (5.1.6 Ensure that Service Account Tokens are only mounted where necessary \(Manual\)) -/Dest [ 842 0 R /XYZ 84.259843 449.446885 0 ] -/Count 0 -/Prev 1030 0 R -/Parent 1025 0 R ->> -endobj -1032 0 obj -<< -/Title (5.2 Pod Security Policies) -/Dest [ 853 0 R /XYZ 41.740157 784.430079 0 ] -/Count 9 -/Prev 1025 0 R -/First 1033 0 R -/Last 1041 0 R -/Parent 913 0 R -/Next 1042 0 R ->> -endobj -1033 0 obj -<< -/Title (5.2.1 Minimize the admission of privileged containers \(Manual\)) -/Dest [ 853 0 R /XYZ 84.259843 720.651496 0 ] -/Count 0 -/Parent 1032 0 R -/Next 1034 0 R ->> -endobj -1034 0 obj -<< -/Title (5.2.2 Minimize the admission of containers wishing to share the host process ID namespace \(Automated\)) -/Dest [ 853 0 R /XYZ 84.259843 589.851496 0 ] -/Count 0 -/Prev 1033 0 R -/Parent 1032 0 R -/Next 1035 0 R ->> -endobj -1035 0 obj -<< -/Title (5.2.3 Minimize the admission of containers wishing to share the host IPC namespace \(Automated\)) -/Dest [ 853 0 R /XYZ 84.259843 238.710432 0 ] -/Count 0 -/Prev 1034 0 R -/Parent 1032 0 R -/Next 1036 0 R ->> -endobj -1036 0 obj -<< -/Title (5.2.4 Minimize the admission of containers wishing to share the host network namespace \(Automated\)) -/Dest [ 856 0 R /XYZ 84.259843 603.629014 0 ] -/Count 0 -/Prev 1035 0 R -/Parent 1032 0 R -/Next 1037 0 R ->> -endobj -1037 0 obj -<< -/Title (5.2.5 Minimize the admission of containers with allowPrivilegeEscalation \(Automated\)) -/Dest [ 856 0 R /XYZ 84.259843 252.487950 0 ] -/Count 0 -/Prev 1036 0 R -/Parent 1032 0 R -/Next 1038 0 R ->> -endobj -1038 0 obj -<< -/Title (5.2.6 Minimize the admission of root containers \(Manual\)) -/Dest [ 860 0 R /XYZ 84.259843 584.681993 0 ] -/Count 0 -/Prev 1037 0 R -/Parent 1032 0 R -/Next 1039 0 R ->> -endobj -1039 0 obj -<< -/Title (5.2.7 Minimize the admission of containers with the NET_RAW capability \(Manual\)) -/Dest [ 860 0 R /XYZ 84.259843 453.881993 0 ] -/Count 0 -/Prev 1038 0 R -/Parent 1032 0 R -/Next 1040 0 R ->> -endobj -1040 0 obj -<< -/Title (5.2.8 Minimize the admission of containers with added capabilities \(Manual\)) -/Dest [ 860 0 R /XYZ 84.259843 323.081993 0 ] -/Count 0 -/Prev 1039 0 R -/Parent 1032 0 R -/Next 1041 0 R ->> -endobj -1041 0 obj -<< -/Title (5.2.9 Minimize the admission of containers with capabilities assigned \(Manual\)) -/Dest [ 860 0 R /XYZ 84.259843 207.281993 0 ] -/Count 0 -/Prev 1040 0 R -/Parent 1032 0 R ->> -endobj -1042 0 obj -<< -/Title (5.3 Network Policies and CNI) -/Dest [ 863 0 R /XYZ 41.740157 784.430079 0 ] -/Count 2 -/Prev 1032 0 R -/First 1043 0 R -/Last 1044 0 R -/Parent 913 0 R -/Next 1045 0 R ->> -endobj -1043 0 obj -<< -/Title (5.3.1 Ensure that the CNI in use supports Network Policies \(Manual\)) -/Dest [ 863 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 1042 0 R -/Next 1044 0 R ->> -endobj -1044 0 obj -<< -/Title (5.3.2 Ensure that all Namespaces have Network Policies defined \(Automated\)) -/Dest [ 863 0 R /XYZ 84.259843 538.851496 0 ] -/Count 0 -/Prev 1043 0 R -/Parent 1042 0 R ->> -endobj -1045 0 obj -<< -/Title (5.4 Secrets Management) -/Dest [ 887 0 R /XYZ 41.740157 784.430079 0 ] -/Count 2 -/Prev 1042 0 R -/First 1046 0 R -/Last 1047 0 R -/Parent 913 0 R -/Next 1048 0 R ->> -endobj -1046 0 obj -<< -/Title (5.4.1 Prefer using secrets as files over secrets as environment variables \(Manual\)) -/Dest [ 887 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 1045 0 R -/Next 1047 0 R ->> -endobj -1047 0 obj -<< -/Title (5.4.2 Consider external secret storage \(Manual\)) -/Dest [ 887 0 R /XYZ 84.259843 568.851496 0 ] -/Count 0 -/Prev 1046 0 R -/Parent 1045 0 R ->> -endobj -1048 0 obj -<< -/Title (5.5 Extensible Admission Control) -/Dest [ 889 0 R /XYZ 41.740157 784.430079 0 ] -/Count 1 -/Prev 1045 0 R -/First 1049 0 R -/Last 1049 0 R -/Parent 913 0 R -/Next 1050 0 R ->> -endobj -1049 0 obj -<< -/Title (5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller \(Manual\)) -/Dest [ 889 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 1048 0 R ->> -endobj -1050 0 obj -<< -/Title (5.7 General Policies) -/Dest [ 891 0 R /XYZ 41.740157 784.430079 0 ] -/Count 4 -/Prev 1048 0 R -/First 1051 0 R -/Last 1054 0 R -/Parent 913 0 R ->> -endobj -1051 0 obj -<< -/Title (5.7.1 Create administrative boundaries between resources using namespaces \(Manual\)) -/Dest [ 891 0 R /XYZ 84.259843 720.651496 0 ] -/Count 0 -/Parent 1050 0 R -/Next 1052 0 R ->> -endobj -1052 0 obj -<< -/Title (5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions \(Manual\)) -/Dest [ 891 0 R /XYZ 84.259843 604.851496 0 ] -/Count 0 -/Prev 1051 0 R -/Parent 1050 0 R -/Next 1053 0 R ->> -endobj -1053 0 obj -<< -/Title (5.7.3 Apply Security Context to Your Pods and Containers \(Manual\)) -/Dest [ 891 0 R /XYZ 84.259843 324.051496 0 ] -/Count 0 -/Prev 1052 0 R -/Parent 1050 0 R -/Next 1054 0 R ->> -endobj -1054 0 obj -<< -/Title (5.7.4 The default namespace should not be used \(Automated\)) -/Dest [ 891 0 R /XYZ 84.259843 193.251496 0 ] -/Count 0 -/Prev 1053 0 R -/Parent 1050 0 R ->> -endobj -1055 0 obj -<< -/Count 142 -/First 913 0 R -/Last 913 0 R ->> -endobj -1056 0 obj -<< -/Length1 41004 -/Filter /FlateDecode -/Length 7589 ->> -stream -x| xUut;YH',-11 EB$!`B'AIT&d 0Ȍ -88L@f:cLnx9ֽrι{?R R23[1i& ǩ=x~sg7;@>x>|- `wbkͷSF'N+KX-NSE@7T^7y\L`ySgξ}/{6eꌅy3 *ϟ}7*zSTKsr> @pFEiY3s+ ,\R{ϬSy `=m&s3|Pu'<\G PɕMƎKIEfJ H[&*DC -4i#w# `QD|77(|;FLv)XVx[ -_p rߧe)s*`i -:iO(N(svx{̦1f0[xqpD'[yZ#j5nQ`,gz‹:tСC:tСC:tСC:tСC:tСC:tСC:tСC:tСC:tСC:to%2Ckmԯ9)e]twj, - Ca4@Lߪ~=6zzt= 0洶^9~7ADtj*r<|ht(^*W:4׊|oxUx~5_/_=^io.xqwӻp'Ǘ8݁8*[%Iun |0\|nMz. 7p 帾*@Zϱ*+Se{*Kgt8*XQ>Q8KxXŧ8YSZquO||n,[eʜʌTQ+IS+Ž|]Zqดc G_KHs\bTEr|̊ ,8߄8m¢&ӄcYgDtHiT*q1d8&|؂9ǙM8΄IX 1.lPIs2}GkFr׆#8'9jЈi `U8 -rG!ӄDZ?ǻtHw9Ό@Nf 2|/rN&&vbtˆf=0663$L6cF {{*vꕺb$ՋILLJwcf)>f1&Ihzr1 #I\@7i1 0*q T`.NANm 梕c%X -h֖`4s4Qf -G\HBEN^& =8Z)/"X:g;~u6T `̣7V&p QR8E` j>As>YqxP%֊ų[,ϊbKíXi]}M! -jE(#-a8PE/~I2,$߲u_YCWr ?<6:Fխ3'qӒK*HgdL!0FV6(CtI'tI'tI'tI'tI'tI'tI'tI'tI't鿟L4A.(~DwoƔhWt|SJW Px$7Ns~zKqtL`(TKOڨDn(f^8f\514ǰ( -{Gۥto8lÆ5o- ta7 PE 6ºc.`$qm}]@sL3Cl(Gؚ׸ 51"NOo<~uMb҇x> a0.|y^e2lYe;ag}"L齠w^Ȇ^RES6ʄ#Si9s-:?0~} ھ3]P5woKwm/[/U$`/.HmՖ5^Kp/-I@kpvU%:<gY,-@0Md12\ļ*rB6N ڼy]8o w`L׾-*b#~Gn9zt#ڸx7݃w3{-dHoUlR>Y@6;`'DA]Sf7  вZiIQ 4T2|(}Q2 Q5|# zcQ;n?kX@C`>0"hY0,SY/,9cJ)[%,<+l*1Vhb1cz~U⯅>jydd͍$v=04+OJQv"EI`uKaFp;hZf:d}4ӥ]r 0d`hmb;2^Z-)c3l/"g֭]rŕZN|^z -!U0gv˶:=g}}E0źTig[`X־!,R.*ip5``xT@fCzdàZ_c6.=zedW^&]xa~?~ܐ!l3u`q>>H+>Wu&Rv1-4l$ޚOvp_GGe13Tͷyl5{if((l^ͯ+,9h)fYlÐ?>{KZk 5B g4ϨV H|R-K%ybP=;HƑ8A$QD.8@ x,J2n),Lw1B F:cG: ]<6Ǣ &$.1DyxL Jً2Y/I Vɫ X{=ڣ&M,>uw]g?~}>{͠yyKi>qJ&I>#}-WK/_U$㾌`5 QQ0&sdb\Zi+a 61d -7@Lx!hdcscGM/ ¯)'0s(*)9$۷?CB MoKK WX--nr}a!ODf^KOCޠUZU[(&{7POa9h]!rYu][k_b 0*(Ti=ߘjזdfoz2JHLJDOE"}Q>/ɊΊJ(LXQYU)^SPp-!k{ّQٞ¨BOaȥQK=KCo:s{c/ĐzEw>QgZ~bKrl¿_'}|0iDrNl}duϞUz / /VUue*S] U#8jhw^6~)>s`-|ixExu:-rZisbxy Y֫Y/w!{utnvű9XXZAJ ; t.u`uIk-[O aadh~vjʡȥՑ:6 vobݿLk[N;w>KxHxƝ9l Spי˗m|8ƕ*ɵIuv4QkYw K#p[cOFRˆ"EH?/wdcwSUn8[Uptpn5LчASA,i>`9{S&7_XRWP+l_*<<ةo׵;3??M$` ]x[1Kf*כ hTݲIuf-jy5d8ٜqC8 t ۮR!\.[lzj?j&˒u55^'7'#!Pu/ V&Z&&(0RݹNg_WF2сlvڵvQ&ͮ1vʽuu^w-a[C¦͛mk)-~ RBYatYc~$ؚ3Uskhn$},cHHvz8QKBx&EI]%]%GsI@FYbLffU')eNFh6-B{DLJ $IݔB0U)H˄273B^yQpP<( f1AL >K>f[pX&=%6zn|I:dxx .^L x1b ޿_k9U';K-[ --7s 4oH[!^(]dHa6]"h_0apYJ#-bv.IDMV[ϭjfn[b4j~45C u:ք5(TsDmwlb(K %JTb.XKKl%bGuص0o= {uh=5WxӗyԷy#Bny'ïFځ^d3KzIV@t(`V U'($E Kuu}ƃc-Hy%f+s͖bmwes,T=Ｕ7bQՠ8c%\){t>nən$7b DsנdgkpbdbT'):.aiyeeCUBdlF цa-F'=T4":ZR(o ` KsBY٤uOnGޘVβ5S<%&mC?<WlH{Ng.z?WJMf16Ur`H% ^g4 "IQz*VW /z [KKMw-e#7n@.gwy8m9}c1zg~jHf6 3oQB<ۧnkk?숰%gcۄ⟪M;U=^"f ?8$ $ANڏ.![:g(o-"<* %JaV&(DFzW9`1Y&%Y_+(ɆP1S"0bylNJr2b,E -Xʰ΃rTF|V|VZ/^kEUkz 077CMbvS?vC|AZa ThsWT6lj@>1!t)rTq5‰ԔBNaj>Zvܠj&'ijo/c XCP.G:EE`< ~yPC!ZC﷮7BTnrwT - Z)(ئe]WTS#v2|Iɢ(6agO厢]FB8>@PWLSݭ0L:~F,RMј!fOt6>S]JFHcL7u2UM5uGSTX6XlVTڜT_ݫw׼%z>N^ဪζG&-p%lWnhBn5a/813@:ܲnI2M0 Bݞ]vez^nV-N;E2.kC!LPh#I7jA0yٖNbld[^'˃{ -a!́i0a.x & x R(7Zx` Et́)3;YԾ'D1VVB)g> f1i>ͥ,jC}RQ7Q >9hS9Def;y͞=u(EtUg-Ҿ(4K'M[?Uk}c҂r~eSi]}baꗏl1P= #FiY>Ӿ)hݺSNZf@J3i $ 2x [UDd00sș; BA$PԞS[S"\3z&hwFQ[ -a qڦsLigЇ/5pGU7?D˭[_ƶ9-֩ŶI TNE~Fsm>ܩ-zPFKZRCj:utkο0<#+t'#~! Q;/@i{Lo{kyDzHd5L#=@;x"U}A(R2-Ue!meX:Ϧj5eߖƝ qv^;qSN97?gHFGDDM)> -endstream -endobj -1057 0 obj -<< -/Length1 7648 -/Filter /FlateDecode -/Length 4712 ->> -stream -x9yxSU眛&-PhZHYӄ(rtO&͞nItInPR"ouFD}*OE2 ~CGE8qDܼ߹IK|{[o;)h1Ho.)vW;V!4^]dv,(; S])jnBn_/.A(l5+=*A9{%ˏewr|i a=J y%NFV%0f%k#B9d5mQd~kFNF)$9wПȉJ*`y1;$Q<9{ 2g_gA10;x^~cԎ1l"T'D҅IQ}H -!5*h܅`B Ff?HB&ZXp*u61 -7"4E 3)2\ -A5h ZhN PhV VUl]p6˧~k~KڎGoA9>CWCI&ny/ALa1_ R킇''87|_وyDcƈ"x7iis,[T?R@#fM$WP*3Mx`.'8PiS"\dccdQk5:r, B$ZQZc ]e(ՖԉLn[VZInN,Aiixs2]U¡/\:<3ܑ%ja,WXF(9_;#/ 3]%sB(HNg%B"-vuyq#8Νw#V`eupT֨RFKfQjkg_o]{_glq9}RKm0#IEJ<]LWKAxb] QYrɣY2fevB8Гhc͵pǑ7 [pv|E-\Ej66UJf % -E|Pj+>)`_㾪bkԧڧEoQ$$M r@7IBUXhVgm16|Jd65KouQnKsktՑaQLzeKÚe/plFׂ #4"49XJ -uMMz -%NQo>m4[!$He87KtnZjKҮ,k4*ҭ/.))GȖ vZ 3uEEr h8t ptBĀ&A%SLJ5PUk5dz9R*L'ynuhK?Wv> 7 -[QJkm}Rmidg/F. \x%  rh'{Bp2 -*B Rh;tVgկr8Ub*,q\zjVl6BSgi4|C} caƩB}Q` jУ8ZH9A )'TU*&C{κ:kZgV&WYѝM'ylEO.[iVR-x;Sr(iFI7AA nw$*r::zAd#y!X&ǰ1r%?qg2꯷_/y~s{t8>G[&qc6[m5qׯTt{Ho2ŧx{nz!۳^A1\̆(xסC=;G;;wȘ7?O)]p# G,8<`\(46|{o=dyQHfZ 5{U*k˖ܟPw׷foJulaMʹb xo9i -NZ#ЎTޤxp#pj9dVVðFO> h Rɋ<T=[[{#.z^F!=[K&GULNE"=jFl_Z~u+9}L7n u2PC-.L)tIQ(ʎJmg5qR+wn>sܦO{F$] -Τ7V"GxYqz۰fڷdLͶDsq5Wg G /Ǥ3IVM,lb|BWvVa}xS-7ӒY"JL3KTqԆ%ٚ9Q1luPJq8!GWOz^GVڨ؁J D|SZlBasMuu ,CYYC!v7_lL GA3"|@RfD 3Ovn&t()#NX\c(fAh>\h>r+⾇Kӳ죘UĈFUq,>Q\l!rLaC2 ggگ;t„ibaqq:`~m큭d}CeMg@%f&9$Jͥ}~_!$ #~ds2hZ:޹fj#>*gYJfrn`ҥ4ϷY6ri^]^MZZ MVp &'Ni&\wVs.A@E(u n&.\>(`BXkM+܈\͒9EE9%b4 )+ ΆƮ 4bBZHKҲ{惴:֡[H+;給@\A\mo"Ԑ; M5e$la͖(`hɸBWFBlWVQ{q-' &h,͚$ +x|SsvܑU]ug!J1 =~)l)xedMbz6(e;z|1yV( ]OC薶C֏_Ԫ H"w_)2*hMry\$. 'a5:(CY5Feh 0/οs_s\\σ~0$dOCo̢B<qҎIo81YG'~n\56?I"^TAl כ#EE#VhQ -ڝr"@ G7Jޤ$o{ :x[y Λ=ЩΐN:}@y)܃̒)Z[zVO -s7bgKnnO+Ss%JڃDǿȃ{JFc -LSS+(P t7+0y,&%ۦ*OvDST,WQ|2RoIzY\$2jNdY -;yj"Sr!SBVb2Ca6{vyii*m4Vox]*szj2-٠jV7Qϗ.K[k8J`?ǰxg o< ,A>%(ݲHjXG1c(85>ͱtHxmӐ)fǰt=ںi]3GOQx[oqqd1K X,枯DqCNpF".GvJ^qiwn6@6v3HA!^x:;`|~I"^O>t8u[]j oC?M7rз-@WCah--D p<2 ~ԎZQB|]0 m  0=hH5+*h`_4+PDػX 7knc- -m06қe໐@ [8Bs*5АOoNK .x_|oLCpC*S>ԼZk?5G" -endstream -endobj -1058 0 obj -<< -/Length1 47128 -/Filter /FlateDecode -/Length 11768 ->> -stream -x} xEhUw2353IH0<W $0 s1bVA -nD֋.rO$XoΡNwUPBH - 3e㫞$Xҷw_}p?+< B{~0!/oCΌYЭx?|Œ H'dxvmsyF݄affrD|^5xv9 myyOr7%֭X>i[N1"o=lBB!3o/̖c 8xFI[۵Hse4 p||VI_2E)"y^8gIwO/ϟ ٦FjUL2${"lCMkrfC`M`E"߱PeK8t6-zH)0ȶf})=I"U=CXf/mhhOHiSK[I5J 2؈xI<*1:36ڑHsYm^ϰ'W'er^A>Hͻ 54xdC}y AF|i^ Ul2 ^k6Y+v:.$`H,kלA b 1A b 1A b 1A b 1A b 1A b 1A b 1A b 1A b 1A b7@c;KgzKj"F\X AEޤ?La2#S- iEڑk@|> 7iy×^5E` Yȍ#o k{me V!y CF(|d5OVӿ_k;pȈnڪwAc -x){<U'L>z0냮-DaƲ% !8mIj.lXl'2id"24ɬeY&,ԃRkkuY:,NN^Syf' -Q+JOEXg:`ojfi!6o;kϯ9/n -1%4,߀Pw-p- -B_BQ ? QyeA}]Pc@MD۷[|k_kG|_Wpo8-K%  8%Z8i"?9>MaI-|>|q]p+?glZx? GpO~$^ދp*C xB"H[av!Q -ÛޘAkjW^}6+{$u{le'K8Kv x /Sx>xyi{-J6Ouz|2BPv(w);EREg+ke>!)! kְ5i{ t 8-\fзAw[?hrY.=KFWa7U832[^R~ TfЎG PR-~E#v8f&*UWw0'.?#qdP%2'/_E-?r=wɓy]0{Nfun1*nr;̐/a͋h֪_-~8K,VѻB3 X ?m_ddM2Φh:s|V3oow爕$H^*ZD%8O"$r>_:M]-T)'H(Hf ۧ,X0uS]bD|,ͤ4jh3qohX"ft6Cr~_ "^خ|l׵D5 H"VMs3a;th:XC xU]?a QNC,p%S9W<89UqkKr|^Ӂa#^"аոFǻ7߹-.4ZZ'GOLHHHlAZ$H% 'ORI7,yiqu -*^ja#_g}Tߊ;fy&34~΂)DiW<3|K,ΰiCUJy{\x>*:}*ߗAiYc5qm>%,~<:M}>G t%鹍i==!Ğ_:՛ڴf#{}cg}>Ѓ<⳯ae)F:&)1Pu NB0e;D6$bI~&ckмQk Aɝ.~:~\VpT#BHVWx,;9ľ* Z3ĕywu*Li^+L^lʟq it~\fߟAC;@m۴VZh-IH TԪJ -WU)6=$BeXZiك&yRg?"mz=PwIc5;SPZRBouH~W5PxS\'ZA{Oz}qw#DM6Q8ES,TPj&YJzGS,̑J,O'H!3FH }Ƈ4DC(%{,#?EEكn!'bihˬ"jUn*;ѫ۠eu7COJ΄$gFe6z7"Eޡ \ɱpFFn疡F#2s^粀;̙>m,`4 I-^8:ϐ}=Ä1Ə5f[{̙3**U*e~eg_~ٲW#FW$e?@'FeoWd%]T.VVS–"n`]D6svQ$s[d&q:j`ͨ3kO-%Ş)ieI)*Eiizڠsr6JN w{w#gJłQVSxU*]icxNC)  d؋Ac+T[RUUkCKTP -ٮ)KTf蚅+] !;@ |QLDxFEFcQjTJZUsuƫGO8-EZk=h}~ 編aR'E9d>C9}>}/h/7]k{C!r\D` QASeXȲ,K,JW.qmlݽM@iMdH$G^rS_JZ ĥٜzbb_uY|~-AZB4*H)ώ褅ECZ(QgM% qǎ}T̩/ob.֋v |ogP\,1ז?Ȍ7JQǠ-IHͥ1vmv}-Jog#j$fuMi8z#Js- 79|O3!1 :?iiC\C7ZJ7\Eۿ@\kq?j#T7y@Gdig՞tfJ4q.{?1nٓU`sN]T#NUvϾsJą(S,s%C鰒GٯcmA$`3x`_pهM&q⬟&կf/sR|ǶhcfErQ́a]FcbDH䚑>^*.6juwE505:PTMijFq f}ܧlݡe R-EJRi)ݫܧn$dMjH>BR>C+gUj%3Z|9ygW;_o֟bug٠]͹IB*9PPQO7.ٕu{%6H'ȳhG&OtCy !3\׀Qn#A=`#r\.y&N3>̩9ZZ@mXO֏YdVf)3Ve2iVm6`~p9Z0tp@_m6RL'A6U/rܫ=?%YkoQaӿGbXΏ}6JA _CB' "<`yE иJ-bYY7:Y.sPRlW}u8N"$oX'K|r3e)eS,VSTJ${; bh&D!H13*g$tl-doPNjlps!xD:>%.jҎRJz;(GUo>1nĉ= 1=K -?R\$$~K!umIOW_%=[|VH;:I>B^&H $'&Ry޾!i%_Q&9OB|БSLQTA_솅E ]n =GM*!?տˏU%FCQ#go=<iMŠ'mXx_OV׺WJ3d I;<VOk9(#RJ=יK*;2<GcG&˂3Cssls  B+O[X\bbbߖ-m[`[p[Ut""j9qff4)Qw;{FVlw⿖.w7zϏ u̧ -"vfА%rriAgPZ(;N #0SͼSġF5گjtt|MN6/;y ./VvD{63*fqy"L%*Mai_I`~lR 1qBeD#m s f - $DHTx@ j}I_):j&BC>Lw$rёPGGBҗj*R$/5Ү!<\Wy+ -̆qF.VY1~1j!vC}VY.M7=/0^AĮ膻򞼓1q,ˋy13sjDHPܫy$k-Lǔ#Gj%[;{:Cp7+7PPm~VFh ɖm>͘ib+ͅmm-j^d{e7^gxI.fIC= 3zQ .΋Jy-J5VDZ]_4Ih~̢t>բ7.E4EaiTLȨlaCXj z$֐KBqQfH6Ac?`FԿeF[_zGDB ]*u c7+Å8o _*o(ѪHk]%9ሺq<x7e]!*IODn-C.`s0]ulP C3m3Tp'B |%I\ ܔ6$0!(poڢei;Ҫ..csP\~9lco,yPkǸzm}ͳC;P;0h@Ⱥ-n|cw7oO)˿MG>V`nB$lGdwPģ~I$rGS)slҊdlE -&Hp͞=*PCtb~uO[4;>P(_,AJY墬N"1q~V6$,5qɕr=q95BO=rca"0704''x.8Nj% 1rUĹJ@:QmY$i -ϟq+31)i"8"~Ƒ9;7J͚7?l0ؿ=yD+dr]$Da_g%;d[eN --Ť`ɹr%3U bZqeڇona%ƪ9:!-[Tz4&8UtaL)L\.AƓ#).Nm#N[Ev{omV^u?x0=SW:+FM#|eƐjEo4T:7u9Ob͎?T=R0ԭ"J)Wч;y(Vd`$# {w̿..A?dߙ!r2lxnYMAr:*eY[n\Ϛ[7(Pti{mT{'V]~Iӽ񅙯ö/LJ|vuǪ~³/Tݤ,̈N&)b7)ыr}\΃hCQ.W=y pcKwMM S;q]0=-E~c,e#,̥i%ܦܦη,{CuTI>]֗ІBmF>~?=׼W.Qj?bXzꞧSH?shJڋdd_2r72dFZ6\B)doXHP$:Oá)h:8fWyqTWFt֓*vv[.@І!噋2e>i)ܽ4%ϕ=/8$VQgpi"C'^LLqᬟ=%i?aL{Iٝz>H"Re}h&R!.n#lV%꽜U?U{K|Oxhє%܅ V,XP -[,NK/fÆgAx[ Mk$%Ub88-z9rT134ʮӧ5Kheq'Bf ѳ1lߥd"ctcI_i֘/$;?sJ5 ͢`mRD6Ҹjty@Z8j6aune]MCq͕3>s٣%/kG{)gXO'3} 7qk]|s3V7^L\QW?X,r+:J"5]#Es~N0򁁶OS I -iRHgJև"v~Օd%] |^/A G'bRTW r0nmWGtGt~D_ݏ8rOVW^#h\m57ӍJdG4}㨁  >Fw.&N>km,Foi :8rI.̺jWK[OG_~pm>:6QʊH-i"k+WfrR1ʭ(>CGm[ӰEyA{ZbfC/h/ޤz} )3_FŠ7@1c1b -z]\N4jy>FXTM'dsWTEURꦢI_E$2,j5&V{.0;xi'?'Bt t;Aw:1xφ;`,їꏑe S^ _%pD?pJ??9ڠb*6 xhFBWh- Mld @eV`#Rux`kmZ^U^դ^QhQvJzJ;j|M>g+ߨk?ԮRSh[b::[Žu?{Y.vAIiw~\Qšܜ4/r38lvp 930c .êk#w5 L3 '8LeMb,5ST/;,Te=j:]ֱ͜FP8G pGܫz--yKE5Yޤ7޼:}bbcl%..VW;mMyt/VjUKow:q~ΰK = <]õS*7%]kżWr} !JN$ih c &mTѽq_A##pVjncYnP5EZ˚YZk:@g<kڗP͉xriޯw5 FT'IDIn9=)=;>\0buw$wbJpC37y-Ii*4օ7[nXN@n.yBMw~j tn58(r+UߒS -~EtߠiLmC2t~2W ~]V:u{|o{XRHHOgq )dIF}.yr5&˓#5 oq\Xnxs`W&cbxZuOiKq5˜T{I$D3N+q锯Fz]nЕud[ig&v_LJwa[HAݩ_|mȵ,E -I{2cgʖ,@pt 6~˱2He*67t& /FjmXְ_ܡMô_o0O\xe X~+{b1WԿϣ\Qj~'Wz5ؼi䦸 Ήsչ<@]K\@U\12yHzT]"p*.ɹKslن ݛkPK忐ׯAEiO\.^FZ/m.m-˄Q2Kt@޾[?Kd$z1?ʗ+KSp_Qamjz7Uc:.]9/]hn<Ǒx"?I͈[pd7"CϘDTL‘< )G -"oQih#%!7 :1> žoFt/\Gأ81HCԗ>Iw*OϚ1,?x -Y6xl,'rެd٤24dY6x&\2k,&˦e>s&e3ɚI3ȲY3ҙ,mrIWnD}7E3{H -iAZal yPsc9(Y,ߩDY -endstream -endobj -1059 0 obj -<< -/Length1 17264 -/Filter /FlateDecode -/Length 12304 ->> -stream -x|yxTŶo {s;ݙ:N!d" @0 a<*C &P"ǃA<!=9\q@#z= -݉N]VZހ0B;̔=/ ۻO~{ :dx.FAc8h_ CTnh:oB|qS,j "DR/1o,s ̘h!aCm1w&G ˚ ' >pu9'3Ȅ]0ur65pq'ZNE^~{E¹.X؝X~}v;yF $G .+2 -Ds  I( ME#9y~&1G;3uC&Ȃ$@Y *ftc4D/""7tzbC1hdgvU;lS'%4 J8oPA{W~ J1pn:PnBe]\E|UPVϢu(PPSAZyc(#.޻88&?eS~?H@xLj6:v\+!ԂjTs~ҳ~虧HP>UҦ2iFO-2zw=(62zcQ精1І[(:O +i}E/MFPw}`bD^F_cV*{2nJ:m/ﲊ/']Vחſ./%ӿ0&/Xa }^lctVo,V33*isJFz0}DW ^tpNi9(/e 2/}J1RF׬k]m*FO +-yrq^N]fK}]A\l1]3ǎ -ltOxG]tDqp:/etN:t:qNgtŌN2:Y)n:INdt8Dqұkc4NG1:ч#ćF3:чӡ FiB?>h ]_؏Ѿ[L Upqpw6}0*>hO'2V_OzLb/3UB˗g}&%3<ͫ>_Г@B[49 b5-\:f3l@] 8d073ij8MZvօN!b&>l'UB;qr+bxiGMh" ƛ74_4XYe,zӘd=ad7QFl#Yጆ1b =8 h#Y ͧEt$S}!vjmZsk>+dg6D3Ud ;J AG \=*p2 ʌJеĨh9$@NBq=.^'C K-鈟)%+m,Mx>]Ugғ8j lhd-os>78³KۺGcq/ Gy% \V8a2z¶ @S -迈2tm!Wk -M詖 VH@,6$p]lpyY %Kv9rۅid0:/C#8 'UTAf3bdGr%$m[#Op- -}NBm8F&sdk^-Fp?e@'@2-0L\P-lzZ kN2&Hs퍲a(ZH^>$ {n0KFj3MGEB0Y8(đK)Y~rwyK S&^]TU5M}J}UDD?lVݍLѦѦ3̵5(Emn=da+=ck Y=>ݾcB'|ەZu#lҢsE̴TZ*1j9ےR[RqQk#MMMbs#lZ@Z -[FQ:BAo% YCmtkg_N@xѴ (EH\NQ]yYo5F"#]b6 N pc9{>7ן-0 ɠVBx2=Zq4ycVͬإ5n11qSfbƈ&lVM/Ro;ZOu;'-b_]מbq`oY щn{Y\a-A$""&Ƙ@pnʩg?r y'kkܼfXs6'dVVf$9V||Bfh%+;3 :L/f.wO?5i껧)Cvxš[7L+?,~^X8ad:w<3u6}5)E`Eۺ:~fn= -GnrH_;;*16AuϚcޔlMYWdD̤:H5x.h5xbƮpL^pnո'\ -ՙ -al1/P1W -θ 䆸*i -Ņ m5Yggee8\OK6~h'SOkUA}&/5n)"BZϦUΌ)^wW -zc{+t\7cu_y/NfabA.71Z+]pҨ4%a\~%DjvdIȥ+. jqmθxŖM^juMU -W]-87_+c\M[7#9.˖مqZ5лdka.ܖo;_^._HNƔC>/Z ϫTiS *IV -3 z]Qi&s(N(pq3S(^f WHb[oۗ9x"JA)8!ELR%EP#y4O<9Oy!hBCD;HVFU:%NrS=La_0 ^UfXp7zg߭-km$zEzEItSgW|ecR@UYTU3B;DY0ѣ`]/`6L녑3PvV?y 6J^L^/>]Jƾpɟa͵'pK,ߐ{iW1cx]zQ_7ʡv貘]UqR㕎!7;@[@5rrHK7f MM7f|4c;Sv߿eֲ׌nF'|w8٥rSջ[,1PLgo,{70,`/QjGT/Wa܊ L#]5[@ħD%X(O&:=ߝu^:W_-TB0K(^AE')p,Fͭ\oi[$I2sDiGZ)&\*`~uPUTNMx%emֹmD¤heѦ꼕K6Wζп PMlV8Ɉ:bM0LH3/3Ⱦ/L*ۦuL59X_XǞf X)[ 4d>#ى;%G HѠ7Nt~βpЃ!z}! -T@QX 6pA#*'YzagD J¥kH8p&_n_68/q紴!~OCcz7x Gf>'ƭS ݽ(m>zŁƍ# Q>`o [E -ĤNj2"нN^5${oZRfQJ4 )Ɏ vO!s&,6@Fms3%R\Rb/qH ,LjYʬl'\ 4lT2gʕs攔?]5s^þ7E۲-ƶI{ܶmS۶o~.葷A&[jwd72Ѽz!/@]Pk(P$( -:/U(ثRy xM\AU$-ST=(ƀ2ʁj -2x/\EfT@ dIYe<GGf6C7Zڭ$-{@<YRuUJ{UܡbzdmhE-B)Am.G~Wvͬ?>կVmzdrϮ#Yυ)^i@X4Xqa/:lh}?MAm!A:Y;T.jwww.hGnkm/0GQ( G4*yrG (+$]ts5΃^ez5=ήFQ }vGypZOe*O\f֙A L)wqD$ qRE.i:.Sr\e@H%5MM\vR|+lR<JZ5Umv*-lg!#]?E{8簓 +jk(H)*Gwd/:H(ETgC%;ᖣS%i7@Y Jd0RqLg"eID7%$9^F i_<"y2.ON03 03 eM8Oz¶r $[Z_'-/77g i"Y4ؔr% k&r_,6cx΀V:)[eJ UP0`V$ )R%&|x*%*F}DE9:.wJG]ΡYJW,æRC<Ȁ>ָf5qVȯ4֧A]yH@=@@>ebd+JULFޜ'S|%w$rWy)&d$ X*(<ϔ :AoaWĔb [I3-:-W Ui\B,)ݖ҈j-O06:]Wzk_Z[oo\Ņ8} ^}p![JZ\KX έb͎$ WYREUtcW+r2H-Ur. ߕ?}=„ݹi1ի7ٺg_W j4YV`F.0j3P|FZҨ !GKLR]9)-R!+~rXWnM: _C1^Iw(LD}]0PUR^AT!^DkN*HUk]uRƛΚc fsm&;SL: -qZڅM~<Xӧ-v[?qC3m]l&^ubn>LF^{juAdh &VtDV|Uuˮ*+~,Ty+ՉnU!S]ΉMM䱩 -Y.MusGQe$22紝9c1q'T_Y~6^ |{GΌs}F󿒓?.ncRj=q'̣"}&)`_&wdZSE,%#k6zhy>ڐuUj ^6i,}ouooBLI,i|&9fQOz̆9g>اA Ƈu6n.yݻuE u< [DG">@BGRT9iM ⎎r3L<,p 8[+&m~A OUGU -fT5!CDE2`/2 *WP <4 |QJ?K5 s/pq%MhgbT!cDSO^1QIyLҍf -J7]}aǐ":J)ÔQ"x ea }\X{\i 4ҸTtٽisV}ה Ҡ!w|t^CJ֫%@g|=܏N҃ ݥ]> a_BOlhW(]bNx}ID|Boz͊YpqRg駑E* HO—>eϲup|Uu9urh4~^p^|fPQ2rE7ʕu FK K1|<#Zg +3 uқ) kI#Κ3xO?"^wXE Km Ki2F&m#:GF=$_7jAP`d'l&%觟$_THYJw&7P=Iy/pv -7t( -fx%{k6M8:vᢲ=cH# - ->S_߹wme浫W^%ֲ~(;gb.|~ m\@O_ʼnT-uYAp9f$DF:Q2v&Vm\r>m >pNW'd~h - -=[15M:` ~0;"AGme!rwhju'{ ! I18w+W c;N~M=]S̠cJWnX7w Rsk;mws+SIΙ?>s 좟##:wڹOY>aen#lDAEhsLa^nm0lOB -|j0EC?9R4fYYV_{^!uI]Ն7Z*[_42~7CF!C H@$DTuşxyL8x>.za?yb#1B%"+ZM1M1 ^76UV,Doq|ӯ*n?}׫\-~ͲuSst=N Ich[0ˠÒ1[ •  pcaQP]J&"f)d:YL*JX&.%&rwqF g1 -sh?HPs\^*RRT}^h3ϕ.%B0yJ}EhUV^QYU5j{yNER vg ;a/{ Fs]j}aѲZW?-GaҤܼ -Wv:7U/VYY8-s!P#ܛ=]=sqĻ?x 3˟y|3Ϭ޼I/]Ϛ?}4N؍;F -#`\3|~TcQj.z۹ b{0rWͷWJxt})I>þxpj ul-^7{[#cv 9:w~hqwk̜:$7xq8]rW`\&QY1NU:JiE-sxg%N6a3r!Uiʦ]MdRħ„V}K_[w0Cі"h,|^ydn/{ɒ;wO.8'LB~=g &! Cd(bQ(D}dm6yE -UA$^BҸ#.8<vM[nh1`ܦSyfZY:Ir3pλ(9qD[=w] hH8H]6ģxܑċrɐC)GPr }B]aRmNf,qnqT|RQ}Y #<&FjI{bO&ę2.VK?+Tȭ-y.x;ױ[^߿omnא[II+~Ad  S'oiUNWA:'H6_,(0$X#qJ1S2dMn@;tBXIJP:t B G5h]N#vU(ZLt$qЍ=_d0Y0eZ*.:`h/3K^]c<t; ykЩb0!Ďbzf 䋂[~gBY?.;zz+s{\?|` lccVtqSŨ >!,b_+F"Ll,4HQ/߸h{/HQ~߳}ވPY;̂CQX]{'⤹72,a_Є;l -v q?=Ou柏I p.^?r̂cGs|gC_o*6]ъǪ~Y[AAݼQ u|ӻ wEB_`%D B=fh&z NDS!fAPʀ#=EPEd@l!wZ/44EZk3þTQo͆FpTw22C3e>=SYp_ <Ɲ]Z/Ap|(P9pZTd{o{YNw>Ac ?.qrvvB -#bhBp @E.{"a@$gT7½ q;~sv=~򣓧ԩKRg<:mJ;yA ?6ާW -endstream -endobj -1060 0 obj -<< -/Type /FontDescriptor -/FontName /SXAKMW+DejaVuSans -/FontFamily (DejaVu Sans) -/Flags 4 -/FontBBox [ 0 -14 557 560 ] -/ItalicAngle 0 -/Ascent 928 -/Descent -235 -/CapHeight 560 -/StemV 80 -/StemH 80 -/FontFile2 1056 0 R ->> -endobj -1061 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /SXAKMW+DejaVuSans -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 3 [ 317 ] 16 [ 360 317 ] 20 [ 636 636 ] 25 [ 636 ] 36 [ 684 686 698 ] 42 [ 774 ] 44 [ 294 ] 53 [ 694 634 ] 68 [ 612 ] 70 [ 549 634 615 352 ] 75 [ 633 277 ] 78 [ 579 277 974 633 611 ] 85 [ 411 520 392 633 591 ] ] -/FontDescriptor 1060 0 R ->> -endobj -1062 0 obj -<< -/Length 744 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -30 beginbfchar -<0026> <0043> -<002c> <0049> -<0036> <0053> -<0003> <0020> -<0059> <0076> -<0014> <0031> -<0011> <002e> -<0019> <0036> -<0025> <0042> -<0048> <0065> -<0051> <006e> -<0046> <0063> -<004b> <0068> -<0050> <006d> -<0044> <0061> -<0055> <0072> -<004e> <006b> -<0010> <002d> -<004f> <006c> -<0049> <0066> -<0024> <0041> -<0056> <0073> -<0057> <0074> -<002a> <0047> -<0058> <0075> -<004c> <0069> -<0047> <0064> -<0035> <0052> -<0015> <0032> -<0052> <006f> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -1063 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /SXAKMW+DejaVuSans -/Encoding /Identity-H -/DescendantFonts [ 1061 0 R ] -/ToUnicode 1062 0 R ->> -endobj -1064 0 obj -<< -/Type /FontDescriptor -/FontName /YFABGK+Poppins -/FontFamily (Poppins) -/Flags 4 -/FontBBox [ -27 -132 753 704 ] -/ItalicAngle 0 -/Ascent 1049 -/Descent -349 -/CapHeight 704 -/StemV 80 -/StemH 80 -/FontFile2 1057 0 R ->> -endobj -1065 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /YFABGK+Poppins -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 3 [ 266 ] 5 [ 291 ] 7 [ 621 ] 10 [ 158 453 453 485 ] 15 [ 197 550 209 475 627 319 574 588 628 627 634 545 630 629 212 ] 32 [ 722 ] 36 [ 673 612 771 706 512 503 777 691 245 ] 46 [ 598 431 860 702 785 578 787 607 586 540 674 675 975 ] 60 [ 583 540 422 ] 64 [ 422 ] 66 [ 732 256 675 675 606 675 619 328 675 639 245 247 514 245 1029 639 639 675 675 372 521 363 639 560 819 478 562 454 ] 95 [ 290 ] 204 [ 218 ] ] -/FontDescriptor 1064 0 R ->> -endobj -1066 0 obj -<< -/Length 1430 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -79 beginbfchar -<0026> <0043> -<002c> <0049> -<0036> <0053> -<0003> <0020> -<0059> <0076> -<0014> <0031> -<0011> <002e> -<0019> <0036> -<0025> <0042> -<0048> <0065> -<0051> <006e> -<0046> <0063> -<004b> <0068> -<0050> <006d> -<0044> <0061> -<0055> <0072> -<004e> <006b> -<0010> <002d> -<004f> <006c> -<0049> <0066> -<0024> <0041> -<0056> <0073> -<0057> <0074> -<002a> <0047> -<0058> <0075> -<004c> <0069> -<0047> <0064> -<0035> <0052> -<0015> <0032> -<0016> <0033> -<002e> <004b> -<0045> <0062> -<005a> <0077> -<001b> <0038> -<0052> <006f> -<0030> <004d> -<0031> <004e> -<004a> <0067> -<0029> <0046> -<0017> <0034> -<0033> <0050> -<001a> <0037> -<0018> <0035> -<0013> <0030> -<0028> <0045> -<005d> <007a> -<002f> <004c> -<003a> <0057> -<005c> <0079> -<001c> <0039> -<005b> <0078> -<0027> <0044> -<0032> <004f> -<0037> <0054> -<0053> <0070> -<000f> <002c> -<001d> <003a> -<002b> <0048> -<0039> <0056> -<003c> <0059> -<000b> <0028> -<000c> <0029> -<004d> <006a> -<0054> <0071> -<000a> <0027> -<005f> <007c> -<0012> <002f> -<000d> <002a> -<0020> <003d> -<0042> <005f> -<0043> <0060> -<0005> <0022> -<003e> <005b> -<0040> <005d> -<00cc> <2019> -<0007> <0024> -<0038> <0055> -<003d> <005a> -<0034> <0051> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -1067 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /YFABGK+Poppins -/Encoding /Identity-H -/DescendantFonts [ 1065 0 R ] -/ToUnicode 1066 0 R ->> -endobj -1068 0 obj -<< -/Type /FontDescriptor -/FontName /PPVKZX+DejaVuSans -/FontFamily (DejaVu Sans) -/Flags 4 -/FontBBox [ -9 -92 733 729 ] -/ItalicAngle 0 -/Ascent 928 -/Descent -235 -/CapHeight 729 -/StemV 80 -/StemH 80 -/FontFile2 1058 0 R ->> -endobj -1069 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /PPVKZX+DejaVuSans -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 3 [ 348 ] 11 [ 457 457 ] 16 [ 415 379 365 695 695 695 695 695 695 695 695 695 695 399 ] 36 [ 773 762 733 830 683 ] 44 [ 372 ] 46 [ 774 637 995 836 ] 51 [ 732 ] 53 [ 770 720 682 ] 57 [ 773 1103 ] 60 [ 724 ] 66 [ 500 ] 68 [ 674 715 592 715 678 435 715 711 342 ] 78 [ 665 342 1041 711 687 715 715 493 595 478 711 651 923 645 651 582 ] 5038 [ 741 ] ] -/FontDescriptor 1068 0 R ->> -endobj -1070 0 obj -<< -/Length 1182 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -61 beginbfchar -<0014> <0031> -<0016> <0033> -<0017> <0034> -<0018> <0035> -<0011> <002e> -<0003> <0020> -<0028> <0045> -<0051> <006e> -<0056> <0073> -<0058> <0075> -<0055> <0072> -<0048> <0065> -<0057> <0074> -<004b> <0068> -<0044> <0061> -<0024> <0041> -<0033> <0050> -<002c> <0049> -<0059> <0076> -<0053> <0070> -<0052> <006f> -<0047> <0064> -<0046> <0063> -<004c> <0069> -<13ae> <00660069> -<004f> <006c> -<0050> <006d> -<0019> <0036> -<000b> <0028> -<000c> <0029> -<0015> <0032> -<005a> <0077> -<001d> <003a> -<004a> <0067> -<001a> <0037> -<001b> <0038> -<001c> <0039> -<0026> <0043> -<0031> <004e> -<004e> <006b> -<0049> <0066> -<0030> <004d> -<0013> <0030> -<005c> <0079> -<0010> <002d> -<002e> <004b> -<0045> <0062> -<005d> <007a> -<0035> <0052> -<0025> <0042> -<002f> <004c> -<0036> <0053> -<005b> <0078> -<0027> <0044> -<0054> <0071> -<0039> <0056> -<0037> <0054> -<0042> <005f> -<003a> <0057> -<0012> <002f> -<003c> <0059> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -1071 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /PPVKZX+DejaVuSans -/Encoding /Identity-H -/DescendantFonts [ 1069 0 R ] -/ToUnicode 1070 0 R ->> -endobj -1072 0 obj -<< -/Type /FontDescriptor -/FontName /MWAATU+DejaVuSansMono -/FontFamily (DejaVu Sans Mono) -/Flags 4 -/FontBBox [ 0 -155 598 728 ] -/ItalicAngle 0 -/Ascent 928 -/Descent -235 -/CapHeight 728 -/StemV 80 -/StemH 80 -/FontFile2 1059 0 R ->> -endobj -1073 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /MWAATU+DejaVuSansMono -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 3 [ 602 602 602 602 602 602 602 602 602 602 602 ] 15 [ 602 602 601 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 601 602 602 602 602 602 602 602 602 ] 46 [ 602 602 602 601 602 602 602 602 602 602 602 602 602 602 602 ] 62 [ 602 602 602 ] 66 [ 601 ] 68 [ 601 601 601 601 601 602 602 602 601 602 601 601 601 602 601 601 602 601 601 601 601 602 601 602 602 602 602 602 602 ] ] -/FontDescriptor 1072 0 R ->> -endobj -1074 0 obj -<< -/Length 1570 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -89 beginbfchar -<0031> <004e> -<0052> <006f> -<0057> <0074> -<0024> <0041> -<0053> <0070> -<004f> <006c> -<004c> <0069> -<0046> <0063> -<0044> <0061> -<0045> <0062> -<0048> <0065> -<0058> <0075> -<0050> <006d> -<0047> <0064> -<0056> <0073> -<0055> <0072> -<0003> <0020> -<0010> <002d> -<0051> <006e> -<0020> <003d> -<0008> <0025> -<001f> <003c> -<004b> <0068> -<0012> <002f> -<0049> <0066> -<0021> <003e> -<0038> <0055> -<001d> <003a> -<002a> <0047> -<0059> <0076> -<000a> <0027> -<001a> <0037> -<0013> <0030> -<0054> <0071> -<004e> <006b> -<0042> <005f> -<005a> <0077> -<0011> <002e> -<0006> <0023> -<0004> <0021> -<0037> <0054> -<004a> <0067> -<005c> <0079> -<0007> <0024> -<0014> <0031> -<002c> <0049> -<0033> <0050> -<0027> <0044> -<0035> <0052> -<003e> <005b> -<0005> <0022> -<005e> <007b> -<0060> <007d> -<0040> <005d> -<001e> <003b> -<005b> <0078> -<000b> <0028> -<000c> <0029> -<002f> <004c> -<000d> <002a> -<005f> <007c> -<0015> <0032> -<0009> <0026> -<0019> <0036> -<0017> <0034> -<002b> <0048> -<0036> <0053> -<0028> <0045> -<0030> <004d> -<0032> <004f> -<0029> <0046> -<003f> <005c> -<0022> <003f> -<005d> <007a> -<0016> <0033> -<003b> <0058> -<000f> <002c> -<0025> <0042> -<0026> <0043> -<001c> <0039> -<003a> <0057> -<001b> <0038> -<0018> <0035> -<003c> <0059> -<004d> <006a> -<0039> <0056> -<0034> <0051> -<0023> <0040> -<002e> <004b> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -1075 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /MWAATU+DejaVuSansMono -/Encoding /Identity-H -/DescendantFonts [ 1073 0 R ] -/ToUnicode 1074 0 R ->> -endobj -1076 0 obj -<< -/SXAKMW 1063 0 R -/YFABGK 1067 0 R -/PPVKZX 1071 0 R -/MWAATU 1075 0 R ->> -endobj -xref -0 1077 -0000000000 65535 f -0000000015 00000 n -0000001112 00000 n -0000001246 00000 n -0000040647 00000 n -0000040781 00000 n -0000043473 00000 n -0000043672 00000 n -0000047406 00000 n -0000047812 00000 n -0000048013 00000 n -0000048216 00000 n -0000048351 00000 n -0000048487 00000 n -0000048645 00000 n -0000048804 00000 n -0000049037 00000 n -0000049271 00000 n -0000049486 00000 n -0000049702 00000 n -0000049943 00000 n -0000050185 00000 n -0000050408 00000 n -0000050632 00000 n -0000050864 00000 n -0000051097 00000 n -0000051311 00000 n -0000051526 00000 n -0000051753 00000 n -0000051981 00000 n -0000052190 00000 n -0000052400 00000 n -0000052629 00000 n -0000052859 00000 n -0000053070 00000 n -0000053282 00000 n -0000053501 00000 n -0000053720 00000 n -0000057475 00000 n -0000057940 00000 n -0000058141 00000 n -0000058343 00000 n -0000058558 00000 n -0000058774 00000 n -0000058971 00000 n -0000059169 00000 n -0000059388 00000 n -0000059608 00000 n -0000059809 00000 n -0000060011 00000 n -0000060239 00000 n -0000060468 00000 n -0000060678 00000 n -0000060889 00000 n -0000061104 00000 n -0000061320 00000 n -0000061551 00000 n -0000061783 00000 n -0000061986 00000 n -0000062190 00000 n -0000062327 00000 n -0000062465 00000 n -0000062659 00000 n -0000062854 00000 n -0000063044 00000 n -0000063235 00000 n -0000063426 00000 n -0000063618 00000 n -0000063810 00000 n -0000064003 00000 n -0000064242 00000 n -0000064482 00000 n -0000064697 00000 n -0000064913 00000 n -0000065120 00000 n -0000065327 00000 n -0000068893 00000 n -0000069371 00000 n -0000069567 00000 n -0000069764 00000 n -0000069960 00000 n -0000070157 00000 n -0000070356 00000 n -0000070556 00000 n -0000070756 00000 n -0000070957 00000 n -0000071155 00000 n -0000071354 00000 n -0000071588 00000 n -0000071823 00000 n -0000072022 00000 n -0000072222 00000 n -0000072425 00000 n -0000072629 00000 n -0000072831 00000 n -0000073034 00000 n -0000073234 00000 n -0000073435 00000 n -0000073631 00000 n -0000073828 00000 n -0000074017 00000 n -0000074208 00000 n -0000074400 00000 n -0000074593 00000 n -0000074783 00000 n -0000074974 00000 n -0000075160 00000 n -0000075347 00000 n -0000075559 00000 n -0000075772 00000 n -0000075987 00000 n -0000076203 00000 n -0000076416 00000 n -0000076629 00000 n -0000080328 00000 n -0000080831 00000 n -0000081033 00000 n -0000081236 00000 n -0000081438 00000 n -0000081641 00000 n -0000081852 00000 n -0000082064 00000 n -0000082285 00000 n -0000082507 00000 n -0000082736 00000 n -0000082966 00000 n -0000083167 00000 n -0000083369 00000 n -0000083567 00000 n -0000083766 00000 n -0000083979 00000 n -0000084193 00000 n -0000084392 00000 n -0000084592 00000 n -0000084803 00000 n -0000085015 00000 n -0000085161 00000 n -0000085308 00000 n -0000085522 00000 n -0000085737 00000 n -0000085929 00000 n -0000086122 00000 n -0000086333 00000 n -0000086545 00000 n -0000086764 00000 n -0000086984 00000 n -0000087183 00000 n -0000087383 00000 n -0000087591 00000 n -0000087800 00000 n -0000087996 00000 n -0000088192 00000 n -0000092056 00000 n -0000092527 00000 n -0000092664 00000 n -0000092802 00000 n -0000092994 00000 n -0000093187 00000 n -0000093386 00000 n -0000093586 00000 n -0000093743 00000 n -0000093901 00000 n -0000094114 00000 n -0000094328 00000 n -0000094524 00000 n -0000094721 00000 n -0000094913 00000 n -0000095106 00000 n -0000095329 00000 n -0000095553 00000 n -0000095754 00000 n -0000095956 00000 n -0000096153 00000 n -0000096351 00000 n -0000096548 00000 n -0000096746 00000 n -0000096906 00000 n -0000097067 00000 n -0000097264 00000 n -0000097462 00000 n -0000097597 00000 n -0000097733 00000 n -0000097916 00000 n -0000098100 00000 n -0000098292 00000 n -0000098485 00000 n -0000102326 00000 n -0000102813 00000 n -0000102972 00000 n -0000103132 00000 n -0000103353 00000 n -0000103575 00000 n -0000103778 00000 n -0000103982 00000 n -0000104205 00000 n -0000104429 00000 n -0000104633 00000 n -0000104838 00000 n -0000105069 00000 n -0000105301 00000 n -0000105514 00000 n -0000105728 00000 n -0000105957 00000 n -0000106187 00000 n -0000106405 00000 n -0000106624 00000 n -0000106860 00000 n -0000107097 00000 n -0000107315 00000 n -0000107534 00000 n -0000107669 00000 n -0000107805 00000 n -0000107998 00000 n -0000108192 00000 n -0000108403 00000 n -0000108615 00000 n -0000108818 00000 n -0000109022 00000 n -0000109213 00000 n -0000109405 00000 n -0000109619 00000 n -0000109833 00000 n -0000113909 00000 n -0000114396 00000 n -0000114599 00000 n -0000114803 00000 n -0000115008 00000 n -0000115214 00000 n -0000115404 00000 n -0000115595 00000 n -0000115832 00000 n -0000116070 00000 n -0000116301 00000 n -0000116533 00000 n -0000116737 00000 n -0000116942 00000 n -0000117150 00000 n -0000117359 00000 n -0000117567 00000 n -0000117776 00000 n -0000117929 00000 n -0000118083 00000 n -0000118280 00000 n -0000118478 00000 n -0000118639 00000 n -0000118801 00000 n -0000118983 00000 n -0000119166 00000 n -0000119331 00000 n -0000119497 00000 n -0000119694 00000 n -0000119892 00000 n -0000120094 00000 n -0000120297 00000 n -0000120446 00000 n -0000120596 00000 n -0000120778 00000 n -0000120961 00000 n -0000124800 00000 n -0000125271 00000 n -0000125492 00000 n -0000125714 00000 n -0000125928 00000 n -0000126143 00000 n -0000126361 00000 n -0000126580 00000 n -0000126784 00000 n -0000126989 00000 n -0000127165 00000 n -0000127342 00000 n -0000127541 00000 n -0000127741 00000 n -0000127936 00000 n -0000128132 00000 n -0000128330 00000 n -0000128529 00000 n -0000128681 00000 n -0000128834 00000 n -0000129021 00000 n -0000129209 00000 n -0000129403 00000 n -0000129598 00000 n -0000129744 00000 n -0000129891 00000 n -0000130093 00000 n -0000130296 00000 n -0000130463 00000 n -0000130631 00000 n -0000130787 00000 n -0000130944 00000 n -0000131151 00000 n -0000131359 00000 n -0000133666 00000 n -0000133961 00000 n -0000134105 00000 n -0000134250 00000 n -0000134452 00000 n -0000134655 00000 n -0000134869 00000 n -0000135084 00000 n -0000135269 00000 n -0000135455 00000 n -0000135633 00000 n -0000135812 00000 n -0000140610 00000 n -0000140849 00000 n -0000141105 00000 n -0000141312 00000 n -0000141518 00000 n -0000145091 00000 n -0000145322 00000 n -0000145519 00000 n -0000145708 00000 n -0000149393 00000 n -0000149596 00000 n -0000153335 00000 n -0000153558 00000 n -0000153692 00000 n -0000157714 00000 n -0000157953 00000 n -0000158087 00000 n -0000158221 00000 n -0000158355 00000 n -0000161968 00000 n -0000162171 00000 n -0000166877 00000 n -0000167268 00000 n -0000167402 00000 n -0000167534 00000 n -0000167666 00000 n -0000167798 00000 n -0000167930 00000 n -0000168062 00000 n -0000168194 00000 n -0000168326 00000 n -0000168458 00000 n -0000168591 00000 n -0000168724 00000 n -0000168857 00000 n -0000168990 00000 n -0000169123 00000 n -0000169256 00000 n -0000169389 00000 n -0000169522 00000 n -0000169655 00000 n -0000169788 00000 n -0000169921 00000 n -0000170053 00000 n -0000170184 00000 n -0000175185 00000 n -0000175584 00000 n -0000175717 00000 n -0000175850 00000 n -0000175983 00000 n -0000176116 00000 n -0000176249 00000 n -0000176382 00000 n -0000176515 00000 n -0000176648 00000 n -0000176781 00000 n -0000176914 00000 n -0000177047 00000 n -0000177180 00000 n -0000177313 00000 n -0000177446 00000 n -0000177579 00000 n -0000177712 00000 n -0000177845 00000 n -0000177978 00000 n -0000178111 00000 n -0000178244 00000 n -0000178377 00000 n -0000178510 00000 n -0000178645 00000 n -0000183449 00000 n -0000183912 00000 n -0000184047 00000 n -0000184180 00000 n -0000184313 00000 n -0000184446 00000 n -0000184579 00000 n -0000184712 00000 n -0000184845 00000 n -0000184978 00000 n -0000185111 00000 n -0000185245 00000 n -0000185379 00000 n -0000185513 00000 n -0000185647 00000 n -0000185781 00000 n -0000185915 00000 n -0000186049 00000 n -0000186183 00000 n -0000186317 00000 n -0000186451 00000 n -0000186585 00000 n -0000186719 00000 n -0000186853 00000 n -0000186987 00000 n -0000187121 00000 n -0000187255 00000 n -0000187389 00000 n -0000187523 00000 n -0000187657 00000 n -0000187791 00000 n -0000187925 00000 n -0000188058 00000 n -0000193055 00000 n -0000193518 00000 n -0000193652 00000 n -0000193786 00000 n -0000193920 00000 n -0000194054 00000 n -0000194188 00000 n -0000194322 00000 n -0000194456 00000 n -0000194590 00000 n -0000194724 00000 n -0000194858 00000 n -0000194992 00000 n -0000195126 00000 n -0000195260 00000 n -0000195394 00000 n -0000195528 00000 n -0000195662 00000 n -0000195796 00000 n -0000195930 00000 n -0000196064 00000 n -0000196198 00000 n -0000196332 00000 n -0000196466 00000 n -0000196600 00000 n -0000196734 00000 n -0000196868 00000 n -0000197002 00000 n -0000197136 00000 n -0000197270 00000 n -0000197404 00000 n -0000197538 00000 n -0000197673 00000 n -0000202259 00000 n -0000202650 00000 n -0000202785 00000 n -0000202918 00000 n -0000203051 00000 n -0000203184 00000 n -0000203317 00000 n -0000203450 00000 n -0000203583 00000 n -0000203716 00000 n -0000203849 00000 n -0000203983 00000 n -0000204117 00000 n -0000204251 00000 n -0000204385 00000 n -0000204519 00000 n -0000204653 00000 n -0000204787 00000 n -0000204921 00000 n -0000205055 00000 n -0000205189 00000 n -0000205323 00000 n -0000205457 00000 n -0000205590 00000 n -0000210570 00000 n -0000211081 00000 n -0000211215 00000 n -0000211349 00000 n -0000211483 00000 n -0000211617 00000 n -0000211751 00000 n -0000211885 00000 n -0000212019 00000 n -0000212153 00000 n -0000212287 00000 n -0000212421 00000 n -0000212555 00000 n -0000212689 00000 n -0000212823 00000 n -0000212957 00000 n -0000213091 00000 n -0000213225 00000 n -0000213359 00000 n -0000213493 00000 n -0000213627 00000 n -0000213761 00000 n -0000213895 00000 n -0000214029 00000 n -0000214163 00000 n -0000214297 00000 n -0000214431 00000 n -0000214565 00000 n -0000214699 00000 n -0000214833 00000 n -0000214967 00000 n -0000215101 00000 n -0000215235 00000 n -0000215369 00000 n -0000215503 00000 n -0000215637 00000 n -0000215771 00000 n -0000215904 00000 n -0000216036 00000 n -0000219278 00000 n -0000219517 00000 n -0000219651 00000 n -0000219785 00000 n -0000219920 00000 n -0000224952 00000 n -0000225175 00000 n -0000225310 00000 n -0000230303 00000 n -0000230526 00000 n -0000230661 00000 n -0000235447 00000 n -0000235650 00000 n -0000240649 00000 n -0000240872 00000 n -0000241007 00000 n -0000245852 00000 n -0000246055 00000 n -0000250970 00000 n -0000251193 00000 n -0000251328 00000 n -0000256189 00000 n -0000256412 00000 n -0000256547 00000 n -0000261310 00000 n -0000261513 00000 n -0000266505 00000 n -0000266728 00000 n -0000266863 00000 n -0000271838 00000 n -0000272041 00000 n -0000276936 00000 n -0000277159 00000 n -0000277294 00000 n -0000282231 00000 n -0000282454 00000 n -0000282589 00000 n -0000287403 00000 n -0000287606 00000 n -0000292603 00000 n -0000292826 00000 n -0000292961 00000 n -0000297965 00000 n -0000298188 00000 n -0000298323 00000 n -0000303231 00000 n -0000303434 00000 n -0000308403 00000 n -0000308626 00000 n -0000308761 00000 n -0000313532 00000 n -0000313735 00000 n -0000318047 00000 n -0000318278 00000 n -0000318413 00000 n -0000318548 00000 n -0000323431 00000 n -0000323654 00000 n -0000323789 00000 n -0000328814 00000 n -0000329037 00000 n -0000329172 00000 n -0000334040 00000 n -0000334243 00000 n -0000339339 00000 n -0000339562 00000 n -0000339697 00000 n -0000344581 00000 n -0000344784 00000 n -0000349796 00000 n -0000350019 00000 n -0000350154 00000 n -0000355070 00000 n -0000355293 00000 n -0000355428 00000 n -0000360228 00000 n -0000360431 00000 n -0000365468 00000 n -0000365691 00000 n -0000365826 00000 n -0000370748 00000 n -0000370971 00000 n -0000371106 00000 n -0000375917 00000 n -0000376120 00000 n -0000381088 00000 n -0000381311 00000 n -0000381446 00000 n -0000386387 00000 n -0000386590 00000 n -0000391465 00000 n -0000391688 00000 n -0000391823 00000 n -0000396759 00000 n -0000396982 00000 n -0000397117 00000 n -0000401918 00000 n -0000402121 00000 n -0000407114 00000 n -0000407337 00000 n -0000407472 00000 n -0000412461 00000 n -0000412684 00000 n -0000412819 00000 n -0000417598 00000 n -0000417801 00000 n -0000422784 00000 n -0000423007 00000 n -0000423142 00000 n -0000427990 00000 n -0000428193 00000 n -0000433212 00000 n -0000433435 00000 n -0000433570 00000 n -0000438436 00000 n -0000438659 00000 n -0000438794 00000 n -0000443530 00000 n -0000443733 00000 n -0000448788 00000 n -0000449011 00000 n -0000449147 00000 n -0000454091 00000 n -0000454294 00000 n -0000459120 00000 n -0000459343 00000 n -0000459479 00000 n -0000464495 00000 n -0000464718 00000 n -0000464854 00000 n -0000469631 00000 n -0000469834 00000 n -0000474808 00000 n -0000475031 00000 n -0000475167 00000 n -0000480155 00000 n -0000480378 00000 n -0000480513 00000 n -0000485271 00000 n -0000485474 00000 n -0000490551 00000 n -0000490886 00000 n -0000491022 00000 n -0000491156 00000 n -0000491290 00000 n -0000491424 00000 n -0000491558 00000 n -0000491692 00000 n -0000491826 00000 n -0000491960 00000 n -0000492094 00000 n -0000492229 00000 n -0000492364 00000 n -0000492499 00000 n -0000492634 00000 n -0000492768 00000 n -0000492901 00000 n -0000497397 00000 n -0000497708 00000 n -0000497843 00000 n -0000497978 00000 n -0000498113 00000 n -0000498248 00000 n -0000498383 00000 n -0000498518 00000 n -0000498653 00000 n -0000498788 00000 n -0000498923 00000 n -0000499058 00000 n -0000499194 00000 n -0000499330 00000 n -0000504338 00000 n -0000504561 00000 n -0000504697 00000 n -0000509536 00000 n -0000509759 00000 n -0000509895 00000 n -0000514751 00000 n -0000514974 00000 n -0000515110 00000 n -0000519926 00000 n -0000520149 00000 n -0000520285 00000 n -0000525136 00000 n -0000525359 00000 n -0000525495 00000 n -0000530166 00000 n -0000530389 00000 n -0000530525 00000 n -0000534114 00000 n -0000534317 00000 n -0000538901 00000 n -0000539132 00000 n -0000539268 00000 n -0000539403 00000 n -0000542898 00000 n -0000543101 00000 n -0000547952 00000 n -0000548175 00000 n -0000548311 00000 n -0000553075 00000 n -0000553278 00000 n -0000558388 00000 n -0000558611 00000 n -0000558747 00000 n -0000563492 00000 n -0000563695 00000 n -0000568822 00000 n -0000569045 00000 n -0000569180 00000 n -0000573906 00000 n -0000574109 00000 n -0000579103 00000 n -0000579306 00000 n -0000584107 00000 n -0000584330 00000 n -0000584466 00000 n -0000589217 00000 n -0000589420 00000 n -0000594467 00000 n -0000594690 00000 n -0000594826 00000 n -0000599592 00000 n -0000599795 00000 n -0000604796 00000 n -0000605019 00000 n -0000605155 00000 n -0000609920 00000 n -0000610123 00000 n -0000614957 00000 n -0000615160 00000 n -0000619972 00000 n -0000620195 00000 n -0000620331 00000 n -0000625074 00000 n -0000625277 00000 n -0000628895 00000 n -0000629098 00000 n -0000632371 00000 n -0000632574 00000 n -0000637611 00000 n -0000637834 00000 n -0000637970 00000 n -0000642503 00000 n -0000642706 00000 n -0000646992 00000 n -0000647215 00000 n -0000647351 00000 n -0000651417 00000 n -0000651648 00000 n -0000651784 00000 n -0000651920 00000 n -0000656866 00000 n -0000657137 00000 n -0000657273 00000 n -0000657409 00000 n -0000657543 00000 n -0000657677 00000 n -0000657811 00000 n -0000657945 00000 n -0000658081 00000 n -0000662852 00000 n -0000663115 00000 n -0000663251 00000 n -0000663385 00000 n -0000663519 00000 n -0000663653 00000 n -0000663787 00000 n -0000663923 00000 n -0000666684 00000 n -0000666887 00000 n -0000671193 00000 n -0000671432 00000 n -0000671568 00000 n -0000671704 00000 n -0000671839 00000 n -0000675857 00000 n -0000676096 00000 n -0000676232 00000 n -0000676368 00000 n -0000676504 00000 n -0000681153 00000 n -0000681400 00000 n -0000681536 00000 n -0000681672 00000 n -0000681808 00000 n -0000681944 00000 n -0000686819 00000 n -0000687050 00000 n -0000687186 00000 n -0000687322 00000 n -0000691466 00000 n -0000691697 00000 n -0000691833 00000 n -0000691969 00000 n -0000696136 00000 n -0000696383 00000 n -0000696519 00000 n -0000696655 00000 n -0000696791 00000 n -0000696927 00000 n -0000701916 00000 n -0000702147 00000 n -0000702283 00000 n -0000702419 00000 n -0000706998 00000 n -0000707229 00000 n -0000707365 00000 n -0000707501 00000 n -0000710438 00000 n -0000710661 00000 n -0000710797 00000 n -0000714870 00000 n -0000715073 00000 n -0000720577 00000 n -0000720976 00000 n -0000721112 00000 n -0000721246 00000 n -0000721380 00000 n -0000721514 00000 n -0000721648 00000 n -0000721782 00000 n -0000721916 00000 n -0000722050 00000 n -0000722184 00000 n -0000722319 00000 n -0000722454 00000 n -0000722589 00000 n -0000722724 00000 n -0000722859 00000 n -0000722994 00000 n -0000723129 00000 n -0000723264 00000 n -0000723399 00000 n -0000723534 00000 n -0000723669 00000 n -0000723804 00000 n -0000723939 00000 n -0000724073 00000 n -0000727769 00000 n -0000728056 00000 n -0000728191 00000 n -0000728326 00000 n -0000728461 00000 n -0000728596 00000 n -0000728731 00000 n -0000728866 00000 n -0000729001 00000 n -0000729136 00000 n -0000729272 00000 n -0000733691 00000 n -0000733914 00000 n -0000734050 00000 n -0000738503 00000 n -0000738734 00000 n -0000738870 00000 n -0000739006 00000 n -0000743465 00000 n -0000743688 00000 n -0000743824 00000 n -0000748783 00000 n -0000749118 00000 n -0000749254 00000 n -0000749388 00000 n -0000749522 00000 n -0000749656 00000 n -0000749790 00000 n -0000749924 00000 n -0000750058 00000 n -0000750192 00000 n -0000750326 00000 n -0000750461 00000 n -0000750596 00000 n -0000750731 00000 n -0000750866 00000 n -0000751000 00000 n -0000751133 00000 n -0000754374 00000 n -0000754629 00000 n -0000754764 00000 n -0000754899 00000 n -0000755034 00000 n -0000755169 00000 n -0000755305 00000 n -0000758716 00000 n -0000758919 00000 n -0000762176 00000 n -0000762379 00000 n -0000766780 00000 n -0000766983 00000 n -0000771375 00000 n -0000771742 00000 n -0000771878 00000 n -0000772012 00000 n -0000772146 00000 n -0000772280 00000 n -0000772414 00000 n -0000772548 00000 n -0000772682 00000 n -0000772816 00000 n -0000772950 00000 n -0000773085 00000 n -0000773220 00000 n -0000773355 00000 n -0000773490 00000 n -0000773625 00000 n -0000773760 00000 n -0000773895 00000 n -0000774030 00000 n -0000774165 00000 n -0000774301 00000 n -0000774493 00000 n -0000774715 00000 n -0000774841 00000 n -0000774987 00000 n -0000775127 00000 n -0000775324 00000 n -0000775558 00000 n -0000775789 00000 n -0000776045 00000 n -0000776284 00000 n -0000776531 00000 n -0000776761 00000 n -0000777003 00000 n -0000777228 00000 n -0000777472 00000 n -0000777700 00000 n -0000777935 00000 n -0000778153 00000 n -0000778384 00000 n -0000778598 00000 n -0000778833 00000 n -0000779051 00000 n -0000779295 00000 n -0000779522 00000 n -0000779754 00000 n -0000780001 00000 n -0000780206 00000 n -0000780382 00000 n -0000780577 00000 n -0000780782 00000 n -0000780988 00000 n -0000781195 00000 n -0000781449 00000 n -0000781679 00000 n -0000781902 00000 n -0000782113 00000 n -0000782324 00000 n -0000782539 00000 n -0000782755 00000 n -0000782969 00000 n -0000783219 00000 n -0000783434 00000 n -0000783653 00000 n -0000783871 00000 n -0000784087 00000 n -0000784299 00000 n -0000784504 00000 n -0000784711 00000 n -0000784916 00000 n -0000785117 00000 n -0000785344 00000 n -0000785574 00000 n -0000785803 00000 n -0000786020 00000 n -0000786237 00000 n -0000786463 00000 n -0000786699 00000 n -0000786943 00000 n -0000787159 00000 n -0000787372 00000 n -0000787600 00000 n -0000787814 00000 n -0000788026 00000 n -0000788209 00000 n -0000788423 00000 n -0000788627 00000 n -0000788852 00000 n -0000789085 00000 n -0000789298 00000 n -0000789520 00000 n -0000789717 00000 n -0000789891 00000 n -0000790081 00000 n -0000790278 00000 n -0000790470 00000 n -0000790681 00000 n -0000790889 00000 n -0000791093 00000 n -0000791328 00000 n -0000791541 00000 n -0000791750 00000 n -0000791945 00000 n -0000792142 00000 n -0000792325 00000 n -0000792498 00000 n -0000792681 00000 n -0000792873 00000 n -0000793074 00000 n -0000793298 00000 n -0000793520 00000 n -0000793761 00000 n -0000793984 00000 n -0000794233 00000 n -0000794465 00000 n -0000794712 00000 n -0000794949 00000 n -0000795203 00000 n -0000795426 00000 n -0000795604 00000 n -0000795800 00000 n -0000796027 00000 n -0000796246 00000 n -0000796455 00000 n -0000796687 00000 n -0000796908 00000 n -0000797131 00000 n -0000797339 00000 n -0000797594 00000 n -0000797842 00000 n -0000798065 00000 n -0000798292 00000 n -0000798504 00000 n -0000798699 00000 n -0000798899 00000 n -0000799078 00000 n -0000799278 00000 n -0000799461 00000 n -0000799676 00000 n -0000799881 00000 n -0000800072 00000 n -0000800257 00000 n -0000800496 00000 n -0000800728 00000 n -0000800964 00000 n -0000801186 00000 n -0000801380 00000 n -0000801597 00000 n -0000801810 00000 n -0000802011 00000 n -0000802205 00000 n -0000802395 00000 n -0000802592 00000 n -0000802780 00000 n -0000802985 00000 n -0000803155 00000 n -0000803353 00000 n -0000803548 00000 n -0000803719 00000 n -0000803924 00000 n -0000804157 00000 n -0000804360 00000 n -0000804541 00000 n -0000804605 00000 n -0000812285 00000 n -0000817087 00000 n -0000828947 00000 n -0000841343 00000 n -0000841577 00000 n -0000841981 00000 n -0000842779 00000 n -0000842932 00000 n -0000843163 00000 n -0000843760 00000 n -0000845245 00000 n -0000845395 00000 n -0000845630 00000 n -0000846169 00000 n -0000847406 00000 n -0000847559 00000 n -0000847803 00000 n -0000848398 00000 n -0000850023 00000 n -0000850180 00000 n -trailer -<< -/Size 1077 -/Root 3 0 R -/Info 2 0 R ->> -startxref -850272 -%%EOF diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/_index.md b/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/_index.md deleted file mode 100644 index b1eba5740d7..00000000000 --- a/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/_index.md +++ /dev/null @@ -1,3098 +0,0 @@ ---- -title: CIS v1.6 Benchmark - Self-Assessment Guide - Rancher v2.6 -weight: 101 ---- - -### CIS v1.6 Kubernetes Benchmark - Rancher v2.6 with Kubernetes v1.18 to v1.21 - -[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf). - -#### Overview - -This document is a companion to the Rancher v2.6 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark. - -This guide corresponds to specific versions of the hardening guide, Rancher, CIS Benchmark and Kubernetes: - -| Hardening Guide Version | Rancher Version | CIS Benchmark Version | Kubernetes Version | -| ----------------------- | --------------- | --------------------- | ------------------- | -| Hardening Guide CIS v1.6 Benchmark | Rancher v2.6.3 | CIS v1.6 | Kubernetes v1.18, v1.19, v1.20 and v1.21 | - -Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark do not apply and will have a result of `Not Applicable`. This guide will walk through the various controls and provide updated example commands to audit compliance in Rancher created clusters. - -This document is to be used by Rancher operators, security teams, auditors and decision makers. - -For more detail about each audit, including rationales and remediations for failing tests, you can refer to the corresponding section of the CIS Kubernetes Benchmark v1.6. You can download the benchmark, after creating a free account, in [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). - -#### Testing controls methodology - -Rancher and RKE install Kubernetes services via Docker containers. Configuration is defined by arguments passed to the container at the time of initialization, not via configuration files. - -Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher are provided for testing. When performing the tests, you will need access to the Docker command line on the hosts of all three RKE roles. The commands also make use of the [kubectl](https://kubernetes.io/docs/tasks/tools/) (with a valid configuration file) and [jq](https://stedolan.github.io/jq/) tools, which are required in the testing and evaluation of test results. - -> NOTE: Only `automated` tests (previously called `scored`) are covered in this guide. - -### Controls -## 1.1 Master Node Configuration Files -### 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. -All configuration is passed in as arguments at container run time. - -### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. -All configuration is passed in as arguments at container run time. - -### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - -### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - -### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - -### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - -### 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. -All configuration is passed in as arguments at container run time. - -### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. -All configuration is passed in as arguments at container run time. - -### 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Manual) - - -**Result:** warn - -**Remediation:** -Run the below command (based on the file location on your system) on the master node. -For example, -chmod 644 - -**Audit:** - -```bash -stat -c permissions=%a -``` - -### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual) - - -**Result:** warn - -**Remediation:** -Run the below command (based on the file location on your system) on the master node. -For example, -chown root:root - -**Audit:** - -```bash -stat -c %U:%G -``` - -### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the below command: -ps -ef | grep etcd Run the below command (based on the etcd data directory found above). For example, -chmod 700 /var/lib/etcd - -**Audit:** - -```bash -stat -c %a /node/var/lib/etcd -``` - -**Expected Result**: - -```console -'700' is equal to '700' -``` - -**Returned Value**: - -```console -700 -``` - -### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) - - -**Result:** pass - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the below command: -ps -ef | grep etcd -Run the below command (based on the etcd data directory found above). -For example, chown etcd:etcd /var/lib/etcd - -A system service account is required for etcd data directory ownership. -Refer to Rancher's hardening guide for more details on how to configure this ownership. - -**Audit:** - -```bash -stat -c %U:%G /node/var/lib/etcd -``` - -**Expected Result**: - -```console -'etcd:etcd' is present -``` - -**Returned Value**: - -```console -etcd:etcd -``` - -### 1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. - -### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. - -### 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - -### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - -### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - -### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - -### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the master node. -For example, -chown -R root:root /etc/kubernetes/pki/ - -**Audit Script:** `check_files_owner_in_dir.sh` - -```bash -#!/usr/bin/env bash - -# This script is used to ensure the owner is set to root:root for -# the given directory and all the files in it -# -# inputs: -# $1 = /full/path/to/directory -# -# outputs: -# true/false - -INPUT_DIR=$1 - -if [[ "${INPUT_DIR}" == "" ]]; then - echo "false" - exit -fi - -if [[ $(stat -c %U:%G ${INPUT_DIR}) != "root:root" ]]; then - echo "false" - exit -fi - -statInfoLines=$(stat -c "%n %U:%G" ${INPUT_DIR}/*) -while read -r statInfoLine; do - f=$(echo ${statInfoLine} | cut -d' ' -f1) - p=$(echo ${statInfoLine} | cut -d' ' -f2) - - if [[ $(basename "$f" .pem) == "kube-etcd-"* ]]; then - if [[ "$p" != "root:root" && "$p" != "etcd:etcd" ]]; then - echo "false" - exit - fi - else - if [[ "$p" != "root:root" ]]; then - echo "false" - exit - fi - fi -done <<< "${statInfoLines}" - - -echo "true" -exit - -``` - -**Audit Execution:** - -```bash -./check_files_owner_in_dir.sh /node/etc/kubernetes/ssl -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -true -``` - -### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the master node. -For example, -chmod -R 644 /etc/kubernetes/pki/*.crt - -**Audit Script:** `check_files_permissions.sh` - -```bash -#!/usr/bin/env bash - -# This script is used to ensure the file permissions are set to 644 or -# more restrictive for all files in a given directory or a wildcard -# selection of files -# -# inputs: -# $1 = /full/path/to/directory or /path/to/fileswithpattern -# ex: !(*key).pem -# -# $2 (optional) = permission (ex: 600) -# -# outputs: -# true/false - -# Turn on "extended glob" for use of '!' in wildcard -shopt -s extglob - -# Turn off history to avoid surprises when using '!' -set -H - -USER_INPUT=$1 - -if [[ "${USER_INPUT}" == "" ]]; then - echo "false" - exit -fi - - -if [[ -d ${USER_INPUT} ]]; then - PATTERN="${USER_INPUT}/*" -else - PATTERN="${USER_INPUT}" -fi - -PERMISSION="" -if [[ "$2" != "" ]]; then - PERMISSION=$2 -fi - -FILES_PERMISSIONS=$(stat -c %n\ %a ${PATTERN}) - -while read -r fileInfo; do - p=$(echo ${fileInfo} | cut -d' ' -f2) - - if [[ "${PERMISSION}" != "" ]]; then - if [[ "$p" != "${PERMISSION}" ]]; then - echo "false" - exit - fi - else - if [[ "$p" != "644" && "$p" != "640" && "$p" != "600" ]]; then - echo "false" - exit - fi - fi -done <<< "${FILES_PERMISSIONS}" - - -echo "true" -exit - -``` - -**Audit Execution:** - -```bash -./check_files_permissions.sh /node/etc/kubernetes/ssl/!(*key).pem -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -true -``` - -### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the master node. -For example, -chmod -R 600 /etc/kubernetes/ssl/*key.pem - -**Audit Script:** `check_files_permissions.sh` - -```bash -#!/usr/bin/env bash - -# This script is used to ensure the file permissions are set to 644 or -# more restrictive for all files in a given directory or a wildcard -# selection of files -# -# inputs: -# $1 = /full/path/to/directory or /path/to/fileswithpattern -# ex: !(*key).pem -# -# $2 (optional) = permission (ex: 600) -# -# outputs: -# true/false - -# Turn on "extended glob" for use of '!' in wildcard -shopt -s extglob - -# Turn off history to avoid surprises when using '!' -set -H - -USER_INPUT=$1 - -if [[ "${USER_INPUT}" == "" ]]; then - echo "false" - exit -fi - - -if [[ -d ${USER_INPUT} ]]; then - PATTERN="${USER_INPUT}/*" -else - PATTERN="${USER_INPUT}" -fi - -PERMISSION="" -if [[ "$2" != "" ]]; then - PERMISSION=$2 -fi - -FILES_PERMISSIONS=$(stat -c %n\ %a ${PATTERN}) - -while read -r fileInfo; do - p=$(echo ${fileInfo} | cut -d' ' -f2) - - if [[ "${PERMISSION}" != "" ]]; then - if [[ "$p" != "${PERMISSION}" ]]; then - echo "false" - exit - fi - else - if [[ "$p" != "644" && "$p" != "640" && "$p" != "600" ]]; then - echo "false" - exit - fi - fi -done <<< "${FILES_PERMISSIONS}" - - -echo "true" -exit - -``` - -**Audit Execution:** - -```bash -./check_files_permissions.sh /node/etc/kubernetes/ssl/*key.pem -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -true -``` - -## 1.2 API Server -### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the below parameter. ---anonymous-auth=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'false' is equal to 'false' -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.2 Ensure that the --basic-auth-file argument is not set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and configure alternate mechanisms for authentication. Then, -edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and remove the --basic-auth-file= parameter. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--basic-auth-file' is not present -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.3 Ensure that the --token-auth-file parameter is not set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and configure alternate mechanisms for authentication. Then, -edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and remove the --token-auth-file= parameter. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--token-auth-file' is not present -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and remove the --kubelet-https parameter. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-https' is not present OR '--kubelet-https' is not present -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the -apiserver and kubelets. Then, edit API server pod specification file -/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the -kubelet client certificate and key parameters as below. ---kubelet-client-certificate= ---kubelet-client-key= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and setup the TLS connection between -the apiserver and kubelets. Then, edit the API server pod specification file -/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the ---kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. ---kubelet-certificate-authority= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-certificate-authority' is present -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --authorization-mode parameter to values other than AlwaysAllow. -One such example could be as below. ---authorization-mode=RBAC - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'Node,RBAC' not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --authorization-mode parameter to a value that includes Node. ---authorization-mode=Node,RBAC - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'Node,RBAC' has 'Node' -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --authorization-mode parameter to a value that includes RBAC, -for example: ---authorization-mode=Node,RBAC - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'Node,RBAC' has 'RBAC' -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set the desired limits in a configuration file. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -and set the below parameters. ---enable-admission-plugins=...,EventRateLimit,... ---admission-control-config-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' has 'EventRateLimit' -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and either remove the --enable-admission-plugins parameter, or set it to a -value that does not include AlwaysAdmit. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --enable-admission-plugins parameter to include -AlwaysPullImages. ---enable-admission-plugins=...,AlwaysPullImages,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -### 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --enable-admission-plugins parameter to include -SecurityContextDeny, unless PodSecurityPolicy is already in place. ---enable-admission-plugins=...,SecurityContextDeny,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -### 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and create ServiceAccount objects as per your environment. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and ensure that the --disable-admission-plugins parameter is set to a -value that does not include ServiceAccount. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is not present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --disable-admission-plugins parameter to -ensure it does not include NamespaceLifecycle. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is not present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and create Pod Security Policy objects as per your environment. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --enable-admission-plugins parameter to a -value that includes PodSecurityPolicy: ---enable-admission-plugins=...,PodSecurityPolicy,... -Then restart the API Server. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' has 'PodSecurityPolicy' -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.17 Ensure that the admission control plugin NodeRestriction is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --enable-admission-plugins parameter to a -value that includes NodeRestriction. ---enable-admission-plugins=...,NodeRestriction,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' has 'NodeRestriction' -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.18 Ensure that the --insecure-bind-address argument is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and remove the --insecure-bind-address parameter. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--insecure-bind-address' is not present -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.19 Ensure that the --insecure-port argument is set to 0 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the below parameter. ---insecure-port=0 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'0' is equal to '0' -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.20 Ensure that the --secure-port argument is not set to 0 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and either remove the --secure-port parameter or -set it to a different (non-zero) desired port. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -6443 is greater than 0 OR '--secure-port' is not present -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.21 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'false' is equal to 'false' -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.22 Ensure that the --audit-log-path argument is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --audit-log-path parameter to a suitable path and -file where you would like audit logs to be written, for example: ---audit-log-path=/var/log/apiserver/audit.log - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-path' is present -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --audit-log-maxage parameter to 30 or as an appropriate number of days: ---audit-log-maxage=30 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -30 is greater or equal to 30 -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --audit-log-maxbackup parameter to 10 or to an appropriate -value. ---audit-log-maxbackup=10 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -10 is greater or equal to 10 -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --audit-log-maxsize parameter to an appropriate size in MB. -For example, to set it as 100 MB: ---audit-log-maxsize=100 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -100 is greater or equal to 100 -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.26 Ensure that the --request-timeout argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -and set the below parameter as appropriate and if needed. -For example, ---request-timeout=300s - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--request-timeout' is not present OR '--request-timeout' is not present -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.27 Ensure that the --service-account-lookup argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the below parameter. ---service-account-lookup=true -Alternatively, you can delete the --service-account-lookup parameter from this file so -that the default takes effect. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-lookup' is not present OR 'true' is equal to 'true' -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.28 Ensure that the --service-account-key-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --service-account-key-file parameter -to the public key file for service accounts: ---service-account-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-key-file' is present -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the etcd certificate and key file parameters. ---etcd-certfile= ---etcd-keyfile= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--etcd-certfile' is present AND '--etcd-keyfile' is present -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the TLS certificate and private key file parameters. ---tls-cert-file= ---tls-private-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.31 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the client certificate authority file. ---client-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.32 Ensure that the --etcd-cafile argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the etcd certificate authority file parameter. ---etcd-cafile= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--etcd-cafile' is present -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the --encryption-provider-config parameter to the path of that file: --encryption-provider-config= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--encryption-provider-config' is present -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 1.2.34 Ensure that encryption providers are appropriately configured (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -In this file, choose aescbc, kms or secretbox as the encryption provider. - -**Audit Script:** `check_encryption_provider_config.sh` - -```bash -#!/usr/bin/env bash - -# This script is used to check the encrption provider config is set to aesbc -# -# outputs: -# true/false - -# TODO: Figure out the file location from the kube-apiserver commandline args -ENCRYPTION_CONFIG_FILE="/node/etc/kubernetes/ssl/encryption.yaml" - -if [[ ! -f "${ENCRYPTION_CONFIG_FILE}" ]]; then - echo "false" - exit -fi - -for provider in "$@" -do - if grep "$provider" "${ENCRYPTION_CONFIG_FILE}"; then - echo "true" - exit - fi -done - -echo "false" -exit - -``` - -**Audit Execution:** - -```bash -./check_encryption_provider_config.sh aescbc -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -- aescbc: true -``` - -### 1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and set the below parameter. ---tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM -_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM -_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM -_SHA384 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -## 1.3 Controller Manager -### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the master node and set the --terminated-pod-gc-threshold to an appropriate threshold, -for example: ---terminated-pod-gc-threshold=10 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--terminated-pod-gc-threshold' is present -``` - -**Returned Value**: - -```console -root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true -``` - -### 1.3.2 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the master node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'false' is equal to 'false' -``` - -**Returned Value**: - -```console -root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true -``` - -### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the master node to set the below parameter. ---use-service-account-credentials=true - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'true' is not equal to 'false' -``` - -**Returned Value**: - -```console -root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true -``` - -### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the master node and set the --service-account-private-key-file parameter -to the private key file for service accounts. ---service-account-private-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-private-key-file' is present -``` - -**Returned Value**: - -```console -root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true -``` - -### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the master node and set the --root-ca-file parameter to the certificate bundle file`. ---root-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--root-ca-file' is present -``` - -**Returned Value**: - -```console -root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true -``` - -### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the master node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. ---feature-gates=RotateKubeletServerCertificate=true - -Cluster provisioned by RKE handles certificate rotation directly through RKE. - -### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the master node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'127.0.0.1' is equal to '127.0.0.1' OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true -``` - -## 1.4 Scheduler -### 1.4.1 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file -on the master node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-scheduler | grep -v grep -``` - -**Expected Result**: - -```console -'false' is equal to 'false' -``` - -**Returned Value**: - -```console -root 121587 121567 0 12:27 ? 00:00:12 kube-scheduler --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --address=127.0.0.1 --leader-elect=true --profiling=false --v=2 --bind-address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -``` - -### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml -on the master node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -/bin/ps -ef | grep kube-scheduler | grep -v grep -``` - -**Expected Result**: - -```console -'127.0.0.1' is equal to '127.0.0.1' OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -root 121587 121567 0 12:27 ? 00:00:12 kube-scheduler --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --address=127.0.0.1 --leader-elect=true --profiling=false --v=2 --bind-address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -``` - -## 2 Etcd Node Configuration Files -### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the etcd service documentation and configure TLS encryption. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml -on the master node and set the below parameters. ---cert-file= ---key-file= - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--cert-file' is present AND '--key-file' is present -``` - -**Returned Value**: - -```console -etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 2 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json -``` - -### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and set the below parameter. ---client-cert-auth="true" - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--client-cert-auth' is present OR 'true' is equal to 'true' -``` - -**Returned Value**: - -```console -etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 2 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json -``` - -### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and either remove the --auto-tls parameter or set it to false. - --auto-tls=false - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--auto-tls' is not present OR '--auto-tls' is not present -``` - -**Returned Value**: - -```console -etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 1 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json -``` - -### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the etcd service documentation and configure peer TLS encryption as appropriate -for your etcd cluster. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the -master node and set the below parameters. ---peer-client-file= ---peer-key-file= - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--peer-cert-file' is present AND '--peer-key-file' is present -``` - -**Returned Value**: - -```console -etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 5 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json -``` - -### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and set the below parameter. ---peer-client-cert-auth=true - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--peer-client-cert-auth' is present OR 'true' is equal to 'true' -``` - -**Returned Value**: - -```console -etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 4 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json -``` - -### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and either remove the --peer-auto-tls parameter or set it to false. ---peer-auto-tls=false - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--peer-auto-tls' is not present OR '--peer-auto-tls' is present -``` - -**Returned Value**: - -```console -etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 4 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json -``` - -### 2.7 Ensure that a unique Certificate Authority is used for etcd (Automated) - - -**Result:** pass - -**Remediation:** -[Manual test] -Follow the etcd documentation and create a dedicated certificate authority setup for the -etcd service. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the -master node and set the below parameter. ---trusted-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--trusted-ca-file' is present -``` - -**Returned Value**: - -```console -etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 3 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json -``` - -## 3.1 Authentication and Authorization -### 3.1.1 Client certificate authentication should not be used for users (Manual) - - -**Result:** warn - -**Remediation:** -Alternative mechanisms provided by Kubernetes such as the use of OIDC should be -implemented in place of client certificates. - -## 3.2 Logging -### 3.2.1 Ensure that a minimal audit policy is created (Automated) - - -**Result:** pass - -**Remediation:** -Create an audit policy file for your cluster. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-policy-file' is present -``` - -**Returned Value**: - -```console -root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json -``` - -### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) - - -**Result:** warn - -**Remediation:** -Consider modification of the audit policy in use on the cluster to include these items, at a -minimum. - -## 4.1 Worker Node Configuration Files -### 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. -All configuration is passed in as arguments at container run time. - -### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. -All configuration is passed in as arguments at container run time. - -### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 $proykubeconfig - -**Audit:** - -```bash -/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %a /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' -``` - -**Expected Result**: - -```console -'644' is present OR '640' is present OR '600' is equal to '600' OR '444' is present OR '440' is present OR '400' is present OR '000' is present -``` - -**Returned Value**: - -```console -600 -``` - -### 4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is not present OR '/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml' is not present -``` - -### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /etc/kubernetes/ssl/kubecfg-kube-node.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c permissions=%a /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' -``` - -**Expected Result**: - -```console -'permissions' is not present -``` - -### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the file permissions of the ---client-ca-file chmod 644 - -**Audit Script:** `check_cafile_permissions.sh` - -```bash -#!/usr/bin/env bash - -CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') -if test -z $CAFILE; then CAFILE=$kubeletcafile; fi -if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi - -``` - -**Audit Execution:** - -```bash -./check_cafile_permissions.sh -``` - -**Expected Result**: - -```console -'permissions' is not present -``` - -### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the ownership of the --client-ca-file. -chown root:root - -**Audit Script:** `check_cafile_ownership.sh` - -```bash -#!/usr/bin/env bash - -CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') -if test -z $CAFILE; then CAFILE=$kubeletcafile; fi -if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi - -``` - -**Audit Execution:** - -```bash -./check_cafile_ownership.sh -``` - -**Expected Result**: - -```console -'root:root' is not present -``` - -### 4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chmod 644 /var/lib/kubelet/config.yaml - -Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. -All configuration is passed in as arguments at container run time. - -### 4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chown root:root /var/lib/kubelet/config.yaml - -Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. -All configuration is passed in as arguments at container run time. - -## 4.2 Kubelet -### 4.2.1 Ensure that the anonymous-auth argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to -false. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---anonymous-auth=false -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /var/lib/kubelet/config.yaml -``` - -**Expected Result**: - -```console -'' is not present -``` - -### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set authorization: mode to Webhook. If -using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---authorization-mode=Webhook -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /var/lib/kubelet/config.yaml -``` - -**Expected Result**: - -```console -'' is not present -``` - -### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set authentication: x509: clientCAFile to -the location of the client CA file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---client-ca-file= -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /var/lib/kubelet/config.yaml -``` - -**Expected Result**: - -```console -'' is not present -``` - -### 4.2.4 Ensure that the --read-only-port argument is set to 0 (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set readOnlyPort to 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---read-only-port=0 -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /var/lib/kubelet/config.yaml -``` - -**Expected Result**: - -```console -'' is not present OR '' is not present -``` - -### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set streamingConnectionIdleTimeout to a -value other than 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---streaming-connection-idle-timeout=5m -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /var/lib/kubelet/config.yaml -``` - -**Expected Result**: - -```console -'30m' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 121813 121792 4 12:27 ? 00:03:37 kubelet --fail-swap-on=false --resolv-conf=/etc/resolv.conf --authorization-mode=Webhook --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --v=2 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --make-iptables-util-chains=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --hostname-override= --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-.pem --network-plugin=cni --streaming-connection-idle-timeout=30m --root-dir=/var/lib/kubelet --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --protect-kernel-defaults=true --cloud-provider= --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet--key.pem --cgroups-per-qos=True --cni-bin-dir=/opt/cni/bin --cni-conf-dir=/etc/cni/net.d --pod-infra-container-image=rancher/mirrored-pause:3.5 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --anonymous-auth=false --authentication-token-webhook=true --node-ip= --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --read-only-port=0 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set protectKernelDefaults: true. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---protect-kernel-defaults=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /var/lib/kubelet/config.yaml -``` - -**Expected Result**: - -```console -'' is not present -``` - -### 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set makeIPTablesUtilChains: true. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove the --make-iptables-util-chains argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /var/lib/kubelet/config.yaml -``` - -**Expected Result**: - -```console -'' is not present OR '' is not present -``` - -### 4.2.8 Ensure that the --hostname-override argument is not set (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and remove the --hostname-override argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -Clusters provisioned by RKE set the --hostname-override to avoid any hostname configuration errors - -### 4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set eventRecordQPS: to an appropriate level. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /var/lib/kubelet/config.yaml -``` - -**Expected Result**: - -```console -'' is not present -``` - -### 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set tlsCertFile to the location -of the certificate file to use to identify this Kubelet, and tlsPrivateKeyFile -to the location of the corresponding private key file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameters in KUBELET_CERTIFICATE_ARGS variable. ---tls-cert-file= ---tls-private-key-file= -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /var/lib/kubelet/config.yaml -``` - -**Expected Result**: - -```console -'' is not present AND '' is not present -``` - -### 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to add the line rotateCertificates: true or -remove it altogether to use the default value. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS -variable. -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /var/lib/kubelet/config.yaml -``` - -**Expected Result**: - -```console -'--rotate-certificates' is not present OR '--rotate-certificates' is not present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 121813 121792 4 12:27 ? 00:03:37 kubelet --fail-swap-on=false --resolv-conf=/etc/resolv.conf --authorization-mode=Webhook --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --v=2 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --make-iptables-util-chains=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --hostname-override= --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-.pem --network-plugin=cni --streaming-connection-idle-timeout=30m --root-dir=/var/lib/kubelet --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --protect-kernel-defaults=true --cloud-provider= --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet--key.pem --cgroups-per-qos=True --cni-bin-dir=/opt/cni/bin --cni-conf-dir=/etc/cni/net.d --pod-infra-container-image=rancher/mirrored-pause:3.5 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --anonymous-auth=false --authentication-token-webhook=true --node-ip= --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --read-only-port=0 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. ---feature-gates=RotateKubeletServerCertificate=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -Clusters provisioned by RKE handles certificate rotation directly through RKE. - -**Audit Config:** - -```bash -/bin/cat /var/lib/kubelet/config.yaml -``` - -### 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set TLSCipherSuites: to -TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -or to a subset of these values. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the --tls-cipher-suites parameter as follows, or to a subset of these values. ---tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /var/lib/kubelet/config.yaml -``` - -**Expected Result**: - -```console -'' is not present -``` - -## 5.1 RBAC and Service Accounts -### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) - - -**Result:** warn - -**Remediation:** -Identify all clusterrolebindings to the cluster-admin role. Check if they are used and -if they need this role or if they could use a role with fewer privileges. -Where possible, first bind users to a lower privileged role and then remove the -clusterrolebinding to the cluster-admin role : -kubectl delete clusterrolebinding [name] - -### 5.1.2 Minimize access to secrets (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove get, list and watch access to secret objects in the cluster. - -### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) - - -**Result:** warn - -**Remediation:** -Where possible replace any use of wildcards in clusterroles and roles with specific -objects or actions. - -### 5.1.4 Minimize access to create pods (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove create access to pod objects in the cluster. - -### 5.1.5 Ensure that default service accounts are not actively used. (Automated) - - -**Result:** pass - -**Remediation:** -Create explicit service accounts wherever a Kubernetes workload requires specific access -to the Kubernetes API server. -Modify the configuration of each default service account to include this value -automountServiceAccountToken: false - -**Audit Script:** `check_for_default_sa.sh` - -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -count_sa=$(kubectl get serviceaccounts --all-namespaces -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true))' | jq .metadata.namespace | wc -l) -if [[ ${count_sa} -gt 0 ]]; then - echo "false" - exit -fi - -for ns in $(kubectl get ns --no-headers -o custom-columns=":metadata.name") -do - for result in $(kubectl get clusterrolebinding,rolebinding -n $ns -o json | jq -r '.items[] | select((.subjects[].kind=="ServiceAccount" and .subjects[].name=="default") or (.subjects[].kind=="Group" and .subjects[].name=="system:serviceaccounts"))' | jq -r '"\(.roleRef.kind),\(.roleRef.name)"') - do - read kind name <<<$(IFS=","; echo $result) - resource_count=$(kubectl get $kind $name -n $ns -o json | jq -r '.rules[] | select(.resources[] != "podsecuritypolicies")' | wc -l) - if [[ ${resource_count} -gt 0 ]]; then - echo "false" - exit - fi - done -done - - -echo "true" -``` - -**Audit Execution:** - -```bash -./check_for_default_sa.sh -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -true -``` - -### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) - - -**Result:** warn - -**Remediation:** -Modify the definition of pods and service accounts which do not need to mount service -account tokens to disable it. - -## 5.2 Pod Security Policies -### 5.2.1 Minimize the admission of privileged containers (Manual) - - -**Result:** warn - -**Remediation:** -Create a PSP as described in the Kubernetes documentation, ensuring that -the .spec.privileged field is omitted or set to false. - -### 5.2.2 Minimize the admission of containers wishing to share the host process ID namespace (Automated) - - -**Result:** pass - -**Remediation:** -Create a PSP as described in the Kubernetes documentation, ensuring that the -.spec.hostPID field is omitted or set to false. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or (.spec.hostPID == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -1 is greater than 0 -``` - -**Returned Value**: - -```console ---count=1 -``` - -### 5.2.3 Minimize the admission of containers wishing to share the host IPC namespace (Automated) - - -**Result:** pass - -**Remediation:** -Create a PSP as described in the Kubernetes documentation, ensuring that the -.spec.hostIPC field is omitted or set to false. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostIPC == null) or (.spec.hostIPC == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -1 is greater than 0 -``` - -**Returned Value**: - -```console ---count=1 -``` - -### 5.2.4 Minimize the admission of containers wishing to share the host network namespace (Automated) - - -**Result:** pass - -**Remediation:** -Create a PSP as described in the Kubernetes documentation, ensuring that the -.spec.hostNetwork field is omitted or set to false. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostNetwork == null) or (.spec.hostNetwork == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -1 is greater than 0 -``` - -**Returned Value**: - -```console ---count=1 -``` - -### 5.2.5 Minimize the admission of containers with allowPrivilegeEscalation (Automated) - - -**Result:** pass - -**Remediation:** -Create a PSP as described in the Kubernetes documentation, ensuring that the -.spec.allowPrivilegeEscalation field is omitted or set to false. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -1 is greater than 0 -``` - -**Returned Value**: - -```console ---count=1 -``` - -### 5.2.6 Minimize the admission of root containers (Manual) - - -**Result:** warn - -**Remediation:** -Create a PSP as described in the Kubernetes documentation, ensuring that the -.spec.runAsUser.rule is set to either MustRunAsNonRoot or MustRunAs with the range of -UIDs not including 0. - -### 5.2.7 Minimize the admission of containers with the NET_RAW capability (Manual) - - -**Result:** warn - -**Remediation:** -Create a PSP as described in the Kubernetes documentation, ensuring that the -.spec.requiredDropCapabilities is set to include either NET_RAW or ALL. - -### 5.2.8 Minimize the admission of containers with added capabilities (Manual) - - -**Result:** warn - -**Remediation:** -Ensure that allowedCapabilities is not present in PSPs for the cluster unless -it is set to an empty array. - -### 5.2.9 Minimize the admission of containers with capabilities assigned (Manual) - - -**Result:** warn - -**Remediation:** -Review the use of capabilites in applications runnning on your cluster. Where a namespace -contains applicaions which do not require any Linux capabities to operate consider adding -a PSP which forbids the admission of containers which do not drop all capabilities. - -## 5.3 Network Policies and CNI -### 5.3.1 Ensure that the CNI in use supports Network Policies (Manual) - - -**Result:** warn - -**Remediation:** -If the CNI plugin in use does not support network policies, consideration should be given to -making use of a different plugin, or finding an alternate mechanism for restricting traffic -in the Kubernetes cluster. - -### 5.3.2 Ensure that all Namespaces have Network Policies defined (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and create NetworkPolicy objects as you need them. - -**Audit Script:** `check_for_network_policies.sh` - -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -for namespace in $(kubectl get namespaces --all-namespaces -o json | jq -r '.items[].metadata.name'); do - policy_count=$(kubectl get networkpolicy -n ${namespace} -o json | jq '.items | length') - if [[ ${policy_count} -eq 0 ]]; then - echo "false" - exit - fi -done - -echo "true" - -``` - -**Audit Execution:** - -```bash -./check_for_network_policies.sh -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -true -``` - -## 5.4 Secrets Management -### 5.4.1 Prefer using secrets as files over secrets as environment variables (Manual) - - -**Result:** warn - -**Remediation:** -if possible, rewrite application code to read secrets from mounted secret files, rather than -from environment variables. - -### 5.4.2 Consider external secret storage (Manual) - - -**Result:** warn - -**Remediation:** -Refer to the secrets management options offered by your cloud provider or a third-party -secrets management solution. - -## 5.5 Extensible Admission Control -### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and setup image provenance. - -## 5.7 General Policies -### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) - - -**Result:** warn - -**Remediation:** -Follow the documentation and create namespaces for objects in your deployment as you need -them. - -### 5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions (Manual) - - -**Result:** warn - -**Remediation:** -Seccomp is an alpha feature currently. By default, all alpha features are disabled. So, you -would need to enable alpha features in the apiserver by passing "--feature- -gates=AllAlpha=true" argument. -Edit the /etc/kubernetes/apiserver file on the master node and set the KUBE_API_ARGS -parameter to "--feature-gates=AllAlpha=true" -KUBE_API_ARGS="--feature-gates=AllAlpha=true" -Based on your system, restart the kube-apiserver service. For example: -systemctl restart kube-apiserver.service -Use annotations to enable the docker/default seccomp profile in your pod definitions. An -example is as below: -apiVersion: v1 -kind: Pod -metadata: - name: trustworthy-pod - annotations: - seccomp.security.alpha.kubernetes.io/pod: docker/default -spec: - containers: - - name: trustworthy-container - image: sotrustworthy:latest - -### 5.7.3 Apply Security Context to Your Pods and Containers (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and apply security contexts to your pods. For a -suggested list of security contexts, you may refer to the CIS Security Benchmark for Docker -Containers. - -### 5.7.4 The default namespace should not be used (Automated) - - -**Result:** pass - -**Remediation:** -Ensure that namespaces are created to allow for appropriate segregation of Kubernetes -resources and that all new resources are created in a specific namespace. - -**Audit Script:** `check_for_default_ns.sh` - -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -count=$(kubectl get all -n default -o json | jq .items[] | jq -r 'select((.metadata.name!="kubernetes"))' | jq .metadata.name | wc -l) -if [[ ${count} -gt 0 ]]; then - echo "false" - exit -fi - -echo "true" - - -``` - -**Audit Execution:** - -```bash -./check_for_default_ns.sh -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -true -``` - diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf deleted file mode 100644 index c61b5c4abc1..00000000000 --- a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf +++ /dev/null @@ -1,8259 +0,0 @@ -%PDF-1.7 -%🖤 -1 0 obj -<< -/Type /Pages -/Kids [ 6 0 R 8 0 R 30 0 R 45 0 R 53 0 R 67 0 R 77 0 R 99 0 R 129 0 R 164 0 R 194 0 R 232 0 R 270 0 R 310 0 R 350 0 R 390 0 R 425 0 R 464 0 R 499 0 R 534 0 R 557 0 R 591 0 R ] -/Count 22 ->> -endobj -2 0 obj -<< -/Title (Hardening Guide with CIS v1.6 Benchmark) -/Creator (pandoc) -/Producer (WeasyPrint 54.2) ->> -endobj -3 0 obj -<< -/Type /Catalog -/Pages 1 0 R -/Outlines 611 0 R -/Names << -/Dests << -/Names [ (TOC) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (cb1) [ 45 0 R /XYZ 84.259843 441.572079 0 ] (cb1-1) [ 45 0 R /XYZ 101.433071 439.875057 0 ] (cb1-2) [ 45 0 R /XYZ 99.933071 420.928036 0 ] (cb1-3) [ 45 0 R /XYZ 99.933071 401.981014 0 ] (cb1-4) [ 45 0 R /XYZ 99.933071 383.033993 0 ] (cb1-5) [ 45 0 R /XYZ 99.933071 364.086971 0 ] (cb10) [ 390 0 R /XYZ 84.259843 416.811778 0 ] (cb10-1) [ 390 0 R /XYZ 101.433071 415.114756 0 ] (cb10-10) [ 390 0 R /XYZ 99.933071 244.591563 0 ] (cb10-100) [ 499 0 R /XYZ 99.933071 590.755821 0 ] (cb10-101) [ 499 0 R /XYZ 99.933071 571.808799 0 ] (cb10-102) [ 499 0 R /XYZ 99.933071 552.861778 0 ] (cb10-103) [ 499 0 R /XYZ 99.933071 533.914756 0 ] (cb10-104) [ 499 0 R /XYZ 99.933071 514.967735 0 ] (cb10-105) [ 499 0 R /XYZ 99.933071 496.020714 0 ] (cb10-106) [ 499 0 R /XYZ 99.933071 477.073692 0 ] (cb10-107) [ 499 0 R /XYZ 99.933071 458.126671 0 ] (cb10-108) [ 499 0 R /XYZ 99.933071 439.179649 0 ] (cb10-109) [ 499 0 R /XYZ 99.933071 420.232628 0 ] (cb10-11) [ 390 0 R /XYZ 99.933071 225.644542 0 ] (cb10-110) [ 499 0 R /XYZ 99.933071 401.285606 0 ] (cb10-111) [ 499 0 R /XYZ 99.933071 382.338585 0 ] (cb10-112) [ 499 0 R /XYZ 99.933071 363.391563 0 ] (cb10-113) [ 499 0 R /XYZ 99.933071 344.444542 0 ] (cb10-114) [ 499 0 R /XYZ 99.933071 325.497520 0 ] (cb10-115) [ 499 0 R /XYZ 99.933071 306.550499 0 ] (cb10-116) [ 499 0 R /XYZ 99.933071 287.603477 0 ] (cb10-117) [ 499 0 R /XYZ 99.933071 173.921348 0 ] (cb10-118) [ 499 0 R /XYZ 99.933071 154.974327 0 ] (cb10-119) [ 499 0 R /XYZ 99.933071 136.027305 0 ] (cb10-12) [ 390 0 R /XYZ 99.933071 206.697520 0 ] (cb10-120) [ 499 0 R /XYZ 99.933071 117.080284 0 ] (cb10-121) [ 499 0 R /XYZ 99.933071 98.133262 0 ] (cb10-122) [ 534 0 R /XYZ 99.933071 799.173057 0 ] (cb10-123) [ 534 0 R /XYZ 99.933071 685.490928 0 ] (cb10-124) [ 534 0 R /XYZ 99.933071 666.543907 0 ] (cb10-125) [ 534 0 R /XYZ 99.933071 647.596885 0 ] (cb10-126) [ 534 0 R /XYZ 99.933071 628.649864 0 ] (cb10-127) [ 534 0 R /XYZ 99.933071 609.702842 0 ] (cb10-128) [ 534 0 R /XYZ 99.933071 590.755821 0 ] (cb10-129) [ 534 0 R /XYZ 99.933071 571.808799 0 ] (cb10-13) [ 390 0 R /XYZ 99.933071 187.750499 0 ] (cb10-14) [ 390 0 R /XYZ 99.933071 168.803477 0 ] (cb10-15) [ 390 0 R /XYZ 99.933071 149.856456 0 ] (cb10-16) [ 390 0 R /XYZ 99.933071 130.909434 0 ] (cb10-17) [ 390 0 R /XYZ 99.933071 111.962413 0 ] (cb10-18) [ 390 0 R /XYZ 99.933071 93.015391 0 ] (cb10-19) [ 425 0 R /XYZ 99.933071 799.173057 0 ] (cb10-2) [ 390 0 R /XYZ 99.933071 396.167735 0 ] (cb10-20) [ 425 0 R /XYZ 99.933071 780.226036 0 ] (cb10-21) [ 425 0 R /XYZ 99.933071 761.279014 0 ] (cb10-22) [ 425 0 R /XYZ 99.933071 742.331993 0 ] (cb10-23) [ 425 0 R /XYZ 99.933071 723.384971 0 ] (cb10-24) [ 425 0 R /XYZ 99.933071 704.437950 0 ] (cb10-25) [ 425 0 R /XYZ 99.933071 685.490928 0 ] (cb10-26) [ 425 0 R /XYZ 99.933071 666.543907 0 ] (cb10-27) [ 425 0 R /XYZ 99.933071 647.596885 0 ] (cb10-28) [ 425 0 R /XYZ 99.933071 628.649864 0 ] (cb10-29) [ 425 0 R /XYZ 99.933071 609.702842 0 ] (cb10-3) [ 390 0 R /XYZ 99.933071 377.220714 0 ] (cb10-30) [ 425 0 R /XYZ 99.933071 571.808799 0 ] (cb10-31) [ 425 0 R /XYZ 99.933071 552.861778 0 ] (cb10-32) [ 425 0 R /XYZ 99.933071 533.914756 0 ] (cb10-33) [ 425 0 R /XYZ 99.933071 514.967735 0 ] (cb10-34) [ 425 0 R /XYZ 99.933071 496.020714 0 ] (cb10-35) [ 425 0 R /XYZ 99.933071 477.073692 0 ] (cb10-36) [ 425 0 R /XYZ 99.933071 458.126671 0 ] (cb10-37) [ 425 0 R /XYZ 99.933071 439.179649 0 ] (cb10-38) [ 425 0 R /XYZ 99.933071 420.232628 0 ] (cb10-39) [ 425 0 R /XYZ 99.933071 401.285606 0 ] (cb10-4) [ 390 0 R /XYZ 99.933071 358.273692 0 ] (cb10-40) [ 425 0 R /XYZ 99.933071 382.338585 0 ] (cb10-41) [ 425 0 R /XYZ 99.933071 363.391563 0 ] (cb10-42) [ 425 0 R /XYZ 99.933071 344.444542 0 ] (cb10-43) [ 425 0 R /XYZ 99.933071 325.497520 0 ] (cb10-44) [ 425 0 R /XYZ 99.933071 306.550499 0 ] (cb10-45) [ 425 0 R /XYZ 99.933071 287.603477 0 ] (cb10-46) [ 425 0 R /XYZ 99.933071 268.656456 0 ] (cb10-47) [ 425 0 R /XYZ 99.933071 249.709434 0 ] (cb10-48) [ 425 0 R /XYZ 99.933071 230.762413 0 ] (cb10-49) [ 425 0 R /XYZ 99.933071 211.815391 0 ] (cb10-5) [ 390 0 R /XYZ 99.933071 339.326671 0 ] (cb10-50) [ 425 0 R /XYZ 99.933071 192.868370 0 ] (cb10-51) [ 425 0 R /XYZ 99.933071 173.921348 0 ] (cb10-52) [ 425 0 R /XYZ 99.933071 154.974327 0 ] (cb10-53) [ 425 0 R /XYZ 99.933071 136.027305 0 ] (cb10-54) [ 425 0 R /XYZ 99.933071 117.080284 0 ] (cb10-55) [ 425 0 R /XYZ 99.933071 98.133262 0 ] (cb10-56) [ 464 0 R /XYZ 99.933071 799.173057 0 ] (cb10-57) [ 464 0 R /XYZ 99.933071 780.226036 0 ] (cb10-58) [ 464 0 R /XYZ 99.933071 761.279014 0 ] (cb10-59) [ 464 0 R /XYZ 99.933071 742.331993 0 ] (cb10-6) [ 390 0 R /XYZ 99.933071 320.379649 0 ] (cb10-60) [ 464 0 R /XYZ 99.933071 723.384971 0 ] (cb10-61) [ 464 0 R /XYZ 99.933071 704.437950 0 ] (cb10-62) [ 464 0 R /XYZ 99.933071 685.490928 0 ] (cb10-63) [ 464 0 R /XYZ 99.933071 666.543907 0 ] (cb10-64) [ 464 0 R /XYZ 99.933071 647.596885 0 ] (cb10-65) [ 464 0 R /XYZ 99.933071 628.649864 0 ] (cb10-66) [ 464 0 R /XYZ 99.933071 609.702842 0 ] (cb10-67) [ 464 0 R /XYZ 99.933071 590.755821 0 ] (cb10-68) [ 464 0 R /XYZ 99.933071 571.808799 0 ] (cb10-69) [ 464 0 R /XYZ 99.933071 552.861778 0 ] (cb10-7) [ 390 0 R /XYZ 99.933071 301.432628 0 ] (cb10-70) [ 464 0 R /XYZ 99.933071 533.914756 0 ] (cb10-71) [ 464 0 R /XYZ 99.933071 514.967735 0 ] (cb10-72) [ 464 0 R /XYZ 99.933071 496.020714 0 ] (cb10-73) [ 464 0 R /XYZ 99.933071 477.073692 0 ] (cb10-74) [ 464 0 R /XYZ 99.933071 458.126671 0 ] (cb10-75) [ 464 0 R /XYZ 99.933071 439.179649 0 ] (cb10-76) [ 464 0 R /XYZ 99.933071 420.232628 0 ] (cb10-77) [ 464 0 R /XYZ 99.933071 401.285606 0 ] (cb10-78) [ 464 0 R /XYZ 99.933071 382.338585 0 ] (cb10-79) [ 464 0 R /XYZ 99.933071 363.391563 0 ] (cb10-8) [ 390 0 R /XYZ 99.933071 282.485606 0 ] (cb10-80) [ 464 0 R /XYZ 99.933071 344.444542 0 ] (cb10-81) [ 464 0 R /XYZ 99.933071 325.497520 0 ] (cb10-82) [ 464 0 R /XYZ 99.933071 306.550499 0 ] (cb10-83) [ 464 0 R /XYZ 99.933071 287.603477 0 ] (cb10-84) [ 464 0 R /XYZ 99.933071 268.656456 0 ] (cb10-85) [ 464 0 R /XYZ 99.933071 249.709434 0 ] (cb10-86) [ 464 0 R /XYZ 99.933071 230.762413 0 ] (cb10-87) [ 464 0 R /XYZ 99.933071 117.080284 0 ] (cb10-88) [ 464 0 R /XYZ 99.933071 98.133262 0 ] (cb10-89) [ 499 0 R /XYZ 99.933071 799.173057 0 ] (cb10-9) [ 390 0 R /XYZ 99.933071 263.538585 0 ] (cb10-90) [ 499 0 R /XYZ 99.933071 780.226036 0 ] (cb10-91) [ 499 0 R /XYZ 99.933071 761.279014 0 ] (cb10-92) [ 499 0 R /XYZ 99.933071 742.331993 0 ] (cb10-93) [ 499 0 R /XYZ 99.933071 723.384971 0 ] (cb10-94) [ 499 0 R /XYZ 99.933071 704.437950 0 ] (cb10-95) [ 499 0 R /XYZ 99.933071 685.490928 0 ] (cb10-96) [ 499 0 R /XYZ 99.933071 666.543907 0 ] (cb10-97) [ 499 0 R /XYZ 99.933071 647.596885 0 ] (cb10-98) [ 499 0 R /XYZ 99.933071 628.649864 0 ] (cb10-99) [ 499 0 R /XYZ 99.933071 609.702842 0 ] (cb11) [ 534 0 R /XYZ 84.259843 331.262799 0 ] (cb11-1) [ 534 0 R /XYZ 101.433071 329.565778 0 ] (cb11-10) [ 534 0 R /XYZ 99.933071 159.042585 0 ] (cb11-11) [ 534 0 R /XYZ 99.933071 140.095563 0 ] (cb11-12) [ 534 0 R /XYZ 99.933071 121.148542 0 ] (cb11-13) [ 534 0 R /XYZ 99.933071 102.201520 0 ] (cb11-14) [ 557 0 R /XYZ 99.933071 799.173057 0 ] (cb11-15) [ 557 0 R /XYZ 99.933071 780.226036 0 ] (cb11-16) [ 557 0 R /XYZ 99.933071 761.279014 0 ] (cb11-17) [ 557 0 R /XYZ 99.933071 742.331993 0 ] (cb11-18) [ 557 0 R /XYZ 99.933071 723.384971 0 ] (cb11-19) [ 557 0 R /XYZ 99.933071 704.437950 0 ] (cb11-2) [ 534 0 R /XYZ 99.933071 310.618756 0 ] (cb11-20) [ 557 0 R /XYZ 99.933071 685.490928 0 ] (cb11-21) [ 557 0 R /XYZ 99.933071 666.543907 0 ] (cb11-22) [ 557 0 R /XYZ 99.933071 647.596885 0 ] (cb11-23) [ 557 0 R /XYZ 99.933071 628.649864 0 ] (cb11-24) [ 557 0 R /XYZ 99.933071 609.702842 0 ] (cb11-25) [ 557 0 R /XYZ 99.933071 590.755821 0 ] (cb11-26) [ 557 0 R /XYZ 99.933071 571.808799 0 ] (cb11-3) [ 534 0 R /XYZ 99.933071 291.671735 0 ] (cb11-4) [ 534 0 R /XYZ 99.933071 272.724714 0 ] (cb11-5) [ 534 0 R /XYZ 99.933071 253.777692 0 ] (cb11-6) [ 534 0 R /XYZ 99.933071 234.830671 0 ] (cb11-7) [ 534 0 R /XYZ 99.933071 215.883649 0 ] (cb11-8) [ 534 0 R /XYZ 99.933071 196.936628 0 ] (cb11-9) [ 534 0 R /XYZ 99.933071 177.989606 0 ] (cb12) [ 557 0 R /XYZ 84.259843 446.115778 0 ] (cb12-1) [ 557 0 R /XYZ 101.433071 444.418756 0 ] (cb12-10) [ 557 0 R /XYZ 99.933071 273.895563 0 ] (cb12-11) [ 557 0 R /XYZ 99.933071 254.948542 0 ] (cb12-12) [ 557 0 R /XYZ 99.933071 236.001520 0 ] (cb12-13) [ 557 0 R /XYZ 99.933071 217.054499 0 ] (cb12-14) [ 557 0 R /XYZ 99.933071 198.107477 0 ] (cb12-15) [ 557 0 R /XYZ 99.933071 179.160456 0 ] (cb12-16) [ 557 0 R /XYZ 99.933071 160.213434 0 ] (cb12-17) [ 557 0 R /XYZ 99.933071 141.266413 0 ] (cb12-18) [ 557 0 R /XYZ 99.933071 122.319391 0 ] (cb12-19) [ 557 0 R /XYZ 99.933071 103.372370 0 ] (cb12-2) [ 557 0 R /XYZ 99.933071 425.471735 0 ] (cb12-20) [ 591 0 R /XYZ 99.933071 780.226036 0 ] (cb12-21) [ 591 0 R /XYZ 99.933071 742.331993 0 ] (cb12-22) [ 591 0 R /XYZ 99.933071 723.384971 0 ] (cb12-23) [ 591 0 R /XYZ 99.933071 704.437950 0 ] (cb12-3) [ 557 0 R /XYZ 99.933071 406.524714 0 ] (cb12-4) [ 557 0 R /XYZ 99.933071 387.577692 0 ] (cb12-5) [ 557 0 R /XYZ 99.933071 368.630671 0 ] (cb12-6) [ 557 0 R /XYZ 99.933071 349.683649 0 ] (cb12-7) [ 557 0 R /XYZ 99.933071 330.736628 0 ] (cb12-8) [ 557 0 R /XYZ 99.933071 311.789606 0 ] (cb12-9) [ 557 0 R /XYZ 99.933071 292.842585 0 ] (cb2) [ 53 0 R /XYZ 84.259843 753.620079 0 ] (cb2-1) [ 53 0 R /XYZ 101.433071 751.923057 0 ] (cb2-2) [ 53 0 R /XYZ 99.933071 732.976036 0 ] (cb3) [ 53 0 R /XYZ 84.259843 654.779014 0 ] (cb3-1) [ 53 0 R /XYZ 101.433071 653.081993 0 ] (cb3-2) [ 53 0 R /XYZ 99.933071 634.134971 0 ] (cb3-3) [ 53 0 R /XYZ 99.933071 615.187950 0 ] (cb3-4) [ 53 0 R /XYZ 99.933071 596.240928 0 ] (cb4) [ 53 0 R /XYZ 84.259843 282.344928 0 ] (cb4-1) [ 53 0 R /XYZ 101.433071 280.647907 0 ] (cb5) [ 53 0 R /XYZ 84.259843 217.647907 0 ] (cb5-1) [ 53 0 R /XYZ 101.433071 215.950885 0 ] (cb5-2) [ 53 0 R /XYZ 99.933071 197.003864 0 ] (cb5-3) [ 53 0 R /XYZ 99.933071 178.056842 0 ] (cb5-4) [ 53 0 R /XYZ 99.933071 159.109821 0 ] (cb5-5) [ 53 0 R /XYZ 99.933071 140.162799 0 ] (cb6) [ 67 0 R /XYZ 84.259843 749.870079 0 ] (cb6-1) [ 67 0 R /XYZ 101.433071 748.173057 0 ] (cb6-2) [ 67 0 R /XYZ 99.933071 729.226036 0 ] (cb6-3) [ 67 0 R /XYZ 99.933071 710.279014 0 ] (cb6-4) [ 67 0 R /XYZ 99.933071 672.384971 0 ] (cb6-5) [ 67 0 R /XYZ 99.933071 634.490928 0 ] (cb7) [ 77 0 R /XYZ 84.259843 716.781496 0 ] (cb7-1) [ 77 0 R /XYZ 101.433071 715.084475 0 ] (cb7-10) [ 77 0 R /XYZ 99.933071 544.561281 0 ] (cb7-11) [ 77 0 R /XYZ 99.933071 525.614260 0 ] (cb7-12) [ 77 0 R /XYZ 99.933071 506.667238 0 ] (cb7-13) [ 77 0 R /XYZ 99.933071 487.720217 0 ] (cb7-14) [ 77 0 R /XYZ 99.933071 468.773195 0 ] (cb7-2) [ 77 0 R /XYZ 99.933071 696.137453 0 ] (cb7-3) [ 77 0 R /XYZ 99.933071 677.190432 0 ] (cb7-4) [ 77 0 R /XYZ 99.933071 658.243410 0 ] (cb7-5) [ 77 0 R /XYZ 99.933071 639.296389 0 ] (cb7-6) [ 77 0 R /XYZ 99.933071 620.349367 0 ] (cb7-7) [ 77 0 R /XYZ 99.933071 601.402346 0 ] (cb7-8) [ 77 0 R /XYZ 99.933071 582.455324 0 ] (cb7-9) [ 77 0 R /XYZ 99.933071 563.508303 0 ] (cb8) [ 77 0 R /XYZ 84.259843 372.023195 0 ] (cb8-1) [ 77 0 R /XYZ 101.433071 370.326174 0 ] (cb8-2) [ 77 0 R /XYZ 99.933071 351.379152 0 ] (cb8-3) [ 77 0 R /XYZ 99.933071 332.432131 0 ] (cb8-4) [ 77 0 R /XYZ 99.933071 294.538088 0 ] (cb8-5) [ 77 0 R /XYZ 99.933071 275.591066 0 ] (cb9) [ 99 0 R /XYZ 84.259843 652.281496 0 ] (cb9-1) [ 99 0 R /XYZ 101.433071 650.584475 0 ] (cb9-10) [ 99 0 R /XYZ 99.933071 423.220217 0 ] (cb9-100) [ 194 0 R /XYZ 99.933071 590.755821 0 ] (cb9-101) [ 194 0 R /XYZ 99.933071 571.808799 0 ] (cb9-102) [ 194 0 R /XYZ 99.933071 552.861778 0 ] (cb9-103) [ 194 0 R /XYZ 99.933071 533.914756 0 ] (cb9-104) [ 194 0 R /XYZ 99.933071 514.967735 0 ] (cb9-105) [ 194 0 R /XYZ 99.933071 496.020714 0 ] (cb9-106) [ 194 0 R /XYZ 99.933071 477.073692 0 ] (cb9-107) [ 194 0 R /XYZ 99.933071 458.126671 0 ] (cb9-108) [ 194 0 R /XYZ 99.933071 439.179649 0 ] (cb9-109) [ 194 0 R /XYZ 99.933071 420.232628 0 ] (cb9-11) [ 99 0 R /XYZ 99.933071 404.273195 0 ] (cb9-110) [ 194 0 R /XYZ 99.933071 401.285606 0 ] (cb9-111) [ 194 0 R /XYZ 99.933071 344.444542 0 ] (cb9-112) [ 194 0 R /XYZ 99.933071 325.497520 0 ] (cb9-113) [ 194 0 R /XYZ 99.933071 306.550499 0 ] (cb9-114) [ 194 0 R /XYZ 99.933071 287.603477 0 ] (cb9-115) [ 194 0 R /XYZ 99.933071 268.656456 0 ] (cb9-116) [ 194 0 R /XYZ 99.933071 249.709434 0 ] (cb9-117) [ 194 0 R /XYZ 99.933071 230.762413 0 ] (cb9-118) [ 194 0 R /XYZ 99.933071 211.815391 0 ] (cb9-119) [ 194 0 R /XYZ 99.933071 192.868370 0 ] (cb9-12) [ 99 0 R /XYZ 99.933071 385.326174 0 ] (cb9-120) [ 194 0 R /XYZ 99.933071 173.921348 0 ] (cb9-121) [ 194 0 R /XYZ 99.933071 154.974327 0 ] (cb9-122) [ 194 0 R /XYZ 99.933071 136.027305 0 ] (cb9-123) [ 194 0 R /XYZ 99.933071 117.080284 0 ] (cb9-124) [ 194 0 R /XYZ 99.933071 98.133262 0 ] (cb9-125) [ 232 0 R /XYZ 99.933071 799.173057 0 ] (cb9-126) [ 232 0 R /XYZ 99.933071 780.226036 0 ] (cb9-127) [ 232 0 R /XYZ 99.933071 761.279014 0 ] (cb9-128) [ 232 0 R /XYZ 99.933071 742.331993 0 ] (cb9-129) [ 232 0 R /XYZ 99.933071 704.437950 0 ] (cb9-13) [ 99 0 R /XYZ 99.933071 366.379152 0 ] (cb9-130) [ 232 0 R /XYZ 99.933071 685.490928 0 ] (cb9-131) [ 232 0 R /XYZ 99.933071 666.543907 0 ] (cb9-132) [ 232 0 R /XYZ 99.933071 647.596885 0 ] (cb9-133) [ 232 0 R /XYZ 99.933071 628.649864 0 ] (cb9-134) [ 232 0 R /XYZ 99.933071 609.702842 0 ] (cb9-135) [ 232 0 R /XYZ 99.933071 590.755821 0 ] (cb9-136) [ 232 0 R /XYZ 99.933071 571.808799 0 ] (cb9-137) [ 232 0 R /XYZ 99.933071 552.861778 0 ] (cb9-138) [ 232 0 R /XYZ 99.933071 533.914756 0 ] (cb9-139) [ 232 0 R /XYZ 99.933071 514.967735 0 ] (cb9-14) [ 99 0 R /XYZ 99.933071 347.432131 0 ] (cb9-140) [ 232 0 R /XYZ 99.933071 477.073692 0 ] (cb9-141) [ 232 0 R /XYZ 99.933071 458.126671 0 ] (cb9-142) [ 232 0 R /XYZ 99.933071 439.179649 0 ] (cb9-143) [ 232 0 R /XYZ 99.933071 420.232628 0 ] (cb9-144) [ 232 0 R /XYZ 99.933071 401.285606 0 ] (cb9-145) [ 232 0 R /XYZ 99.933071 382.338585 0 ] (cb9-146) [ 232 0 R /XYZ 99.933071 363.391563 0 ] (cb9-147) [ 232 0 R /XYZ 99.933071 344.444542 0 ] (cb9-148) [ 232 0 R /XYZ 99.933071 325.497520 0 ] (cb9-149) [ 232 0 R /XYZ 99.933071 306.550499 0 ] (cb9-15) [ 99 0 R /XYZ 99.933071 328.485109 0 ] (cb9-150) [ 232 0 R /XYZ 99.933071 287.603477 0 ] (cb9-151) [ 232 0 R /XYZ 99.933071 268.656456 0 ] (cb9-152) [ 232 0 R /XYZ 99.933071 249.709434 0 ] (cb9-153) [ 232 0 R /XYZ 99.933071 230.762413 0 ] (cb9-154) [ 232 0 R /XYZ 99.933071 211.815391 0 ] (cb9-155) [ 232 0 R /XYZ 99.933071 192.868370 0 ] (cb9-156) [ 232 0 R /XYZ 99.933071 173.921348 0 ] (cb9-157) [ 232 0 R /XYZ 99.933071 154.974327 0 ] (cb9-158) [ 232 0 R /XYZ 99.933071 136.027305 0 ] (cb9-159) [ 232 0 R /XYZ 99.933071 117.080284 0 ] (cb9-16) [ 99 0 R /XYZ 99.933071 309.538088 0 ] (cb9-160) [ 232 0 R /XYZ 99.933071 98.133262 0 ] (cb9-161) [ 270 0 R /XYZ 99.933071 799.173057 0 ] (cb9-162) [ 270 0 R /XYZ 99.933071 780.226036 0 ] (cb9-163) [ 270 0 R /XYZ 99.933071 761.279014 0 ] (cb9-164) [ 270 0 R /XYZ 99.933071 742.331993 0 ] (cb9-165) [ 270 0 R /XYZ 99.933071 723.384971 0 ] (cb9-166) [ 270 0 R /XYZ 99.933071 704.437950 0 ] (cb9-167) [ 270 0 R /XYZ 99.933071 685.490928 0 ] (cb9-168) [ 270 0 R /XYZ 99.933071 666.543907 0 ] (cb9-169) [ 270 0 R /XYZ 99.933071 647.596885 0 ] (cb9-17) [ 99 0 R /XYZ 99.933071 290.591066 0 ] (cb9-170) [ 270 0 R /XYZ 99.933071 628.649864 0 ] (cb9-171) [ 270 0 R /XYZ 99.933071 609.702842 0 ] (cb9-172) [ 270 0 R /XYZ 99.933071 590.755821 0 ] (cb9-173) [ 270 0 R /XYZ 99.933071 571.808799 0 ] (cb9-174) [ 270 0 R /XYZ 99.933071 552.861778 0 ] (cb9-175) [ 270 0 R /XYZ 99.933071 533.914756 0 ] (cb9-176) [ 270 0 R /XYZ 99.933071 514.967735 0 ] (cb9-177) [ 270 0 R /XYZ 99.933071 496.020714 0 ] (cb9-178) [ 270 0 R /XYZ 99.933071 477.073692 0 ] (cb9-179) [ 270 0 R /XYZ 99.933071 458.126671 0 ] (cb9-18) [ 99 0 R /XYZ 99.933071 271.644045 0 ] (cb9-180) [ 270 0 R /XYZ 99.933071 439.179649 0 ] (cb9-181) [ 270 0 R /XYZ 99.933071 420.232628 0 ] (cb9-182) [ 270 0 R /XYZ 99.933071 401.285606 0 ] (cb9-183) [ 270 0 R /XYZ 99.933071 382.338585 0 ] (cb9-184) [ 270 0 R /XYZ 99.933071 363.391563 0 ] (cb9-185) [ 270 0 R /XYZ 99.933071 344.444542 0 ] (cb9-186) [ 270 0 R /XYZ 99.933071 325.497520 0 ] (cb9-187) [ 270 0 R /XYZ 99.933071 306.550499 0 ] (cb9-188) [ 270 0 R /XYZ 99.933071 287.603477 0 ] (cb9-189) [ 270 0 R /XYZ 99.933071 268.656456 0 ] (cb9-19) [ 99 0 R /XYZ 99.933071 252.697023 0 ] (cb9-190) [ 270 0 R /XYZ 99.933071 249.709434 0 ] (cb9-191) [ 270 0 R /XYZ 99.933071 230.762413 0 ] (cb9-192) [ 270 0 R /XYZ 99.933071 211.815391 0 ] (cb9-193) [ 270 0 R /XYZ 99.933071 192.868370 0 ] (cb9-194) [ 270 0 R /XYZ 99.933071 173.921348 0 ] (cb9-195) [ 270 0 R /XYZ 99.933071 154.974327 0 ] (cb9-196) [ 270 0 R /XYZ 99.933071 136.027305 0 ] (cb9-197) [ 270 0 R /XYZ 99.933071 117.080284 0 ] (cb9-198) [ 270 0 R /XYZ 99.933071 98.133262 0 ] (cb9-199) [ 310 0 R /XYZ 99.933071 799.173057 0 ] (cb9-2) [ 99 0 R /XYZ 99.933071 612.690432 0 ] (cb9-20) [ 99 0 R /XYZ 99.933071 233.750002 0 ] (cb9-200) [ 310 0 R /XYZ 99.933071 780.226036 0 ] (cb9-201) [ 310 0 R /XYZ 99.933071 761.279014 0 ] (cb9-202) [ 310 0 R /XYZ 99.933071 742.331993 0 ] (cb9-203) [ 310 0 R /XYZ 99.933071 723.384971 0 ] (cb9-204) [ 310 0 R /XYZ 99.933071 704.437950 0 ] (cb9-205) [ 310 0 R /XYZ 99.933071 685.490928 0 ] (cb9-206) [ 310 0 R /XYZ 99.933071 666.543907 0 ] (cb9-207) [ 310 0 R /XYZ 99.933071 647.596885 0 ] (cb9-208) [ 310 0 R /XYZ 99.933071 628.649864 0 ] (cb9-209) [ 310 0 R /XYZ 99.933071 609.702842 0 ] (cb9-21) [ 99 0 R /XYZ 99.933071 214.802980 0 ] (cb9-210) [ 310 0 R /XYZ 99.933071 590.755821 0 ] (cb9-211) [ 310 0 R /XYZ 99.933071 571.808799 0 ] (cb9-212) [ 310 0 R /XYZ 99.933071 552.861778 0 ] (cb9-213) [ 310 0 R /XYZ 99.933071 533.914756 0 ] (cb9-214) [ 310 0 R /XYZ 99.933071 514.967735 0 ] (cb9-215) [ 310 0 R /XYZ 99.933071 496.020714 0 ] (cb9-216) [ 310 0 R /XYZ 99.933071 477.073692 0 ] (cb9-217) [ 310 0 R /XYZ 99.933071 458.126671 0 ] (cb9-218) [ 310 0 R /XYZ 99.933071 439.179649 0 ] (cb9-219) [ 310 0 R /XYZ 99.933071 420.232628 0 ] (cb9-22) [ 99 0 R /XYZ 99.933071 195.855959 0 ] (cb9-220) [ 310 0 R /XYZ 99.933071 401.285606 0 ] (cb9-221) [ 310 0 R /XYZ 99.933071 382.338585 0 ] (cb9-222) [ 310 0 R /XYZ 99.933071 363.391563 0 ] (cb9-223) [ 310 0 R /XYZ 99.933071 344.444542 0 ] (cb9-224) [ 310 0 R /XYZ 99.933071 325.497520 0 ] (cb9-225) [ 310 0 R /XYZ 99.933071 306.550499 0 ] (cb9-226) [ 310 0 R /XYZ 99.933071 287.603477 0 ] (cb9-227) [ 310 0 R /XYZ 99.933071 268.656456 0 ] (cb9-228) [ 310 0 R /XYZ 99.933071 249.709434 0 ] (cb9-229) [ 310 0 R /XYZ 99.933071 230.762413 0 ] (cb9-23) [ 99 0 R /XYZ 99.933071 176.908937 0 ] (cb9-230) [ 310 0 R /XYZ 99.933071 211.815391 0 ] (cb9-231) [ 310 0 R /XYZ 99.933071 192.868370 0 ] (cb9-232) [ 310 0 R /XYZ 99.933071 173.921348 0 ] (cb9-233) [ 310 0 R /XYZ 99.933071 154.974327 0 ] (cb9-234) [ 310 0 R /XYZ 99.933071 136.027305 0 ] (cb9-235) [ 310 0 R /XYZ 99.933071 117.080284 0 ] (cb9-236) [ 310 0 R /XYZ 99.933071 98.133262 0 ] (cb9-237) [ 350 0 R /XYZ 99.933071 799.173057 0 ] (cb9-238) [ 350 0 R /XYZ 99.933071 780.226036 0 ] (cb9-239) [ 350 0 R /XYZ 99.933071 761.279014 0 ] (cb9-24) [ 99 0 R /XYZ 99.933071 157.961916 0 ] (cb9-240) [ 350 0 R /XYZ 99.933071 742.331993 0 ] (cb9-241) [ 350 0 R /XYZ 99.933071 723.384971 0 ] (cb9-242) [ 350 0 R /XYZ 99.933071 704.437950 0 ] (cb9-243) [ 350 0 R /XYZ 99.933071 685.490928 0 ] (cb9-244) [ 350 0 R /XYZ 99.933071 666.543907 0 ] (cb9-245) [ 350 0 R /XYZ 99.933071 647.596885 0 ] (cb9-246) [ 350 0 R /XYZ 99.933071 628.649864 0 ] (cb9-247) [ 350 0 R /XYZ 99.933071 609.702842 0 ] (cb9-248) [ 350 0 R /XYZ 99.933071 590.755821 0 ] (cb9-249) [ 350 0 R /XYZ 99.933071 571.808799 0 ] (cb9-25) [ 99 0 R /XYZ 99.933071 139.014895 0 ] (cb9-250) [ 350 0 R /XYZ 99.933071 552.861778 0 ] (cb9-251) [ 350 0 R /XYZ 99.933071 533.914756 0 ] (cb9-252) [ 350 0 R /XYZ 99.933071 514.967735 0 ] (cb9-253) [ 350 0 R /XYZ 99.933071 496.020714 0 ] (cb9-254) [ 350 0 R /XYZ 99.933071 477.073692 0 ] (cb9-255) [ 350 0 R /XYZ 99.933071 458.126671 0 ] (cb9-256) [ 350 0 R /XYZ 99.933071 439.179649 0 ] (cb9-257) [ 350 0 R /XYZ 99.933071 420.232628 0 ] (cb9-258) [ 350 0 R /XYZ 99.933071 401.285606 0 ] (cb9-259) [ 350 0 R /XYZ 99.933071 382.338585 0 ] (cb9-26) [ 99 0 R /XYZ 99.933071 120.067873 0 ] (cb9-260) [ 350 0 R /XYZ 99.933071 363.391563 0 ] (cb9-261) [ 350 0 R /XYZ 99.933071 344.444542 0 ] (cb9-262) [ 350 0 R /XYZ 99.933071 325.497520 0 ] (cb9-263) [ 350 0 R /XYZ 99.933071 306.550499 0 ] (cb9-264) [ 350 0 R /XYZ 99.933071 287.603477 0 ] (cb9-265) [ 350 0 R /XYZ 99.933071 268.656456 0 ] (cb9-266) [ 350 0 R /XYZ 99.933071 249.709434 0 ] (cb9-267) [ 350 0 R /XYZ 99.933071 230.762413 0 ] (cb9-268) [ 350 0 R /XYZ 99.933071 211.815391 0 ] (cb9-269) [ 350 0 R /XYZ 99.933071 192.868370 0 ] (cb9-27) [ 99 0 R /XYZ 99.933071 101.120852 0 ] (cb9-270) [ 350 0 R /XYZ 99.933071 173.921348 0 ] (cb9-271) [ 350 0 R /XYZ 99.933071 154.974327 0 ] (cb9-272) [ 350 0 R /XYZ 99.933071 136.027305 0 ] (cb9-273) [ 350 0 R /XYZ 99.933071 117.080284 0 ] (cb9-274) [ 350 0 R /XYZ 99.933071 98.133262 0 ] (cb9-275) [ 390 0 R /XYZ 99.933071 799.173057 0 ] (cb9-276) [ 390 0 R /XYZ 99.933071 780.226036 0 ] (cb9-277) [ 390 0 R /XYZ 99.933071 761.279014 0 ] (cb9-278) [ 390 0 R /XYZ 99.933071 742.331993 0 ] (cb9-279) [ 390 0 R /XYZ 99.933071 723.384971 0 ] (cb9-28) [ 129 0 R /XYZ 99.933071 799.173057 0 ] (cb9-280) [ 390 0 R /XYZ 99.933071 704.437950 0 ] (cb9-281) [ 390 0 R /XYZ 99.933071 685.490928 0 ] (cb9-282) [ 390 0 R /XYZ 99.933071 666.543907 0 ] (cb9-283) [ 390 0 R /XYZ 99.933071 647.596885 0 ] (cb9-284) [ 390 0 R /XYZ 99.933071 628.649864 0 ] (cb9-285) [ 390 0 R /XYZ 99.933071 609.702842 0 ] (cb9-286) [ 390 0 R /XYZ 99.933071 590.755821 0 ] (cb9-287) [ 390 0 R /XYZ 99.933071 571.808799 0 ] (cb9-288) [ 390 0 R /XYZ 99.933071 552.861778 0 ] (cb9-29) [ 129 0 R /XYZ 99.933071 780.226036 0 ] (cb9-3) [ 99 0 R /XYZ 99.933071 574.796389 0 ] (cb9-30) [ 129 0 R /XYZ 99.933071 761.279014 0 ] (cb9-31) [ 129 0 R /XYZ 99.933071 742.331993 0 ] (cb9-32) [ 129 0 R /XYZ 99.933071 723.384971 0 ] (cb9-33) [ 129 0 R /XYZ 99.933071 704.437950 0 ] (cb9-34) [ 129 0 R /XYZ 99.933071 685.490928 0 ] (cb9-35) [ 129 0 R /XYZ 99.933071 666.543907 0 ] (cb9-36) [ 129 0 R /XYZ 99.933071 647.596885 0 ] (cb9-37) [ 129 0 R /XYZ 99.933071 628.649864 0 ] (cb9-38) [ 129 0 R /XYZ 99.933071 609.702842 0 ] (cb9-39) [ 129 0 R /XYZ 99.933071 590.755821 0 ] (cb9-4) [ 99 0 R /XYZ 99.933071 555.849367 0 ] (cb9-40) [ 129 0 R /XYZ 99.933071 571.808799 0 ] (cb9-41) [ 129 0 R /XYZ 99.933071 552.861778 0 ] (cb9-42) [ 129 0 R /XYZ 99.933071 533.914756 0 ] (cb9-43) [ 129 0 R /XYZ 99.933071 514.967735 0 ] (cb9-44) [ 129 0 R /XYZ 99.933071 496.020714 0 ] (cb9-45) [ 129 0 R /XYZ 99.933071 477.073692 0 ] (cb9-46) [ 129 0 R /XYZ 99.933071 458.126671 0 ] (cb9-47) [ 129 0 R /XYZ 99.933071 439.179649 0 ] (cb9-48) [ 129 0 R /XYZ 99.933071 420.232628 0 ] (cb9-49) [ 129 0 R /XYZ 99.933071 401.285606 0 ] (cb9-5) [ 99 0 R /XYZ 99.933071 536.902346 0 ] (cb9-50) [ 129 0 R /XYZ 99.933071 382.338585 0 ] (cb9-51) [ 129 0 R /XYZ 99.933071 363.391563 0 ] (cb9-52) [ 129 0 R /XYZ 99.933071 344.444542 0 ] (cb9-53) [ 129 0 R /XYZ 99.933071 325.497520 0 ] (cb9-54) [ 129 0 R /XYZ 99.933071 306.550499 0 ] (cb9-55) [ 129 0 R /XYZ 99.933071 287.603477 0 ] (cb9-56) [ 129 0 R /XYZ 99.933071 173.921348 0 ] (cb9-57) [ 129 0 R /XYZ 99.933071 154.974327 0 ] (cb9-58) [ 129 0 R /XYZ 99.933071 136.027305 0 ] (cb9-59) [ 129 0 R /XYZ 99.933071 117.080284 0 ] (cb9-6) [ 99 0 R /XYZ 99.933071 499.008303 0 ] (cb9-60) [ 129 0 R /XYZ 99.933071 98.133262 0 ] (cb9-61) [ 164 0 R /XYZ 99.933071 799.173057 0 ] (cb9-62) [ 164 0 R /XYZ 99.933071 780.226036 0 ] (cb9-63) [ 164 0 R /XYZ 99.933071 761.279014 0 ] (cb9-64) [ 164 0 R /XYZ 99.933071 742.331993 0 ] (cb9-65) [ 164 0 R /XYZ 99.933071 723.384971 0 ] (cb9-66) [ 164 0 R /XYZ 99.933071 704.437950 0 ] (cb9-67) [ 164 0 R /XYZ 99.933071 685.490928 0 ] (cb9-68) [ 164 0 R /XYZ 99.933071 571.808799 0 ] (cb9-69) [ 164 0 R /XYZ 99.933071 552.861778 0 ] (cb9-7) [ 99 0 R /XYZ 99.933071 480.061281 0 ] (cb9-70) [ 164 0 R /XYZ 99.933071 533.914756 0 ] (cb9-71) [ 164 0 R /XYZ 99.933071 514.967735 0 ] (cb9-72) [ 164 0 R /XYZ 99.933071 496.020714 0 ] (cb9-73) [ 164 0 R /XYZ 99.933071 477.073692 0 ] (cb9-74) [ 164 0 R /XYZ 99.933071 458.126671 0 ] (cb9-75) [ 164 0 R /XYZ 99.933071 439.179649 0 ] (cb9-76) [ 164 0 R /XYZ 99.933071 420.232628 0 ] (cb9-77) [ 164 0 R /XYZ 99.933071 401.285606 0 ] (cb9-78) [ 164 0 R /XYZ 99.933071 382.338585 0 ] (cb9-79) [ 164 0 R /XYZ 99.933071 363.391563 0 ] (cb9-8) [ 99 0 R /XYZ 99.933071 461.114260 0 ] (cb9-80) [ 164 0 R /XYZ 99.933071 249.709434 0 ] (cb9-81) [ 164 0 R /XYZ 99.933071 230.762413 0 ] (cb9-82) [ 164 0 R /XYZ 99.933071 211.815391 0 ] (cb9-83) [ 164 0 R /XYZ 99.933071 192.868370 0 ] (cb9-84) [ 164 0 R /XYZ 99.933071 173.921348 0 ] (cb9-85) [ 164 0 R /XYZ 99.933071 154.974327 0 ] (cb9-86) [ 164 0 R /XYZ 99.933071 136.027305 0 ] (cb9-87) [ 164 0 R /XYZ 99.933071 117.080284 0 ] (cb9-88) [ 164 0 R /XYZ 99.933071 98.133262 0 ] (cb9-89) [ 194 0 R /XYZ 99.933071 799.173057 0 ] (cb9-9) [ 99 0 R /XYZ 99.933071 442.167238 0 ] (cb9-90) [ 194 0 R /XYZ 99.933071 780.226036 0 ] (cb9-91) [ 194 0 R /XYZ 99.933071 761.279014 0 ] (cb9-92) [ 194 0 R /XYZ 99.933071 742.331993 0 ] (cb9-93) [ 194 0 R /XYZ 99.933071 723.384971 0 ] (cb9-94) [ 194 0 R /XYZ 99.933071 704.437950 0 ] (cb9-95) [ 194 0 R /XYZ 99.933071 685.490928 0 ] (cb9-96) [ 194 0 R /XYZ 99.933071 666.543907 0 ] (cb9-97) [ 194 0 R /XYZ 99.933071 647.596885 0 ] (cb9-98) [ 194 0 R /XYZ 99.933071 628.649864 0 ] (cb9-99) [ 194 0 R /XYZ 99.933071 609.702842 0 ] (configure-default-service-account) [ 53 0 R /XYZ 84.259843 561.590928 0 ] (configure-etcd-user-and-group) [ 45 0 R /XYZ 84.259843 283.686971 0 ] (configure-kernel-runtime-parameters) [ 45 0 R /XYZ 84.259843 539.222079 0 ] (configure-network-policy) [ 67 0 R /XYZ 84.259843 599.840928 0 ] (contentsbox) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (create-etcd-user-and-group) [ 45 0 R /XYZ 84.259843 169.788971 0 ] (ensure-that-all-namespaces-have-network-policies-defined) [ 67 0 R /XYZ 84.259843 564.092928 0 ] (header_bottom_text) [ 6 0 R /XYZ 85.009843 422.718898 0 ] (known-issues) [ 45 0 R /XYZ 84.259843 799.370079 0 ] (overview) [ 30 0 R /XYZ 84.259843 272.631496 0 ] (reference-hardened-cloud-config-configuration) [ 534 0 R /XYZ 84.259843 537.158799 0 ] (reference-hardened-cloud-config-for-red-hat-enterprise-linux-8-rhel-8-and-ubuntu-20.04-lts) [ 557 0 R /XYZ 84.259843 511.863778 0 ] (reference-hardened-cloud-config-for-suse-linux-enterprise-server-15-sles-15-and-opensuse-leap-15) [ 534 0 R /XYZ 84.259843 397.010799 0 ] (reference-hardened-rke-cluster.yml-configuration) [ 77 0 R /XYZ 84.259843 191.441066 0 ] (reference-hardened-rke-template-configuration) [ 390 0 R /XYZ 84.259843 518.211778 0 ] (set-automountserviceaccounttoken-to-false-for-default-service-accounts) [ 53 0 R /XYZ 84.259843 522.092928 0 ] (title-block-header) [ 6 0 R /XYZ 84.259843 502.818898 0 ] ] ->> ->> ->> -endobj -4 0 obj -<< -/ExtGState << -/a1.0 << -/ca 1 ->> -/A1.0 << -/CA 1 ->> ->> -/XObject << ->> -/Pattern << ->> -/Shading << ->> -/Font 632 0 R ->> -endobj -5 0 obj -<< -/Filter /FlateDecode -/Length 2578 ->> -stream -xˎd 602%R^8 ;0 dad1.'8~~*]럋IDHGRU,x{Η7' 5 ~wCw|b5؊.j˩ ^4ϧ|v5Bk%|Ǯ2 kLT *JT9ZS.DUb#T0#WK0Úg Q`Fј -fĖ+QE1P 3MDs(t)-5ŚN5j1Gk &2lLze[PlI^*lIFt[]NuEDkrs3kЉW%!0]!7갣H]-Er:ؒU)l1ZnM}whd [RFu -lZBc@5XK \9@VeH-+2DRd P- -#FbعT[c&؂%2(hknMZd,P$pa0(^@\Rc,P0WNt+cKb,P`W cjQ UŕT[cX`Fb%jJHX`nr1wSEݔ,r)Kb,0p7Y*p] $t%e,BBZXȞBV 2Gu-Ċ'b) TX]  2ݘ0dpyCf,;-DR]  2 ,%D P] pXAXP]XP]ɪCCuE=1 ۖi$AHtD0Ӂ"1pMƂR 9c ȂcAq XP@J@;3T YT[cд9cAMESb, e`,@FZDMwd YfXPsA=YeWX jP PKǦg,CO `t j-*E2sI6c2]bd,[ 2xrTE QKbΤיXVBO MPiT[ O/3c(sh6Mg,p-Ic|כ lAXФ&3Љ071`_z -Mxd6-ެ`KFBuIS#LB :1]-cA+כX4&2zz$ެ db:pia,@&2[V +3^q:=17##{*=3HfBO VB E>fL>GTP3l~|췟OF=O'ej֥\ov~~\?$s;Qeц2=cb7 }᧞<<||tU_- }F8OTOoN}_bO?BEhc9m]n_}?U>uy~}e?" $ȴ|70f\'wqQ_7u~:q'L+W*ؑ{,'.ږKF+w}'ŗ*_O q0 ȋ/W}[Dzo;UIMX[:hvYRcz1!+|\zӥָ{, 6>"lƞ\ϲ#`bl`@\HqʼJBv9ExZ{޶ys-IYqY1Hhu_LGqzAx`zki -6놶]7\~PU6a~6'^?̩+K8Mߧ.n?-՗g*PVcvL7ڔs.u"ˉ_ɸa1~[_>f6DJץm2ex";&mW`57Ax9!)W;/VH u,YR䟷 WT)9ޠ(jf }oN$2clwX} ߡ;{nSkuHMx܋)3Y e8OW~/;ܪY`%n}Lv>:W҈ԥf[[7[mw?y{u\҉)}ޥtKh9zy {t&9kknR_:}PAGLlޱ1-;:s%e鼯ʜļJy;"̖t&@yw纞NVϙK:)Sql{D )+3uY~IClX:N00D7XoGq> -endobj -7 0 obj -<< -/Filter /FlateDecode -/Length 3519 ->> -stream -xMo$+l`e #6@ -!?Ş&iRZ$]k=d%(N?5[Oj^џ8n&zbN-'j]p>~/uźoN'iz|2U'Y|XC6Y˧hZC//m!5+Yk:x HA 2tkX'p$ :(ͅZ}Gm'CX-=H/?Vb<8JĵNj٣P6 ]ȑ[-eֱd'U3yզzDy2]XQ"zyPzH}&D-'< :fb":uED'r3Dt"FQ|FwDt":}n}DY(f_EQ? $%#\tT!ʷYiɵ5TQ DAP=6 ]F#Տ,iLCy.J&ረ̃`QKtQСPE F="ʑhQ ND'DobCgDщD݉Dt"j](E(׈Za7 '.rs KDW$ nG -?4X0&Gۦ`y#Տ7&[!;Bw":F7>Kػ(DQ:7@S-+>TQ DAP6ΣGD9Rx˒d< - dꎈJ @tˤM$p, Hp =>/?D4΍!(TM7x0=rd;Bw":F7>KꯢMII)u+M$p, vn4] -:jѶ3~eIcECuQ2HU p|;C!<% *y0bnT?/@F0@w"db":ZT *z.F:#ND'ohotGND'W:_EY(_EQF48NIGO10#\.vn"chGC[ 1qt%)vn GZm:<9Rx~cECuQ2HU #!n I"4{ȃActC~ <cE!щDע}h":};ND_t]֟>takX7K:$]OGo?|ӏ[PJ?s;_44_dԙ;2W/9-mH5dzE+(Y_wm:%۰KՐnB+s9ǐu]R?`טG/Bh -Pn?^Xϡj.'SDĢ՟Ab za΍<¼VXM9K.;sc$vBpR%Eu2T8@gdLpkXzBj;Uf 'I,aeǸ -=.?_Tt~IGDOmH,y1{#]~EgWS,0'/-ϻwܯ*+ {a2Ly=<[̷-/^s[ou*mK} -}tR~򉊕6UqYYt'x*$S㫷epa3\[IjڶcqoNTkL.H&gZG.WE_f6CWMmjiތ6_GS4|iߔb8tfG>ȔVjId۲A>IY[? -ܱLִu ׶&B:'rkjtLQMЩT_[TEwv>dͬiS-$ڮ#Ov52[ħy -M-mѮ4q<JjU1|*A?iyP69)Vc"4V˿7< ZIńG줰d$Cu\/En 1x:ˤZ Bz̵{eju&)Ƨ͕( rDzo|/doRWgACf{c˸ ׁ5_󶰹k~NX6v DM -,4zɕ6;KOeXor^7J_j=}:nT-L[+1I٘Ć ϲNjh10_;>]^[6.cikGUF楹rhȍK+ráY^0IG)/.]!83R褅a*l(s̢m&NN N,x8{C%mjo=m`Em^_amͱK9r- ٶa4xk(Oxt&օM5)հl#N(Ŷ`7Ǭ zJ8-vvKm> -endobj -9 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 671.061024 504.679134 638.361024 ] -/BS << -/W 0 ->> -/Dest (overview) ->> -endobj -10 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 489.361263 663.111024 496.429134 648.111024 ] -/BS << -/W 0 ->> -/Dest (overview) ->> -endobj -11 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 626.361024 504.679134 593.661024 ] -/BS << -/W 0 ->> -/Dest (configure-kernel-runtime-parameters) ->> -endobj -12 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 488.881526 618.411024 496.429134 603.411024 ] -/BS << -/W 0 ->> -/Dest (configure-kernel-runtime-parameters) ->> -endobj -13 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 581.661024 504.679134 548.961024 ] -/BS << -/W 0 ->> -/Dest (configure-etcd-user-and-group) ->> -endobj -14 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 146.805601 573.711024 177.256773 554.961024 ] -/BS << -/W 0 ->> -/Dest (configure-etcd-user-and-group) ->> -endobj -15 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 488.881526 573.711024 496.429134 558.711024 ] -/BS << -/W 0 ->> -/Dest (configure-etcd-user-and-group) ->> -endobj -16 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 536.961024 504.679134 504.261024 ] -/BS << -/W 0 ->> -/Dest (configure-default-service-account) ->> -endobj -17 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 146.805601 529.011024 197.845152 510.261024 ] -/BS << -/W 0 ->> -/Dest (configure-default-service-account) ->> -endobj -18 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 488.893245 529.011024 496.429134 514.011024 ] -/BS << -/W 0 ->> -/Dest (configure-default-service-account) ->> -endobj -19 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 492.261024 504.679134 459.561024 ] -/BS << -/W 0 ->> -/Dest (configure-network-policy) ->> -endobj -20 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 488.809749 484.311024 496.429134 469.311024 ] -/BS << -/W 0 ->> -/Dest (configure-network-policy) ->> -endobj -21 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 447.561024 504.679134 414.861024 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-rke-cluster.yml-configuration) ->> -endobj -22 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 234.738707 439.611024 313.229430 420.861024 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-rke-cluster.yml-configuration) ->> -endobj -23 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 489.877620 439.611024 496.429134 424.611024 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-rke-cluster.yml-configuration) ->> -endobj -24 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 402.861024 504.679134 370.161024 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-rke-template-configuration) ->> -endobj -25 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 484.970394 394.911024 496.429134 379.911024 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-rke-template-configuration) ->> -endobj -26 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 358.161024 504.679134 325.461024 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-cloud-config-configuration) ->> -endobj -27 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 210.896178 350.211024 288.867613 335.211024 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-cloud-config-configuration) ->> -endobj -28 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.993831 350.211024 496.429134 335.211024 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-cloud-config-configuration) ->> -endobj -29 0 obj -<< -/Filter /FlateDecode -/Length 4947 ->> -stream -x]K$qׯ#6l/5fJ#EV fFfUuw;`DazQdw<ְ8y$ 2r 0jX\\FlH%@ 55, 0A[.awaeB@Xs^ p,JM&K԰ wmFT^lǕ'cѰ wPy p5,OXQk=Vjܵ p}Cа0Y4`}Aꪼ2 Xr`L4!ɠհ w "p5,]Ch{TtiX 3FÂb34,@]~3kXP~[?^~3?)k], _Nh&]o%z[Y:&Izd`'uG3]H~ztBӹaیKٍ.칎fQxJBuԹsti>S57q|SXqLDh_@N|sBs5y:w[ v'8Z.,3r\;\@[lK6@r䂠7ŌS/_Tc)3\U/'^#ׁ^LK9>/0(ɻȟubwXvmò4݇buKY0nnfŨGZxhjv@vH9taK Sæ^c>={ -=s挶lNGM$G$`~>je9зª=W#0j|;`Cx6__ }/]+5a{tax(V]oנ_ =|z7|5ѷ|{=bwх&|5ix%-*/?/?A :dLO nB8fyadͿۘyO9<1e7,ןqA`&sG_?(qI^lzY2W|C/rK|gT[MFBv%V}T5՘}ZtXb^|y%?Ycw|7;-?5N2wRץj-վ5E_z>VZ=-Ɯ7 ~/84߬꫍kϏ;Tgdk՘ -zmӡ?tŦ'l6|ӕuz_g\Af4S<Ύhh(淈ITiAMc9m16&9$3ṡ#z٩%U-<6fX j]>+m⸉ϡ/5^2[ֈU<"[O -xW& < 5js;sY;kώ6qJ9Zw|޺ռ/&{ >SG֖Cŵzǭ.?ظe_֡FMP[$߷n9Ĝ{ĪZCuQfsxc3>?.;_?8}n}E%b$_f+%pbhͷJ-{t>aպouO6K.Go?mx%s_/G/}- -r/t0Dn =ȣFO_Pο_h{9X`8Iuh )n)21"+nlTI.P9_P~7O8~LlhPE]dO`_ a&"a@T^r>sTbL%3fغo<8DydJ9̺g*8U:NyWXh<ݫnVMխZYmjsVMMࣤ?_MlgA-i-" y -Jﲆ{7=b=|hQ<\I˞0 ZL$oA9DM/Κd3aDU%>S!' -Ɂ-BJȣo^9^x[j<6 Zx}kMݕn|F"A1D=&r61sCb&~ ObLlJ&_ȯ녽_^Q_T O;9.|$zh;M6 bmuڀt -¶2x6)kqCz|B=8vWssom>}693:_[/ l9|e^<͒So|fG/*kVx:# -%}J5gtL-UfwMk uC_ŵNylAayC2֢7x7F~aONk砋֙5}lq+tKҥ/,GyA~"B3*%_s;4<~X -Hҟ1~zZMɍ?aio8{MLo817&s '>+X 'rGګF!wk7f4v4;ƛ}Kߣ=V7$p|(pk6}徨҉ R9󻢲d{k9J#sK/Nf[~}9BS%MLή^to%LO[j,.'L+tOx|0TkPo7 ivn+D֛.d~+pr*!VAIwA [u5NlKY:%#izU.*zkeyTiPGPBw&En7bDm\夎[F~kT9^])hל1:#GƚHn'^NZ%v2:t0$z!ҩ)WW4+?ߠ"4*# / -W}IG'IzlC,>V˦rVfgmpRcj1m˺FfiX)*iR:j0mhE&cΫ$qO75}\x6Z9si]LbN0zɵZ:K믽ȴri^?ڎvewd3':~];5lr%㷳Jle#w}lq^St`#mCP۸ٵu τeȼ56}]jwh5B\}I> }IR(.ńk6 )'igI\B|;2+EWl ) (JEX+ *06ө~e[s/jv5Y^ԞoMN/Zp!sTPsmTiäuhp&1Ur[ulqVZOѩ2*͉AF%nƲܺnɷ(tN:G^2+(nT#}mqڞ35*{MGڨJ_zG!/*OőqlO2٣&Yt` ![FmŨ&=j+r.oߧf~~2;qsZP -endstream -endobj -30 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 29 0 R -/Resources 4 0 R -/Annots [ 31 0 R 32 0 R 33 0 R 34 0 R 35 0 R 36 0 R 37 0 R 38 0 R 39 0 R 40 0 R 41 0 R 42 0 R 43 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -31 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 84.259843 445.281496 409.271317 430.281496 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://releases.rancher.com/documents/security/2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf) ->> ->> -endobj -32 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 107.173228 418.281496 162.214732 403.281496 ] -/BS << -/W 0 ->> -/Dest (overview) ->> -endobj -33 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 107.173228 403.281496 332.953990 388.281496 ] -/BS << -/W 0 ->> -/Dest (configure-kernel-runtime-parameters) ->> -endobj -34 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 107.173228 386.659914 295.486949 371.659914 ] -/BS << -/W 0 ->> -/Dest (configure-etcd-user-and-group) ->> -endobj -35 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 169.605601 388.281496 200.056773 369.531496 ] -/BS << -/W 0 ->> -/Dest (configure-etcd-user-and-group) ->> -endobj -36 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 107.173228 367.909914 319.724254 352.909914 ] -/BS << -/W 0 ->> -/Dest (configure-default-service-account) ->> -endobj -37 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 169.605601 369.531496 220.645152 350.781496 ] -/BS << -/W 0 ->> -/Dest (configure-default-service-account) ->> -endobj -38 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 107.173228 350.781496 255.796275 335.781496 ] -/BS << -/W 0 ->> -/Dest (configure-network-policy) ->> -endobj -39 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 107.173228 317.031496 400.593883 302.031496 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-rke-template-configuration) ->> -endobj -40 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 107.173228 302.031496 397.449596 287.031496 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-cloud-config-configuration) ->> -endobj -41 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 233.696178 302.031496 311.667613 287.031496 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-cloud-config-configuration) ->> -endobj -42 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 293.575760 126.231496 442.798661 111.231496 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/) ->> ->> -endobj -43 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 84.259843 111.231496 285.368241 96.231496 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/) ->> ->> -endobj -44 0 obj -<< -/Filter /FlateDecode -/Length 5107 ->> -stream -x\Y%7~?<#㥼I DEbar Bw>_u{݉h2m\Ujiwşw+L)5':_>u&G;6K7dzMt5xĄMt~9Ky?9sǝ5y(\rQih.(M1}LJSrKUk1cSTKԚy_6eMlHkƬ49 >Vm#(xE ygRmm.{-2贶jRJhm^bNk%:" -%km ^|AkC:Ui+U6buZ[ &BUْ˱hb jmΙ jvKm%뵶^6D ezE}& @^lN`% |Ά' | - |r  5֡; /UKaA7hXx4,@[hXdӰ oɺaAMaA→HÂȅ)U 07;5,]laAꆘ$ p7p7T X  pkXaҰb|)VbI e=4, ஏX湁>Zaw=a  w!Q V{a3a*ܟVƕ4,]W>!qeBƥT5,]8aA>x5,]ੵ6jX0hXfmZ X [$j[60$aXġ$.{հ wm AÂܵGm/x נ VV@ - k4wUÂeaALE0h{ R!SsNjцOmKQÂlA, P& XjѰ {װ {AD:Djz^`.j~@@2S*9&c֖)paAdȥLװo8\Ұl͑l L̵6^dkXHmiXPOJY`'!SWffK ]Xl:tVvc6pyp[3s,kH~ṋQ|7/H9߯__bO)w'7"5/_ Jo_lkUkEqMAqD<6:&a4cy a_c1QIqU1Y)`[ZD[I)xʒ>B4`%5~jElk mwyA%NR8:x+SaY2[/^-ݴj뙽)BF!7f YGY\Abqwb˴ ֚Dw|m)t_;W7)woo6>ܴ-j&bme!s&ϋ [MǹVznʯp$αv= 9trkPN;pWY|u_CmE_]`Kq |Wy1zيk-]쳮b!fw+/ۯ~Lw9̣fs=4]VѶǦ--tu`W=Pn`n9HÃj+?Ȋ4kxC< 1H [SGpODT@< 1%SLG{˵QԂbE8݀JpLunب Ǡ埄֘ibHE>U}^&ncj7r|襝޾?OoR~>+ľ_n5}/& IdL)kۦc^tKs#?Rf2;`Z -?4YssOy6@/sm޹E[jm}v}`kcW9N>K|r+J#sY*p,c/gL1n}k_{[p8a3LY'dלD]K!C|} #_%SXeP>oEwq^/YUǡqkeIP@3`>}޸$n}EbxF>Puɸt!~l PWpݯaDvHi|qcX/~۴u{;bOE:J ec}&IWk2*7^,J6 䎲;R :tC;(T`U TkEICl"MI|Rl~]{1=RXh;iDzg -|~'UnU1 q(:]l92#W#nZGcg"ĔtgkRB09U-nJ[v+5:5Qub7Gjn(*dzn8+7.|E=gTx7mxtvEis_ -d|_==߅SrPd[!F^ hyDM7w*GK:_l -^•->c-ziStݮ,mC=AYKc]+,m#!jSS< ;Q:qA:ʕ\`+[A7cзG)s݉?E7N\9󔳮&lk;Ҫ̊>nƝ{>o -bhYw-ׄ, ]U߅/> ۔9DJHjt39nGnIIVXU¬h[ǭOIoͳs>fᴌ}.o_lntq|VZ+VB88z//G t2B'OhCZo[FQFJ@7vek/D\R:ͽ3X}v߷;\(a=ѱrg1^<ːbȾ>2T3xmN\pm{ݣQՏYw;]󟴼tX/0˯Eb&n!Wz.2Ȯc7ŃEݿ'DdRpQم\|F -ӎ m?g}%s>ލ_G|:BDd^5nńv+1uAw8;%IGMΏO ѥIK9~B {JItvZLAΡzRHB|gev5cc*ݐhW} -rRkš<*k풟LSe^]D-7*ܒkxi7@"8/ -Ibr^&Lf +TAeY~t}y5'y+$IOuHqp*yج":~q؆*D&: ؒݰAfX)3&9S~ِ'qlhd scIN;_$9;w+l/c=MI&d8(Lїw@'bf97q/7Crci2:r➯':ݿαqoZd|Ǫ~_>[wSꋤ1uN e^E}N {a9skЂ6Fn('NLŀ ls)n],ˊ*> -endobj -46 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 191.048717 658.622079 244.661998 643.622079 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/admin-settings/pod-security-policies/) ->> ->> -endobj -47 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 439.875057 101.433071 421.125057 ] -/BS << -/W 0 ->> -/Dest (cb1-1) ->> -endobj -48 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.928036 99.933071 402.178036 ] -/BS << -/W 0 ->> -/Dest (cb1-2) ->> -endobj -49 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.981014 99.933071 383.231014 ] -/BS << -/W 0 ->> -/Dest (cb1-3) ->> -endobj -50 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 383.033993 99.933071 364.283993 ] -/BS << -/W 0 ->> -/Dest (cb1-4) ->> -endobj -51 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 364.086971 99.933071 345.336971 ] -/BS << -/W 0 ->> -/Dest (cb1-5) ->> -endobj -52 0 obj -<< -/Filter /FlateDecode -/Length 4930 ->> -stream -x]K$9nDs0l/<^]`COkFYQzD33݀P HJhwOfgr.)˯kRWKl.*M,'\9\%J)^.]m븫7DodRNUV&%ŠKX#$|d%%12 N1|r +!),g!֪<b+<Lң\|Qy <#21 Nc Y1d : KpVA4^,ɪXaw=a  w!A V{ ɂY*pb XB%kXKT3s,(//+ecM? xej{\Wc∄s !`q]t!n˵q[!;MHƊ*uI֡#/yjYGS{һkvxhIJ'IbRq 4՞Jd}λ5݀ p^ SR{һkvx2?M+G^GG?_YIfd|"rDhu#_Aʄo\wYyeW6k[9-ˣ_?0߃,;E3AĖKjt RPͶ;zAvc9U.~ʯ0E"L㍀avɦ.C Alq9vd -_$l"d2X䘸eCKL@XiZvClJQ&ŇcR8h d1w7u-o1,yehz;ߜ. k,I#,QM#٨:7J뢒~(tye]eU_?TIu\&N=2Tle2%v~N3^r~q LP'4f/yA?Wk7"p7:}NAwyZӻۍ.]5a -49CdtRT''nSsN2t:ۗLSSTZr!d_e:WۙZ9 =ž p+h_i p2t~qg1 CuڔW/@9MAZjX w?7!;1]@-Y5K-uC䭉Tc۬26>Y`mۼ}Y g tYxMn6r)M?bzcAx{e异"C^GU y-9Z/$E@G*_z8ea7"'_-{:$v\ sbQ(nSU q4ѫW(]?oaˀ"[Gr =/M܃;Y:9:mwZwɡ Lm';~""?ӆΌmkÝ#pw#ݤHvl%9:W1)!''eCt2'aV2C'ģeX/bśkѩSszxD#e#xRO??O:i뫹Lu'N.)UyL6M) -*gWom?rzSgr1r]hC]) -݇ -6Pg|&ŗY -ntF3j柲7?=7[ޯNzmMf߲b^n|"56|WguSrGڱ~פǻ/[{v6}̰ 66l?R1|<م_\ǹ?o^璼"ߣm^58Jsf>.459vHLa'*z&8 ]6_0}3c[uMNF=ĘQo) &X ~өʍu$OzƎl6Dz{^" ,dyl7/=' iGӷdo*$9 YU©=ɐ:(@&'?2[l['|3h+=:@*;leB(%HsQjcTn}R.*ȅuțM icrbiam;85pN^t6n9gr<3&|3Pv?]yssTus; %G{NvD^AA'gyOhyϱ[s:p -h)]A/􇊻>,$[{|vOm#b4)3yDE[ cPʯ~uV;o+4di іޭR}jv{uz NJRوUrBdKuU!zf}᯽+UZ:0\eovwױBfa~-v=Sk< T% -8|C=Q?jNէꗎ"jFw$[Vz(!6A \v48*>$K0HSw}1]uq4,?E|[STu5մm$TJ>N -i`v4j~siĽ\iE-JTUKe:x2JBiXj_dy,C0 \8oa` f"Mvr^˪*LF7_*B -/II,5F'27;y;갦i%K`tlt؆:l%nu,ӱr&&MmCr>UE7{r6SqyqF|d1:d& 0F*֎Nr}L/^YoP煯?W,~ێc<{2yk>IcOyAvy UIu;tA]0t8}7]hLC|i2_:6a/nN%@M*\̷goJx2%TgosW&ӒuqW20MNg]70cT_ jŪ%sWSߺ/&z7 tsf/(f -endstream -endobj -53 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 52 0 R -/Resources 4 0 R -/Annots [ 54 0 R 55 0 R 56 0 R 57 0 R 58 0 R 59 0 R 60 0 R 61 0 R 62 0 R 63 0 R 64 0 R 65 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -54 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 751.923057 101.433071 733.173057 ] -/BS << -/W 0 ->> -/Dest (cb2-1) ->> -endobj -55 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 732.976036 99.933071 714.226036 ] -/BS << -/W 0 ->> -/Dest (cb2-2) ->> -endobj -56 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 653.081993 101.433071 634.331993 ] -/BS << -/W 0 ->> -/Dest (cb3-1) ->> -endobj -57 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 634.134971 99.933071 615.384971 ] -/BS << -/W 0 ->> -/Dest (cb3-2) ->> -endobj -58 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 615.187950 99.933071 596.437950 ] -/BS << -/W 0 ->> -/Dest (cb3-3) ->> -endobj -59 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 596.240928 99.933071 577.490928 ] -/BS << -/W 0 ->> -/Dest (cb3-4) ->> -endobj -60 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 280.647907 101.433071 261.897907 ] -/BS << -/W 0 ->> -/Dest (cb4-1) ->> -endobj -61 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 215.950885 101.433071 197.200885 ] -/BS << -/W 0 ->> -/Dest (cb5-1) ->> -endobj -62 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 197.003864 99.933071 178.253864 ] -/BS << -/W 0 ->> -/Dest (cb5-2) ->> -endobj -63 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 178.056842 99.933071 159.306842 ] -/BS << -/W 0 ->> -/Dest (cb5-3) ->> -endobj -64 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 159.109821 99.933071 140.359821 ] -/BS << -/W 0 ->> -/Dest (cb5-4) ->> -endobj -65 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 140.162799 99.933071 121.412799 ] -/BS << -/W 0 ->> -/Dest (cb5-5) ->> -endobj -66 0 obj -<< -/Filter /FlateDecode -/Length 4895 ->> -stream -x\[$~_Qφ1 ֻͮt9cB"34]RE(q3ԜzŚ-kgl?ǫMt5x !\v_CyuvzSk.^YL.9ۨ*XǤ3Xb bL 1 y_V GV>;X՘ykUD+<MғΤR}Uy< L.:WMJ)G%V4^,YY(d )XY|Ae⡝ -dwYlN`b-D*gK.GxΙ *#ʃ,0>A øaP/P/PA_T:Ӏ X)iHd!Dʃ,CaASа m ޢaAܒNÂ%뒆 1J"  T5,԰ tY 1y `7PIn g5, n X  pa5,U 0iX_1aw}aw}F -Py K27pG5, '4,U. $djX|`2QhX")1 2ԤaAj\ƕKjXHTAÂ| kX. SkhXP(.5,@` Ty0aÛa6?lb KaA)EÂR ^&7BT|T V -4,@\~hXP~[<%nkHT,%ʃ,($7N/A_IÂ7(3DE -7. -dx]TI`V[ǫtfgQ;[Ֆ"[eg`GR;˒Ԯ*Ϊm E=FLXOE9d^dEX瘧;- syU?(8^6܂Q8T~hǭm7 ^2L[m.͂Bҥ}BڣY*$H.~߿zӯH1ZK~7v+~7U̕9mS;7~w`bSWn,t3&+To[cvC>U؉ -(-,UÀRfwoO]18B_ѭaѡsNCW.Y>>pM4'_ iyucĵMq4wk|AkВז/.A=Փ3=/ @ -bm`8q?OleYbHwc?'.K5n*%:'݈e=+!񓍎аҏ=Ǒ_u18t!yQy7#0 -kfZ7/\ϳ+_]1K|zWw{TȌaǮ<$O -Spl16`V.拫c\ԑԶ,Np|*ƺyqߝ9]‾ݽ֜[)ݓwO7oms2}~E_9.Wi-]y=~}(qmr,Q.<i9_~+CXg@>)\5 p>r|`wrwSZ]?sg)/DM:ltiڿIJ~ٹJ.Dⷤws7fAU@.&.phMM6 UxߵCwQ7S_RX׋4;8J -`_*G9{e=o{d-۰ۣ>WYĺݟϯ(MHѕ'/Xьf - 9ZwbԊRG@PMzO더0 0j ?mp||#ύH QMx -B6n -ಛ.eΕ?mOxe?̕P.$F7 -YN}!ת UP4.޴g궇TRܭq`ݮz=cW֮ #~r=/Lzd.>սCy(Gm2ںX=S!n7nBcykF\!Ҝ'V"lҧIIq|q m[ O:߮ -B;_zTgq?J? !jUΧd|}|u{'q)u,Xc{}I񛎥97Q s#[l꺻xw{t$[9x'#㯎S=6zo\>7OHtOuH䩇OV(걡]zL{=>kW)Lݮi +ӷ6~w7mN49OuX} -KlZx7k_}z*/{ ;M^a`iȇ1rf"VxKڬ\b*mCy֌_\P\|_4b|w֦9cPp&o]Oj^ЭrqFB'E̩&=_]^н?;N=YE>Tߙ󙺋N{zv{MLmz^Wvo7VMO -쾣tU~¦ǹ^{Id7pOU1xo/zmK>Cy ?鞢SW>8}gQo1kz 8?+e~'= ܘQplw;{z{&\cn<\kF}ΛOto;K]`oEJkkUddow=|)kwiNvV/ऽyLRлC{nE e ֗r#vŸX"5xʃP?t so\6o*?ӧvЂjgаB]7OM0 p :j?O!.ylqX*Z(CWh7`S*bĆsKNlnk[v4"q.1+glj(ļ\Iͥ -i8@ETFr}y4/±9[%IzCyPy} G3ʩ;B8919yѺGv_EN=:}P$u,tjhi{8rNAީ1WF3Cc9>*e[OiD14iceJ밮j)bR&5UJ:70 -(9y%BKr<3tڴv϶W Y9,}$vvV:o!Q >Aے0~hi{y=y%P6;.1CL?V]p&uˮom[Esࢷ'uz׳nZ'Ƥ -endstream -endobj -67 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 66 0 R -/Resources 4 0 R -/Annots [ 68 0 R 69 0 R 70 0 R 71 0 R 72 0 R 73 0 R 74 0 R 75 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -68 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 748.173057 101.433071 729.423057 ] -/BS << -/W 0 ->> -/Dest (cb6-1) ->> -endobj -69 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 729.226036 99.933071 710.476036 ] -/BS << -/W 0 ->> -/Dest (cb6-2) ->> -endobj -70 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 710.279014 99.933071 691.529014 ] -/BS << -/W 0 ->> -/Dest (cb6-3) ->> -endobj -71 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 672.384971 99.933071 653.634971 ] -/BS << -/W 0 ->> -/Dest (cb6-4) ->> -endobj -72 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 634.490928 99.933071 615.740928 ] -/BS << -/W 0 ->> -/Dest (cb6-5) ->> -endobj -73 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 287.395585 321.344928 323.513505 306.344928 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://github.com/projectcalico/canal) ->> ->> -endobj -74 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 84.259843 291.344928 111.294999 276.344928 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://www.suse.com/c/rancher_blog/comparing-kubernetes-cni-providers-flannel-calico-canal-and-weave/) ->> ->> -endobj -75 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 308.171464 172.723346 401.561844 157.723346 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://kubernetes.io/docs/concepts/services-networking/network-policies/) ->> ->> -endobj -76 0 obj -<< -/Filter /FlateDecode -/Length 5546 ->> -stream -x]K9rׯC2/`0x<^c@CFŢe`}L>23Ju &x| l{6RϗϧNfOybuSƿp!g!Pb. mnǟO_:즜R4JQFy?|P9kE`Gv/`sZ`Rq/`EZذGa1j12)ZQfʈz)Vgc2^e6ZxaJQ+  I+A:Y)K֕2bZYĬeӾ?Dd2k'$ %9jxdVFW+Nx))Ļɐ$f4-}^^;+B *tF#VlOW0uGr.$UΗ/ofZ!UNVx)V*Ԙ-eSy+ĵ!cnB% ^1QfKw$:um> " iOWԕn_} IuOG8l$:U:c H6 -ߢ?vy՟G&+ -:W"&7(N)!QFx*{+]Lc]L*Wz n%Y 켐^1ـ  2w?O~@wNC .]>wr3E$2q{#A)+r]V9?E -39Ime'dv;,vĸr׻?q!Q]h/f#hO8&Φdvv@SF-W\^)4Ƶ]BZZ?q߶˫ř}ݲd a᱈"-~W)}./Eq~?^ޯwV2đHM21jj ru~ - ̚Z7vSU`9d:-Ư`&]2QYmiwUy;Ѱujb/XGvozjH0ƻc%L/FߏP^#}׼0^vR*oGT&e *p^R$Wl}1B%2m-W9KO1WBk˪G{mq tGȞ4|W$[P/ǫFw+kN/BYx|W|_7N/{WSrѼ:׍>}tf9{䋁 -°԰V~,ke*,+Y~iX JsNtj6 ɾgh^|vY]Y/>^(-Rp߭j固E˂ckK*6EV5`b/_<)6y> In6e18u5c'vY>L\3Ole[h5Y7Sz㼆߬ya|`d}>TXڄHu$L&$}uB݋P9}}/^˰?D A0K0:=,PϫflDܗgwe<,nCjOע A4x|?pQ_!u/ LEA-:/ge#4b Y+{Cnw__].ۮpXN+n )dي)c‡I ˱1;Mu!-mv?S9!ݒ~y{ [pUZ kz9x/rIS/=,mgˢ֯#k _'#^Uب5]M_2_?73t\37iA!1|:Eeǣ!N9pZ; |D< &K#OY>qgc,X9֍xXxG%wW^_mw _6.Iq;c"8cTצݑ"Lmh'U8RDDzį~qOf)P)fGۓe}6CO)8aOПC0F\t)|[u^{6~\dc/^J iO/3T^kN'}&l%5S!KfTBjۋybf2}6|h'+mLE؍u)99_G9y]vrJ/=$u -1LmШEVA|o^ݎ„RAu1"wÛ?aLZW|wM{J`w›njWDYvh$[|˿8R#& -^PQ~M]c6jFPք -*[@85 mlh#1DYZG@ "FrE(Rw%A}Y}NWX79&,99[<_iFF>+۫y|5aϭ4{N=LYU^w -4vWp 4] gM|m,?\畗G~AY>];,_WP"8:;*z^=ۗk=\5ʚi;fF x\} gFNO1^MOZ'J TrUgHC`fnhKgHm+9ʩmֵP2?ueC{(a|-ϖnmauٹx7phIF(s&i1BzS?HF#Ǜ9|Cur~)dYߒOr~:+dd!.ŶQ]N)o$?'ԓ _FZMεcӦns -5ݓdA&ZBc`xHd]'gY.s9QtvP}A-Y׵*] ֕FSQ}})1i2[59?t&jHܞ9t9-؞JjtS.TJp} _a$@յIݸr*OW4t{T9dkV(PU\Xn&%w"k!P5 wvGE16eQmO7:pӚ aT,nsvO8ywkغ"#.t'Y~7H%6dZC儙IuӁ>iV:}@vtA2b dV7}o!9r%H62CyhwhQnQيM1ȱ&zGU5 aR/>̎MWZy4ތ Eo+Qbj/,Bmި#PT*a}*GUjm{Ԃ=h5j~+mi(\f*+OaVR8R-ԿV{Vڭ#^@~4'[,Zk7*'}:ڞH葩/¿/uBY{-361PiGw0bDNÔunqg211V~;3 -qTyzlWzLN?3BDN*oC# zh:cVS'zB -endstream -endobj -77 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 76 0 R -/Resources 4 0 R -/Annots [ 78 0 R 79 0 R 80 0 R 81 0 R 82 0 R 83 0 R 84 0 R 85 0 R 86 0 R 87 0 R 88 0 R 89 0 R 90 0 R 91 0 R 92 0 R 93 0 R 94 0 R 95 0 R 96 0 R 97 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -78 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 715.084475 101.433071 696.334475 ] -/BS << -/W 0 ->> -/Dest (cb7-1) ->> -endobj -79 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 696.137453 99.933071 677.387453 ] -/BS << -/W 0 ->> -/Dest (cb7-2) ->> -endobj -80 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 677.190432 99.933071 658.440432 ] -/BS << -/W 0 ->> -/Dest (cb7-3) ->> -endobj -81 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 658.243410 99.933071 639.493410 ] -/BS << -/W 0 ->> -/Dest (cb7-4) ->> -endobj -82 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 639.296389 99.933071 620.546389 ] -/BS << -/W 0 ->> -/Dest (cb7-5) ->> -endobj -83 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 620.349367 99.933071 601.599367 ] -/BS << -/W 0 ->> -/Dest (cb7-6) ->> -endobj -84 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 601.402346 99.933071 582.652346 ] -/BS << -/W 0 ->> -/Dest (cb7-7) ->> -endobj -85 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 582.455324 99.933071 563.705324 ] -/BS << -/W 0 ->> -/Dest (cb7-8) ->> -endobj -86 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 563.508303 99.933071 544.758303 ] -/BS << -/W 0 ->> -/Dest (cb7-9) ->> -endobj -87 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 544.561281 99.933071 525.811281 ] -/BS << -/W 0 ->> -/Dest (cb7-10) ->> -endobj -88 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 525.614260 99.933071 506.864260 ] -/BS << -/W 0 ->> -/Dest (cb7-11) ->> -endobj -89 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 506.667238 99.933071 487.917238 ] -/BS << -/W 0 ->> -/Dest (cb7-12) ->> -endobj -90 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 487.720217 99.933071 468.970217 ] -/BS << -/W 0 ->> -/Dest (cb7-13) ->> -endobj -91 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 468.773195 99.933071 450.023195 ] -/BS << -/W 0 ->> -/Dest (cb7-14) ->> -endobj -92 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 370.326174 101.433071 351.576174 ] -/BS << -/W 0 ->> -/Dest (cb8-1) ->> -endobj -93 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 351.379152 99.933071 332.629152 ] -/BS << -/W 0 ->> -/Dest (cb8-2) ->> -endobj -94 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 332.432131 99.933071 313.682131 ] -/BS << -/W 0 ->> -/Dest (cb8-3) ->> -endobj -95 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 294.538088 99.933071 275.788088 ] -/BS << -/W 0 ->> -/Dest (cb8-4) ->> -endobj -96 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 275.591066 99.933071 256.841066 ] -/BS << -/W 0 ->> -/Dest (cb8-5) ->> -endobj -97 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 298.350419 124.541066 391.740800 109.541066 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rke/latest/en/installation/) ->> ->> -endobj -98 0 obj -<< -/Filter /FlateDecode -/Length 5338 ->> -stream -x]]$;r}_Q WW/0 6 |0vfc}P>232kN3ݕ!)8 -)*sW"R1UJEI MQyCׯ,pQm ~.쯗??Ks*`3'S1ŨW1Z`n1g) fHIfPN^Jdmp&ea!) f죐d40Vk1 h"g4U@)RYLH3JiΩx#eBIJ#6R-i) KQJ 4bStRZ-[$ҲS>'"1-#MiV{sZJ3Fy`Ӊi(tRB-A,ﴕl!Hi bJZnO '5LAW4IKȳ1>c&rm :y2įcO.F>]FxghlzC!$0~z/_P/b4&_3ncⳝ|$>Ϻp\S -sY|hmY?}.mv"mQn?i6oڮ !iN ^Z>4vyu@Os+~?Ϙq" E^$LBį083Ɂ_ -3n ,!O빝 >OmZۺ̟+ o_ e֍:ͻn#a"( jY -:V>SG0aaqnٟۈ6@>v]?#Z!it>4yJy"]yxy" xOK #Z8썼 - ̈ҥ~ᔧUhM7-ӧ.,T9UqYf+kԙ 2lH;6i2eua,{@/19LxQ9]a79<xa DnȾ4?ʼ ǃVN<5'u;c_}ᔺ?~YupIZ6ʼgݕ}i/'yj-*wIX\к) xq9.Đ;)4aEoU.>虢_Tonszޞƕi5<< 1lX+8F\ qZEe4;{Y:?/yQ9nk:+i1YN;u -dVrٴzǻYp) P(`9&o2O(v.w6AkJƮ4 :VC0 Őg0X.l˖R<;kcj[Q(g"9&D!,;tD,{`;o[So}L?/ N;`a@|+s'u#dG,x'<ums]bs?'_7a1A;s*OcoZ:5%ygpz[5> ͏5Y/ihe_?ҙ_AfegJWtq6ż(wվG3N;VŬҲN~a]w=c8<1Yu9tjp:*tB\n)TiztFD}uveH]U|zDw{fC -V+/%AX[^~3 (3=~ -GSΓ:"-{hQɂд$}͡JN'=Z1uO @>hs1Ѻ90cKi5 7&G;<weE%VT<M } 03KIjI^PPW|zUfa$ʻ!Cl`č ߅X*o4i}ykɼ<-+)CɋYT^ilm8^F}Mb L#Z7)p:r.3txJ~x?8PtH3@4^qNFпǀ|#2y%G@<<@l$ƇoE%?ćam8A7gQ[Pv9^D`7ޢNܬJ -z< 7pZ*tV('o'uIsА{O[Vq\2&/a:b#3AZ\B,e}Rye#ݷ֢R-H}Ix}jQ- - 2BgݞSyy~cV0ZTR`zr_v+~8-B7g 4@pBTss:D]hQI jǧ@)!h?B[{Jv(/G(N:4ʚj> @h{rmYpV1jyUc^ Z*Lrr; :+/m  )!HmԶ!EQl?<<pZT2p}N}nv}f>ivVjƋ2􀝨1O+O<")weE%jk뭮灴[Ǟ[ -w"\(n\9EgZ'ul|ԃ2~Gj*C3P#T'?uRK6>f2>ytd?OA07Ev*GyEJ̑46q{պUԢjZdn0*79[P'AtŸt-Й-}5>} -$jr'n1\o=[UsmnJKYiYѮ~\@k؍vCG!\(on(xҘjS5U&e) 5HW¾F塱I-QHQv c{fL-wkthARC#451SXmƕPW#& ʯ q7WUwиuㆿ0_2ZO.Ս -V 솁kWom۷d҈{R9;8_3FGwSܧqqB`Oj.eiסH\q>#절P\nLXIkzƮG&Fiԇٱ*+w1dAƋ`2cya`wlrFM:Jۍ,u2,/ۘʤ:ooV|ϵ F-hq1bt6gcTeJ@2]eXm -ZmrIlb.~ֈ~앰EK@~sw{K&AF&UٶnZ]Gp =2]or~}gtKOY0 j2|6e*[BY4,i> -endobj -100 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 289.074296 784.370079 316.109452 769.370079 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rke/latest/en/config-options/nodes/) ->> ->> -endobj -101 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 650.584475 101.433071 631.834475 ] -/BS << -/W 0 ->> -/Dest (cb9-1) ->> -endobj -102 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 612.690432 99.933071 593.940432 ] -/BS << -/W 0 ->> -/Dest (cb9-2) ->> -endobj -103 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 574.796389 99.933071 556.046389 ] -/BS << -/W 0 ->> -/Dest (cb9-3) ->> -endobj -104 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 555.849367 99.933071 537.099367 ] -/BS << -/W 0 ->> -/Dest (cb9-4) ->> -endobj -105 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 536.902346 99.933071 518.152346 ] -/BS << -/W 0 ->> -/Dest (cb9-5) ->> -endobj -106 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 499.008303 99.933071 480.258303 ] -/BS << -/W 0 ->> -/Dest (cb9-6) ->> -endobj -107 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 480.061281 99.933071 461.311281 ] -/BS << -/W 0 ->> -/Dest (cb9-7) ->> -endobj -108 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 461.114260 99.933071 442.364260 ] -/BS << -/W 0 ->> -/Dest (cb9-8) ->> -endobj -109 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 442.167238 99.933071 423.417238 ] -/BS << -/W 0 ->> -/Dest (cb9-9) ->> -endobj -110 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 423.220217 99.933071 404.470217 ] -/BS << -/W 0 ->> -/Dest (cb9-10) ->> -endobj -111 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 404.273195 99.933071 385.523195 ] -/BS << -/W 0 ->> -/Dest (cb9-11) ->> -endobj -112 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 385.326174 99.933071 366.576174 ] -/BS << -/W 0 ->> -/Dest (cb9-12) ->> -endobj -113 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 366.379152 99.933071 347.629152 ] -/BS << -/W 0 ->> -/Dest (cb9-13) ->> -endobj -114 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 347.432131 99.933071 328.682131 ] -/BS << -/W 0 ->> -/Dest (cb9-14) ->> -endobj -115 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 328.485109 99.933071 309.735109 ] -/BS << -/W 0 ->> -/Dest (cb9-15) ->> -endobj -116 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 309.538088 99.933071 290.788088 ] -/BS << -/W 0 ->> -/Dest (cb9-16) ->> -endobj -117 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 290.591066 99.933071 271.841066 ] -/BS << -/W 0 ->> -/Dest (cb9-17) ->> -endobj -118 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 271.644045 99.933071 252.894045 ] -/BS << -/W 0 ->> -/Dest (cb9-18) ->> -endobj -119 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 252.697023 99.933071 233.947023 ] -/BS << -/W 0 ->> -/Dest (cb9-19) ->> -endobj -120 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 233.750002 99.933071 215.000002 ] -/BS << -/W 0 ->> -/Dest (cb9-20) ->> -endobj -121 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 214.802980 99.933071 196.052980 ] -/BS << -/W 0 ->> -/Dest (cb9-21) ->> -endobj -122 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 195.855959 99.933071 177.105959 ] -/BS << -/W 0 ->> -/Dest (cb9-22) ->> -endobj -123 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 176.908937 99.933071 158.158937 ] -/BS << -/W 0 ->> -/Dest (cb9-23) ->> -endobj -124 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 157.961916 99.933071 139.211916 ] -/BS << -/W 0 ->> -/Dest (cb9-24) ->> -endobj -125 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 139.014895 99.933071 120.264895 ] -/BS << -/W 0 ->> -/Dest (cb9-25) ->> -endobj -126 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 120.067873 99.933071 101.317873 ] -/BS << -/W 0 ->> -/Dest (cb9-26) ->> -endobj -127 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 101.120852 99.933071 82.370852 ] -/BS << -/W 0 ->> -/Dest (cb9-27) ->> -endobj -128 0 obj -<< -/Filter /FlateDecode -/Length 5039 ->> -stream -x]]}_ρUQ,$0$!p7C~N-YnU۳a^Wtt$˶9kDFc'3XL?_g)*orH \T1{no﵍9[sƟUTL1j/2T8A彊 QĜ%,7('/YUq*  I*aha֢h"g*уFmu:sNHIU'IGgm$/iI_ȥ(|qiQ_lNEb:Y%t%Q_tFe|ND.CSLj|rNK:c6ÈB'(,| gQ_V9B+Ŕjyt;팤H%$ -RKeK %J ؔ$+ -9J<ഁ/ueY8_,9 ؖ t68-i$.p \%.p`\I\@RsSp8J\@Rw-qw/`GLrx%. . qlJZڤIڈ txz\k+qw- q?Z/+q=tI\)D5O`+eRxI>Qhqaܢ !K\TN}& -J\!RK:YK\2H$.@|SF.+SwAKVDaDE  @J# w޳s&=d%.@^0*m zXҁwY)qA,I8[ B"c C'± j<(K$qk]ND _D _2H\@e[E|A(qLL$qA1 Vu :%.Bs)0%.+N$. f"qBJ3It3Fd A Me-q"4hjIGIDAq(q f`JQ_@x%.MLsD|q$.Ht3I\|J\l|3J\5|A'qAAq,qh:%.&aiIKo& Әob'7G" ,[p`'I$qAIo"7\$L8|4 ^3$hPGl 4*ks$qnbfj -ⲁ"OU"bf|Â9R)v]?N{O_~5wxby،]t6j!|ƆyqҀE7v6/f2 yV[!HcO ;MSTĹ@@)-s'^M¿p0oDsBZ}~?~rN?<96уVui_OE)̿iEv{;4s<ߧ; 1<Mi|b4EC)`^.\4}i~N݇5ΒWyi@S|1xx"AcuΏ*c|N8lAA%|$ ɝHLA&f: ;˧_7z^u6 ۦ{ӄ J|)rT&%Bјq@l3zѪ /οTv&]|?Wmߝ"af\LtۜSuw2&[9"YWlUJT4YO)72]ۀkYnɸz{=%enS;Fo2ژagyB+\ї4otSm-[@lxob$ 5PSmm1_iJPI,t>lo- 6- Zxqtaa8|$xJ -x_d(u>mRg=Dgd n",i- I!WqUWqw]2ދ=ZU!R{ |ƤL][9 xW2 c6 yF.UǺZ\c,W-w7tۼ92z73)x-n*7mȊ229x-dsJoIګ2o@pCT9PIm6G\ڴӮf9p=D_ U%pBj$P3PA`|$Γz=}[0uu4%oc6ǁn"2WBwUɴ DM/y+-P.nSdB26r%`) T-V-6!h^JS4==a Kj~u]W" }vzU&E[k;B+wS \wbm*~Po@zsSj4,}`ܞ+/}]{{}PφK#c`iKcCho UlfN^G6eQhjfoo5߿S -'RԨv[Ax8`M>Yz/ǃ𪒒7Jl?5[*ӘM5,x7(26va:kqߞD4#+}mP{}A=ΚAZƃq &̪؂<W wBp'ao?z$lHcaǑt80, νr麒R8C0+P wk>nnس|[[ퟀ47؃6ǁ4Fg~ !dpgZ"}iN ZOf6A@!h~:zzη J_u{}y`o/ &`<o mAǏo Ul'偽(#6ǁgޢ1["[tcdwۻ7Lv{a38-~A!q+7c+gy ``oIe7{p6Zm9+7+y3h}]8)?"9N;~fyͺnPeO,lޟ=Mo]Z5z(xk?]8m]hC|Vdl1G*xGHrܯ;ߦ]nl4+%8|>{[[M] v2_KaY>UGB(qx UG .*݆c3wguL&`AsK!fql^.)+ &~_Wooc8HĖA.x|Mӵh-mӵY3M÷Ȳc;:o_>V7׵k?;Bw.ez}Kj/p{$8LGol -1r˺o=*GV['g36gAs|ںWm>z>!C~/車mO) ^ U%̻zvzg[P@wΏh0^m"%zZ"=w{}[Y淞cV8 %E67)ln -u!8ş;gۈ\@~^pJ?^lvڴ4ߒ˱*w$w0aLi3creS箹>f*Sžy)|`$ЋsAǟk)"͟ Ssd*|H젘󯺞@.ྨmI畞Η_/W1QvrXV,aL/ט_ؤ|+>!\NHm儋ᦘwr,B uS"kCX]o4_t#jݭMWʩJZ]eq*W/%kP'At9 t955VU -˥ r|XK4_\YRmxA6,fhW~]yslkNx9P/\}^+ty8/_Lv CK*|2L,GK%<6xH> -endobj -130 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-28) ->> -endobj -131 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-29) ->> -endobj -132 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-30) ->> -endobj -133 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-31) ->> -endobj -134 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb9-32) ->> -endobj -135 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-33) ->> -endobj -136 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-34) ->> -endobj -137 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb9-35) ->> -endobj -138 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb9-36) ->> -endobj -139 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb9-37) ->> -endobj -140 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb9-38) ->> -endobj -141 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb9-39) ->> -endobj -142 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-40) ->> -endobj -143 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-41) ->> -endobj -144 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb9-42) ->> -endobj -145 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb9-43) ->> -endobj -146 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb9-44) ->> -endobj -147 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb9-45) ->> -endobj -148 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb9-46) ->> -endobj -149 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb9-47) ->> -endobj -150 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb9-48) ->> -endobj -151 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb9-49) ->> -endobj -152 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb9-50) ->> -endobj -153 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb9-51) ->> -endobj -154 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb9-52) ->> -endobj -155 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb9-53) ->> -endobj -156 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb9-54) ->> -endobj -157 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb9-55) ->> -endobj -158 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb9-56) ->> -endobj -159 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb9-57) ->> -endobj -160 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb9-58) ->> -endobj -161 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb9-59) ->> -endobj -162 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb9-60) ->> -endobj -163 0 obj -<< -/Filter /FlateDecode -/Length 4884 ->> -stream -x]]8}_/haahh؁bf؇;U3,apZ̔oUVt -KGG!9lşL%E>|dM -M%V/YN&s8,J&S[TpH3s,辭9bte{iq?qu! te1:ڙIȓp-6D*8o1ݖs.c!zRp*mT8m{\i5ݏwOￗܭݟԁº :4n6;@W&;A1jqex<vmsn #cZ \|c&o304KaOܪ9-ggT,򊷆0c..XGDL2֑5nGpvk.;A-l:iһ9 u%; -eԕnX>ʛ_?_% uo!t/.H`hEb^OxKtPh͐c6/Vo>+fY'Nki -O; 0PjtnDD#x.;nslӹInQ3iU9cW=ܰ|sŗ٭CdYֲ5,[l"/)'h]~ -y>0˃.`~J]8BP;l"vKvq)0,o-+ -]pWWGF>#ZE3+< ͸~#)eeuknr'&1#P q }nc6ǁѕ[ YAQ3\l_||=ñT˹s]lky? -{>qZva8p 3pVݵ N]}nZ[4&?2_KeY/:jp[|9lIKyl`)e%y*JvUz3 Mvkk(;2X쓤p{tm8ɛ|ᙀ[U2w9N1*=ز X]dWG+Yp -bc6ǁX@Q[UE;wwÞwkoUZqvS^7fsIbgoU 'JMw@Xn (1ߑ7hs 3SA֕Vo[/m%mA/|)y.Ly&V#KjӞD[}YR[ \o4Kj0@,V#bU%U֋=YR[}YR[{+ݢw7hs<S|fRͺ/zOXcKhgXVCiӞxk][-WVi6\R9H<%o&HW|.u{nKodYޖ H*?rzk=FbE(/{mU.1oA[ײʊYuk1)%=*y)b>G p.jՅs˫y -75՛_qG0LC={/pϟYL\d/32r""88)72+^l\;[16NFb$ ڼnjwa9}VJʇz$Yaj`.1?EQ Zv˪Zz/"F"v.I -\`S?}W# ]HzX2X"+t|+!V!\N}儋C$/°ڮE,_e}YZC\u_u= ҵUʷjzd9U4ԒC"z9)l=5(^/\[R)Zn>[h=Z+ )WdS$ƈs-mp7—<BRJ+lԝ]Hԗ_U&_/TTgAJ2Mn^rm8wJ }{lBtkkNJuOHZX(O^hnוx3l,wƝ8wAo;o*|&6 sd{fN8RX N:Z;I^.Lq_N> -endobj -165 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-61) ->> -endobj -166 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-62) ->> -endobj -167 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-63) ->> -endobj -168 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-64) ->> -endobj -169 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb9-65) ->> -endobj -170 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-66) ->> -endobj -171 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-67) ->> -endobj -172 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-68) ->> -endobj -173 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-69) ->> -endobj -174 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb9-70) ->> -endobj -175 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb9-71) ->> -endobj -176 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb9-72) ->> -endobj -177 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb9-73) ->> -endobj -178 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb9-74) ->> -endobj -179 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb9-75) ->> -endobj -180 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb9-76) ->> -endobj -181 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb9-77) ->> -endobj -182 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb9-78) ->> -endobj -183 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb9-79) ->> -endobj -184 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb9-80) ->> -endobj -185 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb9-81) ->> -endobj -186 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb9-82) ->> -endobj -187 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb9-83) ->> -endobj -188 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb9-84) ->> -endobj -189 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb9-85) ->> -endobj -190 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb9-86) ->> -endobj -191 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb9-87) ->> -endobj -192 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb9-88) ->> -endobj -193 0 obj -<< -/Filter /FlateDecode -/Length 5023 ->> -stream -x]ߋ$~ +K/X` 3 w=kXEVJ̌T@ݕ!}T2;sI^~Xſb* ~R:Wb_@ɤ|׷ ~m.okw])b2)dRTPd)E!|JQtXV1Bb1A >+Eb'G1|rA WBR[AL^)sD zʼ31_Բ2VFdbbVVL1d!K(iel2”V! Ejd9V ,CXWV ieL(Y-+(9}Ld2LmZ%Ťym(jd dVF_+NJ9+&KN+ jd55 2K L3g |.S" | cIu(N%pԐda\ Pa CTаx& h˰ p˶8 xE  1ĥY”%`tOPB`8G K쬆 %ZY` L0pM0pkXa԰b|VlY%9H0p܂湁>Xaw=a  w!A V{yҰDÂuO@+rPZVKqebhXpTaA>x5,]GZpb5,] Aq4,3tղblYÂ,y @,Ӱ`l,P "phX6iXeװq 0m9`XʀAZpT4,]q$5,Qװ f6%aA,eԲhp4,HR 'ְ)TC^Â! B }dCDL.aTMNk,% RbW4,@.e2&x#ᒆe5,H`hXWdGd9Ȃ [D(sNÂ! A 2հ$Z+c+yfְ s4*jXiLHAЏ$A$?H6ekXt3kX3dkX۔|3iXP,dAħaAHa`ejXP\FYK7,Mxʼ-%L,!ZY4eoY|a Jof f DD. d7\ ȤwF p|[oH,gVW ,7K o5 I]4,sTW VQ謺l`x է~*|fNrӂݷcFw_|M+eGIL_nc(ڙȓ=<"D*8/pp>ȐXdvf;_d -4GJ_L?ސZ 0cO O|HbZT`'&^˫t4жNnxsz{+G ~??1u)V}H|k*vM3uvV\ϵǷHa;r?0  ߱[n9oo珟֖a0!occyG`A߱4bH6cWmN621XOQ4U'CV}S7zי̮c f=bp:@a5~=˒+bs="i ˊ --;ܺ! PJo& {?21IvuPTG yLiiN&W`xgŘI -RC~fu8S/Ol"O(|<41˪՞{hݩ[)֝q?dtr<qjs?ix4ҙîg1-b*w ,&$rKc9)%F})vxFgsqJ[BqI7lbQG$yNc.leח>\֍HEx[]](E/+{ɞYs?<bxk٠3|#o.Z"jzxO6s}{^۩'3ӞI:Mdy,0RqG&9s %@INɧT[K$۸kx{- ^my&X⑺xΣ.2G"Ȫ?~<*,𾯁𹅿{T yIu?GSi4,ǧm$n7ɄƳ.޷yF/a{l=6J5Q1sÑW2ŏTntUs'5>^}_Ϥ{xNNC>f ZOG4r# BD:: C oYPf(Ɗ]@,/P[:w7s+Cϊt"s(v<؁?"hq-Oߗ*Gbn߸|nPcumkgDE^奒,i(Zy/r:CY#`{Xn=dQjHUAwlі' y!uFu-s'ȢAlA\R DHbv:R9wf0 R8իF1]φ0N0n?MYkr_tP"sS:ZJ׾_s[#|G xO5~0YN]HѺۆ!D(9ay$9or=|Ksvb*~l0Lx,cCwJY5C?D0>Q('A(?.nG}D63c=\o keZx1.h1p0r+w f{4Wb\Lr(QgI6qjl]Se:*7wt(i5A(;CͧQWˋ9 <,`4]9RGvAJ DO2sLڹęqNпR1Ib?t|T{%Y.]k -8r0]t78h0E釜=yӟa@ܮĺLRlF<\O=s^;Q -;ՙǝ=&ꄮx#nK:uy6NFr<19g*fKi@5"Z$+4\I1^dܣX[DՕ-" -n8-yb'S5);,q -n?T69"F=+[ -r9ȍ, W\*4}ݥ,[bmBj]>sйNO:_/薶7*צzh U5ԚM!^/ -[hwZSo\ [R)׋Zon-4MV+/"b+ifj戥qMk?"vKHJ` z"u6r,ԔPajV!+oPUgน,-WK'27y=H==6am`$픚U mVn:z*U<kkVau|VD[@w 94S~[9C΢=vrl֓SӸC+url%B|Zgq }u6tei</i$'QGGgן7?mC ߰uE=|Q$7Ub6s n^n`5]CPJ{bXư#fQ72u3-V,vI9NJvp2Z\kWRuq(e1o]el%dIz{U]ta\RƋ훮.*fwZV(B{z}gcBmިo=ݘPT.{wusZL%Eo5/lswʕ:Jk-*SLwQJ-XG:Ziz]]iz-Q Boi;ldVhnT^jRu^EDva ¿̝f@UO+./_#G.!m>s45JF]{: ;>uPP l_@YY`Vp/yÿy!]&I;I,_EStzas81 -endstream -endobj -194 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 193 0 R -/Resources 4 0 R -/Annots [ 195 0 R 196 0 R 197 0 R 198 0 R 199 0 R 200 0 R 201 0 R 202 0 R 203 0 R 204 0 R 205 0 R 206 0 R 207 0 R 208 0 R 209 0 R 210 0 R 211 0 R 212 0 R 213 0 R 214 0 R 215 0 R 216 0 R 217 0 R 218 0 R 219 0 R 220 0 R 221 0 R 222 0 R 223 0 R 224 0 R 225 0 R 226 0 R 227 0 R 228 0 R 229 0 R 230 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -195 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-89) ->> -endobj -196 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-90) ->> -endobj -197 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-91) ->> -endobj -198 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-92) ->> -endobj -199 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb9-93) ->> -endobj -200 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-94) ->> -endobj -201 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-95) ->> -endobj -202 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb9-96) ->> -endobj -203 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb9-97) ->> -endobj -204 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb9-98) ->> -endobj -205 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb9-99) ->> -endobj -206 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb9-100) ->> -endobj -207 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-101) ->> -endobj -208 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-102) ->> -endobj -209 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb9-103) ->> -endobj -210 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb9-104) ->> -endobj -211 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb9-105) ->> -endobj -212 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb9-106) ->> -endobj -213 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb9-107) ->> -endobj -214 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb9-108) ->> -endobj -215 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb9-109) ->> -endobj -216 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb9-110) ->> -endobj -217 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb9-111) ->> -endobj -218 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb9-112) ->> -endobj -219 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb9-113) ->> -endobj -220 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb9-114) ->> -endobj -221 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb9-115) ->> -endobj -222 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb9-116) ->> -endobj -223 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb9-117) ->> -endobj -224 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb9-118) ->> -endobj -225 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb9-119) ->> -endobj -226 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb9-120) ->> -endobj -227 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb9-121) ->> -endobj -228 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb9-122) ->> -endobj -229 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb9-123) ->> -endobj -230 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb9-124) ->> -endobj -231 0 obj -<< -/Filter /FlateDecode -/Length 4449 ->> -stream -x]ߋ$~bU/~ÑB>?_Ꞛ^Inٛ*I]]%}U%t_rԜɻ=M%V;x&/E'%pvƐ6cӟ~s5_~P%g V]!&kX#f rCj bH`YbLb ՘ yA{AG%(=Y@.Q٥,UR dՓŋ%xEd '&ej -dA*&UvW%k^-l0` ^,j Kd,CNDΥ5fd"d !Ƀ,0!AANq€PIb@(Il@I^ C(B&"&p 8@a h+-0V|% x+ rIbarѕ e` p0Pc -0`$ B2Ƀ,Sa 䳅0 -0YXB) `d "}@AB w! {[X\@XbaAR34Q‚ܥ(CƸT-,]8* w`G D.1<R‚E-,@wp7G]Uk)D.`)XX/|БC-,H]jaAlaAzAc `a0l1`x]Oz n‚! -",,HՃ%haA D@Ƀ,֮r-Y8 r,,,@D*!6ȂbY)ZX$sXXcB>Z\ɀkWlaAR`[Xw.YX1# WȂba\+#Ȃ DYXPdA4haA YfC#-x3EP d@JY>lG Dc Gf|}SlaA'aq𼷰RAK7=MxƸ4T,!Ƀ,1nI7N/AP‚7ћSElNwc2Y<."da.o"r{,qsz#|9eVٜ3_͑I̲$snL洁"+L>ST !gY1,}9b|e~O_=L3eY&QH07M Mn"$!|M"EH,Γn*$\1m=/̄`fz2L`*N/Vr/og9 risUBRHcR\b'^/¿{w0o헃~廯?>[ ^I~C77\h=~=]>c=_߭\u#Uy>]m"C6:o ->$_+4@ %?0:u$,R賙u6D*d4tg qL; nvƯ Ip;GQ3FJ71\NAcsQtף@MoaFngØLosh(I*e_㘅u'q׎C\s47,X0[})TJGXIJ>zf_=*4-w6[}ڪK-i -l쾫}uΈ1#Bk16Kc?^,\ Yi>߬iYmmݖz/Ȧ+[{{-snQ~-4"|mqWEFx]iJ)(qjF~`}Ucr)}K qi>o]U LU1v9j7}b^W7,]&Av$4{~sd]7s-z=ྍwU9Ӣ;Kf*]9qa99AY[Qfc,µ,<,X"g9+a>Hp -4+,bHDgܗ5fz%[Kʬfg.e=cS^Ns)ѐ5Nep4X~+u|J9C45#ԢG9ݲY6*ziRoԜOzПNjO/?Ot"}F홗8D^ݐOzdmԆ]ݖ9!UӓqtFҾzADDd}zh&)|(15A\R!xMʆvEUG[ِs#>p[RMٚj xvjl%A = 5:@v!֑Az:bTR6/,]KWAt4S=뚜HZ~O'AtE~>l VغHN.~/ 5* F TNU䙾.g-WMtlvZI#=uK$y);r}voWVAe=&T5zd#7!p{W~^9c%{.Աy$nqݡ7dK֮_Mr-7`Dn( <ǠgbaDom]x-BydzxIdLe)~<e`o%#(uHr]7wO-@fqؗKn۰eפ8, |ĕ]\:púHS;xz_FSk'n)"yoZWBzxj"6ڡSGj0v<]e9<c{ %GjYxSiMpobn2ZSR1BitҕGnx=Zű;RǒŠvR޲w1d$-_ū¿׌KlUL3T#<ᨅ2*/)CDR)׹?q=8;N}&:`njwjx)Y`_L`扜~5UԿogO4W'Ͽ2 -endstream -endobj -232 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 231 0 R -/Resources 4 0 R -/Annots [ 233 0 R 234 0 R 235 0 R 236 0 R 237 0 R 238 0 R 239 0 R 240 0 R 241 0 R 242 0 R 243 0 R 244 0 R 245 0 R 246 0 R 247 0 R 248 0 R 249 0 R 250 0 R 251 0 R 252 0 R 253 0 R 254 0 R 255 0 R 256 0 R 257 0 R 258 0 R 259 0 R 260 0 R 261 0 R 262 0 R 263 0 R 264 0 R 265 0 R 266 0 R 267 0 R 268 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -233 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-125) ->> -endobj -234 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-126) ->> -endobj -235 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-127) ->> -endobj -236 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-128) ->> -endobj -237 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-129) ->> -endobj -238 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-130) ->> -endobj -239 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb9-131) ->> -endobj -240 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb9-132) ->> -endobj -241 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb9-133) ->> -endobj -242 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb9-134) ->> -endobj -243 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb9-135) ->> -endobj -244 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-136) ->> -endobj -245 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-137) ->> -endobj -246 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb9-138) ->> -endobj -247 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb9-139) ->> -endobj -248 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb9-140) ->> -endobj -249 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb9-141) ->> -endobj -250 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb9-142) ->> -endobj -251 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb9-143) ->> -endobj -252 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb9-144) ->> -endobj -253 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb9-145) ->> -endobj -254 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb9-146) ->> -endobj -255 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb9-147) ->> -endobj -256 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb9-148) ->> -endobj -257 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb9-149) ->> -endobj -258 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb9-150) ->> -endobj -259 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb9-151) ->> -endobj -260 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb9-152) ->> -endobj -261 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb9-153) ->> -endobj -262 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb9-154) ->> -endobj -263 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb9-155) ->> -endobj -264 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb9-156) ->> -endobj -265 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb9-157) ->> -endobj -266 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb9-158) ->> -endobj -267 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb9-159) ->> -endobj -268 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb9-160) ->> -endobj -269 0 obj -<< -/Filter /FlateDecode -/Length 4154 ->> -stream -x]ߋ$ ~￢-ٖ!C `H!w^SuL{" 3%U*,ׄW%<~J:ťPg%PqX_c_~wN8FWk!,&W V2X)Rb+WbAT85@ ,` .YbbAPS1XC7y3S4x! gRc5yP#rpHUsNbK%fo ! e&D)d -dN5xYкA}x\l*x^\O. x!I&#b"d>UYh0-p"Q15w`dɃ,01C_ da@,ql@r,, -DK! bMs-`yȒ8[H@0 rAj w|&Pqoer$.:* wba0ޡG$n b$.da ,,@G5y*baA腝 + )XX0vqZX>YXkkW2yk:k^a{ߘ3"4eDQtA&"ӑq7qDe=t.{vk9xFGno~(2EMAJ%S˨;-Y˪nOǷZU ]h{}Z;":)m# R-WeNUٍ ffx,2jTS9I*$HW"pn)v~ SobZ;,H>tf/v~T3:d'SmU=peD;>Yg?+ДpNxIR>\ti_0-zyg|8-/<F^hu+):j#bWB|YMi f|wQeSk6}k{ aWycy>cM vXW]ƁnXp~ SܤM<(:r"-<p|+Ø&TCXɼ7I_Љ429ќEiΓL`6/$rNQLuٹ:Q-u'뺹{g @⻋+[}a6*uFoEu" t_# Pq'&P ]?ס prx:Rqs.F:~0F.FXtyX:QsOs -W3l^҅WER-8F 8}޳ x͘.# ع:Q}Rj&oRo'kxq}js/w9#ĄyOd]9We7j^W¯1(8F䏄 $Ip5v ]oob_j"UN`ԕE#zj÷|XLFSctӐ3)=;-l>yfKeOSe|,TC^NII>/}o=)zԓ9ް($@:I*N\?^Y N䧃]D$+{LZ\,IoN}OJ5s&{d=Qr%&3 y,px+1]𸕬;[?ns`V6/x,]RLnմ} TJvpAz<į|F6?XM95$j+gfRTdZWQ֦NoE|S%g@5+Aל\ӊ>7io'_J9OpFG *R*,&'WC7;y;갥e-;+쨯 (KwmzM<[r譮š~:VD߄VrMiC^LUahw%玝O#t=;F|\:6$kӗ}և U0J^ai!7o複CY=EJQLAO7p7|};NԏG"vlݐǞL•IۈmbWrlj1xku{+:i@@f -@fO^!=Iup)+.8WZt8TxS\d1AWy4鳆!KZyvmyB`/sZ7B^gsvhԧ_Ll*-y{Zv7]5EQrVXC \mtZ\ F5x$_w=ss1Z`jF:t -EZ!aHu^hc`DO`یV?GtuJS1œYy _M!e%oO! -endstream -endobj -270 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 269 0 R -/Resources 4 0 R -/Annots [ 271 0 R 272 0 R 273 0 R 274 0 R 275 0 R 276 0 R 277 0 R 278 0 R 279 0 R 280 0 R 281 0 R 282 0 R 283 0 R 284 0 R 285 0 R 286 0 R 287 0 R 288 0 R 289 0 R 290 0 R 291 0 R 292 0 R 293 0 R 294 0 R 295 0 R 296 0 R 297 0 R 298 0 R 299 0 R 300 0 R 301 0 R 302 0 R 303 0 R 304 0 R 305 0 R 306 0 R 307 0 R 308 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -271 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-161) ->> -endobj -272 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-162) ->> -endobj -273 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-163) ->> -endobj -274 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-164) ->> -endobj -275 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb9-165) ->> -endobj -276 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-166) ->> -endobj -277 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-167) ->> -endobj -278 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb9-168) ->> -endobj -279 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb9-169) ->> -endobj -280 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb9-170) ->> -endobj -281 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb9-171) ->> -endobj -282 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb9-172) ->> -endobj -283 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-173) ->> -endobj -284 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-174) ->> -endobj -285 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb9-175) ->> -endobj -286 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb9-176) ->> -endobj -287 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb9-177) ->> -endobj -288 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb9-178) ->> -endobj -289 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb9-179) ->> -endobj -290 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb9-180) ->> -endobj -291 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb9-181) ->> -endobj -292 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb9-182) ->> -endobj -293 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb9-183) ->> -endobj -294 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb9-184) ->> -endobj -295 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb9-185) ->> -endobj -296 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb9-186) ->> -endobj -297 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb9-187) ->> -endobj -298 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb9-188) ->> -endobj -299 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb9-189) ->> -endobj -300 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb9-190) ->> -endobj -301 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb9-191) ->> -endobj -302 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb9-192) ->> -endobj -303 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb9-193) ->> -endobj -304 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb9-194) ->> -endobj -305 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb9-195) ->> -endobj -306 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb9-196) ->> -endobj -307 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb9-197) ->> -endobj -308 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb9-198) ->> -endobj -309 0 obj -<< -/Filter /FlateDecode -/Length 4927 ->> -stream -x]߫帑~?y"<,@``B=73 ˝d߯t%٪o{%T>}e5~3'9R1/_oZEX]ow]TPT1{6}[s'9R1Ũ IޫBR0 -3|t֍If3IHJ0\44&eaqR0G!hab ΑҌW4kTHf1-"D+FJ*`Hix㜖`[(`M[,Z' i ]IL-:h#eR>'Ĵ4bӬ'"- CJiAbZBb#qb)0%.+v$.H3Nₘa T̥4[dK\OiH\,l7(qA Qf`F,Ҝ83I\\P*J\aHL)Є~l"` y'qAJ$qAJj+qf kO€b7Y8Ҵ x: 0.9Ld҈7 6Sx3J\lpQ4) x$b fnMx@x3]LRxi7JLNLq&q@z=Vq@{1[Eq@|9F `&"ULH4Z\6_cnSD93EɌaטed{o{~]Y)[~ O.p`y،]RCGUX?F܌4m_dX683\_/" zX,[i -0{|B]0;Sa)*b_ e܉WUt0zVXݘ_nOO?>3oW7zȽ̃4orᙸϷ?~Z"n bf[:‹SP(kg[8)M_䇎[䙆ɞ׾J>\KpKt&#T.K)T7am؆~2GsVbhÄ߲s:iZ+֑s#`hj5ihLsYd?D9_N|ûwƜu:#8> *-iˎ-OMH:PT0vȠH`frrP^9ˀrTj\ +bۂlnE3W#4W Ž bac~]9 4^#"m'܁%3yZud^gR:A 1m B pp_\(BՃd"^]!<ÈD%n)t?Eg@:!4[ȸuΣݏ&;^X/hόn= z B &^,PnWؙӹx"1B3*N/@cbzp(u ީ= IPWVWg=Iw7$1{u<Ǵ *Χm2%MO)cռQ{XowNQ)H&ٲǽb&u,Y8YLgkU~#e3eN_9ҵW@J3z{s0Lef``HI[Z~|9";||& W~;yf#¬ϼޛ_Bx} ibϕgzD[;v(YAɔy0GJ -7sHGޤ]8YW@2k0ɍǍS~`@@ -^(΃jN2j]篁fY^pݵ -Z@i>%AJXȸߤu1dgBiUiF x~1O߃!^ՠ !0+\z΄o{tF8.t`'tA寽8?qFОh7&IpO:ׁ'o Lx - -+7uhNhq8ws:p,~1 uԿFpݨ}hzQ-o9%z rR:Wc%\/2׵g]m}ƺ_s뜸 nA`iCz~uYNUCe5: 3@kOE=[罶IOЙ_>hB 买Xmk:ⵍǼ6AP篓:Tv]9<@ -lͳhő''Ԃ WBmR:P#~9s&w ]=U mh 6hڨ4oǀ8a59@[zhy`cG|Q&+fms_ԹO>sҺkzY6ղ[m>1j[ *Miޛӹ 0~g޺3vf#7jc>A`p>0"AIṀBlX,lcҊ_mxZĎ3kb=9m6syvbgn9Z^Na~K1P!f2ۨ[D':XӚe<`Bgv_$g>rɆWO\VF|yZzV}m m}"cԞ Z!2Gu7s@85 UӀ<C[y͂ {s|i6pA7syvݜh]A BCn\%6Sޚ &uܪвˆDpaH0j =Yrfl0seo9P.t`.5 FcႠl2!1|2=Owa5sX b8sѺ+h{(Kn.D'Bof3['>Z:`hF홀J& -Z߃C6gw`Ѥu yꇹ2ݪo`euh{XǑFFS">gtI)[d|@ZzH WN -8sGێ5j{K`fgeӟdO{7r1Y,$ g2'XhX3o߷DZ%O9Q<+o+)sDބ~ꮺ&rkCXMtݿ䵱= V.J;IKQK\d/9kO&KkaZjDo71߳4_{*\) j FOiO0vcDZ֩Ío7~d|r/ԕ[I74iLKSah.2>}PRfqRv*YF塲Zw~Ac$-gҭk]u*yŦ–\ bkb_7;}^ʂkM*wX{SLln+f觥& :a3 čFߋxkdҌvLse?ׄڙHN -#ѥnIǸq5;#eޑ_'tE-Y=Xᖎ5hN+8c\ȩCEv6/PğڈK:e%O -endstream -endobj -310 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 309 0 R -/Resources 4 0 R -/Annots [ 311 0 R 312 0 R 313 0 R 314 0 R 315 0 R 316 0 R 317 0 R 318 0 R 319 0 R 320 0 R 321 0 R 322 0 R 323 0 R 324 0 R 325 0 R 326 0 R 327 0 R 328 0 R 329 0 R 330 0 R 331 0 R 332 0 R 333 0 R 334 0 R 335 0 R 336 0 R 337 0 R 338 0 R 339 0 R 340 0 R 341 0 R 342 0 R 343 0 R 344 0 R 345 0 R 346 0 R 347 0 R 348 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -311 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-199) ->> -endobj -312 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-200) ->> -endobj -313 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-201) ->> -endobj -314 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-202) ->> -endobj -315 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb9-203) ->> -endobj -316 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-204) ->> -endobj -317 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-205) ->> -endobj -318 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb9-206) ->> -endobj -319 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb9-207) ->> -endobj -320 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb9-208) ->> -endobj -321 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb9-209) ->> -endobj -322 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb9-210) ->> -endobj -323 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-211) ->> -endobj -324 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-212) ->> -endobj -325 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb9-213) ->> -endobj -326 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb9-214) ->> -endobj -327 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb9-215) ->> -endobj -328 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb9-216) ->> -endobj -329 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb9-217) ->> -endobj -330 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb9-218) ->> -endobj -331 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb9-219) ->> -endobj -332 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb9-220) ->> -endobj -333 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb9-221) ->> -endobj -334 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb9-222) ->> -endobj -335 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb9-223) ->> -endobj -336 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb9-224) ->> -endobj -337 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb9-225) ->> -endobj -338 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb9-226) ->> -endobj -339 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb9-227) ->> -endobj -340 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb9-228) ->> -endobj -341 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb9-229) ->> -endobj -342 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb9-230) ->> -endobj -343 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb9-231) ->> -endobj -344 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb9-232) ->> -endobj -345 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb9-233) ->> -endobj -346 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb9-234) ->> -endobj -347 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb9-235) ->> -endobj -348 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb9-236) ->> -endobj -349 0 obj -<< -/Filter /FlateDecode -/Length 4954 ->> -stream -x]]6}_ρ(J >$,w}ؿܖ,[nΐѩ*IU%gTJ9w}rUM%VSO?.*orH(z_˶_]1Wr8ˑ)F텬,mH^h}QŜ,ᣳϊP,MBV䢡>+C > -YFCcvg - YB6yy&Z)H7R^V!<]|F純](B]l$Eb;YKJbtA)/99'eSgW>i)M00H! -y] 2&spYGV!lm\ƧMC4Rm *Pw#PAAvNy/݁(K6 -#ɜDw|V ACW^6N8ˬj O)aW&9X^f@9>]W:1N@h:wNeiAzdWuY1 ;YR ʜ8 kx"pVoڙj 'z%vyl-2k8(sangoU}8$3gy:KkwE|d9h>Z6 1Øg|&Voke '&>/!umX'}`.:paP<3|>!}&V1v3fC *h@{b20coֺ`M@ڰW6ւKz=yԑ'L"mP<`㧗"_`sc&JM^&J/ Jؐ>.he{P<ʀJ߷&J.Ke?u 'uz=femaeu]Zs|o,g_9$:O҉'[~ <7D=9շfKl.2ZiL4p -^<8+݃ӽ(uV 06Ah. -Q$c2/LX*mMB}l=.;s;p(N#p{cpExA)ʛaCFr958'pj652ĦwmhYz=oS+v+lZ==&rְ^˳*]jE9K;-P0\<{P">k,,Z뾽u_A~&򫼮nB4!Ldħ"5 3RժoY4q?7oԞҍg]6a\)}t>T&~7؜^)K6} /Cd1(kɄ5&ƇhP}VD<8]IN/my 1@'k~c Jo Ӽ_ru4Æoꥏ.A~Lde]AL0*= oR748K `P8"0(syPtf^4<][Gꥏ=%mWD. ʜPr?PJ7sW>G{cˁ2S `CiC"SV'.r͋,,w{6:lVn~ߺJ_ a㮗axXAO:$;@{|Olnu: ŷۏ_z~l3IqVmL^3uޑ>6[-#I')xvb.40_.u=2oߊS2nzo9!Lu)M Ty[\+'_~Z_}w8rX5,$B2>kN7%EU5qеe -ɼw$>Q7-FR֟9mיfKYK|YڦRU]XIF\S})Yq^.B׺TqoFߕKLH˥r͵:RJh.=@Rx!m959\'2u.§׋Bipzm"5,1,iqF2L?,WK#<7kPYI=5]*ꎱb/PI=JmI$Ucl*j2SXʕm.J%W(=}^ƂikKr&:?P6//asd~*,ɼtXSk@ -KBSrsd}z̜%oE dKFwdC/cyu͎[]Vn]%{;x%N&Ѻdqkv^4AMm҇Mе;/^`.х.eZh1צJ\qŤ#Fml̋f+5m#Yq[EF%-yn1m%m\`j/ڊi+}<*28R{M}mSqj%<9˰62yuQ3:9X\ h1ڤEl.F]I[5Z E VkE0n8OoGvoG%tebD-rwz)Y}$V$mnXksnQ$,^|WMs٬Hʟiäc30D4}?X!?]j4q+em á-8|%ZǸ[:Bs[>慜z9T/;?XtZ>yP۷ -endstream -endobj -350 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 349 0 R -/Resources 4 0 R -/Annots [ 351 0 R 352 0 R 353 0 R 354 0 R 355 0 R 356 0 R 357 0 R 358 0 R 359 0 R 360 0 R 361 0 R 362 0 R 363 0 R 364 0 R 365 0 R 366 0 R 367 0 R 368 0 R 369 0 R 370 0 R 371 0 R 372 0 R 373 0 R 374 0 R 375 0 R 376 0 R 377 0 R 378 0 R 379 0 R 380 0 R 381 0 R 382 0 R 383 0 R 384 0 R 385 0 R 386 0 R 387 0 R 388 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -351 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-237) ->> -endobj -352 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-238) ->> -endobj -353 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-239) ->> -endobj -354 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-240) ->> -endobj -355 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb9-241) ->> -endobj -356 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-242) ->> -endobj -357 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-243) ->> -endobj -358 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb9-244) ->> -endobj -359 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb9-245) ->> -endobj -360 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb9-246) ->> -endobj -361 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb9-247) ->> -endobj -362 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb9-248) ->> -endobj -363 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-249) ->> -endobj -364 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-250) ->> -endobj -365 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb9-251) ->> -endobj -366 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb9-252) ->> -endobj -367 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb9-253) ->> -endobj -368 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb9-254) ->> -endobj -369 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb9-255) ->> -endobj -370 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb9-256) ->> -endobj -371 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb9-257) ->> -endobj -372 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb9-258) ->> -endobj -373 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb9-259) ->> -endobj -374 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb9-260) ->> -endobj -375 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb9-261) ->> -endobj -376 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb9-262) ->> -endobj -377 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb9-263) ->> -endobj -378 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb9-264) ->> -endobj -379 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb9-265) ->> -endobj -380 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb9-266) ->> -endobj -381 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb9-267) ->> -endobj -382 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb9-268) ->> -endobj -383 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb9-269) ->> -endobj -384 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb9-270) ->> -endobj -385 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb9-271) ->> -endobj -386 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb9-272) ->> -endobj -387 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb9-273) ->> -endobj -388 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb9-274) ->> -endobj -389 0 obj -<< -/Filter /FlateDecode -/Length 5112 ->> -stream -x]]$9r}_Q `20{a]ۆY?GfFU05wʐB"$e=|gN9E:_~>)9OMl )9)RJ4.[\5 iʸ'!;iiL%d f ބG. ěI]. fL@ V 7$gz"Kꊁ̭ꒁbJꚁJ.LDULHF]60_cSD9dư x5hl&_wJY(u!2t5HJB1"f-.nb$bL\?صɰXlpf;^D -]n:Oo#do$ -|aǔ~mfR}\YR1 y08^1VeJ1>LuE7]yJՊJ_gnyYEReun10\ttP qhr`S~ e 6a}"Ve*,\:]=i,z Bp<-~1uf ֳbPu^G9v'.) r,DnAQ/^ + -Lpb1<{5>Fx~.d͝Lx1ׁ@ -<.tnfnDVG)00 7Avywv DF6eJ$@g3ÚxArLu dS{&$WT`ò41 Mzqڏh]>1P=[ Y"Ry9YB9[攷9`&7٤Tc⩱'i|N8r~_}=8{<>Ve||9fgduԹy޷l3a*Z6| ;/m16Wzo#^1WZѿ\MBt!ׁZbdB8D6uC]m#OweVܫpd'cޥ$>,G@@Nԫ*zkqͽPY1Pk#!G'NΎY2hoPuaBc9ĺй}ee .xpc5FyS|//p8fC$M{,͚){ϫM9mePud V~&Zy8Xdَi]Mȕz mǰl+{푉Y_k{^,ojewP-(XBWP#r][;^ Z}^fɓ6*|R_.%)Q~VrtKUSp`GPZ|s luK;\]0ݱE/vtP\mKhp7cVGɏNM;c0.]sg'-Y{m.ΈrW*Zyk;k?/ݫEoI{ܶݴ>}V[mמsk5鿥b.r헥ftޯnwi7.}b -v++uWu%9`/ſcYv%5[7M;70~i_)Wol/Qz{v~ӛ?ʣzmZ[ g?pqm[{6۟!_ ?.76cpܥX`pP@+ɖEo0>0Ѿ= oG2=fs{c[:mCh=S;9nPu(S&K[~K SI~!PvX>c'k2"ZAPR= rO2vf~0>(t^q~S%\ӽQ6`2"8=#y< 9u_!I,Ks:;ِD~]å?] '㰁(-;ȗ!o+=7n񜔳ߺЇYl`߮mz^{ǘq)29(t G?۝\>vjk\MU_An,1<: Xy73 gI - thڝ9 Ns<^YHbg7)WpяAd66?u }j\axgoCdxbo-HRv~t>""2v$t5VWu"EZV> !}eA+e2kga mjejPFVsQuXgyTiy=Ńڡ)YZ-$Y,ʑS/0=t=f!!Ϧ=q]R6ϧ8/;6ҨN ጀIΜ|k y |Csk. 7MK87vr27]h|)bv@,壩eJSa2vY\]?M?5ӕ+bEhb{3E,__b54H}V`S<bt5~̵!Mg/y]rB~+}WRTi]gwF* %g.'E)E:w& -j\)IͷjOj.-LiP\^]I#Ɨkq(}mÍ /@u$6)$%wh\aB^/]U̦IeK CJJy*%U"c׍ceZ@f*f¼ҭk]uyBR8qwdD?':Xވ{ǝl*L&_gÃbz"æ:h-u|MM4b/9meP[S{ahm؉]kpGxٴbud~iߴ zI( R.Vᢿ\rKmJ>wEJ):E\ⲫ07Vf - JjӋw!Qfl. \`_++{?<~q/&2DZJ{i1Vӥ~:9,P-wcW' Zh'妶d}TdJDQ2SdTlZiYmT}&[ҡڈ+zK:@sjwgZK"vRl_7. j晚v9?;TZ3`XnD-u[qw8Fp7$nIakׄ{|n;qBWTG]M[z%FsoBNL*[=DXuIg^jɫ]@_ -endstream -endobj -390 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 389 0 R -/Resources 4 0 R -/Annots [ 391 0 R 392 0 R 393 0 R 394 0 R 395 0 R 396 0 R 397 0 R 398 0 R 399 0 R 400 0 R 401 0 R 402 0 R 403 0 R 404 0 R 405 0 R 406 0 R 407 0 R 408 0 R 409 0 R 410 0 R 411 0 R 412 0 R 413 0 R 414 0 R 415 0 R 416 0 R 417 0 R 418 0 R 419 0 R 420 0 R 421 0 R 422 0 R 423 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -391 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-275) ->> -endobj -392 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-276) ->> -endobj -393 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-277) ->> -endobj -394 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-278) ->> -endobj -395 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb9-279) ->> -endobj -396 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-280) ->> -endobj -397 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-281) ->> -endobj -398 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb9-282) ->> -endobj -399 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb9-283) ->> -endobj -400 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb9-284) ->> -endobj -401 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb9-285) ->> -endobj -402 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb9-286) ->> -endobj -403 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-287) ->> -endobj -404 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-288) ->> -endobj -405 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 84.259843 443.811778 177.650223 428.811778 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/installation) ->> ->> -endobj -406 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 415.114756 101.433071 396.364756 ] -/BS << -/W 0 ->> -/Dest (cb10-1) ->> -endobj -407 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 396.167735 99.933071 377.417735 ] -/BS << -/W 0 ->> -/Dest (cb10-2) ->> -endobj -408 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 377.220714 99.933071 358.470714 ] -/BS << -/W 0 ->> -/Dest (cb10-3) ->> -endobj -409 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 358.273692 99.933071 339.523692 ] -/BS << -/W 0 ->> -/Dest (cb10-4) ->> -endobj -410 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 339.326671 99.933071 320.576671 ] -/BS << -/W 0 ->> -/Dest (cb10-5) ->> -endobj -411 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 320.379649 99.933071 301.629649 ] -/BS << -/W 0 ->> -/Dest (cb10-6) ->> -endobj -412 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 301.432628 99.933071 282.682628 ] -/BS << -/W 0 ->> -/Dest (cb10-7) ->> -endobj -413 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 282.485606 99.933071 263.735606 ] -/BS << -/W 0 ->> -/Dest (cb10-8) ->> -endobj -414 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 263.538585 99.933071 244.788585 ] -/BS << -/W 0 ->> -/Dest (cb10-9) ->> -endobj -415 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 244.591563 99.933071 225.841563 ] -/BS << -/W 0 ->> -/Dest (cb10-10) ->> -endobj -416 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 225.644542 99.933071 206.894542 ] -/BS << -/W 0 ->> -/Dest (cb10-11) ->> -endobj -417 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 206.697520 99.933071 187.947520 ] -/BS << -/W 0 ->> -/Dest (cb10-12) ->> -endobj -418 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 187.750499 99.933071 169.000499 ] -/BS << -/W 0 ->> -/Dest (cb10-13) ->> -endobj -419 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 168.803477 99.933071 150.053477 ] -/BS << -/W 0 ->> -/Dest (cb10-14) ->> -endobj -420 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 149.856456 99.933071 131.106456 ] -/BS << -/W 0 ->> -/Dest (cb10-15) ->> -endobj -421 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 130.909434 99.933071 112.159434 ] -/BS << -/W 0 ->> -/Dest (cb10-16) ->> -endobj -422 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 111.962413 99.933071 93.212413 ] -/BS << -/W 0 ->> -/Dest (cb10-17) ->> -endobj -423 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 93.015391 99.933071 74.265391 ] -/BS << -/W 0 ->> -/Dest (cb10-18) ->> -endobj -424 0 obj -<< -/Filter /FlateDecode -/Length 4783 ->> -stream -x]ߋ8~Ͽ"F+)B`eaazjw9jfiɲ.+wQ]V>²-~~p/395)XJ.&_YN&s*J&S/zqwoJޅ?I9%V:RX!| -+:[,EcA󞕠4`P89ڳ -ɱƂ[e&\05w&K5]pcK(i]c0"tHVAi]`&9*P` r ]7e4,( Ӱh$Lְ0aƥ7,֛X)PfҰ0t QTtATq Lz"t5,(1z3kX0MDjJ z3n(@&Ed5,֛lLgfYqf5c`s2^VIXԤ2G5kiLgմ"&JWba 6iG%4}N#D; D91Z^O7 G~]vjc.gtO~OB>Ap?:`IaUR G5yu2!\-n_돓?M5;#\CGH:2YD/jc"2V[I!޳.Ͻo& ?y4"i#KR׉&L'F2 7ƗQ`˄jt/,EE BXvLجhQJΗu$io/b9ziֽQfDW!lS"C]6_2;I,ed.|)ESGif7[ͷ8N6]iwT_Ni&=pI?(&G/j7$vA븠DB4,Q\قkm>upCH<ϡ\$IXo}\s`P;O4(Ss\leǑ6wEG,I6OgP:U»ͳ;33n ݯR]I\0[:-`Ȼ-tgi1tla -󁇾+3y9yA|Q8y4i9aS+\ƌ=>>u#66tӴ.7]sݳŽ<[K?lQwălF^d0*䳍72qYy"#[o֍|>PB.[sLfEzĥc_JE.WncvzJu\95}W]5yN4cԿ"5:ml"h#]afAk0 "C N`NR;͹ \ǽ]v[^FrfE\!iX{َnN'oeSj kള˝LfzW?ve8/)6y)!*<ۘ3(s B鼫J'=_^hzw-e$K0r|;1tM))hmhp[Ox=ul]Pn9ڶQ/>ʦ69hxDH\Y6Y9!aJ>h4;(sӹ:$~n]`ET%)"Gz;Ng\II_}~ݶXVOGE7YnE4(snD)Û_R3yu>n{V~f%wdx,Y NC1f?wH`j/yƟP䓎Nא)g>xqŞj|!m-@:d96ȉE.TO͹Sql7r?vu3?}. kl\G9@h*s e.1v㶻 F7k4,Ǧ%,7sC@rzZ)$+ Kxb.d_oNQ|q:Ȳܒ_or:=+dL#~,mu ؐLٖ`)ԏ>ԻP@:rC?n|ǽmhL&ߴ+؆MGBvy)7yy ג!kܞ>ȾwLx|m qIٲ[E; )U+)LqWˮhRSouϽ)H.0B.i2UWt]_-+}=ʱ6hoמnL t*Mq}.PG-YZю@J[5Z'Jk5SjLw^J-X{:Viz]Yx-Zޝrwv)bɬb/ݨJ۷l{nEE,J 3v2lVL 1QKi:c|Hܥ4y;DZdGa&'= -F9gtU%drKuY`28ӗOߜiI]s$AoI֩))e>~A -endstream -endobj -425 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 424 0 R -/Resources 4 0 R -/Annots [ 426 0 R 427 0 R 428 0 R 429 0 R 430 0 R 431 0 R 432 0 R 433 0 R 434 0 R 435 0 R 436 0 R 437 0 R 438 0 R 439 0 R 440 0 R 441 0 R 442 0 R 443 0 R 444 0 R 445 0 R 446 0 R 447 0 R 448 0 R 449 0 R 450 0 R 451 0 R 452 0 R 453 0 R 454 0 R 455 0 R 456 0 R 457 0 R 458 0 R 459 0 R 460 0 R 461 0 R 462 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -426 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb10-19) ->> -endobj -427 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb10-20) ->> -endobj -428 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb10-21) ->> -endobj -429 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb10-22) ->> -endobj -430 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb10-23) ->> -endobj -431 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb10-24) ->> -endobj -432 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb10-25) ->> -endobj -433 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb10-26) ->> -endobj -434 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb10-27) ->> -endobj -435 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb10-28) ->> -endobj -436 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb10-29) ->> -endobj -437 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb10-30) ->> -endobj -438 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb10-31) ->> -endobj -439 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb10-32) ->> -endobj -440 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb10-33) ->> -endobj -441 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb10-34) ->> -endobj -442 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb10-35) ->> -endobj -443 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb10-36) ->> -endobj -444 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb10-37) ->> -endobj -445 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb10-38) ->> -endobj -446 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb10-39) ->> -endobj -447 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb10-40) ->> -endobj -448 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb10-41) ->> -endobj -449 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb10-42) ->> -endobj -450 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb10-43) ->> -endobj -451 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb10-44) ->> -endobj -452 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb10-45) ->> -endobj -453 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb10-46) ->> -endobj -454 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb10-47) ->> -endobj -455 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb10-48) ->> -endobj -456 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb10-49) ->> -endobj -457 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb10-50) ->> -endobj -458 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb10-51) ->> -endobj -459 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb10-52) ->> -endobj -460 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb10-53) ->> -endobj -461 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb10-54) ->> -endobj -462 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb10-55) ->> -endobj -463 0 obj -<< -/Filter /FlateDecode -/Length 4628 ->> -stream -x]ߋ$ ~￢g[/8,I`N6!.yȿOeZ=Cv..,dD# FH 4`89ec1\ Ia9 9VAL^`":=j'x xNQxʃ,6Z -P2+ٜ-`B&9`0,ц K 5AƏNJ9+&KN}bY| |,6E 0>%ų>YCH_Xdxi@@, ְ4 z G `(ch  z8Y߃Ix%+pʘZK԰ w]T^1.Ǖq^6.ƢaAQ  <װ wSk#ˌVxhjV̬aAh$T԰&RAЏ$A$?H6 x;`'GQuo\O' ~rޔ񷼐Ϗ?ѳsWƇc P79k!gzBce,; -. =#{E@qztF{ڕ蔟g]zl) Už*jFU EvdsA.㙼;6+-(&Zn|>z#UѲmGƋ2M1=L U֏|!9Rnq+"۸R$oŘJ~ckah{{=o,KUHϓD RN;;]>X8]LŒ%G9auʯLH`<,3V8u ˏvpe9Z 9ĘajZIfgdm18jd;Bވӻ 2 w;=$Xttf;u$mnz[9#/J[ (UaeU92L }eQ1#LISh޿Wac,w*ʻzM*m'MVx"2*S#9$.~ o>FOt}iQ0s2X, ΋hvaTVVb |jߨjDܦѧw|HA y~^oRҥK_ -0o]Yy]b%r*ZH!JO& eal5vsuc| ϺቬW'Ir}gmвΥha9`Ks-M佩S&PjDu~85'7gl}B8hgG -= zЃ!et>mM8Gҡ1_*;hw'!,oO8F*/D$SuXtMp\-^)a3-2:k:uwyMz u${?):r웑|^OWLapMXFv6/f>kВsc>{y_sut:|6KTۙ>o rW~TOv+޲ᶶ>eltrT@~wxq/+1 ox>?{?_t)g y|ÊTs[\ 0?y\w(ʫNv6XCݢRכ̩koۮiԝeRVyO;rȸy9y+F}a#n6\vMyɖ2-<+$ `ߘh@gLΥ0:ԗa| gq#3:zC=V2->2Bi:uuՎ9j쮕bҺnt2e )OlSIm oeZNjl3rd2'yz5̏m26%MAHwaw:%|gu!3lVV, cgrnJ,#x\4[dGcI?g9YG4gb.Yfܯ"߯#6dy =ԭ:e1?s27'.R&tmkݺ(8_Oq:gMg8E%ѐF\O*g9.[bWMwjNGJo*zSs_'r7*'0ۉ/l/'92?Hն{f HlKR0vZ)ԯ>ԧV&aݒ-,gCUlXeq!e.wɲb![[rM-tb:שSk ҖRzڻ6uBF dS7=)I!~k+&'P^rSHZn[hJT^(SnЦ>I,C7F,կkr T]#cX/'ف{C~9 VPM'RwFv*]ahV'PUg⸙lg\Fdl6zzlZ")5 R^@n=v]S H5X]FӰ'*[ȡˊP 5]gw!dž/=95;9P|%^&[~,d :"@a!/02hm$[eirirs6ȝ2??N|Hy6 [Wޓ_ȃd؆MGBvy)54?}׼T ג!kܞ>ȾwLxxb d>W7þ^R}84Cri -2/jF}OtחtSK{Q79XB ^]6QRm.FVVG4[i펩j['j/S,Կ=zN VMYox-Zޜtv)bɬb_Qy)Iv6ۮ=/%2KpS]s-J՟ig8jvdL#0+$ݔƛ>q;Q8D69j/`}Fwj^Hoe -g9{33'reTQIЛπ$)iy5}2 b -endstream -endobj -464 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 463 0 R -/Resources 4 0 R -/Annots [ 465 0 R 466 0 R 467 0 R 468 0 R 469 0 R 470 0 R 471 0 R 472 0 R 473 0 R 474 0 R 475 0 R 476 0 R 477 0 R 478 0 R 479 0 R 480 0 R 481 0 R 482 0 R 483 0 R 484 0 R 485 0 R 486 0 R 487 0 R 488 0 R 489 0 R 490 0 R 491 0 R 492 0 R 493 0 R 494 0 R 495 0 R 496 0 R 497 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -465 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb10-56) ->> -endobj -466 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb10-57) ->> -endobj -467 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb10-58) ->> -endobj -468 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb10-59) ->> -endobj -469 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb10-60) ->> -endobj -470 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb10-61) ->> -endobj -471 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb10-62) ->> -endobj -472 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb10-63) ->> -endobj -473 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb10-64) ->> -endobj -474 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb10-65) ->> -endobj -475 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb10-66) ->> -endobj -476 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb10-67) ->> -endobj -477 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb10-68) ->> -endobj -478 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb10-69) ->> -endobj -479 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb10-70) ->> -endobj -480 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb10-71) ->> -endobj -481 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb10-72) ->> -endobj -482 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb10-73) ->> -endobj -483 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb10-74) ->> -endobj -484 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb10-75) ->> -endobj -485 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb10-76) ->> -endobj -486 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb10-77) ->> -endobj -487 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb10-78) ->> -endobj -488 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb10-79) ->> -endobj -489 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb10-80) ->> -endobj -490 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb10-81) ->> -endobj -491 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb10-82) ->> -endobj -492 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb10-83) ->> -endobj -493 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb10-84) ->> -endobj -494 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb10-85) ->> -endobj -495 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb10-86) ->> -endobj -496 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb10-87) ->> -endobj -497 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb10-88) ->> -endobj -498 0 obj -<< -/Filter /FlateDecode -/Length 5118 ->> -stream -x]ߋ庑~?y\G?JR }XX >IX.!~dٮӖ{z ;LK*,}Jm{5Lv`)巋R03XP͑W4\ [՟/-u 9Gg_8%"cR Q)v%Ѷ( "AαR0S~[aK"asHJ5:c2bSl":=jejYBMN+~lZYb2-!,` yNZY->zke 8NV]ʲBf",pm3aʬ2( RLJ-фTи{k\h\AdոoبqLqzqJYN DqzqzFzM ok\@]oMҸFNF 1 ؐu .@-K׸.4 u8 E ch - z8[@ߣy p!,Ѹ wmS4jkç&2o˃1k\pT^}i\Ske]Ѹ w7 "иmU`2 Zr $jY$qx0C5.]qAkaZ[<; נ VVZxXV5&e "xWܦ10p@4.LCN)j\AB>,8$Aeei\z>  "EpQ-5. 4.H!"Cje @j& Rj\\j`Lz @K YҸ e؂q\Vfa l Z Dcdh\\]<5.`` Se4qGq$Hs2i\$d a3N`SͤqA6Ad @(3Fl# 0/%d 77)6(fҸ l Q2؂)+|줕E2i\c|5.@|$o&u2I+"2&"[-7 ސ,'+[%JꚁJ.LdUUZ./1p}]C$1-}9jAz|ݸRVZS:q F aktĈg#-hqZt#nb&b"v)X uV_C)o0ݮ -7Ty Kѐ|vz -*ۧ }6vÛ:י_/OO. ?ޟ}DNMMi4RO,rsypO;=1AY~kZ؏p݌l\>WG`.>Gߏc@b49 #6x5sCi)Y%"ۦ?V>1V25E=2 T, -Yrvةs4"KBqǥ'~)X,V1*'l -g}iwm0p*֣;-\e4vGO ȶuԱA'K4)+cB;uPdގ3ɗK#>O\t ʑvض}1 +=W=;m$Glښ42 >1-H .X"9j3YqBӀ4@Jخʍ5r}+7P籛gIg#,ڧs:YB9} xFk7~(ܶs$j :'ZT(J -z n:灢<ڝ /_G|rHP\ ;odݕƲP2xt-7=ht.Y攣q+hg֣G%``4ؽ9p'#t[ #߬c5p&&ں!MҴ{"q$k8bFIv!ݧsH3!4b D -捛,p>` piȑRִ{.$0+o&:灱C;:e?zfɶI(5{z9xztHAn" E2J{Dnvq#Ӂm[Gҁv7n$r_}|fكbyaD]9m&v@ ?1ysC͙f@V{Ml@:̲ŒDf}:hYٲё^y@l} bJ!FDzEKv[D{*:u1tC8HEݪR$͎n{ңEy¦h$ ;u3n5F?㇧&jb -7ERE}YڛT݋[,~l-~(=H s'=N@Xv -~z=vWSS2pSm޷->-ko,ܟufЃu#-[߶mY6j?-9Mq:灤]$ӿ6ݩsfyG kK#>~mzkϑߵiސC@6OcPi -m0?r?ʊ!Q܃ײIuĉ+Vg|O8-vuR.pwV<MgA=\tg oШb`G7_Mނ8]iD3G)?$Ͽ|r٪z$*(Yĝz%$0D&S=r_~d$3Nui5Tꄦx-č|yݿ]] ;~1ϲ 1_ʷ4xԽv{}9~2ZKȇdTq`~Xp\0ofv"_#EPuE8jdSJv!k0\OCՅr5|Ag(G{ÊnrsXȃb5%b3 ;pV[oa -M,CXMo6_ KYʷʩJۊ7F* f㤈nE) 7&_ j\)E7-ԑJϪl uϵG4g`9b|u)2e 7q"}lϗa - -Zo[lfR" S{!*B -XoGs#27xITm0_ѱZ,,h6g@ -xQ\fke'y:O2.n z+#l#{' B_p~ܙrBz2z-wkEXM#t,<  Տ;5f&RVu7=^VXa}8yi|:Xrps]9%QJQA{R6 ٲȶb?Cᥭ #e4E6^ES!om {_={'c"^ϭ^H+R?a9~|'KssfSc-hqb6UmTdFt)zTlZYTcYC;*C;*qSW[<^| B 4_kXYl暾ȶmӲmelH#S3MWk]gZ* '&/$!$rM͒a8+em 1&Y (ͩjrI:@Y™ilVpzϴS!]5d3.'v -endstream -endobj -499 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 498 0 R -/Resources 4 0 R -/Annots [ 500 0 R 501 0 R 502 0 R 503 0 R 504 0 R 505 0 R 506 0 R 507 0 R 508 0 R 509 0 R 510 0 R 511 0 R 512 0 R 513 0 R 514 0 R 515 0 R 516 0 R 517 0 R 518 0 R 519 0 R 520 0 R 521 0 R 522 0 R 523 0 R 524 0 R 525 0 R 526 0 R 527 0 R 528 0 R 529 0 R 530 0 R 531 0 R 532 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -500 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb10-89) ->> -endobj -501 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb10-90) ->> -endobj -502 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb10-91) ->> -endobj -503 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb10-92) ->> -endobj -504 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb10-93) ->> -endobj -505 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb10-94) ->> -endobj -506 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb10-95) ->> -endobj -507 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb10-96) ->> -endobj -508 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb10-97) ->> -endobj -509 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb10-98) ->> -endobj -510 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb10-99) ->> -endobj -511 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb10-100) ->> -endobj -512 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb10-101) ->> -endobj -513 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb10-102) ->> -endobj -514 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb10-103) ->> -endobj -515 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb10-104) ->> -endobj -516 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb10-105) ->> -endobj -517 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb10-106) ->> -endobj -518 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb10-107) ->> -endobj -519 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb10-108) ->> -endobj -520 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb10-109) ->> -endobj -521 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb10-110) ->> -endobj -522 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb10-111) ->> -endobj -523 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb10-112) ->> -endobj -524 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb10-113) ->> -endobj -525 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb10-114) ->> -endobj -526 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb10-115) ->> -endobj -527 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb10-116) ->> -endobj -528 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb10-117) ->> -endobj -529 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb10-118) ->> -endobj -530 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb10-119) ->> -endobj -531 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb10-120) ->> -endobj -532 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb10-121) ->> -endobj -533 0 obj -<< -/Filter /FlateDecode -/Length 5065 ->> -stream -x][,~_Qφu Â1p]8CcB[fFUfxJ.!EI6W ~$2*]o?]~hƿcPwW)*orH'b6?6sus*`G&S1Ũ@ i*F@ -F9K$#Yړ"ؠDdmH l8IlhH" }HFci`D9+ЌW$5*lHh%s*D2HB>I4/>k#X `Q -8#%, s() Xr&9 댎pJX*alJZڤI ҢtpztA]뵕l?Z/+a=hIXʔ["a 'i2) OQ JH‚1D Vi 4%,LJK IX3xTH% \'[x#aAޠ&DAKX XC-Hs$,H` R4`KX&^' Rn& R/V[ oF /$,:(v%,$ě$,x3IXFO7" ,[`MD f fnMx@x3]L 4HXěl^x}&GI\1Ѐ^*.h`/U 4c$ql"LA\5Yhq@էy*@"lfɌiA{1;ٖR־ Q\R!8<,s ~ 3`3 S sY ggv)w$^c] S4~V@.-% " -M/qap~/?zv|_>0C^TCoFL7&7|׏|OSVw<> -*)%q4u\QK8h67/1rhy7=s,>2#Z C c?ް xiPLKYB^F0V9RY F!6C&f+>{7sG߄l%̒Փ7"Q!#X\QOpTUE@/Sk6*g՝\V˒ۤ$)}$x}<P( Q*}bB|Eu:T`M9*)T\Q'ܱ6tb*:/4`]j&IcCmp2l>2#z !Yx 7B4RTAWqV<[KՔn=F~Ym\y[d7n]80zs&je,e/>crʿ,~.rdž(dQn[{pܫF~Mn!RWn~ =5!(ftLw/8o\QD -2wFMaRWET#oU`\XOw[T">۴ɝm/}&yWjLQNi[޳Xd?|ӴZƞ_~g^*\TMaQǚ3|fakkuҦ зjK/-)sOZ.{Xݵsaja%` pZe>bSG &ٗcmdždmwPTGAgik%_))yB4f4?%_i'g~1O񻍾OK_ N}nE?ƠF峭9Ʈ<_&nȍ"=o%-`켖t+GZ˩gʓM啗͗HF{csjҐ /To½N}i[ n}{8ӵ;/Xc;?ЏI?(Sǫɂ^Gzim\W5uKÇq۔+1s[<\EL&{9s+,Z7>̞em1gm[yɽ:YF3|}0'C>^rۆvO2Xw4Kф6 =Z.I0|S2#>m')^_Wu^J.;LD}Me 5al+`VsEG19F&z>o8$ny MBwیseFI1H䣽#u#_;(ϯ7> Yޝ/>Y,<" N>x*l\m皙G/ȯ]'QCVLy[hΕyx0 *Esf .N.cO6w_޷Ӿ%yI7%|/KKBy>i7ר\Jںu*IH^S[fmXܴs1{h7 _db;XLsegJKV|cүпlDpֽ}WIIw[Wݨ_eIo Os[n('oQ'-sjg_ -5xDTeB;" lH6dYd|:M'kܜ69e\t2O#ް(Mރ:LTR/]'ג2>yt|Eq`)WGx=Jm%8 r Ew76[nϗшt9&7ڶkhgMcp| B,S.E{q&SxF⨐漣Q0[F'꩹̷#]HCg&pͺmꛘʗZT.'!vӭj0;})|n1_wIŞ+`e:Ә iHb9dhiK].⣐оޜz{rC_F*:T-/ TS>*ŗ͞9=t!i őw.cyLB~ݞ*u)=TuZדtuc͍dUm<}z fRwɡcۜ N:oŰ6U?FF2X5M1H0Vlį[cIv9e/58ޑsŎ[vl]%ϖO'ا͔hil6t;n4-j:uNc dU7xیbwd~l^]C׮P0wi0שJ~Jzޒ9鑳IH sJ#kiivש4 3գ}d,e6RUV0LwPκt -B||4-i5JF[[89?%B>&LU?%Z@X0w+8/_]鏑CE?|3%{QqI^W6/ -endstream -endobj -534 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 533 0 R -/Resources 4 0 R -/Annots [ 535 0 R 536 0 R 537 0 R 538 0 R 539 0 R 540 0 R 541 0 R 542 0 R 543 0 R 544 0 R 545 0 R 546 0 R 547 0 R 548 0 R 549 0 R 550 0 R 551 0 R 552 0 R 553 0 R 554 0 R 555 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -535 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb10-122) ->> -endobj -536 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb10-123) ->> -endobj -537 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb10-124) ->> -endobj -538 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb10-125) ->> -endobj -539 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb10-126) ->> -endobj -540 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb10-127) ->> -endobj -541 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb10-128) ->> -endobj -542 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb10-129) ->> -endobj -543 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 329.565778 101.433071 310.815778 ] -/BS << -/W 0 ->> -/Dest (cb11-1) ->> -endobj -544 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 310.618756 99.933071 291.868756 ] -/BS << -/W 0 ->> -/Dest (cb11-2) ->> -endobj -545 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 291.671735 99.933071 272.921735 ] -/BS << -/W 0 ->> -/Dest (cb11-3) ->> -endobj -546 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 272.724714 99.933071 253.974714 ] -/BS << -/W 0 ->> -/Dest (cb11-4) ->> -endobj -547 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 253.777692 99.933071 235.027692 ] -/BS << -/W 0 ->> -/Dest (cb11-5) ->> -endobj -548 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 234.830671 99.933071 216.080671 ] -/BS << -/W 0 ->> -/Dest (cb11-6) ->> -endobj -549 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 215.883649 99.933071 197.133649 ] -/BS << -/W 0 ->> -/Dest (cb11-7) ->> -endobj -550 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 196.936628 99.933071 178.186628 ] -/BS << -/W 0 ->> -/Dest (cb11-8) ->> -endobj -551 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 177.989606 99.933071 159.239606 ] -/BS << -/W 0 ->> -/Dest (cb11-9) ->> -endobj -552 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 159.042585 99.933071 140.292585 ] -/BS << -/W 0 ->> -/Dest (cb11-10) ->> -endobj -553 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 140.095563 99.933071 121.345563 ] -/BS << -/W 0 ->> -/Dest (cb11-11) ->> -endobj -554 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 121.148542 99.933071 102.398542 ] -/BS << -/W 0 ->> -/Dest (cb11-12) ->> -endobj -555 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 102.201520 99.933071 83.451520 ] -/BS << -/W 0 ->> -/Dest (cb11-13) ->> -endobj -556 0 obj -<< -/Filter /FlateDecode -/Length 4901 ->> -stream -x]]$IѾ_¦_ 00xqףYa¿ՕUU}ۊ3tWD~DeD>l+2;sIϗO?Iϔb0)d+1BdR > ooH0p湁>Xaw=a  w!A V{ ɂY*pb XB%kXcK5[gf 2G#&i)UdLhX`;hXH֡dΪȀsl*af*ͤJxjŀ6 ?!*dـ+~u,!)*8+"/~ `E_}:꯳qq=O~z=}ZBorw>Og~('%_nc$bEqAs:|/#yߞ~i #Y?l&/yUfDNfXJcFyN}HH֙\zHJ煎eySIx }j>vFjqa_2ZT6Ŧ Ͳ,@d 'MlvoxYFK=dwazwÈoV1vϲyh{.T{y#H=;qTZ@$bt{]*ZJv @A]W68l{6醟ʢ)h y4VY9ϠGe,fnl׆T ,l]psT[O9e=eW @zkdZk .1(:Xݷ~ە(-<^NC|}FLI Ji^jz7V>,t8FI9+5ɻHIS 546sY -4fZ5}}Y??헫"+24Y0wI͟AIfH0}u$ߥ<ޥ;{4_r[~>iThB?MRr0m{os;ww`LRng<<0\;|wckgQhqI\}8]^Riq6{/>A&jos$9{(bxv0atƙI-jBƎ꜓cCѥ0g8m7ԋ!є_4V~Ypeik\60-A+Atr;8yT4ϱ8gg\䦓Dyw <ϣ\ї݇RoE4q;y)oN?Y)YRzhȝ4ſm[ǽmh.ȣ'Cغ@<~'ӆj ͏{?5{M@teeՊ-Hd/V0sQwHy{ h{Ԃ5zhFja+mQiu .@JLU8g2qV[)S2t1ZRnx-ZќS;SX2+8nT)Ҷumkp$la]sͳ-Rտ 6j8jv> -endobj -558 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb11-14) ->> -endobj -559 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb11-15) ->> -endobj -560 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb11-16) ->> -endobj -561 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb11-17) ->> -endobj -562 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb11-18) ->> -endobj -563 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb11-19) ->> -endobj -564 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb11-20) ->> -endobj -565 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb11-21) ->> -endobj -566 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb11-22) ->> -endobj -567 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb11-23) ->> -endobj -568 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb11-24) ->> -endobj -569 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb11-25) ->> -endobj -570 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb11-26) ->> -endobj -571 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 444.418756 101.433071 425.668756 ] -/BS << -/W 0 ->> -/Dest (cb12-1) ->> -endobj -572 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 425.471735 99.933071 406.721735 ] -/BS << -/W 0 ->> -/Dest (cb12-2) ->> -endobj -573 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 406.524714 99.933071 387.774714 ] -/BS << -/W 0 ->> -/Dest (cb12-3) ->> -endobj -574 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 387.577692 99.933071 368.827692 ] -/BS << -/W 0 ->> -/Dest (cb12-4) ->> -endobj -575 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 368.630671 99.933071 349.880671 ] -/BS << -/W 0 ->> -/Dest (cb12-5) ->> -endobj -576 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 349.683649 99.933071 330.933649 ] -/BS << -/W 0 ->> -/Dest (cb12-6) ->> -endobj -577 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 330.736628 99.933071 311.986628 ] -/BS << -/W 0 ->> -/Dest (cb12-7) ->> -endobj -578 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 311.789606 99.933071 293.039606 ] -/BS << -/W 0 ->> -/Dest (cb12-8) ->> -endobj -579 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 292.842585 99.933071 274.092585 ] -/BS << -/W 0 ->> -/Dest (cb12-9) ->> -endobj -580 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 273.895563 99.933071 255.145563 ] -/BS << -/W 0 ->> -/Dest (cb12-10) ->> -endobj -581 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 254.948542 99.933071 236.198542 ] -/BS << -/W 0 ->> -/Dest (cb12-11) ->> -endobj -582 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 236.001520 99.933071 217.251520 ] -/BS << -/W 0 ->> -/Dest (cb12-12) ->> -endobj -583 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 217.054499 99.933071 198.304499 ] -/BS << -/W 0 ->> -/Dest (cb12-13) ->> -endobj -584 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 198.107477 99.933071 179.357477 ] -/BS << -/W 0 ->> -/Dest (cb12-14) ->> -endobj -585 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 179.160456 99.933071 160.410456 ] -/BS << -/W 0 ->> -/Dest (cb12-15) ->> -endobj -586 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 160.213434 99.933071 141.463434 ] -/BS << -/W 0 ->> -/Dest (cb12-16) ->> -endobj -587 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 141.266413 99.933071 122.516413 ] -/BS << -/W 0 ->> -/Dest (cb12-17) ->> -endobj -588 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 122.319391 99.933071 103.569391 ] -/BS << -/W 0 ->> -/Dest (cb12-18) ->> -endobj -589 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 103.372370 99.933071 84.622370 ] -/BS << -/W 0 ->> -/Dest (cb12-19) ->> -endobj -590 0 obj -<< -/Filter /FlateDecode -/Length 3157 ->> -stream -x͛[% ϧ8a`00$kfvWKήװ;̞n.*կ:=|%|*Z[z}|B$¿fSߒLZBk7PZ%_.t5rtGSRKTR -ĔUGlST4꽪 m5y*1VGUahaW5 RqTL#!*q -=]kDO'rQNZ9FlIJ2l,`KE<]-]-` ebO$VU]]jH)*B9$:(LR..–L:ؒآtDRZn!aO`KE]l{Pqc@,%hA V Zz-E< ĖV<1t=#0lQ\W[<@@[x,Vo8{,fqfX @.\y,0WNbJc5{,pWc"` cx,PpWwjfk% -J@Xc1܍wrpI~8[XcAwas4h \1}.qgb<$px,H.Y=;jX]ԞcAw7$p<` Lp]WZ=$pX  + @C=dp{X]J" 2Kcl5`5P)<Kt.Qi 2kۦǂ\LGjhdt\]O -A,W[֡I J-ǂa BBcDnz[.n~,Ԧ걠| r ׮BcA)Rb{,K `t J-X* {:-= ҅cAѠǂ+L C#P{:%3ǂ9X&H` 0cvX&W[$ǂZcA%RXߴ|x,h[y,h q<47z,|z,hB79I|x,h -[BW[45g݂I7A'OaKl걠lfX0&"zHZYp75ӁL DdWV8{b@@o؋ݪgZLd5Vdr EGTPgbٰ,9f1y|ן._{鿗wNE%ɖHln*l+B5 a1#JF2؊ݶɰlf3ۓ/2TIm:Vb!}@Lv+rs1#|KёEc'^C?=\o'vbp#]_~>DWl?ɼg'z~;Z{Zg^~s/zi/GF??7>|{q+B> ep {ʼn]Oc"C6<rHd7ڲ$'WXO(Ü)s_nTS?u7熯pEk9> ;YZsz_"¤rضXE]/laUb9d>m;N(sЈX]?4B RȨs@JJOz^='RctxZ- G9V~9{}>WyS|Rg ,RH[CΗžIpCcm c$ɎrtC'أrr9֞ Q6K^vb m38Nº~88ɽJpptùtѝm|ζsr߾ŮlAUqV8~D loS9d$'(>mutӶ7wK"%a(%&Ot?gkO"TT7 aT3.Z#>n}^a'8ۻbiX[Blgtp|L -endstream -endobj -591 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 590 0 R -/Resources 4 0 R -/Annots [ 592 0 R 593 0 R 594 0 R 595 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -592 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb12-20) ->> -endobj -593 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb12-21) ->> -endobj -594 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb12-22) ->> -endobj -595 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb12-23) ->> -endobj -596 0 obj -<< -/Title (Hardening Guide with CIS v1.6 Benchmark) -/Dest [ 6 0 R /XYZ 85.009843 502.818898 0 ] -/Count 14 -/First 597 0 R -/Last 608 0 R -/Parent 611 0 R ->> -endobj -597 0 obj -<< -/Title (Overview) -/Dest [ 30 0 R /XYZ 84.259843 272.631496 0 ] -/Count 1 -/First 598 0 R -/Last 598 0 R -/Parent 596 0 R -/Next 599 0 R ->> -endobj -598 0 obj -<< -/Title (Known Issues) -/Dest [ 45 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Parent 597 0 R ->> -endobj -599 0 obj -<< -/Title (Configure Kernel Runtime Parameters) -/Dest [ 45 0 R /XYZ 84.259843 539.222079 0 ] -/Count 0 -/Prev 597 0 R -/Parent 596 0 R -/Next 600 0 R ->> -endobj -600 0 obj -<< -/Title (Configure etcd user and group) -/Dest [ 45 0 R /XYZ 84.259843 283.686971 0 ] -/Count 1 -/Prev 599 0 R -/First 601 0 R -/Last 601 0 R -/Parent 596 0 R -/Next 602 0 R ->> -endobj -601 0 obj -<< -/Title (Create etcd user and group) -/Dest [ 45 0 R /XYZ 84.259843 169.788971 0 ] -/Count 0 -/Parent 600 0 R ->> -endobj -602 0 obj -<< -/Title (Configure default Service Account) -/Dest [ 53 0 R /XYZ 84.259843 561.590928 0 ] -/Count 1 -/Prev 600 0 R -/First 603 0 R -/Last 603 0 R -/Parent 596 0 R -/Next 604 0 R ->> -endobj -603 0 obj -<< -/Title (Set automountServiceAccountToken to false for default service accounts) -/Dest [ 53 0 R /XYZ 84.259843 522.092928 0 ] -/Count 0 -/Parent 602 0 R ->> -endobj -604 0 obj -<< -/Title (Configure Network Policy) -/Dest [ 67 0 R /XYZ 84.259843 599.840928 0 ] -/Count 1 -/Prev 602 0 R -/First 605 0 R -/Last 605 0 R -/Parent 596 0 R -/Next 606 0 R ->> -endobj -605 0 obj -<< -/Title (Ensure that all Namespaces have Network Policies defined) -/Dest [ 67 0 R /XYZ 84.259843 564.092928 0 ] -/Count 0 -/Parent 604 0 R ->> -endobj -606 0 obj -<< -/Title (Reference Hardened RKE cluster.yml Configuration) -/Dest [ 77 0 R /XYZ 84.259843 191.441066 0 ] -/Count 0 -/Prev 604 0 R -/Parent 596 0 R -/Next 607 0 R ->> -endobj -607 0 obj -<< -/Title (Reference Hardened RKE Template Configuration) -/Dest [ 390 0 R /XYZ 84.259843 518.211778 0 ] -/Count 0 -/Prev 606 0 R -/Parent 596 0 R -/Next 608 0 R ->> -endobj -608 0 obj -<< -/Title (Reference Hardened cloud-config Configuration) -/Dest [ 534 0 R /XYZ 84.259843 537.158799 0 ] -/Count 2 -/Prev 607 0 R -/First 609 0 R -/Last 610 0 R -/Parent 596 0 R ->> -endobj -609 0 obj -<< -/Title (Reference Hardened cloud-config for SUSE Linux Enterprise Server 15 \(SLES 15\) and openSUSE Leap 15) -/Dest [ 534 0 R /XYZ 84.259843 397.010799 0 ] -/Count 0 -/Parent 608 0 R -/Next 610 0 R ->> -endobj -610 0 obj -<< -/Title (Reference Hardened cloud-config for Red Hat Enterprise Linux 8 \(RHEL 8\) and Ubuntu 20.04 LTS) -/Dest [ 557 0 R /XYZ 84.259843 511.863778 0 ] -/Count 0 -/Prev 609 0 R -/Parent 608 0 R ->> -endobj -611 0 obj -<< -/Count 15 -/First 596 0 R -/Last 596 0 R ->> -endobj -612 0 obj -<< -/Length1 9900 -/Filter /FlateDecode -/Length 6559 ->> -stream -x:{\UU^py? 8Tt|:)HZj ->2%S35#sdy5Ԛ;cnh6ך{0m{݋z|[{}lU2$g>6g694<4mH+?uh/@/бL= GfLMZNCc{'W`^ꏟ67g=iop~8 I0E/>w^]R*E}97DnGgfe熝߾3hzRI|GϘ;'H͙S8-;zs+WK&d͋~q0]**,!L=|Qq^@÷Ԕ d'MpG}}a*h׷Uj?xC⤮ -_0WP}QcL8@/ 6];':fꆶ?/9hYATeI ES8\v5 X'mڬ|;!UO]6O#&ׁowQ)N;$ GP? -1 -U0@MNo i}!c!`&̆BXԦisv0 gt mmmW^[:bP:=<3zB;#zQ7f:޶ rXǃЭO={̘^:$됬4;Zi|H>mZ7<.|ڌlOE xʖ7'xrOmNO7G"wo w7ŊM7~ԃ7jz 65o_kHkzYoT~r5Rr (xP~y)^/ -] -|_{/ssn"xzƷE o |SqolxLQ;Wy@c+)1ȷs[l@b&$pc(iQu nXoz+>ی]3=k5ϸ)#?Ƨ^Ջ>El> V4*'4c% TbI+\Ire=m^Zҥ$K3]ԍ \,1+.B.8K5cBDl8S8: -&0G`jƩ"pI'N08Lc 28q?>Z`!p#6>J#6|XH)ppC|pkpH |Hj*'?ȗA} O/S__ľf׆fI>x' -ό <{WO#eÞF쑈<>9xw79[w{c6_t1Z`H_ >#aJ,b5cH@]r1$ ПKS@8ډW`-E\ -sYɆF* NTrQI,4K=2/]4p5’ 稜#̣Z 4rcURO 7"AV9+I4 -pKpe!‘œ,@$5<%9K.aIN)9 aePp$ld+|p/|NhY9*vi'+2TC#gB/m"Qw= a0._{x32:| @@ 23ir:{z es&TEhN&e=E -9J#5,XChk|xJ]Z$ge!okў1\^؈lVl\0{z`XJ\0ZpBO5IWǿ[O5i{iu7|֚(92N9ӅYĎ}_Fe2$۩,_Wh* %U/ nCalJʥGIBtnJE!rTy &x\Vj5aJ0B3.͜PON#It)r/Ҕ~vNG"!6wو{aa͗Rη\C6chSJm.[*r]j%aAn"VS}`kh#%$d xA>)C)l -T\Nľ}b+&&*R¾}儨p "_ڹrt3=E߁gʸh7X z9xt ǎ㨴#"_cO, -ղX& -vLDBXxU^ U/05؟2BC [HMĤFJAHF,#t4D˩"zϿ(Xu6$_k._RKܼtUWHyEzj3ܦw> 5]層@^:`}uWC$8m]5t}#oPXDiRd~.E#VmY`ٵYחW㬂s.?:UWę^6mg }hUHbT:^pU[שC%mD[Kc˩;ԉK7)) n{Dr];T>)KZC,`ge!3?昽2[l8el?<%*~'sk>tmZ-"&ŀliWl"tP#5fB-I(ξ+w[#[Jҙhn^GUICG>;Φyާ/$pY|  ;a%|J$XgEаP(LRXX`94Lv1pХ.W7)[dȠ@kOC3SM-Mmj4:5;#z"Dƀp#"cb;|366&&OtR<^_ >f}S^TJCe|_޿Kº|k퍲Ig 3rRoW WX Us!1jBtZ 2)-$$&%'D$DzB<0O'["2222bE؛K;u. - - -ϊ( -- -+ -/(-+/rOKgJ&$IM"AbH™tOnzSV?zI/m:w|ҿߔKsJ{'vlU^{cc[4v!llYi^-8|`s `nؾ1قʃqv:AdG0kx3Ȯ)'S퐓_pj|h6 4HTɓ' {փYV/ۈ2P<$tvTyCSMS7gֆ<:&m< LxmɹsK^k=ҳ/ai6fiL-\];G7tUFrByŌJzz ;֥ᵬrIKwHN)rv\OԐڐ߆ ᩐRTWja60B!+ -]A)4Gߑ,3B7e--:3-qŵ| ^i-Vig9нLx6'1^D<3btTb}L7XFא@P-C#|HTO5 ^\8J!w/^]~!&w$ ]vP+Dsѣ͡Kkiyot;}Ι>Z|& - }G7ޜ<- `d6 g^͒K6}ݢY-( xώJ[o?S*]?Mܣq?x -vb&q큒 -(%7)`ĸ t'gYYʜ ]Fha,T**riSRh$+vUqr ltHgq·)u3|.Kqe`UXE1BQڂM|ԩomS(GMeSO_5Y-v-Ih< $da_{q -78Ǚ&ifb7NSU&8 A,Mt)$2YgϜ<ΡU~Zen&W6B>ڰh? ~RwMMm\y)4\Mdi2g0H<ߴtJio05H = CdDE6sj6_ʃ 첸͢XFcP3M I0Og) ltKu,`[^orlgiZiJfIڗ>HN ޖ@emk\͡ V!("X 0 N8z&B$jD8 &PBw1A6̅4: -9Ta\%z/yf!չik&~, hlZFYn<, icWd&$pZ_Hgs?3VRB;̦Qm-1%ItܽsMyh?yIڗ6RAe6c‡/v*Le;j n;錑tRFA: z-yT/.˧R{zqlX>#`flX>'0\͞?F -gυ -r~~tghϻegdڠ\8 _nw_}6=g(Jx k]8tWYڍ4 P -endstream -endobj -613 0 obj -<< -/Length1 6944 -/Filter /FlateDecode -/Length 4153 ->> -stream -xYyxSו>Y2/l%['ɻ,[vWɋŘLiI&MB)kMJ/4!Mffi&I6i:COsmBso=w߽{s9OF!!LEBQmr6+3Ij]ޘ-ΑDB'ۚ=M^6(61{`(Gii՗`G.Cu*OY&OgZ}O ^FJ9:.,,xB {A9ZT^n2!DqGP@軁sJ|e< eB_0 -R }6kG~3i,BD1z@4BOLj5Κ}u^ߛ>(P Zϯ:XHbIJ!Ch Y&(1HJQـ,=?.rQ#@<* /=/t -xzgCd%!Gc(Don1X̯x҉I1}A,!Ў?QDQo&)h!B oQafJ4c&:8vZAaDB-`Xg-JdbTFWF|Qdl"O -:v[WZ]j ܇)tGd܀S6aIΜ~>Wp_svSF&fpLiaN⭷`gOCYP$QRY#$b%o_{]o΍cOxϼv:L)̬ϔ5ajQ0q%zzgu}{8Q-g('?ۛmCj6ď'nhViXe8B(+ˣd˄(9-th&r¦Ic8YP(dZz{p/> 1 &dЛ$dk<*F֑Vj!lS. j6TwMS 1bQ0 )DZr4BT,U?Hc`c*cͭ# [}j\[wcp=COP|@HWT˫@ԬF3O?bhdMvU"hij,uvQiKq!AKj.UOKݒa˳LZ~ǐJr͇R՘ e2Lkp]WSSn|;N^t02[ ~ KŚi*% Òj-ASھ}QUSWT\\. -+/ףwe:uuezFyhɧr,,&1S/*#%E`/*ě׺I&b;=(. >3tGqOGc2kVQ Cw;4Xj)}Q(<<5HvRwV|,daJ\䌄*MP(uOk{SE7dZؘ_;>uTm,MVh2*u\ZׇM3䧝&/QEQPF{rসgBTW,ZG7d۳6?ܗivN;FGinw_=V]a+͖Jzr -Z -E4'> dy z#+paɴwKGG'/Mnz20~ֈB2X-4tC,̉մMMJ}*=3~t^aQZשRDRR[VgM}Kߢ{M~M^G+驣Hds\F*/}ke27hë~A7>ݜc0lq:9M]#-? e> -D$e'N_w?ػktL= Sn۾o*Vo@ ~0\L%Px -n7&=F<gK;nȄVMk[osc/"s 5+-!~Ҳsv?9yV?뷔nol:@8$BaIZ\ 7&ŽA& 43hq%ekiy4 ac =s{z빣ܱ?9!;Z+b hIe8%}.n"S3S:xWh5|>Bg`kxp݇(rV O:Jqim=*2:[x5e5_`@ EF^,kBVodæ?ܵ ?>}H&eo0R2 Ӈ=KpZ-]x%wLhܙ0*ndk N:h'c=y"LۆP%ō.- yǐvCÖ kv9>'=YYRe( r+Jdg㒗- -c@ؤ۠Z3GƷϹ^KzX@J w`Ӟ72[`<+32+˰B$}X!p}v+ϕ+~:A /0F11n92|xˡ'9)SvN[$44P$?Q7 [Qnrɲ'e,T*,[m[ڤ-9lwJ[SR-xӼfe1=7xљo`&rA`E))ϵƭNv6\>t'dk)25&xOHaq⬠; G T -e3Ml6CB-{%a ?d35kpyK1t۟>扄1Rp֠fsfPpѰĢ|W㐕%ĢF㶲|ðdSTR֓|t3K#~e2յg ˜_)e$g+6]Zm~9G3٨ϏiD7eT䛜rwDI:rg*~3]yQ|6+C@?:|v45@6? ~y!>2'>E~{,|2ZX8jUCR2۹-?l8ѝNHp Jxl]5I~Ĭi@-]vGu9Mw퉺}bVbY_V> rV.9-|_@.@o - -dSS+OSeJwWbr)2uRUyʵD\D^g\.WY.,YU&(F~v/2Rq!"RBfx6fn7\{㼲FZ`,z۞=44.x]X4]K&ISWK%\5@XR,56ex.u\jpI@4ަcl:*ݹdwkr/pDΩۓDק٠!UJRY&{o;}uN_#/ǑX#}8Fbv~|"&8> _.>pY*+2R -_vhjGŊF$s5>l%<F.jfyL&Ve6ޅdR&Jkf|?F dj|ÏV@d }ǐ x._\]Vہ 4/ *ԏQ+jC (/ =PT@Ӎv?tX#?# A}~A12 v%<j@0uA/k!X @\^kkVDFT2 \JJp@A?C;.>:p^yP `;Q09ÏG45oPUp7Fe -endstream -endobj -614 0 obj -<< -/Length1 7204 -/Filter /FlateDecode -/Length 4875 ->> -stream -x9kXUוku}.y\^ jA#H-QV1iK'!CljhjR4k6~Ik-vZ˜~68:1t:c컟k^{`BKKVV>QD -,W@ˊ*.ܱ>꟣gYEY[>br~KcE fl-;=k6qWR۸=;o+|4 چΚ߅~`win*р1+_E]T,XƊ-b"{`*gEKsKs[e֏W--+u^L}j+)a,nfσ"eLEhMt6C@=v@4i)V![ Z^H\DA:$xW ֔z~!6-/3ECNtQ7 !jDo_(* [R8CuIy!RS0/)TaʢCKC-u?hOaaO5ϜW' |e32(9{$D@|&9e)\ᓋ ?߆OqyNc2>_b"?2T[yO>|vᑇh~؏3g@_}? Ypo> c7v -w>/.ˏ_$/Ӎ;i`gvȸC6o3at*tl!hK6 o7=bC7aC@ܶ RgL{Ua-UUXC+Dcd"c]X.U$= i!| K]x7e\u2x v5EVƅEVKի>\U+e\!>\n/L \څK -|I7.2B?.3/c</0<>̛kyGk1wbnsw3 -tJƴTO a!Љ)ja2S,2Qo8{ -&$ &x7OG/UOwcgE:,?zyи'c"<&1Pp;J:1<)Lka6 Sx[t;0tE;yfsZ j\-]hMDF`A=k5F6C PcDC(q( i3b`M%2B GX׎bY,bGe4V&؅ H9<[ bm1 , A%d -&%H>шTU!ׅ-51%8YKo0/˄~# .1=˃J| 8|;$h_7`ކq~? -Ǩįv*QҰΚaֳ*_Ȗ T#մf ]QI*9hpiW!+cDIG0v)\=X 3kIf4MqEԿV&M͔ hoYM(bx]Γ+C)EOM?Y<.\hL"bY1uH*_!\L@/C -X&ƂUY+&F3Zł12bpӹD+K - %H7÷(V(pQɒpס^K/ݏU:j$5z`bH[bHfcD-0wXhPpmr,$/bUڜG6bT7 ,Cdh5,z1 m\e c%$f9VϾ"Io'pD -.(tד%BK`):!lBNjӀjm wM-RSxkRV]R+4YIɑɱk<(1fh:SԜhk 9Y~W-!!ntBC].Chssr|zH}O$jݎ+ ;V -=wtWw,]_`MfNjN6,YeQ^);\U͐-d##t*73!L(o3AUyAɗI,/d$N'>k)1$ zO'AXL(6TPYwqneHA#9:91ʵAZH_F -;:#&Ó{lu젾6Пpp8\nWSH4k͑Y$9Y$a&gΜ,K8{8JΉ^ǵUVf"KjVn| ;~șes'~Hx aUNk]Fȕri5$K yfՁw_-<ўu_]2s٩y/W俑G -0'f:Nj>1T෹ QČ"l0\S0S@`2njBo_V};?#7lԴys.yDE%fn2d˱c6_]88 :[St+%%Gwctf\U M#x-eUN.rԈk.+â>cGRӐ;{6@BVޱk;'.U9!;{ܮcf&;.^re,?IRPSL9kYYNbGxʃe:^UNv?z|4DI<"uL0;4=+ =6 A1+K*k*6si{XuWB0)Fy0|Y,QON juZ.qzzz\@vwc.)r9(Rcf M#M+ɥ{\y9"sY*<Ϻ{ r%ZJke=خk :%YG0I5my2ҾHd^a#^foc'4sZ4l|5P( Qiࡈ0lHw~|6_oɷY/*Y1d(MRtOIє 棂q-XQl9 zDHGysB}n_/,.-/4,4.- Yh_X(cdf.-Φ#, -^ ~I~KaM-x}Y -w5)ߵk*S,o_j yڻn@L2\839cʞf|ETFD|eOޙJN~ve5o+wt3jP إ:'Y9[:WH:nou:&ګӋzCtȜ:#$y'E 1X2j\Y9c c L,3ʼˠ,ɺd}!٘lJ6}3ՕIOtn.FP!$*"ʪ5 |k+޼v#kOCvN"?:7-p1$f:LO7#3fz'Mbŭ!Zt>3W9c{AD‹lܽ|G/ʿG{ѩFzOGZs@6YQt%8nS$Ir [x]Kݩκ~2p"YD5%x%"gTJd)hFzD<㐉> ZFj( hK%.븠(׉$o+Ѷ.vˏ_gq],dMn%ɥē:=X$bd4Qd6h0& -ރ VɨIZh4ꆬ7+YQP=q`\Xǎ%).y=*'"2qQC> -&MXi3P/@ i#̦i-f֙ , ]lNhz:h'IC,jUN;w *^XMNE@C>&6WMu5AeaꡐZ[z0nQU1=V{J-SIt Ci -tU* -UDy1<0׫fuu?psifc?s 7u唄iSwY? 1ޚa b(J )1C<1Zw1,`#uMjzK -,!>DuI'TVTBƖȨm lo"l/3} -endstream -endobj -615 0 obj -<< -/Length1 16324 -/Filter /FlateDecode -/Length 11653 ->> -stream -x{y|TEo-w{;4!d# K a¾*/$@D0M%2bQ1ЀD@ 9:;uo||^ԽUw9uS|OB6 (`Ġ}~8շw|P^ 2ҁK= ڱ}??4cmhv)s>0!#Λ~^ـ"Θ7̹߂{gL^ɰ?@0ck.dDB9s @#\Ϛ ' ^bh9oSGe MousB~88oS ŏp?iQ-Y0 -9 ȯ/|bܓGa&Br$"1E7&Q]R~rd=XpNMEc9y:x=륝r jQ!ObX MWH?AӉ K:~ ާyQ,Z)ٙo+tRmwrsDA@i%[|-q [CPJ܂ r(k -܏,z[h{˃4N@iۧ'PF] ^ K%/G|6x6vD%tVCՠyP_z<57dw]_DPQ@+ -P4 -V޻ǭ Dаىݻ؋{SD:ZOa>EKfE݇3.woh)'Feq_;Z[}zN/*oi8ߧvO_}SgnlpnLM>HVcŞQ؁j$`;bP6dU[mIWFZP#z{UR V{D.hvhgw4֕]Fӟ+O*ğphVZْ MozSߡ?fFO7* ,63\m_zZx^+b#o:~9 -w_0^}?cӍzSd%86A)gG]ѳ(PW3 =IFevqF1GQ;=b o}ۇ۫{ķӷa=*Z_S|:8ݡo^Lӿ>}WѽFk}eI|%1їw[ŗV?/%?2.ӝ/Xĝ }^;}:yFZXNhճ*Fz0}viu<0 0}C+A=&&;ݨp=tgRFוXuX1?X? k]]*Ft1D3$K] .1%y/ tQa. -O08 ]0Ο^?kO2:'ftV:y8L3:bFNqS,$F'2:a^`Xh1z -]dcct+PF`Fdqi06-e h>ab?FBo1-Va'i|F{W'4V_OzzMbO3YB˛g&ǫgЉyWb݁wh7F怀sihV]b4s!v@3h:ܘh\N4j)a.Tt&w 4n;Zbڑ[%$=}|C;\Md4L=mgnFf1Ѹd1n%M1 zv1h6HJd8`40F@Y@Cbh>u-#-4 SGғ8juJC{~pPPx%^(t+h-1xz -W@ *G2 (P)l[Kh9gk*G-h@8@ J;jvP"A(gDBSI&PT/e7m7~ #x~ADp Ok : Fg&Ɏ*e7e$m[G&Zt hNF2L,dA; ̈́~B̓++hO&dZ@3h1Zؒō -k;ArHs퍲h*o$D&'%~0zC#s6H;CS"l{?19J.π,V+ǔugtoV۩^FOO}C>uRvƻ&){syE̳n}`m[a{3uN`r䎤SΙYbZcmIXi0D4->sU٪e#je!;).}9NQ"%Esn@D641yp{֍buB([LAAǘTbb;Q!nJAqa5dd@YYčk(~ڦ}<=_z-躲䅹Yƾ#:F-\Z9}576zq }^ s;뚳;4; % wQ~E]JPHCЕ q-.l0I;s&MBa Jorp&t'ζldڒ֭>vu+ |pc3tʜ - -lzoNnFa';˖ٙq.ٚYKYw\ݤvcE-F=)h5,*o-~QZx\:G{,2@^WK-Ǿpɟc.M'p}CVn~Z']ܓ/`o{ 9rnO)sWIՎW: jw%X\4>Ʈ盭hɡ7 %g*[vooxw޿;60sۅ$|o&;ٹjw/hEbc?cK1V}xLBDdrQi:䲥Lmv6k1')@*&J\~}U/g֮C_^vSWl|f=z,\xwX=laGᯣ>j|ݰUꈐtJR#8k6TXdΠh#+[Hk,̎<=vנ#O46(z0C\Cݽ2>`cz׃Ć%|23KȬi!MvYRmg{ҳ85$Kw=4Ľ[}}RLa[j@1B?/7T)>*ui2 ʸoK[GMO#'y,)maBP֡vސ e0!4$F#Z;ma((uƅGPzHOpeK..FN<,v>tј՝' }Rv5b/w裵O8ni>W }xW\fA,kÛws I#P*X4Ԁ5*TRCr{3Ù3UN9ٚåx -JUS.d3|2@b'NqN,ﮪ֠ 4>o)0e@KE$׵$ 㖣WS;͓w@Y JdrqBg"veID7%$9AɥWKGERnU` -}'ILGC|D: 獒n>}ebd+JU\Fߜtb' ;<\V$`X*(<ϔx>na.>~1t7CN dK`kN!:U0nȒmaSm0"efB۫KK~Sk뭟\_Å8}dk r22\W;jK4?agfQ" 1Ŋ\ {`F%g"pW^x~F6 wi1֒-|~{x_@!v@LUC*zKrP/ 5T'QZQ5ͮ YXh8k|-g -.:WmhAۃ;A+sҋ^ܼ4yǾ`78u߷&[oaݚxth &RtDV=11|Uua>+~,u;,o4#9W,\P'S@@2򚤀3Ʌx+Z"͂SE, Kzmu2^ڐuj .s]4ugsQ|f&ot4!a9vQOř s -kgϪ'tyûv5|\z?wvqsDئeB0τGHRCH(FD"X@xܔڠx8ϱ7ـsb8wg<0UtNPuTիz"ÜE&J Ȁ=ȐBQV1UI/K~aਹ[{_07 14FQRʗcQ'G %|Dl$<C&ɥBUugFx )Xi݈L#v σY8|;;,Mge[X-}xmptE''ĒN[ѡ[.ήǢ-\8lXށ`Q(f -Qmn|.l} Q #KO,Ijʗ!rwk4RiB"7ZUVnÆu%eW:>7)T_OR>y/.}N8ɇoxԂÏVPKU6 -",-mYՄ(x??؃G.2/gNRuy;=s]{p>lS&{RmjQզ\8@4#c;Uv\VRR^^RRFϑ^?7o> -wl٣ _oB?E Ǜ Vu:,U;! hJ,P F,A%rSВ7A8$ -F&yYDze%{-d !؀^ٷiحYC9ڛ•ȃ_S^_gџ_!uIoӛn-/M} u+uШ>INXle] /(\غ. 'x>.za?^| b#1"+V+\G-1M1 ^66MV,0D] -ktbӯ*VhJO׸4at5v›8٪Sp!;"8c`Ò1۲·( mpBje!IDQBIdbR@%dUQ{Rb{+*d9rҟʣ:K%͒ѧe29Wmsl_ϱ1$ ˃U)$Yj!I?P',i)" 3Y5v' _UOy̳xGobͬd)CE,m<nլ [G AAת݈{Gw j-ڋ7UHST9UIե8=~'"y)~V{2 vݓӿ0 Fos]j}nъZW5?,GaҤnyg+׳Wluf0iD{WOpZf,UP#ܛ=4gKf_aO?]7^knK>n/`g'm`#/ިqTcj~(e<SJR5jkmz=dk,űT3,V/^u(ZZmq¯,)poKN|~G¤ϟ\ߎeX$%^;ihW;P9>*G*BR@*>$R2ʒ=O@|(o?z o[\U-=xU!5Wf>nF,_wS rtݦ+wv23^FL1[VZt-]_ 3 -dȊ)u0J0hn֨}!g%.6a’r!UnʖgȤJ#O# *>f3?L}mVWz[Ep&L{{>'32e1p0 ri7 s?a! F{gWFʷ?F_0Q""\]|GA$Aޭiсz!l:|U`KhAp1JFc (w bV:rH#J7CPWoFGYt0K_JO)=O6/1jDMVgYLuYE Ujȭ-<;^uξ>I[5dzvՁ D2?@ -O0uNuTzdsdUY')T$SAr55,A#Odzx,xQjY#TD D&V6z}' -ZZay cs|3!zPi2r#.xi ~Z&i2-!FdUǭc!VWl''؁/?#Ֆ5XŦ,K-D*pC1`b-FU^(Ʉi2p}S;muޣ!@8;x `V: "L,]䍢|&(NQe:KHHr\hG(QGQHFg+KrE?1]ɭ+ZaYaU\\di `vh73K]c(P~WwQǠSv(ZCņwW͢wX; -~j[ml =F[p<ϯ̩cW~T<6v1U4<ŕOTpqKMiʑ& Rt7v~ɽRm{7;j0+zGYc) -Duw#Oox#f~= ("݂6t^hRSM$} {o9f#79ލsܣh"7={cQ喋?T=Qŭe47zQ,u#2X( }KhzB3LnB)pG,ʇ{EP@dl!wZO4X4>EZk3Ka_ w7fh 1 TfhwBӏ*atg}wvtkT8Ap|(P9pZL.2PCϷ=, ާh̯:'iwj/.Ԏ֎\7.Moo/e\w # @G43xwзw/H;p<#i&?1y -J쉹(uԹׇ~ mZD -endstream -endobj -616 0 obj -<< -/Type /FontDescriptor -/FontName /ICOIPK+DejaVuSans -/FontFamily (DejaVu Sans) -/Flags 4 -/FontBBox [ 0 -14 472 560 ] -/ItalicAngle 0 -/Ascent 928 -/Descent -235 -/CapHeight 560 -/StemV 80 -/StemH 80 -/FontFile2 612 0 R ->> -endobj -617 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /ICOIPK+DejaVuSans -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 3 [ 317 ] 17 [ 317 ] 20 [ 636 ] 25 [ 636 ] 37 [ 686 698 ] 42 [ 774 751 294 ] 54 [ 634 ] 68 [ 612 ] 70 [ 549 634 615 ] 74 [ 634 633 277 ] 78 [ 579 ] 80 [ 974 633 611 ] 85 [ 411 520 392 633 591 817 ] ] -/FontDescriptor 616 0 R ->> -endobj -618 0 obj -<< -/Length 702 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -27 beginbfchar -<002b> <0048> -<0044> <0061> -<0055> <0072> -<0047> <0064> -<0048> <0065> -<0051> <006e> -<004c> <0069> -<004a> <0067> -<0003> <0020> -<002a> <0047> -<0058> <0075> -<005a> <0077> -<0057> <0074> -<004b> <0068> -<0026> <0043> -<002c> <0049> -<0036> <0053> -<0059> <0076> -<0014> <0031> -<0011> <002e> -<0019> <0036> -<0025> <0042> -<0046> <0063> -<0050> <006d> -<004e> <006b> -<0052> <006f> -<0056> <0073> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -619 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /ICOIPK+DejaVuSans -/Encoding /Identity-H -/DescendantFonts [ 617 0 R ] -/ToUnicode 618 0 R ->> -endobj -620 0 obj -<< -/Type /FontDescriptor -/FontName /TGPMTG+Poppins -/FontFamily (Poppins) -/Flags 4 -/FontBBox [ -27 -260 122 795 ] -/ItalicAngle 0 -/Ascent 1049 -/Descent -349 -/CapHeight 795 -/StemV 80 -/StemH 80 -/FontFile2 613 0 R ->> -endobj -621 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /TGPMTG+Poppins -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 3 [ 266 ] 10 [ 158 453 453 ] 15 [ 197 550 209 ] 19 [ 627 319 574 588 628 627 634 545 630 629 212 ] 36 [ 673 612 771 706 512 503 777 691 245 ] 46 [ 598 431 ] 49 [ 702 785 578 ] 53 [ 607 586 540 674 675 975 ] 68 [ 675 675 606 675 619 328 675 639 245 247 514 245 1029 639 639 675 675 372 521 363 639 560 819 478 562 ] 206 [ 379 379 ] 209 [ 411 ] ] -/FontDescriptor 620 0 R ->> -endobj -622 0 obj -<< -/Length 1248 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -66 beginbfchar -<002b> <0048> -<0044> <0061> -<0055> <0072> -<0047> <0064> -<0048> <0065> -<0051> <006e> -<004c> <0069> -<004a> <0067> -<0003> <0020> -<002a> <0047> -<0058> <0075> -<005a> <0077> -<0057> <0074> -<004b> <0068> -<0026> <0043> -<002c> <0049> -<0036> <0053> -<0059> <0076> -<0014> <0031> -<0011> <002e> -<0019> <0036> -<0025> <0042> -<0046> <0063> -<0050> <006d> -<004e> <006b> -<0016> <0033> -<0017> <0034> -<0018> <0035> -<001a> <0037> -<0015> <0032> -<0013> <0030> -<0032> <004f> -<0052> <006f> -<0049> <0066> -<002e> <004b> -<004f> <006c> -<0035> <0052> -<0033> <0050> -<0056> <0073> -<0053> <0070> -<0024> <0041> -<0031> <004e> -<005c> <0079> -<0028> <0045> -<0037> <0054> -<0010> <002d> -<0045> <0062> -<0054> <0071> -<000b> <0028> -<000c> <0029> -<000f> <002c> -<001d> <003a> -<0039> <0056> -<001b> <0038> -<001c> <0039> -<0027> <0044> -<0029> <0046> -<00d1> <2022> -<005b> <0078> -<003a> <0057> -<0038> <0055> -<00ce> <201c> -<00cf> <201d> -<004d> <006a> -<002f> <004c> -<000a> <0027> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -623 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /TGPMTG+Poppins -/Encoding /Identity-H -/DescendantFonts [ 621 0 R ] -/ToUnicode 622 0 R ->> -endobj -624 0 obj -<< -/Type /FontDescriptor -/FontName /WKJFDI+DejaVuSansMono -/FontFamily (DejaVu Sans Mono) -/Flags 5 -/FontBBox [ 0 -14 584 759 ] -/ItalicAngle 0 -/Ascent 928 -/Descent -235 -/CapHeight 759 -/StemV 80 -/StemH 80 -/FontFile2 614 0 R ->> -endobj -625 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /WKJFDI+DejaVuSansMono -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 16 [ 601 601 ] 29 [ 601 ] 36 [ 601 ] 54 [ 601 601 ] 66 [ 601 ] 68 [ 601 ] 70 [ 601 601 601 601 ] 76 [ 601 ] 78 [ 601 601 601 601 601 601 ] 85 [ 601 601 601 601 601 ] 92 [ 601 ] ] -/FontDescriptor 624 0 R ->> -endobj -626 0 obj -<< -/Length 674 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -25 beginbfchar -<0048> <0065> -<0057> <0074> -<0046> <0063> -<0047> <0064> -<0049> <0066> -<0044> <0061> -<0058> <0075> -<004f> <006c> -<0056> <0073> -<0055> <0072> -<0011> <002e> -<005c> <0079> -<0050> <006d> -<0042> <005f> -<0053> <0070> -<0052> <006f> -<004c> <0069> -<001d> <003a> -<0010> <002d> -<0051> <006e> -<0036> <0053> -<0059> <0076> -<0024> <0041> -<0037> <0054> -<004e> <006b> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -627 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /WKJFDI+DejaVuSansMono -/Encoding /Identity-H -/DescendantFonts [ 625 0 R ] -/ToUnicode 626 0 R ->> -endobj -628 0 obj -<< -/Type /FontDescriptor -/FontName /TGTVMX+DejaVuSansMono -/FontFamily (DejaVu Sans Mono) -/Flags 4 -/FontBBox [ 0 -235 585 699 ] -/ItalicAngle 0 -/Ascent 928 -/Descent -235 -/CapHeight 699 -/StemV 80 -/StemH 80 -/FontFile2 615 0 R ->> -endobj -629 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /TGTVMX+DejaVuSansMono -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 3 [ 601 602 602 602 602 602 602 602 602 602 602 601 602 601 601 601 601 602 602 601 601 602 602 602 602 601 602 602 ] 32 [ 602 ] 36 [ 602 602 602 602 602 602 602 602 602 ] 46 [ 602 602 602 601 602 601 ] 53 [ 602 602 602 602 602 602 ] 60 [ 602 ] 62 [ 602 ] 64 [ 602 ] 66 [ 602 602 602 601 601 601 601 601 602 602 602 602 601 601 602 601 601 602 602 602 601 601 601 602 601 602 601 602 602 602 602 ] ] -/FontDescriptor 628 0 R ->> -endobj -630 0 obj -<< -/Length 1500 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -84 beginbfchar -<0056> <0073> -<005c> <0079> -<0046> <0063> -<0057> <0074> -<004f> <006c> -<0012> <002f> -<0048> <0065> -<0011> <002e> -<0047> <0064> -<001c> <0039> -<0013> <0030> -<0010> <002d> -<004e> <006b> -<0058> <0075> -<0045> <0062> -<0052> <006f> -<0051> <006e> -<0049> <0066> -<0059> <0076> -<0050> <006d> -<0055> <0072> -<004c> <0069> -<0042> <005f> -<0020> <003d> -<0014> <0031> -<0053> <0070> -<0044> <0061> -<005b> <0078> -<0015> <0032> -<0018> <0035> -<0003> <0020> -<0016> <0033> -<0017> <0034> -<004a> <0067> -<0005> <0022> -<004b> <0068> -<001d> <003a> -<0036> <0053> -<0024> <0041> -<0037> <0054> -<0039> <0056> -<000e> <002b> -<0006> <0023> -<0004> <0021> -<0007> <0024> -<000b> <0028> -<004d> <006a> -<005e> <007b> -<003e> <005b> -<000d> <002a> -<0040> <005d> -<000a> <0027> -<0060> <007d> -<000c> <0029> -<001e> <003b> -<005a> <0077> -<0031> <004e> -<0033> <0050> -<001b> <0038> -<002c> <0049> -<0028> <0045> -<002e> <004b> -<000f> <002c> -<0035> <0052> -<0054> <0071> -<0027> <0044> -<0026> <0043> -<002f> <004c> -<002b> <0048> -<003a> <0057> -<002a> <0047> -<0030> <004d> -<0019> <0036> -<0032> <004f> -<003c> <0059> -<001a> <0037> -<005f> <007c> -<0038> <0055> -<0009> <0026> -<0029> <0046> -<005d> <007a> -<0025> <0042> -<0043> <0060> -<0008> <0025> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -631 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /TGTVMX+DejaVuSansMono -/Encoding /Identity-H -/DescendantFonts [ 629 0 R ] -/ToUnicode 630 0 R ->> -endobj -632 0 obj -<< -/ICOIPK 619 0 R -/TGPMTG 623 0 R -/WKJFDI 627 0 R -/TGTVMX 631 0 R ->> -endobj -xref -0 633 -0000000000 65535 f -0000000015 00000 n -0000000235 00000 n -0000000351 00000 n -0000027525 00000 n -0000027658 00000 n -0000030309 00000 n -0000030508 00000 n -0000034100 00000 n -0000034450 00000 n -0000034584 00000 n -0000034720 00000 n -0000034882 00000 n -0000035045 00000 n -0000035201 00000 n -0000035358 00000 n -0000035515 00000 n -0000035675 00000 n -0000035836 00000 n -0000035997 00000 n -0000036148 00000 n -0000036300 00000 n -0000036475 00000 n -0000036651 00000 n -0000036827 00000 n -0000036999 00000 n -0000037172 00000 n -0000037344 00000 n -0000037517 00000 n -0000037690 00000 n -0000042711 00000 n -0000043015 00000 n -0000043265 00000 n -0000043401 00000 n -0000043564 00000 n -0000043721 00000 n -0000043878 00000 n -0000044039 00000 n -0000044200 00000 n -0000044352 00000 n -0000044525 00000 n -0000044698 00000 n -0000044871 00000 n -0000045133 00000 n -0000045393 00000 n -0000050574 00000 n -0000050829 00000 n -0000051084 00000 n -0000051217 00000 n -0000051348 00000 n -0000051479 00000 n -0000051610 00000 n -0000051741 00000 n -0000056745 00000 n -0000057042 00000 n -0000057175 00000 n -0000057306 00000 n -0000057439 00000 n -0000057570 00000 n -0000057701 00000 n -0000057832 00000 n -0000057965 00000 n -0000058098 00000 n -0000058229 00000 n -0000058360 00000 n -0000058491 00000 n -0000058622 00000 n -0000063591 00000 n -0000063860 00000 n -0000063993 00000 n -0000064124 00000 n -0000064255 00000 n -0000064386 00000 n -0000064517 00000 n -0000064713 00000 n -0000064972 00000 n -0000065203 00000 n -0000070823 00000 n -0000071176 00000 n -0000071309 00000 n -0000071440 00000 n -0000071571 00000 n -0000071702 00000 n -0000071833 00000 n -0000071964 00000 n -0000072095 00000 n -0000072226 00000 n -0000072357 00000 n -0000072489 00000 n -0000072621 00000 n -0000072753 00000 n -0000072885 00000 n -0000073017 00000 n -0000073150 00000 n -0000073281 00000 n -0000073412 00000 n -0000073543 00000 n -0000073674 00000 n -0000073903 00000 n -0000079315 00000 n -0000079752 00000 n -0000079990 00000 n -0000080124 00000 n -0000080256 00000 n -0000080388 00000 n -0000080520 00000 n -0000080652 00000 n -0000080784 00000 n -0000080916 00000 n -0000081048 00000 n -0000081180 00000 n -0000081313 00000 n -0000081446 00000 n -0000081579 00000 n -0000081712 00000 n -0000081845 00000 n -0000081978 00000 n -0000082111 00000 n -0000082244 00000 n -0000082377 00000 n -0000082510 00000 n -0000082643 00000 n -0000082776 00000 n -0000082909 00000 n -0000083042 00000 n -0000083175 00000 n -0000083308 00000 n -0000083441 00000 n -0000083573 00000 n -0000088687 00000 n -0000089166 00000 n -0000089299 00000 n -0000089432 00000 n -0000089565 00000 n -0000089698 00000 n -0000089831 00000 n -0000089964 00000 n -0000090097 00000 n -0000090230 00000 n -0000090363 00000 n -0000090496 00000 n -0000090629 00000 n -0000090762 00000 n -0000090895 00000 n -0000091028 00000 n -0000091161 00000 n -0000091294 00000 n -0000091427 00000 n -0000091560 00000 n -0000091693 00000 n -0000091826 00000 n -0000091959 00000 n -0000092092 00000 n -0000092225 00000 n -0000092358 00000 n -0000092491 00000 n -0000092624 00000 n -0000092757 00000 n -0000092890 00000 n -0000093023 00000 n -0000093156 00000 n -0000093289 00000 n -0000093421 00000 n -0000093552 00000 n -0000098511 00000 n -0000098950 00000 n -0000099083 00000 n -0000099216 00000 n -0000099349 00000 n -0000099482 00000 n -0000099615 00000 n -0000099748 00000 n -0000099881 00000 n -0000100014 00000 n -0000100147 00000 n -0000100280 00000 n -0000100413 00000 n -0000100546 00000 n -0000100679 00000 n -0000100812 00000 n -0000100945 00000 n -0000101078 00000 n -0000101211 00000 n -0000101344 00000 n -0000101477 00000 n -0000101610 00000 n -0000101743 00000 n -0000101876 00000 n -0000102009 00000 n -0000102142 00000 n -0000102275 00000 n -0000102408 00000 n -0000102540 00000 n -0000102671 00000 n -0000107769 00000 n -0000108272 00000 n -0000108405 00000 n -0000108538 00000 n -0000108671 00000 n -0000108804 00000 n -0000108937 00000 n -0000109070 00000 n -0000109203 00000 n -0000109336 00000 n -0000109469 00000 n -0000109602 00000 n -0000109735 00000 n -0000109869 00000 n -0000110003 00000 n -0000110137 00000 n -0000110271 00000 n -0000110405 00000 n -0000110539 00000 n -0000110673 00000 n -0000110807 00000 n -0000110941 00000 n -0000111075 00000 n -0000111209 00000 n -0000111343 00000 n -0000111477 00000 n -0000111611 00000 n -0000111745 00000 n -0000111879 00000 n -0000112013 00000 n -0000112147 00000 n -0000112281 00000 n -0000112415 00000 n -0000112549 00000 n -0000112683 00000 n -0000112817 00000 n -0000112950 00000 n -0000113082 00000 n -0000117606 00000 n -0000118109 00000 n -0000118243 00000 n -0000118377 00000 n -0000118511 00000 n -0000118645 00000 n -0000118779 00000 n -0000118913 00000 n -0000119047 00000 n -0000119181 00000 n -0000119315 00000 n -0000119449 00000 n -0000119583 00000 n -0000119717 00000 n -0000119851 00000 n -0000119985 00000 n -0000120119 00000 n -0000120253 00000 n -0000120387 00000 n -0000120521 00000 n -0000120655 00000 n -0000120789 00000 n -0000120923 00000 n -0000121057 00000 n -0000121191 00000 n -0000121325 00000 n -0000121459 00000 n -0000121593 00000 n -0000121727 00000 n -0000121861 00000 n -0000121995 00000 n -0000122129 00000 n -0000122263 00000 n -0000122397 00000 n -0000122531 00000 n -0000122665 00000 n -0000122798 00000 n -0000122930 00000 n -0000127159 00000 n -0000127678 00000 n -0000127812 00000 n -0000127946 00000 n -0000128080 00000 n -0000128214 00000 n -0000128348 00000 n -0000128482 00000 n -0000128616 00000 n -0000128750 00000 n -0000128884 00000 n -0000129018 00000 n -0000129152 00000 n -0000129286 00000 n -0000129420 00000 n -0000129554 00000 n -0000129688 00000 n -0000129822 00000 n -0000129956 00000 n -0000130090 00000 n -0000130224 00000 n -0000130358 00000 n -0000130492 00000 n -0000130626 00000 n -0000130760 00000 n -0000130894 00000 n -0000131028 00000 n -0000131162 00000 n -0000131296 00000 n -0000131430 00000 n -0000131564 00000 n -0000131698 00000 n -0000131832 00000 n -0000131966 00000 n -0000132100 00000 n -0000132234 00000 n -0000132368 00000 n -0000132502 00000 n -0000132635 00000 n -0000132767 00000 n -0000137769 00000 n -0000138288 00000 n -0000138422 00000 n -0000138556 00000 n -0000138690 00000 n -0000138824 00000 n -0000138958 00000 n -0000139092 00000 n -0000139226 00000 n -0000139360 00000 n -0000139494 00000 n -0000139628 00000 n -0000139762 00000 n -0000139896 00000 n -0000140030 00000 n -0000140164 00000 n -0000140298 00000 n -0000140432 00000 n -0000140566 00000 n -0000140700 00000 n -0000140834 00000 n -0000140968 00000 n -0000141102 00000 n -0000141236 00000 n -0000141370 00000 n -0000141504 00000 n -0000141638 00000 n -0000141772 00000 n -0000141906 00000 n -0000142040 00000 n -0000142174 00000 n -0000142308 00000 n -0000142442 00000 n -0000142576 00000 n -0000142710 00000 n -0000142844 00000 n -0000142978 00000 n -0000143112 00000 n -0000143245 00000 n -0000143377 00000 n -0000148406 00000 n -0000148925 00000 n -0000149059 00000 n -0000149193 00000 n -0000149327 00000 n -0000149461 00000 n -0000149595 00000 n -0000149729 00000 n -0000149863 00000 n -0000149997 00000 n -0000150131 00000 n -0000150265 00000 n -0000150399 00000 n -0000150533 00000 n -0000150667 00000 n -0000150801 00000 n -0000150935 00000 n -0000151069 00000 n -0000151203 00000 n -0000151337 00000 n -0000151471 00000 n -0000151605 00000 n -0000151739 00000 n -0000151873 00000 n -0000152007 00000 n -0000152141 00000 n -0000152275 00000 n -0000152409 00000 n -0000152543 00000 n -0000152677 00000 n -0000152811 00000 n -0000152945 00000 n -0000153079 00000 n -0000153213 00000 n -0000153347 00000 n -0000153481 00000 n -0000153615 00000 n -0000153749 00000 n -0000153882 00000 n -0000154014 00000 n -0000159201 00000 n -0000159680 00000 n -0000159814 00000 n -0000159948 00000 n -0000160082 00000 n -0000160216 00000 n -0000160350 00000 n -0000160484 00000 n -0000160618 00000 n -0000160752 00000 n -0000160886 00000 n -0000161020 00000 n -0000161154 00000 n -0000161288 00000 n -0000161422 00000 n -0000161556 00000 n -0000161786 00000 n -0000161921 00000 n -0000162054 00000 n -0000162187 00000 n -0000162320 00000 n -0000162453 00000 n -0000162586 00000 n -0000162719 00000 n -0000162852 00000 n -0000162985 00000 n -0000163119 00000 n -0000163253 00000 n -0000163387 00000 n -0000163521 00000 n -0000163655 00000 n -0000163789 00000 n -0000163923 00000 n -0000164056 00000 n -0000164188 00000 n -0000169046 00000 n -0000169557 00000 n -0000169691 00000 n -0000169825 00000 n -0000169959 00000 n -0000170093 00000 n -0000170227 00000 n -0000170361 00000 n -0000170495 00000 n -0000170629 00000 n -0000170763 00000 n -0000170897 00000 n -0000171031 00000 n -0000171165 00000 n -0000171299 00000 n -0000171433 00000 n -0000171567 00000 n -0000171701 00000 n -0000171835 00000 n -0000171969 00000 n -0000172103 00000 n -0000172237 00000 n -0000172371 00000 n -0000172505 00000 n -0000172639 00000 n -0000172773 00000 n -0000172907 00000 n -0000173041 00000 n -0000173175 00000 n -0000173309 00000 n -0000173443 00000 n -0000173577 00000 n -0000173711 00000 n -0000173845 00000 n -0000173979 00000 n -0000174113 00000 n -0000174247 00000 n -0000174380 00000 n -0000174512 00000 n -0000179215 00000 n -0000179694 00000 n -0000179828 00000 n -0000179962 00000 n -0000180096 00000 n -0000180230 00000 n -0000180364 00000 n -0000180498 00000 n -0000180632 00000 n -0000180766 00000 n -0000180900 00000 n -0000181034 00000 n -0000181168 00000 n -0000181302 00000 n -0000181436 00000 n -0000181570 00000 n -0000181704 00000 n -0000181838 00000 n -0000181972 00000 n -0000182106 00000 n -0000182240 00000 n -0000182374 00000 n -0000182508 00000 n -0000182642 00000 n -0000182776 00000 n -0000182910 00000 n -0000183044 00000 n -0000183178 00000 n -0000183312 00000 n -0000183446 00000 n -0000183580 00000 n -0000183714 00000 n -0000183848 00000 n -0000183981 00000 n -0000184113 00000 n -0000189306 00000 n -0000189785 00000 n -0000189919 00000 n -0000190053 00000 n -0000190187 00000 n -0000190321 00000 n -0000190455 00000 n -0000190589 00000 n -0000190723 00000 n -0000190857 00000 n -0000190991 00000 n -0000191125 00000 n -0000191259 00000 n -0000191394 00000 n -0000191529 00000 n -0000191664 00000 n -0000191799 00000 n -0000191934 00000 n -0000192069 00000 n -0000192204 00000 n -0000192339 00000 n -0000192474 00000 n -0000192609 00000 n -0000192744 00000 n -0000192879 00000 n -0000193014 00000 n -0000193149 00000 n -0000193284 00000 n -0000193419 00000 n -0000193554 00000 n -0000193689 00000 n -0000193824 00000 n -0000193959 00000 n -0000194093 00000 n -0000194226 00000 n -0000199366 00000 n -0000199749 00000 n -0000199884 00000 n -0000200019 00000 n -0000200154 00000 n -0000200289 00000 n -0000200424 00000 n -0000200559 00000 n -0000200694 00000 n -0000200829 00000 n -0000200964 00000 n -0000201097 00000 n -0000201230 00000 n -0000201363 00000 n -0000201496 00000 n -0000201629 00000 n -0000201762 00000 n -0000201895 00000 n -0000202028 00000 n -0000202162 00000 n -0000202296 00000 n -0000202430 00000 n -0000202563 00000 n -0000207539 00000 n -0000208010 00000 n -0000208144 00000 n -0000208278 00000 n -0000208412 00000 n -0000208546 00000 n -0000208680 00000 n -0000208814 00000 n -0000208948 00000 n -0000209082 00000 n -0000209216 00000 n -0000209350 00000 n -0000209484 00000 n -0000209618 00000 n -0000209752 00000 n -0000209887 00000 n -0000210020 00000 n -0000210153 00000 n -0000210286 00000 n -0000210419 00000 n -0000210552 00000 n -0000210685 00000 n -0000210818 00000 n -0000210951 00000 n -0000211085 00000 n -0000211219 00000 n -0000211353 00000 n -0000211487 00000 n -0000211621 00000 n -0000211755 00000 n -0000211889 00000 n -0000212023 00000 n -0000212157 00000 n -0000212290 00000 n -0000215522 00000 n -0000215769 00000 n -0000215903 00000 n -0000216037 00000 n -0000216171 00000 n -0000216305 00000 n -0000216476 00000 n -0000216630 00000 n -0000216745 00000 n -0000216911 00000 n -0000217100 00000 n -0000217229 00000 n -0000217422 00000 n -0000217595 00000 n -0000217779 00000 n -0000217938 00000 n -0000218117 00000 n -0000218294 00000 n -0000218486 00000 n -0000218704 00000 n -0000218916 00000 n -0000218978 00000 n -0000225626 00000 n -0000229868 00000 n -0000234832 00000 n -0000246576 00000 n -0000246808 00000 n -0000247198 00000 n -0000247953 00000 n -0000248103 00000 n -0000248332 00000 n -0000248864 00000 n -0000250166 00000 n -0000250313 00000 n -0000250554 00000 n -0000250927 00000 n -0000251654 00000 n -0000251808 00000 n -0000252050 00000 n -0000252644 00000 n -0000254198 00000 n -0000254352 00000 n -trailer -<< -/Size 633 -/Root 3 0 R -/Info 2 0 R ->> -startxref -254439 -%%EOF diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md deleted file mode 100644 index 51a6df997f8..00000000000 --- a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md +++ /dev/null @@ -1,641 +0,0 @@ ---- -title: Hardening Guide with CIS v1.6 Benchmark -weight: 100 ---- - -This document provides prescriptive guidance for hardening a production installation of a RKE cluster to be used with Rancher v2.6.3. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Information Security (CIS). - -> This hardening guide describes how to secure the nodes in your cluster, and it is recommended to follow this guide before installing Kubernetes. - -This hardening guide is intended to be used for RKE clusters and associated with specific versions of the CIS Kubernetes Benchmark, Kubernetes, and Rancher: - -| Rancher Version | CIS Benchmark Version | Kubernetes Version | -| --- | --- | --- | -| Rancher v2.6.3 | Benchmark v1.6 | Kubernetes v1.18, v1.19, v1.20 and v1.21 | - -[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf). - -- [Overview](#overview) -- [Configure Kernel Runtime Parameters](#configure-kernel-runtime-parameters) -- [Configure `etcd` user and group](#configure-etcd-user-and-group) -- [Configure `default` service account](#configure-default-service-account) -- [Configure Network Policy](#configure-network-policy) -- [Reference Hardened RKE `cluster.yml` Configuration](#reference-hardened-rke-cluster-yml-configuration) -- [Reference Hardened RKE Template Configuration](#reference-hardened-rke-template-configuration) -- [Reference Hardened **cloud-config** Configuration](#reference-hardened-cloud-config-configuration) - -### Overview - -This document provides prescriptive guidance for hardening a RKE cluster to be used for installing Rancher v2.6.3 with Kubernetes v1.18 up to v1.21 or provisioning a RKE cluster with Kubernetes v1.18 up to v.21 to be used within Rancher v2.6.3. It outlines the configurations required to address Kubernetes benchmark controls from the Center for Information Security (CIS). - -For more details about evaluating a hardened cluster against the official CIS benchmark, refer to the [CIS 1.6 Benchmark - Self-Assessment Guide - Rancher v2.6]({{}}/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/). - -#### Known Issues - -- Rancher **exec shell** and **view logs** for pods are **not** functional in a CIS v1.6 hardened setup when only public IP is provided when registering custom nodes. This functionality requires a private IP to be provided when registering the custom nodes. -- When setting the `default_pod_security_policy_template_id:` to `restricted` or `restricted-noroot`, based on the pod security policies (PSP) [provided]({{}}/rancher/v2.6/en/admin-settings/pod-security-policies/) by Rancher, Rancher creates **RoleBindings** and **ClusterRoleBindings** on the default service accounts. The CIS v1.6 check 5.1.5 requires that the default service accounts have no roles or cluster roles bound to it apart from the defaults. In addition the default service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments. - -### Configure Kernel Runtime Parameters - -The following `sysctl` configuration is recommended for all nodes type in the cluster. Set the following parameters in `/etc/sysctl.d/90-kubelet.conf`: - -```ini -vm.overcommit_memory=1 -vm.panic_on_oom=0 -kernel.panic=10 -kernel.panic_on_oops=1 -kernel.keys.root_maxbytes=25000000 -``` - -Run `sysctl -p /etc/sysctl.d/90-kubelet.conf` to enable the settings. - -### Configure `etcd` user and group - -A user account and group for the **etcd** service is required to be setup before installing RKE. The **uid** and **gid** for the **etcd** user will be used in the RKE **config.yml** to set the proper permissions for files and directories during installation time. - -#### Create `etcd` user and group - -To create the **etcd** user and group run the following console commands. The commands below use `52034` for **uid** and **gid** are for example purposes. Any valid unused **uid** or **gid** could also be used in lieu of `52034`. - -```bash -groupadd --gid 52034 etcd -useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd --shell /usr/sbin/nologin -``` - -Update the RKE **config.yml** with the **uid** and **gid** of the **etcd** user: - -```yaml -services: - etcd: - gid: 52034 - uid: 52034 -``` - -### Configure `default` Service Account - -#### Set `automountServiceAccountToken` to `false` for `default` service accounts - -Kubernetes provides a default service account which is used by cluster workloads where no specific service account is assigned to the pod. Where access to the Kubernetes API from a pod is required, a specific service account should be created for that pod, and rights granted to that service account. The default service account should be configured such that it does not provide a service account token and does not have any explicit rights assignments. - -For each namespace including **default** and **kube-system** on a standard RKE install, the **default** service account must include this value: - -```yaml -automountServiceAccountToken: false -``` - -Save the following configuration to a file called `account_update.yaml`. - -```yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: default -automountServiceAccountToken: false -``` - -Create a bash script file called `account_update.sh`. Be sure to `chmod +x account_update.sh` so the script has execute permissions. - -```bash -#!/bin/bash -e - -for namespace in $(kubectl get namespaces -A -o=jsonpath="{.items[*]['metadata.name']}"); do - kubectl patch serviceaccount default -n ${namespace} -p "$(cat account_update.yaml)" -done -``` - -### Configure Network Policy - -#### Ensure that all Namespaces have Network Policies defined - -Running different applications on the same Kubernetes cluster creates a risk of one compromised application attacking a neighboring application. Network segmentation is important to ensure that containers can communicate only with those they are supposed to. A network policy is a specification of how selections of pods are allowed to communicate with each other and other network endpoints. - -Network Policies are namespace scoped. When a network policy is introduced to a given namespace, all traffic not allowed by the policy is denied. However, if there are no network policies in a namespace all traffic will be allowed into and out of the pods in that namespace. To enforce network policies, a CNI (container network interface) plugin must be enabled. This guide uses [Canal](https://github.com/projectcalico/canal) to provide the policy enforcement. Additional information about CNI providers can be found [here](https://www.suse.com/c/rancher_blog/comparing-kubernetes-cni-providers-flannel-calico-canal-and-weave/). - -Once a CNI provider is enabled on a cluster a default network policy can be applied. For reference purposes a **permissive** example is provided below. If you want to allow all traffic to all pods in a namespace (even if policies are added that cause some pods to be treated as “isolated”), you can create a policy that explicitly allows all traffic in that namespace. Save the following configuration as `default-allow-all.yaml`. Additional [documentation](https://kubernetes.io/docs/concepts/services-networking/network-policies/) about network policies can be found on the Kubernetes site. - -> This `NetworkPolicy` is just an example and is not recommended for production use. - -```yaml ---- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: default-allow-all -spec: - podSelector: {} - ingress: - - {} - egress: - - {} - policyTypes: - - Ingress - - Egress -``` - -Create a bash script file called `apply_networkPolicy_to_all_ns.sh`. Be sure to `chmod +x apply_networkPolicy_to_all_ns.sh` so the script has execute permissions. - -```bash -#!/bin/bash -e - -for namespace in $(kubectl get namespaces -A -o=jsonpath="{.items[*]['metadata.name']}"); do - kubectl apply -f default-allow-all.yaml -n ${namespace} -done -``` - -Execute this script to apply the `default-allow-all.yaml` configuration with the **permissive** `NetworkPolicy` to all namespaces. - -### Reference Hardened RKE `cluster.yml` Configuration - -The reference `cluster.yml` is used by the RKE CLI that provides the configuration needed to achieve a hardened install of Rancher Kubernetes Engine (RKE). RKE install [documentation]({{}}/rke/latest/en/installation/) is provided with additional details about the configuration items. This reference `cluster.yml` does not include the required **nodes** directive which will vary depending on your environment. Documentation for node configuration in RKE can be found [here]({{}}/rke/latest/en/config-options/nodes/). - -> For a Kubernetes v1.18 cluster, the configuration `spec.volumes: 'ephemeral'` should be removed from the `PodSecurityPolicy`, since it's not supported in this Kubernetes release. - -```yaml -# If you intend to deploy Kubernetes in an air-gapped environment, -# please consult the documentation on how to configure custom RKE images. -# https://rancher.com/docs/rke/latest/en/installation/ . - -# The nodes directive is required and will vary depending on your environment. -# Documentation for node configuration can be found here: -# https://rancher.com/docs/rke/latest/en/config-options/nodes/ -nodes: [] -services: - etcd: - image: "" - extra_args: {} - extra_binds: [] - extra_env: [] - win_extra_args: {} - win_extra_binds: [] - win_extra_env: [] - external_urls: [] - ca_cert: "" - cert: "" - key: "" - path: "" - uid: 52034 - gid: 52034 - snapshot: false - retention: "" - creation: "" - backup_config: null - kube-api: - image: "" - extra_args: {} - extra_binds: [] - extra_env: [] - win_extra_args: {} - win_extra_binds: [] - win_extra_env: [] - service_cluster_ip_range: "" - service_node_port_range: "" - pod_security_policy: true - always_pull_images: false - secrets_encryption_config: - enabled: true - custom_config: null - audit_log: - enabled: true - configuration: null - admission_configuration: null - event_rate_limit: - enabled: true - configuration: null - kube-controller: - image: "" - extra_args: - feature-gates: RotateKubeletServerCertificate=true - tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 - bind-address: 127.0.0.1 - extra_binds: [] - extra_env: [] - win_extra_args: {} - win_extra_binds: [] - win_extra_env: [] - cluster_cidr: "" - service_cluster_ip_range: "" - scheduler: - image: "" - extra_args: - tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 - bind-address: 127.0.0.1 - extra_binds: [] - extra_env: [] - win_extra_args: {} - win_extra_binds: [] - win_extra_env: [] - kubelet: - image: "" - extra_args: - feature-gates: RotateKubeletServerCertificate=true - protect-kernel-defaults: true - tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 - extra_binds: [] - extra_env: [] - win_extra_args: {} - win_extra_binds: [] - win_extra_env: [] - cluster_domain: cluster.local - infra_container_image: "" - cluster_dns_server: "" - fail_swap_on: false - generate_serving_certificate: true - kubeproxy: - image: "" - extra_args: {} - extra_binds: [] - extra_env: [] - win_extra_args: {} - win_extra_binds: [] - win_extra_env: [] -network: - plugin: "" - options: {} - mtu: 0 - node_selector: {} - update_strategy: null -authentication: - strategy: "" - sans: [] - webhook: null -addons: | - # Upstream Kubernetes restricted PSP policy - # https://github.com/kubernetes/website/blob/564baf15c102412522e9c8fc6ef2b5ff5b6e766c/content/en/examples/policy/restricted-psp.yaml - apiVersion: policy/v1beta1 - kind: PodSecurityPolicy - metadata: - name: restricted-noroot - spec: - privileged: false - # Required to prevent escalations to root. - allowPrivilegeEscalation: false - requiredDropCapabilities: - - ALL - # Allow core volume types. - volumes: - - 'configMap' - - 'emptyDir' - - 'projected' - - 'secret' - - 'downwardAPI' - # Assume that ephemeral CSI drivers & persistentVolumes set up by the cluster admin are safe to use. - - 'csi' - - 'persistentVolumeClaim' - - 'ephemeral' - hostNetwork: false - hostIPC: false - hostPID: false - runAsUser: - # Require the container to run without root privileges. - rule: 'MustRunAsNonRoot' - seLinux: - # This policy assumes the nodes are using AppArmor rather than SELinux. - rule: 'RunAsAny' - supplementalGroups: - rule: 'MustRunAs' - ranges: - # Forbid adding the root group. - - min: 1 - max: 65535 - fsGroup: - rule: 'MustRunAs' - ranges: - # Forbid adding the root group. - - min: 1 - max: 65535 - readOnlyRootFilesystem: false - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: ClusterRole - metadata: - name: psp:restricted-noroot - rules: - - apiGroups: - - extensions - resourceNames: - - restricted-noroot - resources: - - podsecuritypolicies - verbs: - - use - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: ClusterRoleBinding - metadata: - name: psp:restricted-noroot - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: psp:restricted-noroot - subjects: - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:serviceaccounts - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:authenticated - --- - apiVersion: networking.k8s.io/v1 - kind: NetworkPolicy - metadata: - name: default-allow-all - spec: - podSelector: {} - ingress: - - {} - egress: - - {} - policyTypes: - - Ingress - - Egress - --- - apiVersion: v1 - kind: ServiceAccount - metadata: - name: default - automountServiceAccountToken: false -addons_include: [] -system_images: - etcd: "" - alpine: "" - nginx_proxy: "" - cert_downloader: "" - kubernetes_services_sidecar: "" - kubedns: "" - dnsmasq: "" - kubedns_sidecar: "" - kubedns_autoscaler: "" - coredns: "" - coredns_autoscaler: "" - nodelocal: "" - kubernetes: "" - flannel: "" - flannel_cni: "" - calico_node: "" - calico_cni: "" - calico_controllers: "" - calico_ctl: "" - calico_flexvol: "" - canal_node: "" - canal_cni: "" - canal_controllers: "" - canal_flannel: "" - canal_flexvol: "" - weave_node: "" - weave_cni: "" - pod_infra_container: "" - ingress: "" - ingress_backend: "" - metrics_server: "" - windows_pod_infra_container: "" -ssh_key_path: "" -ssh_cert_path: "" -ssh_agent_auth: false -authorization: - mode: "" - options: {} -ignore_docker_version: false -kubernetes_version: "" -private_registries: [] -ingress: - provider: "" - options: {} - node_selector: {} - extra_args: {} - dns_policy: "" - extra_envs: [] - extra_volumes: [] - extra_volume_mounts: [] - update_strategy: null - http_port: 0 - https_port: 0 - network_mode: "" -cluster_name: -cloud_provider: - name: "" -prefix_path: "" -win_prefix_path: "" -addon_job_timeout: 0 -bastion_host: - address: "" - port: "" - user: "" - ssh_key: "" - ssh_key_path: "" - ssh_cert: "" - ssh_cert_path: "" -monitoring: - provider: "" - options: {} - node_selector: {} - update_strategy: null - replicas: null -restore: - restore: false - snapshot_name: "" -dns: null -upgrade_strategy: - max_unavailable_worker: "" - max_unavailable_controlplane: "" - drain: null - node_drain_input: null -``` - -### Reference Hardened RKE Template Configuration - -The reference RKE template provides the configuration needed to achieve a hardened install of Kubernetes. RKE templates are used to provision Kubernetes and define Rancher settings. Follow the Rancher [documentation]({{}}/rancher/v2.6/en/installation) for additional installation and RKE template details. - -```yaml -# -# Cluster Config -# -default_pod_security_policy_template_id: restricted-noroot -docker_root_dir: /var/lib/docker -enable_cluster_alerting: false -enable_cluster_monitoring: false -enable_network_policy: true -local_cluster_auth_endpoint: - enabled: true -name: '' -# -# Rancher Config -# -rancher_kubernetes_engine_config: - addon_job_timeout: 45 - authentication: - strategy: x509 - dns: - nodelocal: - ip_address: '' - node_selector: null - update_strategy: {} - enable_cri_dockerd: false - ignore_docker_version: true -# -# # Currently only nginx ingress provider is supported. -# # To disable ingress controller, set `provider: none` -# # To enable ingress on specific nodes, use the node_selector, eg: -# provider: nginx -# node_selector: -# app: ingress -# - ingress: - default_backend: false - default_ingress_class: true - http_port: 0 - https_port: 0 - provider: nginx - kubernetes_version: v1.21.8-rancher1-1 - monitoring: - provider: metrics-server - replicas: 1 -# -# If you are using calico on AWS -# -# network: -# plugin: calico -# calico_network_provider: -# cloud_provider: aws -# -# # To specify flannel interface -# -# network: -# plugin: flannel -# flannel_network_provider: -# iface: eth1 -# -# # To specify flannel interface for canal plugin -# -# network: -# plugin: canal -# canal_network_provider: -# iface: eth1 -# - network: - mtu: 0 - options: - flannel_backend_type: vxlan - plugin: canal - rotate_encryption_key: false -# -# services: -# kube-api: -# service_cluster_ip_range: 10.43.0.0/16 -# kube-controller: -# cluster_cidr: 10.42.0.0/16 -# service_cluster_ip_range: 10.43.0.0/16 -# kubelet: -# cluster_domain: cluster.local -# cluster_dns_server: 10.43.0.10 -# - services: - scheduler: - extra_args: - tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 - bind-address: 127.0.0.1 - etcd: - backup_config: - enabled: true - interval_hours: 12 - retention: 6 - safe_timestamp: false - timeout: 300 - creation: 12h - extra_args: - election-timeout: 5000 - heartbeat-interval: 500 - retention: 72h - snapshot: false - uid: 52034 - gid: 52034 - kube_api: - always_pull_images: false - audit_log: - enabled: true - event_rate_limit: - enabled: true - pod_security_policy: true - secrets_encryption_config: - enabled: true - service_node_port_range: 30000-32767 - kube-controller: - extra_args: - feature-gates: RotateKubeletServerCertificate=true - tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 - bind-address: 127.0.0.1 - kubelet: - extra_args: - feature-gates: RotateKubeletServerCertificate=true - protect-kernel-defaults: true - tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 - fail_swap_on: false - generate_serving_certificate: true - ssh_agent_auth: false - upgrade_strategy: - max_unavailable_controlplane: '1' - max_unavailable_worker: 10% -windows_prefered_cluster: false -``` - -### Reference Hardened **cloud-config** Configuration - -A **cloud-config** configuration file is generally used in cloud infrastructure environments to allow for configuration management of compute instances. The reference config configures SUSE Linux Enterprise Server (SLES), openSUSE Leap, Red Hat Enterprise Linux (RHEL) and Ubuntu operating system level settings needed before installing Kubernetes. - -#### Reference Hardened **cloud-config** for SUSE Linux Enterprise Server 15 (SLES 15) and openSUSE Leap 15 - -```yaml -#cloud-config -system_info: - default_user: - groups: - - docker -write_files: -- path: "/etc/sysctl.d/90-kubelet.conf" - owner: root:root - permissions: '0644' - content: | - vm.overcommit_memory=1 - vm.panic_on_oom=0 - kernel.panic=10 - kernel.panic_on_oops=1 - kernel.keys.root_maxbytes=25000000 -package_update: true -ssh_pwauth: false -runcmd: -# Docker should already be installed in SLES 15 SP3 -- zypper install docker containerd -- systemctl daemon-reload -- systemctl enable docker.service -- systemctl start --no-block docker.service -- sysctl -p /etc/sysctl.d/90-kubelet.conf -- groupadd --gid 52034 etcd -- useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd --shell /usr/sbin/nologin -``` - -#### Reference Hardened **cloud-config** for Red Hat Enterprise Linux 8 (RHEL 8) and Ubuntu 20.04 LTS - -```yaml -#cloud-config -system_info: - default_user: - groups: - - docker -write_files: -- path: "/etc/sysctl.d/90-kubelet.conf" - owner: root:root - permissions: '0644' - content: | - vm.overcommit_memory=1 - vm.panic_on_oom=0 - kernel.panic=10 - kernel.panic_on_oops=1 - kernel.keys.root_maxbytes=25000000 -package_update: true -ssh_pwauth: false -runcmd: -# Install Docker from Rancher's Docker installation scripts - github.com/rancher/install-docker -- curl https://releases.rancher.com/install-docker/20.10.sh | sh -- sysctl -p /etc/sysctl.d/90-kubelet.conf -- groupadd --gid 52034 etcd -- useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd --shell /usr/sbin/nologin -``` diff --git a/content/rancher/v2.6/en/security/hardening-guides/_index.md b/content/rancher/v2.6/en/security/hardening-guides/_index.md index ea4e969f058..a3635419be5 100644 --- a/content/rancher/v2.6/en/security/hardening-guides/_index.md +++ b/content/rancher/v2.6/en/security/hardening-guides/_index.md @@ -1,6 +1,6 @@ --- title: Self-Assessment and Hardening Guides for Rancher v2.6 -shortTitle: Rancher v2.6 Hardening Guides +shortTitle: Rancher v2.6 Guides weight: 1 aliases: - /rancher/v2.6/en/security/rancher-2.5/ @@ -10,56 +10,4 @@ aliases: - /rancher/v2.6/en/security/rancher-2.5/1.6-benchmark-2.5/ --- -Rancher provides specific security hardening guides for each supported Rancher's Kubernetes distributions. - -- [Rancher Kubernetes Distributions](#rancher-kubernetes-distributions) -- [Hardening Guides and Benchmark Versions](#hardening-guides-and-benchmark-versions) - - [RKE Guides](#rke-guides) - - [RKE2 Guides](#rke2-guides) - - [K3s Guides](#k3s) -- [Rancher with SELinux](#rancher-with-selinux) - -# Rancher Kubernetes Distributions - -Rancher uses the following Kubernetes distributions: - -- [**RKE**]({{}}/rke/latest/en/), Rancher Kubernetes Engine, is a CNCF-certified Kubernetes distribution that runs entirely within Docker containers. -- [**RKE2**](https://docs.rke2.io/) is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector. -- [**K3s**]({{}}/k3s/latest/en/) is a fully conformant, lightweight Kubernetes distribution. It is easy to install, with half the memory of upstream Kubernetes, all in a binary of less than 100 MB. - -To harden a Kubernetes cluster outside of Rancher's distributions, refer to your Kubernetes provider docs. - -# Hardening Guides and Benchmark Versions - -These guides have been tested along with the Rancher v2.6 release. Each self-assessment guide is accompanied with a hardening guide and tested on a specific Kubernetes version and CIS benchmark version. If a CIS benchmark has not been validated for your Kubernetes version, you can choose to use the existing guides until a newer version is added. - -### RKE Guides - -| Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides | -| --- | --- | --- | --- | -| Kubernetes v1.18, v1.19, v1.20 and v1.21 | CIS v1.6 | [Link](./1.6-benchmark-2.6) | [Link](./1.6-hardening-2.6) | - -> **Notes** -> -> - Kubernetes v1.22 is currently in experimental mode in Rancher v2.6.3. -> - CIS v1.20 benchmark version for Kubernetes v1.19 and v1.20 is not yet released as a profile in Rancher's CIS Benchmark chart. - -### RKE2 Guides - -| Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides | -| --- | --- | --- | --- | -| Kubernetes v1.18 | CIS v1.5 | [Link](https://docs.rke2.io/security/cis_self_assessment15/) | [Link](https://docs.rke2.io/security/hardening_guide/) | -| Kubernetes v1.20 | CIS v1.6 | [Link](https://docs.rke2.io/security/cis_self_assessment16/) | [Link](https://docs.rke2.io/security/hardening_guide/) | - -### K3s Guides - -| Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guide | -| --- | --- | --- | --- | -| Kubernetes v1.17, v1.18, & v1.19 | CIS v1.5 | [Link]({{}}/k3s/latest/en/security/self_assessment/) | [Link]({{}}/k3s/latest/en/security/hardening_guide/) | - - -# Rancher with SELinux - -[Security-Enhanced Linux (SELinux)](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) is a security enhancement to Linux. After being historically used by government agencies, SELinux is now industry standard and is enabled by default on RHEL and CentOS. - -To use Rancher with SELinux, we recommend installing the `rancher-selinux` RPM according to the instructions on [this page.]({{}}/rancher/v2.6/en/security/selinux/#installing-the-rancher-selinux-rpm) +Rancher v2.6 hardening guides are currently being updated. For the time being, please consult [Rancher v2.5 self-assessment and hardening guides]({{}}/rancher/v2.5/en/security/rancher-2.5) for more information. diff --git a/content/rancher/v2.6/en/virtualization-admin/_index.md b/content/rancher/v2.6/en/virtualization-admin/_index.md index 19c517f7c3d..f37ffb8b951 100644 --- a/content/rancher/v2.6/en/virtualization-admin/_index.md +++ b/content/rancher/v2.6/en/virtualization-admin/_index.md @@ -25,8 +25,6 @@ To navigate to the Harvester cluster, click **☰ > Virtualization Management**. The [Harvester node driver](https://docs.harvesterhci.io/v0.3/rancher/node-driver/) is marked as `tech preview` on RKE and RKE2 options in Rancher. This will be the case both on the Create page and once the driver is already enabled. The node driver is available whether or not the Harvester feature flag is enabled. Note that the node driver is off by default. Users may create RKE or RKE2 clusters on Harvester only from the Cluster Management page. -Harvester allows `.ISO` images to be uploaded and displayed through the Harvester UI, but this is not supported in the Rancher UI. This is because `.ISO` images usually require additional setup that interferes with a clean deployment (without requiring user intervention), and they are not typically used in cloud environments. - Click [here]({{}}/rancher/v2.6/en/admin-settings/drivers/#node-drivers) for more information on node drivers in Rancher. ### Limitations diff --git a/scripts/converters/css/style-portrait.css b/scripts/converters/css/style-portrait.css index ab19e788e28..e6bcd2303ef 100644 --- a/scripts/converters/css/style-portrait.css +++ b/scripts/converters/css/style-portrait.css @@ -238,7 +238,7 @@ h2 { font-size:1.5em; } -h3 {font-size:1.2em;} +h3 {font-size:1.4em;} h4 {font-size:1.3em; line-height:30px; } @@ -283,7 +283,7 @@ nav ul li a { nav ul li a::after {content: target-counter(attr(href url), page, decimal); float:right;margin-right:10px;} nav ul li ul {list-style-type: none; border-left-style: dashed; border-left-width: 1px; border-color: #000; margin-top:1.5em;} nav ul li ul li {margin-left:-.5em;color:#ff0000;} -nav ul li ul li a {border:none;font-family:PoppinsExtraLight;font-size:.75em;margin-bottom:1.8em;} +nav ul li ul li a {border:none;font-family:PoppinsExtraLight;margin-top:-1.5em;} nav ul li ul li a::after {font-size:.75em;} nav code {background:none;} nav a{text-decoration:none;outline:none;color:#000;} diff --git a/scripts/converters/scripts/results_to_md.sh b/scripts/converters/scripts/results_to_md.sh index a7d5d473313..6e087588c3f 100755 --- a/scripts/converters/scripts/results_to_md.sh +++ b/scripts/converters/scripts/results_to_md.sh @@ -19,7 +19,7 @@ get_id_text() { get_section_ids() { id=${1} - jq -r --arg id "${id}" '.[] | select(.id==$id) | .checks[].id' ${results_file} | sort -V + jq -r --arg id "${id}" '.[] | select(.id==$id) | .checks[].id' ${results_file} } get_section_desc() { @@ -53,11 +53,12 @@ for id in $(get_ids); do test_desc=$(echo ${result} | jq -r '.description') audit=$(echo ${result} | jq -r '.audit') audit_config=$(echo ${result} | jq -r '.audit_config') - actual_value=$(echo ${result} | jq -r '.actual_value_per_node[]') + actual_value=$(echo ${result} | jq -r '.actual_value_per_node."cis-aio-0"') type=$(echo ${result} | jq -r '.test_type') status=$(echo ${result} | jq -r '.state') remediation=$(echo ${result} | jq -r '.remediation') expected_result=$(echo ${result} | jq -r '.expected_result') +# echo "#### ${test} ${test_desc}" echo if [ "${type}" = "skip" ]; then echo "**Result:** Not Applicable" @@ -75,7 +76,7 @@ for id in $(get_ids); do if [[ ${audit} =~ ".sh" ]]; then audit_script=$(basename $(echo ${audit} | cut -d ' ' -f1)) test_helper="${test_helpers}/${audit_script}" - echo "**Audit Script:** \`${audit_script}\`" + echo "**Audit Script:** ${audit_script}" echo echo '```bash' cat ${test_helper} @@ -105,14 +106,6 @@ for id in $(get_ids); do echo '```' echo fi - if [ ! -z "${expected_result}" ]; then - echo "**Expected Result**:" - echo - echo '```console' - echo ${expected_result} - echo '```' - echo - fi if [ ! -z "${actual_value}" ] && [ "${status}" != "PASS" ] && [ "${type}" != "skip" ] && [ "${type}" != "manual" ]; then echo "**Returned Value**:" echo @@ -121,6 +114,14 @@ for id in $(get_ids); do echo '```' echo fi + if [ ! -z "${expected_result}" ]; then + echo "**Expected result**:" + echo + echo '```console' + echo ${expected_result} + echo '```' + echo + fi done done done From 7a7fa47547931d65636e2fb90331ba072eb1112c Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Mon, 4 Apr 2022 17:19:35 -0700 Subject: [PATCH 380/478] Revert "Revert "Staging to master" due to rendering problems" --- Dockerfile.dev | 2 +- Dockerfile.prod | 2 +- Dockerfile.staging | 2 +- config.toml | 2 +- .../pod-security-policies/_index.md | 29 +- .../rbac/cluster-project-roles/_index.md | 18 +- content/rancher/v2.6/en/api/_index.md | 17 +- .../en/backups/restoring-rancher/_index.md | 9 + .../en/faq/networking/cni-providers/_index.md | 6 + content/rancher/v2.6/en/helm-charts/_index.md | 3 +- .../install-rancher-on-k8s/_index.md | 8 +- .../install-rancher-on-k8s/upgrades/_index.md | 8 +- .../air-gap/install-rancher/_index.md | 8 +- .../populate-private-registry/_index.md | 4 +- .../behind-proxy/install-rancher/_index.md | 6 +- .../upgrading-cert-manager/_index.md | 9 +- content/rancher/v2.6/en/security/_index.md | 2 +- ...her_v2-6_CIS_v1-6_Benchmark_Assessment.pdf | 14832 ++++++++++++++++ .../1.6-benchmark-2.6/_index.md | 3098 ++++ .../Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf | 8259 +++++++++ .../1.6-hardening-2.6/_index.md | 641 + .../en/security/hardening-guides/_index.md | 56 +- .../v2.6/en/virtualization-admin/_index.md | 2 + scripts/converters/css/style-portrait.css | 4 +- scripts/converters/scripts/results_to_md.sh | 23 +- 25 files changed, 26998 insertions(+), 52 deletions(-) create mode 100644 content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf create mode 100644 content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/_index.md create mode 100644 content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf create mode 100644 content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md diff --git a/Dockerfile.dev b/Dockerfile.dev index af34fcf57dc..53225113ca0 100644 --- a/Dockerfile.dev +++ b/Dockerfile.dev @@ -10,4 +10,4 @@ RUN mkdir -p /output /theme/rancher-website-theme && tar -xzf /run/master.tar.gz # Expose default hugo port EXPOSE 9001 -ENTRYPOINT ["hugo", "serve", "--bind=0.0.0.0", "--buildDrafts", "--buildFuture", "--baseURL=" ] +ENTRYPOINT ["hugo", "serve", "--bind=0.0.0.0", "--buildDrafts", "--buildFuture" ] diff --git a/Dockerfile.prod b/Dockerfile.prod index 38ba46de614..0a0511d279c 100644 --- a/Dockerfile.prod +++ b/Dockerfile.prod @@ -16,7 +16,7 @@ COPY .git .git ADD https://github.com/rancherlabs/website-theme/archive/master.tar.gz /run/master.tar.gz RUN mkdir -p /output /theme/rancher-website-theme && tar -xzf /run/master.tar.gz -C /run/node_modules/rancher-website-theme --strip=1 && rm /run/master.tar.gz -RUN ["hugo", "--buildFuture", "--baseURL=https://rancher.com/docs", "--destination=/output"] +RUN ["hugo", "--buildFuture", "--destination=/output"] # Make sure something got built RUN stat /output/index.html diff --git a/Dockerfile.staging b/Dockerfile.staging index 5dc30768635..ea6ea487cfb 100644 --- a/Dockerfile.staging +++ b/Dockerfile.staging @@ -16,7 +16,7 @@ COPY .git .git ADD https://github.com/rancherlabs/website-theme/archive/master.tar.gz /run/master.tar.gz RUN mkdir -p /output /theme/rancher-website-theme && tar -xzf /run/master.tar.gz -C /run/node_modules/rancher-website-theme --strip=1 && rm /run/master.tar.gz -RUN ["hugo", "--buildDrafts", "--buildFuture", "--baseURL=https://staging.rancher.com/docs", "--destination=/output"] +RUN ["hugo", "--buildDrafts", "--buildFuture", "--destination=/output"] # Make sure something got built RUN stat /output/index.html diff --git a/config.toml b/config.toml index 35fdfda6e03..de5a060aead 100644 --- a/config.toml +++ b/config.toml @@ -1,4 +1,4 @@ -baseURL = "" +baseURL = ".Permalink" languageCode = "en-us" title = "Rancher Labs" diff --git a/content/rancher/v2.6/en/admin-settings/pod-security-policies/_index.md b/content/rancher/v2.6/en/admin-settings/pod-security-policies/_index.md index 2e0d6d70fc3..9244102623d 100644 --- a/content/rancher/v2.6/en/admin-settings/pod-security-policies/_index.md +++ b/content/rancher/v2.6/en/admin-settings/pod-security-policies/_index.md @@ -9,6 +9,7 @@ If a pod does not meet the conditions specified in the PSP, Kubernetes will not - [How PSPs Work](#how-psps-work) - [Default PSPs](#default-psps) + - [Restricted-NoRoot](#restricted-noroot) - [Restricted](#restricted) - [Unrestricted](#unrestricted) - [Creating PSPs](#creating-psps) @@ -28,18 +29,22 @@ PSPs work through inheritance: Any workloads that are already running in a cluster or project before a PSP is assigned will not be checked if it complies with the PSP. Workloads would need to be cloned or upgraded to see if they pass the PSP. -Read more about Pod Security Policies in the [Kubernetes Documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/). +Read more about Pod Security Policies in the [Kubernetes documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/). # Default PSPs -Rancher ships with two default Pod Security Policies (PSPs): the `restricted` and `unrestricted` policies. +Rancher ships with three default Pod Security Policies (PSPs): the `restricted-noroot`, `restricted` and `unrestricted` policies. -### Restricted +### Restricted-NoRoot This policy is based on the Kubernetes [example restricted policy](https://raw.githubusercontent.com/kubernetes/website/master/content/en/examples/policy/restricted-psp.yaml). It significantly restricts what types of pods can be deployed to a cluster or project. This policy: - Prevents pods from running as a privileged user and prevents escalation of privileges. -- Validates that server-required security mechanisms are in place (such as restricting what volumes can be mounted to only the core volume types and preventing root supplemental groups from being added. +- Validates that server-required security mechanisms are in place, such as restricting what volumes can be mounted to only the core volume types and preventing root supplemental groups from being added. + +### Restricted + +This policy is a relaxed version of the `restricted-noroot` policy, with almost all the restrictions in place, except for the fact that it allows running containers as a privileged user. ### Unrestricted @@ -51,9 +56,9 @@ Using Rancher, you can create a Pod Security Policy using our GUI rather than cr ### Requirements -Rancher can only assign PSPs for clusters that are [launched using RKE.]({{< baseurl >}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/) +Rancher can only assign PSPs for clusters that are [launched using RKE]({{< baseurl >}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/). -You must enable PSPs at the cluster level before you can assign them to a project. This can be configured by [editing the cluster.]({{}}/rancher/v2.6/en/cluster-admin/editing-clusters/) +You must enable PSPs at the cluster level before you can assign them to a project. This can be configured by [editing the cluster]({{}}/rancher/v2.6/en/cluster-admin/editing-clusters/). It is a best practice to set PSP at the cluster level. @@ -63,19 +68,11 @@ We recommend adding PSPs during cluster and project creation instead of adding i 1. In the upper left corner, click **☰ > Cluster Management**. 1. In the left navigation bar, click **Pod Security Policies**. -1. Click **Add policy**. +1. Click **Add Policy**. 1. Name the policy. 1. Complete each section of the form. Refer to the [Kubernetes documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) for more information on what each policy does. 1. Click **Create**. # Configuration -The Kubernetes documentation on PSPs is [here.](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) - - - - - -[1]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems -[2]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces -[3]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#users-and-groups +The Kubernetes documentation on PSPs is [here](https://kubernetes.io/docs/concepts/policy/pod-security-policy/). diff --git a/content/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/_index.md b/content/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/_index.md index 022b08762ce..c2767b8a66f 100644 --- a/content/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/_index.md +++ b/content/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/_index.md @@ -5,7 +5,7 @@ weight: 1127 Cluster and project roles define user authorization inside a cluster or project. -To manage these roles, +To manage these roles, 1. Click **☰ > Users & Authentication**. 1. In the left navigation bar, click **Roles** and go to the **Cluster** or **Project/Namespaces** tab. @@ -60,8 +60,8 @@ The following table lists the permissions available for the `Manage Nodes` role | SSH Access | ✓ | ✓ | | Delete Nodes | ✓ | ✓ | | Scale Clusters Up and Down | ✓ | * | -***In RKE2, you must have permission to edit a cluster to be able to scale clusters up and down.** -
      +***In RKE2, you must have permission to edit a cluster to be able to scale clusters up and down.** +
      For details on how each cluster role can access Kubernetes resources, you can look them up in the Rancher UI: @@ -81,12 +81,24 @@ To assign a custom role to a new cluster member, you can use the Rancher UI. To To assign the role to a new cluster member, +{{% tabs %}} +{{% tab "Rancher before v2.6.4" %}} 1. Click **☰ > Cluster Management**. 1. Go to the cluster where you want to assign a role to a member and click **Explore**. 1. Click **RBAC > Cluster Members**. 1. Click **Add**. 1. In the **Cluster Permissions** section, choose the custom cluster role that should be assigned to the member. 1. Click **Create**. +{{% /tab %}} +{{% tab "Rancher v2.6.4+" %}} +1. Click **☰ > Cluster Management**. +1. Go to the cluster where you want to assign a role to a member and click **Explore**. +1. Click **Cluster > Cluster Members**. +1. Click **Add**. +1. In the **Cluster Permissions** section, choose the custom cluster role that should be assigned to the member. +1. Click **Create**. +{{% /tab %}} +{{% /tabs %}} **Result:** The member has the assigned role. diff --git a/content/rancher/v2.6/en/api/_index.md b/content/rancher/v2.6/en/api/_index.md index a4b56bd9478..d1cc9cc4454 100644 --- a/content/rancher/v2.6/en/api/_index.md +++ b/content/rancher/v2.6/en/api/_index.md @@ -5,7 +5,22 @@ weight: 24 ## How to use the API -The API has its own user interface accessible from a web browser. This is an easy way to see resources, perform actions, and see the equivalent cURL or HTTP request & response. To access it, click on your user avatar in the upper right corner. Under **API & Keys**, you can find the URL endpoint (`https:///v3`) as well as create [API keys]({{}}/rancher/v2.6/en/user-settings/api-keys/). +The API has its own user interface accessible from a web browser. This is an easy way to see resources, perform actions, and see the equivalent cURL or HTTP request & response. To access it: + +{{% tabs %}} +{{% tab "Rancher v2.6.4+" %}} + +1. Click on your user avatar in the upper right corner. +1. Click **Account & API Keys**. +1. Under the **API Keys** section, find the **API Endpoint** field and click the link. The link will look something like `https:///v3`, where `` is the fully qualified domain name of your Rancher deployment. + +{{% /tab %}} +{{% tab "Rancher before v2.6.4" %}} + +Go to the URL endpoint at `https:///v3`, where `` is the fully qualified domain name of your Rancher deployment. + +{{% /tab %}} +{{% /tabs %}} ## Authentication diff --git a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md index 1f20f311720..468b179d348 100644 --- a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md @@ -5,6 +5,15 @@ weight: 2 A restore is performed by creating a Restore custom resource. +--- +**Caution:** Before performing a restore or rollback, note the following: + +- In Rancher v2.6.4, the cluster-api module has been upgraded from v0.4.4 to v1.0.2 in which the apiVersion of CAPI CRDs are upgraded from `cluster.x-k8s.io/v1alpha4` to `cluster.x-k8s.io/v1beta1`. This has the effect of causing rollbacks from Rancher v2.6.4 to any previous version of Rancher v2.6.x to fail because the previous version the CRDs needed to roll back are no longer available in v1beta1. + +- To avoid this, the Rancher resource cleanup scripts should be run **before** the restore or rollback is attempted. Specifically, two scripts have been created to assist you: one to clean up the cluster (`cleanup.sh`), and one to check for any Rancher-related resources in the cluster (`verify.sh`). Details on the cleanup script can be found in the [rancherlabs/support-tools repo](https://github.com/rancherlabs/support-tools/tree/master/cleanup-rancher-k8s-resources). + +--- + > **Important** > > * Follow the instructions from this page for restoring rancher on the same cluster where it was backed up from. In order to migrate rancher to a new cluster, follow the steps to [migrate rancher.]({{}}/rancher/v2.6/en/backups/migrating-rancher) diff --git a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md index cb8fdb4b278..ea4bbde4872 100644 --- a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md +++ b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md @@ -109,6 +109,12 @@ Calico also provides a stateless IP-in-IP or VXLAN encapsulation mode that can b Kubernetes workers should open TCP port `179` if using BGP or UDP port `4789` if using VXLAN encapsulation. In addition, TCP port `5473` is needed when using Typha. See [the port requirements for user clusters]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/#networking-requirements) for more details. +>**Important:** In Rancher v2.6.3, Calico probes fail on Windows nodes upon RKE2 installation. Note that this issue is resolved in v2.6.4. +> +>- To work around this issue, first navigate to `https:///v3/settings/windows-rke2-install-script`. +> +>- There, change the current setting: `https://raw.githubusercontent.com/rancher/wins/v0.1.3/install.ps1` to this new setting: `https://raw.githubusercontent.com/rancher/rke2/master/windows/rke2-install.ps1`. + ![Calico Diagram]({{}}/img/rancher/calico-diagram.svg) For more information, see the following pages: diff --git a/content/rancher/v2.6/en/helm-charts/_index.md b/content/rancher/v2.6/en/helm-charts/_index.md index b5313d0bd54..d225e2f5854 100644 --- a/content/rancher/v2.6/en/helm-charts/_index.md +++ b/content/rancher/v2.6/en/helm-charts/_index.md @@ -74,7 +74,8 @@ To add a private CA for Helm Chart repositories: [...] ``` -- **Git-based chart repositories**: You must add a base64 encoded copy of the CA certificate in DER format to the spec.caBundle field of the chart repo, such as `openssl x509 -outform der -in ca.pem | base64 -w0`. Click **Edit YAML** for the chart repo and set, as in the following example:
      + +- **Git-based chart repositories**: It is not currently possible to add a private CA. For git-based chart repositories with a certificate signed by a private CA, you must disable TLS verification. Click **Edit YAML** for the chart repo and add the key/value pair as follows: ``` [...] spec: diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md index 5776af8f778..5d97210cc95 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md @@ -104,6 +104,10 @@ There are three recommended options for the source of the certificate used for T ### 4. Install cert-manager +**Note:** New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. + +> You should skip this step if you are bringing your own certificate files (option `ingress.tls.source=secret`), or if you use [TLS termination on an external load balancer]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/#external-tls-termination). + > You should skip this step if you are bringing your own certificate files (option `ingress.tls.source=secret`), or if you use [TLS termination on an external load balancer]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/#external-tls-termination). This step is only required to use certificates issued by Rancher's generated CA (`ingress.tls.source=rancher`) or to request Let's Encrypt issued certificates (`ingress.tls.source=letsEncrypt`). @@ -116,7 +120,7 @@ These instructions are adapted from the [official cert-manager documentation](ht ``` # If you have installed the CRDs manually instead of with the `--set installCRDs=true` option added to your Helm install command, you should upgrade your CRD resources before upgrading the Helm chart: -kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.5.1/cert-manager.crds.yaml +kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.7.1/cert-manager.crds.yaml # Add the Jetstack Helm repository helm repo add jetstack https://charts.jetstack.io @@ -128,7 +132,7 @@ helm repo update helm install cert-manager jetstack/cert-manager \ --namespace cert-manager \ --create-namespace \ - --version v1.5.1 + --version v1.7.1 ``` Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the cert-manager namespace for running pods: diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md index 5c25a7f24b8..cfe481e2b94 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md @@ -148,7 +148,13 @@ helm upgrade rancher rancher-/rancher \ ### Option B: Reinstalling Rancher and cert-manager -If you are currently running the cert-manager whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, then you need to reinstall both Rancher and cert-manager due to the API change in cert-manager v0.11. +If you are currently running the cert-manager whose version is 1.5 or below, and want to upgrade both Rancher and cert-manager to a new version (1.6+ in the case of cert-manager), then you need to re-install both Rancher and cert-manager due to the API change in cert-manager 1.6. This will also be necessary if you are upgrading from a version of cert manager below 0.11 to a version of cert-manager above 0.11. + +>**Important:** +> +>- New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. +> +>- Note that if you are below version 1.5 and want to go to 1.7, you should first upgrade to 1.6 as an intermediate step. Follow the cert-manager docs [here](https://cert-manager.io/docs/installation/upgrading/upgrading-1.5-1.6/) to do a 1.5 to 1.6 upgrade, and [here](https://cert-manager.io/docs/installation/upgrading/upgrading-1.6-1.7/) to then do a 1.6 to 1.7 upgrade. For more details on upgrading cert-manager, refer to our [documentation]({{}}/rancher/v2.6/en/installation/resources/upgrading-cert-manager). 1. Uninstall Rancher diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/install-rancher/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/install-rancher/_index.md index 8f15d855e8e..a739fd07987 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/install-rancher/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/install-rancher/_index.md @@ -94,8 +94,10 @@ helm repo update Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager). +**Note:** New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. + ```plain -helm fetch jetstack/cert-manager --version v1.5.1 +helm fetch jetstack/cert-manager --version v1.7.1 ``` ### 3. Render the cert-manager template @@ -103,7 +105,7 @@ helm fetch jetstack/cert-manager --version v1.5.1 Render the cert-manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files. ```plain -helm template cert-manager ./cert-manager-v1.5.1.tgz --output-dir . \ +helm template cert-manager ./cert-manager-v1.7.1.tgz --output-dir . \ --namespace cert-manager \ --set image.repository=/quay.io/jetstack/cert-manager-controller \ --set webhook.image.repository=/quay.io/jetstack/cert-manager-webhook \ @@ -115,7 +117,7 @@ helm template cert-manager ./cert-manager-v1.5.1.tgz --output-dir . \ Download the required CRD file for cert-manager: ```plain - curl -L -o cert-manager/cert-manager-crd.yaml https://github.com/jetstack/cert-manager/releases/download/v1.5.1/cert-manager.crds.yaml + curl -L -o cert-manager/cert-manager-crd.yaml https://github.com/jetstack/cert-manager/releases/download/v1.7.1/cert-manager.crds.yaml ``` ### 5. Render the Rancher template diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md index 05b260b3aa5..18c8817f76f 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md @@ -51,6 +51,8 @@ If you will use ARM64 hosts, the registry must support manifests. As of April 20 In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS certificates, you must add the [`cert-manager`](https://hub.helm.sh/charts/jetstack/cert-manager) image to `rancher-images.txt` as well. +**Note:** New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. + 1. Fetch the latest `cert-manager` Helm chart and parse the template for image details: > **Note:** Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.12.0, please see our [upgrade documentation]({{}}/rancher/v2.6/en/installation/resources/upgrading-cert-manager/). @@ -58,7 +60,7 @@ In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS ```plain helm repo add jetstack https://charts.jetstack.io helm repo update - helm fetch jetstack/cert-manager --version v1.5.1 + helm fetch jetstack/cert-manager --version v1.7.1 helm template ./cert-manager-.tgz | awk '$1 ~ /image:/ {print $2}' | sed s/\"//g >> ./rancher-images.txt ``` diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md index 35ceaf1b26a..a5a57c7b6ae 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md @@ -23,15 +23,17 @@ kubectl create namespace cert-manager Install the CustomResourceDefinitions of cert-manager: +**Note:** New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. + ``` -kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.5.1/cert-manager.crds.yaml +kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.7.1/cert-manager.crds.yaml ``` And install it with Helm. Note that cert-manager also needs your proxy configured in case it needs to communicate with Let's Encrypt or other external certificate issuers: ``` helm upgrade --install cert-manager jetstack/cert-manager \ - --namespace cert-manager --version v1.5.1 \ + --namespace cert-manager --version v1.7.1 \ --set http_proxy=http://${proxy_host} \ --set https_proxy=http://${proxy_host} \ --set no_proxy=127.0.0.0/8\\,10.0.0.0/8\\,cattle-system.svc\\,172.16.0.0/12\\,192.168.0.0/16\\,.svc\\,.cluster.local diff --git a/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md b/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md index 3879ab15d1f..f3b21f8aed0 100644 --- a/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md +++ b/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md @@ -15,7 +15,7 @@ To address these changes, this guide will do two things: 1. Explain the cert-manager API changes and link to cert-manager's official documentation for migrating your data > **Important:** -> If you are currently running the cert-manager whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, you need to reinstall both of them: +> If you are currently running the cert-manager whose version is 1.5 or below, and want to upgrade both Rancher and cert-manager to a new version (1.6+ in the case of cert-manager), then you need to re-install both Rancher and cert-manager due to the API change in cert-manager 1.6. This will also be necessary if you are upgrading from a version of cert manager below 0.11 to a version of cert-manager above 0.11. Follow the steps below: > 1. Take a one-time snapshot of your Kubernetes cluster running Rancher server > 2. Uninstall Rancher, cert-manager, and the CustomResourceDefinition for cert-manager @@ -220,6 +220,13 @@ cert-manager-webhook-787858fcdb-nlzsq 1/1 Running 0 2m ## Cert-Manager API change and data migration +--- +_New in v2.6.4_ + +Rancher now supports cert-manager versions 1.6.2 and 1.7.1. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. To read more, see the [cert-manager docs]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/#4-install-cert-manager). For instructions on upgrading cert-manager from version 1.5 to 1.6, see the upstream cert-manager documentation [here](https://cert-manager.io/docs/installation/upgrading/upgrading-1.5-1.6/). For instructions on upgrading cert-manager from version 1.6 to 1.7, see the upstream cert-manager documentation [here](https://cert-manager.io/docs/installation/upgrading/upgrading-1.6-1.7/). + +--- + Cert-manager has deprecated the use of the `certificate.spec.acme.solvers` field and will drop support for it completely in an upcoming release. Per the cert-manager documentation, a new format for configuring ACME certificate resources was introduced in v0.8. Specifically, the challenge solver configuration field was moved. Both the old format and new are supported as of v0.9, but support for the old format will be dropped in an upcoming release of cert-manager. The cert-manager documentation strongly recommends that after upgrading you update your ACME Issuer and Certificate resources to the new format. diff --git a/content/rancher/v2.6/en/security/_index.md b/content/rancher/v2.6/en/security/_index.md index 1f121f11ed2..0cd5e3dcaf4 100644 --- a/content/rancher/v2.6/en/security/_index.md +++ b/content/rancher/v2.6/en/security/_index.md @@ -11,7 +11,7 @@ weight: 20

      Reporting process

      -       +

      Please submit possible security issues by emailing security-rancher@suse.com .

      Announcements

      diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf b/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf new file mode 100644 index 00000000000..f08210f51e6 --- /dev/null +++ b/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf @@ -0,0 +1,14832 @@ +%PDF-1.7 +%🖤 +1 0 obj +<< +/Type /Pages +/Kids [ 6 0 R 8 0 R 38 0 R 76 0 R 114 0 R 152 0 R 186 0 R 222 0 R 258 0 R 292 0 R 304 0 R 309 0 R 313 0 R 315 0 R 318 0 R 323 0 R 325 0 R 349 0 R 374 0 R 407 0 R 440 0 R 464 0 R 503 0 R 508 0 R 511 0 R 514 0 R 516 0 R 519 0 R 521 0 R 524 0 R 527 0 R 529 0 R 532 0 R 534 0 R 537 0 R 540 0 R 542 0 R 545 0 R 548 0 R 550 0 R 553 0 R 555 0 R 559 0 R 562 0 R 565 0 R 567 0 R 570 0 R 572 0 R 575 0 R 578 0 R 580 0 R 583 0 R 586 0 R 588 0 R 591 0 R 593 0 R 596 0 R 599 0 R 601 0 R 604 0 R 607 0 R 609 0 R 612 0 R 614 0 R 617 0 R 620 0 R 622 0 R 625 0 R 627 0 R 630 0 R 633 0 R 635 0 R 638 0 R 641 0 R 643 0 R 660 0 R 674 0 R 677 0 R 680 0 R 683 0 R 686 0 R 689 0 R 692 0 R 694 0 R 698 0 R 700 0 R 703 0 R 705 0 R 708 0 R 710 0 R 713 0 R 715 0 R 717 0 R 720 0 R 722 0 R 725 0 R 727 0 R 730 0 R 732 0 R 734 0 R 737 0 R 739 0 R 741 0 R 743 0 R 746 0 R 748 0 R 751 0 R 755 0 R 764 0 R 772 0 R 774 0 R 779 0 R 784 0 R 790 0 R 794 0 R 798 0 R 804 0 R 808 0 R 812 0 R 815 0 R 817 0 R 842 0 R 853 0 R 856 0 R 860 0 R 863 0 R 880 0 R 887 0 R 889 0 R 891 0 R 893 0 R ] +/Count 131 +>> +endobj +2 0 obj +<< +/Title (CIS v1.6 Benchmark - Self-Assessment Guide - Rancher v2.6) +/Creator (pandoc) +/Producer (WeasyPrint 54.2) +>> +endobj +3 0 obj +<< +/Type /Catalog +/Pages 1 0 R +/Outlines 1055 0 R +/Names << +/Dests << +/Names [ (TOC) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (api-server) [ 508 0 R /XYZ 41.740157 784.430079 0 ] (apply-security-context-to-your-pods-and-containers-manual) [ 891 0 R /XYZ 84.259843 324.051496 0 ] (authentication-and-authorization) [ 741 0 R /XYZ 41.740157 784.430079 0 ] (cb1) [ 315 0 R /XYZ 84.259843 207.170079 0 ] (cb1-1) [ 315 0 R /XYZ 101.433071 205.473057 0 ] (cb10) [ 349 0 R /XYZ 84.259843 342.035606 0 ] (cb10-1) [ 349 0 R /XYZ 101.433071 340.338585 0 ] (cb101) [ 622 0 R /XYZ 84.259843 504.320079 0 ] (cb101-1) [ 622 0 R /XYZ 101.433071 502.623057 0 ] (cb104) [ 627 0 R /XYZ 84.259843 772.370079 0 ] (cb104-1) [ 627 0 R /XYZ 101.433071 770.673057 0 ] (cb107) [ 630 0 R /XYZ 84.259843 313.070079 0 ] (cb107-1) [ 630 0 R /XYZ 101.433071 311.373057 0 ] (cb110) [ 635 0 R /XYZ 84.259843 560.570079 0 ] (cb110-1) [ 635 0 R /XYZ 101.433071 558.873057 0 ] (cb113) [ 638 0 R /XYZ 84.259843 110.570079 0 ] (cb113-1) [ 638 0 R /XYZ 101.433071 108.873057 0 ] (cb116) [ 643 0 R /XYZ 84.259843 418.070079 0 ] (cb116-1) [ 643 0 R /XYZ 101.433071 416.373057 0 ] (cb116-10) [ 643 0 R /XYZ 99.933071 189.008799 0 ] (cb116-11) [ 643 0 R /XYZ 99.933071 170.061778 0 ] (cb116-12) [ 643 0 R /XYZ 99.933071 151.114756 0 ] (cb116-13) [ 643 0 R /XYZ 99.933071 132.167735 0 ] (cb116-14) [ 643 0 R /XYZ 99.933071 113.220714 0 ] (cb116-15) [ 643 0 R /XYZ 99.933071 94.273692 0 ] (cb116-16) [ 660 0 R /XYZ 99.933071 799.173057 0 ] (cb116-17) [ 660 0 R /XYZ 99.933071 780.226036 0 ] (cb116-18) [ 660 0 R /XYZ 99.933071 761.279014 0 ] (cb116-19) [ 660 0 R /XYZ 99.933071 742.331993 0 ] (cb116-2) [ 643 0 R /XYZ 99.933071 397.426036 0 ] (cb116-20) [ 660 0 R /XYZ 99.933071 723.384971 0 ] (cb116-21) [ 660 0 R /XYZ 99.933071 704.437950 0 ] (cb116-22) [ 660 0 R /XYZ 99.933071 685.490928 0 ] (cb116-23) [ 660 0 R /XYZ 99.933071 666.543907 0 ] (cb116-24) [ 660 0 R /XYZ 99.933071 647.596885 0 ] (cb116-25) [ 660 0 R /XYZ 99.933071 628.649864 0 ] (cb116-3) [ 643 0 R /XYZ 99.933071 378.479014 0 ] (cb116-4) [ 643 0 R /XYZ 99.933071 340.584971 0 ] (cb116-5) [ 643 0 R /XYZ 99.933071 321.637950 0 ] (cb116-6) [ 643 0 R /XYZ 99.933071 302.690928 0 ] (cb116-7) [ 643 0 R /XYZ 99.933071 283.743907 0 ] (cb116-8) [ 643 0 R /XYZ 99.933071 264.796885 0 ] (cb116-9) [ 643 0 R /XYZ 99.933071 226.902842 0 ] (cb117) [ 660 0 R /XYZ 84.259843 569.399864 0 ] (cb117-1) [ 660 0 R /XYZ 101.433071 567.702842 0 ] (cb120) [ 660 0 R /XYZ 84.259843 196.152842 0 ] (cb120-1) [ 660 0 R /XYZ 101.433071 194.455821 0 ] (cb121) [ 674 0 R /XYZ 84.259843 550.251496 0 ] (cb121-1) [ 674 0 R /XYZ 101.433071 548.554475 0 ] (cb124) [ 677 0 R /XYZ 84.259843 571.820079 0 ] (cb124-1) [ 677 0 R /XYZ 101.433071 570.123057 0 ] (cb127) [ 680 0 R /XYZ 84.259843 575.570079 0 ] (cb127-1) [ 680 0 R /XYZ 101.433071 573.873057 0 ] (cb13) [ 374 0 R /XYZ 84.259843 711.620079 0 ] (cb13-1) [ 374 0 R /XYZ 101.433071 709.923057 0 ] (cb13-10) [ 374 0 R /XYZ 99.933071 501.505821 0 ] (cb13-11) [ 374 0 R /XYZ 99.933071 482.558799 0 ] (cb13-12) [ 374 0 R /XYZ 99.933071 463.611778 0 ] (cb13-13) [ 374 0 R /XYZ 99.933071 444.664756 0 ] (cb13-14) [ 374 0 R /XYZ 99.933071 425.717735 0 ] (cb13-15) [ 374 0 R /XYZ 99.933071 406.770714 0 ] (cb13-16) [ 374 0 R /XYZ 99.933071 387.823692 0 ] (cb13-17) [ 374 0 R /XYZ 99.933071 368.876671 0 ] (cb13-18) [ 374 0 R /XYZ 99.933071 349.929649 0 ] (cb13-19) [ 374 0 R /XYZ 99.933071 330.982628 0 ] (cb13-2) [ 374 0 R /XYZ 99.933071 690.976036 0 ] (cb13-20) [ 374 0 R /XYZ 99.933071 312.035606 0 ] (cb13-21) [ 374 0 R /XYZ 99.933071 293.088585 0 ] (cb13-22) [ 374 0 R /XYZ 99.933071 274.141563 0 ] (cb13-23) [ 374 0 R /XYZ 99.933071 255.194542 0 ] (cb13-24) [ 374 0 R /XYZ 99.933071 236.247520 0 ] (cb13-25) [ 374 0 R /XYZ 99.933071 217.300499 0 ] (cb13-26) [ 374 0 R /XYZ 99.933071 198.353477 0 ] (cb13-27) [ 374 0 R /XYZ 99.933071 179.406456 0 ] (cb13-28) [ 374 0 R /XYZ 99.933071 160.459434 0 ] (cb13-29) [ 374 0 R /XYZ 99.933071 141.512413 0 ] (cb13-3) [ 374 0 R /XYZ 99.933071 672.029014 0 ] (cb13-30) [ 374 0 R /XYZ 99.933071 122.565391 0 ] (cb13-31) [ 374 0 R /XYZ 99.933071 103.618370 0 ] (cb13-32) [ 407 0 R /XYZ 99.933071 799.173057 0 ] (cb13-33) [ 407 0 R /XYZ 99.933071 780.226036 0 ] (cb13-34) [ 407 0 R /XYZ 99.933071 761.279014 0 ] (cb13-35) [ 407 0 R /XYZ 99.933071 742.331993 0 ] (cb13-36) [ 407 0 R /XYZ 99.933071 723.384971 0 ] (cb13-37) [ 407 0 R /XYZ 99.933071 704.437950 0 ] (cb13-38) [ 407 0 R /XYZ 99.933071 685.490928 0 ] (cb13-39) [ 407 0 R /XYZ 99.933071 666.543907 0 ] (cb13-4) [ 374 0 R /XYZ 99.933071 634.134971 0 ] (cb13-40) [ 407 0 R /XYZ 99.933071 647.596885 0 ] (cb13-41) [ 407 0 R /XYZ 99.933071 628.649864 0 ] (cb13-42) [ 407 0 R /XYZ 99.933071 609.702842 0 ] (cb13-43) [ 407 0 R /XYZ 99.933071 590.755821 0 ] (cb13-44) [ 407 0 R /XYZ 99.933071 571.808799 0 ] (cb13-45) [ 407 0 R /XYZ 99.933071 552.861778 0 ] (cb13-46) [ 407 0 R /XYZ 99.933071 533.914756 0 ] (cb13-47) [ 407 0 R /XYZ 99.933071 514.967735 0 ] (cb13-48) [ 407 0 R /XYZ 99.933071 496.020714 0 ] (cb13-49) [ 407 0 R /XYZ 99.933071 477.073692 0 ] (cb13-5) [ 374 0 R /XYZ 99.933071 596.240928 0 ] (cb13-50) [ 407 0 R /XYZ 99.933071 458.126671 0 ] (cb13-51) [ 407 0 R /XYZ 99.933071 439.179649 0 ] (cb13-52) [ 407 0 R /XYZ 99.933071 420.232628 0 ] (cb13-53) [ 407 0 R /XYZ 99.933071 382.338585 0 ] (cb13-54) [ 407 0 R /XYZ 99.933071 363.391563 0 ] (cb13-55) [ 407 0 R /XYZ 99.933071 344.444542 0 ] (cb13-56) [ 407 0 R /XYZ 99.933071 325.497520 0 ] (cb13-57) [ 407 0 R /XYZ 99.933071 306.550499 0 ] (cb13-58) [ 407 0 R /XYZ 99.933071 287.603477 0 ] (cb13-59) [ 407 0 R /XYZ 99.933071 268.656456 0 ] (cb13-6) [ 374 0 R /XYZ 99.933071 577.293907 0 ] (cb13-60) [ 407 0 R /XYZ 99.933071 249.709434 0 ] (cb13-61) [ 407 0 R /XYZ 99.933071 230.762413 0 ] (cb13-7) [ 374 0 R /XYZ 99.933071 558.346885 0 ] (cb13-8) [ 374 0 R /XYZ 99.933071 539.399864 0 ] (cb13-9) [ 374 0 R /XYZ 99.933071 520.452842 0 ] (cb130) [ 683 0 R /XYZ 84.259843 560.570079 0 ] (cb130-1) [ 683 0 R /XYZ 101.433071 558.873057 0 ] (cb133) [ 686 0 R /XYZ 84.259843 556.820079 0 ] (cb133-1) [ 686 0 R /XYZ 101.433071 555.123057 0 ] (cb136) [ 689 0 R /XYZ 84.259843 369.020079 0 ] (cb136-1) [ 689 0 R /XYZ 101.433071 367.323057 0 ] (cb139) [ 694 0 R /XYZ 84.259843 565.251496 0 ] (cb139-1) [ 694 0 R /XYZ 101.433071 563.554475 0 ] (cb14) [ 407 0 R /XYZ 84.259843 171.512413 0 ] (cb14-1) [ 407 0 R /XYZ 101.433071 169.815391 0 ] (cb142) [ 694 0 R /XYZ 84.259843 102.004475 0 ] (cb142-1) [ 694 0 R /XYZ 101.433071 100.307453 0 ] (cb145) [ 700 0 R /XYZ 84.259843 514.251496 0 ] (cb145-1) [ 700 0 R /XYZ 101.433071 512.554475 0 ] (cb148) [ 705 0 R /XYZ 84.259843 309.320079 0 ] (cb148-1) [ 705 0 R /XYZ 101.433071 307.623057 0 ] (cb151) [ 710 0 R /XYZ 84.259843 103.070079 0 ] (cb151-1) [ 710 0 R /XYZ 101.433071 101.373057 0 ] (cb154) [ 717 0 R /XYZ 84.259843 613.970079 0 ] (cb154-1) [ 717 0 R /XYZ 101.433071 612.273057 0 ] (cb157) [ 722 0 R /XYZ 84.259843 403.070079 0 ] (cb157-1) [ 722 0 R /XYZ 101.433071 401.373057 0 ] (cb160) [ 727 0 R /XYZ 84.259843 178.070079 0 ] (cb160-1) [ 727 0 R /XYZ 101.433071 176.373057 0 ] (cb163) [ 734 0 R /XYZ 84.259843 628.970079 0 ] (cb163-1) [ 734 0 R /XYZ 101.433071 627.273057 0 ] (cb166) [ 743 0 R /XYZ 84.259843 595.251496 0 ] (cb166-1) [ 743 0 R /XYZ 101.433071 593.554475 0 ] (cb169) [ 748 0 R /XYZ 84.259843 267.651496 0 ] (cb169-1) [ 748 0 R /XYZ 101.433071 265.954475 0 ] (cb17) [ 440 0 R /XYZ 84.259843 543.320079 0 ] (cb17-1) [ 440 0 R /XYZ 101.433071 541.623057 0 ] (cb17-10) [ 440 0 R /XYZ 99.933071 333.205821 0 ] (cb17-11) [ 440 0 R /XYZ 99.933071 314.258799 0 ] (cb17-12) [ 440 0 R /XYZ 99.933071 295.311778 0 ] (cb17-13) [ 440 0 R /XYZ 99.933071 276.364756 0 ] (cb17-14) [ 440 0 R /XYZ 99.933071 257.417735 0 ] (cb17-15) [ 440 0 R /XYZ 99.933071 238.470714 0 ] (cb17-16) [ 440 0 R /XYZ 99.933071 219.523692 0 ] (cb17-17) [ 440 0 R /XYZ 99.933071 200.576671 0 ] (cb17-18) [ 440 0 R /XYZ 99.933071 181.629649 0 ] (cb17-19) [ 440 0 R /XYZ 99.933071 162.682628 0 ] (cb17-2) [ 440 0 R /XYZ 99.933071 522.676036 0 ] (cb17-20) [ 440 0 R /XYZ 99.933071 143.735606 0 ] (cb17-21) [ 440 0 R /XYZ 99.933071 124.788585 0 ] (cb17-22) [ 440 0 R /XYZ 99.933071 105.841563 0 ] (cb17-23) [ 464 0 R /XYZ 99.933071 799.173057 0 ] (cb17-24) [ 464 0 R /XYZ 99.933071 780.226036 0 ] (cb17-25) [ 464 0 R /XYZ 99.933071 761.279014 0 ] (cb17-26) [ 464 0 R /XYZ 99.933071 742.331993 0 ] (cb17-27) [ 464 0 R /XYZ 99.933071 723.384971 0 ] (cb17-28) [ 464 0 R /XYZ 99.933071 704.437950 0 ] (cb17-29) [ 464 0 R /XYZ 99.933071 685.490928 0 ] (cb17-3) [ 440 0 R /XYZ 99.933071 503.729014 0 ] (cb17-30) [ 464 0 R /XYZ 99.933071 666.543907 0 ] (cb17-31) [ 464 0 R /XYZ 99.933071 647.596885 0 ] (cb17-32) [ 464 0 R /XYZ 99.933071 628.649864 0 ] (cb17-33) [ 464 0 R /XYZ 99.933071 609.702842 0 ] (cb17-34) [ 464 0 R /XYZ 99.933071 590.755821 0 ] (cb17-35) [ 464 0 R /XYZ 99.933071 571.808799 0 ] (cb17-36) [ 464 0 R /XYZ 99.933071 552.861778 0 ] (cb17-37) [ 464 0 R /XYZ 99.933071 533.914756 0 ] (cb17-38) [ 464 0 R /XYZ 99.933071 514.967735 0 ] (cb17-39) [ 464 0 R /XYZ 99.933071 496.020714 0 ] (cb17-4) [ 440 0 R /XYZ 99.933071 465.834971 0 ] (cb17-40) [ 464 0 R /XYZ 99.933071 477.073692 0 ] (cb17-41) [ 464 0 R /XYZ 99.933071 458.126671 0 ] (cb17-42) [ 464 0 R /XYZ 99.933071 439.179649 0 ] (cb17-43) [ 464 0 R /XYZ 99.933071 420.232628 0 ] (cb17-44) [ 464 0 R /XYZ 99.933071 401.285606 0 ] (cb17-45) [ 464 0 R /XYZ 99.933071 382.338585 0 ] (cb17-46) [ 464 0 R /XYZ 99.933071 363.391563 0 ] (cb17-47) [ 464 0 R /XYZ 99.933071 344.444542 0 ] (cb17-48) [ 464 0 R /XYZ 99.933071 325.497520 0 ] (cb17-49) [ 464 0 R /XYZ 99.933071 306.550499 0 ] (cb17-5) [ 440 0 R /XYZ 99.933071 427.940928 0 ] (cb17-50) [ 464 0 R /XYZ 99.933071 287.603477 0 ] (cb17-51) [ 464 0 R /XYZ 99.933071 268.656456 0 ] (cb17-52) [ 464 0 R /XYZ 99.933071 249.709434 0 ] (cb17-53) [ 464 0 R /XYZ 99.933071 211.815391 0 ] (cb17-54) [ 464 0 R /XYZ 99.933071 192.868370 0 ] (cb17-55) [ 464 0 R /XYZ 99.933071 173.921348 0 ] (cb17-56) [ 464 0 R /XYZ 99.933071 154.974327 0 ] (cb17-57) [ 464 0 R /XYZ 99.933071 136.027305 0 ] (cb17-58) [ 464 0 R /XYZ 99.933071 117.080284 0 ] (cb17-59) [ 464 0 R /XYZ 99.933071 98.133262 0 ] (cb17-6) [ 440 0 R /XYZ 99.933071 408.993907 0 ] (cb17-60) [ 503 0 R /XYZ 99.933071 799.173057 0 ] (cb17-61) [ 503 0 R /XYZ 99.933071 780.226036 0 ] (cb17-7) [ 440 0 R /XYZ 99.933071 390.046885 0 ] (cb17-8) [ 440 0 R /XYZ 99.933071 371.099864 0 ] (cb17-9) [ 440 0 R /XYZ 99.933071 352.152842 0 ] (cb172) [ 751 0 R /XYZ 84.259843 607.820079 0 ] (cb172-1) [ 751 0 R /XYZ 101.433071 606.123057 0 ] (cb174) [ 751 0 R /XYZ 84.259843 298.679014 0 ] (cb174-1) [ 751 0 R /XYZ 101.433071 296.981993 0 ] (cb176) [ 755 0 R /XYZ 84.259843 715.370079 0 ] (cb176-1) [ 755 0 R /XYZ 101.433071 713.673057 0 ] (cb179) [ 755 0 R /XYZ 84.259843 375.479014 0 ] (cb179-1) [ 755 0 R /XYZ 101.433071 373.781993 0 ] (cb179-2) [ 755 0 R /XYZ 99.933071 354.834971 0 ] (cb179-3) [ 755 0 R /XYZ 99.933071 335.887950 0 ] (cb179-4) [ 755 0 R /XYZ 99.933071 279.046885 0 ] (cb179-5) [ 755 0 R /XYZ 99.933071 260.099864 0 ] (cb18) [ 503 0 R /XYZ 84.259843 720.976036 0 ] (cb18-1) [ 503 0 R /XYZ 101.433071 719.279014 0 ] (cb180) [ 755 0 R /XYZ 84.259843 200.849864 0 ] (cb180-1) [ 755 0 R /XYZ 101.433071 199.152842 0 ] (cb182) [ 764 0 R /XYZ 84.259843 655.220079 0 ] (cb182-1) [ 764 0 R /XYZ 101.433071 653.523057 0 ] (cb182-2) [ 764 0 R /XYZ 99.933071 634.576036 0 ] (cb182-3) [ 764 0 R /XYZ 99.933071 615.629014 0 ] (cb182-4) [ 764 0 R /XYZ 99.933071 558.787950 0 ] (cb182-5) [ 764 0 R /XYZ 99.933071 539.840928 0 ] (cb183) [ 764 0 R /XYZ 84.259843 480.590928 0 ] (cb183-1) [ 764 0 R /XYZ 101.433071 478.893907 0 ] (cb185) [ 774 0 R /XYZ 84.259843 490.251496 0 ] (cb185-1) [ 774 0 R /XYZ 101.433071 488.554475 0 ] (cb186) [ 774 0 R /XYZ 84.259843 429.304475 0 ] (cb186-1) [ 774 0 R /XYZ 101.433071 427.607453 0 ] (cb188) [ 774 0 R /XYZ 84.259843 116.807453 0 ] (cb188-1) [ 774 0 R /XYZ 101.433071 115.110432 0 ] (cb189) [ 779 0 R /XYZ 84.259843 772.370079 0 ] (cb189-1) [ 779 0 R /XYZ 101.433071 770.673057 0 ] (cb191) [ 779 0 R /XYZ 84.259843 459.873057 0 ] (cb191-1) [ 779 0 R /XYZ 101.433071 458.176036 0 ] (cb192) [ 779 0 R /XYZ 84.259843 398.926036 0 ] (cb192-1) [ 779 0 R /XYZ 101.433071 397.229014 0 ] (cb194) [ 784 0 R /XYZ 84.259843 799.370079 0 ] (cb194-1) [ 784 0 R /XYZ 101.433071 797.673057 0 ] (cb195) [ 784 0 R /XYZ 84.259843 738.423057 0 ] (cb195-1) [ 784 0 R /XYZ 101.433071 736.726036 0 ] (cb197) [ 784 0 R /XYZ 84.259843 410.926036 0 ] (cb197-1) [ 784 0 R /XYZ 101.433071 409.229014 0 ] (cb198) [ 784 0 R /XYZ 84.259843 349.979014 0 ] (cb198-1) [ 784 0 R /XYZ 101.433071 348.281993 0 ] (cb2) [ 318 0 R /XYZ 84.259843 730.370079 0 ] (cb2-1) [ 318 0 R /XYZ 101.433071 728.673057 0 ] (cb201) [ 790 0 R /XYZ 84.259843 230.570079 0 ] (cb201-1) [ 790 0 R /XYZ 101.433071 228.873057 0 ] (cb202) [ 790 0 R /XYZ 84.259843 169.623057 0 ] (cb202-1) [ 790 0 R /XYZ 101.433071 167.926036 0 ] (cb204) [ 794 0 R /XYZ 84.259843 583.970079 0 ] (cb204-1) [ 794 0 R /XYZ 101.433071 582.273057 0 ] (cb205) [ 794 0 R /XYZ 84.259843 523.023057 0 ] (cb205-1) [ 794 0 R /XYZ 101.433071 521.326036 0 ] (cb207) [ 798 0 R /XYZ 84.259843 700.370079 0 ] (cb207-1) [ 798 0 R /XYZ 101.433071 698.673057 0 ] (cb208) [ 798 0 R /XYZ 84.259843 639.423057 0 ] (cb208-1) [ 798 0 R /XYZ 101.433071 637.726036 0 ] (cb21) [ 508 0 R /XYZ 84.259843 565.251496 0 ] (cb21-1) [ 508 0 R /XYZ 101.433071 563.554475 0 ] (cb210) [ 798 0 R /XYZ 84.259843 296.926036 0 ] (cb210-1) [ 798 0 R /XYZ 101.433071 295.229014 0 ] (cb211) [ 798 0 R /XYZ 84.259843 235.979014 0 ] (cb211-1) [ 798 0 R /XYZ 101.433071 234.281993 0 ] (cb213) [ 804 0 R /XYZ 84.259843 640.370079 0 ] (cb213-1) [ 804 0 R /XYZ 101.433071 638.673057 0 ] (cb214) [ 804 0 R /XYZ 84.259843 579.423057 0 ] (cb214-1) [ 804 0 R /XYZ 101.433071 577.726036 0 ] (cb217) [ 808 0 R /XYZ 84.259843 428.570079 0 ] (cb217-1) [ 808 0 R /XYZ 101.433071 426.873057 0 ] (cb218) [ 808 0 R /XYZ 84.259843 131.823057 0 ] (cb218-1) [ 808 0 R /XYZ 101.433071 130.126036 0 ] (cb219) [ 812 0 R /XYZ 84.259843 799.370079 0 ] (cb219-1) [ 812 0 R /XYZ 101.433071 797.673057 0 ] (cb221) [ 817 0 R /XYZ 84.259843 768.620079 0 ] (cb221-1) [ 817 0 R /XYZ 101.433071 766.923057 0 ] (cb221-10) [ 817 0 R /XYZ 99.933071 596.399864 0 ] (cb221-11) [ 817 0 R /XYZ 99.933071 577.452842 0 ] (cb221-12) [ 817 0 R /XYZ 99.933071 482.717735 0 ] (cb221-13) [ 817 0 R /XYZ 99.933071 463.770714 0 ] (cb221-14) [ 817 0 R /XYZ 99.933071 444.823692 0 ] (cb221-15) [ 817 0 R /XYZ 99.933071 425.876671 0 ] (cb221-16) [ 817 0 R /XYZ 99.933071 406.929649 0 ] (cb221-17) [ 817 0 R /XYZ 99.933071 387.982628 0 ] (cb221-18) [ 817 0 R /XYZ 99.933071 350.088585 0 ] (cb221-19) [ 817 0 R /XYZ 99.933071 331.141563 0 ] (cb221-2) [ 817 0 R /XYZ 99.933071 747.976036 0 ] (cb221-20) [ 817 0 R /XYZ 99.933071 198.512413 0 ] (cb221-21) [ 817 0 R /XYZ 99.933071 179.565391 0 ] (cb221-22) [ 817 0 R /XYZ 99.933071 160.618370 0 ] (cb221-23) [ 817 0 R /XYZ 99.933071 103.777305 0 ] (cb221-24) [ 842 0 R /XYZ 99.933071 799.173057 0 ] (cb221-25) [ 842 0 R /XYZ 99.933071 780.226036 0 ] (cb221-26) [ 842 0 R /XYZ 99.933071 761.279014 0 ] (cb221-27) [ 842 0 R /XYZ 99.933071 742.331993 0 ] (cb221-28) [ 842 0 R /XYZ 99.933071 723.384971 0 ] (cb221-29) [ 842 0 R /XYZ 99.933071 704.437950 0 ] (cb221-3) [ 817 0 R /XYZ 99.933071 729.029014 0 ] (cb221-30) [ 842 0 R /XYZ 99.933071 685.490928 0 ] (cb221-31) [ 842 0 R /XYZ 99.933071 666.543907 0 ] (cb221-4) [ 817 0 R /XYZ 99.933071 710.081993 0 ] (cb221-5) [ 817 0 R /XYZ 99.933071 691.134971 0 ] (cb221-6) [ 817 0 R /XYZ 99.933071 672.187950 0 ] (cb221-7) [ 817 0 R /XYZ 99.933071 653.240928 0 ] (cb221-8) [ 817 0 R /XYZ 99.933071 634.293907 0 ] (cb221-9) [ 817 0 R /XYZ 99.933071 615.346885 0 ] (cb222) [ 842 0 R /XYZ 84.259843 607.293907 0 ] (cb222-1) [ 842 0 R /XYZ 101.433071 605.596885 0 ] (cb225) [ 853 0 R /XYZ 84.259843 434.451496 0 ] (cb225-1) [ 853 0 R /XYZ 101.433071 432.754475 0 ] (cb228) [ 856 0 R /XYZ 84.259843 799.370079 0 ] (cb228-1) [ 856 0 R /XYZ 101.433071 797.673057 0 ] (cb231) [ 856 0 R /XYZ 84.259843 448.229014 0 ] (cb231-1) [ 856 0 R /XYZ 101.433071 446.531993 0 ] (cb234) [ 860 0 R /XYZ 84.259843 799.370079 0 ] (cb234-1) [ 860 0 R /XYZ 101.433071 797.673057 0 ] (cb237) [ 863 0 R /XYZ 84.259843 394.701496 0 ] (cb237-1) [ 863 0 R /XYZ 101.433071 393.004475 0 ] (cb237-10) [ 863 0 R /XYZ 99.933071 222.481281 0 ] (cb237-11) [ 863 0 R /XYZ 99.933071 203.534260 0 ] (cb237-12) [ 863 0 R /XYZ 99.933071 165.640217 0 ] (cb237-13) [ 863 0 R /XYZ 99.933071 127.746174 0 ] (cb237-14) [ 863 0 R /XYZ 99.933071 108.799152 0 ] (cb237-15) [ 863 0 R /XYZ 99.933071 89.852131 0 ] (cb237-16) [ 880 0 R /XYZ 99.933071 799.173057 0 ] (cb237-17) [ 880 0 R /XYZ 99.933071 780.226036 0 ] (cb237-18) [ 880 0 R /XYZ 99.933071 761.279014 0 ] (cb237-19) [ 880 0 R /XYZ 99.933071 742.331993 0 ] (cb237-2) [ 863 0 R /XYZ 99.933071 374.057453 0 ] (cb237-3) [ 863 0 R /XYZ 99.933071 355.110432 0 ] (cb237-4) [ 863 0 R /XYZ 99.933071 336.163410 0 ] (cb237-5) [ 863 0 R /XYZ 99.933071 317.216389 0 ] (cb237-6) [ 863 0 R /XYZ 99.933071 298.269367 0 ] (cb237-7) [ 863 0 R /XYZ 99.933071 279.322346 0 ] (cb237-8) [ 863 0 R /XYZ 99.933071 260.375324 0 ] (cb237-9) [ 863 0 R /XYZ 99.933071 241.428303 0 ] (cb238) [ 880 0 R /XYZ 84.259843 683.081993 0 ] (cb238-1) [ 880 0 R /XYZ 101.433071 681.384971 0 ] (cb24) [ 511 0 R /XYZ 84.259843 125.570079 0 ] (cb24-1) [ 511 0 R /XYZ 101.433071 123.873057 0 ] (cb241) [ 893 0 R /XYZ 84.259843 768.620079 0 ] (cb241-1) [ 893 0 R /XYZ 101.433071 766.923057 0 ] (cb241-10) [ 893 0 R /XYZ 99.933071 596.399864 0 ] (cb241-11) [ 893 0 R /XYZ 99.933071 577.452842 0 ] (cb241-12) [ 893 0 R /XYZ 99.933071 520.611778 0 ] (cb241-13) [ 893 0 R /XYZ 99.933071 501.664756 0 ] (cb241-14) [ 893 0 R /XYZ 99.933071 482.717735 0 ] (cb241-15) [ 893 0 R /XYZ 99.933071 463.770714 0 ] (cb241-16) [ 893 0 R /XYZ 99.933071 444.823692 0 ] (cb241-17) [ 893 0 R /XYZ 99.933071 425.876671 0 ] (cb241-18) [ 893 0 R /XYZ 99.933071 406.929649 0 ] (cb241-2) [ 893 0 R /XYZ 99.933071 747.976036 0 ] (cb241-3) [ 893 0 R /XYZ 99.933071 729.029014 0 ] (cb241-4) [ 893 0 R /XYZ 99.933071 710.081993 0 ] (cb241-5) [ 893 0 R /XYZ 99.933071 691.134971 0 ] (cb241-6) [ 893 0 R /XYZ 99.933071 672.187950 0 ] (cb241-7) [ 893 0 R /XYZ 99.933071 653.240928 0 ] (cb241-8) [ 893 0 R /XYZ 99.933071 634.293907 0 ] (cb241-9) [ 893 0 R /XYZ 99.933071 615.346885 0 ] (cb242) [ 893 0 R /XYZ 84.259843 347.679649 0 ] (cb242-1) [ 893 0 R /XYZ 101.433071 345.982628 0 ] (cb27) [ 516 0 R /XYZ 84.259843 425.570079 0 ] (cb27-1) [ 516 0 R /XYZ 101.433071 423.873057 0 ] (cb3) [ 318 0 R /XYZ 84.259843 523.623057 0 ] (cb3-1) [ 318 0 R /XYZ 101.433071 521.926036 0 ] (cb30) [ 521 0 R /XYZ 84.259843 715.370079 0 ] (cb30-1) [ 521 0 R /XYZ 101.433071 713.673057 0 ] (cb33) [ 524 0 R /XYZ 84.259843 211.820079 0 ] (cb33-1) [ 524 0 R /XYZ 101.433071 210.123057 0 ] (cb36) [ 529 0 R /XYZ 84.259843 451.820079 0 ] (cb36-1) [ 529 0 R /XYZ 101.433071 450.123057 0 ] (cb39) [ 534 0 R /XYZ 84.259843 730.370079 0 ] (cb39-1) [ 534 0 R /XYZ 101.433071 728.673057 0 ] (cb42) [ 537 0 R /XYZ 84.259843 294.320079 0 ] (cb42-1) [ 537 0 R /XYZ 101.433071 292.623057 0 ] (cb45) [ 542 0 R /XYZ 84.259843 575.570079 0 ] (cb45-1) [ 542 0 R /XYZ 101.433071 573.873057 0 ] (cb48) [ 545 0 R /XYZ 84.259843 129.320079 0 ] (cb48-1) [ 545 0 R /XYZ 101.433071 127.623057 0 ] (cb51) [ 550 0 R /XYZ 84.259843 350.570079 0 ] (cb51-1) [ 550 0 R /XYZ 101.433071 348.873057 0 ] (cb54) [ 555 0 R /XYZ 84.259843 538.070079 0 ] (cb54-1) [ 555 0 R /XYZ 101.433071 536.373057 0 ] (cb55) [ 555 0 R /XYZ 84.259843 301.323057 0 ] (cb55-1) [ 555 0 R /XYZ 101.433071 299.626036 0 ] (cb56) [ 559 0 R /XYZ 84.259843 799.370079 0 ] (cb56-1) [ 559 0 R /XYZ 101.433071 797.673057 0 ] (cb59) [ 562 0 R /XYZ 84.259843 350.570079 0 ] (cb59-1) [ 562 0 R /XYZ 101.433071 348.873057 0 ] (cb6) [ 318 0 R /XYZ 84.259843 138.376036 0 ] (cb6-1) [ 318 0 R /XYZ 101.433071 136.679014 0 ] (cb62) [ 567 0 R /XYZ 84.259843 598.970079 0 ] (cb62-1) [ 567 0 R /XYZ 101.433071 597.273057 0 ] (cb65) [ 572 0 R /XYZ 84.259843 772.370079 0 ] (cb65-1) [ 572 0 R /XYZ 101.433071 770.673057 0 ] (cb68) [ 575 0 R /XYZ 84.259843 271.820079 0 ] (cb68-1) [ 575 0 R /XYZ 101.433071 270.123057 0 ] (cb71) [ 580 0 R /XYZ 84.259843 571.820079 0 ] (cb71-1) [ 580 0 R /XYZ 101.433071 570.123057 0 ] (cb74) [ 583 0 R /XYZ 84.259843 144.320079 0 ] (cb74-1) [ 583 0 R /XYZ 101.433071 142.623057 0 ] (cb77) [ 588 0 R /XYZ 84.259843 440.570079 0 ] (cb77-1) [ 588 0 R /XYZ 101.433071 438.873057 0 ] (cb80) [ 593 0 R /XYZ 84.259843 715.370079 0 ] (cb80-1) [ 593 0 R /XYZ 101.433071 713.673057 0 ] (cb83) [ 596 0 R /XYZ 84.259843 275.570079 0 ] (cb83-1) [ 596 0 R /XYZ 101.433071 273.873057 0 ] (cb86) [ 601 0 R /XYZ 84.259843 556.820079 0 ] (cb86-1) [ 601 0 R /XYZ 101.433071 555.123057 0 ] (cb89) [ 604 0 R /XYZ 84.259843 125.570079 0 ] (cb89-1) [ 604 0 R /XYZ 101.433071 123.873057 0 ] (cb9) [ 325 0 R /XYZ 84.259843 509.420079 0 ] (cb9-1) [ 325 0 R /XYZ 101.433071 507.723057 0 ] (cb9-10) [ 325 0 R /XYZ 99.933071 318.252842 0 ] (cb9-11) [ 325 0 R /XYZ 99.933071 299.305821 0 ] (cb9-12) [ 325 0 R /XYZ 99.933071 280.358799 0 ] (cb9-13) [ 325 0 R /XYZ 99.933071 261.411778 0 ] (cb9-14) [ 325 0 R /XYZ 99.933071 242.464756 0 ] (cb9-15) [ 325 0 R /XYZ 99.933071 223.517735 0 ] (cb9-16) [ 325 0 R /XYZ 99.933071 204.570714 0 ] (cb9-17) [ 325 0 R /XYZ 99.933071 185.623692 0 ] (cb9-18) [ 325 0 R /XYZ 99.933071 166.676671 0 ] (cb9-19) [ 325 0 R /XYZ 99.933071 147.729649 0 ] (cb9-2) [ 325 0 R /XYZ 99.933071 488.776036 0 ] (cb9-20) [ 325 0 R /XYZ 99.933071 128.782628 0 ] (cb9-21) [ 325 0 R /XYZ 99.933071 109.835606 0 ] (cb9-22) [ 325 0 R /XYZ 99.933071 90.888585 0 ] (cb9-23) [ 349 0 R /XYZ 99.933071 799.173057 0 ] (cb9-24) [ 349 0 R /XYZ 99.933071 780.226036 0 ] (cb9-25) [ 349 0 R /XYZ 99.933071 761.279014 0 ] (cb9-26) [ 349 0 R /XYZ 99.933071 742.331993 0 ] (cb9-27) [ 349 0 R /XYZ 99.933071 723.384971 0 ] (cb9-28) [ 349 0 R /XYZ 99.933071 704.437950 0 ] (cb9-29) [ 349 0 R /XYZ 99.933071 685.490928 0 ] (cb9-3) [ 325 0 R /XYZ 99.933071 469.829014 0 ] (cb9-30) [ 349 0 R /XYZ 99.933071 666.543907 0 ] (cb9-31) [ 349 0 R /XYZ 99.933071 647.596885 0 ] (cb9-32) [ 349 0 R /XYZ 99.933071 628.649864 0 ] (cb9-33) [ 349 0 R /XYZ 99.933071 609.702842 0 ] (cb9-34) [ 349 0 R /XYZ 99.933071 590.755821 0 ] (cb9-35) [ 349 0 R /XYZ 99.933071 571.808799 0 ] (cb9-36) [ 349 0 R /XYZ 99.933071 552.861778 0 ] (cb9-37) [ 349 0 R /XYZ 99.933071 533.914756 0 ] (cb9-38) [ 349 0 R /XYZ 99.933071 514.967735 0 ] (cb9-39) [ 349 0 R /XYZ 99.933071 496.020714 0 ] (cb9-4) [ 325 0 R /XYZ 99.933071 431.934971 0 ] (cb9-40) [ 349 0 R /XYZ 99.933071 477.073692 0 ] (cb9-41) [ 349 0 R /XYZ 99.933071 458.126671 0 ] (cb9-42) [ 349 0 R /XYZ 99.933071 439.179649 0 ] (cb9-43) [ 349 0 R /XYZ 99.933071 420.232628 0 ] (cb9-44) [ 349 0 R /XYZ 99.933071 401.285606 0 ] (cb9-5) [ 325 0 R /XYZ 99.933071 412.987950 0 ] (cb9-6) [ 325 0 R /XYZ 99.933071 394.040928 0 ] (cb9-7) [ 325 0 R /XYZ 99.933071 375.093907 0 ] (cb9-8) [ 325 0 R /XYZ 99.933071 356.146885 0 ] (cb9-9) [ 325 0 R /XYZ 99.933071 337.199864 0 ] (cb92) [ 609 0 R /XYZ 84.259843 440.570079 0 ] (cb92-1) [ 609 0 R /XYZ 101.433071 438.873057 0 ] (cb95) [ 614 0 R /XYZ 84.259843 685.370079 0 ] (cb95-1) [ 614 0 R /XYZ 101.433071 683.673057 0 ] (cb98) [ 617 0 R /XYZ 84.259843 238.070079 0 ] (cb98-1) [ 617 0 R /XYZ 101.433071 236.373057 0 ] (cis-v1.6-kubernetes-benchmark---rancher-v2.6-with-kubernetes-v1.18-to-v1.21) [ 304 0 R /XYZ 84.259843 784.970079 0 ] (client-certificate-authentication-should-not-be-used-for-users-manual) [ 741 0 R /XYZ 84.259843 684.651496 0 ] (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) [ 889 0 R /XYZ 84.259843 684.651496 0 ] (consider-external-secret-storage-manual) [ 887 0 R /XYZ 84.259843 568.851496 0 ] (contentsbox) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (controller-manager) [ 674 0 R /XYZ 41.740157 784.430079 0 ] (controls) [ 309 0 R /XYZ 84.259843 612.381496 0 ] (create-administrative-boundaries-between-resources-using-namespaces-manual) [ 891 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-a-minimal-audit-policy-is-created-automated) [ 743 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated) [ 734 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-all-namespaces-have-network-policies-defined-automated) [ 863 0 R /XYZ 84.259843 538.851496 0 ] (ensure-that-default-service-accounts-are-not-actively-used.-automated) [ 815 0 R /XYZ 84.259843 206.451496 0 ] (ensure-that-encryption-providers-are-appropriately-configured-automated) [ 643 0 R /XYZ 84.259843 577.220079 0 ] (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) [ 842 0 R /XYZ 84.259843 449.446885 0 ] (ensure-that-the---anonymous-auth-argument-is-set-to-false-automated) [ 508 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated) [ 596 0 R /XYZ 84.259843 445.970079 0 ] (ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated) [ 601 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated) [ 604 0 R /XYZ 84.259843 295.970079 0 ] (ensure-that-the---audit-log-path-argument-is-set-automated) [ 591 0 R /XYZ 84.259843 183.470079 0 ] (ensure-that-the---authorization-mode-argument-includes-node-automated) [ 537 0 R /XYZ 84.259843 464.720079 0 ] (ensure-that-the---authorization-mode-argument-includes-rbac-automated) [ 542 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated) [ 532 0 R /XYZ 84.259843 183.470079 0 ] (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) [ 774 0 R /XYZ 84.259843 332.207453 0 ] (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) [ 710 0 R /XYZ 84.259843 258.470079 0 ] (ensure-that-the---basic-auth-file-argument-is-not-set-automated) [ 511 0 R /XYZ 84.259843 295.970079 0 ] (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) [ 689 0 R /XYZ 84.259843 524.420079 0 ] (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) [ 694 0 R /XYZ 84.259843 257.404475 0 ] (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) [ 700 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) [ 630 0 R /XYZ 84.259843 483.470079 0 ] (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) [ 779 0 R /XYZ 84.259843 675.273057 0 ] (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) [ 705 0 R /XYZ 84.259843 464.720079 0 ] (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) [ 638 0 R /XYZ 84.259843 295.970079 0 ] (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) [ 635 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) [ 622 0 R /XYZ 84.259843 689.720079 0 ] (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-automated) [ 794 0 R /XYZ 84.259843 208.126036 0 ] (ensure-that-the---hostname-override-argument-is-not-set-manual) [ 794 0 R /XYZ 84.259843 425.926036 0 ] (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) [ 575 0 R /XYZ 84.259843 427.220079 0 ] (ensure-that-the---insecure-port-argument-is-set-to-0-automated) [ 580 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) [ 751 0 R /XYZ 84.259843 163.687950 0 ] (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 751 0 R /XYZ 84.259843 454.079014 0 ] (ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated) [ 529 0 R /XYZ 84.259843 652.220079 0 ] (ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated) [ 524 0 R /XYZ 84.259843 427.220079 0 ] (ensure-that-the---kubelet-https-argument-is-set-to-true-automated) [ 519 0 R /XYZ 84.259843 164.720079 0 ] (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) [ 794 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) [ 727 0 R /XYZ 84.259843 333.470079 0 ] (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) [ 717 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) [ 722 0 R /XYZ 84.259843 558.470079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated) [ 588 0 R /XYZ 84.259843 595.970079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated-1) [ 677 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated-2) [ 694 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) [ 790 0 R /XYZ 84.259843 445.970079 0 ] (ensure-that-the---read-only-port-argument-is-set-to-0-automated) [ 779 0 R /XYZ 84.259843 301.829014 0 ] (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) [ 609 0 R /XYZ 84.259843 595.970079 0 ] (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) [ 686 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated) [ 798 0 R /XYZ 84.259843 138.881993 0 ] (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) [ 583 0 R /XYZ 84.259843 314.720079 0 ] (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) [ 617 0 R /XYZ 84.259843 408.470079 0 ] (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) [ 612 0 R /XYZ 84.259843 164.720079 0 ] (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) [ 683 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) [ 784 0 R /XYZ 84.259843 641.326036 0 ] (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) [ 674 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) [ 625 0 R /XYZ 84.259843 239.720079 0 ] (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) [ 798 0 R /XYZ 84.259843 542.326036 0 ] (ensure-that-the---token-auth-file-parameter-is-not-set-automated) [ 516 0 R /XYZ 84.259843 595.970079 0 ] (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) [ 680 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) [ 323 0 R /XYZ 84.259843 586.670079 0 ] (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 323 0 R /XYZ 84.259843 702.470079 0 ] (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) [ 550 0 R /XYZ 84.259843 520.970079 0 ] (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) [ 555 0 R /XYZ 84.259843 708.470079 0 ] (ensure-that-the-admission-control-plugin-eventratelimit-is-set-automated) [ 545 0 R /XYZ 84.259843 314.720079 0 ] (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) [ 562 0 R /XYZ 84.259843 520.970079 0 ] (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) [ 570 0 R /XYZ 84.259843 258.470079 0 ] (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) [ 567 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) [ 555 0 R /XYZ 84.259843 501.723057 0 ] (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) [ 555 0 R /XYZ 84.259843 264.976036 0 ] (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) [ 774 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated) [ 660 0 R /XYZ 84.259843 411.552842 0 ] (ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 313 0 R /XYZ 84.259843 553.851496 0 ] (ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 313 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-audit-policy-covers-key-security-concerns-manual) [ 746 0 R /XYZ 84.259843 333.470079 0 ] (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 755 0 R /XYZ 84.259843 519.629014 0 ] (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) [ 764 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) [ 815 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-cni-in-use-supports-network-policies-manual) [ 863 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-container-network-interface-file-ownership-is-set-to-rootroot-manual) [ 315 0 R /XYZ 84.259843 170.823057 0 ] (ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual) [ 315 0 R /XYZ 84.259843 347.570079 0 ] (ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 313 0 R /XYZ 84.259843 277.251496 0 ] (ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 313 0 R /XYZ 84.259843 423.051496 0 ] (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) [ 325 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 323 0 R /XYZ 84.259843 209.270079 0 ] (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) [ 318 0 R /XYZ 84.259843 365.776036 0 ] (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) [ 318 0 R /XYZ 84.259843 694.023057 0 ] (ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 315 0 R /XYZ 84.259843 478.370079 0 ] (ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 315 0 R /XYZ 84.259843 609.170079 0 ] (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) [ 764 0 R /XYZ 84.259843 383.493907 0 ] (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) [ 764 0 R /XYZ 84.259843 195.693907 0 ] (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-automated) [ 808 0 R /XYZ 84.259843 392.223057 0 ] (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) [ 748 0 R /XYZ 84.259843 553.851496 0 ] (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 748 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 349 0 R /XYZ 84.259843 184.188585 0 ] (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) [ 325 0 R /XYZ 84.259843 668.570079 0 ] (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated) [ 440 0 R /XYZ 84.259843 702.470079 0 ] (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-automated) [ 751 0 R /XYZ 84.259843 763.220079 0 ] (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) [ 689 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 315 0 R /XYZ 84.259843 739.970079 0 ] (ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 313 0 R /XYZ 84.259843 146.451496 0 ] (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) [ 323 0 R /XYZ 84.259843 340.070079 0 ] (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 323 0 R /XYZ 84.259843 470.870079 0 ] (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) [ 891 0 R /XYZ 84.259843 604.851496 0 ] (etcd-node-configuration-files) [ 700 0 R /XYZ 41.740157 784.430079 0 ] (extensible-admission-control) [ 889 0 R /XYZ 41.740157 784.430079 0 ] (general-policies) [ 891 0 R /XYZ 41.740157 784.430079 0 ] (header_bottom_text) [ 6 0 R /XYZ 85.009843 392.718898 0 ] (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-automated) [ 748 0 R /XYZ 84.259843 423.051496 0 ] (kubelet) [ 774 0 R /XYZ 41.740157 784.430079 0 ] (logging) [ 743 0 R /XYZ 41.740157 784.430079 0 ] (master-node-configuration-files) [ 313 0 R /XYZ 41.740157 784.430079 0 ] (minimize-access-to-create-pods-manual) [ 815 0 R /XYZ 84.259843 307.251496 0 ] (minimize-access-to-secrets-manual) [ 815 0 R /XYZ 84.259843 523.851496 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) [ 853 0 R /XYZ 84.259843 238.710432 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) [ 856 0 R /XYZ 84.259843 603.629014 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) [ 853 0 R /XYZ 84.259843 589.851496 0 ] (minimize-the-admission-of-containers-with-added-capabilities-manual) [ 860 0 R /XYZ 84.259843 323.081993 0 ] (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) [ 856 0 R /XYZ 84.259843 252.487950 0 ] (minimize-the-admission-of-containers-with-capabilities-assigned-manual) [ 860 0 R /XYZ 84.259843 207.281993 0 ] (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) [ 860 0 R /XYZ 84.259843 453.881993 0 ] (minimize-the-admission-of-privileged-containers-manual) [ 853 0 R /XYZ 84.259843 720.651496 0 ] (minimize-the-admission-of-root-containers-manual) [ 860 0 R /XYZ 84.259843 584.681993 0 ] (minimize-wildcard-use-in-roles-and-clusterroles-manual) [ 815 0 R /XYZ 84.259843 423.051496 0 ] (network-policies-and-cni) [ 863 0 R /XYZ 41.740157 784.430079 0 ] (overview) [ 304 0 R /XYZ 84.259843 704.822079 0 ] (pod-security-policies) [ 853 0 R /XYZ 41.740157 784.430079 0 ] (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) [ 887 0 R /XYZ 84.259843 684.651496 0 ] (rbac-and-service-accounts) [ 815 0 R /XYZ 41.740157 784.430079 0 ] (scheduler) [ 694 0 R /XYZ 41.740157 784.430079 0 ] (secrets-management) [ 887 0 R /XYZ 41.740157 784.430079 0 ] (testing-controls-methodology) [ 304 0 R /XYZ 84.259843 166.076079 0 ] (the-default-namespace-should-not-be-used-automated) [ 891 0 R /XYZ 84.259843 193.251496 0 ] (title-block-header) [ 6 0 R /XYZ 84.259843 502.818898 0 ] (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) [ 808 0 R /XYZ 84.259843 670.970079 0 ] (worker-node-configuration-files) [ 748 0 R /XYZ 41.740157 784.430079 0 ] ] +>> +>> +>> +endobj +4 0 obj +<< +/ExtGState << +/a1.0 << +/ca 1 +>> +/A1.0 << +/CA 1 +>> +>> +/XObject << +>> +/Pattern << +>> +/Shading << +>> +/Font 1076 0 R +>> +endobj +5 0 obj +<< +/Filter /FlateDecode +/Length 2619 +>> +stream +x[Wa咪tc! "d1!v1u.׭CO{n̶II4ς?ZΗק7' 5 =jȱϯ]5ԞS-~w +DMt_C#?%oUͩGk@׃GMMɆ=럹te mGT|r´\D~6,ct3Oi='" 9ۮy-rH6я.'6Z;Ugc)յͅ'cn꿠Έx/.c.I y=NyBp]۸Sd˒"-y&?S9>y5Zk?S|HL[huݖ+:}v_؄wsےmڇy {q^7Ŏ>Pnt;3ϣeNVyei׹Kiw!ۘ͞dh&ۄ0@aF8Nq2q/_OGKSu$*=ˊ7dFirI&-dxd{b=c m_VuoV6uQ/jUh쯃f[:]! w]!ZKۃh샢MؗewfC̥wm +ƖFxSV݇-.Huo['w?x}L.t}Jv|1Nqrߜ1GwK3YGcv}tحC'!t duTne9޸U3X_E>x3[ҙݝz;Y=g.وOO:ds#ڞװeHYCϏǜzz&$u@}\YJCVmW#wߕ<ވ}&lG0UҎEbj }?o׃S ]fRJ=m *^ E:9 H +endstream +endobj +6 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 5 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +7 0 obj +<< +/Filter /FlateDecode +/Length 3661 +>> +stream +x\[ܶ~_C/@Q  $Ѥ-`oq(p6-}onD{4?)?,1̗ǏK'Ȝ69=X&(7~n8Ll'5t0Lٺ㯯C: +i3't%t?Û桇HS6̖Dqp"HtIe:[;_o;7u0ho]w &xqJK:zB!qXI4ȶi7cgjQoiqCs\ 41E;;ߏQ1Br(,,q [Bt\!*5GvFt [BBt??ѽ-Dl~lC(f⦎!*p\>^C4G G[C2x Pm.=vF;Ԁ2yMف.AH#f1Dx]8;Xiڄ`jDŽh {9o-Do! чEeJMчB}Ot/-Do!z GMt8A򗌏%FoMpP fB" L%VdM] +FI;9(2lf"T@g!E&sBe4(:E&la2G{ c de3&ͬpt,$CЙ'CaYV8dVV8d8DCsA}Q8d 19Cf'&}vF0@go8,oJ8: :["qXRO]$`D#40QdgR8 HxĘ(>ptv:CxAJA0xl3"U CgcMT9hrBD M^uFGI0oaBDOqX{ZM :;.È%H*Fm Y0ZVSj5%VS@1dLjJD4:DAA +upBM:{d2CAxh5%1)9!X)#i5%fLRZMLSjJ2n!pL!$ dp:{!fC7 +AgrV)AgCgVSy2*!3?lO N$)u"y*_i5%%XLX c0Ed3Yj +<xjJPjJak5~1VS2ZM#O1`p__VS2G Cg8dLrζD"3fZM:ÊݲVSryəa)DguB""kU^홌B#,P+O(s^W{kWƄbNC6.ŋ}ߝ5K_8`|X0*TFd#te- _ ś}?/>e::W:uGxD͠vޯ-"ڀtLQw囿tsqgl3g|ͣjb|͇2|c+G4,{ʹh>awʹii|.as:ɩ+2{z=%eFDf-`ҙqYfImqָum̦>k0s3fNOީl> D|d:Zu/D9&?ٓeݞidڒVx~;9@3~b-E(oJ3g#4NRT#NOcybYt'$eg!˹?O>Hۑ| NMgxo3ksW,f߷Ϊ9OdG`Oʝ>W^(IQk{[)n5ى\ƒyY}"Aqvާ?Ў]O{ֶ}9 ۯ[sۗV^VL\/ň Eٖ atteGS /#R_їhbC ˛zX-=<.Vapԏv ta/6/R_6w.{| >WC[ILlٝoq/olS1@ٔe'^3>`<ؗp=4-o`N,Ka9̭qaMz[BYqwg1 #Iz*{^Way ]R;:+_e) +sjn9zmUv4 rCJ6f|c?71A.FSZT7\vaWnmbJ\tWw(ĝ8-/A¡X$7Ow6݁4\ahthR!4+V6T -g>T(NJl6x$Ieǀ +lg%_6ttcl@eWTK#l5O˕4U tan|7]OnZV`ݹr睄c ׁ |s~tLv3vŐ: hm{U\1򍪛7i=2__n[8-U^r[HrVljDv{-vU905%33D汶{9uuplZD_s$E8+'q#Nd8٠fqHI)\KiD9ueV6]yB[qCNώG}U9(hK hXA[G|Vsܱ =&9=4'GmN}ņNkh|Sb:J> +endobj +9 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 671.061024 504.679134 638.361024 ] +/BS << +/W 0 +>> +/Dest (cis-v1.6-kubernetes-benchmark---rancher-v2.6-with-kubernetes-v1.18-to-v1.21) +>> +endobj +10 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 488.750423 648.111024 496.429134 633.111024 ] +/BS << +/W 0 +>> +/Dest (cis-v1.6-kubernetes-benchmark---rancher-v2.6-with-kubernetes-v1.18-to-v1.21) +>> +endobj +11 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 626.361024 504.679134 593.661024 ] +/BS << +/W 0 +>> +/Dest (controls) +>> +endobj +12 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 485.690364 618.411024 496.429134 603.411024 ] +/BS << +/W 0 +>> +/Dest (controls) +>> +endobj +13 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 581.661024 504.679134 548.961024 ] +/BS << +/W 0 +>> +/Dest (master-node-configuration-files) +>> +endobj +14 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 485.521907 573.711024 496.429134 558.711024 ] +/BS << +/W 0 +>> +/Dest (master-node-configuration-files) +>> +endobj +15 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 530.961024 498.679134 507.561024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +16 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 510.561024 491.179134 495.561024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +17 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 491.361024 498.679134 467.961024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +18 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 470.961024 491.179134 455.961024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +19 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 451.761024 498.679134 428.361024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +20 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 431.361024 491.179134 416.361024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +21 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 412.161024 498.679134 388.761024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +22 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 391.761024 491.179134 376.761024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +23 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 372.561024 498.679134 349.161024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +24 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 352.161024 491.179134 337.161024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +25 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 332.961024 498.679134 309.561024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +26 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 312.561024 491.179134 297.561024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +27 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 293.361024 498.679134 269.961024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +28 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 272.961024 491.179134 257.961024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +29 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 253.761024 498.679134 230.361024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +30 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 233.361024 491.179134 218.361024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +31 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 214.161024 498.679134 190.761024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual) +>> +endobj +32 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 193.761024 491.179134 178.761024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual) +>> +endobj +33 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 174.561024 498.679134 151.161024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-container-network-interface-file-ownership-is-set-to-rootroot-manual) +>> +endobj +34 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 154.161024 491.179134 139.161024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-container-network-interface-file-ownership-is-set-to-rootroot-manual) +>> +endobj +35 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 134.961024 498.679134 111.561024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) +>> +endobj +36 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 114.561024 491.179134 99.561024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) +>> +endobj +37 0 obj +<< +/Filter /FlateDecode +/Length 3681 +>> +stream +x\[~?< AI&`ȕ%-}41 g LL S! LA@#ɢ3g ,:/&΁7\ L1yЋX1PĠ3ǐDgP A.ML@rc&J61ѻ90Μ$љ!0!ɢ3%,H CB!/:byK!0 :{HrJ6&:ʉcD(?DQ&G1b6G#.`cDgF (:P?$%(e#5ȧlƑ!r6| lA!0A lR9 R1QIHD.)"c1s`Nb`cDgJ1"$13x Rc1A :^dLSD'dKVhKR:(s 13 a@Pl,0Re7EXGd<d%0˔geqKe2ienvD>z^ӗo?}ziYEY>O;~TgL/2z^/jO_~e(ߝ 7h>>y&Ih^n]ȬK;|/?a^d\0Wge|Y7NaGuii2˧sbף?levê-aU͋.fy.GNYIܖ1qb޼wC4'_IQ?(.l2nmYc|L#߇>&nr;+ &d6s%F­1D.oNq{uDݟ0X*bM+>:Vmgզ!qkW"0cAC q8gy-y$n+O$n|kgo_?a.hMԁM֦O_ + VɍKabx4TiUHB*whنl7.C,^pbr/8e,%qVW!^{&ڳeF_yN|ɆpaYmx+tՆUUۑG[5S򧲥>MrӕoוMre8uO |KXag?w8D)ڊRߖ_>8 +M +PMv9[${fi룤>3z1uO~xG(gFYӗhًM}R {a7@~u`XlqNUMi^N-mR&j]OoP4)Wd#$4vD͕ _Bf;>./\)4\崋[ZTjO-]ꔛwda<͵8*k+yJpⴃ+TMggd60N46xmQ[ {:v0|v,vtYl%L6Sijc-uM)ڧQ]ss凕-Tkgwnǖ;Fqj zWe*la+Vϵ.Fߪ]lv$)tqOFkNn,=*TjZk)PI~o[n]JH›b҄-l!!w1 #:}O -B;: +pcs],Æb<^]nH?qTq81%<4){ +%É36*CkRSr줙^#} ;4Bw ̎MW4`89ceώ^}Q9PiKM0JT޾ݸm5κS[ECQS}t~PeNkhBŮb:jiyJ)ydGVVۭ͖MxtG;%,g7iHúZm0BW$߇{ե׏B"sNQr DV!F|}HX2~{Txm%!=o^@LWnҥ"o,A^ ;wW +endstream +endobj +38 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 37 0 R +/Resources 4 0 R +/Annots [ 39 0 R 40 0 R 41 0 R 42 0 R 43 0 R 44 0 R 45 0 R 46 0 R 47 0 R 48 0 R 49 0 R 50 0 R 51 0 R 52 0 R 53 0 R 54 0 R 55 0 R 56 0 R 57 0 R 58 0 R 59 0 R 60 0 R 61 0 R 62 0 R 63 0 R 64 0 R 65 0 R 66 0 R 67 0 R 68 0 R 69 0 R 70 0 R 71 0 R 72 0 R 73 0 R 74 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +39 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 790.370079 498.679134 766.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) +>> +endobj +40 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 769.970079 491.179134 754.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) +>> +endobj +41 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 750.770079 498.679134 727.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +42 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 730.370079 491.179134 715.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +43 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 711.170079 498.679134 687.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +44 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 690.770079 491.179134 675.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +45 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 671.570079 498.679134 648.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +46 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 651.170079 491.179134 636.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +47 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 631.970079 498.679134 608.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +48 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 611.570079 491.179134 596.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +49 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 592.370079 498.679134 568.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +50 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 571.970079 491.179134 556.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +51 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 552.770079 498.679134 529.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +52 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 532.370079 491.179134 517.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +53 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 513.170079 498.679134 489.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) +>> +endobj +54 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 492.770079 491.179134 477.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) +>> +endobj +55 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 473.570079 498.679134 450.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +56 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 453.170079 491.179134 438.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +57 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 433.970079 498.679134 410.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated) +>> +endobj +58 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 413.570079 491.179134 398.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated) +>> +endobj +59 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 394.370079 504.679134 361.670079 ] +/BS << +/W 0 +>> +/Dest (api-server) +>> +endobj +60 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.982112 386.420079 496.429134 371.420079 ] +/BS << +/W 0 +>> +/Dest (api-server) +>> +endobj +61 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 343.670079 498.679134 320.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---anonymous-auth-argument-is-set-to-false-automated) +>> +endobj +62 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 323.270079 491.179134 308.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---anonymous-auth-argument-is-set-to-false-automated) +>> +endobj +63 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 304.070079 498.679134 280.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---basic-auth-file-argument-is-not-set-automated) +>> +endobj +64 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 298.670079 491.179134 283.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---basic-auth-file-argument-is-not-set-automated) +>> +endobj +65 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 264.470079 498.679134 241.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---token-auth-file-parameter-is-not-set-automated) +>> +endobj +66 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 259.070079 491.179134 244.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---token-auth-file-parameter-is-not-set-automated) +>> +endobj +67 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 224.870079 498.679134 201.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubelet-https-argument-is-set-to-true-automated) +>> +endobj +68 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 219.470079 491.179134 204.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubelet-https-argument-is-set-to-true-automated) +>> +endobj +69 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 185.270079 498.679134 161.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated) +>> +endobj +70 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 164.870079 491.179134 149.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated) +>> +endobj +71 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 145.670079 498.679134 122.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated) +>> +endobj +72 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 125.270079 491.179134 110.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated) +>> +endobj +73 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 106.070079 498.679134 82.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated) +>> +endobj +74 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 85.670079 491.179134 70.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated) +>> +endobj +75 0 obj +<< +/Filter /FlateDecode +/Length 3492 +>> +stream +x\ێ}gIV1"m`ր~⥻53ӽ 6JR:: {S8R4'>~yq~!dWϦ>b fhsb Yz̩2|ձ-Zf@V&s|Vf`ŞQhb`UVGWK*aNҫСfK*:FBcTWg1lUL 0`UV'<0Vg.K*:!ҫ +XzUաҫ +΅ҫ +,>{Lk߰njY20e)KVFⴜ"&9u zcZPmU\|l{ar?[W/}n{&[4dwv_|q#wU]=Ow_~_>a{%Pœ S>_=,`^nɤ~oQ{kx#>=PJ7D*CXb16- edQ[n9&嶌̕7*1Q{CAM&z27ccz|GHyHLS%CƲڼy<7x|u^ "^yf#XwlG{j̥-4t8Hjo{~th6L=DV~suFn5}T~;V$CmwϏiG5̵Z-W.g(p4 Z%\SvY%洼%.Ʋˋ>P3/W/&i*!sرm}v}3ֵǺL/cx'8[_ײGsúڷ&z,hjO[;?R_GH L,uX\^Ui}ε Ϝ|sZ?N(hig?>` ˻z@ +n\_5?7?fo_z2s5 zIŴ0Ÿq8~c۫x #L\޻eֽԛ"h;&\tavaM 7Nxtn}ڴm}(Vi] twG:A6ٳ$Փǩ9^55|z5f]<)}0uwq94sgbv7a)l|n] sڍM0$aii1ڳSPcmUR" =7Jt"_?cgsyd1R9F>l&c)s(WZou<)_8ݏ[yxR]^Oݪ~  ICq\x)eluJ_(2Ek; :k2{rI-WSkS=s[z~=9Z+B}7שhA!6tO3 +endstream +endobj +76 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 75 0 R +/Resources 4 0 R +/Annots [ 77 0 R 78 0 R 79 0 R 80 0 R 81 0 R 82 0 R 83 0 R 84 0 R 85 0 R 86 0 R 87 0 R 88 0 R 89 0 R 90 0 R 91 0 R 92 0 R 93 0 R 94 0 R 95 0 R 96 0 R 97 0 R 98 0 R 99 0 R 100 0 R 101 0 R 102 0 R 103 0 R 104 0 R 105 0 R 106 0 R 107 0 R 108 0 R 109 0 R 110 0 R 111 0 R 112 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +77 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 790.370079 498.679134 766.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-includes-node-automated) +>> +endobj +78 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 769.970079 491.179134 754.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-includes-node-automated) +>> +endobj +79 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 750.770079 498.679134 727.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-includes-rbac-automated) +>> +endobj +80 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 730.370079 491.179134 715.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-includes-rbac-automated) +>> +endobj +81 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 711.170079 498.679134 687.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-eventratelimit-is-set-automated) +>> +endobj +82 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 690.770079 491.179134 675.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-eventratelimit-is-set-automated) +>> +endobj +83 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 671.570079 498.679134 648.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) +>> +endobj +84 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 651.170079 491.179134 636.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) +>> +endobj +85 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 631.970079 498.679134 608.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) +>> +endobj +86 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 611.570079 491.179134 596.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) +>> +endobj +87 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 592.370079 498.679134 568.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) +>> +endobj +88 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 571.970079 491.179134 556.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) +>> +endobj +89 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 552.770079 498.679134 529.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) +>> +endobj +90 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 532.370079 491.179134 517.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) +>> +endobj +91 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 513.170079 498.679134 489.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) +>> +endobj +92 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 492.770079 491.179134 477.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) +>> +endobj +93 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 473.570079 498.679134 450.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) +>> +endobj +94 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 453.170079 491.179134 438.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) +>> +endobj +95 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 433.970079 498.679134 410.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) +>> +endobj +96 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 413.570079 491.179134 398.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) +>> +endobj +97 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 394.370079 498.679134 370.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) +>> +endobj +98 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 373.970079 491.179134 358.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) +>> +endobj +99 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 354.770079 498.679134 331.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---insecure-port-argument-is-set-to-0-automated) +>> +endobj +100 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 349.370079 491.179134 334.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---insecure-port-argument-is-set-to-0-automated) +>> +endobj +101 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 315.170079 498.679134 291.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) +>> +endobj +102 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 309.770079 491.179134 294.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) +>> +endobj +103 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 275.570079 498.679134 252.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated) +>> +endobj +104 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 270.170079 491.179134 255.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated) +>> +endobj +105 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 235.970079 498.679134 212.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-path-argument-is-set-automated) +>> +endobj +106 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 230.570079 491.179134 215.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-path-argument-is-set-automated) +>> +endobj +107 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 196.370079 498.679134 172.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated) +>> +endobj +108 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 175.970079 491.179134 160.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated) +>> +endobj +109 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 156.770079 498.679134 133.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated) +>> +endobj +110 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 136.370079 491.179134 121.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated) +>> +endobj +111 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 117.170079 498.679134 93.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated) +>> +endobj +112 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 96.770079 491.179134 81.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated) +>> +endobj +113 0 obj +<< +/Filter /FlateDecode +/Length 3624 +>> +stream +x\݋6￢QTRUIAA}rn1Wr[R.Lf703]TOIV^~\%1O%3!'w|DΗP i:ggYqybX"( zaffaT!LH!̔$?!̈d9P PbO &z " ,bA1bN 1c6'bE "1"3 ,2#lOc&Fj`>eD7.JcQʠxfE RC BB`cX0?(u0X?(uP9JJ@mȌD:(D#2G1:(9:$P`6Fd?(u0PlLvP('Ǥ8)#Tv)JA6Fdf1:(2?$uP@`cDX<CR!B1"C6ibHꠌGƈ^2?2Βa>fLxpYܲZ43YhZG'3t?/i Hœx*rxRLZmkV ΜܳqdшIх"\@钪>4=[[XZwjPO % zU #-.yU+jQij]ߧx%}2^!lAѳ0ȵ\aPv/ʥU aEu}ޕXv޼P\xKK^(ןt>xBj KG +P|@w+t_B%D_B j[rjƼA׌Vs]ӧM XR`0098Ă,L xzH(:70QTȐ9͸>34dN>zC$N02.2Y2G2°+PPg o y"bl`Z 08%4%s.ђ9I9QR%ss&ddS4l}ySNr;9HbډK;cti'v;$w'v2I߉,9Ď8;%GNdQ;YrT؉,9*ĎHNQq'v(܉"9 +wbԇ;SCܝ)x'v=ɫ;S]ډ’Wwb՝)u;Er߉"9N;S$GN쀗$vG@ezu=Wc%_]pZo.̿_C9ob*2ޫz%~tÿ<7>W|b 糯7e@inL4mCL>94me_>=EGu=?oE7fv`>ځpg?z}[`سXo>ؑua۠yL:oTFCЈSDtd΋"L[mȭӧGx3?]俟F0t9u}?8hnk>fc~L͇L=dB2ص>o TiޜںOY ps߆ڰjSkڰ }㵰ȏO3_Yz.v:s9򚍍[%/)(}+ίq}j].9yi~ ?fXcBQ߃-0\N7'f@8_׹o1P|lˇjlR&՝;cj<;~eW5xަ8l[۝!c|I7ӽ[yEh6G]އ~LSR? z!`-,0ft )f*.oMЮ['S۫:Bv~5mҙ/7Yus+D\{_Is&:8q,5v07%("]jn%KÆ~XckՁ2ÆiOi6^RW:-4֗4PS!AiTrE7(וՂ317GŽ+ B:Vq37Jǭi~2\=ڤ*iQB\-lpE<j޹"?(i +O41*AMֺ*Sk^h hf'/ܳi0 R}VK&+t;klAU*Sivc=y,нk +kR}Bd 98{kA;u=w>jroku7i*lxI[#|v1EIRF'r֞~8l?2"RZ_p'Ҷx}~uA֕,LKtbE CXjx*_ݏސ3(HCJ3dOZ[m3 +4I3I%';rǵ8JQ +%Սrʩj bVԍtWQ"ֶԉF8(uMPu3‚1n,YugE@ީ;V=St^sⱞ꼢9#4'G5fFBEߖ15xeq^RcAYkUI[ox};;?},WhThmVm8126B>+='vV7K!o&C<:̒C))aVk#O^,^i%%1LڣO !£\(+ڥ)`k_.ViSE*y7fedb9 +endstream +endobj +114 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 113 0 R +/Resources 4 0 R +/Annots [ 115 0 R 116 0 R 117 0 R 118 0 R 119 0 R 120 0 R 121 0 R 122 0 R 123 0 R 124 0 R 125 0 R 126 0 R 127 0 R 128 0 R 129 0 R 130 0 R 131 0 R 132 0 R 133 0 R 134 0 R 135 0 R 136 0 R 137 0 R 138 0 R 139 0 R 140 0 R 141 0 R 142 0 R 143 0 R 144 0 R 145 0 R 146 0 R 147 0 R 148 0 R 149 0 R 150 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +115 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 790.370079 498.679134 766.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) +>> +endobj +116 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 769.970079 491.179134 754.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) +>> +endobj +117 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 750.770079 498.679134 727.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) +>> +endobj +118 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 730.370079 491.179134 715.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) +>> +endobj +119 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 711.170079 498.679134 687.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) +>> +endobj +120 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 690.770079 491.179134 675.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) +>> +endobj +121 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 671.570079 498.679134 648.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) +>> +endobj +122 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 651.170079 491.179134 636.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) +>> +endobj +123 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 631.970079 498.679134 608.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) +>> +endobj +124 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 611.570079 491.179134 596.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) +>> +endobj +125 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 592.370079 498.679134 568.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) +>> +endobj +126 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 571.970079 491.179134 556.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) +>> +endobj +127 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 552.770079 498.679134 529.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) +>> +endobj +128 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 532.370079 491.179134 517.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) +>> +endobj +129 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 513.170079 498.679134 489.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) +>> +endobj +130 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 492.770079 491.179134 477.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) +>> +endobj +131 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 473.570079 498.679134 450.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-encryption-providers-are-appropriately-configured-automated) +>> +endobj +132 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 453.170079 491.179134 438.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-encryption-providers-are-appropriately-configured-automated) +>> +endobj +133 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 433.970079 498.679134 410.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated) +>> +endobj +134 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 413.570079 491.179134 398.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated) +>> +endobj +135 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 394.370079 504.679134 361.670079 ] +/BS << +/W 0 +>> +/Dest (controller-manager) +>> +endobj +136 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 483.326107 386.420079 496.429134 371.420079 ] +/BS << +/W 0 +>> +/Dest (controller-manager) +>> +endobj +137 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 343.670079 498.679134 320.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) +>> +endobj +138 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 323.270079 491.179134 308.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) +>> +endobj +139 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 304.070079 498.679134 280.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-1) +>> +endobj +140 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 298.670079 491.179134 283.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-1) +>> +endobj +141 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 264.470079 498.679134 241.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) +>> +endobj +142 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 244.070079 491.179134 229.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) +>> +endobj +143 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 224.870079 498.679134 201.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) +>> +endobj +144 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 204.470079 491.179134 189.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) +>> +endobj +145 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 185.270079 498.679134 161.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) +>> +endobj +146 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 164.870079 491.179134 149.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) +>> +endobj +147 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 145.670079 498.679134 122.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) +>> +endobj +148 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 125.270079 491.179134 110.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) +>> +endobj +149 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 106.070079 498.679134 82.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) +>> +endobj +150 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 85.670079 491.179134 70.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) +>> +endobj +151 0 obj +<< +/Filter /FlateDecode +/Length 3789 +>> +stream +x][ ~_1B-@,zE6IKٖHٲ|ٴh|gw"%%j󩡿"c +.Z3I4oW|ɸ뇋Ѥ('}cPHO\~M|b ä)heְ7 +`y,+xb%՜1H &"qmf n I]?7}=`"t:lowϸJCubuqmo` %ںpNFlL.\~[]2Rɇ>Iwi''cp㯞>tlҌwFs$IȇO{W{4=xWO{ƄZ-ȸq^#\)*3Ws]#VAD\p2*a¨2(Mv$h29[#"Di Ad20CZʪ#ZJ#Z^ F\c4p +=o}6otf7ϸ( g,X64B~it& allԥ/c7#<$p8qNmN#G}TQcQ„ѸQyhG}N336q>Z?bL[L 2 Aܗ ֎d43\H1 ଆAR`ͨN+QW#Qz b +۫2*pV;੺p*;w 1w Q:@:jwj=RAQ;H5pFwjpj<;H5pFz w(-(WĹ+pSR;j>eFP*+{O5pSrTw<(8=bAl{8ş)CRs"mvBonzPwoo2.2|+g1\򕸷)Z@omoUܼ4Hݶa̞ ,- -3<5G~s݉㖮6*nNlA..[h#7S}bS^u((#qRI E_)PO3zIѓ'E?ETGݓ'EOj+iCͦ|/Fϗ̻8nʋF\\l!xۑ @_& 0iJ?g{ Խ):F-nuՌZQs0z5?E,QqQ.J8h hV7US 5Uqd"{`˪$-kX[QaS5Wq;q2qS5#nN\ \(6f'u:N1;ݧe$N=) 6iF;#:)zRGh/t{RIW-t%mB#(x$yzkv18^!)L>\o?F"廨灁wRɤ7.w_H޼swW߾!iV[Q,d({o[ +4FAKMML~5z0_ڬgc30nENh{nm ogIǓ- ̰_l弰vKle\S,,2X}93}TgvWX0?Osϭ_wǡKՂ BXSdf/1K݄PtrS"[Gp._3?Dgc&F1T۾ϗAAm2n:/eyrx͖Q:E(M~SEgd}TiyheoAߧ>]u/RTcRY"kLW/^{Fްj|cޔ8B1GC#e4ͱo_WXU m*]4βZs6?K V;\>f|W eL@:e2^3JH35uȯ=A/>@f32GL=NsP&58cs˲ܡ\jz?fQ,-:vcMх =G _ccZk\Pm6uru2}lו]\4NŐ@\]P!wΧ[K#RZ|((jwn-732;ˆG}.sa&W$_YDsx1퓔 Mr^򹷤rcJ Q<~0Z̒\Jm6s`2E"Q bP;m> +endobj +153 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 790.370079 504.679134 757.670079 ] +/BS << +/W 0 +>> +/Dest (scheduler) +>> +endobj +154 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.309749 782.420079 496.429134 767.420079 ] +/BS << +/W 0 +>> +/Dest (scheduler) +>> +endobj +155 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 739.670079 498.679134 716.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-2) +>> +endobj +156 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 734.270079 491.179134 719.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-2) +>> +endobj +157 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 700.070079 498.679134 676.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) +>> +endobj +158 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 679.670079 491.179134 664.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) +>> +endobj +159 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 660.470079 504.679134 627.770079 ] +/BS << +/W 0 +>> +/Dest (etcd-node-configuration-files) +>> +endobj +160 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.237972 652.520079 496.429134 637.520079 ] +/BS << +/W 0 +>> +/Dest (etcd-node-configuration-files) +>> +endobj +161 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 609.770079 498.679134 586.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) +>> +endobj +162 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 589.370079 491.179134 574.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) +>> +endobj +163 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 570.170079 498.679134 546.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) +>> +endobj +164 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 564.770079 491.179134 549.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) +>> +endobj +165 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 530.570079 498.679134 507.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) +>> +endobj +166 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 525.170079 491.179134 510.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) +>> +endobj +167 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 490.970079 498.679134 467.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) +>> +endobj +168 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 470.570079 491.179134 455.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) +>> +endobj +169 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 451.370079 498.679134 427.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) +>> +endobj +170 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 430.970079 491.179134 415.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) +>> +endobj +171 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 411.770079 498.679134 388.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) +>> +endobj +172 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 406.370079 491.179134 391.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) +>> +endobj +173 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 372.170079 498.679134 348.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated) +>> +endobj +174 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 351.770079 491.179134 336.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated) +>> +endobj +175 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 332.570079 504.679134 299.870079 ] +/BS << +/W 0 +>> +/Dest (authentication-and-authorization) +>> +endobj +176 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.986019 324.620079 496.429134 309.620079 ] +/BS << +/W 0 +>> +/Dest (authentication-and-authorization) +>> +endobj +177 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 281.870079 498.679134 258.470079 ] +/BS << +/W 0 +>> +/Dest (client-certificate-authentication-should-not-be-used-for-users-manual) +>> +endobj +178 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 261.470079 491.179134 246.470079 ] +/BS << +/W 0 +>> +/Dest (client-certificate-authentication-should-not-be-used-for-users-manual) +>> +endobj +179 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 242.270079 504.679134 209.570079 ] +/BS << +/W 0 +>> +/Dest (logging) +>> +endobj +180 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.506282 234.320079 496.429134 219.320079 ] +/BS << +/W 0 +>> +/Dest (logging) +>> +endobj +181 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 191.570079 498.679134 168.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-a-minimal-audit-policy-is-created-automated) +>> +endobj +182 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 186.170079 491.179134 171.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-a-minimal-audit-policy-is-created-automated) +>> +endobj +183 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 151.970079 498.679134 128.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-audit-policy-covers-key-security-concerns-manual) +>> +endobj +184 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 146.570079 491.179134 131.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-audit-policy-covers-key-security-concerns-manual) +>> +endobj +185 0 obj +<< +/Filter /FlateDecode +/Length 3766 +>> +stream +x\[~ׯslxrH m}8VqZwt.:'n#9h%7?RHÇǝ8xɿݔMcbv5$*f1rDg$@4bfȶuo':6[Ó y4uڊ܄ "*rk\Cw+)˾ȲRl{M_7+ҿimN"Dp;әpe~a.f2̿ 6t*,4Jvl.nCv> /o~qŝ6'Jm$Iv~to>c7HXV#򖐷JBﱻխ4-:!']n}#\SrؙA9R0_ޭ0tL'.F VÀs`F \0^ǀ3ygIU1]6&ipv@6! c0`,8Uô}0AɦH*ƻr4Lq!ď LV1'ĘC +#7(]*&sq m*&I.+1X&ɨ2Y{&NsR18+]L 1+=8T sD^p skpf%~|g獊blYlRR1 f3%~|Š)짜8$%JJ`˜2{bK1"5 8lUYQ1X)'%~ȃb8cP11%%(35)Cd*%`0xU1 ?gVrRIÄ +Y[ +. +,8D*Ɓ aI0xk٪gk +*& ob%B"Y8'U XyȤb8Gc&˳gV@̈́P5Q3{4gGi2G%~g TgCT'rtY6Bg2['W c#1.k ]&DdGEʀэι]3t(f (+1X [/M#dOϺB: + J5N^ɹҋ Rc{ +?嫐S8+9mI?ijed|U.hWҕ^V~db46Rw;WV-Eo)zOl+n)zK[PSݭԽ-Eo)<!^ƥ(3\vthu<|}R‰[yd)%H?\BG8Jјqfpƙ`sg<2d[Jy6k3zN 8B +d^a,8}r_ +gp >jKi(4>8S(%LPʆXxbN}46R6t% 3 M +KІVaR)F>zb<IB/-1l4U8cS8g S8ge{yqQ8czyqlbggc}8c iCyiC"&8c8c83893=i8D9sp gcXYi X2y(X>VAg"ڳ (a ߬=8~#ƃGg"oݿocy~/aq㕿7߿EG>ȳJ~o9NX -?^WC. Hnr/*"EU9*$=o X4gط<T!g*GmX&0̯r=SEr*rWxl/'sUW^qR rŜ]4{k@X+}_͝]D&{C-S\s~~F tݨ +>uP|Sp'&䪟lYh:džZ~LSߊ 4G$ p*sJLOWb9zo'K9US!5\W~e!0T->δµu%+s<[-mБئ 5:77}bHfPJa6bBY/,Ċm#\xƗ++\2{/{% +/KN4ąBaV4K@J%?IWK\mDeVv]e(hLv1Y4 H?9rPmjo{)m+6፥~˶}-"|[ Z]ԛ- RօM*k=rf,J]t^iF + [+^- +2tdK,MJ\7uv/AH;Sӛ3濧jU +0 jߗ2)F!T~ސ)ȣŒH-HMpްEmPǍ|jFlCz64~O~\j\!2ٲ| +endstream +endobj +186 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 185 0 R +/Resources 4 0 R +/Annots [ 187 0 R 188 0 R 189 0 R 190 0 R 191 0 R 192 0 R 193 0 R 194 0 R 195 0 R 196 0 R 197 0 R 198 0 R 199 0 R 200 0 R 201 0 R 202 0 R 203 0 R 204 0 R 205 0 R 206 0 R 207 0 R 208 0 R 209 0 R 210 0 R 211 0 R 212 0 R 213 0 R 214 0 R 215 0 R 216 0 R 217 0 R 218 0 R 219 0 R 220 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +187 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 790.370079 504.679134 757.670079 ] +/BS << +/W 0 +>> +/Dest (worker-node-configuration-files) +>> +endobj +188 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.434505 782.420079 496.429134 767.420079 ] +/BS << +/W 0 +>> +/Dest (worker-node-configuration-files) +>> +endobj +189 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 739.670079 498.679134 716.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +190 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 719.270079 491.179134 704.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +191 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 700.070079 498.679134 676.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) +>> +endobj +192 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 679.670079 491.179134 664.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) +>> +endobj +193 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 660.470079 498.679134 637.070079 ] +/BS << +/W 0 +>> +/Dest (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +194 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 640.070079 491.179134 625.070079 ] +/BS << +/W 0 +>> +/Dest (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +195 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 620.870079 498.679134 597.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-automated) +>> +endobj +196 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 600.470079 491.179134 585.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-automated) +>> +endobj +197 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 581.270079 498.679134 557.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +198 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 560.870079 491.179134 545.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +199 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 541.670079 498.679134 518.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +200 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 521.270079 491.179134 506.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +201 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 502.070079 498.679134 478.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +202 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 481.670079 491.179134 466.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +203 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 462.470079 498.679134 439.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) +>> +endobj +204 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 442.070079 491.179134 427.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) +>> +endobj +205 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 422.870079 498.679134 399.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) +>> +endobj +206 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 402.470079 491.179134 387.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) +>> +endobj +207 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 383.270079 498.679134 359.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) +>> +endobj +208 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 362.870079 491.179134 347.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) +>> +endobj +209 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 343.670079 504.679134 310.970079 ] +/BS << +/W 0 +>> +/Dest (kubelet) +>> +endobj +210 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 484.911067 335.720079 496.429134 320.720079 ] +/BS << +/W 0 +>> +/Dest (kubelet) +>> +endobj +211 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 292.970079 498.679134 269.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) +>> +endobj +212 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 272.570079 491.179134 257.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) +>> +endobj +213 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 253.370079 498.679134 229.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) +>> +endobj +214 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 232.970079 491.179134 217.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) +>> +endobj +215 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 213.770079 498.679134 190.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) +>> +endobj +216 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 193.370079 491.179134 178.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) +>> +endobj +217 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 174.170079 498.679134 150.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---read-only-port-argument-is-set-to-0-automated) +>> +endobj +218 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 168.770079 491.179134 153.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---read-only-port-argument-is-set-to-0-automated) +>> +endobj +219 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 134.570079 498.679134 111.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) +>> +endobj +220 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 114.170079 491.179134 99.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) +>> +endobj +221 0 obj +<< +/Filter /FlateDecode +/Length 4001 +>> +stream +x\K$ sE @FX֝];PzTYҳ*%RHR=/Йr x|>$)7c +:jlISGET0e0 O!a h0Md$Ɖ%0D&)z9arR6sƤ +샜2!$S <)pFTxSV0>lGYVxq$ξO .h6 2sf` i)q,“s&2!DWY>LFG>B3<?= +G>BwuW37.袟 hY7kk +hbԶ'AZ,>@rlM"oU ^B[t1 ;.YU|qp#g{f?W1O6^ˡn+0 _ugabi11lZor"bamWc:VX r[o~`ꘔ)/,Gw[^ym?WYlq^*Nar#!/jw矋?޿q%F~m;1g31j_ ;ʷj]xO3]7 X5>~[=*]ԽKwu\5ߍ9YcqWxa~kV`}VK  + V4jҌĜT(+e? OjFj=T͠*ҽ F͐,`_V[nqh[gΎ9Zv{lDsxnOxxjwYQ $}o|=6~ +(>J-sļ[=lג'mj5$OTzW#WGy9^m:Ey(8pIji8_UelJd+Yɿm}n$ݰaV i qk;mf ]\6m>.m@3Q2b٩}[&lˀe -0w6U[{Bw%btVBh "h7y6՞P?@yq02O7ͫpSn,v,O-͓LѪgsL{+p"fk9jL}/nrġ,IB2q).$h8Ų|t/~ӚƄ2Ix>P~ ]hK~b S?<\;c|y~nם<Nxs{:zn]L7{"H }Gs;{t=~UiPn~ )Ɗ1a_O}-_>w*'r8|5? +*h'S>lfqH) +_dQFS?fe׍Bѭ:F'>_^w^U- +N}>B oNiX9/n;,"|/rFhW'G5fPl6Qt4ht +Y324R5Š$-MnDoxZ"q^K -֝7^6e,C0*S;юE%3}qƵ +qoa a=s.NٗOWS$F>Yi%Rvoc;P/DW5fNi8|b7}XSM=6>mi +endstream +endobj +222 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 221 0 R +/Resources 4 0 R +/Annots [ 223 0 R 224 0 R 225 0 R 226 0 R 227 0 R 228 0 R 229 0 R 230 0 R 231 0 R 232 0 R 233 0 R 234 0 R 235 0 R 236 0 R 237 0 R 238 0 R 239 0 R 240 0 R 241 0 R 242 0 R 243 0 R 244 0 R 245 0 R 246 0 R 247 0 R 248 0 R 249 0 R 250 0 R 251 0 R 252 0 R 253 0 R 254 0 R 255 0 R 256 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +223 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 790.370079 498.679134 766.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) +>> +endobj +224 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 769.970079 491.179134 754.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) +>> +endobj +225 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 750.770079 498.679134 727.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) +>> +endobj +226 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 730.370079 491.179134 715.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) +>> +endobj +227 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 711.170079 498.679134 687.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---hostname-override-argument-is-not-set-manual) +>> +endobj +228 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 705.770079 491.179134 690.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---hostname-override-argument-is-not-set-manual) +>> +endobj +229 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 671.570079 498.679134 648.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-automated) +>> +endobj +230 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 651.170079 491.179134 636.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-automated) +>> +endobj +231 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 631.970079 498.679134 608.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) +>> +endobj +232 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 611.570079 491.179134 596.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) +>> +endobj +233 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 592.370079 498.679134 568.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated) +>> +endobj +234 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 571.970079 491.179134 556.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated) +>> +endobj +235 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 552.770079 498.679134 529.370079 ] +/BS << +/W 0 +>> +/Dest (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) +>> +endobj +236 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 532.370079 491.179134 517.370079 ] +/BS << +/W 0 +>> +/Dest (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) +>> +endobj +237 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 513.170079 498.679134 489.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-automated) +>> +endobj +238 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 492.770079 491.179134 477.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-automated) +>> +endobj +239 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 473.570079 504.679134 440.870079 ] +/BS << +/W 0 +>> +/Dest (rbac-and-service-accounts) +>> +endobj +240 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.154476 465.620079 496.429134 450.620079 ] +/BS << +/W 0 +>> +/Dest (rbac-and-service-accounts) +>> +endobj +241 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 422.870079 498.679134 399.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) +>> +endobj +242 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 402.470079 491.179134 387.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) +>> +endobj +243 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 383.270079 498.679134 359.870079 ] +/BS << +/W 0 +>> +/Dest (minimize-access-to-secrets-manual) +>> +endobj +244 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 377.870079 491.179134 362.870079 ] +/BS << +/W 0 +>> +/Dest (minimize-access-to-secrets-manual) +>> +endobj +245 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 343.670079 498.679134 320.270079 ] +/BS << +/W 0 +>> +/Dest (minimize-wildcard-use-in-roles-and-clusterroles-manual) +>> +endobj +246 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 338.270079 491.179134 323.270079 ] +/BS << +/W 0 +>> +/Dest (minimize-wildcard-use-in-roles-and-clusterroles-manual) +>> +endobj +247 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 304.070079 498.679134 280.670079 ] +/BS << +/W 0 +>> +/Dest (minimize-access-to-create-pods-manual) +>> +endobj +248 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 298.670079 491.179134 283.670079 ] +/BS << +/W 0 +>> +/Dest (minimize-access-to-create-pods-manual) +>> +endobj +249 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 264.470079 498.679134 241.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-default-service-accounts-are-not-actively-used.-automated) +>> +endobj +250 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 244.070079 491.179134 229.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-default-service-accounts-are-not-actively-used.-automated) +>> +endobj +251 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 224.870079 498.679134 201.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) +>> +endobj +252 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 204.470079 491.179134 189.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) +>> +endobj +253 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 185.270079 504.679134 152.570079 ] +/BS << +/W 0 +>> +/Dest (pod-security-policies) +>> +endobj +254 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.622493 177.320079 496.429134 162.320079 ] +/BS << +/W 0 +>> +/Dest (pod-security-policies) +>> +endobj +255 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 134.570079 498.679134 111.170079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-privileged-containers-manual) +>> +endobj +256 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 129.170079 491.179134 114.170079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-privileged-containers-manual) +>> +endobj +257 0 obj +<< +/Filter /FlateDecode +/Length 3764 +>> +stream +x]m$>b>,K*1Đl6y%&>k8C~J=z)uճwg~ZUGU%iz{Y'Q!D|y:?iI"ѝ,/1^m8 +#DcOwA+p8E+|vyܔ9[%_~"71/[5ƉSޣ1n_$ + lj +*Y31 ~&T&2*ZG0R*F(LdxXi=A4: 7PT:3{)Qb}M(.)üۙ=*idfFR{@!pʶ(kDX搝&*NH蜟p +(qf +I=*> Q:!RdٓNE~)G*V1`f3fR˳$Ɖ%qlMpjYjbՑ3&9pcS&0=93Y8#NdiCpjmT8csfz"Cs&qxΙ`̇0z9ӱf2sL? hg93&29g"/Zs4\Uf2sfz)IO8EI`grLl"c5LSs&jك +>1p \Z&23 pfӜ39N8ETaij gĪ4 A/3¾Y)Mc$O_<N>[DK)$buyC[;L^MIw8wt}88zE/XB:lt4ehAxWa ɡו9jJH4EHnPU$mZ+U_]g Z0(;a00zEK'-]Tw& 4\$_WCO] ] ^~/ZiH. <5ChP'ۆ;\V橱{%!wC&*<+`|nTq |ף\FF2YG~v_E{9 y>~ΑmE/dõ:>Ƙq=z]kuEo{h"6vm~';r51=j92lXu^`g&ۢ\kh\hYl{X_$3tnxve?6/ڗ21};wFmi's>nުpI6^p6/S_/? G6=FgQu9*5gyb?H+/>X v-1Z}h:I>~|9'(Iщ2For>XGGu[m)_}83&.m 1eR{Pmql8604n[m=r~ehje/bZ+:l~e,|y9zq[>orvRy0۫jꁶd9c~50ʎ6 + e%KET:{IczbM: Yrc uAgJd[h#꺹M[߶Q[&~٭D4钒D-7N:6H݌N,(jRUG6B\" +Ӽ.W{9j{O)<|e<*Hhx5u"r=kd(G]-Ȟ2Vj^2( [<|HꇏV4A.Y{Lvȗ_ 0&Z6\KZˆX47j4@Wu]{ANRC;%NX&}Z ӷDS0;FG3Z\ A?Wl Px2gyT~Vקq,db5Pt=b~dX>um wMb$-M3JoT.prU+©֝+$PP6j +b3Av!l mA-5c0Yrn.]gEs^N֮! +bP bV+JEـ42s|Tb@P.F)_B47SP:~->(Gqj-=\ l) x"?+4'A+ڭpm4ԇ*͂5UPESY7]4 Ϛ$qWZ)M, }b:f e%C VEo Mhu@kl؋O%H͇:t_(h xYyNd^M+S[:48Ndw4l+g$%VSq!FT(Ͳ4 d?J*l%N4"2+. !F\kT;{F8^{6ٕHhM}hXBkv9ui9vs%xj[VĞmj݉ ,@R)SZ +EM}ˊ[|S4'iT'dmdSْ ٷ&Ya9yuEIڂmucT۳6C\vm$_^;[FRV u C?R`{i8y bo7K["eDjb:xn7*`>-)'ut " +endstream +endobj +258 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 257 0 R +/Resources 4 0 R +/Annots [ 259 0 R 260 0 R 261 0 R 262 0 R 263 0 R 264 0 R 265 0 R 266 0 R 267 0 R 268 0 R 269 0 R 270 0 R 271 0 R 272 0 R 273 0 R 274 0 R 275 0 R 276 0 R 277 0 R 278 0 R 279 0 R 280 0 R 281 0 R 282 0 R 283 0 R 284 0 R 285 0 R 286 0 R 287 0 R 288 0 R 289 0 R 290 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +259 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 790.370079 498.679134 766.970079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) +>> +endobj +260 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 769.970079 491.179134 754.970079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) +>> +endobj +261 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 750.770079 498.679134 727.370079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) +>> +endobj +262 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 730.370079 491.179134 715.370079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) +>> +endobj +263 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 711.170079 498.679134 687.770079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) +>> +endobj +264 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 690.770079 491.179134 675.770079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) +>> +endobj +265 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 671.570079 498.679134 648.170079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) +>> +endobj +266 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 651.170079 491.179134 636.170079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) +>> +endobj +267 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 631.970079 498.679134 608.570079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-root-containers-manual) +>> +endobj +268 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 626.570079 491.179134 611.570079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-root-containers-manual) +>> +endobj +269 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 592.370079 498.679134 568.970079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) +>> +endobj +270 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 571.970079 491.179134 556.970079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) +>> +endobj +271 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 552.770079 498.679134 529.370079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-added-capabilities-manual) +>> +endobj +272 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 532.370079 491.179134 517.370079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-added-capabilities-manual) +>> +endobj +273 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 513.170079 498.679134 489.770079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-capabilities-assigned-manual) +>> +endobj +274 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 492.770079 491.179134 477.770079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-capabilities-assigned-manual) +>> +endobj +275 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 473.570079 504.679134 440.870079 ] +/BS << +/W 0 +>> +/Dest (network-policies-and-cni) +>> +endobj +276 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.070980 465.620079 496.429134 450.620079 ] +/BS << +/W 0 +>> +/Dest (network-policies-and-cni) +>> +endobj +277 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 422.870079 498.679134 399.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-cni-in-use-supports-network-policies-manual) +>> +endobj +278 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 417.470079 491.179134 402.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-cni-in-use-supports-network-policies-manual) +>> +endobj +279 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 383.270079 498.679134 359.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-all-namespaces-have-network-policies-defined-automated) +>> +endobj +280 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 362.870079 491.179134 347.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-all-namespaces-have-network-policies-defined-automated) +>> +endobj +281 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 343.670079 504.679134 310.970079 ] +/BS << +/W 0 +>> +/Dest (secrets-management) +>> +endobj +282 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.118587 335.720079 496.429134 320.720079 ] +/BS << +/W 0 +>> +/Dest (secrets-management) +>> +endobj +283 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 292.970079 498.679134 269.570079 ] +/BS << +/W 0 +>> +/Dest (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) +>> +endobj +284 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 272.570079 491.179134 257.570079 ] +/BS << +/W 0 +>> +/Dest (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) +>> +endobj +285 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 253.370079 498.679134 229.970079 ] +/BS << +/W 0 +>> +/Dest (consider-external-secret-storage-manual) +>> +endobj +286 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 247.970079 491.179134 232.970079 ] +/BS << +/W 0 +>> +/Dest (consider-external-secret-storage-manual) +>> +endobj +287 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 213.770079 504.679134 181.070079 ] +/BS << +/W 0 +>> +/Dest (extensible-admission-control) +>> +endobj +288 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.131038 205.820079 496.429134 190.820079 ] +/BS << +/W 0 +>> +/Dest (extensible-admission-control) +>> +endobj +289 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 163.070079 498.679134 139.670079 ] +/BS << +/W 0 +>> +/Dest (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) +>> +endobj +290 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 142.670079 491.179134 127.670079 ] +/BS << +/W 0 +>> +/Dest (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) +>> +endobj +291 0 obj +<< +/Filter /FlateDecode +/Length 2232 +>> +stream +xZ݋$7q,r $w= G&#,YU]y_ɒ/\ρd&璢ӻɚ,4͠>7&4ņ8lbn~;%e_ '73OMSbԔd \1\&McDS+(Zœ8X!q&,a>cI Yf`5 I8ڭJt|Nǿ}:>]HaKNǁj'!3o74(hq Mѳs'4 &33}(ڼMPIx MLbyMH9b>q3]3}Pz*h.tS V ghbr9\r6M6Nc&݉yyYc&݉yQ<;1r;1OK2N;bw'uU@5ڔδvvK<s&/%*w22Vq`~x;}|?_N Wa-\@j ܝoBMA#;V{>o0:7vv]SmK{oQv?,jtx؀Uuͫžj|EԦڦu]8/ }- |$>2 Fsgx<[^xΏuq}Ƀ.vIvl0QkT3ڝ[C{TLjMݛz㎦K-!lrR%6TZ]Yzhq GezJW+&-ެx3sT_a͵ ޺>^u r}PM`,58G>~LŌ'hNPd!A_{!zҧF&Wg9?n'\~i&lc+JWs%^Mx[K *p]}=[arBQU聰8zM;wapVaZ%niQ.٥6(3-&3pHF/(`E+SJASCb;sˬ=9S+d3t2unA<*-?T^6ncF2qQC/p`_۬w2պ/SHa +84_2ДTóR]ԣD`z4xk$G:ӠU nlkjU&Sx*^-RR<0H \KGj-+A$/x$U)YXA8Jh8!zYyk~f!^B)p(FEa^* JˑdG;2:m]R_9=7iJ@Xd]x: J(*]PQ)^4* cԵaeqsp /rI3Rc~31> +endobj +293 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 790.370079 504.679134 757.670079 ] +/BS << +/W 0 +>> +/Dest (general-policies) +>> +endobj +294 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.986019 782.420079 496.429134 767.420079 ] +/BS << +/W 0 +>> +/Dest (general-policies) +>> +endobj +295 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 739.670079 498.679134 716.270079 ] +/BS << +/W 0 +>> +/Dest (create-administrative-boundaries-between-resources-using-namespaces-manual) +>> +endobj +296 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 719.270079 491.179134 704.270079 ] +/BS << +/W 0 +>> +/Dest (create-administrative-boundaries-between-resources-using-namespaces-manual) +>> +endobj +297 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 700.070079 498.679134 676.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) +>> +endobj +298 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 679.670079 491.179134 664.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) +>> +endobj +299 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 660.470079 498.679134 637.070079 ] +/BS << +/W 0 +>> +/Dest (apply-security-context-to-your-pods-and-containers-manual) +>> +endobj +300 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 655.070079 491.179134 640.070079 ] +/BS << +/W 0 +>> +/Dest (apply-security-context-to-your-pods-and-containers-manual) +>> +endobj +301 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 620.870079 498.679134 597.470079 ] +/BS << +/W 0 +>> +/Dest (the-default-namespace-should-not-be-used-automated) +>> +endobj +302 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 615.470079 491.179134 600.470079 ] +/BS << +/W 0 +>> +/Dest (the-default-namespace-should-not-be-used-automated) +>> +endobj +303 0 obj +<< +/Filter /FlateDecode +/Length 4723 +>> +stream +x\ێH}g"!E$ B<ۻB=H >'mgf}.rD:y"2첾*|/9=cpˏ5Eo1oU+'sHlb&mrx)`rv)F +%,)XPGgܞ3p$JPú힕1G +zhA5`xFO!e)/aStVƳƔj5eu[e5ybLt]|&@q LK.10)O.F`d?#4xF3 +xX ]V.Ak 0,gXC0,[fX`NpbX`6ǰrJaZ`' r ,P`Xu)0,]bXLʃ.`@d8*2,p],#ð^abe2))kr pDʋ֠eXc +,swWagQB`jxஶԌ&+3,@8LI+.Ix.`0,@TP^HaxRC.{fX[˰ wCCy&ðu xXdMXR0pWixJ̰ wKdXb!İ +N Âܔc BV䣼03, +ȢM(>yJHdYƃuy r(qb[Kn_X:<9qa7.9-Fe~ߩuy r޼y~\ɠG-w]S9,뎉dsA.s|:.zXh?̇ ;.1~0<qa_\5ay!ox3. ދ凑VE__0;{nyGKҥ_xqa_\5ayš`zg>\Y>b{{t!5 w7iœQoёe x-%3;.$W _.W;J ~~\{\7h+{<̎ ;{_,s;FN~~\{\7h{<̎ ;{_,~󀾟> Zr;N{ 'd\Vt՟~~|JߛR6i{KW7/4i<~VW2ulo9eV_W9^ZVʹ~C6+f;q-o9[~hVuàWSȶx2'nyX9;sm rױvM]w]}7`JQ<0Y/}~z_UPn|W-zΦ OW. r>SԷx=zϸ|͔$IznRܞgK+8yxv}lUEb뽺:,l" 1?ڋ?4yr^5伵r[o㓈ǦjlYL* +Sއm%PvVKbVK'Em0\+ c$u\ ڧa$.ɾ@zTbApMn'uygKӷ1_9-~dZĮ@;Z:P֏}{pӜޔ;2 +2Yei7][qZYf ۲DwN}1]?]u`#uCPݸ ٴ5 +mcVȼ7=a/Nm)U  SٞB$ОuF)₹k6YR^+l8eD9z+m)iy;GZ2Zg7#mkl{p]+SOo¿Ke ѩ% +h_RW]9;"W"wLZuy;W|!D׻ӲSz6a,[n[T4A#o +endstream +endobj +304 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 303 0 R +/Resources 4 0 R +/Annots [ 305 0 R 306 0 R 307 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +305 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 740.570079 409.271317 725.570079 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://releases.rancher.com/documents/security/2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf) +>> +>> +endobj +306 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 351.653153 216.824079 461.230790 201.824079 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://www.cisecurity.org/benchmark/kubernetes/) +>> +>> +endobj +307 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 201.824079 165.615800 186.824079 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://www.cisecurity.org/benchmark/kubernetes/) +>> +>> +endobj +308 0 obj +<< +/Filter /FlateDecode +/Length 3498 +>> +stream +x[Kϯ$2p 6Q9|n35|!ZԬXV8{|Wjm%]IzCoI๸Z^T\i)|MSw|vqL8GZ!y',&Wj)>dRrĔ V[lbAT8=@ n5Y,1VU!q tj# b +rɃ e(=[\-6W %Z<" ,^s9T-C|x -daeBɃ,xDh +Y]A}x\j5|-}ryKM2y()!K<ȒGGcJFFn,^,16yƷ fK , 8n-W +B ĖV, %qdaDɃ,,, ,2ܲo޲BLoaqfpfas iatRlawDi PR"f +.-,`n-,`n,H&8 YXݘ+swcF8xB]@E‚ ψi e p7T5 +4n-B‚E" pY-,;dhaABx wQ7$ .5yV X ;_$&88R`YXQ/˫+-VS3ʿ Fy槝h/'＝x~;{z;oöX?b:5w{'w9'{|oi} +Z2l ȿ%xC==Ēy䙒'M4EV撹ZǼe_(5G]nɡ#<y4V!GJ{ߡN00rzLwnO<~-p\ūSs esC n\(ZA4B|b){_)xvfE;;`9SM9[vcY+-Pr]:?L&X8`gGZ)4ʝ.9,WL/šZǼ0)io91M sߥP,6RP0H*c-7 >A78R93:Jdy}^c?|:,u |i,)p6ڥ>7^(w{e{嗏mF$&r%=Ӵ4{#Lqrީ](2^KH̖?)NY6NF6ֹ!u +T\(9p,ܻQ*ܙIA׎ڜMk +إ 󀴵l!wVIX6$W7e_ݟ է$&y("O^b[4?4~a?^n=*u)(.pTC{lNՅ(߸3;FC'L+6_~|? / UcM(B<\;XI>b̼G?0i.m=As؍Oc\_9o D,d8:[y5!k5Er ry#ئ8Dת o,ʜ/(}~jR哜1.砑Mj=Ax ]Ns?fsFÑxkA~liZ^u mCKT E"_4,UM#^Ng$.;-i&w_U!4M^ TIKɫZHlNQI'갥eU +L +tg况ULK HM8IX~!Г+_%g\,iλybU˴xS9AƷdq:Yg[) Fl︚Z*XԟTbVw}eޑfDJڝڝ_=g-Y Z֣'WOȶg ^U5,$1/ޭ^߄ BP(R^ a^pUW#yw%7"Ds8&%۳E^f鳇5on)'VkוBh6iU./~kү>3]B +endstream +endobj +309 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 308 0 R +/Resources 4 0 R +/Annots [ 310 0 R 311 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +310 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 739.370079 128.273270 724.370079 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://kubernetes.io/docs/tasks/tools/) +>> +>> +endobj +311 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 345.193925 739.370079 356.281327 724.370079 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://stedolan.github.io/jq/) +>> +>> +endobj +312 0 obj +<< +/Filter /FlateDecode +/Length 3610 +>> +stream +x\ߋ$~b 'K/0C&Z\1[\GqoV]PHH3QX\!1 rlqA3eͅq +s w}V 5Z\-x7-.H]  (,.@~suMYsjqAW0)+,.;: EzodODdg= P ak4U#’w} +[2Y\6-.EX-.Up WvlqAn2|,;' @Y pa PXFZ\P"t-.(dkշ=.ps`2W%e`UKtm*dX\P +;`qR"-.;),.4PՈܒ"T`qAՠ5V2{Iڒ}frvR*Z\0NLiʠ hl`m).Zl7BMo .,.h>;)-.C-T7#[\f~[<#neo CŔAM͈[p`'KKllqAYo7/ Torx750%2MTރxSA}f 8yzry{y|ed^4Yl^5@Z0x'ܮ>KTP3kI6{ٌhv>/ ˕#$HAXذO0k+*Lrb/'c[ +v-`]p5ZЋ'l#)Ͷc8 ws&WIϡu,^Na?>5A*iM`8N,mu@vY]8bخ5Z[/ZekUs,Q²}mn|h[8-c yjPU>Tz<ێ4}(>499ԴeK*+w>~1Xvc1v@d)ۿK}fr>~yDiՌ!6|/| >3Wr/xY=r.E` ?ϯcLSvjBkːv2dm߭۰ }A!ʎ8 1f;nڵГՓW+uOѥ7k}׶rߗMr3|ڦlZ[&ﭷ+>‚`bޯ#,-lцwVQ}qJr~𛛬ja6Vn%yeeh^M76mp0bN7U~2%y؏nEՓVi]9_#f9mBs{966NZquێ;ւnLkĉD*++g(sum.;[[z譎o~yoHOvLo9 ݗI`o-[X]ױڎtw븱~ۖ`3]Zu49si3(1Bx8˲=<&;Vَ2fg[}tjuu8sGn٧72~|sy lC'cߟwIao|&|W6]e˒}7V8bgKkՊ^Z6$w?=yW ّC;˳ULa1l8q +V/CfWe߃W$&|= ؀',Տ8 vH4ٵuR 5>9?-Ϧ6@{VXޢQGyru<@^z5܄#w}u ~\M9 C(m +z:8SF3%U83CQ)ՀmjQSR2L/^ +ԁ*#䐦g]wljm1z*jUcb³QZp:AiأQИo*I Š `cui,ˌi2j- #&*VoTK4 +ݹrԒ>{<[Rǎcvmj<ɳ2thQ1c>`?˕P+9ל!,/)\եG둰| ~O[+O)=w|h#,/x[X."[Ey#I[5TG\>Y~r +endstream +endobj +313 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 312 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +314 0 obj +<< +/Filter /FlateDecode +/Length 3664 +>> +stream +x\Mϯ,V 0 @A4VݵҮ[XͰM> EȕRsɻ=-56E~s<"T +8\c|\/N^CjM7v죡PybC9d9 VK1K*-`HP`GUI,`PP +ޛ:" E`dTj.CG9X:fP$KW]J)K''K%t"\K‰P2[ ,֩ :`ɓb-"BK.G]-M6uXQ ]c5uK"tȹc],]:`[ , + +rK  NBNrfBNR'YDX$ ErMp 8 *X\ ,A +݊dqoSA-.`0.$0(T-.`p.;-.`.{SA,%Y\]xW:`[\vtL-..x(X\Yudq|ŅR ŋ !e5x7D }@AB?h1X\T5 rTj w`L]uaqcʎRD.[\bq8! "xҁw)ToqA"o!͑뚺|-- /`S,.;<Ex$$=X @eki$0z [:Z\6-.HYX\Yp q5dqA:|.9CAYX$H]Z,.X8 r  #p}`d\"䘰U-] +dе+Q gqdqR`[\w.Y\БX\+`X\PJ@fnXd[\L:" JdPLDh%ajK'^"ihq v`JS, 0?َ`&9X8n JMof d|TơJ `]~X\Pc-n+'of KDbIS5-8 MKX\PSfi#lwc3Y:.2dq +o"33[YtYꍈ摁"Ze|ud&v%P7 <8z4Q%CF,YY,}sj@?|{?/Cp~kd rK{&HSQZ\$B1m=/ Ċ,#M*抓Xf r=LɂXdl7zͷ3|ywWzLA?4^.;ˈy~~(&ykmMr"MxG~_kwimE^zx߲i}Zڧ_Ytrų}p :Kr0d7iHPjh[|սPUaewܴd߭m=:Umzi2Ode68S۴4 ~L۸_\\q}X}bgQS( 93P~A_igZ?|vJE*Gk;WO7;\am;ˬiV쭿FGF|">:PekGg~:,N6:iXrkftNcm_qI Y'ĶﶳE>;m=Ol `$pߎ->mlixB3c;-=dcoD󔯿~~ qح۬k>n;I#Dc;&>;mG=>eͯ'LoFL[&`(1o?"űO)~x)m#E=~O#EѕۑiDHGFߎ~ڍQtvs7kۗ];~zSθR[Yv~+ީf zw2+!Yj1M>v~=y2pˆ#@8mC7}󯩝m~1sZZslեvy{CrƕzmhS~hun٢Eh1v?\Hr#(THT)Mw1?'\o^ak)/;zcǛäP 7/2npj43L9ruҖz̷Qn̖^7 +´wz%|CYXD9^';)rar.R,r7՛#6Wž,ļ]~Hu?sOy*fn=?mI_=Ayi˱89H<@ Zt#t| +=Rs,UaYX5Ckm'Vͤ=3~3h{Y -۹:nw׾wmKnYy,~˪&Y< iŰt~=wj׷I{SanXR[kH~ +C| xDm ui &"_RUv>(UkdžW&:u*W㵔:fG2 IB?u7AGvhV7i:o /'t{)ZSͺwOjVOy2D!|[ӂi1쫰4G^zr2뭭>S*,? W o.SnF<[nS\2M8/(}%)fv\csYS]\!ͥ +K!VJKy/$ݥAQ⭑fy#H;r>;ۋ7+bdIk$c+u]ӹr q|/{g&w!N;gq3NVA۝| /K`X]N8Fgp) EVkg'}S}̊O%A؉I_,:uNr=}w[79+=ue3 L?TFؼ&qjRgPY 'q'Ί=y܌}-ra}Baex$JZuth%L07a60!NSG)saJ#C'#M72 +R` sBsuy_!TکKgiJ;R^i[1ZhwX䌥1R fe\VsdN[tobnzY32bZ)bH-YFC]mE-qOyΏ=,,WwdǾewi2qY<|=e/XrBeDŽ@-9i|I "vq2|5J'"d g?2dC>jȾzsHf__YZBuT5-.|+L1P,?CvƏ +endstream +endobj +315 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 314 0 R +/Resources 4 0 R +/Annots [ 316 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +316 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 205.473057 101.433071 186.723057 ] +/BS << +/W 0 +>> +/Dest (cb1-1) +>> +endobj +317 0 obj +<< +/Filter /FlateDecode +/Length 3947 +>> +stream +x\[d ~_UU I &<0yϧ:u;}4=dClRI:=~>/59|ˉL +o +gKL%pY>TKtWk7cΔ _{rJVWX!\ ++Z% FHJK bsYae9Yde1l IaY<B)<Lңs\\Qy <6XWL1dǐ%/@`IA9iY| kYS^, ExJfVy<)y {x֚*MI9)Y'9;)79CGNئԛIÂB4Y8xDQo:ְ~)fְxBOԛI% EQyISQz"dq5,(1J5,@zz$Lqp7 "3&2['oHtf3' {zf@_C2GaLKӧ*bfN`d3Ͷ_<}{ǏIY0~ϱb_7&m'H$GHe +iMD(F-E"E2SWƻyQ*X앏od:B݋/ {_wyuޫ;R'9=ռTEY;$2mz] +ڼ}^y;G yv# ":d 'o~>}?~ş1} +=N|-qeNmsWC^~CC&6zl4eч־}\ۖ趍J}kjǩzoǐ'4ioȢ.nu۸xSˏ(L ,[,fo<9"V58)QAwNnև!/*Zv87/YCc+id^7?;MAr$Se_= =,,| _Tf/AAO7Sn^}Z7S˼[.YcxVM -(@`rq3JIZT[{ѻvY|vzXKfw+zqku֎.sn wE>nhvYmk՚=*ʫ-RWf{s깲+mHFL-ՖGK>6-Qr va hGЏ ~л}8c7{X[q}Dr;Ďp0Ǻw{o]`7,w{Y-ui{Sןfj1tTT^/`_TZgu.{efg7)fޯC.ʼnos6[1aK֚~o2\jQ(ّTL[Plo')>9ӽi*=t/ibO {՚2궕D=e[̏R)rjҚZ>cAN5C/b|x>L n0=\L󋒜vXRn_ݦ6ߗ,yrB-khJT^f\r$6Մ7-n.e_2|hv)޲\& %f,21L *;a/H;vY.Kv{Ds]0ƴ*O떤Tu/nEq+x8_Q~/腢.k^WE{qu=y7h G{7ƴýܮ^2m}i/2}5=ul{1cmca9^6ezۇۺMؽS56ۆc]w+n'_g؆y!'ޯ"a`roߔR.;cCBzg搣$OGv#9Ov>Î"fK%;^_GR@PoiynXM^0rzc@ )|vNU}P e[|~Ws r])3;ƿ} mb},WS(fczl@g۷V3=V%` 墵n(!^4pt6Y!3Wc!qW 7rFv.HлCLn+DHՓ,/fU8pv|l=-p$2$;XyIb.N}U]ui[I>Tyծյh"T[ O +rRS욼s7$Jo.']-JU]KeC +%y,c)/v)I~:+P#/ri/rW\qo0mu\Q\oQHw|~?EzT!2sGUO)h0adž נ:@Ki gzcz|;t |w?|_7O?Mo|瘯KZ_o&%V"Sm_77c襦{o¶*XzuW_1D+:ʰ0^6f< "*݀?.ٻ 8-nOA/DڻH{[DؓˌiN*EoP@IY1zDn#56WKtc^k%4IW_v\y^cklǩ[Yc\읯% {Xwq|Z+|cʺ=mʫ+X9OS43rXh}Y)iks?8~(bw:mqK2/\h\~aHBFߋi3><.cqgu|t=|=f";i-Z/{-CfZs֘5xˤif1KF}[Nʡ/ych-iDWnuϮyrV ftOE~^=>Ǿ?m*JS~$S R;VDwA8BcN~^}>Ǿk.,Vcƺ.6^&M|~ +WԈ2HG2F2g)[#Q甉5nqs;1T+?_~wyyv2ı9}r8ig\x QoI(\x!y>NӞ8Ӫ5og`O/+c]mPv+72^uɶi} #]H)\ƻKݴBqg3:flp<')烾چcz'% 6M~q?sBj}G}dtLdrq}Z%!;\bEFXG}D]NPSݷh8}z1v5z~lsvB/O]683X_N\qnJLfG2{IB Pwץ!Ϯ!Or°ޙR}uռx2vil-H'Ct9ϩu-̮fMg +K $jkg.'[3{2NÔ\ e*̳;q+5)nAx9:VPl7 y귋 x\4L]Y>`u0AtmvI߬|98,C#%.qMGJVt"Nq8 Xe35 A~u`*#NFn*&(y>;?Z7Fz&Tޥw_J;l)/i{s-Ok{3(-ds0$-㴵A& EddlJi-KC8Jwbg%j-j{phd1di>Ke&;-۱[=O!Ð4*SC߇9V eD->swPI }M7Kn9+9iJ0N){m= wPSW7اU2/pUG Z~]rCf*oga-zT~; +endstream +endobj +323 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 322 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +324 0 obj +<< +/Filter /FlateDecode +/Length 4631 +>> +stream +x\[$m~_V+ 0XI~00,0Ӟ C~>Jfw9sAOwPR]-s/39zŚ,#>)\d+1/BdR >./?:M)ѻpWa1SAa#Iɇ3b) bĞY bpAcA >+ 1{V>9XÕykU &BQygb.K^1b %8f SN/BdUd9KC;Ee*h+dB*gs%ų>YCH_Xdxi@@, Uy +kX@D3iX@@[hX@[iX@[.jX@\i5, . T4, `.;5, .=iX@@] +kX@]5, .0p5UdkXt42iX]r6iX]װj`Q؊9[ e BK>H0p A]װ}԰b?Va=x4,@c#-Ѱ w]AS|he\.QÂuӧq WZ6.ƢaA"P  "װ w!RkcXKB3TQ V@JY`~d4,M,sTde5,x5,mz3iXP,dAƧaAHa`|@)Opnwk9/e1c׺PPe*]ii:ijRv¶>3V*NR_y]I՞>rI< knù'[y~jȹcÍxMkꛧNLk]7{N޺ SIWh15۹קrP\oaO~Yk?w>i~8q5]F}n~1cT\s5԰nE}:_v91G~Xm{? Z,u-J]|]c~{[ֱ|]y/B֯oFU~-ETBPڷkO)cex[bk1 '`oۺjТ(T%Ylɖrawh??X5skNw~k$jx x +i +D_n(J,K\6#pu~(tyCLW/ʻ&,C-z]UNXV@5.9#mqIEȑҲVW.W:@,]:F@̀`ZrI.qǙR9b:H " r4uqQLD>nG{x#s=<Ԑ,-aN0ME6) [6n96l;Ek +TNGq <Hsu>6hnr'{ rw]=ΧLXK6*%9B9OӢ5YJ4S8\Ꝭ&ZپE_m(*uarH\ܮyq ÒZ;.%r7ڃ},TS"`V]g?U(c_MXy#z^<958o/:\y4#у,lk0r[-vA$"ZV'-7^$Ó?>x,R_Gqa"cs.&z˜1ˢ-Jm> ʍP\g &[QF(6:۪0[tJy·QNf1;1?Ol=#Oǃe]-EPV躺]&G Ѥ +<5=%Oq'vҍwdiXߵ\O^OKNO=ʷܴNNlNJzi_W`,HKd6\ l q&WjiK Yy݆> +endobj +326 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 507.723057 101.433071 488.973057 ] +/BS << +/W 0 +>> +/Dest (cb9-1) +>> +endobj +327 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 488.776036 99.933071 470.026036 ] +/BS << +/W 0 +>> +/Dest (cb9-2) +>> +endobj +328 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 469.829014 99.933071 451.079014 ] +/BS << +/W 0 +>> +/Dest (cb9-3) +>> +endobj +329 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 431.934971 99.933071 413.184971 ] +/BS << +/W 0 +>> +/Dest (cb9-4) +>> +endobj +330 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 412.987950 99.933071 394.237950 ] +/BS << +/W 0 +>> +/Dest (cb9-5) +>> +endobj +331 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 394.040928 99.933071 375.290928 ] +/BS << +/W 0 +>> +/Dest (cb9-6) +>> +endobj +332 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 375.093907 99.933071 356.343907 ] +/BS << +/W 0 +>> +/Dest (cb9-7) +>> +endobj +333 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 356.146885 99.933071 337.396885 ] +/BS << +/W 0 +>> +/Dest (cb9-8) +>> +endobj +334 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 337.199864 99.933071 318.449864 ] +/BS << +/W 0 +>> +/Dest (cb9-9) +>> +endobj +335 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 318.252842 99.933071 299.502842 ] +/BS << +/W 0 +>> +/Dest (cb9-10) +>> +endobj +336 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 299.305821 99.933071 280.555821 ] +/BS << +/W 0 +>> +/Dest (cb9-11) +>> +endobj +337 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 280.358799 99.933071 261.608799 ] +/BS << +/W 0 +>> +/Dest (cb9-12) +>> +endobj +338 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 261.411778 99.933071 242.661778 ] +/BS << +/W 0 +>> +/Dest (cb9-13) +>> +endobj +339 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 242.464756 99.933071 223.714756 ] +/BS << +/W 0 +>> +/Dest (cb9-14) +>> +endobj +340 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 223.517735 99.933071 204.767735 ] +/BS << +/W 0 +>> +/Dest (cb9-15) +>> +endobj +341 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 204.570714 99.933071 185.820714 ] +/BS << +/W 0 +>> +/Dest (cb9-16) +>> +endobj +342 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 185.623692 99.933071 166.873692 ] +/BS << +/W 0 +>> +/Dest (cb9-17) +>> +endobj +343 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 166.676671 99.933071 147.926671 ] +/BS << +/W 0 +>> +/Dest (cb9-18) +>> +endobj +344 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 147.729649 99.933071 128.979649 ] +/BS << +/W 0 +>> +/Dest (cb9-19) +>> +endobj +345 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 128.782628 99.933071 110.032628 ] +/BS << +/W 0 +>> +/Dest (cb9-20) +>> +endobj +346 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 109.835606 99.933071 91.085606 ] +/BS << +/W 0 +>> +/Dest (cb9-21) +>> +endobj +347 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 90.888585 99.933071 72.138585 ] +/BS << +/W 0 +>> +/Dest (cb9-22) +>> +endobj +348 0 obj +<< +/Filter /FlateDecode +/Length 4926 +>> +stream +x][$m~_ `p8 yGuR]xv0;]D$#R29sI/~=Y_?7YJ]ϿHAH&)NrvoN_qgoJ_DeT@.($f稐3R4D1dH +)C@Ʌ-@ i$ +',pZA,Q +ͱѼ31_TZ%B01cъ1rhYX# PIEb* FKctBːڕUd:VᒉTZ攷4opj4 C7JEabRhDEAkY? 8!X68ƐD* `55% |J' |2e |.R + †bI@N`! SԐ 8B\YB! ,aASа m ڢaAܒ-NÂ%뢆 1r$  T4,԰ taI (G p7p7Ti +a &  3`V 0jX]1>gaw}aw} Pi[<7p׳pד@Q Ǫpz8Y߃惆`f<  +ܟb@+r0peLJ+%beb,0p*hX]gְoQ uZw/V"n` !а8 Uiؒ ,y @ iX06q ^4,]!hX4װq h0[Ŧ kfXwMEÂaALRೆ +L5,łOEkְ Y0 KAJakSB$Y$Y2hX[M E R԰Hfr!Ұ qD>Qhћ*-撆)+v 2FaHa͑@pE&{DA 9 ,5,>#ˌVxhjFV̬aAh$T԰fLH `B̏$۬a$HsTd L% Y@7%L YiXPl4&kXZ 7=iX|3kXPEOIÂB4Ȃ(v LB thB% @^]Ȓo&uȤрL@V-3%ꊁ2|d`VI]3_ɑE2GunDge EKT3s,0 BtsQ-S>~9%f1_0݀+S2D16"D*CHX\DHbrZdH,2;3hTzw':,w A7|8vm\yAdeM12YBUޕ.ȿÎr }$H/Le6ҙXv<b$$"+ hl_NrK%ϟ~9OOn?wr'/ڿ3c/e~Y -/^^D/?ߗі !erWle Q3-["[Z۰#cϊHb-3Y͗A9|?K@!EڽA19ăJcLLap "!:Km:RwN4Yo;5=,S9/6= [J9{Dr;zC=ɶA[Ln32l^y$dL::eNZkIPiP=bd'(YbSGMgZv˳N#x$5pE*n*HŷSaT8G[ݥU$UifIAW0;l[N(01y cs|]CZ++>Dy]Y=N%_HPr V|JLjΨ{ 'ֆ]mg|X=vv i-G}ivӮ ,E3nWxZ"$L)(Ÿ#6o%{ĩg@]5X U~82ȓw>YoR>2W#yFI8X{(h rl,b>bcSFJU a͕iI1$zܽ'kk59*{-gd_giMA.k6aTڗڔK=2S6Q4e6䲎|_gABĥQj +p9<ՎI\\"]u<`0ǘwՍ5,%my޳폨^FMrg} ֒CM>ț=wQ5YIxz9V'^ 썋3ǚ| G@tͶ=tu> 4˖8$()Ikv+@Ft!K &nGX3I^'M+HIw$ZJG$#w?-#DKDK񴒶r(4-{B㐳lcLp04>ÀYyʻ#YNhyOhИ\0ǚ|%g$+>Kц|8b;L#)l:Q#gs+qu> )݁Gn +`3l}ݾ};tuv= STZ}D=޿kC`/5&~گ{!X}nV}H[ rƍVM};l25yO99HB:V Gzҫ:g}` xcyݐE'HZkf[粫c) v7t:YqM|wv_,]і6}S{w#U=QuywKVޟ+Ns5zUxuwTC}b:&Iż_y1-z_yt*i\siձw0L[!#Yn6wEa)[V(w}ϲ[A5t]-H= +/q6ҺQikn0i]]Y-W9T8'w-Se >[|Knη: g[O E?VyW:_Xt]|Θ~>^nlU;S%ȸx…FOh桼>3l;̩t5q}mftpBV3QhV@kCo-q8)y`zsalRyA \6KyG]lq5:AcGFQur)ueJ!Si HuXuX Oʹ6!(o!'wSe;nRw|Gq6>Nvη—XT?NFo[9Fw뫜(OK#wV]ik%sOC!{t@(UN-<VnPJP┺]<=IA,_{-j +endstream +endobj +349 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 348 0 R +/Resources 4 0 R +/Annots [ 350 0 R 351 0 R 352 0 R 353 0 R 354 0 R 355 0 R 356 0 R 357 0 R 358 0 R 359 0 R 360 0 R 361 0 R 362 0 R 363 0 R 364 0 R 365 0 R 366 0 R 367 0 R 368 0 R 369 0 R 370 0 R 371 0 R 372 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +350 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-23) +>> +endobj +351 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-24) +>> +endobj +352 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-25) +>> +endobj +353 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-26) +>> +endobj +354 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-27) +>> +endobj +355 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-28) +>> +endobj +356 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-29) +>> +endobj +357 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-30) +>> +endobj +358 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-31) +>> +endobj +359 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-32) +>> +endobj +360 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-33) +>> +endobj +361 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-34) +>> +endobj +362 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-35) +>> +endobj +363 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-36) +>> +endobj +364 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-37) +>> +endobj +365 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-38) +>> +endobj +366 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb9-39) +>> +endobj +367 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-40) +>> +endobj +368 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-41) +>> +endobj +369 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-42) +>> +endobj +370 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-43) +>> +endobj +371 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-44) +>> +endobj +372 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 340.338585 101.433071 321.588585 ] +/BS << +/W 0 +>> +/Dest (cb10-1) +>> +endobj +373 0 obj +<< +/Filter /FlateDecode +/Length 4729 +>> +stream +x]K$ȳH" c>腱SmcQc`QzD$3#f]Ȫ RE~!Z|+395)X%6g|R:Wbן@ɤ| ~.⯗mw]󋰘L)٠ +X֑ +CTXb) bĞoY bpAcA >+ 1[V>9XÕykU &BQygb.K^1b %8f SN/BdUd9KC;Ee*h+dB*gsʷ%ų>YCH_Xdxi@@, Uy +kX@D3iX@@[hX@[iX@[.jX@\i5, . T4, `.;5, .=iX@@] +kX@]5, .0p5UdkXt42iX]r6iX]װj`Q؊9[ e BK>H0p܂>Xaw=a  w!AO V{Ne}||M])k?OX|xLm B*"$|W%#!0n"&1n/n+4dҙzoѢKJ!Y7uR"1`J~|_?槯+k rV/ > =`v0s?-6eۏ46R]k?,]5׵+=v6D<ֺBCڇ_YoD[>m沿Кk3qǵUXnk׭&4KkZ燵Q-M:T/VjM8hik?R|ꊿ,zj ӽƥ*eo5޶=}a_h1ѼʢbnPڷ'E]$DD:.p!$@TLm}!uޅ0+`d07CK E ch?>fj{:Koaa+j*_aRw.ia~F|EF&1uϭERl !Wʿ joXV^su( ײm0x̋SWܠ=㢿@^Q"x(䭗޾_[fr+ Ĝ5XdM񰜩<=*}P@@v(NsUG1bZg Y.Sj&{e, +Ng'<:1sXJlQgH:o;ewzuNvamW D +Bsew4!xyBɘX};G6mj`Vva$cL-M8ڃ^e{hf#~L-GltyOMjpc@*Y|x2\ܶ⾜vN6d٦':!}76]h9Yi t}gqθ:ڈd3"Ͷ9~ju>nbaP=V*OpÇC8Qw{𫪧r(z\2BF#&=,yֶ "5#D?YrBxߚ֖$e&[byc3Wkjy4fF#CSw&32ޒ9wet:Oɲ pc?$ +~5"f!bHu]3ô{k.v1rctvM)؟0Xy Nہ9*In۽hR|dUs qY^lanc6G_G +}S_U .Iٶ -mKm}?q|?en[76no{Z'y6=r7%3\=l @M΅цUʳf=^J~d$Y8_E2[ٷA~uCׯ7; P8/)+׾[bGЪɩl[!ꗎ"jFwKƬdI Wb eG!ّhsk%]uq4Op>"\-*UkM5&JVqRH/mM3Q[bnĽ\iE-H^*i~2LrWB:ZI4|R%}m_.'%$tXaC3HSAM +hr^"t O⸛_3F'⛝ULuXӀ4NBFmv֗V)/Kwm&z*M<[VaM?+gmBAݔ_7!gl,Cowcי;9۝l_j`=YL?NYfS|zgqPܼھ'"</y}$'gY/O0%{wlݐH&'d<݈m& Q64kq yT[IuL CwӕfN=c3rI 1@M*\̷> +endobj +375 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 709.923057 101.433071 691.173057 ] +/BS << +/W 0 +>> +/Dest (cb13-1) +>> +endobj +376 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 690.976036 99.933071 672.226036 ] +/BS << +/W 0 +>> +/Dest (cb13-2) +>> +endobj +377 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 672.029014 99.933071 653.279014 ] +/BS << +/W 0 +>> +/Dest (cb13-3) +>> +endobj +378 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 634.134971 99.933071 615.384971 ] +/BS << +/W 0 +>> +/Dest (cb13-4) +>> +endobj +379 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 596.240928 99.933071 577.490928 ] +/BS << +/W 0 +>> +/Dest (cb13-5) +>> +endobj +380 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 577.293907 99.933071 558.543907 ] +/BS << +/W 0 +>> +/Dest (cb13-6) +>> +endobj +381 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 558.346885 99.933071 539.596885 ] +/BS << +/W 0 +>> +/Dest (cb13-7) +>> +endobj +382 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 539.399864 99.933071 520.649864 ] +/BS << +/W 0 +>> +/Dest (cb13-8) +>> +endobj +383 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 520.452842 99.933071 501.702842 ] +/BS << +/W 0 +>> +/Dest (cb13-9) +>> +endobj +384 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 501.505821 99.933071 482.755821 ] +/BS << +/W 0 +>> +/Dest (cb13-10) +>> +endobj +385 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 482.558799 99.933071 463.808799 ] +/BS << +/W 0 +>> +/Dest (cb13-11) +>> +endobj +386 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 463.611778 99.933071 444.861778 ] +/BS << +/W 0 +>> +/Dest (cb13-12) +>> +endobj +387 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 444.664756 99.933071 425.914756 ] +/BS << +/W 0 +>> +/Dest (cb13-13) +>> +endobj +388 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 425.717735 99.933071 406.967735 ] +/BS << +/W 0 +>> +/Dest (cb13-14) +>> +endobj +389 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 406.770714 99.933071 388.020714 ] +/BS << +/W 0 +>> +/Dest (cb13-15) +>> +endobj +390 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 387.823692 99.933071 369.073692 ] +/BS << +/W 0 +>> +/Dest (cb13-16) +>> +endobj +391 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 368.876671 99.933071 350.126671 ] +/BS << +/W 0 +>> +/Dest (cb13-17) +>> +endobj +392 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 349.929649 99.933071 331.179649 ] +/BS << +/W 0 +>> +/Dest (cb13-18) +>> +endobj +393 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 330.982628 99.933071 312.232628 ] +/BS << +/W 0 +>> +/Dest (cb13-19) +>> +endobj +394 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 312.035606 99.933071 293.285606 ] +/BS << +/W 0 +>> +/Dest (cb13-20) +>> +endobj +395 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 293.088585 99.933071 274.338585 ] +/BS << +/W 0 +>> +/Dest (cb13-21) +>> +endobj +396 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 274.141563 99.933071 255.391563 ] +/BS << +/W 0 +>> +/Dest (cb13-22) +>> +endobj +397 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 255.194542 99.933071 236.444542 ] +/BS << +/W 0 +>> +/Dest (cb13-23) +>> +endobj +398 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 236.247520 99.933071 217.497520 ] +/BS << +/W 0 +>> +/Dest (cb13-24) +>> +endobj +399 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 217.300499 99.933071 198.550499 ] +/BS << +/W 0 +>> +/Dest (cb13-25) +>> +endobj +400 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 198.353477 99.933071 179.603477 ] +/BS << +/W 0 +>> +/Dest (cb13-26) +>> +endobj +401 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 179.406456 99.933071 160.656456 ] +/BS << +/W 0 +>> +/Dest (cb13-27) +>> +endobj +402 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 160.459434 99.933071 141.709434 ] +/BS << +/W 0 +>> +/Dest (cb13-28) +>> +endobj +403 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 141.512413 99.933071 122.762413 ] +/BS << +/W 0 +>> +/Dest (cb13-29) +>> +endobj +404 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 122.565391 99.933071 103.815391 ] +/BS << +/W 0 +>> +/Dest (cb13-30) +>> +endobj +405 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 103.618370 99.933071 84.868370 ] +/BS << +/W 0 +>> +/Dest (cb13-31) +>> +endobj +406 0 obj +<< +/Filter /FlateDecode +/Length 4922 +>> +stream +x]]#muH"8)r`zyo=Nzѿ߇^.!GF#L%E>|dM +jEer2g!P2.??:M)ѻp7a1SAa#Iɇ3R4=Y bpAcA >+ 1=@ k,JH +Yἵ*Xf +31_T^%LLxCx YBNx)'! E*H%⡝2dueYlN2dfW9=`B&9`Q,ц K 5A_rVՋw%d>ʃ,| |,6E AFpIYp次pJ/p,I<4 YG AH0p܂6sw}^zQX5B@a3a +?ŧV5,]1|*qoeb,.&*Ұ wY`5,]G5pb5,] Aq4,f骼blYÂ,y 0 $*/Ӱ`l,P "p{Ѱ wm Ұ w-#Qyװq xp[ŧkFXwMEÂܕiSÂೆ +̦5,łOEaA @ʃ,X֦P$Y{ ,4,@D`C Y)jX$30kXBD>jMNksIÂ`*v 2NaHaϱ@L5,5,@ sdY jX}FKBYÂHa&RAIH~l"QykXt3kX3dkX۔|3iXP,dAħaAHa`)vY_O=8JbE|pLmEBH".,.n"$bLܾȐXdvf/2zw'uAyTR#TNy^~4Y,Yi AY&DuLRI 9яDXx3%,o + tYn؈ӯǟ~O?Z7?8˵wULBY# +\TkT!7U7H8̀Mk5cҭew{{Ё$=l8\cj R҄oD$]2do]JZuTȰJ|mk@ve~޴*/ckȿ"t{"\!D~grwc t#!5#$6zu誛nmljSw7v{% +-z "S}mIKlFm2ՖG쐦"|Zms@|yanySUjs1>?bVt5>+9ɢ,8\8СyFgWСj}ؓ{|?>B+OJ? 9kD}r N~iR0y2s]ݷJH2wQ["١b"5ٛHIQ} @irao}e|}W'⣰w :l? Euu޶=}g&vto$ |CIuqܵ{b}km۲ܥLpl1V\L8^$;GAa ꃫ~1WeBJ1!n~J$m-mkt]kcw S`=IR{2g_f7hc~<7!lV{$Oq&w֛DSXףAeRIS&d](.i3a#0zYY;204b/cJNyAߑ!<.=-ÛESR32O:`TjϬQ(?&S"֞YlvQzݐr[ݷpz{FmPVeY&y(BПK_`g~b6fv-NDW-6SjtVsz  z:K̜V{P|vu^\a +l #//y.A,lU[ "DI@ᅈ'Ȑa7 =6$s=IR;, &oX:Bh +Q8"Mo ^#6?I +{.{="n7."9<ʑ檼ȫM"6l=~cv^SU^GA薥ϧ( Nbr}꼎][g wJCG$!#wCp!#\w.{74Y)玵dX}*GH0,>0*CU +EX" Bf *yKd펃|*ehhz(cAYE@H;emhVAV'V1Go|>ûB;;Z\ :f;2"bq>ӟ:"ykX$ns2}dJ0Ѭ窼yA*9L#4`=nw6:Q[h&m8ӏaVKSU^F:-K+1D`GYdQ[ѵpGe.nv=}?@a=A};1J3Fs|F +y>jsw(ܰcn}H[/׃`REU%БSU!s!#sHT!㱐rmBR;Lc; +'3ĹzŹIv;nߥmt,ťxHd0)^ᐹFz/S_UxR&ee.rdJ1%Es uX-Ӄ;?->ޖ]W m[_CXV[÷}.OE[A*uиwN}Œ];+UYyu d2 bKE6Qu:L=`\JG87W.]\&GGIǹ)ۻ0bJt%|q ,-fHe{j'|TޕvZ` +rf^  Hgwl($-I)S{, +bϗ:]sָCJ}mwzUw\VT/6qigiMO_az[|~Xmzazjci䅻T.eK܎=rUIzt/ neEx'd]_듣7Ӷ_/:$'Bf6~,mmZ L.._Kk\Wֻa&'~JlұBDd{$ YNoφD qY e{!Yİ'ڡNeֲ}-mAlse}nR赩UHW BF k6 I!vm1?y!Ր+k9vR-6RʽjY5EN)^U-$?G1eֱy#d[͎q +I):VذHFζK"\T\irn{ШMJ)\CE\rt6bA4Ջ<C!yܧٱVb(Ƌavce#"㾈WjFƄOR6P+Wjm{Ԃ=h5jK0v+m:Q4ͮbZeKU-bNۨ0JSbG%Jע%jP9d%BcF^Vھoζ6 {dj{+=;:WZo] q]]"Ol3q4rwk%ud a&'+F9f M9We-ݧe)ÜݭŸeA]&IwH,?S +mO r +endstream +endobj +407 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 406 0 R +/Resources 4 0 R +/Annots [ 408 0 R 409 0 R 410 0 R 411 0 R 412 0 R 413 0 R 414 0 R 415 0 R 416 0 R 417 0 R 418 0 R 419 0 R 420 0 R 421 0 R 422 0 R 423 0 R 424 0 R 425 0 R 426 0 R 427 0 R 428 0 R 429 0 R 430 0 R 431 0 R 432 0 R 433 0 R 434 0 R 435 0 R 436 0 R 437 0 R 438 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +408 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb13-32) +>> +endobj +409 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb13-33) +>> +endobj +410 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb13-34) +>> +endobj +411 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb13-35) +>> +endobj +412 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb13-36) +>> +endobj +413 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb13-37) +>> +endobj +414 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb13-38) +>> +endobj +415 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb13-39) +>> +endobj +416 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb13-40) +>> +endobj +417 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb13-41) +>> +endobj +418 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb13-42) +>> +endobj +419 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb13-43) +>> +endobj +420 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb13-44) +>> +endobj +421 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb13-45) +>> +endobj +422 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb13-46) +>> +endobj +423 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb13-47) +>> +endobj +424 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb13-48) +>> +endobj +425 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb13-49) +>> +endobj +426 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb13-50) +>> +endobj +427 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb13-51) +>> +endobj +428 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb13-52) +>> +endobj +429 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb13-53) +>> +endobj +430 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb13-54) +>> +endobj +431 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb13-55) +>> +endobj +432 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb13-56) +>> +endobj +433 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb13-57) +>> +endobj +434 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb13-58) +>> +endobj +435 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb13-59) +>> +endobj +436 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb13-60) +>> +endobj +437 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb13-61) +>> +endobj +438 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 169.815391 101.433071 151.065391 ] +/BS << +/W 0 +>> +/Dest (cb14-1) +>> +endobj +439 0 obj +<< +/Filter /FlateDecode +/Length 4511 +>> +stream +x\K$ s+HÀ $`` 0rXwv*=];ۋLzPRIp_fgr.)駓5)XWKl*[pv ? +I%/'o897o븳7Db2)d*`YG ++QaEg0R4=_Ƃ}VXb'G׬1|r +!),g!֪<b+<Lң\|Qy <#21 Nc Y1d : KpVA4^,ɪ B-ȯ`oSJ^SV:Me&p'H +Av02>*BDlP #7\<,M< JNH\ʹtxhIJZj#DQjf1ـ+qtU,VH"P,$,o +dZX6Gu4>x=xK}oyo)\eǕNL?r?hw<݀"x\Gϓ8,`="' U4Ɗ%8ڕ>?nLLTD~})9jS@^`n@.Pp?ty7FlYVjݱ*cwɦ{;Lgll;yGb~}˳̹o6d ,vov<_ײ4f{al|ֺ؇L{,6墩}8ߕvu#꿛{[̞$[uhB1 IzuT<4V=r坳ln#@\^ڹHhvym+ޕ[r1:m|utRd$ѲEiZPX9Yc>vҷ(S㞑ɫXl[=ڼ[r qbʗDzw=u[nJwkԥТ$~mǮtq^|?Z ,?O(h+ȴ"<$c(d!{6Hmr,>?&JlcM-MQz$XB1<D@|R.FW]uNv:VYVY#0I~Dڐ(GY:ȇX}GVx?Z"Z oyx64lrɄGڿ[3%qR07L|/ٱ:o|l(cm(laIY N/K-=6⩞U[Mm,3S\mG[Z_Dx̳߭K{G֝.o8S*= AX.>2CU~mDBmiYIesr 4f/[wx(28yw=YFi{+Ѻݻv!#ӽ-/x6uzٽܻǷC(^Wl߷CU0YbiCvSU/9EI"crQ"x(57'Rz>~oZl-A'&[É9s#;rLJa|cRtVA' (F c:cx2wR[[i?<ꔣPeg:Ov{=ewz +v;%ڕ _0~LR}۽g/_@ "f2$ťu4rc+aˠlIX̳nO5bv&z4`;Ty& "I.}FT?'D߃uF5דE/vءpjW//[= +Gͫˍ'oq|#xig@wryU!<3s4ucUG1r+ a,8D.'f)3{V=##<-QNp5i+elɔ/Vo2 +Ǿ9ȶ#ɎyafMrX"׋$wt߮W^R8˻eWnt>,@mNshRuuJaihסE[NFy@\"FWX;FϼWy/78[nogN'y60˲j~:zի^4X62㩜*e{&W7j/K]S|ahzXT'ǓNv1e'/ljd!~|.'T%)9N8nh~h"VUc]eָ,0Ob eGC#;5N &K]uq4Ot#^N*7ZSMvMBN d.'mM3&Y 17C^r +rR˭>Sʣji S.M$_|RsKC}(v㯈Sr +I)VLo&n'g;ePSnk6\/P:U!\k`~ovVI3=vaM(;˥mv֗V)/Kwm&z*M<[VaM?+gmBAݔ_6!gl,CowcΗ;N6߈xOϭAk[|zgqP/ܼ|9L?O5y +^rHN>G3gY_#~u%{wlݐH&/1Fn3=O?.YCr[+hR`o%]GP׹31 NdMWn ̈́;N=ܹ{y68tCrsIy8x̃G#$&$EGHTsx:,Cbs']"?SA0H#M7ZT)0sNFEOvϞU<@;e N=Y h=IpZaщG@;FtE lS)՚ZꈳsA0JWbg%^v[((sɬ\SyF}h{C82S;;KݮV;!./ P˖Xc|+qF^]^H+{t&|u^(SSSzb!NVЀ9{TXo d(o%Iz.Y u eUU +endstream +endobj +440 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 439 0 R +/Resources 4 0 R +/Annots [ 441 0 R 442 0 R 443 0 R 444 0 R 445 0 R 446 0 R 447 0 R 448 0 R 449 0 R 450 0 R 451 0 R 452 0 R 453 0 R 454 0 R 455 0 R 456 0 R 457 0 R 458 0 R 459 0 R 460 0 R 461 0 R 462 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +441 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 541.623057 101.433071 522.873057 ] +/BS << +/W 0 +>> +/Dest (cb17-1) +>> +endobj +442 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 522.676036 99.933071 503.926036 ] +/BS << +/W 0 +>> +/Dest (cb17-2) +>> +endobj +443 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 503.729014 99.933071 484.979014 ] +/BS << +/W 0 +>> +/Dest (cb17-3) +>> +endobj +444 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 465.834971 99.933071 447.084971 ] +/BS << +/W 0 +>> +/Dest (cb17-4) +>> +endobj +445 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 427.940928 99.933071 409.190928 ] +/BS << +/W 0 +>> +/Dest (cb17-5) +>> +endobj +446 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 408.993907 99.933071 390.243907 ] +/BS << +/W 0 +>> +/Dest (cb17-6) +>> +endobj +447 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 390.046885 99.933071 371.296885 ] +/BS << +/W 0 +>> +/Dest (cb17-7) +>> +endobj +448 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 371.099864 99.933071 352.349864 ] +/BS << +/W 0 +>> +/Dest (cb17-8) +>> +endobj +449 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 352.152842 99.933071 333.402842 ] +/BS << +/W 0 +>> +/Dest (cb17-9) +>> +endobj +450 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 333.205821 99.933071 314.455821 ] +/BS << +/W 0 +>> +/Dest (cb17-10) +>> +endobj +451 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 314.258799 99.933071 295.508799 ] +/BS << +/W 0 +>> +/Dest (cb17-11) +>> +endobj +452 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 295.311778 99.933071 276.561778 ] +/BS << +/W 0 +>> +/Dest (cb17-12) +>> +endobj +453 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 276.364756 99.933071 257.614756 ] +/BS << +/W 0 +>> +/Dest (cb17-13) +>> +endobj +454 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 257.417735 99.933071 238.667735 ] +/BS << +/W 0 +>> +/Dest (cb17-14) +>> +endobj +455 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 238.470714 99.933071 219.720714 ] +/BS << +/W 0 +>> +/Dest (cb17-15) +>> +endobj +456 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 219.523692 99.933071 200.773692 ] +/BS << +/W 0 +>> +/Dest (cb17-16) +>> +endobj +457 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 200.576671 99.933071 181.826671 ] +/BS << +/W 0 +>> +/Dest (cb17-17) +>> +endobj +458 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 181.629649 99.933071 162.879649 ] +/BS << +/W 0 +>> +/Dest (cb17-18) +>> +endobj +459 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 162.682628 99.933071 143.932628 ] +/BS << +/W 0 +>> +/Dest (cb17-19) +>> +endobj +460 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 143.735606 99.933071 124.985606 ] +/BS << +/W 0 +>> +/Dest (cb17-20) +>> +endobj +461 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 124.788585 99.933071 106.038585 ] +/BS << +/W 0 +>> +/Dest (cb17-21) +>> +endobj +462 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 105.841563 99.933071 87.091563 ] +/BS << +/W 0 +>> +/Dest (cb17-22) +>> +endobj +463 0 obj +<< +/Filter /FlateDecode +/Length 4905 +>> +stream +x]]$}_qXDQa xF7ugauR "E%GJv/q+gr.)_/]IlTbu1OgC2J(Tاv_7}˟wZƽxSJ_S +X֑b6)y ++:[,EcA N-+AP2k, ++C +іUO.h, +',pZElcQygb.K^c1rxpN1tax%PN/BdUt9Kţw֕Ut:Wp!)oy޲Ld5saQ.rQyЅzG%N0odi<.ާ _CMQx\0dBAɄ>R" |abIuyY!jH@xʃ.T +hX@]| h`-64, m.jX@\i5, .4, @.LhX@\vjX@]{ҰkX@] +9jX@] +jXDTyaѐˤaAIÂ܅y 0v5,հ w}A SK>Hg܂6sw=[aAࣆ0j4@a*3a uӟ@+r0pe +%eb,0piX]gְo0z 3:_ ECa7,LWcK0p5,,lld`HNC5,]LEÂܵLaAڀGA^5mFjRh7wֆqo";uR=aHkcd|*!S2p9Y[_ +83>ݵ?|ZP1-L Fn4eN $T)NE }DYbUu̝bxm5P~!}`pxY jAx8YŐVBŪ(6!MwxDX#d5{wtx,\2w=Y"y7_ݱjEe'0X0}P@/d.@p]Hp+$6HGn-@-d`*i:E-:Szo$0³m G"#"+ܐ,y;-x1dSg1C&uu?&DH>-f{ou{?Vc5-Gٶ*k_ߏ|N&bEn"?&4'[+|'lUL/rlA8n w㚐-EװlEz+n/}3(|qʹ5#`ԗdeG|d~bV.und%zĹrّGZurHr1VӒ dξx&#r]_ae<4n2O-^׫>mg$^7t4J3G-Fմ:Rq[[nm^aw-38[߶3vtQ=R du)7mc2OzD+{ا ̖Q9;:y$ISYw CCܠɗq9v{h#~,i3SeOy{1X"ګ6e`A%jEau?F>*z@n<| vPHqwoΠEQ@<\Ww~mk܇t_>zH!`sq+=^G\t B>~MO/ ;FT?^ץ\Z6v0z] +vD .|VNs9~F{9#YaK伽56G:um4s\ CaFO`zuߦCW04B{2O~G($s]cmGLEY㘣)D;El$oO%DgXB˽`BuOR}rxG朐uuP/%2,u9#ݼg``gիvv?mݗ3Tz"}Ez~,ȭ{޽9 ݢ0u+E93BwRfc͟cYN zgMw}Gc&Kç=#I?_6lL %B9wͨ%239VYۿux-Ďl~S=sݜ>&9h+U?mwLupwCe~(W7m4JNrEc` >:ֽ#9Jo a4\i.i*+k +mr@ؙ,? WTb0e[Mp,5"okP_Ks}׹n>uyzAtK}SKUKb&[h)U*u@B'zQإjMQCļRRN!^rsm\G*R*)׎WhS$|eF6oI) +,/mҨ)/]\hrD} +TA դv߬u'XQ'h=BjeB?.g>_qo+Z+r?6ABn}`]ney:{uhRUuaGtgk ѱiC3$/Zᢿ\ƣ6%tUJ);A\k4VjAԮC?< m^h]tESW\hY(}ڽ>> +endobj +465 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb17-23) +>> +endobj +466 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb17-24) +>> +endobj +467 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb17-25) +>> +endobj +468 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb17-26) +>> +endobj +469 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb17-27) +>> +endobj +470 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb17-28) +>> +endobj +471 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb17-29) +>> +endobj +472 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb17-30) +>> +endobj +473 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb17-31) +>> +endobj +474 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb17-32) +>> +endobj +475 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb17-33) +>> +endobj +476 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb17-34) +>> +endobj +477 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb17-35) +>> +endobj +478 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb17-36) +>> +endobj +479 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb17-37) +>> +endobj +480 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb17-38) +>> +endobj +481 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb17-39) +>> +endobj +482 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb17-40) +>> +endobj +483 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb17-41) +>> +endobj +484 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb17-42) +>> +endobj +485 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb17-43) +>> +endobj +486 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb17-44) +>> +endobj +487 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb17-45) +>> +endobj +488 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb17-46) +>> +endobj +489 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb17-47) +>> +endobj +490 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb17-48) +>> +endobj +491 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb17-49) +>> +endobj +492 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb17-50) +>> +endobj +493 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb17-51) +>> +endobj +494 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb17-52) +>> +endobj +495 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb17-53) +>> +endobj +496 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb17-54) +>> +endobj +497 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb17-55) +>> +endobj +498 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb17-56) +>> +endobj +499 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb17-57) +>> +endobj +500 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb17-58) +>> +endobj +501 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb17-59) +>> +endobj +502 0 obj +<< +/Filter /FlateDecode +/Length 3167 +>> +stream +x[Y ~_1T& @ (0 Xycfa$Z4YGτU9JBIۈK:3i [RBi)|~8:W]s cRKXR +ĔV[lcAT4=@ m5y,1VU!hag5 ǂRqXL#˃ *q +J/rȵ +x\ ('x-Sx +YR#x $V%YTjxHry%"@4W! ZY&VȀV=3 HDgY{j +&{l@_cz zD9ɆPT~9}˿OoNE5B$6p!dMhS6!'L1J"2@8r3ly|k!I(eu[ CIv%)_Hҩ F̓UC(g,{J}/uߩ#O֏eERkz_Wȧ?)ؿ'(_XH"9Ek6k +Eҏ%,}N%-Z^X#}uO"6*Mf#_;}|@ QY-qIYWے$/l(e%wMi TSжŤlV=jg$lp\Pv?j \%m|+V+mo~V7c^]1Fr}1 +\5Vva)iNGHnwM=hvw[{t`sXѰ}IGFzD/~Fz[66Z]鵿ٸG^'$yr|건xV79=NZfԀ@c[K##pڷ{5V{f>9ù/G5ToOދ1~76?iv8+}cv 25q()w :v.8'>Ifl7Q6Ŝ/'l+jC_k7Ҡ"TG谓C K+9INݑtk}CqjiXQuNm]SRڦZ%FcJfnk;tD$?RqFDYJ_& ơ*f9ܡ" !u=WsAVJukcuq)gW}Yt?@w.*[u x\yx u \ԅv+?\ijYXw·\ yǺweKlzK6ׯ}I4l!N +63aoۈ=2Rb\ɓ˒3=X&b]ˆmJv%9Pɯ)Z.2.etuNbX֋uauv%#'g90A}Xƌ:ϧv/GΑ XKؓQИ^]>Pv HiWD14괱b2cZWvR5Ťj:VJLUX[gQ-(e͑-UHzmm$ʔt7Sbgss_Ir(_P_Ѻ|JODYɺT +"<ўf,K5row.vȽmBXh!VV{ݴGCJ:>پ X9 +endstream +endobj +503 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 502 0 R +/Resources 4 0 R +/Annots [ 504 0 R 505 0 R 506 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +504 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb17-60) +>> +endobj +505 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb17-61) +>> +endobj +506 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 719.279014 101.433071 700.529014 ] +/BS << +/W 0 +>> +/Dest (cb18-1) +>> +endobj +507 0 obj +<< +/Filter /FlateDecode +/Length 4957 +>> +stream +x]ۊ%}_ '́cY$փ6ÈB'( l gQ[UFY#Ɣjht[eŘDlAK `lQ1H4/I`b\6N"K hd?Vi茖*]j0rElI\` lA -Y ,-XЭSYK\`N qL%q (e ,8ׂ;%. ] (qZk] +XuZI\"-`d%.p]Uw18 +III\&)'q)@cJ\ƣ 5^ x8$.P.(lJ\:c%.@aAX"qO`A$.]}.:¸Bw1QY p`!e$.>`=J`Aע.A1Sk!aK\(\f@1  0 2t Ȗ.tZK\ lA4(qA2 ̠$. $\-霢uf 0P(q V`JQ[@h%.M,sDlI\f %bؤf +؂O€@aq蔒 q`\z3I\zK$xi'Xo" +#3Yhř[-l=5i3LA5 +Vⶁ"s+NwU"!okn$/?bo_C4HAm_.pk@.4]ӂ\RXv-vabDy`M}˱KEΪӈ56&0Hb[^^n0iot{G3:+/{1QVVA]sjeںD +¡w5zdF\t..eM2"/(Ŵziq sq9 +ViS!R/>t긐C(j^U2p)R@; _9ȸ߸l;39b>| /o6 9( tҾ͍j(Fw5y0І|M(mRmPv*ܬ^Uֻ󼻭+DzE#ZwFzz]Wɚ${6;ޠ z Υrn+O><_+ ++]nP@xnR.)?h`F~ldh]xDkMQ7L܏PZ 4F9SZTQ~KZYԅm۲rF9ʋq-zd{c53cSxff>fy集!lxumq"x~Tc;`ͦVkf\F?6|fgGjV%N<6qWcTǮ.-5Su LJ2KwD7\fIe$m< EBdlf7ϫbi" ]G{Q +vN-gWjkکٛkj8~_l%xMӞg{˦6+aPnYTX)tD_ANP> \c!*e2=)e;솇$u{,,4rՒv~WX~w`%r>O[4DNrXDu[|5v+PYtm;AzP[ aݟQ%y޲Gp'}cn~GC乾*FXغ,o!~ wOyאV }| +NlrW<@zB=2ʱy yp?Q~K/W::"ͧ$7fO߼N$<.ꌋrc{eP@E:syelzheO&tV:52?^"4Y[i+.{@B[.yoV.{\#M ,QL?n~x>_Wf~KRS<R"U@TvSk=3Zrm;*2GԾ끝ű䍑{;ZolOm!3ƇC92Oy8d]m^\Y{( kϸ{ maѠuu4o~Λ1v \CxQ\mlqq+.ODֲ'9Q_Ocqe2/lڶuƓ;!鹤T%G޹<rٓqXϮfc)oH3[~ޏY?YlGzY͐U2;<'<zA\YYEϲUq|5ri+ybf!mg yWu2bcO#dC~01[׼޾AtsϨw\ky1ڎλqDwE@s2áy?]ţ4;7 ;T{F_īK|sm#+ƶFқĔ.oG<ƴǮh({zz]ݕZ<0T +5xfH;Vҽi^^p?}CLy][ήo=8ӈS[ۢ([{E3ۻ<":w.Yj"[ި:V,3赘Z=/iYhM tdbӠke;‹-yk {򢫬%Al /i^i#~LuQ{pikIR[N9Vec϶ Z (mJyf։dZl-IRl1E{^iNW*-[g-y[zK&Ax&u=un^wmzdz6J*{(?e'D LNGklJ!C}*:lwׄ*j*l X_e%6>[AVon峄eϯlHKE +7Ӣx#mI??"; +endstream +endobj +508 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 507 0 R +/Resources 4 0 R +/Annots [ 509 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +509 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 563.554475 101.433071 544.804475 ] +/BS << +/W 0 +>> +/Dest (cb21-1) +>> +endobj +510 0 obj +<< +/Filter /FlateDecode +/Length 4918 +>> +stream +x]]q}_VXI~0p#00ӻc# C~NEDZꞹw{iUX<<,RjJ~/9=cpOOj^_I(?7V.N^'8M .yӟse}6Shrv)FUJi+b4>'41gI3|tƭUfΘ$̰.jVeav +f죠 +vh!9kSӃ3z +),"t:Ig^K<|tk甤-Φ(l*Q[LVEb,l-*(-鲝|NΉ J1uF'kzuQ-A,`H: [~$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a +c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& +%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn 'E93Ejdưpۚ'ɮc/|oNYJj +dtG|A+G1w#5hqt##1ѿrN#7E2s`RâCsf7<&GD>h*^ody>Vۺ5SR-`kiv@Y> +ND1il6ʈו[$`⺷.C4N㟿˿O_N'|w_w|=k:C,h33<׆tkIGy˞\+z~^Di_u`ٖeiL/8%dJ|~ʎeʾؿ;u]@Dy|uie5md'p/y6@aw QGz_7| TF9A/.c{:P/;w<询 zeZsFʱ鐺cex\^}Z}C9k1湵yamԦBgy6ĺxvg⼏G2OZ܍Z6@{0ӡv9r֑Y.o=wq&|Yy:ĩ1pl4dzc{0ϳ<:ְjDW:uﳡb(T簊6Q潈߳'nD~`#6Ps<Jw+B\ᩞ~eR$Ud:z[x*7!XC C>enSlr@{<ZoǮޖ(Y/p(͸JAjU<'pe~m< z@y:$ߎq]zʞmqa-kR9VbTц]iyL#c]ރyŞ,kXqFeԝn񈿖I.17y^wVR4ǙQhg$L4?,㡂_)=> ?Xޮ߅o|=7c1bGQvW7.6˷f'z]sX6cCCkv&Oa6wi=kmz%OB}2 yY;;\&=f^*p큻h +65$7e@ݬTM_͇anW2-u~!-}=2Of!n)rw?Ήͥ"?W>7}W 3N.o6V42uwNСdf/1=`.%K>=˂k'lVä2;TXot͓Bm/K$D{r0e>ry[kw=d+&vCa;[N{/򢫬%Al/i^i^#p&:HڨI߹5d-ay[uv,{9}h-.8F4ls+uUN. SUJզ0gn)-Nb)oӞJsVi:hɶs8:SX2 s7)mv˺l{fpݐ#SճUʇs3:HO ѩ5[^RG.+YԽ^cr֪镾 P}+WΖؤ luSNDj +WKAo7EpI?)J +endstream +endobj +511 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 510 0 R +/Resources 4 0 R +/Annots [ 512 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +512 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 123.873057 101.433071 105.123057 ] +/BS << +/W 0 +>> +/Dest (cb24-1) +>> +endobj +513 0 obj +<< +/Filter /FlateDecode +/Length 4711 +>> +stream +x]ۊ$}gJyH`d X#l$?}"RYQjKTɓQٕ,!9_~9zRER_oR?X]_HUޝ_Nl~iyVCNI{#|^XFR3*ku#e*3L S T`Tfh㥞"P^N3dQI;aVNSrp!f*Zh,lQV[([w` K(H@=`*x9PE:%9"X8&\V[t4h[a2 5@ tkDhq\A0Sp\:8qJ N 4Hs\:qj` qq2h xWK9.0] #qzuʠB +p\`c +`u~𮲸n*+r(Gxbyw`9.|A-wenji CtX >V̸E+ҹqbX.3p\0* ,xWjԜ+UX.q0H8`~tY]D  -) 0 "IX$qxC9.p]LVk xW=8._-3B)8xWH0 +#K&Γ@ `/Xq\tpXpm9. buxq!8. +h8. +e%ovy[v}`` }_OU-!(ж10m sg!Srh突k7o =^Y/ALh^@aU}y}b aW]5"ɖKo/ב\qu]L>mdnKs>jAz Rvyy>dߓ~35=;>sY-xyݟ3C%;䓏6>GEѻ/Ы7܂ӿWmV-k|עɦ%o33>m4Rϓ{VrK<:3o|t{ [F$YZmn_s8Ϋq[;us-ݾߙph^{g1+#b;G̛gV9rh]'B ;hܗhh4~–sgYOݻ+#w<9{0? +6B6C2투m=ݞxd;՝y gWAM ,&G[ݗp݈>o³*z[Bkd.D>ŋzdzyЍF3fI):(3~=m}BK=]G;lk;J[}hTD;4u vOsYV)Eo_GFJGh(; nÿܻhRv a*Ŝy~nz6 +[sÅUjZM\Y(M+EkNGy +#5y痱M>SuoYiuЂF[2'PpE^Z}j6׾<׆uo7}uS+.U^GgG-Tʡ|Ѷˈ]`;vGs8Dm<%,7>gyTW; U~c;786aGkg!ekWd~_Ԟ,Ϋk%WSȻn\mG\''9^{Vonߍ3к!ֽ{"s7I>ݓ蟙M"i Hm"[{o3ᐺ ;(M򊑷/j;vs4D}dyh7-Or0 8ۙpU_i? +xP-ڴg< +l嚲j{Minñ Ƚ; qܻsq^_W};i687kݙpF . 'E'9{:+QBnۙ;tpaiheimFCǕj{N) ʢma#VJeҵbqd:a_/u9TԪl.e:]sS$(i%ɈP\6jLd[Iizߴ]q#RWl[thE[mqbc~MvyP{rc$-Kut23][[SFu-h# 5ۘ,T'B,+%lfIwVŧҟۖmFmYZ*7x[-};QS_202.RSS,mu܆ꙊRk.?)"C=^+}!&4J+ikBw Fk%` q[2tg UHP:K=$S@\zZ*ژN!Љ^G4|~ +endstream +endobj +514 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 513 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +515 0 obj +<< +/Filter /FlateDecode +/Length 4924 +>> +stream +x]۪ʑ}gÑ~p c?z00{ۘ}ߟR^BJ{w]DF\JU%r zEM+S.f/V.N^'8M ׷ .y˟uu}5ShWR9;*CTO1U>:㶪3\N^R gLT fXݪ20Q;I3tQPi;QJ5N)A=Mu:v +i%]B>I:[|VZysJgSt`-&E+"l1Nt ]ItN>'D]N:䓵Ji=y`ӊ:(tR|u[e$-%xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a +c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& +%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ +CĜ"52cX8Dmѓٝdr &_qyռSVjsj +dtG|6iTm, ",ld&hz4S'JAf>4AKS?3,ha@ ͠E}[% ȴXӷKf>b:맟.^/oJAӧY}&,\OuB`m(o+oeZeTZ>-C[T_mdfguV乗Qi*>}|~?9 +8 7.zsYϿswް﷞G?>/ul(Cڥ ]#UH7=! oz"+艬g^׽^֤!ϝdVVfv|l726RpZ8Jy:cC!rCI32a|ėlM7$uL=? MF=tH=juިQ?(`5[Gb{1i Г+yDZk5J_Gu23zf1Qk^Y ڐ{cyu : +j_ǡsEe؈3m͑GBifl{ '<q:g&0$U<^?1d|QAf\leBګj_fiD >'<c\+gxFtKeX%(2~{4=t+w瑧Y:GIW9Vxl:`Ll&vWJ9fvÙzP'%7kCڤ'w?)itF X`wڐN]zbϵUF }]<:<|Rf,~IGZgYLkn7zhS.eE;CkZm{jrTJ5 ]ծ[|u4bIk)I>]9qQ#G7qPpZsc}Ӷ꧑5}ޒ>2Z%g_c1tc#~^cK7~,_,x-b9|iGaVhYAc].[X|6F}Nx =r*;]>0^:e=`. { ˂v+aR֮zzDc.PۥYD{a}&'񆒽!3?d|;^Ւw=OO=u! <`y%QB}l\zᰎ19)hw Ir`ڽqӃ*G+RSw2ϓ,u9ܧ^'<8sֵzSv97npJa0Z I SCGNAy ц#6&W["Q'˵ːK,rcR>6>Qt#qΓye젏PaMY~h<\w`:sRJwaL?n"5Ǒz.!5yacŷ}Mj$Ս׸lk;|7%Oyb[F̍p<2>1Rk:Bt}yBd~su;ey3)!sy3Qe+pGGHODQԷ:WX[cB6ۺIa݉!O|8w'{r<2f&.Eaᝣc8sfGzY͔U2t1zy:މ+chÊȿ =G|m7cQP?Jnޚn=vv{lNǏ-iSy7ZaNˠثV&z4aꨫ^׵>"Gl 0Gzx&,\m9Kj;N_za޻^vt_{g!c.Lc~^{$;ʯ =Cq۰鶟/a~߁BI7љᘯͤӵX}9-U E//J颳 j'S/B s1 Wr=Pe7mI:|5TMdw. B z+֫I1Bl +:؄@{ƻbmPظj6ׅ.lsi5; M;kQջF5eF&5eI.Uv̦gFo]ɵtD[OŖ*zҡNOunH?ƈZLOVlwm$vG!\|ZVn'ҥ1UWahVW_7)1E)z7plⵓ<4q=-saK'%'mVR2&G$c- uMLVӸ U5uoP~[ UZeA3VnƝo\[kzs0_ybsj%]lTzeL )tqѷY\Gkc-'kdҌ{2OszCOw xD?.e7iܺ~&ӯTa6Lh.֩ m7U'R7M˅Mіyo[ }'j.xsp)ʊ%S:ΰUe+3 zT`a]ڮs}EW +!`yye`7{19@FMƥa$m'K|֗mαuv,{9}h­.8F4l%畺*[UZ'F*k%jS(٪['K]Wi{9^ TnZd[9co)[,Y๛ʶuuufnH葩&=cg3:Hy'DjyLNGkk*q/%5p㽒H+5;&g~Q6 |_ )gJlc:ͩN_^!.#-w,~(*-Ua~ha}2?x[K +endstream +endobj +516 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 515 0 R +/Resources 4 0 R +/Annots [ 517 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +517 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 423.873057 101.433071 405.123057 ] +/BS << +/W 0 +>> +/Dest (cb27-1) +>> +endobj +518 0 obj +<< +/Filter /FlateDecode +/Length 4770 +>> +stream +x]]㸑}sQ,La Co}ؿSH%Q/n[U(%w%r |IM++)E>џrq:?)fob8pȓ,賙rF??)T*~ p9K*3VaK*I* 뢶 3LNR }TZmu0D9g~ +h 錞B&FY;ג.O!$->+-'D]NnuF'kzuQ-A,`H: [$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4swWF5 Do +;[@`X PdH\:c4j) p`)e$.>`=VtL)E]NG btb-qRS ?$q̀N; b-*`*g.4l-q<]贖 oPdVAI\kI4s֙ID&Xi)ElMH\Ŷ,6uz'qAJIₔ`QF`֛Q€` <> +ơSJ€֛I\qI$qA +M,qmf ;ᢈ:) &Ib @$q 7ы!D( >$xiXo³ +#3YhřĈz̭b@{1[E1f@F0+ĨU( + p5CTp3S}[sdv%5>Ͽ~o{zU? v0 LFw{xoHLDRd! |&s7Ro,,?m>c/;@݆b!X? VXa Hc!vW*H'um|̗X ;ӯG/Nor<Ҭ| (WYΚf.߃ZeN79}d^txvzf[Zڳ8^=|~ߝtKxp.Ney N<ϛE:s7١K_ʹ\Mu]nN?_a13@uvma D.|GN]s4buTSԛVO^(&{ń^C~4r +iUBe}bqi30@zvV>(GnIQ[A}-w9]ly\FBt~eF~*Fn\ +If=nLCʩǬL+fN&Jg a ҷ8{ue!UqiSCǏW˲,r̷ӗ<7P6>WE;}$ 3($,Yǘ[FR}E8BS"D s4 r廙Ƹ]F8!e==p{Djr.$ݻwwpihՕZV87C+g+COcIGy +-y痹O,y]eL3OZ-ZarIW{-׾<׆lz*{cc<.cY9mletY0Vz9{Mgz2~UV=ܙh_wwyDmtcw{7yEwPuѰ㌬G]o/j&#uӭNp%L36|•YCW}q?ۙpU+hyhu{a3+eWZCFc&ߙp]\y'5v +;s84n?^9z+b$S[}lWcaԷñ2rz<3ѐ]}WG谟Ln`l1'b;Ir_"=)=:i>a/aׂ9bs/ya蜾 +qO;o}xݙp>$ !#ORTlϽ'pOVrBZkղvm<ί zYyzw9} +ٛkBֲ.u9x"hx{Wh,uۼ 1Dwgaz_lgAׯaQ7#Z&1Ĕ7kkHWh 3{H^<CC{3 +?Olok~9~7b~|%`1;|~Ҝcmc`;.Xۃj'z'&C&}=SRtZ9l[ˑڐN-{My>ճкYe7R-4,\vg 󖴗eX[[{fgĮ驵U/{Uode-ՄE1N![z\[oϭYZr qn)g^[7a~*r(k[f{r$uH`3 El:5t8=E[/W:/ـ MJ_]6ŀS G]I畜r?T{z^;p} ;\:'$7:v;T'SDsع>7$Vm> +endobj +520 0 obj +<< +/Filter /FlateDecode +/Length 4840 +>> +stream +x][q~_ ؀?8yc# C~ċҥ{f{s}ZD~XE)uNh1o.?_N_N8UISGw&~i\{G]HkTֈCQ%29vQy%p)q*v +0æ8̰ZGFaA* T0C%Ci)Y 9VǤ Щ91tIx]t$s)k%-KTp3cL}9Z2lZ.}{\~Wʟ9O|%ry&mMYCFԌTyэT6]Z fg&_]ԋPAgm;ϧ + >׋y:C#)`^KqDqg3}k@=kM_~/oHiZC1ÈR_?"Ӳ*]TrSu9 2}~6 6ԎLҒ,gˠ|5[os]aʛ9:T.N6(j 4\T1y.uի̗Ttt,`j.4j^WKWtH.2Aɽ&emQ:]adkFvmDZ h/_2;ʷ@KKÔc{<3zIEx]-NMSOq^ܧe&?[# ew6}gB!{ +DCm2 \O"%j$0%܄ ڳFm_W[|:o6Z8UZic"`ϜwK#XH2{<|(7x's_B,hE;g }$lV'ϻ'WGm]$j|HOOf#\gC;!Ǟ ˖^Lqy&ZX7}_|uH2jza'<z҂o+/CvQhV1riy}fƧƚ]ܖ%aT;Gsho)ʱ={SzytCt9;ϗ'<j3=;8ή)]C[#bY];Hծm /C>|~ Y\:|x~nTϟ=ϟO߆|9 ukg#y }ytrQ;qc㹏dpD$D=r2ӡ<uw)hcDvFEEAg1~^XZw==pY +~F4?kt2I.1Vs4k16J6E t)Fћ7f[ٖʢO2AC-϶N:x|w\ׁhw}uW *gccۮe>HZ_lYlKf._ê~{K\b +rCQJ7ܰ꺑3b皊HF sdNs.*YAO 0!Cfq変/ˈeYUV DDS'|jᴵtd},L޻u"Wk1]j[f0󙯦jU +}V`x(VFvBʮ&ֶأhWt }өKZ.֌wVJ(EղLgTRWRhάhI lMJ:Ft\PSŖ5o4X6^ՍiRL;־Í^ ogHl Lj׸B^hr8ʆ&Che +W<@ +)#JhlVzcP6]s*fB Ϥ'ҭk-]uyDR-\WBTlDmU0䷦=8ҋyJ+"eIѪ12(z-o;XUލgKY +j4~C~b^ B4PH;5FzM[; m|@] +endstream +endobj +521 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 520 0 R +/Resources 4 0 R +/Annots [ 522 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +522 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 713.673057 101.433071 694.923057 ] +/BS << +/W 0 +>> +/Dest (cb30-1) +>> +endobj +523 0 obj +<< +/Filter /FlateDecode +/Length 4786 +>> +stream +x]ێ$9}gM|Hi  ӵӻBH >'i;Y]S"ӕDOU.}VJR/ߟ~8)zꢨZ8yCI`71NoN:lOrv)FUJi+b4>'bΒ +f۪"p9yI31IP%a]v0D$GAF)QCs:IgR6YEt4)Dty +!$lYiIa)I[MQbU;Y%t%Q[TPZe;u:bO*IM+00H! +:[Yot8H:1%aVY-Rxd#Y҈:Ɵ?|z/h_iv.uXr헿y+zhk)Ӣ[8^6 CPV? a׶Zh^k?/~ߝ~a ʲLAIY;R# +8Wq|K7/ֵL,_"Ϭ0] 2tD]úѩp<x̾ޛq!==ԾþO. $ڻF~&=Xs逬7ɣD\S_HFWp٥'OcwSTJVב{!zy ֏и.A~ ~N=ƋVG/28ͭU:OckX;ztD +E s(r[#X IuZ{뿰Hu+2 qih۽0D~dH2RM;g<R͍\;V/ZƉ:G}[7Zq#: +<.ӗ]! |`C|v/Sy'{-ݱ{γ]]ȽQRj_F]62C60ּ2D!;B5{]ߠcAM[3ڲ}31ۊ͑'τg;dy:__GwVI!z~F)2;\cp(͸JIf226x^wcus\+g7τrdgl{\XԲ'rUa|=Xۺ+1}.:OC<^yQX|mKL9m%oh ;o#khg$L2߬_bD)׳j伆o}Xgï+w瑧YwsSGrv^cms`_Y)X3_4b#.`>-6%kǂm)+TO>J[VW岏Pl\lSd}?.eS׏6QkkԎk5[*VhPt4+{Ό+3۬]Z˼2n7 [`yUy@3;꜎ئn^s;7kvtpތDA8+HXkQ<DZ+dwQ{IȷcL^xϛ^)yDu9&ƥGZlH8*vhs]u7{}>MqC/eY<n9L*ӉQCB|˴bEc.ТUۥrZ=j0e1j󷥷e!SN.u>޺s-с*wx҃BVm75K,9y}V耟;A\$eP{6#)36tZfe8\$7S׸O}{)7\z9>`R˒idyga(=aAl5 :tI3@`mQu௡(*3 jkhvXC5 +sZqsS>E=8GMm90(v4U"7PT}=謇CtM]@]GX>븬-(p%_/l=J2FZzٳZO6)u93V4iCʟh!3Qu.睚(Zt~Eab)CO:_6 IڪiQvԝ v4pyZ[N*ǒjyw7)N/wC}F'!zE;VLw&44*4S(nޠe{M VXw]l\Gu u -k"k Q&J,T.VUfQI}-ĵqD Jզ٨I0U V.rr-6RJjt/. @`sDr-6*1ܘr.~;(+Bm:^4*L*s*|5HYwBsNXI.]:ƆY/PHn[I˘{C$mޤo\nd-a}b-juv,{%9}j­.8F4jK;uUF*k-jSXU;Nb);iG9Q nx-[-αߝ%[.Y൛ʶ}u5ڞmnH虩]wܙ RSvBtGq#P;T + 2KlkulwD^ 19kU=y oP +T=ZV-VP9 *_TˆPTE&:rj +endstream +endobj +524 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 523 0 R +/Resources 4 0 R +/Annots [ 525 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +525 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 210.123057 101.433071 191.373057 ] +/BS << +/W 0 +>> +/Dest (cb33-1) +>> +endobj +526 0 obj +<< +/Filter /FlateDecode +/Length 4688 +>> +stream +x][~_ρ~؅$ By8ӳ'K8!?lbl='̡UU>}*eK\9k gpR8s\;fD\?Gr#]_sX'Wd!X)_?EVy!T*.29'%TV0\b +f^J3Pyj +0C:)8B%8sRCJ:aE[J'>@tIJN #(]`Z)-&pA l1BkN`VQ: [U面tHN t]ntA1֤.@ǽKtB0l*RFIb %SEҁ'rUޭ)&uO1;KQzDqt 5E+ HvNQ4 aG:)("Pm)&Ph\R[T( [`Ԋ@  +ty(R\@0S\[MqJUN HQ\XIq*- +hRI` Lqؑ)wh.ʀCKq¤ ޕk 4xW: 1AEqJKFn4\R\RKKq?CKq{褢'cn +?OR\`£H]`¡Ɖ~Zf@qbR.S\gQ%+FjJ2p x~p`ߘ. ).0]В0LB cR\`ˍRX.p{HlQ^R\:t[OYe\)(x 0rM ). ^z͂s8tpHe868e:آ5 *x -JJ -p(.GMN` B4lHq5XPJy脣90 0b<0:).pP\y Ϝ 'x Aq ^z2-#4撨jJygz ,` $u4Aq'N `i-h q).H.).6|Q\8lGqAE78tS\|Sj /|S\|S<e|Q\4l1pQHl~ N|D,lAS\MOq 7ѓ!盎 wM3Q:.8a-˷?> 0z977߈-o7~åCwLcRIҤ4}Or)'}|2iˏz[O@1zɔFMtli5l7Ke.]?s}X֞l5s cu-2֯qU[:T(e0Dy i~jppPJvʓt;Xyqu;kYC]q +O0P;r )ѰJ%cl2ms5md,c} gב=imurVz(בV2-{ʒo*aaCf_!lrhv,Qe4x3b?"f}yN>o1Y.R[#նdͥKe 12KoJx++QH1s#wnYzõ3鐻Et޷f|ߙlhV~ 9#fgѡ±_mdi\iŰ`yNm?vTb<2~u7gjGnxrqgadleVH눬 VyڙtWpJ7z,KQ;;q3w⮝gЌ-Q&.%XBҷOhiPݮ٘?(۵#벵S:SUzs:FK=*UnBKZ9gow*b'P{z]jV3鐷s.:ѲڮHz>-o{$7FV\3{|y\^RTWQg{55Ki}'*~|ů4JM13P_:껔lE8+r<ŜynZ: +Zèk:u;}8J_f6g ,1g 2>ǔ.I3W;MX%]V~ƢN2' v%qBG 3g\ns/_;ֽm\ա6#."<{=N +ිm ÌwXٙl;w}-_3t$kXj؝yN_ GDm\3EVZEzs6hqF~j'F޾Hw +rG={ u9w|']O~jզ.,_AouyL q4jb~=~4O԰X0!DN+xILMG6blrB]-',wBJhB^WR'{Dܿ-W-lz]ujV9 U]@өRJe2*dI)sNv!tj^j' .tv!Mg3\NK֐jR|xB6$uqp~6@jk+ȅv1:"~G6+IЫ:o{^Rfŝ#U,3:C*&WJ!ofjͬڕUu 2f#ԹfҪ* ɼHRu WQ% Zԅ=ww}2٦ڳ LxT v~uRUS)]zvPcmJ`Bu +ME x3djؓOQ?5mVɕhViޒ2:wR%ٲl=/;2t1ϔlf.y* fpJkN*4r8vdI$4Jq'ޠTo>tK:VD(_DSSrC& zs 244ܼӳ_1< +endstream +endobj +527 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 526 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +528 0 obj +<< +/Filter /FlateDecode +/Length 4917 +>> +stream +x]]q}_ 5py)J$KTIixӪGxxX(*_rzJ)ஷ/\¿buQoW\!$qٛo7\o?'41gI3|tmUfΘ$̰.jUeav +f죠 +vh!9kSӃ3z +),"t:Ig^K<|tk甤-Φ(l*Q[LVEb,l-*(-鲝|NΉ J1muF'kzuQ-A,`H: [~$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a +c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& +%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ +CĜ"52cX8Dmѓٝd?z &_SV4!00}k41`CژYDlYuae+L%c+@SKR2+Cd^[$Jf_HlO\Y}mho[*a/Vbdg+Vhh|aD6V*FdVze]ސ{cyu :XKEe؈3mڙmifAu#\C;ہ87!z~wRd9 uM_qn2[)b㔽W2pe~m<d.>|ZۺgZֱ4fhcu!@mCR]1v>0} 1ůaQuG\&1ĔcG12bFi 3hg$L4_P/qFkz4݈l5ߕGfk$GJX逩3ju5F(;/iw6RnRu2XOKjxڤo?Dٞ5bYg/a6g紞sm|_g4aKY%v-.J3zݽ漤٫ܘ\[~\XRc,[)v)VY{SKoӝI̥v%O[l nSQm9ji#;lmYmf^l#A9 7__T2WkjcӸeI+߰>syRmxbRmKIyf˒6uhS<&r, ~LAh\qHpf'֗nḠ~kW;oOwmsMʘ0zqfv{̺Ӊ>u ʮ}0W?UvƑTz,u;'.uۊ?V0 ~Y8He~~lN]v)gpUu X e29yn\ux` W:R|jq2ϻn{r7{m*qQ(ln ZΝ[at\t +A%.Pۥr:ў{}GIKP;ʹw=dcK3ڢ=vt opΖVKM7-'َXZ5>r7\e#K̐NE798(Obpcb)CÇ35.y6G0:bYm_oEgg^4_,!_y͊ڔQvE:yelP xbn -%znqi;HqtH|}nm? c;HZWx=k;|6K3toGkBwӰp<2!ZGJc=<G KAa7.bQx.ϳ0[ϰ[i{G`m5!u>Y;G@ ouuA g6ۺIa݉!O9w'{r<`5f&,Eaᝣ8sf>U2lv,F(JZAyhˑ&. tD~ ɪ?T^'pݕ9bjIYy)T jF<cy+feSam\By.U!M MCWzaRM8V_wrR-oW2_zZvtD/Il"N^tۅ޲sa;b.U+V@qcJ'|xQ#x}Fos&osł9ފjҋT&\f +m^i{=] VXu]l\GӛMB6ӹ4D֝GQ&Jص]2ruk$nAE;tfӳ^TZ\ EL[OŖ*zҡnSs #}#֏k1=GZ%.޵oԾsz\hYMTKT]YeF +ߤ7b*lÆ c:0v=^SƠiw2i52mb do=_8zv^W[o.S>%_Y}JP\ +sle&W\O;b,KuO*+`I[~ vWWF{x}s/&:HڨI߸5d-a}[{eس-Cnu1ʤg[x^UuhtVb6%[uKiq[LѥW=IKEK@9֩ŒII]Oil[[]g+k놄oR3v<îk1Q;T +3Klk<{%WkBwLZ5}lU_OΖؤ luS%Je߲lHKE4KAozJﳡ#~}R~W +endstream +endobj +529 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 528 0 R +/Resources 4 0 R +/Annots [ 530 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +530 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 450.123057 101.433071 431.373057 ] +/BS << +/W 0 +>> +/Dest (cb36-1) +>> +endobj +531 0 obj +<< +/Filter /FlateDecode +/Length 4900 +>> +stream +x]M丑ȳ, /|b)Fc%!f(̪ng/܅JET )%}VNR/?~9)z꠨og\!$qٛo'7o?:lHS VPy?h|TAObΒ +f茻VEr +f8cJ0ú* T0CgVCD QY#负=H:ɢ.BtN!:S'I`JK:[vNI:l.uŤh%]-]-@WuE%]9QS)kQ~Z%鴞 ,h׺$.]봒wEMQ[` J\V(qb 8 +III\&)'q%@ sJ\ƣ 5^ x8$.P&.(lJ\:c%.@cAX"qO`I$.]>Q'1¼(O:,qbx.3I\ `?QtL)E]NG btb-qRS¤?Q$q̀N; b-*`)Ad.4lA-q"]贖 ؂hPdvAI\{I sID&i)ElMH\fK\6:b %C$qAJ(#qI(qAVYd @)%qA M$.f [&x¼6~3J\lQDlAДy N~$l1I\CfaŔ@f]L4H\7J{{LLb@z=V1eX3P _#Ie +b*ZiE<8a>U"!o{^ncןJhC|i`2}ktH,!#bFjt##ѿ0rzNϧDŽ3y9a:Z|g4N6͆ C\ܪo?Ŋ9X/vƟ?|0zSʅ|כ/@m2ϘGhu9j;"*xGO>.nKeJ<=Ovcsc\YQύVaxoߏzac9#~?O85KtZ谙;"=V=VdRDvJ7%&v]>jkk2fqJ۵ ~hOe +/ӶsraGY{9`gvF7֞g :F}O9ꎲ⽑\j{H4O, ߳c^㰶ȹ6l; " a a<M+O#JXk,C UqmSCǏ3 +댨-~wU~YeҎ_x2se,z( a6~}<WHV' `Ͻg&oD{(=VP_r0o[a%r7 1Gmyxz`g9åaT7jMov ,&;CXQèzKeis>?W$ӊ~AnXl@uҌ~q|tډ1]>3.U>G11X>[vY0]v`cuQ&B#Ʒ>U:OQ?w2va@`gC1gXlڸdQ~b}v~Gw]6ڛٸ XJ)dmth݉!Aj]p%`8:Qs!W>rcw{wyewPu<RwaG1N`˚m wHP"<"wbU]W }y_:φ`~7r +b@Y^v5d[=:OޝuBWC=VƨDoj@yǃu;WN/=uE쀄-ˆ@n?p!GuI}'޾?i,ù\:φ\,~m(.Xޓ" t}݇?ynԲb܃uͷcn=}jv[jYV9]<{@#d}<:φ{2U7ySs޺6c҃;u˹~H\tԲqxq̖{ }3q,>=z`Cν]]U99ly/lѦeLe~> >p_:Oҝ +vweǽ|ASߜ9oAd1rSyJޓy6ƃוC1mn]S1:O۱k%{5ZU +eot_.W]3B5{]׿Bǂ-ԙwqVl<57t$ GCRGRTwe'ٞ[(mjueVƵ8.7'u.>V|;Ƶ~SzvƶŅK-zu]αso,Z^c6Vw`)KqXNTrJq2N1'ЎGr-jUvA <>|׏P}_ѣly|bAA_jҋ^ۖ&ff{ bmkbb=^ц.ta3feMd%pZ;JD),6UGר&̨ܤlqOrߩڴ3y^1 Skr-'.'ҚoTUsnJMmمEC戲ZLI5܎s%k3N> +} ++вv8.',͟05^X@Tᛔ|ЮA^:ҏIhn6z<4qh{Y6\:ƆY>^:)[g =2U*=2w:CA*UJ&D*,NGkly J!CI2R#w׹+Έ\ ?19kUByل7(5U_6/WJ} :ͩLPypSB0V^ n)MӨ|a2ya>)? +endstream +endobj +532 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 531 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +533 0 obj +<< +/Filter /FlateDecode +/Length 4820 +>> +stream +x][ȑ~_Qφye`  g1هumEJyTu5>]K(/#B*I_~'bLS/dU+ +Gw6 !9}˟u!%oGVB A9AR +*.* JI*ADAaZ` $AF)QC5Ncн3z1$t:Igi%].J:-.)-lqHI:B6IaV:bb.I.+:آҒ.H$t*UNVaEa|tx咨-*#,l!H:!Fa^VY-l1&-|-*x%L%C h%01 h$7OA4tFKD`lq%&V-6ZbJ\`H\`AoIi/qL%qI kX.{uF ڵkI+ k-j:K\vVZ22`VK\ &F%qwMT$qwM €5h%. q8i5dQ78- X Cghl0pK$.p] kl5蘼#OԥAn1ʃ>I\ب F;j I\8 ]QbwAKFƒ`QIK\2P RASҍV6]=7L>3PAcm·y F>#V_ڜ6C'{o>]c_;l x O_~PXJ_E/9|Icae>&EYqlnF87 c9eu#4F{XfJ'mlȳΌz=ձP1~?2n6G3lK;<mhl>N0]Wکd6ߏ<7{áLvP ~KVml^*g^.XxC5&"`a !b^E%Fqh꡶ G@F?çj+/;ͫ6SSdc$lv7A%r&@Ob-! -ףV8hQmUaΤ=tFyry1BVE"g/f>[Uż9A>ϣ@ uK&/qf"g7u& +[B.p>q:li^Wm&3|)靬kpܧ0VOsl9Wv4ʌ_.V<*d-mTt\ڪ^u̼(oa]N:%XŠ!j_,;8NE:φP Ahq!MQcQǟ(e;ee;>âP@ue< ʚl'^*&v(+B~>k̏ $F_UluȬhB;k|z<~k6H=WwPB.;]Ԛ3v6GόX!uuoseeqՉ+i:;f6VnQEyK4&2SCO2y6d:GJzg #[Լf|?rfP<#f'< +ufCgti u}"3sA2#yKm[g<)dbPsuy>r&|Wfvm|ڏ-xGc?Gfćf:v͐T4| x<zʓ:]Բw=ZUmF^&Yi<=ܖaT;G:φXo>ޘx7YyZOy:noշf??YмBڝ+bvVF*3̫-%b9ڶƑ[Wv>)MQ|{>y:4+duw\T/ׯwfw7R+>'WWfG%fV/^k\]2WOy6dwA]Ǐ Q(#vړuw[p%mu.]gb=}Hչo k'<B'U`C.CfD_M\KhR{Eqŵwm̮^4.:K۾tZI ;ⳏsu~ߙ=Bkۻ r__Ŋ@iZnŪ:B|yγ!/\_ķ.rw]ޑ]54}<-_": Q:2A["dCA>tݓ]sanSEǗWO̷ӷylJ ]lDtӡyt(e;IY{W{VJGhQNy:g*"X";#꽘3?/QвL/ςݭlOpq1k5G87o; g9b0{%wp&e6գV~ˢ/yڮl)u∼|y:Yua=:\5~ʇXر<.LR϶&LWfݑ'<fdyG'<Z杻gfZQp| uγ!%\}_7޸C{y_ԙɫ%Ո)nsY uk5>Yz}!{ d''>kfLR[tH=Ȇ=gTM򁙷_^lx!7Yu7=W +o{'<yV:7r X%MN9 +?M, 3͏{jayՋG}Οw&]E6^ ?W|&"'~ay)OD1LXB:'?ɏ('o}Wٔ.S$2d\~yeg칔i9ϏA~w{HW~vTt&V_7j7>\K)~/?8?ih\9J5~RG  Bz-Wң8WS!UlkU<k:[ U]*h~H~:߄~t7 t otk7QʯZ)M5lgTRWJ :Ovߩ4a25~`(HT˥RN.b5Wg*RUMe) 6ցdy&i෸ukDq.<eUpcVQ]MvqA(WHkڭ^',"}#U*e4UH#Qf:$våCKG%gҭͤݐuyLRO9EXM'4~ʺ5{)+텮a'6Fnd܎ȼwnچ=rre~A +06m[kG\mВ*o]Y63wR~*,tnڦMY>\` ;M3{^^d_VK+W[/'JxC??{+.PmvkV'-Zh'TR:-E TCOʰ3(S4vAtUYnx[r=C;;JV_2 +2׮Rj%myevA> +endobj +535 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 728.673057 101.433071 709.923057 ] +/BS << +/W 0 +>> +/Dest (cb39-1) +>> +endobj +536 0 obj +<< +/Filter /FlateDecode +/Length 4862 +>> +stream +x]ێ$9}gM|Hi  5ۻBH >'i;ӳ[ ӕagK_~/9=cp.j^_I(?7V.N^{8M ח .y˟v:)`R9;*CTO1U>:㶪3\N^R gLT fXݪ20Q;I3tQPi;QJ5N)A=Mu:v +i%]B>I:[|VZysJgSt`-&E+"l1Nt ]ItN>'D]N:䓵Ji=y`ӊ:(tR|u[e$-?">VI1P^U2P^VQ3P _Z#0+]LPj%n(/1yoQ!bL1,Ny^~]VvFPR;W&=o@1 *1Us7Km62 n?ld,rc%h!kSJwXcE`h춾:]#b|mlk;IyVL`XzzE#%~gbf֋1cLlm#%S'PS>Sٿf&2;GDfC3(hkV2]%31h_O@__iiw!4vݖN뗼>oeTNҙ~oK]u]<$͠r`oթ/R%o  CD{]~a 2I +h;,/Ŝ8Mr?0麘W8iӳl$=P&Oݝa|ru+O-Q U2HdG.VG[{LO$t!{mq,Zar٤C2$LcpuǜG_&!t25ErkDP $g|NKOlD5xފ`qyi(=1D~ބG;HdC@8V/ZƉ:G}[VP7'Zq0Gy|^iiwwhdCxvoV˗>?yإݨEFyC{2ϣǸ*QMG[\·q0 k*kZyM<#y}\z2áNs٦:@ftcu:_na<&=:yH~ms98|?iFcaE}ŷ^ИH]p=i75Zz8tgCQOgVVfv|-nޡpHeGݺdZwExFtKigNYM/j~y8,vmOtԙm;Mjw/110,Wq Bh-_&oo)it^ ~'L0ZɻsZOT[6_oi0z12*2˵Y5Z*#5f}kW=|ʥts/Yj +ݫV˖*GG4l)Z=J7wP-uZʙg2(&?pE|sm+bO[ڟ-+r- yf#,u9Ｃg6inúow;aH3+b-s[viӎrUs;]`fS`m~Ѭ}Q"?3͡觙zY]&Rm7of3PK缵E3LfY<=s.Ѽ5mYPJKĺumq5ǍQY~ +hEGNynjSJrˍE&v+aR*7zm fZp.SUBۇ){?dۂP{CW|;Dzgz: jy4rףg(/DTP UB@rlQ9Vtxk=v2ϣ!*k}ͣkaN_ ۹%>{[w:$z`vl ߽tOy\y;(챟fRB1 +y4ju.`rLoOΓg?6ۺ"JaJ8aѣǠad ow܁W]mW@:Et5@QtҞwM]bvoGL] at7UᲉ^nLYnusyj_7=ＬMJ6%"u9%X4iC_#p ngbҩIYk7X}Y|ᇖj>EG4Œ_tv,g"N^t˅wع~{񎘄Grݭ3NyLիZ>[?_[C}Fg:Ur\ DΠbj"H]B36[x^`xWbB*V]Wt^ms]f:wf_ӚȺHxZ;J_D)z^5,3*7)[Ov_ZCg6=5:;v +$N.b4z*Tgݔuٍ*l([?tJ 7f#]k#_.> +} ++вr8. +CM +ߤA&͸w2 I V<#%;F50[Wb>b^*lÆ c:0v=^SƠiw2i52mb d>o=_83LWpuOWV$(iҡue/-[I4דw #v,/J+X_=o^ɡ6jo.m #i#QiinՐV'?. +endstream +endobj +537 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 536 0 R +/Resources 4 0 R +/Annots [ 538 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +538 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 292.623057 101.433071 273.873057 ] +/BS << +/W 0 +>> +/Dest (cb42-1) +>> +endobj +539 0 obj +<< +/Filter /FlateDecode +/Length 4739 +>> +stream +x][~_~`! 8!ٶ&<+ґTRώ5zuN]QIW/Z0zt™3A>\׎7OQsHg/_.iq,+STiŜwBB*csXBe)@`qZ T0CK J;3R #T!9'u0k$Y4tR0 A'tJ10f5ib#hEYIl)J`DBa Il J3kMt;?InJqJ'3"uQ$-@`Q\R:[4(x(=1Ze݊+A liR[H [`KHRS$ bkOiE2mp(."aіb%`%uEMq (.P +H(.P`[ P\@Aqj., + 39 +(P.(.P\@t1 +(ЮR\J Nq*^Q\JpGqbI Ы 8+Lz).]鹦@w@Th48jJ%+( Io +1;[@`N* PpK(.0]0clńG-N[2 xwAp<Ì*).0]0SS:𮐁S\` p(.tI]` ,ơ <֛RS\qכ₠8֛X6(כ₠aB` @[p֛`'Jga `m\oz f` tdkҁwZ p&<[jmA?>8=1^ pp/f+G 87Ƞ[2jiJɰ3NGLI >9J2WO|?)KZÿ0m} h,GD#\(F +tFbaC*W0߫X%u Vs,0ZQAFvWr=I :Zq|̗X ki>]o|ᯀч?MxlXr~c~P1i-i)U.qBlhԯƼbz./ԟXӞC.0(p<],y{S~.P?TF5L`M@~I5y26es5uɰK5;odoia%iƨ^v9`ZEB/![H˽!rZK=SW!K=#>$oTLu?ROܾzMA;# ǒ9:}PY@hH\Mu9B7}fl4Depz,!Z2zTgb1}{^lm"w,:SK_s:nFK=*?}W?cH˺K~aTNJc6 ;L%=[AQCfuَRe-'׷ꘀڔKC9fӷ<7P֎2,]:}}օvMRZ߉*_##yW#|D֎ٿ*%ؙtص;}5GԆ?lD: )fkWlv_TO\vMkWWW_K+*v`[G\xו=ը{;?-3'tO|?f6- lɸ6j}yNԍh8#?#o/j;;}w<ywlD: vW}Zvz{mςVWZ{s:n.W5okq⎝yN ta7S&${S]q%3pY_pr܏ݙt{ӷFh?h۩M@3ِ׽F{dwdDVй]%Os:$?s}H~XA铧f?m:f;[Wl; н -GջBjKh eE;wܐ6#@X +y-2R7YmNlT8+pα.'y9}\EggׄNٳ5%.Le5\+rcL ^8ԩy'L0fgFPW/*@LkMAi°Japaup-<7/Íq;E~Ich294<;dpbDp/~ߩ-NÅ֘?CY&ϱxQ6N'囱ʞ SIum^(1A[τZ"poH$ׅËͩw51CYlH!Ae:(K|&Nq?y.K0n`bBRǟ!L)M:ߤl}GDjxϽbBV9835lfKN[ +,7BJhB^UWR'{D|]n:[D)tUw oTZ )oDME֕f>KBfn,#w;0J(uEE,|Ik<.e׺dSJTdm-4 +ЕBU-cV#hߔ ~ɡ_PA}:8Eʔ|QLZth2.UX613$7}_]b]AFCUtLuI6E.ꂵ+ {}4٦ڳLxT vzuiej䔡Q\ =91ZI}6&0u:&"d> +endobj +541 0 obj +<< +/Filter /FlateDecode +/Length 4922 +>> +stream +x][q~_K8``#0ӻc#8/%N"c%U")<]o?_~)89"ZQN>,a +əo7\.yL)yoYEv +1UJi+B0 *'41%I3\ C[UT0* KAۭ* 4I* J+ءR("kvG{Igc2It0NK4y]t[\RZ94tl u`%]-]-@WuEy%]KH%T q3M.Z$֓6Ì l%Q[UFYBt gCl5I\X 'F+j I\8LX&]Q&bwAKF“`Q&IK\2P xSzN~]H&s}yaѺbo-'̓P6|]p(uvNu2XTAuQ/U[IӦM#H BŲ6;L +s9cy)78nWV22Ye6E[]9GŬ +sNwVeLfbzިT]\-TۈNp;FmT-'hU۵gV;vYoyEgĶ2l~f1 ʝ_lrSϥl6?.c}wvd4,0K]aΛ/:tnCmvݍ}S1; B)s[viӝbpeNe}0Cwm+[f^Eev)43R++VYz)9oic%#ˮv柞{z޹9 sw)m~im]I,>]4ul^;9qt, S< +C?ks^EFxgep؂vN<w+L9߼*,4aSIJK46M"%ףNE{r;?%Fʝݎceq=dCD伽C}pL:VΫMT֓:vqOXy=O`Eq.-[謋${n흎#h9w[牟I|v4;G p$k>rn㽓r"8oK7+ ->I|>*J²weEPDSJ.=T"]Qw<{(\kn˿au.CoEn'SoߴM/l2 + 1$y5CٽͶӋdd4eezT[b$py3˞C}dVia7~-+6+Ej0#\CjC !vЩ-grͰya݀ b\/QQfg8ʶ%,yҝ[;jo]$sg.2SC~{'<2ڋ#k%->!}tK_gZ5nύ(#g&3bvQx2ӡXGI0nnA}"Ƒe˜u'V ڬHۺIa|H'38wC#=A_7g†w#vsd>4zJz;Q)h}t=+KV^:l]_+F6F^Yi!<$p$wޒ0;G<φذo>јWnϵ<ßtQ|g.h=}wL'<ލ?zAHsEwlq:"W"{8rlǭOgX(]G[>"uA?쎚!N?y)Ϡ}~O m6 ~i}y6e,9zV4u{g#y}ͣ{$E)w^~?x<|W#4EF('<J˳QGr6FdgqTT}s5 +ڮu7GOkF'wPgkpq@,0ܱz'g>j9_|cbIK/:O'r,\4ۅOd'ALԎ8pjYEv-))g+dHD67W,뭘[&T8WSe*lR2Um {4Z7a5: IkB7{Q&J,RT]vF*u%e$nA*EQIga,@.tv-:R-k*=LiPSQn7#ʖk1RZ7f#]ՙoԮqrzvVqT /Mʻ'L"*\2*Lv*YN徲I=)]w*f gҭk]uyLRV a &n4eVv/ )$V寗 {/K_i~y7ܺ+H<)o):m:Xǖ4uܘeWKJ]TWm/t;5v=v#ѱi |iKd>ڶX9Mgے|'mK:d eWajd@Ԯg +uu-}E[% l`}ie`ׇ}1ٗJUKkXZ O|חuͱP2y[ղl7lurh.zvز- \_)٪ҲPTLY-1tKnq{)TIGvGoreūޒZTKY}(|JEu5!yes̝9ϰ *?y'Dv7jME!_(v[#+& D֪dޠHNJ]|r&=VP9 _wP *Yvz#-LPZ>4&Zm`У +endstream +endobj +542 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 541 0 R +/Resources 4 0 R +/Annots [ 543 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +543 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 573.873057 101.433071 555.123057 ] +/BS << +/W 0 +>> +/Dest (cb45-1) +>> +endobj +544 0 obj +<< +/Filter /FlateDecode +/Length 4929 +>> +stream +x]]$}_QφMa ?b.ݵ6װʔʪ陭5+# +YJ}VFR/?~<)z%ꢨZ8yCH`71OoOrg"!p )_s5 ?R"M<=LP"ܚy6D1ά;Vָy[_s|?/Fy:߈U?;hlbW}Ōς8pK[ky7bכzϨֆ1*|tahhua?RYSWHzW~Ykñ2r`gC~^ 4mP?_?'޾0iLss{<rům')BE@u@eGh]%?yͨEF{ =Ǹw:G:rv5 >1;rg2?{@WhΗ;{``Cߍ8ߑ٩Jܹvc҃+yɟDG0Nosxg3qzY|zeSlrA#7yk빷5JVjjW3.{!QKկLtqGuot,){;{ ud;Fy`#k'gody:__GwVI!z~z)SIg|^GQq! +ieVxߗ `gCrZa='=;cZyܗs=?Ĩ WFcnF<~=YPװʨ7#~.]bʱkw/y;+])Ll43[P/qF˞toX]+?_V{%`Ǧ7cĶ~po/110o\;`moGPODddDHڤobCCkvtoa6ē紞赶nȗwQ/,@Dž';:zy[rN$5=܎KSEkbkiT&5EYպHaiNX#)dKg.KyiZ|rwrm9n)+\#igmq־y aA9PvpSJ͎Kj_f}Mm,}rUgF؟g~6]}Nϰ-}}-O^+i"5J(Yo}g s|8_U՞Ň-x{,bfBݫ z7%L^d,Z^T|:t#XX:,\RB1ƚ'z] 1 t[>WuZ>56͒jak6:F֩ȖT!rSդ1%Mv +qx^`xSbB*V]WtDxs]f:wf_ӚȺrBvRzD-zר&̨ܤlZ? I~jY*\Kk:At9|R5WwS:mjdVl([?ŴZ%^N޵'Ծsz\hYMTKɌ' *Î*|5HсWBcNXI.]:ƆY/Hn[I˘ѫA1 +۰aBwN=hh1]Ϯ:ה1nZ.݇Llt32x27}ž/mm-j.xsp)̊%S:ΰUe+3 zT`a]ڮs}EWYiK ^ӼҼG0 i&}06“\eslYX=ʲlC eԳ- > +endobj +546 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 127.623057 101.433071 108.873057 ] +/BS << +/W 0 +>> +/Dest (cb48-1) +>> +endobj +547 0 obj +<< +/Filter /FlateDecode +/Length 4833 +>> +stream +x]ێ}gyH8 lﮍ`C~?("tٵ;V/%X*!蝹~zRER_oR?X]_HU]/l?_~yyUCNI{=|^XFR3*ku#e*3L S T`Tfh^"P^N3dQI;aVNSrp!f*Zh,lQV[([w` K(H@=`*x9PE:%9"X8&\V[t4h[a2 5@ tkDhq\A0Sp\:8qJ N 4Hs\:qj` qq2h xWK9.0] #qzuʠB +p\`c +`u~𮲸n*+r(Gxbyw`9.|A-wenji CtX >V̸E+ҹqbX.3p\0* ,xWjԜ+UX.q0H8`~tY]D  -) 0 "IX$qxC9.p]LVk xW=8._-3B)8xWH0 +#K&Γ@ `/Xq\tpXpm9. buxq!8. +h8. +e%ovy[v}`` kv/oh?!\=Z1]M&Yޚ<yŇybC_,a橱ֲ[mlm)۬֙mI6>cc[gϥl۵ksO}.~3% J/X[Ƥ߂n>oz} <vVok~ ~tm`{|ۤ񾱵iN-3Y$]jOӯsYjӤQM7XHuȮ~ߕ໺;.N̻n9+ oX<òvܿʎϓ}lbHf~'~灂G"e8L4Pj^|ҏGZ1\]m(d)r|۾q&?"L>$/0uį%?&ޗINǮeJs[6ce5=v_6&|6qqL[SMXcEn]T|ʦ +Lh&z9 zNY8zAPikVG{ҼNr&}}7˴󰽗2]d1[B=5+/׹2H2+bAsU:*…grKݞ0 MAY~=潖ҼpzGq>^v M2t9fۥm#+5nm|RzUȴ} vۏ] +p,ꙗ̝\=f-B@hd-{Ѽ#>s:d:;P)Rm iŻXK*+&wXbہ]ONrܿ`ӡuk{ݱ''tOb?f6}oUl}`!u'pQ<#o_ll嚲j{MwqJ&qY_>F oib3r%UDjeRJIGka':8qo/iSڪNK:H~}19H1OuR HFrwsCzyc%ˈH5;x[1hz]E} *͉E$() T.=-mLi/0Җ,|~F +endstream +endobj +548 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 547 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +549 0 obj +<< +/Filter /FlateDecode +/Length 4894 +>> +stream +x]ێ丑}ϯg#~ c`w/`؇)F}HRY]= Օ%<< R_~/9=cpۏ.j^_I(?7V.N^G8M ׷ .y˟~uu}5Shrv)FUJi+b4>'41gI3|tmUfΘ$̰.jUeav +f죠 +vh!9kSӃ3z +),"t:Ig^K<|tk甤-Φ(l*Q[LVEb,l-*(-鲝|NΉ J1muF'kzuQ-A,`H: [~$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a +c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& +%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ +CĜ"52cX8DmѓٝdrgL׿Weh%C|a`2#h-`CژYDlYuae+L%c+@`,{J` ͒և59"&A˶vz$[F1y!Yy7vq[10h<lm#%S'ŤDi~fY>`a@ ͠E}[%ݧ tbާo|tO?^~?}?^w_\_0bEvï3=}KAfy," i^"?5C;6W*,m?jKm.=w'HG乻t#W6[2Sq7D2IONy:$߉c9z.g~G̨ul4/dPH=l51UKC؜6yfamfGv\FF*C8ֵRwF ]u5->V8siWc3O~r0,\mIC_9Ɗ7Sse^Lugncֽkf]D1 -wiӃȧyusKOy/vRW9LZ6ϝ[aPanMTwK46O>" +%{]*d s/S3)7ILyىx纑n-3X<=}ׅ(^n7k>.Vcx@x'a{ϟtۀby2wH/:] ;un+d'Y6qͼP>w8`ztAēy<.9pBr֏c\grRl4zp#8S|q^>lym4nv{8$jVӤ5GQOy: G?g4Z69 |8mG Xμ2dܾZnyG&)-o9F۹y[W8}JK +vmfɓwfkArA֢G/zm˛1b/lkxj}U/Z9(Zr'$ayQ=^fōFBXP~Cwwrgi~T?תiW,$V~=gnY\ڰ鶟.ES7)UZ7K`iݤcu'gZ;+ƚ^aZ_,*Eg7}Q򪈓]vpع~s1 d7jћZ>(?_[C}F}t&͇sł9ފjҋ!Mv +:Rn^i{=] VXu]l\G;}B6ӹ4D֝GQ&J]2ruk$nAE;tfӳ^TZ\ EL[OŖ*zҡNnH_:ƈZL㵾Vlwm$vG!\|ZVn'ҥ6Ь2z;)?SoRbA)zplⵓ<4q=-saK'%'mVR2&G$c- uMLVӸ U5uoP~[ UZeA3VnƝo\[kz]t0_2QLO.6v2&솁[ة?e4.iXo~`5}]P_;F50[Wb>w夓b*lÆ c:0v=^SƠiw2i52mb do=_8^\o.S>%_Y}JP\ +sle&W\O;b,KuO*+`I[~ vWWF{x}u/&:HڨI߸5d-a}[n{eس-Cnu1ʤg[x^UuhtVb6%[uKiq[LѥW=IKEK@9֩ŒII]Oil[[]g+k놄oR3v<î 1Q;;U +kcKlk<{%WkBwLZ5}{lUYRΖؤ luSaelHKE@KAo/9Jϼn]mr +endstream +endobj +550 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 549 0 R +/Resources 4 0 R +/Annots [ 551 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +551 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 348.873057 101.433071 330.123057 ] +/BS << +/W 0 +>> +/Dest (cb51-1) +>> +endobj +552 0 obj +<< +/Filter /FlateDecode +/Length 4696 +>> +stream +x]ێ}gy)ހ $Aaϡ$^Dnݳc vJaD*d}pO_/sF_brЫǙ:#) +\05u߾{G^UU\)Hw;' +P 1sXFeeK S H\`o8 <0Cz +0C9I +f`vH%!H+F'MgQ)YT`u:Ӻ.tZ9tI$8l!E[-XlQiN`BFa YlVHNtg'bu:᝟0Z N'egMУH1:[0t8xh=[UZh lQ-h|-YЃK(: +8P^ws,|9р +#ZH@ brL%l!\V[t -HqְE@m h@nIqߒ …  ( 48W;9. ]twqjc[ 4xWxWkdui5R8 n8.@vX*/*!չ}Ps\@]ep UF( HY #Xo +1;[@`Ni PXp\`2`c4ت>X xWz4 tqߢ;imw1Pi x9.wQ+5FjNޕ* x~p$ 0uR.t"xq;$ud X.q +5+n-+ @ni8P` +N-Bqa@y ``/Xq\`=u9q :|v868e:B8.c<NN #肄N` SL@q31*t~t1ƼQ7!ß/-'W雞s,۔$_%=[Lw#)w?~6`a U,?1u]`Ti$.ULMS }K爰TD'7?˶XUV]KQD&:xyO3<5- +Fְ\1!e  {\0[o9dAۤ-uВ)OzMF;# ǒźΟ{,^#T1ԝyΆPwy({"epZ,!m  ByTgb1}{]lmʷvCk `:ov_ӡvOMmv~b)ze۫njs_s:mܤo淳δ`;cuPhy#uZAһ- /&g"N;|=:ߪcnjSFǏ +wOrȷoun%eGUrhg[ډE?UGzJGQ[Qv9J7˽.e3h#,ΊiFGteu|kkv9]|S }MT12Hv18s'0^G6G%}~G:p8aі 1x^:x|wk_kú:vEdWk=ףr[Ѷۈ~3cum3ِj7awI^1f c qVw; ՇdN;[wgӡy}t6^NFa*-TӰ ~^zs:٧#tcmg=, 7 +s:$?s}H~XA铷f?:[g}O& 5wCqĸ9ְUru0oO cعTbA\εĈ #Nq?E.dJe7BRN?C.\St51IB$R"3"sqzQwl6d3@ӖKMԢPT+bEwUg0^W?Uj5VJ㞣TJd +YjR ۉ.K&4fWwn>r1ۅM7frKʗ!|1@]\񌬯QvU:mlWQ3b("~Ǥ6+IЫ*7(x) ]3W*LFHʐ{וr7xZIf!$.\l]_ &}$ݜ:DZUY%w!I*T,38RX̕P$#p"6/q +YYrf|.f{slԊ#}:I+GrJX )qї^zkf-ɸvsJjխ,y/|Ͽ.t>m6JdP['z$+{nS U_җ&!JU|M%(ĞR̠2kk)uXU"5Gۦ áN` +.C*G1iҡ%UeA](b$T7*7"ꢣ2E'YU> &Y4La{=6(Ԟ/4_Xf㥺?> +endobj +554 0 obj +<< +/Filter /FlateDecode +/Length 4237 +>> +stream +x\ۊ$}gRyH`d XcnK#af +?}"23*gv$v<]Ul)DӇ59Zk%6M~s<;KDWS,}N]⏧|v綎;{Sk.UL.9ۨ*TEǤ3b +0b&OGU %j* *(pTUّ WcVT֪:D+:MѓΤR}Uu: L.:MWMJ)MGu.KtDV 5]UuK.u+*XlN`b-DBgK.GtΙ + +lXb^`!h:D ez^"xI &_cQVa^8lzH`PXj(рPY`tiD,DJ,%TҸ x`A BOA%xtK: K.`Z 7DP.\j\ܩqAbg X75.@%i\ո!8`G\ x785. .׸jIX % 3U `и>b z ' (ch +z8, X Chx%D5 2ԤqAﺂSuո +V6.qAb +D.h\7QvjMuZ "xqCԸ` gẪ[KѸ wAK^04.8T^5.H]Cи w-!Qu׸q tXʚFjSh:uaM޵6W xM Rf/A5.HL9i\!KQl!,U,I֦Z4.Xd,4.@D`CwQDLD䘐.yS2Z\ָ g2؊ȥL׸o8\Ҹ0sqAq"S<"sMAtsNѠdj\$LrY4.( ` S:`Mh\d;j\&U,!xN7^&Yj&aqո|ӓXo j7)붆fָD(X4Ue݂o4]_I゚E7ѫGͬwc3i:."Ӥq.o"r{ ,qz#V{[e|9GR eIU(U ,8a9}GT g̃X~XRl9ovRV_a鎈|$%uD-n ;?l8CGmE" [ I1{:OBΈy|p:i*ﴕu^ $9F:nWvka cT.ڦ4-@[aϬ "GtP&Tϻ)(yMߜ@+~\ +6Joޟ/_}ϰӛ~gS|~D߷-gHY(eko욣~:t$MG=#VNhZ_n]MT®Nc7ߜ~f-z?WcpZoqn6\貝OsZZmˠ2~7>}]y׎!l1Zpա;zu>5v&5yvׅ:}bɴ[LQp60|ni[^Qqw;?nr;y:r-(\JTXxgCxr[} oWݱz;py&Vĸ_L;_L_}?͙p:D֭gl ?[K n>ײ'xmX`tsczoX>|*LjI#<cch\&uԃgp 4hѧeax"bO }G-NϽk8}ie+d y˳ͭoNZa;,1ʳli^׿IG^a[wsv:?Q`r:߲{{tlmuroؿb^}Xy[v|D)y2 ߴ۩u|u;ll }JN|a /pm&_I<G-w׶[o>rlx4oI}LHΚaqWLxgb0^$3%FЇ 6Z'n BevXuة8{-PMLJX|KJ*jdjĜiQG܃|b +W,ԏ0DJwHQ)otۭXkRTm7pBgy*P7|3un'ܟk|[SL^`y"{5ˋ$obI^.Tw>/=TO'y#mYގ"Q/7?pZw3)M+dǥ=v6a[ n(N{m7_"tzXzŴ#!P+{-م߭5R tߜr<,r?dA'H٭/w7x6K} ipJy7מy(g>y[4Y@Oku+5۫d>Re,?p.kmߟڭP=koM=ŏ'~)bCN1 ׏vEnĢ]vAMݗDrm׏3`{c ׏? +}~XfrG1m*ń* (ld+()8~v.M.M>%t/}TT.. TK 1OrR4a2^? Kw$j/.'Z3G2n ez("̯kĆq+a̵-oAx9E+qO1+ +N# bLi.TX] U!ei go$iipgYa.Yi/WRIwHɄ<IjV 1SXJ)8\q#8XюΒGSw>Jq3w+| /mc]N۱΄p)L&uLq/Nm!z>N{JdFo.-֍XdVrrՅc'AS,7}{4I콤 V +㴡axCxYq2;7s^.C#.ppY.-,[:EE\Fq):&;d񓜊} Fe:۬l(DA^ȆN} +`!}10ӥ]s™/mrҘm. +iQvJ]o. ]6ZSZuJySt2嬤CYnx#Z +#ҝ%G,YYfeǾiwmb4Y-J^v:STi'!WI`&g׹}Vr<g%'LlvW#ihVV:@9 +4g'AE큺v 4.3^AoבeorVNb5 +endstream +endobj +555 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 554 0 R +/Resources 4 0 R +/Annots [ 556 0 R 557 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +556 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 536.373057 101.433071 517.623057 ] +/BS << +/W 0 +>> +/Dest (cb54-1) +>> +endobj +557 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 299.626036 101.433071 280.876036 ] +/BS << +/W 0 +>> +/Dest (cb55-1) +>> +endobj +558 0 obj +<< +/Filter /FlateDecode +/Length 4808 +>> +stream +x][ȑ~_Qφy30?beN1=>/$EYKUit)"//$}UNHz1Oן.?_¿`T]08|tןX`3_/;l_?u )y?b VP97`T^8Ŕ$p ݪ̠dLTfX +ު0A: (%`"Fi7x tF>&D]N#| KEIG%%-N)I[ ;wN-$%qop qA+@WԥA%.p]В"Dԅ@?T$.]嬕wuF#ql5 guPL!Jc%xW$.]6%.&J\xFiH!x |Ru~ ((K +$q!%.Xc$.e4o1<-l(qlH<1ft-"t:H\ ؊E/q~`wI& B-X*`+g.4l-q<]贖 oPh"L$.XC-Hq%.v%.2A u4!q懃m'qsDl$.p%.e$.69 $[I\M4R$o(qA +&B-pe[ ehUn$a(ٸWx:vD\.#=ZF?e=ǭش]ژ|gg`@! Q&;hEw9eب맟._~Oo-gz:=ɝ=7ġɲ?BMb  + 8^f2;=mњOg&89oѡu]GMwdΜKs/Ǝ*o:gk0n[u)Sg:Kg.3>խWf7Ӝv~G]h&n{/\w> +c:qyjS ]}yA_p29'U4FmR:!_܏*&Vm8%UrЬjV[aGvl,.`gg̈́Jq[A'i\mtstVAKU8ٴ0eҹH3њ[&%:bRC"8ƉMs&5na`DQcQǟܕ2e/_ۿj>{ یhUĨ(;V$(fm.Œy_VRg36(˳B~9kc;$NLzۣnmZhc1dw}c0=^ԔG:gCxsRhJ֩[%zͶq}]7ڑWi%7omuFϟ GF5= ;,]˗ՠ}U4~̠yF6 +9 +efAgT]IHODV?-_ctE_Sdll\uBv|H|C/Oo#X!oLJg2,G}d+%#D 7#m۟#?ѝW6>62 W|[-&j-_+FnsS73 >m4V2wErk:QXas:n?}U(O\Kt 鐻2:O쯉շpм;;l6;gW1_?ֶʑ[V6>)9Qm4s64m?vza˹<3}=xUʐݠ?{o drڗddՃuNɻSPuWټ6Q"x+j9jw p:]kh=̥y,փއY7>p`!t'zQ GҘ2j ˈ&{~:Twm,^4wn޶/MsRrN/lXJFKZ]FMyVߞ{no.±5{{b-+zy_U{WH/9vwZfvqu];Rײ=bɮٌ +2A[/ X!x'[.o9˄WO̷ӯy_%{&wy4":Xt;o]k')J}')~?}d%pȈڻ`4G*emQQP^̅(Yf;.k{wksFnvpՕ:F87; g9b0{%F[_v_zT}oYe?O}pP-N7F<8_:Vtfc?Yis|<:;m}ѶcĻXys8>6c* s6Tŝżs>o^);W_#?7^C/H^VfյגJ]7Nv /|ו}Hߍ}к}C½qwϘ˵O&vyl:CN6M; +mYcVJ&?qJޔ2j|>"Xj|>yYn~˓hN̰cCdh}7r.ʹ|(J" i}~,,~v-[wڪFn鮊 e{4 bz;t\քf:tk{(WUd1*%˄P'Azߩ4a25~Q$HTʥ\N^rskT(bWS*m,/1ڬeǥ V^XҮrrz6qT/UWOXYƯ'pE3~T ůG^EV 4B- `/PI.#6CC1IXuA]3)\ +U6U+P~_,UJg^7pw*;[q(3Kn,|76 ;bnW;k0BW}yvwuI;oqCXaUj~`e ][3F0[v'Cǃb~ me 5_:ֲ.4|MĞK h[c؈MѶ!|F82aO6xA{:8Ug|m[:d8haa-d@g +}5nmY6ES.mچI=/l+ڋci!> +endobj +560 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 797.673057 101.433071 778.923057 ] +/BS << +/W 0 +>> +/Dest (cb56-1) +>> +endobj +561 0 obj +<< +/Filter /FlateDecode +/Length 4950 +>> +stream +x]]q}_ 0p $Fa cn<%%VnwӪGxxX(*_rzJ)ஷ/\¿buQoW\!$qٛo7\o?v'I>m %,bzAlzö^X,{6mH C1)31Q`4*ADfC3(hkV2]%31hϗ?߁O'_\_0bEvï3=}KAfy," i^"?5C;6W*,m?jKmQO[d02gz r>si^X_;V9]#?5xG;\Cߝ sw9:Gldf0j;[od\utH9z.g~G̨ul4/da(L$zOy6v[êόJfl[z<Ⰺ6S棈gv.#}a#[wA);O\CqS=Rr€ւL7Ǖq%[=? ŨMF=tH=kvިkud( ~#=q]4݆^}'<c\+g7g{l{\XԲۮrաUa=h,umȘ~.Tgu;z(mFKoWtzõMXrm9zz|s[N[ +v`ZޱC\̣^ ʙg<2A~&Fqs,6L٣Ϥm E]:pΖIwxBy/78ÚK,9y:P\䤨= bN`aٽlл(2==TZFE+yz̡͓ydAڸ/z}3[􍋼:5 $N]nÍ"BQY$t#3LJSZ>FZ+bN>IPͦd0׎6!/t| ãGHAj#\gCjև|}pm||rxD#Eu$-+ص>%Oy=A}tqT۴  dtȴ5rn󼟟>Y{G +{缙wssy3ޱ>Y;. ҿ6ۺIa݉!3O9w'|< +3g)o Iݯ3Caw|d#}dgCVwLCM/<~Y Meѣw A5Mrul"^WC6] З#OG7՛YCCKn[YL]V?(pMrc7r~#~ӸtRݙzÜٳa҆Mr mX4iC_Yp n6MM8V_wr/zZAUŒ?_tvJ*iWEL bѦ;b.U+vRn 81Z>T84ޟTMd!rSդ1}Ar)tS {w*&[buqMm ]LӬkZYw oTkG(7עwj2ˌMk! ]ЙMzS; SkrM'n1Ro=[ԳnJ::ۗؑH_ƈZLZ_pc6Ż6⣐wPB -+xҘ04ITᛔ|ЮAۯz%46x$.ubOܥclI t[汕cI5XuC]U4BU@u]VnoCիVY šq^m2WLlnSj] a .4Vu6v*!Y>A&͸_/e3:oQ/kkyܨqJg2ΙtRLASm0qXW4y׮gWkJT7-C&6 F[ ^lMK[G'*\2uS+Jڧthaq %0wVf y%d]a.v]4ˋ +!`yye`Wbr#ڛK[HOr֗mαVC,ƞmAN=p Q&M=ےJ]*E Tc),٪[Jb.+ҜyMZ*x-Z-αN-L,MzJ[eۺݺ:^Y3\7$Tl~]3vT_h-ݧRG_]b[#9+Խ^cr֪[eޠ r&=a+Ӝ*eC]FZ*ҷY +z}YPTZ~vnI?iEL +endstream +endobj +562 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 561 0 R +/Resources 4 0 R +/Annots [ 563 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +563 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 348.873057 101.433071 330.123057 ] +/BS << +/W 0 +>> +/Dest (cb59-1) +>> +endobj +564 0 obj +<< +/Filter /FlateDecode +/Length 4793 +>> +stream +x][8~_H|)$HaA!H }>c\!#1G=ݩb\8>+}_$=ĘO'5oL1;Y+ +Gw1 lBr& uҐB'c'qAP8P-H8C)J\ lH\ l q Cv%.CIG7 I\qכQd֛X 6YכADEuNS-8 M$ yכQXo£C17.ft]x^` VZ+ de+(F anC +܋*1k$1h3^`ZR+1l'CC>ɄaA뚣% ɮL1RV41500 }ks&l! |$O6"f-NAl$|cf9 nfkI"wfyGGm=d2;r+ @@!3%dӏO~鏀ѧ_~_~;GI7!7}<ӱB9嘕W~oz_qfwh=] t,c,?bvvtD \uH.neSO;z8Yjg7CH\8r~)=VMSq}^Y[}ȝy+ m>'%7]G5- !Xqڙpވ>SA=q˒L:ܦ(?je^S9nӗ<7P֏6,vwE3g7HfVV)$Eǘ3#yW#4Č(}y r廙_V=GUQ>]hG[}w?7EݻwwpkՅ:&pn&|Yr$;L}K0f2壖5Ӿ\ Zl)+{/~y/96p Őpނ=;v>݋_3Ed:ʻ n#pQ=#o__lܙp c7=W>rھʸs8oﴟ^B]ۏ{_/ +\Czֽٕs8nyG!e4; ~?] }sׇk\SW {S]y%3rY_c;>|G#O& {~}^ԧb;I글v?Kq]ퟗ83:FsUuw~+$~q\ޙpHU_߱eOaî3м>Z} +񅫶YZ/2yfr{Fs8}ه{"U+\}B./{X@ڙpH~.U"=bgO͸~x<f}w&.< {s4 Խ=G]! +B"~;w܈6M#g#}^ (}`_ݙphx@E&ֳ߫7ׄٳ5%.,eu\jٕכrx"hCWbe4uۼ31@wgaz_lgAׯbQ7#Zffv)o_kKHWgykQH=C#Vg~2~X_[ݗp݈ +=XuKZ +M;cv9bحc;.X忛i;+* +$}Hy}9<!3LJ!''ϿW}x:rSj}efi&7g.[qmqIN믟XN,TrL +W|7p\9n;A೧!wHN[ncB?T۔U~b~U`J?t!7QM9hS~- bgSղHUv!)+o|؄Odo$"U<׊!rz}+g=ۃ`#_Mq a+xV`˸)V1*V]*t 4֝k ^&J;KKQu2ˌJUJ!TI]NU&tfճ^o~ +ctDn*՞ +5UlYSifJF4ס1l9Ud17QMvrAHW(WDž[Q54i~ffT43CST~];jYFr_YZZ\:Y^:*!}&ݚLʚC*e1늺*Vڧr%bkbW67;]{kwWmb_Cq_dX2eبgRIUgV6@ +MhmZi| 2iƽ~9cI^>i~?NtCyu7:,=緺a6Lh~Һ:ZvՈԕAurkmĦBhZƭ/]+VGپiЖC56BX~:8Mg۔|fE('mS:dXFBq*LͲ~]as]쀹6i]dY$p-?敦=}2ٗګKei%> +endobj +566 0 obj +<< +/Filter /FlateDecode +/Length 5021 +>> +stream +x]]$}_Qφ װ6xa?LL,}aPHeTfVO{(ve>BW?h/9=cpϗ_.j^ῒbPOW\!$qٛoox.yL9_IS VPy?h|TAOhbΒ +f۪"p9yI31IP%a]v0D$GAF)QCs:IgR6YEt4)Dty +!$lYiIa)I[MQbU;Y%t%Q[TPZe;u:bO*IM+0I! +:[Yot8t ocJh54ZybLt%0$ +$01N.'Ivr%LʓJ4`\Q4tFKD`l.HL`5lq$. l ,֩%.[tpaqm +N kX.{uF ڵ. ,x:$.p]kSXdu8*J\FF ɤ$.p]wM 1h%.p]ik (Gxp`%.| ,wu'iդSxN>Q'qa˓!K\ L'̨F3jK\8L&]Q'SwAKF“J`Q'IK\2P x{ wVUa-6 @a+i2` +IU=,J,qAҴ)qA$0I8! +6c dB>Q&<{ DlqI\z6' - -$.@D0e[\E\8؂HQ0ٔsDW%]0SkQQ݄XK\Ԕ0%.O.I\3Nₘa dK: [dK\H:%.H  UfP`ZtN:3I\\(T+M0- ?`&9X$.Hr3I\l1H\lz3J\lA'qAVa0Y8tJI\uz8 0.i$.Va%0n ތd[V=7^/"YԇYp`&Qq&[{6o?] X#&]?|{^/ GпY>,S\ +IwX~WWʥ9-r/~*EF]~Y]򅭜';ܽ.s}^ʥ|~)e?r*TmCoZ1涘wκ4ʭT/Byn? K o!um[ӗv,C9˶`)>*{prRVص#{vޖھJ6ڋ ʁ߄ RgWո]|RmKZ +q".O* +K~N/J~* /}X\l)ϵL{}72߽j6{>2jN)wyҙQϔ<]ƚgknq5tck<#qvl6U=vվ|| F0V_}vr9(>uic nW+ԑ{ih7b}5=1G"s qGzOr_ _⑏h3*W,۹{Yw䞏`͝uO%}q@[%s~T@xhw-(Xw2SN6rU&v5Q[21 L7DO?})F5\ֲtb2q֐c.K=%qDc3VxB(KH(ў>L٣Ϥ4|X DLy`x}]-PL*>cag;ΖmOz QnQn7p5y FYrc/+:@ m%JOD[ 9 :Z-Z콅6ЧCLUCed!=U%0?)];[ sY{bȡ0tnq浏FF]MWʚuXPک`ݯu*vM溴NjK99ٖl]ZɄ;N!\'Ap7=7$UH%2"u쭚!tpnU6[[ioԵZ8z6{k um}ai?2[/nk[VXq,tXl450囓=BCǡɆ8=Xl1Yxq,K#c9y:,]^3Q_5~ Jɱoy3cdČ0ۼ(Ʉ\4F3[/hh}Ȱq< +]<aH^ Ft'<~t#Ga=ɱ#Sg"[>{C\`H{`blϯUŝu_[E6Fw[m6=5r)½5Ϻ\7#Q}.ϓ\qrgQG<^f;/{7mg+;3OݶQtQPv2ϓMz|^v*UOυeSuĬ ^+iHhwõ}d6ia/czS}?TGjňLY%Csyqx22g٪e8Zy~%nHWBL" ѕ={kU[slo.1)5rsy `?[cÇ8z% o|uчT捛y'ύZdp=*i_Cˉޗ~{O(ǷGx{=/,;NKs9]N;P{*-|&?Tۋ#1 qTHƈZLwVlwm$vG!\!oIut)EJ' * <3U&%)kKxSf塱<]it _:)!=nK<21y<"Fknkbƕ\}Jmz* ݷr84|z\ӍV.|F1A?Jب6ʘRNoE\Gkc'2iƽ]~)ӜНFje"_wcvǍjla|&I'2U؆ hui}ECǍa|zvՉԍAur>dbӠke;|k {~qtGe\oS>%_Yx}JP< +sle&W\O;b,GuO*+`I[ vWWF{x}s/&:HڨI߸5d-a[7{eس-Cn1ʤg[x^UuhtVb6%[uKiq[LѥW=IKEK@9֩ŒII]Oil[[]g+k놄oR3vKT_ ѩN:Zc87DyJ;"uׄ*jEل7(U|QΖؤ lu^)^aI iH_g)M=@QiR>).;B +endstream +endobj +567 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 566 0 R +/Resources 4 0 R +/Annots [ 568 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +568 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 597.273057 101.433071 578.523057 ] +/BS << +/W 0 +>> +/Dest (cb62-1) +>> +endobj +569 0 obj +<< +/Filter /FlateDecode +/Length 4809 +>> +stream +x]M丑ȳ6| 0|a,0}?R"B셻P] +! +?iIO1|IM)+%VE~;kEar:?e SH~==WYg3v~*S!('TJ[Aq^Py=)I*ڪ̠dLTfX +nU fIR \TZmu0DY#贛<%ѓ$QH:k'H;-wQlqIiI`DJ1H:[Jtx' [(`JKd'"KЩVg\VI:'lZQAAK8#ΆjjI`1DlK `181P^UL(p/V 7Ĥ2z1keJĴ" ''CCd´ Dmыٝbs~; o{zUɔ&W&ao[_j`%r>hzګ_z9~/Z/upN5E\i?+h! ,}Ǫ_^ ZaCQ]>BW^p0 0|y ͙e\c47`G\6nX5e^FW&cIeV}체Qυ[VO9bŖJN^>2,_<*{=l4~Ef#K,kYl,ζrw0ֱ:!SF=#kݷ>U=`!lAA[:VPu=yͣa|̨OJy~)<REH v\u/[=ۻnrYO]&ڶs/5y Zޗu,fJ*cu7⯯bHs;Z[!r$3G{M'Vίv9,̤H=Vz#vh""ibL}{)DJ+:1Ϊ;mԒ:3&2ٽu FA[=-|f X(AoC pDتړpAj}ˬև1*|t~h;phxdˍ2;_mi2Ȳocwߞ8X{ +ֿ:Búc=觱 Υ;r<rX2IA.X3g9E5"JF>h_,~o3InxIk֥m~;spH> cexD# 7v8qX#:r,_vew;#=X[/{$śQqy84_q߻W:G:rv +SrϘz͝Vyf4{/6e;<܍8#Ͻ%Su҅-_$dqpH~_DG +5@lbaE}Ƿ^b{áƽh NqSs #GB8U6ߊ[ѦeЏl2twJ︯`C +W3< !c.u@REkA&_;-_9,FU4-@:TAr asn#?a5&7ޑ=Xz=vm#F^Myպd |_.W]3B5{YߠcAMR;oqVl<5wp5fV$ϐT=?](3/p(͸ٚi\ 08.7'e.>V|=Ƶ~vsM!GvƶDžK-.Gz86WJ\v[w4"Yރu 7؝~ <Ψzc[<63KLnq޻TJj43[P/qE~cu7r~W~vK +MomF^.v+rLy$Fb'K>?8$ʏ~&}=S Mӵk-lgО;u}k|)㋴zFVvt,kWyāQsbuv]le9\w_UjTwmR1/]>:[^XoC򃣷4ҖjG{vޗC>g`[~Wd|.xNsܿiǨU0v_yAfkfLu++"KKߟ6U?S/vmpz ݾ>]eW|>5R(x +Թ&W}fFT{;Kw"/}WUSfviSz_d?a)w6~ƪY By =ԣ/kי]#j:9+>^+gz9bo#fkjౖ8=sՏUlx3λw oEZ?,O ;mSbl"76+g d~͍gl)dX)+e +Zf?CMa7SLDg4f!6reY+h_gE!iQa3l?|y.OWޜ=My +霟%]IN򲠟[A*R ?Nz~;X\'D$k|Y8zůD=H!jmn1o] SKZWcGjor}Wg𒪅ly +|bA^oŹjҋ8/'Nv9 7*&t[bbC\绰]ײ&&pZ;J_Ei~KGmzר&̨ԤlBm$Si`6=Y+K rKkThb)66 <06G?icPl6PuPB -kx(f'EgpM| ޏIlⵓ7!B/ܥChQ 3c+)sT$c- uM)q%jNŮAu%v6Uz2]k}W.mu~t0_(Џ$]lT[ɘRNE\gkcTcdҊ{9T9cIoQ>8:nTc Ӹu%+Y~oY<(16m.ֱu m75{-B}ĦAh</[ ޱ |hkp_cپ$Y8E-VQn H~l?\쀅ve7]eB`xäI軧׻}1ڛK[Dz,ЯۚcN֖es϶ OZcIcpTeօdZj-QRh1E{QiNt|Tlnx-Z-rΡN-MJi}ڞY7{dz5)y3w:CA*UJ&D,Ԥ5UE!_(ț\ϕl3"5WτZt~l+鶂5U+WKJ :ͩM&ʱ\- vV17+**}R~Qye +endstream +endobj +570 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 569 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +571 0 obj +<< +/Filter /FlateDecode +/Length 4937 +>> +stream +x][q~_Vxր <ٱX!?_EJ= LcUI-wEC)x~|QCp +rAV]08|tןX`3_/;l_u )y?b VP97`T^8Ŕ$p -UfPNR 2& +3,m3L$`N.*`6J:t %у$QH:kH;-wQlqIiI`DJ1H:[JtNt]Q啖t.E"QS1ĥ(7htZش+ +䃠3+DlqVIga Gҁ' 1 +jI`1DlK `D `/H\# )/qO +:|8ve:B$.c=$k #-p-%. 1I\G ơSJ₤#MC`]r%.HV!D'd=ǛADEuNS-8 &IybI\x3J\7&/jE1Q֋>Z-"๵‹-k3B/N!=Z^_.{_h XOǿ7חdBJe~_/K>O[9+hyn*Om\8`-<`EbtzzðШk (|Zti>@VIsفuLO&ʭrw +ΏTeƱ:5]M:+{tH TQ&>ز} +sm8een}rԭ86FjV])nMy]6_m(7ةX]nc +Vlϩl}[aն8?j>׶Z+64d``s!G|I<#"}j4;=R*u*R̈́ D1zVP[WO7& ڔ)cck3uns[fX6q,s:,&f^=:&Ԕ17X}е#;6ZO`n]+ oXvO:òvܛ2#x/d?7[5cF}b~/ ӵ׹7ڍQשּׂe O.߃,YmcXax;n=G.lzxud/s976|.x\ p+úg8]uN@Yv @ڍ7܏E+u;ʍ75e_u&֬حnj&Ĩ(;V$(NHLVye0+#2`2l2[}糖!6.gκdVisߎTkH%F:gC*M>.k;Zr&׬22v+vn{ۗ]nl˼c}6ctEi5 b!H292iC(;v-H 3[WP8~̠yF6 +9 +ufZ#R`IHODʵ,jR;*u[g<)\SZ``!oLJgc{53V>KG#m۟#?ѝWZD:gC+"]D^m-kblӚ7:̂O[= 飑ܚnTwGcGo<*fik1:C-i-]кV9ޅ?AHsEhCey׋z|s,ץmG>n]+֠t&9@VY<3ݠ=qWZlZ.}iO;'ڟrYAmooXӡv'QaU=qot{,ݝ^b=}H/ٹ"ꟸvw=xݨz}em;1*J ~ W~w3=bhi{L6Z&wy aOU2Zڝpr3߅Z:Gh[wPJZ.V;ʋEڻB|y鐷szfWݵ#jhxx-[#:m WQ[Ap_8hK>Vtɟ~_:Vt񰞝fcʧ˷j;/3v1#zȃuNƯ}>f:gCUڹk;͸vD`!ekW|;eoH^]{-F\MNum]9)'mM/u^uNHf{r~/GfGPN߷:XtHɆ=gTM򉙷__֬"ッ9m߽jC\a[duYg^u6$1+;r)C,aSJ֪~הr-:ry+Sp9> +endobj +573 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 770.673057 101.433071 751.923057 ] +/BS << +/W 0 +>> +/Dest (cb65-1) +>> +endobj +574 0 obj +<< +/Filter /FlateDecode +/Length 4841 +>> +stream +x][,~_1wt@08`8!sap򐿟-Z]=;eLWR]$hYKSJ9wpZ8yCH`71_No_Nu}6Shwrv)FUJi+b4>'bΒ +f۪"p9yI31IP%a]v0D$GAF)QCs:IgR6YEt4)Dty +!$lYiIa)I[MQbU;Y%t%Q[TPZe;u:bO*IM+УH! +:[Yot8I:1%VY-Q'q˓!K\ L'F#jK\8L&]Q'SwAKF“J`Q'IK\2P x{ wVUa-6 @n+i2` +IU-,J,qAҰ)qA$0I8! +6c dB>Q&\{ DlqI\z6' - -$.@D0e[E8؂HQ0ٔsD0W%]0SkQQ݄XK\Ԕ%.O.I\3Nₘa dK: [dK\H:%.H  YfP`\tN<3I\\(T3M0- >4`&9X$.Ht3I\l1H\l|3J\lA'qAVa0Y8tJI\u|8 /i$.Va)o 4ߌd[Z}%"<N_ßϧo_}.uXri=Qj~DF}4ί硌AyÐ2CaײZ(^g?.Ne[͠9%Xs75M,OKY",] 2ti_j"- bT݃y \'ߛ!5=ԺþO. $ڻFz&=s逬V"G$|e\ӓñ;e)WY%C={=}[3 4mP߇_lE#/48ͭY<ckX}=:"|й\9ȭAy,9-Q½Xk2 P{bdwy4G!v^_uR4~iJoصa+qa> qwij<boij{:OA<nĩ<+̔.N'=H<&=8:ѐl߶D{0NocxgO3j c/3<1YKCN]l9̊*NE-;'Spl<!TO?1k*Z 2W bT&]rRy8^ks ~#~̽=&7n5؃y zZy2gu:!Š ]q: jBYT qVl>y$45X=|=~k\QZ&GjsWGQq! iwVx zAy8$_q0 =d{l{\XԲ;cu!Fmw>Kvw42X=0}cwiL/~ <Ψz[<2%{{ɛ3ۑQhg$L4P/qD)׳gc5}_Ϸp,ϣX,vmOtԑ&v[WrFE5j Bh[\VTZ⯿7#[ӵEԽaOzbzwF/_eSu~Zgz8.v:,ݥP{!'o̺l~UhM,\fd谘-NʖNlZl/Tv.Oږ,}ٖS쯾 ^AۡؽU_ۂaɛnT9|3W 8ͯU_iJlcx$?[IGG닶foSZDD/[j s#Vä2W3TX/R%BVnN!Ô=L/mᗽ!SMt>T[7r p/.D>ovX~wɠ%r>/p19))=Ā=U@cm@e:yjң_^)ΚCydָ/uGЛ 3h 0~ }!fuxhkn=@A[v^Ir)k{p`GuqyZH^qu=qH?,[fק=O?~do:b>x0σ5љkK1QOV*<@XlYo\}$~1<RU>پ?~kgI|HjOZz`vl> +endobj +576 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 270.123057 101.433071 251.373057 ] +/BS << +/W 0 +>> +/Dest (cb68-1) +>> +endobj +577 0 obj +<< +/Filter /FlateDecode +/Length 4725 +>> +stream +x][,~_Qφu `16xYbOʹc?e.UigÞNUF)}Tfw +R"]o?_~HĿ!`PW% s/|ڻum˟u4j^SR>x/-PIe{mrJcT0z4WyA1XN3H0䕙"^*ZϨJK`$2)+q: QGVS^s:ctQ8lt[lYbtLduEo8-]-@W`uE:8]4@"t20ii HNauQ$-N`5Rs:[GA"{AQG:A:DAt\ӊ##a%1Q0rYl18.0 M%%|KR9 fJ GP.9.0\t1=kЮ8.0]CJr\@]c0* kxHs\^X:qwuqw4xW[7swjҎE$ wA!w` iq +n "?fL +q\`*X]ʣřqVʹqb2X.3p\Q5 fjNU:J ,x~p +߄.B8.]ВL c!r\#+18$=9._-3 ++zӁwM&'@/Xs\E \>V-^B`AY' Xhbkbkx"*x.` ~w_`<;ÅY-q*eyvXn֍~35ݪRW~OF:N7Sv!CtW|!C7E3EtW3.N t=+ȮE 4r]hHYBnA8&ӥXա*&#/3ܼMhޜ'6N#K/ qs::.B4ݗ!7s_=uđ icyب N5 )jd\~7Htgn4W6]R!R$9ޙ?ApsAȠF1ΟYun[cѺI*w9;CVnYgYLݻ+#wg7CHC28s~=Mcqh,|ߟצ-{~lȝx+mDmPۊ8s:oO)Hrr} M?Q0|z:cGM<}se(sZ;qwGW|ۺurڴ/:҂F[2'<Ꮌa㫽ڼ__֣}ա>vw\$Vy>sp>)mV ȝyNᱞM>ϣ+yΆ*k;{fQ} 3鐲q+~3xav/jO\vMWW^K*+&wX`ێ+'9^Vkޙth>p ͐pto܁=C|O"#kfHR{9R7aI1f<";w9"ݾ;Yڍ|GZۧ. h_]9}$?S/׹w9R7|w̭hNvݗYpn霾 +q;><'s; a}v5\Nfa=tW}A>#=gݙt;OsG"U+\}B.o{X@OڙtH~.)'O͸1~xm=L\@ob3{ BOݫQsT+尌6PQo~p k8f6~lyΆҸrOvwN0>𘀭g s:;; خ{>O=k`w9Z70d=PTrW3S{oGmW?5醽}D(u3tb |m;9ꮟBdw9#OHw|$x^r+;=E!d%?59-R]}"h>\7ׂxN mryHf _>_qM=݈CDpcJѧw$ovUJ݃I Pc󻱙).#5Q* Jw RZw erB&t+OIvg(6`9̺헋IEWG"RARа꺐sx}/%Fe^^urs0e/*H퟈S9UvIo%FLAwp)KYr"}JcRlR~̉^{Ō9KFqzpf#SK=Z7z&],XoԶrz4q/Un̲*l&~(*J￫G46xH!i.}l^*H&}"ݒD4Y#1HT +8QXn•Pf#P]巉iPseN5p*v;Z/= Yx&6 !WRZٮVa *46h-4<~Y7. Ӝ6VGpFw^ i^2EmiJiDMxK8@g'kKFEJ5ɲy4;϶4g*k6;K=2vy* S1QFkLNpBB9g=V2XI[C1+m7(ⶢ)m|,-J5 +4'g #BЧ+e KņgId?q +endstream +endobj +578 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 577 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +579 0 obj +<< +/Filter /FlateDecode +/Length 4962 +>> +stream +x][q~_Vx@ &D]N#鬝| KEIG%%-N)I[  3wL-$%qop qI+@WԥI%.p]В"Dԅ @'?T$.]嬕wuF#q0l1 guRL!J%xW$.]6%.&J\'xFiJ!x |Ru~µ ((K +$q)%.Xc$.e4o1<-l(qlH<1ft-"t:H\MA/q~bwI& B-*`*g.4l-q<]贖 oPh"L$. XM-Hq%.'v%.0A u4!qm'qsDl$.p%.e$.69 $[I\M4R$o(qA +&BStm QC%QG5n.uة':n(؝:_u>-}@4ߚuh/뻁{w(Kv>@<_mv Y瞧G-` d^h _uyrڂr_y:J݃^XU]m Bu=Q/;O4o711Ok=uO^,Yv[FkE;1;78m[6!;۷f#Vo0嗴VWԓeTj7:za+?۹Ww6K5/4DKvi#ۍ8mZx3o[NҞ>͞,ۡڽp{7lM]qPV_ [&Vw֘{e{( fȘ*i^;)Λ/:tnCmv=mS1; B)s[.긐ۊy~T}*nM{I_Crl׽6jf=ok[FxrT'Ǟmʶ+X/e+w9S~< +?ѡpސ`(ѡ =˝Vo (@bُ%B(7żhQngR/ע-Ha!ͷsS򙺴/ʜiQ'Qv.ϓ-lA^b\v!f[q+u%_> vâS__N#M Ww^וTwH=鐚vPB.GvЩ-grͰ⮡݀ b\/QQFֲ%2͒'yG[}lCWZ"y2ϳ!]8=PYPg Ku4u] wP|? 3bQx.ӡ(F8[1%'"kɞKnw2^A5 j3"}o'):!}>wC=9>}0Lvzha;_92C a?jG3D>y:4duOBT|,;{+d]Y+^ᯞlȌ'ڟ?7|6jQ~:?{vsy >aݽwFSWV}Ho?ػ?zzrߨz'^QQw72wP~AƀPe '(ǧGzw|dýOsRrNQ{.ӡOU2ZU% +WW> )ʱ㞽T[=1 8vHz/Oy6䥃}q =gnaW /C%~<O?SA#떫~M m6 }`>|<}e(9zV4ukg#y}ͣv;/|,`KޚZE\ \Rh| GSC_8m^uUX&9Qy%i{0UQZB|WxK,#a#My)?/yQ+ۨ8׈_9-pZvD|܁_^W;{Va~헋'=|گr 8 ȧDZҥtnX}3/5 +Zc6s7K_r|щ&n|B>]eq4墉. bvhÁWU˂ m 4R/h_+w]g*l>oX"[1߽"]|5_V i[-X[ VPG󹳵|V])j(}|zy)QUf;Rv~D A Y]0 QMJ:At\PSŖ5o4X^ݺT0J7F-_b>#nFx8#..] + +zʭ^oE'hgpU̓hSpUf:$vͥC I-vMC*1IUXuE]3\ U15P~[Uje^wpw&;zq=Hjo-|FK%MlTZeRhFoY\Fke' 2iƽ]zӜj> ]Pq*[ʭ+q?ēb}"æhuli]ACǍZvՈԕAuBڰ +]m2nGxZ:26aϗg‡ p.c6%_"qI۔-.#.BqUe+3}%~r]EFm:jl_tE_0ҴG0`i*}XZ O|חuα(2x[ ղl7lurh.zvز- \_)٪2QTLY-14K(R>EoiJmDߤrˌW%[ 9S-e% }*ٶnZ]fkw 3U-ۤ|gyU)UWBtlc&wTB&b4pHY+kBwLd +P6 t*~(gKJ@X +j46+A'c^~_F!|&j$?2 +endstream +endobj +580 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 579 0 R +/Resources 4 0 R +/Annots [ 581 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +581 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 570.123057 101.433071 551.373057 ] +/BS << +/W 0 +>> +/Dest (cb71-1) +>> +endobj +582 0 obj +<< +/Filter /FlateDecode +/Length 4847 +>> +stream +x]ێ$9}gM|Hi  V)`?;R9;*CTO1U>:㶪3\N^R gLT fXݪ20Q;I3tQPi;QJ5N)A=Mu:v +i%]B>I:[|VZysJgSt`-&E+"l1Nt ]ItN>'D]N:䓵Ji=y`ӊ:(tR|u[e$-?">VI1P^U2P^VQ3P _Z#0+]LPj%n(/1yoQ!bL1,Ny_;#&}zY)?BI_a5oQ)3YCF܍ԠeӍG+a8X aDtE1nyn!se[xWwy/[mLIKHi  wfyG (,:c(#^WnWN Ŋyo]2hߟ~??O^OB)g~_ta]_y3), Uבz,!z\w hj=|#V}dm)_X>3> wPz9,ny:ވ]oCC=ZƨDIӅM;h|``CtKeM]; eV_-el_d?k{<r8bqnB>)Ockk={,~m;IQ.ؾ'sֈ(;G:(/lD;I,oN CMutH~bE8sڗ9?'97CV8ck{--vFm+>t}8#]-ތZd4b܃y z)~s#wmW=\S*{gM<#y}t/=;UWйY)]X;>yLzpu0!\H~ms98|?ly0A/Oޱ={бU$ʸҩ{ #GB8U2E-|Fi[6R{KFโy s{;!.3 +tX bBtR]|? sym9Pt鶜P|sŎ]XO< ڠ Y({f/s331]lIϵd=mib{^k5+û阢?٤Y.蛆!lxmkE^:jnkl +moz?r[~3_> v~$Қ<$ٰAfij7'oGmygo,6SV悑RcƏO?c?z\Wnl,,Cq<obApo7ҰTz5hٔ=wn9L*Cj3A-`Q(ѿR98ў[}GIc-7=d/(;[κs< ׅ(Vn7p5y FYr WhlY bg*X{63QA&͸Oe3ZLq}X>i~y7iܺ^ޔeNU؆ hui}ECǍa|zvՉԍAur>dbӠkeW-Ծ|ikhqL'WpuOgV$(iҡue/-[I4דw #v,/J+X_=OPGI7,2/ۜc˺Vec϶ Z(mIyV։dZl-IRl1E{^iNW&-[g-y[zK&Ax&u=mn]wmϬzdz6I=2v<î0Q;%*q;H+5;&g^g*vv]:e%6>[Af'Ϯ> +endobj +584 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 142.623057 101.433071 123.873057 ] +/BS << +/W 0 +>> +/Dest (cb74-1) +>> +endobj +585 0 obj +<< +/Filter /FlateDecode +/Length 4736 +>> +stream +x]ێ丑}ϯg#~f60@/ᇮ)5xeR %ʫw#wzE +S,Fx{肽Bva\#j)iTF>x/,P :FKS 2k&˩`Q*03RUf(/ 2ZϨR `0F+F'P)9Udu:zpH+9]s6p:[lYb1th-*xuJrfuQh$-N`Bq: [ 8xj[n-t( -h|-;Ѓ%p$L0c` hx@ h[qh [ z.-: -HqְEq 5"J 48. \)8.`\@rqjp'9.`]m@v  F + xWkdu8h4.:`eP! xWa8.0]1:?j xWY\7rwUF9 #Xo +;[@`Ni pA-wei CtX h>VQLE-ҹqbX.3p\0* ,xWjԜ+UX.q0H8`|tY]D  -) 0 +"IX$qxC9.p] Vk xW=8._-ӧB)8xWH0 +#K&Γ@ `/Xq\tpXpl9. buxq!8. +h8. +e%ovz[v~`` 3v?rXzgkÇ; u(c;09_S:ʗu/Uz9餞5,[R'˛mSNҏyS4:5]9/oOz?OM6rA70MT@\:_,Cb,J!(kH5֌WlSS/K.`-ނ^1fEbݮҙ百5wHƐj+Tk6s:[/?7i߳\Wϗ;Vi_fLΘnAۇmu|Lߜק7PfFDY_ 7{eu.33 ۾TjKi%̈aske$F5BO nKYEyjܣm9Oöt;kYcVLo|@jT#/ِ.rᕤk= jZ6CƼ} _BI%?)淚č'+?Ɩ>F˟B&KhOٙtԻzjjdĭk}}Ow,Y e4o~ƪA`NGa_ӡ_-c*$lqz^ԖXd-Ys2FWe?Lo<m]d[u>Aư>y>dے~Y+U-6~s.-xٟuߟ3)C%{z+Qs62;eYh9"z#/hcJ-OMygu;g=bs6;>[D8#ѝz6w9ޕ?zApsFNϨC_md/k +Gw[I!Bhs64}?v~a͹2̧U8nݙZ\YX![?y:"kc%3y௾.+ټ VQZ`ٳT3P{O}7z{UѵcI\\gb=}p޹o {yNЃk}vuҊyn(NwWZ,!'djVm,u|/#ۮZuhWqD;4v}yΆZ{ +-H~:>s(k +&sl{ޭTlbYO41]3l{R+\hju \+# EiƠH2s:ʓfI;}򙒿.+?eQgm l>oՙtH==g&y۷5@+; IV#sG#{ ѽvd1Ti|{1Һ3k='$&ˣӽN?sٕ=f~xal^ܸ. RўWgZb㕶P BI+9ǝBͩC'F{L;Vs_"OQ˶ mh1p)L v]bRA?c>9|loS6ڀÈH[PL3Btr-ŴYf|)%!,'4ur’P,v-UqELGJ\f몓UW͹']PnoKJDʨ6 br;1ۅ~'ҩ 3V&aH@29]L¦fsK*1|1@]\lYiߪ~.ŎZ nJxX{b]gR&B]7(x)RZ8BL2&f)1vRQ)f/+:i|I[U>c/H75VUV}LIeXeF]\Y E2P~[6wU=dw[.s[-%ە0q`3R!EDJaR(Bo8NqY:7.?_aNi"~8-i˒G?sShǕl2.HFN1mbTBe*/bJZАq*6%(ĞR̠2kk-uXU#5gۦ ӡNb4형A}98 Eː|N#JZtIo2>)cla&.$W=oTVuPtΔa>uWQ% Fօƅ=w}6٥@LYVK4/[1G_ uRC\{:;9k,jVP l]IEitH|FlrsT-|)约m*m*nΛF-ξ\()/sg))u6˲h{.C\LEfW)GΔ:p HFrwsCzyc%H%9x0 xN6og* HиBTq]6e[OƿDq +endstream +endobj +586 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 585 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +587 0 obj +<< +/Filter /FlateDecode +/Length 4893 +>> +stream +x]]$}_Qφ,aw1?Lܶ1}aO(SR22+P}BGG!2K_~/9=cpO/j^_I(?7V.N^'8M ׷ .y˟~uu}5Sh珤rv)FUJi+b4>'41gI3|tmUfΘ$̰.jUeav +f죠 +vh!9kSӃ3z +),"t:Ig^K<|tk甤-Φ(l*Q[LVEb,l-*(-鲝|NΉ J1muF'kzuQ-A,`H: [~$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a +c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& +%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ +CĜ"52cX8Dmѓٝd?vgL׿Weh%C|a`2#h Xb,{(1Us7Km62 n?ld,rc%hOZ*X%krDL탖me>b2' >m İhFW4^|V/7ނ ;ƞF֣:t(eO-M| + xDil64Qn7. Ŋy]2iL_?t~z?r?~_/k\{dqH濴\?׿Յ*KnCy]y+z(KRmQ=-ْQhÏCE{ƨGoo/i βZIqfC<5x%`}M>}2Cֱ0j2tT"dR,.{2ϳWCVEVYϼ{}^ֆ^:ɬ(n>p_HeGݺvPj(=P9vqj@ CH *Z 2a|ėlM7$uL=? MF=tH=jv֨Q?(`5[Gb{1i Г+yDZk5J_Gu23zf1Qk^Y ڐ{cyu :XCKEe؈3m#ng?6񽄓y 8~ˏ?qyW/EƟRG{2( J3.dRвY!յj_4|^wly1ֳgZֱ4fhcu!FmCR]1wt;4FugTF-sSfȈa1<~f10|YCSouc{~sywv<4]K$zcǦĶiR{)aqe)쿊;`mo7'z]{9:ԮM*=7;OI;4k7Zg7{4/#!<<@/uF!;.B>K/12'ew6e=Yl'}z:-s Ced^{3[N3w2ϓ,#Sչ#5xFKtSzYRvIO//aDאgd0OI~g)#* 5glȋ>?4-/~|-<;,yHeȍY7/zN#*ï9yd'A;̪P<~e.ϳ0g&ԑDd*H᭗9x_xĦ}[W<)n;1d'<ĐcOFd;#6st=vs c/>jwbDms2ӡN\9^VDгq|vToC+={k%+Z4'<M>Ms?Y;x)W昩%ݏݽh Eo=WMv:Nve16r餄D-uJ\1WyźªWrF. o+qӷU,hwиcqMnrV&67 VFٮWƄ0Bw}+:Z;, f2 =odQ+yܨqJg2tRLSm0qXW4y׮gWkJT7-C&6 F[ ^lMK[GˣUe:ۧ++WO:2KVa$@J~ǻR]삅tii]e, B`/xNJwPGI7,2/ۜcc/uv,{9}h­.8F4lK+uUN. SUJզdn)-Nb)ӞJs6i:hɶs8:SX2 s7)mmvl{epݐ#SճMw{ΜguR՟Si>&j5|J!C}Mtm> +endobj +589 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 438.873057 101.433071 420.123057 ] +/BS << +/W 0 +>> +/Dest (cb77-1) +>> +endobj +590 0 obj +<< +/Filter /FlateDecode +/Length 4866 +>> +stream +x]]ʑ}_Qφ+,kX,fYamw{" eJqizȓ'#C*I~/9=cpϧ_Nj^_):(Y+'sH3 lb& O:ﺎ>)`?'R9;*CTO1UN1gI3|t]"p9yI31IP%a]ZaI*J+ءR(tON)lh$SN{-BI9ҒS8 Dl1)ZIawKJv99'2t*t3O>Y$֓6Ì ( l gQ[UFY#Ɣjhv[eŘDlK `lQ1H4/I`b\6N"K 'hd?Vi茖*]j0sElI\` lA -Y ,-XЭSYK\`N qL%q (e ,8ׂ;%. ]L(qZk] +XuZI\֢-`d%.p]Uw1 8 +III\&)'q%@ sJ\k28q&H\L%F]P=tJ\&D˟0VN9H\:aD]tDžy /O:,qbx.3I\ U"$3Ct(6ӯ?c=_LYJi +d Gq6 -DRd! |s7R?,?m>cDŽ3ru*h0u6͆ C\ܪo?Ŋ9X/vƟ?|0zSʅ|כ/@m2ϘGhu9j;"*xGO>.nKeJڞ_Q';c\Y}#UpO^/G~dc7sӿZD p#cUރ/Yluo@+*uh(]FR ewnl9.e_>jkk2fqJ۵ ~hOe +/Ӷsrɰyγ; 둿t:? ;RU䍈+@Gn~fHN=f5MGD401=tv7s}]y#%FniY`Ha*mjqFA}/붌^ O_A8K:@:JBC߱:OcuIbGx8cs(")Jy:ėGl4ƭƈ0wXRm5Gm%݃umt. ^ݘe7s3c}e1i1ҽǒF[/K/y_eL+/y6 ݰR9ye!GKuk'ztX5aʇX>[vY0]v`cuQ&B##Ko}g;uU6=7ˌډYu )v_,6mGWcnoˮi㎓Eucs=ImRLY%CLoXCN_ n}u3sÕ6Dͅ\ʍypUfRBmtHɆ=gd#i6 4>wX鐺~bE8xuZ½`]+Nֈέj+ׅss; >t}݇?ynԲb܃uͷcn=}jv}ղrfy}G2yփu }a'Nsdnjta}޺6c҃;u˹~H\tԲcL@/O^=Xлso8ZîVT +Vf6ڼ{yǍh2܏l2t?vJ`C}|;z绲^ өoN| U<%`<Roʁ|!6)@`Cص%{5ZU +eo#3D#j]i]ܻ:fj\5%[3K1yHh~J| '{!vzϓ4 I<4JQ]ߕd{n=P|RV_ 08.7'u.>V|;Ƶ~Spm k[Zv꺜c}Z!Tu2>٤Ye kO"@6zm@j rA]k'l +uw|-m LX~=<-=KEv'/g\ IzMgs.GzP 9(3Cz sŝysܯx0=Ї y^#)p5lBy./9Q!M[M|'ct&]5˻~i)z ]`~;XRgP=h{y*dA_N;W1 t[p삀0Ny,i}}47[gC}Fdwsǂ5٫I/bz}Zr)>T! :^7+UL诅uU{4n.ta3NeMdyKx9[;JD)6UkTYfTnR_Kqm$Silz6jY*\+k9At9|J^5WwS:mjdEz$#֏k1$mvܘ+]]vQ(;W(_DžIut)=hYe +ߤ*͉J*KEK@9Sd% v^Vunw]m4\7$TjCܙ YT)P;u*qFK]v:#Rs%' UQӋeޠ +T}\-+s +42A;zKIH[Ez7Grvi>)?fm +endstream +endobj +591 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 590 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +592 0 obj +<< +/Filter /FlateDecode +/Length 4800 +>> +stream +x]ێ8r}ϯFK5a6ᇪ]5f J))j9Bu"H1DF>+_$=Ř/'5/XdY+ +Gw6L!9þ/;׺>)%o;N!JP)msSyAKLIR е* JI*ADAa* 4I* J+ءR("kvG{Igc2It0NK4y]t[\RZ94tl u`%]-]-@WuEy%]KH%T Zg\VI:'lZQAAK8#Άjxv[esŘ@`%0% + $0!L I$`(RX4QVD>-UőjBDX[P@ka!+q"qݒJZ % 3k' ,(PJXpwJ\`AA ֵ ,hRX%$. 𮵨)` ,qq:Z k +xH\QC/q25Q5K 栕k2xא(Gxdw`%.zd["qO`I%.p]1|.M:Džy^IBe%.p]g?aE58X%xW$.p] Nap$.6i芺4 Z2`T0HZJ\Xޓx"=h$._0Nʀ)$xWi*˦>D `/H\#M)/qO +:|O8ve:B$.c=%k #-p-%.M1I\G<^tL1E]N B K1%.O.I\3$qAHSE,ES4%-p%. D[ J\MDXK%)3Į&4&$.p$.@`a-֑171&ǛA₤` <> ơSJ₤#MC`^r%.HV!D'd=ǛADEuNS-8 &IybI\x3J\7&V8Xu{w|aH ºni3DqG+}׀×{sMЗc~vPJ0.<:p\}N斿\/.e,|.2rrs\wu|g{qϱ2/6Teuq~?co ;NnqkKڝ<oKgkg[s!gS9Rv>^3[]>/erkCYmo aݮu>?~V„snlޜcl֬8e,. +Bl2a G:wM=U{l˨O?}y܏?h`c lJ rv~> ^ pFWq{ўØID/=\QsO伽Cm9W饡yw#{d[v-9!AνȟջLҕ"wy!lr둵+{yB dVn +GLʑglXC1 uHY]:rq${.FvE_sd>xO +.!qoo#XCގ9dXZn|ڎ-\񎴲m‡F^ɯ>kooNoXgC+KV^yFZG|ӕ7̂O[=14HnT'#50by:nO~4'z=bUcu>ΧqDwA컁fӡyGw<iu٘}v07#b;m#;oI Jxγo^?O׻yɫ; 3dW/^[\C뒌Lz!s_USPuW3|g~nˍMl{=VPOox hЍw RtΚzگ*_|ܻ?Xw=xߨz +9")g~5 RF !Q\P=>t{8>=/G۾v[IM;|cu aOU2Z2X<Q1~{zvOx +rx_ߩ=2ss!gҠ˃uy;j #;8)]C÷#bɮ~'mi~<w)랼Vk*:(ȿ{Z?ee ׹q=+ш`C1s^;IQ;IY{WGf 6_Q{Ol(;ѨK9D#38* +>-kݍe}|i`݃>\z\p™l ^cIuJQr׮}[[}ٗ ybKg3CW(y:|xXq7Vwqic|:;mzΗYl, zȃuQ;wc#2|G<SǼs~,3jNdy:}򊿚o| #yY%WKWS(O8}öy|϶&{<ZwjHق#;܋~>bgʤ@j:}u;ٰI>1˚@Old(*ˇG׿epmmFثnwˊ";0-\x6cpJ~g4[{/-Ϗm):575heviMܼj->2K{cӲ -(_0Ya$_հryaWqҜ=Mtm0ܱ|f~/=yZeǵVÍ^NLl Bi׸B^hVqT /MfVLJyMR{;jܬu'r_YZٮt}騄LtNR1IZ+ꪘ)O^h]Jtu:U󺃻mb_:֯v/K^h3ci]k6@ +Mh=l +$Vo!0_{Y?(G*{Q-L֕_b7,:m:XV4uܘUWKI]TWm/t;5v=6#ѱi |hδ} +06mK;%h[ҡ%UARv fLdHzVwй|h2۟UtE?1ѴG0q_LeR{za,'Km>úؼkl7lurhzvت-\(٪ѲPTLY=c(6Z|QP}&[ӮډU[V-Ρ]j%/kW)Ȯۦue=wA? v +endstream +endobj +593 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 592 0 R +/Resources 4 0 R +/Annots [ 594 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +594 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 713.673057 101.433071 694.923057 ] +/BS << +/W 0 +>> +/Dest (cb80-1) +>> +endobj +595 0 obj +<< +/Filter /FlateDecode +/Length 4861 +>> +stream +x]]$}_QφIa k?z1C6˝>ʔ[}gl_2BQHWo4KNO)凋WWR.xE~Ov%Ov˯.Σf9TN1ŨP)mSA&,`θ* T0UEm 3LNR }TZmu0D9g~ +pztFO!eE]NG#鬝BtkIOtx휒t%]-6X%`IJ[ ]-@WuE%]9QS)(?dtZOش# +3%(ElVIgaßOxSFmՒcu/1 E QFD$qqr8LK.I,`R\VBX3Z"`wAbauf'q5 $.g%.`[H\`ANe-q: 3kSpXP.%.\ t1ܣk}0XЮu)H\`i%qZ'wVQ02W'0H\L&%%qk"Q'A+q&H37xxe$.p]L@?J/+q{茕Ma3?aL&rwuB< ^tYDe%.]g?aF5x𮶘%xW$.] ^a$.6i芺< Z2`T8HZJ\޳r{DlH\: [aL#XSH:aIU*f xM B$I Q $7!+0K\%`NS9I\ lH\ lA q")kD.Dɦ *邙R]&LZA/q~pIv [0T$.T4%\i؂ [Di-qA2Ѡ$234֒ps֙ID&Xi)ElMH\Ŷ,6uz'qAJIₔ`QF`֛Q€` "> +ơSJ€֛I\qI$qA +M,qmf ;:؂) &Ib @$q 7ы[֛Q. ft]DA\`VZ+degw cn U ȗH2q*Z +xm8a}[Tp3SFf 辭9z2l/?v0 LFw{Dͷ)w%jcfiFfa£퇕0En#KR2+Cdyke[xI"^"#\+y/v~"ԋ=郍mdҡa#>I43ߙ VX#" HcrĿt.V풙Ncr4˯o@_~Fݖ\/y+)ݐʮ:5cISҫie)6mm"wl"yfy_i cXZw-%;B9W?}oOۧ5 J6Qp_HeGݺvP(=Pz"TO0{*Z 2Ww~w,Qvɹ{H=zhlk2)6v=ؓyDZk5J\pg 5 ,mȽP^7XPS~wȢlx߈3bsdpddOy6uqGiy"5ƀ8 +7Ҍ lVH{u-#|Z0$sX۪u/_g:S4c6>.2cx@x'!{{̟k`N`tPi;Gs.F/x޻}~2ϓ,cMHҴ.Y.*KölIHlKHB̆Lǯ >7SCGˀĂ$o͹Ny6y1<=lwünyZy! +. tח=/?qeTC0Oyu>B{:J=fÿ#=(\?rRy?Ry:C>9sL|7HZWx=k;|6K3toGk7э]dƇ9ِé+!~~Bh~\ z>`夳c^rBePആI@ۃz8|kmH ,ҩj/,_^22M,(շn*Y,7m;b7OT&-_M^mmKfj0/biæ~r.'&m'Mt;b$Lt&];9ER-8i:Jt#XP:n">wUԋ.~9N;opZYXCAvy))P~ÊGkk(Ej"[N +VLW^[ iUhXO ULBŪb=m ]LӬkZYw oTkG(kQջF5eF&5eI.Uv̦gFTZ\ EL[OŖ*zҡNe7vS7ҏ1l}*1ܘv.~(+Bm:^4* *SB*|5HIWBcNXI.]:ƆY/Hn[I˘aϗ6с*\2uS+Jڧthaq %0wVf y%d]a.v]4ˋ +!`yye`}19@FMƥa$m'Km 6rVec϶ Z(mIyV։dZl-IRl1E{^iNW&-[g-y[zK&Ax&u=mn]wmzdz6I=2v<îA񘨝*q-%5<{%WkBwLZ5lUQΖؤ9@ +46;Agdj}D?6ݥ>O{Rp +endstream +endobj +596 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 595 0 R +/Resources 4 0 R +/Annots [ 597 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +597 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 273.873057 101.433071 255.123057 ] +/BS << +/W 0 +>> +/Dest (cb83-1) +>> +endobj +598 0 obj +<< +/Filter /FlateDecode +/Length 4726 +>> +stream +x][,~_Qφu `16xYbOʹc?e.UigÞNUF)}Tfw +R"]o?_~HĿ!`PW% s/|ڻum˟u4j^SR>x/-PIe{mrJcT0z4WyA1XN3H0䕙"^*ZϨJK`$2)+q: QGVS^s:ctQ8lt[lYbtLduEo8-]-@W`uE:8]4@"t20ii HNauQ$-N`5Rs:[GA"{AQG:A:DAt\ӊ##a%1Q0rYl18.0 M%%|KR9 fJ GP.9.0\t1=kЮ8.0]CJr\@]c0* kxHs\^X:qwuqw4xW[7swjҎE$ wA!w` iq +n "?fL +q\`*X]ʣřqVʹqb2X.3p\Q5 fjNU:J ,x~p +߄.B8.]ВL c!r\#+18$=9._-3 ++zӁwM&'@/Xs\E \>V-^B`AY' Xhbkbkx"*x.` ~w_`<;ÅY-q*eyvXn֍~35ݪRW~OF:N7Sv!CtW|!C7E3EtW3.N t=+ȮE 4r]hHYBnA8&ӥXա*&#/3ܼMhޜ'6N#K/ qs::.B4ݗ!7s_=uđ icyب N5 )jd\~7Htgn4W6]R!R$9ޙ?ApsAȠF1ΟYun[cѺI*w9;CVnYgYLݻ+#wg7CHC28s~=Mcqh,|ߟצ-{~lȝx+mDmPۊ8s:oO)Hrr} M?Q0|z:cGM<}se(sZ;qwGW|ۺurڴ/:҂F[2'<Ꮌa㫽ڼ__֣}ա>vw\$Vy>sp>)mV ȝyNᱞM>ϣ+yΆ*k;{fQ} 3鐲q+~3xav/jO\vMWW^K*+&wX`ێ+'9^Vkޙth>p ͐pto܁=C|O"#kfHR{9R7aI1f<";w9"ݾ;Yڍ|GZۧ. h_]9}$?S/׹w9R7|w̭hNvݗYpn霾 +q;><'s; a}v5\Nfa=tW}A>#=gݙt;OsG"U+\}B.o{X@OڙtH~.)'O͸1~xm=L\@ob3{ BOݫQsT+尌6PQo~p k8f6~lyΆҸrOvwN0>𘀭g s:;; خ{>O=k`w9Z70d=PTrW3S{oGmW?5醽}D(u3tb |m;9ꮟBdw9#OHw|$x^r+;=E!d%?59-R]}"h>\7ׂxN mryHf _>_qM=݈CDpcJѧw$ovUJ݃I Pc󻱙).#5Q* Jw RZw erB&t+OIvg(6`9̺헋IEWG"RARа꺐sx}/%Fe^^urs0e/*H퟈S9UvIo%FLAwp)KYr"}JcRlR~̉^{Ō9KFqzpf#SK=Z7z&],XoԶrz4q/Un̲*l&~(*J￫G46xH!i.}l^*H&}"ݒD4Y#1HT +8QXn•Pf#P]巉iPseN5p*v;Z/= Yx&6 !WRZٮVa *46h-4<~Y7. Ӝ6VGpFw^ i^2EmiJiDMxK8@g'kKFEJ5ɲy4;϶4g*k6;K=2vy* S1QFkLNpBB9g=V2XI[C1+m7(ⶢ)m|,-J5 +4'g #BЧ+e Kņg|O +endstream +endobj +599 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 598 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +600 0 obj +<< +/Filter /FlateDecode +/Length 4918 +>> +stream +x][,~_1˺_ lHyB9gm:`!?_[VW_fw}ćLWIRӧԭQW_)/Z%bL)/X\dUISGw&r>寿kG]Hk宿|&5"cT * rNgT^ T1%N3\ڮUfVȨ"06(V% +fRv(-%!Zri%|L: +#|)NENgaKRq:[Vr:bM duE`8]-I.+:"T.R%d q N)MУH>0: [tgtXt gBLoԻ49آu99 +@KMr$6ȱI G:9a} +ӊ##ac`Eeu$qѰ 8.0hk8.0`[ p\`@V&qZ< 3%kP.8.0\tkЮs\`*qQp\`Fqi Ъ8+B(9.]wu@4Xv7rw V{ l48>- X 0C K8.p]01}l%TLUPg-,@e8.p]g/0j xWԜt8.q  0 %]VL1r\%qFa!# ) @B"w1' ;R뇟._~/@K~w<0zz1.ez't~Y>6z7>uiOyϴ2J"/*erc4zPCagCʾ-mXC.Ӭ4$}X4ϵC,oA]V6;5t@\5ti\{jl8;6FHWdLdN2\; SU2~gS5C*ZTzOy4*K~~Iڷt&:{cȼ`y ;W?i .K>;5 Z^vhDlcn +MDٲ0yCW/="<_ukV>QչoNO> a}=5'C{s=F8٧}<\GgwvV?Mm<%&^6l+,6}>3ocO#cyn>Iu6TzqMŐl.xk+84KPm]݊U{I_CmW{~2rm[vվ:DaL o&vV}MQfݳߥ 7l\G;>mnNyբ;tڋ It] rWgsj;Ӆ S#l6. gP!;jQn>=Gɡ͸9 )Aˡt~:o6A2kHk9la;9g>jY_nIFM\GCo8+dž8l7k-_jmڊF昙ikZnmF8<jSo^t[h#}}Ckk;{'<B]OK8yV oGܿ c@(BU{l#};>xaMŜ69ҙ =PTɣ ^g,]z=_➂;NZ, %a]h4dC>י]DJkj{VgW6ŗ! +e,=syo)ϠuV&6Ut|Pް{Z?%% <@KM<s^f)ſ:b={KO@iH:zdGCiGM9L7FhgѴ(0" Ke뮩25<<#zU0AFG]pܒ7R)Йt;M~zn+3|(̪.o' +ޟAN/~n.o/Ӽ>Mil/rz{޿ٳx7Pê~|JDӁWo"h*ͤcu#gk $fLYf/?颒|A>e\fq墉_.teֶ$z/ Ev)Ɣƕs#v6ߕlt%M3Bj-Kf1|5^vCۧm7lNB{Z]盰޻Nu_5vAfR:ܪxW*3QJ]IYvbD #J[[4fwFNXdkT1ۅM7Ֆ +5UlYS|3AxFv1 #]|]T2v+lMrqIWHW Mw*Ii6}C,2:?QRbE +):g]BoVIWֱ -m.Bl/%H[H;uyDRĺBW+yok ֶitiJ +:X:Mgڐ|n+Jچth2⢿).Sla&/}S*4Mg0ߺr-$Mتд1>K i*}饵b$KM:|CC^{9k..zvز \_-Eet,zPls\z)ԘI=VNt}UZojdjz8V;RX222RR"[meU6C|LeV)_;SaՁKU1 +Fs2z!ni> +endobj +602 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 555.123057 101.433071 536.373057 ] +/BS << +/W 0 +>> +/Dest (cb86-1) +>> +endobj +603 0 obj +<< +/Filter /FlateDecode +/Length 4914 +>> +stream +x]]$}_Qφ,k.xa}mcaPHedUVuܺ3twe>B2K +R1O'5EX]Y+'sH# lb& K_Σf9TN1ŨP)mSA&,`θ* T0UEm 3LNR }TZmu0D9g~ +pztFO!eE]NG#鬝BtkIOtx휒t%]-6X%`IJ[ ]-@WuE%]9QS)(?dtZOش# +3%(ElVIgaI6$VC*%-D'` :_b`AxIq d'\X<D&Ʌ%JCgDVV+`Nk` H\`-l1J\`hnZ uJ ,f* ,צ$.\@)K\`)qbG ,X`$.]RwJ޵9El%.;NV'+qZad$.@NaXLJJ5I9 xDL.NV5MfnH\ƙ q2 wA!^` V+q +   B7ӯ_ӧӟM)~󝦿i.u\yMg(E+bwf'ڐetǸEo?CvY}a\B1;rgy~1#?w>\NO^WaibmKNt6y"-=Ee[Nt-G-\}L;vޖ?wmtrP΄,=ʎk3qT-6UoKK~',oQ0QӼe*j?٤Y>蛆!lxmmķ'J/Jڅ ]`fS`m~+뾨~ʟ몟觙mնƈg>IB;\.o!C]zyD1f2RꟼjmSigMcqYsm">~#?cn"9r(`87{RAUq(s'Vä26}^zjA$qо[UhmE/"tXk۝=rzmA9Lrڪ5pڅ(ޝcF/ZYa23Q׵ҍO/Q qEծ/^f2SYnZ"HA<e0{VQF^-mtOPI|Ҥ K%mT|Nnű觖~C=tFuF~tXaU3/QEGۉ^ 1栘Gr-#:NyL Q-ZfI0~m 5TMdѶsł9ފjҋ^“&\f +8M t +} ++вr8. OUFO*|5HWBcNXI.]:ƆY/Hn[I˘"qEI3,#.xdnL$w+,.XA\fyUVZ 44~xxC$mޤo\FFxԖ˰ls- :xZY=ۂ>4zhVLz%畺*[UZ'F*k%jSXU'K]Wi{9^ TnZd[9co)[,Y๛ʶuuu=fnH葩&Cؙ R@h-/U)pEylwD^ 19kUz`ل7(m+:XΖؤ luS~DEj:XKAoE[Y[?A} +endstream +endobj +604 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 603 0 R +/Resources 4 0 R +/Annots [ 605 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +605 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 123.873057 101.433071 105.123057 ] +/BS << +/W 0 +>> +/Dest (cb89-1) +>> +endobj +606 0 obj +<< +/Filter /FlateDecode +/Length 4704 +>> +stream +x]ێ}VxAH8ȃ nF0`!SxUݳw0;*^JaU+C;st"o);z{肽Dre\#j)i|O*QEԌ{err-ȩ`F T0(Uxת3S gTR`u0Dvpht\*:i=8o.98-6 +,l`s:[ӂt(Ndt]tQ6cX]N:%`ւI9X`S:(tN'lduj8-?GADe8PA& +q0kTqsV\[ Xl1p\z: -Z) -p8.G0D ]]O01xCr:A׬.@'=ޛSk!`s\]f@' >  0 A3t.tRr\l7qAPL'8. $AqA0n W 4&8.@br\X:آ EqAE qIMqAQd @ qAMe8.f j&x̸zs\ lpQXlq NzlQp\fnِ֛@g]L q\ 7rk{ l@z-V6d <3 _Z#Aepl*Ra?fV0E<&#w%H6~|?7c,H8cj +@Et-qa9ZIKX9FFa0e7dNBڛ镍֩~=JT= P:0wfyEVpp 計B1. +Hͻ Fl͗Rd>+vOo_OIS `+JȲ 0 +xqyA!gwPʽokVg &,Wj֧ߏX0ٮfT8edY׌vȏ*kQ^7Tʰˈ(s,KB }z+K7soe1 nK]E}jQw̌6ɔTV[R}yΆT%vC $Xs.ܖYpW۶Al?-HH#KNIk|Vs1d|߷bmS|[Ȥh3(pm ps:d]ͭ5P֭'@,h˺ +7PX|?cbQؗt(g}X^r'k.T~O+e_\קö LmwT?HA͝yNIl]d9?ìViߟ3C%䳏 V>G<ۗl~eiiWD}ӳժejyi0̌O=jV_Ymٛx;v#3o|v{ {F"Zm_w9r}_[D8-ѝz86_w9ޕ?zApsFȨCi_mdֶ7ʞA3CHCjB=M\K걄h3oOhiPXvihK>j Ows:4WkAsoj{|R_n odw9rc܇smq^_wm;i87>ks:Qb*Iy=cDb;\ww崑*o o +qyNv{ޓ9jw|]L{L$_c0oOZOlIHpU@Rt^qmw1|"SwwOϧێL"xK7vSzz758SZ7e͟rBb>)?=~Q1;=tnCxhpaN:3tHIMrlXy9sN5).:e:8-˒"ͷ\Nq%2[̭ q=ѱSL'a6PX&4y\M. +23ZhKVbZoM+fGپ)t͡MgR%pQ.C2%_"qEI˔.UF\ԅⲪ0f Jrӓ +MuUALf뢓l* \`]_YW0F?$ǀPTq> +endobj +608 0 obj +<< +/Filter /FlateDecode +/Length 4908 +>> +stream +x][$~_1wt@0ؐBÞYp󐿟-Z]sv 㙮ҥTV¿4R1O'5E_I(?/V.N^G8M 7\ou}6Sh{R9;*CTO1U>:㶪3\N^R gLT fXݪ20Q;I3tQPi;QJ5N)A=Mu:v +i%]B>I:[|VZysJgSt`-&E+"l1Nt ]ItN>'D]N:䓵Ji=y`ӊ:(tR|u[e$-$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a +c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& +%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ +CĜ"52cX8Dmѓ+qGLSVi%C|a`2#h Xb,+1Us7Km62 w~Y +SXJ(RT );,"04Kv[s䈘 -|eNl;m İhFeHFJb#ԋ0ȢG3=hz4S' 3I|gGDfC3(hkVp.V풙Ncr4ӯog oQ}W>͟/˵_f8 '<ӽvݭPxIce(o+oeZeT?*u_kr-6|?{Y乗QiZ|4뿟?|w58˪j'eYw|,qw0;7o<賗 qUKw*&eq݃y *„zu{㚴6IfE`mJ"\FF*C8nuݏcync!N {aP9a@REkA& v2-F~@UhcyA_u{Y# +V^կ}$'^ë< =;к{]yTw/:g!Š g@z]ߠcA8kYT 8Vl<Jv6`K8lב87!z~wRd9 uǏ1 + 4Bf+-ҵ` K3' +\|0!y?ƵzS³#\X: s=?Ĩ q{Xۼ+1ރy7xȰʨ7#~.]bʱ~1#4ǙQl43[Ox`u8vtlOϷ{,ޮߕGfk$Zrtԑ};M^cmc`_Y)X g BhެukJOw|?}Jڡ5]¾yy 9'z74-=uc&ϓ8.uz%yV_=7?V6U;j^>dKoSigwO9.ww赽#~#Sdc1}S=q(9]GufwSCF%HCi\eS W+aRV3/<(_ov<hϭ>L٣Ϥeo؛2QK烽/uf-,yz Qnoky FYr!`/_ʜ= bpk"*`ׂmAezZe+NL`ޚcGyy_>}#>_\׸7m[Ni>-ܘE_>-}ґcEo:bx=IPae۶GW׎49)JyRl| mH~tHͻ|ǖ}k1em*.re5^͒'_ybjאTCz s0 zhXgCfyxg"==HDxޏOw@7G^|=s }t(</޳ޛ|ԑDd]9LX~G}/sM*ۺIa݈! 9w#{r<3f&][=ja;{c~X}0ӡq?vst;ݰӻ+w= GwGSEwG3=6>x~~|DxlPEږ~^Gz3 h kJI?apXa>RM̔sYGCٽgv4t/Hl^=W4WPؿjNjMy,@GtV~=NY=҆Mt +'Z4iC?$qnb>{INnű|%gZ9^Z_,*Ig73 +]v_Opع 1 ňdmз|WQ5lVKj"[8W,3識Z&(dL#M t +} ++вr8. +Cݫ*|/5HUf塱<]it _:)!=nK<21y<"Fknkbƕ\}Jmz* ݷr84|z\˰\*͍b~tQm1a7 ŝFߊNM0>ȤrT9cQ< wɝX_&/be*lÆ c:0v=^SƠiw2i52eb d>o=_8z^C]o.S>%Y}JP\ +sle&W\O;b,KuO*+`I[~ vWWF{x}v/&:HڨI߸5d-a}[M{eس-Cnu1ʤg[x^UuhtVb6%[uKiq[Lѥ?pO{+͉Jؤrע% {TOb$ݤUۭ뮳5uCBLU7);saAJU1Q;U +GqKlk<{%WkBwLZ56lU7SΖؤ luShe/lKzo!Z +zSTZ~DFYmCՕ& +endstream +endobj +609 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 608 0 R +/Resources 4 0 R +/Annots [ 610 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +610 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 438.873057 101.433071 420.123057 ] +/BS << +/W 0 +>> +/Dest (cb92-1) +>> +endobj +611 0 obj +<< +/Filter /FlateDecode +/Length 4773 +>> +stream +x]ێ}gyH8 Nc#)I$KRK3b<*^aDIs%r |I +7X\Y+sH lb& .ỵf9ϿH*gbT^Pe!Fム +z@sT0Ggܵ* T0UEmUf:((%`rAA=Mu:vi%]B>I:[|VZysJgSt`-&E+"l1,l-*(-|NΉ J1]O*IM+00H! +:[Yot8t ocJl54ZybLt`%0$ + $01.'Ivp%LʃJ4`\Q4tFKD`l.HL`5lq$. l ,֩%.[tpaqm +N kX.{uF ڵ. ,x:$.p]kSX`u8*J\FF $.p]wM 9h%.p]ik (Gxew`%.z-wu'iՠSxN>Q¼E/:,qbx.3I\ c2t۝yލhuU-9 +VfVʼ[yFi6S;%4>p`g4n+geHg;'?/>; k-3ᐺ9Oخ_؞,s=oˆ`w9Z7^/d#Pjjp%^GzҹũL7]#Bů{^Bnj1[(3Kgq6Y;'?<s8_y=QTz㑇F)SI֛{8 +7+k[i!5jYVD=HK; 鶏k=Clwm KYZv꾜culI?+qc6u 1@wgaz_dAy֯bQ7ƺ#~*]bʫgoڽgVR4w^ըg$L/]+ +o_v6V5y ]~ V=W}ɘ[i19WrE4b#Q/1u! jƑ۟aqJОkawLnVSOi=1Sit}%Oj%"45h'45gޮXFBZUY9"5科jl2Q˜z~WW[ΙWi)Vk07^)kjM}-aakCȖ4jQiE ^tNӹ.glC0`ѣ & +n&`9"_Oim(>fnC'eZ +&g6vn #3?eرs ݯ5:EOLcs_ {Rj'S.Dsع67$T,+7kxroF ֗?/d;UMSł9Sՠg1}- v +O +l7*&BŪkb=Q.4a5wf_ҚȆrBRT)QUfQJ}IYqD \٨4&a*@r5].$KubMZ\zҠnSxAvalL9ls)4eUb1Wɻ:䣐7P@ -+jxiRz9fU*%ЮB(ҮZ%47xI\*8--.c,/H=.cyDR i*}0V“v ˺3]zeܳiSnq1ʤex^+Eet*Zb,69[閱IX}&R;Q WiܲUoVs8:RV_2 sWk)m]u̚!yeW)GΔ:Hʿ1S j5vƸJ!C}&2B#w+X 18kUxل(U$/gJl} ͩH1D>e"}ܒӛ裦Qi9:~#o>g> +endstream +endobj +612 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 611 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +613 0 obj +<< +/Filter /FlateDecode +/Length 4944 +>> +stream +x]ۊ$}gJyH`d`X#쮍$?}"+ouu;vUD^2OȪΒW% FN!D1y+/X$*{O>Z>ǯ.ZW5蔴_>eT*!5v^YǨp1r*aQf0`90JF`6^* T0CFC*!X h褝q:%'C'tZOi%sNg`Br: [4Fp:bt`uE9- +]-@W`uE8!9]ԓVN ;٠tRNԬ# + 3wLREqoqI +@I8.]В$ @'?9.p]aw`5a2c$ӁwDs:>r\4mr\< TN.)z8.pQ@չ / ,V[7`V` \ LQf-9.M!qZ95fu:9.L%Aq~"w4[0T8.T4ϜI'xIqAP ADNp\$Aqf 7q "M0%- ?l[  D```MqAQd @ qA2`\R8.Z Dnjۨśh`` Ȍ[pMsEEqAtq ě%@g 68x'7rZW8b @s+d O;#(2Gdoy|t{d2քa7W3}'k6^\jF SEW$,V0]f4"vĈ<Nᴶjz_=Z=֪䳫Eu˗* c)F*c,#͌u2σ 2eCYJsVG9OC;Ud|߱KK2kyN?[we5Ĉ(;AP6bed]<̊6ɔ3̟)FrKYL]MQT+oG<TˇBxĚ3޶2V]}Ɏ2<ؑ/pr1d~kS|)c`;B≮ˡ][GJ8B|Ȓ-} bYWC3B|?cՄbvQx2ϣО(lw+u%RA},ƞJ}?#e_קö dVÉi{/ 陠}p;!Ǟb]dǜ_ac}Ψ̇jGz;Q)i}p=+jг]Բw=ZTlFgiJxS$eosm {.!v|1-nnfk=?ѐ}7/ѷfu{2áy]7;W쌌~uՀЗ"{qmѺŭOJ2d<ح;=Rϼ&3nV|'Ww돂]![x:XYK^5/m dC恿ƳꦵǷ Q뻵Q\z'<jzk}Û7WPꯣs^;ݟp=Xw=yߨz 9")et7q/ +X>;<#k=ǧ6N|+ǧGzhۇ.wK}9MNp;P{ +-L~Q>WgL[ߩZe=S+Qut;\C}!]ugwu|"kxxk|D-fI5/}6[}h맯)Ϡu~M/m0 }^q>J|K<<\Qrh.FD'<G ~?>{H@iMu4<lߥ ayQ\y~je*<׻'}0XMMQB+1(ҽ;10:S"On :LUeѧ}렀-(O"_|_'<⁇uow}uS*ogccsĪ +[O +lRNhBU{hrk6d%]w /VVJo(EUtgTR[R1~-JY]^0 .t¦˥S +-k,-LiPס6<#Km^ՍRL{־ÍZ /ԑ/ԶqzPwVq /MJ|Yd2?SRbt MZ%46xHU1\ H[ڮ}{!pbԵҮ:<"JKb>+{(F&/ q֡jEĮrK/%mm_v/4QL&VvN )4qї$.A͸ϗ\40BNKzSKe|y1?y\rBd^pRL*:l:27 --hR_]4b/)eePYж6ĪBWIݵ>XMS].vܤMU8/t]8mJ֨.#NBqUe 3 }%~w΍StM}EKX'}Fƅ=wW{6ٕ@JUK녑/-O뜣feen䴡\ 81IC˖ؾRSdJDQ2QdD_lr9[itŁm%_}&GҶڈJKzK:@oW'ZKFUjZJ]dͲ2^0> +endobj +615 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 683.673057 101.433071 664.923057 ] +/BS << +/W 0 +>> +/Dest (cb95-1) +>> +endobj +616 0 obj +<< +/Filter /FlateDecode +/Length 4791 +>> +stream +x]M$qׯM0ۀ !5^+$#Y5=ӕ$3|| FVU;SJ9wx颦~ju_$Sp}7^W3׿@*gbT^Pe)Fム +zBsT0GgVaK*I* 뢶[U&j'`> +*`6J:Fi?8=H:ɢ.BtN!:S'I`JK:[vNI:l.uŤh%]-ɂ.+:آҒ.䜨ЩVg|VI:'lZQA +QϢxGҁ') jIa1щ:؂آb(3h"^88lD&%$0)O.F+р~r!G-UŻ 1հa:b؂X [XZ$.[oA …J Ƶ)8 ,(PXpwJ\`AQ ֵ> ,h׺$.]봒wEMQ[` J\V(qb 0p$.V&wMRN5K栕wGk28q&H\L%F]P=tJ\&D˟0VN9H\:aD]tDžy /O:,qbx.3I\ ;/㟿ӿ^/'NO_痿u},\܆z|u~fk7]0hߣ}^cC k^}V?\de4 %߱u| .s>cf߃Nʴڨz5Ů@_zTH_.(f;:`9wd2>fA.rNÌy.6*sکp<z1ޝ 5G}C'M>?<$qM}="evn<~=\bU2f:F:O8b_q]nB15^:)ss E ).{u \Z=VBM@C\enkֈ:HRx(/lF5x݊`q uih۽0D~DH;HqdCX;V/ZƉ:G}[v*oNصale7ӷ! xdCxN⼯dvx7jA1:OkwSe4j)hq3"ua5c~[vM;<]c\G:~&YOy6;q?"Ͻ'SuN vcғ;u_sU"#rv6q^ˌZf8o,>=dCqLaWaSs #GtYqXEi󽈿g~.3}a3[w﵃Upӡ +W3" +-{k:-ў{}ǘI{[kzȔCTvC? rT?.DjӸO8ϻd0˒CȱMQ8z;A GX + ^ tL 7-3{ąMt9y-p㾬ϿGjy8pbm&2qم#<7eqgos^۠|$p#,cf\zkνUd2j͛χts9-qumPK{rَ-!n{ ofe_~Uެs9Гue `w+eu;w'ݡz7Qe?Р̶1^rfPϻE.cz88lI#btFfvK.^6/, eSY{hPYnZYmuOJͥeSʒ`ya҇Ͱt \N]fV!MЗ7\YRW: 4)t&];5W^J-߂`l: #XTNjta>^1h?.N;ӳw$\^֖-[e7lXkZ^0-Kko$Ij![Ro,Q3識z&[dLd/ULBnU{4\]ײ&<.oΚMUdגm@\'AtTma0; Skr-'nҚo#[ԫnJMD6G/bҷVlwm&vG\Y +-kxҘ05;gMJS^h Eg~Mv:Nve16r餄DtJ\1WyźªWrFv]VnoSիv}kC7.m5@m2W,lnSIV~3&솁[ةβLZqo]2g7)V)(K_e:nTc Ӹu%+}N:)o6m8F]S/+:n k׫N쵤n }!]-?/@kǦ/󥭝7\.Sپ$_Y}IVQ\nL$Is=PP_0.m׹򦫬Aloi~ӼG0㾘 i&}16“\e[slI=ڲlC eԫ-*aSڭ+^l > +endobj +618 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 236.373057 101.433071 217.623057 ] +/BS << +/W 0 +>> +/Dest (cb98-1) +>> +endobj +619 0 obj +<< +/Filter /FlateDecode +/Length 4661 +>> +stream +x][$~_Qφu plcfjm~%lsEfS(RRWo D;~t[C^$/.I`jﮯ_/6EN+{IEFུ*B%aT +u)[S I\`9  +pÐWfpC{E +nh=R~(-%#hFpt.DYNyΓEᜳ|Q*NgUD2s:_3thNdt]t\6#9RաGgt8i#/H |!p:5>Ի4Y'V_h_wKhEM ` + yo8 +rs<`N+/FBeuDh_4 ؖ dT-I8.0 \)9.0`\q\`@Rs EwNs\`@w )qw%/0`GaT0x(9. .*Cq"t j!y>h8. 𮶸nj+5դH6B,,ӆLh%X> *Dq婢cuQ(g-jY("p\`q8^`DX29xW(9.] A(`|J. +CwAKB0 @RDqbx8p\:bq tLF*Sp:ThaNޕG x7 8:p\`q $%tX8x e:B8.@`-њ B }/9.8.a>ZtNA׬.@<ޓP8.\Jtz @"K q\#|AWC9SA6tS゠ A e:qFh%Q՜dg 9BE M0S:&ۖL~04ctn B/Zj 4D _q\)L4D0qeo obh\oz "M$7N\o f`M 4lk#Ӂw: p&"[nn/A#>!81^MHp/F+ $7͑ؤ286kaJ%ٴ"'ܳOmcf&#!/sZ,/?c__  hn[CC+1i>b:@c-9/?L< 7pxL0}rMteLԉ9ĕ&^sq%&äӏ_~Oѧ_%%oT Ϧ_y~/n+e,GyԿQO4 ^'Q7C +oMY6qz'UU!/i +!&H |3y_ήTDܼʩis6u,tg'3Z7{YNӡy=ţ7:Ĭ65[8ū=bޝ?ܷʑ[z61iZX'@mlN8v\ R<3auWgj9Fx%|lle4HۑY=5.- xu鐹&:{|lZF"is6Ԛ|곱x TQo }Ēϒz0_z,_6s6tȻ|nT"n4deQ_reDX?FFrqh,|ח.{߾oxTjjI +ĝvPJ-Hhzr]u[EVV/Dž4?w'KX6h==w(.^Ԅr鐷񜾛:Ӳ/Giv>-{$N+H5ė>eȻN!6OĔ{u$o9yԧ(~xz:ǎ|x^Rǁ5˽36C߾xsY;q>vG&Vx2<Nӡjc;[fQ} tHxZlB_'/}gIe|ۑ>$kX;mΆV!ڂ={D_蟙M2i Hm2[{otHȆ=g&y˚- ;mN}dyj5' +~ N!x#V}O(CӮ,'{lߛw];mNƍta5[rM5tH9צLfn>6C'ڭ'օ>ozlq֝6C%&(1hh)>Y?qPftȧ틜}}*$5z3"<{ِ6bLkyU{Gk{YZ{=}bgwڜϭ><_|$sĸ;mN{U_xj;^CY=Hj=y}Ywڜ}SܑL +:Wбx$(lH\?$"Wp7&롵l\c mӽOlwڜ wU3*zjWѦy[\q4 [絀9J7vwe7IWoObJk-tHr ur?OqOoѰVa/%'-> +D7l r!HV~zȹkHpEIѧko?T o琢Re=$=v!՚ 6O;,O_3$BSYw5~2륤iO N]?936`=̚]R{tڜHu>^^OARP`9liS)5r,ƇiӫXH""rv%FLཝ$?r.R`^ľBc9nfi ʹ_ҩ8ݽj]}0+X}ڲpSlv.XSG]Jչ*,UeosMxದҴh>U]-4N"di*ĈnF̧&4f7vd Cr1cD [n<--KPMcJ PGԧmʛ>"M8ehpgRUz)m+WH +Ms"J5,gS-<ERiOzT/fO+:Հ"_6ե/mKɔO[JH*k>fIUA]' +S.WŶ@u"~U|1r*v;_[/-rYx6 !_,]X# νcd܈{2 sXm,u7{mq\pD܎diwSv[mXZf4q\놯J칤* ZXje+[W%ym}?4p^ᠽ3uH6Q*ZthI78hO悱z6q3H?Maҵ&HlB`'&^4Na~{=.$-^Xf8t2k:ȝP9i)AN5AFX,\4. YVOn42q`kɗJִm[Tm[ʦDK@w'kKFZ"Zd4vmmPuTV3;+=w6]ց+L +uKS ԤSPhShR#ms%HΕWBs2Fz- +EV4zw͢doX0Jsr 2Œ)!!T}*8l .:yT^*654OK +endstream +endobj +620 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 619 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +621 0 obj +<< +/Filter /FlateDecode +/Length 4980 +>> +stream +x][,~_1u@0ؐ`8!9gm:`!?_ukuuO0Yt.ҧO%G~/93/_ObV_JHY +'+ |ʻ }߾8kGSҞD*'QEԌ{errBcT0zZar*a +* mkUKé`3*)`TB:"ъI;98q:%'C'tZOi%sNg`Br: [4Fp:bt`uE9- +މ.+:".` ЉZlZp:)' ljVNr)ℍX-ӰӁ'!0UBKNgaRް:؂@9"(#h"^8@y? G*8P!N{рv2.z)1`:آ@+؂h [hZ8.Р[#@o …  4(Phpwr\A ) 4hW8.]mwFNV[` As\`Z +qb) Ыp8.V&wUUSƠwEP2q\LF]P=tJs\& ޕ3V q\`2X]Ǚq /OҹqbX.3p\0* ,xWjԜ+UX.q0I`~tY]D  -) 0 O"IX$qxC9.p]LVk xW=8.@\-3NB)8xWH0 +#K&Γ@ `(Xq\tXpm9. buxq)8. +h8. + d%ovy[v}`` "E dSp\z ^tNMY]Nz 7bqRS?Qq̀N |-*`*Bd$lAq"] (؂h゠VNp\kIAqA0nP 4&8.@br\X:آ EqAE qIMqAQd @ qAMe8.f j&x̸zs\ lQXlAq NzlQp\fa֛-@Mnwm3q:."Sq.Dd˭zg2Њ3;k1[܋ʳ{Kk$vfbekiJ)mE[Tp3FF 辮9Z2lWO|?E)+?BJm_a%]p_ޓ)AyӍG a8X9 0DLJ7Xc}hl&ߜB<r떯k^6'^ fY*A4&EyKZvNg2ziu%ty^y2\2i[Yڭ6vm*6|g;²~?;imuey Ƹ _?[Fn.=%Oj0!AׯmEߠԕ_[ίKSØQ݊y RVQtYcl&ّG",e DMF 3]rp6FcS.Ǵy8L]v'cГ_}>(zk0b29?3Ocx * `tMq %bg<~[k$>5p9.LMpU߰E?WmtIKm6fot85q˱]x~iv;߶Űe4t o +DC?C}~B_"EW3%ڗkMHgcۺ)Z;wc%W=scPPY8N΁=; \>c[nW`Нqq(Yv ^)G<>MT<6ΘcbR&үY}W4fRY_~?濱Kg{7PF +bA (kf9mmm6S>&Iw(3է˞ȬhL9ۦ(~!rS)6om"ۑz,!5!Yk嚍s3XeEuvy/K!b$%^wݵ>'n= ߽dK:2`~ƪIX1(_"au9kwHc/y4 7'cq{p^#)mC/G޲nv?V!C~m+uz_k*n&r\v"^~K֊Z~yg iKVɥwK~a$}ٙ#L BYI&F Tܙ^왺MIF3ӓ"*MzFlL{|eY. OqLmy+^4?gj~[(tz\1#DN'bjd7I+WM{hXj Z(Xb7V׹&]wݹ'Pޗ^*UtgTR[R1hά譳0 .trbl)_S57Sugd#BK1=^Z7j%#_O3m +a zʭ ^ԇ* "wv3U*%IV *^::4%%`c iNc1HR,+ꪘ(re/TĶBu!nv:TݛYdw[mbW^\v/K(&RI+QgVY'lkZى|lq/OiS*zjiI GY<%ĪBWIy/k ־i|K)dz}q +}spN)+Jڦth2/]Y0WR]O+4]ta]3m.Ԋ. B`_W0F=dWFI+Wk/ #i%<^ӥ[^9Gxmen䴡B 1IC˖ؾRSdJDQ2QdD_lr9[qKjq`kLѤ?}T'ھW*-[f-ξN5 Դuee=w0"SѲUʻ3vT'^ێHN'sC_MFnγW){%}Mh-TMx"^WtE[E660[Aj'(}VLBRCOShi}~ 7e +endstream +endobj +622 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 621 0 R +/Resources 4 0 R +/Annots [ 623 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +623 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 502.623057 101.433071 483.873057 ] +/BS << +/W 0 +>> +/Dest (cb101-1) +>> +endobj +624 0 obj +<< +/Filter /FlateDecode +/Length 4869 +>> +stream +x]]q}_̏p Ly!%%ԭ]촪Q*KjI~~/bLדSWJ'w֊tѝ C^O9>)%o;sVB A9AR +* .* JI*ADAaV` $AF)QC5N^=Lu:vӒ.M{%t8M$l!zDl11XI`w芢(Kvr)!nuFEkzruQ$-^$`H: [? +wJ-$%q"npF qַI+@WԥI%.p]В"Dԅ @'8T$.]嬕w!uF#q0m9`uRL!Jc%xW$.ݼlJ\C(q  |)%.IAO N₠ p,Q[(dS b ؂ADS҈l\Dɦ$.c?J:o@ע.B!ЄXK\1%.O9\f@Iₐ` XhK: [dK\H:%.  ]W`^t>3J\O9T;M0- 0>y$.MlsDl$.f Fb qARI)ơSJ₤#$.(qA +Mly qA":؂) &IybI\(q 7ы)ALw]3I:."S/qDd+g2g3 +밶)jĜ=4YF/f B6P_c9STpX3c'0-}sbv؜۟O}{~S2eG#@( In[TLRBHlDHH Z\nH,yae9 to[ xHl͂dؾY Va(c!T*O'ub΁Cf>Klɸ_N~ӿFNOJ:_gy\!boӅlmk9eq$Ȗ&mf}:AU~YeҎt^ԩmΟpOk@(sTJ>wǪ_zز*JW7 s.ZW+Qjpːڃw݀D;-SY{s.o*4!3 o``g)vCP:XFF#ma9~ ˯_NCۀ>et]m_tKW9 98W!hVˍ}Y1@;@Lֽǒ.1^,sY}e}a8/W܇U]R9!׉32ױ:Oգc13.2|9񸜏e5mvX:Vu=jʨxdd}˨2:φ*s={ݣa|̨OJ9;t)<RGL-B_16j{Ѹ{͎Euαem;-q0n.wCaޥRLIEӧzӡF _ n}urv}m3Ĺמ ٔ{aUm,̤H=Vz#p"ib̼}Y3w.VPZy6D1Ϊ{OJ r|ewdy:߈U?;hjbW}Ōς˭>a̱U'?X{#v=rzϬvcT"pN;h| xӡF|:F㕓aʞ"v@oY헅X^#˾K:φ\:vka]nB1xj`XփuזI +GGPt9(rQ29G6g;rL2^2uih/(<RoĪ/BXh'=s|h֟p/9`׊5bs-ua9}bgy:ľ:1;|e ȯ6w@`Cߍ8#ݓNvW= Ǥw\<ߗs.m s;8|?lǀlgQŧGtqo8ZîEegCQamf{;mZff*Ccy(Wpγ߸`q5S=2R$"[p+Ũ&)B:OԃǕCukm]SlrA9؃uc6rokjW+N կr1#T㺷u :ԔNn,Uspnj3̶bs`#Y[(:O_cFiM I<4JAmʎ=8 +7Ҍ 9hZfn̯ua=Qo2y6$1kBO95=.m \jٕu9b}!Fm~ߕ2Kv[w42t>/vgA_:3*Sne%}gE*!*VuEYj?mg}eks +uv h17Ǘ~/}{͖`|Z7ccn`(S=wKgpΞy wwyuů_aspyMyێvr^9bse双 3s`[~@Wd|.%˸-mY}n>/6eny"7KY>Cp^Sڲ}W}lG?`q!Zw[k6و돹 >+l?ǂ:4.W}6xdM/=rgs3rc;0&)5~kM*.Ka%߽8<[qʱ0ލ)Wpl5}9|k6BG6mʼo bX:?+j,r#>>й M#x6SO8KcvM B_ue^tr ė-KܴQ.3.گ0e(4-s ۯ'_I)ΐQYutq>,/Z;(cReAH1_yG*hA9w & q.UktC삽bXҺ _ZW?W&wZ~v3ZȖ Bz+g&{d#Lq aox`xSbB*]\:߅t:͆5 5n("J]jSջF5eF&udj$.'AM٨gXD\$[ZsmB+{T=MP9^]؆.DZ9l縿 7f#_N.] +*вv8.A?ajVY~x +פyM R-wf徱IzY.B,J(In[I˘dbӠkeqW-y{>Ѝ/[Vဟcپ$Y8E-VQSlef$魯>O|(l0"ڮ򦫬+0iiZ#z/&:Q{~vbYOrׇmͱ|P'oPk˲g[ӧF-hu1ʤW[ +8)U٪ӺP4LUYk1TRqZLѥv|T)ۭ+^l sgzKFAy&^VٶoZ]W3; ^mJ>̝ΐuJ՟ ѱd 5`- V{pW,5rw빒mFJxOUA7@&|"VۡjItTP9WK%!wL~Ao/* Jru>)?? +& +endstream +endobj +625 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 624 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +626 0 obj +<< +/Filter /FlateDecode +/Length 4751 +>> +stream +x][ʑ~_Qφ#%1x0ƘekN,} ~/RʋХx.E%! +?iI1zE )%fYGwՊt]b CH}a__]>fHUdCPNP%ʹ!㼠z)$` dh +0Rt +f1QPEa)hV%a&I3trAPi;QJEdnt/|L&FY;@iIｋ`KJK:[&RAybU `t芢(Kvp)!uFEkzpuXQ$-^$`H: [?;wN-$%qop qA+@WԥA%.p]В"Dԅ@?T$.]嬕wuF#ql5 guPL!Jc%xW$.]6%.&J\xFiH!x |Ru~ ((K +$q!%.Xc$.e4o1<-l(qlH<1ft-"t:H\ ؊E/q~`wI& B-X*`+g.4l-q<]贖 oPh"L$.XC-Hq%.v%.2A u4!q懃m'qsDl$.p%.e$.69 $[I\M4R$o(qA +&Bs]Z޹CX'g>dx!TQ*Tuv6Oj]rÃ5uz;;{÷!]%}r5T~˾obAZtGTx/sT0Jm(A9Oۍ(-#H]=S]ֲóp y a|6ϛrK'xhf`ӥiv}Td'͙g2= =׏Ee֍OTekέ&b,:+{4}"0gH)y'g7Ep<}0|EUBW&X(幟jeY%}3X=5rΞӪb[X&m®{_FA>:^`=WI٬f y76sTQ?΍8*#e⦘Y!r1E{dNydRڝ3fFoE̗$7fҗ/ԕ}ڞK^3,ڭ, {C:uelC{(Ä.v2/lQfd;يY;j +;ޮ3mg2+ڴ΂msD}=WSݍjw@u#\C*{Zs.qb+ĸmn_ ,=:q%MywvLu{c{ܳ*fk1:O}-a5]zd4;}γ+82Pa^-n.^ֶ5vrO-T:Ssu~žsyfO׻vfw7R+>'WWfG%fV/^k2WOy:dk=~olj(#xsuw[p%mu.]gb=}Hչ\?Y'U`C.CfD_M\KhR;qŵwm̮^4.:K۾tZI ;su~ƭ2u]kB?o.ʱk~}b++ziRw?>57suyj 3;:]wtW Moe˗'N;Hf3jm)c<)Ϡ랼Vs*:(ȿzZ?ee-eUrthrg#u }᜿yt(e[c{VJGhQNy:g*"X";#꽘3?\g?v^unvOpq1k5G87o; g9boNXqae6գV~ˢ/yڮl)u∼|y6׹:O99#.U>lϜŽqPme&ns+3V|ȓu Q*q|lf9-@? ·8Y{~UUZh0qNrgV9@\yWx`[hve㕝>.0[V<+jLQGuяmZXdo~S; ?s83=p־a\9մ|:B8hoz8ҕ%]I׍a?R?D,OLE'xyQYM9h 1`NY8}T-ҥ`aH˒pf1?WΆRIacǂ5^ՠ'16+v:~j/lڪNBuĆ=_P7a5:M)kB7{ڥMzJSet2ԕuBΓ ]w4M̪f_y0 +crDXnjՙ +TlUSfJuYI=Q|=@k;ܘvqTWb]\JB۵[Q54)_?ai?0U)3OB_ЎZ'6x>HW!i4V.Bl?^:*(R3!:wa&5*z!~_إF+YgDJ 1*h~lX5U^-WKJ<@H5[&5(sBΖ J~M6K^ +endstream +endobj +627 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 626 0 R +/Resources 4 0 R +/Annots [ 628 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +628 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 770.673057 101.433071 751.923057 ] +/BS << +/W 0 +>> +/Dest (cb104-1) +>> +endobj +629 0 obj +<< +/Filter /FlateDecode +/Length 4941 +>> +stream +x]]$}_QφG 5x0YkmL_>#eJTFfe5+# +*}UNHz1O/j +N_I(7V&C0L׷ .y~q:)%okVB A9AR +* MLIR V`$ c0RvJ0M +f䂠 +vh!At/錞|L&FY;@iI&ｋ`KJK:[&RAybU ;IEtEQ[WZ%;D]N:䢵Ji=9`ӊ:(t\uYe$-Ip6(VGUVK:[ $` :_ba +^)&!LE & +J4`ȧ U:%" +8X [#WHk` H\`-l1d%.`[Z$.[RIK\`paqm$qJI εN ,H=H\`y#qZ^ ޵޵9El%.;NVG+qwVAb Ыp%.V&&*&` +uax84A)#qw /q2 wA!N` V+q +  xW'L˜[M:&/qui-b:Ѹ.^/74:?_Z:754X(0^]uҐ&#t! =_yNڧgYc9u&;﬷Gy/lD5xފ`qA¤4M/ 6"һ#ytȱe +=>esڗ9u[Nk ]+N1p`K煝6W 9Z<bړywٽYsy4.kF8. z7jAs'NgwйY)X$xA2IONy:$߉c{r6qˌZbaE}ŷ^P1={nzkX4qXԍφ^:Ϭ8^߳|@;@_HeGݺvP(=Pz"TO0{*Z 2i+?6,FU4MROy6_wvV^խ}$'ܻ۽`Oy:Ǯ^()kpvksZg]3C40ּ2D!;B5{]ߠcAM[#+eFy`k'g~dOy:ǯ#;J$ϐT=?Cw@1d|QAf\lAfW2pe~m< zAr|y:$ǸVXn =e5pew^7աUa=h,umӈvyOy6Lӝ]a>szk`XqFe;}7]bʱ~޻;- Fc<#a +V3 +oίi~y:,vmOtԙ&B m +K9eUk|{=XOK6%/kKOOOwhkY <<ֆ9R[6_oqp٣͒~)fowFؖUXgȏ, -3v;vu҆?*ž=,=e[o3"_L+\~O.3z}X|e[U:kSՑ1١z[V}d-ؖEOBi_0|]|Qmr,s .R⿎%`Ó^ql_k_>jCqV+q|g5oK|f"|4UWƂ^C_/Ιwr}݃;xԚ6]Zzᰎq rRxq^0`*({6|2Pi{ .qUG$ }Q#S?~'&;>zzn6UFc1pņL,jXL\05[ҔA0gL9k=w20cFs(Z(7עαF>i˲,eXڗ{ǔb +1'=IPeyLh;?4>HzX#~Pػz2!>cJr;7okN@RGҾ]Y򤝑{;Z+G7vIɅD0C:]Z_,,E 򪈣]v+@#jenOT 4nRAސ?W[-H&ùbA^oŹjҋ87Cr)Cw*&t[bujg6.lsi5 ; MkQջF5eF&u5ej$nAE:Ysuga@.tv-S=kt/n쑜leǵ8?5ZE.Hⷋ Bj׹B +=.&KCЬ|*i +פyM Rd~+cNrX$h +=-saKG%ϤR7eLR5/T#X75qƕ\]Jtm:*ݵr7|z\c\*Fq~tQm1a7 ŝFߊN,cdҌ{R9cOx(K_i~߿^z<4n]L#'̩6l.ֱu m75{MB}ĦAh<-־|ikj.xsp)ʊUNڧthɰUe+33 y%~]as]삅vi]e, B`/xyie`}1ڛK[ò,ү/ۜc˃uv,{9}hЂVL{%R*E TC/٪[Jb. ҜxM\nZd[8Co)[,繛zJ[eۺi]wm =2U=ۤ|;saAJUN`zLԤ5|נރC(]LȶFޝxd#RJxM莉UAoMx"W7Jْ>[Af'|mX,B2b@ޘ((-woaI?hl +endstream +endobj +630 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 629 0 R +/Resources 4 0 R +/Annots [ 631 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +631 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 311.373057 101.433071 292.623057 ] +/BS << +/W 0 +>> +/Dest (cb107-1) +>> +endobj +632 0 obj +<< +/Filter /FlateDecode +/Length 4702 +>> +stream +x][,~_Qφu am⇁Oʹҳ0އ)+uIe䥲aOӧ+#t>} +E*K*!zG/_/Rx+oH1?۫U{% >Z6/4j^sR>x/-PIe{mrJcT0z4WyA1XN3H0䕙"^*ZϨJK`$2)+q: QGVS^s:ctQ8lt[lYbtLduEo8-]-@W`uE:8]4@"t20ii HNauQ$-N`5Rs:[?GA"{AQG:A:DAt\ӊ##a%1Q0rYl18.0 M%%|KR9 fJ GP.9.0\t1=kЮ8.0]CJr\@]c0* kxHs\^X:qwuqw4xW[7swjҎE$ wA!w` iq +n "?fL +q\`*X]ʣřqVʹqb2X.3p\Q5 fjNU:J ,x~p +߄.B8.]ВL c!r\#+18$=9._-3 ++zӁwM&'@/Xs\E \>V-^B`AY' Xhbkbkx"*x.` K,I_._~F_^/NӿV_Fy_Y[9Mg/ְ~e ;M*QwS8 6.]uo]HdK;e+4mBK}Y+kp]PނY +Ŕ6?.{#Ïzs>foC;leC2^1&s˘yi՝yN gwAUnr|{ټ:(m7P3P}է}Çf^oSdphc\g_Fg՗ܽڙt]?n9GwAKhgdt-t.ՎGl~ڴeoOMoehNJQ/PJ-Lhzz]u{E^V/rY_}ڬP2-bYOVQG[]ַp/9~};L~Q|3T#: FxƿA(CmEv9F r[Nn1?; +Wd6-K;m[w(GI.v92qwcx+!!Jmt_ӡtÿܻhRvҪȏ]h(BXںvsÅU갚bpufIbI~RzX&m]:9Xmڗ{iPu-RpGްy`Eڙl h7}P;.[﹏ΎzӔFFL+^ٿ*Jpgӡjc⿘wwqDmt 3鐲+~3߸{.Dgյϒʊ)]7V-ض#.Г=;9ZkoG=gO^|DlI[@jٲZHK.jѰqFy|7;F>_lvs:D{ȏtw97Ӆг>l嚲jܛN+˺Rc{yN}Opsqރ_W};i8@ug!wZ"I{R\3E'9}w#IM~?Ǿ#xν3ِ7|w̭hNZ m煅{KmW =s:>|~iW;qw9}gWS߫S,Ljfyzfr{>#s:}٧G"U+\]$EXQhg!9<sH~XAo͸1~xm=L\@o}b37=jFEQ2B"~wܰ6#~jFjcPz`_> +endobj +634 0 obj +<< +/Filter /FlateDecode +/Length 4899 +>> +stream +x][ʑ~_Qφ#%ˁcX0Y>L,}࿿_$Uw{(4=]KdD))K_~~/bL嗋SK.2 䣻 ze__]w]G_͔7]YdCPN`%˹)zSX2eA):1Ș("İݲ0AĂ: (% "Fi7y(K<'I"/xN>vZ{#Aă,dcxXoȃ,&+d1Nxȃ,+-\D"/b[QnrZ%|ӊ<(g W.<2BN8bfmAc<K`\e%)3uG?2h1daV`m?A9$úh'pyD~ +#(cGѪo>].}GD4wO?}Oxৗ˟M)_7TAqʹZFrV/4Y"mr;fyl׶[Q(ȝ:_~)XRfu12_aԗ A_?.3쒤yCGC^|{)=+% R88kFʼlaٺbN\,c;ǭ=inBcq!3DVm A61[~o~Hw,횵aZݝ5~tn-(2eYM<aiw_󱥬 '۲||3J}QYE2LsMS.<:Yf^6~ JkGJannW.sԬlaՂC~V-^rيʍmRnlW⼊.mt׍UwZ|%͛/ʴ~Aݷ]glm&vOGVKU׬IoYڕwVe\+;6ۜmS:oJ?0VuUDSDRkU f#0I%e5tXK?i?hlEZt/G);ދv~J6jh7PC&?:E;oC8> +٭cnrѴl;o<ˇ|yT 4O`EBu7]ZǘD|wz^^p wN̾zu0K+,蝬$yz>~^c~I2$ШXM_>>m=Ctc=#7;5c{gxΪe!~Y|oKSJ.=twoZ>䬁)͖Msuwߤ 0_<\Pwo~+[6xcI/;WI۲l}Q{0ٛlej"#go{N=z6G~M+2+Tzj2{:^!luځ5& +k36㺺|Yefy։3i_u]Y;3Oqqߺc=!? Kgtiw1tԪzͭ>?!}gVy/l93)G=f y:/</VtUFV|[J#5Zw WwQ}YW8)mA x'<Đ%Z,Y|ڏ-lpGZ#~M ޜ;D7 +iz{:q?w\{zWzǺw6?<8}vgo}*x#1b)X:b1߼rpG4:O'īE9+J &~tG/={>_SZ=0RbNJnBIyukAdoW£74n~C,V1~oyqMz +bxoTۋ#2ss!gҤ˓uf ]W{>~;ŗ!N?<쟾#<][o{a-Sw=ϟ22N߆qx8KMٌdsѽv;9b={L-VD 4EQNy6/N%iGrH7F.iQPaUnж;S`o kq9[)8hi;ȁ #gz8gN CmX*>L|ϯ+Em%G-,ϬI~p跦k~4-\֫y|m=NPk밵j'ݴCy r{ϒ.fYzf>Zj9^|x|}w%N49diєF~$ad&.Umt=[n0uZ>(qe4\ߕj|R3"jz%դ2'\* +YA˶[C#-Qu5"<|#V{ 9 #UХ]*vBJud5U; E JcV~g5>Ys&HT˥RN .b5W-jت&Jsu>>&9l&9"*v~c6QzqA(V(W\'ڮJKr6,4>U*#O-ڮZ'<7+y+ꐤMԥC>KG%gЭVNe="T5YWd=Q!]#ʯ+rթT]m}מx2 6t|OqYGlk&Zщ|lLZqo^2g3|=,}sA:nTE SuEW2xߚQutDC7+Pqc:V]5`/%uEP]=5vdS]hiok ^۴{ep|VZE?\ƳmIvM⊋%\2]E\05VbCTճԛr_EFm?eW +endstream +endobj +635 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 634 0 R +/Resources 4 0 R +/Annots [ 636 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +636 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 558.873057 101.433071 540.123057 ] +/BS << +/W 0 +>> +/Dest (cb110-1) +>> +endobj +637 0 obj +<< +/Filter /FlateDecode +/Length 4913 +>> +stream +x]],}_QφI1xp1fL,=2%E*#ީ1{]P(R7%r |IM++)VEF?Hv%OvӯN_g3@*gbT^Pe)Fム +zBsT0GgVaK*I* 뢶[U&j'`> +*`6J:Fi?8=H:ɢ.BtN!:S'I`JK:[vNI:l.uŤh%]-ɂ.+:آҒ.䜨ЩVg|VI:'lZQN +QϢxGҁ') jIa1щ:؂Ηآb(#h"^88lD&%$0)O.F+р~r!G-UŻ 1հa:b؂X [XZ$.[oA …J Ƶ)8 ,(PXpwJ\`AQ ֵ> ,h׺$.]봒wENQ[` J\V(qb Ыp$.V&wMRN5SƠwGk28q&H\L%F]P=tJ\&Dӟ0VN9H\:D]tDžq /O:,qbx.3I\0 -8D̙)R#3Ct=I6㯧_`=_ n[E4TW,!#bFjFFb퇕0LGn`D# X3wirD탖mv_Iޝl[3%-R 1&h$ܙDfCx]U|:+vGAƟ?xw?}z=?o4M_wYrk:C,h^33<׆tkIGy[^Rg.#Ӿu`ŖeiL?O;2%>eDze_\X_:3(\i`x]cY9lbe4nD<(!PHZ˦ٿ*(!e y:TCrg"!p )_s5 ?R."{|a%L0!FL3뎳~뵼5C%? ˿;|#Vdm)?X|,f|ǡPsXZt{F͵6Q CD{e4y64폷M^*k ?_/j/ } r8v=yX?B:c=Oc[^/촍eW2b<φXw#|q#]-ތZv@{0ӡz9r֑Y.o=ǸFtHA<nĩ{0ӡzzuճZU zfFs:]yvuq: jBY~gm#Y[(=كy z:׸M + I7?,y__FK:^ z3[Q2و\n[G7;:l^`j|Pҳ[3s:WDZVm W|>8a ԝcX)wtx:bO7k;rϰUs;]`fS`Vw̷7~lzqkq3%WX._W9qV.e7WF]m q@1F8: tr`wSܔЖo,\ƥ^(ò m +sT# +o.P[%'p.Cۇ){? LyUxk=4rΖSs-7jk6:ةȖr!rSդ1'Mv +&:3koUU{4\]Y״&&Po^ R5,3*7)[OrߨZCg6=5:} +$N]Nb4z*TgݔuZ.l'һQ~\iJ 7f#䣐wPB -+xR:qYet5?SoRbA):_Jhl6I\8ŞK0c+)s\#j놺&& +i\Ʌ7(N߆W}+C7.5UeK(&ZIf^v@ +]ihmT[>A&͸Ne3Zq}> i~=9ϰ ?e'DLNGkly5J!C],ĶFs}d#RJxMY &Ao+XQr&a+ӜL2ʆPTZ +z /*-ȧ j\ +endstream +endobj +638 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 637 0 R +/Resources 4 0 R +/Annots [ 639 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +639 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 108.873057 101.433071 90.123057 ] +/BS << +/W 0 +>> +/Dest (cb113-1) +>> +endobj +640 0 obj +<< +/Filter /FlateDecode +/Length 4683 +>> +stream +x][8~_H|)$HaB<BH }JǗ8N{vLʗsY"!D `/H\# )/qO +:|ve:B$.c=$k #-.` "SL6D$qAp1ft-"t:H\ XK ^0:M[0T$.T4D\i'[xi-qA4ޠD234֒hjIGיQH~`WQ 4&$.@bI\X:bI\f Fbf )O₤nq蔒 ! 0.y%.HVa%0n $-.-p0nIXo$-&{^oF f` ^ D^o1\u $LzW ^+(F anC +܋*154XYF/F 0B6P_ck Qy!`Όo2aXJk|_;3&}z)?˜g ޷[h '-WR5J fSB$ں7;l_}:_Meci9AfѧN?oo\|z=}TʽKL.0\?8pvc+_ϟ~ixء/46-%-gA"X4(Z־33m=51nN  }äShwʕ_\j +F!n ӷ~cmi鳛^.ӵuTP.#ӎve|!Rl򰬯k=KFH*@]un5 M`5K@c'5/t%nBzgawf[XM7\Esw3ojҾL~k#uxMil7z,fuՕqxV2ʌ1jv9ʪٰu.ԩ:K[^bh zFν6C¥c׹~Ϭ=6YЦr:T7z +RMt%hJ֩%g=3zuX .sF;22Q'F^͵>)OZyOB+t9rO292MOp|5} j^WE + +G ʑgF 5HX㬗=p ={;u5ue2/l\uƓ.}l)G#73ѐg7|Ⱦ'ükzv1|RZX4?cmLWćFw^O>jW IE1ݗp+s ^ljw-Z>j|3n2̂O[<>䞕ܚ9nw܏}ya|g׼>gT׆;}λqG;ush&ugn tÃf炘#:Ġg,my_ep+5>)/Aq?m4s84cמ=z<ѻ7WjGxrd{+E^k1S +2Ww927wUw7<&6{8Mmv_áv#oxϪc\gb=}Hѹu<ߙhuqםύg͐=萹&.%XF4M32:z:T6fϏv|/#[ڲKVy ?UhigBoQW+=BK pl/TbEO}41]GR}yv1օ=g~GJдhy{tI_mDmR[y>t=jcanSAǗ+ +'̷ӗ>7P֏]]s4}ֳvV)$E_gF +JGh(;UG[mƫ^̙(Q릧;.k[5<ݝ>\Zue ܛ3 Gy`Xrt'0޲w~}iQUeѦ| \?ْ9+{܇i^|s8|mxXqWwYx}tvBΗlLW2cvGs4D>ٿ*sJpgájcwwiDmၨrAѽy _?wժM|ƣ |ֽؙ͓p]o˨]+oD{ 3И6ӕЋo}5e!7+˺R_Ǯ ods8{wN?~2i_{3AN}-} ֺ3ᐻ3]44qOK#}UpݝݕG~#"={g!uW,}{n}/s+z{~PLGìVm@<3s|7<8v<«ěI6 |z~I"(CL/O0WJkU޾h'WucW]}]ߥyoyyʉ+39??o^>>+Mu7^r.â~< +=\2|C:IQYҹذs<ǒj:#RQ|dbJ?t۟z*~;y~$S*e CSZ7c*󋠯w],ʉxbA^/|jГD|1l3@jkMP5Ul3tJ*,MiMhrBR>-[ר"QH]NY:J? I~rф,<0f QIr:At9\PRŚ5喯TX^m4Iڌ1&C+UlpcQUvrAH*W( +mSnGUR C34JHy +DzU+YFj徰I-)ԴMs +fQ tKb3id:UnۙϦ;|Vma 5_:ִ.4|M5ĞS h[m؈MѶiwCxZ82M6|0R +2VS)WNВi2-MZ63VR+,\4n_ڪ:ͶEgxMh &VfF?<YrIAgxK HXSK<6IIX0I#m ++ҤR8.`HX/<$ya!i ƓB*a½' 0D (HX#M)/aO +<|"OvdOpj84)ο[~ic er=pfovn,4"}n1ç>([ٮ_Em;GgLW?z?ZTgq ^-6k^JGG_-#3ZPqӴՔ_^y-&[pj 46 +_Ϳf6n%ur +ӭ1?FɆCC;X ;K޳7Xx蹝RG=G}0΢";k8xj=5tQOƺ#nn]BGmFr[{la.p5{hʖvgܑ8Vv1Z^wȲ?fٹg~Ḳf\:Ƿǯgfo.ߵY[/픾rK/өQEJF*ewF1>˽{'4_sBgx,#."[̽`R^]5rKmwmx0G2́˞8֋{ދ-J@E>L:Xd5g>CA*/!R <eɎ'qMd{ÐSY\7zBRyb3)y .)I7gW2 C]j 3C0uH?b`]j_/ڈ>)UMQ`{gmZ&~\M?'26#Nt.Ʊ&/o'k?΄%֟w͈~2(@7M9jȱxG7%6e;v/r#2N=uViuP6Cܬ5\Fz؀"l  TPl_Rz]j*:ߒ'+D(G'!)ؠ\| h68fWiպ­䧪֜ $N -T]= Sz!ar*b7a w=NWm8}.pӠbԌ2dmPC~]U WoxW' A9U>~Z>0%H^E,OyWkdцWqN%ӕ#\|ƨIJ['mE[}P{a)N'\jf~xW0ɛRzJngnUagDlk 6l; gVqwHιLo5Us ҐYD6O9V*ϣp>EC;[" +NNidl'eA!ZNB m8.`DR9-r"F=~㮇ߞI>(M)A0v%m +[B/SY,Ͼ3+mnQXx2-CmEj&o?3_TZ=[Dr~ECE2l|>J6|$ß8;%]IgN|/Iq|Xb)Ko,29rȯ7>2QۤvBfUնHם +SKZ7kgN Wz]3*l>h@DMd=g).W| e[)96UwF6T|^Uo*z: )kB7GǍ㳑*RT.҉BPR])Y8 M JQsfb,D\*&[ZsuB-[T4DincU@{tGe56ֱFlRڐ_o.] +D۵[Q5{i05 O3TJe_K5> ]ܬ䵒zC4VSjtTByZjlETC*1HUXuJf+XUkdWMuEnr:U73wWmd_':⚏uv;/Gvl4cI# +H1z(4rL.S~|&q߲3qЈ^)}2?otc9oFU0[Wޓ"ϸ/:m:YVk~ܘUW KI]TWnOtMT͗M3XoK[:W|b +}wp6|m.\2]E\ⲻajdoRUS?]ta_ƣf -+}ä<^<ȾVhמZ; +x2K>2yj[{9mjЂVvت-\S*Mp*b(2ZQKqjLѨ5QJtMYnx-ޜCj%k,kW*жwݠ&ojܦ=sg3:HV+!:dIkl@*z !>=PF\xd"RJ;a8&VIt*Jإ)@X +j06+A|W=P *_FcAi@~!O+m +endstream +endobj +643 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 642 0 R +/Resources 4 0 R +/Annots [ 644 0 R 645 0 R 646 0 R 647 0 R 648 0 R 649 0 R 650 0 R 651 0 R 652 0 R 653 0 R 654 0 R 655 0 R 656 0 R 657 0 R 658 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +644 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 416.373057 101.433071 397.623057 ] +/BS << +/W 0 +>> +/Dest (cb116-1) +>> +endobj +645 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 397.426036 99.933071 378.676036 ] +/BS << +/W 0 +>> +/Dest (cb116-2) +>> +endobj +646 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 378.479014 99.933071 359.729014 ] +/BS << +/W 0 +>> +/Dest (cb116-3) +>> +endobj +647 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 340.584971 99.933071 321.834971 ] +/BS << +/W 0 +>> +/Dest (cb116-4) +>> +endobj +648 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 321.637950 99.933071 302.887950 ] +/BS << +/W 0 +>> +/Dest (cb116-5) +>> +endobj +649 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 302.690928 99.933071 283.940928 ] +/BS << +/W 0 +>> +/Dest (cb116-6) +>> +endobj +650 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 283.743907 99.933071 264.993907 ] +/BS << +/W 0 +>> +/Dest (cb116-7) +>> +endobj +651 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 264.796885 99.933071 246.046885 ] +/BS << +/W 0 +>> +/Dest (cb116-8) +>> +endobj +652 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 226.902842 99.933071 208.152842 ] +/BS << +/W 0 +>> +/Dest (cb116-9) +>> +endobj +653 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 189.008799 99.933071 170.258799 ] +/BS << +/W 0 +>> +/Dest (cb116-10) +>> +endobj +654 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 170.061778 99.933071 151.311778 ] +/BS << +/W 0 +>> +/Dest (cb116-11) +>> +endobj +655 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 151.114756 99.933071 132.364756 ] +/BS << +/W 0 +>> +/Dest (cb116-12) +>> +endobj +656 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 132.167735 99.933071 113.417735 ] +/BS << +/W 0 +>> +/Dest (cb116-13) +>> +endobj +657 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 113.220714 99.933071 94.470714 ] +/BS << +/W 0 +>> +/Dest (cb116-14) +>> +endobj +658 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 94.273692 99.933071 75.523692 ] +/BS << +/W 0 +>> +/Dest (cb116-15) +>> +endobj +659 0 obj +<< +/Filter /FlateDecode +/Length 4421 +>> +stream +x\K$I ׯ3aKB+J4bEZ8*WeNOҎa#3˝-~qٙK|tdM +jEe)d+1OBdR > ./?mw]8듰L)٠ +X֑ +CTX,1BbϷ1䠱 {V-@ k,JH +Yἵ*Xf +31_T^%LLxCx YBNx)'! E*H%⡝2dueYlN2dfW9[Ld5s&6II1)<Y EA@k<,rVՋw%d>ʃ,| |,6E AFpIYp次pJ/p,I<4 YG AjXC1f]@Hհ 2.aASyŸ+~ -cѰ wHÂ|f kX5pb5,] AqH4,@|3tU^1aAf K4,kX `aAlJJQÂX,xHT^4$ Bd<‰5,@bm +aA򐅼װ yȂAd8djyY`.j}@2 )DcЪƋVy<4,H BӰpz F% x5,HU4,@(2#3x ְ.xiX=dA6aAUf B5[3TQ *M ʃ, ?Rl PD ְ g/fְ gװ)fҰXȂOÂb4Y8xjXP\FYԛYÂB&Jo.+e/f^UȽƻґ;~3T m֖!:Q =w}VRz +(sM~fIъ M?@{3ryG1:E>>^ ;'YGSۉmԦўyݑ8o:_ʑw9Y;&S#泻;DkC9=aL5,Gnby?m@ǡbBaܜ؀C&[bQ܇ $o{ae'.ȑ="9Ya[ơ.0<okag6M{VJדNJ?(ˉ3-MpnV,.d|Q)eoRﵾ6Kw&F"vg;KKNQR$;xb̤obW >7Wzxy5x,6R<蝇̲+-- /| ru1gId}]ɚ‹K'm#[Y!I4w`ƅ.o&c©DG?m6=[LfK/ +|ϯ-Kgy2i{`y +d)j}|%UZ>rPtWXM>dirVzǤդ6 si.9B|C9Kz| ~<tVyۃ6* Ob WO6qgX]lhIdu5֖ڿf;#7q>:R;Y\+jʒ4Qmo'l9)%r w~.<ُCzBҖ5T^eV9CjqrTK^JjݟNzy;ĢyEAo#jnVcD:Ki"iD&NdsZi5m%vJdž ,'УyHĚq;N݁U0ȑvꫭOI2gsX[z.V|߂E'wyWMYB=Qѥyr %qOdrSudumM27{Hm]GJ(}:-mup])zwC}?]۝}nk.r<=ԙY3L[Yݺ6O~+yէ6>odi~{ځ`Xe,H_|@p Wti+~ tzZok[^oӬcֈ#r7z;ƮcuNlG|6ЛPZo4~s_ƅ/}uNz `~g.}5E~*|߇㰽G;WCΩAUw6|ϻ9Y^y0FU!gZ>R߰鎆qZ/XQؒlig/ȃм Ťsoy^ݷͰcq}~>僧d$Z}]ݲٞ`H (LwMSøZze*ķ<ޭ) KݔT#gGo9rw=u#9w\vgw5&5|{m?b}Gdmy" TF\*gy/+[b׶UźG~/HV^R6kMl|[ɰpM~9ɷGBF~},vp.{ɔ-v8N $;jhj߮旉"zFwK[V|G6^.`w'yn;w [dyc{b}ViG 5E{iNIҩ}mhfvkB͐+BvhTZ()w+tJ+&>nr(n r +=q_N!) +Dl <|k6{&*S?8&%1f'o4cG48\Jfg}dQ ]cꤲJO@ǖu@XOʙhnC7 y'n2رe&N^q'oK l|MmA& 0F_*ykG'q8q/O5y +^ +8mߝr^\⸷-| ydMH YLDˣmh^n#ܙ'M +-DKfДpT> +endobj +661 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb116-16) +>> +endobj +662 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb116-17) +>> +endobj +663 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb116-18) +>> +endobj +664 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb116-19) +>> +endobj +665 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb116-20) +>> +endobj +666 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb116-21) +>> +endobj +667 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb116-22) +>> +endobj +668 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb116-23) +>> +endobj +669 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb116-24) +>> +endobj +670 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb116-25) +>> +endobj +671 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 567.702842 101.433071 548.952842 ] +/BS << +/W 0 +>> +/Dest (cb117-1) +>> +endobj +672 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 194.455821 101.433071 175.705821 ] +/BS << +/W 0 +>> +/Dest (cb120-1) +>> +endobj +673 0 obj +<< +/Filter /FlateDecode +/Length 4933 +>> +stream +x][$I~_–y"00g"g_d%*̸ٳ=/̺w$r |t|RS +>џrq:ϟH`71_Nguȓ~'41gI3|tmUfΘ$̰.jUeav +f죠 +vh!9kSӃ3z +),"t:Ig^K<|tk甤-Φ(l*Q[LVEb,l-*(-鲝|NΉ J1muF'kzuQ-A,`H: [$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a +c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& +%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ +CĜ"52cX8D}1+|ge6< R4zd!/'D+M װ]"QAb_rR4b͚Ƥ&~9aJ}O;0ђ&U H~DGe oT"5ʊpӪ`9+c]1ԭK eWyNaneNX(C("RL6x !.Gҫ4m +R2PB؇^rB]:=ޑ{ydRN?m$ȫm xc1y#~|om9Av_ye@ 6 9( t&gsʢѝML0\Wɳu]>T[= +k{A<_VhmiuQh7;[#: g5I4hhvNrK]Vi[O^)JӆU| {4(-W@IK}/w=i`J;lhmxD-*߮Z~jߡ~7kd{(kZTQ>EW[G tQW+朞3U_e-?y6ᵼZtZkXBiYx% 4nvLer/p<'|jUu遷c +vR2wI ԜW٥} dOڇn#W>v3+1"gz Yk+KuO8}e&i務|8WJc{$(ЅYhG'DQ+賆F4^Td贶BrxIV~JtsYD.uҏe W+aR.pZUئ:Uk%,|AJϷrT AVn3J]؛2B{烽!qU3/î[Vin&yX9tB K51b}~n~_k>`Z$kk"9Dۤ1y0@rיs\UZX +a岕lt%I `/Y[Wx3=T(>.ѵ"v5nFYVΓtkVjgٔFqc8Arys6h2M9{:XVqx(K\y շҿH |.QEYχo7|f ڒȱԻ.kh;A6~7U˞j+ֹƶ%˵4cQA ۚ/Vcmjf I7J=%.΋z:zPw%KYsX#4m7vBy4ˇG{c(ynjhyV3|'m r$Z{|0!r-kc(IiE,B5"宣Em)зFYwoI7|$x0!y?k5O%u4pYIGMV=}efN#f$.ܠIX}ÑWDWК^<Zcԟ.{6[^d$G?4@3ʣ -5j^ѓ2#[s0?\H8G2+hVB۱<:Zy~Pk~+vzPڱ({"j">;zx?>[_R׽7u&γьcHT/`t4TUHR}biu ZR)yRݗ|4(K*܍y ei?v_WteeY9t&T.\WW􊽼yMw"!.d:~m޹WP_Q<c׏ȼ{qCqyQ7o2;:p0ϣ'oЁ38VZ_䅲Vi8{sJ[KCmv?/K=gG3p<RM6(;lv{_> +1<Y_rj_agp^=vĮ]=s޴v͡}q<BΗ.Η޺jwb+\8JhGry(({ }gA5ͷN`Lt-"="fp>P=|a](^fcu9_{{B]֫)6iE;Me6U͔G7{$ < Agq7ԚroNe77V{7b^.mtS(-*Iz91YIY[7X}sOUB젦\:Ig7 +=T'Dotqعȃb֟tB]UJ'U, O[k(oINDڍj{K;B?|ĦChЃ6xzY=ۃ14FhLFJ]-*mE Tc)l-IR1Ő{^NW&-f-y8ZFK&Ax.u#mmnYwmϬnFdF6I*{(je'DJLNGkly˫J!C+:$\# 19kU^ل(m+WΖؤ l > +endobj +675 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 548.554475 101.433071 529.804475 ] +/BS << +/W 0 +>> +/Dest (cb121-1) +>> +endobj +676 0 obj +<< +/Filter /FlateDecode +/Length 4764 +>> +stream +x][,~_Qφu20?1fه6KaB[*2ϔaNӧ+#t>}2U**c +^o?\~HĿbuopW%mN% Br:Mc˟~u:j]TֈCQ%29vQy%p)q*v +0æ8̰ZGFaA* T0C%Ci)Y 9VǤ Щ91tIx]t$s)k%- + C5(z(g[k{6W6ڴuuEО%Kb؃YyDiLMAIJOkbYovO?\~?}ݧ?.oQk׹r}+׺\F$B"4E*j9-eڷd/K9]TW~':Jszo+VG6Z_]~i !䞬GF^ZL {kduTi댦b_*=gd')˽Uz>n~QHym8\u}Ď%zx抗e.,w=HiObW ҬiVs;eKrCΌ0Q#+e+n}l1BBMU{xcn!w›< 1dMb!ɦl?zT>fp|K'ܭ0y!m,MV +C*vG'ͷ%jL(y{֞΋g\~8Y͝gczSiTMaP牶Ly[8gGzvF uk+Jh*Fy.oq둝{}N=5dYc7ȺomHŠ +(h_Pm'_<ِGϵ o7 *vY)M/ k*oAE_/m\wg9ݐcwm}$hf{;~rݽU޺4j,ddTLuS[<@|,>W1Lmcmv BC6TlBy:]><㹗_Ρ}Y<(庞G[;6*9Zrx3lHj+xbܳ'8M|e0G]y{>$CNw<ċgu5di_:3\_l)a!/h}; u2ӡj?x}/D^/8&wyQ^qX;:p2ӡ`鑝3{;8eq2f L+۰97a}d=? q@Hݧy `]NmPvY7[Z;@w2ӡ`=K֛Nΰs)&v驝}ӆڙCg8 KNy:_'/=zjw\c{\;I+Dhs2! ~8FG{=ϊ[M[-sDs ~xklgêa//=lgy9Eu>eq:W5a~Eҡ&^5P5˗E8 5/qXEBo~6-Be :?I*s[Ջ㩬{tۏTXPz+h(+Iv wrlis7%d> -8z:L2bkqb d70biNi\=l8^Z>-}j6:ʚ3ݖ!rzKN”+LghǴPn+Cu]mGi|6ǦSC״S՚YJZTm]- F&u5e.Y̦zN]ɶtcD ZO*|7C6S41"Mep76uBo&KdfѹBIye~+F徱Z@ͥBhKEɤ'm[C yDRC.-23-Cvu1btƞ$pcVVG2YePm%[m|Ǒmb.nֈnIKVע% 79=e%##c&=mv]w6l7TlnCVT'؏ކ*m=8b쯕lWDZXCXcdPx PcPT<>[-=RP9Y _P5}7׷S)i#u|Ž +endstream +endobj +677 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 676 0 R +/Resources 4 0 R +/Annots [ 678 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +678 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 570.123057 101.433071 551.373057 ] +/BS << +/W 0 +>> +/Dest (cb124-1) +>> +endobj +679 0 obj +<< +/Filter /FlateDecode +/Length 4781 +>> +stream +x][,~_QφI~e` /~0,}zmxJ]"QYY}g]BOBL*|_rzI)ய?^~%z%梨ZxCI`71\/o/oA/Zu;|$pn%nzE#%0;^Z {6W63uuej"-L~0W4Xax0 ͆O"V>mTZXw%3hӏ_}鿀Oo?B73=>0ggP"-U_k;7W?[=e,e4{4ikW#(;m>iMR?_?O[uOASb\/?j9BmrWw5 ^nRa9w'֭۝ff]4\B1K6+j!Iw?s 1M1$Hކ'ZbPn[wtUή# QW3XeiJT[cwZJ@_v3kqh8V' Akod,%|ȿ tb_Ni#;Z߰C|e#u +-Mu0Oo-be'_P*mB; Z76~6v%z4)e'y˩Kњ_7kL%b߯|_|ЋBHڃugtg>{pVr +Bm 쭀llNVAF~n"rwd'YUvtzF޼ziv9SpFq5T؎O2rkB̦xyJ7s)#4z@" Zes'< Gh_BVYIAw^E]6iݦ}/w76\ȱԻ.ͤc$hfc;Սi[^~}ko)NMӐ켃: qoT{ kK]tjw%[Ys[;!0X"8{=l^~9gআu3~Wzʊ6Heľug{|.ϳ!1Cs=Y~B{w +wQ[Nš=(y搴-iXxv?|cDEg%|#W+A23^&!ݔő7D7ݓy1+#,{s.d$tH˾܎k~+3j^ѓ2#9Uz▭FF݌1G@ۈ={h;īs5y~FG`!z9Xn56wZ"Kztؼ">O2T)n3we7vfyDZ/Ž{Dg'<]g#cݫG3fLT#ǐs}LGQPU"Zgύ,e< ՖZNɓ]ʢye<ʎc0J';beН8Sm{ezjzlhJDZ"!!dt#tyNy:T:O0#謗F?0tu/GdC/yRjow7wrOO=[OO79{C~i~7luډ9t#{Qoz<φT]uQ|rLxB}hVIqcI%.'G^0C=(+?fsAc:&پM"s(ɑ +u_-A1w?FeoC. 5 ++QZ_atQy[^Ϋ"x~J)ϑ5]s/ټƞ>Liî~rV.番m@kp m|Nnűz#g9 X:(t#*EgygUɴ!~)N;7#&azYN3&<~Q8^Z-[6:]ͩȖ֊!rSբNBOWBv(X[ń~/T!6٣0t:ͺ5uj,}tr+yר.̨ܥz? ׋ F:Y)05 .t"SJ#kn Ye찖Hځe׭}Í _/8~p z\hY]ːҙ`7 &3*|/uH9jTBcNYI.]:ƎY/HH˘T{C:wsq=N Fy 07k,&V< >2&x{ىD:4^z)Ӝ9j:cGYH;]\q:[έ1/Rb M؇ hui}CCǍa|Fv5ԝAur>dbӡkeɋ=Ҿzi[:Y \cJ"qEIǔ3,#.xdaL$w+,.XAvܘfyMVZ 44o~&6HکK߹7d-a{[hwxeس=Ccns1ʤid <5٦6QtL5Y/16BRZD/S _=D{%RmђpujddR7R&uʚ!aDjd⿏5ϴ j?e'Dq 4&j5e/B8 %5p㽒H+5;gFl;~-+I9@ +4v;AƲ!/#-orY +z)|'ylo +endstream +endobj +680 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 679 0 R +/Resources 4 0 R +/Annots [ 681 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +681 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 573.873057 101.433071 555.123057 ] +/BS << +/W 0 +>> +/Dest (cb127-1) +>> +endobj +682 0 obj +<< +/Filter /FlateDecode +/Length 4741 +>> +stream +x][,~_1˺_lH~0Þ=gmžqZVY]vJRUSI֨ +U"=?~8}t;&>ӿyYV{bY#B A:0,Dy@SX Mq,a +B c2[V:(˱ J.0,%!R<"5)'<9VǤ ੠91xIx]x$s)k%ǃ,,X 0ރ (Lh%8J> *&a$Tƙ~ - }w1P p9, U#5*$qXw +߄p]L1rX%aFa!#GRDabxOxtpX"ayDam>`UH x]`aܕ2$ ":Q/_Woqu\>x\?ϒO6DZR'S..4nMv*|z˨Aޚŵ\mC-ꠥ)6ίy~Oo=ف4BhD,sDz|ҮMjۨt0_c4s*UR :rP]FE A1.w1E1q KֆM'ZbEW[78t*kv-)I NoǢ_6c оYi)wdh1[ݶohRIrdi=9l_CAKOdd ,/-".2^u}#-ٳSZSuw?٦6_6gV]z~FyյA=(us;b%z*se.zLU_K^izmCܮ¬,wa-8u%oAEUoSt.Gaݞ]ݥvzD˺pV\ҡ+og=飓>~~ZKZ_ƌ5UܜOћG\3n +5~㭳3'miK7c*wI[##fQ{ZzGo;J:]g==뵝6MZ9߼P#GWm[9W)n_ֳ^7jMVku5>,u䇱jRybY|4_ocy~{tcrډEa,˧ υ`-`퍞9xMoΏa*⑗6;ڏu^_`D=Q/8&wƒyΣco02_{a +<=z-;Cfҗvp0KIiiܑ_ ;8;kb7m^;c;Cp4`=`?KWyמ]:טwҊ<69<jO ++.pp^ϳi)~,lÂA"O}r8$Wܱа=^嬦#m(coE:}+X*5w37$+U˴^WDu?@W~u~O.k붃v+7Pn#GS$ +]=@kTB|ls):=Jo6ZI#7Ա =.BQ_*J&=nK4*!Uxɪy]#U4 +:5W~^uU'[e^ Zv>,NFq>_y`3\?J:*]0B'w}[:;ɸ)s8Mg(xd1R"ͷɞGI.㸖 -ty{ A2}/D%n3`Ui]6k=eR5U;]@u2fqb d>6}^nMm AVp36LC}H!#nBq;Td+1!JI~;P]FЭ<ۇٱJ˭ 6XUci%#'۽k jF}aDmSM6|$B]C,3=ӂ5zhaW7سnVڪ:P4MVZ+1T|VՒ[Y-StOhD7ZoRukђi9ɞŒ1wڞTڶn {d*{6I"{IYL\WBT/c*mi=0W"쯕lWDZX!12(f4^g0uPT4>[lnSaNnVW˼ nM雰 #HşIDIS +endstream +endobj +683 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 682 0 R +/Resources 4 0 R +/Annots [ 684 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +684 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 558.873057 101.433071 540.123057 ] +/BS << +/W 0 +>> +/Dest (cb130-1) +>> +endobj +685 0 obj +<< +/Filter /FlateDecode +/Length 4776 +>> +stream +x][,~_QφIw g1ه>=6Ka ns):I\%` l[1[2H\`Iѷ<-> ؂HQ0yUIZEt Z0k Z" % `t$. `H\hӰAtZh` A Xez%qfh%jIGיQH~PQ 4&$.@bI\X:bI\f Fbf )؂O₤aq蔒 ! 0.y%.HVa%0n $-!-0nIXo$-&{^oF f`^ vx%0"2MD^x]@|&+#8c@seg@F7 `&VыVJ6P_cuiܢC72aXdr &_SV4_av5o=e(6} R7Q˖ɏ]6vl6*`1AR=x(NXcu`x?AZ{jJ<_Vs7FKu;ƾ^,سѶ՟C A{ +Ė`vbf+,zl +:H&o?]@ŊuϾ]#Ә(~?>'(ZF/s\rֿ#T [˫IoSH/k9mzlSB9Om~ױ}>mW<+X0Ak1׹,_R:UuRqσ +TҸ|NPǽ ];45K R!+;Pm[_l4'COw +p )w!Ny6a}c#:{tDȈ4шj rPwraf`߾G]e^LڱűmkZrѵN'Ļo>^uRxe2rn꛽;NV/C*Sc\mضrP|Sۡ6!ڦ'ueWhY,}&*6GPx |/Gv~ʾ:O_e;ToGf3m|!^b^G[3 +\Ql^A>5Ol-mm^ngƝm>ί:J_nsnGXr~Ǎ6Wn.3c;bAyiVdlw m<1۱{cc^'+OqWӻkW{fvۏZ?: +gn|9R_o󢓏m<Z5{adĒ(1DCx^BvNYaJ||6UXi8wm [˾=.X8"%{)f${v~I}&΁żtw=dm\伽!a +:6= d:u5LRgss85>'%b߯x|_ל׋jHiĵKCtP-bP (6A'')TifI|(,(_j3soo8nFga};ю'ڸ=z|ؿ6Ҟ7Hҳ_lHwbٗ89ȽP:#^=i/3RS-nhd$]9JF['` hthqy#~׆P NQfkT)n3woǍƧi7{t(<5)6L=(X5}#f >;z8>ok^=6Vf2gúAyLEU[_K|u5di_:M@\_l';n]}ɷ3l 8y6韡w?Ɏ:er$^گnܧyMDZ"s@C+#u2ӡ8x}Gg$Jܭ{'<c_`fy =~#'C'VҷNpcg~4gwPyhݹmv7~~(~ >t/DZ6u~(x'<zg}ɝR~x"9Npn=n=upnP;s>yi~qΑQ{4̝>esZwS~B<qLȤKu]wQsK-yܨqF͎EWYnŐ!/ƂI=^_d_GK7(m ci#> +endobj +687 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 555.123057 101.433071 536.373057 ] +/BS << +/W 0 +>> +/Dest (cb133-1) +>> +endobj +688 0 obj +<< +/Filter /FlateDecode +/Length 4596 +>> +stream +x\[%~?<,R1ؐ``x&vZV׹Lg9t)U*mKdTJ9:?|U?_g)*orH3\T1{\'똳U9kw"bQ{ ,UsXGtdEA9y1$p;2İѐĂ&(j- &rV$5*lȋh%s*D2HB>I<,>k#yde\MXi Z$>;@iϧϾ/ />5}z_뵭qh68|hXh^kϣMzZ@Ez.h_deuv#eЮק?;KYl΂mcB_U-*nTvr'hs3{eNwڏLkty['HsC8nw˴nL~uW;q,jXy6U_ks6zۢtZEg=`lZh&p-zBɺC&')*7m*/+ګ~+m^ήrmea6mz-83߾\ۧ˸0}w&:؂kgMw.ͪo5kfG=!Oj~FJKSSE(C^e.X9qm$fc:g~8oF c;vb"OUdy^,c.Ұ~cArxG{o6ak}t:5>f#Sj;WoY|yrs\ثN>] ?d.hmV~<&s8ʭmnz>KOF1|Aouieo/Lc'o []ɮyL[Oq{*:ynQǨ6N^O3ᔩ~T2#<~+6~ ?[lYud^ϫ|t_Tju<1/㱓?aS[=qkўo|x]ֳ\WLl6Ƨ!gT.yܟi@vw!/{m>S|CӶ\j2>zSeH295.ȸ('?Bulg%9>8:IyLJS\tO&ɘ?Gܛ6}c(s{~Vj1^djt^ta~&>c1(o ǫ;Gwy[!qwy=SD2*Sg6u)mFaV2'Z:lW\-[ BVmJ] wfnK6֭EV?wh]TaX͗b&6ݷ j>eMzH_UxuR3>YAܤ$¿].%TDŽ:g>UtZP`Fy>GW:df{qS?tuV ir˔j[[~,nv7lqy&WE\8{22l>mpJmHs߶T-&p~s?E>:LH;$O,^ád]eR*g%^+C 8}//H(y:➷+\Zvs<ː8.e>w0]u^ ZZ(FbݑbK:s7N zgXNt5B;kMmࡱcE`0[z_W*kb5`Sm~~^rY"sG:.;#}u^'ikx>ZH|V5]srq%CҾywyu|=? } J/;:o~X<[.Ǣ <>pgW7rهqGI/`V?ZxAv8g|Y܊QK43gyFI$/[v_mFHXsK/_$Qd&֯ELkGgTy-|{:w:W0V& +Tֱ@D`dViIz(|G4 7D=u7Ȗ<߷U>LoemyxBn>T~kSkiNsPS}+ BN$?խi1;b#HVN =r5-{4!put3 !9]')nk&S|Q(Vh\o&NNzˠ7LF7 *|2/K?f'4CG4`(Lgg} t؎:lc'uӱr&&d]yGr>U3r/QiRb.S#KvQ\N!NLvȹzfS8ktG#M7ZT)/̝<=>UfS;wLcj> +endobj +690 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 367.323057 101.433071 348.573057 ] +/BS << +/W 0 +>> +/Dest (cb136-1) +>> +endobj +691 0 obj +<< +/Filter /FlateDecode +/Length 3514 +>> +stream +x\K$ I $``#0rxl9瓪jcf.zD#w$Τc-FeOGg%rH8=p|9]srÿcܑL΁?ca b^aec彉|PXb b($1$' % Kt|1\Qa9 9Y aRxΛM )SVy<I1y !l; p/@lUdYEB؝du%YlNe6>')sYo|b9aQPR + K><ْc"x 1%[x7[vC(*@P,6 AL%6$i(@)5썄5`#[%hHqoƅ5,]*ְwI`AD% îj@&EK๨aAbLkX7%]ҰbDÂ! \E"sItsNÂD٠`5,@F-xbK4,HLI5,R<а)ŶװM9* RRn& R,dIf7Bd|dLI5,g%ԛ$/K4,lQoS6s(f԰ dHQTdAҔ&:iY(9Ro& fDF RoF3Iw @V-Gg:33'[# EꙁI=4,SPO VtV=6_cr |D`13rn!{1n/?xB=g8$ P=og⩊^չ,c"^w< +Qr_7#nu d<PIW(_pG02dV6~wiR,9W}8|_}0wχ`aK_~w~{oTp |<>Oum'뵜V#^A﷙kקe]nFu+4W7.ѺYF1#N*SWQU3ƅJ&W6ܰ;JLƱnY}cβ盛/L[li-\?絏s}t4i[t6I{'hfc#dK彝[vߘ~{}޸ǣٲ4n}$zlw\ vzh+fz>ĥ=6r,?{EU)eH$DVQtPփذBQXu{7@eV+lT啍*)p]n˯RTSZ<)j]e|I׵'y~˽>B}էmSyĔ蘏dY\SF֗>^{{<_\^kU.)_\nyVrCyJ \sk;&{7v}rY}V}:q}kYX!bdpr͕\SKVdqL(s1x 89N 2IǕօA[&'u^#XZގiS%i< ;շ]!NmS 3 15C/~ +tP{14 S7^=Zx;v%k&3{ |Tz7ӛ<{Ԓ/WpF+OhZ^8&UHNnLuD'qmv/ҿnwlCl+ cKv:@X۟36! n/wWły9t|ɱkܕG滼}TS[dh7C0 }odZ=~>0G)"+oY;}9~9^8َԱuC#Yy_8I.7bwH2 4f =Mx-czsg{8.9v_!vOKa.7Иo4xYȡy@vhԗoP;TͰm:c\<$gH-dӘmt1lE6@4h}d +밶-K~JD?k%-׳% 9g%B Nѓ|mٮݢq 1̟|w1SW'!.tE&wŦ!R^W~Vr~"J敠#6tt^ȷTòUoupmsF9 B ތT,1Kқʋ:h>6'أ. +endstream +endobj +692 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 691 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +693 0 obj +<< +/Filter /FlateDecode +/Length 4509 +>> +stream +x][d7~_H1o$@(BNf|sl9]}&2v*_WUn-~r3Ԝxt|&GZCc 9l'&lr>e÷8k[5yYL.9ۨ*XǤ3b bLYbP-QcA (1eYbHcA WcVXBUy\4 JO;JUe\/24^5)X4AXxDGd5dPK%`Ud%!v+UTd:W +-&sDfPyXQ,ƪ K kY?8C.EYWwiYϤ &_C I øaP/P/PA_T:Ӏ X)iHd!\YB% ,(aASа m ֢aAܒNÂ%뒆 1J"  T5,԰ tܳbn4,@jX@PSA@G\ p785, .װj`I؊X % 3\k0hX@]1sw}^zIX5B@a3a*ܟVƕ4,]W0}*qeBƥT5,]8aA>x5,]5pj5,] Qq4,3tU^5aA 4,8TÂ܅{$஍!hX<װq xXʚFjRhә3΢X@ooU ,*{9i1Y鬺m` 'E`>ddŲ D#…bؿ~{8sS6"/R4fWqm' "9{YkۮE#(btduEwZZ&'1A~: Y@F#8$1v'yIPgWS;~Oo1џeS Um<Ωvp.%JTcy IֺjJfbY7, p[2gϽ,ޝ7&4[t?XFwݦbBV7!+LӴѝ$JJ jjGm$ #uxFY9OȤޤ-XX(bkom- 9/,ȷ~f I q7[ӒF:j|򼡼fϩs=u=/uSA~Ck}HyqY)Z :?8t_~ͯ᯿BP2"Ŀ[ z׏s_Qq&(  +wﭽҫ/_n}Mkǥw. 3t zog,h1,mD+~ON_zky`W t~[U&G2Hz߭N]g4[/OBZc|TS{Z{Kk7I+:1M{w!1v6S59$ci3dzyTZ娴XlskYӪn9Nz;i{Y럄%&} ZNf~Zm߯r)1ʭU׽^8!s<￭;tHڅwiR/yr&1>nE/?$gj+ay>]B. b|"Md^ck}]sabL12_'4I o|γ|/:5bi'^ՌG␷>67߼p<qSw^ =ĖIaMV>"Ñk&2 __o#m Yi1~Uv'RRUgej7W[4njȷS!~*ЮVZ w?dm=vj$8Mқ糓P]8oyr +U^XYdTL"مctЄKAyg+uVУvȸ.>8];|K`}}w7#e`7Z[\ZNf}òEV . Lm,/"X1>_;6˃ZY^G+ M>{&~eeSǰU|f>EFMoD /{o JvgΫP_(9q,y`nLi's8ǽi,!݊,zlg'(2`"tXL{;n_JXJ=wZ޷'[ᕻ𗤧r>{~g_s=R"7#-rVo ‰Y}$s>Hg_v=GNEϿ\k<0Ѿ8rg`݇`Ɛ#.[t; Y\p3ha P|sz'~G*U!sxx׮tOZ̈vz#~ESll]s -}>vkT|-1'#Sl ק5źㅚ2ϣz+[&q2.J0۸'?.RRD3Af֎ȍNp]I8y{"h ׏/iPh,+DḶGp>b(8$Yv68+$`1n=uy5T&q.U>F<mST*"ٛvЂj%DŽИ'ߊ;#~e{ӄ|1k|B,ݐhB:rkkqTʬZ(CWh'[gZ-ӿ1׶g+7!Klj6vӓ bLj.]UX7 TAeio o$iipgY.Y/WRAwP=.- dhn0 yRvt08ڝ4IqW yG;lw2o7;)@a'>5r_v.2847C%y}Hw/<+vغ!KOj;|v'e#O+l0iV{I7 $ƩCAt B3 +d~L<>8N8R.pX&/L|M≋N.yQQ<l#&d'9"0y4ݬl(DA>ȆNFEg/<ȩh'Ic<c>mrҘm +jQvJ;N-.SZuUKy(ge(1YIgeFF99:;KX($k*͒m0h +fdjgxVY~+]+N+2K8jr9>-)CTu\KQ0͎Ҍ.6C4 +^ZuH)@ +0wvkj}6cToϕg{Nf_̀ +endstream +endobj +694 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 693 0 R +/Resources 4 0 R +/Annots [ 695 0 R 696 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +695 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 563.554475 101.433071 544.804475 ] +/BS << +/W 0 +>> +/Dest (cb139-1) +>> +endobj +696 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 100.307453 101.433071 81.557453 ] +/BS << +/W 0 +>> +/Dest (cb142-1) +>> +endobj +697 0 obj +<< +/Filter /FlateDecode +/Length 3420 +>> +stream +x՜[\S̳A IL&rsN_f+l4UuU"Rsλ=-%.^T)N.⏻Nؓ5Q>J咳B]JkT0#f!9We!DK33XrsUX*j̆*x{SC % zt\*ЅL٥,!KW]J)K'%V,]-1xK[Kt pbo` ̖.TCW` : +/G t!dSIJlI>VS["{t [/KNDΥtu`"l!b` &"%sK(g'ĂvRXRF'ft,-QEErMl* ` +X,`-$lA[X,`V|  paX .$ ȅ+U 2i],lA],0RwYX .3j:X::-gb̪&GxRb@].;AX .E܂],KBbŁ?] $l`- CGl9BZb "krd `L]u!cčuQv!j Tl gX;DTXԖ Tł"o . X悇뚺|-bAw%X(|IL]vp`0vył"W bAw 1u Y,@^:O w} [:p\-$pWæłU@b tȂbA*jbA:|.9\GC,S[$$֮r- 2&X eXՀ?؂LbHJXc~ jkSW bA\X;M, X,`X,@(r[[d[,@ ] +d +2X$҉}fXP$9M-`` R:LX,f;Z,MlsLl( J!ndlz؂bAil{57I,`]~X,X7ł*%"E1uIS5-&dl* jJ, f`<(q+d]db.Dfk=33[YtYFVV<3CeI*E>&gLXO#wȈ%MV, Av_(w_{f9)ka)-g,;9!ӸRa3 ~onw0{jzW4|ؿ_ֳͤmck8@ Ooo/bd}5cҳ:NZ0I݄ͮk?]ƌfdIi㱃-xb/mq HbpB+wlܥuE s`BNqz4w#T +w_x/k9ֿl2)[ߋlF9LZKlaZݥ[֠mol={8l?JW۰9o>_~zm;.r( _QL^!%3zXs!0F$'^ҦݹЙ !bW"YWN:̇rχ[ejl;WeJw. 9bh:SR5 9y!3FxsnHQ > O`sB3m44OYudg#zFzozU{_*,\q:~*{Zٖm>WS9mm+w)wc Gm|rg%d|_*_LK=3d҉|ν':^hR'L~Wچ1mu%#zuJ\6X|p:pZ*'>5tNi[Cm=>;j?n}OvP!{8ϻ<kIzS{}\xЦ),j.ߊKm_>7~b^&.Tq:@ׇ"..q!qtX[ے +vaӒΡd}}Kݍ֏>l cC) XPoWSѠeGMq`? O 1I'd}v &<-JM>ܚjKx2vil%H'CtW5-̮fMZ9r3DYnk-ʽTUkapu.} 2F475L<3ڗoLxE+qw1`f!Ovq_6TXMK<˛ ݥq5:ѵǃ4SX#$p7+t{>bGi&y.Z;{WXdV=~-a8RśA/dc{k;-HRkj$$T4}I R2<vV2ps6z[15;Z-=m.>^n?|gu9F\e֭~E5-ͺrt|@ +endstream +endobj +698 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 697 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +699 0 obj +<< +/Filter /FlateDecode +/Length 4776 +>> +stream +x]K$ׯaz^`v6`tc/))233[x{#RfڣWeS%E:>>̔ZbuQo +Gk(M#|R .m.ew:k]TJt6Y䧔S2Aa ++)%ŠvKX#$rg%A%1ȹ2߳ +pɒƂ !N0E(=j +Ӱ wJaA"n&@o50]W&Srְ wKN“@&հ`<ġD.aAཆkaʃ,>; ׀U|dBw k<1hXljX\ְN1TRbCȧaA2 @ʃ,HS%kXdiXdAȠa"XDjzY`.j~@@)" RǠUݔZelҰ %[ KMNa~pI% R,p M!2x ְ.xjXdA4aAvYf4`F. Uk<2gf 2ʼnCE &4*&4,p4,@diʃ,>9;N79CgM7@D|'5,gf䛎4,_r5,( DmͤaA!<Ȃ(~ LB txB9 @^Ȝo&u +IwF p|oHtf3;[؋*{9i1Y`Yu'Ea kfN< D=bؿq{,S~6;)` +f +Az6 + ӭ,5nuעOAFZ +tl/k:\;ĵMPOb$r@tCaI"vyEPǠGWC;~O0џdCeYSUx.Ssm,{(hsɖS$fYEQWh]Ɋ1&݆l(1­ɜ>#lh6$鈚,+ e݆[rlN EՆ:u zt5?r +ʮQwȳNқ9/"K;O +,F,7{s7T'/]l/x#uկ*Wi!KQ%>cawYJ_Pշz  MD~Jo}<c c\6k(74 nߏp>f]  N\}.AsiɵƥpB"4p>7)l+Ѻ6Й7.==s*LoKYV.r-246>,mMfƖVuZV[Fj۞˚pDuMeD Cb4I3Uceq?Cn>4퐵Yg};7|@hߎY5Yب*wfel|P,V+m7nz/-WXAZp(ꤥEꖶlK/뙶h2~M+:*Q5\ѣZ{q9)χGeb;2Vn}.1n} +^V(d^Zt{n ӅD6޿*TcpdF[׶jH{HhԐl]! {*\ 9 *6zU/]^Nw~7߼ԖN-ha8‡66S,y<}EXF\$|6z/FUkQUi/i{_՞tH9v NR F#;|hYUmz]^M2gOM^ y[ e>=a1MjQs +mi7VM9> 0"Ez?.ay/͜h).oP۬H :nnjۧՐ~Ilb+?l8IJ!K~m>`r/Tft'h*%pVO hͦCᡋ>qcGȧeT˟0 /[~[/-I6ֵbJq'.7r[YZmuĪ/YU`G̥5D]C76K7'k9hvaX®㚶+}cl[Y~ӧZ\XpGS#+|[*\|Hk[rš=&.$$Bc庼g3:g"ʕkgYMeUc]\^[n}!Cͨ|XV\b*/qy5Gg/,:f}rWۜγz .~D|3YmcRv(DYĝMd3ly8k49_V +V~!˿w|h/šYFLIX\t,V$ڢѦe2v"C0:|?wC0#|hcq]-rŔk3i>&>,$~z>?.Ë֨.䓪r+[V&FzSH|XX[n7Bz,!&%3ǰOXj "y(G~h6l&[kgjl|꥖7o~7?u~-X` MzWn}JzhfC~9[H![{|4-NF;i >Lf8n'CGh~hdZ!_8wQ3=Go&MyU L8$Yv48*^%[o1Ft7ȎO +ױ#~eZӄ|1k!Q/WZ9t:BKQ4QNį>b|&}Mvv)-a` $ыv;9a/'HOpFg3TNe,u$ f'$鱣iFY.RY/D Jy^klE*t/7;xɶ[]'35tDӄ@w)C]5YCowcIN}-?6߈і̦['L_Fg8( їJnщ_>'VC]N;deE?:=[h^ǝh:r%7Fn#ͣlhq^Өn#\I C:fi|܌{mp|5?nI 9\cI>&qEǒ.9QQ\ːl%&줫'9"K?x4YtQ" <ЯvϞE<;EROzח}CC-/| g-hu!mTPSjUmpibj2ťZSKqVzL1?HM9+]AJܕvۊף% 9љQǒYEYSi}(AC8"S3]Wk|G}VԝcPMDc&xu.Ȼ 1&Y~. :C4ޏW+F} +PgKcꗉSE~7󫚒9ظINlk +endstream +endobj +700 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 699 0 R +/Resources 4 0 R +/Annots [ 701 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +701 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 512.554475 101.433071 493.804475 ] +/BS << +/W 0 +>> +/Dest (cb145-1) +>> +endobj +702 0 obj +<< +/Filter /FlateDecode +/Length 4689 +>> +stream +x]ێ}gy)ހ$Fag6 ϡZ*ݳkNJaUjϗ +R"x/-PIe{mrJcT0zҴVyA1XN3H0Y"^*ZϨJK`$2)+:q: QGVS^s:ctQ8lt[lYbtLduEo8-]-@W`uE:8]4@"t2ii HNauQ$-N`5Rs:[?GA"{AQG:A:DAt\ӊ##a%1Q0sYl18.0M%%|KR9 fJ GP.9.0\t1=kЮ8.0]CJr\@]cP0* kxHs\QX:qwuqw4xW[\rwjҎE$ wA!w` iqn "?fN +q\`*`X]ʣǙy^ʹqb2X.3p\XQ5 VjNU:J ,x~p +X߄.B8.]ВL c!r\X#+18$=9._-3 ++FӁwM&'@/Xs\E \>V-^B`AY' Xhbkbkx"*xlx[6> O0o1*sZfu:9.bqb)09..q\3SqS,E"hxN8ӅN) -9.: tЈ%՜d3H"&4&8.`r\&V[% B) [)D [q\M4Doj2śh$Mx̼ƥxs\ X(i̼'!;q:[t$ s) @ M oz6]޵L8@ ϖ%zg23 X[ٔbl@|S& `&"جU(d Vp>)*8x(vɏWS,(8Sii#V|0JLB,IFXT9閌ӛrUr4NV[2&NJI¿}wPg+.9rؘ0i{~~w޽̑')IJiW*W!Pee@Er;R TڋMe&^Η>??m濓te>gֵ<_-0y 4Fvƪ<W S,/%uaZ~zX;snz2>uelX^Cn\z nrnm۴K.Pݶ{ )˞A G&JDfǃudD:א܏ZݾE[2Q9h*Ws7Z5t +>Xp<F&tk?GuOuR_y|y$ABu9Z;#k f u\#h$=ͬ[̄д延چcH}skSЊa;~i?=4#Vz_W4zsAO]]sKvo +hcVgx4 wnMu&}7\qݓC>]I![Z\H=he™CScOnC { URj^i8/XG~h7[ff" }Gpᐹum;dcֿ+3q,̣?z96g=׉W|nNW=lAֵ~pv}h ǻua-jUL[=\֬|Zאn6-.5oS:GC50mԜVt2sw٨+|ǽlco3Xph3 F=E9E.Kt[0V|Du`!v}4%V.}:{ ]*nX=e?ؾ;po5(vo93xPvtݒ\ksLm>YFm;ډ{`_>`!s>MX+o ~u{{dO}~/n-_UQ/Q]9r|͂)v;.k5wbu;ϷtXۛbpme8dxJqOWgPڲ#_|umn_u/%;oo5#gJ;ll)ߑMs8D]n*ٔ17Puǝ:Cn_wn7yF]zuUNJ6Fܓ%WK*WS{ڰm /|}R;fR}!ֽ#>-;C |Bh.:CoMy/k;Ts8D~'HΤO2g5#7Xp~I፟ڴig< +y1b:GCo|OZ@y:Czԇ\~wd&.c $`!,}jv}aoW}?e8\`!'SFQbg M3e9N}gn3IM6kG bP2vl^Q[dFW/O77酭&`R' ^7<ѼQ_)YKOr-[wFhBٜ5e{TzSX:WT3p^>pZK_Yizdn*Efb\ qbD'FMQKoCr1cD'ܚ-#KPՔ +uJ3fOn4R䱖^ OLדLi[B Vhv8Ȋ*M[.05,( +[y +{Q=IEV +|-t`/$S>n)]zl!mK$Uc)VuE(,OV(8]ׅiTɜjnKU +wb_F\{K yZب'|*ֲvdRJ8Nӷ$V?N2Q靪Ao/ZЅ[v%KoF,,ӦjjhUemFCYǵnjuY=TAUѶB[]L3<:6u|q8IVᠽ3uI>7M(K:8hasX-[ٞt}ڡ0\AFCSuTٶ,)شmäړƅ=wO}6ڋ KBxLnyXsNy*mfԩQ] ZmV e慢d2J>j[+l/ST?ڞNUn^dd[8zu,d`d]TK,[Ϋ ZͮJ̝K.?S&DK,ԤPzФFns=WΈ\I{& cWۆ P}EPZ%L*Ҝ\e0srJCBEWGҫӽTljh~>~ } +endstream +endobj +703 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 702 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +704 0 obj +<< +/Filter /FlateDecode +/Length 5035 +>> +stream +x]]$}_QφM#5\l`c5nK}LIȬ욞J>"PJ_~/bL始SWr. 䣻lBr& I\0TV}F ,wd]mw78 Im +eiR)F xd$.T0HZJ\0IUZ OQ0yЫ̛)е( qA4k "& )K@ 4I\tTh$Nt!Zh A Xez%q,4֒jIF*3]E 0MS2N,~2GAHM^nF b.F ͼ $]I\,qh2$.H:biH˼ތ$O $..(.p0oIXo$.&ތzypx%0$3Mx^x]& c^qF1b@U (p/Uc +Hbjbe5YP+1lh s􉇨<`3c70-}[slv'. {?/(  +$ qgǿޕ97RWK0[V /n?tYYJapO Ɗd+u}w*>hYGI.慨sp1Jۍ`mX4s@VlVڶ N,_8AM?SE>Pa<|: hӏ_O?@_K)sٙo\/XL ~toX?5y 2NJSC{C=99D%ooi^2Uלn[dZn@鷗aY=| n\S:ű%>yI+_y:@z5~v δUְ"mӾ T0w*0$Mv@|̳YCm$r4ue4LX7C +⨏p6 +eoMki"ǰFSj{??wgϤ'<Ky.'CȕMf\";9<8HC;9=׳q~>{QKl604?bC\COa-ֆ^:Ϭ8^|}.3-΀m(5<ғe WERr€ւLʕ~/޴;D\x+iGU4MRϕy:_knmf( nGu76ܯ>'<Z}6rk5!Uad! 7Uu]~5%[3+efy`O }6Ȟ,t>_G#JhgH=?CHDFGQq!5;-^[ 0kg'UFUe ǵzv!#;lqakRK,ϸ)G =?ah{Xڴ۲+1@d(`M/ֹQX7uffrlh67sgԅ띶 ^5 -ϗ?T:hQ}} {NlW犯Gfk$ZW9Vo:`oXIRá1S.twKXзe?1ewb^ϗޫ/-=QqΓӍY99{IY q^^Fne EWOy6Dѱֱn{VwF.Gq-2һY}AV#pcd? $ٸk=6Ѣo~Ow,nkCq{!~cu%{ 'h?7Um.S;֮N+ܗ&}cqroјeqn G[m%mֽ~SmyGei}3ýVs~~iޯ asVb-u< fCWZg绗ӿv샆tj>˓IWv}oc?1 ^:F%ly'\a6N[NytX\פ):! 1Pma'C^V>5Xqދ+L*}cػg ^Xܹ#daDMG[&)ƺ7)̪H0uXtKX븍E9(bSXB/krH잓5-=GrqU'2>7uiq灮lPq}28]~ӡg<҈9K/rxY<[ձ_YGP2AjB25.p.˖F*w@Fi[/@y7([Pe"HZ'06?["iYOjy_F, edy`ô@c^V6xʹR|\aCYm*^6ŗ3?u9Yyx;&1ӔʒäKNu?\7l|v>p #XTNjN4/4|U).HH&[wsQ!V SsZ7cΡc˧Tl9qnXHDIդq˕o +$W MVDMTl ĭ|Ollk^"ͩ1MLתj,S*TWs6NB"$~jՄlr6j491V Q˗j>!v-6R劽h=UPuvc|9l([? mUd1Q=ₐuPB'ZVoK㥧u ST3U| CW<7[xoCRh +=/.B,/,t[cTe,=^&FdPג3i\UUdנJz6UjyZ=7|ɡ·[7}[ 5V 6ғj֮7b i$ة|L/L~Z[{Y/-~BÁg;nTc Ӹu-Yfx29OMlӆ%bߓuy]EC0^\ub9ucPݤ<>dɦAhz$ކ^l׎M77JWpol7WV%rn!% +WK`ꚭ̀䍴 +b̍ȗ˨Y^uM+wWL7VJ?)?0 +endstream +endobj +705 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 704 0 R +/Resources 4 0 R +/Annots [ 706 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +706 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 307.623057 101.433071 288.873057 ] +/BS << +/W 0 +>> +/Dest (cb148-1) +>> +endobj +707 0 obj +<< +/Filter /FlateDecode +/Length 4670 +>> +stream +x]M丑ȳf6|*gʃEQ)R!*RfV7wR$"#BRҜ5~1/Q)|I5 %f{F6&?*foc8_wȋu٪5)FUJ'W1ZU0 +>* K*A&A`hRa$0GAe40VkQC4xAYB6V9B$㍤*#6o-Rtന-6E'"l,l-:h#S>'"Q)j|rNK:c6Ì (,l gQ[V9Bt bJlev;팤H`%$ + R$1*ʖ$)J$)+I4`Wrxi58 [< -+`$q$.pXr8--8-l$.p[&H\@0SK\.r,q:p%.p`]烕v q:2Z:3I\@]gtFV)i k& k#Q栓kxג ( +Eo +;[@`: ИpK$.] slLA5 '2=.[2!d ?DIhP* 4Us[b$1i3Y f Bi6_ckfX.2cZsLJk~;owz͐)?P_a، . Q a#u1OFt+Fb+3a];}*>B!"P8ZO_ *hFp6˶ RӬwNh5X/ O?~?>ZS7}p[2tː:7B;W?׿\8EhΩo_YEVO㵬z?6x)Q g*`s@!-( n+H js]Y_P3Nw|- +8;+kMs4"Z7jjאmnK+k:b$$;GTLjzD=n=ۍ("6bq>I>V@raxvڌݵ]Xۗe~6{'Ѧlu G>\n;Y^u|3Z%_׸@ܒC},֡G+henA-ams8U=f+{WCς^x?ɈOI+YȝuH~!Cތ _}O>u~b?O*ݚ3t(^]̯XbB4m"9"7|;/#~쏝|:ViO!mew9Ok_W=Yht +ʆd.Lm~qlz\u_Z#aWMms9}Yk76lQ L}WPϷPv5lݺ+O4δȸ"ɍ҈*Q7t+SWQoTnAV;{VC2ƭLk(#m~_Y&H\AWb+Zu{QrKۻzs4҆xۿ 9e?> ¹nzgáu>յ[fx&h6$.ͪ[f>~6˶qBb>&e %-s8m=y7;zڟcqp]{W4Do:"#ZAŤYph.ü]>]Ikz"}vy3ⱵX{jk> \㟛 s44 Q}"9mZ'w[<uf =0;;Qy"F髽ɩ;)/]F j>p|g!v}6'>L:GC\ܸ_ݭ 17xgȗ@X.mqQٴ6Xg"s8n<+Gf[#mK wU;[fv9 +|Tݙ{ ~VPʞs8n:fFm_CkU.]yQC:l>3蟙j}U>:GCnQn_o8Z'šֽϳ4Jkx!Vons3 w={+|=3KB!ow_áwQg>Z.V:mػUҺxˤcپ's8DmHO>Ϯ $}>3^ +ou t[χo%|sLi=IkH; y}1+x߇C?ᚯ'єm: q|͆-^>O|'D~Yp=~K\57x2xn/96G#!xutv]>;;v1=DRAe FE6Pȡnp.?=,ˆeHMT]:%˾#~_d7mcVSbn-.Cݕ!PӲ]CZ@-ewhk +Wqc6q^&iy S>D+U&-3|0 UNX0L  ҭfReLs5T#45q?+PW#pIgNߦ*^O oNиcqS6kv2,lԋ S=$vɘp2 0'}u6v|8M2iŽ~: ˜uf|Δ}Ne2um:슝v.Uئ Zb?M[z"Z45M˅~C& 83bsdizq8+[Up/iҹiI>&qTNK:dYEFqN'ff@򓴮/ +WQݤiMWp\`xdI臧> (FMՊ,ua5ǝAS{99Ԙ\ p2i> +endobj +709 0 obj +<< +/Filter /FlateDecode +/Length 5052 +>> +stream +x][ȑ~_Qφye`  g1ه56Ka2 B%uԘ=M.E%嗑! +?hIO1zEM)+%VE'wՊt] v!/v._W3vUdCPNP%ʹ)㼠z)$` dh +0Rt +f1QPEa)hU%a&I3trAPi;QJEdnptFO>&D]N#鬝| KEIG%%-N)I[ I&L Bt)6˯?b_LYJiB|i`!8}˂ʿb! |N6"n-.Il$gQ"sXJM1&w949 BHA˶vW~$[]sj۰\t uqv@;|F (l:xdTFhU7. Ŋ9C4ݸ/㟿O^/, _nb&7:laAͺk,e M kz~ K;~@)Qy +aAuʧ`K@ +[;jCˆ]Cg8 :C;?|f@etUa4BC)wqrγ;HuphrcagYqaI5J_F֭6tՆ.S`o?x9V;?vhNsvb׵OfQCT49ĽsutzE6u6djA/?>Ժ +;LR9sĹ2GVίk~C NF}tHqMmG1NˏH3m8̄9?."{xp?WyF-mePG 5g`޿_>Ylbρjb};qhDNюdCAz8?¿B3k>i:?h=th_4?㞬th~n_9U*L}u">c5w[ރwŏa&|,ȳl裃8ߑޓNܹr;H1:OO˹"9rv6q^r0΢A/O^=Y{pc8ZîEegCQamf"wq#ڴTAt(=`q5S=2R$UdAs+Ũ&C:\gChlukm]SlrA9ؓuc6rkjW+N կr1#Tu :ԔNn,UsgmΓGBfWP#oedu1&yGweGٞ~YWDiƅlvH{}-3|n̯ua=Q;Hp:O1kBO95=.m \jٕu9b}!Fm~ߕ3Kv[w4"Yޓu 7؝~ <Ψz0-qs%7{ג"]sx\ [xFt+:*X%(=Y{`;]Vxl:~3Dl7 +r)İ_a߸\5nɻ \ϻl{dCAΖ{eҽZo+c!7fϹ̩Ml(\ «ڭn7 ՓuQw:v\31jw=Fd)ٖƽ'vX=ϴQZ.xN_+G +idgCe{OzQ[A=ݏVD9jsӗqޛצvc8s.;Yw 1{aRU +߉|#f, $ٸk;6٢;ח96OSS~;dO +ȵewCͽ>ȻۗF>6< s|8>sƥ_aw6ns-׎8Gݞ=w3w{/[D٢қ_]~_ڷ˨soC"ȷ3^Sqυn='5:ꨒ_|SHoRV4{mn}J]5ۯF?<ՙ^ +}8v[}W|%4Lg# 8w/Q8W>5k8tz5s~o< ~0K|y7FEޢT0o6NDE'<ܱ`0GCoي8nO*姇=V" +PIY|{Ic<Ԥ{=N6GkcOǍoGm&v\\ZnGҥ'L*vT43OA*Nlⵓ7!B/ܥChQ 3c+)sT$c- uM)q%jbנw;]Nμfpw.;߸8M.|F8C?NبΘRNoE\gkc8cdҊ{R9D&oɼQ<`^Ǎjla|%˯'Uئ b:0^]ub%ucPݴ\4mgmb d>ul=zryqQ?Ʈ}I&q%Z2"x8dn HIs}P;`aD>]G}MWY9 V!aҼӴG0㾘 FMƥIJ,ЯۚcN֖es϶ OZcIcpSUuhtb6ZuK9(z)K=4':>*~S6[W-9N-MJmߴWv =2U۔|;s! ?%cj[^׬o YjuJ+=a8&V_-E:VKjI>Nsj *o^-WKBU/Z9AiiaϮ'_P +endstream +endobj +710 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 709 0 R +/Resources 4 0 R +/Annots [ 711 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +711 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 101.373057 101.433071 82.623057 ] +/BS << +/W 0 +>> +/Dest (cb151-1) +>> +endobj +712 0 obj +<< +/Filter /FlateDecode +/Length 4651 +>> +stream +x]Y$9~_QHk|/iHaA!k^>3G:#rvVMUF?pVW D;~x[CoJVE$0^hw 䯗?yu"F뻤"#|^ZF0*k:F)ȩ`i0b +fցQa+TE"N3TQ) ;Id4SV84tZ CtIYp(*"` 9-`p:[4Z'2[`tRqhEda +N)aM0I3: [kt8x3ZuF,l-|-;0D%&t0t7 h90RAGFKc` a:b"q\`4lA - lK@ tK2* r.̔0 8.0\@)r\`qb{ XX9.0]Cq\`一 '-0`GaT0x(9. .*Cq"t j)y1h8. 8nj+5դHB,,ӆ&4 ,xWEL̘[ wU@(G3,s De8.]g/0j ,xWԜtX.q  0 %]V!p\`%qfa!y ) @Bw1G xWZc8.p]Ip{Xl1As\: [fLYR)8xW*0J#M O8.^{q:| [ Xl!Oqװhqװ.DT.l|@"`2":chUNtts\= LŊR"`s\]f@a +D9-p9. R [ r\t@$K9g 9\E 0Li)YlMp\IM9KS8.h9.6S9. J'qh:)9.* qe7HěqK lpQXlq NB vtHDR8.x=$R`&Nޅg8.Mx\l/A?!E]1^]2^V]3 #0epU(d $-8a\}j1gN2bXsdf%ٸ>/|{ߗ_ +eOARa#V8}`{ҦJ}F)Ȗt]?foSLz4;l__ƵMFhr[F~/׿pׯ }KM.0}Zxl._R_m:19:S573=0Ĵ@h MVwfyK[OMSCc$$-ڝrcSCel:Dе Fr+ujOzNi^&S9!r3Tf-jeFbDcGY5xve6xbjiЄSD 篫pkL7b:nC({8Y|%Vtag,{k=Moj͘ps&] ;!mb{iaԋ9 ٰpUlfk0odVɜ7hws;g;[(}@fک=G51]G^^+օt;cyN`zO2Y9qBVw)9ttZs?:9:&3Yr~3cdjc}ƿ!9h2 MfWL3Si >Sۚ4y2gY2G7%'7\{lHm_uL3[|c&FBs\顊giVƕO#yN_>Xw(dƳEWgY%TZDtf۾{kp;!ԣ ++7Y}/&ly,ㇾAcGA| Ӗ߯ҿeMyΆ4YӜCꌥ~g5tO:imy,;މWlsj!-yNYO+׸ǃyNծCEv(3pn(0v[X'xun֔V!3M=7eQ-+٦}MtVu y(IwQ˧G{;l(s>ߡmz3t_tL}ݵTQos]=h9[{}},л#nxw!<;D8[kh`\>0>bYWROLO Դӭ +:>iȮf+?}eǔtڃyNfp뉀%;u,Krh&y4=tֿ3SkM[Oy/ ]3&EV;e\Kǻ_s-,U/b!_f1*皷ڏ;?wK0ZaPc;kw;gG jzOxylŻkk6z7F3;>[z +wuQsٮFm~W:%b\y먔_:lUrvɰl"K/$%K'+-z*3d$;P[<*߻"ӆ&\5}z?m7ݓF UkUWu~8r`$7 w^Ûݘ>i8ua֍ +o72t9|Vnl>Exqj?H&oD Dkگ"HC*wV]Wr2XRM;5ʴySڸcƱ98tIO~UM5wv#FL$AqN?e)TNXd7OiX +OIj&9[dNd3Btj)Ng/ig t)e!RX3.5e{Tɦ4bztV; 5rQu,2攥C#]W2M̢oz-*3 +Ct1cD n*͖%UYcnjJ FԧV1C~h.@봙uVb*~XϤ+k)x104,ɑibᇢN=YFj宰q-״Ms) fRA2ԥfҦټDRHBEJˉ%i!<^jC7?,s#ʃP)4c'Zh# 5۔R*E d}Mr gVŧҿ-m^)h^q<oȶpdMY|\H4YuڜUC\Lef)G* +!*m0QFkLNpBiTOY;ZrE$5;#VLx"+^lQt_0KA; fkÂP9)TqTT*=h|2#y +endstream +endobj +713 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 712 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +714 0 obj +<< +/Filter /FlateDecode +/Length 4919 +>> +stream +x][,~_QφI~cb56gaEVJTF^8]"OBʒ*|_rzH)ஷ/?]¿1bTZ8xCI`71\..y 9o?!T*~ p9K*3n0%p$A`uQۥ* T0CgVCD QY#=H:ɢ.Bt!:C'I`JK:[vNI:l.uŤh%]-]-@WuE%]9QS)(?dtZش# +3%(ElVIgaÏOxSFmՒcu/1 E QF@$qqp8LK.I,`R\VBX3Z"`wAbauf'q5 $.g%.`[H\`ANe-q: 3kSpXP.%.\ t1ܣk}0XЮu)H\`i%qZwVQ02W0H\ &%%qk"QA+q[fnH\ƙ q2 wA!^v` V+q +  3wL-d%qo qA+@WA$.]ВD@?T%.]孕 w#`MF5a +c BҁwFK:R1K\4mJ\" L!!$.YAOԅ^₨ ,Q[\tIh`5Fh` \  YpSL6Ъ.!EеK(qAnT%.ZjHr$.i'qA̰CELEC2%-p%. $[ J\L*3( 0Cc-tN:3I\\U+M0- ?`&9X$.Hr3I\l1H\lz3J\l'qAVa 7Y8tJI\uz8 0.i$.Va%0n ތd[<\Q[4ea܂;I[Lvh$.&Va8r,hm@  RY|hdcb嗿÷~o叿R@֯7z5]ߦ0[f h=}j9p .uLZ~g1Yf^ cXySYQä8-rҼME;K_鷗4އ%LLcYރ/Q,m wC-VVwa~ ]ob;A䯶=ס½ZO6t_Oҽܯ%)믢ߦr_X>u2X<{`ɖ 'pGu,%=Ǭpq|f6az\ʌes6DmPLRkfٿ*iPu,Pyy0FκWW);+Wb+.YWt׽1x'.;qgIub +smE=W*h +Z/͐U2qdE!эG"sݓ:D,}V3Y$MFk>/B&R9RN#⌏n%5[AdʬHT8:gm_ewOD9m{WP}=Ͱ][WPz9,;> ݵ(?w8tclgGhN{3~зSfss:>Zr&=)>?/qPgtS/w$/Pv¼ԕK,> +syN_;Vhٞ{~zNsZoSjϮ<[1Ԛ +FeW2b>ֳgB:.⹜cu|_hCWbc4ueȘ~"{00}/W¨;}]/]bŻ,y~&W51hj^S3ߟuvNlWיִ7;] +Voڿs}µXcحc7."`FOq<RP؎ +$;H]QʸO0a0q]p\t& AƯݗn#B̉ +QqPw5H26gJcY籜T*S}5O!xS̞ {XtO0TH6t5"1_ӥذs_Nq$7!rݫAOb:7 v +O +lw*&Kb5qM'զ MXMMY&.7QJ烖JUeԗC\'AtoT)ڡ3v$WN.b4_{*Teͥ) 6ՆdcMHG1l8*1ܘv&~(+/Bʭ^L C*NJyUH9sUBc塲Z@Ҳ1V +LHO[SIY1y<"Jsb>+P#P] +巙PKeA3Znʝo\kk:4[e/8^LO&6v2&l(.-6Ȥve&C^?ˡkyܨrLg2:1= EX huji}ACǍa|ZvՈԕAuromĦBhZoo]+VG}&-7j,W\mJ"qEI۔3,#.xdfL$6=xWX]07.mӹ6l .`yyf`> i*}zc$'KxuαW(P-˲gӆFs-cIS6%RWdJDQ2UdXl +S,'b)/=ڈJXrˌW%[ ݩIJ]KilY]f+ 3U-_|;<]AJU~HNRLNGk5B8:<> +endobj +716 0 obj +<< +/Filter /FlateDecode +/Length 4726 +>> +stream +x]Yȍ~_Fqƀw/`؇.F>ߏ$1%eхJq0dHW4Stt~jEar:?1)$g]r,v/.YW3v׿~b)X ,rn +8/0Ĕ$p mYbPNbA 2& +1,m1L$ N., 6J<xMJd `$xi޻(si"% $,[% JY ^,( JKd'"Kg\VI<'۴"+ +3+DdqVg! G' 1 +j 1DdK` SJ‚#MC`]r%,HV!D'd=A‚D!DyAS-0 &IybIX|3JX0&"zqK rK@&Ed%,MDRn. >3((@o *{ +9i1YF/mh ӸEa>3d² D-b_xG8SV4ߒ.oՔ#d ;  RR˦ W w^ Yf`&"UИ+EYeE۲_Yȃ‡Yw~8~{'pʼnž>\v뗃"yGM~~zÿiH('4__VS\ƯeC7zC/eEEim1|溙D76rE. +'ToRoNi1ZC,+U: ]yMQy+*.Yױ嗕cJ:(^04zjY>+V8t{M\nǬ>n8x8Bc: +XK45 x' gHT6!^gմKm]X$"X?|!b,qjlUbyv4Q%C]uXUy~Ec2D\EzTi9r^稶Sr3ƲcCYG +iJ58 5;|Tѡ6-.MwhMFcݷ&E!BRnz18t ZA!ߔM|ci=K#h&Ƽr|N +5-m .}9հV +*^Uqͮԩa}_ilKg=wtw}gqzwZNzuzbĝh!"?k9p 뛩kM'Qz6|IpHW>2*KNΊ;57 J/EP|N2q(E'X|vI L,Ukt;n0uI$(|T Gh`ARG DzKѫI2 @lM>ԡ{4 dm@t[dCU͇6Nlײ& ӹG]Э]SD*=^5 TjTWK 6Ovߩ4a25>u&jHʥZN .bҚk3Zث.J7um8- kDqIS\8؍oGm%vX\5hv9n/o͟4+gpȓ?hj&G F^*i:$i@Seu͎Q t[馱uP@ cI!aHTUtɮۂtm::z0wd߰m$6#iv[vl&I'ռ]l v +a-jm߱R?E&yOuOlVc2/tm=uF50 [ѓēdrJlf `ue]ǍzuՁ AuDu8M3]CϝK['PIU*\e<]uhW\tp q16ˡ%[9vT8.0/mQwcӕG1AlNjaci! g{6RO|闗|S]]C-;=ۂ4zhAFjJ7vJ:Jk-*/ժZ򈣨bNӨi7JSgorhɶȍT/b(XQ훖}Wo{A]#SիMw{֎xȳT pԤ56C$PFW{%cOUA"CS jICzLVPcjSE::Aoo Jˇr_l 3 A +endstream +endobj +717 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 716 0 R +/Resources 4 0 R +/Annots [ 718 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +718 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 612.273057 101.433071 593.523057 ] +/BS << +/W 0 +>> +/Dest (cb154-1) +>> +endobj +719 0 obj +<< +/Filter /FlateDecode +/Length 4676 +>> +stream +x]ێ}gyH8 LF0`~%"$ggӪ"yxXU^ }pV/NO9o(1;?י1#) +c.ú/NgBRo?GVy!T*.29'%TV0b +f^J3Pyj +0C:)8B%8sRCJ:aE[J'>@tIJN #(]`Z)-&pA l1BkN`VQ: [U面tHN t]ntA1֤.@ǽKtB0l*RNIb %SEҁ'rUѭ)&uO1;KQFDqt 5E+ HvNQ4 aG:)("Pm)&Ph\R[T( [P`Ԋ@  +ty(R\@0S\[MqJUN HQ\XIq*- +hRI` Lqؑ)wh.ʀCKq¤ ޕk 4xW:L1AEqJ[fn4\R\RKKq?CKq{褢'cn +?bLR\`£H]`¡ʼnqVf@qbR.S\gQ%+fjJ2p x~p`ߘ. ).0]В0LB cR\`ˍRX.p{HlQ^R\: [bLYe\)(x 0rM ). ^z͂s8tpHe868e:آ5 *x -JJ -p(.GMp! [)R\&c>hMq3ZYɼ]:p8bAqb)1)..Q\3` +)-p). x [ R\Gi9K)1xmYt).0A $u4Aq'ۆ?6:آ{MOqErIqMGqA[d @qNqA`\xS\GAo: -. +-p1nI7N4oz f ބGO|7.ft]x ބgKk3ZcɌ̭dʀ{1[92gA1F"0d*i?0fLM >Z)6~&/9=}1dҏ00 d@wx,:ZA a-u.#hqJE#1凙0*_>`/!4+f[2*NJgpP'+h>|`XKs?~͇FN?scR_cQ.LbT.k>W۩\s kWϛΓykOu׍Ǥ.~V)q;e4H}N05 9Y*`5tJ)ߏ߰lFe + 4$xfCXf05[عOshQnxʞtŎ _UA,5;Kpf1;@Yଳрe i E%/JO^\oǍ6A猒k  +ROI:2ordLg&>^62zuۦA1˼^JH#FN"yfaʳձj>˩NX%#][`jJY[`睍4WX9lhs84n;wỗ@(hk]ڨ|\:[HmG7v{\Z z5z`Qf9!C=*ޓ3LȺT\n~*\oux1:gvY6&nuFsӫOML|(sZ.4GCc{-c]Ac3 +2Wph3_ F2".5uq2XջV[*"Dv9bw|{ckb۷+FŬdB ++R86$DwB׃X/.Mu9Զ1QgRG.1"38(l9׾=b\AiPgáwG~w7A4dwPw=|{?;:s8:n{W ;֟K\ڠ gn>ѹȦ=fhjGs45Oz,!ZO<Ҷ~BF UG=z-#Qse;]We+ to⣵.ذ޾:Cﶏk2Ƕ9Z.gO ػUԼGCf\oz]S=5u<-@һ)VP\;;h[Ξ97ﱌ# +;o#O_QvQγvMwï_ѐi_U]WEІw<6\5ME|]U(vWp53Rm YE_i|:k[|@MQ7)[fɎ񔌺:)JztǪ.kP5bk'[':~C<A⫯%U_]vEhhӋTaO!1+ǭgBƍgVυssE&148KM;_i޷::IbGwtPϧ۪&Z3)#"̲ 8ױЖTc'W&}&MoR 橐/LQӊ8=gbk=SӑͦlPe K]PW+b="pa6n:Qu*+]՝[ U}2өRJe2*dI%sOr"_tjnc' \.rr"Mg3\.KՐZR|nxB6$uq jp>6@k+ȅr2:"~>G6+IЫ:o{^Rq C3^M*LF>![+G"qlfjͬڕUs 2f#ҹfҪ* ɼHROE}00uwO&44S{>|cQ  B\{*;9ehBjVR_ML}Qd"d<]NR wVr٧(_6uF4uEx4eoIepvx)}IOl];Ku)lym=vmmb-)/̢Mw4YT2!—:1QkTo-8DMUj:۹eF$J+;V; EWTzv:Nu @ +E&H154P>t1T4a{|w\]4'S +endstream +endobj +720 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 719 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +721 0 obj +<< +/Filter /FlateDecode +/Length 4972 +>> +stream +x]ێ$q}g ۀ =C0?lKz fdF^w]fݕA&3K+9=cpOoj^_I(?'V.N^'8M ~ :㶪3\N^R gLT fXݪ20Q;I3tQPi;QJ5N)Ӄ3z +),"t:Ig^K<|tk甤-Φ(l*Q[LVEb;Y%t%Q[TPZe;u:bO*IM+00H! +:[Yot8t ocJl54ZybLt`%0$ + $01N.'Ivr%LʓJ4`\Q4tFKD`l.HL`5lq$. l ,֩%.[tpaqm +N kX.{uF ڵ. ,x:$.p]kSXdu8*J\FF ɤ$.p]wM uq8h+#qgQb4x9- X 3V6%xpœ[M: quy=.[Cx.wAIpj$.]m%xW$.] ^a$.tE]TNI- '$.Nd<)ġ.{ wVUa-6 @i+i2` +IU#,J,qA۔ D$q  BrS1H\! QAAY$.@`=ek  "F-.` "lA(qlJ9 XW%]0SkQQW%.ZjJ' +$.i'qA̰SE)DN ҅Nk -%.H&aXK%SL$& +%.4JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@U2P^x((/Me +*Z +xm8a}[Tp)R#3Ct=I6/~o/);eFPR;W&c=o[آL1 )1Us7Km62 ݷVT2 +bpO)a!/m}sS#b|ol+#Vo$7p[rcbzAg?v{&`dث>hF4 MDai\?3Y>`<"€46E}[%ݧtbާo|tnß~ӿ^n'Y58w>]\>r]Ҿ,2<˽]:AL2N$qkک_!kL=}?ϟ++aZo/ќ 75 "s0P-=ڮmYjc([bӍI*+8X伾u:ZiB9'Ô,UafKΝbg*VGHm#v~mmf(tˬ\!+}$'l9ch'Um;EҶ ־8Fʈ޿NRC+i3 izϖ^#Ua1'tsev1Oiҋ_K.m9 wC#;RڳC03 ^P^Q]{vJbc^RvMPouwHq᫷Cj샆lk> ul붍 +ft.q)X%;>޴A~3cRoQ|_pd[pmf)΍1A?[CU&i陯KyuCiycyӀ`7neŅ[Aح0Iez`fR ʦ%'SQ(ѿv<_hYn1fR+s |iYzz r-'KJ-:MK wChM fUrp{Xqc)r~- eApl:=Yғ;$& ?$ydֹ.#SZxgHi-y~V}z!1a?̌6q-lhu{5=&%==WQ&]6Mπy)˓Ҏqy>.Vd#5KHy +aX}zbm~1ϓzcѨ_M:v +\o 4nwqg2T-LC[< >xdc:f΃ԛ6~_;6\L.'ŋOj9޶i7*'P9Prƛy-ӡ3t,M<">xz+qAhx|r@h.~t 3\;(Ի_t;[x_lX8\=ufBթź`{rp''^X@t~s]9 i,w,z׶/2($'7eUX{](pޱ"0rg2/6+/nXeBXMػ[1CNl~?(vR[T)v૕_j1{V)m ϷP-UH6&z2;2)t&]:VwrmZA˝ŞeŒ2?4Ulߺl u b1 ņdfI-U74ކTMd!rSդ1}sAr)t8 {bmPظj7ݶ ]L]״XɚK Q*J}鵨ڻF5eF&5eI=n;Uv̦gFoɵtDn)ͷ-UYsnJMكU,l([?tJ 7f#|ܼk3_o> +} ++вr8.{'L*wv*|5H{wUf;Cc'veݥclԭVReLs5HZꚘ(OJ.TTžAu%v6Uj[]wrql#%V.|>csj%]lTv2&솁kة=d'qފ3:yQ?Khg?nTc Ӹu%枌A&]7Ta6Lh.֩ ͏{MBMі?>^l̷Mw󥭍j.xspv|gE⊒v3,#.xdnL$u=PX]0.m׹fyUVZ 44~q_LuQ{rikIR[.[%{eܳ-Snu1ʤg[x^UQ4LUY+1V’vKiq{)K{QiMZ*z-y[zK&Ax&u=mn]ww =2U=ߤ|gy])U_vBtmv:Zc78їDțlwD^ 19kU Ps+~ߢ-+Ioa+Ӝ/*{eC]FZ*wY +z}OTZ~j_f7e +endstream +endobj +722 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 721 0 R +/Resources 4 0 R +/Annots [ 723 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +723 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 401.373057 101.433071 382.623057 ] +/BS << +/W 0 +>> +/Dest (cb157-1) +>> +endobj +724 0 obj +<< +/Filter /FlateDecode +/Length 4691 +>> +stream +x]ێ}gy)ހ $Aagc# `!CxUj]ffwۭ**J}_ %B嗋JJL6x{U*`x]/l?_:EN+{Ǥ"#|^ZF0*k:F!ȩ`i0b +fցQa+3WE"N3TQ) ;Id4SV8ttZ CtIYp(*"` 9-`p:[4z'2[`tRqhEda +N)aM00H3: [kt8x3[uF,l-|-;0D%&t0t7 h90RAGFKc` a:b"q\`4lA - lK@ tK2* r.̔0 8.0\@)r\`qb{ XX9.0]Cq\`一Ơ&-0`GaT0x(9. .*Cq"t j4xW[Jqw5iq"?ˇq=tp\ƄFXqiP!: ,xW By83oB99.]8*q>x9.]e9xW(9.] A( %]V!p\`%qL c!r\pޕ xWV[L ӖV` +Nޕ +#Rq&qI0P +@"z8.pQB9mqXP-"8.9. d +7 RL&B$[| Y]Ny 'W8.@.%&= x% `t8.`p\W$FdlAq"] h؂h゠L'9.F.t$S8.D +9.4A du4q'%ۖ$?H6:b,q\Nf آL J؂(Ha2q |S) D#o"cm4.回H"DauASd-8 &؉9آ#q\KfaMD@Hg 68x7rZWqv@z-|+d V]3 ߔ#0ep*Jxfp[}j3O1-}9j1P>O^a,)CiB|i#"V8|0J B,G$#|F*薌KaM}iamxgW48֡: RҤ.hm l6_"&m>^o|ѻ? T߾-hێߣm7n DSYPӴ=仒ʷS r4n8}lKhWPlMRG5(T\w|ajK}?ﾻCTz O +fUy fHq@u}wg0d{߾'CJ"TvN?ǴJ?FLa ȔѧA=Zd|NPQ!oB񆆽i۷r>?f*S<0έyuN4}i^lavߙt(^tWw}5_5Dns:D; qf6t2 QXXt3<]^7Qm! Lm1vkzо\q>ڷy_rkxoXl5+1hrCJBso R9:CXswcIJѯx?qY07nq5_g5oK4?^hSЊ¶9VҞu7]uY=Hֻ!\jʆh6M^nȆԬ !9dž0{rSLqҹނ<1w^G^sv%}iλ'C[m;>.k'~Ҿ3acf QǤC JD>^n40cuZ_JM2-fc,0/*HVF9U|Io$FL$Fq?eiT.XdW/b_X!ǟ4nlm>Tjm)$s!3/cFNP843nbufkԖ ֊bed#slvWŚ=* tbzu\Vf8 /حϬ4O17{W"3QHm.Y81 #R YͨR݄!J1 [nl͖TUcjJ GԧW57sDs*viXFτKe&Vz\!m^+4MEdKd S3;}7Eg@*n՝YNj宰q=ײMw) fBĔO[JH.k>fIUA]' +SlvWŶ@y"v2U3nϭؗW%kn,|wRZoWwa *4vXMuطM1f*lPuk$Rҡ%TF(6jv'Ij60"mfۦl8B`n jw'0F^/dg@j/VZ,I R3lf96=T23%ȩS4h1HC6N)&;͎d2J>j[#l/STmOvTJ'vTܬlj7{-ξ%K,kk)Ւ&龳6AW#SYYCwdt\7P_GMm1;9p-{ +:J+"yC1+mg(⺢iy|#&_-JuTiNV0 T6}Jm^,CHRKC:nd ;\ +endstream +endobj +725 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 724 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +726 0 obj +<< +/Filter /FlateDecode +/Length 4926 +>> +stream +x]],}_QφI1xp}]3mO(SR22nߙ[ "U)~tQS +JEQ _rq:?)fob]pɋ]uL9?)T*~ p9K*3n0%p$A`uQۭ* T0CgVCD QY#负$SHdQH:kZ)sg%-^;$lq6EI` V:bR.dA` ЕDlQAiIsrNeTi3O>Y$֓6Ì ( l gQ[UFY#Ɣjhv[eŘDlK `lQ1H4/I`b\6N"K 'hd?Vi茖*]j0sElI\` lA -Y ,-XЭSYK\`N qL%q (e ,8ׂ;%. ]L(qZk] +XuZI\֢-`d%.p]Uw1 8 +III\&)'q%@ sJ\k28q&H\L%F]P=tJ\&D˟0VN9H\:aD]tDžy /O:,qbx.3I\ m6eʦ0S4A;U>`1B26Z7T(*ObŜo|KO?^~?ݧ`~z_r?|ƫOk~]_82 CPVzn}ㆲKR*y+{lvhzګpg~ +ێyR&!Z\/׀cwXٮ!26^ͯآ8HayKm*iP=YWGZރZcחBpsfs!|Q){ö<\CϿ!==! =?<Y5ɣD\SߏHFWp٭'ٯcwBR읳Jr6{!~e1/и.A~x{\/Za}ٔ9\cQBhuγ!ל_+4UFAnc$ifDX#׭אNX CMwNy:Īرz2N|9J\-v9a׊5bp`+ׅ{{;>Ϟt=g}y$èeĸ'<Ǹ_*QMGۈ]·q0 k*kyuŏq&|,>g=YgF{O:7;sA= Ǥ'w\'<,DG +5@l賗͆qzY|zy:O1f]KC_N}6Tyfamf"v= 8k|dC +W33\c p(͸JAf2pe~m<Ο zArzy:$ߏq<zʑqamkR˞n9ևbTцfcn뮘FĴ {γadyȰʨc?I.1q{;-] [xFt+:*X%(>e>=Y{,vmt;Xg1'b2Mj7v+K;%z'ykwmywz:Oʃ-ej\^QNs{*s*:f4[_45J6†j6ƾvknfȯt:yͮcsw5F_.<ֈ,%Ҹ!Fr^dŻTgYi_ %&}w\۱y`xAI:S5Ie_ݿ;j,njsog+;hwRycȇYFw>L!r +{;m];fs(8KPCgv۫+6@1?y]8yŇGm'X:ܶSP}ّҞ I?3`@I! mxm}]ԅŗ=Q:0lƼv-ʰn}Dqu}Cd&5aE3zRf]W`6:?߫]Cnpgl_wd6~:Fpk ÎQ=j}_ 2K|n9$)rHj6^ +rC|` y tJr?&8X΃ata;Wohl|EZG]*GΆ sTۇ){TLzҁÞ)wdS,-ѡ7-+=M*&cM fUrXz藰~c*rPvh1XmLUdmPArg:vxrrԍr<8YI6뒿u3_c.~z0DՐs]By 9mKV,IZ!A%<{A"hdAL-OUyd} {;=ږ}jS'8*\3# 0*ґ"/kkm+/e‚y?oN*eS$L2 , =-Z|Cگ4gLOoaQB"'1_᤬utq,߲S+EC,~: #XTNjD;I*b,~]KR v$\ު֖-CQe7@X\=A z7TjtxS-Ƿ B z+W^E3iUhP؄A{C VXw]l\Gu u -k"{Q&J-jSջF5eF&dI.Uv̦gFTZ\ E,HV*zҡnSs T_obsDv-LUknFxxfb]|JWqe6qR/]SufLIy~;k'qyh$h{Y.c,NJ(OJ7eLs5HZꚘ(q%jbߠw;}^΂fp.;߸8t}0_QLO.6v3&솁[ةaLZqo]2MP…GY(]X q[ƭ+1_ I1}XiÄ1bzY_qc_^]ub%ucPݴ\4mgmb dtl=_zsUසu/W$h_ҡuUo-[I4ד #v,o]"- ;;+{^_<ɡ6jo7.m7FFxԖ˰lk- :yZ[=ۂ>5zhVLz睺*[uZF*k-jSXU;Nb)oӞJs6eݺhɶs8~wlddnRK*}nuCBLU7%G\g:HOɄԿe [8U!*R#s?W͈\ 19kU oPck~=\-+!iNm2A;K$e"}婥77EwЧ?'C-d +endstream +endobj +727 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 726 0 R +/Resources 4 0 R +/Annots [ 728 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +728 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 176.373057 101.433071 157.623057 ] +/BS << +/W 0 +>> +/Dest (cb160-1) +>> +endobj +729 0 obj +<< +/Filter /FlateDecode +/Length 4690 +>> +stream +x]ێ丑}ϯgC16腱0PU=ecQxP/Bz]N)yxAIIuN@JOoRx+oH1;?]Iª肽 vi_{Gݵie1QE2ZὶQ9%p1r*a=iZ<̠,u`Tf,UfhS gTJdu0D8V…#)91yRVq(s6p:-6J,lHr:B&xN`qF:آ7։.+:"T.ac bu:|X괴c$SJX`Ӱ:(tN'mdu9-?NƇVFFq: [` :c` x#@c G:ZA.zTiŒ(BH [c`&qqݒ% 3%k# (Ppwr\`@5i hPp!%9. 1` qQ 5Jz a9.@ +q\一:H⸀c +`u^`  -.Jqw5iq"?˻q{  U3VB8.]}. +̸E+ \w1Q ,x8. ̨ U35*% r\8oBI@E!cX.hIs\YX&au^HC9.p]Lޕ xWV[LÖpV` +Nޕ +=Rqi@ `9.pDq\ࢄ.s/!,V[pE41p\5l1Zs\5lq<o6<- lqLHqZ9-]xOSEr8.)G؂q"4V_qHUa6hdԼ>:q)`I6\TN؝OOQM=.''~eEF}|'֓>>O4SSN?:ht:tw4}6i|2QH[1:#Ĥ^@u0EPUm*`EN rO D[7~Q:;SNgD7еS{jc:e&oo?^+qӇwn\!^$vxk@hO~fy ZDsS&+3=sƏ]KW$FM_`ˡiWL3Si >Sۚ4y2gY2G7%'7\Z^D=ts9twDG1Vp6=td`ˡq.yBp塚|A6V`mms5Ԛ55Ԯ!KܖVrnc1uy #Fӕ|A3+JVGtt0зҼՇ_˥ջ18d%6vWJdbAh=rhU-\_f'+?ggK.@d)09cyHC?_` Cތ㈆Y$}>N?rHiҡxuRG͚dz\Ѵ{7r>W; +79{9g [ͶF˼}" rM)i;q7GA\;J݌csѿwGY;6]E:r(<>#: >G;r(Y|؝fd7{\ z\k;y~r^6`!W'5$pQ3=Vk7/lo]ɷwTђQiKy-%xRZaڎ[UfFfw$;]0՞pP{ +ȴ w $Fozߠ T=ǩca 7O[$HrҺ35LS}Orܺ ~ʷSݍ=4mPkXt77l9mǤCӾwG"=ms!I +9\. ^e-3tc{2yn*Hb܌Q'p;-mIH$e)TNXd/Oia,-Cmդ6gK̰̉MX1#DNtRI64 Lgb]Z ik5XR(XSG Jӹ*,MiosKrCҴb.*Efbڜt~bD/7FE:^KQD%]ˍM7fKO*Ԭ1|5B݄lhI&.@kf*~YϤ+k)xҴ2ahfY'?R-<ÁW=YFj宰q-6VP )`m/$>nI]Zl&mK$Uc.VuE(,OV(mL\e2RnoؗWiobo)| +b-lW+k0BW}yvJE:ȸ0icuā3*mzYHG|F?彩y\pLdicpP62lXf4y<>d)ĞS h[m؈uVi!|Z82:a&_1iWlNi:S{S$R:CKɈP6jȶ~j¤ƍHNmY6\E.iOڂIƙ=wd# I [+-xN9fA> +endobj +731 0 obj +<< +/Filter /FlateDecode +/Length 4759 +>> +stream +x]]q}_VG  $?,p#0pwF0`J"YJ-uZ7̝V?JaHU;"!<]o?_~!8cŨ]08|tן!$g]_wɓ].RF~*C!('TJ[Aq^Py=ST02VA):I3Ș("̰]0A: (%`"Fi7x4tF>&D]N#| KEIG%%-N)I[ 'R3R[6_w]XXY|@pɃ"f@Gm=d2;r+-@ba2oї˟_}q61,3sܩ>44mrŴ\9O͎RwKOe2tL|=׽/Wlw~?~Yd'XgG +U总:= 8azN7]i0v[hp+ˮMCl;~ꆈɱ{)׬ +?H]i=] }/ck4E s6ctK$jƵŽ8ַDdt-rS|Yok~}auig,TG^-rlKᄜ'NR~}29yΆ/%=Ǭc?"s|f6cz\ʌeu0u߻ɨxg}oBPu,Pu{ýa|3u9RvW,i+.YWt׽1x'(q9'vίM&v ({wލh̗fH*5t (g? }ueG6B qykBV龲tkm>93(G>>R9RwVgQ8^lͿs<\ 7s:D#QG␿ھɸs: <aش3l>|Ƴ \F/5?4-'RmoM~0K;}BwK-J6:ݓh;s:4t4 b;$zW:sYwX cI>_oߍԧ'bI +r_&=st#P1)^ޑ#I,oxIsH$K]ĪpOss6_;Vhř)'9ַ:)7]ٵn܋ִ|^ظ|OB@;=}dv1 SGZENg?9i#y}OY9vknkLUe_=E $YK;VѢ;K~O;3֊o߀b +$;H]w2kg +̯г +Q +[3퟾?K4i6K*DqYXȪU&$ibsN߱XN,K ?ä_溙=c݃+_.~|[ߘ|ɯԻzr k~CCTt&=6n_DKM5PWUL/.ds_ 3iLS8ro9ĄAqU-tIXe7poRҺ=:­++w-?Ȏp?U,8߽,⋃|5b3@i[-X[ńn-T&6T-|Vyi% ; oTk{(o+E5,3*U+)kP'AtT)ЙUz-Ge$RI'n1\=jز͔uk fi/ecDq)J_pcVQMvqAHW(WDž[Q54i2fP'pUgB*I]Jجe#qCR h +--k.B,o/tkb )k2&IR+8SXiʕ\]Btu2]-}7.u~-P0_qb^K%MlTZeL )4qѷQ\FkeumI38Lou~ ]X^2FU0[b>wƃ"Æ 1ob[ZWPqc_Sˮ2Z.t TmY˸;[׊Ցyoߴ {P/)V.c6%_YI۔-P\ +Slaf$6}xW\`nDMGmEx, \`/xyia`>JUƥƲ,_^9^EjY=[64kA Q&-ۜJdjlY;b+S4_yK;+J-3^lushwZKFAy*ٺnZ]f+ j晪ͭR>ό)OuR1c{&j;[^E!_(yJ+5;V mEWwْoBA*4&z mzR1f7иKz[OƟv"O +endstream +endobj +732 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 731 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +733 0 obj +<< +/Filter /FlateDecode +/Length 4737 +>> +stream +x]ێ$q}gK+6 C ݵ^+?}dfTfV̪$y=]Kd0U2W KdTJ9~|*z⢨FST'b6.?:jUgVS1ŨPi*F냠 +FsT0GUEA9yI3$p۪2̰ѐ&(j-`&rV$5*lЙh%s*D2HB>I:->k#:❶OxSf3k#:؂آc(3H1/I`cT-I$`S(I,`SVhf((:k$"px +8[3WIga +H\l$.p`[Z$.p[H\Mpaq] +$qJYuN H=J\+q:JAudu5El%.;*g(qw1U eSx&MxF,.*A'qw-H+7xzm%. %$.PGxp`%.zu1eH\&c4JkOee"<.[xYI\$q8^aExqX%xج%.] ^A`}SF.+SwAKVJ'0 +@2F*qAbyI\:⒕q tœFSH:6aI:f xM BdM@(J\c d B>QQCAYP$ Xr Z⬕ Z؂AD*Dbz[1? ؂HQ0JH1xUR]H +KJK I\3lTKJ3At3Fda A M2+4rIZґ<3I\((%.4A u4!qƇm/q$HsDlq$.Hr$.H Xm%.69ߌd [I\uP&K\Nk I7-I\yf ;|)0o oF 2EMY$`'I`$qA$q 䛈-f >$xi7JLV&8cAkeXgA#0e +U( 4m8a}f71-}9z1wش??]~; +Xs.o*2Lۖ ~s7ҀM76K1|m/dX63h/RrA:_VqޖF>Ł`8_xƞ7.nHf~?a>]O~wbDA8iy3 *ZS^'9|SYί~𚺼c.momC 6&6,l 籭鷧Goqnzu{3R6%)7o}yPoS{m;qS6'̓Y +vx (A!A8Jhms'w|4og3x/+a^F@wIGq?_!W'n>8P'ŕWfVSKarn˻q"Mu׏6|k_c?kaǟk,2o?~?i\q܌o.뇹_˭}6vf7~kfSX0ݗ sdĕ:JK*Ggy?w}]cs?*P ޫFn=Vch}sD,~˖O:'M0jkڥq!gS~~C051 {7 μ.)ehklY~edYB6R[޶A稶*{T{cR9u{7őF{kmŹYuܑGxtlL|IE7 BǢϳgwaAx; <L2.u ª;$ 9 u$ &\h˸$dLK˙6-W5/d~yҲi9]Aܩωby\{l5\fmm}f&_Fb@pċO*yiRf`WNh̓|${h嚽wiY鐼5^'wbl]~,uN=de& 91;=QҐ* θ+db26gJ'<A,JKѿ3w*YZn:)z]8ĝƪGzӡu?VxpsC|X_Jt|Y0 wcJ"?9y! W;W[xh?c]/ӌx!sp{@ }+9}-vlC-:) +\۷>t(ۏN0Jn]R3OtT?vWOʨ;YP6rn9j +쨝SY2նÙ'>n[k:+;|L8/`dCX ?c}gϴ\Oy:Ĉ;C"=+d8{{ Z9:OփOlwx$'jYLE,(w;?l۲_`5rӤDt cFk + + +(8'vM{Ҳ݇"t-ļ QȢqI~n@tX29XW:kn"pl>0gavs`o<ĤC:>/6$/f_)\i׃A{M/9iʱ:$e,/5M|eҎL&SkwjosA|gb.s.&ba캈%+'ALO:p~[[d!YUv F%Wz~O׻VC`zŘ:VwI*4Sp& X7+Ӄoz讋-U{ \> _8 vAn-}|zmz&sQI}-8 E~kӄla0I*˵ ]rskTlR).5 p\ohvR'ioOm&vG\}(tCMtKӕ+L*<*|28~;K'X$.c/PIn[H yLR5zhA4js?vJU.. UZզ0Wn)wD/StGOqT8*aSۭ+^\ N-L,zIWe۾iw]mmP7$Tj~SC#X-?e'Ĥ~;j2YWO!߱) [#+Խ' "t4U PcTFZ-=a+x][elȩ"77EmƩտB)?O4 +endstream +endobj +734 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 733 0 R +/Resources 4 0 R +/Annots [ 735 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +735 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 627.273057 101.433071 608.523057 ] +/BS << +/W 0 +>> +/Dest (cb163-1) +>> +endobj +736 0 obj +<< +/Filter /FlateDecode +/Length 4668 +>> +stream +x]ێ}gyH8 lF0C~?j,QKwώfUE%DYKU"=_>~9IĿ`PJ J>,0Ati߾8{ZGHkοUֈCQ%29vQy%p)q*v +0æ8̰ZGFaA* T0C%Ci)Y 9VǤ Щ91tIx]t$s)k%-4oH4<&cD:7VyE%#eLҙ9N +V\s7 +{>03~Sv?~BY@:12iY7ui.msMW yiyUx\S١s۶Ğ8m]J~N|7Q^ +mm_G)`tfB/0! ^A +5Ŝ"\Rݴ):9S2.˜iAr=YhDn]btQ*(Ē8tKc}c@J]GEťzԭ`jYk2hhWphjP-4s84n?gu7:#jVnį4!6-_tg!v}4%} aVL[";L|KĐ?[Wp^Gg% Zo}{=U>˷pKtqq>g:WĬ\:G̛g6;@γ }۾?bkv9zͺƱ%xrvӥ?rL#ڦH;~k7|Y@iwGG;䑙+sK;,֝~l>3րs8nz7q/e +#}dtС߲1cDoEcuimHFWU߱]7vXɧ s4uSo߳8KXF^uw?uΆ͌K+5:CԆ^~ki<-]AgS>5-Ҋ!ڊv97%o9Gsa:b(~{Z7f<}fYFm-#s8d?F|/:GЇ6\5]U~Pѐ)6hez_lg/:|M16)VκcNM/yߓzէm qr^h٧k9`-rxC<fk_kKwX4̹6{?ǐѣmCĻXwdv9ֽ{F6g>gy~U;; U~co;786~.u+~aaz/jO^{轤qBٓԂm;7W*lZw9ZR}!ֽ{2s7}}'93dJqZHg}zzdg!uoMy/k#2:GCdx'Hn3y6w;{;v=oRxgm3 %O1Gs8no[!xGqgáq?] ={5QCroj;G2u>]";Yhȍ~߳vq^_W}?e\:CmOF . H3g'9}gnOw$RO#. ;;^$Vأwص\V_g-z˷kbgw9b7ٍ=F^ tМvW.ѭUx(=w[WF:~ܳ#ݑgYp{{>K%SoX}*$:Cc9ɯ+ >֌ @}61dz:C~gU *zB(sފ-oq4TyU0"8 SfxE68Fy9P#<_`kM!%C?|U6C~dp=#9+Tuy[м JCppX†ycT'wcĞ\+0_N~xWW'}Jڞy?jH~(UeбPsx /f`__u}m092 ǓJVϤp}Q&~9巸ZFl;Y8~\VUv 9~Lƕڕ]߮ce)d\f\^ +5p0㑯8_lҲ턭XIn.&ֶأj&ӮSdKYp /'4kz +,*ebTRWJuYd[̮XdkT1ˉ-7Ց +TlUSfJG4W{9"M8<ee$3lMrr)WHWGlxiXfw@T43A +vsD徲z@ʒR!TRQ23ҵ&ReDR1/T%XUUq?+P#\ +嗉TKc^z&;_8W|z^" 4Zծ5F0B7}eVv}&^N?eN>x;fE=_^jv]ǵl+Nt%o$; EX jKhUle]AC]ǵ&|m[uوTAURk}HĺBW+Czƭ/]/VGѱi ДC3&Xz98Mgڒ|&Q.ږth&q@OC`jM̀Ԯ[:&EMٶSp\`C艭=wO}4ٗګJei%<^jC?=k92y[s2LurhPil6jlhY(*]@&1XtpőP}&R;Qeūޒpd+Y}<]4E6oN.\mVJ̝k.*?C&DP,V9ew'zFzd)CXcdPۂ /Pm9UZ%L*ќe0crHÐCEWiTlj]NR( +endstream +endobj +737 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 736 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +738 0 obj +<< +/Filter /FlateDecode +/Length 3543 +>> +stream +x͜ߋ$篘geIU`Cpa &[8!~-{3]RS%MϺϗev&"/ON֤`o)X?7Lp%p(J&S!dIc> `w=bf.t DcAw]AS4he\.QcAw]b\ˆ+l\EcAwHcAwϬ7^cAw!Rk:pb5pyCXw0 7,\WcK  ,yfD%Gr ccj,.{X]4Dp2U[({kòU4Uc=H]0Úܵ6ܕ &d^cAlJJQcA,:|.\B,U[8$֦P -Ƃa RLqȾl-5d&f)D0.zp2t.i,H BXX x#c,E&{d$ BƂa Ag2X$Zӱ}fX9I5`` R:Lh,f;h,MlsTl r r-zMo&d| Fd8tj,(.cYc֥7ƂBMlu[(~3i,( [RU[4e݂IoN._XcAQYc 7ѫGYI=.wC44j,lxCB~+8zb`ހتX*g=zh3Q=5@XYi"$曇qO?Z~KW~`k?}8n2y{;V,fkK۵^-QLmoeޡ߸! >L]6b}n6>}9zN~;ߒ·;}U~n 7\i\}ߖk2jmIKilcOڷY0Η~uWx}@&羚Y9+L73<0\;~b +K7Ͻ u&ؼ`kZYŗ8ն؜,myxŃ_ys̷y;+̡qO#?qU~N:ª« J}mVƵqOO`}uޜ'NpiEL͙8;famkb)POCnJPU铎uw}:ys>};e\cQ\|$m +5RߚC3J5ʼCNF>Uc+?wpgv~ngNI-|eM'' /em ̇+[; +jW?Ōa;t/8MՒ)xz ÝuޜWyw#j^yQ̒k{{p y%mnB8tԵ~+G:oΣn>vnLٙcށ##.7ښ=4ޱYC<1Uہgs3 `:o+?e,?Se;dKP۵C_JykEފ̷xHc<ȴޗC죺MO.M*}wq8-~OD:tn^Io +hyB'yS3׏n3b|0Ѥ|Ń2;%Sz7od[/mKe[XaUA%uu(SNȽ~i'׭֟ԗ#w퇭0CpO<':my9TQĮN[֝\(ھ;cqZyjbpLǓ+ldsvg_/$s`Eq)ֶՂMv{)sI +noKkB}Cj5ym-DkNJ5;qX+ mWb e{bGvujg .lCe}rB4KT<^m`TiPK 6OrR_4c2~5yoHʕZN]Njf*RW-u))Wdm$_~ֈv/2umSR:tVP]ongKSCYe"4gy㸹<دz'6x?H<66S/; K8^؁)ttAJ5O uM,X9 +m5uqhw;C[pYtnΧQڌ;yl| +/K`Y,k']mvA ci|fLӯ%y +M$',w/|}}o6Z֝xd|XWm B^6TohqܫZ5 uad eŖ޹{zsj.e:!<4+)C:쇊a;iC/8$} C!ut-w1A +L0ӲG1wfr+@ M4JۍOr-Y.#ڢaQKr.FW +S]5P4\@fMqVe㬎Rj9E:tg bg%J5lZFwNl/rɬXI*;k=ݐ3S۫CW5kg3:hrrP]"O>9F0kp4:J'"d a&'B7 bh Z-l~ਐkr .l$YlS#.Pf 8 +endstream +endobj +739 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 738 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +740 0 obj +<< +/Filter /FlateDecode +/Length 3198 +>> +stream +x[Mda䒪Cp"0`Bbܞ ,sT|y?)5ԞS- Wz/)oU$j#QdGs5J bj*IEjHoA I95XjGQFDP#\Q$+"$ɑ +^|jƇjù; Z*Mt zuT]8,{Ón/|+|FY͈!|/||n}^L@KSwOlTзU4ϯN_O?0|">#>= >/9oy~3[pdޛ|py7*bX^"Hmf|>m߾zWv<ct(6}򽞶ά:OwcK[Yzu\֖{k{l,kdhˮIU(L}KPKğ)GzⱝZovݲ?WNͺFnzͦҝGȎMƻGC|e^۸[oQen|K3Ǽz̨)Rͳomry~)ATo?ӎd#fl1s:)岨q>#Iu2lvg99VO?ʇ&C#K,Wf~Ѥ^o$D_[ttxL]7D1eZ4+ootf6MmI*ˍ{ Cل}*ô?]_{Pi!&z.g}؈%ia'kgf-e}zvk +{?a%Poh[_Oz RXd- ܿlK\v9El&@׵hq_SxLNj(:v@7k^?梁U vޠh c#W9/4GӷQ¹=r}>f9MeIOin zzniK4S9?f=:65o{pGkek'Jg%Z*gj6j|_>2@dcx\.[7ʬ)-ef%x9ۈEƟ`036z@B${L/bl2.#wi&k~V9N!soi)s߰b60Dڽy^5RL46EE/A)pfܦ:6M=U{JƎT:t +rg;;afEv:y' $qQnd{w9ʍ61<ba |S,9o7Z~S<--H]}}=S^ֲó'OW<ߥA>ϣo>kޯ)xY$P66]zaH 2dNiU i$De5ݎ+ZT={m{# Hdr +#;ܧ>}?-<,4/XyZ*m*;u9؆1{8=qzMߓܘI_>ԥ}#kUF b9 (kfp;(+TlbEʔr?uUZS%LFPVz+{0$uZPT3gκdVieŦ3u6];~G<TˇBtY Zs.,w-z-Be; +2gDO/ⷙ ]\ZcɟDf|CsyqCZmY{(Vq@n7y] (l93(p#f< +xLYOݺ #u}"=s:r(4g&qq_۶xRX ?;;wC.{2[zgW#o)H#[~ޏ,ET/ v16CR={W|W^~-hz|9l}j<&k\SZ䙙ܖ%n-vjS}ڏcm+e<k:[ UW]*hށ6ojztք; K(i\)QUf;Rv~D/J*E:^Ga,@.tvMS-k*-LiP6 u[~EZ#ʖs1hRZ7f%]UOl:k\\^/]UUK Yd6?RRfCSߎZ%UMGm.|]? &WfFڽɾxK+WK/'JxC??cm-T˲4hzvزM \_)٬2PTLY-14K>(R1EoiJmD_rˈW%[ 9S-e% }*ٺn]Fkw -2U-[|w&T/^t7=8%g]4ϳV6&t@֪]Dz /PcEWTy-)ka)j?P_vP= > +endobj +744 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 593.554475 101.433071 574.804475 ] +/BS << +/W 0 +>> +/Dest (cb166-1) +>> +endobj +745 0 obj +<< +/Filter /FlateDecode +/Length 4458 +>> +stream +x][+9~ϯ36_$"B0=Bs<ݶIOe+&Lʗr粻g7SJ9w|8}<)zbuQY+'sH6N1{_%Oz/NZg3'SL1*/2TJ[AAP=9K*3n0%p$A`uQۭ* T0CgVCD QY#负$SHdQH:kZ)sg%-^;$lq6EI` V:bR.dA` ЕDlQAiIsrNeTi3O>Y$֓6ÈB'( l gQ[UFYt ocJh54ZybLt%0$ +$01N.'Ivr%LʓJ4`\Q4tFKD`l.HL`5lq$. l ,֩%.[tpaqm +N kX.{uF ڵ. ,x:$.p]kSXdu8*J\FF ɤ$.p]wM 1h%.p]ik (Gxp`%.| ,wu'iդSxN>Q'qa˓!K\ L'̨F3jK\8L&]Q'SwAKF“J`Q'IK\2P x{ wVUa-6 @a+i2` +IU=,J,qAҴ)qA$0I8! +6c dB>Q&\{ DlqI\z6' - -$.@D0e[\E\8؂HQ0ٔsDW%]0SkQQ݄XK\Ԕ0%.O.I\3Nₘa dK: [dK\H:%.H  UfP`ZtN:3I\\(T+M0- ?`&9X$.Hr3I\l1H\lz3J\lA'qAVa0Y8tJI\uz8 0.i$.Va%0n ތd[.=^=KּՆijdS{X|2ѶkRvfOfQG؛U2]G<VwҺfVsZ2P΀RޗB[joȝ6;qLH҅u}o5B Ncy׃[h?GSE#G[D6#"kGEd<ݢF(n<"oĄ;8^[Y.;Qo}~_~>6y F9 {m[Lbπc1 |=[avkE~0áFzs>5e\k>i0Iww=ph{+b$xe?-\5H䦷pȽ~Z# 4mP?~J}u`Ә;Zy4ckIGGPt=iw#P FDّ=ڗyD f#bIbyێ4p¼4"G?o"=ӣ<;V/ZƉo:G}}Z}C9kʼn1湶yamԦ/BA<=Nj>=yͨewĸ<Ǹw:G:rv5 >1;W9ݳ=+~k4Hˏd}}փy }Fs乷T]AftauKr{;H1<OsI"s0Nosxg3qzY|z<5Z'QƕNl9?9V߲O܈6-#F*C}y +y8x`quz!dKTZ ¯SsYd4`n=o,ϣ!_k`'`5[Gb{̽{Mn;hc`Cص%g5Zpg WO u#T㺗u :Ԕߝ:TFc#k'g{ܓבnR`Hx^jTv|QAf\leBګk3pe~m< zAry8$_qzȞqa-kRn9VbTц]+iyWL#b:ܱ{0ϣa:{~ׯaQouG\&1Ĕcy^wVR4ǙQhg$L4?㡂_)=& ?<{~W~K +MomF^cmc`_a߸w, v tz_Ȏ1&o)nڽ1.ZOX:Os.KK2m9a3tᶜ⹧6qcGJ{vKOWtϛy +A9PvAg}^WsVw(y̜wDjw{ae/F uI(myeqTvֶ$qqI쟫[]%ϒWw>~9%z4k[N +ҦśInۣ̂Y'gz\=cm:#,s9IB.sxP\-p=?JQ [DU#SKXQ:tsTު]bexGQ-L֕dt}:(s﫰 &4~6{MB}ĦAh</[ }'ơK,VpuOgV$(iҡue/-[I4דw #v,/J+X_=wOPGI7+,2/ۜctQoP+˲g[ӇF-cIS϶$RWeJD2UeXm +K$z)K=y4'z+aʭ3^l $N- +endstream +endobj +746 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 745 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +747 0 obj +<< +/Filter /FlateDecode +/Length 4211 +>> +stream +x\Y~_1L(^a`@yƒ`@C~b7YIj*:*r۝-~>u3Ԝ|y{zw&G?梱ogg)j* !\p?K'o7&̢`rFU.(M>&kX#ftdeAD1 +]8*ّƂƬ[ % +^h4w&5^&erijRJh<,Z"djgCՓCTC9 |RN`!K!Ap*JY@ aAEÂ%[xK% bZ 7D@.\jXةaA"ܳbn4,@jX@SA8@G\ p785, .kXaҰb|)VbIA  #enஏkX@]O>iXG1V]@Hհ<4,`ƣ,Ѱ w]ESbhe\IÂuSyո +q -Rհ w , 2װ w]@x]հ wQ7D ơа8 UyZ X [$*/8Ӱ`l,P pjX6aAZB٣ K(^5!lFjRh#wș%"+‚Pݏ=l4[~K$9A +}ߞlQ&A~2ݑ`=Z4$ؖ{Ö`it1Z&A~8al;DN\ɃEϩv4^NSAzm΁.l\zvnkk-M$ (+.eCYd>t n|h>$騚ŇCEPA=9vL'҇C:={y_%rT?e7kx M9|O +,V,{{bAJ@>s)%'6&Posyq5mHRlI}W>}nDlGAߗL;ͼak}HOe-51̫ +XGMaW/NPN +W2D}ķhd>>x{ ϭuZG 6zFk5~£/y~91'O:, ~yux(Ƽ{;oVQ2@qSاRt)b}S9Ϻ;=.s&嫅ޥ>׶>c~iyb_qǮK[mkknmRM^Ӽ>3j?5ۮ6$ /UCgc_$'diVWui]bڬ Oaȴ/[sIO{vȐ}#zYir%Bn9-™!]n!uTqn[f}_m:Vmno4tJsX]է6qM{o4c:˜ù ۹'Nt]柎/qD. +[ygq^ y?v]#d8?O!rW rA9|ha9w;ˢmhjF h\Xgeͮ#oQ}d<$y#8ǘ)G9/DZ{8ĥAm=зX8-qJba>-ֹ{0r|Seǐ8V̵;d/+84C#7vi +B?"KM]Ϙl(9Qg76^KtӋvI'^ߺ7RيaX+NGF +5c&T]Zm-jƥ q[r&w_~oLM;w_b[t5[tiGFmSΑsO%E*߮{B^ b"Gpo{gH!/ur>!΄e^!z皯;tw[Q{2;~pzKʮG\>PQn$^oxUj~.f1"}[BH^8 S~ܵeI[RT[DwTq;|?GP]QW7ۭ^_l? t̂_ـL~vGH sz|Cwz}}~#^6&wpT=1ž+mooΛMh“?Ogn$ʑ<]؟ć7>5"wYi3ОBMV<5&xQ~k0$(OEFZmC?\wB_=gg=tO,ޟzv‘t y6'=bz(1uǀ$gG.XAGM.$ѥ0oE0mST*յ!T[аBJOm`VgbD]夶[GRy*k횟LWe(^]w>_&bĆqKm~)҈In7[lj6vד bLj.]UN'*2KjN±9[%IzCV<|Vg6T2Aϵ 5cKv!g`$.8\aCrюɒǸv>Hrwj!W|'^Zb=]I&ۑd8(LчF:Љ_7? 2㩥9烬iHVY_:~ǽhn2{ʝd~O]'DO'ٕ6voy{4 콥Wԡ xxiq2j>~)B +r9,fJ>!qMgJ 9(.ńuJRN2T4Eą(#2L4+ +%pr`rrҺGz0u@>HXS.rN_{N 0ͅQA- I6D14iceJkj)bR*CQZ%=j)(JwsuvdQhIT-C=۞2h +fejgxh^>>ӣ?$ĕ2$jr9kKJWe*h}U$r&P6;~S.qYV)[u'\{Ug;lB2V-Bl> +endobj +749 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 265.954475 101.433071 247.204475 ] +/BS << +/W 0 +>> +/Dest (cb169-1) +>> +endobj +750 0 obj +<< +/Filter /FlateDecode +/Length 3991 +>> +stream +x\K$@AFc 3kX/*U3;d0;]Ue/-lM%E>>Ȥ@W[l.*p[bBɤ\LJ]m{tl8NXM)QPX,^a`Rr!*h XƂ!sV\rX ++C sV.YXÖ%aʃ ³D(=j; ׀ciBwb5p( "pWܦ1 e A4,MI)jX OEaA" KANakS|$Ys$Y2hX[M E R԰Hfraְ | Zxљ*/g)+ 2^pIe R,8*k< YdkXH:/εg{>WENʱCECGO2 3Ry͇UKXuo +uo"BnQPp5~͗2/rG<+e OOqUGIׂx78U廎~i};v7o|sU$\?o;@zGr:ʎu?}2`s<׿I3x`׿q聈'B[[ n-~O ߍyvF[in7xcũoZv&zѶhIF{M#|'Zs<4.T J*u\ō9=,BUNj?EqVi;^Up"Uk;';dwUHbQd|Y;[:O^Ӥozݟw]w?US,-sjc^ԭ߯?1XJ~ׯdϋ|UηkOXN7su]7_+_iG(xl)?gr hS;y:dY\e4}V*-=cȕv<[F-"ϞyqV:.=&W,~134.,u^Kw?<\1y؍}>w6b6Ĉ@ZKǶ}lyLGǒ/t{y>䇼/cSl̻-XHoCd.D3- Y0]7-r\k)Le,_oblI/ٲ<SPLrEӻ+)b pkҫ.Z?yJ^ةg58[‹3)IqyEq+:Xo'N(ᚯDN v:'xC{|bz,a}\\Tsˑ{}8L} k2 ݭ[w9fVdpm>2bc$:y1(dl6٪X{|g}Çj}A3bmn{x605Urvb0=+d$rF׏bqNɔ}K8Z?p|tFMrlv%6L3s]Blz(!6%Pv 8:^%[O1in7yNں4m%iR16T.uIҩ}64c3;5yl!fHەN!juw*Vyt-MCa>w+ae:#-Y})OvΈC~: Lo&iN4ePSnl4yG_"t O`܎>$r6;y;갦ieS6;fR ]cꤲ.D:vؒmNkX9 9tS~ؐ@}h's}A;fr;n.owFbj2ŵ[SK]qVzL1?Ϛt%yWY[y-ٜX= +-ν;GKhsvm2xGdJ[8k,{YZS+!6&|}!,HIȓ\WDZd a{JV^FΘjQԻR4> +endobj +752 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 606.123057 101.433071 587.373057 ] +/BS << +/W 0 +>> +/Dest (cb172-1) +>> +endobj +753 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 296.981993 101.433071 278.231993 ] +/BS << +/W 0 +>> +/Dest (cb174-1) +>> +endobj +754 0 obj +<< +/Filter /FlateDecode +/Length 4871 +>> +stream +x]K$9ׯ3?/ H4iEZ8WfFUV?Hg9k|eȨr t|UJEa џ!LpQm >6s_~q׺9[sƟYTL1j/2X8彊 Qb bH1('/ YVq{V6XdѐXED + OQ JH‚1hUR\H +[JXK@ IX3dR[J3Nt3F‚d! A M2;4bIZ83IX((v%,2A y0!a懃m/asDdq$,Hr$,H Xm%,mr%,㓰 M0doZ$aAv&Bw<$Jxwv)yY3w1 !<"v?%Y5;;^և뼻XbQw\XNp/Z_cj6:]&>u}E^ݞ匽:]).)뱙KLҢS.[t1HuX 0Ɩ4Iw2tD7W=KfZq|((⺣:{cPf7)GۭnJi辡xA[g21`Y(>̊f[u6uz&c\.Z~Үzy,FճU~Mƣ]Ե449waVjks0]_q9;P>aO)&=0+lHƓ|2x%T]ƕ 5AW|Ds\Ner&NY޿?0q:N^lÌ*Omʧna;d)E21[aH4|t  QEc-JʁbNRK/?-tKgf*I䯌6|o5ka((~D܁e8|z;Q$dDGu_/<4?8e Af>CMJ1O<'?SrD<̙M:_0:M8ZUp:i>ØjWI3(ΠHRU'{-[e]qϻu*X^;A3|L:J {}[{vpրKY*itG&T0jpNp%H=d[{/ڵd=YzB :uny^k}ls&'2n~kjr?_ksU^S"C V+}nLɾ귎H%FCQp u9@o?etÜu~͡kIo^[)jt?%쁢ӪAvC? :?b4!cˆ_Gd?ᙻuN.e`p35ڐGygC.eoYi uo>:ػP|2cmnTjƕC}B_Sdg}^h_ҹܳD4²Kv"OۖѫC<٠g u 1d&Mwδ/?#j=5ɳz6)/e _oS(oB0m8:rw'K[Hμ#& שM)5+5K$_a_`,A<8o'~`f䤇 *?|l4~.P;|1MW^VLuHߴ0;*ڎ/~p~_A[Q'Mx RϬ/RS2!&J&:{u +BHiJ<\vdi'rNG,15wZS +0YOytIP*;_TU +䩠 +endstream +endobj +755 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 754 0 R +/Resources 4 0 R +/Annots [ 756 0 R 757 0 R 758 0 R 759 0 R 760 0 R 761 0 R 762 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +756 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 713.673057 101.433071 694.923057 ] +/BS << +/W 0 +>> +/Dest (cb176-1) +>> +endobj +757 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 373.781993 101.433071 355.031993 ] +/BS << +/W 0 +>> +/Dest (cb179-1) +>> +endobj +758 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 354.834971 99.933071 336.084971 ] +/BS << +/W 0 +>> +/Dest (cb179-2) +>> +endobj +759 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 335.887950 99.933071 317.137950 ] +/BS << +/W 0 +>> +/Dest (cb179-3) +>> +endobj +760 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 279.046885 99.933071 260.296885 ] +/BS << +/W 0 +>> +/Dest (cb179-4) +>> +endobj +761 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 260.099864 99.933071 241.349864 ] +/BS << +/W 0 +>> +/Dest (cb179-5) +>> +endobj +762 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 199.152842 101.433071 180.402842 ] +/BS << +/W 0 +>> +/Dest (cb180-1) +>> +endobj +763 0 obj +<< +/Filter /FlateDecode +/Length 4696 +>> +stream +x\K%qޟ_qD 0@&0!U9|n>sFx.*>WEvu3+2[sIϗO?Ȥ@WKln*Ml ? +'Jp)Oow;?7ֱggJΆބޤU"V&%Š`h,;>Ƃ\VXbxNYbdYcA [BRX uD*w +51WT^&71 Vc Y1d %Xfx}N/B=?{> ec`_r^BPgY""$|c7 + Ejp7c`1[>>_ I;${m)MjB #]Suf~4YeEpČEW^yw>^<}8!wӤ'o Y~<}_N. +Al@o`׿q聈RDօneD( O?/RhǓLSMr^K7q4[f~7wq>ӮʯB\ByGSn(p'{LNi mR*%ڈd=0U>4%KbD/`=nѹyRecH Q٤',Kհ>}}\E8 hҿ]u}ia믶mp-3^mmޏߗ@~{zߍ[cpN먍aYCm}IzbwPo1"8_Z/!tcLw5y8cl'DT=~nm6uY~0y{̜Ōڤzy5lkأIJmYeTϭEId4мTf+=PU򶽫Ӑ +vctO7~7ymm) 3tpM%B/b Cp(aA󃁸(иL %>I<_iK`rث tqf`x]u~2;zSi$ \m1%y*٧{/!}վw{R["w5.+mλ>ӮB;a#&Y,p0ȇ4 `/jPSiRlCO0wrH=(CA;^j8dSvh8 +5m('MIC9܄N3t b]IG_yhs269|%jhaޕ;r4^== ˍQv:E\^!I)X$ʞ6x=V^Qr4윾{~Y"B0q϶b3D6گ'?hsyrD<,%Ӊ_wM:)oʒHòroj)[k1ØPM:龹1*J?<[ϱtk>lߞ}XY^VR~d+j˯ǽ2xpр KY*"е>cIBx+i:\m| \iRmW,/Yǖt?A ݿY3 K'`%7lazHIA1r>> =#.r~>F&(|F s2D# i;{4sk1Ju\RSfpf `X7g#C撳~b;mScrh86%f}o7+k5Ҝ=?>!q:bnVd%YXM:wMFNbݲHZ%p \1u}n^‹)jdDL},Im Jos4Z ՛ZO{x^f#/πsLVZi#GϳGs4m+=d:?%k<e;4{Qϐ ^w:SQҔϲ>q65U5yicۿd^kX{31֧mo'>^Cm'ơZ&\s.c5ikfUF?ڷY<\fT#[햴k׭g&NDOJ÷m#PϯvoKtTyk^^_{祭6o-5}ldol9d͇؎zvGǔu>߶_ǴF\:WR+ӯm1uƴf=q!ms&?DL 햽vy[f =v~G6"g=Ƕo="y)率,ك2 ] +!X__̕_?#[ΑH_:] M׶|>$/Mq9ͧsv. ;߆w9m^ʚ`MLl{Y2Y1S/Vq &3f2,r<6M*֞Ԭ,A"^qYT'Ǔ<OQ%gn$b<<KmavJ/郡rxm?^Em4R?j*0S+˰K +5=edJv!@Xb%&3AˎGŻdi"#qg vgi[YEЭSU|,5մ$TJ >O +rR_Qk1?͚|ra!fH˕VN!]Njg*RyT-MCa>w+&Fȷ-Y>ה'q$類a`fz3Ovra/Ϊ*,F*B + ݤnt"kJ鱣k={픺7ŏt{鮱 uRDO' cK:Y cL&M}CrT΢=v9v|ɩϸ/ty{7:6ޓsduo7:C0 }Z;:WXdǽrnhV>5GY({?/0,~QG ױuC=|>1?H)6b_6l(5t?܄<Vv;Dvtġpxi2;7a/ xvG +7pp|ĝ.\vSE̍v 6bAΝtՋ0vөm9>owh姵{3-xs3DͣZ ̝rm:mhhdk:j)bP2k:̳ҕYnx=Z= +91:%{,Zkw*ю}m0xGdJZ8| ^Y;NR> +endobj +765 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 653.523057 101.433071 634.773057 ] +/BS << +/W 0 +>> +/Dest (cb182-1) +>> +endobj +766 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 634.576036 99.933071 615.826036 ] +/BS << +/W 0 +>> +/Dest (cb182-2) +>> +endobj +767 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 615.629014 99.933071 596.879014 ] +/BS << +/W 0 +>> +/Dest (cb182-3) +>> +endobj +768 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 558.787950 99.933071 540.037950 ] +/BS << +/W 0 +>> +/Dest (cb182-4) +>> +endobj +769 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 539.840928 99.933071 521.090928 ] +/BS << +/W 0 +>> +/Dest (cb182-5) +>> +endobj +770 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 478.893907 101.433071 460.143907 ] +/BS << +/W 0 +>> +/Dest (cb183-1) +>> +endobj +771 0 obj +<< +/Filter /FlateDecode +/Length 2686 +>> +stream +x]dϯk咪!CpE` Mccz \9GzafG=RU̻RjNv~>nr|5 +Ų/@5. kϯKpMerY"QU+Qr1UC`FYa +fX +P^Uf썩`11@t>IOLKJu:өGtեba:-g[7-%3]-T2l Jt`w-3]Uk1 +\uAEU{7QX.$Rl*K!wg[BFulAq1 cE+Tg9+@Yq@C< +l Rlj` *0–`Xa0(pkR=c&>1( 3@A\- V +*X.=3(1vJb,PpW chIutt2^2cpXUu؇{ŅRP GeTwC (`!1`8Gh4!e,y]P%iRcAw}Q]u>cƉbO2Dp2Dp,`É "'5Ӂ>Ta,.X<o .U'ƂKP]vH0v8 8+cAw%2$pW a-q tp[V]XawEre,Hn;6 RnP `C R1WsN +t.9#cA"EuŲ1 vUka,h9 \iz[]h~`"cHJ5c,1!ì2] +d +t>3lGg,@. +w-\b,yc,U p3- B=cA  cA Yf%1LgXP,*2MiT[ OK#c$Hsh4ƂRBK7 cA)%H`,lff,[1TIɌ8t" -,U&R0_Gھ[1ػs񨷷cޘӺiijݙ^E9޶Nlw_ν^:q]m%˟0w˘ož5bqsG9\&Htq,׼NUr~O^'\lw8dq!0m[0LN<;6s9tmֽc_G6sWeCD~\꽿w;--=߷bR>cӲ}=%FjݙN:K 7Z4|GXdb)~<—6-;. +e#.q~7(]ÃyXٿu\cDf؛1j襶珎-ы]g) S!/|lbP8XǷlL]a:u~Y^7e9?%nV7*mW|U}vu.F!XDD׍jbj-Q:o$jGD׍;JQ̦4enu-clSۧ{qj+Q7IxۓLj +}B];E~RT58<2ެ4;i9Ӡge|cϮ勐 ;2e؉{~c.h  I.5wi{tA-`x=ڇ3C.n-؟b_fw8CXxmL~*sq[7x]f&~Bx}޵Q>8t-V2u:JZyCkaiR̶!N7m] +m}-%hE:.GTAka}zg1wirФCz[c`M:ǥ}q9zisƻt=AtZ]aݣfgvj]vi?(. .oݦt6ӲY#י몌I몤ђ(9ɬ9bBdim=6kj=m} æ!iF2ŧ_Ŀ/íտ_M#jY<&%%0r5|Fߕ=a9J 7(+Wͪ! xʖ_BhsKۿ}i zK: ݯڏ]2| +endstream +endobj +772 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 771 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +773 0 obj +<< +/Filter /FlateDecode +/Length 4231 +>> +stream +x\K$@ AaV>̨Ȗ0]Ǘ9U΄+RjN||8}<ђ#_kho%J<BKt~<ΎKg_jM%) +`b\r1,V1bfGV\KX/@م#B [,jpAb๸$(=Yb  쓅pCf6D;,X ߃烅lHK,,]W1 Z\‚u3yuq7Z^\J‚F,,]g`GD ة-pJD.haaqH,,8뚼P-‚,y /T$&//p$gax!$.jaAR ‚%Fc K(5!lFRX<.9Xwr we۴ e!ba\{ R,,HCg҂haA&" Ala륆Z,,-, eRo<,p>`ȂL R*9&cЪK~)pm +x.[X3/؊HdaϱB؊⑙[<Yd[XL<,,( *3ءQKBIbaAHha&A?(6Q<"[XPrXXP +d-,oJ-,YYXP)-&[X‚ +M .,@7Qq[Cz3[XPD(& iFPo,^,5%7H3Po"7ԛ<. +dx]d\Dfk,RqĀ{yd@^V<3 HDeYyjmLG'}D{fɲȊ`dv6uzY;)?Q0 k +k8A!(&E~ 3"to pMvjш"#:8=U]it5CV)EDO(P^cmt渓%^R޳?ߧ|/ >3^r>S%)'%p?ULK+ⓗ孪|Mە~~c{DR@Pr"WX,Ϙ'иyylLwf,+-3mI"m߭t][c9.%E/!ڿclAMSnim/s&krj,^*XL!wziY\dlNI FfsF1m~}'uu7uܒ#䠹X‹LD`5nzYt/t߸I[4ei1ևot+;UDۺ_a?*qg N]͟\ z~|^BIq7-]gjƆMB>Kænt'>s3XʷO8zv#.!.lx}=&|oMoo|6qx/sVz|rM}Ń<WXOiYw\BH>ދg>r7:d3o?8$?)ɊWg";.q_S)uV?yњx3t{wr\&P'촂uc<ң:5)Gk;{:'lOAs-;{::{뿮FMn!ΝzOE5_k?G^p>tSoZoHe|MŃ_#m|覞򵞞;GjB۵{zW؏<7q1[z,!=ן UN~!y(*5}6tgMi_Kj~Ÿl!Et=H=4,lg u|hpxe_cHyaP(g-,ؙ~Z!m#l>8rmJn9XR1VWyD\ͷQ->:جub]×fxJP@, Iy.,ϣ +캙\S;?ѳvh `&u e /~)I~T׮A J:a'$oSaWVWbģ] dFRy*k횟LWe(ޠ]ԩNWпr`0lME?/#'ݳ{l'VP쮧A;ȅLj.]UNgn* +/KsjN"9{%izÖV<|V2 Cc;R'u,3R &9W~ܑqj1YrwGMN^0*K,_$ivs2E&yc#h$/v_gY;S|^GgYo8fu4lݑN&o+wp8F=+؟dWfؽa+ٝ&n \MSzf J#z0Mtp2yang5$e:BK5aԓ ՋMd.u sCwZ[j8 =0;=icvDN=:}P5u,Lljhi9ڃwjhT셑И.*jݶQOʝo.@N#.SںuSKyw騭2Uҡw-EyfˑKtA2tqnw۳ZOALiv¿Ď8ժWkWQ&]*)CX^y[?L0!PvNd[G0 5T_ݭ)טRvB;YJEynȫ2=0 JQY +endstream +endobj +774 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 773 0 R +/Resources 4 0 R +/Annots [ 775 0 R 776 0 R 777 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +775 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 488.554475 101.433071 469.804475 ] +/BS << +/W 0 +>> +/Dest (cb185-1) +>> +endobj +776 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 427.607453 101.433071 408.857453 ] +/BS << +/W 0 +>> +/Dest (cb186-1) +>> +endobj +777 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 115.110432 101.433071 96.360432 ] +/BS << +/W 0 +>> +/Dest (cb188-1) +>> +endobj +778 0 obj +<< +/Filter /FlateDecode +/Length 3943 +>> +stream +x\[, ~_1WJI !B0y8{:!?Ӛڜ$TJJt;[~'39|ɚ,~jEeW +gg9J(TO|Ÿ˵Oޔ ~',&rJ6(uB0)VtK,EcA 4`89: +ɱƂ[ e&\0J;sE%\.8WL1dǐ%4^,1[YrxP$ ω4^,) +/CXWVyF4^!JfVy &d"3I*MIym(*^daj` z G `(ch  z8Yϓx%+8ZK԰ w]b\hX8HÂ|f 'װ wx]հ w7 `!аq%g p5,)lld`HNC5,]EÂܵHÂܵGA^5mFjRh ɂY*pb XB%kXuG>$#Ѓ,By.>1GTGՇx^GG_7_귿?<G[8",_>In:sx˷NPN.6ט*p%\.oҦ$,bx p#͆]kǥ0 *e쫷Uӗ_~T|2ᗟ/DYQ^FFO_xsb !!jbK6H e]{+>yܯU/~o3G 5e.cw&|rT,2 E"H/7s-QخClfTW~N.\s5i&R,:k1H>dcc{bV&v2l&-txuVh.Œrêܯک²ʼ~MG?o_rU&)XG8 +!tDZm]AR8s-;}\&xFz^6;r1f#}k.Lݮ-*] &6_lVm]v96\[0ηaG/s}8ˤ}tC$YznSeߐnu=;]ݦk޴n#vS7O.gU[|=`ÞB-ܱt[r}W_堯@aJ:Snzdǹ9fVvuNwnG?6a鞞䚭/g M<<p:v7Xa?Ikۅ.}07ag^u]]v`=' yyU}t׶:v-:eݯznw~T׮FPePCo96>)I!~nЌeA!hWz;t9haTZ()+˒T'vG,{cm^Sቓ| +Ii&VMo%2 g;eRSkv.7*S8&%̫9 @48Ͷ\JfW}l؎l'au,3r%.0LyGrɢ[=q'9|^i츓犆c;R6&>${;N9B&ys%wo$ߕN'Nozy +^>15rel縷-y=KdNn=/?.϶[8ǽ_gw;tA0u0]hLC\iq2?vo恽]R_!yKu9̓GH>/CJ#\KG\rLvbA Ջn\F%Mcv*&iXfNZv(Bٽ~7ch:&x:e_3'RyX g -xwBͳ[kIvbhƈ[j)bRj:2]2n?FD# +9:;[X2+T-ӎs~~ڞe$nMQZZ qy>Ɉ]"O˩lRyucEJ֙lr5c`P+nŪKzn>?Tg~\ B2I(_+Ef6dǙj'k Y +endstream +endobj +779 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 778 0 R +/Resources 4 0 R +/Annots [ 780 0 R 781 0 R 782 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +780 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 770.673057 101.433071 751.923057 ] +/BS << +/W 0 +>> +/Dest (cb189-1) +>> +endobj +781 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 458.176036 101.433071 439.426036 ] +/BS << +/W 0 +>> +/Dest (cb191-1) +>> +endobj +782 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 397.229014 101.433071 378.479014 ] +/BS << +/W 0 +>> +/Dest (cb192-1) +>> +endobj +783 0 obj +<< +/Filter /FlateDecode +/Length 4574 +>> +stream +x\[,ɍ~_Qφ Eq30 g1uNYz }ؿOqLUVvOϸaOӧ+(2+UR/?]^_i(779$ .r˹寿c\9X,r*X,m^h}X(,1g1|$K{VXM+A GѸ=+C  I,aha"h"g*@AYB6V9B$*#6Coă,Rxȃ,6E'"dNx ȃ,:h#S>'")=j|rNKив2!d 6%, 6IX`+aAHrA‚5xD^PD dX@.,BCDP%71|Z`2e]4O<`\%}mwt(`p +#r;ԓ}]gzϻˊ +SrB>jP:6# uu4i:ݝtίp}]gzϻ8yi^ Sy EWNlw\Ab?"#^$+ he9 h1HVHNܤnAtlӏ}0Cm&7f{W!Tԙ(x +l#jBHorM_ЩNDhk4b(@|b\ e?4mgͣ/Rt. +`iG!o+0\ o<ЌNy7բȩ_m?*xwb?fCL 'Ocֹ|k9h~^c}y>l"nlz% O,-K0Uf-9\P h%ͤegE FA_-ן믛l +Nĉֶm.lͺ_mnnIwrbHeъMdoQ˱^԰fAĿ}8*}u=ۺzd ovY}[fcO5 f2cmgxMaxrkW4gIv6uaԼF6N%yh7,Q eGrtO=Rv] ?4!.p[N"g]b*{iYzNSxϕ.Kw lqۼ]G^>nȅn7^vX7.G4ծuFOȰȂxHWd{'2#.( u 1?__uy[>1myaޜhcXKx=G1Ƀ_1iiW4{e}:Sm2£"ߡ-S_iҷ΢X% Awcʫ i|1V m"W첆vR7-áv}FtGLӦ0yk_6J>ҰNxx16h~x7z4LkmyHo~X8v(Rq^.vʄRX=];P|F›`W*'7U@@_Ǐ0-u}>~p*p~&_V:~)=0}>Zq;}mR67* 5\bݵJqcmn_q+p;|yĉ{?Xg3GcjĐkl8wgy!6+Õ6)zM_ߊ&(MR9o'4,yw;Yyst&2­A6n#?;KBGpgyhf,?({ly|4+]߷54ml5;af5۹~&9ڙuuC\Μ-a[O(Č>ժ=My{Σ;V8Ōg3}> @ǵhu9[q69Pܖp\G~뗅o^)p5S'AG~/G7g՚Uŵ޸㠧u}䁙5מ鿚3Z7Vt-FX1=Pm>k^b[5>Qc?uѶ^֚=uSO;i3~?ɳz#*AYn~dS^PCRbvd6Xsӳު +LA{¦?^L&/6BN] ˅@&G> 3~},2qF]-W~drYo7GߺiIF|tX g0{2^+Sꫤ\ +] in;zn-5y *. b}Vq#iݖ"R;m];MBNe$nnC6], z ElWG}boF4?DRW@M-G~#ڵk2? +Znxx8/~`f䤇 jLMU$A*|2I՘}J顣I0GI]&nLB{޺klET6cn1HuXMNfkX9u "9}wUdL:vw[8}V6ڒSdݘl" +<`vt7 ɤvsyOgRse6\Gl[W$Wd~%a#v&dF[߬NxMZsg:ȶ5nҌ? 6Zݛq`/-8~E +rpύ#: +n:tpNq1i<$[9OUӼ.0/8fbjdIJA7*rh2S˜Or֗qaCC},7ApZbщFϓR&mE tc)nM-eIR1Š}ִw+ϻvmyvhhc$ܻSits:- aDzto¿gSuZR 1i5+r)`"4>ǵ}EJ晰Ke^ȏPr%NB)hU[YK]eT_8MȨUUjJ(_X +endstream +endobj +784 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 783 0 R +/Resources 4 0 R +/Annots [ 785 0 R 786 0 R 787 0 R 788 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +785 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 797.673057 101.433071 778.923057 ] +/BS << +/W 0 +>> +/Dest (cb194-1) +>> +endobj +786 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 736.726036 101.433071 717.976036 ] +/BS << +/W 0 +>> +/Dest (cb195-1) +>> +endobj +787 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 409.229014 101.433071 390.479014 ] +/BS << +/W 0 +>> +/Dest (cb197-1) +>> +endobj +788 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 348.281993 101.433071 329.531993 ] +/BS << +/W 0 +>> +/Dest (cb198-1) +>> +endobj +789 0 obj +<< +/Filter /FlateDecode +/Length 4800 +>> +stream +x][$q~_ςSK lk1~m0s G~Yyʊ]m/ȪW4St|墖wՊt] q?%/q.fI).!JP)msKyA[LIR ^`$ c0RvJ0M +f䂠 +vh!At/^|L&FY@iIｋ`KJK:[&RAybU ;IEtEQ[WZ%D]N:⢵Ji8`ӊ:( \uYe$-Ip6(VgUVK:[ $` _ba +^̠%&!L E  +J4`[ȧ U:%" +8X [3WHk` +H\`-l1d%.`[Z$.[RIK\`paqm$qJI εN ,H=H\`y#qZ^ ޵޵5El%.;.VG+qwVAb 0 p%.V&*&` uax8܂rwSF2^e(1BX3V4%8NX9 ZtL^'Ң<.[xy' x wAQpH\bt]mw78 E#ۢ+ҢR8.hH\UxQL" i @ƋB*qbyOxrJ\:bq tœF(t]1’THxn^6%.! L.>ҒBC'k'qAP8P-HK)J\ lH\ lA q"%iDbz[1? ؂HQ0ycft-"t:H\-XȥI/q~0:M[0U$.RD\i؂ [Di-qA4ѠDd^I\$\-H<3J\/9T&RЄl; D#`u$qA&QaQF`3A₤` "> K%.CIG䛆$.f Y|)0o9 $-!-0oI7NH}73o"b7]u $L@Vg23; +밶[ +܋*{ +s$qf"^5 +Vⶁ"'O|kf &!9(f[˯߰^_ ҄ +$ Cq#64XTmH, "l,,xuac+LƢ62!sv )`d&֧<49 &HA˶~$[le>CҌ =su@A*+T9m9ɘ#)PvV>hstL}w4X-&el2ys#=x~룄~Gة~w׿?~g ˿"u7?h\wQL\XDt۶ʛ܇a[_jrwB;qٌwL_~q7vق$h+!6"ܝ-[-CCLu4JV[YwZ#p`oTRnIn-} !m{+U CLj;qM$ aa-=>2_m MͶ~AܷK Mq' u}[YfD  +OJ.;$=WJII0!NZҔx{ݫg~z5 KyˌTnB&le3e6Negݻfcrȅ*7G]8E64v8uęˉ=pT3mAOtsVY3GCӗ:eae6_R #$rH|>C3?6 !m;}%џM;eNl*m pć&)׃!\CqL9qy cK7mz?[Sm{>Y'c7oD&CS+u޼ "}y9T?/" 7ӻ'c}bodWC=؛b&\mW9k5fع8o |J¾rͷ6޳C{ɾǡ>l˧exK> m Vl;6 On`]e{v],=m]ݎ7;}k?f^5j۵OQ1,c[pv.ös>?a}H0Uw4jo+S[XoG6j}l֣C>bϛzNjM_q5k04̝9|UyjmXy䧠g?9g󞧫{uw)mZ~SU_CۍZׇ̟y)ˊ_yv3nbgK0z-(elT{i=]sVدo"tuDcK8 G"wؚKKbjql~Z|,VȖa֎!jzW|m\l *&t{b fGu!si6 l8 C3[Sͻ2RVqD A lc06 Q/Z9AtjkT⨚)9K/fsDq+λ}Ud1;! v+kB^4`dJK3:ljtfo徳IFY.B,J(IH˘GY_(; ]N#[q:[έ1_Q8-ބ}0!FC(:n k VRw]˅nMіyo{ c3ҶC76c׬\ơcI&q%Z2".xda HIw}P`aDCGcM7Y V!aҼӴG0ǽ N]Ʋ,o/cK~&Po˲g{3-hs1ʤqTli[(:]@MVkn)wE/S _DGvۊף% ݩQǒQy^KiM}n!~DjTs̝δ j?e'Dq~'j[KP>U;Pd[#O9+c!kU?בM"=V#WKJ l S+͹!/CNbsAi$f 7 +) +endstream +endobj +790 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 789 0 R +/Resources 4 0 R +/Annots [ 791 0 R 792 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +791 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 228.873057 101.433071 210.123057 ] +/BS << +/W 0 +>> +/Dest (cb201-1) +>> +endobj +792 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 167.926036 101.433071 149.176036 ] +/BS << +/W 0 +>> +/Dest (cb202-1) +>> +endobj +793 0 obj +<< +/Filter /FlateDecode +/Length 4069 +>> +stream +x\K$mׯ E/`!`d`` X0[#5#㕙yit%HFfZ|_fgr.)嗋5)X-vM,'\9\%J)^_.p67qWoJޅ~I9%V:RX!| ++:% FHJK bYaeAYbXcA WBRXBUy2Wx.G睉x.yGdbb+&cu/@ƃ,L9iY(UyD/A! +)ñ$ :Ӏ,d 5$ Y ְXaw=a  w!AO V{ Fd YaAqg Rof +Yԛ(-L,)ʃ,H$ԛ@'!/aAQͬa ԛ#,fR 4pi԰7jLgf8zb`U=2^DXHDezj +걁"&lOU9$̜dnG1ѝfrG_78?qZj-9v~LQa"DB>"D*SHXln"$B1mn/2$2͋Ra(uꈑ!%B^^e tF-ky?*k_,~q`ͼ\6=D$ϗ?}ç"[[LQHKOOh|ik.CH?[Y}_q6GXmV5ĩU5/m6~{ªgm.e$0m]zeM2JLJaqU= k)ݞufՖiӏb/\emշx㿦#ζbo&49Ye$.صxkwU*-7^V^CQ5XpuS͸tokE?݇[*V W-);a)qcʖZl氯. ɀMՑ@ rވjIu;=b9+";1p=q|h@OQK7:xwb/WlA^xR}^hn{wܷu:lG#&k"]~f8ln-*=-Q[U<6QaҺw^w&)?sNP8۷/-fBk'y<6jOz<ÔkGuQ?9{ՏF۲*==#=;r>ݮ儉Bl${x}/wtZzF` Fܳ]Pk'v&.R)GN-ycŞ-׾ghiߠ|2vMK[ݝ8ii短m5Nt[ckuA+_^p"~v~sK +L<%_ .ncv}M>▉W".* v4Z*z˱!bܓ%!{mb7D]OKHJ0†nz+q9i/rW\1x0> +endobj +795 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 582.273057 101.433071 563.523057 ] +/BS << +/W 0 +>> +/Dest (cb204-1) +>> +endobj +796 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 521.326036 101.433071 502.576036 ] +/BS << +/W 0 +>> +/Dest (cb205-1) +>> +endobj +797 0 obj +<< +/Filter /FlateDecode +/Length 4092 +>> +stream +x\[c~ׯг I !WKиrneb,.iXϬa0z p<:_!hXs0oY+Ɩ5,]װ^ $QyccjXpEÂܵHÂܵGA^5*gHa5pT4,]q$5,Qװ f6%aA,<|*/\ !Td 6Jְ yBkX Fd YaAqg p.%7)P|3iXP(* h*ʹ&!:iY|a Jof f DDI-wC2i<."Өa.o"r{ ̒qfb`U-X`/URk+9Z4,sTp`: ,0\}ZKT3sE Ft?rٌ4;~[8/:<|V+ecMqb 2u.+I\v^Uȧ?)ɿ/\l޻wyu޻wyCHlKyơϫu^eE /S<}jjȾys@v(7x_poO<~Zڐ;,]5Q!j4᳴x1^|AڏvR }?OEy-Gڄ]sg!:Sku:|{Ewe]Uע*6\2w;[Eez,yy8 2{jnuNߺE^ɼ߮f+f[\Iu ?{up~+S[k1\Z?Fq^_~o3umfW ?Û +4S$j% "q9s6"+>ϋCC\Ȣ)TdHl0}ֳjƥ0Dh 'mEo2QYW;1&\)-R_P>vshc6w_?lC2`OI۷E7[֞1vŋkw EqXh݋jI^ωY2sڦCG!yT8~ ۸qCSNKNNO''n5Ӫm]6bhG]ikAOpZ+}hvXu5;Eȸ>݊8|,hb:N$Cُɀb] 9p~aZ6Se;"R xL4z{&oVfq`.aIh/]Fyo$g8~3ͽK}m演g"Qߛ1]_O˺1Iz~=3rI6Lr..mtn_?G=+dKfr~nx4YyݣzM;^;}-v˥(T}Ty?Rq W\WZ|[z;a*S5_PC6 U [5q_5(Ʉ|ńHnH.YXK e]YmU1G{?SYmc=bzS_{_IWV>*ȹXEzgO08chw}vRe:7D,B ݕ;|2}}߻c&S=+IoUV&nr8zomϧVY-6߲߭cfWlͷ+rK{^נ>vuw?&QQORGNٳ IWzKZfG飏̚{V^qJ@jۭ)`7,$D);&O ~/]euRi|6p s +RZTKcZ4zJp6eݕ|D7oװ۶X_p6 <~l$Oe<@6Xwҳ2ѪXّ/ ,rE짯>k+9~1ɏIX!3#Yci'deK86>Now(z7moD +=ۓeָF㳡v(!vAv8;>Ivdb2${ȝJc{./uWչe{[.iR>T׮FPePCo96>)A!~nЌe31wCѮv +tP۵ة4ZٵtOQSWhŵ&Xdm5bi7~G<xIi&VMo%2 g;eRS4y,D?CETA0)yk^IlVI+=aMl˥4lv՗Vi/;Zmz*]<[V7a]?+WB`IÔ7)gG51Yt1$ǁ+9wސw|'cK~L 0F+ցN#to>_R_!yBKu9̓G%!q%MK렸\&,Sb$C"?[A2rrIͮCwZ]!0IFE&r'@q uNzP;54Ƣrјo.V]yvk :)wf(\f;mLuj+Ϊ҈)&UaݕİJܵq(l9bɬ{PyN۹=.)H®%gG}Jkj%d05Dꏽ#0:4>k%H3a; gt(O3O݊U<\}ZdnS-mׂиL*ϴY~]&Y^9(ԿbN +endstream +endobj +798 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 797 0 R +/Resources 4 0 R +/Annots [ 799 0 R 800 0 R 801 0 R 802 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +799 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 698.673057 101.433071 679.923057 ] +/BS << +/W 0 +>> +/Dest (cb207-1) +>> +endobj +800 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 637.726036 101.433071 618.976036 ] +/BS << +/W 0 +>> +/Dest (cb208-1) +>> +endobj +801 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 295.229014 101.433071 276.479014 ] +/BS << +/W 0 +>> +/Dest (cb210-1) +>> +endobj +802 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 234.281993 101.433071 215.531993 ] +/BS << +/W 0 +>> +/Dest (cb211-1) +>> +endobj +803 0 obj +<< +/Filter /FlateDecode +/Length 4914 +>> +stream +x][$~_QφI`w eه}lx*Rt/[Os*#t I>E(3UEK)x~rQKp +#jEaq:?%$g]rLvӯ.[Wv׿e%T *rn 8/^Ĕ$p mUfPNR 2& +3,m3L$`N.*`6J:t-%ы$QH:kH;-wQlqIiI`DJ1H:[JtNt]Q啖t..E"QS1ĭ(htZ/ش3 +䃠3+DlqVIga ៤O8bfmՒc:؂xآ(3ha^8P2$vHQbB!XLr $JCgDVG^ba a:bI\` lA -lK@tK*i ,X.TX0$.\@)I\`)qb ,X:o$.]KK\`"-`h%. *H\@]L##qFubbTxDEx,.,V&H+7x8e$. !%.P.(lJ\:c%.@a["qO`E%.p]1|.-:Džy^^IBe%.p]g`E58X%xW$.p] Nap$.h芺 Z2`^THZJ\Xޓx"=h$._0.ʀ)$xWi*˦>D `/H\#-)/qO +:|/ve:B$.c$k #X-p-%.-1I\G<^t,1E]N BK1%./.I\3$qAHSE,EK4%-p%. D[ J\MDXK%)3®&4&$.p$.@`a-֑171&ǛA₤` <> ơSJ₤#MC`^r%.HV!D'd=ǛADEuNS-8 &IybI\x3J\7&[TpX3cF&L wb$ϗ_`/;e-y x'0%G0l^B +LN] fҍ).߇44c u(j[CW!;]Ulmb04iA.>= +%UOE!}凜[f } pw#Ʊ?-iĸ0}g7x~ϊ/uo Gh@`4E e[Jhx8Psѿ9m:'']E1`hy7s<i?^nSG͘= 3[1di^IH!)6ސAR?;{TkwM5{#LlTv8~K~f0ln/*Tak';1 d#\'A\7;##< |cpÅ'Ƃ iIŠ +Kvcm)x'< :Jk,. G5d0%:fY9 [t?1ռ3~u$PG1zyL'< Q&E|}Y>ڸCo𵯹ĊvH3yf.Uf>̆VFZu= RZKRmclꐃf4̑{FBϣBYE\!}۶ 59yR 3 ׼_Yhxu8JnqF?$qΓyhڪr&DLz%Ϟ@IFGØxyn+8 rx_QcDtߪ_|>r[;ͺVc0-)PywyǾhºWG|<3QђG4L\PFt<;c9D5p?ިm\|a4E>Oy:iysm=۳Iؙ=iG}wWt~_Tգ6rqhA)o3s}mgKޖz4ܘ?ŖQ4 >{gQv.ӡGtcv١Lړ :8\gCh6q b9?]=lc9f'86pjO$=㧞Cr1*wP$m!)TZttQ0A}+:V)ʛηhSĦUޤ-ߥMy<85ʯoiNHj aQj:<U{ר&QI]M8 EjфlaŻ0V QKj:AtJiThbϚjwS:ml/ri_戲Ż#VqoGm&v!\\(CMUKr~Ư/QSkRfES3ٯz%<7xI7!4v.B_:*!=nKzl%lTcj놺&f +Ӹrjbנw;]NʼZ]wF\V*免f1C?Jبa7 ŝF߲N;kdҊ{咗9c |e ]P\F50[Wq%L' +Uئ 44~Ӻ35{M 6 Fۡg܁6bsdul}qi*\e:ۗP$8i_ҡ%3dX(. +Sle&ru=OPXk]G}܊! \`;^+M+{?Eei7JD7ߤr׼% 79֩Q1wROil[7뮫uhuC|LU6)?;⁡R/O)BM:XcO=8akyJ;"ud ñ*h 1ل7(cPTy19[RbVP7d^cjCE(No_J>5o#V[(- +endstream +endobj +804 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 803 0 R +/Resources 4 0 R +/Annots [ 805 0 R 806 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +805 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 638.673057 101.433071 619.923057 ] +/BS << +/W 0 +>> +/Dest (cb213-1) +>> +endobj +806 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 577.726036 101.433071 558.976036 ] +/BS << +/W 0 +>> +/Dest (cb214-1) +>> +endobj +807 0 obj +<< +/Filter /FlateDecode +/Length 4504 +>> +stream +x\[$ˍ~_Qφ/~0b㇞g)2.LUvtÙ+($')2;2%"]o?\~%梲PZ-1LiI%/_.}-Dg_E~I9%VXBXRr!*h,1B"GGVTrX ++C O#@ ,i,aKH +a1*" Kңsvx69`5^Yb!k<,d h'!ި; ׀mi$q@ +5x]cRѰ w9ljX\ְ.Ȃ1RRbCʧaA2 @ʃ,H$K%kXdiXdAʠa2XdjyY.j}@@%" RǠUݒZelҰ %ZMa~tI% R,* -!3x ְ.xjXdA6aAvUf4 B53©&4*&4,}A2GAHÂYÂ!3N&כIÂb 2> 3FÂb3MG`_r5,(ޠD#כIÂB% EQyISQ-0 &IE +iXPbz3kX4&2zH sn(@&Ef5,MdZmo!!?ә+ά@o@lU *g5zh1QY樞 izl` Urr.Бw*I>$QR̷}>\r޷}>JV?Yi5'd{&y. wm|q?| mPڤXOǥEhtӧ(N E@n{8 mPFqs9\;}^5s9@q?~4˹̠">s@9nl:p:|'/x~:ImJQd !ԯ=~pRN7߃2R2qC]tc>ߚ6>j PWp3,LƦq#w^jg06Oϴx}oovn5uti{)LyƘ1?ls\"0zCP:7陔Z-y!vݫVvvk׾izRo_emkkkm?F;6-3WE$X(cWŘ[o6/MWyj_wiϓx+^u6N|Nu>[a~gFvU>vV몣'&w*%gjr멾A_BOU6^3f'eC;{ngǵ/zVJ=V鹵-IDncQ7̠t( E{QWkn(t瓡c;{<^O]ch f?ymR~nc5td3ϊ :`[xM_}[}9?Bm:i7Y枉=eŁvl7r*6 +[Ӽ^_Ǽaz;NyIUO3WzˊZկD;z[b&O@xWŚKVnM -n➞پ5a[e[y{Dw<-܄lF\qq)dGp]] :Jy(^+й{kHd+|ln%||Oo/j]v4-yL/"}qMNHܓ݅qd{MO {sIjJ{_t+nxnn#nyټPkWʛ7]7\7[MÍ͛ߖ\Msp|67_MwOջu?oX,%x1bg0C$'Np`} vV`iw3am}qTeo`\Ư;*^b>qF5j[58!yjI>~\z;ezSSSSoC7lsCNasoFLqq7 +g_9co怟0 6e>֋C~~787kZz5!.-f2N=W-ߵRu4i66yK目vVD%񣮪b8 +֌'\حxw༱c{78T ͡p=V5cT׮3PePCo9 BN +vQߙ>4//oX;vSHڮhg5?E_UOۑh(wM~%؉r Ii&V]Ow2)wUakv?P~4\__1$7y$IuHӀ4 +uٔJ}&Q3CcPc%u3RMMr!O9تɢƸvHr.!W|'j`=]?I&ٙd8(LїJuS}}L_.59g[~̲hrX3- YF2~c~#_؉c#ll78k+aPp]gL8!vZ{m3z0緀tp!*yvk :m3i.@36FL]غugUKi 2U-#ȖHt4WgfˑKfeAwqnݣU, qffv __w>SU'!6Ϸ!PMBkc0QG#9?+99̱&Y~5. u\Vp5RGw֧MиL\*='ߠտyJ?F 5 +endstream +endobj +808 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 807 0 R +/Resources 4 0 R +/Annots [ 809 0 R 810 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +809 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 426.873057 101.433071 408.123057 ] +/BS << +/W 0 +>> +/Dest (cb217-1) +>> +endobj +810 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 130.126036 101.433071 111.376036 ] +/BS << +/W 0 +>> +/Dest (cb218-1) +>> +endobj +811 0 obj +<< +/Filter /FlateDecode +/Length 2862 +>> +stream +xM +l@e 2p Axmry;V f5MVWȧȚ *Z[zoJ"[.vxta\ R,ϳ˵Wۿ%rt'SRKTR +ĔUGlST4꽪 m5y*1VGUahaW5 RqTL#!*q +=]kDO'rQNZ9FlIJ2l,`KE<]-]-` ebO$VU]]jH)*B9$:D)GaK\lIB lQ<8Dkt X,Ga !Kb)A[TJЪգ@-h)a 4q@@$ a"r]l $4X [m@[ U@\I ĕcp@\;=p/ ԕvEkX (wEp-p`c@]a* EEX? +!J ܍c` pu% c1܍wrpI~:[XcAwasb +\[X]X>W̸97 F%  |V`|=$p;w96X] c!0\յ@V *HJ#8P<dpǂ "quEjX:HVEӁXaO mz,z,YpXVJXA䱠 ruEz,@b걠D"1z,( eX 4F +[)z,Bm Jʨ0.P p*t\<[1{,@-*c,]X3cXPlAx,VjDf XL:f5d j23y,ZS锬ά ` *M`cNJM9HRF+7ǂZaKifX X(K=y,h\QoFXzz,hB7Q9q$[Y<4- )-H`Mez,h9[Y= @=VoM dt.27z= ?*ЛGb*V#0eU(cnOU;왵C6"5l&hv;|/?g{j?)/f+HlXn*) +L3}-fBiD#7316vl05\:P]K?R"aFv׵/Z'r7RػQذV£~[9-~-tjK$+E;"i9v<.YRn#]m_7߾]WzC_(r;kC!޻Mmzl~xM)Ӷ]h{?o9()o1k:\n{N3DF;EjV=t_6[c;酓}=%Xoq}z{eqWLf~2|,r9א:plCPZi䅹;/9gGFXz(,es,IlR-n7Yn77Ws{ɳ>@# ojG%$O|-L?c/}RϗR&B:8r b jLO,_>p-b۷~6Fi`on;]J#=?m%:bf&<>K7o["4FS͒c_v3؞b"90S١mg,ӽ8jcL]a:u,o˲^7 +ϥOԎ{W}vQ^t,F!MX䈮#|EkbjvqH:ڵ]7[+UF:om})եwdb/1B?V5*7NxP0iKi&+(u[;ĕL) +c]f%" g:\ʎabsϓz3Zfe|q%Aw3v.SK?np姓xڙF&e^=~8v>2VLm;]| Ʀ2őn7[0@a'FvqA'@8q/۾!GVeahͲ_mzIHq$^w2AAD G,¨ l7}<ƅ:o ޒAyhWaspȲLlG"[fnطKaNUXudnɗK\YӹCqk\lӲ c~]BlbI#RN6veS,MzvN8Fqxu?L=L:>Oto>uȽNXsи,V*O*Œj)~ dewh +endstream +endobj +812 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 811 0 R +/Resources 4 0 R +/Annots [ 813 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +813 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 797.673057 101.433071 778.923057 ] +/BS << +/W 0 +>> +/Dest (cb219-1) +>> +endobj +814 0 obj +<< +/Filter /FlateDecode +/Length 3998 +>> +stream +x\݋$ ￢ ,$ y,!aw0C.۪*uO,yg$-OßBΔRs-~ꤱOGg)j* !\xͩZaw=aZ w!Q/ V{|аDÂuOiq& "pLʫeX\[XٸD4,]gѰoQ2:_!jXw0oYʫR4,]װY$QyccQjXHUÂܵ1 p]Ba4Uc=Bw k<வjX65,H hX `aA*djIÂT-x(T^28d Bdy1Vv _||Ra1bigkߝ}%煀| %~j!*>/X?tֺÇx[ж>iʋ "b Fw?]ЃMzpE )n"ܔqϛy5 F_C-_x-yp,˚3!+EhFk w]6_$>_{Zx>qa ڴvX{8{[[Y#EV# )0(ه5Чo'(-~W^qX<ğ}\эoI|JsOK"NZu~a+o<{4#|m|fFtϗ^?pN[0Lu=g԰mJ[}[jɖMuf>o]`fk#p-֖^ݺ0.ck=5t-<ɹHxNv> =>_ڦo},]c; on"n:4]y<V`q{_}]Q,K5M5Ȭhz+sDk9\Ix_^_2Y~,o,]Y~K 5T~#3 Yo+/>mQmv#ng6TrGe*=yҽF9l_ 4PV2Jed +nú FS_1܇}mcCEGћ:d.lQY:RڰlyOnlQ삜V߶>D^[iU>·#Pg'FQkÛW7kxo羈/6\oW|փWmvV91V7ĎXԅ^f ]­~ht9?U [x—,.V8bLi󹫸Q7pcNOzrIgƾ^]mg}v/pu]ݓdlnVg,6[;p=3nA +|=qCp3^nq/#:G{M0y_aPGcr[DzGHć55;:d!"#! E/v+ٜtX+r'i{ qd]M7\Ugy}wҨhP|&E52w>Nt9eh{fdx_/Bm a7m_=6>a](+D\ܞ̣-d~@1a9KC IO]D+dO] ӥIK91]g1׈ [Jǝ{SݺZJA]rLyRH|Ǝ 9b3tG!WB:T8f*2/S +3IEσ$sa:7~G<"Hv^:N$ ;eRQ(.Bhv?rP8.ŏͳ $iip0y+Vgb+0c&u3RmWMr"O=U8{,9q;i`$1㎟vw%6ڒKdnv&S1$O}l.pqO_-}{:GeO@ǿ{ }p&Ӈ]+L^)(Δ.yq!Nd8֩JMvH0=Or*%NDahYtQAȆNJEgr(c`LSC;Mӑs‘OzN 0ՉQA-E NVD14iuJe,mER5Ť*- #F9+i'70 +(9)9jɢВzPiJNM{=aT$NkbGsZm'ĕ55|h/ҳ%%`P25r5_̯=T! +`ԧDj!gNv| +Eo7d{wZQj ut +endstream +endobj +815 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 814 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +816 0 obj +<< +/Filter /FlateDecode +/Length 5429 +>> +stream +x]K$qׯ0ۀ !=n FdfFUjzGexg{3 #|;[L\ROO$X=?'YJ]? !$ +'yyٛRw|$Q0)dYI*H.(I&%QIKђ 'OJJf- bYI#PraT O$ +'%YἵjD+iMDG-;sEMKHski!ȱҊ1rpNKcŽjiBNZZ,!ASdhejd:-%ii6O afP0I1)iDEM,d!ҀRh2 NKc}"5 552K O e +\ 4 Œ4!; ,LQC ai%Ұ xȂ Y< Ж--4,[.jXjX!GҰ rJE N @=iXװ vaArVN5 @5,:rа٤aw1U=@WjX@]-iX@]`Դd0W,7p׳pד@Q Ǫpº;Y# PpK4,`+0ʘZK԰.Դb\B+l\EP   ,װ.Rki]հXqp4,}3BuմblYf iX06~ ^4,]!hXi%daa*cΪHwCki]kSѰ wljX|ְx^ÂɔXSӢ3kX, R %Ұ)d ,{ ,p4,G`Y)jX$3iX8"CjiћjZFKDiXXd z F% iX +dPѰd\KsNt朆CxdeFa,4bI4FV̬aAhU԰&RM, ?l~l"Q K`Ұ g/fְ gװ)fҰXOÂb7Y8Ҭհxӓof J7)㶄(fҰda(jdTq LB t"d4,(1J5,x:%%Ltp IK3&<[-^N,gVg ,a[) 셵J꜁JN@LD90HtV6_cÄS?E 63'yɂaA[̱d W]ӯ_`|LAE n pejqTJ!RYtiM)-[ Efg"RpuY Y/'en3$O_ǿ7ғ-$^ 0OpIs͟_~孄K@^%p_TuN' +Yf?.M, duε,5Ԧ2{Ay ]v s6h$KKW7`?5%_4w+$ekoTSQbZ ޾f>Msn.pץ[ n F^/iZ¿"5ͬЈZ&tX)(-˧@gt"792ݭԕ ^j,ZTU=]F b]b-v.|ER z%;TY?K<c(.n'HAS'xb_;Tp˓zՌFx_?[k_T M` +ǍCe2++c])|Gߏ "Qj0B3>WfN&E88$Rqq"^٣X5-_QhdE܂( 3cyT#BbM5,J"Jog,M%Wa %ApY9d1#Hkmp=et+ d\ #(U8>%,4ˏ!dKI#eF1(yB JQ<fj?a ge& +:܈S%x[⫍A^ucP?wKXB?PJ{YDK(]+pxs4ܝU܀Ts6iMo.+oy#WvsZф,g +$k?,{83i܇uc6)C֔R. vjUpԇ4GS,K̅ܽAҲ=/̬[o]սnߞO{aObUb r^ؕ ц|)t͑<[x_.-nxCVŏNx{no6Q0O]J^=wUחGF[eI끈^)AQk. HH+Kh)g/ <̀d9 +K8kﯚZ`v`Yv:yf%/Uvn"r8\^Xz8 +Zn67l,9bK5mM̪G ] pvF;SlVh^$\>rc<V57n)Ym+Zyz-.{߮C{,"׭(,NF $@xG^AW){tWmඐ$W -y9tvy_*#@elQG0E_94]3r|γZ62h1HnW+|s2 +7ku|!yF)x2Qޔ\nC}y: A&G\z:u8K|N]7g5_axo skv3G"RgEJ#ma}ݺرyҜ 82{i[Ib95f+hu}s_ESH̏*t kf0aJD={7P)2 {%̇ z$h zJ$HLZ{mzlQ96gm} T77|jsy@)S҈ P\Uss gFŶbcAfcSIX|ŗ!/5= S?K w3z\tu V."z^noItpV.K,1&hI20p \G+;>0캊{OE90Va^/v &r9RvepE =-dyWuO6)cu߶+6kup[:oWۼѤB︯^u!>Ox.X=~p;sI1|pO ʹdȗB"wgs8Zy!$/›,xSÇ:Wmv:?_a-YT?ϕ,d fiuE0B^`IR]fq_O;U3_K/^;?yOn\츷 -|d> +endobj +818 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 766.923057 101.433071 748.173057 ] +/BS << +/W 0 +>> +/Dest (cb221-1) +>> +endobj +819 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 747.976036 99.933071 729.226036 ] +/BS << +/W 0 +>> +/Dest (cb221-2) +>> +endobj +820 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 729.029014 99.933071 710.279014 ] +/BS << +/W 0 +>> +/Dest (cb221-3) +>> +endobj +821 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 710.081993 99.933071 691.331993 ] +/BS << +/W 0 +>> +/Dest (cb221-4) +>> +endobj +822 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 691.134971 99.933071 672.384971 ] +/BS << +/W 0 +>> +/Dest (cb221-5) +>> +endobj +823 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 672.187950 99.933071 653.437950 ] +/BS << +/W 0 +>> +/Dest (cb221-6) +>> +endobj +824 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 653.240928 99.933071 634.490928 ] +/BS << +/W 0 +>> +/Dest (cb221-7) +>> +endobj +825 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 634.293907 99.933071 615.543907 ] +/BS << +/W 0 +>> +/Dest (cb221-8) +>> +endobj +826 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 615.346885 99.933071 596.596885 ] +/BS << +/W 0 +>> +/Dest (cb221-9) +>> +endobj +827 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 596.399864 99.933071 577.649864 ] +/BS << +/W 0 +>> +/Dest (cb221-10) +>> +endobj +828 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 577.452842 99.933071 558.702842 ] +/BS << +/W 0 +>> +/Dest (cb221-11) +>> +endobj +829 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 482.717735 99.933071 463.967735 ] +/BS << +/W 0 +>> +/Dest (cb221-12) +>> +endobj +830 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 463.770714 99.933071 445.020714 ] +/BS << +/W 0 +>> +/Dest (cb221-13) +>> +endobj +831 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 444.823692 99.933071 426.073692 ] +/BS << +/W 0 +>> +/Dest (cb221-14) +>> +endobj +832 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 425.876671 99.933071 407.126671 ] +/BS << +/W 0 +>> +/Dest (cb221-15) +>> +endobj +833 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 406.929649 99.933071 388.179649 ] +/BS << +/W 0 +>> +/Dest (cb221-16) +>> +endobj +834 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 387.982628 99.933071 369.232628 ] +/BS << +/W 0 +>> +/Dest (cb221-17) +>> +endobj +835 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 350.088585 99.933071 331.338585 ] +/BS << +/W 0 +>> +/Dest (cb221-18) +>> +endobj +836 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 331.141563 99.933071 312.391563 ] +/BS << +/W 0 +>> +/Dest (cb221-19) +>> +endobj +837 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 198.512413 99.933071 179.762413 ] +/BS << +/W 0 +>> +/Dest (cb221-20) +>> +endobj +838 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 179.565391 99.933071 160.815391 ] +/BS << +/W 0 +>> +/Dest (cb221-21) +>> +endobj +839 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 160.618370 99.933071 141.868370 ] +/BS << +/W 0 +>> +/Dest (cb221-22) +>> +endobj +840 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 103.777305 99.933071 85.027305 ] +/BS << +/W 0 +>> +/Dest (cb221-23) +>> +endobj +841 0 obj +<< +/Filter /FlateDecode +/Length 3621 +>> +stream +x[[d ~_U% $ÆBv;6a6C~>t쮓aOIuQI:ǿ"ޕRsÁ\Ǯ_GO]5x|.r:>v:ÿc1ZS[e \rh*X`r1nV1b ׬ 1h P V,5BX,kA`|t JO/xJ e|٥,>zW]J)'%V/BEA-^,Ld %ː%@;*&P"o*XɫQ(Xy"lM< + %Q&D`~-p"r.֠EBYY(' ANq€PIb@(Il@I&^0A(BE&p 8@ta h+ p+T BL\XX\R 촰plau9`avYJ,,,.3F<@)[X ]Q`؊  ` `Enn,,n,,8pt`-,@/%DயO/5YX`L^u>CBΧT-,]* w`CD DgDj!ZXsp oLUG "p,,@vT$&/;`y ^-,H]$. Y ׀5|ɪx]a%‚հiaAJ RWsNJ!3yɡ-,Bd<"Y,,@b*baAC ȂdzdfyY`.f} @2W9&cЪK 6y<-,YB+pz N% x^,,U,,@(r% 3x ɶ.x[XPdA6haA Uf" QKBOHbaA4UnJHi `?(6Q^u%xQ ~][;Js# yg(pQ^4#",ps,jB/A; uɮh.r#67?^˾zwy߷?U9(y.$ۯ~(\ߙ!9)S*8+Y#d@$yw]&/"7zNXcC>ʂ~ é>#np" FN:wù R~"W0ؒǛؐ/f[P:H^/4QMbm#j['hY=D}lȗ=wSqs7ܬ˳˨UKjEj?ij ίΦA@>#](-2+/'NNO☷ڛ7v!Ĕ +yո mlx]Y0wK"o7/0)}|b&L'b>]7xnfZn8sQܦ~MϙRcc>l-P<߲Bz>HEl2~"RoCkDaQUbu4k+C/xF.j -{NWhYs4׃Y +*w_:OgAg{rf3gP < MsTTc5n}<67|O. 6>5^Qy\U'vINV㔚V^%/,ö8Kޘ䧃-Yd;d%KsNH=PLent|TNwya_FwQVeqN(k9xb&Ҳ$oe{}U_ y[%ɤjէ 4hU5cCdA: ԧl/=~3HٯNѫ̡k~2MPA;-I^/->B/d7^SY&\O_"?b6zljD^B^&5*f[# qPy /äͯٚo^I+= K^컨O+uܘRTޚi1sSCc.^|G3]ck6P:uQݢ=P :m̘L jZ#_VMuW+骯#Ȗx$@q5> +endobj +843 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb221-24) +>> +endobj +844 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb221-25) +>> +endobj +845 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb221-26) +>> +endobj +846 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb221-27) +>> +endobj +847 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb221-28) +>> +endobj +848 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb221-29) +>> +endobj +849 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb221-30) +>> +endobj +850 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb221-31) +>> +endobj +851 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 605.596885 101.433071 586.846885 ] +/BS << +/W 0 +>> +/Dest (cb222-1) +>> +endobj +852 0 obj +<< +/Filter /FlateDecode +/Length 4344 +>> +stream +x\K$ s+HÀ $`#rmflrGUQUoٙ"(R;[|'39|xt&梲r2(TOtŸ\NqgoJޅ? ɤ +e)LJ>DKX#$|d%%12 N1|r +!),g!֪<b+<Lң\|Qy <#21 Nc Y1d : KpVA4^,ɪ%ų>YCH_Xdxi@@, Uy +kX@D3iX@@[hX@[iX@[.jX@\i5, . T4, `.;5, .=iX@@] +kX@]5, .0p5UdkXt42iX]r6iX]װj`Q؊9[ e  |4,`rw}^zQX5B@Xa3a +?ŧV5,]1}*qoeb,.*Ұ wY`5,]GX5pb5,] Aq4,f骼blYÂ,y +$*/Ӱ`l,P "p{Ѱ wm Ұ w-#Qyװq xp[ŧkfXwMEÂܕeSÂೆ +̦5,łOEaA @ʃ,X֦P$Y{ ,4,@D`C Y)jX$30kXBD>jMNksIÂ`)v 2NaHaϱ@XL5,5,@ sdY jX}FXKBYÂHa&RAIH~l"QykXt3kX3dkX۔|3iXP,dAħaAHa`mrO9ĚkIzF2NH!G*7kBfB* +yܐ 3XO}ᳰa~#I~~o~Λ~iu-[i2ππr|'ᲫaI)W;J?iŸ)9OYD] epkvUݮ-RHY߭eV歎 }V_ikeI3eUsoUU6lǪ*:,{wx3j/Lŵ8 KkRh3X!pۉ$>xͱlwM䟓=Wb1hǢ-mڜyx|6~OCOpeqǿ_u&pUتɳWIVY[=*7cXZ4P^OFi謕ClzOr{}U]կZ{ݏ$C0PsAÇ#W2Z_ph?jk#cеjo$i'̪~Y8laubqs܏sy)SK7qMkخʦ_ 75&\dSΙK<ӭ r 5T&ؒ-ǭE5Q8#OKo͟Gw!khPܠAzv^9Bfl] l4x9bM(K's:‡[6io̰FuD|9[׃ݼ5}ۭ X%;39ƉGmV'2˚}VkrrQk*kxfoz}=lP7a{W!opP0 cwĨ5Nu=Oi/ۈƝ:rˀhnp}p~&WrxxoCBL8o#O3jfawv3Zn@vlU(uU437.2A')oa=Aݓ\;"'.`uӤX֦C$6"=MN <ؐ)kûi[K Јh= Ңc{p}͂Eb =eo&7Gz \5v \ >176\e'vmgm>yNى Ώ" +j[5=֟gs޸{uK (aW[Hm;[Ѽh-S܂vx͂<^X #a@U'!4f?/D߱ P qV3[FRwy0kLãҺoThmyٶzq99cǶ i {}To]{7> ]Qh'zȍU<dzENj w5!ܗ]F5봶*KUu!aZwt HL6g}>,Q+\ţޮ ݴ־'y;16ô}:XfHw7#y(gy8[bצU"k7^}֗`Yy/<]qX~JF䧓"x,mkj]]IXx%[F#C&bIJl~X!ftGOz(!64ho粣Q&ّHSw%]uq4Ot^#^N'*iM5"m4*Z>!I! ۚfLfO&/ {)I-L^*i~2LrWBLiM>b}ݒ%smd7@wOz\X: LNvˠTl4yY.P:U~qMJ^Y0F'⛝ULuXӀ4Nr)uU ]cꤲ.uo:vؒ]NkX9m r!9Cw`{gMz;v>g'R6ޓsdegOl" +<`vtw굯ɴrT9OˍHN^4GYo=~~9eغ!+|/I5bwyAvy :<쭤:w&ÉzGfeع rImprAФ<\$&q%Eǒ.".Fq9uXd1 NE~b +#2;7huS4_ ;-yv=ȱyP;wLj> +endobj +854 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 432.754475 101.433071 414.004475 ] +/BS << +/W 0 +>> +/Dest (cb225-1) +>> +endobj +855 0 obj +<< +/Filter /FlateDecode +/Length 4378 +>> +stream +x\[, ~_1UU I!L0y3>;unLxm/9˞RI_Ige&"/?~TKr˱N^ggJΆOޤU"V&%Š`h,;޳Ƃ\VXbxNYbdYcA [BRX uD*w +51WT^&71 Vc Y1d %Xfx}N/B=DazQlIz*5,:oװRҰp#avr& 2 u GK>5,` Xvrw] awa Ha{װDÂܵǟ@+cs>WMив1 pװ wY`4,]qRkJ4,( YBY4oI7N/BWXÂY7ѫ%,fRPL4jX 䛈lܞ!!>әY2άV p%Jj̀#E2GjcLKjـx si,QEC™,-}9z3J>?N_<=?ϦJY0~Q . +pex*&!~߈."B*]D P\Jn""b>صW$eu8-Q.o.)< y=Ry]Qet^nVr05m^=l}6c}\(//e XwX[XHߔL$ / đ.wvy='$h勓 [U?p\.ĴKCSq4 ::şŴO}Iğ~ߐ:.\?27b*8鐧?B~)}ᨤ5?[A]N$ oudnuR&b:O[He.-~',EtĈlp3RȩY@ciĮB[I a`O]w}m ۯmYX#T,L))c]7IJ&. Y +f 6vl.vyͿ鲴ㆎ@mc222^l[cdߧ[Vcp1ny#6c}` em᡹l[C81^Q`gҺ -cuW7)DBkŎzqVf몾i6fC8 ZtY*oϝabip8^*84)惩-oqш8}'pF`Cz>Ȳ7-0lW4*@#GBJ na1 r-ޯ?KIqi^d pBtԠUs"A<S"l|o?^9"s.Ӽ>AxBW'[yPc3c.f;r(,߂c}~NKk5ԴuP߶T^{={ko/wXo_f!i<++Bz$ނ8%d7^ 4d^'s'X0J$r}bβj 6P a\-)il9OYb7lU}\{Dk8qn7U&jFĞcӒ:eQg&8a-u,/ +g=>-:k0>ꍷk-2 J=/vo^7}oeC$9F\xㇵ7Ɣ_17:JHkV!v: 23wigfM=Cˍ2o;pHTe»}{Knzm?ވ+|[[tPUv }G.>uyZۖa [vM=%"Xz߄h졇vd(9'î!;9" Ji_w 7y iM7.@KfA2Z{('ު¾0SﺰlfEo__Ox͂j G Ǻ7I!];gߏH~Wܯ2.F] KIyiCʵtYKϋ=] cJ{m >S,+}|.59~|۵oh*gOouy|~ӲJe,sǙzɍAvs:L!S’Y=5ԍM[2]Ѵ]÷8WI%ui4@^ܻ4ӢKwa{t[Ckmۏ8=cj P:y9,ϵfHmb~lH^ N8^,6lb= DF䗓z,#ض.n["c?%&?PW#C&w&2F~z.pX!g{]lr(!VAض;$[O14LɎ)I!~Nuhf6kLՐ+BvhTjrZ(}nWh!MJG׏kPm)vviueK~9+(T~3u{Ԕ&3TF>Xn&%>f#4cC4`9lJfG}LJ{ֺilET6S H5XmFiX9 +:94S~Yj6Y6n'dž/#92&owJLobNrw56@:DI^W?v'N韧s>8!z+,{/|0|;jhI&ofJln36ZC;ǝ{w^[چqGb:Ȯ~LBl7/}]|"1Rb\.s~$!q%M.wạ#.Aq9LXd+1 IE~\Fȥ<8tM 80qҲGaA{Զ06ө~v;]Cm,?oANwZbс{A'J[MZQS).ݪZgUKQaܕ0Jܵqע%0sꫣ޲ŒYűwro+m?7箧yXwAbLw #3TVg_߂mOo#0jPZɾ"Rk%LSne]0m0T}ޭ:Ѯ4\sf*$KWY^XRFI?A +endstream +endobj +856 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 855 0 R +/Resources 4 0 R +/Annots [ 857 0 R 858 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +857 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 797.673057 101.433071 778.923057 ] +/BS << +/W 0 +>> +/Dest (cb228-1) +>> +endobj +858 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 446.531993 101.433071 427.781993 ] +/BS << +/W 0 +>> +/Dest (cb231-1) +>> +endobj +859 0 obj +<< +/Filter /FlateDecode +/Length 4384 +>> +stream +x\[, ~_1J NLy3>k;Tun58gٳR]T*T=lɹϧ_N֤`\T_YN&s8,J&Sgaw}aw}BPyI%h0p׳P Ǫpt`5,@ϓx%+O%jX.cT^1.ABX4,]*Ұ wY`AD#DjuX pyCа` ߌ0]W-9kX%aH!9 "հ wދkkiʃ,k*>dXx]km*D஄M b@@,kX3R԰  R> ɂY*pb XB%kX`r4QECBIY=l9}z'RXq_݀+SUXI.U !k !`q=t!n˹p[!ԕo.wrVGç}Qt$`[XHj"@!4 kfDIvy=(UE% +ZP?X4 NuKGɍЭw?zWL?Xo_vW~Zw^k&۹e:TmXZimJ< ~\S}y]89B \x9HȨ< Is\÷H +չu.-k[S" +#\g(cG[íH jy29i3: +ͮn &G>*= vyK6no~}7\8YI}]^kof]\$aHdg[wlxXm~w?)a&y8m܏wwv&o/kg{*a ;|:& 'js ڣG͇q=U3߇xy3{WlRzߌc|0V}w!=:>XJLNS"t\gTof|0rа.tAnwq=n8=wΑ$ɡqoa^)LJ[Ryox_\-koMrIdae!'cؽ-r"ˍi>$T+WPǖB^8aYg}%4puг~#W y:>P5o_}?߬aM!(,29-{@ackYTѬn&yz]iP'y܀;|oQgQ\I@þ߇=i{o&!^`Ee+ A,^lE5Y'WyĦMx͂0t,^Ϸ}]>5!P ıԴI/'k aCj .D a\VKh E>,,,|^[rOްxZik֊1,YR5?x<`V:ě}/v{tuEKWu:įp9j?n>IBKp[;p{¶;v7NqzF^÷ R> <aqmrCMU~][ÖŒ]hqC>#}^/{q3ͼZ>c]mCks;r0-a^@:ud9I y P8PrDZ7'e}lwB}y +};JLUs=d^'55s e&g˭۱=Cu<@ồKU{?#\W9JV=#vCg8gt~8Gw﫩Gk6ΆƎ:7g^q#OΒ܄C ꥔17L4coޭ֯VGEyrɍ[+v=rc!{"(a +g\Nᨩ,{apj+nTU.6O1e\J0|v*b +!5SZBF#)JS9kH']U;?ӳ~/wr}?#%a[R_,$O' +yd27B\?>5`eߒǑ=m5?n< ֈk +=;eָ,_8 W"E'yn;oىD;M7ȞTyͽ մhtjh-p't9)m?횼,s3$Jk.':Z;zwɻ]>dxd1&do{M!@a>Ur֎N}>p2-^N?j<-W9Y;m?O|;qo;Zd"Fn3=O?.YCOxͣZsgb:Ⱦn}k&\!^vZ%i +rpFH>OCJ.#.Aq9MXd1 IE~dbJ#Gn R`/͓<ЯvU<@;i Nz=P}9P&ߣ o.fyt[yRnͤ-PtLqRWU-S Oü+]aޕxh+㶈׳% P9ѲYŹwhIvsh{C82S;CWk|g;uZzxZ^=T@!,߁8OG#/sx"J晰lrUO`یi5zb%LQЀ9{8 ߅VŭB2I(_}HfƦd*(ysR +endstream +endobj +860 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 859 0 R +/Resources 4 0 R +/Annots [ 861 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +861 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 797.673057 101.433071 778.923057 ] +/BS << +/W 0 +>> +/Dest (cb234-1) +>> +endobj +862 0 obj +<< +/Filter /FlateDecode +/Length 4884 +>> +stream +x][~_D l$@"Xa;N8y?եKU/3g;.R"?R*9ٙK|<}:|>Xꡲr2(TOt_ǹ_ޔ = +ɤ +e)LJ>DKX#$g%%12 N1|r +!),g!֪<b+<Lң\|Qy <#21 Nc Y1d : KpVA4^,ɪ)ñ$ :Ӏ,d 5$ Y ְXaw=a  w!AO V{NcL $&ŧqeCYKI\Ql(6'(%8flCQN] h=}_s%U +ʮIwȋNۤoǜ/ F<+beߜ}sg:dK9/87xcBCMy(p7YS|dS˲EEew.A_:rnV򵞢.+߼?z` \_ $w?61lƒū̚-ichm;wb @@׈Tmv9xfokzmcn>(ļcCa#6Hy]dkkuF,"־uZKr|qڷ]mLHqiAyZti6%愵2-*]KU45\@1$km'f;u$pW3XGLS!%Xrc3 +YxyU*y"uDX7Tr7?XfuI>b'ʼZ %\QQh.]U^e5{c= {p 'YN!ra~)Wj;;$ASJ&dmmLW1), ܒ:oϜr0 j2ӵߘ]g0{xILI0F̻ ˗9vxԍ1yDa+ߗ{WC^!I4fnL|)[Vۼ=H83yvX>6-jp<!3+c6)qOcQ%49OJ^tE_ ³%KKs>J 8Jz;`x29Al5}퇯\naDT<\9@p ˗B*)4E_*\cY._ՎKv_7hQ[jIܝ~n}nf#Nns(a%Su1 V59 ڵ]aM3\K?lBmKe*'zRgV}6+_C͎(k TΛIY2(Tt0yRo{a^.cU;\A}XFMuD|OX]@on̮7pڀIz;HGnPW%<]pI +!Б`)[@wy; vixȶjc3[ѭf6]ql+*{IbFq_49nj/nh,r+'> ;c䈹/v&Q.OG ~`r:)0L֢GڟdQR:jiqBi|F"WocdC2( e lbBz^JʕrTa)N𧃤1]otZY!#w|-DpMI +.\BxV-2"jF'/d6Zb%&3AˎGśdGv"=N &Ѻ vgչi[YF<-mO*UnlM5&JVOyRHmM3&Y {)A-L^*i~2LrWB;MGؓ\=qMS}mܑE + {"Mvr^5*fMO*B +Immit"k%Q5 8N.RY_.[n/5N*4:xɮ[]' 5t 9tS~Zj&sA;fr3.oowF<[~n $|zgqPOܼ{iit9OKRtKo4Pǁlp>qo;Z+|'Y!o6(58<쭤:w&Épxh'2_:7#` ݐ\zפ<3nG#$&$EGHTsx:,Cbs']"?S!5)G<avn("Hi~f7wZV(Bؽxcvhԧ&x:c\?CGyh;4ۢ'95FjF'jՖami .@[LMTkj#ΪR)ﳦ<+]a++׳% P9QYŹv(I}h{C82S;]K|GTB+ԝerS[lrw> +endobj +864 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 393.004475 101.433071 374.254475 ] +/BS << +/W 0 +>> +/Dest (cb237-1) +>> +endobj +865 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 374.057453 99.933071 355.307453 ] +/BS << +/W 0 +>> +/Dest (cb237-2) +>> +endobj +866 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 355.110432 99.933071 336.360432 ] +/BS << +/W 0 +>> +/Dest (cb237-3) +>> +endobj +867 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 336.163410 99.933071 317.413410 ] +/BS << +/W 0 +>> +/Dest (cb237-4) +>> +endobj +868 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 317.216389 99.933071 298.466389 ] +/BS << +/W 0 +>> +/Dest (cb237-5) +>> +endobj +869 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 298.269367 99.933071 279.519367 ] +/BS << +/W 0 +>> +/Dest (cb237-6) +>> +endobj +870 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 279.322346 99.933071 260.572346 ] +/BS << +/W 0 +>> +/Dest (cb237-7) +>> +endobj +871 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 260.375324 99.933071 241.625324 ] +/BS << +/W 0 +>> +/Dest (cb237-8) +>> +endobj +872 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 241.428303 99.933071 222.678303 ] +/BS << +/W 0 +>> +/Dest (cb237-9) +>> +endobj +873 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 222.481281 99.933071 203.731281 ] +/BS << +/W 0 +>> +/Dest (cb237-10) +>> +endobj +874 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 203.534260 99.933071 184.784260 ] +/BS << +/W 0 +>> +/Dest (cb237-11) +>> +endobj +875 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 165.640217 99.933071 146.890217 ] +/BS << +/W 0 +>> +/Dest (cb237-12) +>> +endobj +876 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 127.746174 99.933071 108.996174 ] +/BS << +/W 0 +>> +/Dest (cb237-13) +>> +endobj +877 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 108.799152 99.933071 90.049152 ] +/BS << +/W 0 +>> +/Dest (cb237-14) +>> +endobj +878 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 89.852131 99.933071 71.102131 ] +/BS << +/W 0 +>> +/Dest (cb237-15) +>> +endobj +879 0 obj +<< +/Filter /FlateDecode +/Length 3166 +>> +stream +x͛[$ S̳aRIu`Cpa &M8X!_?t]zF綻&ٙV~g+?U9JӇm%{tf\ R,|?Wk_}ZˑMJ-jPJ)SvTn5O3RѨ3`XUV`F, +fpKQ1DDG)d8={!+qN$䢜ӵsN)lI%ؒX<lQe"YXx["]-` ebO$VU]]jH)*B9$Ħ:( R..–L:ؒآtDR3[n!aO`KE]l{P0qc@,%hA V Zz-E< ĖV<1t=#0lQ\W[<@@[Ex,Vo8{,fqfX @.By,0WNbJc5{,pWc"` cx,PpWw1j@fk% +J@X0c1܍wrpI~:[XXcAwas4h \1|.3o97 B%  |V`|=$p+w96X] c!0XBյ@V *HJ@ 8P<dpǂ "quEjX:L[gN#Y A +Oc=KTǂ ڲ dcAZ)cAnR>WǂB$ -uhҪǂa豠D؂c2ٷ=-w,Ԧ걠r ׮BcA)BŤXK< X=[0U<`) +5"3t [d{,@ ǂa A5V23y, +$\lY=TRE&i 0>N fW[$ǂZm7ǂZaKiⱠlA籠Q&{,ơ#Xиbc7ǂ&&xμmmY<4- )-H3o$7A'OaKl걠li#jLEf=MdޞTj;ЛGb*Gr `&v5XVdr E>7L>GTPfb70-sb@o|NN#EmM0Uؚ퀇f! :fDiHC73K1v_h2,6vgc$guJ0Ql _k =>gtg|~[!wot7OZ'F +gTl~@`Ҏ"ے],qcjF)iv2Coޜq *<~7Coޝ~ʶ7>2,TCkր"лׯxkOo>)(v^~V܆:W OTZB*ßpE?;^ll laϪǛ$Q%Y/yi' v%Yvw2u` Jgrȉy)՗SYFr7@TkBڦ}aG,d}w.eR//!|=4uC?6ј:o@aÑ(|*{M$1nP%D^(&9wݕ=wPKO!Z%}GI봇|phh_t^uC={l '=ϫ)IAy$j32"=RzDl5cYt~nʳ~AIǢnDT [r ݣnvFbכj8{¶G6JWox{t%IJfZ ,nztdvh^D;sQ|E`GujxoW|Aᖓ%-HK9=H.ˇɷU=_~6X}gأ=,9q}Y8W9^0JoM=HC+U^6O4-T/o8&_LpQG3&ܿhK;LuIL'ڿѸͱטXԫYn vvf[=P _aJfg ΊOYh[!-MqnSL:>tܘI|lx9΀m2d$9sjBk.:کv١ӾP \@F]6Z,ݦWn^*#_WOuT:*W-He͒#,TgI۾w_mm4$̔ftS1sR+ ,ElB5g'lؒȋ<~Vr{"J֞0AEo=iT&Z#^5UIvb[E{k=ڎeH5 +endstream +endobj +880 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 879 0 R +/Resources 4 0 R +/Annots [ 881 0 R 882 0 R 883 0 R 884 0 R 885 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +881 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb237-16) +>> +endobj +882 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb237-17) +>> +endobj +883 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb237-18) +>> +endobj +884 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb237-19) +>> +endobj +885 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 681.384971 101.433071 662.634971 ] +/BS << +/W 0 +>> +/Dest (cb238-1) +>> +endobj +886 0 obj +<< +/Filter /FlateDecode +/Length 3336 +>> +stream +x[K$ 賁%zH8!FzsGUIbusfgvٙ.zPRMJɻ<Bg%Rh!PqXzŸ~=_6]k9tGa1RK`5| +%lrpbk b‘YbpbA  +1K{VX#T V#DM ^H.Crm^(\8`9jK%fo S-/CMd+%B;U&kR&kK[\mɃGar1xdɃ,|xY?8jxk&O%caY Y|-BXRȂؒ܊x1X@@$P, 5y[X@D%2YX@@[XX@[-XX@[![X@\-, . ,, `.;-, .ܽXX@@]J9ZX@]-, .q0p-Md[Xtt*YX] +XX]Q`؊z g  B+>H0p7&Lݘ|c?dka=x,,@g."- wCC3|hBm‚ g 7Zv!faA"P "j w!R[N`&9&Pb jݬ +Y6eY,,h 㳰$M0PߌlaR‚FMl meY,,h YRY45oIo,^,-goV f`<,qp75 "3&2[ko ?Uv<1ބjx`/U1 w># s($܂=ǪFT~;O>=|OƏF'Lccj8A!"͊|"3!`z[b?I-:둎`t5Q[ɦ5EYҪ;D^.UQפPK;~/uK&N|0Ɓ&.%j!ZceUƿ*=*kr7Y5bPA#Yϣ.Z i:a-s qŰjPU6TQ;DmCٴI]^C-Xzs%Ueڙs`;NvЛ:o+8XX+`ٯ|B3e)#xs秜ޞ YTƎȑ㟰|p7އ߀"g)m !o-zhO~w n]w|ެ"8eT~&|OK{;LEٟuVDI>C]n[WqoyXlӼ㲍7e<Sw7ކw/&{|scW]4i/}*08'e ևqO&9ЖK[|OA?&Ǯ+.K'iNqtC6<=܌z_6{rW~;O?LuYٜ%s2>]x}-< + G6=sՋ躷tضom+ӆLi{/ =!%ZO#dZ +ǪMK%'~=P+ }?/CN_ }(X,9ޛGf.˦,ސ.{Ѿ{RVVtÍwްF! M.D~uqk' Jߕ^N6Ag_f,)njRr~\xiFڧLJ#$6 l2{޻yu{6CuW'Ɂ"{W-r!OGSuyZuA-ZΧ(|jRjhMj5\'$;?f,U?CYzr2Re֪i_,S:o.*,#,9\k_;儜vZX0=M$$WeQKkܝTIIUZoNQI'갥eU +L +tgULK HM8ôIX~9MSK4]>A{.ry2W=YM ye~5Kw5? >wW`VOBB]g9Կk/hm> ȗ mE>P]͚72> +endobj +888 0 obj +<< +/Filter /FlateDecode +/Length 3182 +>> +stream +x[MdadIUc! 8d0!x1؄8R_}ƞ" x=+JUG%]u8{ +W5Z[z?}8yWO/qw_I൸Z)K>_Ov/~=}τstLJ-'"j D+%LD98t5&hGQjb"1V"PCy5KP&BDC2(U%YH.bpب@Jd2sL%5,AT=AZ,C Z +tN# +]]ʠ>0YZU>ʢO.Ud!*CDar!]OʠKLIJ$ZEx LKE ` ]|ɌAxq@,iH VqZ29-E ĖV@) FޗƸ wmd\2.Ypd\VJf\ )eĸx EeE2.@b횴ʸD"12.( e`\. ܅ Sd\&s2.()c=2Y5UBa\P:LŁqR"K dA]* 03Y.H Ӆ,5Bd jXefϸ34֒05ufe\P5;K LSRtM0.b;1.M,s HRF[nVB#7 2>ggi28d3.hbq֛qA&x$nd[oMKBBeIS#q NzdĦ Zζެ f`n T[o]M d]dqnDfě +3.tzVe +3 _[#Met*mE>p}ڷ2ܡ`ά:~9V1ymO_{?w_k,HA0O0k_WdO`M 6RC0X ֎o!76d',"}vPW ^=njjYracYR0Y! psX.%J#P`C2kqf.p*{E(·|C;ixl.ؼB|rU~ +vpL}hӫefK_"Ru9?^{ٝ6ۿK΂/O9?^|B +o= q/|/GRg%^wx>|\|6uŶ4ϯߟ͟w|} O/G|Sq}_;ÿgڳ=k"*AuܪF)ޚMuoͧtwBϳ@-N4ۡRG~*|5:] O`3#]E3mW뼞mCvʽ3M}8/7m>́cOᦹ>-טo;,nhaj0WBYrnz |'mQzh9tK]!??ƠGHn1Ct#9k̍=:ovp"1vuYYz G,3:ˡC^z(>{Gn8돯-~ПS+m;حE>G6o@[QDGxb+Qe&0D؎NY;!o#0YwvÍ'uz{on^ԟ {*}H;I\]vi^z0)tÆ3OfDC*v\u9 .|k7 Xu/~֥a#X$5H1iXbc鴸§z;([~Bt9L{7H5AKu؜v RHwC7m8~V'yaz݄†}&WJ;xfGc9lf Γ;;\; 2n>?K)l_G# ~v \h\AfS梤lsKmܳp/|ױuǣl'Lf'믄dgl`ԍ*7y<ƍu=a2hLˆ eG+D淎͚o2:fĎa pwudMJY5Cq{7{lK;5!FM݇BfK#VL4W=ދR`o5썶;}ҟ^yC'OcN|;9eYl'3YR }tCz(Fu`wb0?Yc:aJTfNПvK}T>*;f-Leί3URض޷=f ]䕙Xz(Y9CYwBB]0Qk(ל!j‹mk䓟O{K"n(W +AeV(yڥO3_o +м-T%վP3/Fm{r +endstream +endobj +889 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 888 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +890 0 obj +<< +/Filter /FlateDecode +/Length 4326 +>> +stream +x\K$ ׯ˂l 1>Lbz >ST*BŇiz:CP(ORTe;jtVr<>)_jt[XLr-tLPLiɗ||:MSv:{ћֲw'b`J-&.(L)>e[X#U Fl5i, +B {V k(,g!֪<bc ^d25w&+5^&xSxfK%ƃ,1Ԣ2d 9XY|-A⡝*duUYlN`R1y&jV9gl3a ZdP Ǫpt`5,@ 0HK4,H]ZW[ְ w]f\˹iXTAÂ|V kX. Rk IÂbAH,Yb 6-aA%xaA)LsȾ\ BdLm1jXPRF=jM-kWsEÂRA(v2NaPaE J,p L5,H5,@ sTY jXP}EШ%j-ՙUÂTQ *M ʃ, ?Tl' PD KHQÂZ=UÂZ!^&՛EÂf! 2> ͆d YaAs/ެ`QoSLfѰEȒ<Ȃ)~ LB tx5,h9SY5,@zz$P,qp75 "3zV[o*tf'Л[# E*ꙁR@LT5`:X/Ä<0Y --"QsnBد?}@=769)`v +Ay6 ~jщ #:8ا5U]t1C ID(Pn)s:IsI+yԹ9Ԏ'l9&@ ѭHwa{vͭv.%zVciM֦jJnbE7"*pk2UW;ʄ&ymB䇍eL(l*&du„*zo)OkI4РEϩv4⸔ӿBYϺC^t277{sߙeW;O,W,7{s7T'/ox3ǻ=ܗ??@mX!}χo?翠~|xwֺ_:o-o߈3?7s;𛗿7awv& +YbCC8*uw)M"I=Kx]:x$8:?K&H",J;4ag?ȴ/->mu9BeG;.^~:kȋYM1X0Cc qrj2~g_cI\ee;!llMr{BvYN>"D಴OﷲmqSӶ]w_q!/㞦ײN{}XcuV4sXޔQ,Mt'QJɄ}@hƞ5-HVέU=坞nч'ۘY?lm^41Js|ΥXi:&viLR3=PeӢ{5ǪY9Ű{3uI_@>ْ۟Эdt;W /C(c;t}ROΕW{n>w ^]_V_+[c[QVu͞6kF˜@Ԧlp돎}]wc@x2j#>Lܾ.~7e:8~mm=VsUg:GQ_Ր^g]f5csu]ӤrMwyû|nra2ob{j\CmUS64/ko| >㴍CƁkLok!4 ic=Or9-;f_e϶ykw ?~\3:Ym$֒XKgE^ +p, +;&r DŸt@ؖ\YcV;t bsNO'z̓թ8`(=q읧o:&%'_d?}&պKr,S$UO/ucih,Į3m2@ϖ3 +rOKv +bn}dy= +=T'q.Us_T&iÖR<kA B6{ c}ApG|gy|kXXِ׸B:~hiT꼵(CWh'qzWrMDj쵭nx:8?_x+?Fp[WdcF2rmGF^u u+iP0]LBIXQЛy1';54 +Hrk"FۖINŀ ,ƈemjbRNrWܕKrR P\9rɪв{P;h{ˈS<3S;oK/¿p֋IѕCU9C"m*F祯3a;L G/Ex=C yۚUt. E}.ghҧ^(nb/> +endobj +892 0 obj +<< +/Filter /FlateDecode +/Length 4317 +>> +stream +x\K$ȳ%X 0vჁ6 :Ƣf2Pd2˞ `PG(2=~ ppԜ|ɻ,>Ysvj*rI ]s:_w'5 <+咳U 9J2X)8b bH 1Xc,@ U!F́-U +rɃ ,^ .-KW]JIc"'Exd %&Ēej +duY|UrR ɫ=/zqR lLv)e!KRMddaX‚A@Ƀ,֮R-Y(F r,,,@Dj@mb Y)ZX$s2[X%!V-^d+laAȥ\4\b‚\! pEDD/@ / J,-,( LxhPcyfpr*ZXmLHi `&ba$HsLd!a Jn J,G `of ,,,>9 -,罅5䛑-,|XXP#DgJIlaAe"QLdAT} LB tx Ԕ4, @, 7Y.J2Y<."da.o"r{f8Y1^o5K o͚jd &2˒̪*eE%s%MVl Ft?rZN~=N_~*e'&H7R rm8F0A3a4 !Q!r] ťB#lE*s@0y),%[7y'YW%Ѹ(g%!膯Qn`w<$K7ywYi!OBX/yM!JG! B5~G!7N{:O!O_~/Xfx\w8#a|D:]yzy5?\:kU#YҴn6s ڧp6S7w*3]tո1G5j 󝢥zqj~Wj3>e d$.j˲+R}.C?,o/HhQƆ /Nǜ.}sqH!?R@a]*qC煞ה B`̇MAYc`j='MH + v{,*w}cʲuWnqf^,ه,~$W)z]cz)"%!j|E'>ϜCTmX_ajօik͟;_fd1Cʜc/;'.L-=ؚ-jzy<`uARFq1G,Hz9] 8rh'*}>m +ABsڏ ݽXduK VsyÈUE0ɼ/U(~l'r`2?nn/JAJ)qcɎ_I1o̢&7CK[5g*3Nfz0'aZS䧛o\Z< [|#}|~\t8 ^ .|6;꟢n;O79oCznI%lYܜRVCzKI DUV>=ўGc}>LEaC_k&{8VK>Fݍ\8ajs3ϲ#Let<Y>{ R܅ zCR_17L+ 9 +zQ'\ˤx u0PѻXL5}!_ y&13;q_)RZ<OcwO$.1ľil5T.F/I.jCz-0~7}rHv5rñ.(P0h~#N{g;[+FoɏvۑxqownJzS MG.!m#rǺPJXҎE}/z}~i'~쫾pjIנ=<^R+^Kݟji՗n&m}2B߷>G@Ӓ\h=8Micz.ql7X PI/GNVblVJfGWb͈wGp?j}!]_Gm;9Bs f!C$ZYߵ1/m#k@|= M8u%pn;eG!m|^ Q]CgfZ)ŏӻe{ 3A=|l?R{G,=3ΛtYO2p~gG+$/i zm狥m:Nz8ro`PXƑN`#m?ǮFwwsJm:ADzޅ@R-WiuA\:qOD'iա´mr>"^Nn/&U>TnFPuP c d}haUӷG Gl&chU֮k~e5u*ChfJi}fKkd7x9 _Nֲbnz3q^V*EUؚWAUi&ϮW$7y갥ym;+> +endobj +894 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 766.923057 101.433071 748.173057 ] +/BS << +/W 0 +>> +/Dest (cb241-1) +>> +endobj +895 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 747.976036 99.933071 729.226036 ] +/BS << +/W 0 +>> +/Dest (cb241-2) +>> +endobj +896 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 729.029014 99.933071 710.279014 ] +/BS << +/W 0 +>> +/Dest (cb241-3) +>> +endobj +897 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 710.081993 99.933071 691.331993 ] +/BS << +/W 0 +>> +/Dest (cb241-4) +>> +endobj +898 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 691.134971 99.933071 672.384971 ] +/BS << +/W 0 +>> +/Dest (cb241-5) +>> +endobj +899 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 672.187950 99.933071 653.437950 ] +/BS << +/W 0 +>> +/Dest (cb241-6) +>> +endobj +900 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 653.240928 99.933071 634.490928 ] +/BS << +/W 0 +>> +/Dest (cb241-7) +>> +endobj +901 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 634.293907 99.933071 615.543907 ] +/BS << +/W 0 +>> +/Dest (cb241-8) +>> +endobj +902 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 615.346885 99.933071 596.596885 ] +/BS << +/W 0 +>> +/Dest (cb241-9) +>> +endobj +903 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 596.399864 99.933071 577.649864 ] +/BS << +/W 0 +>> +/Dest (cb241-10) +>> +endobj +904 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 577.452842 99.933071 558.702842 ] +/BS << +/W 0 +>> +/Dest (cb241-11) +>> +endobj +905 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 520.611778 99.933071 501.861778 ] +/BS << +/W 0 +>> +/Dest (cb241-12) +>> +endobj +906 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 501.664756 99.933071 482.914756 ] +/BS << +/W 0 +>> +/Dest (cb241-13) +>> +endobj +907 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 482.717735 99.933071 463.967735 ] +/BS << +/W 0 +>> +/Dest (cb241-14) +>> +endobj +908 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 463.770714 99.933071 445.020714 ] +/BS << +/W 0 +>> +/Dest (cb241-15) +>> +endobj +909 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 444.823692 99.933071 426.073692 ] +/BS << +/W 0 +>> +/Dest (cb241-16) +>> +endobj +910 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 425.876671 99.933071 407.126671 ] +/BS << +/W 0 +>> +/Dest (cb241-17) +>> +endobj +911 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 406.929649 99.933071 388.179649 ] +/BS << +/W 0 +>> +/Dest (cb241-18) +>> +endobj +912 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 345.982628 101.433071 327.232628 ] +/BS << +/W 0 +>> +/Dest (cb242-1) +>> +endobj +913 0 obj +<< +/Title (CIS v1.6 Benchmark - Self-Assessment Guide - Rancher v2.6) +/Dest [ 6 0 R /XYZ 85.009843 502.818898 0 ] +/Count 141 +/First 914 0 R +/Last 1050 0 R +/Parent 1055 0 R +>> +endobj +914 0 obj +<< +/Title (CIS v1.6 Kubernetes Benchmark - Rancher v2.6 with Kubernetes v1.18 to v1.21) +/Dest [ 304 0 R /XYZ 84.259843 784.970079 0 ] +/Count 2 +/First 915 0 R +/Last 916 0 R +/Parent 913 0 R +/Next 917 0 R +>> +endobj +915 0 obj +<< +/Title (Overview) +/Dest [ 304 0 R /XYZ 84.259843 704.822079 0 ] +/Count 0 +/Parent 914 0 R +/Next 916 0 R +>> +endobj +916 0 obj +<< +/Title (Testing controls methodology) +/Dest [ 304 0 R /XYZ 84.259843 166.076079 0 ] +/Count 0 +/Prev 915 0 R +/Parent 914 0 R +>> +endobj +917 0 obj +<< +/Title (Controls) +/Dest [ 309 0 R /XYZ 84.259843 612.381496 0 ] +/Count 0 +/Prev 914 0 R +/Parent 913 0 R +/Next 918 0 R +>> +endobj +918 0 obj +<< +/Title (1.1 Master Node Configuration Files) +/Dest [ 313 0 R /XYZ 41.740157 784.430079 0 ] +/Count 21 +/Prev 917 0 R +/First 919 0 R +/Last 939 0 R +/Parent 913 0 R +/Next 940 0 R +>> +endobj +919 0 obj +<< +/Title (1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 313 0 R /XYZ 84.259843 684.651496 0 ] +/Count 0 +/Parent 918 0 R +/Next 920 0 R +>> +endobj +920 0 obj +<< +/Title (1.1.2 Ensure that the API server pod specification file ownership is set to root:root \(Automated\)) +/Dest [ 313 0 R /XYZ 84.259843 553.851496 0 ] +/Count 0 +/Prev 919 0 R +/Parent 918 0 R +/Next 921 0 R +>> +endobj +921 0 obj +<< +/Title (1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 313 0 R /XYZ 84.259843 423.051496 0 ] +/Count 0 +/Prev 920 0 R +/Parent 918 0 R +/Next 922 0 R +>> +endobj +922 0 obj +<< +/Title (1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root \(Automated\)) +/Dest [ 313 0 R /XYZ 84.259843 277.251496 0 ] +/Count 0 +/Prev 921 0 R +/Parent 918 0 R +/Next 923 0 R +>> +endobj +923 0 obj +<< +/Title (1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 313 0 R /XYZ 84.259843 146.451496 0 ] +/Count 0 +/Prev 922 0 R +/Parent 918 0 R +/Next 924 0 R +>> +endobj +924 0 obj +<< +/Title (1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root \(Automated\)) +/Dest [ 315 0 R /XYZ 84.259843 739.970079 0 ] +/Count 0 +/Prev 923 0 R +/Parent 918 0 R +/Next 925 0 R +>> +endobj +925 0 obj +<< +/Title (1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 315 0 R /XYZ 84.259843 609.170079 0 ] +/Count 0 +/Prev 924 0 R +/Parent 918 0 R +/Next 926 0 R +>> +endobj +926 0 obj +<< +/Title (1.1.8 Ensure that the etcd pod specification file ownership is set to root:root \(Automated\)) +/Dest [ 315 0 R /XYZ 84.259843 478.370079 0 ] +/Count 0 +/Prev 925 0 R +/Parent 918 0 R +/Next 927 0 R +>> +endobj +927 0 obj +<< +/Title (1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive \(Manual\)) +/Dest [ 315 0 R /XYZ 84.259843 347.570079 0 ] +/Count 0 +/Prev 926 0 R +/Parent 918 0 R +/Next 928 0 R +>> +endobj +928 0 obj +<< +/Title (1.1.10 Ensure that the Container Network Interface file ownership is set to root:root \(Manual\)) +/Dest [ 315 0 R /XYZ 84.259843 170.823057 0 ] +/Count 0 +/Prev 927 0 R +/Parent 918 0 R +/Next 929 0 R +>> +endobj +929 0 obj +<< +/Title (1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive \(Automated\)) +/Dest [ 318 0 R /XYZ 84.259843 694.023057 0 ] +/Count 0 +/Prev 928 0 R +/Parent 918 0 R +/Next 930 0 R +>> +endobj +930 0 obj +<< +/Title (1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd \(Automated\)) +/Dest [ 318 0 R /XYZ 84.259843 365.776036 0 ] +/Count 0 +/Prev 929 0 R +/Parent 918 0 R +/Next 931 0 R +>> +endobj +931 0 obj +<< +/Title (1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 323 0 R /XYZ 84.259843 702.470079 0 ] +/Count 0 +/Prev 930 0 R +/Parent 918 0 R +/Next 932 0 R +>> +endobj +932 0 obj +<< +/Title (1.1.14 Ensure that the admin.conf file ownership is set to root:root \(Automated\)) +/Dest [ 323 0 R /XYZ 84.259843 586.670079 0 ] +/Count 0 +/Prev 931 0 R +/Parent 918 0 R +/Next 933 0 R +>> +endobj +933 0 obj +<< +/Title (1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 323 0 R /XYZ 84.259843 470.870079 0 ] +/Count 0 +/Prev 932 0 R +/Parent 918 0 R +/Next 934 0 R +>> +endobj +934 0 obj +<< +/Title (1.1.16 Ensure that the scheduler.conf file ownership is set to root:root \(Automated\)) +/Dest [ 323 0 R /XYZ 84.259843 340.070079 0 ] +/Count 0 +/Prev 933 0 R +/Parent 918 0 R +/Next 935 0 R +>> +endobj +935 0 obj +<< +/Title (1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 323 0 R /XYZ 84.259843 209.270079 0 ] +/Count 0 +/Prev 934 0 R +/Parent 918 0 R +/Next 936 0 R +>> +endobj +936 0 obj +<< +/Title (1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root \(Automated\)) +/Dest [ 325 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 935 0 R +/Parent 918 0 R +/Next 937 0 R +>> +endobj +937 0 obj +<< +/Title (1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root \(Automated\)) +/Dest [ 325 0 R /XYZ 84.259843 668.570079 0 ] +/Count 0 +/Prev 936 0 R +/Parent 918 0 R +/Next 938 0 R +>> +endobj +938 0 obj +<< +/Title (1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 349 0 R /XYZ 84.259843 184.188585 0 ] +/Count 0 +/Prev 937 0 R +/Parent 918 0 R +/Next 939 0 R +>> +endobj +939 0 obj +<< +/Title (1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 \(Automated\)) +/Dest [ 440 0 R /XYZ 84.259843 702.470079 0 ] +/Count 0 +/Prev 938 0 R +/Parent 918 0 R +>> +endobj +940 0 obj +<< +/Title (1.2 API Server) +/Dest [ 508 0 R /XYZ 41.740157 784.430079 0 ] +/Count 35 +/Prev 918 0 R +/First 941 0 R +/Last 975 0 R +/Parent 913 0 R +/Next 976 0 R +>> +endobj +941 0 obj +<< +/Title (1.2.1 Ensure that the --anonymous-auth argument is set to false \(Automated\)) +/Dest [ 508 0 R /XYZ 84.259843 720.651496 0 ] +/Count 0 +/Parent 940 0 R +/Next 942 0 R +>> +endobj +942 0 obj +<< +/Title (1.2.2 Ensure that the --basic-auth-file argument is not set \(Automated\)) +/Dest [ 511 0 R /XYZ 84.259843 295.970079 0 ] +/Count 0 +/Prev 941 0 R +/Parent 940 0 R +/Next 943 0 R +>> +endobj +943 0 obj +<< +/Title (1.2.3 Ensure that the --token-auth-file parameter is not set \(Automated\)) +/Dest [ 516 0 R /XYZ 84.259843 595.970079 0 ] +/Count 0 +/Prev 942 0 R +/Parent 940 0 R +/Next 944 0 R +>> +endobj +944 0 obj +<< +/Title (1.2.4 Ensure that the --kubelet-https argument is set to true \(Automated\)) +/Dest [ 519 0 R /XYZ 84.259843 164.720079 0 ] +/Count 0 +/Prev 943 0 R +/Parent 940 0 R +/Next 945 0 R +>> +endobj +945 0 obj +<< +/Title (1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate \(Automated\)) +/Dest [ 524 0 R /XYZ 84.259843 427.220079 0 ] +/Count 0 +/Prev 944 0 R +/Parent 940 0 R +/Next 946 0 R +>> +endobj +946 0 obj +<< +/Title (1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate \(Automated\)) +/Dest [ 529 0 R /XYZ 84.259843 652.220079 0 ] +/Count 0 +/Prev 945 0 R +/Parent 940 0 R +/Next 947 0 R +>> +endobj +947 0 obj +<< +/Title (1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow \(Automated\)) +/Dest [ 532 0 R /XYZ 84.259843 183.470079 0 ] +/Count 0 +/Prev 946 0 R +/Parent 940 0 R +/Next 948 0 R +>> +endobj +948 0 obj +<< +/Title (1.2.8 Ensure that the --authorization-mode argument includes Node \(Automated\)) +/Dest [ 537 0 R /XYZ 84.259843 464.720079 0 ] +/Count 0 +/Prev 947 0 R +/Parent 940 0 R +/Next 949 0 R +>> +endobj +949 0 obj +<< +/Title (1.2.9 Ensure that the --authorization-mode argument includes RBAC \(Automated\)) +/Dest [ 542 0 R /XYZ 84.259843 745.970079 0 ] +/Count 0 +/Prev 948 0 R +/Parent 940 0 R +/Next 950 0 R +>> +endobj +950 0 obj +<< +/Title (1.2.10 Ensure that the admission control plugin EventRateLimit is set \(Automated\)) +/Dest [ 545 0 R /XYZ 84.259843 314.720079 0 ] +/Count 0 +/Prev 949 0 R +/Parent 940 0 R +/Next 951 0 R +>> +endobj +951 0 obj +<< +/Title (1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set \(Automated\)) +/Dest [ 550 0 R /XYZ 84.259843 520.970079 0 ] +/Count 0 +/Prev 950 0 R +/Parent 940 0 R +/Next 952 0 R +>> +endobj +952 0 obj +<< +/Title (1.2.12 Ensure that the admission control plugin AlwaysPullImages is set \(Manual\)) +/Dest [ 555 0 R /XYZ 84.259843 708.470079 0 ] +/Count 0 +/Prev 951 0 R +/Parent 940 0 R +/Next 953 0 R +>> +endobj +953 0 obj +<< +/Title (1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used \(Manual\)) +/Dest [ 555 0 R /XYZ 84.259843 501.723057 0 ] +/Count 0 +/Prev 952 0 R +/Parent 940 0 R +/Next 954 0 R +>> +endobj +954 0 obj +<< +/Title (1.2.14 Ensure that the admission control plugin ServiceAccount is set \(Automated\)) +/Dest [ 555 0 R /XYZ 84.259843 264.976036 0 ] +/Count 0 +/Prev 953 0 R +/Parent 940 0 R +/Next 955 0 R +>> +endobj +955 0 obj +<< +/Title (1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set \(Automated\)) +/Dest [ 562 0 R /XYZ 84.259843 520.970079 0 ] +/Count 0 +/Prev 954 0 R +/Parent 940 0 R +/Next 956 0 R +>> +endobj +956 0 obj +<< +/Title (1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set \(Automated\)) +/Dest [ 567 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 955 0 R +/Parent 940 0 R +/Next 957 0 R +>> +endobj +957 0 obj +<< +/Title (1.2.17 Ensure that the admission control plugin NodeRestriction is set \(Automated\)) +/Dest [ 570 0 R /XYZ 84.259843 258.470079 0 ] +/Count 0 +/Prev 956 0 R +/Parent 940 0 R +/Next 958 0 R +>> +endobj +958 0 obj +<< +/Title (1.2.18 Ensure that the --insecure-bind-address argument is not set \(Automated\)) +/Dest [ 575 0 R /XYZ 84.259843 427.220079 0 ] +/Count 0 +/Prev 957 0 R +/Parent 940 0 R +/Next 959 0 R +>> +endobj +959 0 obj +<< +/Title (1.2.19 Ensure that the --insecure-port argument is set to 0 \(Automated\)) +/Dest [ 580 0 R /XYZ 84.259843 727.220079 0 ] +/Count 0 +/Prev 958 0 R +/Parent 940 0 R +/Next 960 0 R +>> +endobj +960 0 obj +<< +/Title (1.2.20 Ensure that the --secure-port argument is not set to 0 \(Automated\)) +/Dest [ 583 0 R /XYZ 84.259843 314.720079 0 ] +/Count 0 +/Prev 959 0 R +/Parent 940 0 R +/Next 961 0 R +>> +endobj +961 0 obj +<< +/Title (1.2.21 Ensure that the --profiling argument is set to false \(Automated\)) +/Dest [ 588 0 R /XYZ 84.259843 595.970079 0 ] +/Count 0 +/Prev 960 0 R +/Parent 940 0 R +/Next 962 0 R +>> +endobj +962 0 obj +<< +/Title (1.2.22 Ensure that the --audit-log-path argument is set \(Automated\)) +/Dest [ 591 0 R /XYZ 84.259843 183.470079 0 ] +/Count 0 +/Prev 961 0 R +/Parent 940 0 R +/Next 963 0 R +>> +endobj +963 0 obj +<< +/Title (1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate \(Automated\)) +/Dest [ 596 0 R /XYZ 84.259843 445.970079 0 ] +/Count 0 +/Prev 962 0 R +/Parent 940 0 R +/Next 964 0 R +>> +endobj +964 0 obj +<< +/Title (1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate \(Automated\)) +/Dest [ 601 0 R /XYZ 84.259843 727.220079 0 ] +/Count 0 +/Prev 963 0 R +/Parent 940 0 R +/Next 965 0 R +>> +endobj +965 0 obj +<< +/Title (1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate \(Automated\)) +/Dest [ 604 0 R /XYZ 84.259843 295.970079 0 ] +/Count 0 +/Prev 964 0 R +/Parent 940 0 R +/Next 966 0 R +>> +endobj +966 0 obj +<< +/Title (1.2.26 Ensure that the --request-timeout argument is set as appropriate \(Automated\)) +/Dest [ 609 0 R /XYZ 84.259843 595.970079 0 ] +/Count 0 +/Prev 965 0 R +/Parent 940 0 R +/Next 967 0 R +>> +endobj +967 0 obj +<< +/Title (1.2.27 Ensure that the --service-account-lookup argument is set to true \(Automated\)) +/Dest [ 612 0 R /XYZ 84.259843 164.720079 0 ] +/Count 0 +/Prev 966 0 R +/Parent 940 0 R +/Next 968 0 R +>> +endobj +968 0 obj +<< +/Title (1.2.28 Ensure that the --service-account-key-file argument is set as appropriate \(Automated\)) +/Dest [ 617 0 R /XYZ 84.259843 408.470079 0 ] +/Count 0 +/Prev 967 0 R +/Parent 940 0 R +/Next 969 0 R +>> +endobj +969 0 obj +<< +/Title (1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate \(Automated\)) +/Dest [ 622 0 R /XYZ 84.259843 689.720079 0 ] +/Count 0 +/Prev 968 0 R +/Parent 940 0 R +/Next 970 0 R +>> +endobj +970 0 obj +<< +/Title (1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate \(Automated\)) +/Dest [ 625 0 R /XYZ 84.259843 239.720079 0 ] +/Count 0 +/Prev 969 0 R +/Parent 940 0 R +/Next 971 0 R +>> +endobj +971 0 obj +<< +/Title (1.2.31 Ensure that the --client-ca-file argument is set as appropriate \(Automated\)) +/Dest [ 630 0 R /XYZ 84.259843 483.470079 0 ] +/Count 0 +/Prev 970 0 R +/Parent 940 0 R +/Next 972 0 R +>> +endobj +972 0 obj +<< +/Title (1.2.32 Ensure that the --etcd-cafile argument is set as appropriate \(Automated\)) +/Dest [ 635 0 R /XYZ 84.259843 745.970079 0 ] +/Count 0 +/Prev 971 0 R +/Parent 940 0 R +/Next 973 0 R +>> +endobj +973 0 obj +<< +/Title (1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate \(Automated\)) +/Dest [ 638 0 R /XYZ 84.259843 295.970079 0 ] +/Count 0 +/Prev 972 0 R +/Parent 940 0 R +/Next 974 0 R +>> +endobj +974 0 obj +<< +/Title (1.2.34 Ensure that encryption providers are appropriately configured \(Automated\)) +/Dest [ 643 0 R /XYZ 84.259843 577.220079 0 ] +/Count 0 +/Prev 973 0 R +/Parent 940 0 R +/Next 975 0 R +>> +endobj +975 0 obj +<< +/Title (1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers \(Automated\)) +/Dest [ 660 0 R /XYZ 84.259843 411.552842 0 ] +/Count 0 +/Prev 974 0 R +/Parent 940 0 R +>> +endobj +976 0 obj +<< +/Title (1.3 Controller Manager) +/Dest [ 674 0 R /XYZ 41.740157 784.430079 0 ] +/Count 7 +/Prev 940 0 R +/First 977 0 R +/Last 983 0 R +/Parent 913 0 R +/Next 984 0 R +>> +endobj +977 0 obj +<< +/Title (1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate \(Automated\)) +/Dest [ 674 0 R /XYZ 84.259843 720.651496 0 ] +/Count 0 +/Parent 976 0 R +/Next 978 0 R +>> +endobj +978 0 obj +<< +/Title (1.3.2 Ensure that the --profiling argument is set to false \(Automated\)) +/Dest [ 677 0 R /XYZ 84.259843 727.220079 0 ] +/Count 0 +/Prev 977 0 R +/Parent 976 0 R +/Next 979 0 R +>> +endobj +979 0 obj +<< +/Title (1.3.3 Ensure that the --use-service-account-credentials argument is set to true \(Automated\)) +/Dest [ 680 0 R /XYZ 84.259843 745.970079 0 ] +/Count 0 +/Prev 978 0 R +/Parent 976 0 R +/Next 980 0 R +>> +endobj +980 0 obj +<< +/Title (1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate \(Automated\)) +/Dest [ 683 0 R /XYZ 84.259843 745.970079 0 ] +/Count 0 +/Prev 979 0 R +/Parent 976 0 R +/Next 981 0 R +>> +endobj +981 0 obj +<< +/Title (1.3.5 Ensure that the --root-ca-file argument is set as appropriate \(Automated\)) +/Dest [ 686 0 R /XYZ 84.259843 727.220079 0 ] +/Count 0 +/Prev 980 0 R +/Parent 976 0 R +/Next 982 0 R +>> +endobj +982 0 obj +<< +/Title (1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true \(Automated\)) +/Dest [ 689 0 R /XYZ 84.259843 727.220079 0 ] +/Count 0 +/Prev 981 0 R +/Parent 976 0 R +/Next 983 0 R +>> +endobj +983 0 obj +<< +/Title (1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 \(Automated\)) +/Dest [ 689 0 R /XYZ 84.259843 524.420079 0 ] +/Count 0 +/Prev 982 0 R +/Parent 976 0 R +>> +endobj +984 0 obj +<< +/Title (1.4 Scheduler) +/Dest [ 694 0 R /XYZ 41.740157 784.430079 0 ] +/Count 2 +/Prev 976 0 R +/First 985 0 R +/Last 986 0 R +/Parent 913 0 R +/Next 987 0 R +>> +endobj +985 0 obj +<< +/Title (1.4.1 Ensure that the --profiling argument is set to false \(Automated\)) +/Dest [ 694 0 R /XYZ 84.259843 720.651496 0 ] +/Count 0 +/Parent 984 0 R +/Next 986 0 R +>> +endobj +986 0 obj +<< +/Title (1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 \(Automated\)) +/Dest [ 694 0 R /XYZ 84.259843 257.404475 0 ] +/Count 0 +/Prev 985 0 R +/Parent 984 0 R +>> +endobj +987 0 obj +<< +/Title (2 Etcd Node Configuration Files) +/Dest [ 700 0 R /XYZ 41.740157 784.430079 0 ] +/Count 7 +/Prev 984 0 R +/First 988 0 R +/Last 994 0 R +/Parent 913 0 R +/Next 995 0 R +>> +endobj +988 0 obj +<< +/Title (2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate \(Automated\)) +/Dest [ 700 0 R /XYZ 84.259843 684.651496 0 ] +/Count 0 +/Parent 987 0 R +/Next 989 0 R +>> +endobj +989 0 obj +<< +/Title (2.2 Ensure that the --client-cert-auth argument is set to true \(Automated\)) +/Dest [ 705 0 R /XYZ 84.259843 464.720079 0 ] +/Count 0 +/Prev 988 0 R +/Parent 987 0 R +/Next 990 0 R +>> +endobj +990 0 obj +<< +/Title (2.3 Ensure that the --auto-tls argument is not set to true \(Automated\)) +/Dest [ 710 0 R /XYZ 84.259843 258.470079 0 ] +/Count 0 +/Prev 989 0 R +/Parent 987 0 R +/Next 991 0 R +>> +endobj +991 0 obj +<< +/Title (2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate \(Automated\)) +/Dest [ 717 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 990 0 R +/Parent 987 0 R +/Next 992 0 R +>> +endobj +992 0 obj +<< +/Title (2.5 Ensure that the --peer-client-cert-auth argument is set to true \(Automated\)) +/Dest [ 722 0 R /XYZ 84.259843 558.470079 0 ] +/Count 0 +/Prev 991 0 R +/Parent 987 0 R +/Next 993 0 R +>> +endobj +993 0 obj +<< +/Title (2.6 Ensure that the --peer-auto-tls argument is not set to true \(Automated\)) +/Dest [ 727 0 R /XYZ 84.259843 333.470079 0 ] +/Count 0 +/Prev 992 0 R +/Parent 987 0 R +/Next 994 0 R +>> +endobj +994 0 obj +<< +/Title (2.7 Ensure that a unique Certificate Authority is used for etcd \(Automated\)) +/Dest [ 734 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 993 0 R +/Parent 987 0 R +>> +endobj +995 0 obj +<< +/Title (3.1 Authentication and Authorization) +/Dest [ 741 0 R /XYZ 41.740157 784.430079 0 ] +/Count 1 +/Prev 987 0 R +/First 996 0 R +/Last 996 0 R +/Parent 913 0 R +/Next 997 0 R +>> +endobj +996 0 obj +<< +/Title (3.1.1 Client certificate authentication should not be used for users \(Manual\)) +/Dest [ 741 0 R /XYZ 84.259843 684.651496 0 ] +/Count 0 +/Parent 995 0 R +>> +endobj +997 0 obj +<< +/Title (3.2 Logging) +/Dest [ 743 0 R /XYZ 41.740157 784.430079 0 ] +/Count 2 +/Prev 995 0 R +/First 998 0 R +/Last 999 0 R +/Parent 913 0 R +/Next 1000 0 R +>> +endobj +998 0 obj +<< +/Title (3.2.1 Ensure that a minimal audit policy is created \(Automated\)) +/Dest [ 743 0 R /XYZ 84.259843 720.651496 0 ] +/Count 0 +/Parent 997 0 R +/Next 999 0 R +>> +endobj +999 0 obj +<< +/Title (3.2.2 Ensure that the audit policy covers key security concerns \(Manual\)) +/Dest [ 746 0 R /XYZ 84.259843 333.470079 0 ] +/Count 0 +/Prev 998 0 R +/Parent 997 0 R +>> +endobj +1000 0 obj +<< +/Title (4.1 Worker Node Configuration Files) +/Dest [ 748 0 R /XYZ 41.740157 784.430079 0 ] +/Count 10 +/Prev 997 0 R +/First 1001 0 R +/Last 1010 0 R +/Parent 913 0 R +/Next 1011 0 R +>> +endobj +1001 0 obj +<< +/Title (4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 748 0 R /XYZ 84.259843 684.651496 0 ] +/Count 0 +/Parent 1000 0 R +/Next 1002 0 R +>> +endobj +1002 0 obj +<< +/Title (4.1.2 Ensure that the kubelet service file ownership is set to root:root \(Automated\)) +/Dest [ 748 0 R /XYZ 84.259843 553.851496 0 ] +/Count 0 +/Prev 1001 0 R +/Parent 1000 0 R +/Next 1003 0 R +>> +endobj +1003 0 obj +<< +/Title (4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 748 0 R /XYZ 84.259843 423.051496 0 ] +/Count 0 +/Prev 1002 0 R +/Parent 1000 0 R +/Next 1004 0 R +>> +endobj +1004 0 obj +<< +/Title (4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root \(Automated\)) +/Dest [ 751 0 R /XYZ 84.259843 763.220079 0 ] +/Count 0 +/Prev 1003 0 R +/Parent 1000 0 R +/Next 1005 0 R +>> +endobj +1005 0 obj +<< +/Title (4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 751 0 R /XYZ 84.259843 454.079014 0 ] +/Count 0 +/Prev 1004 0 R +/Parent 1000 0 R +/Next 1006 0 R +>> +endobj +1006 0 obj +<< +/Title (4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root \(Automated\)) +/Dest [ 751 0 R /XYZ 84.259843 163.687950 0 ] +/Count 0 +/Prev 1005 0 R +/Parent 1000 0 R +/Next 1007 0 R +>> +endobj +1007 0 obj +<< +/Title (4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 755 0 R /XYZ 84.259843 519.629014 0 ] +/Count 0 +/Prev 1006 0 R +/Parent 1000 0 R +/Next 1008 0 R +>> +endobj +1008 0 obj +<< +/Title (4.1.8 Ensure that the client certificate authorities file ownership is set to root:root \(Automated\)) +/Dest [ 764 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 1007 0 R +/Parent 1000 0 R +/Next 1009 0 R +>> +endobj +1009 0 obj +<< +/Title (4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive \(Automated\)) +/Dest [ 764 0 R /XYZ 84.259843 383.493907 0 ] +/Count 0 +/Prev 1008 0 R +/Parent 1000 0 R +/Next 1010 0 R +>> +endobj +1010 0 obj +<< +/Title (4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root \(Automated\)) +/Dest [ 764 0 R /XYZ 84.259843 195.693907 0 ] +/Count 0 +/Prev 1009 0 R +/Parent 1000 0 R +>> +endobj +1011 0 obj +<< +/Title (4.2 Kubelet) +/Dest [ 774 0 R /XYZ 41.740157 784.430079 0 ] +/Count 13 +/Prev 1000 0 R +/First 1012 0 R +/Last 1024 0 R +/Parent 913 0 R +/Next 1025 0 R +>> +endobj +1012 0 obj +<< +/Title (4.2.1 Ensure that the anonymous-auth argument is set to false \(Automated\)) +/Dest [ 774 0 R /XYZ 84.259843 720.651496 0 ] +/Count 0 +/Parent 1011 0 R +/Next 1013 0 R +>> +endobj +1013 0 obj +<< +/Title (4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow \(Automated\)) +/Dest [ 774 0 R /XYZ 84.259843 332.207453 0 ] +/Count 0 +/Prev 1012 0 R +/Parent 1011 0 R +/Next 1014 0 R +>> +endobj +1014 0 obj +<< +/Title (4.2.3 Ensure that the --client-ca-file argument is set as appropriate \(Automated\)) +/Dest [ 779 0 R /XYZ 84.259843 675.273057 0 ] +/Count 0 +/Prev 1013 0 R +/Parent 1011 0 R +/Next 1015 0 R +>> +endobj +1015 0 obj +<< +/Title (4.2.4 Ensure that the --read-only-port argument is set to 0 \(Automated\)) +/Dest [ 779 0 R /XYZ 84.259843 301.829014 0 ] +/Count 0 +/Prev 1014 0 R +/Parent 1011 0 R +/Next 1016 0 R +>> +endobj +1016 0 obj +<< +/Title (4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 \(Automated\)) +/Dest [ 784 0 R /XYZ 84.259843 641.326036 0 ] +/Count 0 +/Prev 1015 0 R +/Parent 1011 0 R +/Next 1017 0 R +>> +endobj +1017 0 obj +<< +/Title (4.2.6 Ensure that the --protect-kernel-defaults argument is set to true \(Automated\)) +/Dest [ 790 0 R /XYZ 84.259843 445.970079 0 ] +/Count 0 +/Prev 1016 0 R +/Parent 1011 0 R +/Next 1018 0 R +>> +endobj +1018 0 obj +<< +/Title (4.2.7 Ensure that the --make-iptables-util-chains argument is set to true \(Automated\)) +/Dest [ 794 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 1017 0 R +/Parent 1011 0 R +/Next 1019 0 R +>> +endobj +1019 0 obj +<< +/Title (4.2.8 Ensure that the --hostname-override argument is not set \(Manual\)) +/Dest [ 794 0 R /XYZ 84.259843 425.926036 0 ] +/Count 0 +/Prev 1018 0 R +/Parent 1011 0 R +/Next 1020 0 R +>> +endobj +1020 0 obj +<< +/Title (4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture \(Automated\)) +/Dest [ 794 0 R /XYZ 84.259843 208.126036 0 ] +/Count 0 +/Prev 1019 0 R +/Parent 1011 0 R +/Next 1021 0 R +>> +endobj +1021 0 obj +<< +/Title (4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate \(Automated\)) +/Dest [ 798 0 R /XYZ 84.259843 542.326036 0 ] +/Count 0 +/Prev 1020 0 R +/Parent 1011 0 R +/Next 1022 0 R +>> +endobj +1022 0 obj +<< +/Title (4.2.11 Ensure that the --rotate-certificates argument is not set to false \(Automated\)) +/Dest [ 798 0 R /XYZ 84.259843 138.881993 0 ] +/Count 0 +/Prev 1021 0 R +/Parent 1011 0 R +/Next 1023 0 R +>> +endobj +1023 0 obj +<< +/Title (4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true \(Automated\)) +/Dest [ 808 0 R /XYZ 84.259843 670.970079 0 ] +/Count 0 +/Prev 1022 0 R +/Parent 1011 0 R +/Next 1024 0 R +>> +endobj +1024 0 obj +<< +/Title (4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers \(Automated\)) +/Dest [ 808 0 R /XYZ 84.259843 392.223057 0 ] +/Count 0 +/Prev 1023 0 R +/Parent 1011 0 R +>> +endobj +1025 0 obj +<< +/Title (5.1 RBAC and Service Accounts) +/Dest [ 815 0 R /XYZ 41.740157 784.430079 0 ] +/Count 6 +/Prev 1011 0 R +/First 1026 0 R +/Last 1031 0 R +/Parent 913 0 R +/Next 1032 0 R +>> +endobj +1026 0 obj +<< +/Title (5.1.1 Ensure that the cluster-admin role is only used where required \(Manual\)) +/Dest [ 815 0 R /XYZ 84.259843 684.651496 0 ] +/Count 0 +/Parent 1025 0 R +/Next 1027 0 R +>> +endobj +1027 0 obj +<< +/Title (5.1.2 Minimize access to secrets \(Manual\)) +/Dest [ 815 0 R /XYZ 84.259843 523.851496 0 ] +/Count 0 +/Prev 1026 0 R +/Parent 1025 0 R +/Next 1028 0 R +>> +endobj +1028 0 obj +<< +/Title (5.1.3 Minimize wildcard use in Roles and ClusterRoles \(Manual\)) +/Dest [ 815 0 R /XYZ 84.259843 423.051496 0 ] +/Count 0 +/Prev 1027 0 R +/Parent 1025 0 R +/Next 1029 0 R +>> +endobj +1029 0 obj +<< +/Title (5.1.4 Minimize access to create pods \(Manual\)) +/Dest [ 815 0 R /XYZ 84.259843 307.251496 0 ] +/Count 0 +/Prev 1028 0 R +/Parent 1025 0 R +/Next 1030 0 R +>> +endobj +1030 0 obj +<< +/Title (5.1.5 Ensure that default service accounts are not actively used. \(Automated\)) +/Dest [ 815 0 R /XYZ 84.259843 206.451496 0 ] +/Count 0 +/Prev 1029 0 R +/Parent 1025 0 R +/Next 1031 0 R +>> +endobj +1031 0 obj +<< +/Title (5.1.6 Ensure that Service Account Tokens are only mounted where necessary \(Manual\)) +/Dest [ 842 0 R /XYZ 84.259843 449.446885 0 ] +/Count 0 +/Prev 1030 0 R +/Parent 1025 0 R +>> +endobj +1032 0 obj +<< +/Title (5.2 Pod Security Policies) +/Dest [ 853 0 R /XYZ 41.740157 784.430079 0 ] +/Count 9 +/Prev 1025 0 R +/First 1033 0 R +/Last 1041 0 R +/Parent 913 0 R +/Next 1042 0 R +>> +endobj +1033 0 obj +<< +/Title (5.2.1 Minimize the admission of privileged containers \(Manual\)) +/Dest [ 853 0 R /XYZ 84.259843 720.651496 0 ] +/Count 0 +/Parent 1032 0 R +/Next 1034 0 R +>> +endobj +1034 0 obj +<< +/Title (5.2.2 Minimize the admission of containers wishing to share the host process ID namespace \(Automated\)) +/Dest [ 853 0 R /XYZ 84.259843 589.851496 0 ] +/Count 0 +/Prev 1033 0 R +/Parent 1032 0 R +/Next 1035 0 R +>> +endobj +1035 0 obj +<< +/Title (5.2.3 Minimize the admission of containers wishing to share the host IPC namespace \(Automated\)) +/Dest [ 853 0 R /XYZ 84.259843 238.710432 0 ] +/Count 0 +/Prev 1034 0 R +/Parent 1032 0 R +/Next 1036 0 R +>> +endobj +1036 0 obj +<< +/Title (5.2.4 Minimize the admission of containers wishing to share the host network namespace \(Automated\)) +/Dest [ 856 0 R /XYZ 84.259843 603.629014 0 ] +/Count 0 +/Prev 1035 0 R +/Parent 1032 0 R +/Next 1037 0 R +>> +endobj +1037 0 obj +<< +/Title (5.2.5 Minimize the admission of containers with allowPrivilegeEscalation \(Automated\)) +/Dest [ 856 0 R /XYZ 84.259843 252.487950 0 ] +/Count 0 +/Prev 1036 0 R +/Parent 1032 0 R +/Next 1038 0 R +>> +endobj +1038 0 obj +<< +/Title (5.2.6 Minimize the admission of root containers \(Manual\)) +/Dest [ 860 0 R /XYZ 84.259843 584.681993 0 ] +/Count 0 +/Prev 1037 0 R +/Parent 1032 0 R +/Next 1039 0 R +>> +endobj +1039 0 obj +<< +/Title (5.2.7 Minimize the admission of containers with the NET_RAW capability \(Manual\)) +/Dest [ 860 0 R /XYZ 84.259843 453.881993 0 ] +/Count 0 +/Prev 1038 0 R +/Parent 1032 0 R +/Next 1040 0 R +>> +endobj +1040 0 obj +<< +/Title (5.2.8 Minimize the admission of containers with added capabilities \(Manual\)) +/Dest [ 860 0 R /XYZ 84.259843 323.081993 0 ] +/Count 0 +/Prev 1039 0 R +/Parent 1032 0 R +/Next 1041 0 R +>> +endobj +1041 0 obj +<< +/Title (5.2.9 Minimize the admission of containers with capabilities assigned \(Manual\)) +/Dest [ 860 0 R /XYZ 84.259843 207.281993 0 ] +/Count 0 +/Prev 1040 0 R +/Parent 1032 0 R +>> +endobj +1042 0 obj +<< +/Title (5.3 Network Policies and CNI) +/Dest [ 863 0 R /XYZ 41.740157 784.430079 0 ] +/Count 2 +/Prev 1032 0 R +/First 1043 0 R +/Last 1044 0 R +/Parent 913 0 R +/Next 1045 0 R +>> +endobj +1043 0 obj +<< +/Title (5.3.1 Ensure that the CNI in use supports Network Policies \(Manual\)) +/Dest [ 863 0 R /XYZ 84.259843 684.651496 0 ] +/Count 0 +/Parent 1042 0 R +/Next 1044 0 R +>> +endobj +1044 0 obj +<< +/Title (5.3.2 Ensure that all Namespaces have Network Policies defined \(Automated\)) +/Dest [ 863 0 R /XYZ 84.259843 538.851496 0 ] +/Count 0 +/Prev 1043 0 R +/Parent 1042 0 R +>> +endobj +1045 0 obj +<< +/Title (5.4 Secrets Management) +/Dest [ 887 0 R /XYZ 41.740157 784.430079 0 ] +/Count 2 +/Prev 1042 0 R +/First 1046 0 R +/Last 1047 0 R +/Parent 913 0 R +/Next 1048 0 R +>> +endobj +1046 0 obj +<< +/Title (5.4.1 Prefer using secrets as files over secrets as environment variables \(Manual\)) +/Dest [ 887 0 R /XYZ 84.259843 684.651496 0 ] +/Count 0 +/Parent 1045 0 R +/Next 1047 0 R +>> +endobj +1047 0 obj +<< +/Title (5.4.2 Consider external secret storage \(Manual\)) +/Dest [ 887 0 R /XYZ 84.259843 568.851496 0 ] +/Count 0 +/Prev 1046 0 R +/Parent 1045 0 R +>> +endobj +1048 0 obj +<< +/Title (5.5 Extensible Admission Control) +/Dest [ 889 0 R /XYZ 41.740157 784.430079 0 ] +/Count 1 +/Prev 1045 0 R +/First 1049 0 R +/Last 1049 0 R +/Parent 913 0 R +/Next 1050 0 R +>> +endobj +1049 0 obj +<< +/Title (5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller \(Manual\)) +/Dest [ 889 0 R /XYZ 84.259843 684.651496 0 ] +/Count 0 +/Parent 1048 0 R +>> +endobj +1050 0 obj +<< +/Title (5.7 General Policies) +/Dest [ 891 0 R /XYZ 41.740157 784.430079 0 ] +/Count 4 +/Prev 1048 0 R +/First 1051 0 R +/Last 1054 0 R +/Parent 913 0 R +>> +endobj +1051 0 obj +<< +/Title (5.7.1 Create administrative boundaries between resources using namespaces \(Manual\)) +/Dest [ 891 0 R /XYZ 84.259843 720.651496 0 ] +/Count 0 +/Parent 1050 0 R +/Next 1052 0 R +>> +endobj +1052 0 obj +<< +/Title (5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions \(Manual\)) +/Dest [ 891 0 R /XYZ 84.259843 604.851496 0 ] +/Count 0 +/Prev 1051 0 R +/Parent 1050 0 R +/Next 1053 0 R +>> +endobj +1053 0 obj +<< +/Title (5.7.3 Apply Security Context to Your Pods and Containers \(Manual\)) +/Dest [ 891 0 R /XYZ 84.259843 324.051496 0 ] +/Count 0 +/Prev 1052 0 R +/Parent 1050 0 R +/Next 1054 0 R +>> +endobj +1054 0 obj +<< +/Title (5.7.4 The default namespace should not be used \(Automated\)) +/Dest [ 891 0 R /XYZ 84.259843 193.251496 0 ] +/Count 0 +/Prev 1053 0 R +/Parent 1050 0 R +>> +endobj +1055 0 obj +<< +/Count 142 +/First 913 0 R +/Last 913 0 R +>> +endobj +1056 0 obj +<< +/Length1 41004 +/Filter /FlateDecode +/Length 7589 +>> +stream +x| xUut;YH',-11 EB$!`B'AIT&d 0Ȍ +88L@f:cLnx9ֽrι{?R R23[1i& ǩ=x~sg7;@>x>|- `wbkͷSF'N+KX-NSE@7T^7y\L`ySgξ}/{6eꌅy3 *ϟ}7*zSTKsr> @pFEiY3s+ ,\R{ϬSy `=m&s3|Pu'<\G PɕMƎKIEfJ H[&*DC +4i#w# `QD|77(|;FLv)XVx[ +_p rߧe)s*`i +:iO(N(svx{̦1f0[xqpD'[yZ#j5nQ`,gz‹:tСC:tСC:tСC:tСC:tСC:tСC:tСC:tСC:tСC:to%2Ckmԯ9)e]twj, + Ca4@Lߪ~=6zzt= 0洶^9~7ADtj*r<|ht(^*W:4׊|oxUx~5_/_=^io.xqwӻp'Ǘ8݁8*[%Iun |0\|nMz. 7p 帾*@Zϱ*+Se{*Kgt8*XQ>Q8KxXŧ8YSZquO||n,[eʜʌTQ+IS+Ž|]Zqดc G_KHs\bTEr|̊ ,8߄8m¢&ӄcYgDtHiT*q1d8&|؂9ǙM8΄IX 1.lPIs2}GkFr׆#8'9jЈi `U8 +rG!ӄDZ?ǻtHw9Ό@Nf 2|/rN&&vbtˆf=0663$L6cF {{*vꕺb$ՋILLJwcf)>f1&Ihzr1 #I\@7i1 0*q T`.NANm 梕c%X +h֖`4s4Qf +G\HBEN^& =8Z)/"X:g;~u6T `̣7V&p QR8E` j>As>YqxP%֊ų[,ϊbKíXi]}M! +jE(#-a8PE/~I2,$߲u_YCWr ?<6:Fխ3'qӒK*HgdL!0FV6(CtI'tI'tI'tI'tI'tI'tI'tI'tI't鿟L4A.(~DwoƔhWt|SJW Px$7Ns~zKqtL`(TKOڨDn(f^8f\514ǰ( +{Gۥto8lÆ5o- ta7 PE 6ºc.`$qm}]@sL3Cl(Gؚ׸ 51"NOo<~uMb҇x> a0.|y^e2lYe;ag}"L齠w^Ȇ^RES6ʄ#Si9s-:?0~} ھ3]P5woKwm/[/U$`/.HmՖ5^Kp/-I@kpvU%:<gY,-@0Md12\ļ*rB6N ڼy]8o w`L׾-*b#~Gn9zt#ڸx7݃w3{-dHoUlR>Y@6;`'DA]Sf7  вZiIQ 4T2|(}Q2 Q5|# zcQ;n?kX@C`>0"hY0,SY/,9cJ)[%,<+l*1Vhb1cz~U⯅>jydd͍$v=04+OJQv"EI`uKaFp;hZf:d}4ӥ]r 0d`hmb;2^Z-)c3l/"g֭]rŕZN|^z +!U0gv˶:=g}}E0źTig[`X־!,R.*ip5``xT@fCzdàZ_c6.=zedW^&]xa~?~ܐ!l3u`q>>H+>Wu&Rv1-4l$ޚOvp_GGe13Tͷyl5{if((l^ͯ+,9h)fYlÐ?>{KZk 5B g4ϨV H|R-K%ybP=;HƑ8A$QD.8@ x,J2n),Lw1B F:cG: ]<6Ǣ &$.1DyxL Jً2Y/I Vɫ X{=ڣ&M,>uw]g?~}>{͠yyKi>qJ&I>#}-WK/_U$㾌`5 QQ0&sdb\Zi+a 61d +7@Lx!hdcscGM/ ¯)'0s(*)9$۷?CB MoKK WX--nr}a!ODf^KOCޠUZU[(&{7POa9h]!rYu][k_b 0*(Ti=ߘjזdfoz2JHLJDOE"}Q>/ɊΊJ(LXQYU)^SPp-!k{ّQٞ¨BOaȥQK=KCo:s{c/ĐzEw>QgZ~bKrl¿_'}|0iDrNl}duϞUz / /VUue*S] U#8jhw^6~)>s`-|ixExu:-rZisbxy Y֫Y/w!{utnvű9XXZAJ ; t.u`uIk-[O aadh~vjʡȥՑ:6 vobݿLk[N;w>KxHxƝ9l Spי˗m|8ƕ*ɵIuv4QkYw K#p[cOFRˆ"EH?/wdcwSUn8[Uptpn5LчASA,i>`9{S&7_XRWP+l_*<<ةo׵;3??M$` ]x[1Kf*כ hTݲIuf-jy5d8ٜqC8 t ۮR!\.[lzj?j&˒u55^'7'#!Pu/ V&Z&&(0RݹNg_WF2сlvڵvQ&ͮ1vʽuu^w-a[C¦͛mk)-~ RBYatYc~$ؚ3Uskhn$},cHHvz8QKBx&EI]%]%GsI@FYbLffU')eNFh6-B{DLJ $IݔB0U)H˄273B^yQpP<( f1AL >K>f[pX&=%6zn|I:dxx .^L x1b ޿_k9U';K-[ +-7s 4oH[!^(]dHa6]"h_0apYJ#-bv.IDMV[ϭjfn[b4j~45C u:ք5(TsDmwlb(K %JTb.XKKl%bGuص0o= {uh=5WxӗyԷy#Bny'ïFځ^d3KzIV@t(`V U'($E Kuu}ƃc-Hy%f+s͖bmwes,T=Ｕ7bQՠ8c%\){t>nən$7b DsנdgkpbdbT'):.aiyeeCUBdlF цa-F'=T4":ZR(o ` KsBY٤uOnGޘVβ5S<%&mC?<WlH{Ng.z?WJMf16Ur`H% ^g4 "IQz*VW /z [KKMw-e#7n@.gwy8m9}c1zg~jHf6 3oQB<ۧnkk?숰%gcۄ⟪M;U=^"f ?8$ $ANڏ.![:g(o-"<* %JaV&(DFzW9`1Y&%Y_+(ɆP1S"0bylNJr2b,E +Xʰ΃rTF|V|VZ/^kEUkz 077CMbvS?vC|AZa ThsWT6lj@>1!t)rTq5‰ԔBNaj>Zvܠj&'ijo/c XCP.G:EE`< ~yPC!ZC﷮7BTnrwT + Z)(ئe]WTS#v2|Iɢ(6agO厢]FB8>@PWLSݭ0L:~F,RMј!fOt6>S]JFHcL7u2UM5uGSTX6XlVTڜT_ݫw׼%z>N^ဪζG&-p%lWnhBn5a/813@:ܲnI2M0 Bݞ]vez^nV-N;E2.kC!LPh#I7jA0yٖNbld[^'˃{ +a!́i0a.x & x R(7Zx` Et́)3;YԾ'D1VVB)g> f1i>ͥ,jC}RQ7Q >9hS9Def;y͞=u(EtUg-Ҿ(4K'M[?Uk}c҂r~eSi]}baꗏl1P= #FiY>Ӿ)hݺSNZf@J3i $ 2x [UDd00sș; BA$PԞS[S"\3z&hwFQ[ +a qڦsLigЇ/5pGU7?D˭[_ƶ9-֩ŶI TNE~Fsm>ܩ-zPFKZRCj:utkο0<#+t'#~! Q;/@i{Lo{kyDzHd5L#=@;x"U}A(R2-Ue!meX:Ϧj5eߖƝ qv^;qSN97?gHFGDDM)> +endstream +endobj +1057 0 obj +<< +/Length1 7648 +/Filter /FlateDecode +/Length 4712 +>> +stream +x9yxSU眛&-PhZHYӄ(rtO&͞nItInPR"ouFD}*OE2 ~CGE8qDܼ߹IK|{[o;)h1Ho.)vW;V!4^]dv,(; S])jnBn_/.A(l5+=*A9{%ˏewr|i a=J y%NFV%0f%k#B9d5mQd~kFNF)$9wПȉJ*`y1;$Q<9{ 2g_gA10;x^~cԎ1l"T'D҅IQ}H -!5*h܅`B Ff?HB&ZXp*u61 +7"4E 3)2\ +A5h ZhN PhV VUl]p6˧~k~KڎGoA9>CWCI&ny/ALa1_ R킇''87|_وyDcƈ"x7iis,[T?R@#fM$WP*3Mx`.'8PiS"\dccdQk5:r, B$ZQZc ]e(ՖԉLn[VZInN,Aiixs2]U¡/\:<3ܑ%ja,WXF(9_;#/ 3]%sB(HNg%B"-vuyq#8Νw#V`eupT֨RFKfQjkg_o]{_glq9}RKm0#IEJ<]LWKAxb] QYrɣY2fevB8Гhc͵pǑ7 [pv|E-\Ej66UJf % +E|Pj+>)`_㾪bkԧڧEoQ$$M r@7IBUXhVgm16|Jd65KouQnKsktՑaQLzeKÚe/plFׂ #4"49XJ -uMMz +%NQo>m4[!$He87KtnZjKҮ,k4*ҭ/.))GȖ vZ 3uEEr h8t ptBĀ&A%SLJ5PUk5dz9R*L'ynuhK?Wv> 7 +[QJkm}Rmidg/F. \x%  rh'{Bp2 +*B Rh;tVgկr8Ub*,q\zjVl6BSgi4|C} caƩB}Q` jУ8ZH9A )'TU*&C{κ:kZgV&WYѝM'ylEO.[iVR-x;Sr(iFI7AA nw$*r::zAd#y!X&ǰ1r%?qg2꯷_/y~s{t8>G[&qc6[m5qׯTt{Ho2ŧx{nz!۳^A1\̆(xסC=;G;;wȘ7?O)]p# G,8<`\(46|{o=dyQHfZ 5{U*k˖ܟPw׷foJulaMʹb xo9i +NZ#ЎTޤxp#pj9dVVðFO> h Rɋ<T=[[{#.z^F!=[K&GULNE"=jFl_Z~u+9}L7n u2PC-.L)tIQ(ʎJmg5qR+wn>sܦO{F$] +Τ7V"GxYqz۰fڷdLͶDsq5Wg G /Ǥ3IVM,lb|BWvVa}xS-7ӒY"JL3KTqԆ%ٚ9Q1luPJq8!GWOz^GVڨ؁J D|SZlBasMuu ,CYYC!v7_lL GA3"|@RfD 3Ovn&t()#NX\c(fAh>\h>r+⾇Kӳ죘UĈFUq,>Q\l!rLaC2 ggگ;t„ibaqq:`~m큭d}CeMg@%f&9$Jͥ}~_!$ #~ds2hZ:޹fj#>*gYJfrn`ҥ4ϷY6ri^]^MZZ MVp &'Ni&\wVs.A@E(u n&.\>(`BXkM+܈\͒9EE9%b4 )+ ΆƮ 4bBZHKҲ{惴:֡[H+;給@\A\mo"Ԑ; M5e$la͖(`hɸBWFBlWVQ{q-' &h,͚$ +x|SsvܑU]ug!J1 =~)l)xedMbz6(e;z|1yV( ]OC薶C֏_Ԫ H"w_)2*hMry\$. 'a5:(CY5Feh 0/οs_s\\σ~0$dOCo̢B<qҎIo81YG'~n\56?I"^TAl כ#EE#VhQ +ڝr"@ G7Jޤ$o{ :x[y Λ=ЩΐN:}@y)܃̒)Z[zVO +s7bgKnnO+Ss%JڃDǿȃ{JFc +LSS+(P t7+0y,&%ۦ*OvDST,WQ|2RoIzY\$2jNdY +;yj"Sr!SBVb2Ca6{vyii*m4Vox]*szj2-٠jV7Qϗ.K[k8J`?ǰxg o< ,A>%(ݲHjXG1c(85>ͱtHxmӐ)fǰt=ںi]3GOQx[oqqd1K X,枯DqCNpF".GvJ^qiwn6@6v3HA!^x:;`|~I"^O>t8u[]j oC?M7rз-@WCah--D p<2 ~ԎZQB|]0 m  0=hH5+*h`_4+PDػX 7knc- +m06қe໐@ [8Bs*5АOoNK .x_|oLCpC*S>ԼZk?5G" +endstream +endobj +1058 0 obj +<< +/Length1 47128 +/Filter /FlateDecode +/Length 11768 +>> +stream +x} xEhUw2353IH0<W $0 s1bVA +nD֋.rO$XoΡNwUPBH + 3e㫞$Xҷw_}p?+< B{~0!/oCΌYЭx?|Œ H'dxvmsyF݄affrD|^5xv9 myyOr7%֭X>i[N1"o=lBB!3o/̖c 8xFI[۵Hse4 p||VI_2E)"y^8gIwO/ϟ ٦FjUL2${"lCMkrfC`M`E"߱PeK8t6-zH)0ȶf})=I"U=CXf/mhhOHiSK[I5J 2؈xI<*1:36ڑHsYm^ϰ'W'er^A>Hͻ 54xdC}y AF|i^ Ul2 ^k6Y+v:.$`H,kלA b 1A b 1A b 1A b 1A b 1A b 1A b 1A b 1A b 1A b7@c;KgzKj"F\X AEޤ?La2#S- iEڑk@|> 7iy×^5E` Yȍ#o k{me V!y CF(|d5OVӿ_k;pȈnڪwAc +x){<U'L>z0냮-DaƲ% !8mIj.lXl'2id"24ɬeY&,ԃRkkuY:,NN^Syf' +Q+JOEXg:`ojfi!6o;kϯ9/n +1%4,߀Pw-p- +B_BQ ? QyeA}]Pc@MD۷[|k_kG|_Wpo8-K%  8%Z8i"?9>MaI-|>|q]p+?glZx? GpO~$^ދp*C xB"H[av!Q +ÛޘAkjW^}6+{$u{le'K8Kv x /Sx>xyi{-J6Ouz|2BPv(w);EREg+ke>!)! kְ5i{ t 8-\fзAw[?hrY.=KFWa7U832[^R~ TfЎG PR-~E#v8f&*UWw0'.?#qdP%2'/_E-?r=wɓy]0{Nfun1*nr;̐/a͋h֪_-~8K,VѻB3 X ?m_ddM2Φh:s|V3oow爕$H^*ZD%8O"$r>_:M]-T)'H(Hf ۧ,X0uS]bD|,ͤ4jh3qohX"ft6Cr~_ "^خ|l׵D5 H"VMs3a;th:XC xU]?a QNC,p%S9W<89UqkKr|^Ӂa#^"аոFǻ7߹-.4ZZ'GOLHHHlAZ$H% 'ORI7,yiqu +*^ja#_g}Tߊ;fy&34~΂)DiW<3|K,ΰiCUJy{\x>*:}*ߗAiYc5qm>%,~<:M}>G t%鹍i==!Ğ_:՛ڴf#{}cg}>Ѓ<⳯ae)F:&)1Pu NB0e;D6$bI~&ckмQk Aɝ.~:~\VpT#BHVWx,;9ľ* Z3ĕywu*Li^+L^lʟq it~\fߟAC;@m۴VZh-IH TԪJ +WU)6=$BeXZiك&yRg?"mz=PwIc5;SPZRBouH~W5PxS\'ZA{Oz}qw#DM6Q8ES,TPj&YJzGS,̑J,O'H!3FH }Ƈ4DC(%{,#?EEكn!'bihˬ"jUn*;ѫ۠eu7COJ΄$gFe6z7"Eޡ \ɱpFFn疡F#2s^粀;̙>m,`4 I-^8:ϐ}=Ä1Ə5f[{̙3**U*e~eg_~ٲW#FW$e?@'FeoWd%]T.VVS–"n`]D6svQ$s[d&q:j`ͨ3kO-%Ş)ieI)*Eiizڠsr6JN w{w#gJłQVSxU*]icxNC)  d؋Ac+T[RUUkCKTP +ٮ)KTf蚅+] !;@ |QLDxFEFcQjTJZUsuƫGO8-EZk=h}~ 編aR'E9d>C9}>}/h/7]k{C!r\D` QASeXȲ,K,JW.qmlݽM@iMdH$G^rS_JZ ĥٜzbb_uY|~-AZB4*H)ώ褅ECZ(QgM% qǎ}T̩/ob.֋v |ogP\,1ז?Ȍ7JQǠ-IHͥ1vmv}-Jog#j$fuMi8z#Js- 79|O3!1 :?iiC\C7ZJ7\Eۿ@\kq?j#T7y@Gdig՞tfJ4q.{?1nٓU`sN]T#NUvϾsJą(S,s%C鰒GٯcmA$`3x`_pهM&q⬟&կf/sR|ǶhcfErQ́a]FcbDH䚑>^*.6juwE505:PTMijFq f}ܧlݡe R-EJRi)ݫܧn$dMjH>BR>C+gUj%3Z|9ygW;_o֟bug٠]͹IB*9PPQO7.ٕu{%6H'ȳhG&OtCy !3\׀Qn#A=`#r\.y&N3>̩9ZZ@mXO֏YdVf)3Ve2iVm6`~p9Z0tp@_m6RL'A6U/rܫ=?%YkoQaӿGbXΏ}6JA _CB' "<`yE иJ-bYY7:Y.sPRlW}u8N"$oX'K|r3e)eS,VSTJ${; bh&D!H13*g$tl-doPNjlps!xD:>%.jҎRJz;(GUo>1nĉ= 1=K +?R\$$~K!umIOW_%=[|VH;:I>B^&H $'&Ry޾!i%_Q&9OB|БSLQTA_솅E ]n =GM*!?տˏU%FCQ#go=<iMŠ'mXx_OV׺WJ3d I;<VOk9(#RJ=יK*;2<GcG&˂3Cssls  B+O[X\bbbߖ-m[`[p[Ut""j9qff4)Qw;{FVlw⿖.w7zϏ u̧ +"vfА%rriAgPZ(;N #0SͼSġF5گjtt|MN6/;y ./VvD{63*fqy"L%*Mai_I`~lR 1qBeD#m s f + $DHTx@ j}I_):j&BC>Lw$rёPGGBҗj*R$/5Ү!<\Wy+ +̆qF.VY1~1j!vC}VY.M7=/0^AĮ膻򞼓1q,ˋy13sjDHPܫy$k-Lǔ#Gj%[;{:Cp7+7PPm~VFh ɖm>͘ib+ͅmm-j^d{e7^gxI.fIC= 3zQ .΋Jy-J5VDZ]_4Ih~̢t>բ7.E4EaiTLȨlaCXj z$֐KBqQfH6Ac?`FԿeF[_zGDB ]*u c7+Å8o _*o(ѪHk]%9ሺq<x7e]!*IODn-C.`s0]ulP C3m3Tp'B |%I\ ܔ6$0!(poڢei;Ҫ..csP\~9lco,yPkǸzm}ͳC;P;0h@Ⱥ-n|cw7oO)˿MG>V`nB$lGdwPģ~I$rGS)slҊdlE +&Hp͞=*PCtb~uO[4;>P(_,AJY墬N"1q~V6$,5qɕr=q95BO=rca"0704''x.8Nj% 1rUĹJ@:QmY$i +ϟq+31)i"8"~Ƒ9;7J͚7?l0ؿ=yD+dr]$Da_g%;d[eN +-Ť`ɹr%3U bZqeڇona%ƪ9:!-[Tz4&8UtaL)L\.AƓ#).Nm#N[Ev{omV^u?x0=SW:+FM#|eƐjEo4T:7u9Ob͎?T=R0ԭ"J)Wч;y(Vd`$# {w̿..A?dߙ!r2lxnYMAr:*eY[n\Ϛ[7(Pti{mT{'V]~Iӽ񅙯ö/LJ|vuǪ~³/Tݤ,̈N&)b7)ыr}\΃hCQ.W=y pcKwMM S;q]0=-E~c,e#,̥i%ܦܦη,{CuTI>]֗ІBmF>~?=׼W.Qj?bXzꞧSH?shJڋdd_2r72dFZ6\B)doXHP$:Oá)h:8fWyqTWFt֓*vv[.@І!噋2e>i)ܽ4%ϕ=/8$VQgpi"C'^LLqᬟ=%i?aL{Iٝz>H"Re}h&R!.n#lV%꽜U?U{K|Oxhє%܅ V,XP +[,NK/fÆgAx[ Mk$%Ub88-z9rT134ʮӧ5Kheq'Bf ѳ1lߥd"ctcI_i֘/$;?sJ5 ͢`mRD6Ҹjty@Z8j6aune]MCq͕3>s٣%/kG{)gXO'3} 7qk]|s3V7^L\QW?X,r+:J"5]#Es~N0򁁶OS I -iRHgJև"v~Օd%] |^/A G'bRTW r0nmWGtGt~D_ݏ8rOVW^#h\m57ӍJdG4}㨁  >Fw.&N>km,Foi :8rI.̺jWK[OG_~pm>:6QʊH-i"k+WfrR1ʭ(>CGm[ӰEyA{ZbfC/h/ޤz} )3_FŠ7@1c1b +z]\N4jy>FXTM'dsWTEURꦢI_E$2,j5&V{.0;xi'?'Bt t;Aw:1xφ;`,їꏑe S^ _%pD?pJ??9ڠb*6 xhFBWh- Mld @eV`#Rux`kmZ^U^դ^QhQvJzJ;j|M>g+ߨk?ԮRSh[b::[Žu?{Y.vAIiw~\Qšܜ4/r38lvp 930c .êk#w5 L3 '8LeMb,5ST/;,Te=j:]ֱ͜FP8G pGܫz--yKE5Yޤ7޼:}bbcl%..VW;mMyt/VjUKow:q~ΰK = <]õS*7%]kżWr} !JN$ih c &mTѽq_A##pVjncYnP5EZ˚YZk:@g<kڗP͉xriޯw5 FT'IDIn9=)=;>\0buw$wbJpC37y-Ii*4օ7[nXN@n.yBMw~j tn58(r+UߒS +~EtߠiLmC2t~2W ~]V:u{|o{XRHHOgq )dIF}.yr5&˓#5 oq\Xnxs`W&cbxZuOiKq5˜T{I$D3N+q锯Fz]nЕud[ig&v_LJwa[HAݩ_|mȵ,E -I{2cgʖ,@pt 6~˱2He*67t& /FjmXְ_ܡMô_o0O\xe X~+{b1WԿϣ\Qj~'Wz5ؼi䦸 Ήsչ<@]K\@U\12yHzT]"p*.ɹKslن ݛkPK忐ׯAEiO\.^FZ/m.m-˄Q2Kt@޾[?Kd$z1?ʗ+KSp_Qamjz7Uc:.]9/]hn<Ǒx"?I͈[pd7"CϘDTL‘< )G +"oQih#%!7 :1> žoFt/\Gأ81HCԗ>Iw*OϚ1,?x +Y6xl,'rެd٤24dY6x&\2k,&˦e>s&e3ɚI3ȲY3ҙ,mrIWnD}7E3{H +iAZal yPsc9(Y,ߩDY +endstream +endobj +1059 0 obj +<< +/Length1 17264 +/Filter /FlateDecode +/Length 12304 +>> +stream +x|yxTŶo {s;ݙ:N!d" @0 a<*C &P"ǃA<!=9\q@#z= +݉N]VZހ0B;̔=/ ۻO~{ :dx.FAc8h_ CTnh:oB|qS,j "DR/1o,s ̘h!aCm1w&G ˚ ' >pu9'3Ȅ]0ur65pq'ZNE^~{E¹.X؝X~}v;yF $G .+2 +Ds  I( ME#9y~&1G;3uC&Ȃ$@Y *ftc4D/""7tzbC1hdgvU;lS'%4 J8oPA{W~ J1pn:PnBe]\E|UPVϢu(PPSAZyc(#.޻88&?eS~?H@xLj6:v\+!ԂjTs~ҳ~虧HP>UҦ2iFO-2zw=(62zcQ精1І[(:O +i}E/MFPw}`bD^F_cV*{2nJ:m/ﲊ/']Vחſ./%ӿ0&/Xa }^lctVo,V33*isJFz0}DW ^tpNi9(/e 2/}J1RF׬k]m*FO +-yrq^N]fK}]A\l1]3ǎ +ltOxG]tDqp:/etN:t:qNgtŌN2:Y)n:INdt8Dqұkc4NG1:ч#ćF3:чӡ FiB?>h ]_؏Ѿ[L Upqpw6}0*>hO'2V_OzLb/3UB˗g}&%3<ͫ>_Г@B[49 b5-\:f3l@] 8d073ij8MZvօN!b&>l'UB;qr+bxiGMh" ƛ74_4XYe,zӘd=ad7QFl#Yጆ1b =8 h#Y ͧEt$S}!vjmZsk>+dg6D3Ud ;J AG \=*p2 ʌJеĨh9$@NBq=.^'C K-鈟)%+m,Mx>]Ugғ8j lhd-os>78³KۺGcq/ Gy% \V8a2z¶ @S +迈2tm!Wk +M詖 VH@,6$p]lpyY %Kv9rۅid0:/C#8 'UTAf3bdGr%$m[#Op- +}NBm8F&sdk^-Fp?e@'@2-0L\P-lzZ kN2&Hs퍲a(ZH^>$ {n0KFj3MGEB0Y8(đK)Y~rwyK S&^]TU5M}J}UDD?lVݍLѦѦ3̵5(Emn=da+=ck Y=>ݾcB'|ەZu#lҢsE̴TZ*1j9ےR[RqQk#MMMbs#lZ@Z +[FQ:BAo% YCmtkg_N@xѴ (EH\NQ]yYo5F"#]b6 N pc9{>7ן-0 ɠVBx2=Zq4ycVͬإ5n11qSfbƈ&lVM/Ro;ZOu;'-b_]מbq`oY щn{Y\a-A$""&Ƙ@pnʩg?r y'kkܼfXs6'dVVf$9V||Bfh%+;3 :L/f.wO?5i껧)Cvxš[7L+?,~^X8ad:w<3u6}5)E`Eۺ:~fn= +GnrH_;;*16AuϚcޔlMYWdD̤:H5x.h5xbƮpL^pnո'\ +ՙ +al1/P1W -θ 䆸*i +Ņ m5Yggee8\OK6~h'SOkUA}&/5n)"BZϦUΌ)^wW +zc{+t\7cu_y/NfabA.71Z+]pҨ4%a\~%DjvdIȥ+. jqmθxŖM^juMU +W]-87_+c\M[7#9.˖مqZ5лdka.ܖo;_^._HNƔC>/Z ϫTiS *IV +3 z]Qi&s(N(pq3S(^f WHb[oۗ9x"JA)8!ELR%EP#y4O<9Oy!hBCD;HVFU:%NrS=La_0 ^UfXp7zg߭-km$zEzEItSgW|ecR@UYTU3B;DY0ѣ`]/`6L녑3PvV?y 6J^L^/>]Jƾpɟa͵'pK,ߐ{iW1cx]zQ_7ʡv貘]UqR㕎!7;@[@5rrHK7f MM7f|4c;Sv߿eֲ׌nF'|w8٥rSջ[,1PLgo,{70,`/QjGT/Wa܊ L#]5[@ħD%X(O&:=ߝu^:W_-TB0K(^AE')p,Fͭ\oi[$I2sDiGZ)&\*`~uPUTNMx%emֹmD¤heѦ꼕K6Wζп PMlV8Ɉ:bM0LH3/3Ⱦ/L*ۦuL59X_XǞf X)[ 4d>#ى;%G HѠ7Nt~βpЃ!z}! +T@QX 6pA#*'YzagD J¥kH8p&_n_68/q紴!~OCcz7x Gf>'ƭS ݽ(m>zŁƍ# Q>`o [E +ĤNj2"нN^5${oZRfQJ4 )Ɏ vO!s&,6@Fms3%R\Rb/qH ,LjYʬl'\ 4lT2gʕs攔?]5s^þ7E۲-ƶI{ܶmS۶o~.葷A&[jwd72Ѽz!/@]Pk(P$( +:/U(ثRy xM\AU$-ST=(ƀ2ʁj +2x/\EfT@ dIYe<GGf6C7Zڭ$-{@<YRuUJ{UܡbzdmhE-B)Am.G~Wvͬ?>կVmzdrϮ#Yυ)^i@X4Xqa/:lh}?MAm!A:Y;T.jwww.hGnkm/0GQ( G4*yrG (+$]ts5΃^ez5=ήFQ }vGypZOe*O\f֙A L)wqD$ qRE.i:.Sr\e@H%5MM\vR|+lR<JZ5Umv*-lg!#]?E{8簓 +jk(H)*Gwd/:H(ETgC%;ᖣS%i7@Y Jd0RqLg"eID7%$9^F i_<"y2.ON03 03 eM8Oz¶r $[Z_'-/77g i"Y4ؔr% k&r_,6cx΀V:)[eJ UP0`V$ )R%&|x*%*F}DE9:.wJG]ΡYJW,æRC<Ȁ>ָf5qVȯ4֧A]yH@=@@>ebd+JULFޜ'S|%w$rWy)&d$ X*(<ϔ :AoaWĔb [I3-:-W Ui\B,)ݖ҈j-O06:]Wzk_Z[oo\Ņ8} ^}p![JZ\KX έb͎$ WYREUtcW+r2H-Ur. ߕ?}=„ݹi1ի7ٺg_W j4YV`F.0j3P|FZҨ !GKLR]9)-R!+~rXWnM: _C1^Iw(LD}]0PUR^AT!^DkN*HUk]uRƛΚc fsm&;SL: +qZڅM~<Xӧ-v[?qC3m]l&^ubn>LF^{juAdh &VtDV|Uuˮ*+~,Ty+ՉnU!S]ΉMM䱩 +Y.MusGQe$22紝9c1q'T_Y~6^ |{GΌs}F󿒓?.ncRj=q'̣"}&)`_&wdZSE,%#k6zhy>ڐuUj ^6i,}ouooBLI,i|&9fQOz̆9g>اA Ƈu6n.yݻuE u< [DG">@BGRT9iM ⎎r3L<,p 8[+&m~A OUGU +fT5!CDE2`/2 *WP <4 |QJ?K5 s/pq%MhgbT!cDSO^1QIyLҍf +J7]}aǐ":J)ÔQ"x ea }\X{\i 4ҸTtٽisV}ה Ҡ!w|t^CJ֫%@g|=܏N҃ ݥ]> a_BOlhW(]bNx}ID|Boz͊YpqRg駑E* HO—>eϲup|Uu9urh4~^p^|fPQ2rE7ʕu FK K1|<#Zg +3 uқ) kI#Κ3xO?"^wXE Km Ki2F&m#:GF=$_7jAP`d'l&%觟$_THYJw&7P=Iy/pv +7t( +fx%{k6M8:vᢲ=cH# - +>S_߹wme浫W^%ֲ~(;gb.|~ m\@O_ʼnT-uYAp9f$DF:Q2v&Vm\r>m >pNW'd~h + +=[15M:` ~0;"AGme!rwhju'{ ! I18w+W c;N~M=]S̠cJWnX7w Rsk;mws+SIΙ?>s 좟##:wڹOY>aen#lDAEhsLa^nm0lOB +|j0EC?9R4fYYV_{^!uI]Ն7Z*[_42~7CF!C H@$DTuşxyL8x>.za?yb#1B%"+ZM1M1 ^76UV,Doq|ӯ*n?}׫\-~ͲuSst=N Ich[0ˠÒ1[ •  pcaQP]J&"f)d:YL*JX&.%&rwqF g1 +sh?HPs\^*RRT}^h3ϕ.%B0yJ}EhUV^QYU5j{yNER vg ;a/{ Fs]j}aѲZW?-GaҤܼ +Wv:7U/VYY8-s!P#ܛ=]=sqĻ?x 3˟y|3Ϭ޼I/]Ϛ?}4N؍;F +#`\3|~TcQj.z۹ b{0rWͷWJxt})I>þxpj ul-^7{[#cv 9:w~hqwk̜:$7xq8]rW`\&QY1NU:JiE-sxg%N6a3r!Uiʦ]MdRħ„V}K_[w0Cі"h,|^ydn/{ɒ;wO.8'LB~=g &! Cd(bQ(D}dm6yE +UA$^BҸ#.8<vM[nh1`ܦSyfZY:Ir3pλ(9qD[=w] hH8H]6ģxܑċrɐC)GPr }B]aRmNf,qnqT|RQ}Y #<&FjI{bO&ę2.VK?+Tȭ-y.x;ױ[^߿omnא[II+~Ad  S'oiUNWA:'H6_,(0$X#qJ1S2dMn@;tBXIJP:t B G5h]N#vU(ZLt$qЍ=_d0Y0eZ*.:`h/3K^]c<t; ykЩb0!Ďbzf 䋂[~gBY?.;zz+s{\?|` lccVtqSŨ >!,b_+F"Ll,4HQ/߸h{/HQ~߳}ވPY;̂CQX]{'⤹72,a_Є;l +v q?=Ou柏I p.^?r̂cGs|gC_o*6]ъǪ~Y[AAݼQ u|ӻ wEB_`%D B=fh&z NDS!fAPʀ#=EPEd@l!wZ/44EZk3þTQo͆FpTw22C3e>=SYp_ <Ɲ]Z/Ap|(P9pZTd{o{YNw>Ac ?.qrvvB +#bhBp @E.{"a@$gT7½ q;~sv=~򣓧ԩKRg<:mJ;yA ?6ާW +endstream +endobj +1060 0 obj +<< +/Type /FontDescriptor +/FontName /SXAKMW+DejaVuSans +/FontFamily (DejaVu Sans) +/Flags 4 +/FontBBox [ 0 -14 557 560 ] +/ItalicAngle 0 +/Ascent 928 +/Descent -235 +/CapHeight 560 +/StemV 80 +/StemH 80 +/FontFile2 1056 0 R +>> +endobj +1061 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /SXAKMW+DejaVuSans +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 3 [ 317 ] 16 [ 360 317 ] 20 [ 636 636 ] 25 [ 636 ] 36 [ 684 686 698 ] 42 [ 774 ] 44 [ 294 ] 53 [ 694 634 ] 68 [ 612 ] 70 [ 549 634 615 352 ] 75 [ 633 277 ] 78 [ 579 277 974 633 611 ] 85 [ 411 520 392 633 591 ] ] +/FontDescriptor 1060 0 R +>> +endobj +1062 0 obj +<< +/Length 744 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +30 beginbfchar +<0026> <0043> +<002c> <0049> +<0036> <0053> +<0003> <0020> +<0059> <0076> +<0014> <0031> +<0011> <002e> +<0019> <0036> +<0025> <0042> +<0048> <0065> +<0051> <006e> +<0046> <0063> +<004b> <0068> +<0050> <006d> +<0044> <0061> +<0055> <0072> +<004e> <006b> +<0010> <002d> +<004f> <006c> +<0049> <0066> +<0024> <0041> +<0056> <0073> +<0057> <0074> +<002a> <0047> +<0058> <0075> +<004c> <0069> +<0047> <0064> +<0035> <0052> +<0015> <0032> +<0052> <006f> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +1063 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /SXAKMW+DejaVuSans +/Encoding /Identity-H +/DescendantFonts [ 1061 0 R ] +/ToUnicode 1062 0 R +>> +endobj +1064 0 obj +<< +/Type /FontDescriptor +/FontName /YFABGK+Poppins +/FontFamily (Poppins) +/Flags 4 +/FontBBox [ -27 -132 753 704 ] +/ItalicAngle 0 +/Ascent 1049 +/Descent -349 +/CapHeight 704 +/StemV 80 +/StemH 80 +/FontFile2 1057 0 R +>> +endobj +1065 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /YFABGK+Poppins +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 3 [ 266 ] 5 [ 291 ] 7 [ 621 ] 10 [ 158 453 453 485 ] 15 [ 197 550 209 475 627 319 574 588 628 627 634 545 630 629 212 ] 32 [ 722 ] 36 [ 673 612 771 706 512 503 777 691 245 ] 46 [ 598 431 860 702 785 578 787 607 586 540 674 675 975 ] 60 [ 583 540 422 ] 64 [ 422 ] 66 [ 732 256 675 675 606 675 619 328 675 639 245 247 514 245 1029 639 639 675 675 372 521 363 639 560 819 478 562 454 ] 95 [ 290 ] 204 [ 218 ] ] +/FontDescriptor 1064 0 R +>> +endobj +1066 0 obj +<< +/Length 1430 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +79 beginbfchar +<0026> <0043> +<002c> <0049> +<0036> <0053> +<0003> <0020> +<0059> <0076> +<0014> <0031> +<0011> <002e> +<0019> <0036> +<0025> <0042> +<0048> <0065> +<0051> <006e> +<0046> <0063> +<004b> <0068> +<0050> <006d> +<0044> <0061> +<0055> <0072> +<004e> <006b> +<0010> <002d> +<004f> <006c> +<0049> <0066> +<0024> <0041> +<0056> <0073> +<0057> <0074> +<002a> <0047> +<0058> <0075> +<004c> <0069> +<0047> <0064> +<0035> <0052> +<0015> <0032> +<0016> <0033> +<002e> <004b> +<0045> <0062> +<005a> <0077> +<001b> <0038> +<0052> <006f> +<0030> <004d> +<0031> <004e> +<004a> <0067> +<0029> <0046> +<0017> <0034> +<0033> <0050> +<001a> <0037> +<0018> <0035> +<0013> <0030> +<0028> <0045> +<005d> <007a> +<002f> <004c> +<003a> <0057> +<005c> <0079> +<001c> <0039> +<005b> <0078> +<0027> <0044> +<0032> <004f> +<0037> <0054> +<0053> <0070> +<000f> <002c> +<001d> <003a> +<002b> <0048> +<0039> <0056> +<003c> <0059> +<000b> <0028> +<000c> <0029> +<004d> <006a> +<0054> <0071> +<000a> <0027> +<005f> <007c> +<0012> <002f> +<000d> <002a> +<0020> <003d> +<0042> <005f> +<0043> <0060> +<0005> <0022> +<003e> <005b> +<0040> <005d> +<00cc> <2019> +<0007> <0024> +<0038> <0055> +<003d> <005a> +<0034> <0051> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +1067 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /YFABGK+Poppins +/Encoding /Identity-H +/DescendantFonts [ 1065 0 R ] +/ToUnicode 1066 0 R +>> +endobj +1068 0 obj +<< +/Type /FontDescriptor +/FontName /PPVKZX+DejaVuSans +/FontFamily (DejaVu Sans) +/Flags 4 +/FontBBox [ -9 -92 733 729 ] +/ItalicAngle 0 +/Ascent 928 +/Descent -235 +/CapHeight 729 +/StemV 80 +/StemH 80 +/FontFile2 1058 0 R +>> +endobj +1069 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /PPVKZX+DejaVuSans +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 3 [ 348 ] 11 [ 457 457 ] 16 [ 415 379 365 695 695 695 695 695 695 695 695 695 695 399 ] 36 [ 773 762 733 830 683 ] 44 [ 372 ] 46 [ 774 637 995 836 ] 51 [ 732 ] 53 [ 770 720 682 ] 57 [ 773 1103 ] 60 [ 724 ] 66 [ 500 ] 68 [ 674 715 592 715 678 435 715 711 342 ] 78 [ 665 342 1041 711 687 715 715 493 595 478 711 651 923 645 651 582 ] 5038 [ 741 ] ] +/FontDescriptor 1068 0 R +>> +endobj +1070 0 obj +<< +/Length 1182 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +61 beginbfchar +<0014> <0031> +<0016> <0033> +<0017> <0034> +<0018> <0035> +<0011> <002e> +<0003> <0020> +<0028> <0045> +<0051> <006e> +<0056> <0073> +<0058> <0075> +<0055> <0072> +<0048> <0065> +<0057> <0074> +<004b> <0068> +<0044> <0061> +<0024> <0041> +<0033> <0050> +<002c> <0049> +<0059> <0076> +<0053> <0070> +<0052> <006f> +<0047> <0064> +<0046> <0063> +<004c> <0069> +<13ae> <00660069> +<004f> <006c> +<0050> <006d> +<0019> <0036> +<000b> <0028> +<000c> <0029> +<0015> <0032> +<005a> <0077> +<001d> <003a> +<004a> <0067> +<001a> <0037> +<001b> <0038> +<001c> <0039> +<0026> <0043> +<0031> <004e> +<004e> <006b> +<0049> <0066> +<0030> <004d> +<0013> <0030> +<005c> <0079> +<0010> <002d> +<002e> <004b> +<0045> <0062> +<005d> <007a> +<0035> <0052> +<0025> <0042> +<002f> <004c> +<0036> <0053> +<005b> <0078> +<0027> <0044> +<0054> <0071> +<0039> <0056> +<0037> <0054> +<0042> <005f> +<003a> <0057> +<0012> <002f> +<003c> <0059> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +1071 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /PPVKZX+DejaVuSans +/Encoding /Identity-H +/DescendantFonts [ 1069 0 R ] +/ToUnicode 1070 0 R +>> +endobj +1072 0 obj +<< +/Type /FontDescriptor +/FontName /MWAATU+DejaVuSansMono +/FontFamily (DejaVu Sans Mono) +/Flags 4 +/FontBBox [ 0 -155 598 728 ] +/ItalicAngle 0 +/Ascent 928 +/Descent -235 +/CapHeight 728 +/StemV 80 +/StemH 80 +/FontFile2 1059 0 R +>> +endobj +1073 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /MWAATU+DejaVuSansMono +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 3 [ 602 602 602 602 602 602 602 602 602 602 602 ] 15 [ 602 602 601 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 601 602 602 602 602 602 602 602 602 ] 46 [ 602 602 602 601 602 602 602 602 602 602 602 602 602 602 602 ] 62 [ 602 602 602 ] 66 [ 601 ] 68 [ 601 601 601 601 601 602 602 602 601 602 601 601 601 602 601 601 602 601 601 601 601 602 601 602 602 602 602 602 602 ] ] +/FontDescriptor 1072 0 R +>> +endobj +1074 0 obj +<< +/Length 1570 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +89 beginbfchar +<0031> <004e> +<0052> <006f> +<0057> <0074> +<0024> <0041> +<0053> <0070> +<004f> <006c> +<004c> <0069> +<0046> <0063> +<0044> <0061> +<0045> <0062> +<0048> <0065> +<0058> <0075> +<0050> <006d> +<0047> <0064> +<0056> <0073> +<0055> <0072> +<0003> <0020> +<0010> <002d> +<0051> <006e> +<0020> <003d> +<0008> <0025> +<001f> <003c> +<004b> <0068> +<0012> <002f> +<0049> <0066> +<0021> <003e> +<0038> <0055> +<001d> <003a> +<002a> <0047> +<0059> <0076> +<000a> <0027> +<001a> <0037> +<0013> <0030> +<0054> <0071> +<004e> <006b> +<0042> <005f> +<005a> <0077> +<0011> <002e> +<0006> <0023> +<0004> <0021> +<0037> <0054> +<004a> <0067> +<005c> <0079> +<0007> <0024> +<0014> <0031> +<002c> <0049> +<0033> <0050> +<0027> <0044> +<0035> <0052> +<003e> <005b> +<0005> <0022> +<005e> <007b> +<0060> <007d> +<0040> <005d> +<001e> <003b> +<005b> <0078> +<000b> <0028> +<000c> <0029> +<002f> <004c> +<000d> <002a> +<005f> <007c> +<0015> <0032> +<0009> <0026> +<0019> <0036> +<0017> <0034> +<002b> <0048> +<0036> <0053> +<0028> <0045> +<0030> <004d> +<0032> <004f> +<0029> <0046> +<003f> <005c> +<0022> <003f> +<005d> <007a> +<0016> <0033> +<003b> <0058> +<000f> <002c> +<0025> <0042> +<0026> <0043> +<001c> <0039> +<003a> <0057> +<001b> <0038> +<0018> <0035> +<003c> <0059> +<004d> <006a> +<0039> <0056> +<0034> <0051> +<0023> <0040> +<002e> <004b> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +1075 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /MWAATU+DejaVuSansMono +/Encoding /Identity-H +/DescendantFonts [ 1073 0 R ] +/ToUnicode 1074 0 R +>> +endobj +1076 0 obj +<< +/SXAKMW 1063 0 R +/YFABGK 1067 0 R +/PPVKZX 1071 0 R +/MWAATU 1075 0 R +>> +endobj +xref +0 1077 +0000000000 65535 f +0000000015 00000 n +0000001112 00000 n +0000001246 00000 n +0000040647 00000 n +0000040781 00000 n +0000043473 00000 n +0000043672 00000 n +0000047406 00000 n +0000047812 00000 n +0000048013 00000 n +0000048216 00000 n +0000048351 00000 n +0000048487 00000 n +0000048645 00000 n +0000048804 00000 n +0000049037 00000 n +0000049271 00000 n +0000049486 00000 n +0000049702 00000 n +0000049943 00000 n +0000050185 00000 n +0000050408 00000 n +0000050632 00000 n +0000050864 00000 n +0000051097 00000 n +0000051311 00000 n +0000051526 00000 n +0000051753 00000 n +0000051981 00000 n +0000052190 00000 n +0000052400 00000 n +0000052629 00000 n +0000052859 00000 n +0000053070 00000 n +0000053282 00000 n +0000053501 00000 n +0000053720 00000 n +0000057475 00000 n +0000057940 00000 n +0000058141 00000 n +0000058343 00000 n +0000058558 00000 n +0000058774 00000 n +0000058971 00000 n +0000059169 00000 n +0000059388 00000 n +0000059608 00000 n +0000059809 00000 n +0000060011 00000 n +0000060239 00000 n +0000060468 00000 n +0000060678 00000 n +0000060889 00000 n +0000061104 00000 n +0000061320 00000 n +0000061551 00000 n +0000061783 00000 n +0000061986 00000 n +0000062190 00000 n +0000062327 00000 n +0000062465 00000 n +0000062659 00000 n +0000062854 00000 n +0000063044 00000 n +0000063235 00000 n +0000063426 00000 n +0000063618 00000 n +0000063810 00000 n +0000064003 00000 n +0000064242 00000 n +0000064482 00000 n +0000064697 00000 n +0000064913 00000 n +0000065120 00000 n +0000065327 00000 n +0000068893 00000 n +0000069371 00000 n +0000069567 00000 n +0000069764 00000 n +0000069960 00000 n +0000070157 00000 n +0000070356 00000 n +0000070556 00000 n +0000070756 00000 n +0000070957 00000 n +0000071155 00000 n +0000071354 00000 n +0000071588 00000 n +0000071823 00000 n +0000072022 00000 n +0000072222 00000 n +0000072425 00000 n +0000072629 00000 n +0000072831 00000 n +0000073034 00000 n +0000073234 00000 n +0000073435 00000 n +0000073631 00000 n +0000073828 00000 n +0000074017 00000 n +0000074208 00000 n +0000074400 00000 n +0000074593 00000 n +0000074783 00000 n +0000074974 00000 n +0000075160 00000 n +0000075347 00000 n +0000075559 00000 n +0000075772 00000 n +0000075987 00000 n +0000076203 00000 n +0000076416 00000 n +0000076629 00000 n +0000080328 00000 n +0000080831 00000 n +0000081033 00000 n +0000081236 00000 n +0000081438 00000 n +0000081641 00000 n +0000081852 00000 n +0000082064 00000 n +0000082285 00000 n +0000082507 00000 n +0000082736 00000 n +0000082966 00000 n +0000083167 00000 n +0000083369 00000 n +0000083567 00000 n +0000083766 00000 n +0000083979 00000 n +0000084193 00000 n +0000084392 00000 n +0000084592 00000 n +0000084803 00000 n +0000085015 00000 n +0000085161 00000 n +0000085308 00000 n +0000085522 00000 n +0000085737 00000 n +0000085929 00000 n +0000086122 00000 n +0000086333 00000 n +0000086545 00000 n +0000086764 00000 n +0000086984 00000 n +0000087183 00000 n +0000087383 00000 n +0000087591 00000 n +0000087800 00000 n +0000087996 00000 n +0000088192 00000 n +0000092056 00000 n +0000092527 00000 n +0000092664 00000 n +0000092802 00000 n +0000092994 00000 n +0000093187 00000 n +0000093386 00000 n +0000093586 00000 n +0000093743 00000 n +0000093901 00000 n +0000094114 00000 n +0000094328 00000 n +0000094524 00000 n +0000094721 00000 n +0000094913 00000 n +0000095106 00000 n +0000095329 00000 n +0000095553 00000 n +0000095754 00000 n +0000095956 00000 n +0000096153 00000 n +0000096351 00000 n +0000096548 00000 n +0000096746 00000 n +0000096906 00000 n +0000097067 00000 n +0000097264 00000 n +0000097462 00000 n +0000097597 00000 n +0000097733 00000 n +0000097916 00000 n +0000098100 00000 n +0000098292 00000 n +0000098485 00000 n +0000102326 00000 n +0000102813 00000 n +0000102972 00000 n +0000103132 00000 n +0000103353 00000 n +0000103575 00000 n +0000103778 00000 n +0000103982 00000 n +0000104205 00000 n +0000104429 00000 n +0000104633 00000 n +0000104838 00000 n +0000105069 00000 n +0000105301 00000 n +0000105514 00000 n +0000105728 00000 n +0000105957 00000 n +0000106187 00000 n +0000106405 00000 n +0000106624 00000 n +0000106860 00000 n +0000107097 00000 n +0000107315 00000 n +0000107534 00000 n +0000107669 00000 n +0000107805 00000 n +0000107998 00000 n +0000108192 00000 n +0000108403 00000 n +0000108615 00000 n +0000108818 00000 n +0000109022 00000 n +0000109213 00000 n +0000109405 00000 n +0000109619 00000 n +0000109833 00000 n +0000113909 00000 n +0000114396 00000 n +0000114599 00000 n +0000114803 00000 n +0000115008 00000 n +0000115214 00000 n +0000115404 00000 n +0000115595 00000 n +0000115832 00000 n +0000116070 00000 n +0000116301 00000 n +0000116533 00000 n +0000116737 00000 n +0000116942 00000 n +0000117150 00000 n +0000117359 00000 n +0000117567 00000 n +0000117776 00000 n +0000117929 00000 n +0000118083 00000 n +0000118280 00000 n +0000118478 00000 n +0000118639 00000 n +0000118801 00000 n +0000118983 00000 n +0000119166 00000 n +0000119331 00000 n +0000119497 00000 n +0000119694 00000 n +0000119892 00000 n +0000120094 00000 n +0000120297 00000 n +0000120446 00000 n +0000120596 00000 n +0000120778 00000 n +0000120961 00000 n +0000124800 00000 n +0000125271 00000 n +0000125492 00000 n +0000125714 00000 n +0000125928 00000 n +0000126143 00000 n +0000126361 00000 n +0000126580 00000 n +0000126784 00000 n +0000126989 00000 n +0000127165 00000 n +0000127342 00000 n +0000127541 00000 n +0000127741 00000 n +0000127936 00000 n +0000128132 00000 n +0000128330 00000 n +0000128529 00000 n +0000128681 00000 n +0000128834 00000 n +0000129021 00000 n +0000129209 00000 n +0000129403 00000 n +0000129598 00000 n +0000129744 00000 n +0000129891 00000 n +0000130093 00000 n +0000130296 00000 n +0000130463 00000 n +0000130631 00000 n +0000130787 00000 n +0000130944 00000 n +0000131151 00000 n +0000131359 00000 n +0000133666 00000 n +0000133961 00000 n +0000134105 00000 n +0000134250 00000 n +0000134452 00000 n +0000134655 00000 n +0000134869 00000 n +0000135084 00000 n +0000135269 00000 n +0000135455 00000 n +0000135633 00000 n +0000135812 00000 n +0000140610 00000 n +0000140849 00000 n +0000141105 00000 n +0000141312 00000 n +0000141518 00000 n +0000145091 00000 n +0000145322 00000 n +0000145519 00000 n +0000145708 00000 n +0000149393 00000 n +0000149596 00000 n +0000153335 00000 n +0000153558 00000 n +0000153692 00000 n +0000157714 00000 n +0000157953 00000 n +0000158087 00000 n +0000158221 00000 n +0000158355 00000 n +0000161968 00000 n +0000162171 00000 n +0000166877 00000 n +0000167268 00000 n +0000167402 00000 n +0000167534 00000 n +0000167666 00000 n +0000167798 00000 n +0000167930 00000 n +0000168062 00000 n +0000168194 00000 n +0000168326 00000 n +0000168458 00000 n +0000168591 00000 n +0000168724 00000 n +0000168857 00000 n +0000168990 00000 n +0000169123 00000 n +0000169256 00000 n +0000169389 00000 n +0000169522 00000 n +0000169655 00000 n +0000169788 00000 n +0000169921 00000 n +0000170053 00000 n +0000170184 00000 n +0000175185 00000 n +0000175584 00000 n +0000175717 00000 n +0000175850 00000 n +0000175983 00000 n +0000176116 00000 n +0000176249 00000 n +0000176382 00000 n +0000176515 00000 n +0000176648 00000 n +0000176781 00000 n +0000176914 00000 n +0000177047 00000 n +0000177180 00000 n +0000177313 00000 n +0000177446 00000 n +0000177579 00000 n +0000177712 00000 n +0000177845 00000 n +0000177978 00000 n +0000178111 00000 n +0000178244 00000 n +0000178377 00000 n +0000178510 00000 n +0000178645 00000 n +0000183449 00000 n +0000183912 00000 n +0000184047 00000 n +0000184180 00000 n +0000184313 00000 n +0000184446 00000 n +0000184579 00000 n +0000184712 00000 n +0000184845 00000 n +0000184978 00000 n +0000185111 00000 n +0000185245 00000 n +0000185379 00000 n +0000185513 00000 n +0000185647 00000 n +0000185781 00000 n +0000185915 00000 n +0000186049 00000 n +0000186183 00000 n +0000186317 00000 n +0000186451 00000 n +0000186585 00000 n +0000186719 00000 n +0000186853 00000 n +0000186987 00000 n +0000187121 00000 n +0000187255 00000 n +0000187389 00000 n +0000187523 00000 n +0000187657 00000 n +0000187791 00000 n +0000187925 00000 n +0000188058 00000 n +0000193055 00000 n +0000193518 00000 n +0000193652 00000 n +0000193786 00000 n +0000193920 00000 n +0000194054 00000 n +0000194188 00000 n +0000194322 00000 n +0000194456 00000 n +0000194590 00000 n +0000194724 00000 n +0000194858 00000 n +0000194992 00000 n +0000195126 00000 n +0000195260 00000 n +0000195394 00000 n +0000195528 00000 n +0000195662 00000 n +0000195796 00000 n +0000195930 00000 n +0000196064 00000 n +0000196198 00000 n +0000196332 00000 n +0000196466 00000 n +0000196600 00000 n +0000196734 00000 n +0000196868 00000 n +0000197002 00000 n +0000197136 00000 n +0000197270 00000 n +0000197404 00000 n +0000197538 00000 n +0000197673 00000 n +0000202259 00000 n +0000202650 00000 n +0000202785 00000 n +0000202918 00000 n +0000203051 00000 n +0000203184 00000 n +0000203317 00000 n +0000203450 00000 n +0000203583 00000 n +0000203716 00000 n +0000203849 00000 n +0000203983 00000 n +0000204117 00000 n +0000204251 00000 n +0000204385 00000 n +0000204519 00000 n +0000204653 00000 n +0000204787 00000 n +0000204921 00000 n +0000205055 00000 n +0000205189 00000 n +0000205323 00000 n +0000205457 00000 n +0000205590 00000 n +0000210570 00000 n +0000211081 00000 n +0000211215 00000 n +0000211349 00000 n +0000211483 00000 n +0000211617 00000 n +0000211751 00000 n +0000211885 00000 n +0000212019 00000 n +0000212153 00000 n +0000212287 00000 n +0000212421 00000 n +0000212555 00000 n +0000212689 00000 n +0000212823 00000 n +0000212957 00000 n +0000213091 00000 n +0000213225 00000 n +0000213359 00000 n +0000213493 00000 n +0000213627 00000 n +0000213761 00000 n +0000213895 00000 n +0000214029 00000 n +0000214163 00000 n +0000214297 00000 n +0000214431 00000 n +0000214565 00000 n +0000214699 00000 n +0000214833 00000 n +0000214967 00000 n +0000215101 00000 n +0000215235 00000 n +0000215369 00000 n +0000215503 00000 n +0000215637 00000 n +0000215771 00000 n +0000215904 00000 n +0000216036 00000 n +0000219278 00000 n +0000219517 00000 n +0000219651 00000 n +0000219785 00000 n +0000219920 00000 n +0000224952 00000 n +0000225175 00000 n +0000225310 00000 n +0000230303 00000 n +0000230526 00000 n +0000230661 00000 n +0000235447 00000 n +0000235650 00000 n +0000240649 00000 n +0000240872 00000 n +0000241007 00000 n +0000245852 00000 n +0000246055 00000 n +0000250970 00000 n +0000251193 00000 n +0000251328 00000 n +0000256189 00000 n +0000256412 00000 n +0000256547 00000 n +0000261310 00000 n +0000261513 00000 n +0000266505 00000 n +0000266728 00000 n +0000266863 00000 n +0000271838 00000 n +0000272041 00000 n +0000276936 00000 n +0000277159 00000 n +0000277294 00000 n +0000282231 00000 n +0000282454 00000 n +0000282589 00000 n +0000287403 00000 n +0000287606 00000 n +0000292603 00000 n +0000292826 00000 n +0000292961 00000 n +0000297965 00000 n +0000298188 00000 n +0000298323 00000 n +0000303231 00000 n +0000303434 00000 n +0000308403 00000 n +0000308626 00000 n +0000308761 00000 n +0000313532 00000 n +0000313735 00000 n +0000318047 00000 n +0000318278 00000 n +0000318413 00000 n +0000318548 00000 n +0000323431 00000 n +0000323654 00000 n +0000323789 00000 n +0000328814 00000 n +0000329037 00000 n +0000329172 00000 n +0000334040 00000 n +0000334243 00000 n +0000339339 00000 n +0000339562 00000 n +0000339697 00000 n +0000344581 00000 n +0000344784 00000 n +0000349796 00000 n +0000350019 00000 n +0000350154 00000 n +0000355070 00000 n +0000355293 00000 n +0000355428 00000 n +0000360228 00000 n +0000360431 00000 n +0000365468 00000 n +0000365691 00000 n +0000365826 00000 n +0000370748 00000 n +0000370971 00000 n +0000371106 00000 n +0000375917 00000 n +0000376120 00000 n +0000381088 00000 n +0000381311 00000 n +0000381446 00000 n +0000386387 00000 n +0000386590 00000 n +0000391465 00000 n +0000391688 00000 n +0000391823 00000 n +0000396759 00000 n +0000396982 00000 n +0000397117 00000 n +0000401918 00000 n +0000402121 00000 n +0000407114 00000 n +0000407337 00000 n +0000407472 00000 n +0000412461 00000 n +0000412684 00000 n +0000412819 00000 n +0000417598 00000 n +0000417801 00000 n +0000422784 00000 n +0000423007 00000 n +0000423142 00000 n +0000427990 00000 n +0000428193 00000 n +0000433212 00000 n +0000433435 00000 n +0000433570 00000 n +0000438436 00000 n +0000438659 00000 n +0000438794 00000 n +0000443530 00000 n +0000443733 00000 n +0000448788 00000 n +0000449011 00000 n +0000449147 00000 n +0000454091 00000 n +0000454294 00000 n +0000459120 00000 n +0000459343 00000 n +0000459479 00000 n +0000464495 00000 n +0000464718 00000 n +0000464854 00000 n +0000469631 00000 n +0000469834 00000 n +0000474808 00000 n +0000475031 00000 n +0000475167 00000 n +0000480155 00000 n +0000480378 00000 n +0000480513 00000 n +0000485271 00000 n +0000485474 00000 n +0000490551 00000 n +0000490886 00000 n +0000491022 00000 n +0000491156 00000 n +0000491290 00000 n +0000491424 00000 n +0000491558 00000 n +0000491692 00000 n +0000491826 00000 n +0000491960 00000 n +0000492094 00000 n +0000492229 00000 n +0000492364 00000 n +0000492499 00000 n +0000492634 00000 n +0000492768 00000 n +0000492901 00000 n +0000497397 00000 n +0000497708 00000 n +0000497843 00000 n +0000497978 00000 n +0000498113 00000 n +0000498248 00000 n +0000498383 00000 n +0000498518 00000 n +0000498653 00000 n +0000498788 00000 n +0000498923 00000 n +0000499058 00000 n +0000499194 00000 n +0000499330 00000 n +0000504338 00000 n +0000504561 00000 n +0000504697 00000 n +0000509536 00000 n +0000509759 00000 n +0000509895 00000 n +0000514751 00000 n +0000514974 00000 n +0000515110 00000 n +0000519926 00000 n +0000520149 00000 n +0000520285 00000 n +0000525136 00000 n +0000525359 00000 n +0000525495 00000 n +0000530166 00000 n +0000530389 00000 n +0000530525 00000 n +0000534114 00000 n +0000534317 00000 n +0000538901 00000 n +0000539132 00000 n +0000539268 00000 n +0000539403 00000 n +0000542898 00000 n +0000543101 00000 n +0000547952 00000 n +0000548175 00000 n +0000548311 00000 n +0000553075 00000 n +0000553278 00000 n +0000558388 00000 n +0000558611 00000 n +0000558747 00000 n +0000563492 00000 n +0000563695 00000 n +0000568822 00000 n +0000569045 00000 n +0000569180 00000 n +0000573906 00000 n +0000574109 00000 n +0000579103 00000 n +0000579306 00000 n +0000584107 00000 n +0000584330 00000 n +0000584466 00000 n +0000589217 00000 n +0000589420 00000 n +0000594467 00000 n +0000594690 00000 n +0000594826 00000 n +0000599592 00000 n +0000599795 00000 n +0000604796 00000 n +0000605019 00000 n +0000605155 00000 n +0000609920 00000 n +0000610123 00000 n +0000614957 00000 n +0000615160 00000 n +0000619972 00000 n +0000620195 00000 n +0000620331 00000 n +0000625074 00000 n +0000625277 00000 n +0000628895 00000 n +0000629098 00000 n +0000632371 00000 n +0000632574 00000 n +0000637611 00000 n +0000637834 00000 n +0000637970 00000 n +0000642503 00000 n +0000642706 00000 n +0000646992 00000 n +0000647215 00000 n +0000647351 00000 n +0000651417 00000 n +0000651648 00000 n +0000651784 00000 n +0000651920 00000 n +0000656866 00000 n +0000657137 00000 n +0000657273 00000 n +0000657409 00000 n +0000657543 00000 n +0000657677 00000 n +0000657811 00000 n +0000657945 00000 n +0000658081 00000 n +0000662852 00000 n +0000663115 00000 n +0000663251 00000 n +0000663385 00000 n +0000663519 00000 n +0000663653 00000 n +0000663787 00000 n +0000663923 00000 n +0000666684 00000 n +0000666887 00000 n +0000671193 00000 n +0000671432 00000 n +0000671568 00000 n +0000671704 00000 n +0000671839 00000 n +0000675857 00000 n +0000676096 00000 n +0000676232 00000 n +0000676368 00000 n +0000676504 00000 n +0000681153 00000 n +0000681400 00000 n +0000681536 00000 n +0000681672 00000 n +0000681808 00000 n +0000681944 00000 n +0000686819 00000 n +0000687050 00000 n +0000687186 00000 n +0000687322 00000 n +0000691466 00000 n +0000691697 00000 n +0000691833 00000 n +0000691969 00000 n +0000696136 00000 n +0000696383 00000 n +0000696519 00000 n +0000696655 00000 n +0000696791 00000 n +0000696927 00000 n +0000701916 00000 n +0000702147 00000 n +0000702283 00000 n +0000702419 00000 n +0000706998 00000 n +0000707229 00000 n +0000707365 00000 n +0000707501 00000 n +0000710438 00000 n +0000710661 00000 n +0000710797 00000 n +0000714870 00000 n +0000715073 00000 n +0000720577 00000 n +0000720976 00000 n +0000721112 00000 n +0000721246 00000 n +0000721380 00000 n +0000721514 00000 n +0000721648 00000 n +0000721782 00000 n +0000721916 00000 n +0000722050 00000 n +0000722184 00000 n +0000722319 00000 n +0000722454 00000 n +0000722589 00000 n +0000722724 00000 n +0000722859 00000 n +0000722994 00000 n +0000723129 00000 n +0000723264 00000 n +0000723399 00000 n +0000723534 00000 n +0000723669 00000 n +0000723804 00000 n +0000723939 00000 n +0000724073 00000 n +0000727769 00000 n +0000728056 00000 n +0000728191 00000 n +0000728326 00000 n +0000728461 00000 n +0000728596 00000 n +0000728731 00000 n +0000728866 00000 n +0000729001 00000 n +0000729136 00000 n +0000729272 00000 n +0000733691 00000 n +0000733914 00000 n +0000734050 00000 n +0000738503 00000 n +0000738734 00000 n +0000738870 00000 n +0000739006 00000 n +0000743465 00000 n +0000743688 00000 n +0000743824 00000 n +0000748783 00000 n +0000749118 00000 n +0000749254 00000 n +0000749388 00000 n +0000749522 00000 n +0000749656 00000 n +0000749790 00000 n +0000749924 00000 n +0000750058 00000 n +0000750192 00000 n +0000750326 00000 n +0000750461 00000 n +0000750596 00000 n +0000750731 00000 n +0000750866 00000 n +0000751000 00000 n +0000751133 00000 n +0000754374 00000 n +0000754629 00000 n +0000754764 00000 n +0000754899 00000 n +0000755034 00000 n +0000755169 00000 n +0000755305 00000 n +0000758716 00000 n +0000758919 00000 n +0000762176 00000 n +0000762379 00000 n +0000766780 00000 n +0000766983 00000 n +0000771375 00000 n +0000771742 00000 n +0000771878 00000 n +0000772012 00000 n +0000772146 00000 n +0000772280 00000 n +0000772414 00000 n +0000772548 00000 n +0000772682 00000 n +0000772816 00000 n +0000772950 00000 n +0000773085 00000 n +0000773220 00000 n +0000773355 00000 n +0000773490 00000 n +0000773625 00000 n +0000773760 00000 n +0000773895 00000 n +0000774030 00000 n +0000774165 00000 n +0000774301 00000 n +0000774493 00000 n +0000774715 00000 n +0000774841 00000 n +0000774987 00000 n +0000775127 00000 n +0000775324 00000 n +0000775558 00000 n +0000775789 00000 n +0000776045 00000 n +0000776284 00000 n +0000776531 00000 n +0000776761 00000 n +0000777003 00000 n +0000777228 00000 n +0000777472 00000 n +0000777700 00000 n +0000777935 00000 n +0000778153 00000 n +0000778384 00000 n +0000778598 00000 n +0000778833 00000 n +0000779051 00000 n +0000779295 00000 n +0000779522 00000 n +0000779754 00000 n +0000780001 00000 n +0000780206 00000 n +0000780382 00000 n +0000780577 00000 n +0000780782 00000 n +0000780988 00000 n +0000781195 00000 n +0000781449 00000 n +0000781679 00000 n +0000781902 00000 n +0000782113 00000 n +0000782324 00000 n +0000782539 00000 n +0000782755 00000 n +0000782969 00000 n +0000783219 00000 n +0000783434 00000 n +0000783653 00000 n +0000783871 00000 n +0000784087 00000 n +0000784299 00000 n +0000784504 00000 n +0000784711 00000 n +0000784916 00000 n +0000785117 00000 n +0000785344 00000 n +0000785574 00000 n +0000785803 00000 n +0000786020 00000 n +0000786237 00000 n +0000786463 00000 n +0000786699 00000 n +0000786943 00000 n +0000787159 00000 n +0000787372 00000 n +0000787600 00000 n +0000787814 00000 n +0000788026 00000 n +0000788209 00000 n +0000788423 00000 n +0000788627 00000 n +0000788852 00000 n +0000789085 00000 n +0000789298 00000 n +0000789520 00000 n +0000789717 00000 n +0000789891 00000 n +0000790081 00000 n +0000790278 00000 n +0000790470 00000 n +0000790681 00000 n +0000790889 00000 n +0000791093 00000 n +0000791328 00000 n +0000791541 00000 n +0000791750 00000 n +0000791945 00000 n +0000792142 00000 n +0000792325 00000 n +0000792498 00000 n +0000792681 00000 n +0000792873 00000 n +0000793074 00000 n +0000793298 00000 n +0000793520 00000 n +0000793761 00000 n +0000793984 00000 n +0000794233 00000 n +0000794465 00000 n +0000794712 00000 n +0000794949 00000 n +0000795203 00000 n +0000795426 00000 n +0000795604 00000 n +0000795800 00000 n +0000796027 00000 n +0000796246 00000 n +0000796455 00000 n +0000796687 00000 n +0000796908 00000 n +0000797131 00000 n +0000797339 00000 n +0000797594 00000 n +0000797842 00000 n +0000798065 00000 n +0000798292 00000 n +0000798504 00000 n +0000798699 00000 n +0000798899 00000 n +0000799078 00000 n +0000799278 00000 n +0000799461 00000 n +0000799676 00000 n +0000799881 00000 n +0000800072 00000 n +0000800257 00000 n +0000800496 00000 n +0000800728 00000 n +0000800964 00000 n +0000801186 00000 n +0000801380 00000 n +0000801597 00000 n +0000801810 00000 n +0000802011 00000 n +0000802205 00000 n +0000802395 00000 n +0000802592 00000 n +0000802780 00000 n +0000802985 00000 n +0000803155 00000 n +0000803353 00000 n +0000803548 00000 n +0000803719 00000 n +0000803924 00000 n +0000804157 00000 n +0000804360 00000 n +0000804541 00000 n +0000804605 00000 n +0000812285 00000 n +0000817087 00000 n +0000828947 00000 n +0000841343 00000 n +0000841577 00000 n +0000841981 00000 n +0000842779 00000 n +0000842932 00000 n +0000843163 00000 n +0000843760 00000 n +0000845245 00000 n +0000845395 00000 n +0000845630 00000 n +0000846169 00000 n +0000847406 00000 n +0000847559 00000 n +0000847803 00000 n +0000848398 00000 n +0000850023 00000 n +0000850180 00000 n +trailer +<< +/Size 1077 +/Root 3 0 R +/Info 2 0 R +>> +startxref +850272 +%%EOF diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/_index.md b/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/_index.md new file mode 100644 index 00000000000..b1eba5740d7 --- /dev/null +++ b/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/_index.md @@ -0,0 +1,3098 @@ +--- +title: CIS v1.6 Benchmark - Self-Assessment Guide - Rancher v2.6 +weight: 101 +--- + +### CIS v1.6 Kubernetes Benchmark - Rancher v2.6 with Kubernetes v1.18 to v1.21 + +[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf). + +#### Overview + +This document is a companion to the Rancher v2.6 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark. + +This guide corresponds to specific versions of the hardening guide, Rancher, CIS Benchmark and Kubernetes: + +| Hardening Guide Version | Rancher Version | CIS Benchmark Version | Kubernetes Version | +| ----------------------- | --------------- | --------------------- | ------------------- | +| Hardening Guide CIS v1.6 Benchmark | Rancher v2.6.3 | CIS v1.6 | Kubernetes v1.18, v1.19, v1.20 and v1.21 | + +Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark do not apply and will have a result of `Not Applicable`. This guide will walk through the various controls and provide updated example commands to audit compliance in Rancher created clusters. + +This document is to be used by Rancher operators, security teams, auditors and decision makers. + +For more detail about each audit, including rationales and remediations for failing tests, you can refer to the corresponding section of the CIS Kubernetes Benchmark v1.6. You can download the benchmark, after creating a free account, in [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). + +#### Testing controls methodology + +Rancher and RKE install Kubernetes services via Docker containers. Configuration is defined by arguments passed to the container at the time of initialization, not via configuration files. + +Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher are provided for testing. When performing the tests, you will need access to the Docker command line on the hosts of all three RKE roles. The commands also make use of the [kubectl](https://kubernetes.io/docs/tasks/tools/) (with a valid configuration file) and [jq](https://stedolan.github.io/jq/) tools, which are required in the testing and evaluation of test results. + +> NOTE: Only `automated` tests (previously called `scored`) are covered in this guide. + +### Controls +## 1.1 Master Node Configuration Files +### 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. +All configuration is passed in as arguments at container run time. + +### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. +All configuration is passed in as arguments at container run time. + +### 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chmod 644 + +**Audit:** + +```bash +stat -c permissions=%a +``` + +### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chown root:root + +**Audit:** + +```bash +stat -c %U:%G +``` + +### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the below command: +ps -ef | grep etcd Run the below command (based on the etcd data directory found above). For example, +chmod 700 /var/lib/etcd + +**Audit:** + +```bash +stat -c %a /node/var/lib/etcd +``` + +**Expected Result**: + +```console +'700' is equal to '700' +``` + +**Returned Value**: + +```console +700 +``` + +### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the below command: +ps -ef | grep etcd +Run the below command (based on the etcd data directory found above). +For example, chown etcd:etcd /var/lib/etcd + +A system service account is required for etcd data directory ownership. +Refer to Rancher's hardening guide for more details on how to configure this ownership. + +**Audit:** + +```bash +stat -c %U:%G /node/var/lib/etcd +``` + +**Expected Result**: + +```console +'etcd:etcd' is present +``` + +**Returned Value**: + +```console +etcd:etcd +``` + +### 1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. + +### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. + +### 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chown -R root:root /etc/kubernetes/pki/ + +**Audit Script:** `check_files_owner_in_dir.sh` + +```bash +#!/usr/bin/env bash + +# This script is used to ensure the owner is set to root:root for +# the given directory and all the files in it +# +# inputs: +# $1 = /full/path/to/directory +# +# outputs: +# true/false + +INPUT_DIR=$1 + +if [[ "${INPUT_DIR}" == "" ]]; then + echo "false" + exit +fi + +if [[ $(stat -c %U:%G ${INPUT_DIR}) != "root:root" ]]; then + echo "false" + exit +fi + +statInfoLines=$(stat -c "%n %U:%G" ${INPUT_DIR}/*) +while read -r statInfoLine; do + f=$(echo ${statInfoLine} | cut -d' ' -f1) + p=$(echo ${statInfoLine} | cut -d' ' -f2) + + if [[ $(basename "$f" .pem) == "kube-etcd-"* ]]; then + if [[ "$p" != "root:root" && "$p" != "etcd:etcd" ]]; then + echo "false" + exit + fi + else + if [[ "$p" != "root:root" ]]; then + echo "false" + exit + fi + fi +done <<< "${statInfoLines}" + + +echo "true" +exit + +``` + +**Audit Execution:** + +```bash +./check_files_owner_in_dir.sh /node/etc/kubernetes/ssl +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chmod -R 644 /etc/kubernetes/pki/*.crt + +**Audit Script:** `check_files_permissions.sh` + +```bash +#!/usr/bin/env bash + +# This script is used to ensure the file permissions are set to 644 or +# more restrictive for all files in a given directory or a wildcard +# selection of files +# +# inputs: +# $1 = /full/path/to/directory or /path/to/fileswithpattern +# ex: !(*key).pem +# +# $2 (optional) = permission (ex: 600) +# +# outputs: +# true/false + +# Turn on "extended glob" for use of '!' in wildcard +shopt -s extglob + +# Turn off history to avoid surprises when using '!' +set -H + +USER_INPUT=$1 + +if [[ "${USER_INPUT}" == "" ]]; then + echo "false" + exit +fi + + +if [[ -d ${USER_INPUT} ]]; then + PATTERN="${USER_INPUT}/*" +else + PATTERN="${USER_INPUT}" +fi + +PERMISSION="" +if [[ "$2" != "" ]]; then + PERMISSION=$2 +fi + +FILES_PERMISSIONS=$(stat -c %n\ %a ${PATTERN}) + +while read -r fileInfo; do + p=$(echo ${fileInfo} | cut -d' ' -f2) + + if [[ "${PERMISSION}" != "" ]]; then + if [[ "$p" != "${PERMISSION}" ]]; then + echo "false" + exit + fi + else + if [[ "$p" != "644" && "$p" != "640" && "$p" != "600" ]]; then + echo "false" + exit + fi + fi +done <<< "${FILES_PERMISSIONS}" + + +echo "true" +exit + +``` + +**Audit Execution:** + +```bash +./check_files_permissions.sh /node/etc/kubernetes/ssl/!(*key).pem +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chmod -R 600 /etc/kubernetes/ssl/*key.pem + +**Audit Script:** `check_files_permissions.sh` + +```bash +#!/usr/bin/env bash + +# This script is used to ensure the file permissions are set to 644 or +# more restrictive for all files in a given directory or a wildcard +# selection of files +# +# inputs: +# $1 = /full/path/to/directory or /path/to/fileswithpattern +# ex: !(*key).pem +# +# $2 (optional) = permission (ex: 600) +# +# outputs: +# true/false + +# Turn on "extended glob" for use of '!' in wildcard +shopt -s extglob + +# Turn off history to avoid surprises when using '!' +set -H + +USER_INPUT=$1 + +if [[ "${USER_INPUT}" == "" ]]; then + echo "false" + exit +fi + + +if [[ -d ${USER_INPUT} ]]; then + PATTERN="${USER_INPUT}/*" +else + PATTERN="${USER_INPUT}" +fi + +PERMISSION="" +if [[ "$2" != "" ]]; then + PERMISSION=$2 +fi + +FILES_PERMISSIONS=$(stat -c %n\ %a ${PATTERN}) + +while read -r fileInfo; do + p=$(echo ${fileInfo} | cut -d' ' -f2) + + if [[ "${PERMISSION}" != "" ]]; then + if [[ "$p" != "${PERMISSION}" ]]; then + echo "false" + exit + fi + else + if [[ "$p" != "644" && "$p" != "640" && "$p" != "600" ]]; then + echo "false" + exit + fi + fi +done <<< "${FILES_PERMISSIONS}" + + +echo "true" +exit + +``` + +**Audit Execution:** + +```bash +./check_files_permissions.sh /node/etc/kubernetes/ssl/*key.pem +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +## 1.2 API Server +### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the below parameter. +--anonymous-auth=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'false' is equal to 'false' +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.2 Ensure that the --basic-auth-file argument is not set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and configure alternate mechanisms for authentication. Then, +edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and remove the --basic-auth-file= parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--basic-auth-file' is not present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.3 Ensure that the --token-auth-file parameter is not set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and configure alternate mechanisms for authentication. Then, +edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and remove the --token-auth-file= parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--token-auth-file' is not present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and remove the --kubelet-https parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-https' is not present OR '--kubelet-https' is not present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the +apiserver and kubelets. Then, edit API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the +kubelet client certificate and key parameters as below. +--kubelet-client-certificate= +--kubelet-client-key= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and setup the TLS connection between +the apiserver and kubelets. Then, edit the API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the +--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. +--kubelet-certificate-authority= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-certificate-authority' is present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --authorization-mode parameter to values other than AlwaysAllow. +One such example could be as below. +--authorization-mode=RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'Node,RBAC' not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --authorization-mode parameter to a value that includes Node. +--authorization-mode=Node,RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'Node,RBAC' has 'Node' +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --authorization-mode parameter to a value that includes RBAC, +for example: +--authorization-mode=Node,RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'Node,RBAC' has 'RBAC' +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set the desired limits in a configuration file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +and set the below parameters. +--enable-admission-plugins=...,EventRateLimit,... +--admission-control-config-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' has 'EventRateLimit' +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and either remove the --enable-admission-plugins parameter, or set it to a +value that does not include AlwaysAdmit. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --enable-admission-plugins parameter to include +AlwaysPullImages. +--enable-admission-plugins=...,AlwaysPullImages,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +### 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --enable-admission-plugins parameter to include +SecurityContextDeny, unless PodSecurityPolicy is already in place. +--enable-admission-plugins=...,SecurityContextDeny,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +### 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create ServiceAccount objects as per your environment. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and ensure that the --disable-admission-plugins parameter is set to a +value that does not include ServiceAccount. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is not present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --disable-admission-plugins parameter to +ensure it does not include NamespaceLifecycle. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is not present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create Pod Security Policy objects as per your environment. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --enable-admission-plugins parameter to a +value that includes PodSecurityPolicy: +--enable-admission-plugins=...,PodSecurityPolicy,... +Then restart the API Server. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' has 'PodSecurityPolicy' +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.17 Ensure that the admission control plugin NodeRestriction is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --enable-admission-plugins parameter to a +value that includes NodeRestriction. +--enable-admission-plugins=...,NodeRestriction,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' has 'NodeRestriction' +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.18 Ensure that the --insecure-bind-address argument is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and remove the --insecure-bind-address parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--insecure-bind-address' is not present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.19 Ensure that the --insecure-port argument is set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the below parameter. +--insecure-port=0 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'0' is equal to '0' +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.20 Ensure that the --secure-port argument is not set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and either remove the --secure-port parameter or +set it to a different (non-zero) desired port. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +6443 is greater than 0 OR '--secure-port' is not present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.21 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'false' is equal to 'false' +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.22 Ensure that the --audit-log-path argument is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --audit-log-path parameter to a suitable path and +file where you would like audit logs to be written, for example: +--audit-log-path=/var/log/apiserver/audit.log + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-path' is present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --audit-log-maxage parameter to 30 or as an appropriate number of days: +--audit-log-maxage=30 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +30 is greater or equal to 30 +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --audit-log-maxbackup parameter to 10 or to an appropriate +value. +--audit-log-maxbackup=10 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +10 is greater or equal to 10 +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --audit-log-maxsize parameter to an appropriate size in MB. +For example, to set it as 100 MB: +--audit-log-maxsize=100 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +100 is greater or equal to 100 +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.26 Ensure that the --request-timeout argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +and set the below parameter as appropriate and if needed. +For example, +--request-timeout=300s + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--request-timeout' is not present OR '--request-timeout' is not present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.27 Ensure that the --service-account-lookup argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the below parameter. +--service-account-lookup=true +Alternatively, you can delete the --service-account-lookup parameter from this file so +that the default takes effect. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-lookup' is not present OR 'true' is equal to 'true' +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.28 Ensure that the --service-account-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --service-account-key-file parameter +to the public key file for service accounts: +--service-account-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-key-file' is present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the etcd certificate and key file parameters. +--etcd-certfile= +--etcd-keyfile= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--etcd-certfile' is present AND '--etcd-keyfile' is present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the TLS certificate and private key file parameters. +--tls-cert-file= +--tls-private-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.31 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the client certificate authority file. +--client-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.32 Ensure that the --etcd-cafile argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the etcd certificate authority file parameter. +--etcd-cafile= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--etcd-cafile' is present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --encryption-provider-config parameter to the path of that file: --encryption-provider-config= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--encryption-provider-config' is present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.34 Ensure that encryption providers are appropriately configured (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +In this file, choose aescbc, kms or secretbox as the encryption provider. + +**Audit Script:** `check_encryption_provider_config.sh` + +```bash +#!/usr/bin/env bash + +# This script is used to check the encrption provider config is set to aesbc +# +# outputs: +# true/false + +# TODO: Figure out the file location from the kube-apiserver commandline args +ENCRYPTION_CONFIG_FILE="/node/etc/kubernetes/ssl/encryption.yaml" + +if [[ ! -f "${ENCRYPTION_CONFIG_FILE}" ]]; then + echo "false" + exit +fi + +for provider in "$@" +do + if grep "$provider" "${ENCRYPTION_CONFIG_FILE}"; then + echo "true" + exit + fi +done + +echo "false" +exit + +``` + +**Audit Execution:** + +```bash +./check_encryption_provider_config.sh aescbc +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +- aescbc: true +``` + +### 1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the below parameter. +--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM +_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM +_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM +_SHA384 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +## 1.3 Controller Manager +### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and set the --terminated-pod-gc-threshold to an appropriate threshold, +for example: +--terminated-pod-gc-threshold=10 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--terminated-pod-gc-threshold' is present +``` + +**Returned Value**: + +```console +root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.2 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'false' is equal to 'false' +``` + +**Returned Value**: + +```console +root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node to set the below parameter. +--use-service-account-credentials=true + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'true' is not equal to 'false' +``` + +**Returned Value**: + +```console +root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and set the --service-account-private-key-file parameter +to the private key file for service accounts. +--service-account-private-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-private-key-file' is present +``` + +**Returned Value**: + +```console +root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and set the --root-ca-file parameter to the certificate bundle file`. +--root-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--root-ca-file' is present +``` + +**Returned Value**: + +```console +root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. +--feature-gates=RotateKubeletServerCertificate=true + +Cluster provisioned by RKE handles certificate rotation directly through RKE. + +### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'127.0.0.1' is equal to '127.0.0.1' OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +## 1.4 Scheduler +### 1.4.1 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file +on the master node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-scheduler | grep -v grep +``` + +**Expected Result**: + +```console +'false' is equal to 'false' +``` + +**Returned Value**: + +```console +root 121587 121567 0 12:27 ? 00:00:12 kube-scheduler --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --address=127.0.0.1 --leader-elect=true --profiling=false --v=2 --bind-address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +``` + +### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml +on the master node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep kube-scheduler | grep -v grep +``` + +**Expected Result**: + +```console +'127.0.0.1' is equal to '127.0.0.1' OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 121587 121567 0 12:27 ? 00:00:12 kube-scheduler --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --address=127.0.0.1 --leader-elect=true --profiling=false --v=2 --bind-address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +``` + +## 2 Etcd Node Configuration Files +### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure TLS encryption. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml +on the master node and set the below parameters. +--cert-file= +--key-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--cert-file' is present AND '--key-file' is present +``` + +**Returned Value**: + +```console +etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 2 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +``` + +### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and set the below parameter. +--client-cert-auth="true" + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--client-cert-auth' is present OR 'true' is equal to 'true' +``` + +**Returned Value**: + +```console +etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 2 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +``` + +### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and either remove the --auto-tls parameter or set it to false. + --auto-tls=false + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--auto-tls' is not present OR '--auto-tls' is not present +``` + +**Returned Value**: + +```console +etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 1 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +``` + +### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure peer TLS encryption as appropriate +for your etcd cluster. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the +master node and set the below parameters. +--peer-client-file= +--peer-key-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--peer-cert-file' is present AND '--peer-key-file' is present +``` + +**Returned Value**: + +```console +etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 5 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +``` + +### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and set the below parameter. +--peer-client-cert-auth=true + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--peer-client-cert-auth' is present OR 'true' is equal to 'true' +``` + +**Returned Value**: + +```console +etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 4 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +``` + +### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and either remove the --peer-auto-tls parameter or set it to false. +--peer-auto-tls=false + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--peer-auto-tls' is not present OR '--peer-auto-tls' is present +``` + +**Returned Value**: + +```console +etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 4 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +``` + +### 2.7 Ensure that a unique Certificate Authority is used for etcd (Automated) + + +**Result:** pass + +**Remediation:** +[Manual test] +Follow the etcd documentation and create a dedicated certificate authority setup for the +etcd service. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the +master node and set the below parameter. +--trusted-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--trusted-ca-file' is present +``` + +**Returned Value**: + +```console +etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 3 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +``` + +## 3.1 Authentication and Authorization +### 3.1.1 Client certificate authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be +implemented in place of client certificates. + +## 3.2 Logging +### 3.2.1 Ensure that a minimal audit policy is created (Automated) + + +**Result:** pass + +**Remediation:** +Create an audit policy file for your cluster. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-policy-file' is present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) + + +**Result:** warn + +**Remediation:** +Consider modification of the audit policy in use on the cluster to include these items, at a +minimum. + +## 4.1 Worker Node Configuration Files +### 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. +All configuration is passed in as arguments at container run time. + +### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. +All configuration is passed in as arguments at container run time. + +### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 644 $proykubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %a /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' +``` + +**Expected Result**: + +```console +'644' is present OR '640' is present OR '600' is equal to '600' OR '444' is present OR '440' is present OR '400' is present OR '000' is present +``` + +**Returned Value**: + +```console +600 +``` + +### 4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is not present OR '/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml' is not present +``` + +### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 644 /etc/kubernetes/ssl/kubecfg-kube-node.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c permissions=%a /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' +``` + +**Expected Result**: + +```console +'permissions' is not present +``` + +### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the following command to modify the file permissions of the +--client-ca-file chmod 644 + +**Audit Script:** `check_cafile_permissions.sh` + +```bash +#!/usr/bin/env bash + +CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') +if test -z $CAFILE; then CAFILE=$kubeletcafile; fi +if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi + +``` + +**Audit Execution:** + +```bash +./check_cafile_permissions.sh +``` + +**Expected Result**: + +```console +'permissions' is not present +``` + +### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the following command to modify the ownership of the --client-ca-file. +chown root:root + +**Audit Script:** `check_cafile_ownership.sh` + +```bash +#!/usr/bin/env bash + +CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') +if test -z $CAFILE; then CAFILE=$kubeletcafile; fi +if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi + +``` + +**Audit Execution:** + +```bash +./check_cafile_ownership.sh +``` + +**Expected Result**: + +```console +'root:root' is not present +``` + +### 4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chmod 644 /var/lib/kubelet/config.yaml + +Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. +All configuration is passed in as arguments at container run time. + +### 4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chown root:root /var/lib/kubelet/config.yaml + +Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. +All configuration is passed in as arguments at container run time. + +## 4.2 Kubelet +### 4.2.1 Ensure that the anonymous-auth argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to +false. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--anonymous-auth=false +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present +``` + +### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set authorization: mode to Webhook. If +using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--authorization-mode=Webhook +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present +``` + +### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set authentication: x509: clientCAFile to +the location of the client CA file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--client-ca-file= +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present +``` + +### 4.2.4 Ensure that the --read-only-port argument is set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set readOnlyPort to 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--read-only-port=0 +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present OR '' is not present +``` + +### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set streamingConnectionIdleTimeout to a +value other than 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--streaming-connection-idle-timeout=5m +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'30m' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 121813 121792 4 12:27 ? 00:03:37 kubelet --fail-swap-on=false --resolv-conf=/etc/resolv.conf --authorization-mode=Webhook --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --v=2 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --make-iptables-util-chains=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --hostname-override= --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-.pem --network-plugin=cni --streaming-connection-idle-timeout=30m --root-dir=/var/lib/kubelet --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --protect-kernel-defaults=true --cloud-provider= --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet--key.pem --cgroups-per-qos=True --cni-bin-dir=/opt/cni/bin --cni-conf-dir=/etc/cni/net.d --pod-infra-container-image=rancher/mirrored-pause:3.5 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --anonymous-auth=false --authentication-token-webhook=true --node-ip= --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --read-only-port=0 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set protectKernelDefaults: true. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--protect-kernel-defaults=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present +``` + +### 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set makeIPTablesUtilChains: true. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove the --make-iptables-util-chains argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present OR '' is not present +``` + +### 4.2.8 Ensure that the --hostname-override argument is not set (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and remove the --hostname-override argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +Clusters provisioned by RKE set the --hostname-override to avoid any hostname configuration errors + +### 4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set eventRecordQPS: to an appropriate level. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present +``` + +### 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set tlsCertFile to the location +of the certificate file to use to identify this Kubelet, and tlsPrivateKeyFile +to the location of the corresponding private key file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameters in KUBELET_CERTIFICATE_ARGS variable. +--tls-cert-file= +--tls-private-key-file= +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present AND '' is not present +``` + +### 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to add the line rotateCertificates: true or +remove it altogether to use the default value. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS +variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'--rotate-certificates' is not present OR '--rotate-certificates' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 121813 121792 4 12:27 ? 00:03:37 kubelet --fail-swap-on=false --resolv-conf=/etc/resolv.conf --authorization-mode=Webhook --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --v=2 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --make-iptables-util-chains=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --hostname-override= --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-.pem --network-plugin=cni --streaming-connection-idle-timeout=30m --root-dir=/var/lib/kubelet --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --protect-kernel-defaults=true --cloud-provider= --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet--key.pem --cgroups-per-qos=True --cni-bin-dir=/opt/cni/bin --cni-conf-dir=/etc/cni/net.d --pod-infra-container-image=rancher/mirrored-pause:3.5 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --anonymous-auth=false --authentication-token-webhook=true --node-ip= --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --read-only-port=0 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. +--feature-gates=RotateKubeletServerCertificate=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +Clusters provisioned by RKE handles certificate rotation directly through RKE. + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +### 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set TLSCipherSuites: to +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +or to a subset of these values. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the --tls-cipher-suites parameter as follows, or to a subset of these values. +--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present +``` + +## 5.1 RBAC and Service Accounts +### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) + + +**Result:** warn + +**Remediation:** +Identify all clusterrolebindings to the cluster-admin role. Check if they are used and +if they need this role or if they could use a role with fewer privileges. +Where possible, first bind users to a lower privileged role and then remove the +clusterrolebinding to the cluster-admin role : +kubectl delete clusterrolebinding [name] + +### 5.1.2 Minimize access to secrets (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove get, list and watch access to secret objects in the cluster. + +### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) + + +**Result:** warn + +**Remediation:** +Where possible replace any use of wildcards in clusterroles and roles with specific +objects or actions. + +### 5.1.4 Minimize access to create pods (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove create access to pod objects in the cluster. + +### 5.1.5 Ensure that default service accounts are not actively used. (Automated) + + +**Result:** pass + +**Remediation:** +Create explicit service accounts wherever a Kubernetes workload requires specific access +to the Kubernetes API server. +Modify the configuration of each default service account to include this value +automountServiceAccountToken: false + +**Audit Script:** `check_for_default_sa.sh` + +```bash +#!/bin/bash + +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + +count_sa=$(kubectl get serviceaccounts --all-namespaces -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true))' | jq .metadata.namespace | wc -l) +if [[ ${count_sa} -gt 0 ]]; then + echo "false" + exit +fi + +for ns in $(kubectl get ns --no-headers -o custom-columns=":metadata.name") +do + for result in $(kubectl get clusterrolebinding,rolebinding -n $ns -o json | jq -r '.items[] | select((.subjects[].kind=="ServiceAccount" and .subjects[].name=="default") or (.subjects[].kind=="Group" and .subjects[].name=="system:serviceaccounts"))' | jq -r '"\(.roleRef.kind),\(.roleRef.name)"') + do + read kind name <<<$(IFS=","; echo $result) + resource_count=$(kubectl get $kind $name -n $ns -o json | jq -r '.rules[] | select(.resources[] != "podsecuritypolicies")' | wc -l) + if [[ ${resource_count} -gt 0 ]]; then + echo "false" + exit + fi + done +done + + +echo "true" +``` + +**Audit Execution:** + +```bash +./check_for_default_sa.sh +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) + + +**Result:** warn + +**Remediation:** +Modify the definition of pods and service accounts which do not need to mount service +account tokens to disable it. + +## 5.2 Pod Security Policies +### 5.2.1 Minimize the admission of privileged containers (Manual) + + +**Result:** warn + +**Remediation:** +Create a PSP as described in the Kubernetes documentation, ensuring that +the .spec.privileged field is omitted or set to false. + +### 5.2.2 Minimize the admission of containers wishing to share the host process ID namespace (Automated) + + +**Result:** pass + +**Remediation:** +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.hostPID field is omitted or set to false. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or (.spec.hostPID == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +1 is greater than 0 +``` + +**Returned Value**: + +```console +--count=1 +``` + +### 5.2.3 Minimize the admission of containers wishing to share the host IPC namespace (Automated) + + +**Result:** pass + +**Remediation:** +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.hostIPC field is omitted or set to false. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostIPC == null) or (.spec.hostIPC == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +1 is greater than 0 +``` + +**Returned Value**: + +```console +--count=1 +``` + +### 5.2.4 Minimize the admission of containers wishing to share the host network namespace (Automated) + + +**Result:** pass + +**Remediation:** +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.hostNetwork field is omitted or set to false. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostNetwork == null) or (.spec.hostNetwork == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +1 is greater than 0 +``` + +**Returned Value**: + +```console +--count=1 +``` + +### 5.2.5 Minimize the admission of containers with allowPrivilegeEscalation (Automated) + + +**Result:** pass + +**Remediation:** +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.allowPrivilegeEscalation field is omitted or set to false. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +1 is greater than 0 +``` + +**Returned Value**: + +```console +--count=1 +``` + +### 5.2.6 Minimize the admission of root containers (Manual) + + +**Result:** warn + +**Remediation:** +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.runAsUser.rule is set to either MustRunAsNonRoot or MustRunAs with the range of +UIDs not including 0. + +### 5.2.7 Minimize the admission of containers with the NET_RAW capability (Manual) + + +**Result:** warn + +**Remediation:** +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.requiredDropCapabilities is set to include either NET_RAW or ALL. + +### 5.2.8 Minimize the admission of containers with added capabilities (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that allowedCapabilities is not present in PSPs for the cluster unless +it is set to an empty array. + +### 5.2.9 Minimize the admission of containers with capabilities assigned (Manual) + + +**Result:** warn + +**Remediation:** +Review the use of capabilites in applications runnning on your cluster. Where a namespace +contains applicaions which do not require any Linux capabities to operate consider adding +a PSP which forbids the admission of containers which do not drop all capabilities. + +## 5.3 Network Policies and CNI +### 5.3.1 Ensure that the CNI in use supports Network Policies (Manual) + + +**Result:** warn + +**Remediation:** +If the CNI plugin in use does not support network policies, consideration should be given to +making use of a different plugin, or finding an alternate mechanism for restricting traffic +in the Kubernetes cluster. + +### 5.3.2 Ensure that all Namespaces have Network Policies defined (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create NetworkPolicy objects as you need them. + +**Audit Script:** `check_for_network_policies.sh` + +```bash +#!/bin/bash + +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + +for namespace in $(kubectl get namespaces --all-namespaces -o json | jq -r '.items[].metadata.name'); do + policy_count=$(kubectl get networkpolicy -n ${namespace} -o json | jq '.items | length') + if [[ ${policy_count} -eq 0 ]]; then + echo "false" + exit + fi +done + +echo "true" + +``` + +**Audit Execution:** + +```bash +./check_for_network_policies.sh +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +## 5.4 Secrets Management +### 5.4.1 Prefer using secrets as files over secrets as environment variables (Manual) + + +**Result:** warn + +**Remediation:** +if possible, rewrite application code to read secrets from mounted secret files, rather than +from environment variables. + +### 5.4.2 Consider external secret storage (Manual) + + +**Result:** warn + +**Remediation:** +Refer to the secrets management options offered by your cloud provider or a third-party +secrets management solution. + +## 5.5 Extensible Admission Control +### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and setup image provenance. + +## 5.7 General Policies +### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) + + +**Result:** warn + +**Remediation:** +Follow the documentation and create namespaces for objects in your deployment as you need +them. + +### 5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions (Manual) + + +**Result:** warn + +**Remediation:** +Seccomp is an alpha feature currently. By default, all alpha features are disabled. So, you +would need to enable alpha features in the apiserver by passing "--feature- +gates=AllAlpha=true" argument. +Edit the /etc/kubernetes/apiserver file on the master node and set the KUBE_API_ARGS +parameter to "--feature-gates=AllAlpha=true" +KUBE_API_ARGS="--feature-gates=AllAlpha=true" +Based on your system, restart the kube-apiserver service. For example: +systemctl restart kube-apiserver.service +Use annotations to enable the docker/default seccomp profile in your pod definitions. An +example is as below: +apiVersion: v1 +kind: Pod +metadata: + name: trustworthy-pod + annotations: + seccomp.security.alpha.kubernetes.io/pod: docker/default +spec: + containers: + - name: trustworthy-container + image: sotrustworthy:latest + +### 5.7.3 Apply Security Context to Your Pods and Containers (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and apply security contexts to your pods. For a +suggested list of security contexts, you may refer to the CIS Security Benchmark for Docker +Containers. + +### 5.7.4 The default namespace should not be used (Automated) + + +**Result:** pass + +**Remediation:** +Ensure that namespaces are created to allow for appropriate segregation of Kubernetes +resources and that all new resources are created in a specific namespace. + +**Audit Script:** `check_for_default_ns.sh` + +```bash +#!/bin/bash + +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + +count=$(kubectl get all -n default -o json | jq .items[] | jq -r 'select((.metadata.name!="kubernetes"))' | jq .metadata.name | wc -l) +if [[ ${count} -gt 0 ]]; then + echo "false" + exit +fi + +echo "true" + + +``` + +**Audit Execution:** + +```bash +./check_for_default_ns.sh +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf new file mode 100644 index 00000000000..c61b5c4abc1 --- /dev/null +++ b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf @@ -0,0 +1,8259 @@ +%PDF-1.7 +%🖤 +1 0 obj +<< +/Type /Pages +/Kids [ 6 0 R 8 0 R 30 0 R 45 0 R 53 0 R 67 0 R 77 0 R 99 0 R 129 0 R 164 0 R 194 0 R 232 0 R 270 0 R 310 0 R 350 0 R 390 0 R 425 0 R 464 0 R 499 0 R 534 0 R 557 0 R 591 0 R ] +/Count 22 +>> +endobj +2 0 obj +<< +/Title (Hardening Guide with CIS v1.6 Benchmark) +/Creator (pandoc) +/Producer (WeasyPrint 54.2) +>> +endobj +3 0 obj +<< +/Type /Catalog +/Pages 1 0 R +/Outlines 611 0 R +/Names << +/Dests << +/Names [ (TOC) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (cb1) [ 45 0 R /XYZ 84.259843 441.572079 0 ] (cb1-1) [ 45 0 R /XYZ 101.433071 439.875057 0 ] (cb1-2) [ 45 0 R /XYZ 99.933071 420.928036 0 ] (cb1-3) [ 45 0 R /XYZ 99.933071 401.981014 0 ] (cb1-4) [ 45 0 R /XYZ 99.933071 383.033993 0 ] (cb1-5) [ 45 0 R /XYZ 99.933071 364.086971 0 ] (cb10) [ 390 0 R /XYZ 84.259843 416.811778 0 ] (cb10-1) [ 390 0 R /XYZ 101.433071 415.114756 0 ] (cb10-10) [ 390 0 R /XYZ 99.933071 244.591563 0 ] (cb10-100) [ 499 0 R /XYZ 99.933071 590.755821 0 ] (cb10-101) [ 499 0 R /XYZ 99.933071 571.808799 0 ] (cb10-102) [ 499 0 R /XYZ 99.933071 552.861778 0 ] (cb10-103) [ 499 0 R /XYZ 99.933071 533.914756 0 ] (cb10-104) [ 499 0 R /XYZ 99.933071 514.967735 0 ] (cb10-105) [ 499 0 R /XYZ 99.933071 496.020714 0 ] (cb10-106) [ 499 0 R /XYZ 99.933071 477.073692 0 ] (cb10-107) [ 499 0 R /XYZ 99.933071 458.126671 0 ] (cb10-108) [ 499 0 R /XYZ 99.933071 439.179649 0 ] (cb10-109) [ 499 0 R /XYZ 99.933071 420.232628 0 ] (cb10-11) [ 390 0 R /XYZ 99.933071 225.644542 0 ] (cb10-110) [ 499 0 R /XYZ 99.933071 401.285606 0 ] (cb10-111) [ 499 0 R /XYZ 99.933071 382.338585 0 ] (cb10-112) [ 499 0 R /XYZ 99.933071 363.391563 0 ] (cb10-113) [ 499 0 R /XYZ 99.933071 344.444542 0 ] (cb10-114) [ 499 0 R /XYZ 99.933071 325.497520 0 ] (cb10-115) [ 499 0 R /XYZ 99.933071 306.550499 0 ] (cb10-116) [ 499 0 R /XYZ 99.933071 287.603477 0 ] (cb10-117) [ 499 0 R /XYZ 99.933071 173.921348 0 ] (cb10-118) [ 499 0 R /XYZ 99.933071 154.974327 0 ] (cb10-119) [ 499 0 R /XYZ 99.933071 136.027305 0 ] (cb10-12) [ 390 0 R /XYZ 99.933071 206.697520 0 ] (cb10-120) [ 499 0 R /XYZ 99.933071 117.080284 0 ] (cb10-121) [ 499 0 R /XYZ 99.933071 98.133262 0 ] (cb10-122) [ 534 0 R /XYZ 99.933071 799.173057 0 ] (cb10-123) [ 534 0 R /XYZ 99.933071 685.490928 0 ] (cb10-124) [ 534 0 R /XYZ 99.933071 666.543907 0 ] (cb10-125) [ 534 0 R /XYZ 99.933071 647.596885 0 ] (cb10-126) [ 534 0 R /XYZ 99.933071 628.649864 0 ] (cb10-127) [ 534 0 R /XYZ 99.933071 609.702842 0 ] (cb10-128) [ 534 0 R /XYZ 99.933071 590.755821 0 ] (cb10-129) [ 534 0 R /XYZ 99.933071 571.808799 0 ] (cb10-13) [ 390 0 R /XYZ 99.933071 187.750499 0 ] (cb10-14) [ 390 0 R /XYZ 99.933071 168.803477 0 ] (cb10-15) [ 390 0 R /XYZ 99.933071 149.856456 0 ] (cb10-16) [ 390 0 R /XYZ 99.933071 130.909434 0 ] (cb10-17) [ 390 0 R /XYZ 99.933071 111.962413 0 ] (cb10-18) [ 390 0 R /XYZ 99.933071 93.015391 0 ] (cb10-19) [ 425 0 R /XYZ 99.933071 799.173057 0 ] (cb10-2) [ 390 0 R /XYZ 99.933071 396.167735 0 ] (cb10-20) [ 425 0 R /XYZ 99.933071 780.226036 0 ] (cb10-21) [ 425 0 R /XYZ 99.933071 761.279014 0 ] (cb10-22) [ 425 0 R /XYZ 99.933071 742.331993 0 ] (cb10-23) [ 425 0 R /XYZ 99.933071 723.384971 0 ] (cb10-24) [ 425 0 R /XYZ 99.933071 704.437950 0 ] (cb10-25) [ 425 0 R /XYZ 99.933071 685.490928 0 ] (cb10-26) [ 425 0 R /XYZ 99.933071 666.543907 0 ] (cb10-27) [ 425 0 R /XYZ 99.933071 647.596885 0 ] (cb10-28) [ 425 0 R /XYZ 99.933071 628.649864 0 ] (cb10-29) [ 425 0 R /XYZ 99.933071 609.702842 0 ] (cb10-3) [ 390 0 R /XYZ 99.933071 377.220714 0 ] (cb10-30) [ 425 0 R /XYZ 99.933071 571.808799 0 ] (cb10-31) [ 425 0 R /XYZ 99.933071 552.861778 0 ] (cb10-32) [ 425 0 R /XYZ 99.933071 533.914756 0 ] (cb10-33) [ 425 0 R /XYZ 99.933071 514.967735 0 ] (cb10-34) [ 425 0 R /XYZ 99.933071 496.020714 0 ] (cb10-35) [ 425 0 R /XYZ 99.933071 477.073692 0 ] (cb10-36) [ 425 0 R /XYZ 99.933071 458.126671 0 ] (cb10-37) [ 425 0 R /XYZ 99.933071 439.179649 0 ] (cb10-38) [ 425 0 R /XYZ 99.933071 420.232628 0 ] (cb10-39) [ 425 0 R /XYZ 99.933071 401.285606 0 ] (cb10-4) [ 390 0 R /XYZ 99.933071 358.273692 0 ] (cb10-40) [ 425 0 R /XYZ 99.933071 382.338585 0 ] (cb10-41) [ 425 0 R /XYZ 99.933071 363.391563 0 ] (cb10-42) [ 425 0 R /XYZ 99.933071 344.444542 0 ] (cb10-43) [ 425 0 R /XYZ 99.933071 325.497520 0 ] (cb10-44) [ 425 0 R /XYZ 99.933071 306.550499 0 ] (cb10-45) [ 425 0 R /XYZ 99.933071 287.603477 0 ] (cb10-46) [ 425 0 R /XYZ 99.933071 268.656456 0 ] (cb10-47) [ 425 0 R /XYZ 99.933071 249.709434 0 ] (cb10-48) [ 425 0 R /XYZ 99.933071 230.762413 0 ] (cb10-49) [ 425 0 R /XYZ 99.933071 211.815391 0 ] (cb10-5) [ 390 0 R /XYZ 99.933071 339.326671 0 ] (cb10-50) [ 425 0 R /XYZ 99.933071 192.868370 0 ] (cb10-51) [ 425 0 R /XYZ 99.933071 173.921348 0 ] (cb10-52) [ 425 0 R /XYZ 99.933071 154.974327 0 ] (cb10-53) [ 425 0 R /XYZ 99.933071 136.027305 0 ] (cb10-54) [ 425 0 R /XYZ 99.933071 117.080284 0 ] (cb10-55) [ 425 0 R /XYZ 99.933071 98.133262 0 ] (cb10-56) [ 464 0 R /XYZ 99.933071 799.173057 0 ] (cb10-57) [ 464 0 R /XYZ 99.933071 780.226036 0 ] (cb10-58) [ 464 0 R /XYZ 99.933071 761.279014 0 ] (cb10-59) [ 464 0 R /XYZ 99.933071 742.331993 0 ] (cb10-6) [ 390 0 R /XYZ 99.933071 320.379649 0 ] (cb10-60) [ 464 0 R /XYZ 99.933071 723.384971 0 ] (cb10-61) [ 464 0 R /XYZ 99.933071 704.437950 0 ] (cb10-62) [ 464 0 R /XYZ 99.933071 685.490928 0 ] (cb10-63) [ 464 0 R /XYZ 99.933071 666.543907 0 ] (cb10-64) [ 464 0 R /XYZ 99.933071 647.596885 0 ] (cb10-65) [ 464 0 R /XYZ 99.933071 628.649864 0 ] (cb10-66) [ 464 0 R /XYZ 99.933071 609.702842 0 ] (cb10-67) [ 464 0 R /XYZ 99.933071 590.755821 0 ] (cb10-68) [ 464 0 R /XYZ 99.933071 571.808799 0 ] (cb10-69) [ 464 0 R /XYZ 99.933071 552.861778 0 ] (cb10-7) [ 390 0 R /XYZ 99.933071 301.432628 0 ] (cb10-70) [ 464 0 R /XYZ 99.933071 533.914756 0 ] (cb10-71) [ 464 0 R /XYZ 99.933071 514.967735 0 ] (cb10-72) [ 464 0 R /XYZ 99.933071 496.020714 0 ] (cb10-73) [ 464 0 R /XYZ 99.933071 477.073692 0 ] (cb10-74) [ 464 0 R /XYZ 99.933071 458.126671 0 ] (cb10-75) [ 464 0 R /XYZ 99.933071 439.179649 0 ] (cb10-76) [ 464 0 R /XYZ 99.933071 420.232628 0 ] (cb10-77) [ 464 0 R /XYZ 99.933071 401.285606 0 ] (cb10-78) [ 464 0 R /XYZ 99.933071 382.338585 0 ] (cb10-79) [ 464 0 R /XYZ 99.933071 363.391563 0 ] (cb10-8) [ 390 0 R /XYZ 99.933071 282.485606 0 ] (cb10-80) [ 464 0 R /XYZ 99.933071 344.444542 0 ] (cb10-81) [ 464 0 R /XYZ 99.933071 325.497520 0 ] (cb10-82) [ 464 0 R /XYZ 99.933071 306.550499 0 ] (cb10-83) [ 464 0 R /XYZ 99.933071 287.603477 0 ] (cb10-84) [ 464 0 R /XYZ 99.933071 268.656456 0 ] (cb10-85) [ 464 0 R /XYZ 99.933071 249.709434 0 ] (cb10-86) [ 464 0 R /XYZ 99.933071 230.762413 0 ] (cb10-87) [ 464 0 R /XYZ 99.933071 117.080284 0 ] (cb10-88) [ 464 0 R /XYZ 99.933071 98.133262 0 ] (cb10-89) [ 499 0 R /XYZ 99.933071 799.173057 0 ] (cb10-9) [ 390 0 R /XYZ 99.933071 263.538585 0 ] (cb10-90) [ 499 0 R /XYZ 99.933071 780.226036 0 ] (cb10-91) [ 499 0 R /XYZ 99.933071 761.279014 0 ] (cb10-92) [ 499 0 R /XYZ 99.933071 742.331993 0 ] (cb10-93) [ 499 0 R /XYZ 99.933071 723.384971 0 ] (cb10-94) [ 499 0 R /XYZ 99.933071 704.437950 0 ] (cb10-95) [ 499 0 R /XYZ 99.933071 685.490928 0 ] (cb10-96) [ 499 0 R /XYZ 99.933071 666.543907 0 ] (cb10-97) [ 499 0 R /XYZ 99.933071 647.596885 0 ] (cb10-98) [ 499 0 R /XYZ 99.933071 628.649864 0 ] (cb10-99) [ 499 0 R /XYZ 99.933071 609.702842 0 ] (cb11) [ 534 0 R /XYZ 84.259843 331.262799 0 ] (cb11-1) [ 534 0 R /XYZ 101.433071 329.565778 0 ] (cb11-10) [ 534 0 R /XYZ 99.933071 159.042585 0 ] (cb11-11) [ 534 0 R /XYZ 99.933071 140.095563 0 ] (cb11-12) [ 534 0 R /XYZ 99.933071 121.148542 0 ] (cb11-13) [ 534 0 R /XYZ 99.933071 102.201520 0 ] (cb11-14) [ 557 0 R /XYZ 99.933071 799.173057 0 ] (cb11-15) [ 557 0 R /XYZ 99.933071 780.226036 0 ] (cb11-16) [ 557 0 R /XYZ 99.933071 761.279014 0 ] (cb11-17) [ 557 0 R /XYZ 99.933071 742.331993 0 ] (cb11-18) [ 557 0 R /XYZ 99.933071 723.384971 0 ] (cb11-19) [ 557 0 R /XYZ 99.933071 704.437950 0 ] (cb11-2) [ 534 0 R /XYZ 99.933071 310.618756 0 ] (cb11-20) [ 557 0 R /XYZ 99.933071 685.490928 0 ] (cb11-21) [ 557 0 R /XYZ 99.933071 666.543907 0 ] (cb11-22) [ 557 0 R /XYZ 99.933071 647.596885 0 ] (cb11-23) [ 557 0 R /XYZ 99.933071 628.649864 0 ] (cb11-24) [ 557 0 R /XYZ 99.933071 609.702842 0 ] (cb11-25) [ 557 0 R /XYZ 99.933071 590.755821 0 ] (cb11-26) [ 557 0 R /XYZ 99.933071 571.808799 0 ] (cb11-3) [ 534 0 R /XYZ 99.933071 291.671735 0 ] (cb11-4) [ 534 0 R /XYZ 99.933071 272.724714 0 ] (cb11-5) [ 534 0 R /XYZ 99.933071 253.777692 0 ] (cb11-6) [ 534 0 R /XYZ 99.933071 234.830671 0 ] (cb11-7) [ 534 0 R /XYZ 99.933071 215.883649 0 ] (cb11-8) [ 534 0 R /XYZ 99.933071 196.936628 0 ] (cb11-9) [ 534 0 R /XYZ 99.933071 177.989606 0 ] (cb12) [ 557 0 R /XYZ 84.259843 446.115778 0 ] (cb12-1) [ 557 0 R /XYZ 101.433071 444.418756 0 ] (cb12-10) [ 557 0 R /XYZ 99.933071 273.895563 0 ] (cb12-11) [ 557 0 R /XYZ 99.933071 254.948542 0 ] (cb12-12) [ 557 0 R /XYZ 99.933071 236.001520 0 ] (cb12-13) [ 557 0 R /XYZ 99.933071 217.054499 0 ] (cb12-14) [ 557 0 R /XYZ 99.933071 198.107477 0 ] (cb12-15) [ 557 0 R /XYZ 99.933071 179.160456 0 ] (cb12-16) [ 557 0 R /XYZ 99.933071 160.213434 0 ] (cb12-17) [ 557 0 R /XYZ 99.933071 141.266413 0 ] (cb12-18) [ 557 0 R /XYZ 99.933071 122.319391 0 ] (cb12-19) [ 557 0 R /XYZ 99.933071 103.372370 0 ] (cb12-2) [ 557 0 R /XYZ 99.933071 425.471735 0 ] (cb12-20) [ 591 0 R /XYZ 99.933071 780.226036 0 ] (cb12-21) [ 591 0 R /XYZ 99.933071 742.331993 0 ] (cb12-22) [ 591 0 R /XYZ 99.933071 723.384971 0 ] (cb12-23) [ 591 0 R /XYZ 99.933071 704.437950 0 ] (cb12-3) [ 557 0 R /XYZ 99.933071 406.524714 0 ] (cb12-4) [ 557 0 R /XYZ 99.933071 387.577692 0 ] (cb12-5) [ 557 0 R /XYZ 99.933071 368.630671 0 ] (cb12-6) [ 557 0 R /XYZ 99.933071 349.683649 0 ] (cb12-7) [ 557 0 R /XYZ 99.933071 330.736628 0 ] (cb12-8) [ 557 0 R /XYZ 99.933071 311.789606 0 ] (cb12-9) [ 557 0 R /XYZ 99.933071 292.842585 0 ] (cb2) [ 53 0 R /XYZ 84.259843 753.620079 0 ] (cb2-1) [ 53 0 R /XYZ 101.433071 751.923057 0 ] (cb2-2) [ 53 0 R /XYZ 99.933071 732.976036 0 ] (cb3) [ 53 0 R /XYZ 84.259843 654.779014 0 ] (cb3-1) [ 53 0 R /XYZ 101.433071 653.081993 0 ] (cb3-2) [ 53 0 R /XYZ 99.933071 634.134971 0 ] (cb3-3) [ 53 0 R /XYZ 99.933071 615.187950 0 ] (cb3-4) [ 53 0 R /XYZ 99.933071 596.240928 0 ] (cb4) [ 53 0 R /XYZ 84.259843 282.344928 0 ] (cb4-1) [ 53 0 R /XYZ 101.433071 280.647907 0 ] (cb5) [ 53 0 R /XYZ 84.259843 217.647907 0 ] (cb5-1) [ 53 0 R /XYZ 101.433071 215.950885 0 ] (cb5-2) [ 53 0 R /XYZ 99.933071 197.003864 0 ] (cb5-3) [ 53 0 R /XYZ 99.933071 178.056842 0 ] (cb5-4) [ 53 0 R /XYZ 99.933071 159.109821 0 ] (cb5-5) [ 53 0 R /XYZ 99.933071 140.162799 0 ] (cb6) [ 67 0 R /XYZ 84.259843 749.870079 0 ] (cb6-1) [ 67 0 R /XYZ 101.433071 748.173057 0 ] (cb6-2) [ 67 0 R /XYZ 99.933071 729.226036 0 ] (cb6-3) [ 67 0 R /XYZ 99.933071 710.279014 0 ] (cb6-4) [ 67 0 R /XYZ 99.933071 672.384971 0 ] (cb6-5) [ 67 0 R /XYZ 99.933071 634.490928 0 ] (cb7) [ 77 0 R /XYZ 84.259843 716.781496 0 ] (cb7-1) [ 77 0 R /XYZ 101.433071 715.084475 0 ] (cb7-10) [ 77 0 R /XYZ 99.933071 544.561281 0 ] (cb7-11) [ 77 0 R /XYZ 99.933071 525.614260 0 ] (cb7-12) [ 77 0 R /XYZ 99.933071 506.667238 0 ] (cb7-13) [ 77 0 R /XYZ 99.933071 487.720217 0 ] (cb7-14) [ 77 0 R /XYZ 99.933071 468.773195 0 ] (cb7-2) [ 77 0 R /XYZ 99.933071 696.137453 0 ] (cb7-3) [ 77 0 R /XYZ 99.933071 677.190432 0 ] (cb7-4) [ 77 0 R /XYZ 99.933071 658.243410 0 ] (cb7-5) [ 77 0 R /XYZ 99.933071 639.296389 0 ] (cb7-6) [ 77 0 R /XYZ 99.933071 620.349367 0 ] (cb7-7) [ 77 0 R /XYZ 99.933071 601.402346 0 ] (cb7-8) [ 77 0 R /XYZ 99.933071 582.455324 0 ] (cb7-9) [ 77 0 R /XYZ 99.933071 563.508303 0 ] (cb8) [ 77 0 R /XYZ 84.259843 372.023195 0 ] (cb8-1) [ 77 0 R /XYZ 101.433071 370.326174 0 ] (cb8-2) [ 77 0 R /XYZ 99.933071 351.379152 0 ] (cb8-3) [ 77 0 R /XYZ 99.933071 332.432131 0 ] (cb8-4) [ 77 0 R /XYZ 99.933071 294.538088 0 ] (cb8-5) [ 77 0 R /XYZ 99.933071 275.591066 0 ] (cb9) [ 99 0 R /XYZ 84.259843 652.281496 0 ] (cb9-1) [ 99 0 R /XYZ 101.433071 650.584475 0 ] (cb9-10) [ 99 0 R /XYZ 99.933071 423.220217 0 ] (cb9-100) [ 194 0 R /XYZ 99.933071 590.755821 0 ] (cb9-101) [ 194 0 R /XYZ 99.933071 571.808799 0 ] (cb9-102) [ 194 0 R /XYZ 99.933071 552.861778 0 ] (cb9-103) [ 194 0 R /XYZ 99.933071 533.914756 0 ] (cb9-104) [ 194 0 R /XYZ 99.933071 514.967735 0 ] (cb9-105) [ 194 0 R /XYZ 99.933071 496.020714 0 ] (cb9-106) [ 194 0 R /XYZ 99.933071 477.073692 0 ] (cb9-107) [ 194 0 R /XYZ 99.933071 458.126671 0 ] (cb9-108) [ 194 0 R /XYZ 99.933071 439.179649 0 ] (cb9-109) [ 194 0 R /XYZ 99.933071 420.232628 0 ] (cb9-11) [ 99 0 R /XYZ 99.933071 404.273195 0 ] (cb9-110) [ 194 0 R /XYZ 99.933071 401.285606 0 ] (cb9-111) [ 194 0 R /XYZ 99.933071 344.444542 0 ] (cb9-112) [ 194 0 R /XYZ 99.933071 325.497520 0 ] (cb9-113) [ 194 0 R /XYZ 99.933071 306.550499 0 ] (cb9-114) [ 194 0 R /XYZ 99.933071 287.603477 0 ] (cb9-115) [ 194 0 R /XYZ 99.933071 268.656456 0 ] (cb9-116) [ 194 0 R /XYZ 99.933071 249.709434 0 ] (cb9-117) [ 194 0 R /XYZ 99.933071 230.762413 0 ] (cb9-118) [ 194 0 R /XYZ 99.933071 211.815391 0 ] (cb9-119) [ 194 0 R /XYZ 99.933071 192.868370 0 ] (cb9-12) [ 99 0 R /XYZ 99.933071 385.326174 0 ] (cb9-120) [ 194 0 R /XYZ 99.933071 173.921348 0 ] (cb9-121) [ 194 0 R /XYZ 99.933071 154.974327 0 ] (cb9-122) [ 194 0 R /XYZ 99.933071 136.027305 0 ] (cb9-123) [ 194 0 R /XYZ 99.933071 117.080284 0 ] (cb9-124) [ 194 0 R /XYZ 99.933071 98.133262 0 ] (cb9-125) [ 232 0 R /XYZ 99.933071 799.173057 0 ] (cb9-126) [ 232 0 R /XYZ 99.933071 780.226036 0 ] (cb9-127) [ 232 0 R /XYZ 99.933071 761.279014 0 ] (cb9-128) [ 232 0 R /XYZ 99.933071 742.331993 0 ] (cb9-129) [ 232 0 R /XYZ 99.933071 704.437950 0 ] (cb9-13) [ 99 0 R /XYZ 99.933071 366.379152 0 ] (cb9-130) [ 232 0 R /XYZ 99.933071 685.490928 0 ] (cb9-131) [ 232 0 R /XYZ 99.933071 666.543907 0 ] (cb9-132) [ 232 0 R /XYZ 99.933071 647.596885 0 ] (cb9-133) [ 232 0 R /XYZ 99.933071 628.649864 0 ] (cb9-134) [ 232 0 R /XYZ 99.933071 609.702842 0 ] (cb9-135) [ 232 0 R /XYZ 99.933071 590.755821 0 ] (cb9-136) [ 232 0 R /XYZ 99.933071 571.808799 0 ] (cb9-137) [ 232 0 R /XYZ 99.933071 552.861778 0 ] (cb9-138) [ 232 0 R /XYZ 99.933071 533.914756 0 ] (cb9-139) [ 232 0 R /XYZ 99.933071 514.967735 0 ] (cb9-14) [ 99 0 R /XYZ 99.933071 347.432131 0 ] (cb9-140) [ 232 0 R /XYZ 99.933071 477.073692 0 ] (cb9-141) [ 232 0 R /XYZ 99.933071 458.126671 0 ] (cb9-142) [ 232 0 R /XYZ 99.933071 439.179649 0 ] (cb9-143) [ 232 0 R /XYZ 99.933071 420.232628 0 ] (cb9-144) [ 232 0 R /XYZ 99.933071 401.285606 0 ] (cb9-145) [ 232 0 R /XYZ 99.933071 382.338585 0 ] (cb9-146) [ 232 0 R /XYZ 99.933071 363.391563 0 ] (cb9-147) [ 232 0 R /XYZ 99.933071 344.444542 0 ] (cb9-148) [ 232 0 R /XYZ 99.933071 325.497520 0 ] (cb9-149) [ 232 0 R /XYZ 99.933071 306.550499 0 ] (cb9-15) [ 99 0 R /XYZ 99.933071 328.485109 0 ] (cb9-150) [ 232 0 R /XYZ 99.933071 287.603477 0 ] (cb9-151) [ 232 0 R /XYZ 99.933071 268.656456 0 ] (cb9-152) [ 232 0 R /XYZ 99.933071 249.709434 0 ] (cb9-153) [ 232 0 R /XYZ 99.933071 230.762413 0 ] (cb9-154) [ 232 0 R /XYZ 99.933071 211.815391 0 ] (cb9-155) [ 232 0 R /XYZ 99.933071 192.868370 0 ] (cb9-156) [ 232 0 R /XYZ 99.933071 173.921348 0 ] (cb9-157) [ 232 0 R /XYZ 99.933071 154.974327 0 ] (cb9-158) [ 232 0 R /XYZ 99.933071 136.027305 0 ] (cb9-159) [ 232 0 R /XYZ 99.933071 117.080284 0 ] (cb9-16) [ 99 0 R /XYZ 99.933071 309.538088 0 ] (cb9-160) [ 232 0 R /XYZ 99.933071 98.133262 0 ] (cb9-161) [ 270 0 R /XYZ 99.933071 799.173057 0 ] (cb9-162) [ 270 0 R /XYZ 99.933071 780.226036 0 ] (cb9-163) [ 270 0 R /XYZ 99.933071 761.279014 0 ] (cb9-164) [ 270 0 R /XYZ 99.933071 742.331993 0 ] (cb9-165) [ 270 0 R /XYZ 99.933071 723.384971 0 ] (cb9-166) [ 270 0 R /XYZ 99.933071 704.437950 0 ] (cb9-167) [ 270 0 R /XYZ 99.933071 685.490928 0 ] (cb9-168) [ 270 0 R /XYZ 99.933071 666.543907 0 ] (cb9-169) [ 270 0 R /XYZ 99.933071 647.596885 0 ] (cb9-17) [ 99 0 R /XYZ 99.933071 290.591066 0 ] (cb9-170) [ 270 0 R /XYZ 99.933071 628.649864 0 ] (cb9-171) [ 270 0 R /XYZ 99.933071 609.702842 0 ] (cb9-172) [ 270 0 R /XYZ 99.933071 590.755821 0 ] (cb9-173) [ 270 0 R /XYZ 99.933071 571.808799 0 ] (cb9-174) [ 270 0 R /XYZ 99.933071 552.861778 0 ] (cb9-175) [ 270 0 R /XYZ 99.933071 533.914756 0 ] (cb9-176) [ 270 0 R /XYZ 99.933071 514.967735 0 ] (cb9-177) [ 270 0 R /XYZ 99.933071 496.020714 0 ] (cb9-178) [ 270 0 R /XYZ 99.933071 477.073692 0 ] (cb9-179) [ 270 0 R /XYZ 99.933071 458.126671 0 ] (cb9-18) [ 99 0 R /XYZ 99.933071 271.644045 0 ] (cb9-180) [ 270 0 R /XYZ 99.933071 439.179649 0 ] (cb9-181) [ 270 0 R /XYZ 99.933071 420.232628 0 ] (cb9-182) [ 270 0 R /XYZ 99.933071 401.285606 0 ] (cb9-183) [ 270 0 R /XYZ 99.933071 382.338585 0 ] (cb9-184) [ 270 0 R /XYZ 99.933071 363.391563 0 ] (cb9-185) [ 270 0 R /XYZ 99.933071 344.444542 0 ] (cb9-186) [ 270 0 R /XYZ 99.933071 325.497520 0 ] (cb9-187) [ 270 0 R /XYZ 99.933071 306.550499 0 ] (cb9-188) [ 270 0 R /XYZ 99.933071 287.603477 0 ] (cb9-189) [ 270 0 R /XYZ 99.933071 268.656456 0 ] (cb9-19) [ 99 0 R /XYZ 99.933071 252.697023 0 ] (cb9-190) [ 270 0 R /XYZ 99.933071 249.709434 0 ] (cb9-191) [ 270 0 R /XYZ 99.933071 230.762413 0 ] (cb9-192) [ 270 0 R /XYZ 99.933071 211.815391 0 ] (cb9-193) [ 270 0 R /XYZ 99.933071 192.868370 0 ] (cb9-194) [ 270 0 R /XYZ 99.933071 173.921348 0 ] (cb9-195) [ 270 0 R /XYZ 99.933071 154.974327 0 ] (cb9-196) [ 270 0 R /XYZ 99.933071 136.027305 0 ] (cb9-197) [ 270 0 R /XYZ 99.933071 117.080284 0 ] (cb9-198) [ 270 0 R /XYZ 99.933071 98.133262 0 ] (cb9-199) [ 310 0 R /XYZ 99.933071 799.173057 0 ] (cb9-2) [ 99 0 R /XYZ 99.933071 612.690432 0 ] (cb9-20) [ 99 0 R /XYZ 99.933071 233.750002 0 ] (cb9-200) [ 310 0 R /XYZ 99.933071 780.226036 0 ] (cb9-201) [ 310 0 R /XYZ 99.933071 761.279014 0 ] (cb9-202) [ 310 0 R /XYZ 99.933071 742.331993 0 ] (cb9-203) [ 310 0 R /XYZ 99.933071 723.384971 0 ] (cb9-204) [ 310 0 R /XYZ 99.933071 704.437950 0 ] (cb9-205) [ 310 0 R /XYZ 99.933071 685.490928 0 ] (cb9-206) [ 310 0 R /XYZ 99.933071 666.543907 0 ] (cb9-207) [ 310 0 R /XYZ 99.933071 647.596885 0 ] (cb9-208) [ 310 0 R /XYZ 99.933071 628.649864 0 ] (cb9-209) [ 310 0 R /XYZ 99.933071 609.702842 0 ] (cb9-21) [ 99 0 R /XYZ 99.933071 214.802980 0 ] (cb9-210) [ 310 0 R /XYZ 99.933071 590.755821 0 ] (cb9-211) [ 310 0 R /XYZ 99.933071 571.808799 0 ] (cb9-212) [ 310 0 R /XYZ 99.933071 552.861778 0 ] (cb9-213) [ 310 0 R /XYZ 99.933071 533.914756 0 ] (cb9-214) [ 310 0 R /XYZ 99.933071 514.967735 0 ] (cb9-215) [ 310 0 R /XYZ 99.933071 496.020714 0 ] (cb9-216) [ 310 0 R /XYZ 99.933071 477.073692 0 ] (cb9-217) [ 310 0 R /XYZ 99.933071 458.126671 0 ] (cb9-218) [ 310 0 R /XYZ 99.933071 439.179649 0 ] (cb9-219) [ 310 0 R /XYZ 99.933071 420.232628 0 ] (cb9-22) [ 99 0 R /XYZ 99.933071 195.855959 0 ] (cb9-220) [ 310 0 R /XYZ 99.933071 401.285606 0 ] (cb9-221) [ 310 0 R /XYZ 99.933071 382.338585 0 ] (cb9-222) [ 310 0 R /XYZ 99.933071 363.391563 0 ] (cb9-223) [ 310 0 R /XYZ 99.933071 344.444542 0 ] (cb9-224) [ 310 0 R /XYZ 99.933071 325.497520 0 ] (cb9-225) [ 310 0 R /XYZ 99.933071 306.550499 0 ] (cb9-226) [ 310 0 R /XYZ 99.933071 287.603477 0 ] (cb9-227) [ 310 0 R /XYZ 99.933071 268.656456 0 ] (cb9-228) [ 310 0 R /XYZ 99.933071 249.709434 0 ] (cb9-229) [ 310 0 R /XYZ 99.933071 230.762413 0 ] (cb9-23) [ 99 0 R /XYZ 99.933071 176.908937 0 ] (cb9-230) [ 310 0 R /XYZ 99.933071 211.815391 0 ] (cb9-231) [ 310 0 R /XYZ 99.933071 192.868370 0 ] (cb9-232) [ 310 0 R /XYZ 99.933071 173.921348 0 ] (cb9-233) [ 310 0 R /XYZ 99.933071 154.974327 0 ] (cb9-234) [ 310 0 R /XYZ 99.933071 136.027305 0 ] (cb9-235) [ 310 0 R /XYZ 99.933071 117.080284 0 ] (cb9-236) [ 310 0 R /XYZ 99.933071 98.133262 0 ] (cb9-237) [ 350 0 R /XYZ 99.933071 799.173057 0 ] (cb9-238) [ 350 0 R /XYZ 99.933071 780.226036 0 ] (cb9-239) [ 350 0 R /XYZ 99.933071 761.279014 0 ] (cb9-24) [ 99 0 R /XYZ 99.933071 157.961916 0 ] (cb9-240) [ 350 0 R /XYZ 99.933071 742.331993 0 ] (cb9-241) [ 350 0 R /XYZ 99.933071 723.384971 0 ] (cb9-242) [ 350 0 R /XYZ 99.933071 704.437950 0 ] (cb9-243) [ 350 0 R /XYZ 99.933071 685.490928 0 ] (cb9-244) [ 350 0 R /XYZ 99.933071 666.543907 0 ] (cb9-245) [ 350 0 R /XYZ 99.933071 647.596885 0 ] (cb9-246) [ 350 0 R /XYZ 99.933071 628.649864 0 ] (cb9-247) [ 350 0 R /XYZ 99.933071 609.702842 0 ] (cb9-248) [ 350 0 R /XYZ 99.933071 590.755821 0 ] (cb9-249) [ 350 0 R /XYZ 99.933071 571.808799 0 ] (cb9-25) [ 99 0 R /XYZ 99.933071 139.014895 0 ] (cb9-250) [ 350 0 R /XYZ 99.933071 552.861778 0 ] (cb9-251) [ 350 0 R /XYZ 99.933071 533.914756 0 ] (cb9-252) [ 350 0 R /XYZ 99.933071 514.967735 0 ] (cb9-253) [ 350 0 R /XYZ 99.933071 496.020714 0 ] (cb9-254) [ 350 0 R /XYZ 99.933071 477.073692 0 ] (cb9-255) [ 350 0 R /XYZ 99.933071 458.126671 0 ] (cb9-256) [ 350 0 R /XYZ 99.933071 439.179649 0 ] (cb9-257) [ 350 0 R /XYZ 99.933071 420.232628 0 ] (cb9-258) [ 350 0 R /XYZ 99.933071 401.285606 0 ] (cb9-259) [ 350 0 R /XYZ 99.933071 382.338585 0 ] (cb9-26) [ 99 0 R /XYZ 99.933071 120.067873 0 ] (cb9-260) [ 350 0 R /XYZ 99.933071 363.391563 0 ] (cb9-261) [ 350 0 R /XYZ 99.933071 344.444542 0 ] (cb9-262) [ 350 0 R /XYZ 99.933071 325.497520 0 ] (cb9-263) [ 350 0 R /XYZ 99.933071 306.550499 0 ] (cb9-264) [ 350 0 R /XYZ 99.933071 287.603477 0 ] (cb9-265) [ 350 0 R /XYZ 99.933071 268.656456 0 ] (cb9-266) [ 350 0 R /XYZ 99.933071 249.709434 0 ] (cb9-267) [ 350 0 R /XYZ 99.933071 230.762413 0 ] (cb9-268) [ 350 0 R /XYZ 99.933071 211.815391 0 ] (cb9-269) [ 350 0 R /XYZ 99.933071 192.868370 0 ] (cb9-27) [ 99 0 R /XYZ 99.933071 101.120852 0 ] (cb9-270) [ 350 0 R /XYZ 99.933071 173.921348 0 ] (cb9-271) [ 350 0 R /XYZ 99.933071 154.974327 0 ] (cb9-272) [ 350 0 R /XYZ 99.933071 136.027305 0 ] (cb9-273) [ 350 0 R /XYZ 99.933071 117.080284 0 ] (cb9-274) [ 350 0 R /XYZ 99.933071 98.133262 0 ] (cb9-275) [ 390 0 R /XYZ 99.933071 799.173057 0 ] (cb9-276) [ 390 0 R /XYZ 99.933071 780.226036 0 ] (cb9-277) [ 390 0 R /XYZ 99.933071 761.279014 0 ] (cb9-278) [ 390 0 R /XYZ 99.933071 742.331993 0 ] (cb9-279) [ 390 0 R /XYZ 99.933071 723.384971 0 ] (cb9-28) [ 129 0 R /XYZ 99.933071 799.173057 0 ] (cb9-280) [ 390 0 R /XYZ 99.933071 704.437950 0 ] (cb9-281) [ 390 0 R /XYZ 99.933071 685.490928 0 ] (cb9-282) [ 390 0 R /XYZ 99.933071 666.543907 0 ] (cb9-283) [ 390 0 R /XYZ 99.933071 647.596885 0 ] (cb9-284) [ 390 0 R /XYZ 99.933071 628.649864 0 ] (cb9-285) [ 390 0 R /XYZ 99.933071 609.702842 0 ] (cb9-286) [ 390 0 R /XYZ 99.933071 590.755821 0 ] (cb9-287) [ 390 0 R /XYZ 99.933071 571.808799 0 ] (cb9-288) [ 390 0 R /XYZ 99.933071 552.861778 0 ] (cb9-29) [ 129 0 R /XYZ 99.933071 780.226036 0 ] (cb9-3) [ 99 0 R /XYZ 99.933071 574.796389 0 ] (cb9-30) [ 129 0 R /XYZ 99.933071 761.279014 0 ] (cb9-31) [ 129 0 R /XYZ 99.933071 742.331993 0 ] (cb9-32) [ 129 0 R /XYZ 99.933071 723.384971 0 ] (cb9-33) [ 129 0 R /XYZ 99.933071 704.437950 0 ] (cb9-34) [ 129 0 R /XYZ 99.933071 685.490928 0 ] (cb9-35) [ 129 0 R /XYZ 99.933071 666.543907 0 ] (cb9-36) [ 129 0 R /XYZ 99.933071 647.596885 0 ] (cb9-37) [ 129 0 R /XYZ 99.933071 628.649864 0 ] (cb9-38) [ 129 0 R /XYZ 99.933071 609.702842 0 ] (cb9-39) [ 129 0 R /XYZ 99.933071 590.755821 0 ] (cb9-4) [ 99 0 R /XYZ 99.933071 555.849367 0 ] (cb9-40) [ 129 0 R /XYZ 99.933071 571.808799 0 ] (cb9-41) [ 129 0 R /XYZ 99.933071 552.861778 0 ] (cb9-42) [ 129 0 R /XYZ 99.933071 533.914756 0 ] (cb9-43) [ 129 0 R /XYZ 99.933071 514.967735 0 ] (cb9-44) [ 129 0 R /XYZ 99.933071 496.020714 0 ] (cb9-45) [ 129 0 R /XYZ 99.933071 477.073692 0 ] (cb9-46) [ 129 0 R /XYZ 99.933071 458.126671 0 ] (cb9-47) [ 129 0 R /XYZ 99.933071 439.179649 0 ] (cb9-48) [ 129 0 R /XYZ 99.933071 420.232628 0 ] (cb9-49) [ 129 0 R /XYZ 99.933071 401.285606 0 ] (cb9-5) [ 99 0 R /XYZ 99.933071 536.902346 0 ] (cb9-50) [ 129 0 R /XYZ 99.933071 382.338585 0 ] (cb9-51) [ 129 0 R /XYZ 99.933071 363.391563 0 ] (cb9-52) [ 129 0 R /XYZ 99.933071 344.444542 0 ] (cb9-53) [ 129 0 R /XYZ 99.933071 325.497520 0 ] (cb9-54) [ 129 0 R /XYZ 99.933071 306.550499 0 ] (cb9-55) [ 129 0 R /XYZ 99.933071 287.603477 0 ] (cb9-56) [ 129 0 R /XYZ 99.933071 173.921348 0 ] (cb9-57) [ 129 0 R /XYZ 99.933071 154.974327 0 ] (cb9-58) [ 129 0 R /XYZ 99.933071 136.027305 0 ] (cb9-59) [ 129 0 R /XYZ 99.933071 117.080284 0 ] (cb9-6) [ 99 0 R /XYZ 99.933071 499.008303 0 ] (cb9-60) [ 129 0 R /XYZ 99.933071 98.133262 0 ] (cb9-61) [ 164 0 R /XYZ 99.933071 799.173057 0 ] (cb9-62) [ 164 0 R /XYZ 99.933071 780.226036 0 ] (cb9-63) [ 164 0 R /XYZ 99.933071 761.279014 0 ] (cb9-64) [ 164 0 R /XYZ 99.933071 742.331993 0 ] (cb9-65) [ 164 0 R /XYZ 99.933071 723.384971 0 ] (cb9-66) [ 164 0 R /XYZ 99.933071 704.437950 0 ] (cb9-67) [ 164 0 R /XYZ 99.933071 685.490928 0 ] (cb9-68) [ 164 0 R /XYZ 99.933071 571.808799 0 ] (cb9-69) [ 164 0 R /XYZ 99.933071 552.861778 0 ] (cb9-7) [ 99 0 R /XYZ 99.933071 480.061281 0 ] (cb9-70) [ 164 0 R /XYZ 99.933071 533.914756 0 ] (cb9-71) [ 164 0 R /XYZ 99.933071 514.967735 0 ] (cb9-72) [ 164 0 R /XYZ 99.933071 496.020714 0 ] (cb9-73) [ 164 0 R /XYZ 99.933071 477.073692 0 ] (cb9-74) [ 164 0 R /XYZ 99.933071 458.126671 0 ] (cb9-75) [ 164 0 R /XYZ 99.933071 439.179649 0 ] (cb9-76) [ 164 0 R /XYZ 99.933071 420.232628 0 ] (cb9-77) [ 164 0 R /XYZ 99.933071 401.285606 0 ] (cb9-78) [ 164 0 R /XYZ 99.933071 382.338585 0 ] (cb9-79) [ 164 0 R /XYZ 99.933071 363.391563 0 ] (cb9-8) [ 99 0 R /XYZ 99.933071 461.114260 0 ] (cb9-80) [ 164 0 R /XYZ 99.933071 249.709434 0 ] (cb9-81) [ 164 0 R /XYZ 99.933071 230.762413 0 ] (cb9-82) [ 164 0 R /XYZ 99.933071 211.815391 0 ] (cb9-83) [ 164 0 R /XYZ 99.933071 192.868370 0 ] (cb9-84) [ 164 0 R /XYZ 99.933071 173.921348 0 ] (cb9-85) [ 164 0 R /XYZ 99.933071 154.974327 0 ] (cb9-86) [ 164 0 R /XYZ 99.933071 136.027305 0 ] (cb9-87) [ 164 0 R /XYZ 99.933071 117.080284 0 ] (cb9-88) [ 164 0 R /XYZ 99.933071 98.133262 0 ] (cb9-89) [ 194 0 R /XYZ 99.933071 799.173057 0 ] (cb9-9) [ 99 0 R /XYZ 99.933071 442.167238 0 ] (cb9-90) [ 194 0 R /XYZ 99.933071 780.226036 0 ] (cb9-91) [ 194 0 R /XYZ 99.933071 761.279014 0 ] (cb9-92) [ 194 0 R /XYZ 99.933071 742.331993 0 ] (cb9-93) [ 194 0 R /XYZ 99.933071 723.384971 0 ] (cb9-94) [ 194 0 R /XYZ 99.933071 704.437950 0 ] (cb9-95) [ 194 0 R /XYZ 99.933071 685.490928 0 ] (cb9-96) [ 194 0 R /XYZ 99.933071 666.543907 0 ] (cb9-97) [ 194 0 R /XYZ 99.933071 647.596885 0 ] (cb9-98) [ 194 0 R /XYZ 99.933071 628.649864 0 ] (cb9-99) [ 194 0 R /XYZ 99.933071 609.702842 0 ] (configure-default-service-account) [ 53 0 R /XYZ 84.259843 561.590928 0 ] (configure-etcd-user-and-group) [ 45 0 R /XYZ 84.259843 283.686971 0 ] (configure-kernel-runtime-parameters) [ 45 0 R /XYZ 84.259843 539.222079 0 ] (configure-network-policy) [ 67 0 R /XYZ 84.259843 599.840928 0 ] (contentsbox) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (create-etcd-user-and-group) [ 45 0 R /XYZ 84.259843 169.788971 0 ] (ensure-that-all-namespaces-have-network-policies-defined) [ 67 0 R /XYZ 84.259843 564.092928 0 ] (header_bottom_text) [ 6 0 R /XYZ 85.009843 422.718898 0 ] (known-issues) [ 45 0 R /XYZ 84.259843 799.370079 0 ] (overview) [ 30 0 R /XYZ 84.259843 272.631496 0 ] (reference-hardened-cloud-config-configuration) [ 534 0 R /XYZ 84.259843 537.158799 0 ] (reference-hardened-cloud-config-for-red-hat-enterprise-linux-8-rhel-8-and-ubuntu-20.04-lts) [ 557 0 R /XYZ 84.259843 511.863778 0 ] (reference-hardened-cloud-config-for-suse-linux-enterprise-server-15-sles-15-and-opensuse-leap-15) [ 534 0 R /XYZ 84.259843 397.010799 0 ] (reference-hardened-rke-cluster.yml-configuration) [ 77 0 R /XYZ 84.259843 191.441066 0 ] (reference-hardened-rke-template-configuration) [ 390 0 R /XYZ 84.259843 518.211778 0 ] (set-automountserviceaccounttoken-to-false-for-default-service-accounts) [ 53 0 R /XYZ 84.259843 522.092928 0 ] (title-block-header) [ 6 0 R /XYZ 84.259843 502.818898 0 ] ] +>> +>> +>> +endobj +4 0 obj +<< +/ExtGState << +/a1.0 << +/ca 1 +>> +/A1.0 << +/CA 1 +>> +>> +/XObject << +>> +/Pattern << +>> +/Shading << +>> +/Font 632 0 R +>> +endobj +5 0 obj +<< +/Filter /FlateDecode +/Length 2578 +>> +stream +xˎd 602%R^8 ;0 dad1.'8~~*]럋IDHGRU,x{Η7' 5 ~wCw|b5؊.j˩ ^4ϧ|v5Bk%|Ǯ2 kLT *JT9ZS.DUb#T0#WK0Úg Q`Fј +fĖ+QE1P 3MDs(t)-5ŚN5j1Gk &2lLze[PlI^*lIFt[]NuEDkrs3kЉW%!0]!7갣H]-Er:ؒU)l1ZnM}whd [RFu +lZBc@5XK \9@VeH-+2DRd P- +#FbعT[c&؂%2(hknMZd,P$pa0(^@\Rc,P0WNt+cKb,P`W cjQ UŕT[cX`Fb%jJHX`nr1wSEݔ,r)Kb,0p7Y*p] $t%e,BBZXȞBV 2Gu-Ċ'b) TX]  2ݘ0dpyCf,;-DR]  2 ,%D P] pXAXP]XP]ɪCCuE=1 ۖi$AHtD0Ӂ"1pMƂR 9c ȂcAq XP@J@;3T YT[cд9cAMESb, e`,@FZDMwd YfXPsA=YeWX jP PKǦg,CO `t j-*E2sI6c2]bd,[ 2xrTE QKbΤיXVBO MPiT[ O/3c(sh6Mg,p-Ic|כ lAXФ&3Љ071`_z +Mxd6-ެ`KFBuIS#LB :1]-cA+כX4&2zz$ެ db:pia,@&2[V +3^q:=17##{*=3HfBO VB E>fL>GTP3l~|췟OF=O'ej֥\ov~~\?$s;Qeц2=cb7 }᧞<<||tU_- }F8OTOoN}_bO?BEhc9m]n_}?U>uy~}e?" $ȴ|70f\'wqQ_7u~:q'L+W*ؑ{,'.ږKF+w}'ŗ*_O q0 ȋ/W}[Dzo;UIMX[:hvYRcz1!+|\zӥָ{, 6>"lƞ\ϲ#`bl`@\HqʼJBv9ExZ{޶ys-IYqY1Hhu_LGqzAx`zki +6놶]7\~PU6a~6'^?̩+K8Mߧ.n?-՗g*PVcvL7ڔs.u"ˉ_ɸa1~[_>f6DJץm2ex";&mW`57Ax9!)W;/VH u,YR䟷 WT)9ޠ(jf }oN$2clwX} ߡ;{nSkuHMx܋)3Y e8OW~/;ܪY`%n}Lv>:W҈ԥf[[7[mw?y{u\҉)}ޥtKh9zy {t&9kknR_:}PAGLlޱ1-;:s%e鼯ʜļJy;"̖t&@yw纞NVϙK:)Sql{D )+3uY~IClX:N00D7XoGq> +endobj +7 0 obj +<< +/Filter /FlateDecode +/Length 3519 +>> +stream +xMo$+l`e #6@ +!?Ş&iRZ$]k=d%(N?5[Oj^џ8n&zbN-'j]p>~/uźoN'iz|2U'Y|XC6Y˧hZC//m!5+Yk:x HA 2tkX'p$ :(ͅZ}Gm'CX-=H/?Vb<8JĵNj٣P6 ]ȑ[-eֱd'U3yզzDy2]XQ"zyPzH}&D-'< :fb":uED'r3Dt"FQ|FwDt":}n}DY(f_EQ? $%#\tT!ʷYiɵ5TQ DAP=6 ]F#Տ,iLCy.J&ረ̃`QKtQСPE F="ʑhQ ND'DobCgDщD݉Dt"j](E(׈Za7 '.rs KDW$ nG +?4X0&Gۦ`y#Տ7&[!;Bw":F7>Kػ(DQ:7@S-+>TQ DAP6ΣGD9Rx˒d< + dꎈJ @tˤM$p, Hp =>/?D4΍!(TM7x0=rd;Bw":F7>KꯢMII)u+M$p, vn4] +:jѶ3~eIcECuQ2HU p|;C!<% *y0bnT?/@F0@w"db":ZT *z.F:#ND'ohotGND'W:_EY(_EQF48NIGO10#\.vn"chGC[ 1qt%)vn GZm:<9Rx~cECuQ2HU #!n I"4{ȃActC~ <cE!щDע}h":};ND_t]֟>takX7K:$]OGo?|ӏ[PJ?s;_44_dԙ;2W/9-mH5dzE+(Y_wm:%۰KՐnB+s9ǐu]R?`טG/Bh +Pn?^Xϡj.'SDĢ՟Ab za΍<¼VXM9K.;sc$vBpR%Eu2T8@gdLpkXzBj;Uf 'I,aeǸ +=.?_Tt~IGDOmH,y1{#]~EgWS,0'/-ϻwܯ*+ {a2Ly=<[̷-/^s[ou*mK} +}tR~򉊕6UqYYt'x*$S㫷epa3\[IjڶcqoNTkL.H&gZG.WE_f6CWMmjiތ6_GS4|iߔb8tfG>ȔVjId۲A>IY[? +ܱLִu ׶&B:'rkjtLQMЩT_[TEwv>dͬiS-$ڮ#Ov52[ħy +M-mѮ4q<JjU1|*A?iyP69)Vc"4V˿7< ZIńG줰d$Cu\/En 1x:ˤZ Bz̵{eju&)Ƨ͕( rDzo|/doRWgACf{c˸ ׁ5_󶰹k~NX6v DM +,4zɕ6;KOeXor^7J_j=}:nT-L[+1I٘Ć ϲNjh10_;>]^[6.cikGUF楹rhȍK+ráY^0IG)/.]!83R褅a*l(s̢m&NN N,x8{C%mjo=m`Em^_amͱK9r- ٶa4xk(Oxt&օM5)հl#N(Ŷ`7Ǭ zJ8-vvKm> +endobj +9 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 671.061024 504.679134 638.361024 ] +/BS << +/W 0 +>> +/Dest (overview) +>> +endobj +10 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 489.361263 663.111024 496.429134 648.111024 ] +/BS << +/W 0 +>> +/Dest (overview) +>> +endobj +11 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 626.361024 504.679134 593.661024 ] +/BS << +/W 0 +>> +/Dest (configure-kernel-runtime-parameters) +>> +endobj +12 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 488.881526 618.411024 496.429134 603.411024 ] +/BS << +/W 0 +>> +/Dest (configure-kernel-runtime-parameters) +>> +endobj +13 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 581.661024 504.679134 548.961024 ] +/BS << +/W 0 +>> +/Dest (configure-etcd-user-and-group) +>> +endobj +14 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 146.805601 573.711024 177.256773 554.961024 ] +/BS << +/W 0 +>> +/Dest (configure-etcd-user-and-group) +>> +endobj +15 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 488.881526 573.711024 496.429134 558.711024 ] +/BS << +/W 0 +>> +/Dest (configure-etcd-user-and-group) +>> +endobj +16 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 536.961024 504.679134 504.261024 ] +/BS << +/W 0 +>> +/Dest (configure-default-service-account) +>> +endobj +17 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 146.805601 529.011024 197.845152 510.261024 ] +/BS << +/W 0 +>> +/Dest (configure-default-service-account) +>> +endobj +18 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 488.893245 529.011024 496.429134 514.011024 ] +/BS << +/W 0 +>> +/Dest (configure-default-service-account) +>> +endobj +19 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 492.261024 504.679134 459.561024 ] +/BS << +/W 0 +>> +/Dest (configure-network-policy) +>> +endobj +20 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 488.809749 484.311024 496.429134 469.311024 ] +/BS << +/W 0 +>> +/Dest (configure-network-policy) +>> +endobj +21 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 447.561024 504.679134 414.861024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-rke-cluster.yml-configuration) +>> +endobj +22 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 234.738707 439.611024 313.229430 420.861024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-rke-cluster.yml-configuration) +>> +endobj +23 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 489.877620 439.611024 496.429134 424.611024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-rke-cluster.yml-configuration) +>> +endobj +24 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 402.861024 504.679134 370.161024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-rke-template-configuration) +>> +endobj +25 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 484.970394 394.911024 496.429134 379.911024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-rke-template-configuration) +>> +endobj +26 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 358.161024 504.679134 325.461024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-cloud-config-configuration) +>> +endobj +27 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 210.896178 350.211024 288.867613 335.211024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-cloud-config-configuration) +>> +endobj +28 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.993831 350.211024 496.429134 335.211024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-cloud-config-configuration) +>> +endobj +29 0 obj +<< +/Filter /FlateDecode +/Length 4947 +>> +stream +x]K$qׯ#6l/5fJ#EV fFfUuw;`DazQdw<ְ8y$ 2r 0jX\\FlH%@ 55, 0A[.awaeB@Xs^ p,JM&K԰ wmFT^lǕ'cѰ wPy p5,OXQk=Vjܵ p}Cа0Y4`}Aꪼ2 Xr`L4!ɠհ w "p5,]Ch{TtiX 3FÂb34,@]~3kXP~[?^~3?)k], _Nh&]o%z[Y:&Izd`'uG3]H~ztBӹaیKٍ.칎fQxJBuԹsti>S57q|SXqLDh_@N|sBs5y:w[ v'8Z.,3r\;\@[lK6@r䂠7ŌS/_Tc)3\U/'^#ׁ^LK9>/0(ɻȟubwXvmò4݇buKY0nnfŨGZxhjv@vH9taK Sæ^c>={ -=s挶lNGM$G$`~>je9зª=W#0j|;`Cx6__ }/]+5a{tax(V]oנ_ =|z7|5ѷ|{=bwх&|5ix%-*/?/?A :dLO nB8fyadͿۘyO9<1e7,ןqA`&sG_?(qI^lzY2W|C/rK|gT[MFBv%V}T5՘}ZtXb^|y%?Ycw|7;-?5N2wRץj-վ5E_z>VZ=-Ɯ7 ~/84߬꫍kϏ;Tgdk՘ +zmӡ?tŦ'l6|ӕuz_g\Af4S<Ύhh(淈ITiAMc9m16&9$3ṡ#z٩%U-<6fX j]>+m⸉ϡ/5^2[ֈU<"[O +xW& < 5js;sY;kώ6qJ9Zw|޺ռ/&{ >SG֖Cŵzǭ.?ظe_֡FMP[$߷n9Ĝ{ĪZCuQfsxc3>?.;_?8}n}E%b$_f+%pbhͷJ-{t>aպouO6K.Go?mx%s_/G/}- +r/t0Dn =ȣFO_Pο_h{9X`8Iuh )n)21"+nlTI.P9_P~7O8~LlhPE]dO`_ a&"a@T^r>sTbL%3fغo<8DydJ9̺g*8U:NyWXh<ݫnVMխZYmjsVMMࣤ?_MlgA-i-" y +Jﲆ{7=b=|hQ<\I˞0 ZL$oA9DM/Κd3aDU%>S!' +Ɂ-BJȣo^9^x[j<6 Zx}kMݕn|F"A1D=&r61sCb&~ ObLlJ&_ȯ녽_^Q_T O;9.|$zh;M6 bmuڀt +¶2x6)kqCz|B=8vWssom>}693:_[/ l9|e^<͒So|fG/*kVx:# -%}J5gtL-UfwMk uC_ŵNylAayC2֢7x7F~aONk砋֙5}lq+tKҥ/,GyA~"B3*%_s;4<~X +Hҟ1~zZMɍ?aio8{MLo817&s '>+X 'rGګF!wk7f4v4;ƛ}Kߣ=V7$p|(pk6}徨҉ R9󻢲d{k9J#sK/Nf[~}9BS%MLή^to%LO[j,.'L+tOx|0TkPo7 ivn+D֛.d~+pr*!VAIwA [u5NlKY:%#izU.*zkeyTiPGPBw&En7bDm\夎[F~kT9^])hל1:#GƚHn'^NZ%v2:t0$z!ҩ)WW4+?ߠ"4*# / +W}IG'IzlC,>V˦rVfgmpRcj1m˺FfiX)*iR:j0mhE&cΫ$qO75}\x6Z9si]LbN0zɵZ:K믽ȴri^?ڎvewd3':~];5lr%㷳Jle#w}lq^St`#mCP۸ٵu τeȼ56}]jwh5B\}I> }IR(.ńk6 )'igI\B|;2+EWl ) (JEX+ *06ө~e[s/jv5Y^ԞoMN/Zp!sTPsmTiäuhp&1Ur[ulqVZOѩ2*͉AF%nƲܺnɷ(tN:G^2+(nT#}mqڞ35*{MGڨJ_zG!/*OőqlO2٣&Yt` ![FmŨ&=j+r.oߧf~~2;qsZP +endstream +endobj +30 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 29 0 R +/Resources 4 0 R +/Annots [ 31 0 R 32 0 R 33 0 R 34 0 R 35 0 R 36 0 R 37 0 R 38 0 R 39 0 R 40 0 R 41 0 R 42 0 R 43 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +31 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 445.281496 409.271317 430.281496 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://releases.rancher.com/documents/security/2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf) +>> +>> +endobj +32 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 107.173228 418.281496 162.214732 403.281496 ] +/BS << +/W 0 +>> +/Dest (overview) +>> +endobj +33 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 107.173228 403.281496 332.953990 388.281496 ] +/BS << +/W 0 +>> +/Dest (configure-kernel-runtime-parameters) +>> +endobj +34 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 107.173228 386.659914 295.486949 371.659914 ] +/BS << +/W 0 +>> +/Dest (configure-etcd-user-and-group) +>> +endobj +35 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 169.605601 388.281496 200.056773 369.531496 ] +/BS << +/W 0 +>> +/Dest (configure-etcd-user-and-group) +>> +endobj +36 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 107.173228 367.909914 319.724254 352.909914 ] +/BS << +/W 0 +>> +/Dest (configure-default-service-account) +>> +endobj +37 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 169.605601 369.531496 220.645152 350.781496 ] +/BS << +/W 0 +>> +/Dest (configure-default-service-account) +>> +endobj +38 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 107.173228 350.781496 255.796275 335.781496 ] +/BS << +/W 0 +>> +/Dest (configure-network-policy) +>> +endobj +39 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 107.173228 317.031496 400.593883 302.031496 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-rke-template-configuration) +>> +endobj +40 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 107.173228 302.031496 397.449596 287.031496 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-cloud-config-configuration) +>> +endobj +41 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 233.696178 302.031496 311.667613 287.031496 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-cloud-config-configuration) +>> +endobj +42 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 293.575760 126.231496 442.798661 111.231496 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/) +>> +>> +endobj +43 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 111.231496 285.368241 96.231496 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/) +>> +>> +endobj +44 0 obj +<< +/Filter /FlateDecode +/Length 5107 +>> +stream +x\Y%7~?<#㥼I DEbar Bw>_u{݉h2m\Ujiwşw+L)5':_>u&G;6K7dzMt5xĄMt~9Ky?9sǝ5y(\rQih.(M1}LJSrKUk1cSTKԚy_6eMlHkƬ49 >Vm#(xE ygRmm.{-2贶jRJhm^bNk%:" +%km ^|AkC:Ui+U6buZ[ &BUْ˱hb jmΙ jvKm%뵶^6D ezE}& @^lN`% |Ά' | + |r  5֡; /UKaA7hXx4,@[hXdӰ oɺaAMaA→HÂȅ)U 07;5,]laAꆘ$ p7p7T X  pkXaҰb|)VbI e=4, ஏX湁>Zaw=a  w!Q V{a3a*ܟVƕ4,]W>!qeBƥT5,]8aA>x5,]ੵ6jX0hXfmZ X [$j[60$aXġ$.{հ wm AÂܵGm/x נ VV@ + k4wUÂeaALE0h{ R!SsNjцOmKQÂlA, P& XjѰ {װ {AD:Djz^`.j~@@2S*9&c֖)paAdȥLװo8\Ұl͑l L̵6^dkXHmiXPOJY`'!SWffK ]Xl:tVvc6pyp[3s,kH~ṋQ|7/H9߯__bO)w'7"5/_ Jo_lkUkEqMAqD<6:&a4cy a_c1QIqU1Y)`[ZD[I)xʒ>B4`%5~jElk mwyA%NR8:x+SaY2[/^-ݴj뙽)BF!7f YGY\Abqwb˴ ֚Dw|m)t_;W7)woo6>ܴ-j&bme!s&ϋ [MǹVznʯp$αv= 9trkPN;pWY|u_CmE_]`Kq |Wy1zيk-]쳮b!fw+/ۯ~Lw9̣fs=4]VѶǦ--tu`W=Pn`n9HÃj+?Ȋ4kxC< 1H [SGpODT@< 1%SLG{˵QԂbE8݀JpLunب Ǡ埄֘ibHE>U}^&ncj7r|襝޾?OoR~>+ľ_n5}/& IdL)kۦc^tKs#?Rf2;`Z +?4YssOy6@/sm޹E[jm}v}`kcW9N>K|r+J#sY*p,c/gL1n}k_{[p8a3LY'dלD]K!C|} #_%SXeP>oEwq^/YUǡqkeIP@3`>}޸$n}EbxF>Puɸt!~l PWpݯaDvHi|qcX/~۴u{;bOE:J ec}&IWk2*7^,J6 䎲;R :tC;(T`U TkEICl"MI|Rl~]{1=RXh;iDzg +|~'UnU1 q(:]l92#W#nZGcg"ĔtgkRB09U-nJ[v+5:5Qub7Gjn(*dzn8+7.|E=gTx7mxtvEis_ +d|_==߅SrPd[!F^ hyDM7w*GK:_l +^•->c-ziStݮ,mC=AYKc]+,m#!jSS< ;Q:qA:ʕ\`+[A7cзG)s݉?E7N\9󔳮&lk;Ҫ̊>nƝ{>o +bhYw-ׄ, ]U߅/> ۔9DJHjt39nGnIIVXU¬h[ǭOIoͳs>fᴌ}.o_lntq|VZ+VB88z//G t2B'OhCZo[FQFJ@7vek/D\R:ͽ3X}v߷;\(a=ѱrg1^<ːbȾ>2T3xmN\pm{ݣQՏYw;]󟴼tX/0˯Eb&n!Wz.2Ȯc7ŃEݿ'DdRpQم\|F +ӎ m?g}%s>ލ_G|:BDd^5nńv+1uAw8;%IGMΏO ѥIK9~B {JItvZLAΡzRHB|gev5cc*ݐhW} +rRkš<*k풟LSe^]D-7*ܒkxi7@"8/ +Ibr^&Lf +TAeY~t}y5'y+$IOuHqp*yج":~q؆*D&: ؒݰAfX)3&9S~ِ'qlhd scIN;_$9;w+l/c=MI&d8(Lїw@'bf97q/7Crci2:r➯':ݿαqoZd|Ǫ~_>[wSꋤ1uN e^E}N {a9skЂ6Fn('NLŀ ls)n],ˊ*> +endobj +46 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 191.048717 658.622079 244.661998 643.622079 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/admin-settings/pod-security-policies/) +>> +>> +endobj +47 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 439.875057 101.433071 421.125057 ] +/BS << +/W 0 +>> +/Dest (cb1-1) +>> +endobj +48 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.928036 99.933071 402.178036 ] +/BS << +/W 0 +>> +/Dest (cb1-2) +>> +endobj +49 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.981014 99.933071 383.231014 ] +/BS << +/W 0 +>> +/Dest (cb1-3) +>> +endobj +50 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 383.033993 99.933071 364.283993 ] +/BS << +/W 0 +>> +/Dest (cb1-4) +>> +endobj +51 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 364.086971 99.933071 345.336971 ] +/BS << +/W 0 +>> +/Dest (cb1-5) +>> +endobj +52 0 obj +<< +/Filter /FlateDecode +/Length 4930 +>> +stream +x]K$9nDs0l/<^]`COkFYQzD33݀P HJhwOfgr.)˯kRWKl.*M,'\9\%J)^.]m븫7DodRNUV&%ŠKX#$|d%%12 N1|r +!),g!֪<b+<Lң\|Qy <#21 Nc Y1d : KpVA4^,ɪXaw=a  w!A V{ ɂY*pb XB%kXKT3s,(//+ecM? xej{\Wc∄s !`q]t!n˵q[!;MHƊ*uI֡#/yjYGS{һkvxhIJ'IbRq 4՞Jd}λ5݀ p^ SR{һkvx2?M+G^GG?_YIfd|"rDhu#_Aʄo\wYyeW6k[9-ˣ_?0߃,;E3AĖKjt RPͶ;zAvc9U.~ʯ0E"L㍀avɦ.C Alq9vd +_$l"d2X䘸eCKL@XiZvClJQ&ŇcR8h d1w7u-o1,yehz;ߜ. k,I#,QM#٨:7J뢒~(tye]eU_?TIu\&N=2Tle2%v~N3^r~q LP'4f/yA?Wk7"p7:}NAwyZӻۍ.]5a +49CdtRT''nSsN2t:ۗLSSTZr!d_e:WۙZ9 =ž p+h_i p2t~qg1 CuڔW/@9MAZjX w?7!;1]@-Y5K-uC䭉Tc۬26>Y`mۼ}Y g tYxMn6r)M?bzcAx{e异"C^GU y-9Z/$E@G*_z8ea7"'_-{:$v\ sbQ(nSU q4ѫW(]?oaˀ"[Gr =/M܃;Y:9:mwZwɡ Lm';~""?ӆΌmkÝ#pw#ݤHvl%9:W1)!''eCt2'aV2C'ģeX/bśkѩSszxD#e#xRO??O:i뫹Lu'N.)UyL6M) +*gWom?rzSgr1r]hC]) +݇ +6Pg|&ŗY +ntF3j柲7?=7[ޯNzmMf߲b^n|"56|WguSrGڱ~פǻ/[{v6}̰ 66l?R1|<م_\ǹ?o^璼"ߣm^58Jsf>.459vHLa'*z&8 ]6_0}3c[uMNF=ĘQo) &X ~өʍu$OzƎl6Dz{^" ,dyl7/=' iGӷdo*$9 YU©=ɐ:(@&'?2[l['|3h+=:@*;leB(%HsQjcTn}R.*ȅuțM icrbiam;85pN^t6n9gr<3&|3Pv?]yssTus; %G{NvD^AA'gyOhyϱ[s:p +h)]A/􇊻>,$[{|vOm#b4)3yDE[ cPʯ~uV;o+4di іޭR}jv{uz NJRوUrBdKuU!zf}᯽+UZ:0\eovwױBfa~-v=Sk< T% +8|C=Q?jNէꗎ"jFw$[Vz(!6A \v48*>$K0HSw}1]uq4,?E|[STu5մm$TJ>N +i`v4j~siĽ\iE-JTUKe:x2JBiXj_dy,C0 \8oa` f"Mvr^˪*LF7_*B +/II,5F'27;y;갦i%K`tlt؆:l%nu,ӱr&&MmCr>UE7{r6SqyqF|d1:d& 0F*֎Nr}L/^YoP煯?W,~ێc<{2yk>IcOyAvy UIu;tA]0t8}7]hLC|i2_:6a/nN%@M*\̷goJx2%TgosW&ӒuqW20MNg]70cT_ jŪ%sWSߺ/&z7 tsf/(f +endstream +endobj +53 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 52 0 R +/Resources 4 0 R +/Annots [ 54 0 R 55 0 R 56 0 R 57 0 R 58 0 R 59 0 R 60 0 R 61 0 R 62 0 R 63 0 R 64 0 R 65 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +54 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 751.923057 101.433071 733.173057 ] +/BS << +/W 0 +>> +/Dest (cb2-1) +>> +endobj +55 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 732.976036 99.933071 714.226036 ] +/BS << +/W 0 +>> +/Dest (cb2-2) +>> +endobj +56 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 653.081993 101.433071 634.331993 ] +/BS << +/W 0 +>> +/Dest (cb3-1) +>> +endobj +57 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 634.134971 99.933071 615.384971 ] +/BS << +/W 0 +>> +/Dest (cb3-2) +>> +endobj +58 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 615.187950 99.933071 596.437950 ] +/BS << +/W 0 +>> +/Dest (cb3-3) +>> +endobj +59 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 596.240928 99.933071 577.490928 ] +/BS << +/W 0 +>> +/Dest (cb3-4) +>> +endobj +60 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 280.647907 101.433071 261.897907 ] +/BS << +/W 0 +>> +/Dest (cb4-1) +>> +endobj +61 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 215.950885 101.433071 197.200885 ] +/BS << +/W 0 +>> +/Dest (cb5-1) +>> +endobj +62 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 197.003864 99.933071 178.253864 ] +/BS << +/W 0 +>> +/Dest (cb5-2) +>> +endobj +63 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 178.056842 99.933071 159.306842 ] +/BS << +/W 0 +>> +/Dest (cb5-3) +>> +endobj +64 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 159.109821 99.933071 140.359821 ] +/BS << +/W 0 +>> +/Dest (cb5-4) +>> +endobj +65 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 140.162799 99.933071 121.412799 ] +/BS << +/W 0 +>> +/Dest (cb5-5) +>> +endobj +66 0 obj +<< +/Filter /FlateDecode +/Length 4895 +>> +stream +x\[$~_Qφ1 ֻͮt9cB"34]RE(q3ԜzŚ-kgl?ǫMt5x !\v_CyuvzSk.^YL.9ۨ*XǤ3Xb bL 1 y_V GV>;X՘ykUD+<MғΤR}Uy< L.:WMJ)G%V4^,YY(d )XY|Ae⡝ +dwYlN`b-D*gK.GxΙ *#ʃ,0>A øaP/P/PA_T:Ӏ X)iHd!Dʃ,CaASа m ޢaAܒNÂ%뒆 1J"  T5,԰ tY 1y `7PIn g5, n X  pa5,U 0iX_1aw}aw}F +Py K27pG5, '4,U. $djX|`2QhX")1 2ԤaAj\ƕKjXHTAÂ| kX. SkhXP(.5,@` Ty0aÛa6?lb KaA)EÂR ^&7BT|T V +4,@\~hXP~[<%nkHT,%ʃ,($7N/A_IÂ7(3DE +7. +dx]TI`V[ǫtfgQ;[Ֆ"[eg`GR;˒Ԯ*Ϊm E=FLXOE9d^dEX瘧;- syU?(8^6܂Q8T~hǭm7 ^2L[m.͂Bҥ}BڣY*$H.~߿zӯH1ZK~7v+~7U̕9mS;7~w`bSWn,t3&+To[cvC>U؉ +(-,UÀRfwoO]18B_ѭaѡsNCW.Y>>pM4'_ iyucĵMq4wk|AkВז/.A=Փ3=/ @ -bm`8q?OleYbHwc?'.K5n*%:'݈e=+!񓍎аҏ=Ǒ_u18t!yQy7#0 +kfZ7/\ϳ+_]1K|zWw{TȌaǮ<$O +Spl16`V.拫c\ԑԶ,Np|*ƺyqߝ9]‾ݽ֜[)ݓwO7oms2}~E_9.Wi-]y=~}(qmr,Q.<i9_~+CXg@>)\5 p>r|`wrwSZ]?sg)/DM:ltiڿIJ~ٹJ.Dⷤws7fAU@.&.phMM6 UxߵCwQ7S_RX׋4;8J +`_*G9{e=o{d-۰ۣ>WYĺݟϯ(MHѕ'/Xьf + 9ZwbԊRG@PMzO더0 0j ?mp||#ύH QMx +B6n +ಛ.eΕ?mOxe?̕P.$F7 +YN}!ת UP4.޴g궇TRܭq`ݮz=cW֮ #~r=/Lzd.>սCy(Gm2ںX=S!n7nBcykF\!Ҝ'V"lҧIIq|q m[ O:߮ +B;_zTgq?J? !jUΧd|}|u{'q)u,Xc{}I񛎥97Q s#[l꺻xw{t$[9x'#㯎S=6zo\>7OHtOuH䩇OV(걡]zL{=>kW)Lݮi +ӷ6~w7mN49OuX} +KlZx7k_}z*/{ ;M^a`iȇ1rf"VxKڬ\b*mCy֌_\P\|_4b|w֦9cPp&o]Oj^ЭrqFB'E̩&=_]^н?;N=YE>Tߙ󙺋N{zv{MLmz^Wvo7VMO +쾣tU~¦ǹ^{Id7pOU1xo/zmK>Cy ?鞢SW>8}gQo1kz 8?+e~'= ܘQplw;{z{&\cn<\kF}ΛOto;K]`oEJkkUddow=|)kwiNvV/ऽyLRлC{nE e ֗r#vŸX"5xʃP?t so\6o*?ӧvЂjgаB]7OM0 p :j?O!.ylqX*Z(CWh7`S*bĆsKNlnk[v4"q.1+glj(ļ\Iͥ +i8@ETFr}y4/±9[%IzCyPy} G3ʩ;B8919yѺGv_EN=:}P$u,tjhi{8rNAީ1WF3Cc9>*e[OiD14iceJ밮j)bR&5UJ:70 +(9y%BKr<3tڴv϶W Y9,}$vvV:o!Q >Aے0~hi{y=y%P6;.1CL?V]p&uˮom[Esࢷ'uz׳nZ'Ƥ +endstream +endobj +67 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 66 0 R +/Resources 4 0 R +/Annots [ 68 0 R 69 0 R 70 0 R 71 0 R 72 0 R 73 0 R 74 0 R 75 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +68 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 748.173057 101.433071 729.423057 ] +/BS << +/W 0 +>> +/Dest (cb6-1) +>> +endobj +69 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 729.226036 99.933071 710.476036 ] +/BS << +/W 0 +>> +/Dest (cb6-2) +>> +endobj +70 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 710.279014 99.933071 691.529014 ] +/BS << +/W 0 +>> +/Dest (cb6-3) +>> +endobj +71 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 672.384971 99.933071 653.634971 ] +/BS << +/W 0 +>> +/Dest (cb6-4) +>> +endobj +72 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 634.490928 99.933071 615.740928 ] +/BS << +/W 0 +>> +/Dest (cb6-5) +>> +endobj +73 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 287.395585 321.344928 323.513505 306.344928 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://github.com/projectcalico/canal) +>> +>> +endobj +74 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 291.344928 111.294999 276.344928 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://www.suse.com/c/rancher_blog/comparing-kubernetes-cni-providers-flannel-calico-canal-and-weave/) +>> +>> +endobj +75 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 308.171464 172.723346 401.561844 157.723346 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://kubernetes.io/docs/concepts/services-networking/network-policies/) +>> +>> +endobj +76 0 obj +<< +/Filter /FlateDecode +/Length 5546 +>> +stream +x]K9rׯC2/`0x<^c@CFŢe`}L>23Ju &x| l{6RϗϧNfOybuSƿp!g!Pb. mnǟO_:즜R4JQFy?|P9kE`Gv/`sZ`Rq/`EZذGa1j12)ZQfʈz)Vgc2^e6ZxaJQ+  I+A:Y)K֕2bZYĬeӾ?Dd2k'$ %9jxdVFW+Nx))Ļɐ$f4-}^^;+B *tF#VlOW0uGr.$UΗ/ofZ!UNVx)V*Ԙ-eSy+ĵ!cnB% ^1QfKw$:um> " iOWԕn_} IuOG8l$:U:c H6 +ߢ?vy՟G&+ +:W"&7(N)!QFx*{+]Lc]L*Wz n%Y 켐^1ـ  2w?O~@wNC .]>wr3E$2q{#A)+r]V9?E +39Ime'dv;,vĸr׻?q!Q]h/f#hO8&Φdvv@SF-W\^)4Ƶ]BZZ?q߶˫ř}ݲd a᱈"-~W)}./Eq~?^ޯwV2đHM21jj ru~ + ̚Z7vSU`9d:-Ư`&]2QYmiwUy;Ѱujb/XGvozjH0ƻc%L/FߏP^#}׼0^vR*oGT&e *p^R$Wl}1B%2m-W9KO1WBk˪G{mq tGȞ4|W$[P/ǫFw+kN/BYx|W|_7N/{WSrѼ:׍>}tf9{䋁 +°԰V~,ke*,+Y~iX JsNtj6 ɾgh^|vY]Y/>^(-Rp߭j固E˂ckK*6EV5`b/_<)6y> In6e18u5c'vY>L\3Ole[h5Y7Sz㼆߬ya|`d}>TXڄHu$L&$}uB݋P9}}/^˰?D A0K0:=,PϫflDܗgwe<,nCjOע A4x|?pQ_!u/ LEA-:/ge#4b Y+{Cnw__].ۮpXN+n )dي)c‡I ˱1;Mu!-mv?S9!ݒ~y{ [pUZ kz9x/rIS/=,mgˢ֯#k _'#^Uب5]M_2_?73t\37iA!1|:Eeǣ!N9pZ; |D< &K#OY>qgc,X9֍xXxG%wW^_mw _6.Iq;c"8cTצݑ"Lmh'U8RDDzį~qOf)P)fGۓe}6CO)8aOПC0F\t)|[u^{6~\dc/^J iO/3T^kN'}&l%5S!KfTBjۋybf2}6|h'+mLE؍u)99_G9y]vrJ/=$u +1LmШEVA|o^ݎ„RAu1"wÛ?aLZW|wM{J`w›njWDYvh$[|˿8R#& +^PQ~M]c6jFPք +*[@85 mlh#1DYZG@ "FrE(Rw%A}Y}NWX79&,99[<_iFF>+۫y|5aϭ4{N=LYU^w +4vWp 4] gM|m,?\畗G~AY>];,_WP"8:;*z^=ۗk=\5ʚi;fF x\} gFNO1^MOZ'J TrUgHC`fnhKgHm+9ʩmֵP2?ueC{(a|-ϖnmauٹx7phIF(s&i1BzS?HF#Ǜ9|Cur~)dYߒOr~:+dd!.ŶQ]N)o$?'ԓ _FZMεcӦns +5ݓdA&ZBc`xHd]'gY.s9QtvP}A-Y׵*] ֕FSQ}})1i2[59?t&jHܞ9t9-؞JjtS.TJp} _a$@յIݸr*OW4t{T9dkV(PU\Xn&%w"k!P5 wvGE16eQmO7:pӚ aT,nsvO8ywkغ"#.t'Y~7H%6dZC儙IuӁ>iV:}@vtA2b dV7}o!9r%H62CyhwhQnQيM1ȱ&zGU5 aR/>̎MWZy4ތ Eo+Qbj/,Bmި#PT*a}*GUjm{Ԃ=h5j~+mi(\f*+OaVR8R-ԿV{Vڭ#^@~4'[,Zk7*'}:ڞH葩/¿/uBY{-361PiGw0bDNÔunqg211V~;3 +qTyzlWzLN?3BDN*oC# zh:cVS'zB +endstream +endobj +77 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 76 0 R +/Resources 4 0 R +/Annots [ 78 0 R 79 0 R 80 0 R 81 0 R 82 0 R 83 0 R 84 0 R 85 0 R 86 0 R 87 0 R 88 0 R 89 0 R 90 0 R 91 0 R 92 0 R 93 0 R 94 0 R 95 0 R 96 0 R 97 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +78 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 715.084475 101.433071 696.334475 ] +/BS << +/W 0 +>> +/Dest (cb7-1) +>> +endobj +79 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 696.137453 99.933071 677.387453 ] +/BS << +/W 0 +>> +/Dest (cb7-2) +>> +endobj +80 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 677.190432 99.933071 658.440432 ] +/BS << +/W 0 +>> +/Dest (cb7-3) +>> +endobj +81 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 658.243410 99.933071 639.493410 ] +/BS << +/W 0 +>> +/Dest (cb7-4) +>> +endobj +82 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 639.296389 99.933071 620.546389 ] +/BS << +/W 0 +>> +/Dest (cb7-5) +>> +endobj +83 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 620.349367 99.933071 601.599367 ] +/BS << +/W 0 +>> +/Dest (cb7-6) +>> +endobj +84 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 601.402346 99.933071 582.652346 ] +/BS << +/W 0 +>> +/Dest (cb7-7) +>> +endobj +85 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 582.455324 99.933071 563.705324 ] +/BS << +/W 0 +>> +/Dest (cb7-8) +>> +endobj +86 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 563.508303 99.933071 544.758303 ] +/BS << +/W 0 +>> +/Dest (cb7-9) +>> +endobj +87 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 544.561281 99.933071 525.811281 ] +/BS << +/W 0 +>> +/Dest (cb7-10) +>> +endobj +88 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 525.614260 99.933071 506.864260 ] +/BS << +/W 0 +>> +/Dest (cb7-11) +>> +endobj +89 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 506.667238 99.933071 487.917238 ] +/BS << +/W 0 +>> +/Dest (cb7-12) +>> +endobj +90 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 487.720217 99.933071 468.970217 ] +/BS << +/W 0 +>> +/Dest (cb7-13) +>> +endobj +91 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 468.773195 99.933071 450.023195 ] +/BS << +/W 0 +>> +/Dest (cb7-14) +>> +endobj +92 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 370.326174 101.433071 351.576174 ] +/BS << +/W 0 +>> +/Dest (cb8-1) +>> +endobj +93 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 351.379152 99.933071 332.629152 ] +/BS << +/W 0 +>> +/Dest (cb8-2) +>> +endobj +94 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 332.432131 99.933071 313.682131 ] +/BS << +/W 0 +>> +/Dest (cb8-3) +>> +endobj +95 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 294.538088 99.933071 275.788088 ] +/BS << +/W 0 +>> +/Dest (cb8-4) +>> +endobj +96 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 275.591066 99.933071 256.841066 ] +/BS << +/W 0 +>> +/Dest (cb8-5) +>> +endobj +97 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 298.350419 124.541066 391.740800 109.541066 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rke/latest/en/installation/) +>> +>> +endobj +98 0 obj +<< +/Filter /FlateDecode +/Length 5338 +>> +stream +x]]$;r}_Q WW/0 6 |0vfc}P>232kN3ݕ!)8 +)*sW"R1UJEI MQyCׯ,pQm ~.쯗??Ks*`3'S1ŨW1Z`n1g) fHIfPN^Jdmp&ea!) f죐d40Vk1 h"g4U@)RYLH3JiΩx#eBIJ#6R-i) KQJ 4bStRZ-[$ҲS>'"1-#MiV{sZJ3Fy`Ӊi(tRB-A,ﴕl!Hi bJZnO '5LAW4IKȳ1>c&rm :y2įcO.F>]FxghlzC!$0~z/_P/b4&_3ncⳝ|$>Ϻp\S +sY|hmY?}.mv"mQn?i6oڮ !iN ^Z>4vyu@Os+~?Ϙq" E^$LBį083Ɂ_ +3n ,!O빝 >OmZۺ̟+ o_ e֍:ͻn#a"( jY +:V>SG0aaqnٟۈ6@>v]?#Z!it>4yJy"]yxy" xOK #Z8썼 + ̈ҥ~ᔧUhM7-ӧ.,T9UqYf+kԙ 2lH;6i2eua,{@/19LxQ9]a79<xa DnȾ4?ʼ ǃVN<5'u;c_}ᔺ?~YupIZ6ʼgݕ}i/'yj-*wIX\к) xq9.Đ;)4aEoU.>虢_Tonszޞƕi5<< 1lX+8F\ qZEe4;{Y:?/yQ9nk:+i1YN;u +dVrٴzǻYp) P(`9&o2O(v.w6AkJƮ4 :VC0 Őg0X.l˖R<;kcj[Q(g"9&D!,;tD,{`;o[So}L?/ N;`a@|+s'u#dG,x'<ums]bs?'_7a1A;s*OcoZ:5%ygpz[5> ͏5Y/ihe_?ҙ_AfegJWtq6ż(wվG3N;VŬҲN~a]w=c8<1Yu9tjp:*tB\n)TiztFD}uveH]U|zDw{fC +V+/%AX[^~3 (3=~ +GSΓ:"-{hQɂд$}͡JN'=Z1uO @>hs1Ѻ90cKi5 7&G;<weE%VT<M } 03KIjI^PPW|zUfa$ʻ!Cl`č ߅X*o4i}ykɼ<-+)CɋYT^ilm8^F}Mb L#Z7)p:r.3txJ~x?8PtH3@4^qNFпǀ|#2y%G@<<@l$ƇoE%?ćam8A7gQ[Pv9^D`7ޢNܬJ +z< 7pZ*tV('o'uIsА{O[Vq\2&/a:b#3AZ\B,e}Rye#ݷ֢R-H}Ix}jQ- + 2BgݞSyy~cV0ZTR`zr_v+~8-B7g 4@pBTss:D]hQI jǧ@)!h?B[{Jv(/G(N:4ʚj> @h{rmYpV1jyUc^ Z*Lrr; :+/m  )!HmԶ!EQl?<<pZT2p}N}nv}f>ivVjƋ2􀝨1O+O<")weE%jk뭮灴[Ǟ[ +w"\(n\9EgZ'ul|ԃ2~Gj*C3P#T'?uRK6>f2>ytd?OA07Ev*GyEJ̑46q{պUԢjZdn0*79[P'AtŸt-Й-}5>} +$jr'n1\o=[UsmnJKYiYѮ~\@k؍vCG!\(on(xҘjS5U&e) 5HW¾F塱I-QHQv c{fL-wkthARC#451SXmƕPW#& ʯ q7WUwиuㆿ0_2ZO.Ս +V 솁kWom۷d҈{R9;8_3FGwSܧqqB`Oj.eiסH\q>#절P\nLXIkzƮG&Fiԇٱ*+w1dAƋ`2cya`wlrFM:Jۍ,u2,/ۘʤ:ooV|ϵ F-hq1bt6gcTeJ@2]eXm +ZmrIlb.~ֈ~앰EK@~sw{K&AF&UٶnZ]Gp =2]or~}gtKOY0 j2|6e*[BY4,i> +endobj +100 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 289.074296 784.370079 316.109452 769.370079 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rke/latest/en/config-options/nodes/) +>> +>> +endobj +101 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 650.584475 101.433071 631.834475 ] +/BS << +/W 0 +>> +/Dest (cb9-1) +>> +endobj +102 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 612.690432 99.933071 593.940432 ] +/BS << +/W 0 +>> +/Dest (cb9-2) +>> +endobj +103 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 574.796389 99.933071 556.046389 ] +/BS << +/W 0 +>> +/Dest (cb9-3) +>> +endobj +104 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 555.849367 99.933071 537.099367 ] +/BS << +/W 0 +>> +/Dest (cb9-4) +>> +endobj +105 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 536.902346 99.933071 518.152346 ] +/BS << +/W 0 +>> +/Dest (cb9-5) +>> +endobj +106 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 499.008303 99.933071 480.258303 ] +/BS << +/W 0 +>> +/Dest (cb9-6) +>> +endobj +107 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 480.061281 99.933071 461.311281 ] +/BS << +/W 0 +>> +/Dest (cb9-7) +>> +endobj +108 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 461.114260 99.933071 442.364260 ] +/BS << +/W 0 +>> +/Dest (cb9-8) +>> +endobj +109 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 442.167238 99.933071 423.417238 ] +/BS << +/W 0 +>> +/Dest (cb9-9) +>> +endobj +110 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 423.220217 99.933071 404.470217 ] +/BS << +/W 0 +>> +/Dest (cb9-10) +>> +endobj +111 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 404.273195 99.933071 385.523195 ] +/BS << +/W 0 +>> +/Dest (cb9-11) +>> +endobj +112 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 385.326174 99.933071 366.576174 ] +/BS << +/W 0 +>> +/Dest (cb9-12) +>> +endobj +113 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 366.379152 99.933071 347.629152 ] +/BS << +/W 0 +>> +/Dest (cb9-13) +>> +endobj +114 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 347.432131 99.933071 328.682131 ] +/BS << +/W 0 +>> +/Dest (cb9-14) +>> +endobj +115 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 328.485109 99.933071 309.735109 ] +/BS << +/W 0 +>> +/Dest (cb9-15) +>> +endobj +116 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 309.538088 99.933071 290.788088 ] +/BS << +/W 0 +>> +/Dest (cb9-16) +>> +endobj +117 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 290.591066 99.933071 271.841066 ] +/BS << +/W 0 +>> +/Dest (cb9-17) +>> +endobj +118 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 271.644045 99.933071 252.894045 ] +/BS << +/W 0 +>> +/Dest (cb9-18) +>> +endobj +119 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 252.697023 99.933071 233.947023 ] +/BS << +/W 0 +>> +/Dest (cb9-19) +>> +endobj +120 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 233.750002 99.933071 215.000002 ] +/BS << +/W 0 +>> +/Dest (cb9-20) +>> +endobj +121 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 214.802980 99.933071 196.052980 ] +/BS << +/W 0 +>> +/Dest (cb9-21) +>> +endobj +122 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 195.855959 99.933071 177.105959 ] +/BS << +/W 0 +>> +/Dest (cb9-22) +>> +endobj +123 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 176.908937 99.933071 158.158937 ] +/BS << +/W 0 +>> +/Dest (cb9-23) +>> +endobj +124 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 157.961916 99.933071 139.211916 ] +/BS << +/W 0 +>> +/Dest (cb9-24) +>> +endobj +125 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 139.014895 99.933071 120.264895 ] +/BS << +/W 0 +>> +/Dest (cb9-25) +>> +endobj +126 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 120.067873 99.933071 101.317873 ] +/BS << +/W 0 +>> +/Dest (cb9-26) +>> +endobj +127 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 101.120852 99.933071 82.370852 ] +/BS << +/W 0 +>> +/Dest (cb9-27) +>> +endobj +128 0 obj +<< +/Filter /FlateDecode +/Length 5039 +>> +stream +x]]}_ρUQ,$0$!p7C~N-YnU۳a^Wtt$˶9kDFc'3XL?_g)*orH \T1{no﵍9[sƟUTL1j/2T8A彊 QĜ%,7('/YUq*  I*aha֢h"g*уFmu:sNHIU'IGgm$/iI_ȥ(|qiQ_lNEb:Y%t%Q_tFe|ND.CSLj|rNK:c6ÈB'(,| gQ_V9B+Ŕjyt;팤H%$ +RKeK %J ؔ$+ +9J<ഁ/ueY8_,9 ؖ t68-i$.p \%.p`\I\@RsSp8J\@Rw-qw/`GLrx%. . qlJZڤIڈ txz\k+qw- q?Z/+q=tI\)D5O`+eRxI>Qhqaܢ !K\TN}& +J\!RK:YK\2H$.@|SF.+SwAKVDaDE  @J# w޳s&=d%.@^0*m zXҁwY)qA,I8[ B"c C'± j<(K$qk]ND _D _2H\@e[E|A(qLL$qA1 Vu :%.Bs)0%.+N$. f"qBJ3It3Fd A Me-q"4hjIGIDAq(q f`JQ_@x%.MLsD|q$.Ht3I\|J\l|3J\5|A'qAAq,qh:%.&aiIKo& Әob'7G" ,[p`'I$qAIo"7\$L8|4 ^3$hPGl 4*ks$qnbfj +ⲁ"OU"bf|Â9R)v]?N{O_~5wxby،]t6j!|ƆyqҀE7v6/f2 yV[!HcO ;MSTĹ@@)-s'^M¿p0oDsBZ}~?~rN?<96уVui_OE)̿iEv{;4s<ߧ; 1<Mi|b4EC)`^.\4}i~N݇5ΒWyi@S|1xx"AcuΏ*c|N8lAA%|$ ɝHLA&f: ;˧_7z^u6 ۦ{ӄ J|)rT&%Bјq@l3zѪ /οTv&]|?Wmߝ"af\LtۜSuw2&[9"YWlUJT4YO)72]ۀkYnɸz{=%enS;Fo2ژagyB+\ї4otSm-[@lxob$ 5PSmm1_iJPI,t>lo- 6- Zxqtaa8|$xJ +x_d(u>mRg=Dgd n",i- I!WqUWqw]2ދ=ZU!R{ |ƤL][9 xW2 c6 yF.UǺZ\c,W-w7tۼ92z73)x-n*7mȊ229x-dsJoIګ2o@pCT9PIm6G\ڴӮf9p=D_ U%pBj$P3PA`|$Γz=}[0uu4%oc6ǁn"2WBwUɴ DM/y+-P.nSdB26r%`) T-V-6!h^JS4==a Kj~u]W" }vzU&E[k;B+wS \wbm*~Po@zsSj4,}`ܞ+/}]{{}PφK#c`iKcCho UlfN^G6eQhjfoo5߿S +'RԨv[Ax8`M>Yz/ǃ𪒒7Jl?5[*ӘM5,x7(26va:kqߞD4#+}mP{}A=ΚAZƃq &̪؂<W wBp'ao?z$lHcaǑt80, νr麒R8C0+P wk>nnس|[[ퟀ47؃6ǁ4Fg~ !dpgZ"}iN ZOf6A@!h~:zzη J_u{}y`o/ &`<o mAǏo Ul'偽(#6ǁgޢ1["[tcdwۻ7Lv{a38-~A!q+7c+gy ``oIe7{p6Zm9+7+y3h}]8)?"9N;~fyͺnPeO,lޟ=Mo]Z5z(xk?]8m]hC|Vdl1G*xGHrܯ;ߦ]nl4+%8|>{[[M] v2_KaY>UGB(qx UG .*݆c3wguL&`AsK!fql^.)+ &~_Wooc8HĖA.x|Mӵh-mӵY3M÷Ȳc;:o_>V7׵k?;Bw.ez}Kj/p{$8LGol +1r˺o=*GV['g36gAs|ںWm>z>!C~/車mO) ^ U%̻zvzg[P@wΏh0^m"%zZ"=w{}[Y淞cV8 %E67)ln +u!8ş;gۈ\@~^pJ?^lvڴ4ߒ˱*w$w0aLi3creS箹>f*Sžy)|`$ЋsAǟk)"͟ Ssd*|H젘󯺞@.ྨmI畞Η_/W1QvrXV,aL/ט_ؤ|+>!\NHm儋ᦘwr,B uS"kCX]o4_t#jݭMWʩJZ]eq*W/%kP'At9 t955VU +˥ r|XK4_\YRmxA6,fhW~]yslkNx9P/\}^+ty8/_Lv CK*|2L,GK%<6xH> +endobj +130 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-28) +>> +endobj +131 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-29) +>> +endobj +132 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-30) +>> +endobj +133 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-31) +>> +endobj +134 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-32) +>> +endobj +135 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-33) +>> +endobj +136 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-34) +>> +endobj +137 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-35) +>> +endobj +138 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-36) +>> +endobj +139 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-37) +>> +endobj +140 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-38) +>> +endobj +141 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-39) +>> +endobj +142 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-40) +>> +endobj +143 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-41) +>> +endobj +144 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-42) +>> +endobj +145 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-43) +>> +endobj +146 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb9-44) +>> +endobj +147 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-45) +>> +endobj +148 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-46) +>> +endobj +149 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-47) +>> +endobj +150 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-48) +>> +endobj +151 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-49) +>> +endobj +152 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb9-50) +>> +endobj +153 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb9-51) +>> +endobj +154 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb9-52) +>> +endobj +155 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb9-53) +>> +endobj +156 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb9-54) +>> +endobj +157 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb9-55) +>> +endobj +158 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb9-56) +>> +endobj +159 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-57) +>> +endobj +160 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-58) +>> +endobj +161 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-59) +>> +endobj +162 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-60) +>> +endobj +163 0 obj +<< +/Filter /FlateDecode +/Length 4884 +>> +stream +x]]8}_/haahh؁bf؇;U3,apZ̔oUVt +KGG!9lşL%E>|dM +M%V/YN&s8,J&S[TpH3s,辭9bte{iq?qu! te1:ڙIȓp-6D*8o1ݖs.c!zRp*mT8m{\i5ݏwOￗܭݟԁº :4n6;@W&;A1jqex<vmsn #cZ \|c&o304KaOܪ9-ggT,򊷆0c..XGDL2֑5nGpvk.;A-l:iһ9 u%; +eԕnX>ʛ_?_% uo!t/.H`hEb^OxKtPh͐c6/Vo>+fY'Nki +O; 0PjtnDD#x.;nslӹInQ3iU9cW=ܰ|sŗ٭CdYֲ5,[l"/)'h]~ +y>0˃.`~J]8BP;l"vKvq)0,o-+ +]pWWGF>#ZE3+< ͸~#)eeuknr'&1#P q }nc6ǁѕ[ YAQ3\l_||=ñT˹s]lky? +{>qZva8p 3pVݵ N]}nZ[4&?2_KeY/:jp[|9lIKyl`)e%y*JvUz3 Mvkk(;2X쓤p{tm8ɛ|ᙀ[U2w9N1*=ز X]dWG+Yp +bc6ǁX@Q[UE;wwÞwkoUZqvS^7fsIbgoU 'JMw@Xn (1ߑ7hs 3SA֕Vo[/m%mA/|)y.Ly&V#KjӞD[}YR[ \o4Kj0@,V#bU%U֋=YR[}YR[{+ݢw7hs<S|fRͺ/zOXcKhgXVCiӞxk][-WVi6\R9H<%o&HW|.u{nKodYޖ H*?rzk=FbE(/{mU.1oA[ײʊYuk1)%=*y)b>G p.jՅs˫y +75՛_qG0LC={/pϟYL\d/32r""88)72+^l\;[16NFb$ ڼnjwa9}VJʇz$Yaj`.1?EQ Zv˪Zz/"F"v.I +\`S?}W# ]HzX2X"+t|+!V!\N}儋C$/°ڮE,_e}YZC\u_u= ҵUʷjzd9U4ԒC"z9)l=5(^/\[R)Zn>[h=Z+ )WdS$ƈs-mp7—<BRJ+lԝ]Hԗ_U&_/TTgAJ2Mn^rm8wJ }{lBtkkNJuOHZX(O^hnוx3l,wƝ8wAo;o*|&6 sd{fN8RX N:Z;I^.Lq_N> +endobj +165 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-61) +>> +endobj +166 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-62) +>> +endobj +167 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-63) +>> +endobj +168 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-64) +>> +endobj +169 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-65) +>> +endobj +170 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-66) +>> +endobj +171 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-67) +>> +endobj +172 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-68) +>> +endobj +173 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-69) +>> +endobj +174 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-70) +>> +endobj +175 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-71) +>> +endobj +176 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb9-72) +>> +endobj +177 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-73) +>> +endobj +178 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-74) +>> +endobj +179 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-75) +>> +endobj +180 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-76) +>> +endobj +181 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-77) +>> +endobj +182 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb9-78) +>> +endobj +183 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb9-79) +>> +endobj +184 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb9-80) +>> +endobj +185 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb9-81) +>> +endobj +186 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb9-82) +>> +endobj +187 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb9-83) +>> +endobj +188 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb9-84) +>> +endobj +189 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-85) +>> +endobj +190 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-86) +>> +endobj +191 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-87) +>> +endobj +192 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-88) +>> +endobj +193 0 obj +<< +/Filter /FlateDecode +/Length 5023 +>> +stream +x]ߋ$~ +K/X` 3 w=kXEVJ̌T@ݕ!}T2;sI^~Xſb* ~R:Wb_@ɤ|׷ ~m.okw])b2)dRTPd)E!|JQtXV1Bb1A >+Eb'G1|rA WBR[AL^)sD zʼ31_Բ2VFdbbVVL1d!K(iel2”V! Ejd9V ,CXWV ieL(Y-+(9}Ld2LmZ%Ťym(jd dVF_+NJ9+&KN+ jd55 2K L3g |.S" | cIu(N%pԐda\ Pa CTаx& h˰ p˶8 xE  1ĥY”%`tOPB`8G K쬆 %ZY` L0pM0pkXa԰b|VlY%9H0p܂湁>Xaw=a  w!A V{yҰDÂuO@+rPZVKqebhXpTaA>x5,]GZpb5,] Aq4,3tղblYÂ,y @,Ӱ`l,P "phX6iXeװq 0m9`XʀAZpT4,]q$5,Qװ f6%aA,eԲhp4,HR 'ְ)TC^Â! B }dCDL.aTMNk,% RbW4,@.e2&x#ᒆe5,H`hXWdGd9Ȃ [D(sNÂ! A 2հ$Z+c+yfְ s4*jXiLHAЏ$A$?H6ekXt3kX3dkX۔|3iXP,dAħaAHa`ejXP\FYK7,Mxʼ-%L,!ZY4eoY|a Jof f DD. d7\ ȤwF p|[oH,gVW ,7K o5 I]4,sTW VQ謺l`x է~*|fNrӂݷcFw_|M+eGIL_nc(ڙȓ=<"D*8/pp>ȐXdvf;_d +4GJ_L?ސZ 0cO O|HbZT`'&^˫t4жNnxsz{+G ~??1u)V}H|k*vM3uvV\ϵǷHa;r?0  ߱[n9oo珟֖a0!occyG`A߱4bH6cWmN621XOQ4U'CV}S7zי̮c f=bp:@a5~=˒+bs="i ˊ +-;ܺ! PJo& {?21IvuPTG yLiiN&W`xgŘI +RC~fu8S/Ol"O(|<41˪՞{hݩ[)֝q?dtr<qjs?ix4ҙîg1-b*w ,&$rKc9)%F})vxFgsqJ[BqI7lbQG$yNc.leח>\֍HEx[]](E/+{ɞYs?<bxk٠3|#o.Z"jzxO6s}{^۩'3ӞI:Mdy,0RqG&9s %@INɧT[K$۸kx{- ^my&X⑺xΣ.2G"Ȫ?~<*,𾯁𹅿{T yIu?GSi4,ǧm$n7ɄƳ.޷yF/a{l=6J5Q1sÑW2ŏTntUs'5>^}_Ϥ{xNNC>f ZOG4r# BD:: C oYPf(Ɗ]@,/P[:w7s+Cϊt"s(v<؁?"hq-Oߗ*Gbn߸|nPcumkgDE^奒,i(Zy/r:CY#`{Xn=dQjHUAwlі' y!uFu-s'ȢAlA\R DHbv:R9wf0 R8իF1]φ0N0n?MYkr_tP"sS:ZJ׾_s[#|G xO5~0YN]HѺۆ!D(9ay$9or=|Ksvb*~l0Lx,cCwJY5C?D0>Q('A(?.nG}D63c=\o keZx1.h1p0r+w f{4Wb\Lr(QgI6qjl]Se:*7wt(i5A(;CͧQWˋ9 <,`4]9RGvAJ DO2sLڹęqNпR1Ib?t|T{%Y.]k +8r0]t78h0E釜=yӟa@ܮĺLRlF<\O=s^;Q +;ՙǝ=&ꄮx#nK:uy6NFr<19g*fKi@5"Z$+4\I1^dܣX[DՕ-" +n8-yb'S5);,q +n?T69"F=+[ +r9ȍ, W\*4}ݥ,[bmBj]>sйNO:_/薶7*צzh U5ԚM!^/ +[hwZSo\ [R)׋Zon-4MV+/"b+ifj戥qMk?"vKHJ` z"u6r,ԔPajV!+oPUgน,-WK'27y=H==6am`$픚U mVn:z*U<kkVau|VD[@w 94S~[9C΢=vrl֓SӸC+url%B|Zgq }u6tei</i$'QGGgן7?mC ߰uE=|Q$7Ub6s n^n`5]CPJ{bXư#fQ72u3-V,vI9NJvp2Z\kWRuq(e1o]el%dIz{U]ta\RƋ훮.*fwZV(B{z}gcBmިo=ݘPT.{wusZL%Eo5/lswʕ:Jk-*SLwQJ-XG:Ziz]]iz-Q Boi;ldVhnT^jRu^EDva ¿̝f@UO+./_#G.!m>s45JF]{: ;>uPP l_@YY`Vp/yÿy!]&I;I,_EStzas81 +endstream +endobj +194 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 193 0 R +/Resources 4 0 R +/Annots [ 195 0 R 196 0 R 197 0 R 198 0 R 199 0 R 200 0 R 201 0 R 202 0 R 203 0 R 204 0 R 205 0 R 206 0 R 207 0 R 208 0 R 209 0 R 210 0 R 211 0 R 212 0 R 213 0 R 214 0 R 215 0 R 216 0 R 217 0 R 218 0 R 219 0 R 220 0 R 221 0 R 222 0 R 223 0 R 224 0 R 225 0 R 226 0 R 227 0 R 228 0 R 229 0 R 230 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +195 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-89) +>> +endobj +196 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-90) +>> +endobj +197 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-91) +>> +endobj +198 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-92) +>> +endobj +199 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-93) +>> +endobj +200 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-94) +>> +endobj +201 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-95) +>> +endobj +202 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-96) +>> +endobj +203 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-97) +>> +endobj +204 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-98) +>> +endobj +205 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-99) +>> +endobj +206 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-100) +>> +endobj +207 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-101) +>> +endobj +208 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-102) +>> +endobj +209 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-103) +>> +endobj +210 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-104) +>> +endobj +211 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb9-105) +>> +endobj +212 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-106) +>> +endobj +213 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-107) +>> +endobj +214 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-108) +>> +endobj +215 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-109) +>> +endobj +216 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-110) +>> +endobj +217 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb9-111) +>> +endobj +218 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb9-112) +>> +endobj +219 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb9-113) +>> +endobj +220 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb9-114) +>> +endobj +221 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb9-115) +>> +endobj +222 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb9-116) +>> +endobj +223 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb9-117) +>> +endobj +224 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb9-118) +>> +endobj +225 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb9-119) +>> +endobj +226 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb9-120) +>> +endobj +227 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-121) +>> +endobj +228 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-122) +>> +endobj +229 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-123) +>> +endobj +230 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-124) +>> +endobj +231 0 obj +<< +/Filter /FlateDecode +/Length 4449 +>> +stream +x]ߋ$~bU/~ÑB>?_Ꞛ^Inٛ*I]]%}U%t_rԜɻ=M%V;x&/E'%pvƐ6cӟ~s5_~P%g V]!&kX#f rCj bH`YbLb ՘ yA{AG%(=Y@.Q٥,UR dՓŋ%xEd '&ej +dA*&UvW%k^-l0` ^,j Kd,CNDΥ5fd"d !Ƀ,0!AANq€PIb@(Il@I^ C(B&"&p 8@a h+-0V|% x+ rIbarѕ e` p0Pc +0`$ B2Ƀ,Sa 䳅0 +0YXB) `d "}@AB w! {[X\@XbaAR34Q‚ܥ(CƸT-,]8* w`G D.1<R‚E-,@wp7G]Uk)D.`)XX/|БC-,H]jaAlaAzAc `a0l1`x]Oz n‚! +",,HՃ%haA D@Ƀ,֮r-Y8 r,,,@D*!6ȂbY)ZX$sXXcB>Z\ɀkWlaAR`[Xw.YX1# WȂba\+#Ȃ DYXPdA4haA YfC#-x3EP d@JY>lG Dc Gf|}SlaA'aq𼷰RAK7=MxƸ4T,!Ƀ,1nI7N/AP‚7ћSElNwc2Y<."da.o"r{,qsz#|9eVٜ3_͑I̲$snL洁"+L>ST !gY1,}9b|e~O_=L3eY&QH07M Mn"$!|M"EH,Γn*$\1m=/̄`fz2L`*N/Vr/og9 risUBRHcR\b'^/¿{w0o헃~廯?>[ ^I~C77\h=~=]>c=_߭\u#Uy>]m"C6:o ->$_+4@ %?0:u$,R賙u6D*d4tg qL; nvƯ Ip;GQ3FJ71\NAcsQtף@MoaFngØLosh(I*e_㘅u'q׎C\s47,X0[})TJGXIJ>zf_=*4-w6[}ڪK-i +l쾫}uΈ1#Bk16Kc?^,\ Yi>߬iYmmݖz/Ȧ+[{{-snQ~-4"|mqWEFx]iJ)(qjF~`}Ucr)}K qi>o]U LU1v9j7}b^W7,]&Av$4{~sd]7s-z=ྍwU9Ӣ;Kf*]9qa99AY[Qfc,µ,<,X"g9+a>Hp +4+,bHDgܗ5fz%[Kʬfg.e=cS^Ns)ѐ5Nep4X~+u|J9C45#ԢG9ݲY6*ziRoԜOzПNjO/?Ot"}F홗8D^ݐOzdmԆ]ݖ9!UӓqtFҾzADDd}zh&)|(15A\R!xMʆvEUG[ِs#>p[RMٚj xvjl%A = 5:@v!֑Az:bTR6/,]KWAt4S=뚜HZ~O'AtE~>l VغHN.~/ 5* F TNU䙾.g-WMtlvZI#=uK$y);r}voWVAe=&T5zd#7!p{W~^9c%{.Աy$nqݡ7dK֮_Mr-7`Dn( <ǠgbaDom]x-BydzxIdLe)~<e`o%#(uHr]7wO-@fqؗKn۰eפ8, |ĕ]\:púHS;xz_FSk'n)"yoZWBzxj"6ڡSGj0v<]e9<c{ %GjYxSiMpobn2ZSR1BitҕGnx=Zű;RǒŠvR޲w1d$-_ū¿׌KlUL3T#<ᨅ2*/)CDR)׹?q=8;N}&:`njwjx)Y`_L`扜~5UԿogO4W'Ͽ2 +endstream +endobj +232 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 231 0 R +/Resources 4 0 R +/Annots [ 233 0 R 234 0 R 235 0 R 236 0 R 237 0 R 238 0 R 239 0 R 240 0 R 241 0 R 242 0 R 243 0 R 244 0 R 245 0 R 246 0 R 247 0 R 248 0 R 249 0 R 250 0 R 251 0 R 252 0 R 253 0 R 254 0 R 255 0 R 256 0 R 257 0 R 258 0 R 259 0 R 260 0 R 261 0 R 262 0 R 263 0 R 264 0 R 265 0 R 266 0 R 267 0 R 268 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +233 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-125) +>> +endobj +234 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-126) +>> +endobj +235 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-127) +>> +endobj +236 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-128) +>> +endobj +237 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-129) +>> +endobj +238 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-130) +>> +endobj +239 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-131) +>> +endobj +240 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-132) +>> +endobj +241 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-133) +>> +endobj +242 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-134) +>> +endobj +243 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-135) +>> +endobj +244 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-136) +>> +endobj +245 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-137) +>> +endobj +246 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-138) +>> +endobj +247 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-139) +>> +endobj +248 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-140) +>> +endobj +249 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-141) +>> +endobj +250 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-142) +>> +endobj +251 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-143) +>> +endobj +252 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-144) +>> +endobj +253 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb9-145) +>> +endobj +254 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb9-146) +>> +endobj +255 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb9-147) +>> +endobj +256 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb9-148) +>> +endobj +257 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb9-149) +>> +endobj +258 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb9-150) +>> +endobj +259 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb9-151) +>> +endobj +260 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb9-152) +>> +endobj +261 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb9-153) +>> +endobj +262 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb9-154) +>> +endobj +263 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb9-155) +>> +endobj +264 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb9-156) +>> +endobj +265 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-157) +>> +endobj +266 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-158) +>> +endobj +267 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-159) +>> +endobj +268 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-160) +>> +endobj +269 0 obj +<< +/Filter /FlateDecode +/Length 4154 +>> +stream +x]ߋ$ ~￢-ٖ!C `H!w^SuL{" 3%U*,ׄW%<~J:ťPg%PqX_c_~wN8FWk!,&W V2X)Rb+WbAT85@ ,` .YbbAPS1XC7y3S4x! gRc5yP#rpHUsNbK%fo ! e&D)d +dN5xYкA}x\l*x^\O. x!I&#b"d>UYh0-p"Q15w`dɃ,01C_ da@,ql@r,, +DK! bMs-`yȒ8[H@0 rAj w|&Pqoer$.:* wba0ޡG$n b$.da ,,@G5y*baA腝 + )XX0vqZX>YXkkW2yk:k^a{ߘ3"4eDQtA&"ӑq7qDe=t.{vk9xFGno~(2EMAJ%S˨;-Y˪nOǷZU ]h{}Z;":)m# R-WeNUٍ ffx,2jTS9I*$HW"pn)v~ SobZ;,H>tf/v~T3:d'SmU=peD;>Yg?+ДpNxIR>\ti_0-zyg|8-/<F^hu+):j#bWB|YMi f|wQeSk6}k{ aWycy>cM vXW]ƁnXp~ SܤM<(:r"-<p|+Ø&TCXɼ7I_Љ429ќEiΓL`6/$rNQLuٹ:Q-u'뺹{g @⻋+[}a6*uFoEu" t_# Pq'&P ]?ס prx:Rqs.F:~0F.FXtyX:QsOs +W3l^҅WER-8F 8}޳ x͘.# ع:Q}Rj&oRo'kxq}js/w9#ĄyOd]9We7j^W¯1(8F䏄 $Ip5v ]oob_j"UN`ԕE#zj÷|XLFSctӐ3)=;-l>yfKeOSe|,TC^NII>/}o=)zԓ9ް($@:I*N\?^Y N䧃]D$+{LZ\,IoN}OJ5s&{d=Qr%&3 y,px+1]𸕬;[?ns`V6/x,]RLnմ} TJvpAz<į|F6?XM95$j+gfRTdZWQ֦NoE|S%g@5+Aל\ӊ>7io'_J9OpFG *R*,&'WC7;y;갥e-;+쨯 (KwmzM<[r譮š~:VD߄VrMiC^LUahw%玝O#t=;F|\:6$kӗ}և U0J^ai!7o複CY=EJQLAO7p7|};NԏG"vlݐǞL•IۈmbWrlj1xku{+:i@@f -@fO^!=Iup)+.8WZt8TxS\d1AWy4鳆!KZyvmyB`/sZ7B^gsvhԧ_Ll*-y{Zv7]5EQrVXC \mtZ\ F5x$_w=ss1Z`jF:t +EZ!aHu^hc`DO`یV?GtuJS1œYy _M!e%oO! +endstream +endobj +270 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 269 0 R +/Resources 4 0 R +/Annots [ 271 0 R 272 0 R 273 0 R 274 0 R 275 0 R 276 0 R 277 0 R 278 0 R 279 0 R 280 0 R 281 0 R 282 0 R 283 0 R 284 0 R 285 0 R 286 0 R 287 0 R 288 0 R 289 0 R 290 0 R 291 0 R 292 0 R 293 0 R 294 0 R 295 0 R 296 0 R 297 0 R 298 0 R 299 0 R 300 0 R 301 0 R 302 0 R 303 0 R 304 0 R 305 0 R 306 0 R 307 0 R 308 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +271 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-161) +>> +endobj +272 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-162) +>> +endobj +273 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-163) +>> +endobj +274 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-164) +>> +endobj +275 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-165) +>> +endobj +276 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-166) +>> +endobj +277 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-167) +>> +endobj +278 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-168) +>> +endobj +279 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-169) +>> +endobj +280 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-170) +>> +endobj +281 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-171) +>> +endobj +282 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-172) +>> +endobj +283 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-173) +>> +endobj +284 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-174) +>> +endobj +285 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-175) +>> +endobj +286 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-176) +>> +endobj +287 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb9-177) +>> +endobj +288 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-178) +>> +endobj +289 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-179) +>> +endobj +290 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-180) +>> +endobj +291 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-181) +>> +endobj +292 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-182) +>> +endobj +293 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb9-183) +>> +endobj +294 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb9-184) +>> +endobj +295 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb9-185) +>> +endobj +296 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb9-186) +>> +endobj +297 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb9-187) +>> +endobj +298 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb9-188) +>> +endobj +299 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb9-189) +>> +endobj +300 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb9-190) +>> +endobj +301 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb9-191) +>> +endobj +302 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb9-192) +>> +endobj +303 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb9-193) +>> +endobj +304 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb9-194) +>> +endobj +305 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-195) +>> +endobj +306 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-196) +>> +endobj +307 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-197) +>> +endobj +308 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-198) +>> +endobj +309 0 obj +<< +/Filter /FlateDecode +/Length 4927 +>> +stream +x]߫帑~?y"<,@``B=73 ˝d߯t%٪o{%T>}e5~3'9R1/_oZEX]ow]TPT1{6}[s'9R1Ũ IޫBR0 +3|t֍If3IHJ0\44&eaqR0G!hab ΑҌW4kTHf1-"D+FJ*`Hix㜖`[(`M[,Z' i ]IL-:h#eR>'Ĵ4bӬ'"- CJiAbZBb#qb)0%.+v$.H3Nₘa T̥4[dK\OiH\,l7(qA Qf`F,Ҝ83I\\P*J\aHL)Є~l"` y'qAJ$qAJj+qf kO€b7Y8Ҵ x: 0.9Ld҈7 6Sx3J\lpQ4) x$b fnMx@x3]LRxi7JLNLq&q@z=Vq@{1[Eq@|9F `&"ULH4Z\6_cnSD93EɌaטed{o{~]Y)[~ O.p`y،]RCGUX?F܌4m_dX683\_/" zX,[i +0{|B]0;Sa)*b_ e܉WUt0zVXݘ_nOO?>3oW7zȽ̃4orᙸϷ?~Z"n bf[:‹SP(kg[8)M_䇎[䙆ɞ׾J>\KpKt&#T.K)T7am؆~2GsVbhÄ߲s:iZ+֑s#`hj5ihLsYd?D9_N|ûwƜu:#8> *-iˎ-OMH:PT0vȠH`frrP^9ˀrTj\ +bۂlnE3W#4W Ž bac~]9 4^#"m'܁%3yZud^gR:A 1m B pp_\(BՃd"^]!<ÈD%n)t?Eg@:!4[ȸuΣݏ&;^X/hόn= z B &^,PnWؙӹx"1B3*N/@cbzp(u ީ= IPWVWg=Iw7$1{u<Ǵ *Χm2%MO)cռQ{XowNQ)H&ٲǽb&u,Y8YLgkU~#e3eN_9ҵW@J3z{s0Lef``HI[Z~|9";||& W~;yf#¬ϼޛ_Bx} ibϕgzD[;v(YAɔy0GJ +7sHGޤ]8YW@2k0ɍǍS~`@@ +^(΃jN2j]篁fY^pݵ +Z@i>%AJXȸߤu1dgBiUiF x~1O߃!^ՠ !0+\z΄o{tF8.t`'tA寽8?qFОh7&IpO:ׁ'o Lx + ++7uhNhq8ws:p,~1 uԿFpݨ}hzQ-o9%z rR:Wc%\/2׵g]m}ƺ_s뜸 nA`iCz~uYNUCe5: 3@kOE=[罶IOЙ_>hB 买Xmk:ⵍǼ6AP篓:Tv]9<@ -lͳhő''Ԃ WBmR:P#~9s&w ]=U mh 6hڨ4oǀ8a59@[zhy`cG|Q&+fms_ԹO>sҺkzY6ղ[m>1j[ *Miޛӹ 0~g޺3vf#7jc>A`p>0"AIṀBlX,lcҊ_mxZĎ3kb=9m6syvbgn9Z^Na~K1P!f2ۨ[D':XӚe<`Bgv_$g>rɆWO\VF|yZzV}m m}"cԞ Z!2Gu7s@85 UӀ<C[y͂ {s|i6pA7syvݜh]A BCn\%6Sޚ &uܪвˆDpaH0j =Yrfl0seo9P.t`.5 FcႠl2!1|2=Owa5sX b8sѺ+h{(Kn.D'Bof3['>Z:`hF홀J& +Z߃C6gw`Ѥu yꇹ2ݪo`euh{XǑFFS">gtI)[d|@ZzH WN +8sGێ5j{K`fgeӟdO{7r1Y,$ g2'XhX3o߷DZ%O9Q<+o+)sDބ~ꮺ&rkCXMtݿ䵱= V.J;IKQK\d/9kO&KkaZjDo71߳4_{*\) j FOiO0vcDZ֩Ío7~d|r/ԕ[I74iLKSah.2>}PRfqRv*YF塲Zw~Ac$-gҭk]u*yŦ–\ bkb_7;}^ʂkM*wX{SLln+f觥& :a3 čFߋxkdҌvLse?ׄڙHN +#ѥnIǸq5;#eޑ_'tE-Y=Xᖎ5hN+8c\ȩCEv6/PğڈK:e%O +endstream +endobj +310 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 309 0 R +/Resources 4 0 R +/Annots [ 311 0 R 312 0 R 313 0 R 314 0 R 315 0 R 316 0 R 317 0 R 318 0 R 319 0 R 320 0 R 321 0 R 322 0 R 323 0 R 324 0 R 325 0 R 326 0 R 327 0 R 328 0 R 329 0 R 330 0 R 331 0 R 332 0 R 333 0 R 334 0 R 335 0 R 336 0 R 337 0 R 338 0 R 339 0 R 340 0 R 341 0 R 342 0 R 343 0 R 344 0 R 345 0 R 346 0 R 347 0 R 348 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +311 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-199) +>> +endobj +312 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-200) +>> +endobj +313 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-201) +>> +endobj +314 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-202) +>> +endobj +315 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-203) +>> +endobj +316 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-204) +>> +endobj +317 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-205) +>> +endobj +318 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-206) +>> +endobj +319 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-207) +>> +endobj +320 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-208) +>> +endobj +321 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-209) +>> +endobj +322 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-210) +>> +endobj +323 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-211) +>> +endobj +324 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-212) +>> +endobj +325 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-213) +>> +endobj +326 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-214) +>> +endobj +327 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb9-215) +>> +endobj +328 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-216) +>> +endobj +329 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-217) +>> +endobj +330 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-218) +>> +endobj +331 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-219) +>> +endobj +332 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-220) +>> +endobj +333 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb9-221) +>> +endobj +334 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb9-222) +>> +endobj +335 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb9-223) +>> +endobj +336 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb9-224) +>> +endobj +337 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb9-225) +>> +endobj +338 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb9-226) +>> +endobj +339 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb9-227) +>> +endobj +340 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb9-228) +>> +endobj +341 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb9-229) +>> +endobj +342 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb9-230) +>> +endobj +343 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb9-231) +>> +endobj +344 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb9-232) +>> +endobj +345 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-233) +>> +endobj +346 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-234) +>> +endobj +347 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-235) +>> +endobj +348 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-236) +>> +endobj +349 0 obj +<< +/Filter /FlateDecode +/Length 4954 +>> +stream +x]]6}_ρ(J >$,w}ؿܖ,[nΐѩ*IU%gTJ9w}rUM%VSO?.*orH(z_˶_]1Wr8ˑ)F텬,mH^h}QŜ,ᣳϊP,MBV䢡>+C > +YFCcvg + YB6yy&Z)H7R^V!<]|F純](B]l$Eb;YKJbtA)/99'eSgW>i)M00H! +y] 2&spYGV!lm\ƧMC4Rm *Pw#PAAvNy/݁(K6 +#ɜDw|V ACW^6N8ˬj O)aW&9X^f@9>]W:1N@h:wNeiAzdWuY1 ;YR ʜ8 kx"pVoڙj 'z%vyl-2k8(sangoU}8$3gy:KkwE|d9h>Z6 1Øg|&Voke '&>/!umX'}`.:paP<3|>!}&V1v3fC *h@{b20coֺ`M@ڰW6ւKz=yԑ'L"mP<`㧗"_`sc&JM^&J/ Jؐ>.he{P<ʀJ߷&J.Ke?u 'uz=femaeu]Zs|o,g_9$:O҉'[~ <7D=9շfKl.2ZiL4p +^<8+݃ӽ(uV 06Ah. +Q$c2/LX*mMB}l=.;s;p(N#p{cpExA)ʛaCFr958'pj652ĦwmhYz=oS+v+lZ==&rְ^˳*]jE9K;-P0\<{P">k,,Z뾽u_A~&򫼮nB4!Ldħ"5 3RժoY4q?7oԞҍg]6a\)}t>T&~7؜^)K6} /Cd1(kɄ5&ƇhP}VD<8]IN/my 1@'k~c Jo Ӽ_ru4Æoꥏ.A~Lde]AL0*= oR748K `P8"0(syPtf^4<][Gꥏ=%mWD. ʜPr?PJ7sW>G{cˁ2S `CiC"SV'.r͋,,w{6:lVn~ߺJ_ a㮗axXAO:$;@{|Olnu: ŷۏ_z~l3IqVmL^3uޑ>6[-#I')xvb.40_.u=2oߊS2nzo9!Lu)M Ty[\+'_~Z_}w8rX5,$B2>kN7%EU5qеe +ɼw$>Q7-FR֟9mיfKYK|YڦRU]XIF\S})Yq^.B׺TqoFߕKLH˥r͵:RJh.=@Rx!m959\'2u.§׋Bipzm"5,1,iqF2L?,WK#<7kPYI=5]*ꎱb/PI=JmI$Ucl*j2SXʕm.J%W(=}^ƂikKr&:?P6//asd~*,ɼtXSk@ +KBSrsd}z̜%oE dKFwdC/cyu͎[]Vn]%{;x%N&Ѻdqkv^4AMm҇Mе;/^`.х.eZh1צJ\qŤ#Fml̋f+5m#Yq[EF%-yn1m%m\`j/ڊi+}<*28R{M}mSqj%<9˰62yuQ3:9X\ h1ڤEl.F]I[5Z E VkE0n8OoGvoG%tebD-rwz)Y}$V$mnXksnQ$,^|WMs٬Hʟiäc30D4}?X!?]j4q+em á-8|%ZǸ[:Bs[>慜z9T/;?XtZ>yP۷ +endstream +endobj +350 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 349 0 R +/Resources 4 0 R +/Annots [ 351 0 R 352 0 R 353 0 R 354 0 R 355 0 R 356 0 R 357 0 R 358 0 R 359 0 R 360 0 R 361 0 R 362 0 R 363 0 R 364 0 R 365 0 R 366 0 R 367 0 R 368 0 R 369 0 R 370 0 R 371 0 R 372 0 R 373 0 R 374 0 R 375 0 R 376 0 R 377 0 R 378 0 R 379 0 R 380 0 R 381 0 R 382 0 R 383 0 R 384 0 R 385 0 R 386 0 R 387 0 R 388 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +351 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-237) +>> +endobj +352 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-238) +>> +endobj +353 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-239) +>> +endobj +354 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-240) +>> +endobj +355 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-241) +>> +endobj +356 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-242) +>> +endobj +357 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-243) +>> +endobj +358 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-244) +>> +endobj +359 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-245) +>> +endobj +360 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-246) +>> +endobj +361 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-247) +>> +endobj +362 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-248) +>> +endobj +363 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-249) +>> +endobj +364 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-250) +>> +endobj +365 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-251) +>> +endobj +366 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-252) +>> +endobj +367 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb9-253) +>> +endobj +368 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-254) +>> +endobj +369 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-255) +>> +endobj +370 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-256) +>> +endobj +371 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-257) +>> +endobj +372 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-258) +>> +endobj +373 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb9-259) +>> +endobj +374 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb9-260) +>> +endobj +375 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb9-261) +>> +endobj +376 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb9-262) +>> +endobj +377 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb9-263) +>> +endobj +378 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb9-264) +>> +endobj +379 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb9-265) +>> +endobj +380 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb9-266) +>> +endobj +381 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb9-267) +>> +endobj +382 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb9-268) +>> +endobj +383 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb9-269) +>> +endobj +384 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb9-270) +>> +endobj +385 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-271) +>> +endobj +386 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-272) +>> +endobj +387 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-273) +>> +endobj +388 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-274) +>> +endobj +389 0 obj +<< +/Filter /FlateDecode +/Length 5112 +>> +stream +x]]$9r}_Q `20{a]ۆY?GfFU05wʐB"$e=|gN9E:_~>)9OMl )9)RJ4.[\5 iʸ'!;iiL%d f ބG. ěI]. fL@ V 7$gz"Kꊁ̭ꒁbJꚁJ.LDULHF]60_cSD9dư x5hl&_wJY(u!2t5HJB1"f-.nb$bL\?صɰXlpf;^D +]n:Oo#do$ +|aǔ~mfR}\YR1 y08^1VeJ1>LuE7]yJՊJ_gnyYEReun10\ttP qhr`S~ e 6a}"Ve*,\:]=i,z Bp<-~1uf ֳbPu^G9v'.) r,DnAQ/^ + +Lpb1<{5>Fx~.d͝Lx1ׁ@ +<.tnfnDVG)00 7Avywv DF6eJ$@g3ÚxArLu dS{&$WT`ò41 Mzqڏh]>1P=[ Y"Ry9YB9[攷9`&7٤Tc⩱'i|N8r~_}=8{<>Ve||9fgduԹy޷l3a*Z6| ;/m16Wzo#^1WZѿ\MBt!ׁZbdB8D6uC]m#OweVܫpd'cޥ$>,G@@Nԫ*zkqͽPY1Pk#!G'NΎY2hoPuaBc9ĺй}ee .xpc5FyS|//p8fC$M{,͚){ϫM9mePud V~&Zy8Xdَi]Mȕz mǰl+{푉Y_k{^,ojewP-(XBWP#r][;^ Z}^fɓ6*|R_.%)Q~VrtKUSp`GPZ|s luK;\]0ݱE/vtP\mKhp7cVGɏNM;c0.]sg'-Y{m.ΈrW*Zyk;k?/ݫEoI{ܶݴ>}V[mמsk5鿥b.r헥ftޯnwi7.}b +v++uWu%9`/ſcYv%5[7M;70~i_)Wol/Qz{v~ӛ?ʣzmZ[ g?pqm[{6۟!_ ?.76cpܥX`pP@+ɖEo0>0Ѿ= oG2=fs{c[:mCh=S;9nPu(S&K[~K SI~!PvX>c'k2"ZAPR= rO2vf~0>(t^q~S%\ӽQ6`2"8=#y< 9u_!I,Ks:;ِD~]å?] '㰁(-;ȗ!o+=7n񜔳ߺЇYl`߮mz^{ǘq)29(t G?۝\>vjk\MU_An,1<: Xy73 gI + thڝ9 Ns<^YHbg7)WpяAd66?u }j\axgoCdxbo-HRv~t>""2v$t5VWu"EZV> !}eA+e2kga mjejPFVsQuXgyTiy=Ńڡ)YZ-$Y,ʑS/0=t=f!!Ϧ=q]R6ϧ8/;6ҨN ጀIΜ|k y |Csk. 7MK87vr27]h|)bv@,壩eJSa2vY\]?M?5ӕ+bEhb{3E,__b54H}V`S<bt5~̵!Mg/y]rB~+}WRTi]gwF* %g.'E)E:w& +j\)IͷjOj.-LiP\^]I#Ɨkq(}mÍ /@u$6)$%wh\aB^/]U̦IeK CJJy*%U"c׍ceZ@f*f¼ҭk]uyBR8qwdD?':Xވ{ǝl*L&_gÃbz"æ:h-u|MM4b/9meP[S{ahm؉]kpGxٴbud~iߴ zI( R.Vᢿ\rKmJ>wEJ):E\ⲫ07Vf + JjӋw!Qfl. \`_++{?<~q/&2DZJ{i1Vӥ~:9,P-wcW' Zh'妶d}TdJDQ2SdTlZiYmT}&[ҡڈ+zK:@sjwgZK"vRl_7. j晚v9?;TZ3`XnD-u[qw8Fp7$nIakׄ{|n;qBWTG]M[z%FsoBNL*[=DXuIg^jɫ]@_ +endstream +endobj +390 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 389 0 R +/Resources 4 0 R +/Annots [ 391 0 R 392 0 R 393 0 R 394 0 R 395 0 R 396 0 R 397 0 R 398 0 R 399 0 R 400 0 R 401 0 R 402 0 R 403 0 R 404 0 R 405 0 R 406 0 R 407 0 R 408 0 R 409 0 R 410 0 R 411 0 R 412 0 R 413 0 R 414 0 R 415 0 R 416 0 R 417 0 R 418 0 R 419 0 R 420 0 R 421 0 R 422 0 R 423 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +391 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-275) +>> +endobj +392 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-276) +>> +endobj +393 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-277) +>> +endobj +394 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-278) +>> +endobj +395 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-279) +>> +endobj +396 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-280) +>> +endobj +397 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-281) +>> +endobj +398 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-282) +>> +endobj +399 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-283) +>> +endobj +400 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-284) +>> +endobj +401 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-285) +>> +endobj +402 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-286) +>> +endobj +403 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-287) +>> +endobj +404 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-288) +>> +endobj +405 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 443.811778 177.650223 428.811778 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/installation) +>> +>> +endobj +406 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 415.114756 101.433071 396.364756 ] +/BS << +/W 0 +>> +/Dest (cb10-1) +>> +endobj +407 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 396.167735 99.933071 377.417735 ] +/BS << +/W 0 +>> +/Dest (cb10-2) +>> +endobj +408 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 377.220714 99.933071 358.470714 ] +/BS << +/W 0 +>> +/Dest (cb10-3) +>> +endobj +409 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 358.273692 99.933071 339.523692 ] +/BS << +/W 0 +>> +/Dest (cb10-4) +>> +endobj +410 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 339.326671 99.933071 320.576671 ] +/BS << +/W 0 +>> +/Dest (cb10-5) +>> +endobj +411 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 320.379649 99.933071 301.629649 ] +/BS << +/W 0 +>> +/Dest (cb10-6) +>> +endobj +412 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 301.432628 99.933071 282.682628 ] +/BS << +/W 0 +>> +/Dest (cb10-7) +>> +endobj +413 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 282.485606 99.933071 263.735606 ] +/BS << +/W 0 +>> +/Dest (cb10-8) +>> +endobj +414 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 263.538585 99.933071 244.788585 ] +/BS << +/W 0 +>> +/Dest (cb10-9) +>> +endobj +415 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 244.591563 99.933071 225.841563 ] +/BS << +/W 0 +>> +/Dest (cb10-10) +>> +endobj +416 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 225.644542 99.933071 206.894542 ] +/BS << +/W 0 +>> +/Dest (cb10-11) +>> +endobj +417 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 206.697520 99.933071 187.947520 ] +/BS << +/W 0 +>> +/Dest (cb10-12) +>> +endobj +418 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 187.750499 99.933071 169.000499 ] +/BS << +/W 0 +>> +/Dest (cb10-13) +>> +endobj +419 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 168.803477 99.933071 150.053477 ] +/BS << +/W 0 +>> +/Dest (cb10-14) +>> +endobj +420 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 149.856456 99.933071 131.106456 ] +/BS << +/W 0 +>> +/Dest (cb10-15) +>> +endobj +421 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 130.909434 99.933071 112.159434 ] +/BS << +/W 0 +>> +/Dest (cb10-16) +>> +endobj +422 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 111.962413 99.933071 93.212413 ] +/BS << +/W 0 +>> +/Dest (cb10-17) +>> +endobj +423 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 93.015391 99.933071 74.265391 ] +/BS << +/W 0 +>> +/Dest (cb10-18) +>> +endobj +424 0 obj +<< +/Filter /FlateDecode +/Length 4783 +>> +stream +x]ߋ8~Ͽ"F+)B`eaazjw9jfiɲ.+wQ]V>²-~~p/395)XJ.&_YN&s*J&S/zqwoJޅ?I9%V:RX!| ++:[,EcA󞕠4`P89ڳ +ɱƂ[e&\05w&K5]pcK(i]c0"tHVAi]`&9*P` r ]7e4,( Ӱh$Lְ0aƥ7,֛X)PfҰ0t QTtATq Lz"t5,(1z3kX0MDjJ z3n(@&Ed5,֛lLgfYqf5c`s2^VIXԤ2G5kiLgմ"&JWba 6iG%4}N#D; D91Z^O7 G~]vjc.gtO~OB>Ap?:`IaUR G5yu2!\-n_돓?M5;#\CGH:2YD/jc"2V[I!޳.Ͻo& ?y4"i#KR׉&L'F2 7ƗQ`˄jt/,EE BXvLجhQJΗu$io/b9ziֽQfDW!lS"C]6_2;I,ed.|)ESGif7[ͷ8N6]iwT_Ni&=pI?(&G/j7$vA븠DB4,Q\قkm>upCH<ϡ\$IXo}\s`P;O4(Ss\leǑ6wEG,I6OgP:U»ͳ;33n ݯR]I\0[:-`Ȼ-tgi1tla +󁇾+3y9yA|Q8y4i9aS+\ƌ=>>u#66tӴ.7]sݳŽ<[K?lQwălF^d0*䳍72qYy"#[o֍|>PB.[sLfEzĥc_JE.WncvzJu\95}W]5yN4cԿ"5:ml"h#]afAk0 "C N`NR;͹ \ǽ]v[^FrfE\!iX{َnN'oeSj kള˝LfzW?ve8/)6y)!*<ۘ3(s B鼫J'=_^hzw-e$K0r|;1tM))hmhp[Ox=ul]Pn9ڶQ/>ʦ69hxDH\Y6Y9!aJ>h4;(sӹ:$~n]`ET%)"Gz;Ng\II_}~ݶXVOGE7YnE4(snD)Û_R3yu>n{V~f%wdx,Y NC1f?wH`j/yƟP䓎Nא)g>xqŞj|!m-@:d96ȉE.TO͹Sql7r?vu3?}. kl\G9@h*s e.1v㶻 F7k4,Ǧ%,7sC@rzZ)$+ Kxb.d_oNQ|q:Ȳܒ_or:=+dL#~,mu ؐLٖ`)ԏ>ԻP@:rC?n|ǽmhL&ߴ+؆MGBvy)7yy ג!kܞ>ȾwLx|m qIٲ[E; )U+)LqWˮhRSouϽ)H.0B.i2UWt]_-+}=ʱ6hoמnL t*Mq}.PG-YZю@J[5Z'Jk5SjLw^J-X{:Viz]Yx-Zޝrwv)bɬb/ݨJ۷l{nEE,J 3v2lVL 1QKi:c|Hܥ4y;DZdGa&'= +F9gtU%drKuY`28ӗOߜiI]s$AoI֩))e>~A +endstream +endobj +425 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 424 0 R +/Resources 4 0 R +/Annots [ 426 0 R 427 0 R 428 0 R 429 0 R 430 0 R 431 0 R 432 0 R 433 0 R 434 0 R 435 0 R 436 0 R 437 0 R 438 0 R 439 0 R 440 0 R 441 0 R 442 0 R 443 0 R 444 0 R 445 0 R 446 0 R 447 0 R 448 0 R 449 0 R 450 0 R 451 0 R 452 0 R 453 0 R 454 0 R 455 0 R 456 0 R 457 0 R 458 0 R 459 0 R 460 0 R 461 0 R 462 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +426 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb10-19) +>> +endobj +427 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb10-20) +>> +endobj +428 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb10-21) +>> +endobj +429 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb10-22) +>> +endobj +430 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb10-23) +>> +endobj +431 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb10-24) +>> +endobj +432 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb10-25) +>> +endobj +433 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb10-26) +>> +endobj +434 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb10-27) +>> +endobj +435 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb10-28) +>> +endobj +436 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb10-29) +>> +endobj +437 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb10-30) +>> +endobj +438 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb10-31) +>> +endobj +439 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb10-32) +>> +endobj +440 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb10-33) +>> +endobj +441 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb10-34) +>> +endobj +442 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb10-35) +>> +endobj +443 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb10-36) +>> +endobj +444 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb10-37) +>> +endobj +445 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb10-38) +>> +endobj +446 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb10-39) +>> +endobj +447 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb10-40) +>> +endobj +448 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb10-41) +>> +endobj +449 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb10-42) +>> +endobj +450 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb10-43) +>> +endobj +451 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb10-44) +>> +endobj +452 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb10-45) +>> +endobj +453 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb10-46) +>> +endobj +454 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb10-47) +>> +endobj +455 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb10-48) +>> +endobj +456 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb10-49) +>> +endobj +457 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb10-50) +>> +endobj +458 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb10-51) +>> +endobj +459 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb10-52) +>> +endobj +460 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb10-53) +>> +endobj +461 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb10-54) +>> +endobj +462 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb10-55) +>> +endobj +463 0 obj +<< +/Filter /FlateDecode +/Length 4628 +>> +stream +x]ߋ$ ~￢g[/8,I`N6!.yȿOeZ=Cv..,dD# FH 4`89ec1\ Ia9 9VAL^`":=j'x xNQxʃ,6Z +P2+ٜ-`B&9`0,ц K 5AƏNJ9+&KN}bY| |,6E 0>%ų>YCH_Xdxi@@, ְ4 z G `(ch  z8Y߃Ix%+pʘZK԰ w]T^1.Ǖq^6.ƢaAQ  <װ wSk#ˌVxhjV̬aAh$T԰&RAЏ$A$?H6 x;`'GQuo\O' ~rޔ񷼐Ϗ?ѳsWƇc P79k!gzBce,; +. =#{E@qztF{ڕ蔟g]zl) Už*jFU EvdsA.㙼;6+-(&Zn|>z#UѲmGƋ2M1=L U֏|!9Rnq+"۸R$oŘJ~ckah{{=o,KUHϓD RN;;]>X8]LŒ%G9auʯLH`<,3V8u ˏvpe9Z 9ĘajZIfgdm18jd;Bވӻ 2 w;=$Xttf;u$mnz[9#/J[ (UaeU92L }eQ1#LISh޿Wac,w*ʻzM*m'MVx"2*S#9$.~ o>FOt}iQ0s2X, ΋hvaTVVb |jߨjDܦѧw|HA y~^oRҥK_ +0o]Yy]b%r*ZH!JO& eal5vsuc| ϺቬW'Ir}gmвΥha9`Ks-M佩S&PjDu~85'7gl}B8hgG += zЃ!et>mM8Gҡ1_*;hw'!,oO8F*/D$SuXtMp\-^)a3-2:k:uwyMz u${?):r웑|^OWLapMXFv6/f>kВsc>{y_sut:|6KTۙ>o rW~TOv+޲ᶶ>eltrT@~wxq/+1 ox>?{?_t)g y|ÊTs[\ 0?y\w(ʫNv6XCݢRכ̩koۮiԝeRVyO;rȸy9y+F}a#n6\vMyɖ2-<+$ `ߘh@gLΥ0:ԗa| gq#3:zC=V2->2Bi:uuՎ9j쮕bҺnt2e )OlSIm oeZNjl3rd2'yz5̏m26%MAHwaw:%|gu!3lVV, cgrnJ,#x\4[dGcI?g9YG4gb.Yfܯ"߯#6dy =ԭ:e1?s27'.R&tmkݺ(8_Oq:gMg8E%ѐF\O*g9.[bWMwjNGJo*zSs_'r7*'0ۉ/l/'92?Hն{f HlKR0vZ)ԯ>ԧV&aݒ-,gCUlXeq!e.wɲb![[rM-tb:שSk ҖRzڻ6uBF dS7=)I!~k+&'P^rSHZn[hJT^(SnЦ>I,C7F,կkr T]#cX/'ف{C~9 VPM'RwFv*]ahV'PUg⸙lg\Fdl6zzlZ")5 R^@n=v]S H5X]FӰ'*[ȡˊP 5]gw!dž/=95;9P|%^&[~,d :"@a!/02hm$[eirirs6ȝ2??N|Hy6 [Wޓ_ȃd؆MGBvy)54?}׼T ג!kܞ>ȾwLxxb d>W7þ^R}84Cri +2/jF}OtחtSK{Q79XB ^]6QRm.FVVG4[i펩j['j/S,Կ=zN VMYox-Zޜtv)bɬb_Qy)Iv6ۮ=/%2KpS]s-J՟ig8jvdL#0+$ݔƛ>q;Q8D69j/`}Fwj^Hoe +g9{33'reTQIЛπ$)iy5}2 b +endstream +endobj +464 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 463 0 R +/Resources 4 0 R +/Annots [ 465 0 R 466 0 R 467 0 R 468 0 R 469 0 R 470 0 R 471 0 R 472 0 R 473 0 R 474 0 R 475 0 R 476 0 R 477 0 R 478 0 R 479 0 R 480 0 R 481 0 R 482 0 R 483 0 R 484 0 R 485 0 R 486 0 R 487 0 R 488 0 R 489 0 R 490 0 R 491 0 R 492 0 R 493 0 R 494 0 R 495 0 R 496 0 R 497 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +465 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb10-56) +>> +endobj +466 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb10-57) +>> +endobj +467 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb10-58) +>> +endobj +468 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb10-59) +>> +endobj +469 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb10-60) +>> +endobj +470 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb10-61) +>> +endobj +471 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb10-62) +>> +endobj +472 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb10-63) +>> +endobj +473 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb10-64) +>> +endobj +474 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb10-65) +>> +endobj +475 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb10-66) +>> +endobj +476 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb10-67) +>> +endobj +477 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb10-68) +>> +endobj +478 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb10-69) +>> +endobj +479 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb10-70) +>> +endobj +480 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb10-71) +>> +endobj +481 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb10-72) +>> +endobj +482 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb10-73) +>> +endobj +483 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb10-74) +>> +endobj +484 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb10-75) +>> +endobj +485 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb10-76) +>> +endobj +486 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb10-77) +>> +endobj +487 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb10-78) +>> +endobj +488 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb10-79) +>> +endobj +489 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb10-80) +>> +endobj +490 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb10-81) +>> +endobj +491 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb10-82) +>> +endobj +492 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb10-83) +>> +endobj +493 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb10-84) +>> +endobj +494 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb10-85) +>> +endobj +495 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb10-86) +>> +endobj +496 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb10-87) +>> +endobj +497 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb10-88) +>> +endobj +498 0 obj +<< +/Filter /FlateDecode +/Length 5118 +>> +stream +x]ߋ庑~?y\G?JR }XX >IX.!~dٮӖ{z ;LK*,}Jm{5Lv`)巋R03XP͑W4\ [՟/-u 9Gg_8%"cR Q)v%Ѷ( "AαR0S~[aK"asHJ5:c2bSl":=jejYBMN+~lZYb2-!,` yNZY->zke 8NV]ʲBf",pm3aʬ2( RLJ-фTи{k\h\AdոoبqLqzqJYN DqzqzFzM ok\@]oMҸFNF 1 ؐu .@-K׸.4 u8 E ch + z8[@ߣy p!,Ѹ wmS4jkç&2o˃1k\pT^}i\Ske]Ѹ w7 "иmU`2 Zr $jY$qx0C5.]qAkaZ[<; נ VVZxXV5&e "xWܦ10p@4.LCN)j\AB>,8$Aeei\z>  "EpQ-5. 4.H!"Cje @j& Rj\\j`Lz @K YҸ e؂q\Vfa l Z Dcdh\\]<5.`` Se4qGq$Hs2i\$d a3N`SͤqA6Ad @(3Fl# 0/%d 77)6(fҸ l Q2؂)+|줕E2i\c|5.@|$o&u2I+"2&"[-7 ސ,'+[%JꚁJ.LdUUZ./1p}]C$1-}9jAz|ݸRVZS:q F aktĈg#-hqZt#nb&b"v)X uV_C)o0ݮ +7Ty Kѐ|vz -*ۧ }6vÛ:י_/OO. ?ޟ}DNMMi4RO,rsypO;=1AY~kZ؏p݌l\>WG`.>Gߏc@b49 #6x5sCi)Y%"ۦ?V>1V25E=2 T, +Yrvةs4"KBqǥ'~)X,V1*'l +g}iwm0p*֣;-\e4vGO ȶuԱA'K4)+cB;uPdގ3ɗK#>O\t ʑvض}1 +=W=;m$Glښ42 >1-H .X"9j3YqBӀ4@Jخʍ5r}+7P籛gIg#,ڧs:YB9} xFk7~(ܶs$j :'ZT(J +z n:灢<ڝ /_G|rHP\ ;odݕƲP2xt-7=ht.Y攣q+hg֣G%``4ؽ9p'#t[ #߬c5p&&ں!MҴ{"q$k8bFIv!ݧsH3!4b D +捛,p>` piȑRִ{.$0+o&:灱C;:e?zfɶI(5{z9xztHAn" E2J{Dnvq#Ӂm[Gҁv7n$r_}|fكbyaD]9m&v@ ?1ysC͙f@V{Ml@:̲ŒDf}:hYٲё^y@l} bJ!FDzEKv[D{*:u1tC8HEݪR$͎n{ңEy¦h$ ;u3n5F?㇧&jb +7ERE}YڛT݋[,~l-~(=H s'=N@Xv +~z=vWSS2pSm޷->-ko,ܟufЃu#-[߶mY6j?-9Mq:灤]$ӿ6ݩsfyG kK#>~mzkϑߵiސC@6OcPi +m0?r?ʊ!Q܃ײIuĉ+Vg|O8-vuR.pwV<MgA=\tg oШb`G7_Mނ8]iD3G)?$Ͽ|r٪z$*(Yĝz%$0D&S=r_~d$3Nui5Tꄦx-č|yݿ]] ;~1ϲ 1_ʷ4xԽv{}9~2ZKȇdTq`~Xp\0ofv"_#EPuE8jdSJv!k0\OCՅr5|Ag(G{ÊnrsXȃb5%b3 ;pV[oa +M,CXMo6_ KYʷʩJۊ7F* f㤈nE) 7&_ j\)E7-ԑJϪl uϵG4g`9b|u)2e 7q"}lϗa + +Zo[lfR" S{!*B +XoGs#27xITm0_ѱZ,,h6g@ +xQ\fke'y:O2.n z+#l#{' B_p~ܙrBz2z-wkEXM#t,<  Տ;5f&RVu7=^VXa}8yi|:Xrps]9%QJQA{R6 ٲȶb?Cᥭ #e4E6^ES!om {_={'c"^ϭ^H+R?a9~|'KssfSc-hqb6UmTdFt)zTlZYTcYC;*C;*qSW[<^| B 4_kXYl暾ȶmӲmelH#S3MWk]gZ* '&/$!$rM͒a8+em 1&Y (ͩjrI:@Y™ilVpzϴS!]5d3.'v +endstream +endobj +499 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 498 0 R +/Resources 4 0 R +/Annots [ 500 0 R 501 0 R 502 0 R 503 0 R 504 0 R 505 0 R 506 0 R 507 0 R 508 0 R 509 0 R 510 0 R 511 0 R 512 0 R 513 0 R 514 0 R 515 0 R 516 0 R 517 0 R 518 0 R 519 0 R 520 0 R 521 0 R 522 0 R 523 0 R 524 0 R 525 0 R 526 0 R 527 0 R 528 0 R 529 0 R 530 0 R 531 0 R 532 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +500 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb10-89) +>> +endobj +501 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb10-90) +>> +endobj +502 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb10-91) +>> +endobj +503 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb10-92) +>> +endobj +504 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb10-93) +>> +endobj +505 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb10-94) +>> +endobj +506 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb10-95) +>> +endobj +507 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb10-96) +>> +endobj +508 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb10-97) +>> +endobj +509 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb10-98) +>> +endobj +510 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb10-99) +>> +endobj +511 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb10-100) +>> +endobj +512 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb10-101) +>> +endobj +513 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb10-102) +>> +endobj +514 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb10-103) +>> +endobj +515 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb10-104) +>> +endobj +516 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb10-105) +>> +endobj +517 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb10-106) +>> +endobj +518 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb10-107) +>> +endobj +519 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb10-108) +>> +endobj +520 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb10-109) +>> +endobj +521 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb10-110) +>> +endobj +522 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb10-111) +>> +endobj +523 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb10-112) +>> +endobj +524 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb10-113) +>> +endobj +525 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb10-114) +>> +endobj +526 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb10-115) +>> +endobj +527 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb10-116) +>> +endobj +528 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb10-117) +>> +endobj +529 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb10-118) +>> +endobj +530 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb10-119) +>> +endobj +531 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb10-120) +>> +endobj +532 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb10-121) +>> +endobj +533 0 obj +<< +/Filter /FlateDecode +/Length 5065 +>> +stream +x][,~_Qφu Â1p]8CcB[fFUfxJ.!EI6W ~$2*]o?]~hƿcPwW)*orH'b6?6sus*`G&S1Ũ@ i*F@ +F9K$#Yړ"ؠDdmH l8IlhH" }HFci`D9+ЌW$5*lHh%s*D2HB>I4/>k#X `Q +8#%, s() Xr&9 댎pJX*alJZڤI ҢtpztA]뵕l?Z/+a=hIXʔ["a 'i2) OQ JH‚1D Vi 4%,LJK IX3xTH% \'[x#aAޠ&DAKX XC-Hs$,H` R4`KX&^' Rn& R/V[ oF /$,:(v%,$ě$,x3IXFO7" ,[`MD f fnMx@x3]L 4HXěl^x}&GI\1Ѐ^*.h`/U 4c$ql"LA\5Yhq@էy*@"lfɌiA{1;ٖR־ Q\R!8<,s ~ 3`3 S sY ggv)w$^c] S4~V@.-% " +M/qap~/?zv|_>0C^TCoFL7&7|׏|OSVw<> +*)%q4u\QK8h67/1rhy7=s,>2#Z C c?ް xiPLKYB^F0V9RY F!6C&f+>{7sG߄l%̒Փ7"Q!#X\QOpTUE@/Sk6*g՝\V˒ۤ$)}$x}<P( Q*}bB|Eu:T`M9*)T\Q'ܱ6tb*:/4`]j&IcCmp2l>2#z !Yx 7B4RTAWqV<[KՔn=F~Ym\y[d7n]80zs&je,e/>crʿ,~.rdž(dQn[{pܫF~Mn!RWn~ =5!(ftLw/8o\QD +2wFMaRWET#oU`\XOw[T">۴ɝm/}&yWjLQNi[޳Xd?|ӴZƞ_~g^*\TMaQǚ3|fakkuҦ зjK/-)sOZ.{Xݵsaja%` pZe>bSG &ٗcmdždmwPTGAgik%_))yB4f4?%_i'g~1O񻍾OK_ N}nE?ƠF峭9Ʈ<_&nȍ"=o%-`켖t+GZ˩gʓM啗͗HF{csjҐ /To½N}i[ n}{8ӵ;/Xc;?ЏI?(Sǫɂ^Gzim\W5uKÇq۔+1s[<\EL&{9s+,Z7>̞em1gm[yɽ:YF3|}0'C>^rۆvO2Xw4Kф6 =Z.I0|S2#>m')^_Wu^J.;LD}Me 5al+`VsEG19F&z>o8$ny MBwیseFI1H䣽#u#_;(ϯ7> Yޝ/>Y,<" N>x*l\m皙G/ȯ]'QCVLy[hΕyx0 *Esf .N.cO6w_޷Ӿ%yI7%|/KKBy>i7ר\Jںu*IH^S[fmXܴs1{h7 _db;XLsegJKV|cүпlDpֽ}WIIw[Wݨ_eIo Os[n('oQ'-sjg_ +5xDTeB;" lH6dYd|:M'kܜ69e\t2O#ް(Mރ:LTR/]'ג2>yt|Eq`)WGx=Jm%8 r Ew76[nϗшt9&7ڶkhgMcp| B,S.E{q&SxF⨐漣Q0[F'꩹̷#]HCg&pͺmꛘʗZT.'!vӭj0;})|n1_wIŞ+`e:Ә iHb9dhiK].⣐оޜz{rC_F*:T-/ TS>*ŗ͞9=t!i őw.cyLB~ݞ*u)=TuZדtuc͍dUm<}z fRwɡcۜ N:oŰ6U?FF2X5M1H0Vlį[cIv9e/58ޑsŎ[vl]%ϖO'ا͔hil6t;n4-j:uNc dU7xیbwd~l^]C׮P0wi0שJ~Jzޒ9鑳IH sJ#kiivש4 3գ}d,e6RUV0LwPκt +B||4-i5JF[[89?%B>&LU?%Z@X0w+8/_]鏑CE?|3%{QqI^W6/ +endstream +endobj +534 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 533 0 R +/Resources 4 0 R +/Annots [ 535 0 R 536 0 R 537 0 R 538 0 R 539 0 R 540 0 R 541 0 R 542 0 R 543 0 R 544 0 R 545 0 R 546 0 R 547 0 R 548 0 R 549 0 R 550 0 R 551 0 R 552 0 R 553 0 R 554 0 R 555 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +535 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb10-122) +>> +endobj +536 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb10-123) +>> +endobj +537 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb10-124) +>> +endobj +538 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb10-125) +>> +endobj +539 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb10-126) +>> +endobj +540 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb10-127) +>> +endobj +541 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb10-128) +>> +endobj +542 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb10-129) +>> +endobj +543 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 329.565778 101.433071 310.815778 ] +/BS << +/W 0 +>> +/Dest (cb11-1) +>> +endobj +544 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 310.618756 99.933071 291.868756 ] +/BS << +/W 0 +>> +/Dest (cb11-2) +>> +endobj +545 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 291.671735 99.933071 272.921735 ] +/BS << +/W 0 +>> +/Dest (cb11-3) +>> +endobj +546 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 272.724714 99.933071 253.974714 ] +/BS << +/W 0 +>> +/Dest (cb11-4) +>> +endobj +547 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 253.777692 99.933071 235.027692 ] +/BS << +/W 0 +>> +/Dest (cb11-5) +>> +endobj +548 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 234.830671 99.933071 216.080671 ] +/BS << +/W 0 +>> +/Dest (cb11-6) +>> +endobj +549 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 215.883649 99.933071 197.133649 ] +/BS << +/W 0 +>> +/Dest (cb11-7) +>> +endobj +550 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 196.936628 99.933071 178.186628 ] +/BS << +/W 0 +>> +/Dest (cb11-8) +>> +endobj +551 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 177.989606 99.933071 159.239606 ] +/BS << +/W 0 +>> +/Dest (cb11-9) +>> +endobj +552 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 159.042585 99.933071 140.292585 ] +/BS << +/W 0 +>> +/Dest (cb11-10) +>> +endobj +553 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 140.095563 99.933071 121.345563 ] +/BS << +/W 0 +>> +/Dest (cb11-11) +>> +endobj +554 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 121.148542 99.933071 102.398542 ] +/BS << +/W 0 +>> +/Dest (cb11-12) +>> +endobj +555 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 102.201520 99.933071 83.451520 ] +/BS << +/W 0 +>> +/Dest (cb11-13) +>> +endobj +556 0 obj +<< +/Filter /FlateDecode +/Length 4901 +>> +stream +x]]$IѾ_¦_ 00xqףYa¿ՕUU}ۊ3tWD~DeD>l+2;sIϗO?Iϔb0)d+1BdR > ooH0p湁>Xaw=a  w!A V{ ɂY*pb XB%kXcK5[gf 2G#&i)UdLhX`;hXH֡dΪȀsl*af*ͤJxjŀ6 ?!*dـ+~u,!)*8+"/~ `E_}:꯳qq=O~z=}ZBorw>Og~('%_nc$bEqAs:|/#yߞ~i #Y?l&/yUfDNfXJcFyN}HH֙\zHJ煎eySIx }j>vFjqa_2ZT6Ŧ Ͳ,@d 'MlvoxYFK=dwazwÈoV1vϲyh{.T{y#H=;qTZ@$bt{]*ZJv @A]W68l{6醟ʢ)h y4VY9ϠGe,fnl׆T ,l]psT[O9e=eW @zkdZk .1(:Xݷ~ە(-<^NC|}FLI Ji^jz7V>,t8FI9+5ɻHIS 546sY +4fZ5}}Y??헫"+24Y0wI͟AIfH0}u$ߥ<ޥ;{4_r[~>iThB?MRr0m{os;ww`LRng<<0\;|wckgQhqI\}8]^Riq6{/>A&jos$9{(bxv0atƙI-jBƎ꜓cCѥ0g8m7ԋ!є_4V~Ypeik\60-A+Atr;8yT4ϱ8gg\䦓Dyw <ϣ\ї݇RoE4q;y)oN?Y)YRzhȝ4ſm[ǽmh.ȣ'Cغ@<~'ӆj ͏{?5{M@teeՊ-Hd/V0sQwHy{ h{Ԃ5zhFja+mQiu .@JLU8g2qV[)S2t1ZRnx-ZќS;SX2+8nT)Ҷumkp$la]sͳ-Rտ 6j8jv> +endobj +558 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb11-14) +>> +endobj +559 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb11-15) +>> +endobj +560 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb11-16) +>> +endobj +561 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb11-17) +>> +endobj +562 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb11-18) +>> +endobj +563 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb11-19) +>> +endobj +564 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb11-20) +>> +endobj +565 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb11-21) +>> +endobj +566 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb11-22) +>> +endobj +567 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb11-23) +>> +endobj +568 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb11-24) +>> +endobj +569 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb11-25) +>> +endobj +570 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb11-26) +>> +endobj +571 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 444.418756 101.433071 425.668756 ] +/BS << +/W 0 +>> +/Dest (cb12-1) +>> +endobj +572 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 425.471735 99.933071 406.721735 ] +/BS << +/W 0 +>> +/Dest (cb12-2) +>> +endobj +573 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 406.524714 99.933071 387.774714 ] +/BS << +/W 0 +>> +/Dest (cb12-3) +>> +endobj +574 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 387.577692 99.933071 368.827692 ] +/BS << +/W 0 +>> +/Dest (cb12-4) +>> +endobj +575 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 368.630671 99.933071 349.880671 ] +/BS << +/W 0 +>> +/Dest (cb12-5) +>> +endobj +576 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 349.683649 99.933071 330.933649 ] +/BS << +/W 0 +>> +/Dest (cb12-6) +>> +endobj +577 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 330.736628 99.933071 311.986628 ] +/BS << +/W 0 +>> +/Dest (cb12-7) +>> +endobj +578 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 311.789606 99.933071 293.039606 ] +/BS << +/W 0 +>> +/Dest (cb12-8) +>> +endobj +579 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 292.842585 99.933071 274.092585 ] +/BS << +/W 0 +>> +/Dest (cb12-9) +>> +endobj +580 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 273.895563 99.933071 255.145563 ] +/BS << +/W 0 +>> +/Dest (cb12-10) +>> +endobj +581 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 254.948542 99.933071 236.198542 ] +/BS << +/W 0 +>> +/Dest (cb12-11) +>> +endobj +582 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 236.001520 99.933071 217.251520 ] +/BS << +/W 0 +>> +/Dest (cb12-12) +>> +endobj +583 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 217.054499 99.933071 198.304499 ] +/BS << +/W 0 +>> +/Dest (cb12-13) +>> +endobj +584 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 198.107477 99.933071 179.357477 ] +/BS << +/W 0 +>> +/Dest (cb12-14) +>> +endobj +585 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 179.160456 99.933071 160.410456 ] +/BS << +/W 0 +>> +/Dest (cb12-15) +>> +endobj +586 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 160.213434 99.933071 141.463434 ] +/BS << +/W 0 +>> +/Dest (cb12-16) +>> +endobj +587 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 141.266413 99.933071 122.516413 ] +/BS << +/W 0 +>> +/Dest (cb12-17) +>> +endobj +588 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 122.319391 99.933071 103.569391 ] +/BS << +/W 0 +>> +/Dest (cb12-18) +>> +endobj +589 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 103.372370 99.933071 84.622370 ] +/BS << +/W 0 +>> +/Dest (cb12-19) +>> +endobj +590 0 obj +<< +/Filter /FlateDecode +/Length 3157 +>> +stream +x͛[% ϧ8a`00$kfvWKήװ;̞n.*կ:=|%|*Z[z}|B$¿fSߒLZBk7PZ%_.t5rtGSRKTR +ĔUGlST4꽪 m5y*1VGUahaW5 RqTL#!*q +=]kDO'rQNZ9FlIJ2l,`KE<]-]-` ebO$VU]]jH)*B9$:(LR..–L:ؒآtDRZn!aO`KE]l{Pqc@,%hA V Zz-E< ĖV<1t=#0lQ\W[<@@[x,Vo8{,fqfX @.\y,0WNbJc5{,pWc"` cx,PpWwjfk% +J@Xc1܍wrpI~8[XcAwas4h \1}.qgb<$px,H.Y=;jX]ԞcAw7$p<` Lp]WZ=$pX  + @C=dp{X]J" 2Kcl5`5P)<Kt.Qi 2kۦǂ\LGjhdt\]O +A,W[֡I J-ǂa BBcDnz[.n~,Ԧ걠| r ׮BcA)Rb{,K `t J-X* {:-= ҅cAѠǂ+L C#P{:%3ǂ9X&H` 0cvX&W[$ǂZcA%RXߴ|x,h[y,h q<47z,|z,hB79I|x,h +[BW[45g݂I7A'OaKl걠lfX0&"zHZYp75ӁL DdWV8{b@@o؋ݪgZLd5Vdr EGTPgbٰ,9f1y|ן._{鿗wNE%ɖHln*l+B5 a1#JF2؊ݶɰlf3ۓ/2TIm:Vb!}@Lv+rs1#|KёEc'^C?=\o'vbp#]_~>DWl?ɼg'z~;Z{Zg^~s/zi/GF??7>|{q+B> ep {ʼn]Oc"C6<rHd7ڲ$'WXO(Ü)s_nTS?u7熯pEk9> ;YZsz_"¤rضXE]/laUb9d>m;N(sЈX]?4B RȨs@JJOz^='RctxZ- G9V~9{}>WyS|Rg ,RH[CΗžIpCcm c$ɎrtC'أrr9֞ Q6K^vb m38Nº~88ɽJpptùtѝm|ζsr߾ŮlAUqV8~D loS9d$'(>mutӶ7wK"%a(%&Ot?gkO"TT7 aT3.Z#>n}^a'8ۻbiX[Blgtp|L +endstream +endobj +591 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 590 0 R +/Resources 4 0 R +/Annots [ 592 0 R 593 0 R 594 0 R 595 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +592 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb12-20) +>> +endobj +593 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb12-21) +>> +endobj +594 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb12-22) +>> +endobj +595 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb12-23) +>> +endobj +596 0 obj +<< +/Title (Hardening Guide with CIS v1.6 Benchmark) +/Dest [ 6 0 R /XYZ 85.009843 502.818898 0 ] +/Count 14 +/First 597 0 R +/Last 608 0 R +/Parent 611 0 R +>> +endobj +597 0 obj +<< +/Title (Overview) +/Dest [ 30 0 R /XYZ 84.259843 272.631496 0 ] +/Count 1 +/First 598 0 R +/Last 598 0 R +/Parent 596 0 R +/Next 599 0 R +>> +endobj +598 0 obj +<< +/Title (Known Issues) +/Dest [ 45 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Parent 597 0 R +>> +endobj +599 0 obj +<< +/Title (Configure Kernel Runtime Parameters) +/Dest [ 45 0 R /XYZ 84.259843 539.222079 0 ] +/Count 0 +/Prev 597 0 R +/Parent 596 0 R +/Next 600 0 R +>> +endobj +600 0 obj +<< +/Title (Configure etcd user and group) +/Dest [ 45 0 R /XYZ 84.259843 283.686971 0 ] +/Count 1 +/Prev 599 0 R +/First 601 0 R +/Last 601 0 R +/Parent 596 0 R +/Next 602 0 R +>> +endobj +601 0 obj +<< +/Title (Create etcd user and group) +/Dest [ 45 0 R /XYZ 84.259843 169.788971 0 ] +/Count 0 +/Parent 600 0 R +>> +endobj +602 0 obj +<< +/Title (Configure default Service Account) +/Dest [ 53 0 R /XYZ 84.259843 561.590928 0 ] +/Count 1 +/Prev 600 0 R +/First 603 0 R +/Last 603 0 R +/Parent 596 0 R +/Next 604 0 R +>> +endobj +603 0 obj +<< +/Title (Set automountServiceAccountToken to false for default service accounts) +/Dest [ 53 0 R /XYZ 84.259843 522.092928 0 ] +/Count 0 +/Parent 602 0 R +>> +endobj +604 0 obj +<< +/Title (Configure Network Policy) +/Dest [ 67 0 R /XYZ 84.259843 599.840928 0 ] +/Count 1 +/Prev 602 0 R +/First 605 0 R +/Last 605 0 R +/Parent 596 0 R +/Next 606 0 R +>> +endobj +605 0 obj +<< +/Title (Ensure that all Namespaces have Network Policies defined) +/Dest [ 67 0 R /XYZ 84.259843 564.092928 0 ] +/Count 0 +/Parent 604 0 R +>> +endobj +606 0 obj +<< +/Title (Reference Hardened RKE cluster.yml Configuration) +/Dest [ 77 0 R /XYZ 84.259843 191.441066 0 ] +/Count 0 +/Prev 604 0 R +/Parent 596 0 R +/Next 607 0 R +>> +endobj +607 0 obj +<< +/Title (Reference Hardened RKE Template Configuration) +/Dest [ 390 0 R /XYZ 84.259843 518.211778 0 ] +/Count 0 +/Prev 606 0 R +/Parent 596 0 R +/Next 608 0 R +>> +endobj +608 0 obj +<< +/Title (Reference Hardened cloud-config Configuration) +/Dest [ 534 0 R /XYZ 84.259843 537.158799 0 ] +/Count 2 +/Prev 607 0 R +/First 609 0 R +/Last 610 0 R +/Parent 596 0 R +>> +endobj +609 0 obj +<< +/Title (Reference Hardened cloud-config for SUSE Linux Enterprise Server 15 \(SLES 15\) and openSUSE Leap 15) +/Dest [ 534 0 R /XYZ 84.259843 397.010799 0 ] +/Count 0 +/Parent 608 0 R +/Next 610 0 R +>> +endobj +610 0 obj +<< +/Title (Reference Hardened cloud-config for Red Hat Enterprise Linux 8 \(RHEL 8\) and Ubuntu 20.04 LTS) +/Dest [ 557 0 R /XYZ 84.259843 511.863778 0 ] +/Count 0 +/Prev 609 0 R +/Parent 608 0 R +>> +endobj +611 0 obj +<< +/Count 15 +/First 596 0 R +/Last 596 0 R +>> +endobj +612 0 obj +<< +/Length1 9900 +/Filter /FlateDecode +/Length 6559 +>> +stream +x:{\UU^py? 8Tt|:)HZj +>2%S35#sdy5Ԛ;cnh6ך{0m{݋z|[{}lU2$g>6g694<4mH+?uh/@/бL= GfLMZNCc{'W`^ꏟ67g=iop~8 I0E/>w^]R*E}97DnGgfe熝߾3hzRI|GϘ;'H͙S8-;zs+WK&d͋~q0]**,!L=|Qq^@÷Ԕ d'MpG}}a*h׷Uj?xC⤮ +_0WP}QcL8@/ 6];':fꆶ?/9hYATeI ES8\v5 X'mڬ|;!UO]6O#&ׁowQ)N;$ GP? +1 +U0@MNo i}!c!`&̆BXԦisv0 gt mmmW^[:bP:=<3zB;#zQ7f:޶ rXǃЭO={̘^:$됬4;Zi|H>mZ7<.|ڌlOE xʖ7'xrOmNO7G"wo w7ŊM7~ԃ7jz 65o_kHkzYoT~r5Rr (xP~y)^/ +] +|_{/ssn"xzƷE o |SqolxLQ;Wy@c+)1ȷs[l@b&$pc(iQu nXoz+>ی]3=k5ϸ)#?Ƨ^Ջ>El> V4*'4c% TbI+\Ire=m^Zҥ$K3]ԍ \,1+.B.8K5cBDl8S8: +&0G`jƩ"pI'N08Lc 28q?>Z`!p#6>J#6|XH)ppC|pkpH |Hj*'?ȗA} O/S__ľf׆fI>x' +ό <{WO#eÞF쑈<>9xw79[w{c6_t1Z`H_ >#aJ,b5cH@]r1$ ПKS@8ډW`-E\ +sYɆF* NTrQI,4K=2/]4p5’ 稜#̣Z 4rcURO 7"AV9+I4 +pKpe!‘œ,@$5<%9K.aIN)9 aePp$ld+|p/|NhY9*vi'+2TC#gB/m"Qw= a0._{x32:| @@ 23ir:{z es&TEhN&e=E +9J#5,XChk|xJ]Z$ge!okў1\^؈lVl\0{z`XJ\0ZpBO5IWǿ[O5i{iu7|֚(92N9ӅYĎ}_Fe2$۩,_Wh* %U/ nCalJʥGIBtnJE!rTy &x\Vj5aJ0B3.͜PON#It)r/Ҕ~vNG"!6wو{aa͗Rη\C6chSJm.[*r]j%aAn"VS}`kh#%$d xA>)C)l +T\Nľ}b+&&*R¾}儨p "_ڹrt3=E߁gʸh7X z9xt ǎ㨴#"_cO, +ղX& +vLDBXxU^ U/05؟2BC [HMĤFJAHF,#t4D˩"zϿ(Xu6$_k._RKܼtUWHyEzj3ܦw> 5]層@^:`}uWC$8m]5t}#oPXDiRd~.E#VmY`ٵYחW㬂s.?:UWę^6mg }hUHbT:^pU[שC%mD[Kc˩;ԉK7)) n{Dr];T>)KZC,`ge!3?昽2[l8el?<%*~'sk>tmZ-"&ŀliWl"tP#5fB-I(ξ+w[#[Jҙhn^GUICG>;Φyާ/$pY|  ;a%|J$XgEаP(LRXX`94Lv1pХ.W7)[dȠ@kOC3SM-Mmj4:5;#z"Dƀp#"cb;|366&&OtR<^_ >f}S^TJCe|_޿Kº|k퍲Ig 3rRoW WX Us!1jBtZ 2)-$$&%'D$DzB<0O'["2222bE؛K;u. + + +ϊ( +- ++ +/(-+/rOKgJ&$IM"AbH™tOnzSV?zI/m:w|ҿߔKsJ{'vlU^{cc[4v!llYi^-8|`s `nؾ1قʃqv:AdG0kx3Ȯ)'S퐓_pj|h6 4HTɓ' {փYV/ۈ2P<$tvTyCSMS7gֆ<:&m< LxmɹsK^k=ҳ/ai6fiL-\];G7tUFrByŌJzz ;֥ᵬrIKwHN)rv\OԐڐ߆ ᩐRTWja60B!+ +]A)4Gߑ,3B7e--:3-qŵ| ^i-Vig9нLx6'1^D<3btTb}L7XFא@P-C#|HTO5 ^\8J!w/^]~!&w$ ]vP+Dsѣ͡Kkiyot;}Ι>Z|& + }G7ޜ<- `d6 g^͒K6}ݢY-( xώJ[o?S*]?Mܣq?x +vb&q큒 +(%7)`ĸ t'gYYʜ ]Fha,T**riSRh$+vUqr ltHgq·)u3|.Kqe`UXE1BQڂM|ԩomS(GMeSO_5Y-v-Ih< $da_{q +78Ǚ&ifb7NSU&8 A,Mt)$2YgϜ<ΡU~Zen&W6B>ڰh? ~RwMMm\y)4\Mdi2g0H<ߴtJio05H = CdDE6sj6_ʃ 첸͢XFcP3M I0Og) ltKu,`[^orlgiZiJfIڗ>HN ޖ@emk\͡ V!("X 0 N8z&B$jD8 &PBw1A6̅4: +9Ta\%z/yf!չik&~, hlZFYn<, icWd&$pZ_Hgs?3VRB;̦Qm-1%ItܽsMyh?yIڗ6RAe6c‡/v*Le;j n;錑tRFA: z-yT/.˧R{zqlX>#`flX>'0\͞?F +gυ +r~~tghϻegdڠ\8 _nw_}6=g(Jx k]8tWYڍ4 P +endstream +endobj +613 0 obj +<< +/Length1 6944 +/Filter /FlateDecode +/Length 4153 +>> +stream +xYyxSו>Y2/l%['ɻ,[vWɋŘLiI&MB)kMJ/4!Mffi&I6i:COsmBso=w߽{s9OF!!LEBQmr6+3Ij]ޘ-ΑDB'ۚ=M^6(61{`(Gii՗`G.Cu*OY&OgZ}O ^FJ9:.,,xB {A9ZT^n2!DqGP@軁sJ|e< eB_0 +R }6kG~3i,BD1z@4BOLj5Κ}u^ߛ>(P Zϯ:XHbIJ!Ch Y&(1HJQـ,=?.rQ#@<* /=/t +xzgCd%!Gc(Don1X̯x҉I1}A,!Ў?QDQo&)h!B oQafJ4c&:8vZAaDB-`Xg-JdbTFWF|Qdl"O +:v[WZ]j ܇)tGd܀S6aIΜ~>Wp_svSF&fpLiaN⭷`gOCYP$QRY#$b%o_{]o΍cOxϼv:L)̬ϔ5ajQ0q%zzgu}{8Q-g('?ۛmCj6ď'nhViXe8B(+ˣd˄(9-th&r¦Ic8YP(dZz{p/> 1 &dЛ$dk<*F֑Vj!lS. j6TwMS 1bQ0 )DZr4BT,U?Hc`c*cͭ# [}j\[wcp=COP|@HWT˫@ԬF3O?bhdMvU"hij,uvQiKq!AKj.UOKݒa˳LZ~ǐJr͇R՘ e2Lkp]WSSn|;N^t02[ ~ KŚi*% Òj-ASھ}QUSWT\\. ++/ףwe:uuezFyhɧr,,&1S/*#%E`/*ě׺I&b;=(. >3tGqOGc2kVQ Cw;4Xj)}Q(<<5HvRwV|,daJ\䌄*MP(uOk{SE7dZؘ_;>uTm,MVh2*u\ZׇM3䧝&/QEQPF{rসgBTW,ZG7d۳6?ܗivN;FGinw_=V]a+͖Jzr +Z +E4'> dy z#+paɴwKGG'/Mnz20~ֈB2X-4tC,̉մMMJ}*=3~t^aQZשRDRR[VgM}Kߢ{M~M^G+驣Hds\F*/}ke27hë~A7>ݜc0lq:9M]#-? e> +D$e'N_w?ػktL= Sn۾o*Vo@ ~0\L%Px +n7&=F<gK;nȄVMk[osc/"s 5+-!~Ҳsv?9yV?뷔nol:@8$BaIZ\ 7&ŽA& 43hq%ekiy4 ac =s{z빣ܱ?9!;Z+b hIe8%}.n"S3S:xWh5|>Bg`kxp݇(rV O:Jqim=*2:[x5e5_`@ EF^,kBVodæ?ܵ ?>}H&eo0R2 Ӈ=KpZ-]x%wLhܙ0*ndk N:h'c=y"LۆP%ō.- yǐvCÖ kv9>'=YYRe( r+Jdg㒗- -c@ؤ۠Z3GƷϹ^KzX@J w`Ӟ72[`<+32+˰B$}X!p}v+ϕ+~:A /0F11n92|xˡ'9)SvN[$44P$?Q7 [Qnrɲ'e,T*,[m[ڤ-9lwJ[SR-xӼfe1=7xљo`&rA`E))ϵƭNv6\>t'dk)25&xOHaq⬠; G T +e3Ml6CB-{%a ?d35kpyK1t۟>扄1Rp֠fsfPpѰĢ|W㐕%ĢF㶲|ðdSTR֓|t3K#~e2յg ˜_)e$g+6]Zm~9G3٨ϏiD7eT䛜rwDI:rg*~3]yQ|6+C@?:|v45@6? ~y!>2'>E~{,|2ZX8jUCR2۹-?l8ѝNHp Jxl]5I~Ĭi@-]vGu9Mw퉺}bVbY_V> rV.9-|_@.@o + +dSS+OSeJwWbr)2uRUyʵD\D^g\.WY.,YU&(F~v/2Rq!"RBfx6fn7\{㼲FZ`,z۞=44.x]X4]K&ISWK%\5@XR,56ex.u\jpI@4ަcl:*ݹdwkr/pDΩۓDק٠!UJRY&{o;}uN_#/ǑX#}8Fbv~|"&8> _.>pY*+2R +_vhjGŊF$s5>l%<F.jfyL&Ve6ޅdR&Jkf|?F dj|ÏV@d }ǐ x._\]Vہ 4/ *ԏQ+jC (/ =PT@Ӎv?tX#?# A}~A12 v%<j@0uA/k!X @\^kkVDFT2 \JJp@A?C;.>:p^yP `;Q09ÏG45oPUp7Fe +endstream +endobj +614 0 obj +<< +/Length1 7204 +/Filter /FlateDecode +/Length 4875 +>> +stream +x9kXUוku}.y\^ jA#H-QV1iK'!CljhjR4k6~Ik-vZ˜~68:1t:c컟k^{`BKKVV>QD +,W@ˊ*.ܱ>꟣gYEY[>br~KcE fl-;=k6qWR۸=;o+|4 چΚ߅~`win*р1+_E]T,XƊ-b"{`*gEKsKs[e֏W--+u^L}j+)a,nfσ"eLEhMt6C@=v@4i)V![ Z^H\DA:$xW ֔z~!6-/3ECNtQ7 !jDo_(* [R8CuIy!RS0/)TaʢCKC-u?hOaaO5ϜW' |e32(9{$D@|&9e)\ᓋ ?߆OqyNc2>_b"?2T[yO>|vᑇh~؏3g@_}? Ypo> c7v +w>/.ˏ_$/Ӎ;i`gvȸC6o3at*tl!hK6 o7=bC7aC@ܶ RgL{Ua-UUXC+Dcd"c]X.U$= i!| K]x7e\u2x v5EVƅEVKի>\U+e\!>\n/L \څK +|I7.2B?.3/c</0<>̛kyGk1wbnsw3 +tJƴTO a!Љ)ja2S,2Qo8{ -&$ &x7OG/UOwcgE:,?zyи'c"<&1Pp;J:1<)Lka6 Sx[t;0tE;yfsZ j\-]hMDF`A=k5F6C PcDC(q( i3b`M%2B GX׎bY,bGe4V&؅ H9<[ bm1 , A%d +&%H>шTU!ׅ-51%8YKo0/˄~# .1=˃J| 8|;$h_7`ކq~? +Ǩįv*QҰΚaֳ*_Ȗ T#մf ]QI*9hpiW!+cDIG0v)\=X 3kIf4MqEԿV&M͔ hoYM(bx]Γ+C)EOM?Y<.\hL"bY1uH*_!\L@/C +X&ƂUY+&F3Zł12bpӹD+K + %H7÷(V(pQɒpס^K/ݏU:j$5z`bH[bHfcD-0wXhPpmr,$/bUڜG6bT7 ,Cdh5,z1 m\e c%$f9VϾ"Io'pD +.(tד%BK`):!lBNjӀjm wM-RSxkRV]R+4YIɑɱk<(1fh:SԜhk 9Y~W-!!ntBC].Chssr|zH}O$jݎ+ ;V +=wtWw,]_`MfNjN6,YeQ^);\U͐-d##t*73!L(o3AUyAɗI,/d$N'>k)1$ zO'AXL(6TPYwqneHA#9:91ʵAZH_F -;:#&Ó{lu젾6Пpp8\nWSH4k͑Y$9Y$a&gΜ,K8{8JΉ^ǵUVf"KjVn| ;~șes'~Hx aUNk]Fȕri5$K yfՁw_-<ўu_]2s٩y/W俑G +0'f:Nj>1T෹ QČ"l0\S0S@`2njBo_V};?#7lԴys.yDE%fn2d˱c6_]88 :[St+%%Gwctf\U M#x-eUN.rԈk.+â>cGRӐ;{6@BVޱk;'.U9!;{ܮcf&;.^re,?IRPSL9kYYNbGxʃe:^UNv?z|4DI<"uL0;4=+ =6 A1+K*k*6si{XuWB0)Fy0|Y,QON juZ.qzzz\@vwc.)r9(Rcf M#M+ɥ{\y9"sY*<Ϻ{ r%ZJke=خk :%YG0I5my2ҾHd^a#^foc'4sZ4l|5P( Qiࡈ0lHw~|6_oɷY/*Y1d(MRtOIє 棂q-XQl9 zDHGysB}n_/,.-/4,4.- Yh_X(cdf.-Φ#, +^ ~I~KaM-x}Y +w5)ߵk*S,o_j yڻn@L2\839cʞf|ETFD|eOޙJN~ve5o+wt3jP إ:'Y9[:WH:nou:&ګӋzCtȜ:#$y'E 1X2j\Y9c c L,3ʼˠ,ɺd}!٘lJ6}3ՕIOtn.FP!$*"ʪ5 |k+޼v#kOCvN"?:7-p1$f:LO7#3fz'Mbŭ!Zt>3W9c{AD‹lܽ|G/ʿG{ѩFzOGZs@6YQt%8nS$Ir [x]Kݩκ~2p"YD5%x%"gTJd)hFzD<㐉> ZFj( hK%.븠(׉$o+Ѷ.vˏ_gq],dMn%ɥē:=X$bd4Qd6h0& +ރ VɨIZh4ꆬ7+YQP=q`\Xǎ%).y=*'"2qQC> +&MXi3P/@ i#̦i-f֙ , ]lNhz:h'IC,jUN;w *^XMNE@C>&6WMu5AeaꡐZ[z0nQU1=V{J-SIt Ci +tU* +UDy1<0׫fuu?psifc?s 7u唄iSwY? 1ޚa b(J )1C<1Zw1,`#uMjzK +,!>DuI'TVTBƖȨm lo"l/3} +endstream +endobj +615 0 obj +<< +/Length1 16324 +/Filter /FlateDecode +/Length 11653 +>> +stream +x{y|TEo-w{;4!d# K a¾*/$@D0M%2bQ1ЀD@ 9:;uo||^ԽUw9uS|OB6 (`Ġ}~8շw|P^ 2ҁK= ڱ}??4cmhv)s>0!#Λ~^ـ"Θ7̹߂{gL^ɰ?@0ck.dDB9s @#\Ϛ ' ^bh9oSGe MousB~88oS ŏp?iQ-Y0 -9 ȯ/|bܓGa&Br$"1E7&Q]R~rd=XpNMEc9y:x=륝r jQ!ObX MWH?AӉ K:~ ާyQ,Z)ٙo+tRmwrsDA@i%[|-q [CPJ܂ r(k +܏,z[h{˃4N@iۧ'PF] ^ K%/G|6x6vD%tVCՠyP_z<57dw]_DPQ@+ +P4 +V޻ǭ Dаىݻ؋{SD:ZOa>EKfE݇3.woh)'Feq_;Z[}zN/*oi8ߧvO_}SgnlpnLM>HVcŞQ؁j$`;bP6dU[mIWFZP#z{UR V{D.hvhgw4֕]Fӟ+O*ğphVZْ MozSߡ?fFO7* ,63\m_zZx^+b#o:~9 +w_0^}?cӍzSd%86A)gG]ѳ(PW3 =IFevqF1GQ;=b o}ۇ۫{ķӷa=*Z_S|:8ݡo^Lӿ>}WѽFk}eI|%1їw[ŗV?/%?2.ӝ/Xĝ }^;}:yFZXNhճ*Fz0}viu<0 0}C+A=&&;ݨp=tgRFוXuX1?X? k]]*Ft1D3$K] .1%y/ tQa. +O08 ]0Ο^?kO2:'ftV:y8L3:bFNqS,$F'2:a^`Xh1z +]dcct+PF`Fdqi06-e h>ab?FBo1-Va'i|F{W'4V_OzzMbO3YB˛g&ǫgЉyWb݁wh7F怀sihV]b4s!v@3h:ܘh\N4j)a.Tt&w 4n;Zbڑ[%$=}|C;\Md4L=mgnFf1Ѹd1n%M1 zv1h6HJd8`40F@Y@Cbh>u-#-4 SGғ8juJC{~pPPx%^(t+h-1xz +W@ *G2 (P)l[Kh9gk*G-h@8@ J;jvP"A(gDBSI&PT/e7m7~ #x~ADp Ok : Fg&Ɏ*e7e$m[G&Zt hNF2L,dA; ̈́~B̓++hO&dZ@3h1Zؒō +k;ArHs퍲h*o$D&'%~0zC#s6H;CS"l{?19J.π,V+ǔugtoV۩^FOO}C>uRvƻ&){syE̳n}`m[a{3uN`r䎤SΙYbZcmIXi0D4->sU٪e#je!;).}9NQ"%Esn@D641yp{֍buB([LAAǘTbb;Q!nJAqa5dd@YYčk(~ڦ}<=_z-躲䅹Yƾ#:F-\Z9}576zq }^ s;뚳;4; % wQ~E]JPHCЕ q-.l0I;s&MBa Jorp&t'ζldڒ֭>vu+ |pc3tʜ + +lzoNnFa';˖ٙq.ٚYKYw\ݤvcE-F=)h5,*o-~QZx\:G{,2@^WK-Ǿpɟc.M'p}CVn~Z']ܓ/`o{ 9rnO)sWIՎW: jw%X\4>Ʈ盭hɡ7 %g*[vooxw޿;60sۅ$|o&;ٹjw/hEbc?cK1V}xLBDdrQi:䲥Lmv6k1')@*&J\~}U/g֮C_^vSWl|f=z,\xwX=laGᯣ>j|ݰUꈐtJR#8k6TXdΠh#+[Hk,̎<=vנ#O46(z0C\Cݽ2>`cz׃Ć%|23KȬi!MvYRmg{ҳ85$Kw=4Ľ[}}RLa[j@1B?/7T)>*ui2 ʸoK[GMO#'y,)maBP֡vސ e0!4$F#Z;ma((uƅGPzHOpeK..FN<,v>tј՝' }Rv5b/w裵O8ni>W }xW\fA,kÛws I#P*X4Ԁ5*TRCr{3Ù3UN9ٚåx +JUS.d3|2@b'NqN,ﮪ֠ 4>o)0e@KE$׵$ 㖣WS;͓w@Y JdrqBg"veID7%$9AɥWKGERnU` +}'ILGC|D: 獒n>}ebd+JU\Fߜtb' ;<\V$`X*(<ϔx>na.>~1t7CN dK`kN!:U0nȒmaSm0"efB۫KK~Sk뭟\_Å8}dk r22\W;jK4?agfQ" 1Ŋ\ {`F%g"pW^x~F6 wi1֒-|~{x_@!v@LUC*zKrP/ 5T'QZQ5ͮ YXh8k|-g +.:WmhAۃ;A+sҋ^ܼ4yǾ`78u߷&[oaݚxth &RtDV=11|Uua>+~,u;,o4#9W,\P'S@@2򚤀3Ʌx+Z"͂SE, Kzmu2^ڐuj .s]4ugsQ|f&ot4!a9vQOř s +kgϪ'tyûv5|\z?wvqsDئeB0τGHRCH(FD"X@xܔڠx8ϱ7ـsb8wg<0UtNPuTիz"ÜE&J Ȁ=ȐBQV1UI/K~aਹ[{_07 14FQRʗcQ'G %|Dl$<C&ɥBUugFx )Xi݈L#v σY8|;;,Mge[X-}xmptE''ĒN[ѡ[.ήǢ-\8lXށ`Q(f +Qmn|.l} Q #KO,Ijʗ!rwk4RiB"7ZUVnÆu%eW:>7)T_OR>y/.}N8ɇoxԂÏVPKU6 +",-mYՄ(x??؃G.2/gNRuy;=s]{p>lS&{RmjQզ\8@4#c;Uv\VRR^^RRFϑ^?7o> +wl٣ _oB?E Ǜ Vu:,U;! hJ,P F,A%rSВ7A8$ +F&yYDze%{-d !؀^ٷiحYC9ڛ•ȃ_S^_gџ_!uIoӛn-/M} u+uШ>INXle] /(\غ. 'x>.za?^| b#1"+V+\G-1M1 ^66MV,0D] +ktbӯ*VhJO׸4at5v›8٪Sp!;"8c`Ò1۲·( mpBje!IDQBIdbR@%dUQ{Rb{+*d9rҟʣ:K%͒ѧe29Wmsl_ϱ1$ ˃U)$Yj!I?P',i)" 3Y5v' _UOy̳xGobͬd)CE,m<nլ [G AAת݈{Gw j-ڋ7UHST9UIե8=~'"y)~V{2 vݓӿ0 Fos]j}nъZW5?,GaҤnyg+׳Wluf0iD{WOpZf,UP#ܛ=4gKf_aO?]7^knK>n/`g'm`#/ިqTcj~(e<SJR5jkmz=dk,űT3,V/^u(ZZmq¯,)poKN|~G¤ϟ\ߎeX$%^;ihW;P9>*G*BR@*>$R2ʒ=O@|(o?z o[\U-=xU!5Wf>nF,_wS rtݦ+wv23^FL1[VZt-]_ 3 +dȊ)u0J0hn֨}!g%.6a’r!UnʖgȤJ#O# *>f3?L}mVWz[Ep&L{{>'32e1p0 ri7 s?a! F{gWFʷ?F_0Q""\]|GA$Aޭiсz!l:|U`KhAp1JFc (w bV:rH#J7CPWoFGYt0K_JO)=O6/1jDMVgYLuYE Ujȭ-<;^uξ>I[5dzvՁ D2?@ +O0uNuTzdsdUY')T$SAr55,A#Odzx,xQjY#TD D&V6z}' +ZZay cs|3!zPi2r#.xi ~Z&i2-!FdUǭc!VWl''؁/?#Ֆ5XŦ,K-D*pC1`b-FU^(Ʉi2p}S;muޣ!@8;x `V: "L,]䍢|&(NQe:KHHr\hG(QGQHFg+KrE?1]ɭ+ZaYaU\\di `vh73K]c(P~WwQǠSv(ZCņwW͢wX; +~j[ml =F[p<ϯ̩cW~T<6v1U4<ŕOTpqKMiʑ& Rt7v~ɽRm{7;j0+zGYc) +Duw#Oox#f~= ("݂6t^hRSM$} {o9f#79ލsܣh"7={cQ喋?T=Qŭe47zQ,u#2X( }KhzB3LnB)pG,ʇ{EP@dl!wZO4X4>EZk3Ka_ w7fh 1 TfhwBӏ*atg}wvtkT8Ap|(P9pZL.2PCϷ=, ާh̯:'iwj/.Ԏ֎\7.Moo/e\w # @G43xwзw/H;p<#i&?1y +J쉹(uԹׇ~ mZD +endstream +endobj +616 0 obj +<< +/Type /FontDescriptor +/FontName /ICOIPK+DejaVuSans +/FontFamily (DejaVu Sans) +/Flags 4 +/FontBBox [ 0 -14 472 560 ] +/ItalicAngle 0 +/Ascent 928 +/Descent -235 +/CapHeight 560 +/StemV 80 +/StemH 80 +/FontFile2 612 0 R +>> +endobj +617 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /ICOIPK+DejaVuSans +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 3 [ 317 ] 17 [ 317 ] 20 [ 636 ] 25 [ 636 ] 37 [ 686 698 ] 42 [ 774 751 294 ] 54 [ 634 ] 68 [ 612 ] 70 [ 549 634 615 ] 74 [ 634 633 277 ] 78 [ 579 ] 80 [ 974 633 611 ] 85 [ 411 520 392 633 591 817 ] ] +/FontDescriptor 616 0 R +>> +endobj +618 0 obj +<< +/Length 702 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +27 beginbfchar +<002b> <0048> +<0044> <0061> +<0055> <0072> +<0047> <0064> +<0048> <0065> +<0051> <006e> +<004c> <0069> +<004a> <0067> +<0003> <0020> +<002a> <0047> +<0058> <0075> +<005a> <0077> +<0057> <0074> +<004b> <0068> +<0026> <0043> +<002c> <0049> +<0036> <0053> +<0059> <0076> +<0014> <0031> +<0011> <002e> +<0019> <0036> +<0025> <0042> +<0046> <0063> +<0050> <006d> +<004e> <006b> +<0052> <006f> +<0056> <0073> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +619 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /ICOIPK+DejaVuSans +/Encoding /Identity-H +/DescendantFonts [ 617 0 R ] +/ToUnicode 618 0 R +>> +endobj +620 0 obj +<< +/Type /FontDescriptor +/FontName /TGPMTG+Poppins +/FontFamily (Poppins) +/Flags 4 +/FontBBox [ -27 -260 122 795 ] +/ItalicAngle 0 +/Ascent 1049 +/Descent -349 +/CapHeight 795 +/StemV 80 +/StemH 80 +/FontFile2 613 0 R +>> +endobj +621 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /TGPMTG+Poppins +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 3 [ 266 ] 10 [ 158 453 453 ] 15 [ 197 550 209 ] 19 [ 627 319 574 588 628 627 634 545 630 629 212 ] 36 [ 673 612 771 706 512 503 777 691 245 ] 46 [ 598 431 ] 49 [ 702 785 578 ] 53 [ 607 586 540 674 675 975 ] 68 [ 675 675 606 675 619 328 675 639 245 247 514 245 1029 639 639 675 675 372 521 363 639 560 819 478 562 ] 206 [ 379 379 ] 209 [ 411 ] ] +/FontDescriptor 620 0 R +>> +endobj +622 0 obj +<< +/Length 1248 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +66 beginbfchar +<002b> <0048> +<0044> <0061> +<0055> <0072> +<0047> <0064> +<0048> <0065> +<0051> <006e> +<004c> <0069> +<004a> <0067> +<0003> <0020> +<002a> <0047> +<0058> <0075> +<005a> <0077> +<0057> <0074> +<004b> <0068> +<0026> <0043> +<002c> <0049> +<0036> <0053> +<0059> <0076> +<0014> <0031> +<0011> <002e> +<0019> <0036> +<0025> <0042> +<0046> <0063> +<0050> <006d> +<004e> <006b> +<0016> <0033> +<0017> <0034> +<0018> <0035> +<001a> <0037> +<0015> <0032> +<0013> <0030> +<0032> <004f> +<0052> <006f> +<0049> <0066> +<002e> <004b> +<004f> <006c> +<0035> <0052> +<0033> <0050> +<0056> <0073> +<0053> <0070> +<0024> <0041> +<0031> <004e> +<005c> <0079> +<0028> <0045> +<0037> <0054> +<0010> <002d> +<0045> <0062> +<0054> <0071> +<000b> <0028> +<000c> <0029> +<000f> <002c> +<001d> <003a> +<0039> <0056> +<001b> <0038> +<001c> <0039> +<0027> <0044> +<0029> <0046> +<00d1> <2022> +<005b> <0078> +<003a> <0057> +<0038> <0055> +<00ce> <201c> +<00cf> <201d> +<004d> <006a> +<002f> <004c> +<000a> <0027> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +623 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /TGPMTG+Poppins +/Encoding /Identity-H +/DescendantFonts [ 621 0 R ] +/ToUnicode 622 0 R +>> +endobj +624 0 obj +<< +/Type /FontDescriptor +/FontName /WKJFDI+DejaVuSansMono +/FontFamily (DejaVu Sans Mono) +/Flags 5 +/FontBBox [ 0 -14 584 759 ] +/ItalicAngle 0 +/Ascent 928 +/Descent -235 +/CapHeight 759 +/StemV 80 +/StemH 80 +/FontFile2 614 0 R +>> +endobj +625 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /WKJFDI+DejaVuSansMono +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 16 [ 601 601 ] 29 [ 601 ] 36 [ 601 ] 54 [ 601 601 ] 66 [ 601 ] 68 [ 601 ] 70 [ 601 601 601 601 ] 76 [ 601 ] 78 [ 601 601 601 601 601 601 ] 85 [ 601 601 601 601 601 ] 92 [ 601 ] ] +/FontDescriptor 624 0 R +>> +endobj +626 0 obj +<< +/Length 674 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +25 beginbfchar +<0048> <0065> +<0057> <0074> +<0046> <0063> +<0047> <0064> +<0049> <0066> +<0044> <0061> +<0058> <0075> +<004f> <006c> +<0056> <0073> +<0055> <0072> +<0011> <002e> +<005c> <0079> +<0050> <006d> +<0042> <005f> +<0053> <0070> +<0052> <006f> +<004c> <0069> +<001d> <003a> +<0010> <002d> +<0051> <006e> +<0036> <0053> +<0059> <0076> +<0024> <0041> +<0037> <0054> +<004e> <006b> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +627 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /WKJFDI+DejaVuSansMono +/Encoding /Identity-H +/DescendantFonts [ 625 0 R ] +/ToUnicode 626 0 R +>> +endobj +628 0 obj +<< +/Type /FontDescriptor +/FontName /TGTVMX+DejaVuSansMono +/FontFamily (DejaVu Sans Mono) +/Flags 4 +/FontBBox [ 0 -235 585 699 ] +/ItalicAngle 0 +/Ascent 928 +/Descent -235 +/CapHeight 699 +/StemV 80 +/StemH 80 +/FontFile2 615 0 R +>> +endobj +629 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /TGTVMX+DejaVuSansMono +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 3 [ 601 602 602 602 602 602 602 602 602 602 602 601 602 601 601 601 601 602 602 601 601 602 602 602 602 601 602 602 ] 32 [ 602 ] 36 [ 602 602 602 602 602 602 602 602 602 ] 46 [ 602 602 602 601 602 601 ] 53 [ 602 602 602 602 602 602 ] 60 [ 602 ] 62 [ 602 ] 64 [ 602 ] 66 [ 602 602 602 601 601 601 601 601 602 602 602 602 601 601 602 601 601 602 602 602 601 601 601 602 601 602 601 602 602 602 602 ] ] +/FontDescriptor 628 0 R +>> +endobj +630 0 obj +<< +/Length 1500 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +84 beginbfchar +<0056> <0073> +<005c> <0079> +<0046> <0063> +<0057> <0074> +<004f> <006c> +<0012> <002f> +<0048> <0065> +<0011> <002e> +<0047> <0064> +<001c> <0039> +<0013> <0030> +<0010> <002d> +<004e> <006b> +<0058> <0075> +<0045> <0062> +<0052> <006f> +<0051> <006e> +<0049> <0066> +<0059> <0076> +<0050> <006d> +<0055> <0072> +<004c> <0069> +<0042> <005f> +<0020> <003d> +<0014> <0031> +<0053> <0070> +<0044> <0061> +<005b> <0078> +<0015> <0032> +<0018> <0035> +<0003> <0020> +<0016> <0033> +<0017> <0034> +<004a> <0067> +<0005> <0022> +<004b> <0068> +<001d> <003a> +<0036> <0053> +<0024> <0041> +<0037> <0054> +<0039> <0056> +<000e> <002b> +<0006> <0023> +<0004> <0021> +<0007> <0024> +<000b> <0028> +<004d> <006a> +<005e> <007b> +<003e> <005b> +<000d> <002a> +<0040> <005d> +<000a> <0027> +<0060> <007d> +<000c> <0029> +<001e> <003b> +<005a> <0077> +<0031> <004e> +<0033> <0050> +<001b> <0038> +<002c> <0049> +<0028> <0045> +<002e> <004b> +<000f> <002c> +<0035> <0052> +<0054> <0071> +<0027> <0044> +<0026> <0043> +<002f> <004c> +<002b> <0048> +<003a> <0057> +<002a> <0047> +<0030> <004d> +<0019> <0036> +<0032> <004f> +<003c> <0059> +<001a> <0037> +<005f> <007c> +<0038> <0055> +<0009> <0026> +<0029> <0046> +<005d> <007a> +<0025> <0042> +<0043> <0060> +<0008> <0025> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +631 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /TGTVMX+DejaVuSansMono +/Encoding /Identity-H +/DescendantFonts [ 629 0 R ] +/ToUnicode 630 0 R +>> +endobj +632 0 obj +<< +/ICOIPK 619 0 R +/TGPMTG 623 0 R +/WKJFDI 627 0 R +/TGTVMX 631 0 R +>> +endobj +xref +0 633 +0000000000 65535 f +0000000015 00000 n +0000000235 00000 n +0000000351 00000 n +0000027525 00000 n +0000027658 00000 n +0000030309 00000 n +0000030508 00000 n +0000034100 00000 n +0000034450 00000 n +0000034584 00000 n +0000034720 00000 n +0000034882 00000 n +0000035045 00000 n +0000035201 00000 n +0000035358 00000 n +0000035515 00000 n +0000035675 00000 n +0000035836 00000 n +0000035997 00000 n +0000036148 00000 n +0000036300 00000 n +0000036475 00000 n +0000036651 00000 n +0000036827 00000 n +0000036999 00000 n +0000037172 00000 n +0000037344 00000 n +0000037517 00000 n +0000037690 00000 n +0000042711 00000 n +0000043015 00000 n +0000043265 00000 n +0000043401 00000 n +0000043564 00000 n +0000043721 00000 n +0000043878 00000 n +0000044039 00000 n +0000044200 00000 n +0000044352 00000 n +0000044525 00000 n +0000044698 00000 n +0000044871 00000 n +0000045133 00000 n +0000045393 00000 n +0000050574 00000 n +0000050829 00000 n +0000051084 00000 n +0000051217 00000 n +0000051348 00000 n +0000051479 00000 n +0000051610 00000 n +0000051741 00000 n +0000056745 00000 n +0000057042 00000 n +0000057175 00000 n +0000057306 00000 n +0000057439 00000 n +0000057570 00000 n +0000057701 00000 n +0000057832 00000 n +0000057965 00000 n +0000058098 00000 n +0000058229 00000 n +0000058360 00000 n +0000058491 00000 n +0000058622 00000 n +0000063591 00000 n +0000063860 00000 n +0000063993 00000 n +0000064124 00000 n +0000064255 00000 n +0000064386 00000 n +0000064517 00000 n +0000064713 00000 n +0000064972 00000 n +0000065203 00000 n +0000070823 00000 n +0000071176 00000 n +0000071309 00000 n +0000071440 00000 n +0000071571 00000 n +0000071702 00000 n +0000071833 00000 n +0000071964 00000 n +0000072095 00000 n +0000072226 00000 n +0000072357 00000 n +0000072489 00000 n +0000072621 00000 n +0000072753 00000 n +0000072885 00000 n +0000073017 00000 n +0000073150 00000 n +0000073281 00000 n +0000073412 00000 n +0000073543 00000 n +0000073674 00000 n +0000073903 00000 n +0000079315 00000 n +0000079752 00000 n +0000079990 00000 n +0000080124 00000 n +0000080256 00000 n +0000080388 00000 n +0000080520 00000 n +0000080652 00000 n +0000080784 00000 n +0000080916 00000 n +0000081048 00000 n +0000081180 00000 n +0000081313 00000 n +0000081446 00000 n +0000081579 00000 n +0000081712 00000 n +0000081845 00000 n +0000081978 00000 n +0000082111 00000 n +0000082244 00000 n +0000082377 00000 n +0000082510 00000 n +0000082643 00000 n +0000082776 00000 n +0000082909 00000 n +0000083042 00000 n +0000083175 00000 n +0000083308 00000 n +0000083441 00000 n +0000083573 00000 n +0000088687 00000 n +0000089166 00000 n +0000089299 00000 n +0000089432 00000 n +0000089565 00000 n +0000089698 00000 n +0000089831 00000 n +0000089964 00000 n +0000090097 00000 n +0000090230 00000 n +0000090363 00000 n +0000090496 00000 n +0000090629 00000 n +0000090762 00000 n +0000090895 00000 n +0000091028 00000 n +0000091161 00000 n +0000091294 00000 n +0000091427 00000 n +0000091560 00000 n +0000091693 00000 n +0000091826 00000 n +0000091959 00000 n +0000092092 00000 n +0000092225 00000 n +0000092358 00000 n +0000092491 00000 n +0000092624 00000 n +0000092757 00000 n +0000092890 00000 n +0000093023 00000 n +0000093156 00000 n +0000093289 00000 n +0000093421 00000 n +0000093552 00000 n +0000098511 00000 n +0000098950 00000 n +0000099083 00000 n +0000099216 00000 n +0000099349 00000 n +0000099482 00000 n +0000099615 00000 n +0000099748 00000 n +0000099881 00000 n +0000100014 00000 n +0000100147 00000 n +0000100280 00000 n +0000100413 00000 n +0000100546 00000 n +0000100679 00000 n +0000100812 00000 n +0000100945 00000 n +0000101078 00000 n +0000101211 00000 n +0000101344 00000 n +0000101477 00000 n +0000101610 00000 n +0000101743 00000 n +0000101876 00000 n +0000102009 00000 n +0000102142 00000 n +0000102275 00000 n +0000102408 00000 n +0000102540 00000 n +0000102671 00000 n +0000107769 00000 n +0000108272 00000 n +0000108405 00000 n +0000108538 00000 n +0000108671 00000 n +0000108804 00000 n +0000108937 00000 n +0000109070 00000 n +0000109203 00000 n +0000109336 00000 n +0000109469 00000 n +0000109602 00000 n +0000109735 00000 n +0000109869 00000 n +0000110003 00000 n +0000110137 00000 n +0000110271 00000 n +0000110405 00000 n +0000110539 00000 n +0000110673 00000 n +0000110807 00000 n +0000110941 00000 n +0000111075 00000 n +0000111209 00000 n +0000111343 00000 n +0000111477 00000 n +0000111611 00000 n +0000111745 00000 n +0000111879 00000 n +0000112013 00000 n +0000112147 00000 n +0000112281 00000 n +0000112415 00000 n +0000112549 00000 n +0000112683 00000 n +0000112817 00000 n +0000112950 00000 n +0000113082 00000 n +0000117606 00000 n +0000118109 00000 n +0000118243 00000 n +0000118377 00000 n +0000118511 00000 n +0000118645 00000 n +0000118779 00000 n +0000118913 00000 n +0000119047 00000 n +0000119181 00000 n +0000119315 00000 n +0000119449 00000 n +0000119583 00000 n +0000119717 00000 n +0000119851 00000 n +0000119985 00000 n +0000120119 00000 n +0000120253 00000 n +0000120387 00000 n +0000120521 00000 n +0000120655 00000 n +0000120789 00000 n +0000120923 00000 n +0000121057 00000 n +0000121191 00000 n +0000121325 00000 n +0000121459 00000 n +0000121593 00000 n +0000121727 00000 n +0000121861 00000 n +0000121995 00000 n +0000122129 00000 n +0000122263 00000 n +0000122397 00000 n +0000122531 00000 n +0000122665 00000 n +0000122798 00000 n +0000122930 00000 n +0000127159 00000 n +0000127678 00000 n +0000127812 00000 n +0000127946 00000 n +0000128080 00000 n +0000128214 00000 n +0000128348 00000 n +0000128482 00000 n +0000128616 00000 n +0000128750 00000 n +0000128884 00000 n +0000129018 00000 n +0000129152 00000 n +0000129286 00000 n +0000129420 00000 n +0000129554 00000 n +0000129688 00000 n +0000129822 00000 n +0000129956 00000 n +0000130090 00000 n +0000130224 00000 n +0000130358 00000 n +0000130492 00000 n +0000130626 00000 n +0000130760 00000 n +0000130894 00000 n +0000131028 00000 n +0000131162 00000 n +0000131296 00000 n +0000131430 00000 n +0000131564 00000 n +0000131698 00000 n +0000131832 00000 n +0000131966 00000 n +0000132100 00000 n +0000132234 00000 n +0000132368 00000 n +0000132502 00000 n +0000132635 00000 n +0000132767 00000 n +0000137769 00000 n +0000138288 00000 n +0000138422 00000 n +0000138556 00000 n +0000138690 00000 n +0000138824 00000 n +0000138958 00000 n +0000139092 00000 n +0000139226 00000 n +0000139360 00000 n +0000139494 00000 n +0000139628 00000 n +0000139762 00000 n +0000139896 00000 n +0000140030 00000 n +0000140164 00000 n +0000140298 00000 n +0000140432 00000 n +0000140566 00000 n +0000140700 00000 n +0000140834 00000 n +0000140968 00000 n +0000141102 00000 n +0000141236 00000 n +0000141370 00000 n +0000141504 00000 n +0000141638 00000 n +0000141772 00000 n +0000141906 00000 n +0000142040 00000 n +0000142174 00000 n +0000142308 00000 n +0000142442 00000 n +0000142576 00000 n +0000142710 00000 n +0000142844 00000 n +0000142978 00000 n +0000143112 00000 n +0000143245 00000 n +0000143377 00000 n +0000148406 00000 n +0000148925 00000 n +0000149059 00000 n +0000149193 00000 n +0000149327 00000 n +0000149461 00000 n +0000149595 00000 n +0000149729 00000 n +0000149863 00000 n +0000149997 00000 n +0000150131 00000 n +0000150265 00000 n +0000150399 00000 n +0000150533 00000 n +0000150667 00000 n +0000150801 00000 n +0000150935 00000 n +0000151069 00000 n +0000151203 00000 n +0000151337 00000 n +0000151471 00000 n +0000151605 00000 n +0000151739 00000 n +0000151873 00000 n +0000152007 00000 n +0000152141 00000 n +0000152275 00000 n +0000152409 00000 n +0000152543 00000 n +0000152677 00000 n +0000152811 00000 n +0000152945 00000 n +0000153079 00000 n +0000153213 00000 n +0000153347 00000 n +0000153481 00000 n +0000153615 00000 n +0000153749 00000 n +0000153882 00000 n +0000154014 00000 n +0000159201 00000 n +0000159680 00000 n +0000159814 00000 n +0000159948 00000 n +0000160082 00000 n +0000160216 00000 n +0000160350 00000 n +0000160484 00000 n +0000160618 00000 n +0000160752 00000 n +0000160886 00000 n +0000161020 00000 n +0000161154 00000 n +0000161288 00000 n +0000161422 00000 n +0000161556 00000 n +0000161786 00000 n +0000161921 00000 n +0000162054 00000 n +0000162187 00000 n +0000162320 00000 n +0000162453 00000 n +0000162586 00000 n +0000162719 00000 n +0000162852 00000 n +0000162985 00000 n +0000163119 00000 n +0000163253 00000 n +0000163387 00000 n +0000163521 00000 n +0000163655 00000 n +0000163789 00000 n +0000163923 00000 n +0000164056 00000 n +0000164188 00000 n +0000169046 00000 n +0000169557 00000 n +0000169691 00000 n +0000169825 00000 n +0000169959 00000 n +0000170093 00000 n +0000170227 00000 n +0000170361 00000 n +0000170495 00000 n +0000170629 00000 n +0000170763 00000 n +0000170897 00000 n +0000171031 00000 n +0000171165 00000 n +0000171299 00000 n +0000171433 00000 n +0000171567 00000 n +0000171701 00000 n +0000171835 00000 n +0000171969 00000 n +0000172103 00000 n +0000172237 00000 n +0000172371 00000 n +0000172505 00000 n +0000172639 00000 n +0000172773 00000 n +0000172907 00000 n +0000173041 00000 n +0000173175 00000 n +0000173309 00000 n +0000173443 00000 n +0000173577 00000 n +0000173711 00000 n +0000173845 00000 n +0000173979 00000 n +0000174113 00000 n +0000174247 00000 n +0000174380 00000 n +0000174512 00000 n +0000179215 00000 n +0000179694 00000 n +0000179828 00000 n +0000179962 00000 n +0000180096 00000 n +0000180230 00000 n +0000180364 00000 n +0000180498 00000 n +0000180632 00000 n +0000180766 00000 n +0000180900 00000 n +0000181034 00000 n +0000181168 00000 n +0000181302 00000 n +0000181436 00000 n +0000181570 00000 n +0000181704 00000 n +0000181838 00000 n +0000181972 00000 n +0000182106 00000 n +0000182240 00000 n +0000182374 00000 n +0000182508 00000 n +0000182642 00000 n +0000182776 00000 n +0000182910 00000 n +0000183044 00000 n +0000183178 00000 n +0000183312 00000 n +0000183446 00000 n +0000183580 00000 n +0000183714 00000 n +0000183848 00000 n +0000183981 00000 n +0000184113 00000 n +0000189306 00000 n +0000189785 00000 n +0000189919 00000 n +0000190053 00000 n +0000190187 00000 n +0000190321 00000 n +0000190455 00000 n +0000190589 00000 n +0000190723 00000 n +0000190857 00000 n +0000190991 00000 n +0000191125 00000 n +0000191259 00000 n +0000191394 00000 n +0000191529 00000 n +0000191664 00000 n +0000191799 00000 n +0000191934 00000 n +0000192069 00000 n +0000192204 00000 n +0000192339 00000 n +0000192474 00000 n +0000192609 00000 n +0000192744 00000 n +0000192879 00000 n +0000193014 00000 n +0000193149 00000 n +0000193284 00000 n +0000193419 00000 n +0000193554 00000 n +0000193689 00000 n +0000193824 00000 n +0000193959 00000 n +0000194093 00000 n +0000194226 00000 n +0000199366 00000 n +0000199749 00000 n +0000199884 00000 n +0000200019 00000 n +0000200154 00000 n +0000200289 00000 n +0000200424 00000 n +0000200559 00000 n +0000200694 00000 n +0000200829 00000 n +0000200964 00000 n +0000201097 00000 n +0000201230 00000 n +0000201363 00000 n +0000201496 00000 n +0000201629 00000 n +0000201762 00000 n +0000201895 00000 n +0000202028 00000 n +0000202162 00000 n +0000202296 00000 n +0000202430 00000 n +0000202563 00000 n +0000207539 00000 n +0000208010 00000 n +0000208144 00000 n +0000208278 00000 n +0000208412 00000 n +0000208546 00000 n +0000208680 00000 n +0000208814 00000 n +0000208948 00000 n +0000209082 00000 n +0000209216 00000 n +0000209350 00000 n +0000209484 00000 n +0000209618 00000 n +0000209752 00000 n +0000209887 00000 n +0000210020 00000 n +0000210153 00000 n +0000210286 00000 n +0000210419 00000 n +0000210552 00000 n +0000210685 00000 n +0000210818 00000 n +0000210951 00000 n +0000211085 00000 n +0000211219 00000 n +0000211353 00000 n +0000211487 00000 n +0000211621 00000 n +0000211755 00000 n +0000211889 00000 n +0000212023 00000 n +0000212157 00000 n +0000212290 00000 n +0000215522 00000 n +0000215769 00000 n +0000215903 00000 n +0000216037 00000 n +0000216171 00000 n +0000216305 00000 n +0000216476 00000 n +0000216630 00000 n +0000216745 00000 n +0000216911 00000 n +0000217100 00000 n +0000217229 00000 n +0000217422 00000 n +0000217595 00000 n +0000217779 00000 n +0000217938 00000 n +0000218117 00000 n +0000218294 00000 n +0000218486 00000 n +0000218704 00000 n +0000218916 00000 n +0000218978 00000 n +0000225626 00000 n +0000229868 00000 n +0000234832 00000 n +0000246576 00000 n +0000246808 00000 n +0000247198 00000 n +0000247953 00000 n +0000248103 00000 n +0000248332 00000 n +0000248864 00000 n +0000250166 00000 n +0000250313 00000 n +0000250554 00000 n +0000250927 00000 n +0000251654 00000 n +0000251808 00000 n +0000252050 00000 n +0000252644 00000 n +0000254198 00000 n +0000254352 00000 n +trailer +<< +/Size 633 +/Root 3 0 R +/Info 2 0 R +>> +startxref +254439 +%%EOF diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md new file mode 100644 index 00000000000..51a6df997f8 --- /dev/null +++ b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md @@ -0,0 +1,641 @@ +--- +title: Hardening Guide with CIS v1.6 Benchmark +weight: 100 +--- + +This document provides prescriptive guidance for hardening a production installation of a RKE cluster to be used with Rancher v2.6.3. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Information Security (CIS). + +> This hardening guide describes how to secure the nodes in your cluster, and it is recommended to follow this guide before installing Kubernetes. + +This hardening guide is intended to be used for RKE clusters and associated with specific versions of the CIS Kubernetes Benchmark, Kubernetes, and Rancher: + +| Rancher Version | CIS Benchmark Version | Kubernetes Version | +| --- | --- | --- | +| Rancher v2.6.3 | Benchmark v1.6 | Kubernetes v1.18, v1.19, v1.20 and v1.21 | + +[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf). + +- [Overview](#overview) +- [Configure Kernel Runtime Parameters](#configure-kernel-runtime-parameters) +- [Configure `etcd` user and group](#configure-etcd-user-and-group) +- [Configure `default` service account](#configure-default-service-account) +- [Configure Network Policy](#configure-network-policy) +- [Reference Hardened RKE `cluster.yml` Configuration](#reference-hardened-rke-cluster-yml-configuration) +- [Reference Hardened RKE Template Configuration](#reference-hardened-rke-template-configuration) +- [Reference Hardened **cloud-config** Configuration](#reference-hardened-cloud-config-configuration) + +### Overview + +This document provides prescriptive guidance for hardening a RKE cluster to be used for installing Rancher v2.6.3 with Kubernetes v1.18 up to v1.21 or provisioning a RKE cluster with Kubernetes v1.18 up to v.21 to be used within Rancher v2.6.3. It outlines the configurations required to address Kubernetes benchmark controls from the Center for Information Security (CIS). + +For more details about evaluating a hardened cluster against the official CIS benchmark, refer to the [CIS 1.6 Benchmark - Self-Assessment Guide - Rancher v2.6]({{}}/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/). + +#### Known Issues + +- Rancher **exec shell** and **view logs** for pods are **not** functional in a CIS v1.6 hardened setup when only public IP is provided when registering custom nodes. This functionality requires a private IP to be provided when registering the custom nodes. +- When setting the `default_pod_security_policy_template_id:` to `restricted` or `restricted-noroot`, based on the pod security policies (PSP) [provided]({{}}/rancher/v2.6/en/admin-settings/pod-security-policies/) by Rancher, Rancher creates **RoleBindings** and **ClusterRoleBindings** on the default service accounts. The CIS v1.6 check 5.1.5 requires that the default service accounts have no roles or cluster roles bound to it apart from the defaults. In addition the default service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments. + +### Configure Kernel Runtime Parameters + +The following `sysctl` configuration is recommended for all nodes type in the cluster. Set the following parameters in `/etc/sysctl.d/90-kubelet.conf`: + +```ini +vm.overcommit_memory=1 +vm.panic_on_oom=0 +kernel.panic=10 +kernel.panic_on_oops=1 +kernel.keys.root_maxbytes=25000000 +``` + +Run `sysctl -p /etc/sysctl.d/90-kubelet.conf` to enable the settings. + +### Configure `etcd` user and group + +A user account and group for the **etcd** service is required to be setup before installing RKE. The **uid** and **gid** for the **etcd** user will be used in the RKE **config.yml** to set the proper permissions for files and directories during installation time. + +#### Create `etcd` user and group + +To create the **etcd** user and group run the following console commands. The commands below use `52034` for **uid** and **gid** are for example purposes. Any valid unused **uid** or **gid** could also be used in lieu of `52034`. + +```bash +groupadd --gid 52034 etcd +useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd --shell /usr/sbin/nologin +``` + +Update the RKE **config.yml** with the **uid** and **gid** of the **etcd** user: + +```yaml +services: + etcd: + gid: 52034 + uid: 52034 +``` + +### Configure `default` Service Account + +#### Set `automountServiceAccountToken` to `false` for `default` service accounts + +Kubernetes provides a default service account which is used by cluster workloads where no specific service account is assigned to the pod. Where access to the Kubernetes API from a pod is required, a specific service account should be created for that pod, and rights granted to that service account. The default service account should be configured such that it does not provide a service account token and does not have any explicit rights assignments. + +For each namespace including **default** and **kube-system** on a standard RKE install, the **default** service account must include this value: + +```yaml +automountServiceAccountToken: false +``` + +Save the following configuration to a file called `account_update.yaml`. + +```yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: default +automountServiceAccountToken: false +``` + +Create a bash script file called `account_update.sh`. Be sure to `chmod +x account_update.sh` so the script has execute permissions. + +```bash +#!/bin/bash -e + +for namespace in $(kubectl get namespaces -A -o=jsonpath="{.items[*]['metadata.name']}"); do + kubectl patch serviceaccount default -n ${namespace} -p "$(cat account_update.yaml)" +done +``` + +### Configure Network Policy + +#### Ensure that all Namespaces have Network Policies defined + +Running different applications on the same Kubernetes cluster creates a risk of one compromised application attacking a neighboring application. Network segmentation is important to ensure that containers can communicate only with those they are supposed to. A network policy is a specification of how selections of pods are allowed to communicate with each other and other network endpoints. + +Network Policies are namespace scoped. When a network policy is introduced to a given namespace, all traffic not allowed by the policy is denied. However, if there are no network policies in a namespace all traffic will be allowed into and out of the pods in that namespace. To enforce network policies, a CNI (container network interface) plugin must be enabled. This guide uses [Canal](https://github.com/projectcalico/canal) to provide the policy enforcement. Additional information about CNI providers can be found [here](https://www.suse.com/c/rancher_blog/comparing-kubernetes-cni-providers-flannel-calico-canal-and-weave/). + +Once a CNI provider is enabled on a cluster a default network policy can be applied. For reference purposes a **permissive** example is provided below. If you want to allow all traffic to all pods in a namespace (even if policies are added that cause some pods to be treated as “isolated”), you can create a policy that explicitly allows all traffic in that namespace. Save the following configuration as `default-allow-all.yaml`. Additional [documentation](https://kubernetes.io/docs/concepts/services-networking/network-policies/) about network policies can be found on the Kubernetes site. + +> This `NetworkPolicy` is just an example and is not recommended for production use. + +```yaml +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default-allow-all +spec: + podSelector: {} + ingress: + - {} + egress: + - {} + policyTypes: + - Ingress + - Egress +``` + +Create a bash script file called `apply_networkPolicy_to_all_ns.sh`. Be sure to `chmod +x apply_networkPolicy_to_all_ns.sh` so the script has execute permissions. + +```bash +#!/bin/bash -e + +for namespace in $(kubectl get namespaces -A -o=jsonpath="{.items[*]['metadata.name']}"); do + kubectl apply -f default-allow-all.yaml -n ${namespace} +done +``` + +Execute this script to apply the `default-allow-all.yaml` configuration with the **permissive** `NetworkPolicy` to all namespaces. + +### Reference Hardened RKE `cluster.yml` Configuration + +The reference `cluster.yml` is used by the RKE CLI that provides the configuration needed to achieve a hardened install of Rancher Kubernetes Engine (RKE). RKE install [documentation]({{}}/rke/latest/en/installation/) is provided with additional details about the configuration items. This reference `cluster.yml` does not include the required **nodes** directive which will vary depending on your environment. Documentation for node configuration in RKE can be found [here]({{}}/rke/latest/en/config-options/nodes/). + +> For a Kubernetes v1.18 cluster, the configuration `spec.volumes: 'ephemeral'` should be removed from the `PodSecurityPolicy`, since it's not supported in this Kubernetes release. + +```yaml +# If you intend to deploy Kubernetes in an air-gapped environment, +# please consult the documentation on how to configure custom RKE images. +# https://rancher.com/docs/rke/latest/en/installation/ . + +# The nodes directive is required and will vary depending on your environment. +# Documentation for node configuration can be found here: +# https://rancher.com/docs/rke/latest/en/config-options/nodes/ +nodes: [] +services: + etcd: + image: "" + extra_args: {} + extra_binds: [] + extra_env: [] + win_extra_args: {} + win_extra_binds: [] + win_extra_env: [] + external_urls: [] + ca_cert: "" + cert: "" + key: "" + path: "" + uid: 52034 + gid: 52034 + snapshot: false + retention: "" + creation: "" + backup_config: null + kube-api: + image: "" + extra_args: {} + extra_binds: [] + extra_env: [] + win_extra_args: {} + win_extra_binds: [] + win_extra_env: [] + service_cluster_ip_range: "" + service_node_port_range: "" + pod_security_policy: true + always_pull_images: false + secrets_encryption_config: + enabled: true + custom_config: null + audit_log: + enabled: true + configuration: null + admission_configuration: null + event_rate_limit: + enabled: true + configuration: null + kube-controller: + image: "" + extra_args: + feature-gates: RotateKubeletServerCertificate=true + tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 + bind-address: 127.0.0.1 + extra_binds: [] + extra_env: [] + win_extra_args: {} + win_extra_binds: [] + win_extra_env: [] + cluster_cidr: "" + service_cluster_ip_range: "" + scheduler: + image: "" + extra_args: + tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 + bind-address: 127.0.0.1 + extra_binds: [] + extra_env: [] + win_extra_args: {} + win_extra_binds: [] + win_extra_env: [] + kubelet: + image: "" + extra_args: + feature-gates: RotateKubeletServerCertificate=true + protect-kernel-defaults: true + tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 + extra_binds: [] + extra_env: [] + win_extra_args: {} + win_extra_binds: [] + win_extra_env: [] + cluster_domain: cluster.local + infra_container_image: "" + cluster_dns_server: "" + fail_swap_on: false + generate_serving_certificate: true + kubeproxy: + image: "" + extra_args: {} + extra_binds: [] + extra_env: [] + win_extra_args: {} + win_extra_binds: [] + win_extra_env: [] +network: + plugin: "" + options: {} + mtu: 0 + node_selector: {} + update_strategy: null +authentication: + strategy: "" + sans: [] + webhook: null +addons: | + # Upstream Kubernetes restricted PSP policy + # https://github.com/kubernetes/website/blob/564baf15c102412522e9c8fc6ef2b5ff5b6e766c/content/en/examples/policy/restricted-psp.yaml + apiVersion: policy/v1beta1 + kind: PodSecurityPolicy + metadata: + name: restricted-noroot + spec: + privileged: false + # Required to prevent escalations to root. + allowPrivilegeEscalation: false + requiredDropCapabilities: + - ALL + # Allow core volume types. + volumes: + - 'configMap' + - 'emptyDir' + - 'projected' + - 'secret' + - 'downwardAPI' + # Assume that ephemeral CSI drivers & persistentVolumes set up by the cluster admin are safe to use. + - 'csi' + - 'persistentVolumeClaim' + - 'ephemeral' + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + # Require the container to run without root privileges. + rule: 'MustRunAsNonRoot' + seLinux: + # This policy assumes the nodes are using AppArmor rather than SELinux. + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + readOnlyRootFilesystem: false + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRole + metadata: + name: psp:restricted-noroot + rules: + - apiGroups: + - extensions + resourceNames: + - restricted-noroot + resources: + - podsecuritypolicies + verbs: + - use + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRoleBinding + metadata: + name: psp:restricted-noroot + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: psp:restricted-noroot + subjects: + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:serviceaccounts + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:authenticated + --- + apiVersion: networking.k8s.io/v1 + kind: NetworkPolicy + metadata: + name: default-allow-all + spec: + podSelector: {} + ingress: + - {} + egress: + - {} + policyTypes: + - Ingress + - Egress + --- + apiVersion: v1 + kind: ServiceAccount + metadata: + name: default + automountServiceAccountToken: false +addons_include: [] +system_images: + etcd: "" + alpine: "" + nginx_proxy: "" + cert_downloader: "" + kubernetes_services_sidecar: "" + kubedns: "" + dnsmasq: "" + kubedns_sidecar: "" + kubedns_autoscaler: "" + coredns: "" + coredns_autoscaler: "" + nodelocal: "" + kubernetes: "" + flannel: "" + flannel_cni: "" + calico_node: "" + calico_cni: "" + calico_controllers: "" + calico_ctl: "" + calico_flexvol: "" + canal_node: "" + canal_cni: "" + canal_controllers: "" + canal_flannel: "" + canal_flexvol: "" + weave_node: "" + weave_cni: "" + pod_infra_container: "" + ingress: "" + ingress_backend: "" + metrics_server: "" + windows_pod_infra_container: "" +ssh_key_path: "" +ssh_cert_path: "" +ssh_agent_auth: false +authorization: + mode: "" + options: {} +ignore_docker_version: false +kubernetes_version: "" +private_registries: [] +ingress: + provider: "" + options: {} + node_selector: {} + extra_args: {} + dns_policy: "" + extra_envs: [] + extra_volumes: [] + extra_volume_mounts: [] + update_strategy: null + http_port: 0 + https_port: 0 + network_mode: "" +cluster_name: +cloud_provider: + name: "" +prefix_path: "" +win_prefix_path: "" +addon_job_timeout: 0 +bastion_host: + address: "" + port: "" + user: "" + ssh_key: "" + ssh_key_path: "" + ssh_cert: "" + ssh_cert_path: "" +monitoring: + provider: "" + options: {} + node_selector: {} + update_strategy: null + replicas: null +restore: + restore: false + snapshot_name: "" +dns: null +upgrade_strategy: + max_unavailable_worker: "" + max_unavailable_controlplane: "" + drain: null + node_drain_input: null +``` + +### Reference Hardened RKE Template Configuration + +The reference RKE template provides the configuration needed to achieve a hardened install of Kubernetes. RKE templates are used to provision Kubernetes and define Rancher settings. Follow the Rancher [documentation]({{}}/rancher/v2.6/en/installation) for additional installation and RKE template details. + +```yaml +# +# Cluster Config +# +default_pod_security_policy_template_id: restricted-noroot +docker_root_dir: /var/lib/docker +enable_cluster_alerting: false +enable_cluster_monitoring: false +enable_network_policy: true +local_cluster_auth_endpoint: + enabled: true +name: '' +# +# Rancher Config +# +rancher_kubernetes_engine_config: + addon_job_timeout: 45 + authentication: + strategy: x509 + dns: + nodelocal: + ip_address: '' + node_selector: null + update_strategy: {} + enable_cri_dockerd: false + ignore_docker_version: true +# +# # Currently only nginx ingress provider is supported. +# # To disable ingress controller, set `provider: none` +# # To enable ingress on specific nodes, use the node_selector, eg: +# provider: nginx +# node_selector: +# app: ingress +# + ingress: + default_backend: false + default_ingress_class: true + http_port: 0 + https_port: 0 + provider: nginx + kubernetes_version: v1.21.8-rancher1-1 + monitoring: + provider: metrics-server + replicas: 1 +# +# If you are using calico on AWS +# +# network: +# plugin: calico +# calico_network_provider: +# cloud_provider: aws +# +# # To specify flannel interface +# +# network: +# plugin: flannel +# flannel_network_provider: +# iface: eth1 +# +# # To specify flannel interface for canal plugin +# +# network: +# plugin: canal +# canal_network_provider: +# iface: eth1 +# + network: + mtu: 0 + options: + flannel_backend_type: vxlan + plugin: canal + rotate_encryption_key: false +# +# services: +# kube-api: +# service_cluster_ip_range: 10.43.0.0/16 +# kube-controller: +# cluster_cidr: 10.42.0.0/16 +# service_cluster_ip_range: 10.43.0.0/16 +# kubelet: +# cluster_domain: cluster.local +# cluster_dns_server: 10.43.0.10 +# + services: + scheduler: + extra_args: + tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 + bind-address: 127.0.0.1 + etcd: + backup_config: + enabled: true + interval_hours: 12 + retention: 6 + safe_timestamp: false + timeout: 300 + creation: 12h + extra_args: + election-timeout: 5000 + heartbeat-interval: 500 + retention: 72h + snapshot: false + uid: 52034 + gid: 52034 + kube_api: + always_pull_images: false + audit_log: + enabled: true + event_rate_limit: + enabled: true + pod_security_policy: true + secrets_encryption_config: + enabled: true + service_node_port_range: 30000-32767 + kube-controller: + extra_args: + feature-gates: RotateKubeletServerCertificate=true + tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 + bind-address: 127.0.0.1 + kubelet: + extra_args: + feature-gates: RotateKubeletServerCertificate=true + protect-kernel-defaults: true + tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 + fail_swap_on: false + generate_serving_certificate: true + ssh_agent_auth: false + upgrade_strategy: + max_unavailable_controlplane: '1' + max_unavailable_worker: 10% +windows_prefered_cluster: false +``` + +### Reference Hardened **cloud-config** Configuration + +A **cloud-config** configuration file is generally used in cloud infrastructure environments to allow for configuration management of compute instances. The reference config configures SUSE Linux Enterprise Server (SLES), openSUSE Leap, Red Hat Enterprise Linux (RHEL) and Ubuntu operating system level settings needed before installing Kubernetes. + +#### Reference Hardened **cloud-config** for SUSE Linux Enterprise Server 15 (SLES 15) and openSUSE Leap 15 + +```yaml +#cloud-config +system_info: + default_user: + groups: + - docker +write_files: +- path: "/etc/sysctl.d/90-kubelet.conf" + owner: root:root + permissions: '0644' + content: | + vm.overcommit_memory=1 + vm.panic_on_oom=0 + kernel.panic=10 + kernel.panic_on_oops=1 + kernel.keys.root_maxbytes=25000000 +package_update: true +ssh_pwauth: false +runcmd: +# Docker should already be installed in SLES 15 SP3 +- zypper install docker containerd +- systemctl daemon-reload +- systemctl enable docker.service +- systemctl start --no-block docker.service +- sysctl -p /etc/sysctl.d/90-kubelet.conf +- groupadd --gid 52034 etcd +- useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd --shell /usr/sbin/nologin +``` + +#### Reference Hardened **cloud-config** for Red Hat Enterprise Linux 8 (RHEL 8) and Ubuntu 20.04 LTS + +```yaml +#cloud-config +system_info: + default_user: + groups: + - docker +write_files: +- path: "/etc/sysctl.d/90-kubelet.conf" + owner: root:root + permissions: '0644' + content: | + vm.overcommit_memory=1 + vm.panic_on_oom=0 + kernel.panic=10 + kernel.panic_on_oops=1 + kernel.keys.root_maxbytes=25000000 +package_update: true +ssh_pwauth: false +runcmd: +# Install Docker from Rancher's Docker installation scripts - github.com/rancher/install-docker +- curl https://releases.rancher.com/install-docker/20.10.sh | sh +- sysctl -p /etc/sysctl.d/90-kubelet.conf +- groupadd --gid 52034 etcd +- useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd --shell /usr/sbin/nologin +``` diff --git a/content/rancher/v2.6/en/security/hardening-guides/_index.md b/content/rancher/v2.6/en/security/hardening-guides/_index.md index a3635419be5..ea4e969f058 100644 --- a/content/rancher/v2.6/en/security/hardening-guides/_index.md +++ b/content/rancher/v2.6/en/security/hardening-guides/_index.md @@ -1,6 +1,6 @@ --- title: Self-Assessment and Hardening Guides for Rancher v2.6 -shortTitle: Rancher v2.6 Guides +shortTitle: Rancher v2.6 Hardening Guides weight: 1 aliases: - /rancher/v2.6/en/security/rancher-2.5/ @@ -10,4 +10,56 @@ aliases: - /rancher/v2.6/en/security/rancher-2.5/1.6-benchmark-2.5/ --- -Rancher v2.6 hardening guides are currently being updated. For the time being, please consult [Rancher v2.5 self-assessment and hardening guides]({{}}/rancher/v2.5/en/security/rancher-2.5) for more information. +Rancher provides specific security hardening guides for each supported Rancher's Kubernetes distributions. + +- [Rancher Kubernetes Distributions](#rancher-kubernetes-distributions) +- [Hardening Guides and Benchmark Versions](#hardening-guides-and-benchmark-versions) + - [RKE Guides](#rke-guides) + - [RKE2 Guides](#rke2-guides) + - [K3s Guides](#k3s) +- [Rancher with SELinux](#rancher-with-selinux) + +# Rancher Kubernetes Distributions + +Rancher uses the following Kubernetes distributions: + +- [**RKE**]({{}}/rke/latest/en/), Rancher Kubernetes Engine, is a CNCF-certified Kubernetes distribution that runs entirely within Docker containers. +- [**RKE2**](https://docs.rke2.io/) is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector. +- [**K3s**]({{}}/k3s/latest/en/) is a fully conformant, lightweight Kubernetes distribution. It is easy to install, with half the memory of upstream Kubernetes, all in a binary of less than 100 MB. + +To harden a Kubernetes cluster outside of Rancher's distributions, refer to your Kubernetes provider docs. + +# Hardening Guides and Benchmark Versions + +These guides have been tested along with the Rancher v2.6 release. Each self-assessment guide is accompanied with a hardening guide and tested on a specific Kubernetes version and CIS benchmark version. If a CIS benchmark has not been validated for your Kubernetes version, you can choose to use the existing guides until a newer version is added. + +### RKE Guides + +| Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides | +| --- | --- | --- | --- | +| Kubernetes v1.18, v1.19, v1.20 and v1.21 | CIS v1.6 | [Link](./1.6-benchmark-2.6) | [Link](./1.6-hardening-2.6) | + +> **Notes** +> +> - Kubernetes v1.22 is currently in experimental mode in Rancher v2.6.3. +> - CIS v1.20 benchmark version for Kubernetes v1.19 and v1.20 is not yet released as a profile in Rancher's CIS Benchmark chart. + +### RKE2 Guides + +| Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides | +| --- | --- | --- | --- | +| Kubernetes v1.18 | CIS v1.5 | [Link](https://docs.rke2.io/security/cis_self_assessment15/) | [Link](https://docs.rke2.io/security/hardening_guide/) | +| Kubernetes v1.20 | CIS v1.6 | [Link](https://docs.rke2.io/security/cis_self_assessment16/) | [Link](https://docs.rke2.io/security/hardening_guide/) | + +### K3s Guides + +| Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guide | +| --- | --- | --- | --- | +| Kubernetes v1.17, v1.18, & v1.19 | CIS v1.5 | [Link]({{}}/k3s/latest/en/security/self_assessment/) | [Link]({{}}/k3s/latest/en/security/hardening_guide/) | + + +# Rancher with SELinux + +[Security-Enhanced Linux (SELinux)](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) is a security enhancement to Linux. After being historically used by government agencies, SELinux is now industry standard and is enabled by default on RHEL and CentOS. + +To use Rancher with SELinux, we recommend installing the `rancher-selinux` RPM according to the instructions on [this page.]({{}}/rancher/v2.6/en/security/selinux/#installing-the-rancher-selinux-rpm) diff --git a/content/rancher/v2.6/en/virtualization-admin/_index.md b/content/rancher/v2.6/en/virtualization-admin/_index.md index f37ffb8b951..19c517f7c3d 100644 --- a/content/rancher/v2.6/en/virtualization-admin/_index.md +++ b/content/rancher/v2.6/en/virtualization-admin/_index.md @@ -25,6 +25,8 @@ To navigate to the Harvester cluster, click **☰ > Virtualization Management**. The [Harvester node driver](https://docs.harvesterhci.io/v0.3/rancher/node-driver/) is marked as `tech preview` on RKE and RKE2 options in Rancher. This will be the case both on the Create page and once the driver is already enabled. The node driver is available whether or not the Harvester feature flag is enabled. Note that the node driver is off by default. Users may create RKE or RKE2 clusters on Harvester only from the Cluster Management page. +Harvester allows `.ISO` images to be uploaded and displayed through the Harvester UI, but this is not supported in the Rancher UI. This is because `.ISO` images usually require additional setup that interferes with a clean deployment (without requiring user intervention), and they are not typically used in cloud environments. + Click [here]({{}}/rancher/v2.6/en/admin-settings/drivers/#node-drivers) for more information on node drivers in Rancher. ### Limitations diff --git a/scripts/converters/css/style-portrait.css b/scripts/converters/css/style-portrait.css index e6bcd2303ef..ab19e788e28 100644 --- a/scripts/converters/css/style-portrait.css +++ b/scripts/converters/css/style-portrait.css @@ -238,7 +238,7 @@ h2 { font-size:1.5em; } -h3 {font-size:1.4em;} +h3 {font-size:1.2em;} h4 {font-size:1.3em; line-height:30px; } @@ -283,7 +283,7 @@ nav ul li a { nav ul li a::after {content: target-counter(attr(href url), page, decimal); float:right;margin-right:10px;} nav ul li ul {list-style-type: none; border-left-style: dashed; border-left-width: 1px; border-color: #000; margin-top:1.5em;} nav ul li ul li {margin-left:-.5em;color:#ff0000;} -nav ul li ul li a {border:none;font-family:PoppinsExtraLight;margin-top:-1.5em;} +nav ul li ul li a {border:none;font-family:PoppinsExtraLight;font-size:.75em;margin-bottom:1.8em;} nav ul li ul li a::after {font-size:.75em;} nav code {background:none;} nav a{text-decoration:none;outline:none;color:#000;} diff --git a/scripts/converters/scripts/results_to_md.sh b/scripts/converters/scripts/results_to_md.sh index 6e087588c3f..a7d5d473313 100755 --- a/scripts/converters/scripts/results_to_md.sh +++ b/scripts/converters/scripts/results_to_md.sh @@ -19,7 +19,7 @@ get_id_text() { get_section_ids() { id=${1} - jq -r --arg id "${id}" '.[] | select(.id==$id) | .checks[].id' ${results_file} + jq -r --arg id "${id}" '.[] | select(.id==$id) | .checks[].id' ${results_file} | sort -V } get_section_desc() { @@ -53,12 +53,11 @@ for id in $(get_ids); do test_desc=$(echo ${result} | jq -r '.description') audit=$(echo ${result} | jq -r '.audit') audit_config=$(echo ${result} | jq -r '.audit_config') - actual_value=$(echo ${result} | jq -r '.actual_value_per_node."cis-aio-0"') + actual_value=$(echo ${result} | jq -r '.actual_value_per_node[]') type=$(echo ${result} | jq -r '.test_type') status=$(echo ${result} | jq -r '.state') remediation=$(echo ${result} | jq -r '.remediation') expected_result=$(echo ${result} | jq -r '.expected_result') -# echo "#### ${test} ${test_desc}" echo if [ "${type}" = "skip" ]; then echo "**Result:** Not Applicable" @@ -76,7 +75,7 @@ for id in $(get_ids); do if [[ ${audit} =~ ".sh" ]]; then audit_script=$(basename $(echo ${audit} | cut -d ' ' -f1)) test_helper="${test_helpers}/${audit_script}" - echo "**Audit Script:** ${audit_script}" + echo "**Audit Script:** \`${audit_script}\`" echo echo '```bash' cat ${test_helper} @@ -106,6 +105,14 @@ for id in $(get_ids); do echo '```' echo fi + if [ ! -z "${expected_result}" ]; then + echo "**Expected Result**:" + echo + echo '```console' + echo ${expected_result} + echo '```' + echo + fi if [ ! -z "${actual_value}" ] && [ "${status}" != "PASS" ] && [ "${type}" != "skip" ] && [ "${type}" != "manual" ]; then echo "**Returned Value**:" echo @@ -114,14 +121,6 @@ for id in $(get_ids); do echo '```' echo fi - if [ ! -z "${expected_result}" ]; then - echo "**Expected result**:" - echo - echo '```console' - echo ${expected_result} - echo '```' - echo - fi done done done From e98cb6dee13b51742b1c070ebd72a64ec8681f65 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Mon, 4 Apr 2022 18:01:28 -0700 Subject: [PATCH 381/478] Remove breaking changes to Permalink --- Dockerfile.dev | 2 +- Dockerfile.prod | 2 +- Dockerfile.staging | 2 +- config.toml | 4 ++-- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Dockerfile.dev b/Dockerfile.dev index 53225113ca0..af34fcf57dc 100644 --- a/Dockerfile.dev +++ b/Dockerfile.dev @@ -10,4 +10,4 @@ RUN mkdir -p /output /theme/rancher-website-theme && tar -xzf /run/master.tar.gz # Expose default hugo port EXPOSE 9001 -ENTRYPOINT ["hugo", "serve", "--bind=0.0.0.0", "--buildDrafts", "--buildFuture" ] +ENTRYPOINT ["hugo", "serve", "--bind=0.0.0.0", "--buildDrafts", "--buildFuture", "--baseURL=" ] diff --git a/Dockerfile.prod b/Dockerfile.prod index 0a0511d279c..38ba46de614 100644 --- a/Dockerfile.prod +++ b/Dockerfile.prod @@ -16,7 +16,7 @@ COPY .git .git ADD https://github.com/rancherlabs/website-theme/archive/master.tar.gz /run/master.tar.gz RUN mkdir -p /output /theme/rancher-website-theme && tar -xzf /run/master.tar.gz -C /run/node_modules/rancher-website-theme --strip=1 && rm /run/master.tar.gz -RUN ["hugo", "--buildFuture", "--destination=/output"] +RUN ["hugo", "--buildFuture", "--baseURL=https://rancher.com/docs", "--destination=/output"] # Make sure something got built RUN stat /output/index.html diff --git a/Dockerfile.staging b/Dockerfile.staging index ea6ea487cfb..5dc30768635 100644 --- a/Dockerfile.staging +++ b/Dockerfile.staging @@ -16,7 +16,7 @@ COPY .git .git ADD https://github.com/rancherlabs/website-theme/archive/master.tar.gz /run/master.tar.gz RUN mkdir -p /output /theme/rancher-website-theme && tar -xzf /run/master.tar.gz -C /run/node_modules/rancher-website-theme --strip=1 && rm /run/master.tar.gz -RUN ["hugo", "--buildDrafts", "--buildFuture", "--destination=/output"] +RUN ["hugo", "--buildDrafts", "--buildFuture", "--baseURL=https://staging.rancher.com/docs", "--destination=/output"] # Make sure something got built RUN stat /output/index.html diff --git a/config.toml b/config.toml index de5a060aead..6ea4f5e3a0b 100644 --- a/config.toml +++ b/config.toml @@ -1,4 +1,4 @@ -baseURL = ".Permalink" +baseURL = "" languageCode = "en-us" title = "Rancher Labs" @@ -209,4 +209,4 @@ pre = "keyboard_arrow_down" [[menu.main]] name = "Partners" url = "https://rancher.com/partners/" - parent = "about" \ No newline at end of file + parent = "about" From c02308fdfe34cae103723d164d1375e2740a6bd4 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 4 Apr 2022 21:58:23 -0400 Subject: [PATCH 382/478] Recommended revisions for Nutanix docs --- .../rke-clusters/node-pools/nutanix/_index.md | 10 +++--- .../nutanix-node-template-config/_index.md | 16 +++++---- .../provisioning-nutanix-clusters/_index.md | 33 +++++++++---------- 3 files changed, 30 insertions(+), 29 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/_index.md index a5080e62f47..f009dc078f8 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/_index.md @@ -6,15 +6,15 @@ metaDescription: Use Rancher to create a Nutanix AOS (AHV) cluster. It may consi weight: 2225 --- -By using Rancher with Nutanix AOS (AHV), you can bring cloud operations on-premises. +[Nutanix Acropolis Operating System](https://www.nutanix.com/products/acropolis) (Nutanix AOS) is an operating system for the Nutanix hyper-converged infrastructure platform. AOS comes with a built-in hypervisor called [Acropolis Hypervisor](https://www.nutanix.com/products/ahv), or AHV. By using Rancher with Nutanix AOS (AHV), you can bring cloud operations on-premises. -Rancher can provision nodes in AOS (AHV) and install Kubernetes on them. When creating a Kubernetes cluster in AOS, Rancher first provisions the specified number of virtual machines by communicating with the Prism Central API. Then it installs Kubernetes on top of them. +Rancher can provision nodes in AOS (AHV) and install Kubernetes on them. When creating a Kubernetes cluster in AOS, Rancher first provisions the specified number of virtual machines by communicating with the Prism Central API. Then it installs Kubernetes on top of the VMs. A Nutanix cluster may consist of multiple groups of VMs with distinct properties, such as the amount of memory or the number of vCPUs. This grouping allows for fine-grained control over the sizing of nodes for each Kubernetes role. -- [Creating a Nutanix Cluster](#creating-a-nutanix-cluster) -- [Provisioning Storage](#provisioning-storage) +- [Creating a Nutanix Cluster]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/provisioning-nutanix-clusters/#creating-a-nutanix-aos-cluster) +- [Provisioning Storage]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/provisioning-nutanix-clusters) # Creating a Nutanix Cluster -In [this section,](./provisioning-nutanix-clusters) you'll learn how to use Rancher to install an [RKE]({{}}/rke/latest/en/) Kubernetes cluster in Nutanix AOS. +In [this section,](./provisioning-nutanix-clusters) you'll learn how to use Rancher to install an [RKE]({{}}/rke/latest/en/) Kubernetes cluster in Nutanix AOS. \ No newline at end of file diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/nutanix-node-template-config/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/nutanix-node-template-config/_index.md index 55c64c2fc9b..a4ae10d8ece 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/nutanix-node-template-config/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/nutanix-node-template-config/_index.md @@ -14,9 +14,9 @@ weight: 2 | Parameter | Required | Description | Default |:-----------------------------|:--------:|:-----------------------------------------------------------------|:----- -| Management Endpoint | * | Hostname/IP address of Prism Central | -| Username | * | Username of the Prism Central user | -| Password | * | Password of the Prism Central user | +| Management Endpoint | ✓ | Hostname/IP address of Prism Central | +| Username | ✓ | Username of the Prism Central user | +| Password | ✓ | Password of the Prism Central user | | Allow insecure communication | | Set to true to allow insecure SSL communication to Prism Central | False # Scheduling @@ -25,7 +25,7 @@ Choose what Nutanix cluster the virtual machine will be scheduled to. | Parameter | Required | Description |:----------|:--------:|:---------------------------------------------------------------------------- -| Cluster | * | Name of the Nutanix cluster where the VM should be deployed (case sensitive) +| Cluster | ✓ | Name of the Nutanix cluster where the VM should be deployed (case sensitive) # Instance Options @@ -35,12 +35,12 @@ In the **Instance Options** section, configure the number of vCPUs, memory, and |:---------------------|:--------:|:--------------------------------------------------------------------------------------------|:------- | CPUs | | Number of vCPUs allocated to the VM (cores) | 2 | Memory | | Amount of RAM allocated to the VM (MB) | 2 GB -| Template Image | * | Name of the Disk Image template to clone as the VM's primary disk (must support cloud-init) | +| Template Image | ✓ | Name of the Disk Image template to clone as the VM's primary disk (must support cloud-init) | | VM Disk Size | | New size of the VM's primary disk (in GiB) | | Additional Disk Size | | Size of an additional disk to add to the VM (in GiB) | | Storage Container | | Storage container _UUID_ in which to provision an additional disk | | Cloud Config YAML | | Cloud-init to provide to the VM (will be patched with Rancher root user) | -| Network | * | Name(s) of the network(s) to attach to the VM | +| Network | ✓ | Name(s) of the network(s) to attach to the VM | | VM Categories | | Name(s) of any categories to be applied to the VM | The VM may use any modern Linux operating system that is configured with support for [cloud-init](https://cloudinit.readthedocs.io/en/latest/) using the [Config Drive v2 datasource](https://cloudinit.readthedocs.io/en/latest/topics/datasources/configdrive.html). @@ -59,4 +59,6 @@ A category is a grouping of entities into a key value pair. Typically, VMs are a To make use of cloud-init initialization, paste a cloud config using valid YAML syntax into the **Cloud Config YAML** field. Refer to the [cloud-init documentation](https://cloudinit.readthedocs.io/en/latest/topics/examples.html) for a commented set of examples of supported cloud config directives. -Note that cloud-init based network configuration is not recommended and only supported via user data `runcmd` rather than by NoCloud or other network configuration datasources. Nutanix IP Address Management (IPAM) or other DHCP service is recommended. +Note that cloud-init based network configuration is not recommended and only supported via user data `runcmd` rather than by NoCloud or other network configuration datasources. + +Nutanix IP Address Management (IPAM) or another DHCP service is recommended. diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/provisioning-nutanix-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/provisioning-nutanix-clusters/_index.md index 9ad854e1b3b..de2647ddced 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/provisioning-nutanix-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/provisioning-nutanix-clusters/_index.md @@ -3,34 +3,34 @@ title: Provisioning Kubernetes Clusters in Nutanix AOS weight: 1 --- -In this section, you'll learn how to use Rancher to install an [RKE]({{}}/rke/latest/en/) Kubernetes cluster in Nutanix AOS (AHV). +To use Rancher to install an [RKE]({{}}/rke/latest/en/) Kubernetes cluster in Nutanix AOS (AHV): -First, you will locate Rancher's built-in Nutanix [node driver and activate it]({{}}/rancher/v2.6/en/admin-settings/drivers/node-drivers/#activating-deactivating-node-drivers). +1. Locate Rancher's built-in Nutanix [node driver and activate it]({{}}/rancher/v2.6/en/admin-settings/drivers/node-drivers/#activating-deactivating-node-drivers). -Then you will create a node template, which Rancher will use to provision nodes in Nutanix AOS. +1. Create a node template, which Rancher will use to provision nodes in Nutanix AOS. -Finally, you will create a Nutanix AOS cluster in Rancher, and when configuring the new cluster, you will define node pools for it. Each node pool will have a Kubernetes role of etcd, controlplane, or worker. Rancher will install RKE Kubernetes on the new nodes, and it will set up each node with the Kubernetes role defined by the node pool. +1. Create a Nutanix AOS cluster in Rancher. When configuring the new cluster, you will define node pools for it. Each node pool will have a Kubernetes role of etcd, controlplane, or worker. Rancher will install RKE Kubernetes on the new nodes, and it will set up each node with the Kubernetes role defined by the node pool. For details on configuring the Nutanix AOS node template, refer to the [Nutanix AOS node template configuration reference.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/nutanix/nutanix-node-template-config/) -For details on configuring RKE Kubernetes clusters in Rancher, refer to the [cluster configuration reference.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/options) +For details on configuring RKE Kubernetes clusters in Rancher, refer to the [cluster configuration reference.]({{}}/rancher/v2.6/en/cluster-admin/editing-clusters/rke-config-reference/) -- [Preparation in Nutanix AOS](#preparation-in-Nutanix AOS) -- [Creating a Nutanix AOS Cluster](#creating-a-Nutanix AOS-cluster) +- [Preparation in Nutanix AOS](#preparation-in-nutanix-aos) +- [Creating a Nutanix AOS Cluster](#creating-a-nutanix-aos-cluster) # Preparation in Nutanix AOS -This section describes the requirements for setting up Nutanix AOS so that Rancher can provision VMs and clusters. +The following sections describe the requirements for setting up Nutanix AOS so that Rancher can provision VMs and clusters. -The node templates are documented and tested with Nutanix AOS version 5.20.2 and 6.0.1. +**Note:** The node templates are documented and tested with Nutanix AOS version 5.20.2 and 6.0.1. ### Create Credentials in Nutanix AOS -Before proceeding to create a cluster, you must ensure that you have a Nutanix Prism Central user with admin permissions. When you set up a node template, the template will need to use these credentials. +Before proceeding to create a cluster, you must ensure that you have a [Nutanix Prism Central user account](https://portal.nutanix.com/page/documents/details?targetId=Nutanix-Security-Guide-v6_0:wc-user-create-wc-t.html) with admin permissions. When you set up a node template, the template will need to use these credentials. ### Network Permissions -It must be ensured that the hosts running the Rancher server are able to establish the following network connections: +You must ensure that the hosts running the Rancher server are able to establish the following network connections: - To the Nutanix Prism Central API (usually port 9440/TCP). - To port 22/TCP and 2376/TCP on the created VMs @@ -62,18 +62,16 @@ Creating a [node template]({{}}/rancher/v2.6/en/cluster-provisioning/rk Use Rancher to create a Kubernetes cluster in Nutanix AOS. -1. In the upper left corner, click **☰ > Cluster Management**. +1. Click **☰ > Cluster Management**. 1. On the **Clusters** page, click **Create**. 1. Click **Nutanix**. 1. Enter a **Cluster Name**, then click **Continue**. -1. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user. -1. Use **Cluster Options** to choose the version of Kubernetes that will be installed, what network provider will be used and if you want to enable project network isolation. To see more cluster options, click on **Show advanced options**. For help configuring the cluster, refer to the [RKE cluster configuration reference.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/options) +1. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users who can access the cluster. Use the **Role** drop-down to set permissions for each user. +1. Use **Cluster Options** to choose the version of Kubernetes that will be installed, what network provider will be used, and whether you want to enable project network isolation. To see more cluster options, click on **Show advanced options**. For help configuring the cluster, refer to the [RKE cluster configuration reference.]({{}}/rancher/v2.6/en/cluster-admin/editing-clusters/rke-config-reference/) 1. Add one or more node pools to your cluster. Each node pool uses a node template to provision new nodes. For more information about node pools, including best practices for assigning Kubernetes roles to the nodes, see [this section.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/#node-pools) 1. Review your options to confirm they're correct. Then click **Create**. -**Result:** - -Your cluster is created and assigned a state of **Provisioning**. Rancher is standing up your cluster. +**Result:** Your cluster is created and assigned a state of **Provisioning**. Rancher is standing up your cluster. You can access your cluster after its state is updated to **Active**. @@ -88,4 +86,5 @@ You can access your cluster after its state is updated to **Active**. After creating your cluster, you can access it through the Rancher UI. As a best practice, we recommend setting up these alternate ways of accessing your cluster: - **Access your cluster with the kubectl CLI:** Follow [these steps]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/kubectl/#accessing-clusters-with-kubectl-on-your-workstation) to access clusters with kubectl on your workstation. In this case, you will be authenticated through the Rancher server’s authentication proxy, then Rancher will connect you to the downstream cluster. This method lets you manage the cluster without the Rancher UI. + - **Access your cluster with the kubectl CLI, using the authorized cluster endpoint:** Follow [these steps]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) to access your cluster with kubectl directly, without authenticating through Rancher. We recommend setting up this alternative method to access your cluster so that in case you can’t connect to Rancher, you can still access the cluster. \ No newline at end of file From aca17a5e9751e0f0e496d830c3c59f4065f87bcf Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Tue, 5 Apr 2022 15:01:40 +0530 Subject: [PATCH 383/478] Amending per suggestions --- content/rancher/v2.6/en/installation/requirements/_index.md | 2 +- .../workload/quickstart-deploy-workload-ingress/_index.md | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/requirements/_index.md b/content/rancher/v2.6/en/installation/requirements/_index.md index d7a9168baf5..c60d529b881 100644 --- a/content/rancher/v2.6/en/installation/requirements/_index.md +++ b/content/rancher/v2.6/en/installation/requirements/_index.md @@ -170,7 +170,7 @@ Rancher performance depends on etcd in the cluster performance. To ensure optima This section describes the networking requirements for the node(s) where the Rancher server is installed. -> If a server containing Rancher has the `X-Frame-Options=DENY` header, the Ember UI will be completely unreachable on upgrading from the legacy UI. This is because any screen written for the legacy UI is rendered as an embedded iframe within the new Dashboard. +> If a server containing Rancher has the `X-Frame-Options=DENY` header, some pages in the new Rancher UI will not be able to render after upgrading from the legacy UI. This is because some legacy pages are embedded as iFrames in the new UI. ### Node IP Addresses diff --git a/content/rancher/v2.6/en/quick-start-guide/workload/quickstart-deploy-workload-ingress/_index.md b/content/rancher/v2.6/en/quick-start-guide/workload/quickstart-deploy-workload-ingress/_index.md index 5be4b866fb9..004950b7fe2 100644 --- a/content/rancher/v2.6/en/quick-start-guide/workload/quickstart-deploy-workload-ingress/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/workload/quickstart-deploy-workload-ingress/_index.md @@ -54,6 +54,7 @@ Now that the application is up and running, it needs to be exposed so that other **Result:** The application is assigned a `sslip.io` address and exposed. It may take a minute or two to populate. + ### View Your Application From the **Deployments** page, find the **Endpoints** column for your deployment and click on an endpoint. The endpoints available will depend on how you configured the port you added to your deployment. For endpoints where you do not see a randomly assigned port, append the path you specified when creating the ingress to the IP address. For example, if your endpoint looks like `xxx.xxx.xxx.xxx` or `https://xxx.xxx.xxx.xxx` change it to `xxx.xxx.xxx.xxx/hello` or `https://xxx.xxx.xxx.xxx/hello`. From facd7baf0b245d01447036957744e7405ded97ca Mon Sep 17 00:00:00 2001 From: jgallucci32 Date: Thu, 7 Apr 2022 14:18:26 -0700 Subject: [PATCH 384/478] Remove invalid link to kubernetes cloud providers Kubernetes removed the official documentation for cloud providers in https://github.com/kubernetes/website/pull/23517. Users are now instructed to view the individual documentation provided by each cloud provider. --- content/rke/latest/en/config-options/cloud-providers/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rke/latest/en/config-options/cloud-providers/_index.md b/content/rke/latest/en/config-options/cloud-providers/_index.md index 45501bcf784..f9a58253e15 100644 --- a/content/rke/latest/en/config-options/cloud-providers/_index.md +++ b/content/rke/latest/en/config-options/cloud-providers/_index.md @@ -3,7 +3,7 @@ title: Cloud Providers weight: 250 --- -RKE supports the ability to set your specific [cloud provider](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/) for your Kubernetes cluster. There are specific cloud configurations for these cloud providers. +RKE supports the ability to set your specific cloud provider for your Kubernetes cluster. There are specific cloud configurations for these cloud providers. To enable a cloud provider its name as well as any required configuration options must be provided under the `cloud_provider` directive in the cluster YML. * [AWS]({{}}/rke/latest/en/config-options/cloud-providers/aws) From 9dca333f2720be3117078265cec1a835361c62fc Mon Sep 17 00:00:00 2001 From: jgallucci32 Date: Thu, 7 Apr 2022 14:21:18 -0700 Subject: [PATCH 385/478] Remove invalid link to cloud providers in v2.5 Kubernetes removed the official documentation for cloud providers in https://github.com/kubernetes/website/pull/23517. Users are now instructed to view the individual documentation provided by each cloud provider. --- .../rke-clusters/cloud-providers/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/cloud-providers/_index.md b/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/cloud-providers/_index.md index 82f660865e9..6b12db8c31a 100644 --- a/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/cloud-providers/_index.md +++ b/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/cloud-providers/_index.md @@ -6,7 +6,7 @@ aliases: - /rancher/v2.5/en/cluster-provisioning/rke-clusters/options/cloud-providers - /rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/ --- -A _cloud provider_ is a module in Kubernetes that provides an interface for managing nodes, load balancers, and networking routes. For more information, refer to the [official Kubernetes documentation on cloud providers.](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/) +A _cloud provider_ is a module in Kubernetes that provides an interface for managing nodes, load balancers, and networking routes. When a cloud provider is set up in Rancher, the Rancher server can automatically provision new nodes, load balancers or persistent storage devices when launching Kubernetes definitions, if the cloud provider you're using supports such automation. @@ -39,7 +39,7 @@ For details on enabling the vSphere cloud provider, refer to [this page.](./vsph ### Setting up a Custom Cloud Provider -The `Custom` cloud provider is available if you want to configure any [Kubernetes cloud provider](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/). +The `Custom` cloud provider is available if you want to configure any Kubernetes cloud provider. For the custom cloud provider option, you can refer to the [RKE docs]({{}}/rke/latest/en/config-options/cloud-providers/) on how to edit the yaml file for your specific cloud provider. There are specific cloud providers that have more detailed configuration : From 62f23aaa3462a91157faaa9717ee16fc660ab917 Mon Sep 17 00:00:00 2001 From: Roberto Bonafiglia Date: Fri, 8 Apr 2022 10:31:33 +0200 Subject: [PATCH 386/478] Added wireguard port on networking installation --- .../en/installation/installation-requirements/_index.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/k3s/latest/en/installation/installation-requirements/_index.md b/content/k3s/latest/en/installation/installation-requirements/_index.md index 3daee8b3ccc..276e684d7c4 100644 --- a/content/k3s/latest/en/installation/installation-requirements/_index.md +++ b/content/k3s/latest/en/installation/installation-requirements/_index.md @@ -44,7 +44,7 @@ K3s performance depends on the performance of the database. To ensure optimal sp The K3s server needs port 6443 to be accessible by all nodes. -The nodes need to be able to reach other nodes over UDP port 8472 when Flannel VXLAN is used. The node should not listen on any other port. K3s uses reverse tunneling such that the nodes make outbound connections to the server and all kubelet traffic runs through that tunnel. However, if you do not use Flannel and provide your own custom CNI, then port 8472 is not needed by K3s. +The nodes need to be able to reach other nodes over UDP port 8472 when Flannel VXLAN is used or UDP ports 51820 and 51821 (when using IPv6) when Flannel Wireguard backend is used. The node should not listen on any other port. K3s uses reverse tunneling such that the nodes make outbound connections to the server and all kubelet traffic runs through that tunnel. However, if you do not use Flannel and provide your own custom CNI, then the ports needed by Flannel are not needed by K3s. If you wish to utilize the metrics server, you will need to open port 10250 on each node. @@ -59,6 +59,8 @@ If you plan on achieving high availability with embedded etcd, server nodes must |-----|-----|----------------|---| | TCP | 6443 | K3s agent nodes | Kubernetes API Server | UDP | 8472 | K3s server and agent nodes | Required only for Flannel VXLAN +| UDP | 51820 | K3s server and agent nodes | Required only for Flannel Wireguard backend +| UDP | 51821 | K3s server and agent nodes | Required only for Flannel Wireguard backend with IPv6 | TCP | 10250 | K3s server and agent nodes | Kubelet metrics | TCP | 2379-2380 | K3s server nodes | Required only for HA with embedded etcd From 54c8abb9cd01e4130761008783b9418fd98a035c Mon Sep 17 00:00:00 2001 From: Bastian Hofmann Date: Fri, 8 Apr 2022 13:01:46 +0200 Subject: [PATCH 387/478] Always link to the latest Longhorn docs version Signed-off-by: Bastian Hofmann --- content/rancher/v2.6/en/longhorn/_index.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/rancher/v2.6/en/longhorn/_index.md b/content/rancher/v2.6/en/longhorn/_index.md index ad14ffbb067..d394cab5d02 100644 --- a/content/rancher/v2.6/en/longhorn/_index.md +++ b/content/rancher/v2.6/en/longhorn/_index.md @@ -24,12 +24,12 @@ With Longhorn, you can: ### Installing Longhorn with Rancher -1. Fulfill all [Installation Requirements.](https://longhorn.io/docs/1.1.0/deploy/install/#installation-requirements) +1. Fulfill all [Installation Requirements.](https://longhorn.io/docs/latest/deploy/install/#installation-requirements) 1. Go to the cluster where you want to install Longhorn. 1. Click **Apps & Marketplace**. 1. Click **Charts**. 1. Click **Longhorn**. -1. Optional: To customize the initial settings, click **Longhorn Default Settings** and edit the configuration. For help customizing the settings, refer to the [Longhorn documentation.](https://longhorn.io/docs/1.0.2/references/settings/) +1. Optional: To customize the initial settings, click **Longhorn Default Settings** and edit the configuration. For help customizing the settings, refer to the [Longhorn documentation.](https://longhorn.io/docs/latest/references/settings/) 1. Click **Install**. **Result:** Longhorn is deployed in the Kubernetes cluster. @@ -64,7 +64,7 @@ Longhorn creates a dedicated storage controller for each volume and synchronousl The storage controller and replicas are themselves orchestrated using Kubernetes. -You can learn more about its architecture [here.](https://longhorn.io/docs/1.0.2/concepts/) +You can learn more about its architecture [here.](https://longhorn.io/docs/latest/concepts/)
      Longhorn Architecture
      ![Longhorn Architecture]({{}}/img/rancher/longhorn-architecture.svg) From 8efe67488d26c0b6ca9659a490d51d6fc0928edf Mon Sep 17 00:00:00 2001 From: mutron3k Date: Fri, 8 Apr 2022 10:05:40 -0400 Subject: [PATCH 388/478] updating cert-manager version to match 2.6 notes https://rancher.com/docs/rancher/v2.6/en/installation/install-rancher-on-k8s/ "New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022." and https://rancher.com/docs/rancher/v2.6/en/installation/install-rancher-on-k8s/ ("CLICK TO EXPAND") helm install cert-manager jetstack/cert-manager \ --namespace cert-manager \ --create-namespace \ --version v1.7.1 --- .../deployment/quickstart-manual-setup/_index.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md index cd8a9fe0e07..5dcaa385978 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md @@ -92,7 +92,7 @@ helm repo add rancher-latest https://releases.rancher.com/server-charts/latest kubectl create namespace cattle-system -kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.5.1/cert-manager.crds.yaml +kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.7.1/cert-manager.crds.yaml helm repo add jetstack https://charts.jetstack.io @@ -101,13 +101,13 @@ helm repo update helm install cert-manager jetstack/cert-manager \ --namespace cert-manager \ --create-namespace \ - --version v1.5.1 + --version v1.7.1 # Windows Powershell helm install cert-manager jetstack/cert-manager \` --namespace cert-manager \` --create-namespace \` - --version v1.5.1 + --version v1.7.1 ``` The final command to install Rancher is below. The command requires a domain name that forwards traffic to the Linux machine. For the sake of simplicity in this tutorial, you can use a fake domain name to create your proof-of-concept. An example of a fake domain name would be `.sslip.io`. From 98cd5108a382cb6cf9fda054bd61ff95ba33bb9c Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Mon, 11 Apr 2022 11:33:37 +0530 Subject: [PATCH 389/478] Amending Encryption Configuration Section --- content/rancher/v2.6/en/backups/examples/_index.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/content/rancher/v2.6/en/backups/examples/_index.md b/content/rancher/v2.6/en/backups/examples/_index.md index 87c607b7780..38aa7964541 100644 --- a/content/rancher/v2.6/en/backups/examples/_index.md +++ b/content/rancher/v2.6/en/backups/examples/_index.md @@ -272,6 +272,13 @@ data: # Example EncryptionConfiguration +The snippet below demonstrates two different types of secrets and their relevance with respect to Backup and Restore of custom resources.s + +The first example is that of a secret that is used to encrypt the backup files. The backup operator, in this case, will not be able to read the secrets encryption file. It only uses the contents of the secret. + +The second example is that of a Kubernetes secrets encryption config file that is used to encrypt secrets when stored in etcd. It is important to note that while backing up your etcd config ensure you also backup your EncryptionConfiguration. Failing to do so might result in you not being able to use the restored data. + + ```yaml apiVersion: apiserver.config.k8s.io/v1 kind: EncryptionConfiguration From 5f30d33956ddd31a9ce1825a4677259cec80dbe2 Mon Sep 17 00:00:00 2001 From: Bastian Hofmann Date: Mon, 11 Apr 2022 10:24:53 +0200 Subject: [PATCH 390/478] Fix link in Logging -> Flows to link to the correct upstream docs page Signed-off-by: Bastian Hofmann --- .../v2.6/en/logging/custom-resource-config/flows/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/logging/custom-resource-config/flows/_index.md b/content/rancher/v2.6/en/logging/custom-resource-config/flows/_index.md index f4ffeb05cfb..2ad4991dc8f 100644 --- a/content/rancher/v2.6/en/logging/custom-resource-config/flows/_index.md +++ b/content/rancher/v2.6/en/logging/custom-resource-config/flows/_index.md @@ -3,7 +3,7 @@ title: Flows and ClusterFlows weight: 1 --- -For the full details on configuring `Flows` and `ClusterFlows`, see the [Banzai Cloud Logging operator documentation.](https://banzaicloud.com/docs/one-eye/logging-operator/configuration/output/) +For the full details on configuring `Flows` and `ClusterFlows`, see the [Banzai Cloud Logging operator documentation.](https://banzaicloud.com/docs/one-eye/logging-operator/configuration/flow/) - [Configuration](#configuration) - [YAML Example](#yaml-example) From b20990affbfe93d03db1c23c93445300c05d8440 Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Tue, 12 Apr 2022 11:46:58 +0530 Subject: [PATCH 391/478] Update content/rancher/v2.6/en/backups/examples/_index.md Co-authored-by: Brad Davidson --- content/rancher/v2.6/en/backups/examples/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/backups/examples/_index.md b/content/rancher/v2.6/en/backups/examples/_index.md index 38aa7964541..a6922f9c802 100644 --- a/content/rancher/v2.6/en/backups/examples/_index.md +++ b/content/rancher/v2.6/en/backups/examples/_index.md @@ -272,7 +272,7 @@ data: # Example EncryptionConfiguration -The snippet below demonstrates two different types of secrets and their relevance with respect to Backup and Restore of custom resources.s +The snippet below demonstrates two different types of secrets and their relevance with respect to Backup and Restore of custom resources. The first example is that of a secret that is used to encrypt the backup files. The backup operator, in this case, will not be able to read the secrets encryption file. It only uses the contents of the secret. From da01e1d2324a6730f11a549523bc5db47a375a38 Mon Sep 17 00:00:00 2001 From: Charlie <64078329+zacharlie@users.noreply.github.com> Date: Tue, 12 Apr 2022 13:51:18 +0200 Subject: [PATCH 392/478] Fix powershell newline character Remove backslashes from powershell command --- .../deployment/quickstart-manual-setup/_index.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md index cd8a9fe0e07..4eb6b2c200e 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md @@ -104,9 +104,9 @@ helm install cert-manager jetstack/cert-manager \ --version v1.5.1 # Windows Powershell -helm install cert-manager jetstack/cert-manager \` - --namespace cert-manager \` - --create-namespace \` +helm install cert-manager jetstack/cert-manager ` + --namespace cert-manager ` + --create-namespace ` --version v1.5.1 ``` From c273c5b47df4cf57b757a722964be894c558fe8f Mon Sep 17 00:00:00 2001 From: Jamie Phillips Date: Mon, 11 Apr 2022 16:34:36 -0400 Subject: [PATCH 393/478] Creating docs for creating VMware vSphere VM templates. --- .gitignore | 2 + .../rke-clusters/node-pools/vsphere/_index.md | 3 +- .../vsphere/creating-a-vm-template/_index.md | 141 ++++++++++++++++++ 3 files changed, 145 insertions(+), 1 deletion(-) create mode 100644 content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/creating-a-vm-template/_index.md diff --git a/.gitignore b/.gitignore index daefacf85e2..e50d424efcf 100644 --- a/.gitignore +++ b/.gitignore @@ -11,3 +11,5 @@ package-lock.json /scripts/converters/results_to_markdown/.terraform /scripts/converters/results_to_markdown/terraform.tfstate* /scripts/converters/results_to_markdown/*.tfvars + +.idea/ diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/_index.md index 13c897c89b3..e11d83949fb 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/_index.md @@ -36,6 +36,7 @@ For the fields to be populated, your setup needs to fulfill the [prerequisites.] ### More Supported Operating Systems You can provision VMs with any operating system that supports `cloud-init`. Only YAML format is supported for the [cloud config.](https://cloudinit.readthedocs.io/en/latest/topics/examples.html) + ### Video Walkthrough of v2.3.3 Node Template Features In this YouTube video, we demonstrate how to set up a node template with the new features designed to help you bring cloud operations to on-premises clusters. @@ -54,4 +55,4 @@ For an example of how to provision storage in vSphere using Rancher, refer to [t When a cloud provider is set up in Rancher, the Rancher server can automatically provision new infrastructure for the cluster, including new nodes or persistent storage devices. -For details, refer to the section on [enabling the vSphere cloud provider.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/cloud-providers/vsphere) \ No newline at end of file +For details, refer to the section on [enabling the vSphere cloud provider.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/cloud-providers/vsphere) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/creating-a-vm-template/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/creating-a-vm-template/_index.md new file mode 100644 index 00000000000..ef49277a333 --- /dev/null +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/creating-a-vm-template/_index.md @@ -0,0 +1,141 @@ +--- +title: Creating a vSphere Virtual Machine Template +weight: 2 +--- + +Creating virtual machines in a repeatable and reliable fashion can often be difficult. VMware vSphere offers the ability to build one VM that can then be converted to a template. The template can then be used to create identically configured VMs. Rancher leverages this capability within node pools to create identical RKE1 and RKE2 nodes. With that said, Rancher does have some specific requirements for the VM to have pre-installed to leverage the template to create new VMs. After configuring the VM with the requirements, the VM will need to be prepared before creating the template. Once preparation is complete, the VM can be converted to a template and moved into a content library, ready for Rancher node pool usage. + +- [Requirements](#requirements) +- [Template Creation](#template-creation) +- [Preparation](#preparation) +- [Converting to a Template](#converting-to-a-template) +- [Moving to a content library](#moving-to-a-content-library) +- [Other Resources](#other-resources) + +# Requirements + +There are specific tooling required for both Linux and Windows VMs to be usable by the vSphere node driver. The most critical dependency is [cloud-init](https://cloud-init.io/) for Linux and [cloudbase-init](https://cloudbase.it/cloudbase-init/) for Windows. Both of these are used for provisioning the VMs by configuring the hostname, settings up the SSH access, and default Rancher user. Users can add additional content to these as desired if additional configuration is desired. Outside of that some additional requirements will be listed below. If you have any specific firewall rules or configuration, this should be added to the VM before creating a template. + +## Linux Dependencies + +Here is the list of packages that need installed on the template. These will have slightly varied names based on distribution with some distributions shipping these by default. + +* curl +* wget +* git +* net-tools +* unzip +* apparmor-parser +* ca-certificates +* cloud-init +* cloud-guest-utils +* cloud-image-utils +* growpart +* cloud-initramfs-growroot +* open-iscsi +* openssh-server +* [open-vm-tools](https://docs.vmware.com/en/VMware-Tools/11.3.0/com.vmware.vsphere.vmwaretools.doc/GUID-8B6EA5B7-453B-48AA-92E5-DB7F061341D1.html) + +## Windows Dependencies + +Here is the list of packages that need installed on the template. + +* Windows Container Feature +* [cloudbase-init](https://cloudbase.it/cloudbase-init/#download) +* [Docker EE](https://docs.microsoft.com/en-us/virtualization/windowscontainers/quick-start/set-up-environment?tabs=Windows-Server#install-docker) - RKE1 Only + +**Now here is where the configuration for Windows templates need to differ between RKE1 and RKE2. RKE1 leverages Docker, so any templates for RKE1 will need to have Docker EE preinstalled too. RKE2 doesn't require Docker EE and doesn't require that it be installed.** + +# Template Creation + +There a few different approaches that can be pursued at this step. You can manually create your VM by following [these instructions](https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-AE8AFBF1-75D1-4172-988C-378C35C9FAF2.html) from VMware. Once you have a VM running, you can manually install the dependency listed above to configure the VM correctly for the vSphere node driver. After the required dependencies are configured, you can further customize based on your specific environment and requirements. Finally, you are ready to precede with the final preparation before creating your template. + +## Alternatives to manual creation + +Alternatives to manual creation do exist and below is a list of tools that can assist. + +* [VMware PowerCLI](https://developer.vmware.com/powercli) +* [Packer](https://www.packer.io/) +* [SaltStack](https://saltproject.io/) +* [Ansible](https://www.ansible.com/) + +Packer is often used and here is a good [reference](https://github.com/vmware-samples/packer-examples-for-vsphere) for usage with vSphere. + +# Preparation + +Once you have a VM created with all the dependencies listed above and any additional items that are required, the most critical step is next. That step is preparing the VM to be turned into a template. This basically resets the VM hostname, IPs, etc. to prevent that information from being brought into a new VM. When VMs are created from a template without this step, those VMs could have the same hostname, IP address, etc. The steps differ between Linux and Windows. + +## Linux Preparation + +Here is how to achieve the different items that need reset. + +```Bash +# Cleaning logs. +if [ -f /var/log/audit/audit.log ]; then + cat /dev/null > /var/log/audit/audit.log +fi +if [ -f /var/log/wtmp ]; then + cat /dev/null > /var/log/wtmp +fi +if [ -f /var/log/lastlog ]; then + cat /dev/null > /var/log/lastlog +fi + +# Cleaning udev rules. +if [ -f /etc/udev/rules.d/70-persistent-net.rules ]; then + rm /etc/udev/rules.d/70-persistent-net.rules +fi + +# Cleaning the /tmp directories +rm -rf /tmp/* +rm -rf /var/tmp/* + +# Cleaning the SSH host keys +rm -f /etc/ssh/ssh_host_* + +# Cleaning the machine-id +truncate -s 0 /etc/machine-id +rm /var/lib/dbus/machine-id +ln -s /etc/machine-id /var/lib/dbus/machine-id + +# Cleaning the shell history +unset HISTFILE +history -cw +echo > ~/.bash_history +rm -fr /root/.bash_history + +# Truncating hostname, hosts, resolv.conf and setting hostname to localhost +truncate -s 0 /etc/{hostname,hosts,resolv.conf} +hostnamectl set-hostname localhost + +# Clean cloud-init +cloud-init clean -s -l +``` + +## Windows Preparation + +Windows has a utility called [sysprep](https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/sysprep--generalize--a-windows-installation) that is used to generalize an image and reset the same items listed above for Linux. The command would look like this. + +```PowerShell +sysprep.exe /generalize /shutdown /oobe +``` + +# Converting to a Template + +To convert a VM to a template the first step is to shut down and stop the VM. Once it has been stopped, right-click on the VM in the inventory list and select Template. Then click on `Convert to Template`. Once that process has finished, there is now a template that can be used. + +* [VMware guide](https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-5B3737CC-28DB-4334-BD18-6E12011CDC9F.html) + +# Moving to a content library + +Rancher has the ability to consume templates provided by a content library. Content libraries store and manage content within vSphere. Content libraries offer the ability to publish and share that content. + +* [Create a content library](https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-2A0F1C13-7336-45CE-B211-610D39A6E1F4.html) +* [Clone the template to the content library](https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-AC1545F0-F8BA-4CD2-96EB-21B3DFAA1DC1.html) + +# Other Resources + +Here is a list of additional resources that may be useful. + +* [Tutorial for creating a Linux template](https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/manage/hybrid/server/best-practices/vmware-ubuntu-template) +* [Tutorial for creating a Windows template](https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/manage/hybrid/server/best-practices/vmware-windows-template) From 391d7aee66693048b854992b50e12e52c2ba71ad Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Fri, 15 Apr 2022 10:03:35 +0200 Subject: [PATCH 394/478] Add new security advisories Signed-off-by: Guilherme Macedo --- content/rancher/v2.6/en/security/cve/_index.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/content/rancher/v2.6/en/security/cve/_index.md b/content/rancher/v2.6/en/security/cve/_index.md index 628473bb891..b353c508096 100644 --- a/content/rancher/v2.6/en/security/cve/_index.md +++ b/content/rancher/v2.6/en/security/cve/_index.md @@ -7,6 +7,10 @@ Rancher is committed to informing the community of security issues in our produc | ID | Description | Date | Resolution | |----|-------------|------|------------| +| [CVE-2021-36784](https://github.com/rancher/rancher/security/advisories/GHSA-jwvr-vv7p-gpwq) | A vulnerability was discovered in Rancher versions from 2.5.0 up to and including 2.5.12 and from 2.6.0 up to and including 2.6.3 which allows users who have create or update permissions on [Global Roles](https://rancher.com/docs/rancher/v2.6/en/admin-settings/rbac/) to escalate their permissions, or those of another user, to admin-level permissions. Global Roles grant users Rancher-wide permissions, such as the ability to create clusters. In the identified versions of Rancher, when users are given permission to edit or create Global Roles, they are not restricted to only granting permissions which they already posses. This vulnerability affects customers who utilize non-admin users that are able to create or edit Global Roles. The most common use case for this scenario is the `restricted-admin` role. | 14 Apr 2022 | [Rancher v2.6.4](https://github.com/rancher/rancher/releases/tag/v2.6.4) and [Rancher v2.5.13](https://github.com/rancher/rancher/releases/tag/v2.5.13) | +| [CVE-2021-4200](https://github.com/rancher/rancher/security/advisories/GHSA-hx8w-ghh8-r4xf) | This vulnerability only affects customers using the `restricted-admin` role in Rancher. A vulnerability was discovered in Rancher versions from 2.5.0 up to and including 2.5.12 and from 2.6.0 up to and including 2.6.3 where the `global-data` role in `cattle-global-data` namespace grants write access to the Catalogs. Since each user with any level of catalog access was bound to the `global-data` role, this grants write access to templates (`CatalogTemplates`) and template versions (`CatalogTemplateVersions`) for any user with any level of catalog access. New users created in Rancher are by default assigned to the `user` role (standard user), which is not designed to grant write catalog access. This vulnerability effectively elevates the privilege of any user to write access for the catalog template and catalog template version resources. | 14 Apr 2022 | [Rancher v2.6.4](https://github.com/rancher/rancher/releases/tag/v2.6.4) and [Rancher v2.5.13](https://github.com/rancher/rancher/releases/tag/v2.5.13) | +| [GHSA-wm2r-rp98-8pmh](https://github.com/rancher/rancher/security/advisories/GHSA-wm2r-rp98-8pmh) | This vulnerability only affects customers using [Fleet](https://rancher.com/docs/rancher/v2.6/en/deploy-across-clusters/fleet/) for continuous delivery with authenticated Git and/or Helm repositories. An issue was discovered in `go-getter` library in versions prior to [`v1.5.11`](https://github.com/hashicorp/go-getter/releases/tag/v1.5.11) that exposes SSH private keys in base64 format due to a failure in redacting such information from error messages. The vulnerable version of this library is used in Rancher through Fleet in versions of Fleet prior to [`v0.3.9`](https://github.com/rancher/fleet/releases/tag/v0.3.9). This issue affects Rancher versions 2.5.0 up to and including 2.5.12 and from 2.6.0 up to and including 2.6.3. The issue was found and reported by Dagan Henderson from Raft Engineering. | 14 Apr 2022 | [Rancher v2.6.4](https://github.com/rancher/rancher/releases/tag/v2.6.4) and [Rancher v2.5.13](https://github.com/rancher/rancher/releases/tag/v2.5.13) | +| [CVE-2021-36778](https://github.com/rancher/rancher/security/advisories/GHSA-4fc7-hc63-7fjg) | A vulnerability was discovered in Rancher versions from 2.5.0 up to and including 2.5.11 and from 2.6.0 up to and including 2.6.2, where an insufficient check of the same-origin policy when downloading Helm charts from a configured private repository can lead to exposure of the repository credentials to a third-party provider. This issue only happens when the user configures access credentials to a private repository in Rancher inside `Apps & Marketplace > Repositories`. The issue was found and reported by Martin Andreas Ullrich. | 14 Apr 2022 | [Rancher v2.6.3](https://github.com/rancher/rancher/releases/tag/v2.6.3) and [Rancher v2.5.12](https://github.com/rancher/rancher/releases/tag/v2.5.12) | | [GHSA-hwm2-4ph6-w6m5](https://github.com/rancher/rancher/security/advisories/GHSA-hwm2-4ph6-w6m5) | A vulnerability was discovered in versions of Rancher starting 2.0 up to and including 2.6.3. The `restricted` pod security policy (PSP) provided in Rancher deviated from the upstream `restricted` policy provided in Kubernetes on account of which Rancher's PSP had `runAsUser` set to `runAsAny`, while upstream had `runAsUser` set to `MustRunAsNonRoot`. This allowed containers to run as any user, including a privileged user (`root`), even when Rancher's `restricted` policy was enforced on a project or at the cluster level. | 31 Mar 2022 | [Rancher v2.6.4](https://github.com/rancher/rancher/releases/tag/v2.6.4) | | [CVE-2021-36775](https://github.com/rancher/rancher/security/advisories/GHSA-28g7-896h-695v) | A vulnerability was discovered in Rancher versions up to and including 2.4.17, 2.5.11 and 2.6.2. After removing a `Project Role` associated with a group from the project, the bindings that granted access to cluster-scoped resources for those subjects were not deleted. This was due to an incomplete authorization logic check. A user who was a member of the affected group with authenticated access to Rancher could exploit this vulnerability to access resources they shouldn't have had access to. The exposure level would depend on the original permission level granted to the affected project role. This vulnerability only affected customers using group based authentication in Rancher. | 31 Mar 2022 | [Rancher v2.6.3](https://github.com/rancher/rancher/releases/tag/v2.6.3), [Rancher v2.5.12](https://github.com/rancher/rancher/releases/tag/v2.5.12) and [Rancher v2.4.18](https://github.com/rancher/rancher/releases/tag/v2.4.18) | | [CVE-2021-36776](https://github.com/rancher/rancher/security/advisories/GHSA-gvh9-xgrq-r8hw) | A vulnerability was discovered in Rancher versions starting 2.5.0 up to and including 2.5.9, that allowed an authenticated user to impersonate any user on a cluster through an API proxy, without requiring knowledge of the impersonated user's credentials. This was due to the API proxy not dropping the impersonation header before sending the request to the Kubernetes API. A malicious user with authenticated access to Rancher could use this to impersonate another user with administrator access in Rancher, thereby gaining administrator level access to the cluster. | 31 Mar 2022 | [Rancher v2.6.0](https://github.com/rancher/rancher/releases/tag/v2.6.0) and [Rancher v2.5.10](https://github.com/rancher/rancher/releases/tag/v2.5.10) | From b74e02735100c27c8a1fcad52cce8333e2df4a45 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 18 Apr 2022 14:15:03 -0400 Subject: [PATCH 395/478] Updated 2.6 docs for broken link also --- .../rke-clusters/cloud-providers/_index.md | 2 +- .../rke-clusters/cloud-providers/_index.md | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/cloud-providers/_index.md b/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/cloud-providers/_index.md index 6b12db8c31a..2679bbe634b 100644 --- a/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/cloud-providers/_index.md +++ b/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/cloud-providers/_index.md @@ -41,7 +41,7 @@ For details on enabling the vSphere cloud provider, refer to [this page.](./vsph The `Custom` cloud provider is available if you want to configure any Kubernetes cloud provider. -For the custom cloud provider option, you can refer to the [RKE docs]({{}}/rke/latest/en/config-options/cloud-providers/) on how to edit the yaml file for your specific cloud provider. There are specific cloud providers that have more detailed configuration : +For the custom cloud provider option, you can refer to the [RKE docs]({{}}/rke/latest/en/config-options/cloud-providers/) on how to edit the yaml file for your specific cloud provider. There are specific cloud providers that have more detailed configuration: * [vSphere]({{}}/rke/latest/en/config-options/cloud-providers/vsphere/) * [OpenStack]({{}}/rke/latest/en/config-options/cloud-providers/openstack/) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/cloud-providers/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/cloud-providers/_index.md index 0d82a9a6e0b..bcb6f1d2089 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/cloud-providers/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/cloud-providers/_index.md @@ -2,7 +2,7 @@ title: Setting up Cloud Providers weight: 2300 --- -A _cloud provider_ is a module in Kubernetes that provides an interface for managing nodes, load balancers, and networking routes. For more information, refer to the [official Kubernetes documentation on cloud providers.](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/) +A _cloud provider_ is a module in Kubernetes that provides an interface for managing nodes, load balancers, and networking routes. When a cloud provider is set up in Rancher, the Rancher server can automatically provision new nodes, load balancers or persistent storage devices when launching Kubernetes definitions, if the cloud provider you're using supports such automation. @@ -35,9 +35,9 @@ For details on enabling the vSphere cloud provider, refer to [this page.](./vsph ### Setting up a Custom Cloud Provider -The `Custom` cloud provider is available if you want to configure any [Kubernetes cloud provider](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/). +The `Custom` cloud provider is available if you want to configure any Kubernetes cloud provider. -For the custom cloud provider option, you can refer to the [RKE docs]({{}}/rke/latest/en/config-options/cloud-providers/) on how to edit the yaml file for your specific cloud provider. There are specific cloud providers that have more detailed configuration : +For the custom cloud provider option, you can refer to the [RKE docs]({{}}/rke/latest/en/config-options/cloud-providers/) on how to edit the yaml file for your specific cloud provider. There are specific cloud providers that have more detailed configuration: * [vSphere]({{}}/rke/latest/en/config-options/cloud-providers/vsphere/) * [OpenStack]({{}}/rke/latest/en/config-options/cloud-providers/openstack/) From efaa378baeff825ab9b77d15546069361c8fe050 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 18 Apr 2022 15:06:21 -0400 Subject: [PATCH 396/478] Added update to two other links in 2.6 --- .../rancher/v2.6/en/cluster-admin/volumes-and-storage/_index.md | 2 +- content/rancher/v2.6/en/longhorn/_index.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-admin/volumes-and-storage/_index.md b/content/rancher/v2.6/en/cluster-admin/volumes-and-storage/_index.md index 9467dfa660f..745fbce0131 100644 --- a/content/rancher/v2.6/en/cluster-admin/volumes-and-storage/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/volumes-and-storage/_index.md @@ -44,7 +44,7 @@ For details and prerequisites, refer to [this page.](./provisioning-new-storage) Longhorn is free, open source software. Originally developed by Rancher Labs, it is now being developed as a sandbox project of the Cloud Native Computing Foundation. It can be installed on any Kubernetes cluster with Helm, with kubectl, or with the Rancher UI. -If you have a pool of block storage, Longhorn can help you provide persistent storage to your Kubernetes cluster without relying on cloud providers. For more information about Longhorn features, refer to the [documentation.](https://longhorn.io/docs/1.0.2/what-is-longhorn/) +If you have a pool of block storage, Longhorn can help you provide persistent storage to your Kubernetes cluster without relying on cloud providers. For more information about Longhorn features, refer to the [documentation.](https://longhorn.io/docs/latest/what-is-longhorn/) Rancher v2.5 simplified the process of installing Longhorn on a Rancher-managed cluster. For more information, see [this page.]({{}}/rancher/v2.6/en/longhorn) diff --git a/content/rancher/v2.6/en/longhorn/_index.md b/content/rancher/v2.6/en/longhorn/_index.md index d394cab5d02..fc3d2e2ac91 100644 --- a/content/rancher/v2.6/en/longhorn/_index.md +++ b/content/rancher/v2.6/en/longhorn/_index.md @@ -6,7 +6,7 @@ weight: 19 [Longhorn](https://longhorn.io/) is a lightweight, reliable and easy-to-use distributed block storage system for Kubernetes. -Longhorn is free, open source software. Originally developed by Rancher Labs, it is now being developed as a sandbox project of the Cloud Native Computing Foundation. It can be installed on any Kubernetes cluster with Helm, with kubectl, or with the Rancher UI. You can learn more about its architecture [here.](https://longhorn.io/docs/1.0.2/concepts/) +Longhorn is free, open source software. Originally developed by Rancher Labs, it is now being developed as a sandbox project of the Cloud Native Computing Foundation. It can be installed on any Kubernetes cluster with Helm, with kubectl, or with the Rancher UI. You can learn more about its architecture [here.](https://longhorn.io/docs/latest/concepts/) With Longhorn, you can: From 78f3f2d8943ad7782028094170f266bff52ca912 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 18 Apr 2022 15:18:58 -0400 Subject: [PATCH 397/478] Added word for phrasing clarity --- .../latest/en/installation/installation-requirements/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/k3s/latest/en/installation/installation-requirements/_index.md b/content/k3s/latest/en/installation/installation-requirements/_index.md index 276e684d7c4..f4fd336d7f7 100644 --- a/content/k3s/latest/en/installation/installation-requirements/_index.md +++ b/content/k3s/latest/en/installation/installation-requirements/_index.md @@ -44,7 +44,7 @@ K3s performance depends on the performance of the database. To ensure optimal sp The K3s server needs port 6443 to be accessible by all nodes. -The nodes need to be able to reach other nodes over UDP port 8472 when Flannel VXLAN is used or UDP ports 51820 and 51821 (when using IPv6) when Flannel Wireguard backend is used. The node should not listen on any other port. K3s uses reverse tunneling such that the nodes make outbound connections to the server and all kubelet traffic runs through that tunnel. However, if you do not use Flannel and provide your own custom CNI, then the ports needed by Flannel are not needed by K3s. +The nodes need to be able to reach other nodes over UDP port 8472 when Flannel VXLAN is used or over UDP ports 51820 and 51821 (when using IPv6) when Flannel Wireguard backend is used. The node should not listen on any other port. K3s uses reverse tunneling such that the nodes make outbound connections to the server and all kubelet traffic runs through that tunnel. However, if you do not use Flannel and provide your own custom CNI, then the ports needed by Flannel are not needed by K3s. If you wish to utilize the metrics server, you will need to open port 10250 on each node. From 0ab0391f560340fa926b9a7a025eaa06303e38af Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Tue, 19 Apr 2022 10:46:55 +0530 Subject: [PATCH 398/478] Update content/rancher/v2.6/en/backups/examples/_index.md Co-authored-by: Jen Travinski --- content/rancher/v2.6/en/backups/examples/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/backups/examples/_index.md b/content/rancher/v2.6/en/backups/examples/_index.md index a6922f9c802..4670c938ef1 100644 --- a/content/rancher/v2.6/en/backups/examples/_index.md +++ b/content/rancher/v2.6/en/backups/examples/_index.md @@ -276,7 +276,7 @@ The snippet below demonstrates two different types of secrets and their relevanc The first example is that of a secret that is used to encrypt the backup files. The backup operator, in this case, will not be able to read the secrets encryption file. It only uses the contents of the secret. -The second example is that of a Kubernetes secrets encryption config file that is used to encrypt secrets when stored in etcd. It is important to note that while backing up your etcd config ensure you also backup your EncryptionConfiguration. Failing to do so might result in you not being able to use the restored data. +The second example is that of a Kubernetes secrets encryption config file that is used to encrypt secrets when stored in etcd. **While backing up your etcd config, be sure to also backup your EncryptionConfiguration.** Failing to do so might result in you not being able to use the restored data. ```yaml From 5ae9543692a697bfb93f85424efc36460216b6a6 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 19 Apr 2022 09:53:09 -0400 Subject: [PATCH 399/478] Corrected apiVersion --- .../rke/latest/en/config-options/secrets-encryption/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rke/latest/en/config-options/secrets-encryption/_index.md b/content/rke/latest/en/config-options/secrets-encryption/_index.md index ff8bab209a6..60476cb2040 100644 --- a/content/rke/latest/en/config-options/secrets-encryption/_index.md +++ b/content/rke/latest/en/config-options/secrets-encryption/_index.md @@ -139,7 +139,7 @@ kube-api: secrets_encryption_config: enabled: true custom_config: - api_version: apiserver.config.k8s.io/v1 + apiVersion: apiserver.config.k8s.io/v1 kind: EncryptionConfiguration resources: - Providers: From 81675ce55d65dc8c95050f3ece29509d6af07d97 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 19 Apr 2022 11:07:25 -0400 Subject: [PATCH 400/478] Corrected version back to newest 1.7.1 --- .../deployment/quickstart-manual-setup/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md index 0eae2e48d32..b24baf5a47e 100644 --- a/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md @@ -107,7 +107,7 @@ helm install cert-manager jetstack/cert-manager \ helm install cert-manager jetstack/cert-manager ` --namespace cert-manager ` --create-namespace ` - --version v1.5.1 + --version v1.7.1 ``` The final command to install Rancher is below. The command requires a domain name that forwards traffic to the Linux machine. For the sake of simplicity in this tutorial, you can use a fake domain name to create your proof-of-concept. An example of a fake domain name would be `.sslip.io`. From fcf453ac30bf02f0e143ebbfa9554518cd75280e Mon Sep 17 00:00:00 2001 From: Michal Rostecki Date: Thu, 7 Apr 2022 11:53:17 +0200 Subject: [PATCH 401/478] k3s: Update information about dual-stack Starting from k3s-io/k3s#5387, dual-stack and IPv6-only don't require disabling network policy controller anymore - they can be used regardless of IP family. Signed-off-by: Michal Rostecki --- .../en/installation/install-options/how-to-flags/_index.md | 1 - .../k3s/latest/en/installation/network-options/_index.md | 6 +++--- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/content/k3s/latest/en/installation/install-options/how-to-flags/_index.md b/content/k3s/latest/en/installation/install-options/how-to-flags/_index.md index d7392feba23..447dfdc40f9 100644 --- a/content/k3s/latest/en/installation/install-options/how-to-flags/_index.md +++ b/content/k3s/latest/en/installation/install-options/how-to-flags/_index.md @@ -46,5 +46,4 @@ token: "secret" node-ip: 10.0.10.22,2a05:d012:c6f:4655:d73c:c825:a184:1b75 cluster-cidr: 10.42.0.0/16,2001:cafe:42:0::/56 service-cidr: 10.43.0.0/16,2001:cafe:42:1::/112 -disable-network-policy: true ``` diff --git a/content/k3s/latest/en/installation/network-options/_index.md b/content/k3s/latest/en/installation/network-options/_index.md index 0889039827e..15f1cbf7a84 100644 --- a/content/k3s/latest/en/installation/network-options/_index.md +++ b/content/k3s/latest/en/installation/network-options/_index.md @@ -76,10 +76,10 @@ Dual-stack networking must be configured when the cluster is first created. It c Dual-stack is supported on k3s v1.21 or above. -To enable dual-stack in k3s, you must provide valid dual-stack `cluster-cidr` and `service-cidr`, and set `disable-network-policy` on all server nodes. Both servers and agents must provide valid dual-stack `node-ip` settings. Node address auto-detection and network policy enforcement are not supported on dual-stack clusters when using the default flannel CNI. Besides, only vxlan backend is supported at the moment. This is an example of a valid configuration: +To enable dual-stack in K3s, you must provide valid dual-stack `cluster-cidr` and `service-cidr` on all server nodes. Both servers and agents must provide valid dual-stack `node-ip` settings. Node address auto-detection is not supported on dual-stack clusters, because kubelet fetches only the first IP address that it finds. Additionally, only vxlan backend is supported currently. This is an example of a valid configuration: ``` -k3s server --node-ip 10.0.10.7,2a05:d012:c6f:4611:5c2:5602:eed2:898c --cluster-cidr 10.42.0.0/16,2001:cafe:42:0::/56 --service-cidr 10.43.0.0/16,2001:cafe:42:1::/112 --disable-network-policy +k3s server --node-ip 10.0.10.7,2a05:d012:c6f:4611:5c2:5602:eed2:898c --cluster-cidr 10.42.0.0/16,2001:cafe:42:0::/56 --service-cidr 10.43.0.0/16,2001:cafe:42:1::/112 ``` Note that you can choose whatever `cluster-cidr` and `service-cidr` value, however the `node-ip` values must correspond to the ip addresses of your main interface. Remember to allow ipv6 traffic if you are deploying in a public cloud. @@ -91,7 +91,7 @@ If you are using a custom cni plugin, i.e. a cni plugin different from flannel, IPv6 only setup is supported on k3s v1.22 or above. As in dual-stack operation, IPv6 node addresses cannot be auto-detected; all nodes must have an explicitly configured IPv6 `node-ip`. This is an example of a valid configuration: ``` -k3s server --node-ip 2a05:d012:c6f:4611:5c2:5602:eed2:898c --cluster-cidr 2001:cafe:42:0::/56 --service-cidr 2001:cafe:42:1::/112 --disable-network-policy +k3s server --node-ip 2a05:d012:c6f:4611:5c2:5602:eed2:898c --cluster-cidr 2001:cafe:42:0::/56 --service-cidr 2001:cafe:42:1::/112 ``` Note that you can specify only one IPv6 `cluster-cidr` value. From f416a6a749c1fe6b0f333ba2b9efb3300d37957d Mon Sep 17 00:00:00 2001 From: Derek Nola Date: Tue, 19 Apr 2022 12:38:02 -0700 Subject: [PATCH 402/478] [K3s] Update incorrect template example link We split the templates into linux and windows versions, making the old link incorrect. --- content/k3s/latest/en/advanced/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/k3s/latest/en/advanced/_index.md b/content/k3s/latest/en/advanced/_index.md index 907ecf6cead..dc432f82602 100644 --- a/content/k3s/latest/en/advanced/_index.md +++ b/content/k3s/latest/en/advanced/_index.md @@ -143,7 +143,7 @@ K3s will generate config.toml for containerd in `/var/lib/rancher/k3s/agent/etc/ For advanced customization for this file you can create another file called `config.toml.tmpl` in the same directory and it will be used instead. -The `config.toml.tmpl` will be treated as a Go template file, and the `config.Node` structure is being passed to the template. [This template](https://github.com/rancher/k3s/blob/master/pkg/agent/templates/templates.go#L16-L32) example on how to use the structure to customize the configuration file. +The `config.toml.tmpl` will be treated as a Go template file, and the `config.Node` structure is being passed to the template. See [this folder](https://github.com/k3s-io/k3s/blob/master/pkg/agent/templates) for linux and windows examples on how to use the structure to customize the configuration file. # Running K3s with Rootless mode (Experimental) From a6158c5dd6d1f64c890a8c9884f14915d77f2dd8 Mon Sep 17 00:00:00 2001 From: Derek Nola Date: Tue, 19 Apr 2022 13:39:24 -0700 Subject: [PATCH 403/478] Update content/k3s/latest/en/advanced/_index.md Co-authored-by: Jen Travinski --- content/k3s/latest/en/advanced/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/k3s/latest/en/advanced/_index.md b/content/k3s/latest/en/advanced/_index.md index dc432f82602..554a0e5469a 100644 --- a/content/k3s/latest/en/advanced/_index.md +++ b/content/k3s/latest/en/advanced/_index.md @@ -143,7 +143,7 @@ K3s will generate config.toml for containerd in `/var/lib/rancher/k3s/agent/etc/ For advanced customization for this file you can create another file called `config.toml.tmpl` in the same directory and it will be used instead. -The `config.toml.tmpl` will be treated as a Go template file, and the `config.Node` structure is being passed to the template. See [this folder](https://github.com/k3s-io/k3s/blob/master/pkg/agent/templates) for linux and windows examples on how to use the structure to customize the configuration file. +The `config.toml.tmpl` will be treated as a Go template file, and the `config.Node` structure is being passed to the template. See [this folder](https://github.com/k3s-io/k3s/blob/master/pkg/agent/templates) for Linux and Windows examples on how to use the structure to customize the configuration file. # Running K3s with Rootless mode (Experimental) From acc6a52d2ca8869c6395046a7dd60c56017817f0 Mon Sep 17 00:00:00 2001 From: Manuel Buil Date: Tue, 19 Apr 2022 16:48:31 +0200 Subject: [PATCH 404/478] Add ipv6-masq flag in docs Signed-off-by: Manuel Buil --- content/k3s/latest/en/installation/network-options/_index.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/k3s/latest/en/installation/network-options/_index.md b/content/k3s/latest/en/installation/network-options/_index.md index 0889039827e..b5eb304166d 100644 --- a/content/k3s/latest/en/installation/network-options/_index.md +++ b/content/k3s/latest/en/installation/network-options/_index.md @@ -19,6 +19,7 @@ If you wish to use WireGuard as your flannel backend it may require additional k `--flannel-backend=ipsec` | Uses the IPSEC backend which encrypts network traffic. | `--flannel-backend=host-gw` | Uses the host-gw backend. | `--flannel-backend=wireguard` | Uses the WireGuard backend which encrypts network traffic. May require additional kernel modules and configuration. | + `--flannel-ipv6-masq` | Apply masquerading rules to IPv6 traffic (default for IPv4). Only applies on dual-stack or IPv6-only clusters | ### Custom CNI From 04b4117eac0c1e00341c4915c8bf82f352877957 Mon Sep 17 00:00:00 2001 From: Mars Tian Date: Fri, 22 Apr 2022 17:09:02 +0800 Subject: [PATCH 405/478] break the links by RKE version Co-authored-by: Jen Travinski --- content/rke/latest/en/config-options/_index.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/rke/latest/en/config-options/_index.md b/content/rke/latest/en/config-options/_index.md index eea8bff7467..f742c9346d1 100644 --- a/content/rke/latest/en/config-options/_index.md +++ b/content/rke/latest/en/config-options/_index.md @@ -50,7 +50,9 @@ cluster_name: mycluster ### Supported Docker Versions -By default, RKE will check the installed Docker version on all hosts and fail with an error if the version is not supported by Kubernetes. The list of [supported Docker versions](https://github.com/rancher/kontainer-driver-metadata/blob/master/rke/k8s_docker_info.go#L3-L15) are set specifically for each Kubernetes version. To override this behavior, set this option to `true`. +By default, RKE will check the installed Docker version on all hosts and fail with an error if the version is not supported by Kubernetes. The list of supported Docker versions are set specifically for each Kubernetes version in kontainer-driver-metadata depending on the RKE version used (to override this behavior, set this option to `true`). Refer to the following: +- For RKE v1.3.x, see this [link](https://github.com/rancher/kontainer-driver-metadata/blob/release-v2.6/rke/k8s_docker_info.go for RKE v1.3.x) +- For RKE v1.2.x, see this [link](https://github.com/rancher/kontainer-driver-metadata/blob/release-v2.5/rke/k8s_docker_info.go) The default value is `false`. From 24060cd7e468da0529dd1f1abcb73470dc8fb88f Mon Sep 17 00:00:00 2001 From: Bastian Hofmann Date: Thu, 21 Apr 2022 13:35:34 +0200 Subject: [PATCH 406/478] [K3s] Document registry mirror rewrite configuration and clean up mirror config section Fixes https://github.com/rancher/docs/issues/4007 Signed-off-by: Bastian Hofmann --- .../installation/private-registry/_index.md | 43 ++++++++++++++----- 1 file changed, 32 insertions(+), 11 deletions(-) diff --git a/content/k3s/latest/en/installation/private-registry/_index.md b/content/k3s/latest/en/installation/private-registry/_index.md index c87ee3df0cb..1abbc473cd1 100644 --- a/content/k3s/latest/en/installation/private-registry/_index.md +++ b/content/k3s/latest/en/installation/private-registry/_index.md @@ -32,22 +32,43 @@ mirrors: Each mirror must have a name and set of endpoints. When pulling an image from a registry, containerd will try these endpoint URLs one by one, and use the first working one. +#### Rewrites + +Each mirror can have a set of rewrites. Rewrites can change the tag of an image based on a regular expression. This is useful if the organization/project structure in the mirror registry is different to the upstream one. + +For example, the following configuration would transparently pull the image `docker.io/rancher/coredns-coredns:1.6.3` from `registry.example.com:5000/mirrorproject/rancher-images/coredns-coredns:1.6.3`: + +``` +mirrors: + docker.io: + endpoint: + - "https://registry.example.com:5000" + rewrite: + "^rancher/(.*)": "mirrorproject/rancher-images/$1" +``` + +The image will still be stored under the original name so that a `crictl image ls` will show `docker.io/rancher/coredns-coredns:1.6.3` as available on the node, even though the image was pulled from the mirrored registry with a different name. + ### Configs -The configs section defines the TLS and credential configuration for each mirror. For each mirror you can define `auth` and/or `tls`. The TLS part consists of: +The `configs` section defines the TLS and credential configuration for each mirror. For each mirror you can define `auth` and/or `tls`. -Directive | Description -----------|------------ -`cert_file` | The client certificate path that will be used to authenticate with the registry -`key_file` | The client key path that will be used to authenticate with the registry -`ca_file` | Defines the CA certificate path to be used to verify the registry's server cert file -`insecure_skip_verify` | Boolean that defines if TLS verification should be skipped for the registry +The `tls` part consists of: -The credentials consist of either username/password or authentication token: +| Directive | Description | +|------------------------|--------------------------------------------------------------------------------------| +| `cert_file` | The client certificate path that will be used to authenticate with the registry | +| `key_file` | The client key path that will be used to authenticate with the registry | +| `ca_file` | Defines the CA certificate path to be used to verify the registry's server cert file | +| `insecure_skip_verify` | Boolean that defines if TLS verification should be skipped for the registry | -- username: user name of the private registry basic auth -- password: user password of the private registry basic auth -- auth: authentication token of the private registry basic auth +The `auth` part consists of either username/password or authentication token: + +| Directive | Description | +|------------|---------------------------------------------------------| +| `username` | user name of the private registry basic auth | +| `password` | user password of the private registry basic auth | +| `auth` | authentication token of the private registry basic auth | Below are basic examples of using private registries in different modes: From f8ac666f73fdce9e3f05ce4167dadc8c0400feeb Mon Sep 17 00:00:00 2001 From: Jamie Phillips Date: Fri, 22 Apr 2022 08:45:02 -0400 Subject: [PATCH 407/478] Implementing requested changes. --- .../vsphere/creating-a-vm-template/_index.md | 24 ++++++++++++------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/creating-a-vm-template/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/creating-a-vm-template/_index.md index ef49277a333..00fdaea7956 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/creating-a-vm-template/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/creating-a-vm-template/_index.md @@ -1,9 +1,11 @@ --- title: Creating a vSphere Virtual Machine Template -weight: 2 +weight: 4 --- -Creating virtual machines in a repeatable and reliable fashion can often be difficult. VMware vSphere offers the ability to build one VM that can then be converted to a template. The template can then be used to create identically configured VMs. Rancher leverages this capability within node pools to create identical RKE1 and RKE2 nodes. With that said, Rancher does have some specific requirements for the VM to have pre-installed to leverage the template to create new VMs. After configuring the VM with the requirements, the VM will need to be prepared before creating the template. Once preparation is complete, the VM can be converted to a template and moved into a content library, ready for Rancher node pool usage. +Creating virtual machines in a repeatable and reliable fashion can often be difficult. VMware vSphere offers the ability to build one VM that can then be converted to a template. The template can then be used to create identically configured VMs. Rancher leverages this capability within node pools to create identical RKE1 and RKE2 nodes. + +In order to leverage the template to create new VMs, Rancher has some [specific requirements](#requirements) that the VM must have pre-installed. After you configure the VM with these requirements, you will next need to [prepare the VM](#preparing-your-vm) before [creating the template](#creating-a-template). Finally, once preparation is complete, the VM can be [converted to a template](#converting-to-a-template) and [moved into a content library](#moving-to-a-content-library), ready for Rancher node pool usage. - [Requirements](#requirements) - [Template Creation](#template-creation) @@ -14,11 +16,13 @@ Creating virtual machines in a repeatable and reliable fashion can often be diff # Requirements -There are specific tooling required for both Linux and Windows VMs to be usable by the vSphere node driver. The most critical dependency is [cloud-init](https://cloud-init.io/) for Linux and [cloudbase-init](https://cloudbase.it/cloudbase-init/) for Windows. Both of these are used for provisioning the VMs by configuring the hostname, settings up the SSH access, and default Rancher user. Users can add additional content to these as desired if additional configuration is desired. Outside of that some additional requirements will be listed below. If you have any specific firewall rules or configuration, this should be added to the VM before creating a template. +There is specific tooling required for both Linux and Windows VMs to be usable by the vSphere node driver. The most critical dependency is [cloud-init](https://cloud-init.io/) for Linux and [cloudbase-init](https://cloudbase.it/cloudbase-init/) for Windows. Both of these are used for provisioning the VMs by configuring the hostname and by setting up the SSH access and the default Rancher user. Users can add additional content to these as desired if other configuration is needed. In addition, other requirements are listed below for reference. + +**Note:** If you have any specific firewall rules or configuration, you will need to add this to the VM before creating a template. ## Linux Dependencies -Here is the list of packages that need installed on the template. These will have slightly varied names based on distribution with some distributions shipping these by default. +The packages that need to be installed on the template are listed below. These will have slightly different names based on distribution; some distributions ship these by default, for example. * curl * wget @@ -38,7 +42,7 @@ Here is the list of packages that need installed on the template. These will hav ## Windows Dependencies -Here is the list of packages that need installed on the template. +The list of packages that need to be installed on the template is as follows: * Windows Container Feature * [cloudbase-init](https://cloudbase.it/cloudbase-init/#download) @@ -124,18 +128,20 @@ sysprep.exe /generalize /shutdown /oobe To convert a VM to a template the first step is to shut down and stop the VM. Once it has been stopped, right-click on the VM in the inventory list and select Template. Then click on `Convert to Template`. Once that process has finished, there is now a template that can be used. -* [VMware guide](https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-5B3737CC-28DB-4334-BD18-6E12011CDC9F.html) +For additional information on converting a VM to a template, see the [VMware guide](https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-5B3737CC-28DB-4334-BD18-6E12011CDC9F.html). -# Moving to a content library +# Moving to a Content library -Rancher has the ability to consume templates provided by a content library. Content libraries store and manage content within vSphere. Content libraries offer the ability to publish and share that content. +Rancher has the ability to use templates provided by a content library. Content libraries store and manage content within vSphere, and they also offer the ability to publish and share that content. + +Below are some helpful links on content libraries: * [Create a content library](https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-2A0F1C13-7336-45CE-B211-610D39A6E1F4.html) * [Clone the template to the content library](https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-AC1545F0-F8BA-4CD2-96EB-21B3DFAA1DC1.html) # Other Resources -Here is a list of additional resources that may be useful. +Here is a list of additional resources that may be useful: * [Tutorial for creating a Linux template](https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/manage/hybrid/server/best-practices/vmware-ubuntu-template) * [Tutorial for creating a Windows template](https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/manage/hybrid/server/best-practices/vmware-windows-template) From a7f468576d3d15aa950c77f240f5619431783d8f Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 22 Apr 2022 09:43:27 -0400 Subject: [PATCH 408/478] Corrected to lowercase --- .../rke/latest/en/config-options/secrets-encryption/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rke/latest/en/config-options/secrets-encryption/_index.md b/content/rke/latest/en/config-options/secrets-encryption/_index.md index 60476cb2040..f2539991d7f 100644 --- a/content/rke/latest/en/config-options/secrets-encryption/_index.md +++ b/content/rke/latest/en/config-options/secrets-encryption/_index.md @@ -147,7 +147,7 @@ kube-api: Keys: - Name: key1 Secret: - Resources: + resources: - secrets - identity: {} ``` From 6ed682c4d610dc1abb602a18b0cd118007b104ba Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 22 Apr 2022 10:21:55 -0400 Subject: [PATCH 409/478] Updated for spacing, punctuation --- content/rke/latest/en/config-options/_index.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/content/rke/latest/en/config-options/_index.md b/content/rke/latest/en/config-options/_index.md index f742c9346d1..3fe0a5ab2eb 100644 --- a/content/rke/latest/en/config-options/_index.md +++ b/content/rke/latest/en/config-options/_index.md @@ -50,9 +50,10 @@ cluster_name: mycluster ### Supported Docker Versions -By default, RKE will check the installed Docker version on all hosts and fail with an error if the version is not supported by Kubernetes. The list of supported Docker versions are set specifically for each Kubernetes version in kontainer-driver-metadata depending on the RKE version used (to override this behavior, set this option to `true`). Refer to the following: -- For RKE v1.3.x, see this [link](https://github.com/rancher/kontainer-driver-metadata/blob/release-v2.6/rke/k8s_docker_info.go for RKE v1.3.x) -- For RKE v1.2.x, see this [link](https://github.com/rancher/kontainer-driver-metadata/blob/release-v2.5/rke/k8s_docker_info.go) +By default, RKE will check the installed Docker version on all hosts and fail with an error if the version is not supported by Kubernetes. The list of supported Docker versions is set specifically for each Kubernetes version in kontainer-driver-metadata depending on the RKE version used, as shown below. To override this behavior, set this option to `true`. Refer to the following: + +- For RKE v1.3.x, see this [link](https://github.com/rancher/kontainer-driver-metadata/blob/release-v2.6/rke/k8s_docker_info.go). +- For RKE v1.2.x, see this [link](https://github.com/rancher/kontainer-driver-metadata/blob/release-v2.5/rke/k8s_docker_info.go). The default value is `false`. From 7be775ec6e3b6823dcbe729b8dce6f7cfb9de850 Mon Sep 17 00:00:00 2001 From: Brandon Kurtz Date: Sun, 24 Apr 2022 14:07:19 -0700 Subject: [PATCH 410/478] minor wording fix --- content/k3s/latest/en/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/k3s/latest/en/_index.md b/content/k3s/latest/en/_index.md index a02147dc599..4d71be76b38 100644 --- a/content/k3s/latest/en/_index.md +++ b/content/k3s/latest/en/_index.md @@ -26,7 +26,7 @@ K3s is a fully compliant Kubernetes distribution with the following enhancements * Secure by default with reasonable defaults for lightweight environments. * Simple but powerful "batteries-included" features have been added, such as: a local storage provider, a service load balancer, a Helm controller, and the Traefik ingress controller. * Operation of all Kubernetes control plane components is encapsulated in a single binary and process. This allows K3s to automate and manage complex cluster operations like distributing certificates. -* External dependencies have been minimized (just a modern kernel and cgroup mounts needed). K3s packages required dependencies, including: +* External dependencies have been minimized (just a modern kernel and cgroup mounts needed). K3s packages the required dependencies, including: * containerd * Flannel * CoreDNS @@ -38,4 +38,4 @@ K3s is a fully compliant Kubernetes distribution with the following enhancements # What's with the name? -We wanted an installation of Kubernetes that was half the size in terms of memory footprint. Kubernetes is a 10-letter word stylized as K8s. So something half as big as Kubernetes would be a 5-letter word stylized as K3s. There is no long form of K3s and no official pronunciation. \ No newline at end of file +We wanted an installation of Kubernetes that was half the size in terms of memory footprint. Kubernetes is a 10-letter word stylized as K8s. So something half as big as Kubernetes would be a 5-letter word stylized as K3s. There is no long form of K3s and no official pronunciation. From 46c149930d71d0cd279516b828e02959f1912b95 Mon Sep 17 00:00:00 2001 From: Jamie Phillips Date: Mon, 25 Apr 2022 10:36:55 -0400 Subject: [PATCH 411/478] Updating vSphere permissions to add tagging and custom attributes. This came up from this issue: https://github.com/rancher/rancher/issues/37440. It seems we have some capabilities in the UI that require these additional permissions. Our UI doesn't indicate they aren't configured, it just greys out the fields. --- .../node-pools/vsphere/creating-credentials/_index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/creating-credentials/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/creating-credentials/_index.md index 6f83c84c66c..55ac548274e 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/creating-credentials/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/creating-credentials/_index.md @@ -10,9 +10,11 @@ The following table lists the permissions required for the vSphere user account: | Privilege Group | Operations | |:----------------------|:-----------------------------------------------------------------------| | Datastore | AllocateSpace
      Browse
      FileManagement (Low level file operations)
      UpdateVirtualMachineFiles
      UpdateVirtualMachineMetadata | +| Global | Set custom attribute | | Network | Assign | | Resource | AssignVMToPool | | Virtual Machine | Config (All)
      GuestOperations (All)
      Interact (All)
      Inventory (All)
      Provisioning (All) | +| vSphere Tagging | Assign or Unassign vSphere Tag
      Assign or Unassign vSphere Tag on Object | The following steps create a role with the required privileges and then assign it to a new user in the vSphere console: From 1f25844a8a17ddeeba3b68330b5a5c199566fbcb Mon Sep 17 00:00:00 2001 From: Manuel Buil Date: Fri, 22 Apr 2022 14:21:04 +0200 Subject: [PATCH 412/478] Update ipv6-only docs Signed-off-by: Manuel Buil --- .../k3s/latest/en/installation/network-options/_index.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/content/k3s/latest/en/installation/network-options/_index.md b/content/k3s/latest/en/installation/network-options/_index.md index c667a7cef73..652f22f6adc 100644 --- a/content/k3s/latest/en/installation/network-options/_index.md +++ b/content/k3s/latest/en/installation/network-options/_index.md @@ -89,10 +89,8 @@ If you are using a custom cni plugin, i.e. a cni plugin different from flannel, ### IPv6 only installation -IPv6 only setup is supported on k3s v1.22 or above. As in dual-stack operation, IPv6 node addresses cannot be auto-detected; all nodes must have an explicitly configured IPv6 `node-ip`. This is an example of a valid configuration: +IPv6 only setup is supported on k3s v1.22 or above. Note that network policy enforcement is not supported on IPv6-only clusters when using the default flannel CNI. This is an example of a valid configuration: ``` -k3s server --node-ip 2a05:d012:c6f:4611:5c2:5602:eed2:898c --cluster-cidr 2001:cafe:42:0::/56 --service-cidr 2001:cafe:42:1::/112 +k3s server --disable-network-policy ``` - -Note that you can specify only one IPv6 `cluster-cidr` value. From d04785ee3067f41b8176c1737186b53ed75b66a0 Mon Sep 17 00:00:00 2001 From: Jamie Phillips Date: Tue, 26 Apr 2022 14:10:23 -0400 Subject: [PATCH 413/478] Additional changes. --- .../vsphere/creating-a-vm-template/_index.md | 39 ++++++++++++------- 1 file changed, 26 insertions(+), 13 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/creating-a-vm-template/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/creating-a-vm-template/_index.md index 00fdaea7956..d3da38f1d2d 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/creating-a-vm-template/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/creating-a-vm-template/_index.md @@ -8,8 +8,8 @@ Creating virtual machines in a repeatable and reliable fashion can often be diff In order to leverage the template to create new VMs, Rancher has some [specific requirements](#requirements) that the VM must have pre-installed. After you configure the VM with these requirements, you will next need to [prepare the VM](#preparing-your-vm) before [creating the template](#creating-a-template). Finally, once preparation is complete, the VM can be [converted to a template](#converting-to-a-template) and [moved into a content library](#moving-to-a-content-library), ready for Rancher node pool usage. - [Requirements](#requirements) -- [Template Creation](#template-creation) -- [Preparation](#preparation) +- [Creating a Template](#creating-a-template) +- [Preparing Your VM](#preparing-your-vm) - [Converting to a Template](#converting-to-a-template) - [Moving to a content library](#moving-to-a-content-library) - [Other Resources](#other-resources) @@ -48,30 +48,39 @@ The list of packages that need to be installed on the template is as follows: * [cloudbase-init](https://cloudbase.it/cloudbase-init/#download) * [Docker EE](https://docs.microsoft.com/en-us/virtualization/windowscontainers/quick-start/set-up-environment?tabs=Windows-Server#install-docker) - RKE1 Only -**Now here is where the configuration for Windows templates need to differ between RKE1 and RKE2. RKE1 leverages Docker, so any templates for RKE1 will need to have Docker EE preinstalled too. RKE2 doesn't require Docker EE and doesn't require that it be installed.** +**Important to note: The configuration for Windows templates varies between RKE1 and RKE2:** +- RKE1 leverages Docker, so any RKE1 templates need to have Docker EE pre-installed as well +- RKE2 does not require Docker EE, and thus it does not need to be installed -# Template Creation +# Creating a Template -There a few different approaches that can be pursued at this step. You can manually create your VM by following [these instructions](https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-AE8AFBF1-75D1-4172-988C-378C35C9FAF2.html) from VMware. Once you have a VM running, you can manually install the dependency listed above to configure the VM correctly for the vSphere node driver. After the required dependencies are configured, you can further customize based on your specific environment and requirements. Finally, you are ready to precede with the final preparation before creating your template. +You may either manually create your VM or you can utilize [other alternatives](#alternatives-to-manual-creation) to create your VM. -## Alternatives to manual creation +## Manual Creation +1. Manually create your VM by following [these instructions](https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-AE8AFBF1-75D1-4172-988C-378C35C9FAF2.html) from VMware. Once you have a VM running, you can manually install the dependency listed above to configure the VM correctly for the vSphere node driver. +2. Customize as needed based on your specific environment and requirements. +3. Proceed with the final preparation before creating your template. -Alternatives to manual creation do exist and below is a list of tools that can assist. +## Alternatives to Manual Creation + +Other alternative options to create VMs are listed below: * [VMware PowerCLI](https://developer.vmware.com/powercli) * [Packer](https://www.packer.io/) * [SaltStack](https://saltproject.io/) * [Ansible](https://www.ansible.com/) -Packer is often used and here is a good [reference](https://github.com/vmware-samples/packer-examples-for-vsphere) for usage with vSphere. +Packer is a frequently-used alternative. Refer to this [reference](https://github.com/vmware-samples/packer-examples-for-vsphere) for examples of its usage with vSphere. -# Preparation +# Preparing Your VM -Once you have a VM created with all the dependencies listed above and any additional items that are required, the most critical step is next. That step is preparing the VM to be turned into a template. This basically resets the VM hostname, IPs, etc. to prevent that information from being brought into a new VM. When VMs are created from a template without this step, those VMs could have the same hostname, IP address, etc. The steps differ between Linux and Windows. +After creating a VM with all the required dependencies (and any additional required items), you must perform the most critical step next: preparing the VM to be turned into a template. This preparation will reset critical data such as the VM hostname, IPs, etc., to prevent that information from being brought into a new VM. If you fail to perform this step, you could create a VM with the same hostname, IP address, etc. + +Note that these preparatory steps differ between Linux and Windows. ## Linux Preparation -Here is how to achieve the different items that need reset. +The commands below will reset your VM in Linux: ```Bash # Cleaning logs. @@ -118,7 +127,7 @@ cloud-init clean -s -l ## Windows Preparation -Windows has a utility called [sysprep](https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/sysprep--generalize--a-windows-installation) that is used to generalize an image and reset the same items listed above for Linux. The command would look like this. +Windows has a utility called [sysprep](https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/sysprep--generalize--a-windows-installation) that is used to generalize an image and reset the same items listed above for Linux. The command is as follows: ```PowerShell sysprep.exe /generalize /shutdown /oobe @@ -126,7 +135,11 @@ sysprep.exe /generalize /shutdown /oobe # Converting to a Template -To convert a VM to a template the first step is to shut down and stop the VM. Once it has been stopped, right-click on the VM in the inventory list and select Template. Then click on `Convert to Template`. Once that process has finished, there is now a template that can be used. +1. Shut down and stop the VM. +2. Right-click on the VM in the inventory list and select **Template**. +3. Click on **Convert to Template**. + +**Result:** Once the process has completed, a template will be available for use. For additional information on converting a VM to a template, see the [VMware guide](https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-5B3737CC-28DB-4334-BD18-6E12011CDC9F.html). From e7013de736c330cd3d004e6a152f55c9d8dfeb11 Mon Sep 17 00:00:00 2001 From: Jamie Phillips Date: Tue, 26 Apr 2022 16:24:24 -0400 Subject: [PATCH 414/478] Correcting one last typo. --- .../node-pools/vsphere/creating-a-vm-template/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/creating-a-vm-template/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/creating-a-vm-template/_index.md index d3da38f1d2d..1ed401c2ebd 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/creating-a-vm-template/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/creating-a-vm-template/_index.md @@ -57,7 +57,7 @@ The list of packages that need to be installed on the template is as follows: You may either manually create your VM or you can utilize [other alternatives](#alternatives-to-manual-creation) to create your VM. ## Manual Creation -1. Manually create your VM by following [these instructions](https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-AE8AFBF1-75D1-4172-988C-378C35C9FAF2.html) from VMware. Once you have a VM running, you can manually install the dependency listed above to configure the VM correctly for the vSphere node driver. +1. Manually create your VM by following [these instructions](https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-AE8AFBF1-75D1-4172-988C-378C35C9FAF2.html) from VMware. Once you have a VM running, you can manually install the dependencies listed above to configure the VM correctly for the vSphere node driver. 2. Customize as needed based on your specific environment and requirements. 3. Proceed with the final preparation before creating your template. From 8140d00ade262b21481a152796487bb535957dc3 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 27 Apr 2022 10:38:00 -0400 Subject: [PATCH 415/478] Added NeuVector page, linked to Security page --- .../v2.6/en/neuvector-integration/_index.md | 79 ++++++++++++++++++ content/rancher/v2.6/en/security/_index.md | 7 ++ static/img/rancher/neuvector-architecture.png | Bin 0 -> 121627 bytes .../rancher/neuvector-security-containers.png | Bin 0 -> 71277 bytes 4 files changed, 86 insertions(+) create mode 100644 content/rancher/v2.6/en/neuvector-integration/_index.md create mode 100644 static/img/rancher/neuvector-architecture.png create mode 100644 static/img/rancher/neuvector-security-containers.png diff --git a/content/rancher/v2.6/en/neuvector-integration/_index.md b/content/rancher/v2.6/en/neuvector-integration/_index.md new file mode 100644 index 00000000000..9ae34e2eac2 --- /dev/null +++ b/content/rancher/v2.6/en/neuvector-integration/_index.md @@ -0,0 +1,79 @@ +--- +title: NeuVector Integration +weight: 22 +--- + +##### _Tech Preview_ + +New in Rancher v2.6.5, [NeuVector 5.x](https://open-docs.neuvector.com/) is an open-source container-centric security platform that is now integrated into Rancher. NeuVector offers real-time compliance, visibility, and protection for critical applications and data during runtime. NeuVector provides a firewall, container process/file system monitoring, security auditing with CIS benchmarks, and vulnerability scanning. For more information on Rancher security, please see the [hardening guides and benchmark versions]({{}}/rancher/v2.6/en/security/). + +NeuVector can be enabled through a Helm chart that may be installed either through **Apps & Marketplace** or through the **Cluster Tools** button in the Rancher UI. Once the Helm chart is installed, users can easily [deploy and manage NeuVector clusters within Rancher](https://open-docs.neuvector.com/deploying/rancher#deploy-and-manage-neuvector-through-rancher-apps-marketplace). + +### Installing NeuVector with Rancher + +The Harvester Helm Chart is used to manage access to the NeuVector UI in Rancher where users can navigate directly to deploy and manage their NeuVector clusters. + +**To navigate to and install the NeuVector chart through Apps & Marketplace:** + +1. Click **☰ > Cluster Management**. +1. On the Clusters page, go to the cluster where you want to deploy NeuVector, and click **Explore**. +1. Go to **Apps & Marketplace > Repositories**, then click **Create**. +1. In the Target section, select **Git repository containing Helm chart or cluster template definitions**. Then enter the index URL of https://github.com/selvamt94/charts.git and the branch **neuvector**. Click **Create**. +1. Go to **Apps & Marketplace > Charts**, and install **NeuVector** from the chart repo. When configuring Helm chart values, go to the **Container Runtime** section, de-select **Docker** and instead select **Containerd Runtime**. Finally, click **Install** again. + +**To navigate to and install the NeuVector chart through Cluster Tools:** + +1. Repeat steps 1 - 4 above. +1. Click on **Cluster Tools** at the bottom of the left navigation bar. +1. Select the **NeuVector** chart and then click **Install**. When configuring Helm chart values, go to the **Container Runtime** section, de-select **Docker** and instead select **Containerd Runtime**. Finally, click **Install** again. + +### Accessing NeuVector from the Rancher UI + +1. Go to the cluster where NeuVector is installed. In the left navigation bar, click **NeuVector**. +1. Click the external link to go to the NeuVector UI. + +### Uninstalling NeuVector from the Rancher UI + +**To uninstall from Apps & Marketplace:** + +1. Click **☰ > Cluster Management**. +1. On the Clusters page, go to the cluster where NeuVector is deployed, and click **Explore**. +1. In the left navigation bar, click **NeuVector**. +1. Under **Apps & Marketplace**, click **Installed Apps**. +1. Under `cattle-neuvector-system`, select both the NeuVector app (and the associated CRD if desired), then click **Delete**. + +**To uninstall from Cluster Tools:** + +1. Repeat steps 1 - 3 above. +1. Click on **Cluster Tools** at the bottom-left of the screen, then click on the trash can icon under the NeuVector chart. Select `Delete the CRD associated with this app` if desired. + +### GitHub Repository + +The NeuVector project is available [here](https://github.com/neuvector/neuvector). + +### Documentation + +The NeuVector documentation is [here](https://open-docs.neuvector.com/). + +### Architecture + +The NeuVector security solution contains four types of security containers: Controllers, Enforcers, Managers, and Scanners. A special container called an All-in-One is also provided to combine the Controller, Enforcer, and Manager functions all in one container, primarily for Docker-native deployments. There is also an Updater which, when run, will update the CVE database. + +- **Controller:** Manages the NeuVector Enforcer container; provides REST APIs for the management console. +- **Enforcer:** Enforces security policies. +- **Manager:** Provides a web-UI and CLI console to manage the NeuVector platform. +- **All-in-One:** Includes the Controller, Enforcer, and Manager. +- **Scanner:** Performs the vulnerability and compliance scanning for images, containers, and nodes. +- **Updater:** Updates the CVE database for Neuvector (when run); redeploys scanner pods. + +
      **NeuVector Security Containers:**
      +![NeuVector Security Containers]({{}}/img/rancher/neuvector-security-containers.png) + +
      **NeuVector Architecture:**
      +![NeuVector Architecture]({{}}/img/rancher/neuvector-architecture.png) + +To learn more about NeuVector's architecture, please refer [here](https://open-docs.neuvector.com/basics/overview#architecture). + +### Limitations + +* Currently, NeuVector feature chart installation fails when a NeuVector partner chart already exists. To work around this issue, uninstall the NeuVector partner chart and reinstall the NeuVector feature chart. \ No newline at end of file diff --git a/content/rancher/v2.6/en/security/_index.md b/content/rancher/v2.6/en/security/_index.md index 0cd5e3dcaf4..8b782b613c5 100644 --- a/content/rancher/v2.6/en/security/_index.md +++ b/content/rancher/v2.6/en/security/_index.md @@ -24,6 +24,7 @@ Security is at the heart of all Rancher features. From integrating with all the On this page, we provide security related documentation along with resources to help you secure your Rancher installation and your downstream Kubernetes clusters: +- [NeuVector Integration with Rancher](#neuvector-integration-with-rancher) - [Running a CIS security scan on a Kubernetes cluster](#running-a-cis-security-scan-on-a-kubernetes-cluster) - [SELinux RPM](#selinux-rpm) - [Guide to hardening Rancher installations](#rancher-hardening-guide) @@ -32,6 +33,12 @@ On this page, we provide security related documentation along with resources to - [Rancher Security Advisories and CVEs](#rancher-security-advisories-and-cves) - [Kubernetes Security Best Practices](#kubernetes-security-best-practices) +### NeuVector Integration with Rancher + +_New in v2.6.5_ + +NeuVector is an open-source, container-focused security application that is now integrated into Rancher. NeuVector provides production security, DevOps vulnerability protection, and a container firewall, et al. Please see the [Rancher docs]({{}}/rancher/v2.6/en/neuvector-integration) and the [NeuVector docs](https://open-docs.neuvector.com/) for more information. + ### Running a CIS Security Scan on a Kubernetes Cluster Rancher leverages [kube-bench](https://github.com/aquasecurity/kube-bench) to run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the [CIS](https://www.cisecurity.org/cis-benchmarks/) (Center for Internet Security) Kubernetes Benchmark. diff --git a/static/img/rancher/neuvector-architecture.png b/static/img/rancher/neuvector-architecture.png new file mode 100644 index 0000000000000000000000000000000000000000..d690a1af3b9d85e8ea998e8a08b8ae0bcc3b2b14 GIT binary patch literal 121627 zcmeFZhdH{7f8XDK@bft5aZbl|E}!f3d5!0Ki`3RsBPL)VKtn?#zKT%MMMJ}yKtsb+!NY+6 zf-}>Q1^+;I*Hu$Sd(q9b0)N1=RnkyGL#v7-Jhs4wKjXV1Zn~qPQFx&KMxU}_^+7{B zE4Zqnr0;Y4dnUF&)u)NT#%I3vCA~DI$Iq#fb#tWJu0`pU_3Gx-+zP?=#wWSwU0-w5 zHaWR2RBPh)M`nMXBCxiv~9R(Xd{nDp@e21^EUw^UKc>g+MVaE$*``2Fx??BbZ zfBqdW*n`v#`JZp?{r}(k|L+E>HtNDngoMwZ-`(DxbE|#&^y$ZsA1$kDs;c^?ryFZ( z=tM`y#|sMznlVC}bF}#`Uc6YzL`9X9l7dG#J3D*f!UfS(qW(-%lYI;&1B0hAF)=C} zvp)}lf`SeX4&uMGwQ0^*33>oNXRPhkEd4DXNQiCzDfI%o}OMw`a2^7 zLs~-W)dg=)&oHNW5(5f6tjdbaOlGDld{mFZ!juRW;^N}M4fukt6(|!dRJ?f6-PIM6 zw7tC@8j58Uc*x7k`_o5ubai0?%MU#@HPzbMx{`YJY6j11RZUG2ChTV?$Hy~*ISdI2 z3B5e=y1Kd;ycmSq+26lA8QD2FJdTZ}iB!=o8EkFEBnUs&#?x`q(IM}{(9RAH#%RZ+ z_xJao5oW@Oo$BpHyXEfgo|{#PCey;6gC)gmXVgv_33sqP@lP*F<1EwrBs4Ufeohrr z%D6lA?%;5(B80Q8t?j|#O40D}@O7S_lit&EZVPx;IAe?#9jHdx_9+AfZ@;4}TZvOR zO_B4HK;#q@ELK{yHhp1YV!|P!LmS5lkn!1^(JRty9-eItuP~~@K<@2t%`2SjP%eM1 zb{xs_`*Dd(q;mM|WaHsXop$O{_QTVS#xtDzw`$!MpPj#@`0LmD1a4dK59LW55+=Mf z+#lnO4e7UmblKZzN0jA}2mj-k{tP@5to9Lnm#H2D{5-$=Y|yx-Wx1d6E*kd^R7fSq0K5jzfm5{soatM;1_+3 zK$EU?!E#hRyTCCUd4HZcwPx;^HD3q7uyk zD+|XLzl#VbzoCJJhKFHUCw%Ak^ z0i}`M6K;)QSCwkU8FP|Al5xJRM5_;32^v?b(w6^@J(k1A5ynS}mifp4s*)@}P1`x| z)K&KbJ-SLJx|Gm`n$q#oYv>UaXj0Nlcr^M2N^-d*m1rv}2IzBE=%2J7uZkouRWB< z7|}K-X4_qM>#gR+WI^=s*2sv68o#}}1_sorNDo6q=rONWmdCw&C1qt?;&JW%2iuF6 z!%0$8Qj(rMqgcTRVmp7HSeLEw?OVwhRnC5;K)4wi8XCg4-z_h$Yg`|iVCm@S&?XMK zQBzyne1k9ki%k&{DeJ%QI^FPKsXLPp53l&e3!c~K`S~M1JDa<1Ovw?1JxNWydfn%F zerR~OR<=Cz#`qPukt7WKsExXeW9|VnBr7XxRgCdza&pLc4Bdsf7|AKLAuc^ux$VtO zIuY}xk1>p-Oj4VZHTSxbg>9>hI1<`>dtFB>Euv`78&_Gjy`2t_v1q}X>(+(2Wn}us zX$-ovIe*5*+4+1DB@NB5#bh&hBs);XOky^lyEA2~-}PawzOnhj(EiS6Yff_7pV9%l z3oYV;Q~C4fn3I`O_vVBfk6&7MJu`cFvRl8=kS=Dc>F+PAKeIaYT=@MCg_Ci$1GQ7y zg*zWVu|6b{p{U62yOM+M?CgwRr3Mdj9P>}_;8ZFRvwOI@j=uMM8yOk-C?S|Qm??NA zi2RbYbin>>cu7f#lLTYZ_J>GHVq#*;s?mvwdb7rW8#ivuXyyd_?ft+W2{R2232A2J zr+TcyK@W}J`SctkBV%sH=B8_Oo)i`q!bCHx_lhwJlWr}% z_4ck(d2~!nO#g+Q8rLbpe_H=agiS+B_tDe90Cfdl$-Ti21Kr8C;gC1LuVnctnm)g%2zQtu z60W4@OBbhvJsJ%G_Ef`zbd!fW5nYQU^rBW1Z=6>p=Yr8}t*xo4s1!R^RjvJ4eZ`om*eIAetl0H9}f%+>`3IbwXva~PfJVlS|9hEX$mSXE|!0A zXk}|lxzePiaDv4_aIvJKB0S`cB+lqKqSkj8-+4>86PZ5q9u$EUSY2xpPtNO_o(&8&mI{CnS1}Mfzchaxe#qLcgiMc&+8g zSzcDgB;}fupU+u4MIh2|c>6x~bt5w~Gc7Hb&Ln;)*Zx>$8LPVEUr7=Qf-uHZnEy^H zMVBW}p0u>Ih_i5Gi$_x>Z6|8U->kC44rva2|9ySE8Rz}`_mSl@KC&zod3keCd6+mv zuCA_lcz7w|_PVO7I0?BWCH8P3xTGvd-4b(TsRx<|)njhM@uKPkWsMmlQdW7ck@TQW zvTl6U!?`Ho?u<+BTXSs>kGDRhzOucntQ;XLO_123e-@4g7lzd6MZn`EQ<02Ea7o_% zI@<6+hK@6JFdF)%=GWRt&%i*Uk+Yp09ei)x~3Ewg{rbulTQ;Vj{t*Fo{bI7euXvsxgfkwJSNn@QVAC;=A zYViG*;o+WyRq3j#s-NG!3{2JrqY8`o@6#I`9)^AJhQ(_@q#wq0r3@w}W{b$HmoFcY zFcUoYkbVHAm6LRxM~^3QabdxKyMtFPj>TGpPCZ#@vg!_Q3K!Ln_4SjJz3Eo7b}@L) z-0IKB4wUZU64Av2?rT#f80B2xjV)GkkI=8$`Pfyq8lXY8Y zFUk(60|;{GQ|yQ>Q<75!s4#0t5cS^B4>;)`fXtWd5R{0 z=6A35YfX(5p9AcyBF#(!e0+9QGmCTWj7(u|mgK2^=<@RN0QYJ?p1XxAM&ds;X$za} zMR76OH0MYH3lUw-p?DjNNJRRdQQ6%)IQYR_Btq#5GMtkpDpDpJ^*^8g_aNnPu(Zsp zsECscUd38jS%E>WEw>W|EATb`-&F{Jd3t(!d_1jZDe)?Tlt);2f={%z(3x7x(Sffz=~8WW+^&>iz@>gv#b(cbGY%I$FfEF{cG z6}KN>YoSggB_y6)y%zDdbZ~GGFHBkVDt_Fjb9{X5ot>7Vsin=*sn>B*)vsOa9~f9$ zUDa>E3Tyg7gu^K#lip@o68C{(abU$GNKuie8Z*2#$U*ZF(yXU3T-;j2_zv+|u|re+nlPok+v9AC0WGsi_HO zcO!sks1B>ue6<{_J0GLzFIawnx(X*|^!oOhURz1KqP@M{exUHd!D8}sz|s0Gm-p2! z)AE*CTx5gL7)o=+I{6=CnU6MSFDn-)E*0yq9v}Qv*q^~vP*AWQTeq~ak#Ji;@Eu19 zH~6d+Bp>c=kajgaB4#u{r{6R(;yv3E_CeLo`FHx1~wS2nSTNwE{Pm8 zBp}idG|IZ$w{M>|0v&+~9aOFz1W?AmB@`bA2d6h$MJF@rV>k-4zsC9dm{YGmd-8;W zh2@3(&DiAR5nvNu-$!#Tkm}C_(djYAFlXO+tuyRf1q8@PwHeoYolm(9uvST_8SdnC zz!EblDd}dF!s-4z%#F^D4tqO0piAg{LORAaHs9c3JQFk}_*HxtSxHFs;({}2rlyvL z2KGr*WF$KOWaC2xK}=V{V%g>8z3GRIo@>L!#e8I4d3kw1mwGP0SsSSc5eiO#aZdXE zZE2~1urTQdiqH39-&PWFhdexeY2G~c$`+q%g|~LSFaPDsm$mLo!7he3ZcwPMe*30+SFd4?S~uWi*U;_#&p=Y_ zG;+-tlizp~J3rR9DM9-HmLn8f{xFmr|!C7q|Ki(aGZ4a$cTBKz` zE1yj&?W=6|uqhBdC%?J5*&JzaZ?A$=+2B0!1_o5snA2S0SV{^VF{g&6CJrXo-5O^N zN6vzQ6;}VvW}wL8cdfWrNeRni2FJ$eH9NbzV~w(;Jq1QNEs%f)xVFgvIJFM{ilz$u z0LuilifW1ev^0kH#=Dc!aQQP^KJZgkzeWFd+2V-2mzZ`L8%HSd7?vCF4&QRw-I!)w z5D^vCEeJM$aL(`r0G*l9sypsKx0_t}sR-!oZ``0s2x_xj2Rv}}Ydzqdvh;C zdAr!zu_dPUiRhBOx)Me608j`}o0;r~XD53(N+E2dRZqJXg9GKDkOc33h#-eM4$CHy zN26b)|H09(lET-{&d70lXQVj8dI+g}7i9akwOX1+ppFgt(>^HZ!7t3*Cw}lOFlH##N?+h85amQ|hHgMjw zj>?Por>6jvA8hcuPM6M$py)07pASN$qoc#Z!cxwvF({&|T^4Y1n3|qW`5eR+^DJLq zUy4X%Y3XAhbpo{KGxjpxKSG(+qM7JvY1NPeD?6}K05D|rEK%~GO(AA;a%?}vGV8I< zW4DGL0=ZPyXhNWn_|A?8NjN4)X@I+nlhbz)btow)%;~xA1Ev6~m3;WUMqhxMfcM7+ z+=-kLfR>C30seqAEs&t~RLaDC3em7C6bfuMZ&J&-mn`~^tIvs;(JALH(%{_P+2Oj; zECLtc2U-ijsNPF{etsf~2wZh0QLA>4GP*iDzkN=1UmHF@SEA|KxH3?5Sz<_|wmgPP zBC>7nm&bDeiR3+5az~&oVPj*H>k=FV3se|auL2#KNiEOj zdGn@ega6INOF2fM00M<8(#j54d};`51Fs7NJvRGSwmn%A&J67-$!{gwM@P&aGBYz1 z&%FiyPR^+s*rL?^C0&w~PJ~TFglzB!)a?An7)<`^>T1(^uk|O~>I4J?Gi314?gHT3F1&qTtcWDyyg1Xz_t?H(Bou z%%H}1cNH`ZC|YviV{r+IN1|t6D=o&h7gY|rySueD5ePgZ%bPb-Uvi{1HRODP23)A4 z*qj338*eeU{2@qjA|gGWpQ^KN`XPv_DmK)x5#TPmxw+}ad{Pcmx|VzV^qirPQ6<_j z{kY2FM{W1w)sGtKIi(+JC&tEx1_#M*t*x!Sy*pW2r%ywr@h6G>>d?g z20@yx>1o!p1GN95#f%89C!kjy|C(@t4{k-#9}*cAl`d{i!Dx0BY?eIgzgrxHH&avQ z7*$6(_VfLi(~8lad-f#3x81V_=X5yymyJLCNnVaWvN!1e>~h%WzmoX% zP^15%36l?*Ot~dpaRWCW^!^y!BeEq@BGH^FwDVM^OgFXPn3ep-L9E_h}kpn!H4YJhp ziU!}+9eX2eUReNs@$8qQqoV=gNjQ&-KRi7Koqp5<7GSUO{@S;1aPJ$NgCg=nZYw_! zXL)j6UEL4x-Vuym9Gs2!ds8qI%;{SO1}NQZtgX+RyvB3-*%C$wl*_dYP?2(5)16!l z!;0IeZC7DZYkBwXT|2uP6afptIoWI_t&_P#HhKiYnL$N3it>$P{RJx`iY_iLVq#)h zTyu1H%ra1(k^SmGk8Q532 zK3)+M6}9Qkuy=O;GV3aTu#ngqPI_+7Pv6-1u#MJCN?JPjwvCNV@YUg=A@X!_GCZt* zV>Bj5K$s(Y^Pk}BxhxGqsEU*j6JGQVJWC;des&3T;QIgsc~V4bUpOW`eF{&NxhNO( z;(u$GL^EyznVd6jwU$*Zf}|4MfhE2^QZWq{5Fq&o#z@bEmVPP8I;!H_;)=0 zk>_gNc_T6eu(3#)hWh%psz+}70Z9}b85|U$i*63Vb@^ITm6L;ZBQqnTVSkQrziWQW z+@K9+(XaJs($rd$A6asKH1OmKbU{ZGGHZ}^|8|{^faKnCZ|=SMk3laBi;A-4A22*F zFE7U~2%SGXIs(mt;$mM8U^5|*ytM~m0Isa95jp@EdH@U@pwQQP@3@|&J$cSBN|QHE z^y1jHu_%Ip{dYxxT?H;`>52o0WzhZssE!3Ku$5FH1Nu&|9@HWn*FhklJpg7qo^XRy zcgbhde2v!c6qN3qnh&CQOLd-WY-d1%&1pf3wmbz)TuRI+@fiRZK@i55&!5?JcoLg+ zZdBYReya1MJW`u4L&p0>NeO@L3#``zV2N@$gW?4pm@0LTgNZ~iO|z)=h7sCi7$ukJ z9!Ardr?)W==p42(~a~>YzPp@gHtKR{^#?RUS znr&!!n4+ta`r4yOi)3JdmHZ$SW9aGXTHd(>*Q#`p9a~h4j%bvbE3rKv-74^N`ScBf z>eAxkh^VM2*btGCK@6qW0`nE+{03wdd-2|1tpwashxd00D=v{RON+Zqy&KNYM39Cm z=K>YPExlC+FN&A=+ePeha&iI!1b`PPL8RK<+kywc<{bRT+QLl#0_&l7($M3yD86e^ zDlG=^2K!$qj403rND1Xg?oPrkmjS>J04%xI)PI|2b?9^@;o)GN*!%s&XP0{nEe*_T z{`~MiS~*8$%3;_9X`3f+{ZFtG`sk4~tc9c}YhSQ%ao4hCZ|dqQzc_bQQ*(G^1Z9bS z@Av&U(%IQL&#MW|AHViRB=s}Y1C(FlS{%!jD_5AMT+IO}Bnz49zCT~6QLHbZKkp(Z z7b7Am$t&7!C0b0K1SGfaz2Ba+lvME##n|X*{Y3?EeammXh4+onkS0j(s($&B;~!9L zQc;j5Tk4)A2xM$AR{i;EL^$&xU;%mepO29owDl^`<^wQd`r57!dbAPD8x&*o6BImy z{Vfa)Rx(i3!NsjxveTZx`QUITNHmh_^5s@=1FTmEOMp5bFXzXBLY23eWnpMI06gEm}e6=Sc(t z{QNEwI2gb=FuFKUDmx?vgu&r0Q^tqF^S*Zv-Ckc3qyr|AkB%cR%8jcZi|F=fM#G?m0J6B;B=+TaVm}dA{p&fbt&u&@*e{yEV+^D>wg7*eG**j(#uRt2j6cKbJ6%`eQfhq$ls{(kSO*w1` z7iVNVA4TM-)0@=PF<6<1TWL%wnBfq^IU~L z2+&2ELC>;IQRKjNRv8gm&iY`d4@_*om40r9m}iNJn4(vcIH?H2iReM(p|Laol`W}f zsVC(^NX<&}b=|4(>jk>G;}9v@bw}1|f<6vpVCyL=d-WH~Oe*pu-uLlINlOc!Bl3T+&6iw! ze0X0YufKc+7&}eGq6K&Wc!e)ty~-VhyQ*(!7=i;1Zvc2*IkB#Gz511EQqnq<#Kw&L z`cuu#7WO*%ZW4FD`am;*O3p0nQ@Kke1CfCe?M6r1&nS=D%zvv5 zoGq|P<>2ui{9FprQa+fHm%sJK3B8T`S3iITjNRQ`KtIzD_9j8s0F6k|1HusRELwr3 zULPF?cP$WyEBPPhlww&%@-n=*l(sm~3I`Wg!S1TDaa#W^Ye??^OltI6PfJWpbeJ;r z%*f27OnlP*)F$V1PEOALzK>;fNl8a*E7SyIvap%N#fx9Qdc+&|xTt?wIe&9G znDN&M38P>FJ#Xx%q)<8=WXFnA#L!CQe_6twnFw7 z0W`Uaii!f7XtTV4@|dKUG+kXQ51UXr+Ek z$5Bz-6jvb#Vq%hUohO6{7Dqh&GxmZPFEj;dAj<&qkm3O*3L*$c0-uZw0MWGKe!bSEpGxJk!urAx`8&mcq=)w9Q366&0&Vo-`}gl(${<__ z6==qYY7-C?q{73BC)T82Rn<=!t!ik<67ez$WVS$eqd3T|jd-P}K=ztc90Q_iRGQg* z3YRX?zf|g|r1lE6M$EcORdP}dK^9L&IUvv9C~!DXwpVl$T`2$)GX&J1RskmzZU0Y7 z3PEDWJ_?@3m&4sPrBF~6fDNI)#1eY#FeCu61Ch5^6L}fw>8r-R4_s5M5)>5V(agY0 z2gY@y%n1GT#qAN3NW=JKZrxU88hNrel{1iA!e)sQ_U#z`1kE7oNOa#0DSE2Yb z04mt(Si*Amx4A~ytU|_>ClxDU1cU?!=Uf9NaH%IdoY~aWv?t>dCN9QvS=Sk~V{ARs zS2o0mi%iSo)s8@gVrcVM84#hPP6eAGnqc65ZGC-+x6-4)K(tM1L?~4}A0O7^V2oU&`1g?g>Aln| z>uQQXKf=C(Wgm*|D!Wf;Oz1^`L3FEwK#p45Lh2f*gUjMfgr!(>xYT_7{6SB0$058` ziN=G!q?}=HXUC_{=pRQ{6N{ERi7PE_Aac~e= z2;a`-?z;lqAdBf=<3mXr4XIv@=KF1J?HmxsHFnsVp?l&(ye)|VmEkyDO3LYOUWkYea?>>yU z&I7qTCK6tD_E|IeN2t8_4#U4z71n)@50>}9kcevI7&&7f8ykZS6B!rBi!!Il{zzN# zyt##i-(YW;BNq-8ipt8qf30;tE5t&LmAya74a6s8K|u_w!W0<(CTHPTI5@!rPf)`N zub=2&%#V$kjf&tBQ>+Sy&ij;|Y*9cFut($n`I>REsJ7G7Q!s+X8Dg&cT4G@+-MmR( zEco;qSantc@OHuCfAoY13AjD4Uj5vf{{(&4f#k(e@tCah)T-h{-B;E>aS`pU8I_>??GH*Y4aX%QjHqN3C-EjjSk z^%NfbzF)q7?w37ndSp?Ob$oB*!}76-m9m zeUu;4YbU-f4qK;0UteFg%|nHWqzJNDkmP`1NLg95;97R8&8rTIgd6eBq01zjjo*uE zHkg%833u2yL7p*w%+{^|Y5?KFo*M2=$m!i@fXAnA^Esu;d*k-D`q2k%z9d-s=WoAD z5nQytzv`WRO3OBZ*T>wQtq?b$!HGzRH+l~e1ju$oW`pXGeeo+c)A!P$2Fd z(62*ySEthzN~Bw@thDqYaJ7X~tv1j(k9ODg!1+!L<0ub2!zQ8=33L)heiAdgYH!bf zaKMh2r`jXh51GS66O`oZ8mJncCVQ007Hp||Ta8lNOJ8_=G ztIxLer7m510AR}wX$)^0O?M#}^|tOOhn`UCztg9E2B>?!qATGviq@E$ecU0LtL^ja zYb|g{{Tnx)T#-F*hhz>`Ek%*D2pV{;iXp20k?L2~)z1kEay3>lqtA8Pyt*k!Q~R?K zGv@W>UW6why!&sbb6Ehz(mlvw3y~)zK(!s$$)f`f0_O2JB7!Yy-#aJ43y-1XE~>zd zQP9{F)vEDA98yyIM;ncMo11KnFN{ID_m^+X$!QuLtpRmYaBezCbsPkMI+RB9dq#Tv z7X9lYAdL=C3Q~pJYo$*i3z;c<|H;=^iHe--07oWKmiOK`4&d(tt#m9@!?1aY2O+)n%2HG%SxqE}xDcd~l-#>|cdYvD z+eY7A2gtnEy4!~QpZ8RnoYia^qGupyCz$nl0kC;hS(!631fM*?&kO9S|EoGEBV%Ky zsvT)z;5Fv0yDoJz?`M13*znZe8VUTLpE9n<@$hw{c6{fv&W_M5Jk%J=RK9cP4mdY8 z#U@ifE|N;%hbgnfeXVn8&d0a2){aCeM9&_Z(H*t9 z{;IfntlLcaK6zsdH3|_$+Ba@^f%OaF3zG250SdSJMn`>sIJDm|HP!er{PchBcKoMy zR=GThtGrx4vq)`25|nqM=9Z}m*V^RnR*hDYqna?mosAt{&9kn2P+SB7UviUk(Sg@=oPo$B~ebp!(D1jS5UmB$jBr zj4b6ptNKmQaUW-uem8adm_L2G@Dl#w6BfBefqwjU7P*%Nky(!FYLWXKu@h`RZjvVD zK^k~l*g`b5widjOlw;#JSSB8zEr8#_n|eea{EsSljqP^8S=qZo(I?0HE6?3Ck#wN& zRO4tKr&Tmm&*=QOs9tqH-p$%aqTCg#0ybj(6a%{V#dS!Z=>EQXZcsR<{eNm`Ym*&R zJE;mKhs45;2fhe!H=#Bg=EQ%OC~NDtjy(5JLzA2CyDOaDL$TUXv-J*!w_h}_ebGEe zj_}5Es9WK(PIk zbN}a^5+I9M=m^V8^wJ>g9*+4s*>Yv*&VKi}neY&!Pvxsl6^^SFySi2S-;xci>2B`F zM?|#Xl83RBP*Yru^NW9}*FN9z4Y`%&$er!{F^@P~Q!5ICN`Yeg( zj2YEG(gHB#vdI4oT5H|SdoBsHkg=CLgsOsY#28ML@kpv+g4vx9glOu+>H~<|%ifjppft=D7iB5uYDIqG_GN5!yj!t<$2xGI^2vSHPp-F}*2+cd z39%=S6!{tWw>>~f0UhOVf8S$XE>$3hL|A2r|Ckhvw#H|Uyw!xDmcDkfiQ&oi;r{BADQn~+#@Ki9tVb5g z@2I*@*~4sapSx?vvUNA9J#+0tqt)hw|L~4-Z6%`_E{s%JW}w5U1k4UAVDY+0NYumP zf@EF$_qHnW`X zV0ZTqpqD6X9ZXNmGZ{8_zHHA>&e9RAoIX3?XkhTUN^yiq(O5l)^9C7kVhe6u<#nep zk9Pd$p!cfSt4O1B@$m2{*E#gkX=0Vpv`g z7^QsYj|cwx*#A9Lrks!_L0^S}k0z=QSxMwpYKncMzv^{Swm){@dN}2qcR_cTuD0Im zQ0K6YF*?wyq5Epdbs=F}S5X1R2!x^Pg-q^&Nei=!p)b|^2(X1;d(!^6rNi`d+>5s_ z#{S8hgGVV9^R)rQlVV-us1gTV`xs&T#wj%`YwETAfNBiG?!fWEOaTn`FxGk~?R)O- zA+l^Xg@uLlyw~XvMFJqEkSS(MLWNNPX+Oq65~{(L7E8$8 zgDcB?$!#GRn^6B(aSIr1rRW7gB+UXw1<#*9fAvbNU8GET7V=Zf3IVcAtEZ%>HI+QtSa@;#C4=`*BB-5 z%6hIQ9X4L{5dQBK=35S<-7OKVdq3oLLb=Bl{+;FSG>1oA`PX01xxN2b$QyU>$g!fn zs$JTX(lU}u>eX?I`Z0R_^2r;k47WTQ{r>Xe13%{yKd1IlXALZ!3}CGcWc1S2p3(4%RQ~E_YIP4n%(K=-;L>y!OrS z5rAE-a0uMO!Ag{&q{jLH>&M=>V};z=@z0!Ovj@A>$J`#|+gw~+{&0K(>Ng9{WdhO4 zhSQRj)gY~cR6%yhC=;||h@gRlPFjEYZCP%hAgdV?g!IF<+tL+K>Rix%Jj%`Vt@Hi+1j=N~-`RFrPVwWBq zz77gfY797OvPpdM1P)eM(05}q;C2tTwS^VyZUnYj;@^@FV<*FNb9V=`M?Yp71W_+M zk2~VJ%)j|YuVc*XB%U$XsNC7`Gd|VzlJlkHMahq!nUxKU?!;NPup3`>_HN);;iE|Z z_%yCDd1pOlzjss)N1AzNrV@@blO;JkJD`B zcZH6bfW&15537Q2^!r$2jNr|eSpBG^07SrhD^aK3qRF?LD)<~79sT@{P-1sfJElCo zU$dv**P45k!XeEy{s*E9ywM(eKPJsRP{%cTI(m9=b^MRkQO6;l8nERKtjs)zY@blg zn!50NthV6Gw`<)BUcRIt!3qzgk`h`VA|#xsy7LK~bETU~w2;qHyx7&%Riu%QbH6)N zp+dCZ;Q0-uQ^?oSi`ghzgU4o0-JjbCR%#$0!QdezRKK*h*TCV|WxnIWmrV-W6+oD_;y#VEDd<-ofZ-w@oFWO&K;eI7a@dh zmj6&h!3Z)lv$&&G{OF_TR_2kc;as@Y^{fHnqFpQu^@X=#c-dswzkgh36(+iDCh`c@eje;MNJT= zFqL=%?Rpqn?>Acr+1wtxrKc%UK{)n&3j(YHk}<{29I_cWD|80FtZ}*)cpxAwCnWTN zOb=ra*Y(Z}_&sp$2NFTS6iqfAWnaj=>Oc&YA{!N4xO9IT*@*y;9{>J~?KFfN(4Rw+ z$-Ju)&e*B3OFV#6hrK6FPP396PQhopM9k7u0{9x})Q>3o`}-Ah+2we6RPTSD!t}Rt z4c`8?bd@1JjYjzP_a8qr@BX;(yBSQEUt9UH%dwzz0p$&G-F-7>ySkbB8!pcDFNk7P z46gU(yVOs+cBC#+_h_A`8M>ITXVK4CuyvpujyH8-?V|z_op}m_j6ud_l;ma=C?xI$x`Ou9#C5<@-); zF=a@0fH8e`2}tHP)oY1<02*noSKwGJV)~6Uqu{5uwisp^nj7}wX&_WPR=fxI2$e}A zAHGJnf;u1xcG1vt!*iX^4j79ePN4}9ude8k+xrS(zq^u{n&}xC*B7`D2*l>zo|cvt z?+q|41I|vo`TXJhRQxGOK`m}dO6X3d<>g-hq;+(lhky%BwLAxQkIQ5O@zZeGRaFNU z7t#X@>TZl1aE2Caia`em+rN49rn022?l3=2KKRGd>@51(bdaoT8o1Q#j`xow#0f2s zV9Ii4*{w4tB`06j3yGqT7I=D1NdBGbeUM^7- zY^pzQQ02J{?4O{2(KuHz`26_S7&xGfTrsbWClLzocSaFsZrvQXh#tLZLxvTODBg>@ zLkjQrn7Bj_eg(g=71NDF@5``y^CoWPXu)e^pL;HmPSa=p)ltrW9u4f0mZ2f)XA|PO zB6ScKZfyy|#8qU7l!f{wAR&Px?^Avo?{T}pm;|T;Zh-z|H5|*l+5X0^FR!IVIbN|H za{L7s?!`_eZ~{)e)fgbh6a@+J+bH<(e#Yf?z$s(|EDk`J2YsK0h6WyV7y%VEwbC3| z3YZuemX>!S?+t>1^TrkxBL|ZO4%FXt4L)ac;|;gvUrMSRiX zZ|08bBTLbBMf&+ATkjBx$L!pBnjp;|vm^VIj&1$nkE=1SvpA#ATT8fNE%=h65gj#4ubWC{>bGlZH^0NQXpBl20sE(ydkmfQunW*OrwD7O$gZ*Mf5Roealba6BCh zk@x+G68%;1UqF#Iq2{K5lWI|MaU(wDnmy>ie{%ft6IRK7Q{^dpq^CyzC0_Aqc>-g) zY~iFX)_Y+uf5vKD_8yG>YEXYb!dY*E^hM`(!nP*9wm7|Gt|Xn1qRl2wVjf;VC>8vv zkUgPOFX{?m4nlFL3B7>2b*H7t?Ae-nlj+RgW+;?~ue=}#oCIegft^-s8w?DV8PoX11t`k@J( z-!+D~t?N@d1PW@sh=d|GF)?>o)==oMHv@-u;UHhFk+HF|v=5v0uElP4ESCgdP6liM$Awu;c%Vj=to zr?E$_aOcg|8-IPN{-JE%Bg&jaig#fvV&2sA&Z5DSJC>pc`9LPo!!BNllkhK^lfT_- zXqhPXv?yb^*k*9bSX<9`e!g$8)VG6$v(Qv3xh-)kbi3E1xs1|d)NsCrtmu2%>#w9= zZz7PQv5G`C#RNvwkGTbf8cSbP1$XPKVybw`>9J8Rz(Y_ov#!A}axN>W8x~nUN+N@dh_~R;FZpX2oLeKJjNB3A(KO zj-vT?HZR#ZR*t8gtW^bWLsVCk$MSuvGI+UrxazJR26*5G9Jyin*#^zfe?}=B9x~u7 zQxUW^HRV76IW)0GZx4R|3ELp~3OjJc?zD?*;ES5WF>P@;awlJsltks`9*6Z``T;ES z{)uuH4uiJd%!~EJjGb%7?_$F$k~*wuSM^y4Z=~v6BfeV3>`=8IcmZd5S}Qg0PmfA)<^ksBsgj@+@){&Q* zbyXYp^TLD)Q(XeJFJNmFf(mCH&9J3OwWOF3xW9xE^j$|WWZ|t-K;iaD9$VgCsmf)_ z8a4G$;!X=KGW~f6oinc~yHbM6;d%p(09tj>YWmj$hZK1MI?&Fdj^@Izix~hA20pD= z>UB}ve$3*Ml6#(>Ux32H!Mms4&-4Dv5LwPtEj`gd=4ASQyDs{iB3q^5qla3n*KpF{ zlh&e!$Ya(xxdvRi9k=GOx?-mw2c$mR6A&0b+GmD%uU}NvyppW-fx%2yazM&DMM?I9 zcE~=vV!1c3eu33A`VpP`r3jzc zose&rVh*$O8~kGHdO5foQY0p%YNu0+CAHMv-;;j1QPMu5b>%im``o!~;YB=d-1lx~ z!=${?J7M#)8`=4{Nrh+e>W<4Mkg8l0@w`4I`JdEqRoyk85u{#Y#h&m$Myc@#eAJ&@ zrNS^4h$nt*(7tp_C!=eTLs?|4ZM*eKizKH^d_Vh^iOVCT`lq%&L_!wY(`%C;6QLqb zf<|b%tKYw0&+h}d%lq=zXG{zXowKep>b6!^;=tVCu(z8#Db9ZvtFSnzuJQ*i&Tdlv zwqJ<7X;N=py;ijxtT$j({kDy0Oh<1-7D=D+G5h)1D58it*VMyi(IC>=LDhFMbLh}o zY!%%A6EUxGME#5a=?vXZO=@e1na zcegwX&*`dTy^Oolu6(F>Np)zU@;<)V8`-EcOSQzkfb7p-bYiQ$$nB5_(x7H@KrM^k zzO9C?9v211eFLNlqp_pATZoS@(5w}LggGS(-&lzLd+LG2${*HZu?|BIYngkCuS8lf z>$5}#;hU=q^zYt3;^m4Fh>pN@0L9fdwj>}yn_SFhj-c#YBqpi43ca^ z=TZRiT$dNhXPTY_q{-*2wSHVk`boHC;P%RZ8J-UvHz*xOp~Kx_!4`GrR;r2q4Y z4NcO;owPZHq%V@k!f&xCq>0kk3VmF#Jt{lU5EHa7gdp9BHP z;coRPKj{+^-$mTTexDW^(k(A(dZv}<32AP{^s`PQ(ibf9DQb^>A~&Bt+uM6%k0di| zyEh>9_+fWo`Id$*pV|Y*H6Qut_Y&dLS6E^}CXevi{`nJr0gS!?sE(pyV)+9r|Hmz1 ztd>`ib~4m3s+()$(jDXM@i`?8x8Hj=7W4H}o{QVWgp^&g0G5W63Z*6cdMOq zl5uGmObsSxm!6VSDI<--TpJW}*6+>&MYG;{@w6(mzwYKoeomK{Cq6WzY@rerFX9R1S#fyp4S#LV_A*hGmR?6zvAZhVocYCoX zZ>;c4_WkUQjEB3gWts(sV|@|4@_N_BiEQn~wG_rkr+9uBn%)CSdf>6Uo#k?%E&Pc&nbS zd$~%&V))e7=C;=EF46foVX2Z}7n!d=ZG@?)>sfyHwA<3ILk!|A!)=PQUF21xh)(K` zKXwrRsNYmYhS&igVj7=E{Z-RC{( zjg!%xOMw+`LMs$?vB?JXLX=)C_RE6A*_gS1#mJVdjZZy`0WX`(9Gk@Ea6Syj_6Vmu# zUc>+5`nG$7;X)=(nwF+EB_?FX zNuKvBUR^FbWY=%L^Jin{IF}i}rJ`3jjjnsB&T4xj}9U35J5KtZ(Rgc=Xjpwk}h z!0z9;@CQvVWsSQVf;mNT`E(?NyHk<3kvUG(g4d`R$6*RBK`S{3YHB#EAl-TLNueB3>6WEL5x*b_i`mBeIK=2DmTDAxo6YnMk8=346pknN8tWt6 z5Y+fLa;2HEgiAjaHJ|0mKKot7Tgcsan&^L%Lf|Fv2Vc0P7LUNe!885W)lg&6s8tTi zY9kPf>sY*ol`@nx&b^qtXhRv+j_PArci#RY2EaYIaiUZ5Z9pj9Zl_p-T&zBdH0b{} z1v$LG+}i{GfiCw2Jpht-fCv01X=teZ9H7*sk6@-~1d8316b*U#Xrb|%NGLvcx0Gn2 z&r@tIC{zWeC_iijn&8U1r^SDmrrYLdK!b*VJ3Z&wp=fwC1IY=V`jnVegF{~hAu`P- z>f5I5u(iWND9m_qs}gzbiuLNJlj}oTCNs`~Qf84Q2^@YNZnqc@^gX$*Y7twM70t-| ze{PE^Gy0^h^+iD=<(&^FA?I`QMjm$5|28B;*rRDE*&9)KSD~-IBfR{y{A3p~|7kL|c6Xo2ROoUmzwSggso`Sh=)?m@AE9jF2VO^xtKn%fg72GyTQ#JO5%sA)6Fw6L$`Y_W$ z*cv;!7^-Euk@KlzK&Y3aG^&nvDEaox<4T;WfY2AEpxq5>r(iWFSk0iPuXo50yLheK z05r0H+orQ4);~PLO>v8{I#h4HGVOhSBzy?bUOmC;yQ>MW9G;N> zrA>>!xGzlmI*W7qC`=EUR4Q1+E8GQ*Jb*(dFLA0+T8QbcIsR`B3WI-Dc#4kMzmxw6 zu%v-V7FY$u@+TbEr?P=p>i-I&vIOW8j19j%0fWS;U;&8F1G1$hfNyGE78Mt}@}z$y zL8%duVA4ENpfqSQ;_|4yP;@$NzbDQ|Txk|- zO>VpkzjVrFYtc+8<{U!nv|l^?^|otL;`s$}=2!n~$n>Jv{i3kigOrr>{lEH}q6uIg zLlMRbotmAU{q?p)0N~q*hRUTrTz;zi2M2#;e*uRDej`XBgys0y05q%x1)o2E#sPT* zfP}r+FD~zZ`NGPI*%`N3^8J#A97!5|kV|GJ>gyGbchooHKOY`qy5b6#h2|+EP!~ae zlw!p$w|=W`RkMY#Rg};(D`HbKQp^G-5iJI+=mv$}JX@9dTFV^JB(DE%S8Oj@!*rd}1U%PiHxifQoh&+nM*8t-)MdeKN5;i6&R&q*RL~QHvlqH%v2guEZ%q-~=zQUFSyrF(UCGBrJJXk(rzkck z>ZzqMdFcQ4Hjc>j2^xxu7{tUU2M6Y+rmld713^(`+AVG%@uBDy<{}_vfkOp2Edg2z zRO$T#0}ISj!9vivL%1 zsMKbZFe*Pq*R%<)W+6mW={2~*G=MuO=od?IysU`kbEY`_&a5Xgxjz3EONZnzYvCPu z^E48)2A-gv@w4<~DKFSuwhH{YpLDXU5+o0}OoQ>8zh2pe&_q2(Eq1TcbsorD#0=Lv zW4~O^W%&ONAB{k343Xx|{8H4s9&QU2^653}ZETr=D$=j> z#c~GX9Iczrx`8PV7zW+`U7BKJC#GiA|oK&1Jmvc`VGiphb%6pBq>qR9vB2H z9>BPQ!7n&Ge5xzO#XT~*(xuXqQc6zF@iE2I?--|RpcpM-MtnCM5+y!m{3c!8Kmr}! zzctvSSne1J{yxfe;~ExeIoQLL+kPYw)@~aAGsyy`O1vvd&!=?kgpVbL)i{Ux7e<&@ zKNlrz1zJbxQ@Jk^xA7(NcgKQY)wl!D-g;*%AZKRpzs}Jq-lO9DS~Mvibe&G}A&-g7 z@$yVjM3&|2yt-({7qrSD&X(wft(*6;2!^Zi4AmY}@SUM+A$5UlwT;9YFbcHn<(S?H zotE}EF`vhod=HCVhCV9Z`&Z@XoD=M>=UpSf%C{&{yVcQc91#ySsC@9tj!}F5Pjh*x z{9hH&(cR?K6fQpg_sJJhC)N^hT-pHDWANg`Tm*xD6N^};*~F~a(pB>=ru7e-{D6Uay-F%Zr{sDk%t%5HF)=o}rNk!zBMC7G<5_QWn zlWoyWW|3-a%UAm0bF%nVqKwk0ou0&Oj1atpkCQIP4%hG8zMgMHKqO*fCx}<>k`$@l zWGIe&aniBWhvGyu!R$}6k;|;fzL|{RR&9FJ`^$$;N!qy2=wK{;5FDG1SNqk0Gsk3d z2)vDyWTOOpKsmv1z{rv&RO02Az$xs0wRe!Oju=&Io+ApzC(Qj6?J?7jcW-<))Fwk# ztnc_BLD(I03l}h9-#lqiduuV_mczGGX)ueVF!{p2=H++~c)lYq#p?f9fNT1UBO_!G zih8V@x9M%0N*cWQ2{VhVb^Xc8SIVnN;_@3teoaJ#>^fzY#@$)lOIFJNt}(pm6{;52 z)?a|!A6wf6D(q~tF9!5pQMU}%9x%a16{>*20=nYEiTn}Z!G&*goi5jr1;81B*6UsR zOBRlG5F7Ff+OUXz)ICg*HcrRR$d}9vNB2P0wlLiVE4C{p&DjiZ>fs48Iz#v##DwRk z7M8^LsFu}hW~hn4BN6BiO<`FljMbScTDiV~IrbI|$wDoT86nN?a0)mBox-;Y9!zV(D`!wyW_`&^ll<wn(=+Atw{M@QlPx)DXxX2c!oJ;5VM_<1)zR9<{ z#)KCd`d<87GES}*aKAL+LD(AMHE3s$H|~0GzcjhNEgAlgknw-jXkMhKZs27HUgBmz z>b~T0w6^la^ik9~5^2)k0GU1r@_qt=-p6};;(1OVKuFTBRvSp8L6!lcrK_UKIN zC(QJa-2>ov=ZN0Qfqhr@$ijVKcBjXef z%@CtnXQp2jHbywHe3fXvgmGXwB>50CydE9rzWs*rg92neUADjxZ~^HF!}dk!6G9>0 z@UKU5*uWnpO&P|r;<|2ZfD!L61xuM;cuu! zaHM}3*Z+4#l?N^lV`Jmnx1PYl4}`qNK*%;T^p+x~59mKZV*tP8Beky&D8a8jFX?46 z-hIL|W5r<@a5CtFe3?fupM@S=Qqxs`B_1l0#obe$1=l6|CC9V04U#vA6(mzT&vpG9 zv}59}gCO1`FQ~n!%n~)n=?3iDDsC&QTv|cUp=8E=-Ut-$kwOxo- zxP}w4Y(+6!eso}TEr76zk)!z7#p>hd(G-p77$>BGT@WH8H3kQT&fj zqV&JL{`! z(Oirg3l*J&e>;V!vu&#(W(4dQ1AaE zLW!4+s&&~56%f?`7sH$7vSx#{P2;1n5@T-URp~+jMlUkPyOkibn=Sg%jZltbaLds& zY^!YDKSuS&KgIrW&rZ{@*XXG`)6_^-oi$1zdFi9wKK&PdxJJQ2>;_Zw8g?%renC#- zyt{KjnLW@E0wXS1T>$^a4}=PCZW@9pOqCBn=?M}vNQ!yQ-qh6LQj>tWb&POoENCmS zr3O|iDeh|1vQ7z+x&qOq`;78=spE4#Q6{z`^(Cg=I9{$2;=9c3(-}U$dqGiX9y{kF zZG&&pg2wM7*%X%A)r@1#hiX&>MBAFLZ@skiWyr&w0q9y(mJLs?)%wpBo)`#fdjB%CIY&vboL$!oSM1UnyqsGeVUYTxp7`uLsy%7g_KXr@7`c)sH`S z)iUbHyEAeIV0Xtl46RcACv>$1^S>RkJM<|(0gnrcA`)LHP;QnrDby_hbA>AqxdER( zCpZ%z1?H`n6){o-=-7tbs`J+ekXFnxCAUtn685yTZF=Mnh}*KBNjx{7$3W z?y@AzzL`$9H#1wWxyAOw%X3JB65MFX1I6RmW41f7)g94!^B6e-y5dw*E7OjrHq^&D zR>y6QU8T?xIf}+=?n63>67x7Rtk^qpC1R2Q69b=1li5$AuWz_NoC%M((PSe>_is(J zoV9<9A5S2kbw^lulyRGuOxF}O&N)AK)w0_8|3CLmz?=(`DZYyS>2xqBn$K?s%8X6) zGPD<=F3>!(SuZ0dOrT4=MA;bjq1Cs)%qhRy|p+4pL`6{Zav*97j+~F8h*^;%( zmU2Vc3)()her9U=jp? z9<@JP&vGHVQu4mlvW66V0snYyAqz}BPGanM)N`*Lu+CZ1fhlSUp1yMmS zF5$u!>|Ik3g$SH6>J%}5bV1&|@2{7%7|_x?0RbT}H-k{a?ya8}ZG4hIaMr&WNyY>N zNolR<@^)Vs3T_ zwUY)?)V2BZyK$_#Lm~wCd&6CZZrgOzI37~hI{U~E-^tUWyWPc)rWh={?-gZms+OX) zcjW-p#iW6osfpU7<*4bW;PjU*J(asn|nw~;;d zt4x#_1Lk-+gUMZF`9VX^MX6uuV}L$16xI5ir8axY`GRuJ^X_9?!lY}Jg8QML z^27W^aI)fDdI%v5G@mOI?{_O!NS1d|$nh;HVF8{l9+y*~OY#5#@y4fS1b*69 zIj=-Xn)b(YGDG((R{X^kmW%IZv;t{tXJxwHG^`vcEIM(!Me2VepQ1b+uSSdhO3}7H z&eELL7Za2e6=Js9C_cG9M;b4IU?SbaGcKYX`f!L=bA{1FL;jy}%JPCR2cDc4^{GF2 zG;;V&IdkNdG()k$SuPh7OA$b(*o%Q^ZUz-@=hjdgK0n-B=vSyAx`GSdU9e9}Ud}n1 z+Bkihavg{XsJRF`nOD+??=`eBA;pPO9FFeAK~wuKH2>@NlXBZ z=buC=unGC11g#c>+C!z5J;&@M&Ka+=_kerhK?6*#@K*s7_ zD?iF;&c%Y6xDnNOoHX8fmGx$GXLTs83}567Qr*63CVmgdB?|s3mzMVY`Ljoj>?sd% zCGS+DNoYKU-)m`xv$j#6_&;AgZ*E+p>0B+)E;1)6XjAMv) z{^qOBO9+(x2ydPDvlmn0r#o33>L@Mxe|s2OfALA5KI?8O2f>gvKm|-K`xqZ^nDm$E ziv{T4O>-mRrI6(9kEIpzY_%Obezdu>T7?TELr6&O3~wa5+uACSrH8<#=6l)D??2kh zKgOLMb9Oy8o}>nQAgnuVrsR{5E%OncEhhyZT+7(VqqbBeJQhRvWZCGG z?jhVG0m#8S%Y_(5_D1h$_padAf`rOM-jXecty}b?pEmB(RS|v{DM~wLh9rp%_V#

      7hOSFxz=W_0}SPBz}kQMg_fzt{I(pYP?hE;Y-fa{h&p$L_*a^(3Dc#4 zEYIZG8?mB9mnf${g?$u0%xgZ|+T=Hr>Ay|&Ydm^P*~#K0%<+<;CnU??7+Tj#YFglZ zdDI?EG)G<0MtnT?IDH;|>*+;*TYN#fq76^z$!j-$w3|UB@@$%BGtNE1)=E{Cy4<^d z$%L&WPa5?Y|Mvv@D#!ZMRM2ymUAc15>T|TA?GhAd3mON+)^_;PqW6g##>brNV@^JQ zT*-_G!6^&V>)*vDRk%<#l4<+x=y)Z(*?0M>aZD_L?3+ZbZ}tg} zC~;QsuPa^tQeI5z{%%Fq60&F$h|#w;Ju6>@O1q=pm_1yFl<0m6rJCqvJ%lH5><{yr zQ>!6^dW`q@i8Y&j4s2l9IA6gh$E@Pqiv4vL;w7dHPom2|7M`M#!T{6hx6Tj^OAjqX zOmvK2TOAlLnBK<>lxZ41=~ZCoiA~Y&t_jn-yN@8jNh*Wy5x~*4zklzJ&pAJT5`kwq zGXyM#!qc=v?;1B|48AFa6OQFE3^g|rei1IOEyOfaOv<=2F*r>x2`Ti81n(esmh!ezsR4dMSsobdWXx5IUT_`Qf7UAqHAO` zEqnee`IO8}c(lYP)66ociKCVu3wMY$H@JK2UxvE8xpM0NjVSuBNMW~`(t9aP>4&@= zYEN&QQzD}iUW|@U4th$`c;J-!Sg}Bm+d`5b>auuSe(=X|-N`rvTr0Bdg>7G_j%D$B zVtS`x9&vV!?QpxF=#8e!cp1bnAO8fEf47wpBCgjE8v1PLeuC=6CrIESQn#Dsg)*9M zrlmNRUPR9|_QyS^VSL+A9-=#Ey&U$n~7FYbnzU4Lj82obg5zQc^^-Wz_9m5 z{e~o%A*Q-pOw@Nx;`G$z?;I}E%r;mTyAL$D%M0Ubpp>fRMkhn&SI_s`$NPQO?VhtB zZGLDg5BevI0wbx=63XfBA`uz_`<^P#cWmi@EqQ;qzhO9x&yYU)qtE&-0J@8=+Adg# z#>7e%EVIwA6ui%#NBNX`MdbQdsjsKprmW2nBn@rX===Yan3fIT1cI)&DD_3alQ`}S@M8_&81gP%m{3|D* zizIz>vM2}tz|xlrlJW>*Z)2$m=6|4v*_z_-_d-a3u3Xv1grjOYbc)*+xbQNAUWPmiSUdPQsAB1y&;dz?ebaIuU3_l@_d$T~;Us#o&KkrM_ey=cyEtNqX<3@g2K z2akPrwV)=`467Ru5%vc<{q!4LeKnU+aaulcU3sV(`O8hhwGGC8Nr9sLag$0OQw6t$5_$(sn$WXj(?HACR9I1w>D#CKd4GQ&gfoF@&DF`Pz`Wf~GBP?o zoqW*`TltcMe5->&tT0SPP*$qH5go1W*|w^B$;6WGZ^y>gc4^2gYP<~x^GaT{Qc0@3 z0`wP=xTAL>>Ud~%BjffI)%i6&y$@(Azm*FWDWc*0$%ryW*3N>&eSIp zRC#7nFtg*2s+o){3pGx=?3TFn+0y2ooh`)*D$Jh&+F`rlF(WiMcQII zswNY;!Lr%vPjRe_WQ>>XJz5xU23Emor8gLoBYLAbvF%e#oGH6mWV>0=m7$fh;dolr zl|{77Gb?|b%W`|*cC(&9n=QePS7=vhM5ObTf#xPyhBv#u`sd^C(t~{c%u<TxlfRmu>}|)cVa1ZN!IN*Hs@QBP!X4dYb5YaT{+ z;;xp7aWjhc{h#goj8w{z{#Q4IN@n}XEhE#BjIZvfI_!%@<&UL-kchkm1%XC=4* zN4C_GM#5IpyU5gQ@mG4O8>WlE!Vt56OMmMBLC>0e?5mX)hV%a zAdC+d5(9{~r&?C~Y|z(^@Tzj!Q{TfdbSq4v`-}&9x~nZh;w^<)BvbeeNxqv1*4XK) zMH?puA5d|x+yxjdqrKCUV`8hL<+%1KJP=d3AL zlkQ!praKHYrHY_l5Fz?VC3Ql>9qth!TkRpbiLA`np<=VI;iJ8aGT5y0mw!*l(PV91 zF#8vr;|y}TkmHFI;<%CRkx0T6v!Rp*HlcB-(_|$3POHvRB^~55;8@0wbMC{cqr1w$ z!TVM+w>9ZT?q8H`=I<7W)x-{~c4&h>QxQA5(y(Z@#VwYJ9x`CwQG)U4#Bq3l*_u9< zxUeWm>^!MFPzfX*9qUru<(S~l_+@Ax$+)G&A@WaW4Q!hLz8#R3N!k#>LpS;ZtY3KJ zMvQ{;O6N0E&Bbjb9`$H%obb1IngyEq1>Tt2XU!!{(Z5ob#eyB^F`?(u1^B&dxLp7T z3)^E)XWr$P&cY?(BT_^tB50)gK&?<0Old_Pz9fR*6wc)IBS78^D%c>|poB>m3QaVH ziW$W_<@L2vBx;CFK&pYXW=~R+>FVx_M^r7kY;E{w`0xC-vgOwqy)MM!=Lhb?z zD7ce?Q;9-fV+7V!Ih+khx@mKti(rjavufB6`=sNBvPM(hjE4_Y> zLuY)>dLPDilZcWwUzJX7#1ea}aFbLY&Tjj|UZvLfht?z}RuH9<;VrCIEK^lI+1ET5 zw)ZGI@f_-Md7r-YGs-;a<`9llyb)0cORN(24Yn9ZI*}T8aZXNOAVPo`nz}r=qR*V! zm|7nDj;<&^Mg_$`Dp!npP>&84E}I6+c@ScF4mze*9MtxrZPnEY`$zl0KjZ3u!MqyB{1hPoL*eq z0|zKr0@Ay2)|)fD(Po|lb~89sJg5ikdTwco0ud3Q(LHc}5*1{>0^O7ZjsB9~Omc%P zQ?}IST&d4aNqYO0C>?`FzDWZD_A>$7Rw$vgi`Z&%SQ?Oc0af{UHCNiY>xZfC0~HOp z6HF%*zE7lwo+@0orFN$pd#i2zW8O6i?RYyrtlLD)gH#(sROr%6-f+K&HqK4^=RE(2 z36?Z(^EZ+$?(qB>@zj46lAegCyVKGid;T5Q=%+$^Id8vMQaGa7IgBbXtSSK65t5MlQsR_f}HV>xY{Z)jPa?uqyqs8&+X z6^tyy)=`KHe+#(xF+Yu&D|XK311M+24TL4 zr_f&deZH~Itsd`b;g*Httf8ZKT9@qhk)}oTczDj*Qpnt)_7bUdygMk;NJ&QL$j0*V z!ChI&$@{m4)}JC_`uRThaoc?)46nZ5r6&)N^sU*^G-?Ci-_tMn)1`)RWI$WqsOi*w zsk?pKmE4s^J)B7c2Gze(g?2OZlLpG;QR__aC*7S#e4VcIVTi6!fc!83Y_CaOp)>+pS>nVh2U_tjv!~O!#zK2V*Cr3A(KT7Fd5Fi8uK9I|2ejp*-x0I`p&vPcAX!>RVOcbz)g;GF z;+v6ritiS& zB`w&=?j4!=DUFW>sk-975HsyWP@*+a^^L^ZMKIrAi+9$rsC!gqq}^}{Tk;xn!IV)S zh>P@_6d*~~TgdpvBtzwYTd!=NzAH+b&@zF*&fLo!2htOX953e)wQg%a#VAH%>+eVCqlO#!l$E#ThSMYy z*pVqNt!Zq8!69y>nWQjDQ}*lirq>GUSYF z`Z~sHjd4U^%-T4yQMS%u&UD8^@^O5B-*mmKx!UdSZ|+oJef8S_?)F^Puzi6`jjmkQ zxlg3RuBJnZn(EAU->c3A?cx8f?c-tCPfvO#R~`(r*lWoRh$&smGHR+@He+kJ$S~g| z?xWV$L?lgl5Rx#!7`Ax|IjDE#z8VDaGi=Q4eIe&54LufA6N3iob(-p9Vi~x=dTTtK ziVM~?0e<8qiZwsKXXm2NvbXIe9vMX7gY03jXUq@+0@FfBEJ>oj&|vrCQE1uZdw~Bb zN?Xj*b$^bFU%sGi+0k%$FkHKJRuvM{^3*~HD+jAc+f_0CY}wRn!qLm35)h^QHK=r{ zQMw#lT#ri4YENDNwfIvvsCj&~`DfGvgiPQ<;(O|Ab~U%>oG?zT^w6r1v;i~yezPpJ zO2pD;ESiZOyha&@B1Eb(_z&4kVYeC(TqSAQZG_@nG@Dn^Vq_(SrQzb26&Ftv9T&!u z<#)sU2mLhe$U60}~X5 zrzZ2^x>yQ@5VaJkuoM-Qgu0qET+1pi{pkP2$ZkThj9ca4hfhLmJ->V1#}wXMnD1;r z@wbLchj->G`DU$DvNDuvcICzmm6jF`3^O2EUqIx39X4`yc|DDN9Hbg$#(bRUw3LBF zz-X$Ft}`Q*wj`+D4c49}AK~0;n5D-7NMg5o)V)uVU);zLhA#S3L9E0bq)?0oTV+Zy z-}r-SeYwK*ooik!anlx{82(wjQp4l4qfngyHB%4dpM!mr*z&HCPptWpF0QUfcq|~{ zUU1XxKPM672NpWng@8KfU3IBtvDY-YXdYd-5nYfd#;3DDp2n2q&rmYLfZ%YtVzzr; zmARlPSeFsDxJ~mK3q$YlI_8~!F;g1T#JF>G?g$#fiZCUSefW|Wi&Fq%Rru0Q^8H}l zr51Eb7_S$LU5dea(XCc)*c_!*6$V0?eYoa!aw9!*WZR$h$@Y=Q{p9@u7Y6){aI9rX zI?s467)#nxsSg19lzT6d?6TBhOgcF0pZ&6g8_;n!zF0`*CSruiDE1K?cT)e{-Xr z@f8b;@zU^6oI7}2&zpyBEd^u(6l+x+AhQ%P!ABu}`O{j}?{f{TxN{$#q;!7Gz<{i0 z6s<}7!iJ5$&doQOatlb+kfg+qzle_g@}x*&2ff*f+d{3diq~%Y6M?lH+LC=aD%KQz%mO+2 z(C^jM*|}kiu!H_b&lf^{XO+q3D_JboL0cN(gfxFIXKR|4Utisbu7&+nyIc3$Vx6(4 z!`*isvf4B{Y0z51eW_93KI}WV9d+D<(wGqpdswiWJEW!JNSOHgak|q;Pi_##O)y=E zrl_P$LOhb${`qgeF{dKF(_y^iCp=RXu*elGB{~HH%`33UbM|ZlWLPiyI1r8c0twMQ z*c2FjkOm8EMK95q^HAiDa1RsRV2{*4#8>(7vwDl`T+sEbJFeyX^DD$<=|0}OK)5+$j)=yZm zcp!b|(r8tIyW1mHhZBMOaE1oT`&Y~jg9_V&2u3YtP_nB6<3E8vKkmWd8@&Y=Zbds-$ z?DN!gYg@7_J==|D)&ofpWdNIsejaLoK|`Da@l0vz|uEXt3}pQh$cVrxc- z`^4@gGS!tA_rk#pyL>-8FmIjv{tBlQ zIlOvdSA@Lg+}Er4_GhvieXR{2CLYmZI^f>X3Z**N6=8d{7;|YWFLXpbnrf~!c2oO# zHgmt)nzCM~BJznJ3m=!MTIH_@lvJFnecNc_%Z`F*Ca1)rnQy;+=2p!wsOovJYN!U5 z-IrZpVBgQnCOe=Az(hg$nn#v~WbzC`@^svfSZ{UEk|xE0IPxVJv?wh#OD=zv&I!tU z9`?y}tFC);%|*&W${mQIgJH5L&GrR9Ww3%z=U^=4jtg!j{r^?c1PR^yd?|UHp1reV za#Azhx=8VC7pXz~jj8`VUXIATrDo)0Qt0DtgY`zs(6mlPxnys|cu2ZY&RU-|vzIrf7>yssc#!A$8Mgu8*dh zm5Or`X3|Buyst66F^_QTp-PrNJxB>i07gJuqfOe$_drj<&`uVgyr%L@2LZG8y{7eE z)$rn(g`I@mfBu$P9(9v-Bo5XlpCPCIYl|wVscg=(_vR~8PERRFX zVOVXyr4GqXaii^I9M^tpG7j{DW*BxYlKMNMG*%CSTd%AjR402AJ#G`bGtajR_7+qlfzca-mECicq2MP)MBKO-M z&V3`UUg~y^ah|jtIo(j!_EvK#tvc0y?WBi&i*5M*_obHk+G9$?&3x@TJ3@xiHGc|$ zpYwc&HS3BepI$c`UlW1fFT90Cft&bCDsrPq5sELr-_JwStztYRL|?pJc@+tCw3RTd zz8RTU+R^z(uj^RY^Rljj;uYzO>uCJ5N@Kn21Qj@7kIq6l4_4b27B}7_l(UZdOnc!6 zU4z}KSb=%wU|cS#xV}e%_aEu%H_mpR<#o^4xb_W+9Aq@nP^=_W_+Nc{Fdk&H6bo z3JMD`F%DCtjC*(9FOVvD&Gm+VN6}$PS;t#g;-Ye$yDaPonSY_A`S~(;{~j`;>TV5+ z4{QSTZq#-EK(^qivU%H;Iz0>)U$N!uX~8v{v%2$nRLm30brG+bL7s%n=xZhrLC*)Q z_|yt{on2j-5l*aNS1H)IW|!Z#jtRuIFL}a8n-~F2fyd7BoqYH0mfJEP(a<(vECGt% z&D83=36mei8#VXg(#MVgZp!Z;lOf4pYM02Glj&K+&@h4bVB3yw#aqPhB6Y(MZ0^}EMN z&Mt2|nKK6|f0#$dx}Lwayb9q-QCP=EasT^aQ_SV3nox+i?t|kFN^b)~g!x|6pFiF@ zUk9bX>|2`1W{3&9y9MgpAU27-Ygs398;-4<{$LR)ISYmV+-BkVRC_*qf`RDhqr8Nk zWFZBrHwoKcEH5W?I^CVNq46zEb&=!(X>!1X=*Jsxsu^cJ5{trWO){D!q&**ZS}at1 zuuGO7=>^{e)9>TDcJSH2jtLVtmiSC7A7rs(NP~J_+Kd7HN^6qZu&!Z8C!*E3w8gm{ zc8#EN;mb7|o+|k}X?; zn(Av@C|*mi>0wA!GzB73+yS*k?4P+nbMpJXy9^&Q;Kvc`jk=n8l1TdC3(*(~1Sk){ zQMkI}pOKLPBBT|f>0f&sfn1#TU_1N__q&&@D-f<-6Qh8!MwBNS%pnrYv5wQ+v$$ud zZ`KUdATg8E90AU{l7fO{^)Gb; znpeIO{f_p?+`B|j#Qeo?JqU!>8BIR*nr_zmC0ot5(~QuZ*IqASCYeEp_hB=c_Hdc=1_EAd%@_dX&DwTGzp?r>j!ygt_(QcH-2PyS6kxf*ghgptSN^`D-$A8$< z1f8k-!#K?LE0#klN9NtJt3P`XJXNTSfqoHis`;zDu|XR)NtM@2`a8CqT!HiRVwr)X z)@ug@sV)nw4^iqfN{*A$GjHlK2yEf!%!z-KxABy;R#4HdMP%OpTO8MI{f$aiMb*wq zKu_&9oC&M-Hv&VYTQEOBP7^jZL77q$9?#tVV!W_Vdz%P9Gtfp;GNY}8_XeN)IahOv z`9fU-IQIZ){jyNA1#Ao*Z3bz{Qo@Zt!Lp@Guq)8+G()-bPJlq_+vWYq4hu0k3+(JMGS+#DKfL^r7w zZjKzjl}S;?NpuNgRt%GRyNje<25|wwWTsfZa2f3OUV1HxaumpDGlo;>7WiX}+T$L$V?S2Q>a! zNe?>tyj85pDN;JvH=#~C!-`!>kKVx`cAEu5>NPAf{^H-rzp$Gq%?uo^#=N3mMbwQq+Q4+my#%QWRd;*b!Zsj5u}?e<=~ZNo42lt< zPiYWHt_%%fLU`1|Ae0>wmR_0(%^^@?{z-~{cDMN8$5Yq7V5K*jgc*?H{%Ew{I56)X ziGB6v)F(+ZX>ZN{(k>mosG>5x{@RA zKCg0(rmE^!>C39q*|#umkgKED$hh3rEOyI>!n|8pwuhMu=j-sz=5+}uxVU%6O()3s zY>1ARNqV}vry!E<{$=Z2+MEA7WAxF7Tn6!M;Cqg-Z&#Z8w+0-{RbS>fX_t~>4m7Ym z{b)8|aP6rkn5h>pIJ*4lN^R{k&h|AKQM9P6qc$S3WHex zctseNJnKQsj9mnJy&hh2hEe=;BZ$1EC%^84XGY?Ha%)r81l=F8%+DeQN^%{7<%w0` zs~-9}ala*2V9U-D&-@TKa5_Uv@-N+f6~^FZC<nly2S7;ozXGR`A--xH4t&N%Az2^p9<$xG}y8YE~P%lE9I0}u6M z-HM~S!Ex0Ry~&Ev!QS?=#>>x92L6m`E@no`#}A^0jnf0q9YS^rV$jD zaT(aBAFWPD>bG=I+7gtcT9Lp7Q|)SHMc=Ue|Av=C{UYqEO7CX=uMg5U1y%87JLAkT z3+#||%XZW@|CFc|hNo`_r$2(4_6R*ef8=0S2CE~-fKk!T^Lpdtu4m;swCS6~oUk?E z!XR=)J9ti565k26{zh^K5ZS|%uGcG^zRQn7AO4MEH>j4hi*7%~@Wd8-f@?qBVSP_H zgK0cOnfe*ebhSRGnkJ1WiO8ozY=ZDt?Pz-I*^Kn!wZFpSo&%kT*-3&;cFVQ@X=K|L zw(%;SQ~#H189H(mnyqQ}cv0ioyPl;0LDhT0UwLZiBJ-n)=&8EUOm9oye9=o2h(wXj zxA==L6jL-m!FyhY!|HWQrZnwcA7g>mu*}92=SAXk+MDtx49y zYPv0TD{bX_k$Dqhhed`zU)_PkO549RK@EchgDD^@Z*jZ;;JVtZ4s+e;C?Yg63~)I@ z+9Zty2o7W0*NW8?bHc&fyl-1(*pInlS2Jv4&^+e{oeu~Tw(_L``iy6^-4d>>Bc3kx zpIr@0COQ3H?&ytWo>A#l8T|S`^_>(di)&wnRkKiZ3As|6jA+94fIjMhK8%ag&$yq zjH(kUBhr)sfaTk+SHl6nw{=hIf0Nt)otIUG=lU4hzM>ZRaU9WVz2i#G)|_r(w9XnD zVTM;o2JgB5$bFLy&}XnigW4spyw_~!-fWvC{RjvTqr4xRi~suxMDYS=7|M%Y&RoWf7G5=dh&o7U%O7K^dqOUvtuD=mH;gSJvY3tIx7TnJjI}{}% zg9#e#^4Xepw;q)hx(g$ForCn;?ZIJZF3V&DME@++Yd(5s{dw`6{RPJ$In7Ng*o%{k zHtpi!@48o1dx1#Y0D-K@2inZevdDf{#X3&*qHNh;&_Z^iJg8LTeSV0sm(&E3iIK<` zqB`rbO~41RU9#&ZVY2fu%l);@G)}<)6)^{)$AtMcQpwH(4-e14g z_?~jn20Z_(@dASaeTj0m)iFo{E_7blQWsFwaViyN|AxTw42p1tkA0>Q*!mo zp?~(#>AtD#|4m}gK^M`@SQ(a>8K&q$QlA%@Otxz7Vlu>rYB6|85=}8PEJ^bTaQ`sT z5j~0W0AUom0pj{L^_{?Z6@*wf`qOTX5D|7O#w2f(+Fr z@>iI+!AeZIwfx)pj}JX6T9vONR4AZt!|BlgH%5)`C~u9 z=QCK64jU_kj94B*R*u^eWIgv++@;oUnu17;ufNCyq1@wQ$SXQ44sTnzW^kb(pUrV8 z2EKc4_PLv*WRxkyW4ehkxD;-yd1Tb>jKGCcT zX0Pj1tAs$Ix~A*sW}BrBJIzH#;BqUyD@qj1yWq;6re+KJ24u%mKEN3HaTtyQfDdAT zymgekhe>;E!{LU`w@2tM#KEB9uw(U-c`P=>+3LErp(P0+wJN$? z4#-~sV`UMzgaz*GMauu-bKd3vxG+oV0&Xhi6>^RaM!NAKrj>G>4M#a!H9oh4J~7ts zqCH4G1PK;oNX<17BkXL-(E;MBm04icqL@J|2otK}`j7iC)XS9}wXS&4Klnw4zf|dL zjVB8>#T#EO)}0C(?G)LqIE*cbE~h#Ej&L0Kb5I!C&tjCc7BnP*X3dpeo96UqySW1+ zh^$Fy7jg5#>8RtmLs#tpMRxMbr|y4q`)6Rn%!B7+ZwrW_wk9Gsd{iuH?fNmmB(_L~ z5VlJUHOaN67^I3EsBuAW`AgstKyCg_5B8xbtA>h=s-K6hLyaIzXFp(A3_d4?Z3G|5 z`0zbOSxx8tdn20-pZ2jmcp!DnmZTFh`;LS1RqhD9i?KT*Et-Ir458n+o!qsTnBxdV%|rex`R+)J%(u zD#@bhT*i+pWp!qSb2@C(diYxMWQS`mIW2WyjfFDOC4}Ke*8JI5c=JT0wp5_ytmt;Z z=(!#=m}&OeZ-R}`>$*Ke^a`v~rER+7^@+PZV(BX~nbh<{?z{h772S3&=bLhWv2#Xi z-o`y=7GV1~hZ=`%U=my&C#YY7FUnDto$o?Wt?qs)hw@}lut-p0g?_r9Kx6@eJ=FI> zq<5$BfWb&3F!$Z$G{vE62wbQ=<+a-JP#U$PeIF)WLVK>IzFi+C-7Zj|Q!rpk#&P?2 z+<_T<7|n0PK0R?}{{^8)z);=HSOz>bX*s!}0T>$|qc-3i0{QpUWMojcxASFFdoG4v z{{H}}JMa^%bE84{RUW>UV)+Kndd*c#2BfR@LcnCrjh}gxhPR)RbDo2eO~P~F@z?oD~sg5s4D_3t0(dR2dFnuepei&w`P(7Cnuof7EU^yX*cF;#yS$LvM zGbGlOD1fR>(NZ|8amygO&l0kaxaQ$cLB)oYThdJ*lx+TlZL6rS#alN+9%`iMSDPdlCw7YT{+3T8|jb@#(ugZ*?C+xREv-2zBC9Hr$6TnB>0}?C02rOab~wop8p!jT5DDC5A;N z(grR-K=`X{~a?-9k?|ys|5Lo2fZ;S?hx|P>^j+hU$A9+%B+O$!jrZ2Q+u~mwjX0ywM-w3h z-t2;rT|OomvqF=R+R`kE!UM2M_g@U(P~v}=5YL1$Hq_e=Z`>N|d{A4Cxv9iehj0V%~ zz-a*p8ysKc8^Wpim8zt?{9VE8JtD?AFR$~%X3@(90@pnLGAo(j`FzG8BuhhvY@8v{78Pxl<6SP0)(7wB zfQks@j+^zME2E%7x|05QY``ZB*g^!v4Q54C;<d=2xT4?dCqSPMq}E(XR<0qi^#J^~~asRKyw2;Ds-vm#B_Cxu!r_mnF}dG|GnsQHQ;dMZM| zisoR&WI833mol{7Rs=twbdIjyWEipEva+%WUcFi5Mw@|w4OjK)-kRs-c1?l`IU=-d(gyV z*$w>HOQf!o1~!!G08JnskXeX$HG#FGhn)Lq(BH{bI-mP|RnwgVer}Zv>iiq9)+mt_ zr4o7Ya*S36cE;+5_hu_(c7$;|T`Mfu9TJWN;crq`wcJMIMV`E(?i%6H*w_j*0(@E_ zTAt27Hw)!j%W*pAQ$0PVAS9q;PXa2R?h$FlouMLe;UyLf0nlfsGpEPQmaAvs6dHH+ zZEnMdvsS|y4|ZdN%}u61$c^NZaXLeinL#wKW$YVM|*s|1W@PRBvtG#s$h>m z-o>+Kd!fJnd(}pih~X$T1u@(N+~c4r!nH30Ya{j1!`ws?%-}hA!v+V4hWmUr(C>4Tr+3Fj3^BBMs&~0)4p6H^9$3ju0?SA4TcI{jNsE$*CqPY6Nhz0aB?obo(3h z#mBM{XSj3{<6d4OaM+DdjhuM8XgR<$+izvP$_Z}lsBTHpMsM{|uZNC(%8y8OYacvq z4=>r_Ick`c_lKrXnRTt>!p{VMpSQ;5YZviU8dMHbta?+dB0#Gd%E$%SPyG9facpu_ zv>Km;*v%}9p+P@dYigHUZb$xZyfIEBiDCN*b@O0s1gB&qI9@!;In7H-*j2cmSMeO0 zW1sgiad9PC*q}A2ZeYA9Z@S9_4x&pDImud`UOjb)oKGMwat8YHoT~VzL6~aZhWLtu z??mwZ5S%eD%A{%Hu5P-rTX+&I^)N|e443T1AYEScc8>iXIaU?G+K*vhS^=qnHr=GL z2=Mt1*WM%@YU%hj-38tC{`ldRkl@mZ0oY_gE!^C?$Mu7)AKipcL~9UP+~FcMSv2AA zMvII4)=LZ3kCHR)X~gtey}Z}EntoR~1L1EF5-xqO_bRQ`)WSYX-X(<2J;+xHbTD3k z!KeF8Gh`IPl}TK^H}-kHS!=k_#>LZ-k(D<`5F|SocH!=@lF_DP>T9S<$z)4k(q~~V zD-)ixz462*g>%&9d)aKSJ8}wsM&<0`&`*Xu)R2tWB%l>{SB_+7W}X?n_$`(Coc--* zp%Jf}=Yi6sn*;x5@U$%^fa| z(eY`YjUh*N{!=p$7j5W0-Kv)m7U|6_%2G>gA1P})C=70&L-?j&Rythpf9Sn4%{4Tu zh-F}hV#E&gE`B9y}E zg9ye@0LXqC_V(MeR?TX}#HDtiTr*I;b(??n70Y9N|0!oYKS);K$W$b9qFzzM&HHEI zL21l!)&he6GD1*L`2(ClnOdyYLU*MC52_d%U|& z3U*IFH4>j!rU$-zS*&!6Vz+?kbF!%Z4FHz4=(XK+60%wKAa(o3`24E>sEMDNMIg59 zqlf%KlV_%;3q;i~bF5F)r!H->!QseQM9F&*e4C-A4LiDAn7Ye5J5!gt;YTV1iAndP zbQoC$(l7=7pcWKzHZpoX3>^99h&ecfW-f{>wW$?p%9)1bs0#0PiWAg80A%K>23}E#Dq@@w@KZ#-geFXr9 z%V2pA9y8@@In6cT(;?}y*m5d;NxO4&VcCu)B7 z=zsW-U(1o@>yEwuK6U4c_XJiwTr?B^lMqWy^YiCH-}Jv&sW+!KnhQ7C}ZPkw>Vv8+O(wA3bi`}yh7IOZt zmO(9RK7D^M*))9%G^Qs8&gxUW$PuxFqXyBw3DZlZ2+W_Ws(Q+j$l2 za7oZQy6QJ=LDyc;KIay!>@Wb zBeoZMe;Ra}>YEE|HkEO(<%$|Bp|sB{37CwO0(84PJz5bPt3J1<0()z6d#*aL>Xqx6 zpI@06kMeOOMm3#E>oR+ZgOU2dCbJ8AxE)rDC;J&B&`>u~523oYYZ~1*anjc%+r7tgZtCFgX zqgQR1-f@l%OgOp8;2v#!UMgvDC+ohRh@V!hKt{Io#C$1BrsF+SF2I^tOpuvjY0^x? zK%I>!{!t-{qdg{J+Zp$<8;!cVoS$9EPLGV&%{PgTVUD`ZoUB3!??BbzR8Un>wXb6N z6==h8Z52yfAZ?0tL>r-QaU!U}Do_&c^kMANG(;yOUDs71;oT@s@EaaM{b zge|2ITVBD@^Zkfg33gH>?sye!6-7U_U~@%})*BeCBsxmNmaULitVoDfY~$vks9|Ns zxC>JBG~2@YjKD&%^2#Z*!!Ky0C_L{zTl#0^(Tqxsm1vuatlk*jwcC+8Ljy5sY zhuXjS#w`NgPA#LAC;4Wk*1Sa?w{_x*7Nk#F4SmaJw#jOnIHuYNt6DYYn#05b%pjqr zQ?@(qe(Rvv{8J&@xlf=xA;H#1b=!2^Ca+(s|32n@qrOAUQa_-pPH>7pv$Hn_l**-!1x6-X{)y`0Kk#JWYD08nv%ATE06O-`%{2@Deu9 z1k0{k5n)=F%p<@TAJ5$A$Cq&TSB@W%&0PD5NJ%qiWIz{wnD&2$q}+!8B6%6(9&UbK zD6^NYiad`9CrGCia^TEN`S8ez@CB7Qp9;2&XeQh`t=Qg(Pf4la;dU2@kIKY1#ox8^ zH#1x8^=hEFDhJa~?aKI8skJ`r8=pn6GcL_OOzl3TO#BXPHYpOS*GVH{Y6tJ`yOSqol`RxOO^N+`12Uyssb1;OBJl_KAN2SJ?xKJHZj9Yl{zuVB8OX(mI+Wp%v> zi+U)X$LnG40w5-ewT6DCqoa`5=X%e@JQn2fIA%0C3gw+bJ}c!3zbw=~;Z}P>qghgJ z_Ph()*;h(2V<_m555Kx}Ip>FJ#Vd9)4AVj8Tn*Y0I&^35IM~jmJl1oA#_P0Yyl`mD zMgGpXk0%zOCKqz|o&UWU;9TmZ4B9$UvOkYE2MKH#cBSnjbkbz0^TDm*bf5n|(8$?9 z`t1by@CKCK-44y?@!KU)_+?J&^j%U*m?fPK zno$GJ2?w0*5*}=$Zbz%Oiw@eAb`%wXQ&nefy{URJ=Af1X7t<484&RWzoq5!zn{97T zFmKDDOn^|3mO@6e^N~WjPMH7u$$EnQT`%&sPvIi$0!+3Ym68bb3d|hq97ffzPVP#+ z1V>g)Dfl_;3j#j7wZl_i&D6<+Lj+O%p;E|(>|>o?w4b(f@?&D!F8_*&7%KUIQ{pdN zr)xLv`_o>_EGhiF|2xu;Va<9P3!FGrh2?Z`O`mi>mvZT1Fza11B`TV(-m2q@Vw#!F zWW;LH-45gSdIO%DdW(TUCg^<)myClX&QOe40;KhS)Dn8NQu7wRF=nNrU=qE&_m{6e zJ+nj|Z1K(z5_10gt@Uth6a=R0r$^mcHtV}q9H)+eF-!T_FAD~|K}}|{X=)7J(Q$Lz z#ABL??0geZV}KA9P$MSg@hbSeke+tatXjUnmywvE)&|8Lb@scI>zr-ou6FAkUZNH9 zO4^TYd1))e7pES-LbBO#bKVHv4-`h~lxH@8@yL-B8%DeR< zYqr^Qc(xbTth^))e9qz3wCRHBpDA;(lylc|!;$w`lx*{Ir;BF!61EY^kMM{g#+&q{ zL~+WXb?p3urW`J_0*ZrzCUvCr-h3XucstMZ@=`kLMw=XHS68c(bERIZ*^4KR*u3=A zv`iA}cCcsv+4*k)%Lz?n#l?pJTfxQ{Xo5x?)RbYC?FX8oZnR=Z9|1A3!}ODsu)}4* zmtb+PyQ=iY64wyNLM}D36cvS(+0P)K`}LiS>Qu8M6|5iI0U!Bm>1jjyA#7FSc$!xR zjJu6|*yTdJu=rS|3aDx8qJzsUvFVI)@C%-n2hn{pvVNvM$UsCke_M=5(wKyBzr16( zD+apH-XPhV6iax9?vhyr39P8k-N2jPUnD2pW5wL(EClm zs&3sJV5UmT%bSIZ$)>W7)x(&4mKr5}4O8hU{x51T09;$30<&58X>c8r9afb#e3cO4Py>RFuKmemi*O}21N zHSzP+uO5G0q7#<)-InnUqSK<~@#GwaEVo9w*f-S;Xc}$0QXY_0)nt}!nRez$l|y+2 z1xF#lqi8Ui+Z|mdPc&GwD_TKv5Qgq11Z;_ELk1z$V_OHi9Vnd# zX|wY<m=RqS}xs<}q*X>8s-s`N(V z)Pw24ey$1SFjEEF3Fqj%Jh-n}V$K=lb2;EOTvX;%`g-u^uE1iL=mFyKI^++bg{JB5 z=zRY8%>#3XlJ7yKMWv)eXD6kMmDR5eH6Hhj3k3edf7+m#SxcNg$i>~!bBK|HN(}Fi#QAO~ zVLvU+GveGwSmW@wPJr20x(QT8dXw};_A@oBPht!kN%Q8L)mM;IV>r8&-|_M25EhZC z^k~JmTZsYf_SqUmSAuR_3XZ?D&x>4yWXJ49d}| zOJ5h#Fpf_H5KO$aP~aoq#rDUj_fc_t0H?qLa5#Y>hM}zF?a?O~FhT`d zf}(Gjd;di+Vbw{UO$R7IWebwi5647gN zx(SPmAoEBO-4MoQK9-93D;}lYFkarD;0z(FHn*qt%iPp_4LWA>ViR(|iaAJ8)hj{^ z0B2tQegXk_eYdx5D+kQth>TRe%8bal3Iyo4KYskUzP?UNBSyxjgX`y)>s$HBq+cNy zIu#1)AZp09#Q0Vm1KmX4@tLJ2S4H!Mu+JoD&{6 z-h_n);|22nNVWig@Lwr1vTbQ$b_hir0b_a|N^efDja`qB(JToo}0JnuLs$JLDH;Svs||n{q9k=OjqJs_VKo!TkH3 z_?FxbICr8*?WhQGaC~l>7DY-N;us2rEU1ye1)C!!+AX@PhtMT&Pur;>!3pWOy57Mh zj=zZR>?FIFyC|bS#g;V^1FT$B(mnd#ZtXAy7A~ZSYTh6UTvG{i0+9kqNw4ZiI8zXj zw{d8r%}k%JigY}E%m$KA06WVI;BEy-3g_yQk`@4`96-ZI5bFXbn#({t2dLylyl}G$ z3$OQQ*)&sAQko1qk>|qLqdQhcw&5iuL_|b)yOSloanx)H08pA}t^)uHw|@qFVH5q< zqkDRK6qJ?Y5)ypQw=uQO+n&V5#863D*QfRTObEeN)N*O=r|Z1{(^FGA7{Csb0sP`F z6Wp`1s;GC85tRa58c?9tGl~WI)ImooL$ntE;{*$D}%==-##l08NUes z!@sDES}_Jh<<*a@td9FVil$v!@}zvN)u2~VuaT(tn*s6*&j!vqi=NqbBk}SrDLZPIyF?eHhkaePL&>vuXJhEYZ7{%ANHC8$AEWz8-h)VAfVkGf-0Ja7ntl=5$Zb`)W z{d@AB7Yy;68qwAt#V#<+Wr}ffeiyC0Pq(JCThmw49%@GW?F<1ON7Vd!C=Z@(M@zvy zwGK(?Yrd0ig36_GGJO2_k%nd)pjQBf{%L|fyn_gUyIu5R@W_JD=lHKM9{J&7a}o?D zX$A05dhq4bdBx980Yfo9KE9MFyV)vAVBZj*P$a`wAflvgT3J{a0=#T{SJ(W9^S$X| zARHba{=zSU!3a18mX|XL{|TIGt<;rJKA`Tfj-@T^d+-c}G}U}kJ#MNkUL3t|NjiX~>7)&9aIQdg{K=NC4h6W~O^>k01#7T)!}1${L$y9! z=`^c|tOx)e)W3fHiikiR8?s$&T5NO*){q7swJAVV1!$AXXrR2~3~q;2U^vr@Z=tD4 zXaS&JjV$J;EA&!RQ{&?2=I6)hHr1%pnf&+?0mo)4PoNK!!36N`j;5pC-NCD~gM*Pv zNxgEk5gosO7moDwYy%$hRdsdwHocI^i3yrV+6YN8TF+i}+KJqpoaA&rPjl=PJ~zgT z*XeTNB|d1M^|P{c02(WrTGEdB^FV%*7HNuVt1gW^Ji;w%HI3InOoOtbOe z`&Y^yD}O2^2{b8t{Cd2#zl&Pj);*TDPWRKLI8??!1-;K_R{w6&ZWd$7xHG`abL<;| zB<=TU5E9z`-4^9Ca^osBCx{@Odt69{44F5sK5cn5YQ}g?A3&=5;$!#j{|D}$K$!a8lTwB!@%Yq ziXvynaCQ2P1JYa!UJl#mHy(kDC8fnTJeFbXoa*7f{YBKd+^|wzum-p%MCPai3)hK? z0D`;*m)4&r37@%PU{FsZ50M1uuP#Lp`qkL8ZDk2B#KQD@!YOfTkg6IO5S67 zRL3)49=N}GtWXoj+$Uoj7ouw^sUx8~iECeSEB5+LXg^EmOD#cLh8!)mm^oPvua{ZY z+=yWfxhvmvMBxIonMZ*N|RoD=%jZd{1r--`Uv# zCJ!?R4>k*GBRH^##Gdi>^-b_53y+A{UuxkCB-^m#<58p;b7`Ni!e!EH1@2V^Jx)J0 z-?u%Pn3|5k{XfOsa1p)^8wMEAap6iCkAO%%;^vCP-!s<#68J25++VY7z<$eP+%Ts* z0+_X<#pZ5c`PnfvbO?Mq|A0x&pLzA+h7fBf@mGG%I0T(Xv2lzIU|XI?%blnsl)4se z{Ts`ja`Wo(qNr#oW!70K3V(s`@+gsIYPgAE#5V>n-yAGep3SU)oJ@xt`Tc$}Plda= zokvPIhRo}pU93$6o68gXSl``h@=EotU98b3p~J{n_1JtC>|uujQDg#Ci4to1a5Uww z$z;R_M)qH=N<+uKV%hY7gcR+a2Vqa7#B*~FXQ3i2)SSPOqh;~u}z+6;dI$1 zOwSbSU;Rz~vjn0Xt5%NYIY>5NI$D!^??7lq(WZYiBSBv7UvB=v7;Z-~tW%Y4Bj}m- z&TK&q>9+ayI&H?dw?#rzMf)$&iFWOKoU#Ka5P zqHn0FsmaJPfv#d1h*uUeHXuqTeBk8s5PA(95fp24aOtS zf#PM|1wc|8B$WVoc>_X)4oE1lBv<|=nXwqN>mCx0~>ATbvu0r+a-A zefhswBBI3rmPSaGBa+2vF-^zys7ANV^+9Ejw%|%@J+L{>W;4huZKlO#6m`%nN&@Si zSSi5PZ$HPn&*vZ!Ycu8HRL;L`ZA?R1jgiYdQeu|~323bY#l=lFC^17TriiuJJ*!t~ zjD~v396|N0ey~sR1+`siid~K>Hu07BJq!qOs>m5SiO}7*tYoKM#AtE8&E z->KwN+{b-Vq86H;ez|9kx??3MYOU`y_O+ zlhAB;M6*q{bRWqN^)Q_Jf5`XGVuPWkawU?qh#Q==(nk9)hPyArCL&1lVCL?BQpfRz zEK?&)b^nZZInqZDdeFCnHMNzL)D&+|bw*uZuc79qAapTwwP7`)zIW=ddhaREJc z9WG<|4U*gtBiL(7L0%~&YBPA7B$VslqH;_u4f`Arr2~Jp0vJ|shXK`wF`74F+gAeD;68#HwnlC@8$grxj-50kAJX zL8&1r8G6~_-H7>+$Cme!#l=!#9%8rH`k-DQ=j`m-h-(a=c&4YP$D2Meq0$7oJKxC# zJc72~6bn&0=Q}$9N+R{OuE_AHC{t-+`Y$VD9fW9byCsA{xELT)Mh&$o5BZB${)B2P zZgO}wGNM8C8&^}$vv#2A6H5!hlfH(~{yT3G^Bzt%7FA`X)-B&8ZRfmpDJiV3$TnX? zJ|p<(uF7~wx3J; z_nO%?QN76-dRC6@_5*4gm|DgX)=;8K4dHpqfz9!ffuXWoW6S0sNh%RPTG)Jfu8$y^ z&sWW%yDDMM($u%h5P`$R;2^UVzD& zzcz-iU{c%2TiK9s7>3^;4ca-@9DK zE$I1WKLVS#8v#ipptb?9Rpv1oKrIDIdqrRY^eY&|+`pa{h^2v-0E$FC=Umy^l5hcx zbfmBrT=u3|SbvTDgvJVa19M(Laj4-92?a*JZdK@-o%lO`k7t=j*9xFsVqy{!SZbw` z865F!#qlisj1;Mv%>E~9+s|z9pHnP5nHhUczq!k7L<2{DL&7vW3F78lN_YWTVm~7L)w%Tlhvlyt1zZ@7xoC5_ZHuWo{vwywVy*Um+5g?2-Np2bKbl)5xprKVQKNqziI zQeIvUp}!J~gmU%u$kaJLwrhKIsXmG=2=>99@BSpOG|8- zw^gzI_Yh4zO>@}8N+j|l1`#ts@$g~r=_KV~8}2oD*LS+ZeEOC}D}IuT_B5K_?=S;S zL|bvNaJ5j3@t|Ng# z-m#IHoZKS6k`I>I3{_xu>UttcB06XzlchrI+Rr1DOr7ilgK3hf94mAihw z#%T~E2igc`6dFs`$67}UMPAP9wB|19Cwjx#tGK{8SCF8b+NBmd7Fea_JFL3eUQarwKn9^(vdYDsFi)KVS>i3dIuk_{CpEN+_0YMGd|-z+kjqM)Y;g!fpx<<=+9DIDF7X zH{nA?7+2>ef|B}&Q;VU8ZPGm|5=Y*#P76SyTLLI7=~Xa;wAf&Eh(90 zM#=o*1>aQE0-SXMVh{r5&#NXag(^KkN}(U_k6Pg6@6YL4_Rhj?Ld)z=Mq$E4JffU^ zqaJ9>Ss$RsVFf9ZIF>e@(uhT0mEdU%>vF}0g`esb(P_Mb9^*aPU}9dHmUz$L9th=C zY9#O-iWYn(&hbZW-#qJc>`Fx?kkPReBQI{)3-gfFfC3V5_jfeo@$YT2f_HG->=72` zwT?78*w!JAY2I)^BN14GrJ^+}ygTmg)n0QU6R)sdvu^{-h#-n&i~flI(0@VTf=^MMYaO29Mcvxy~C@e0>`m+4f#+R_6NIdh1z{ z>{`G_84nMy3!|45z=&8F8;d2qeB!=PnuqlF_XB`PDPhWc*8f+d>liL()k8xxDqkB{xDo-t1&4Q4`hc zMdmBQXuwUw*>reks^}~hDZEEq{j;91--Yus>NwUw=v6qDw{6Cv(|~1qXm)u*9;K{=;E7~Agb3UNAqv!LXCSiTbpPua z_y~3kn4-58s3&ixN#(?=11bLY(Np>Az7;jkOW$EYl<=lJiLBv!($GSJzZYEAU(4ib zd;b}TXIGxL!eDPgw=)cjGCs*xq;bY4S$ z31-)aUtV5L=x-LtA|c#QRsrE%zN!tN3xtSx?x(QbzKq}=7~x&kqz4H-tofyVpuJ~V zKH0PhZ`tgaDneh4d`T=dHBEU)N_!@D2(0ZF78U@!H6XTuRBQ&K;F&jxfEYxzwHJU{ zE@1a6Rw;Y*)|!^A*xK4!1|6213^7_Et=_jsy z4QLGC0#+8!sd96tc)7XL+UyOM5FS8Hig&iCA8QAHrSs^Ft5t8C0EOP1bdz;Qkw`Bc zZf`>@`@9jj_f7!%>FJ<;8JScF^WFaseYC&}*+egT;n;N}tU@$Z#S!T?Zfs?Ue2Iq0>b^0}WM zyXRs)O!tlp-<55B7G$O_KEStl>?sS_M$m}8DOH^_HJh6QOEDmP7ngn+^0Y+Bgj{Md z`JLUMg>opR*rueU{2M}g1~RNZ6|SA{jKlQ&$R~*bg$8iqW;&EYnYOUFDEZRR$jEJf zCcCHzXaYW_#LH*!&-V2dcd6HnoTo=5F}`wbBy7?IT9zv7S=J`gSqi}kag|K|#Q5Ze znS>{_!rE+6D|7Rh*VX;9qI41Lf)D8{1U`=nAE*7&V~6C*&JpabP)_H)){SGPcW=72 z@~83xri)LzpX)9hBB&g|QY={b_>dQpOac~5z&R8!MxnnSCKCh3;z$OOT34tjxS#bO zzXx1m5fVz>5pdgo3_Juxfk5V!!J{gxT0=4RVZ#bL0E$9B9-hj6@9i(2(tz?1FlGm^ z-$X2iuR0Ibx}$e!YAykNLQqi9dasO$WDwP}$H&L{db=%q?x%+%KMQ7HZ%r|tkCHYN zVw^D)ScaT34Aha3Swlm^856~4|F8{E>zkYN z?2V;tYHB(^l*`4K+)`7?*KWBoT$gfr3vh-(g?ok zZb`O&E}D(*L+uAzR1qp`FVb4Au({H8lT>@|8bR&OdJR?IZZD~NrWY6e-^nh@*v1hmQ$Uwpi<6!egU zA4SQpe75_4J_KV#X$T=IvMF4sNIbLA2#QqrYqh2ceA1Xc_Y+l`Kr(BIeM9Ipw3%r? zGh{hp25n1tEXi|i>9x2T!C=0bF2ue`j<=<8Zs$~>4IeWm)kJm><#us}gG5M*)NQ*= zAMEus*naB=YYl`jCLuu_Hn%CsR{&#ly5*purOnQr&=n6HXp0)vvwWs?%TklbczHWD z73>b=;xB%IY#jQ1y%6n7(gv>*A1EWuG5gIhE^kn=-yFuyvNAgjKfiW;*M1LlB>ZGM?u4SlO)$EtU|;;=FiGuZkYzvKfBJm3Km zq`cZ+GGVxzKT6_Gn?F76Xma86GcK4W;p;wobHtN2hR=cU%M={8ty;EL0USokIPc|}IZ-tJ$6*a-)**-n=<*CqzgyRE zfIIJEF}1*j1dj2NQtI^h>DsBiPe0@Io0uGXfRTc$uC3*WU1V5Fc1|B*RB`s|JFY3n zyIyvse49uhC%Zg8@~Da;;fO|sW#4~Or33hiWnR(e4|g#!NnRKSWQ|~*L4{ECVnh&| z-||AwpE`%=a~}hbq2s}hYw|uttuk{{EA3xTRAW}x2eqQHEUD@6 zux$Sg928d$vUe;>$D!E`xuNZO(n$cYf-8dI>6J2D^}nhe82as3(U>2BoAz(NNQGAv zPSMy+{`=egT(de0UGy1s`^LDI*gnp+bsMB;;O>46oE8VV#7m;!F(9L&!oztEHbHH| zo&##WqUVxU9vyz+`tn&E**q=b;o;U-q*MZ)rk4j^YHF^d@RL?j^~60H^`nY9)80}B zdfW)&nXAW*hnssnKMScopAFBAnAueVEMWFDq89oX^(JvgJ8{n^5;VRQErhCGmcvDQ zd0dA2FMXN7H;$wyxuO+xJE2_h>Y8~!53f@q5a(fiVPVC{OKqJK{`FEJj#NG}8Xg2p z@7@n3C776P&G0QvEap_078WC<6x$Va9THX@ra6t^+Vgi?*y^-2<(o96iAU8+lplA2 zA)<$gs)>n?PT$@zp-!KIe8nj%>LhHeiuLK+H&wBv!zrpIh!d~_P(s1P3U796TS3sPlLXjMSDJ_R1k7s z33j2-4pOb3sXU)qidb_XGz_zdd92}_J7BFpL9PF6)vOjVRcFzwA&K~FtxsI&MWg>T ztl&gk7}WKBtZEE+C*>SmN?O_AfJT4v;8oZ84IAr#>tB$0HbCbB45Ggl7j!cQY#Je4 z_WYji^q82KTs5$3+(3&vmDjr{sf$+^>N6N6mBknTyJd~482q87NKol11WJtmt-jA7 z3CSf$&C4@E!!wEP`tc3``!P~2QQlz~9hE9cwK^wh>2`0)rM~cbQTCdIf|JuVe=4Ha z&n@(5oVqf47rNAf>S8K(*Q`Bbw`yBI?YfLxkK!fDZ(S`Sbl)od(3{JAiy0@6;W}r9 z5b;_qT*u>D7HF%~GE0d=?9;0vo&67cZyA+ko3;&OfQn+#ARvMuAYFoVcZYyyuu3xk(>?V?Or5#dLU?q1tA; znV6StkaePDg;agHQJOXUjE+l2NhfuUWF<28Q^#uG`>Q%JwSnmj!LXt}#D$o!bG6%_ zGkoUWy+R#7zZ%ywmNiugvlp)<%oJXk=_yDE==B7mt#qU5*5UKj4rJ7JS9??^xwyG1 zdb#p?{ytjz)9)9W^s?HaNiSdj!uTDI`cGvqJGC}OzHf6@=1==6b2yYRd+Ym76}4L6 z`4|d0>@3r7-v4dx_hgS6JMEqg5mql6Kfj>Ak{71WlA(_OlxQQuc>YMYi37+p9{&#{(c(Dly zX#nHO$Y_GoS?qqa4QpemVBLl`9{T#EM5vp!R98T#Y~X96W%qjfc3QVRB3w-h6o{~P zI3`1TGfucvfd?EPPx_Y~}uefq~pUmWvq-Z!GL?Zsi+Q{U-HE z0(pYPHP|ikyPNc@1u3yp<=w=p8TLgifz7wP))AWqRnIq$g0J%XiFk>VFIqk^_N%~e zIl-&`qlcF~$-`lwmmCF06Dk-UwX>Z2i>0|~p+(hVS#qqIveein|2UZ%VwyUtwZCIi zC+xUJ=eLX6x#IDZ=>dRn()T-Zp)0okm}y!b_v!11>zI4HWPc~M3E@J#mi0 z=hcW#L5hZV#A@T8wJN;U+iEPZ_6ZoKYc!`_Gp4$5rJV_utaWQgl)QR5YJ3(dZ+66V zuxfucEP564$9uGS$JDy7mnk-lqt0t{{=w*cz^?PsLih$F&(%BnQl;T)c6sjUr??;K z+K75aTiXer5G1n}fBV+(`_ze5i>}|^(u*jW#qijEmf3JcX{Ec=k7K)X_xrKx$#DKe z`H~c07kd$g9EXr!K%UU^k zRm@`+VZZ@4OgW`oqZy~-W9r+NadIkybBoQ;ug=C$L72FMgM;yC|N?2KZEE0)SiFOA) zCjR8gsr6Lm_auQ;fs;FT?oe~RoJ<$Do962^Z!-$oz_jak-T!85XBu%KyO0nNpTt1Q zMCb1=5C;*okgW6thx3YJd+E{4hG!Qw*0UO66&$mRsI@txIb+xHq~`}WtRw6H4y8p( zYN|&M4^w{!@Ua|k*X(lHwMR#(@6BdJpGC!%1RSW_8tZc8FXeslj!CUM9q>yYz){Oq zioln{p!IINC)XbBwo11*klsME+ov9-o%!u_BsXde=lp4ip93*M)mTh$-@7Kz_+#&= ztDWk;21p5u_@s$VUv z89+VQdyG5J$wPv3YhdIqyMl?3$~V?!#_{B|>xvce$ zEXTVs#d^usa{9ObezCV|%31hdXoirzL);s93#6xWK#ph{@IG87SiVN_7!&hm(Kbtx zXjR-)Z-Jund(@CfuVvVzKL2w7Q^`I5c?*x#-y=rxU-LCfbAA0W?_*^SC_es^id&TTC+PqWo?3D}8CDJ03?H#{rYO z^CwmWPUGV_xyRw!Lb<_FCTY>pst3ZP*@U;(yH=HEiZkW%im$A;b5bbEI}Oh|WE?HA zG!0U78in(zw!Cp5260b?B;gH=mSHw>5t!DPve3)$?#?a08u&^P)WUzulk&koZ)%TY zj8;_D%o<*taqi@9RMkrR4N>*Pds^u)6-KHD5;<{xIuEKVycq4~{Vu%a`0^H0pHtWN zd^>8&o|5v=iIB|?EJ%_)j}ZVc0m2ORtLxUE_>o=z`bX#3d4o83xL`ZN8}beDJ1xV@ zo&MvxXpkXGdKjI<32pi@aqwgy=E8Ax9H%&MyAR!#ZY9bSZq zuZOrS!w1`s#f^V}u5|74%M&?(voFh#Ja<}p zV@0fPQk_eaY#C6UOlEtq*AN(5KoYcHP2_Y@Uz(2RyuL5WTXX+tt_`soOo6fQVmG@* zn}0*x?Eq)(B0BfCXB;Vo@9iD;70Jy;OAF0wFh}VroiL*C&=pP91{~)>hTAI*`784b zt^wM+bHwt;rBdcdS6T<{HhEV}?N$bd=#zX>*S>if4OOmjB0i{0s#AZTot*ymE+$<( z$tM#Fc#(c>WT5Z%X;?0uf|t{*F;3MAjs5O1!$dlMBp%%Zw5S*p3S(imCsePyHqa-r zqAG`O_i~?rC-&3py$q*!Ri~L2+8S2ptJU|epaL(6n3Qe%d~LhGZnbXVA|{b0OpK zc=sUxI~MLw&U{@`d@pP{mT-D`3g;uUk`C=tnNGP%T=%wmtAZcFKiD}=ssC~J79wYN zwwwHMgTj>p*tnJAV|6qXZ4b9*2*<|QgB%t?|pqLOL(VY(x=Y0oU)gn zePI0uZi3aSLl!`DjzPx*UssCR#BDfYIbC*{_Rh`A+=8K0;E~H*^bqBmIjf@md3$wq z71$N|X9Cxuc?noO=2g;ve>2Afce9q1lYw4;vD5?msmU!iqWmJ)?Cq5wGD;e}NT=E^ zp&54%TorXJMJ;xt?_)FR!PH%2`6o~26dxZnG>IyVQ}#=&u1ThuaK(7>scr^JOK%*0 z>z*!GnS7DnP2_mKd`B@SPd_X7ycdUZY=?Glpey z@x|)X&nK#K)%@!vngUTM#di@Q4<_6tmN~3^)y?AV;sYK2XSU-(g2XM^MBBbo%G)+#5+)Vs!=SuPG4!RJQZ+MyglIkHS@1fI>>(?y1 z&W05qx3s)`20#Pe5y`^7HBzRpX3W&D#b7avRsV)3*OA6$iuqs-^rK#yLYr&JQx~r? zvTOhAwksQ8|*i&vv#2m^0K=R7J#r zm*I+EDhdSYUeK?f&tJ_M4ywF&R1AAPm7P21v@T-%$@xcu8!`p)L+(;R)=pk<$x{Ae z0(DHNX8umC<67Koue}?mR)Ma$$+xA6TKbsV@vhT6Nu+Bfp37_V+Ewp!ipU-r_pv@c z;(|5Bw(k_>-VqTFXt;sk; z-*%>eafAK22zs0=?U%Dw-=)2AJ_g1#Z_L1(PlPO-X@XR$C7O7ZFp?te@@OkmnQ1n8 zyh*h^e*e6U?)~ue+3nSz1L|*+7lZTG6a=bj7Pi(tI)Ag#lpFK=cJ|CkAG!X(HI#tc z!3=FKal50wAecSaxGyF_sowp*~rYMmn^mLjrzrw2c9~~?GqgC5C@^wvQNQa+APx_Tb760Iv8Yvg**74cR{cK$E zdz~eh;IulFzaTHU>cjh1Ev2ZaZ)nI#Xt6GtmR2msP`^uQqAz$j`$|8m(DA?zI{YwW>0#I!Qcm%>Cuy z6k`{|z<^oAzW*TQv)(|>_-O@q{#o-CpdEwy@NS9z;}|VPRgE7RDnI09#10EziG|rz z3uP$yQkk!jTl7)|?Oqv3W+R(-7Fy@a`T8PVX#KeUG4AR4+~c;M&oR6@^h@l~t`xXw z=XY_tZWiJ);GE)iUEd}Xit^GenYs(O0X_|j(j^?3YTGx#+vb$^mG5t_z{2da-gNQNN4=LQ^5b?3?~E)VU7E*F zWtIHDOSt5uJgj@j&quK@`MzH+^f9uKox{=3r(*&j;4J2S7mH+t zQ{kh+Fj|;`TaT4|U{;a>GNXTBpkdkB;uq>3%pRU@yYVtE?aFEe#eloVcXM80sw$3* zS1ks(uuh@7;fV24HgtH*I}KY;=Ol`?GFq!iFHd&djk%_7$-$8DT-kp2X=m^1$F4Gd z>o~mE&)arZ-rswt=9uU5E~-yj6@68Qmnw)D|Ni~H+^id@r_Nidm45ldqnM~I-p&?D z+b0b?&dqf9+Pr>V->&!a!8?+F*~ftRa8S-Y$UmI5FOeBOG#V+A&fBrsP3!4Zlt{6Z zOcYq}bL!rCyjxx=eMIMy*xG%4FY8xNy;YbIMSk&*`hh2=+;8Qo)ci3Q<2-Y;4^vqp z5f4RH5w{C@QHfE9A_IddT!Cy)HRW|4>9vuEIF0&=KQz)6p2^2)+O`K>alDmZzy3D- za==>#?aEsOOb@B3eCaO-3wmV0h?KQ_=(-^RVp8(JJb9iIBXOH0SUMDsfJRs9=JxhZ zUvWRF_{7v4PerqutPF~-`MkC)YWvfvdL>!Xq_L8JnXRA%jxsqdZNTr)zk-}@t$Uma zc}K1n@aXf=u-JU_)EU>u)-!UIg71W5W>sO@?ci|9Ir#r-N;Il%^u3lEjLu%S?mw73%N;zk>82*a~XQo;BZQJZl(#x+mbtsPaY}Oe$y~8;= z_$$O|ZLmK#br_xVSL|@fI{uU+L441mjq$Kcw%WjVU;wUsa8rSEl*3}h14EL3< zjJ1ab5EXV8nov#~2ns~-Z1(CUzo|@7qeWw8u{O&1MB_!1>DzqD>7L5}&;-!?ozyb% zaEQ3&35a`KTdIBjI{2b+_9+Jk$6Q)alsN+Nn3D1f-8pKmcA0ILQ9I3|Cx6^Rb*ejT zNKQXDAW3Rl3mjk0#y4-8%DNH1E`PXkZ#FsSZMn1M0KZ8o-;ZJPgXo0s(s3f@$Jk>v8H|J`cZq~Y4&jj7*Z@E)vH!^Y2mE+$M^C<==~_N*0z|abWi>KO08@d zPDA^Cm?{yM<5F5Mh5E))I#*%)^yFgaC(qY0%aW_~)J{bCLvh@0uj)3uPDl3&>%_1& z$|c;=Ha@rRWFa~ddDLpvyOZk9;MOhLCUVnZk?>D^FWMY<%3A=&M&-Km##_F(wp6R#xk$r|wQ9$){o2 zz~S{KMl$1NRp2@v8VLz`_cjN6k0akdWR#d~4$V5V8LJ*`YRW(&-%l2KqMpn4&h~E1 z3jM~|DM|n*vDQSES0(q#Axj&7>?v!NT`;2YH`|B zSelxaIIY`pg}kdi)!?ddoOHW&yu*mg6^E{g{dAa7yF$RC$a3>tjhh<{%~V8;^7@#v zar3rdAm_nw-)gT`Z?<^(_mzgk@Myw<&)Zu+t`H!ue3!U{ws(ob3Wp%a;Sxo(fEmLv z^p7(Qeiz&Aj4h#LHiJ1iQTOlNW42%D0C%rX1BnAs^j4^ANqJ^*WuKSnHK_+DGsVZ3 zAudMhddMHP-R1)}Qhy2X?9@4t!l9(Rn%`cLV|g1MhJEMpI{&17cJ85y7^Ry`yi9@> zZ>h4);G=!OY*bcIP|#mmV*bJ`5#d`_1`RdLiK}dRQ3(+T7dKzG%6fk~u_pSp?sF0D zO8HE`<7BTkrx?YA6jpps`{PJdS~7HY z6x!yp{VmcgO4uAs?7T8Sq=qM@VXv#q>`}RBpW+&)cv|uTqMI zL&X@8T%z#ImTj>;IIdS!Za(bu+Um-k6pXwlNh|cvt9GWlqi{GKR?P>C)%^qPu6jkA zn6fC5O!*SoyV|M9|J;9spRs)x*T;&tN*MR|3FK1L93IF^S}H1y1$RlRodX2@F5xLf^3F5=AR?Rl`X4zTrQ*ab>dQx=30=xKHe^zx6hn;8 zj#~?z2}In$b%HP`<>j?+m@7YXLJ$PJq&GtWWQGS|bXUmjL zE~s)?Msc5#`D8y<4K^Beed5BVlEab6fhi7jKiNA~Q3R+vyA)sNxi|KuE3wetHS!Uk z>hIID7F~1fg@};-V$GUz8z0gp z?2TQ>jE|TnU0<=`_fXY{%aTzwR6Ld^Z69xx*YFfAF9^hEkns;SB_7~L-AXH50z~?E ziHw_I?}Ckuoempik}pn8`;d}v-@bix^cFjQ6==JzE-to*VNqo(YwBn*?KQ4@EAsqj zBG~j-uDpYcO+`r=X7mx#<-r{l|E zJ2sYJxIZ!Me6uR{W26wX2xLWG>Uqcdn^|G335i()BVQ{1VtTi0%RX5fD%9jS8ZY<$<7}+;D3ucosVndyI*544r0@rh`&|7IFU%gTak9$vqk?6IG_w`Tdpp05rB6wl+&|pth04l45Up;se1zT}oX9p-%6x-S`l`}g8vi@SN0%psV5)RS>ee$l@YT-Q;?jtVF#i7kzd zfV)fAS>TfyPl-$3+1(h;u;@N#{fITls`@FH?sE$Jebe97`ch|;I9#c@m|d7fAEl&} zTg=VndhP0Fi4K4J4EJYoh|4|w%3ZWk((r~k(nwrxUglHx^7D=~^@E<3JK;JryQGcb zbw;M@ii$rtvK>)jc8vDFvUbiJog9#Aptwk}pmG3uT8{`PGxOKwgBytZq`0__dn<#$ znsiC1M3^bGFC6flcI37FI1 zzd7iDLV_!}z-|x}$nGcW<-ibsT(SByoFZqGEz&e|V~vy_Xll`_w;Sa7##gZIIl1Tx zzWA#|9grC!D~`A>Z6HEoV2pk+75SzM!*jE`CnQVyr+Lqv|NSWW3hsvsF1im9{;k+%v{&>)*3@ z@#Jwuucmjk%!T4k)j`ktae3wg)2TMuRk`PKy;@bS(fTql_I22;$lIs8qdnnz_TyJ; zG1u(k&){TU8J#^$ao-BTVi?gyspLD)t}|!?;|)+EkvRlg zx=y)uVq&7Uo}M0PpRJzfXJ<>u$$1{{(sTwxVa;zj@?{#x6$jJMkeh|4ryHu_ZHk{G zB4ldCeQ<8%b6(3FEesD=gcfJ9Ga)7-q8_Jj=E-G{;PUeF7HU_C1ye4LF*JgTr{HD9 zHi&rq{r$lb!6Z*!#*MSjYJ|T0UYOT#S!iNUXfg``863;u>Ef+=aaKP1@+poff9g929bZj*K6i8U%1I+gN&E7peY!@~ z?^ge0E{kED0N*IGBE`?3j?aFGDbS9{ejX!eqfgajEFjn@39mfas`?j;-pEqQcLBPa z00hL`3e`=pGRk-+mq6Pd@+ot&#*gtr?&)L3$02r$b({s$0w!G?8IU3W?Vc>B6&112 z(0rim?CJRe(S*(LXgMqSr`&Ryva)iz%jT}RSTIor$mgl4hv7tms_9R0H(xp?jY1dNT1IdCcJ z7s!tU_U2i9dlD&BQifCeA)Onlzm~%Xz{BvrTk`t!@K2=s5>a}4=xO9=9g~U#J53Qn z9g^K;3J?o=xVmx|8k04^usS>}?2FkC@7~1cCv{$W;0l$Z1s^(2bfTKF@07mMO`0j-R0kl7r8%7xNre9TnxM6hwb$X-sLM}Vq1dCfz zXkvpSY)U?KH!lzy=LRcukl2DXxvr8PW^}}b!R*V?E5oiJJjfX8E#aTEWH9Q>^*{@piB{$+)2v5|Q968kGle2r+i z#HzNu-Ss@a%#&&Ds)LBt0&e8u8)n|)+nWO!S-&^y?!+wfT5aP<2U?MCIFqccvp0u~ zSGmbc(s{)YU7|ooD}i4n_%cN_gC0_VfJGkDmqI)Qkc`9yAvOvk5D9^92%eQ_{~`2T zhbJfEVq&OD*S)!^NpY&BrKO=^w%+Ha8kh}gmSlrVZAmn+4`lapm{?gOCrcgrrh*+x z8~jT-TUK<|mD8(L|MD|hNxX|w2mvbS5tu-9j*iA*1{&PI!ah6VpV=(=BqLMP z$SXix;FOkr&P|(J+I{cedon?*pVH7twDJSvpAF1;fkNItummO3<8Bp2MRIWxURSox zT`^EYfl~VM;|vgFIW6_PUFj*6f8+}NC|EWr4asxlSo4lmg$F!FrBe5blj}2^V~?c) zJfhZkR9-|oI1?^E-Nf!NV3Y0Xo5xvRv^|usg)Hn)!#Ts52N5|l~~#FiOX%~fhqzGZR|o)L{O!{HC_1Hoyl6q)ry0iFENbM)h^gg z)Q@-`F+JRx$mzFx&~&bOyxl+*M8tJmQGO618hCqc`T}a-hHG~)uAxVR{L`hz^UO71 zffDR0wNBcD|GhoHVH1EqLsL`J$Y>4}!Hn9KC7`B+VzT=amom(1w6(RBmFC;CuBzF+@(aCef;7_&Z;dPmIR3QWDQbM`qy>lYu(az$vt5?H9`oG*vBqP>C`1> zl_MhYJCp0&h6{!~U*Z3cbB3MDMJ+3W;Fju{i+rnLM3rq>QwDw2-#Xz{C0P(BpmXwk zh^A8q-oBcON>6S;b^T{?MkNx`h2y$~k2_L!_V!j*R;^aCZF6yyCCJiK-of_;n7Q&^ zlI4K=0tV;yyYU9d@>!U{3TW%kpSZkqik@De?bf>P1&o$q{Pl+ug?#uh`o+2?=$7eH zeK2L(nsU`(PJ&R~*4C>sV@JWP2iSx;sa&F}ZWR;R%U;gwdn{}vDJgoXUDc=6JS&mA zB_-geWw+T8)UoGlF_f<%J=H~8`#+l#G@^g9xWClzG9Mis)t5_tFmC_o^7=I;H8qs{ zP%P%=n)wI$`#&yoglV>?OU&?!eh@5oXq;~TB1xaDaN9H#4?$8s?o3Ku-FpplYaYudO<2T8Dds9H|z9%TpnWgc^FKdfpcn- zgGNM$aLl}{3t3KG4a|X8l}ON8~h|vpyOl1VGj2e+-k!F-ZeuKhN^HhOA&MJt2l}>lX^{5&`@cTfr?2XuhW_}IJXFY9R~xYa&}g(q zI(*>b=I%q6279h+iE+iE3wLH`SG;dl1RwH z<+tH>R9(qAyn*l>6z+tD7rdyb1n>p$G3S*&VO7P}`ib9b%dFQdZ_5yH)+XnU^<28* zcZ)#c$WT0#g}3$ZH>h}znAk#JKNX1-DU`^POEfYz-rL;;3ESu({ci}?pp9D-inO(} zJ3gqp;PpCpFZvBNf;*sE;5}|K%pM5>-M!Ue=hdO$g%(RiohbkaPWIRH($gClcKEN> z8Z-r<{6{t>6J%oP(SKtArfb022Q@p$GkVaadv@Q@AP;I?b{0@wt%`&?p7QnUP|9Nc zQ!zxKYyJj2jft+Yv$JdLeQpAgIyej`^LyzmHdNLlv$8hFN~I6o94x4@u&{EKr%lD7 zPyB_gq@v;gb`i_US&r+c2awLEMAa$|ej>I9b-0ZVpDdijt-J@0P;e02RLOF;uGhut zFo00!ZnGE^3#%^6My-y?01`my2kHL3pCA5~d@`?j9+XUvAd|j5-MKj5yr_lkif^x6 z%gxJEPD%+Ur=)zJKOke4dpsYb3zNRD?XnAyk#R=gl!XKaK7YOSYcbi2&vJwb050;Z zj5y|X*%v|bpPv1JO?$xv%--5v?Kf}UR902ZFn4G(s^fyO8RkRqo(X>BMA6yNfyDQ( zaH>68NO*Z(ij9NAruY3#H{VH68^Zj@0P>*i%^NgRQ&ZPMquhH?6FG#N7#a1v612E- zArE-I4TC=HWFMWIJ3KsG<>yAsg-}@O z{d$m@)l4@?{NP`N$pBmGS}zQB@a^sFvfrEdv1Oftl=H!Z2WC{_ZBmXOL86=X&3ury z(mi%jkBsNFfDfp4U4fJZk;lxE3(!L)yP~S9DsYxtF9s75u$lvf8=HZGY`m`Z$d|Xi zu9X;|T$U#8V-h++O46@Kx)_x4Q5Y|Lh7}bhQqIeLbm|2?Pb1rwUz9Aulmgt6dOhE7 zu5$EB_m=zpKw5=B zbJ?DggdcaYlYG(RgK}N$jAef39%0@$e^KalW&z!43CihRat~oAq|Plk{8T##h4$Rx zKivWy)Mu^o5Dcs_+~|Ih@Q^_eR)}! zQR0WPh-XvVB4!|kDvS;7pG8EDQX~x{V^(h%l@(jL;dxGkcCXCODl@4S=z0Os1fePR zD2(cQi7{pkW#5DI(ruD>9A0*I*gEPM8Q$CYhv>@5zOu5K;@nT&vZ}_Ce7XBmHO0Ih z3*c3&&Zw@pPibJ_OWTJEeBaz;y5Ei58DyQ{FA2K9K2dU$b zgkOApF|b5VS$~l;^}#qe(v-y#(k!&lU|DHr$0F;WlLPi`)RP$p52dB0i3s9K1%hBM z<71#D6cok4OeFmCINPYf7t2Ak-$x#dZydto6B1yCC9SR=Q(#R*C_#i$1Sdp>_hpFV zGa7$0pJ+4pnr2sl4OT@gzi)#t+ztj#N<= zB~4Ln!IlhJa3+HNg(rEF`k$!7kum z2`t8#H|XhE#H5skuU+#?Nl5{J(MWHI6r(LI)W8ejNR^~sW}vZ66qD+IIYzF*935%e z_q5pUU}M0t&!kxbVW0bJdAW7snekl$1i&W`oq(=o2}1$( z!KA!H^Pw2T&ia?imR=vOybYg%2}~&eIoMvN=V?LT0JAX%MP)8RnqV}xXJOt+&z-wq zPSAXnHmekFZcun1x|~g;!~AVR?kKfza|i}~X2SOMs1xSjo3F)5WOSR1Z*5^g%q6#B z!T{xl@_~UqBAgGLsaPJ|Zh`g|7+t^x*7ewn&dH%MM3w|NHI-<<`S_2Q@omPg!YDN( zBV(w_2_c*KG2&BwSs`BB@-p0yqN&=3;c>UV*I44$#GUXByr+!yk-w6Ki#dth5M_-F zUbkqTh>pFvbR{c^%<^m>v27KaD zJJRqxx7((Tryz17?tojS0p8@~B-|w$();(ZSJ{->7y z;lc1kFSv9}T?H?dvNTx&Gt3i+H%wwuR(!U<8v$XOhAzEgE7d~@y^YBY&EP5|d>PB) zv&XluiX9L1D?>{Ujc{pE(aJ={4xCVU{gQAupqxUczr(;8LS?xgQ~ zV}G=5+@>H4_h2jl<0>X8cffZE#4Y`@`xO70(Y};X`hbx(Gmq=xtEl5G$n{^=^F(#5 z3uc3fT?1p*roI*z2CQTRI<0;DuSd@+6ps)2fSislkfyb>^YPB^{yx>sNkB?2{?u*z zX^8gI#IJaRny_n{-c} zDEJ({f6pDvMnxqiF7DR`WYb!s*8Ap6UttfpmzP(wgd~Lpzd0RKANZSzstMcA-zMRP zXO2AzK%9~fNR@oq5>jF*bu*f8R$lhMiApX@QvTsnds|z(yQctSAta~~4t9113^FWA z{QPxbCtfxqYEd%`uQefKa9A&lNxboV*@1t2T*gC z&+C_vBw3dFT3VXHQ&StmsO!12Ad5xeu|0QVXHZ=F<5O}Ha3Mu{6zJ9^QGJ7_Y-NX< zRc%J3eS#Pbpw$2+;0*D;Wg`-;mVgOMTI7WMdY8@?NeUBMh|5b03u-5sbca!>1e&H^ zEf%kO=7xk6lhFh{elL>{Bcb-sYquZhd4{q*dlt*^stt%69|}H0umNA6ui~MkY(!5X zV67Bt6#I@6j}ob-|7jT>j-l--y=Z{}3@B!xP=)H*W=W=1j?-#PWERb855~&<1oaav z8O*fw^qq~3@AqXW?gwM2BsV{x_1gM%N%HABo*3qv_x+hcB_8!7iENNN8wJLe*VcF} zw|*fasT1O2b-t83RyvM1oE22%CCp--^tZ@cPM29tedYp2jNA6%4Fqjf+~Hpt^zMz+ z)KoTSaEwb)M?#5dXJ19+K14wUwB07j9dbYA z0EJ|H`R)76tA*}l`FYB06B84UHKmKvQ4)BR&sRX4@S;T5fLj>y?%kCSPj(ub z0K^7TbCuTx-~6&r<~CHr3M73(yu39q0)sm|2iXV8Tu|rdWo0b_n1*%h*3}CI(fiT~ zJ!X+fN!B(t@`m-miK0OnJE><>R2)Hlu$%^78(Wa0mKm+&uGHh}x(kMgC-nOZJ}wyq z6AN%A={UVR0Dv4lJw2k_p=RgKBM=$=Rlu(3@5!Oo92ulg0qgR?m#=Z0&Kuu)4KeNz zNFWY-^eKFE?vSxW^^GW|n^<)7xNqI95tI@-(MJlrS5V>iJdI`hHCAfDmJoDtsJ;vy zW;Tn97NVntPU2j7defEb!fw~E zUr#CRcpr_T%EpVFAUhG>()PyjkBV0hnV#dUk^L3k{U;^(nc2E}L~PGbkKFdx$Y%@7lQQjr82yfXq~8W@a{W&+S8I+1km;i6@ggTd$Aj zZgf^7%Hk6ur3Xi_8Zm*$*Q53}oI}cuwGYHa*wk{TTMbaCIxJ1sUBFF3fqwwUO1ID6 z`a6|k3dl;tR=EG@0fX#QmI{n5~R_)td)?Jhrj91ShS z19j%n9(w-u0fCdNaMsZTPXGGAoBbQ8&%ZhR>jP-(sCh3M+Mg?^51@@v|MmIbaHrsZ zmB|0^5B%RpiaKTgduUMC>i-AVq9kl$;-w7)ihBthRwzEp2s)ZTq@mt9}P`b53ngz zE+mHRrFq>D2{@i{%q6s6WN*45gTD0k_J%m}h6B=W2{;_13A~3uWX6E{#Q0yIfOzy! z2)=|3AO1DP3Nj--Dq`IwhcAi03IE!|@dkb`R7~?neS^-wayRjJ3BjAFAO^HooHq-9 zWqF`trud-3+#~n~0``BUR}9o|jtXS=;7d{}Q2%Omg@DEk_1)iGhcD@QiTd@*F8#my z>pfBwgNi&ZCPq9CycIx-&<0d=Mc;EJK5FVk;Ppn)K;g;2kSPOmVC8%mYrqUL7Y7B!I~J8l zC(+Jyo>ITo9_u))98H)S8ZU{M31{*;h?PhXj?qWn`;_=lcpjF&bs+jk&G@5I_wPof z7Gv|tnpml+;YFrm#hF}}i#%spPsQlz%^~`+OG<8*|BEedQptCSB}DvaClSn^OaGxk2}%6(vnoI>>u%tJ3&W(I}%t=qRrIV?vYy&~xIf&cRG zM6=W!cRg8V4aOpXk@ffYcXsB(p@WGE$;h$L`6$oQT zUmRSV>nbVTUr!#hpKZpv-vxDO_)26wFbnCmE2Cuk+S;Umj1+?Xvm05TfmB5ODiG%D_DF1Rvyf=wcMYDiHQmKCjFy=2lq<@gWq85_mrN# zl{8Bxt}k8uPG22-xL;Dyt-87z49clt#IlkMGoQZYFgztOY3acD{Jgy9jw>o{FRPqn zfph_+nAX-0h&zeiKoKmBbOqI?XCOXf<}DIqKpdg`hTS@c-CpO=fKNx1CZSJN>v zhVlfrwH|Ct*U9f-<%;dK9)o{oA1ez$$tbFAfeX!r@o;< z(ib2jfc^o260ws=P`H^xSTYXHEII~;l0^=SpxZ-rke~1vgC`=)2y(DsQwm@U>?aHP zTG0KLq$VdP=jG8^Nu0aPx8ZUdzzB7a8kdrv2l`S#m6qIdMkzm)T-%mkxthCwyk}v4 zXT2=tOPFQYigG*2g9l5mO0>93;jAgJo8L0d_KHweGP^*A0DL&0x$SQO*Lv53oT>rc$}WCcK?~YeaL+wAS_rCjVdQ$=gM z{qLdVzA#vZ@dZtgCnio#R6cXwcxh|PteT>YqLbYQ$(77;6(F34hp$bv+}zyC_9rSJ z2&I&9J%7HqxX5bJ$_ik(nUN9By?bBbeu58h<|lG4E|=akQP>z2#SiDb7<;S^m?U74 zdF37KB1gxCAVgiS@^E)|7oc-IZ0v^5xLh#Q0V$|=F`59tC;yrSA?HCNeEe z$Pwr~k|X=TVuxh}5V;~%_m}%k!Sp)l;P~VOc>TM8q=1m5;=Ncr=*v(=Z40%&AKQ6i0#H z+$T+&)#gxCLVxk*DKZB&>d4Qhp9fs0(s5PHkc4mz_S^Vk5mNzfWo6Ylak96)jY9oF z)`2n~O{@TL8xGNmz}v5Zc;e#XE3dX+{a=qR4MH_IOQ4kpJXV1T$ZpUG=^x|TwaAo+ zF_`?>0@1Yzh)S-nUx(?O@Ak_BWg*)A=Rxhs#`EnCNZCb#ENq#4R_EY@%LlNI6UxeY z>;mv^a{`*UEf|WA_?Vk%nRGi`-xlM3P%KgP`0E2eB~cjYrwF0PGO{){n=op(1PMtA zJt0c4L}}BJ3oKc?_PUGn1g@OeSOS3T0LxJ#CSq4ovgorMyAub=8)wNuLIFWfNQ2l4 zCgzMySMY);l!vmxe|(zw;XbzrR0T<6==U%GM?itZ24SgwqtQKd6{fd96{KP6gJC1k zXFg%JuKv^`At3>l1@Yax-#;5aBzzA3m2fa3BO`M>0n;Z$HwGlI0pLU$Wfc_>oyFh3 zl^P@*9Ub9mkNRkaaYt|}4S#LFI6+0?4`gxlRWD^x1q3-oB9m>}uOE6v-{9~lv&O#T zbKAH483qZOJSaSg&m%skSs?47B@$U%f2R#ECh8UmhYaN1?Vxb5CT7a>2iOqn!Lu*X zwLhLwQ~OzJY;`c9{r=CuW^Zp#LXtR^Ed5y@i3~@+FiJ(bfCIhJOTg^CO+6sg{A2>R zToyzh<(R&$?H^#8NHDfa$6<;9DFckcM|>{M3d_QQKtEmS7^s~s3X5w_Pp zS|!|emu&z17UjkakBG2?`Fr0sFnCIvd6k|&ukt)Q?o}N5zea!97m4&XGF!7_XAg>c zxe7@|MM$X}<~NRxdjOwZ-w=ZzF9%S1N${;L$j|fh^T0e-1QT++F4*~$|FR-NJG&hW zu*$-fZq~u6U1<2^C?qCj@(t$AfYgF-lN9ihgoPWXrfP$_!AY9_>CR zb%pr*XP;Fx5{XF-<$nHL4TTx(A+v)O$Z(FPzuCUikWPpk2C1R-cv(JFH87#r{__Xu z7*KBL)82(=2}9B~?)J$LrCnhZo6>sL3 zAE2gCaMpG>4N|Y5q;f{XQHA{y!0$Y6+RcQ3xD!A;@=(uhZd>09_W13y9~2F2yC z9PNkX{}DqgUD`havK+birG0RKsSn;>cs(!$nFFEl0+t+Qw!XeTrQ2me*FV2~fZSD~ z3qu^3Rs&b1Au1*+3bln-B~pX(ydqpoRMZhj;?Nc#MOc`Eojv-< z>2c=e1_&LXCSqY>rP0;YJccoYnS}*w9sz{oGl(^Pql&d<;Q;U2J$tb5k&zGqL#$Tq z!?12yB>vFQQ|L=c-~iIy0s_+A-Q7wz?>_U4-{&{a%zIsP`OoON z@B0%w)?RyUoeaQXSuN*LlLqlXY5f2%T%B$y)R(d z);O@A;&Yz(paQ=ylCFMa1pMh(cek{pB+wdd78e&`PoOFzA}L8jNtt}}Y0A6_xW2ff zns#MKoqX0dHzhNefe52qsE54W?GYoXDJf7N={bjxPFU5SkRyB>DvNK| zpnqjKeV=DrWU>;P&B0NDThRww2u&erK|z?r!|mpQdfVn6H~EYWVIoi5n~0-?`ydUE zFikIpplA(rc%e&z+I~J#G75utQ1l}b^oH^jE3mEL4ATic;Y~>fnQXc+Rf5%@-@b7! zc3=8L_>Uk487)9Jh;!ElT=z7|1RO-4e&_Rtks%>-%gbe^W6W@EAs|UhOJmrhq@Y;e z*jTYfI`K`4vMyx}jm@PceHcHm0Au3BwRm~o$5dASJSX?8aug7SmYum#o&}<5Af!al zXm)0u(>&8McvGm|grTjiO+XL>J&$=Qr$V1r%8F~Qel07DEGlojA)Ov5>GO23u5K2p z1a*(Dx-4!`8&LS$&o|Z`sJG-pTpfLW_={&ALPQuJ;=UF7$G-$9qQMR@I+ODn1+~3{ z1M~(yufa$Amk2ksZGrjc6^a+VUxqRvBsnBEz62H2|BaYotXKN4ewsj?huqF(mJ6+e zCpP$(qObkq@4-fQ_weJt}2+i)Kb z&mJNwpaX7S%9=#+P&HnuPHadU*bM`T)Raf5G|KqMfrp`o9FMG(_4K2qYUkb?p(s9C!W%8#Vi@4le$IC1bxnKtgp`Zn6 zH?Tn>i?5=tLXr;!ofi~hzE532ehS%J%wis2UF`}Ec7JQC%bCwaPj353Wh2+E-vNR3#R?q+p}&OUO@#`^xxB-UeFwYLyU3}jk1yiZA(A| z?jIQVGZ2OjM34pwQ3#d_E&#%gB$z&!9iuGva&3D0h1XFVZH>LXy|jpo3?}|G1iBCo z0mfkX1*Q}67?2jVwzr!!`r$*9)8l&QgH1xW8=OEwHX6@(2DUCZIE1|CAu`2}u7BjoGuD-b%0d%^=QPM3Hf$VqmFMI5lRumJT=;DW>A>){$% zKw-XDeU;tz$n9chXD68tf(U_EY2-9f79JLcRTW_cgaoozZKDeq!G=Sl*4+GXWi1wJkR8zr zFy8#REG=y=oW_u*?b5|W=uF*jra9emEB4<7PB9QB*I!Z_5s;&E16}b$-rKeNJ`0MEDLDDk!kUa3tKf;w~1AgA#>1Q8^nEZ;8lH3<>Lv{*1-%wef ze#?poolk!ZGYVGyg525K`Wnn?Uwv{uE(gXqVdnl+daI>~{L(GOwz?_E$3Y5_; z$Pz0uf}|GaHpDVw-l-BoMxKR*Sm(?nhVyU_p;x)qZsXtHfQN^Ng@vV-HWlTo7IN?- z1YC$O?L_IR-@cs!QUzOc2*F73wxO{x1YyW11vYWnJA@R*#KP4kI{ad&tGfVV21RZc zu6jX-OM<}dJcDQfIBYOPysWbF#*G_tUVhd;K4C&0(0=eREIfSBl~sB5OMH#vp3#OI z@1++&GW?%(Ry0^~Ny>Wgxhyn~C@2g-<)7Xc2H8C!2340~SRHePLdduwZHtbI>Ooyx zSOC_t4657(T=1tkP$X_A`qkxMl$GTt9(mJq>jz*^v!zq649v`_-+nF$kKNjJ9B}<{ z|B?k19sdXCfRDDew)WU65Ap@RCGwj=PX*w)Y%u7hrFPcVyJZ%0U%Q){KHho@sj|z- zKK4GJJI*z!4d??O9Uex`j|LtnkeuJb_-ROC1)0NO&-C?$P7(lZKu&A}uuX0f*dDzUE5Y626UEy3LiM=3PB_o2U0Fb)_0)iQYs@hCPK(~3=srZv==QXJiPH=Bk*TD zPqC?B%w@#I0gsEz8R|&RoHMB@mFyNf#lbq~VA=`tb3SboA3IN5O z3!2b?mPDbY*psfTq5>2m24B+;;7j|^ew= zel!dRKo{tmkJ;O6{p9CDMadj|i(Yx3}LyM~8RSkGOmX4DbJ2HGyS^Co3o_%6cI} zTfVtn#MAFa0KoIbGS$POKq*jbwU44zn#tA1mQO|OnY@Jb$2*hQx?cmPyO~B`*ch#c zq<5`{kSEs2Z+9gU-VIH6F`&@F=y(v6PV!aCEnV84FG(;4l_HVd{cfuqY6#{ewwynG zJ9m2ZYb9~7n}*m5UreLwWl;a^2tfzu^71k$4)qjsTFwhoKqGDft3^^ogc6Lg0@l;k zcsY=QByFIi0uHaJxEM*=ljX-kRac*wpPvVhYrQtO0q8#1BnG{9m{*T_)C-N@AmLyI z9x&q(KA9C~+Xg=`bWtIKc?Kc<~*YPBg#S*A`tQybxk!W`>*15C>x(UXuY0=fhw>C}Bl z6@~`~_u)1oAwK{oifuu82CNnZ4b5h6N*hFu5VS#hXKH9D@)0B-CV=g0kO1IM41>O; zpx|{IF!Y=aBClURj@yHp$=3)#9Dz12s4mo$Vy4w~`Cp)5@{XGUFafLj0Q`5Vh>k8o z5D^4v6`-WGwY88h%YU>E;t!4e39foRL?@mx;&CCgg%1E5szs&cwV^3L|5beQ73id< zj2ec<0$HF_TUkLE1F$Ru0|U&yT806bG(rV{*U^m*Khjc3ZPuDK*w!GH4WY5Ax0XoUXVD2rs3+scUrSU5rsqsaf^Hw^5K>4 zetQ)GLXfbL3>Jxz_PS*Y$a)&|?A5N)U|0D+rORvLssiKJYcK6XZHpsl8W34rX>w;~`wY@#my z`oAIbV6w>?6mv!v+%8#} zTfrwo#p3_xZ>!O;KuFHRlb~)!4n7#x0<1Wk1`;M+vCEe_{>K{Q8CpGYQmb+-hV)i< zIBAh@TSQXK4bp;xjj^WiKQ5hL{<}r^E*ygv^^|QMP(`wO9Hs=oX#m{<(QfJ@L}fWQ?pZ!Ks4PRB5mFzZ5vu-dkt*m0yKboh%w#~JN}x~F(XOW8lRYA#$)_D%PL zv6#RN;XzkAhwLTt8HoK-za#Y^Ms%empmW9x*yu(B8Q~L?)^Fb~59iMT3$u1plD|EM zg_e#ki0k^L7bx&lNQT{j2(@_W-5?w;3^+3Ddn879#Of8+h7T`&!4{T~FjXLS*t=#NV%NE#MkQ+Zoe zmoCZlL0J~a1hTDZbiJfN*l)V>f?Y&RY;7QO2nr*^&1Uq_Sq|0=OxdpBKF}|1?UJ;? zp#W_F6yeT<>}L>fI2>6ef!RTF*PVI&IPg?769D0n z6#&p5!^4Y&Aa?U>7?Om6BwCK5!5;`D3&f@XYMRgl10tCPiQ{Ysq7@+VRBzc2qiFec^%aB=8m>N&w6sNUmylAV$Q;An#x756{iW@c%L zMYlB+_L2E50raUtu}f7&g#-@Tm@o41BUz~b{qYylpKJjf0HDZZdXNtS8pxsGLt_I2 z1A~HU&8UzB+rNMAC>xk+@Ic7j9dU%+b%77BdbR-xJNS7W#QHuo>i&lqYd{N&i&Q}U z!W9x1XZq$%0rXHh=4$bkJlx*dfi4|5sl(LIppg6bw{o`yu)^*EAtAC{9GLwP?i#?r z$WE9E@i)I2y8m}@3`#w`yn64^(a;2-4_3enRYgP$0kvdqZVtNkew^^p{&OR`%^aY6 z-^)u7LLY)Go7x3SXr`qD9Q)HJ6k7&V~o=5!Deo8%4FLE9Nf zz5w@z2Iv?MY{mZN-w=ZQDh(|yoPQ@~@iq5Bxcr^*TpTPc5fkD>|2Y2!ABRUqR@T;r z^bx?|fGie*DL94bXlUA{LGu6H25c}=fP|8hk-ffBL<83zOf8s(dNbmYe;nx|${dX< zcD?pUsLC+E@SL_R2Y??8B_<{&7$s3DDgDwQlYc(qHoO8t0qU(rFpl0#4}0d;zU z=$G>gOSkc!PXo?uVw(QPKlY#li-2HleLXfRs^xmh9cX%cnpxyCX|PQ3nkA6ppTEwD zNai`)#quN~2pxdz{Ila#cyLSAJUnFxmnP9Zqm zkqlWR+YHI+{y%fbOF+WRJox?lcQAqILQepefZ{Uv4rs6dY2tdb$4Exn->q|z7GQzR zgV5yC>6Ls3cs&|L2AHZ+(f>RMA%I>52S6@e`2LlIpkO1Qdt~b)j=ewv{-3vq`O(!S z#m6@Xv8~Bt#hvAzWT**VyK$p%4}s(e!&NtJ0|7c*Q3hmY7W~Ys)AER-nKD%9cy54q*bTX)J5HAta|Bky2FL0bZ35L zBk;cuGGuR4L%Y@AWs(zboY8=N^@zQcC|ZLz61>2^&VRnA`>U|4fJ>Xk?MK99=8B%j z+kf!CdXET2L~}(cK86N1*kwoo5ybR2pv4Vj?*cx5cH3KpL>EUjHyddk!DgG{Hwrgg zjYv4hgu3@%D@S8Qu#&crpi#pQ1P~|s=|@*!HSvgbX}zTUQ6}A0VVv{P^Il2dJef9N9A%-AAS1=BNN+&gD!5oci$=Z6IPw${Sd)1i?4>? z#WZd@8{!=Ha(-b)-9Gihf0l7)ca)yX1y0FTq%PDCBLudB!ZU|!Gd){0 z*J?&PEA4sI>eiXs)JmA()vrC&dwA;T)L%(ier-me;n0%)_Xi;CvBMOOR-(G;!JuJ-bo5`m}k6-p5^M zD|LO7jf;CEf1*!JE4wMl8;yOaI&7hRkXe9L{H>S)eok9YAOK)5O|1)h`6{WAYcKX3%t@L??f z^5#S4n=08}6m=@HPmY+p*HY3SR~<|`Z9Tiw>m*kx&s&QbALQQ?Z>3Es8$j_bO+3v|sgMyWstP+ffykS5 z3rh8BYVI9zWX<=*QJM93D6zCgbw927uSBsuS#N3fhMX}rHWpMd9b0>Di~0ih^|Qaf zu9BSrc(S*bh&P($m6W`FL!=MOGE-WT{}wBaw^8!L#OXy@%$w+Ft%z{lglNNvV6Bi)v#>zhGczAu=ir7o{=TxS zA(8gUU&jP7^SyX6NpmaxSZw6!Z0_H`Q-VDAw_hVpp>+8zCqPy(-{{T_e{TXMm6(oV zYfbjLS#Ez{jLvc2r*#8N0<}FS5)TH*>PRH{{&-oMChf`~fGOFMCm~rXDPAZltV?9# z%F)BfT+4bKpe6r6;MEl6>*Df0VL74b9t_`d{!KR8A=b0O*2{{$n+QCe zMTbys;q**5vU|+Z+L<$R_wPy)-;f{{!qyfVc$a4iL&nnIGBft~4=N}QaRSi|*Db|a z*-%+T#1PWwGxxevrvuAEEBY;x6XgnVI!kF5OZh6yiVtjhBSQNWKv1pZJu8y4+g@IJNOUHqD5S5JA8!7_s|DsPYc{Q@+(rO_2xB* zZ=e%5B{pKLmWKHK(5zAwiy0VHR8-(`mRHtz;`7$fP}#ylL`$pZ?Btq*!x5V@Tl#yg zCGoiGFQ?J$w?7B4yzabK1dN0&h}(FtJoDX_S5lM>4-8s!#MqDOnWRbG!?Q5gw0Gc3wC<8hz?Ol}hMvE7`eaGtF}}%%ywsfPjMPOL zU4@2vA#2YkxK!lSlmJPQQ9*Ir)yz!8R?jx+!_rIQk6QP%gr@NEM=Tk7A$EjBq^YrS z@Dm%9y@3`LCM1LkZt1~yVGeo)h0m)5tvkLionNwaKj``H8u@w3`Z+0fan1gxgch11IOrQfmE*4hqvvGRRmD5W&;5JnGNRqTe|0(D zzkiIuhrT{wP8#z`V_xfsv@Yq=1=h^!$J>-33u5LG%V2rvzHPkB$az&woHTGQ4sym^pt1@w^ zGO4SEkw_?vKXqxbFZ5^r^5J>qbN}mxI%;p*QS)u-A30@;wB`-u5A+vfZOr0Q(D#y> zQ@(k9+@6G>ZEtJ)?0>*)dn(hUsNN*mKx)t7MDpU{ci|%ehocWdVFGrt9UbGOGNC_? zbnlY(A#TJ>OegHmKkoH!{HR=U796`Gt)$fX?N@F^>htGDH38XPITO-cs(WQmgMzqQ z$ocxJmuXS-b@dOg#|@O8s5OPB))EL?>ycVJUL$?S=hs{2vjNN8C;1@hboP{V` zB)rBIx!Xs7H+vjsc^D)4uE`t|7nc}@pd*kffp90e*Hdd^vRqlfSDZ9xXO)FqzjDn%#XQN}={|=z<|D;=4!i{7FzDiO zmC?`$kHdYlwwK20Xe3Vd!$sz)%?5v|gu95#O(!wTa1)XVFJHwGKU>sSGTV=X77IcJ zgMtJfcIPK57+DiU7*H`en4)Ug*huKbBZ!u#qE{GsU#X~s2jjR+*t};wxj(2;)6yUe!261W zfS~9#B6T2-VpK{-{XUphHDrz7XDGQU^ZTvW1r5e-RT^=*8;;JBY<{jV;!+uJR4Yzm z-p?3dHI*UQ(fKfwq?$RSl+BpH$d17zQ8AF3WWXcZv1kFZjP`$;8*>T_9g{wj9el<510SMF%rY zM$_?jSM`hj0lvU1m`+D7cL>(pJ%#4z0zs|#2pi5r8N2EnDPN=4gNA_N}33*+kZ9r-Ojb7(wcuu_HL+%od>iv5&1T2JC z+||rH?Y%r4J_?L~K@n=Y-Z+U-Va0N2CTs9UlwVZko&YNY2RHe|Mf4u-F~-~;VRdhD zJl=h~?9~1D(qvf~pJv_RY-brX1VXjl$eO( zkDud86ROPLk=4Dg&Eb7A`9zC*Cg?n<=iW?=g`N8>*2_&2&u1z8h*Y68{YJgTasM*Y zByB#-bJ3}pHRB;t-6=F2(xMqxi=wzLXNu%|T2`f+3_IpN)nQ7(urvwZZfjE12{bg= zg}mu_fV(;-g+LiQZkOu1sVlWuj)IOJ$7t9K6;OcQ3}sMxI4IBoYsPquAdLD{Dd>n1 zax0bupH-?tkD;gi*sn6p$h!c3&|&+-$EdJ@ zYkPZP@{b7~vUE#fKUjHVz|+>fQnRb=^zp%)uB**}%GQ)=M$TY=`?xKj{M`Cn@#NSo zd;OOAwHqmj)YOzTU!vG&K5ucbX2!>3Ib}R{wq!gCt+rD1b*3ab{DfO>iFDi)>k4RY z_I^VY8-^RQ^R!MRs(Q$T1drXte3?;X$Slcx_`Q3tLF?98Fy2=8+4TS(JXR?XAX(Jg z9SPp9?BFjWDn6C5m5}hxOY|aAQ&tZP4W3@L8||J^x{|i#r$+K|ica_Ud1<*>v>RzW zy-N)-_l&Ab<^o3NpoN`TT55{V-B@z(wdvQKQY@k^-UjV97ZNO+!|ZyE{NX8(JI1pK=K9X~_*~ZXr~-T4XrMLf0+X3O|zX8nmI_vvh-`8v8+?6{g*ygKFl)Y9-P#Cxm`Ylj`Yym!>F zhLjyKc=|pCt;t_mBCo)>V6r^!7&aUXVeT7Vv9pLVU8(No(9v|x&=zqJtjY_JKT?bg zsXkL92EjPZ+-YI}fE+FnFW~AR;%iUHcm-+t{M6hkEYC;@ZuHHE>X2maMl!@TqO7fE z-fWZIM2t9itTWqPoQPPaY_EyWq@Z*$TSjY7A72w=*%zdmW(T3qHuP(2w9u){;JWHX8ed41%KTI7D zO|ABIUc|f)+71Y9e<9Z8AV|X_6P6trq=;};^q zV?E4eu{ncL%(|k_v1ZDT1Cl)GBT&>oZlTAeMOCyjSwxvGb549eBE8RO9hJIt_@TPK zs1Z|7^e2_vP))2^*5|U!1l2pL>Pj-w@_2Tnb=|JsL2b8u^5UjimzaA26a@AZ65xKu z#KcZQLQXEyqWSpQ?@-61fdHTN;>|2`+mACl(=l?AL0q$I6GldeHwHz#WLcEdUAw-l zulB_*^} zB955yQ`ak>91oGZ6BQhN4{sK+^<3)PiFj_H_V0Z=xY@_Whk;k#dB?LEwqWYz=j#TaJZ&yQpYToGp&gv0)DAW+unc+grXGDgBD(C1_hfYHRRr8#B( z0G2nBP-|>l$R~=Fjrj9!b#n*`<}lL6nlB!GESc!iV~+Un;e#rptd_csX}MCfjP?+l z-X>Z*=Q;CEB)1%Z)tGx%VeT6Z)%Zy5#!Y86ED;qH-aMY}Fov6Lb31=Uf zq;0*hqrSh3!B!iO8h8UDO^e*;^$hcY-UQc-;-iLQ+lJD{*pz`%R&r;?F)^>Ch-hrm zJlT6JLGR%`t(8v}EHWPcYI-narZ+#za8=Tmkqk?VB#gS)!K>3M_UwSaVY1+WU2Fa2 z!Fhz|Qr%AuoZr}yNYv$_st9^idh0XwE~BcnQdKd*<3kH|7ngwvYdf*7XQ`W^RP`Yhhj`Qfjx(x`g+z zjAS;a*mFo0Eq7tIM0`ALOgDToNi|(?F1Vz<&Z#_qhm)bSVNxqC$0?`yr<%@6adVv$ z>O^jtjDCJu&+9(HIW+!KjW)lD^XGOW>rQJG)%8Tbv?7i?;s1f?wHgwasQcXVKoT5PG)8omsb~rvKZMw4xMkD^p93 z+?C~aS?idrj-NL)(a}w>)C``UuIU>O>3vF5d+$a1Pf;f3Z%H0L#3rlN&CM&cHJ|zh zHO8noae2J+>_3oTmN@rfvfNL*OXc&NEib*zvgR?RI>E2o(^dWCua#63uR76p)q(Jd zro#fZ?PX4++V!8vjBspzRMQ*dDfB^CW9xN&RW@~KB-a;x#5FDc@y?zn`t3}gb!R*E z0}a!S%E3{)s^Ts7U#5ko*~L>v>?9K^M>&;x2WfUcy`55eu49PhzB)_Pu9P1#tJQ5w zpspGkKFnd0B{K@%~p*V(w z)pfg`?-t(03ClFjb)AL!f6QO@3)Kt^a`cSN+f@-sEc~UKqRZ4b^1+XBE@4>oiOE-5 z@~#R!F`1-OS$no^F^PK`79L8+N0}viQ%YIDva%qd^LV~=DT z{Aq%wUtvXej!q7nE!7A#ol6lc8AJ6^9M$9{pV;Z>8Mg+}Tw7iy3O?=eYE+lHA*@!nL{+|RV2`s-Id>LxW1s5;lt6#TV` zpZs@=!n&@@?4GiyS93QF^nt2Eh`))pM_mPn;bb_sF}aX`-?7xk6)`i@Q)X5BoT6=w z7$s{CV%pt`A)Ku|H0-cz_ht%wIBSHd34HP{^!Q2}Scs4>N$K)77eSRkr1mP953^b+ zGAt_Yo)gQDahn?*nk$jv)y8{-5v!wFdAo=PYM9Daw>exudS&z$#tP7dR_L^n|Ij6N#$EQ~o#)DbI*#?uC;GHI5mK zb@@uz=489c%P9rL<1SjSy_@itC}Claameu&v(*>PBddE>?%BX5@4khtLy|Tb;B&jb zBwk3QbZ^RNz4}M9#e_oJHE~qiDjPCtN*}JMw8xZ`#xV8@G~8%uX!Jh5y9WhS)^|a+ zI__^I4B6N4^1A5Wmd4k=RK=Zu7T}WOmfjcF+MgYIoOP%Nyf1PoG~Egryyea%!9S0)=&ds%Yv$5f0b32rA?UlkFrb7dP1+JbchI?ls ze7`nA!XvGlh^43cP0d|$bNORdb6^J3uSBcPq5<&eQ&o_iR)Mc z=46V^8Lgf9NqajLbAf;2xMzdvh__`?rG-h#m)Lp0_A@zA}bPBvcT;p8PAjYF0SQeg|Ta;a%z!xW1}8z z+_m<|$l&{~fwpBMGQtw=|5j2`k>BJ?NeAaIt%FyNru~KLNxF0i$MUrsX9ox!?)pkw z=;45FX%ihCd1%eYxJ>>#7#sJY%l|dD>A3butXqq#Nq7IDBlIGf?1gyxF^*I3X32Fw zSyB~>Hl-;ID4S$obzIBq>!?rNT>CI5F4|W3NFhw{8GGf`xG#SgZjv+iHtks#1-{}q ziE)bifT4V{@!Upp2{*@zq4CwYxLISQPs~^IEvv?1!Kf05tz$=8B@+Lv9w23?oF5bJ5I zwU4uSGZ;U`)~aCIN9`-#=S$~24zf7JS~WbvBReQzP%cnmg}s&5o<wnz#=EZiO{YX1}aTzdy2VTBg;iqf+$ zxIcF@Y$m4d#VN8m;{Rx9$RCix(NfVs=>HHX?Upl3)K@XuOw>;|!!I}aBx?CJizXw3 zT%!Hf?#({i+gw5nDpp+^Z-}v7JY9ri3tgr!S7=5|V==SXjvdO5L0UCJX;x`+YO8v( zUbH{9VZBzSy3BTv7b3~qB+jXnP#Ep{W4TS8y`HMdHvhk7w4kp8V1v@`J{3h@=RaaW zrgFHM*~^b{J|No|Z=tjS3TP92U949h7VU8b#^cJWDk=W@`kZRAk$RpeyWr>OB9^Uy z3F2jb(EZ@4UJXfJp={?;5dr(ptTon^ZKHM(VO^3j1Wsxnx@0{jUVa|Cwmx8?VZC_V zf99CHzv`d#A@48iIWAGTf@lAOYyOtNaHCs-ci-d}>5FjxqIJQd_pEhkDcY11WNA51 zNOPUGc2R3owjWm|&di(z_kYL3Itbjc#vOVP-uSFgFgnU^?AfxPYO~0wFOm61B_9QH z!>CnGHUas#wr+>UCUvlO*ZH(!YEZ1iN;2B5Mo4JKeQyiZ@VRU`^q2g(StO4~+h-PK za#5&rKeZiq8ppZ#14X@Fkw@9Xuv~^)X6PFcO;4jl^fHPDCayYPS7e!~R0n!aPWso( z-1dq`bGX?{_=y|X77bkUS>;PPr}fqq3#h_?dX?>I`as~jqf4ypDR{Q#yi7IklJ zR5A4O4rL^hOl=PK3@2unsH--No{;^9*3Zvw<>qDPJkkGg`5QvF>c>{NG4PZKMjEA; zUz&|M2+F#u`sL~WxRy2@5*~lD8TNE=(3{%?CvJTeUj!e4Vyx`A^$VjfC+jZ0p@gaK zPg5t#nktPM@t3q*ExBZclQS2HSI#=C-EkTgs9fnAj9Xu3mN;@{TnB8|Fm8V;dh=Ig z`AMp3#d-~)R7U2qe_2R8_O^$|4d|iy^JeW`xiG+z=?O)rWny<Qn|VS9YqL6)2e>VwetWjAp=cK26~nV4 zadXFKyB07a7CcTGR;NAh&bWcW*AzwRXcx-O3eBSG zGJJavO}d@&IAVI)o+$z6!{wml3;Z<#Czm%x&dIsQg2uk)QMMA_nwb*})ThX}npB&l zR69qVZGH|?8mZT`EG~|KJa&d97QRy@_ zPWV9cgw#blhf{pL(y2 za+T^CV^8)vl3j zGD{AaAfe7IUdqOKz>-j*?({>CdY~f$)KZ*XdQX*zhq7DPo`fkZ{N6%`0|w_h8Kk!XtBrK?r`VSVC!#TCDV%JAY?qwv?a!0(neKmQRTL#oDQ<|-wW0A zB4rg78XmnU)BlRG!`9nWcf1-cHHFMHi+2?332HoHF4L14@6 z7~0z@DCU*)r-3sE`c$r^I~?k2(4leke-2HuRpOxAmqnYO+zOrBeAAJUh@JlpVmDIE z?x8}$whUnb|fA|ec^ehgKZ#_RTLp=bUf1I5qo%~Tvm_m6*#NrLPV$HqFAMUb?D zZfn$qD$D6-9^-mRW&8wl$yE+%SAl1*9?aMz-5WFgW>j@PySJd95b@@TQ9Zv zBzfJ<5$~ObpAAj7vAhv?pEY$C=wN<2xi}cNw*Q`#=&o8u#v|$C%uKh?cmm?d?~>pA z4Hzz7F<5ndctf0>wn7zF@8!i#QKgIB&~SU(w{_cx-;I$d_si2ISBuWGq%0@T5r=Ea zEPSVa4=_wCSdHoh2KFMn%*qg2ZgbWSx&SWNe30H%{ax%q10QwRgm+`A7`58irU6F6 zy?xYsm$}G4@!PoM9_a>R5i^4jPrv1AhfiCZq$gTeZv>;ja6j&>EHZLhD%U_EOd2R8lzw@7;A*kYW#JLhw{<*W$z}Gl$;-E% zSxsKqO=jWC%x6s0%`m2gy(Bx?ZtQ8yzw*GQxKP!2Eu{}z!&fJYf1y+wZMxFaGiQN@ zFS@CAhS5Wh9~@;LWl^i=2@`3_Yx~LSBzg5?uh52aeIqsbighNK&Pq&GOLs^UHVt*q zrEk;}JqjiW6OYVHGq>KWQFjr9FPDLr#i?B)7uPFBp~(S$v5|PK;cGKhw$ioKZZ3p zczRoqySmEgNtV)ZOjZaB(Cy}^+XsilU5tEx<(n~jv&ZYR=e3lmAXKv%ZyM|QW`3pA zi3(HgO@~A8Am&dRg)?3OyN4F9_{;Loe(fy@WtX#BZ!|nHrZIB#(r_xs%}Y)7`itJ; z?$^&!cc>U^!yk+$@T$$0?`^1C?b#m|>^g=9U#VRJBcdMR22C&G>rLD5B*_IXD~Zi` zOX{RyT-Fbcu-PO{>O~9a+r}$ZDS0j2@5`DJK|qfwT}fvZ6r8oa6kbk zROhL#=cG@e75ZRFjYB8X{A$NoxV-xWpUs0SU13VH`vT9(k_zU{jyrzxFMZ;-6M>5U z8poEO_*=}X7ZgTPGVY$ALI2zNRGm5g!g=FbF_XMI?bj97?Cf-HjRx$&p&>5kPo-?l zP(%FBt*gdd%t=(z?)?V;wR7G+@?ZtA4Ahty_}8)SREIwE1B(Ji*o~Du_6hBS6{0) z@|pC7vN?II2acX((il|u`h~(2dQBizz-AE3(?0GbBIzJy?%46!NbQdNUg!Rj`Junz z9Yuj>J-hw6sU@?u^-jtMb9066RdwQ7E|QuDY?yKLB6CFM&-}B>9>uH%e{5i`R#>#p5an_;_+6Se$M~>eQmwseP+kR;Jtc9?=3M7D8Su^%)>H(q_ zX(&^ln2UEgaqU{o;sCXhU}@Xuu4kP} z#sJeEQ`Es0cZ+#43PHts7=7>HmrrPqNS{4(I%dn|IyuU)GNSCdt>K^{F&5+(dWO2T zw)W?9|MFq_9zBa~Sdz+A*61~Qvo_yp+sTQE{nHtHyFW-_btAHbBcx3)3^EP7tk?Kdy3gBR@;{smgE&<2`f&&rK&a;H%XObXJ_mF1uiyMB_wW@STzk? z7;%`EN4<6#aJ8}@??@sV6kegzXTKFHePN)wB%NJW^zQh2kJIAXS|(-Y!%&5B+MMRh zoa{Si%BfB0p_@Olge_dtC!CQ5!wJ4yTrbgwhlFDumsh%NDv{C4)?C^;8#-5W5VSfv zs-^7ASZ6TNK`|OiwdzeH*ZMWYZHf! zdouQZK=l?eo5aZMa?YR4I^MS83r~=%oCT6J?e93y-iv^mBfDa~=(ty|UNQFJ2KH=Z zRMg12F@mvDyfwg20_`n&IgVvhbxCzad56bsO0f{Dx?n5fV5_8Herh6e7AiJUPBsn- z=7FyE6MnB|;kEcx+@jebVe@Mf6?zs1M=L#IT^Q=Ng1RI4=%uf}365$2+vOVm3e%EA zn`9<67njLMx)uSAxL+9-%v}7@m`n$b?}gt)Tzib!6L#`)%)PyPeE4L2b-g!^enq`+ zDG!=O5h7Xe;PHOzAru*;`n8t0hlQZ0x!1B6d#&De99mZt&X0ewZb6CiZW8 zIEm{crlZYoUfxA1F4~OYD(jxW&&okW&e7g{CN1plE4@pQqUW0a6pc{h@Njd2U&(GP zEUl56Be{BaJuoG0plBVYtk(&TAzPLHq;Nf)5fqb5r(#bj`5D?c8&dC5_rR*4Fos1| zi|>u1j=ay%L{{KhwLafwg}fq{juO{&hb_Lrn<4^Ahq z(k(7K&Af>~i>-j4%6^PL7dt2yZ$!l2FJ9gaY)JE>VM|`Qd-cy<23sRPX4v;e#)Anb ze(;r*nX~mvdl3;jg3pa8o_j3K!iA^xcR3%JX^6CV2L;LAbX72Q(5dr3%nBS^d7q!o zk`!E3e|Ow`BL5)Zc?lY)-K1@?>Gzb611VDGh-;pn8URG)wktb}TJ=Op;U>sVWM44& z6~zG*ghAg+$UY_Kfg69nWVt^NZ7}Ap+*XMJB21UXoa2Z7#4ZYh?d?8V$_N)XZh`<4~_W>SSsZ)w0I4b#@qwx!cLB;;1O|3}rHBu&=xb9uww;gS!=b!Oq4J%@>bJj|B zGUggHX;eQ))1dg-WMw#z-E$ENT2?QsYua-VFkEycrD4tDFfBa&+HlHsy~ecr*cF)B zIPrMZ(;kiPauiOt^tkAH(;_>48isiuPZzAb7a$ev+eDL+9T~K)zV>_BcQfV|JxR&y zR^1Z%U%BjOmLZl4Wa%6A9ux0*7gQM3sEirz;IA#H*sAvK%&igdKjOp^Dtk}#Ampxn zi{XUBNik`5_yhVgtF+B7V;ad<)|R{ObM=v#9^OMe`p;z(^S*rfUO#5jv`~&FWkAEq z6zSR@SJAhrcdCs5Fzx}eP#QV^-E@?P>W;uG?b;SC+-#UGMJl7NJ=YWYQ9+maJuWRr zR^?*B#+P4@QsYS>nx^xqRYfxuC!6(*$eu5={g9c{Zz!OVt6%5b!r!53 zVDXXC$w^tGKiTJR-<m_gCE!;GoJ7=oHvBYd;lDBDTIDcSo^h;Il_z;vR+74z zXopy6wVG<@$YHxETjew&m0wD@V;3MNnIJZj)c+3}g1X?mcgwE{XNo3wSd_G4iczo|N z&cp%`OLO8oRcSlp+?Yq_F2Wk;l)XWKwg|wf3*^|N3xBikU-B)ir6W%f2A5HkiO4x$)JzkdvNuQs7i< zCXK1Ltc-(MauMyb3$M@@3UQt#2Ry^d|6640{`s!tRksInXFFe4za_6;?wLH;MpL2h z<%mj*$vHobFmMXv`J8@gqvqnf-}T-?lF4S^rPf~6>@F5g+c`UX?0v!=DR#Z&RKZe? zUA?raO6vGd?u|;@Di@bdyv;Z}>;8nMkLNbxd%0NA0W4aGjcZT{njdc~)2Z3JeRD|0 zD5Fiv4Ku;^fLECf)>V3$lc@cIlii(Jk4T(hh>yfqc6)ZUp>L$S(kzo!{8;XumIO&2 z{n6RZ@^d~Z?;vi^5M~q@+OjpjSax(8%k$ar)WNw~v#GyC?SxIERrptqI@=$xm_4wV zYEe`)wMK4)3YD*`n7AmDL9ftXNV{3MSbg7TE}bGEZ*{hB?iN?TByF4Fok2#%{#QqF zCt~;BQq%Xt-zFt0`=XqY-@7$Z2InQ&QYaQ#T_51eRr8Jh6 z9kOvM*paBZNb9kvg3aa{DH?>G=}%YvO9J+IC-vu>#6`RkDu?&7X|7CznpM}^Anu_y z{Kt0sv#|)10{?VxTi#5*z4WH&^M`)zgy2{BN}qpX|LST^ifTchxzS10*$#TYcHX4V zT86fcuKS%;;w;=qHp@Ka-SUHb0w!%rVWplK7fk!`V4pY-^OO!z`Lsm8jo7A%t>{Kt zmE?EHTW*RqM>}Gr=9m6?M4ge0bP7|Zger4A-UYJXVX3O!YBOat`xAXHUV3y#;rnph z9*Hb{*ilsb6}w$G%kk19;q4h+*8@R3@^Zgv1FyxcnZQyB6&_=S$`Jqdpkg?QIzk*q z@?~*Vk6TBgt8LJ%`TLJd^M1*qSUY8b`V10PRhF9b3VucF<;%a6#_FQ+ZnnGL6e3Z6 zSI=%JbLX-yJb?I6*#v|06Sjj_$vqdTjIFJGOXGf4JeZilw+gtBLc3Z>TGgLk`FGRe z#8oqaxxj{&y4eE4tX3h^%egkcq}pc~Hq49Ia`PyVLMM({}GTTr|_UihBMZB0DyZXt%xDM$>vE4=WZ^G|ABc`Q>;XN3nMIOSgt>HjQ~dY9b>g@lXM1?p$($Wq-!l+L(3u{RhH-wT2{uZEp;TiEH7rK&206iCl$4x zAGvlCdMNpF=2`_Lv;Xo~;+ntf6s5uVWnJF2`OdT|I49+ zmU@Gp_ii*-8FQDCCSuE~%2NHYi#M)hIR9O)pCB<4n0P&~?ru^|trBM=B6v^e)0gzZ z{$9x+*DTXKbF0=TEb&wfuc{E2BvyMxvry~){9#ERcVNJ`A?EkEnbSat^I-6JSnDIh zv`N81Qm(LXq2VOFY$?Dp&q&i@ChkY{q3u+%;Ey=A9@E&A641)$brRU+nvI z#TI&!21L6=xGVPkA~RTtxi>E>P`^XXH*ri(RpPcFc9^!Y;e&rCQ*Cfn`r6=e0>P3A zQq}flN@H#9DnIw`fskr!v0I-do@d9)9uurJKSADK6E(`-YVzHoJh{a77M!Exw_05@ zF`etP=S)rdJpXyZ0^@;9P3J(9{>n?%$-cKG81_m^Bf+fWUhSU5P{qOs-ND4zyeRL- z!1J^c4I7)HzKanwWvk->om*KQ4PEJV>uF2MhZ|ozbO=A3(KN$*FF%@ACIw|3 z|LtE2Z~7#)o@fPV_iqkX5m$RJ`ZVRdZzZ^53>ze_y(%rcWS_xkq%+{el4MNy&9UZBb-E+K#QCMeJN<u7B^iybUM|1slKRR^6<5KJwk=nW zy!U_E$U}#O-9nel&dm(SHP<1~?Cf{Bv*>us@7zdZVl81}&0`YGQy=n1W1n3mPrxn} zy0CO^dJnYkJzS8|QAGz)I&;V)RDNs{4!_cu@4;RVTH)ySrCL#wzkS=Yuozor=P~0s zB(r89H%Ij-YU7lzN)@h8zOAz5F8848NLs@~`^B+#M6kQ^tBHbhAq76jdSbF05ngvT zTAkUj6_1_|R3!!%Hi@g61TNftNoIb>dY6U^5pXvkv)L$qHPVGL`bL0nx%Z+Z~yY;)Zu5#8Q9XzZINR-3GD_I<>=6rql8&_xH+f7W8UG6&y4T5sVkFG|^J! zA!EwNYZW?)?oefYFLntQjVc zgM&D}V0j&tF^(!&Naz#tn$-@=K)WmKDsN`U6H{RDd+#(yJKA!voWx#kwq~m3T{5_EaF&v{wh33%-da<7c(=a=UI!M$Hu(aQWW}85Qo) ziP~w*XRFt2VklG!PuUH=r_i6qVYAc`W(?4t6}{SH5Wc_4X)O@OB_>~CaQ<(7oTc4 zPk698s+Hs}JCgBvW~eZd1YA#?ZyP`pZb+`zB788qWNXUdWy&4aN+`XhIq=%+ZrHEG zMYTih@^;_)2ScVBc!lTA^`LuqjrWYamw(4uGj(Gd?w~jS?}MsN*3IJOCieKW?ejVG zE=%!uRhg$`$nU0Q2#O`QcDeN*?u48Abgo{SolDp)De&0VDp%v?9&9(;)-7kCUMQz# z39&Veto!5fGl8CBZbsRoXqTGBsh+bqlW85KU}?RJ zi5XE3Cu0C}YuBNgFDg6ce&Q}|Wu1Yh9c50qRIc93f)R97W0k(lvTc#qASaKO<}H?* zUDheP@|sM+hB;`yA8D=7(tI@7C5}l5TacVh)q7Z*fjtY)q|NJ~jz1`{gT|s?{TztF2^ymEtiR zi)lk_t>rq=Y*pr6=N`%xS~{p2Yn>#$Pu$`n$U2V6D@~b9oiME)&feKj+sG@@Y5#K=6MG1xn`XU`;}LcDL2GH&%U==iGC9GTbgn*B1sFW zq^R|%pKdqVqWy|)e$eh7Ui?qKEo`cib-+YP#?S8OX>f||U;a0O9jP=)>@t0k>m_Nh z`Fg?~4py^GuY{_;q}6VNu$352!k7g|b=BLdzfmQIF@aO4ByzR*$vD?b-^5K!Eb_;` zN1u)1tR6_(oFofd(d_c81Urli1tqC6n5vWRNK2@5vKWUxEPvX}R-CTvUp0`u+nPG| z=A{q;!Nzzcs$@S+AtSAF=6gG}E(bcRtk+;6md~|-^75Flzk=WEKTgXvb|i6Y=+mF+ zC}r)(wq1_x#`nBRGr{4am|-9A2R4}=gFdS(AukRoNw5kV>{YNuOLzy z!@W-aMCy2asu7wgW2%l(Z8TS-s($HV>HDa%YxK=iBj;1a4R{vj zPlp?&*(TD|BD+SdG&@n;%Nvz1SBEkzxqV5(e#vDfm?MW%OH#|;W3{-Cyrn;$T9Bh( zp-mDJ;mXgg-@?$X6r<8$-Z5lZu_me?rMOOyv8r@Mv%s$C=PRd1`(&s7Olv+>_e`$v zAWHXj?;m?=v`%Sks)$^8o6YnvnJ2@)KYep@msp5BeuKbf9A9{Ej#1&kNebg#ee)d5 zV48EWQru$bqDxP{@fcFvyZ4V>;Dp=YYP#7>q`3fVMSuRx#>$+;bf})ssDE?CXBNwu zz}iM3A=k#X_-zxcq|#Zk5>`i3SRMR-Cpo5~d^tI|p6&i*PUcSc@B7GS8#kq0N39>0 zvS5T7e?WDGBCoH+d0wMcX|7w`LXo0CRBQC|pXFO$K$&44xRFi}is%la>T1ZL9wVJ> za~3JA^i^S!m656bXk$DOPAie8oK{X#Bs#g3tXvmzG=<=#Use!JSycdYO>(cPbH1&$ zt&&>Zge@nsjMLs}k4DI5eXR%~k(Y*_<*$)fCPn@a7ukUfK`Ng5{?O5A_Crx-^jw#C z?$5rI>dJK`C&~xEd}g(i=gb~ofuhCPnF#(`9F9lTL%ZM?j`%4e&Y1ZXu!m!Gdh^x%rCP+10Fy#a_(-W>7&^1;_!VzI6vXITU+{r zih)QcC!Ygxrf6&C&Ci<>ggVLB%0{_n=L&n(#>#C6@&3-eD;!cXcUMFfMrPop zW#%E3v{Evwq+JR&rwZrShxRLCD~9G{W3%VyTR=g##kX*My$hsXy1IUchN6D|_W1S< zaO2zMc9xB!Uga+Q+>5rdW=~YCW%cx|AL^;tKh!g_e<*3BE-5*a^XpfPs3@pOo%`a@ zDNMI4F7kSb;1JR1ub^{KKJ`kjyF1gmnlg(^)>*bc;jB1|C5+X0ls3Zr;<>o{u}lw5 zvK}f?7Qc#g`S?KIHJ+)ql$T_z<(Bsg14nW3%zL$=IwoEqJ>_+F9KUh23L2k#~)3?-^25k{*+K%UF^Sz?!Nh+jVhxG z=|?ZSRi)~tX~W8I^*X2tCwg{N41wYSLBPAHcaN*7u`V;`x)YmKRUf6d^5=hT!Iovr z**qsdk6^SqiKpzse_2a2*|cZ(QQn+ZepjU#h=%>>UTe^pzQ7j8{>2`-G;}tups}d^ zYUQil4?REJBLbGH?X3@Y5KisX11?iv+m!c868Z`@wio3j>?{N-T(C9fbDNghm3DRO zHwrx4ujYJ~g*)IXGwlwmb6-4DAbiuPx;rIu zWBIae#($+e-($NvYo-rnxaZM9Vcr z^yqOepWcn(qJhzAGD9-G&$!#dRj(TFQef($rOmfYS;jBPmYCdpALaNY4L|0KIwgM; z74mE`&(F(ZeIkR>hnXq4;X6e#sgKwcJ^XGbaDB0sKHQgLsp)OIN-DPfJF%IO@B=-h zQVod~`6}HSy($O&m-?Npr&AI9+*b#R7r%yc?QtIzS*#ceyCs&%x-TkS)!n$6J5aPy z)DmzC5rz}`J8FoI$8e!%-$z%9<8`T-5NhW(6^b@@ona*}su|bxXDE7OGQmJ$TqfOR z)L7Hph4FuXtNUYpl;^Z+x9ZVT{Tb{k@qy*^s@-0}Y69ZPAg@o+*K31&G{Tv~TFg5c zC@c%#FjaRwPGz^wct173PJXp$ma-3X3*>)rc49?VT!S(Dyf4wN!CFbu=e}1SDVkO< zEkYGn&Y0<-DT$D0Q^&J7?ECLDt$Hj7KTK@v!zX1KHz>YLEAs-}ojYv}FyH6~a;Tu9bu>CywC4B7&}MX?288P0=(hb}Ge z+1xL`6-$VAIB`JpCo`5RE*)@p&~%p+HkCc=poZ^UI=AnY*YbW#shCZi(L4sV zjE2Lnk`cEa*N#va-EB8O)i(ZqOEMPh%@HHwDXhS%q`46#JCiObq0-;;#6$RTI=6lP zR76bmXl4l`A6KT@dUur{{e^$cL`dcp?Y=ME_gy2@7+pBn5tiZ7hv$h7C|G~mOy&HL zSX+`f&-Uf1>`D&T7+$1uw=B718swBoZn0We*)G zcQj^pB4_s^F-|ewlp9h0ElGOtg4+H4xH~R$U3Rg&yr-D<>Gy~E+Suqa$_&2mZz2DT zOL^O;+AVN&1VYbBZq5&u?`NgY6`XyA%I5OUvAz_uz~etFEN5~O!VO~XQr$7)1?m{r z@)^ZtH{R*C#lr6g_Cw1ZBU=Z&qG@O7j%q|H3ps%t9gm&GlNc zH{8cpctTzU-(VS1=Zqg(Elr8U&zMe zuSS{y6I9Y~j(1b{CWWhDJ zofNLIR`bWTG(dC;=>)1XH1~UH`A+{iD2qG1M{-Obm(zB`trkd`;aY!Bi#)~^W1tP` z*fOZ};`Za?ie$L|!tKr#fBH?4$3k(93;VbknfGU@{qIj5ja3+&<9-X;YugN{l$3nU zLRm${4gdkQCkWG0Q@0WxcRhhnmH(~>YEm=j6pzlJ(7^xEm`OOm(Fs1wG&l8K`}*L| zt57`$FR}`|Ij9hG2Ur8PK4f&~Rh5)@LN1fMN855jW0Z@Tc)J=Zv2`-Ba2>AjhEoQJm(dITQtA2?oP|7|~+%<6C9`jUr z2WMm82mf_#qf2Wb+IRlci84y*0sthy<$*0E4Wu$q6OV|FZqnka@gedJtp)-{y47XJ z&G}NBIW^o(nl5x@gn+b5c(@w$(et0PhqO<%;s$8F8(0lS-ZgA{QSG1$VlagisxLBo z;qK>|e&O^d!CPQCeF>o-k-~KI=Gw*vXdP!j)fA-Ry-9B#0J#;8o+c&HQ%2pPZl$!h_CTk0{;kmmgSVyqUluK3KHodx9HVvIoS z(8kK@CKJ;~R?H`0NCLtJcTb=v8y6cJ`7*P|x)<1h)$lD~d#(_UZGw)Q4k3+zmTcgMAN=Q_*c4gNotI8--4` zw%pXQ#Vt)uNr(Qg{D8fL~Y6-zo)lI5rYI(BAZ31~wgLcDCt^x~!Tl_aqD>e`s_|i|jdavB>)m ziBl_~fixY3_V*!UP4YnFi`|2BOiWDQJ3B+fB`qV5p{qh00r{jMv!W+`H^j*M(~SS; z&ygzV%|Z(E2js^o)9^d#CZiX92qmS+#e_J5&%A*m9?n##Fb7^??q)GQcm8|^p;qau zcWN%z43>Y@aJr@V2?_`RBm`K_fZrVg6blHL{uBjO-_-%rJOWD2nYp}b*QLrWZI=yI zj;oo5Dr+Sy-o#TU9~P6nBC`}qe7W&AD;_GgK{-m18_;_ z%wU$_PS7$$k}!GG+=v!us{Ne=x^joWwPdchtXOFP$`KCZ5q-SV=5>;s#5Uk^aK8+Y zzRura1}UIQoahmJ`sa7h+xlT_e0vUUKue)HNPzhIeDkR7eKNB#E6ZFiLU*6C5l5_BKho13Wn~x(P8gBJV1dJ zO$>aK$`@nz!OUbPt1JVT6lBe-gQ6)ZDdnR%F~EpUX;sTs7Zn4TM2@vmDr<%UDIel) z2s^Tj&D`8PGtb(2Qvz=lw5D{fAh0vZ0d0~mfuj^HE$wR!y11M-Q`}CkDjA zj9^8@o}pB<0eDe&X1j#~Ei<)u8a}6HEmI#vFZD86%zHUUvn0|wk>2g_=RT^@qz9#XDdVIM?hOfRNQNkS3| zNW!8(LV3JchWERua?Z=oeAj*0s-BLhof-h;7dKtsLRg~KL7^g-JK+SZjBn_{OAx#@ zYLkwlkJ9UUYmmhT01lXy>D7Rxjh;FHYFOy*XFMWn8yhK6W7huU@NhEfHzy=ZQ(1v? zVcaHNV7RKTf!aqmSc^sbZp|gGGXAk%!-d5QR~IlG*@s z*=&ESK7kCF4j3Ijb|g#r%F0S%6R5P@-YyI$!+gF7$P41sJ&?3YZP}dbwFC)o65X;! zpt4~BD|HExQvSeW(2KlNk|J+{ZQl6U!AXSbx$EMNCG0Bu*TrE?s70%x8-Uc7T7UXH znWD~sWS&;}CYU-`po7Vl(pSc^KR;s*{HW$D%&i7S+_G6P1^hPF*Nv3!gFyWw9T%}1 zQF@W5B5^w;P%wOhY7GaVQ3S>u3~aaDIVfH2oyKjGXo=EzZgWajAh&iV6$WuspB(tC z?=$m(h{oR0v1+Z2zwie28+Nc<5gZBR8vrj8yVUjR(;b87XJE*K>G|+mjn0-mQ%+a} zID)6|x*yNT7oe$>GY9hAK_1YvquHM~T%n>WIBsio9v}bd$f%I*yt;I!*JZ|Zg%iBi zGl~P-AW*;|UIw(pS=cb+9f(fk;HaaR+QnbLzFxtA__A^A9UdMxF#SyN)|>_&Z@NPL zMN}h)R4?h45lZ@o+J^R@{(gR>Qk*3b!!0MFp%F@B#)n2Htv~G~juPu&|Cc`ycm)Hz zlqk!49|>8xxsc!ofX(~`XemP$rZuUbum|pKZ+F}Zw@vH^hwEYvz0l$Q8qP{@MC`); z2UAoh|Jms%#=ACEjvFkGZ;~3H$#jE6CU?u?M?q*tjY!+M%6yiE71_if8!6%==VuL6 z8WMGe0gsfFNlnX2F->W01Z;XYN^j&m(}p>aOvp+`LISt|Q0Ugwu9hc%0~18a^@gH{ zF%<`rFFH3jcc$YbHT*Pr6aLn;WEz04yzLM69Snll(IJcqO;<4WKI9qIApbtKRZAkP zag{?4{|D=H6f7H`?PE!!Jg{$m=n4NY5e0~M;O*Xs-`QYK>HG1+i{QmecDa+V0N&9+ zQ)|U*@g_;?Jdnd!roD1x<1d||fOh|=UTxr!-S5;PCyxL!nl(^V!52iWK+d5%!uI-U z_#-;|aY4F*Y6wGBp`@x6(DOiN>URpKyzt3kHs5u(W3YwY5zoxXpcsh+?R>8w^wrSf z-*=GGd?~)!4ULVSsr4i!u${TWE9cY-XGepSdNglPC|W;i@h#!~nzX^!uU``*#Br!S z@EEO6y&3@Ccwk)zF(l3jj`qj(th}mM08;L}`To^I`M&HRM0 z0GSNyfH@PGkU%~R;s!<>Xb38)FzU>gI!&)M@*`8 z=%Nl!F7u-QhuKu5*n@pb*qksk6eOv;U@Bi+GkpZTcx!3WMG#JQb%8GYHK7(9B7s>s zHLy=nD%qStA$}eRsuCaRC44wp!=3e=jUV@Cs%E9Xs5(5@qjgy)Zgn&+doZEm0?wmC zqcd>JjL*qPJRdRnVl^$FSp&{0=@P*JL`^v3$;?^f;)qCjeF%0j&*xhH^*7h+Q;xyR zj;4=^jC5Z8!I)RIJG(qqXWYXNJSPBnMQ6h17A*4?Xp!pDJj0J9CGi)4hJ(ux!^S0- zNH1y8pB)5yQ_~dyv@?(@o}(0t+(C1Ae@aZemc#dQ{8Z~lm@|qV8K>+P2EvLHwPqrL z*|{E~uCA_FnOff2(eZIYk(ZEw;9bxG(XV$w9GvA$6exdG``26C{7j;S3jFgow2Amm z+(D+iZn`3;5Et!kq5uk=Hb(TC^auRIU5WL83Ydj#FnIJg=;%b8uMn&78|P$XF!wX( z=$|o`pj=;Dd#8 zIT2BSTH44`GeT*u9x6(HSmjQWdDa6V5x z$x;3E!~!UoR4dv7%J`v|`CET~!tRIO%eh+R*NKEMH*%6VmA=f+&!@NVS9wXw$aMDf zq#gs1fFsV|(Wm=?dYM@bE-<(thTI6F*mzbFZEqIpSe9FBs>HIDsV-3nMc&jJfT**~ zSxcz+Kx*lmk1@)(cZGbD^VlKy*&hM@cl?2rG2n(*I$QXSk}aS zeqC`L&~$yLs?;7LS2fs=(I+qh+%4Q zOF){4n>y(6DQX-};~yXVH~aB#e_3ASLjHv0hjp`cw7=wN(=9Y>r!iP(`r%jB*Gpva ztS>;6%7lZJYy)cLn0DQHguanYem_Apbtv6H8ujL-JUr^-|9-V!F@6Il|M{%Ha9Lt| zg8yGV#4qjZ(Ze6R-8sue3*0X~+i(A(vtorB&o>~8@h>c7672i?{c!kveE#pbmuT`1Ns0_729NvK2A%i@oSZgg z|L+v}YuIRY5MkDmBtAYq7?!cAsqnx+MI9Zsepz(T5Jw!qHDE!KlarU_q^Ae=XJekp z$;ml8R}>UjiHIB7vX~Iad%EK|~9N zCF`Fj$y-}jUr&vZvVb=NL{|tz z84dQ}vjANVdVI4o3Wcb||Ie{@IPMo3RF;-lR<;WiatMpTZE6HAbtf9#N6Jb^at?UX zlDBZ=UvRnj`O60eG;Fobdw6&RenD?qR%5vZ)rOYNg@27d`#| z4)jE@|L<_jMeCm5xj0%#dhp918c||z87=|7#yaPDaT;-%`2b8FYMk%&?*nRv;`n}n zdw7a>GpXKy$H-Rktx-Z+-!bcB|6v6X2=lPC{wxglLOyxU>Hjo0%ez)6wp(x#9NgxA z%QRNG`G=P3^Zi#R@Siv07knkdNNYl@?C;Np`bz%SIa~t;-jn}j%>)4D(clw?yFH(r zmHV$1E>M5w(tev}84#>yJQuZ_y&oaV($MIqoi_xdw@=5;mh6aW|Q2+MyNbERNQ z?%>D&!;Sra^a`0i0r>0b!YK zoDSYUQoo_UWBl~UQt69HFXA5VNh_befyP@NkD zuzhRBevp*9eEG61&&Z`qmulk`_`ljAz!}r0Wf&R%^-EDv@oPL0V_`oeH?IBSg}l$= z#$0bdTm%3JkZtfA4k-!b`8NVkO(1U=;K`z3f6?S`ifZV`6K_FhBd|l{4T1&iw zX~#no5X+ypsCdUh<|MRmY}C)XDU^A>?wcmg15R^p4P-}hl)-H!OfX(%ly@dX=-W+Q zgZrBwEMfBvJ((J~Lg~2QA7V^kX=w?ol6$A(-Gx~Qz2}*W&Ik(OemL_w+}+pnrl?~T z_)I}T0NgEzxH@vbSDKNLano7D{V3`NUt?{I5weyar|SwRnYC8>u{-bKNG8|~UDVaU zAo&<>KbH#o@3FjA@!gUbW@;Eup>NL5o5NY#by4$e0v=D^`4Wpa9oPJ^-2#j%+#NMY zx^0i)+1c4`Uix~|*UwMF|LRV*_-;M9&ZoV#K!>%d8YlvgH0h(BH~6lst(CVcK$bhc zP7;#AO+r=9?iUuo(z~c3Ha0f&x2CC7Qqt9GBzfUz1B6UYZUTCMcf5lHZIL1CV~7+t z9hP-7sflYi#GM)f3n@29TlINHJ_6lX9PhW?1Q!LJFBc|C+{Fhgp~MssJXe@O3{UM%5DVEAW(Za-_}&N2&dhw;YJ4!_Fb#73pu1@CCxt#qaP-d{$g$r# z`q$7`Nm5A8!DNIl;xf*w0NdjEw_kgTItM8Rh){4d7RnzECvpEY&Vp}3>FLim-$6q5 z4DLfm=lCm*oAjr+Vg>6MIUe}6Oc1&r9yhj0nlP@bcI7N7G~$^ZMCs`vhWC|oO76V=h@ zHBXCYs{j2>maBh;=zoXfXw3e<9gbE&F++Se0~|Ih7k(ΝsxRSk* z+RdBIqobqXFSPXz4-2xeWCD;~i&a?rB7*eXJ4l43t)=*+K~V(6Cyb1khN;UnT)#@f z8*f5@ivM2#kK+5CkNHyb^H(5OW7OcVGA?%WW)|4j=*@i1?_T8JBx!|RWep|DBoDP! zVie*9jGsNbf7$V0f5lXME+{Y_cLkpgDiO5&wk==3(s6Jg7aJhpBrT;f252zkLVI$x z_yH>k#jR?HzV#FnTz4^G1i0J|oTC++wjN{YuQ31E1VWloQbtnJ>cQSp=Z-5xwtzlN zb>lyO-e-07l`X%+#}|kcA5}-kUC0)~FEB!m3zrY~9ZwDrN|LbIUB^VQ>ENnWJYl#+ zZw#40S*8Az;6lT88Wv}OOkY=e#U}O5=PAls8))8~mp?Mz>27q#Bbvov#2!BUUU|Lp zp18C`D&86Z7(?~%%g8jhx95HS91Nq1b6qZ8F^>5V5CB+KZmrr8D4RjrXnnpvE*Y{#RWIy{Wp(Y2Ua~A+~Vm5P1Mw0sXAr&^c*H?uvu7O0} zUn7ccMn7Bzzi{qnG9LD3^-2R3r&k(9j|1c2?$K?Pp|fS>;gJeL12fFs%L51HRAvLfd*98x2AK7NXq6HQQcYVZv?Q4LZJ2 z%ZPo$84n(v*`HCDuoD5o4Gj&rYk-maJ}e1*7_}UY6v)8nM|dlNiJ!S7H)-GTQB)-w z2Y*}m?NRGj2%3h62iWN7==G3}%aLsn@guTQNv1y4)xv*q3^-9b-#rrM!C#+6$y94rR99hMq?7j@cLd*i;TQMuCj zIoHxngj+J+7Rai$bKJ@5xMcu9Uu$vembSdgwaxV+_pQOq_!SE04%e^QtXd=cAHk_t zxh^XwH@OjG{Eo`l*0wl0S_5+NqvZHKXHU7F5G@wD$a>M}{HcjkZ!O~ZLq2LlHEXyG z6hk$|s>G$qVH7ZMlF0w**nW6mbU~Kj9;_8BJuVqQ8b9w#C@%uUXwEpuF7zQb){cZMg zg+ayaAn}I}1FLNo`ghiZh1A_#_SMq7g4a?GC=2r5%R7hUYM`=LSZ=9WLDlueLn)9^cBe;p)jrh2}SMgwo|cbE}HJD%7UI+R&= zR*+#g*-XpU9pX}7TXPxOnNpqOL}p@LU0rEi*OhwRHk|B6MuHloIHviVZY^L*)5vf!XJCp`J~e)Y7V(9Hcq@L5V;fT{cO6;ust3p%VB4F^3Q(zS^k_KH*nbQQ`bOu%=SS4b$l7{-aXAE!3FvU;%wt(Up8& z&~kFM=?-k|zx7e;`xo%>uW%Z@h=|Z}usf&4Q^fR z=O!^im6nzQlzqM@tN9c2$sP^o?)4u6&+{Cs?Q|G)hD)u|p169Ysv~Ytr)24~y?L4{ zqBw*)b^i2Q{5QXx-h3<<`Q(aqba1&q^Y^Hu4BgKV%nJQVz9tc?e=ZT_$06k~y>v3p zshaQEw-2?o_ifv`KZ+nyqBz(3 z%FMh27FlPp3-d)?NZ%w8Re%0e<_S?)(-_)!!vzGm#h@*&@#Kl@-TK_TiXDuFOjKIF ztg68i4HF_<2lMiWi+(;-OU>cNu2P3p#qrsA`}-T%S)4ov zDkFGARb9zzU;39UZK9d1{L$vvjg`8zs?Md2UdW~m95`{}EKf6(<)GT>gy}930_hFZ z%OqK|CM2wn*cH=1c| zxO&qXgPjFt`@jLE&k4WKDOs>}dzy6V#>f-;8i67mP{)Suib8AzA#U161Zk+NuYdR7sr>l@5u%**SjdE%Aw(YP<`9K1UG&SZ_lH4vtq{=}Io|70?xA ztjdSc+Mc~v3$f7jmP5~mNWmC``BwEW`!3)VWB!0}z;5pF zC)9&*h)rw)`MWC_icE!th4UkGDYQHnh8NNMdyi5E4ff6sA9P0y5FwPqsnEk zY0?Qr3gzLqxWYZru+Fr26WmF$dE2P#N+TX@YQ^u~oi0CIOMU1rV8da;Wu zqm)CA>Ecz=YP&5!xXvG#X4_NFKN-2puf(Ixccj|J43%!+gYw<$vsDCu~C)i&5`}_aCj6O<* za`yrS{}UcHhMd-7xAx(mrPI~f+1Y(@gRk%Vh7xYT&uzLEn93x42sd_%qu4;^-Nqxl zYBaI*j#M87y9wmx_f+VX&5$o*%%e`!+&oe9<>f>lb`a3q$4;L>xNsZsW##25boMLo z%r%8ph7VAMkP}?J*U{e}CHM_D9Yb`F#`aYiEL=AYXn9>@W@lrTXe@vQ?u_Er;>HuA!Ykx_h1i1o z5WyvJ85!Yvv(mI(@D?~jn4MUQw#cp~aTq**UPm*In=WPL<#vlb6QgeP;kC{G7b36$~zaGWBfE5w_~5s+=ZXuY^PK;EgJG=SW* zE~%Hv+t4X-6)bn7Qv49az`)=Sm6wi3dCdYgnkF|d2)Rk*w8O+5+!nVMqhJ<%a@Vkx zlI=i~jib9bC6(b~1vuM~yPUrkk840YcS?M>1u!3|y3R~a z)-N7bzy^VF<+s5MSfX{3TN7rTN8_tia*wW@xBD5(BN5!Wy2F<7{MyFDE@GOR)$u!}Ca@Vw^xtW<`)ezRR zoArR21XEnIJC`fS=XaGi_&~J(fdCs=JdT^9jBf_)EQ8FOVzoMp8|JfWbgIOD8tp}d z)WE)aTU=VfxXDtdh%J6KLV8>$xJvr+g+G%aMWzN2^&{Kq5iQCkDaG4OeO1_U%aMvw zKVr3CrYLJKh94JAeNr!qvFiH=Ojr>_Ht*xyo9Q*lS z+J2~1r7q-)ypY`=e5`!;?q5@Rl>_@CnyB_lH@_vY)vC%XD37M)Wp z7uU(~$!@8CT^z;nw;}w)+y$Kdja?a|yhBaUbe>$ss!o^Nx)`sF*P9=962t4fzdnot z7wEwIE{9=np-aW%yg|*A5Y23HSG@~^$3a(9r-PLW9H;VC-EY+*8xr0-&o(+D7T#xaBkwK%B~IvPo#L@ce8@98+O=kbY*qbWY6*{ zZXUBC1fg;sq3tq)eZFPXsS?%FR9LfT?nHQ%1Khx}GCthTT}0fFWCKT@-?4$8L*ZAd zdBL!UTh@Bwp84J*URXw6pFVwZ+ghrYq+>EeTImm*eDkzSq$5R{(Q)%Le+jO%ceEPs zRDX5C`tj`gVvR|rsqDJjwr$+@+#hK>h~0Lx(0(KC2$y)I?UEDF&})+BqTi-eX8h!w zqs>s4kc&>D^w8#3J6!85%U8(luEd-Wy&tm6I81Z?l+39Uj%XSI`%epJ2qEv_K*3B5 zD9lQy0Gg9{hlUb9ZX)-wv2FoxSbiS^n__bWzSJ-6J=R^` zNt+m%8A=H$F18(9lL40o)4vT}gBvrQ8!`2?mY+=z6z*Br#NJztuq)egHm-Y5V7)XS z4_h?^>Kw@66v##_Pl_h1`j`IrrdCE!era=;=PrMB*YLnV^dEl|lMtUfGVEv*)jL4@ znt}@(r(NlUR)#1kdU(e{>0=NXDJiQ)VS0kd({_-kbA0owV%yZupe>d;V)WkML2x2O zAp?cRzn$`ABl$Dmjs7%wQn9h>CVuWzoP4|ha|9;tgkNEC@#Z(L%Wvi5c3rq!`odmB z-PIq!$MRbq*c~^2(AiOZc;mr+@Krldu{4#}PKY{&uzcrC6#4XkZsyiS=godY^Fx`i zQ#en@2<74DCkLHkWmPL95X612aIp)0Jis{UTUN1e5*1s2Rr~-Tthk+_n7I_{>(94yH@$lf^J!>61MC)0E7jO=1gO=Drm5z)x z=&Jbr%8P+SALRi-p9r1(LYy{hC3zfjzdm8fZgxmYS@|w>EDh%nz{@<#G6|89qYm8% z6QpyLIG@Swi~E{%+sp1m0|!M`7yjBHc@s^Wz^f>$>dGmZDtSP}YohH#V;p*?iBlgn zruC{=p?GF%S3TKo$t_1c|Gsu7Kkix9o(I2yvS6ja`r5TUbIv^R4{g2Iqb#_J5UT!P z_D%b~fh*r0$Ik;4>ftnVCeVb`@tf*|?9nym6tAy>Z$2XTn+GW0e3Yg8a2fxA1Ydg* ztq%>e5a!McnVW4p-Iiw|q&}md&>kSPn{Eh6pvuv;tR31mLGJOTwPd%EL_VYaxnW1Uqb4jyvpw>A zQjljrdca{kAVaT%P1>SfMn{g0#<=KhR}>_>4d)2WryXb8nBQ-@nYRy3u@JS+6N0An z(bP|Z91ldvD#4C~ShHpAn@Um~6*pO=8oZ)=lT-qn)+shlhM_Q>Y0Z{cn0PAruG*guK}h?8^xuzP+p=vJ2DxfAmjyLXFDS*Z!Tn_qGSQN zX~1S$F>Q?svUXxJWg*E97AwDqoa zx4XI8wQUlGU)|eUiaAJGkt-28YB&B>M;!7SHTtTei={{MZ1hjG6;f5TNM~zt^xUbv(kDdJ!#PFHexY=O7tWv8gg&ZIx^+gmqj3K7Gx=@=^ykO$S{Xovy*w^f z@k`L9sHi9^ZnGHk`p<8fZc;;wzS}`46A83WBIGggS&6e6ISg_ z=RRtXTUbXb1V>FaM}(;5Yc`*ROi2>QL7HN#1dbUcLtzRmh6E9PCVk1!oWQ0ROu4iD&9F>%`Dx|4Zk1kZ;?dB}ji^ zph(AMqdP6ZRk{? z)!vSdz}sq2>7F;)S%Gx4=$d`B=HS2pF5$N-CjNVD?B{0n1{&l_vcC69o;}AFhO(LK zaan8SQE|q*aAg@9yIsL-Lgg$OeJi3pKoatgH?H6C@_y&-Ee)v>cwM-5aN)y!WgQ)z zDrU7WK^#L>E|6>;ww}BSZ(Z=fS}O43q*MI~2=78GFTSU&MAcc$AWTb8hiTmV?@Lwm`Q@DRU4)EJUl#Q z5i>J0a2mp)Qcm&&*z|!Pl81&BbmF_h6Q|kHhZMLpKzR^H$BpQ0FIQIu1qET@>d43| zyj43-DBn>rKY;Tl-J`HDM}r80)Qc=gd=DgKz<|E*a4ZvpTBy?Q1T zx1k(y{P=Os-M2qX&eD$=AN?&{c0p%SQA0Y0Xeg0~P)q|A+{3C!w66*jVSuCQ@8? z#l?$X|8!Syv9s$!cg6ijiLiYZOrQK(&;do}96jgv$d-6n)9VZjCdS6>HPdWR9K!hp zxGn|W{$cy(owaG`8Nh?+>BYx~;?fPzeptoE#dUUe_OBiPMKSh&+B?&zCa*M(2f^_) zj-WynhT$NqArylWr);uRf5*L;kg?0c1ga&mem4F5(QBc-HA_fk)5GoeM zNQ*2Z3}LB~9t)+44G2XDs|fRdL+WAXy7TiAhDP$-3@C~&M!LZ2I)2oVAAB67Qw{M-Bo)N?kiA)yD1C$+{=CSed zYMBfz3_o%teqlZ({1}&8oSxnYRm<(8J%7b{m3eu;56}CO&o8<6b7KF{P%ZTK#wxyU zrjffLY?@G@poUvgQnIAUt%6IJB9Ko@nizzD9kmMHy26!I^{+F3B+1|EccjsW|&kjXC6R6zmoxN zlBf@2q9;maTcIZpUBelo$Uw@L{KWpB?uUu%CfB`hqu!CDM)Xiy#eFF zoN9n-)O7YFVhEq|NK1dGD=2x?GY?S0#4TsOW%A}{A};4dD`jV&jh`{_sNpTtUAbba zqA?AXRb#|5{uP#dihF9o0V_o=;)|3Z{GcwfmO<9fIQyE5+khpus8Yd z)azwsfBxl%dv5WAaT9|<)M|ZweYWuR#L(2ti$XYtGGyR;Q>ON_*=&?;ph|^ibMB#O zOuOfE08da!>TAAHGo$EeoU|=1J^f^2qQY84wG?gVBtI7g&rS{l2P??W4}kb+sx-sc z+&qTMRX~0Ufh;utIXO9~+F;wNY$~ z+k{;cy`Z4L-fRte0TESpexQJ#kwH;fyU^~b zJK(6t#>T=Y4x+ZB<+dxI-sgF$D4FU8g2~1b+5X$LR+yOx81F!f0C9WdtM=mU(D-jl zQg2v!q|W=2SZKRh*3#ZS3O~6k^mepaH-m%ICK-Ikj`b^yrDH(;22M6uT3P~<+QA3u z1Pc$*FY<0p%`|>1L)y7TAXq&}FbiBRS4Q2mX#`=#>FhcpwEd~rv3@y+k&k(>+1x%pE>6tQOjC9u zpwn@kJ?7@-P|R_}&F$yR+^$u{sRC_Fi;Ih8&c|Oqk;~;sEu5OgMK2Hv=_#{uOCEw> zSWcd@r$=FFA_ea#5zXR^P5LLmB<40vLrQELDrrNw2#fPCr_`h45@**8=@%?TL+c4pge;4y+nHj~~Ap z1oX&=yST^^=ZqGaSo61}4_= zc)S6AU}QI9;=1X6J{DrID^87i(8ZOp9etJP4d7rikK}0>$zYe%u)F`lg|!#3Lm)Nj zELck{w1{y#4bQCU!YUIOKMzz#`ssNSr>ltQG*+$I2#M!IFk0*%uZ=0(<53=b)a!uq z{4|mro}dj8)1Qw9a+xsnox|@+tF7JPhS_Cx#$B96$?pMhB*}u(0_u~%=de!fXaIre z+a%eDr!;%W_3N~N^DwpWurTZfjhTipHUd5c{ECJ6y}|DCVB);GN?r0|zg!PD2@s41 z=Gy?DH^;gpZ zuLo}@3k1?QDi(VR{lg<3t@Q$t=sB{#(a|G#{Zw*1d3$tpB|^5eGzP@zXRl>tt!n*? z&3IT51b>9ly?R}wubau13X;zW=Q^8va>tRLdlfY-z-UefrV^^aa5x&9$r&&)taA4zkUKTCJX2<4WPJ! zqY10Av9Wo%x)0u+WSOt>6=Frgr=jbHQd&QUnhbjQ9t$}SehuCtAr0KaX8YJUdwQDR zHyUx&e&teeHM~P8Gna~{wL;6KyouJ4UkbCl`znkaXc~8my2C@GxUS6AF wQ`&n9k%rV>4e+G2x9`6EzaAF7g(=>GLFj(T&4z%vUBr0$F<3s8ABCO%7Zy;W_W%F@ literal 0 HcmV?d00001 diff --git a/static/img/rancher/neuvector-security-containers.png b/static/img/rancher/neuvector-security-containers.png new file mode 100644 index 0000000000000000000000000000000000000000..1750a2444e684e0f63d35e8978eadd0bfb55e1ee GIT binary patch literal 71277 zcmeGDV|3+Dvpx>Twr$(CZQFJ-(ZsfG+nLy&*qYe3{m*>w^E>y^`{&KG*V=1;&|TeK z-CfsJ)wRPFMVtY6(og)2^5^{ z%`9z90RSYzlT*M|lr^zNu6~}tLI4&ady0D|BY6T8t1Ci6k|rSl0}h6aqz7W%pw4wlGkrkdWQ)J=mQWQd{cXKL+EEV@^iSc>+|F5 z3rj^#hYK5k0$@i&j*A<0=T4%z@g)ETKw(uvmzg?{fBXPq90I`~A~*dY$m25YV8sJ3 zEfX1OKjfMNz?~_QR06>797dl@63iZjP9%+#0i^kdC?Wp8VS>x<;`r>&jK7&X{Ll{`nsi2n|0uwc!w^B~- z4waeSHTVn2nbZ01h(qxhx4rk=rKJq?ux{NOT_X)=Ov50>;6~35jM>B=)KYNwvoi_R zXZO=lhH<3$CkVX*&vIg0FK0O64s_Nitag3x$!K49r1SdV4}S)UDo(v^N}u6{dr@1P zrClw|aKg<@M%NR5TuUDBFTbFj#(Nddk(P&uO)5Sm9w zge!OmU>Jj#cN%}zyg-9(zyJW`Hlj+iK~wVyC^zZ7T4V=gB<5q7{r$n&be`sL#EtcZ z2`s-=XO6FoE%=FSdI`854e3+RUc6bz3%x4GCE%I$Xs<}(NY)J@0E$8Ym*%?QfQc6@ z&&L2j5dugPKOhCr3;}oyVyS9>UPjGL4MFz|ie^moq zcS;**W&?c=5Is=xUh5qk4){&j)LztU%2vp3sI3tEUZQ7Ko^T)vBq_M!7$&jRf^~(@ zG71$QDZf8KR061lR0ouxy)X=R1ABM$@ z66?Hzar(LX@%kl&sCVED(->rnkbZ>63?djIIYQS5 zX~>_G@R4?t$4g+5a4QjnOOKHz$4$lA#eqrYj?S3?H(+yS(2!h_smHJVj{SW_i4p-f z6pSP~ns;8ZpirZjqs%8cLn1?xhJ+J7iDZf-i{wVSDS<@NM2eYEN$N}zNjfdL8IO}n zByl3qCRty^CYda$8+V$TQ8ZU(rs8Ww^#i>r#WRtMDmrl~{xR-Q;z%+#uA7WkM0l3P z(vF4A7W;yvI+2YgFnKoFaExRWWh^V@BtAVZIi)EHHgPhAHnEF@Izf2!9m(XXDyp3-&s3qRHRVy2W998- zWaW4YT~%BqV#>}+dlk3}9R-gObkgQC%EzSlaIZn_4ec%M3LmYWv9G^EYQ)Nh)uO?o z%`-$~wI|&tfio^LkhQF|#+%qI7A<*~$Sl^Z$gS|_F6VOQW)~rsS8L|0m@BAj#}_7N ztLMEd#AltCv@6x~-SqJ*?JIMud_{Ve0odx8Bv>ezTa6*GwXmIFV=*2v4WrJZ+{IAE zK88(ScZtu(|uz&!gXC^dQ6vzE<1s-^ac@5-kHDsi&PQ0{r<+2;P_n)D6qE#}xrr_`^^In$=lulg0<{x$^0PPhq-X0()6cH=kDoqpy+5G8sXu+-L;xGe577C5 zWsqesUl>Q&RpeU|6?zqnKX_!AXt-*~Y^axbdMI=e8d&v=yRJn>B8 zbH)dK$pf=$voEvo>L)d0dOw_-c2AQQQ%cEb$Zp~He$c)qL59*O^ z*dGZWtz)2%0L*Eo7;7l(NH!U}DSTM^7!7^xs;@kW;ovAs{gKaANKn&K@ zfjS6cV%cm(?EQceA*}!_{X$t^VfXIPcQ1NHW`h|h(-WQI?}T#re)b>C%=44X%v)55 z^|62!ZyZ-+leV|pTje~P$R^Ac&uDi8?U zJDC!&(y`Dn5b;3~5D@SwAFof8WqE(lOBgr|j>lJb#~ZDOkFj+GvPa+M3!qf49NM!OFn% zPx=4#=HD&;mztXYuF1^F`d@4QmpA`WlZXEA0RGE>{-v#do_?!~4~mEWKUL2MMMTX$ z1^^%cASoiK;tqJ;1@4|T;z9Rnr+>f69X7Qo8IM9*U#30TVAD2uQ8p;&WOpig*~KY2 z)y96Xo|rY_D7S7Z-GHOnK&shLrY9TT#U2L$5pXP0yY|$5M~?;~n51jquj{uZA$|VI z{Walr_0G+FHKFdJM<#&;0s<%~fPnDdejqRay?Z%H3ke7yAbaI9gNRQs|DOu@7UoZYh(Lr&VvwNwKa}&g zAws2FnE$OA0t6Bup`ri~nFi?pr8NQq5viR2LoXl!A_8G5aek7n|7#WyzQ;Mr{C`Y= zKpX@_JQNbcDBb@tJ>Qc9_Wz%p|DR3{M&JbfDmo&NT?_Wc#>VmSv4FZd`s?fK_Je0> zvO?|hUW&Gz|Bz8STdfHKh){HIzHq3+!C0~aI<|tx=~H}SVqh}0I#`lE6Xbs`quyOn zfv|<$i#177=QbS7P(XJPy*a!; z5xP3O_0I0q4;?)mZ=-n#m3##DYyaO?a{wkL5IF@qdw+fP?0mcIkdT)j8IHzAL`4l= zS<#4AD1Y)tpae~yrHGw^eLNP4YCQ#M%4?vextNWY_|b`jn$ljZ^zTI*MgwBPilh0# zSX#~L^Um>ju@A(Cv1gJ$;w&(^ES2A8*b6r zDk@WHf%9!{FQDY}RNY_IckxO*;r|Vd0Ak(!dyljWzUpL)c;C;8x4s-^DypfK(3S|7 z=aimT(y{CIUvj&O@)X!#dT2L-E0a6;mn4$Q6ETv)t#YpVZ!+1xyn4Q|uuh(YsmRO2 zXJ}#7J3rapEj1fZy*@zGCl+~85)grAlcyC3r>17qjy2cy^ypJ7e}p7?R+0Q$E3G#O z2t+@C@7uU&Jzow|>wlc7si>;-Ojh{ufoBVHl@PR=_I6?l?eAfrD#;pEPPS2oX^yZ~wH z;&T6M-`{$d#o+ zR?9N2OsD$zE4)A1sMblpmul}jL7rUT&!0b=Qhk|;<1!XGl=SrYc3Lrhe-QFgM!Ql)T!S~f!PmVoN4vyq9RT{NwvMPl#?$&d#U$l(T$1^Q0!3m=o zEJBm?K`JxRfM9cjMl`o3(n#vATs#QB3l}c8NhCOBBn2APfQdHB@;^Jzi zL0J`^oqBwH%wuH`QnY6qyuFVh;Z0(6`zqE!p3d-8u3YU~0b&RimX>{M z_C3|MF6GFitV@(Y#pl|At0s!Z1-?3M@x7|pA@aNrC{R#$d9mAZq_mUO?z=bSK%3{P zjv%={hvvVh#{;Jje9ZY%v9asVnsqhWT`U!*HIr(${}0ePeez zfR=!(enF%H&MY>8kcc^Hm+byVS%1)Izpe2qCCTZru{pg67)m9U4YOJIKGn~g(>1nC zSb6@BUnTJje7;3KYWp{LxnEwrlgil28{QkO#WvOogUs7dLP!L@ zA^o>NX~Y7mT^~}Ju3A{<>&01UO&AsNszXQfJl-(V0ymIkxoelAPxKptJNPm$>_U2k zN|BwZi!tIpKA%LXN`uHC!$bm2vFLA(Csp7f$0y|EPjTpu+{Oy^ocD4X!_88g-yket z0I{&JU~skBwbEb;EhQzz(tv!5Tholtx+07x!A<}FO?i5eQ z`v*`UmDjOpQT-({M0pTX_C9ym>#l3I8L65FGUO}BWdeRGuEl1J;d(OAz@vDG9!cPv z28li*)r<=wEGw=u$@+*;ruda|kgED4BP0550UVz`*-lx5$YT<5(%G&R%1ovMr8(+N zhf1fV{yZ&G#q#DwjWye?`|ccO@0!z|$<>?!>pTwX$QuLZ6cS)gX+A-A+v4#gcr| zJKSP$1Fh;KTJ%n$7@y#$vQH#Q*DU%FNfh8i-|jzBu7d5UepIeth~>_S*UD=Lv*ty@ zn`cgS-ESY3B~*mw!44g+wU0})D;p+o4h3DsW4X&^$wG;=Z_`q^!^+K7_ITv1BRBVe zNe$IZpEa~lCU7f;pkV?*K@Rle#}D`0QSzZ{?}YA$pXRDT!rALGZbXGCC*AXITOE=S zuxFdVOih1= z5gJFWQ|-S=n*kZb`C1D+wR+8hj^XtFr@__iQmmog0N9$@S9lVU(kY2K7ZIw>OM>qs z1W1d2HJ(7ahFPrVv(z_JG`Kwur6@nNj;co%E2@P z0k3u(>1cnEO(-BkL4oor$$xwrgZyvGZIyqY^o!XAf(D=gJ*v(>?GZ$Ivw!+b@a&Au zMgKZrD(u&O>$%Wchn$i%XASz|{14ZaZp9eK@&Sk1pVWbfd2cQY{1+o-+?H#8cc zXQP%lIT9EA{U>4!m6zuMl(!JlMKGbXe9Ljd_cRh@L4cSS;ZLPVZ3GA$BPigRE>h!A z>O6!9FSS+7_e`W!-WKcp!x0W~{gbj8HQFP%ya5}Cg`*IS=vc2dNKn7GPcIKa-oiIq z;o^mtg)55~qFQ#};Z;B9cv)b`S}4On#=7}q!{$@eqIKZCWXznm4{scgP^+Ev;Zwc6 z^F<;;_3mBwTWdRVs_}Oa7NWQ3q*_xA<2~8(lpvyV4I)-nR>46LNYU!$6h$Sa0?@F|#|p1+_4;Fj0!G_7 zJZnc$ZA+C%#91$qs3M!(lFxA;i;S1Tap0_DXB9E=KFsmH>oJnYj{9YebP>d63`aW9ua?YlGP9D^0kr?}nf&_>VW*+z^vxphqgQ0^()!2MIVW(Rw zj5DAl>ox&Lz~ErzN2#51p;N+e_ipY8$%%eCo;T2Bpn)#FzWgm<+=_ZQctooD%a8|h zT7Q|UOq8FNwO9rEJft?x1OSU6ppzpVLYniG(BfTHCQJt3goW;@rh&lWC9o^YWlLdh zjskS{udRWr+^xdGRwESsJ`-6Cw1yNel+V(_uFb z@jyR%*kBbQ=BwXd8eE4&=`e2)#tgR*$ZU8BD?S|$TLm|N3iY(LHk#Gg}` zAPxUMin5=Q9|EN zWEY8;ChO0>M|$oQIuR>B#}-2qh;cPCoq`#cn-#Xej@3QN0~oP<(OBLfv{($~_DpvJ zGe9kSUsV4F8p)s|*Qi=5Y#1#wan222rthS3d5*#ohhtBQGF$P;--Q)J{l0WT$>F|RD&c%?DsA3}XpX#6) zxzHV32rRyeXoMnGimuk~LA!Iw;?p~tEMUZp@V$Yfd>PBaCq#;TEw0=Ae>gu*Y7>>_E@*2(M&vTSmuVp1ID{ zM63)91UiNc2=Ii8fI{S%zBlr>k)?!iZ_jGIzh$_{(>dn83fU+T9=l-ttvzILD?J$| zd!Qr!vwSp5Q6vH<e&?k9eMAMpKSX!^taCWD>7 zxctnfEQP(Z`ZmB!HtYpot#SlNPqr_e3#VK3+2$m0ji90#<`ebPN^%(jSie-E<1>6G zipBoIiZY0c#Gl^$i#+6uXgreSvlF-!)C84f#U&5f9eG({ad*TOAl7Js0RjRM!sAPLn=I|oLErS6=5U$W&U0wUllm#pMQzy)r zm6Vk7)L+jK<4i~q0ka8Y|2hpbLu~J%H=ZIJ#v($f;Jd#d z&2nehgr$)GMuP|@ASiG_wtNlkB*H46q*1A4LsnVr?bh<-S%|!&Ap@H$AC6&Mf@(_Y zDpSQkuUpHK1&>htS0rT}-YhtgyIww@x+4n;Fpz#-$ETg1(!HPLe&vQmL}ZkO-}%Uf zEp!Ug{bQPShz(>|3E$X=U9x0U8q~z{NwOI^WVkSlT~wY51?`>>{oBy=|JsaiNJjz8 z^}Z5v0A>BN@3$!uq0`vJt!832wkgSw{~YPrS~B5+%0w?;UeL(d=lGg=nPL#GqOHyA zx}ham>$kHO_Wr!bl`|nrzN*S|_?nGS-X^9omWu|sJOhAps3Ah%Q0iDe#%dcXCIqIn zj)m#9Jf1!x%1sFmn>=CM-`NquGm~h7DOpAG*FB34_p=AY=7erI`AN89T032{?CZ+x z{Q^xMs!#U7zHZ58t5E&aLzW!a;ln8E>27Q1lKZ2eX9%`5dn&P@%uvxnfT?RXW7rnv z^qCXEB*6O>)qiX%>L6VG8O;W5oWqbD)Xt|H0w3v)ICp_*8lr54vyT+~@nb*q*`+t= z{h+emOcfQX5t%U+-mH!mCpokMly2*N6cuN`?{^+a=|Bh|xseg^9)$NV`jTv-bqh~J z4BFCG^OKC$k!Wq>y2F|_ueq9LwaxFL2<#K)y-!qpp-E-9lVo;3SmoD#YRgDUHe&2U z{Ze0_WXpOkhaDhMd<5icyBDfF63YueJxwtIm--|ClcZER%G{GvI}HE}xmT!lAjRdK ztMGfGL-$6Thql+z$ugryr3;m6h=5p5tfM%~UNx}2;*2dE!D)4cjR;y{QL)wV zKTsw8EqT|W1I=&n>CZirGLfm%$3O{%I1zN(+6lkq{faPQ>7mi%ikhOfPaLnfM9ll6 zhb;`6o|9qa#JW5@C%Q(`6}~`S1dFq?B=}bF+msyw`Wp-ncv!@!5JKq0`mF{3xq{7) zh9i%&6w=BEw|(1SNJ%p|cifd?l`q?c)p(<&u1axq-gqbu-j1+mMF|Kn(;2+Jo(bE7 zCE()Xs)`{e@)czL`R8F zZQ~ct_*g_77W(0cDk2)Gv4G|0K2)ouO-l-U7`6+{Z*t%>YJ_xc^i@Yp_t}{O7H{EqeBf|B6pPNoxy4}ZxN`F<#hM>cmn6RvlJ88yK_BH`4`66uRhaI zk)}fAK9O+T#kl*+2)AFbsd0vS=^@fKY$STT{I!2vAX$WI#P9+}~o&?|APC$(Qq%>~^h zV2kE4g|A+`r_;Elh6i--H_OXYXZ;_4(7+!p8GjcymKZ%8!ctVzh%aW)czxCS`kN^; z?f%H-aC`sgX6l zQHK;2NE(Rfnc&5vsSQThc$@Kl7qr~=Mw6Sm$GMr>2N1`cDxekP65C1?f0fYz{PzXmwX`|%_ zdiiFHT36u!csH2bn&Quu;O4CxmNCnK)e3LYuL?J%TQQGR;t7$l$SHL%F1W`#IUUbo;5&D1I=ibA`|v(leGLow zxxwjF9n^my%mt#Afni%fMkc8l6QkX!xG0?zaV03NJ{W#@c|56Wa9C-)tv{gc|l?kso> zJG4Po+fjN5$)u#1sI*mq8&eY_fu5)h1}wUl%}q~G`GNt?*9qarB=7N_IXU-$G<#7x zDz-wpnDsJ4X<0HEAGO}`Vl%G(9y$5}*HRW~siNT}S-Bp9MjZrA5{JJOsZEuk4}l+d z2HdXrG;R<%A9AI7Z4vl}5XndyQIyI{7Oc#bMQ?PUAUJP_=26v0qk4I!)|a+9W5K!n z?##%FBAM;gwBLG1HAdZya{!>@OB88S2)WX5`FMKkmATXOAn8V#da%Ss885z|Q%mkM zL~WNNkb215tY>{H?Onl+7ci7M%}Dl|v_f2BOwzeaQ7H-0lGWj^yCIDqdZG^A8bQ~i zt^oW`^XKPG_X^F><`T7g*bcs7M10*c#fmz0qdBf7M}{+93pz>APcSWi|CSO~@`9NlY5PN| zuq`ktDd(JlSW>>pET*GfxP_1RNkB9N8187Bnl|64?Wc92)Em;}{k zu5Z&Ba3toB;=prg>C;s)t{GN}oldxEly4fhIGkGmk#HeVG)$0kbZDW6w|!K(^v&W( zPuOrfR~DBCkh$E#o)GQGN1}Lq5<+NygQ-TnD`m=lX>S4i-S8oc)5$v9LJp6xl1AY8 zVg$-Cabcbeaqxk(6QcP}yHVD=pl{Yk{K7BQ_6*!I@2MDnK|atb`}=y;=w+LU9~!sj zjuK`QgPP;aw$>yA8X)^3Ry0_*d@v9gaSCyPsGQacnrePgQ7R@yr9_N;SY%BUrFssn z1*+33n!AoF8G8q{ggQTz=n!t7@H)GYm>nS^rG!%>=6!NhtSRh@*6tG1 zDlIi)=+P1w4U6Eu5=A?Zl8p!*Dw8k_ijM}ESx85YQ~!m8T_L3ymmc%$oTaFkj39)Z zLyMoX09$}_XJYr1#DnWp;BABs2A=A6zmGv5uNIEcI_h`Nc+_BV5_wj1Qv3I*vjHGs zp73n~>Pl7@Nb)#U{K#{ty!Y?t(DWM&j-MGf@Mn%MbC|>YG6G7jluNc+W6z;4&;*}5 z66jIx*3t4!1Z-sZXm(a5svAMz_R^yI>MhgS)T&+bcr~IQ#nK#)Csz({%b&emA|r!W@MDguKHFLmE0|0D60r4qcS-uv;3=0iyW!6cJ15> z9-^>gK#<3JEJSTGVlFzGiAYT!9}Cq{I9?!_T1|H{@I2&P=E= zw}!Y-ac5HnX(K5mDroTm!`b?=enM~&2E0{e=B%WA^~MFQ#+>EApU#!vjq{k|P?IJE z<*J!C+c7Nni73r1I{hz8!-& zN*>@}x5O^D96=c4Ld1v!Z9a}Ycp7U5mc2xQc#GPUD>R1poWDkv6%ZI1X*w-F9Qo;T zwnvp4(dk~h!>SpG+&WOhMZq+f?!ykpk;ajQit+mj%OKW7VE1R^dHx0h%s_@mAY~>g z1w;+;BB)>Ev-_Sybr-eX2gaLtElz8Ky!{a=Vf8$%RWAeExwvOE_QW3IiOVcc#pt`5 z;2eczSIT-nGPq5(o_ZI>?eTuKkdzSi6yczWLPdHP)tSLi(wtxnw|fu; zM-<7K7n@5k3OSbMGt+VKTNi|k4`vWl&^#ot^!$x!>US2i1^ZDV!+(t;AMeSf&Mlqs zzkzjs&3WWGFys9+;oTKid0zLPbbk=1FBnb{k{6_mkKG_53={5>Sf9d6)xn+aJK z7xLC7Wy|NUcH7i|xwO`1xc7y0Tp61;S}==2H6_L;#0*Q4MItIcB;15mJNF&%^ z^=^GS;K%434^9;vx7jS7kL!_uFnaHKKL<|u$QA>K0CqlZ`2;wNn4h6{hdhWnV!f#T zw2*z%8=>E<6xPzjoFk&Dsm42j*O>j#25+Z#sI3i*-_i&4+-xE?OUAUUjFO=FPP@wN zSmn=A3iuAQ1YrRVL)zHmMEgF!Do6RQEc>IOej(ITtaZY+yzb$n(dIpeHp6*!9?{~I zlUbhHiFeF{%BwS5@w92Q?5HKB9?mLTb1|LZP*F05u&MmAJsh?mA?K$&FGvj9nZMGN zhvIL$0KXQ`|HM0z&zl8ucPw7*&j`X`#|Yw}(IEGqn-+c!KVsGh0x?~ERR(nz!QX}c z+&@0kqDVEy4VtMqGx&#NUs?=C23mcWxlD$2O=U<|>n-fx!M&8+B9JfGP$szGt`;ul zuu!)7AzL&QHBE*cs8!jmvX40imo4c%tt`185EozFnNT~%f>a1q0g0$q{|0VofT-lQ zD}Tlm4zT$xap`~W(Ifh|UHna{BOaB9`#cbBF{o>BLUKvT~Uq@8>jev(J z1qC|`MqW2r3DtI7Kw07a6}@AsXz#NgL$QK=H?vf=Wld#|{(-Zx51K!31t zx-)iqqaLe`a-r$aM^E3J8Se8D7A7v^_#y@~iMP8((?>1H6zc`1q>@-i{tZH~YE0l; zxfV=A1upYYMIYP7F2CSqv=5KH6T2b7?oLc+X6=4+>}oGEE>v=YQqqua0?L1e@JL53>L-t6?SJm5wM$EhDieWA9C(+I5uG>XcR#(SFF= zbblzWWE!(f_<2Z?bcrhp6BPq(8FRh-+W~QM9jW^mJKFvABz05;MrZ z?=HDE7mWHfvrNh5*)&e8TB}yE86K3RR$a@e`hJa^mGDC`?`0Ox|)U0BKiYhEj)db`G_|qT{xR|jrhOu~b zP2oH3g=!&8%0rOIVDOaNeu!S)+m9K)GuWIC@8B{!J`k|bZ4GSJvmB4@wR^3NjQO`y z=~zujR-2rQ1w!>Hp`h3603^h2CNan?=Q3=%>WgQiB)4Iu$B}4frVsv7s;M=1yq!2d z)-+C^eQf-pC(1?k*1qE9Q;D<{+74xUy55USIgdXTalMwAz^NLv%_NBui8Aib?BmjE z^(|9iC^x3CD;HBRg$oza-%sDDQ8$CQEhcM7r*>E)tg6XpjL$^T7U7#Fkj!wf>hirB z5vkrZ?5i1rTR%2UG?0;xs~5+jS;s_F*=r*mqr_70+7a!mGctrtAX&xGO6jmLJya>y z5=Id4Fn=8xLBz6zT-RlIi=;AVjhqBC8fB5n0+6y>6grobh}QVn@!>ZYdh=(yHN~y_ zCNnljEi`fndN@%Q{f$;oX0f{(cC(t*QOn}asbBQ($qyP`y@fhHPH?WUZkTW#+-t>U z=?8=3twvp#QV9svnT9s=d)WyA+Xf<5UPAa0)Tn_l&M=Xuh zHU?9{2=Wzk_RU7Eqv3?$Zd$-)^Z~^%c@GJq-$4wsK)=KrcyD8XJ^W24a3#yDOeQip zfYK>F1$tGY(y;{%^%C5N58cP~gFPok>&35fDNu zVhgFtypbmz%$spgL@qP>m8AHHP}T<4yM*nKw=b)RY5IIcQpo)h$)fo*lPjAtFO1&w zApi5kIio$zfS-*A(-e0Ocjt2I%%uHNpLy2v9dy9j!7lguvU8k#Q$X%~uBjo&F;q{H7XfXW*eMa`N~rTHhl$4FQpxaIi>J+CTX zWo{Qg!PJ6o#yhp(D8WM)xHeX9A7yOn?v-)W3kU=?X~ za(Q0X9L3vxoIFU8cEHiKDv5F?!nQbPErG;8Jk8#oCuk;cgi6p2YiK@&i&LAdDZD&B z^5e83QZb>9k*)ixfnUE#iot-bP-xP!d3~>RNW%_}k1+v6OU#Ky5t6YlMfT$e$l?gZ zbPBYBvICpwJrHx1V>0dJ1$HVPR00bTunq_)cY>0#a-z>Cg8by157p)1wQ_KU_6*r= zc-M7{(T$Std6JpPPvTu_QB7GkRSVL}r1{){3CYVT$-ML{4^Q>e367vNDWAYZzLm$} ziG+@EJcIr0nm&@6yU8?5n!lN%FYb$+Vtp7lG-TxiVd-=@dkOBy*BxAL z_RA-M!H?MN0{|(pX(V*bL|}j?w3&Z|$(5*UO@=PI9K^5*Y)%0Aw`ucF6ev2K5sCM% zM&*9q)v}O-ElYDfhWh?+iPrMvcYD08nZ`3zCnF03O+*qoC=`sZl#rsu@AfnQ0Q6`I zajY}*f`!MtR9z#H<2uL7W|~ak$FnM{pV4JPGs=UGb*utX9_acYTs)(r2 z6A$1^UIN2&TPm*??dyIB>m@(LPh<8zFkKD4+^FUB#J^RnS0Jz@a41AkV=vB%&Si!=Mmo57h6-%F84BlCt(G1Zz#RR$n z4!DGrtma-#vp(@%!DqeEnfSIg@j#zNvu34*FdRFxF_pAe3@m<9`02>}^NHaV`C&-OLA;%;V|LU1cJsC9v6Dxe|Lm96%>f1Gc|`5aQRVp2;%X!8RO+b-F6H0&{ ztB4_dosVw(1DZxX53^eXAqCHftbFWPPZxdkn_XcGw@gLiD(_I9UPa49_63kH9Z_Mi z#m-SQa`Er{p5c&=qg=l}6Q-Dw+&m?}(fB)=Jjf3YY;TcN`3lvPRyFD%%GX`i9eS9b zW_9p83iu46{_EQmqT(5pyl9@D9apPn%jmvun|9{9(zDS_3TGwb=_K!kIFHmFN#JM6 zopt`ShD9i{ZaA^HD*jz7pE7MAjA|N=6o|FVc+;0=DzsTG$Kt!) z&+xzi4xhZY`nv^JvSu3FF{1z;pAMlEUy=;5Br;_rxy zbUBa^*o#%=GJ4dLL;`xye<43ERwHR9oxQGMQ40#23$!ip_vDxf~otQlcPIMA4;*9yC3} zI!7b(&B#6Fnem8(-8f+AU>Mkppf7x))5p{z1P?!oqz+r^WBanYzq1iaucda7i5cw7 zYjrQqQ4KXk$qL@vK~Kdl&y(%6A{OwchNdAT{3 zg46;*yV6QV{ahgI9qJlZ{0aHaGHxI{bSd5w)mrtj(s4yI#mZ_?twgG^mr&=jmc7#8 z3_Vvh#_PF#5Te3Tt@SXy@bG3Do~w`|qN0>iokW`bsA!mI%4NWzDtdrn2|eUdnUM3M zmLBgxEvZ@voK2p6ybqcDMkBeXN&W|=eD_3Umc8H@#)|6cVP2JL3q0c6`4EUt@Ny3F z15{MBBDe>w@qT_>{4E<^@|p(zkuA$ncSK9;P~G?aM?l*cEyN5Xa>B3!WQ4(Jk}#Ez zV~Dm>aSM{0)B<+xUzQbz+344Hr`{UsIRk#3_wy`BaZgPH-F}_%i`-l!c6oEpfb3jY zT@qBKwUl5wDmD0LzH+I@lXz*CW!epvBB2ZPHXNT^Z`bc`)7wPoB=c{ldHMCUaIrqt zl(!$?fjbtB3zQHvR3IgKVe&Lod-yf$!Q?qneVb2kdlRe9b&mCw&1POV@Tt3f^bDVd z9?yID6_3=Afp;o)B2qg_Ha*;^#n$YF_P?i?I7*a+j8QhMOHB!=nIX+Ct3cIjtYnXs z44hs}+R_`6C^SPTBiRQV>Ij)VB2bVrV2FK7MZ{Rs>4Cc@#71sKx3nR7yruN41*dTB zV02vy_R65M$=#tU+z35eP$4ZR_$PgKWY&01we9QZzt1rYaPd5Loy@N;*RK21pBx`Q zTCUGUn;Ok=Hdd{x@mE*1aRIr13i`KjKooHP1hvzDrP}1uj^5&XdjA3Fads^GyWIu1 zp~M_eFrR&GqJFKQZhcn}h8!u`NG&sde$PLr!e>c_7^wnALMq!Vb_;Q3+zu^Sm~UEQuD?i* z(&VpqkC9wMdYomB*z10r+=%xTld(LW*ovD3`ctVhRDY!@%rZfw1Vxt+Zw5-Sog~va zG1<@HRCq~+>2RQIv9D#`0!tgjuN}loflVQD2a%(@>pD$t$)1J7P zK}iLV$H7T(mx`i4@u{TOI9EelX3-8smbWq=D^-pQ5+xWad)obSl{P@LgHImBFj_VON6Kk<%k ziK*pE0~<8n)8KR~l$7_Q5^H!;$p)guY=Zo^e{*9a;9F+IAAFQ+4U{|bJ6v9Zvn z1u(j~6`(vaC174O!dKw}{}c`T)6gGnD>+4f;M0BJ=FCCA>~J4puW;1q9j3Haz*IAG zT7-k%fsG+$L75F^p19gOj$C$KdEOD!K5BU&!DKLjKSGG8iROOcppn8B`pc7ea7D^- z`R^ZLJZ1LBU=X+EGu`Am5wbcZxW7|ZMxKkN!#azp>pf*T$Cwigl=c8xo))C1Rg1U^ z;M}0p_`Fr1zB4CaHA%v7yOxm$&vlAl^HFlmDYa(?8CqXmJlhebe~a00p})e6onhyz z_LTA6UUW`rg&?@uU2(gzbY2z6#=|*kpNxi0k>3w`Y-d5^x(G2k1Os}cVkj!0eXfeF zrfM3?z^t-9)Z_6!O8w2fbRgWW&wp64%sK)~AVM`uh|uFN&ohS1fU~q*8UFtO#6Ua0 zqk@sNY2yR_w-Nt0ecj#oR{B^@$j^s(P8^(!aYSm_ii^Mq)?i?Ilp0r~5LJ$xH6auD9eE!d#VEjXlh5V@E zAAaxG7l5M8c78t#w$Pg6>3!c!;%FM|8S&tt!af=k-|}f>u`J1CwPVfX6`Ky z;NG3an#XJ04xl|BR38&!W|~6$$iqr^ePuO5{e#1BX)0(mbhVff z6BEl<7Ir;)4_4+y2Jxj+K`kI}!A>LM7?9ULvshE;1SH9e+MhaMAEUW4chA){bjB2m z)dj#Smz(g++ZlLbR|faC$0sLFym12WUgp_VY9i9a(ZqOwc)F)>Iai zAu}lkrZHhjVlxV{yfhW>Rd>Ly98QefA4z|%lZCCUD4a-^0xT~{!~2xQ##5h2lttm{ z8Fa(RbwlzU7NjkwEfia-G(s$?dL*te!t?;+O8vW&^KvBh!j01wAyPL^Uq`5v&RCS(=B1z^Obg4s0CR zcKqH~P{Fy>&3!wAy%Ep<;7vGI-Hu1M=K?g4@n3V&V^Soh?vs1)lV^X23zxfi65^$! zhC<|}CBi_DbKNaXs5#e66~9a9?r%fiy7FTz`dfU}bOfi--Mxb>J(V!bOhF0)}x407F;VmYEP_MKoxcgN1 z{>ykT6ol;TcBWZ7U)7c3b{)}Xp zrtUeBd2tmgQ}W{K&jl%s3IH1w69;Q_EDAEzM3s!&9)196ySR94ZAIOM^Qb<33Kwb` zP=D?Ol1q2tkH5Jlf>g;SgI&21NXCi{Yp|RLHELqgF%HlhBvQk9l~}*7gj-D<3`edF zOjb-duY0aw&(j~^{G}emRNRDz?_7zD_xw4$^8F96 z?7!cMq;R&Gb*J27#09GE)%?JL)W0&1IRNya_B#%30g$os>Y^xo&DA4oMLC|l--(~T z(u!l9gJ^8&K%7OnO{TkZ2V;Y@4r7Q$-D~e$j?ZmK5YOk~>ny2R5Ewz=YIuuhe)b_g zd;2QnrN(faVf@36g%g zn~@nEd1`&*r7>q#Vdv5q>^Y`nd2v!%GGf9h%hY5>uiTuIC-v8nFs)S*`l5OboU)_- zpd0Ob-HesUlPWq>k~IGa2$7n9%;&X6pL2kDs*(%8DeXa~YldbfgOyLY)uByGG)V`YAo&u#-u3X^ zP(wDl%U5l@N<#sI3PlegYe)379VN&2K zKz4dOod4^GIB@<$oV~IWn^Wg_Xc=vQzaeA)(!sbX>(dzqHCY`zv0Ak?6Xlg@ zs47oI4r7K$5(ET+a3f&C8h`x55B%{D4IEB*ifkLAEonVnQCP5XP59#=p-0WtspKmbWZK~(MxW$~RC%^e8(G!x=tz;S;Rot^k5rsHvz63d?jWjyMJ?QMmuYY(Jv>?IAgyR?Xu{CtQ`mo~4m|_?=%BHs z8p%DD3~b#|!d>~<)HAbteFP-%dp+9OK`V})Xhr4549exgxsUd1M9OoVlkZD*RMG=a z!$yGE0_Y>$+U* zd%X!Qo%C9jI=2h{=_Jt89c<2Bdbml>RZGU^Pu^ib!(Z8OG1G*kyXLl?{yv)WFWVTM z6pxi_qES$sioSjahG~OFzRLY=J!0Z4NKCXMhNo25!9Qie@}(dk2+R!vdZaV{;gi1~ zi{HI_2xrbQyv1lmW`?&|hKIhm8QaPuBmSXscH|4HJKD%;-sq{qU4?BisVG^q8U1vI z^gc!EdBFn_JbbU5{cW$Iro?uj)X)dQIFUH#*U(fg*j5p$h{6!pJ>A|#=V-J7g6)V zJ%k;Oa!MKj^KtOqGviJD8B`^=%r^pcb#*8xD45r3gWC1Frez+wq;AH!+Fo9@Vb4#0 z0bPG5+OG6dcR3bio44YYiehA^B_pdS4@Rzx$1aYqDQXTs1S4N+c?nxmk57O3EP9UQ z!R)w#hVwPFm162?#wTyQjWawk8ECu0YsuKMCX*Ax95#NW=wRyb(!y0W$r=|6GZ*}m z-K*1?5uc_UO)$m;PA}W43W}Tp+Avw&;_G%FG5dcR_AFu3guHtfdghrWVa^6fbK=^6BK;7+0!q}^-R4Jv}z`4^h{hP118k78Pqna$*|3@b1W3hh~jrXgeR;JQeczhcjvFw6aW)!P$ma|Lr%Z<#~cSgp2|8SYDMCx3?*-#m`)?tTo?^Q?mo9F!CWt|?-o zV-OviMceE3drkRO~{UTVq(LG|MrjgZHou-JHCa#yRURo&=$fM4Gj(G?CeBkWo3jn z*M{RSzJ&vH6U%)eq!d(O*X}Bm7G)weBN?g5iHs{{(RRQz4>b`k&DiGYqtbBeXFrd$ z%38E`+qiglBQ851OIIyLPOKZ*xuwc!A9uryNK8*byoy2`VabqEikpgnHyS?0YezTX z^Q$M0bkue9Exc1R2qdh>()76}Qd6IJdC~ng<7`~iA>{$8*)SOI=&=;{M|9LFulo^^ zFE^v;R<-gm1bo6db-gp_JjUjF<*D;HS~m!9TmrVNPC*I{xQDpIePUlbj_U^S{a?l7 zufLQtfm`$$)F-zH0)jvY5Mcbn{(77~Mq~emHpV|ZfH*Dw;c_frUP8wclW#eNpz^sd z!ZSc;J*RPk&ThufN^W)XcFoF>F%n(9*zUN4GkB!vmR$=`_nEix^nd&gXY1OjM&_le zUjcG+sha4ac0wCNuUu&6JbW45y{+i|#@DgEI1ytVFDj4yU`vgU*kg=%Nz}=MVK*{bvlwt5g^wAgK*OYqSYw2Aa339fnDgGP6_UFEUy^ zNh7DZe9g~cn!J;K-BK)fuARhfr0bI#r|U zSw^lh8C6NCOYk*kPsA(=HYQ@n=N^P(e+#0i0x?SIy5X&Y`?bu-dbWc4{uQ*F(9 z;p`?s_2`lRkcC8?jqzt^({#g5T>24Dq>2p4zSXzi8uFdv0Ohy0wBY^PL70m3@Z>{< zC`_}^l`^gA_`Gb{kdBvrauO%@)}rBabiOk8{4~H;OEy8^Mn{104X-b>A<@rQRiyfU@cvb`**KKHtoCOqb$(VA(Y)Vh~CaN9C_p@yhDpTfj$XTCVg56FA~jfzfBVj}I8@zC zUE@4F_}JrEnV&?JJ_kB3p2OQOy?~P+*TMc@l>f51OS*wte0<;l+{G(L*G$3HX2s3l z`U@ntI}ly5B)D56D7W&`r$|(Baj|w9rEDuAJDE^<=RL^PMI$LOjvnFkBpHf8MS8mf zLsbO^w9u`)+0SQ{Y}&06OrEY0&47&Mn{jvcAoMYlJ2j7AvKIHIxe=3`907)xIwbBe zqU)p%<^;aR4?KLv;>x%~R!GC$Fzc1Olov-5?3?L8WkXfGQhE11A6&SkXGCLQeI1Uy zXVdI2#P9hv52kz&1j2{_;~y4PVMAsiDykU&(C`$V`hf8ddCD=Q;vZh{#XtNsDFKN& z#aO>d#Xrnn5b+QFpekyVTwIRTYnCHQd1~ccmeTSuetWnVrE6AUMKXy9uO({N1|n89 z%Xy^+`!99Dp1cZQ`@-#5U7AUG#%$11&A?NXuaPUycYlOWYWL!N`z=V%GieTg{CI@( zud?By$q|xwF(B_M&Ra@*MO#Qv1)P4YoEvPo@@wU^VLn>vb1*WclM!PKJ^boWTi1eL zyqk{4c4t!KX8fs?6Q|!fjrZyua3-fBMcXJ;Wd|ZdK$!w5C?t7iO{8i*cmcnwZej-} z;*mf7Biz5W6e&s-i<O#;8;jmzAS1Lv0<8 zBzGUGk5^+bz8Gst;?QvBILZbq*>HpSpkLnkuA>U!?KA?uKfdRW>DT4veuVu2{x)jPc$xMz)ptdK}+> z5G^b-y?ia!m-yxKw;=Gp{rz+~`RiZ9VzJ=nn{U=^)B?XdTsd`!P0vCMpBP1;7H3k# zaN$a(v&14Tld39H2w@`0%2Yq{2+=K1zS|1R79K=hcA%+7#k=z1Z_Lmmsmh2Ye-H&- zI)}e`>6a-6eQtdCzSV(F`K~6m%Rocu7z<}lFTD@WaC_)#f$~le5ClSrfENFdn`G9g z803${Kin}A|FEsC6&KH+$GOv|8UOGyE>)jE65}8K$v4-AMfpuFdZ%3Yjt7Q=k~&n- z^VG&dS8$e*MXG=>;Cwd42pX18W|}Zqux)ofUj2SOj=p^s|8lMkYd55#AeC!tZXDYBhj98}E6!c) zMDwr*8y_e@Iz1C!(=Vd}M*f@G5h-^wUVnZ+hDeo@H#~#~Z(W8oMvV5aw_<20UA}57 z3izY*YtGu558%7sc>(o3{4oyMM+~d2h)+z!vO9THzPsG#pu*9JXTJ9Xw438mR%pWI z+D>#2DhH!RL?$95F*^DsXC=kMUH-ZmfFJ^S&4@6^+<-wngfe}wNoT88Sk zevF^IMZ^BSehk~3TAc<<3=)%a@a4bwORP!ptzg;?KaZz>dj-jNB;g+(s?f@7-v11K z@OlSg^GlH2dl?O#-LNSgVRH;pURjMl`0K||ILiM9@yT=l3%}mqOkLZ4@YIzf5szWn z-ilq{#FKYlFIzs10~@HfJIpezE38=gXEz7E@$4dj+`D%#PMtc1^73-(XfH=HPX-oB z($x1BN@H)xcBCl?uMAF?B zlvMey&F#OOVyVVCS+bD;7d`{Ezw4;RwIY#bcd#6N6g{KGY~Jh7jA zEE#RjxHmomrS1#j-jQR0-hHRgat}AT6HRb;)#ANly>PnhcP9dm;gsb})Wo@njmXv^b6E+# z`56bEd8HYrP7I-io)Y7%4C+i=-3}MJ+J`Ynd$mguG%`(a*%4eNaB*Y8TV|@LiL_s;aKx!wDtW0+c*6s${DpXbJa4W zyzUGB1ro2qB}-uCz!sOK3_gc({MkJ?-0a4xn{UCUvTPXoYVq>(@8PoUBEI*^G5q`2 z*J|X=(bLJJ$O|0&6k+ovM{gJEcujZtGK?+**57pxvWBbitM`tf@lq?Ediyr~?foTM z=7x`dh9AHDF)npEneQvuQpS_C{jcHIpB^Ov`wmK${uA!dSl3nA8fr)~Q>(Blmmb8N zK4R&wd$PYnLqquSkADoO)5()SH`3D5ke;57?c28_KR+LFadBMKj_rxbN{a039-D(Y z*gWr@ZV?~ZVqDicO)d-NTHsyeW&h|@;EDiu?XCl24lfMubD;iB7l!+R*v%#+XA*3Z zso@$9;Ky7T>SVy%;uvI8{b26XM?WuHdC-kK@w>qwjI&WHZ>+kD3lQ za<>(rKp81W5(E}G0`nR`eiX~u|F(Sb4_oMUwh==Or?Kx)EqVqS|FAif@efBE9P}H- z34-ATFsETzfev-&kK&ns9Y8^*8J(>ysAhNub%x$teFU%f)^Wpn2v@Gq)A9Os$d2NP zf~qIz*3JBeK;$xWLqDGEsH?641MX$8dM7*i7(&hQCU{(CByk)jJq`}D8H%Cs^1mi6 zg4h;)+lpwe7o*g&mOy*`3kb%M%3w^Xj9fD;BPIm%*$0!g*$@?tP1`Hz>?sY^bS74R znStg98IzJrA1B>Dt|-Ysc||%Z%Tq|yRgA>>n2RTC?d-14l1SNMQy%)LxL01B?(fz~ zThw{vO}urgjwe_d_}X9nXWY6n3vosd)~zf>?BD+#-fKFC=U+L3-G6=yW7bfeg=9$a z{DjqC#2-9z8839Xf|S`x;23D)}S0Dw{p;4*bO*-G>5taU0ZS1aumu+SAn3gn@wp zD8~{lG+5ucbEkG1Wi+Z2!G-%kDw5$mQw`UpCK^&wAB(Xp^hrrDm6yVlleu8Yhli)B zj#FphYHm^6UFt{^hLmKOE6TV@kUHsaCepr8ayZYje;Qlhb+CVQ8~}OxX<1qsL2`J} z@wy$uy*gw*8HKzx%1({H3C_CCUK4uXvEl5?Zd~3+&x!f78vns)junA|i_=k4v zc}m4U?DEAw9%$)y`e&ftxV{3s>Ka4Y#dBB6X7^aphr1F2=?pJ$`%f0Nyyd9*=Cuf_VaW z+}$VM!+RHc;EY{?igfGfiO+OU&CB-$Hg3Iz>jlObOyIOTW{qdgG9xk0j@mtTByWsH zA{Vm}(GP566ytU+Tgf??ra1j7&^%qvtESVC16G;GW@jTtjgBNNDlOT5 z3knUiiEs~Kpl^U@R8dIcgQt>*i`qcgd)AK6Qgv|yQh5TV^QL0=?zJRRuVH9#P$PR_ zu+_5-y-NKPStM-w!45PHsLlFlA0#{@243$CwJbrrF;RpG7zMcUn=hVi^6@@m2Q1>ZQCprsX6c zH(lABN)iMXHv;ErQ?!KIBnu_^;vb$s=kOrf8)!Sk)Lh#_d+KGlYgZ`>vS~oi-*#$J zyw6jsUl(gZ2xve`Nmsz>X&mZ9mu%F1kbtMX9QYvu?*NbNdPqz%Ch)v4TKypEjx}fxfHx~2Nn;GlbOtN3^L)-2 zJT2|inm#JGZ$(6acOy3b}Zd=Ysv0=5Nu7gxTu}Z0Y`rQ zBU~o0r1~e@LH~ulJcVEy<_-?Ei?rmEEgmbYau}>ExSy1!Pa>R-YyHg)*y+A~>fA}eM#%5THvN7CN&j@-Zl10iD%M;hQ4h+A~)6>FS=(uo> zSQr7`*4+YKj}=}sPuJr4n~J0D;5$@PE%*Xu^*!C;lZ8J#rJbvS@lt1eWIx5%9R7e! z99;N~8YUtlDMR9DdSP-hn0b5a5Y+aN!DL2EQ8ZF%oU07FCCw263q62*C)KLb7e@g3 z4?p}6J9g}tqmB-Bu{Iogf${pvZ%SbWcHh2~@eeZ?zJsygQs`bgnj0YeZ7O`+08eO>=A~zILu1DRC6V zvaK51>XmAgL`m#ouOKQx07S3b_kZUs7Fe{!F0jDv0yBKT-92Z{%=f)>&YAh`cj3qCYw5q6SUCf#F_uskIrfroMM9TLO*zst6$llMcW%z zsJRAKEz{FqkEbIz$#ru*`m5j9P&+FU&GQZ-%_2aHIo^Pzgfx8qz6z8iQj0kY=C>&c zQYvO;^WJVY964T(&y~*`9N5uc+zj*}RyXunphjgRb~?rIlP5J?WDdKBg%Z%ews>fj zX2$++lwzy}PyfTu@yhv1H1{Q7?Y66#EH4SpD-LRqPIv{cv0EB;R7H=xVcq(O7?9sQ z^k(P1%#wmt>o*`r%Nz{87Cfu5fiGKA&ebDAz-tDh;rOZs`zgYX`j@P%EG5819K8*9 z@7}HWNfk2bTr3sq!A}vtr4TlnN;uCkk=xQ`a5Jf}{p2~=b9K5^T(@OQiDeICO_B#;+TXXnj}-gn?|cp3e( zgpqrTMgGGAWTvNZGn4rb6HL%>=f*2s48J1wesS$ZANM%ADEP|Y1~u0|vE#yBGiYTs(g8 zg*+q%NY)!c$V2LSN`e#&d00)w2sQFJ^}@5bu>A*^=e<|`h_Iu*-HL={GYU$xfvU@B zy?jLxGW_?go2sk5*D#zY18ap|d||nIx|PjnVa+3oz3C{PKY9kOZX@pe?qA}jWx2G; z)WcKb#2-xE3GiD+YUXoPaX>2uIIX7Yipopst?ZEdLV`bDG$T& zL-0iNH{1DsSZ=rjn!HR#*qMi(r~e2~Y75-dPC4so&KSjll)G2>Ly-?Vg}(E4SZ=)y zn#@#q`nlWm8#?IPTi`MDz}3_o1%eciekU`$GyhV@>o%M|=VbCi?_KG(dC+%GxJxrx z?*{)j&}8r0DPGs#ir@UM5=U!kCXJ8~De67YXF+l?3ubpbRCD|Iz<9oeAXa*#G2D@cfBBZ2S7(U|T^TOO7Gx zhJSP7G84g`q_IQ7La$lb@bj_rOPHsN+=tt@Z&y-x#0KTef5^a7c`CX!&?&`0Elu=m zW+sR1pzt)g%cJC~2{zybm6Wh1v-AuHgWP8qF1+IwH=_vBH6C&6b;zZ;I$djr1Sw8q z#!GfIo%0~&8Us?9?op>KfP)N{5vb#FDGGeT*4Ts(tGb~o$ip{w6`?GffigG;J7^KM zk#pROzdeCZ_g_Tq?KxP)(E1S-`U0~O)Y+-6>otkE@%HU_^2e{Cui<0->~DXK2flS1 zDrown7YTW5&)}UuJc)gm*Wqt}dOOv`l)B!!jQ+z<;>E)ixP7J9m#3?0FaGoS(+a^w z8{EPnxB-`K6r@IJ+lShb--1Md3FLqIuTS96IST*o0^Iq) z*M}#N|Kqbb@gWn)v$@HLH^EWiM#GU0vHyq@3%(R!^%Sr%BQ}5Q`$%H~c~eDcz?#v1 zQsh3&%ge*Ug|X!SO7s4727w{CvqR8`_Pb;@)8~5!_&!JTs?F3Qb*T&LG&PgV)7Qv< z<<4o$#C)ViF0UE1TKV&8-NtXvzlYIV{{Ckt_ua{LS_gewR&6fE+C|BT(+>%$nHh2D zU0sc1Z`olJ{x7qj_z%Y<*wG+o{pazOZKv_r+ch|I_$562)8j~@Z7|)?VeRQa!^I0| zi7QupgEFtW85_)du(zWM|MTxZ!2wFE*+wgBYN~L&o;%)HjxX$5I7(|Xd>J%0nc9>r zr1Mmpvks5_!w>Pcp%>bXU&CK)pft?m=g^1W|MW*_Seb|VqfG95s?ys~xE3dxOx*n0 z&3NmvJ*ayBN&K+&eH51zG0#F5sxLL7yR!%D9{d-4aiLFF=IuTh-n=z~|6k9L;UX0J zFMjb0#pc|?{0Y%sTwT44(no=UyCWVZ>gs#%6TU6DQ0E?z{X)I6su8|mZYFZ`a92a6 zpW>}MLx8xbS@6(NSMcTTWzdP;A1OSE?j5x)Pz|hs+#TJlM@QI*`xlK3jG#~15>v*& zhTb>#4)Wo;)Cv!G!Gu`i7W{JKLKULl-`KrQ;V8}aQa0+L&(k2kg?THK2aPXnn%#&T zQ4^aEO|DfBYsOT|6S%|>k5QjFCVbl6s8JMkZP7Sqh=U2z^C?q3FMiy(+{PtrVBW8t_JOW;wEC^ z_Pi1-swl=_E_YE^NwR)sAc1@WYEOQO)Ad()A_3X+7hq|zH!`QIw+U6%r}5%B8&g+M z&_8zqXX(Uma~e=u!RW8zmFKdep^84Ymm6v7$v(AaSn;>z3Iwcz^{3FJ?muO3VwU%Ft)7zyOPye%uxFoFDjC4qc86UeWf=jF@SRw$n~F1DU~ z?m2FFT9qJ4!lELUiWHz?X|!USR#g%=|GvU`AweznVZD>BA4{e+Ml33%Ngw@x$1`2@ zt3Lf-#Rjq>BXPdv2CTmssEXzxaRx^3<9XpXrBs`Kil()PDX&Jg@wwP}&z~bc?^V3^ z()&2iP?>`R$<@`utGDB`H(o1zz8UFj5x)9^Z^QWXvv}v!2{gB~!eqOmB+1QKb`$R2 zbvv%g8?p`b>K=qpHoVw5&81`~4i~tLWw`6J8}JWL@5RNVdqHmvlrH`fwDAjY-#2#Q zXOBFO%1;l|Pvr=%w5zdV(_&nD?+ACFM+EL6V=NlmVfoAsYIdS?^0n?g z0^5o6jA+*hPmisa;>+Rfd=>OmltrOchK0R!P##|)m7UnYY9Q&hb2G!w{kl22LtC%ALVBBTu_kk`-`BpvgY@jcA| zLf$vE75kt41)lw=n*M7&6n4Z|F_gX~fq7;YfFNieamLA3yu$tEdsL1eQa8{1qDFv?MFRO7zl$ILNd>jS!O`IDS^VFNy-)m1 zNg&_B1oC!;JwCUjx8nNy@l7UTRk-tOS4kjW#RT$v>*sQUnn*BwLV3LEz->lXyFQ5jHV5tVt~7-A-I$WbSA8_j7ZQu@ZP}XwHiu!Bgyd z%7T=Tnv!!D;<{UsFn{S*P96*|&h1kT^W^A_7NjuXYWxF@X`+nU;7 z)y6~9&s+q$I0{DjC@o^xa{_uy?BgLb1*jm|$YajeSSWM%=jN&1o3$#^U zcgI)p!^PXs+s{Qe`_GzR$U7|#OK-dzf1SS?ZB`WwDykE82`I>o$F0{j!)+=YG~p=N zb|3zsxEq!dUN=z2IwnpT3%22hKU{+Nq^!Z+OG8QlHt+l#@+;QkN@p)4oKf9H?TMN@ zZHY|0Swf*pDdY0yJspn!#ctX9_3QE5-~KkL1u4e`1}dnphO4~?&SWNcKEg!>$Iqke z#B!l41Xv0k#(opjP7Spky|5oY$CWXUTendV8Fq7o1G=!ZVLN*c4w_dw`>CNxqyG!} zax)yIuyqy!2-ilu$F}oIO|2 zZ1~(IVfi2u$ZtT}hy?OtE)&l6z6A2M?>~lL{oy@Sw^~uS<|bUfjL}3Jj^d?P_M=)= zkDmXVgCGC>Ez~)&a9(M@ScQvR7Bp1z@y%L~o401+?5o}c^36;jzvZeQpxBa)1*K*5 z^{mD@l9HTLj0G7cni5(V4p_)S2l4vB!*CTY$Cj(FMozLC7e9C&Z=b9~RrA9*cdSRRj>PhQ3!KK_&mxe0PQRNhFca&COK=sQmnVBr{K-)b4nP zQ2s9w7!LtQjSZ(BbHLi@hMm(f_al^PR%3C%kfO!B?{S?;1#y_CsPV`NcwC#9iCeC+ z;MaRw@zOKLaDWMpHGIE{9nHRu9#l3tkbQMI3g{0U>;6#!h@n|KAS{7Tsu<`XE+rQg zN!hgiVQwSZJ&Lg38nMt45p4XBQd4NkEnAG764v8>mzp*=Zbs_U(iBL|dV@ECnu)yD zu4Ts~ca62kS-cY2;>@t^WJ=~~g;<-M0|%3SiEU@SV*W+pDItq(r8DP}a51M=gSt^2 z`zp#~FasX(fe@Fo5bKy{M&-AN9qX7tLmQWawM^`$B7Z{ARtmqHle4jKWu`J|D2rik z8>nf}DtHrrN*R|o@9A*;pPik}tm9Y0)!fAG5O(o!hg9q~MzK@zAM9C0;80^WE|KV)B*#F?7|LeAke|!JEq0`}m(?hc}cGN_7>VVSNdo z?}Rcqn1jv3XgeB)y;bgHg@pk=7}Zi7)EDQWE$t)dFJ=dg)gbMm5H@(x*k9~TF0|7P zQsZx<#j38pA*_<=m>cP$HYVWi`!DmZ>7(V6;Z% z9t$FYysHVX|M#1yy3&WtYrcZ-erYSRnJdTLw+8d+$M(06y^nMIpTU8K>#;3|n>l=_ zeF@}~L<0HGZes#@6BEdr@%_Jf9PRZV<5MP(pI@*HcYZbxx?{T)L2B6zpTVD$o2YTr zA&sgXUB(LB`<*o86qO)1GX-Ye6WvSm(D}W;#r`W7aPCS!1u3towl7({FLrLQG?bT7 zIHGp$#s6jkd4^A4cIThtzT3SCxsGO*Nm~jV=(ceEogY>nG+(%z2 zcbgln?>W(4>B8A3)L8a)J&ZFktqHq4@i$)48*tUlOW=yH#Or&SaEclOuL8i zc^lUG6n_Z(+`?9MMvL!p3BFTZ2199QX3`8!jrLk@d5%$hJC;d{uSIX=L3mmTtg`M5 zy}vP<5AKlCRgnGhJ}~5^a3P-#dv6!In`_4GV~DS<=&d4OwZ5Aw$bQCbb)thIw9RKk zn;r+#q5`;Se%RYyJ7(j9d@LClpIY%Ch0xEKtxonJ!@%BaM%=BuMMk_{oR=Ip|F6uj z&ZgrsM?CD4?QTlfaZ+5Eh0TR77>pj+Y{DSXThxik*tk9sCi?I=czoy#7u<%y<+HE4 z{G0%RkP^uE)ZrkLthzlZxb3c;SXeByChQG=u3bS3=PWVG^szM@CRfuza4t6ppL=+)M^tG$fqj_ zZD8Vkl%5@r zTy98d)S{iqtP>`4O_*38qnQ!Qj4^7+LlS}MM1YG8x6=j{4QNfNIkXtd3)q`6n;OUS zR%ogDjP~Mm_Q8;3hK8B#-G=sn1>7<)}e%g2wOj?eOWx$MR zoW6`%+2o^-d_=aG%Cw+dGOBnM(D{`RANqwI9o77@CbFv>M?)?Ch2i6Uqz>0fd8e3> z$Ef$i7rwg+r8BYfI10hoJ)n+D^h+Sm``DY=eN2X|jptD(G{f{y%g;$3vL@i}je%AN zskB}dqtntVL~?Eovv{{aOeo4p<%XPh)KrE9&~lH(w_va-SRvG~P)t{S#a4l@U4JENHP z(}$Pib}ofEbkbqE{u-w4P;P>#XU)YZqSieh(FC2AEXF?0Ms}!b;-Nm60^_E2Ox=-1 z#i#G?je2&56UgV;cIX%!=PtsnW}qh%P1T#Z`F}DE>eOr)x2}s?VbR019m0n(bvs>J zR#I8P=T(e?*qbor(8qcsO^aXPGb|*PC@JE-W}+K|gH}h)jXkiERxK0F=N6ifoMK=Q ziYOs83}i?_Dhwb-a}&cR>1ZUBZvwSWM9t#MfDx!{z0CosbUON>V-f|=NL53?t0Hq! ztLNm&x1H18F)?2*ngSY(oVX&pupbL4HD7+B*sX07^5LTSl!1IlTpT2fV@>y}I5pzu zi3KvFxHFnxq>Gz))t+pDjke-qDV|_qK9B)xT$4~+h)9+rN`JovcZ@zfqL%zQ5&;$c zX1!0B4Tq0k3Yb9NX|pQ%2u0LAlVQZ2q%y!l>o_Gw`lw`*;!WmXUkFYkDH-}rJBgtm z{MK^lDg5lQS5R4d1qt)lV*SDbB*oGE{rnjm_qultt3URSiD~d~#pP`-1*XZJyu%v^_>9=QA4 z;OOn9Npv&%-t0l#owq`h6y4gJ@o=+!bO`pwPnoPehf#m?;IcO`okt&B-BoaOTmtrZ zV7hiatr((kSv(LX+|9>N7cizJVJl@woHeMOc)slRi>2JT9`k*@yriEU}oR7ZC-CcxLR*2*{;QZ>IlQ zKeV18w`c>lHoYgE_I~OP7y-a2j9F2nT&p=*D`A9yMG8l zkQ!(%z=ud6FZ_%}0{QZd+p%$s1oFCRP9Se)R1e`NB?3@9`Q(#$@WBTapQ!+3N98H& zn;$@5#6U=9ZZuW8;p}9vBoQVwo$t*gI~-@v!hW_gsuQjYVC@HvQQO4C@OccXQd0+a zlbD<7lM~1JIh6v3mig5_-cJqN7O2K`$%x7!Vlb<2SWg~9{F+Sq$}|1Jc{QBfe6C2Y zCzJdoGD0R(5$G2$fHqr1Y?$1J!E|x2Wq=u-%7M;5SW%m9M9vZsR$LJ8LHDQBSidh) zd~gFLTJ~YN>H5^uRXBX1k3qx|uxV8WG8s*$zpEQ34>aSXNHqUcJpStI#mHdP;#e<{ zUrEF|f|CBJA;1YoXr$EiPqW(?Vz_r;JARy2om`~rsPXWK7}il)64Fd=v5I zqIsiNlM`JpZ~?KJJ`KXq-`3wgF&|Xp8w_#E1SPJG#v*cZQrBl(N)rH%B@@f{SOoc+bFq%0vKpiRb&cQAqck6uG>!$_?=z3$6kVf$ z`B+joN)ii#C^K@)nLhqf8xDV31=m&SOdVx~#^^$GHH9c{-I_C)d#b#cyR|Ab9eoM! zw*=8_2vz(O$iKh@@>er~e40;IR1(Nn(RXBtHzHvO?S@)a_)7`1zq1rJKKS4RY~8vw z)FvWYU-%Q*FV(@cA|1WQTcOQd4de1+KBI2*zV;H_rB~oi>4Np}v8WfMY$s2{ydnYp z4U9H>*$mUwn`w)sf%WL8OgnNM&Ul(_+a_WjTT4gh*$eO(ukbG()=#=%SaJ=F zDQV1I$()F9zYfnlj+3DYBHFGdgYVlY(@LpQ^eEV3$NAk()IHjd)+Ejd!s>!^fve4h z&N`a-Z8IRAucKjeMTDLX+m%inVE`pfX+FMj8zXXOn_y=2WjBLxtzVmiH-B>!dyikn z<^Ce&y%Vd}qCR+I>uK;&EkC0a0cC$DG}?R`Df&F=P27F81a>?Y=5h{dZgd`D+cb&( zLZfbs+M>@O3g2)-=+ko{q%$T?$d`tE4cABo*-sFpjII(|+loetjp$8Da858j8VbcW zYcDl%>AWJeen!(dO-Cq%=q#LWW@N?@7zDh&vl~HX~M3rEJUfh84o{R zhdnQzK(Dm|58RMGB0^f=Hm3=>7;jdC+^c;FF=TZFQ zl{e7aZNUS7_aJj0(pTuzIoOUpgCG8~223B1qbJXxPPk%)P$r~7lZ9J8Jbhz$U0t+w z!^S+ZZQHh;#x@($QINv zK3!G^Lw}B>(5!gS45s%(D|U?_ntfPPl&}%3oYQGisk}iv#_Rbiq7vBh7HDcj29==( zQ0}9kim_eh(fouuUQp$F8MC-%JWep!gbGe?v84copv$iC&=X+92MsPU4Vq*jsz;2BDNH!{J!lrN=$fA}$HM%Bfek;P zMK2qHMs36Fh-Gee>c>Vm(PJqRce?dp$X@$SwOYhU0s?uKu}eplwQzT^eZrQATx?K< zx1&=02h?x!$ejJE{VzWUUP=vz3dzHQ7ZeD+j)EVsy!?@I$>Dc@(a&CyUT-KE%C1yw zyu^dcBCs6wEqi-DOHfL!PV#cHBfkHo?)yD77XC!KL-ZHzy=QxIw@_nhzhv?>jRT9O zK0+!@g^d+xLhktd0)pQ)uGfI*q~9%Nm3t>gP#E+9M%8xg^mc0u^g)cK!-UT>EP0Ig zUR#Uf-Zfeyd%8o2M_JY|txeCR2Yct|)5^ML zL>Ix*jFdOiYnuVxwu^wBz?a|6Mk&Vi?iT;xEQeT93yO6lc5RK;{lRj6jd733P2aqM z;7hF6&GH}phd=YcdpcpJXAI~ZJ`_~w0VXOOe=I;fb_vMdOXRaS1Axb6%x== zMD|?og$^bCGr9@*8yMl|3lO%9lj#-HaWo8`4nX~(wXvX#X49=Q$ObHmWe zc$RI&QuFi=D>p(tJufCiJ4H_0|G-(M71};e&6jf_w)17C9fJTtp8c6$z?}&ooA)Oe;m6|ZD?^VH(FZN5hbijaAcnqx88DO;8+JC z{+IuE+L6~#iN`a&w)?YNbP?K-F9oShvpP_%jLIIQnF^R3;^heDVBajrlE;?{R@me* z_r3mF{{*~DG#6COPaT|7J3G4@NXZK6Nm11&0ZW@;RAuWw%>`bO2hOy`$>O&kXSR)? zH5@;o4<~EvO3VP6V+yp-B1{ngp!&xz(<<~mz?tr;u0`!5`JIZKgnjk;wkT3MX$Pt}4M+A~t zjTz`(m)Fy9ETI_DxMN*xh0~40Ps0hM>5r>R9PlBf#k^o)fcd8GheMOIVA3yEcYdqx zctH&nnn{_&BZ^fu8n7zz!&Ol;lG zva+x?#Xc`mJB=~OfuMJb`2ukBY8<__(e`7M)Y$Tr;@lY8h}k=Kcz5=kFDH3Obd{cb?hrI&MD$Z&H;FZkGkauD`K~r? zcPg7W7hzdfxQ;M!^mkhlpG`JdVr7lqWHEWoQ}r~Y0V?!?24ii|N(7##tLhpjfL1RC zmtHnyC|**!CToeL!GviJ2D4njS#Yf}(%6p(=2`bZWNPfQC;k+T)RQ_wzDa#+uxpex8zkM&Hw&wNQ_dDvNcRG02iI15~Es4>r7b}HNc zSa^G3rNjj$mnU?OsIHql_GxutSnLR?5UT#47Qj)CX4)P9%z;v2;qHgVN?f;sUYL~v zC~J8+2Qfat0#=Is8TcicFJ*^aPj^(&Q{{zZ}Ptt06)X)dI_1nDc$?Nc|jJ}D)F z3QqBx&M$bl%2^R!J&%MrG#}5;19A%#OI@Z5A%e^r#p94VZLF`dj;&DCuU(Vs$(wVi zqewpk$h%fpb`q@xINav*9I?^zI_A+}_Zox*V@c_LHjWfy2_j5K?%W|J4-jA2314~vm~MLsL3MD;v1-Lh z!w@;4BRv6n_h9|A&-^C^Ta3_FWi*dWOPkcMOE}{Cg?lWecmoQOqg#PqPFFUq}dX!j%E=mPxUo=cwDCvn7dOGV`<%O0Y zR8K4nl0FQ$2J$j0=XNYZH>J4Ifq|DjALl;~%O-iQ`SweJBql;%$W1bCI>VoXdk2a? zU~PdJ-;uo{Ww4qX!*5LDlCTxtW-Ij#JpG1pCnQBN)eq`flr_vdJxp6|Y;1LK%mS83 z&l+$30XQZ>lcVY(py`#_o^hQ4esqO$Oa*re7hcj~Cp-KNk1Y_g5+i3nY6JM0WNvav zwo&s#YgEbk^H25S7RYN-4ZKF?{KfthPQ7w(^b@~@4tKR7^G3@{~ zWNK}-e^XTkHk`cVhIOEj1;_Uzitg!jnIE%~r?gxr)O>J_uwxpX9ptkVH85^B4tL6# z14BTsIYal;fXT5lqme99bS4n-6PiDmJeavheS&nLobH5WNl+j4P)Nwav-~K{V#&(z zOjo>z81l_6kz>C1HlUK~9ICGbQ-J=&CE~{kD_-akv)mgwiJ^k4zjtG_Qx~^(T!>#` z@h?wNh}Wv7ZbPxnH-N7b7P0QdKx`$;UZRqKNR`0vfZ6Z3F%Qo}Ne{JixQ?=(gO>uo z_4y_TXX4vMREjD=ybxz=UW>*#H!Ak5Sh?_ z1<>BKTWd`Mwfb_K+1YoiqPiH9(f8JK3nyFKz$l*ZMhecU9YmxV^giPhZe~BZbzX%* z#tUSBVDYBbmxvN_f+r7oIjE6n$)xd}!KN#6T4QlPUJ)28osdnpsLSefVr^m|3fiJx z(QVI$*E7y=HJL>-mrbzD+puELrPwpa<8efa(>nVAN&(4zON-*^v!H4saI^%LSVpum zK~#oJ^aKJ@Dtbh#vGn|(dl-5#-7>7kR|bqU+kLZ(=I`N=_G^!`0AQaiXrymP2qPlXnP7USt93hC=MULH>XmpF7gw?JT%Q%vqj%@w z+tT8jf^ZfxYv_9G=iJ3T@3HMki_(;ofB9>>=?#bV{PpK!hH1SHqR>u;`U3;r>h7Y2 zB}s`2O;(Kh(`1SP6jOZzZ)ME1-?gMLa9xgtqhy=$_<(3jcih5i-+E)xL#%d@Bd?`A z)a+SA+;m<@gL6%lsk3cl$Z>p^^C3BwM)KvA`S75Bb4OYBy}-8Q$*Jx>p~4#*t8TiN zNQEg;zY#oa!PI2`9FeToi(=K`>~h|{yNRF?TWoC2qt)~WFDeXTs;VwMyfjd~Mho64 zG=P6E3|PALjo42fKY%9sUB#!)>=ypdOo~QEIt}sQ-X6~H_TTh_6=o%#UfLAdyB}~d zV9x6sD=1CI3tLm8(n85L$m;IB7yaYB^msRYx)`GKEczj+QE9dFbFy&kgyiUuDLY?U zLw;eu1XI19WiHLXPv_Q4f|G(Gi~9=+!jaSK*q&Uqvl7wC^Ar-#QOHj=V$P~BVE=B% z!W)psuG&ncw25Yr#InU>jcX8^5Zzla6~mz^Jh_>vQ>d6q5^Ghzia^+iXDk&9Q@49F-f?)HkkR=|&LK2TsgaMpn8 zZzRKz_&|S582ICS1uRoHHrZAyMQTm0hP8++%q}BB^1_j=hSUmV8 zZW>%tRDngD5jH=3=cv$>xP64XriC#QLm{hY1zxp?Qf*MV;>ZME@4Xez3&Fuv6dR@J zM{Z!uy81HeI7xo@=nMq)FsTHJ0|so~vTV6?<=QFURoU zhCen{ArqF5^Pr>F8)lK%AHV$;o)7QWSNu!{q0AY{wk)`B1<@*7!Pr9C`~m$;U?iJaLmP3wPOsitsuF~#kB99_se{1o+hH+;J%*VQRVDWUT#{QJU!7nsu zdP-3_X_y-E;V|jzcP6OQDSO+}wr z-if-NK!zsqi8_i!$k3jJqoIb`-Ua=Nh#WHNt7`d+UAeTiH6{DFf5nfWo|VsVMkWHP zT&sJAwJD3rxTjf5Cs&M|j@pBnFz@x-F@Y<1?G=9I zVUgJ+#t>g%mH*HMX#D*JK$Cue!^WuM7Ct@{_B3qu)G_t&RPk-a-v-faj@@&a%?sfJ zK4LaYGXfLpxmLE}X_~A98rg>zT&>(};H(5CaEF#`-d%%8Z6X&z9~4Af?HVJJLF~fR zuu3CjY49HHmdwG$^$M{8fKtglIGt)HiB!ftJKJ6o1)aeFeqw& zK*nQc{JiSX-?qyJn`5vvlaVryygvu1A*lRV51yn*2wB01dAe%Chiq$)%(|`3Zdn!} z9B}zKeflHQoSpw<6BUdMDI*&v52a?*h`wRIoWR{vxuf{iX{o-7dLOM%C>=L4n$p1D z*>AWT^JAwy@DYuLzrT~xmPrZ&Y*~k?7ZU9vdO4w@=?tP(Ja!m;iYP@b;n4?+0pF{~ z8$4A&ArSGh;Ntk3%6yXY*=E>S$#LY9qXLE7vypx!s0K5?3Ty+Te z5i9GEvJvgiQpSEqG5GL6+Ad7_ZU~7w0jivLgXJq9)Q`40YNn%oXj;j>n{jz(aQI$e zJXp>N>x4N}@O0@we#j8fTPZAf@G);S8ELREuf;-SAMv3pJFxsco7!pSw_$&jSpg^- z7B+kp%X4>A((qQZ77Wh5Hq}Ye(ZJHW6h9oGyI^|T8en3DcjuYFXT&f}72hnUgEL(; zPTZ0(o`j^k&l*`bijM?R%?t9A>x`NCCgzP+azaK_s3gJTj5A*;56vj)*OFjV4SjzL zGwx_HxtztPJ9SAEpvcJcxghl!_)9}70uL1K07xT)hF?QRE$uPTLKH9of4@g0(=I1N zj4<+}H7miUT0=Rz3bIj#vGF@#HyBC?H1By_X=F#gNI{*xf#`}sSB}UNdgSM5WkvWD zIS;#^bf~m)B}3S5#jExH5hB|n-?Mk0Jv_{FdxAcxhm%FXQ}CvBe9&2SkVRS?BuQ$1|7 z#ONafZDQg7lhk4L{#fEF4x_9xprFTx0NUV#Y{NL%Yq!B^ywAhCJ~BFD&g#cazqm)y z)4>Z8;pu(4PNPVB`9|I=mGcYg4;*M{N>o1c$;{)s1c0182bP-wFQ|l$;3#`NzdraV zm&Ya6yMNdsKq5OAVtzQL7Jmg%O@(ZR2E6cw!}j&;e5dlMxAP401bwPhojOrw^yWpG zabG;^rKGC%?{?VKW^TVNnl}V~MKyJ7QYmJMH3!pfg8Odlu&kxmf?wYfj!QnVWcUnv z0t$Q?B21TkzA#LgxN_g@hQB_qcG%G`U*{*LdjSUI3>~LVeCS^$-jAO!$z$k8_2les1M`(T8LgqyW|-UeoK+cVgsts9@xP z86R4;2<}0N_jV?KKGWzI4eDa?P$|D@`h?n)eGy_`+$V1L``!O0D0n zR~pFQ54%DnS^mIH1^FusU;xMRfR#0LNg*fHG&j38H&DGKL4k`3iu%$rFd%B07bLa+ z(eZwpM%~3u$ckt3a=gGJXW|t-zTe;s4bLtk^UxzEL{4J@Z;h#rWD()1iHFu7L7ZX~ zMLa)m+sOFy_@+pb^fv5Le+_}ZZ2qG(q$J*O8ZR&|0)6p7L}oHp{BqG)R@LVx;JZr- zk|5|U+e{=i4SdGJ0mvs9DlIGdA3#O)e5-qmn6BXEA59E6Je4F;w#)NDeNvds?7*cC z2$|fbHY_jtM`7LMu$pb%@ctrtRRV#4J-RzbpAvX`K3_Nj{O;h;j=O{c^WL)Szlh*6 zW-Dh>Lew^jQ`w>jZyC6#O3Vs9b8;GinWPG}*oI z4~ng3*Xt31B2sxNXXOiZzvar^JnBRZ>_~Q+6k$4B5yInFz8SV&7(~uZ0MIuI;>L8g z9Lka31o#2L3=XxN!G4SDi;HaCc^n9>Y-$fH6wgNVJrOdsoe{r;kFORY8Z=wjZH<_R z%Vu5H;3qra9FXB~jCBMSMc~#XlcuhZIGi4|XQi~e)iUquyzzamc8ZAAA!O>2#fryT zJ-kr)eLLa7{`RSu674NZSey_~wU8RXKs7ct8Ynp;NJrh4&O~;q5+kicbzZ+}8yX7A zG8RU`jB!OsB7-!(rd5y&ccc`aCQ6WkHhc%koDAjX*RNB~ibltgMz-W}-E{pPO&(Mq ze|dFf{y8wS236cMw$ybqoEeC8AF4GyI@3$X#z>4&hT~z!PDF^`xllw}L`F7E z-b~7X5)hBXDDR{yghr8_(n2R(AQDAf9s^@(V`3W7D+(13e#qT~?B(iLpo(TmBDxl0 zLC?jNZ>txXCy9e4D=hjG?atNOng-(x&XzF<_QBv95cRC6><9%iJAokw_x%|r`H=(@ zyF^PO%`;4EkgwHc-z5@7b~h+I{yI0DziSAJ1Y%(PH-0O62BC8^F{J(F zsaB_R8Eo#1{`irsc;_e`+Y>}GR32ZgX}mZ>{ODIgSu=u zZ;H?%7k{p@{)khODbz*!!|?I(1r6e04N-Rn0zPtLv`jhdYf)dsfOY{27Ssq?TT6?3 zA!9AS=*?Y^i2cI-uDN~b6e zBOJdBV%e2IkEvo1&3o%T-?EgY&ezL z#t80G4hw`kSZ1L_uHvQ%P?F$A-$AyGbQEcGw#R7wNrtNOHgi7>PLQ-X4Y|?JT>2XE zs<{K375}`8_VkO=XZ&FfDc>_;ME4f;#7A~k2z}h$uMyJnpiazU?Q#xR#pkYE)ASE< zj+|qnE=V`DfQQrI#A#Ftw5O7UC-8Zp(F7kXP@=~T5|dd<0$!UG6eWOCoG`+-M@3(7 ziZ&=82G=NnU?~rjW#VsZ*CcvQ@UR0rVC0bdeXkr+^U^mns=Fpgni7m3I0+;zH!op# z+I%2S1|N7DV4w{2JU~m^0rdwm>318CXX2fOaPOsa-mVP~_sRBoQZC?CwBV%=tbA7V zHrXNpyPT?z!;QggN1B;n6FK(i?}_A;Ib=W|mZ4dDQrCaC_V1j8loV%MKG^sG zaO%2qkaOq0Yk+~9ZbqJws`OUiO-bf4ALVa;pf_;uN}-+lKTq|4w-as!z5t0jj)56w zT?jtp{C!MjIlt%Q+m^+NaK&T{ZW0td%HoBrWY&VD98^LjBRc4~_`v99XdSSYl*Qja zXm%fWCUbIT8vSY#OVD;)7u@ITyRPFnDZD+Q@&`hx@Mj{FD0TqYcZ8jfr|mGPX2Pg{ z?l;&Uia#+sJ0{bO_+K`r;8d_fvctRqtOo|*%2+H1pTGQEs_^%-unOc<^ z{?}hkD4ATCJK8z|3t@k9h;pnp7ZZvG=zz~hEnNO(NHbD=N-fRAB&GP&D3hQoOapta z7>S&Bq#M|ly{P3$6=pBQZ1{N&H<~Ta7s}YC42Psy|LXSn=Mx(Y>7{BT)~tlM7S!+h ze)u)&=ML-Uu0}uV(LYk-b}$q!#NLM)c5?0M5m1%t(}}=?Yte#x*_?%*yT{5hb_bN3 z0rOCrRqC|#qav1uda`#!5vfqYI3P4hSRGkYSa2QH!dr7TCZ1^)Ib0=18^0B>ViRbp z9O4pe6o?tmky;zSOnI9-AVj2)RA9}KK_SXd zDfu2GZuBbfatf?#Y1M)zI)E}o9qV;n2FMUp6XEn#oNs^mz2^#s6E8V{#LD_sP*f^* z!nP@alE!E9e_vMv6i5@g-NOYG17DQ5SUrj%_=Z(#V$g(mz<4U$YHF)TyW~8UnMMK7 zfXXdr6R&4CL9KLjC@wEVqb+a8+KNHmyRaEgTVL&n%8|6^=!O?>>wuxQag-$QHCx-x z939HVu}3PQDqOr^;;Fhku&`Y>Vm#4=4dYLi~p>)e~9WTwMC>T4;QgBO)RiB1cZm zfYI`N%r&j8zT-z)VTlNU2e4b{y!z9IlBMsk)<~%Yd;5KPv#iP{G^Ul(D3S|o0=*+& zW?J#gt8%kdaX#|76SOEF&zxRQycAw?a!kZSey)~h$n>%|TBXsj(mAqjh~r4^aZH33q_) z_{1l{R}8$DQ`zc8glulZ+?`pG(3Y_^q%kF&X(y@Rh0w#aHG~I_T$Fk4`OWM(gMI=} z(0kRdaGz8h_)EhB&oB1;p|J^taJ7XE9Rvt=@n>>ov@4z%_#0U@KqY~nFkkojHHCE@ zi1%P28LLzK^Xz*BJq;k@JxUjxe%~b8br>0RgAT`7f85|8MoJF&dNDZd^b+U|TJu5j zs@@<$G~`pe5Ojz42<-PCPU)@a0zTm!C3U>PKBqTjlKF#*$KrTj)PN>59!eAubnoNj zDK;9vpOg$GV3e4UAgX+q0iwKom&3e9T_s+5dN$9X8xxgcT36IqhuM<{=jOJ-E7{9% zYz>7J2_ql*R+GoEx*h)otD>E=y%vpB$u9JXbn8+}+NchB!pWB2Fs`AXfRZ?Y17 zN3A`_V{UbSpd80uwOIK{C4UUZZ%@KNQiRhY8_q^Af!EbFI-FF&o6tQE0$bq>96o;e zd!2GIQx)tGvSzZi{ai}E$&{7ltl-NQy`Y6|>G#*FeZg~BcPB9>*A%V5qOtWQofmyF z^V~M(g~aI}LH^zr=97xj;{9QQ;c*anpeFcA0{6v)hu=frv9Uq-3^S5U{V(V3`N9bB zX8KI8Bz!*5AR@C0oKGMfl*$+MzDQn)s2Fkrwi(g)wV$>lD#k6im$d_P+H?08C(N%; z5B2^q%;h~gv#|tvDb|}nu+z(gbX9^!wKv^&pfJ<~%&9~iE4bZ^2UpQK^BffFu&+&GVN()(e-lSAb8-X9CF!Y|u@nz;w51iTI`o2(IjJ-j!AH#t=VFrC&EG`?Y*Mn*{dLs{I);UU{>)9IQ!BjW|vlrA> zVsiQ-oCS8$kxF{#lHQohT>w<;43->zTQ55oC{L8Ldb zTsRVKy+oHs*o0wTfo&O_MgWi_a;2(}`OoKLi3rkuo^Wv+e~iVFg4PB2Yr28!zb_N@ z>7#9B%nAkxNGQkON{IL(VuRSn2cE2V4vgnToeG(xhV{zI03nnFn=WG<%TT5wtB`EuR-TF9D) zK8ts}6IT2BxP{><<2wI4!394&1z%P5y6V)I4_yOBF+*P-C%dx_?oDZ*# z^G|ARD=kvv+8&DRVp@2+y>RVnn%AmJm0XEFlX-GeR9=*?Y5aWyAP5(h1yeESQ1=I(neJ z_{)^96{E6bL2&{SD2d(1G<&+t!z$$fvX>SGJt<5ys4^I&g{%~KIid6J&!cES_`tGS zCg`^h!5&PePNyN-&&C2F0RY9W+R zrVTjN7Mo31>rZB?M1!*numKDU0hx5b1yc96>u+lTwtvcjIR zF}FG`jj+x(*+q2;3qa+STE$fW<=(i?YTY~WFW+BMc-%H07{2NR>4(Uo%XJ^Yj&EXIqX(kP}R-S z^3ow~mCnb&o(~qd491ve_%Jq8r}mPZvMDv&0e33Vm^l<%5hV6q(iu9fpX_sk8!@@O zcf5L*v-{mW?F193@cqhqzbwUjDMZDT<0DPBjr(XI%Ig#pMo2+HkY>_4=? zJwAmZ7#(eC!;{C?TMgs&5lb%JX~1G{I1V7md>5EAJyMUH@Z&yTzhsvi*jC zCPRl}f>916QRJ_~OEveuMi>{NL#<|dD9)+^ZI$e-O)Uk>r}zU?LNkNk6k>{~Rx611 z8)Z;g*eE5&h>^oFL4ltQ=6&5(ox9V^W1~@a>dXm8shP3IxaKmWb8BMp;+wigW>T$p zz%>_2e<%)#-*YL)I8;RIL4ts8*xHsuTG!eDR`3hU5=I+g-^W> z3qT0{Uy6tX26dfXy?=iYF){ecHj!Yb+SgnQmrLID(w)Z|H-uPova(uimFbg2iAjqMGeeQ6h%wvmnFA0ToKaw>qP9gj|~_;MPuPl@KTag9FTkU*04-qlT6BCoi*2_@`N$8b7o!2s~5V* z3fsFiGI5en$=5Cy@uQwoJuQqVi7rkrw8XYh^pyk`78Zn2Ch8-jK_ntXUvW~2N5O>a z$_qonI>KOcSka!Q(S+CKxL=4Vcah*-xKKB}#Id z5xu`UzJKuJao)dAxL2XIUNLkBm}G-24Hvo}M8xgRU>YcL&1}wp#{omfiZ=VxV}|i* zV+{?b#evZC374~`5!Q@fGL>gwQnb4B=!M_=XcSf8a!b4vfVjo`J#0Sk+;Yj>C@(xB zDz!vIYF-0E&T|_L*fV4ACkL-V(e6bB#k^M;GV6TRdQ7vDY@Y8rd01@ehqu;Y>i|FF zJfF+&k4N^&`m&akixMz{6d$N+;SP*K14fDRq=u)~n+I&AgI8(b#bVJ{8~#HG!im6D z`#-I#*ZmXxOwU?>f*hZx7Nnk)zd8}@A|6-Pb{rWxVoyE~ej?GKzG|H*so{Ljj4^ZV zoHD-b8+wJjUlYAwmbK|IW!tOC8g}~rd-i%wlc@`kUtOui3$;R6+?w_ z0_CJmS65bj#jY5(_;c~d6t|Eth7(}$A+(5hJkWmt8y07IqBbmmod7TUk=ICBOq;`6 zwoe?rYW^_eR4>M9oj8`uh1a4(!+~}*K#{)~*D@`N8U;XVRinUtLxIH2+2!*ZJdIM8ov=b3vWtKZvf6Q6Vfhy} z>62dnD#Bc{aK=)#V1kEDMqq$F`w~{{jm?3>s|SpDF87D(D1He%NQr|pV(ks+0+ z7`W?d`Tx9OA8<%=Bx7`Srom^miBzM_IhZ0#QG^nf=R*R7{2--!(90#$nhpO+8Q6qO z3n48tq9ul@P<3Mo#E)WDxJp$aU}5<=74JL2^iFXQ+qXE=jF0z}EIIePAWzP0tX5xB z{OAGVI|yO-gM;I@>_EKbs-eAiR??v#@!IXU)-04r?Kp~?yZ+p!{w2*S?gtvvJ3~Q> z_ur?)Lj~jl+Or>yy*Z~m#Yp=ez5!8~lPg-V>j$3wV%KjLfWn!_Kd_m)((0bbU zyM6oJi_ed;b{7bgB+IE%)gpE22>#u-A_Y|)-o2ERLid((1NQKDIU^={0U8m6?)Q}J zneJP1er`A1Nn7~moe$@dxmMUr7}R{zuIe)d$J$94pD}V;xp}WU75M0=76zvA$g1u5 zU(#6abNqry9K@k<;#yXNEUN8_u(g5GmqPY&&sIT;XMyAKFAAOtWO z{4yDlovc)o(~DmRW^c(7djCR9#&#UdPIsnQT&}?L>JIw%V1&;1{_R>DC1OS%B&0i_ zjQ=!(D=7v_0H(Nqe=jG9r%_t@jN}s)L8I2-P-cRKi6}q0p2CkNmXGLjHx2_3!XDq!CFz{qAA*ZIVHX)I#N5ehnpDC@ zqYgjk+!obGpWNNq7*}Adx!uq@wbP1VKrbLHZeSO+M>K%ug<)c1l2=wHiCofbw~6fq zCmBfw$`s?D=Kmd?j%6xLGkNqM(Lsxo3&~qLdf}L6YORuq!Z5O5R2F=Dm zo+1hA)1WjS*|Uy~U}QR%E8t*5n0CA+@AcWRk%v;acu+*4p}T}d!l8OSMARz$h+?kN zK8v2;{l(AWly6gzp9<#{{?Pq8r^zAuMcS$0Y{u)^(TPueieqnKY`*N$kvPKV56k(k z%|=+RfJ-7P8YSyud+>X8>IsT#%5Ck5uhJB_Xz!1UJJ4$tVDVSu9(Q0GE>zg(Sj} zrRa~aH7dro-P&^G+>DTOH=ChHIhpiaslf|in|kg{zlR>vr4wQ}A8=0euaEu*SwLOd zLdIVHS=mr`yLi^KYEXAIJ?3rd?q?>A!P1YLJ|2ph2@9Wfj$caQcNtgE#ql*|O&3A^ za(6%#r#n1Sx@u0;SGmK1_+DQQ9*L zR2J>LqAFX=8!b*Cd(OltyBod=2rtF(p!7Y#;r@UkVQ^aX3UgCa!;x4#_q_-Thi#uH zIj-yAC@ymB>PEs?=nsfVrm%RIZ#-~*US=3vuJbxZ1;a5iBJ!#T%!L)HNTkaRk_-hko!I31C zT4?3rbH~+zNM%XySiGY5Uc zz*%Kt?65F%i>+2JujICn0OwY#^WY$%B8rzl2KjhV- zkLk`yx55#Ee~1*7n+XXg`zzV$4M7lcRUiFRjv00!4EawTj!9TpSpHOvACZDGMSjDG z{>@eG^UWtOaw3w;|8p*Axl^w0=iLBBVJ+rqWeG~R@Swb{>|kO&xR`O#vm!hz^2qg( zjB-;g{h%bfq-qd zmmC>Dtrmd(G7D~U?UtckC3+zvCmX7wIsW`Wb)s%5sWQ958gb{;Rfee}`m3Di-v-&m zV9_{#@T@d4$q5by$K`Q_d&4?X1uxKSbs*9g9_W;&IFM>oQC2SKsJtAOmX@t=EKk>5H~jj<@BuSNQzpo){}~7<;OFv#J`2smdz=>^U%T~?Wy>#JuLuZJ>nu&7?yv-=tf zqMuC6Sgv>>ux@J$rf_x?9uIMEZ;!B1`M=^m5vcHEQh^?WYyXu$X_i7(wN5~?j`0|I zXHUzDkk}QYXi`5)VA7FD8Hez&yD_^lDMEMAq8}nVvOQ77=enOp09)t{h|!Xn?L>fq%43#2Y|Rp zua39@v8~6wZ+8ip}k|C#2gEBk5t0E^a|3m3mVt{tR4BK%v_rIX(f813e5|WlKk*u7nioI&k z?SJ`{FL*FSVxutjpc;&Fkm4vqAMwomd=QOBHMq9!eUD9~tlhBoNrU{(m_z8MvsY|GHfVyaL|?p!=!oO6Y(ePD9BnYsMW23exkM@-%>f z+~|bgkJiiLg8<1I{Ejvsvh2YBE>wUM@b|A>V@nH-Xrx&As!gn2AeoC3en4a-%)-LL z&dmtHh|kj|MsqK!)zpu@|LVkhkw8(4FEM|gKFL*n9bh{kApu!eVWOVkP=85&Y)%kM zi%Vc;1jI_*krf9{o%^kts3#+J?3LqT82am*u1N?{I$`z8H#^++6D08aj`^Rsii%_> z2{ZJ$bT2wqE6GeQN|<9-uH9lc zRA)SL-Ld_FKt@Kk(rk+(OFkdG9IIyd@%lhXN2f-t8F`#nQ2~n(W?cFE7KpOS6A`il z2A$AsoR@2SE``MWQ8H+EgJ{^#i0i2G=T8gGvVe=sCPD=LkL3P8hL|uuD=XUNe2IvI z10y9RC2~8NQ3Y*;g_$`%Elu*gV2Axqw5!Q_S=gduut1^FxM7ua=HG&aLjf=_5cOtP zS0lQ+yZg4C9)M+UM`xol-DLkqJtGZ4h3}x=9ZiaOdbSh4-#`Y5@jz~D!jGxb7W&J4eR-lkTBn*$pl zwNX?)vw>+nW@dfC$+tIM#QYjd{LrfmE#eAY_| zK4>JBb{x@Do?NackkWnFgc4vOP6)`C z=jj=bU4Gi<^4LPns;o@I_BQh4=l_p!|A!4{BnNI8Y*cg)2V(HxSB+;W;2r^TO;n(_ zH_>we2_}=Qpb~NTYPZT#J!R?QdXE&yPy(R+6lWFsAJq4+Cr|-E5xwiUn+*%42yPsm zlhrnm@B?LHBwZ+XRb^9LT@vE*2mmOBe3oD&SycW4EU{SNg$D3ep-@2?dOjt{PNIPs zGI*H{IWtsQni}^g06&39@sS$XUI-O#uKEvF{w6(ozi{AfQfw~6`S0N{C3^Q`tL22t z6C!VLsFe?3=lQYpxH?aGJhc_IwIf1*p|50dWA33Oq^HNdzvHGE5z|KF07dzBjCA?d zJl~*W5gehhMrr89e5KzhYuhuXb}xpkoVD;~u=f+vRbo9t(mSPp)e<7~8jCdNpD zlgE8Kt{l^+t@+3E7J!4?;6|}R?I{4h79ht1us#)Flv&`OZBFH7rIL$HpkYDfRS7)t zYw-BPy0`T1*V9RcND{@*($5FMlga^K0$%o?xXX@*UcT1)iXp|dS2!T?gwXLj^md7q zV{5e9KRXsTUDvyK72Jn??TNRdUU0~be7%_P@bFk>uiDn}TTHco+0gxJN?)T)+=EFZ z6hiq{cV&&HScc|wtB&Rxm=|9B`+5@UTg%_cOpn_njF!JoM`KA0?~4_bGOLQJZa`fG1bbZ0fd%YBVHB$qR-FGJX>=_&XGSo48gva|uwE z0t(gX-yImHPItsbbMX4Y+xxgef1vs<;C}J&s_27hSi#78;t2;}tE&I)-^!scT0IEO zcYhn1U1b4x5=Z_yf3(&6JmNLOb|&E}gq770VB?K>VK>s7hC|eag|$jXIitxFob`NlIy86ye*d9+a>YR$3^+J!t##L-<#dL)(p4cIk1S;P zAi=Mo4xBd&up{@c@Be9%<`>$6OD4U~p&iZnF-()t>`Z*YeF$pcwTmA4o@e9q{gb;1;kRB;NcfSB4yShptEr39 zjqQElB`0WyyHQK8)%K@n1%9IG<{T^9GK)y{_BwxW9|oh8O+qQIY743JQ0=Tn|912p zg%ISwBcPSE_WAIq4z^UGBq0~{^Ni~;!op7hmoRx^3hILXeE;XqS2MqUW=NCB&(cuP zq!XNr059g+Z&DWHF#&ycveaV1-|XH`%{kp#AU0V-I9<<7d3_uxyt|$p-Zsvk>jw(6 z*F8SKHcnf=TaO8O@1Gt!wo(&(`fG^iL{nDU_df37(&h4Zp)@sl)jGMIUf@z(3f?cD z%;YtzwH4asgl9|`IxQAZYy12i=prJ3D@R+Y;tzYhHg|-6Ka?<^VWF3fjsTbR|K9^8 z{F_7(N?C)2RXsA)K$UnQDTGT&*;6+nhVPp~D<_wqs(9D{!zaMY$pn`I+i9zo^08AM z<3(f1RiR~n-a0!CMq_U=wI>8`^>pStO*}Ss-`86o8fz2$o=F6>&(j(!a;knCV$)(e z6uL%%_c&#tnpyG^frR`KE5EHxKtn4?*i&j$idlkY)I8v|gP25PH63;n(%k9Hdllnaj&>%=zzdCXgI*@x|M=)#S?OMQDH}$;wb`*2o*a18+0Wd2%9-0u6j*X z8t~CjGJ4-f3OOxC=Z*_F86(L_zkyr|$2L@Ofz;BmI?~_f50reOp(#Wdn6nacq9#8p zgG7(Mld<`#vX_IW{vam%e^k8%P#(e3H5@E>aCdjt;O_2j!QFy80fM`0a1z|z-Q9w_ zyF=h#l6&v_{Z(6A&r`KKJJZuM-F^DZj999b@BYKYNA#FKe5rx6WrsC-9R#Y6QgCCP1~p&$ky8gP7&SI32X@AE zGPMlj76{-4Eg6dqYx)LM=}8jq@q5WT8nJ|MpP6CqH*pyDbL#(mZ0EYi*J>7La zswmZXwQk#cDjGL_dIC4C2(8cupCI+$A*x&{qjJ|8NQ&u9B0{uVw?S3X-ka8b4(`u7 zTxj1ZQ_97cD?-D}2p(V|BOW4x=lJrBQjtrTgZuQtc~9_$(VhT8fHq{ybl#W!WmX7z zjJ&$Jo78r-2}D}}H3Ci*E5MM`*fD{(=hJosKE!iJI7ZQW@AH0no`n%+n@#e@PvD@L zEK5IGnDof32AS2W<_|P5;njYdL~s$!Ov*pUbuzqSiqGOoB^qd$DAT!EbRH8W#s&p_ zhCZ!Wd12UPScwfJB20bF#YY=Kt7+8mAqU2kzbf+gQt!s$(NVGYN#z%*08yQk0`SL5 zzB3}X+6W7+IdFdB?R!=xzlcA$rNq!+cyohn&u0uzqrM}sc6X;jBU@jpkc&Td*?we4 z5mBl2+eby{;wi-pk%TZjVS$bMG6J)^;0FguUED<&53)g1Aq6lh?t==~EGb7-tCh z{dfBN2+m1c_YqMO96F|x2NX8jau08V9Qf^lGD%c%=78$s1-Xhmb=J_~gTdf?jT&aw zljce0)_cVs!LHlCQDSL4;(MX-JNt5c%zr5&DZvx~>x$PX+*+^pm~hG+LxwowB>F-oozIY%%dK7te|z|0){NV|7nL55 z2Jdm&K3-EO|I6lt0+bgiWP)_fA(hgC+;Lq6q ztUWcqL}rB-rv9CC_IKvztAH9@QRaPh0#7QevNc{ej0Wv<$$V{oxOr6LeVd;8X;2O0 zCgj3MQbc_Qk%z(RSnq6+uc9lYTgOInBCY+icy60bC=W{n{GxWp6c4KvcEohN+BzE| zgz$Gi7Vs?QA{w`-_V!AtQMaNGvKsyL+xCP-JwDtopXW}L$%ai|9h}T@D#eGnraxc2 zp1(rd%zYh1qhp(1@E?ygRN=oy;ZbA_{MGTs!K&@3pr;Cw{=J-rx4J%Fg0N*3lS-VR ziMP?NEs*0@f9R#a=3&H+K$CgPcz8K_|2`}J;ux>-uFne7dRRnHkACA+{CpD815(Un zteDsBEOeDo5~rW5qc>T-(4=bfJ~mSuro|Ty@6XjPY3`Jc3)JIYfo(+SVnezu%Ns98 z8?3p&3!=g`HEYAx0~3`y9dyK2&BW_BkW~Sq(kuPdDy9>}c zhp`p36F_>TKq+{Fug_n&>0P3Ytd){JAT79l9bv_$t6avTT=|3B?(W8+q~b>^*|y*t z-Oz5`JK2cSrGUxR27+!y9fshI;5(%Ns?3_5l-f~`3Yc%YxmBx0ji&9c%7`dV|rd2<59T7OlnG9p43oWEPG~4 zO@5cgWC}7IwW!}282RsB0G(OY+KrBOLhYPz)ust(p4m@Cg>W4MhlS`mSOf_i0e*Hs z3e}VBQ%ZtD98xYW3Rk&q-{ghvL64qWtINsfOBl-;;@q(W)#!m?zOGcyd;48W4A3ar zv0$=^{btk?zE|FZOoGkpn*FJ@wP-%~k&sDNFAx+d%k1tcu;?FLJwG$EYyN=$)Z*_= zltc3S!^=4OP*+zDW0~Dof-H?4d6&=85Jo=t*CT9(MRN$! z#Bn7j%jH(NkUPj?^h{BQ$ngf{Ft%Q|f0)iU3ePFGSNQ|H>p`!r5Y~jH_^=N_DoS7X z``Jtn#~ikgDYxpt>h@y4`?J7>Ea#gQP86{3=;HiFu=;TPv;niUfm1lxQu$zq z_uRH`(3=WB{jqAv)9i0HZXL}ad&}^*pKgdtoUbR*3UuL5QYWyFN<-OSmu9F_??=+q zzOO#(3-~-D$vm}c`KT84SqAk0NyrFRk?S>~(ADwEdnE<3~niP-R9 z{1x`LaUb5TGU+FfOXnG*c5G+q^L^@zSj!>i0Z?V+o8k(6o&DCUInzKI@!XNZB8k%c z&kIfV25`EWcyZ!-#LF`Z8XBcd-#x`387CLQneH*Is|$_nvSkD2hK0_Tq{RzCNfs_Q zZ`tAG(;aq#2sWxtcL(h?c7lu$6OqT*XRcsdziR3c`n;e;*-nTaJ?O5e22kx1X7M?q z_N8v&6BG+t47oh?d9R^9J4$EZ=N4E=_z79U8&*>yKQx0oi{UU=o7gI=X=opdv~4Jr zgN1w7sy=>1(jzOdfC}~WH;!wtl`=L7LySlIwZwo6hFea|$=nTP(M7%kD@!Avh$wk? z1Da5@D|$R5XvawVG|fWD)`A-~8p9q?cjH!?KdA2{MGmt=L8~u@gpsy8oY3m=Dgq5F%-Uk^KG5PXN*y6W+IUwVw2-TB$O^|8-HrV+sEo5xdkclGqf zY998gzK81?+>ra+&i}^5b&|%fQ~3^EKb!Z^rB8sUeyhK+rO|PMK(unlF8*ONZSUA0JZ>`Q&eUdbY9QhF?_&7={MLip8KXtDd} z#7V6LyER4G@4Ur)ZBUgVl1~RKKOwVfj_Ua;Nlo7!YJW87Vs&=ICxfy<^V3gafgWxx zQ!9?JRMnK8JG`k#{RR{(%Okv(R|3cJXS~N6XL;!u(10b^ngD0)*8#!3K(<;`S{g3q z7#U;u2d$O!JZ4vQx^u;vyX z1UmkFJLSS|{{&w92KlO73bs@r+Rx~DzLAIUL|pErMSmHQa%m`o?htLP7!Mv$?Xw|% zfQ>Dd6@yL{kUBZ)-sVSfv_qE%FW}tyKX0dIjoLT(zwvWsush`lCZt9oOgJ#u^ zFY7ETR+2HTjmiwFagjAVK`-y-ZBMlaktO}Wx6=HWFzUFENv|@~XbO5GIG<$Mw(~0b z_fzpiTsu#7S8ntdzLO}1qm`YNZYi>s{}Ek zI*S`kCTO0R4?(kFNK9bw&Kt4>Ro83q04b)3jPZBQ%l#jRSGvw)<*}4!-XLgtR48Ph zx2QSns!RJ45kf{mvg(Vk;Rlzl>3Aqe6bLd}!nD=Jrxsiw%zkBc(nJ#o{Di`~mC23d zEpxlB$;lyvZEmNRg$nAaKH5TVV~ZT3x~*TNmX4)#Aa^+)wckzdNsWzM$;GZ6xx(}1 zbOp=l!WXm$7&IZK!%X5wIDpcW|e~?}JC2IEPn>M+urI6+AAeGi+jhXnN4i zB4nCy7(EbzJssW!`i}7z(k6jd@NMOdQQ}A!l{=}V_JL0TIDC*F=jJga&KXE@Lh6k&ET0&Ol6%Rc-k5{sAA0uu*CA_hc#}iEFWCkph_td z7Jf}XCrcB3^=0P~`rDTOw8$15u6WrKyguFT%gfpGL$toDp{FFan1}6;GH-zZ>7A`b ze`;v#&4D0S-%xEXiZE(w1BBa658z@f>q@xlh+u2?GcP~ao5%}rnv1LJ zkh(#yYqG@8zd+=HGitSw2XhZsa4>CO;hLJ3CLzTp`8oZvvIM`Kv|Nl{axID)+&b%b zK91xyP8|p&mD=n=wM@+|M0HU?|In+}@118hTw935fQ{k+MOC_-C#enjFDhVQ13hRS zq}32*0S0hZA&v9JQfSUVr(wJYVWStqR>k#uqnsVk6Sl<`=y7SEarIYh2I`Jiq4M)d zisuvK2EA);t;QM*7h=zak{z-2v$#XXqd;yDH2nX%bYTtIy_sE_<+d9V>jLXC6r^2@HWdddXRtX34AUc~0 zfm-{B44`igk_P_VvN~E4c@hTOP`$r<7W(VFP%N4EwwpR$*GVVcsFjQ}3n7U6QyOkk zriiS#G6gL6KFPRIn4n7Wyxkx-^N_&oxw)caCFLr z^0o6e2gXu49gjka7mLtuGyR8RVF$LJ@;FCJ9vAEGaRzC)DFbMg_9N5^A>_o-nT_!i zKV$QD$JN0`^T&ttzI#+#<7V|;scDh4q0HtgU6d*8NdmYQR4^rxr%(AMvMs^e2SRe# zmDW)2Zq~b}#SD@O@7|X<(jZ`_dzaD`M?H0+6pNSiD0gN3VbYtzQGzO_k$q~QcldWR9jo2jjEkNQZJnD47LU)Fm2``ZfH-7{}^xr>;QX~pC0&d zm}C(~Rn1jRh#mnnZk5sJ>rZ@@;~HzKvv?!J9oiwCVC9QtU;%XA8lXp+aJtXFwVNeFl*=1}~bP8E|=!4wXbJ?+}S#=OvBjj-cM#zmb z937(+alDL96ffZy0C(~Jkf4~wM5F*v(H;E2YQ&S81__WV! z-3Hq^JFB4M-`m8_*QAohaDqpOt!<$cHJBeZBP$Sx30dkQ)z~91B7!>H`HtEx!5`l4 z{1l=1!S@BhTuK6qlv(b?$+0e>j0iw;1R4r=4yEhA{T+IQd{7D!ed7G2rD#$rR78n! z#ISozu^*s&=|JL#P#fx}82^JoN{9eMHgwS{-TM0Bfz!j&)2s|?Xn6BoYL~JCZ8r-3 zMk(yUenxFJzuB4BF;_~1-pgkX0&HBNf&7Woy5~8sv#aYnhoK5b=osiQ34=^1RyMXx z3jRlEDJiM>l8@-m3gEr)ygWT*-1uQwEb#)k$T2~1Tf@{aC5=Z>y^N-AZW^AP3W5~x zfE#cnAvbzIvlkW>CF5^o$r9!8di5<_FBIAv6acldk_Nm)8+Y5(>FJr7O~;HDb)zPwiY2J}Mn=SNuhkRBZ}zQ>kS zI#Lkihcxh6ZRO~JJUWf?Fvj$;oS3IHMuN-QcnWzV&oP%!MyuKOhFRh(e}N4o>D@!1 z;^~5fsGquws;tH4M&>1n>S)o=bm0BnaP)K|$3}(UXM7w{0a4aSQMTPbj(NolW#SNG zVG!az2Xl9{*g0UKQ*?k99~?69pV%~e<(9NNe+0zs%=sFZZMLWC~0LoctZNRX*=eR7_IeJllQv)yV50cii#i?D)h6x z7nRmfZ;BUtKN-%EUO<7*hQ|npeCjffkVqLrRs4yCsuVq$%9Hq4)qpM|Y=_SH?DTP= zTsJ+F0&RVMnhU6GBGgLrS6JZis~OOT(geG_C`AbyREzn)Eq(u9LkOcN>;x+v4wA;vDUmfck9+CX%XtfDH+BvlYhsrC(|@wL6gBYh zz}Bl!e^z8DW54c06VKl|Ud~}7t&9PHEsk+EBjN&Z$RjCqu@Gp_oyEl6XgXRldVYuy z+YR-OKX6pPv%5J6*6S;6aLlV3ogt@iRG5c%WrgUnJubd9C>Tb# zG;G;wV+8ZgAa@P=zZ_*QYQ`~1+x4&dvt)DR&Z&HVyR)7<@v;3kUB?LIA}c6MZ<%;N z2dU)hiKbgOH2ZN}!*`N%_-_Bahu{3e-yWj)%yhD>3penR=IwpY&(5!(Vf#FAwxOhq z0;dcR`i;rp(v8eMEUdjD25!f@RsR5O!+3+X%Z4>7DB${fD4$cvg|H`E#i3^Lfn)8} z?B%i(#Oqbp4z!iO zoMSVD#@AFVa(J9)MRHX3UE>f41&D4x2=I9Mf_f=5@~78vBm3DI!;yUCceZ@+5bWwg zi=rFEOePpDr{?h?h7#7Jl967n7bKVey15d`)TtB#mMF(rD!-L)g8ea2P%MMzVTZ$4 zgdl_Sb*qN562$P^hnfgD+oZM{4X?)gIo;ahpAJVm4m(-M*bN(6yLmBC1aX02 zv07iHJljLcP?6j;ZgN|_woJ^cG)1LY1oz-9+07E7mE$Y{OGB*c6Azi2`Y)6T{$aT) z5iWJPPWHG&f$)83bAyhwE*jTAI@-X1JlfEgV44QZf~Jxh6DyNPWd$8;@rkh(%u5^v z1>kfqw~4EIx89_+V!C=Am4$DHgTq-i+KU`vo;I17_hEVt`9B)-F-wvj*&!Hb=R&iP zsy-Y0(b3_MnLNgrjur0OEc>rKrsg(LaA8le!*kxB2$pL?3Oj&(+6}4=;{JMJw84U; zGnZY?UqkFzf>-osqaFt6du3U6^^K`6clSyvDWewrfZK{?5o8*@`Av+2tOCs z^X6rUL4A{gjvlp5w#|GlJdI1+6~batR!D29vj)7O^~lWjxUVnR*%Z;JY$$V{$NHz7 zOP=v8V0UU2cE3QSaD^+9|M(nUvVaxRN5PdR@sA|S5tBeC!(vO7_R)F0_1!p0z<<{N zLzPuhIe~Bax?$#aE%xEo_g4SHD+mcgwcP^4Wg*4>R}+Gs{s$H=uoJ3J8BfOqU+jEt z4p$e#8+`AuZKLE2mkAPhJW|TojZb{geeX}?kgVDzH1$YM*uh$D5nc@OtidXb)`8Q^ zv_HL#$zK{D@@Vs+YNrv`XE3vEjWtYkEng%*FvxQw#e7zNdkW__Qqh?MWxmMcNHZAW z49kA47$E6ZIB`EW>*&9&qH_CVbR7Xj5D($vNtE^6rElaJ90zq@Lk00Rz%gu^+ROg& ztge%Rz-2B`RI~)E-rcni6}}1|Jru?mi3m+{hO-7{z9<3%V9I_DkHBj&wCxDuE7N6R zOflh2KP|f0wmZ*6Yi&zj@3$gY?@e&U?z(`xA=a{?YI1w3c>DOZX{3Y-493b8nq<2a zYK)rt8}VsU_9IEM#V&VD=ryLTZTuH_dr|E!{(lo2aE}%<7^+#yLmQ|8%r{{8iZD2g z+0Jn|Y(;!+H|KBFWX9D@#RN-`yxVjiZbn+R0?=js^>jFY`>*lw>y$`Ae`DgE3S2wW ze%KnZN|E^;ye*F_=5GjxM@+r;bc?YyS*Y|O((VOt)Dw_?*@NKwUXt;+wxYL>yR5w2 zzAbT~v$>VNOPA5=GJ;&#=-qANgz&4oM$^w&@3{ySj>b4_=GS zP4E3(y9}>V^<*F%SoZ#f`+5UbMtlNcqk8fBa17m9X0h`Afr{t4*T?v&WpdsTtKx0z zx_I@z#zJn?BGID5>%jahi4K-Je0tAi!Zs8))IXy_#@J=nQX?cV{^0Of^m>WGzU(Wq z3H*RVWBZ3cVGGH2n<$Y#V(^FzQF&JCXQjt$X{qr&}M zZ+nb&8L*0s(gs)PYd&p|9`1^Ky5O1f zMq5Z+re2~TVUI!lw~+GYR#2zRr<*IgXfBIw+b?8%sPlu@U0y0DefWh+hx4cy-_NCO_32|_h&;Dm)4;x7d9ui6J)~o4W3JjufOi~3uhe7bwI9bT_3Ou4y-cfD-|1l zA{~7sf)kAnnU!n4cb7fA-lKd)PCGHq-i2I>c*|vrv~VL4Ty}|l&i1s0GrVl>*6jM0 zw)}}$a3f(71}D?>2SY1;6`HKYL1Sff)fG*^uWvXANWw$H^Xh+3VRo zq*3y}q4mWrG|%Wv&q76z8GtbJV1p?09U+_q%R+EZ#_>>j+HRfBAX5^hjec%%DBj_C zsLX@F&>~mRNe^q;XBdV#q#ulplt0 z-4_Fo*%j(w;1)JpIP$lImrY|u!!J7L)g!-ioLsHigwXvCcjN;1aZL`E6xT2Ed*>HR z_AJ=kJd`nnkT&}hqSl|Q5iA_{r^2F>KBP7&HUbDQ zNDV{;!!YVfO2}R3nQxt`YYv}(ps)Ls%ZU`K8Q&y>6dq*ybe%nFHvTp4?~}{LB!JG~ zV`IsGM=}7<#|*uF!NK!)Oxjrd5@On;&N)4#d;nb|??s^q$kSZ2^(YhP$_1m!M2O^4(Q_KZK)w}97!t=jlThd*2= zK1fs^ym0=E8CNpdahbWI<>85{F?3TKd*anB`P-ebmR@&vHeQ!=yk5d$U&i(D6Rxi9 z-Q;JJ4i3^x6GvUCIbWFd?plLf`7OHZrjTw}^##>V;~!qbJ%7MH*G^HZi!xpVqR`1V;7Z6x##W|O62Gm)ks2%stEo%E1?{QqV`AUv3W8<&EI#q zXbval(TrMl_`7c21pW2Y>_hG+!*mpMUoKqJwj}wH+8uRFo9q`Dy9^7Y1u=@O=V!Yi z^YvDrxvPrFD6(CL0WGABKMrLQ07eS9tiX||0Lb#2qc#G3FZUy+>IFzkgxRPxa;-qP zFC+JKzOdXML)5oIq|C8>`&T0ZTlwI=)3Xnj8R2hpU{DqTBx-ALq_%+vl;Pm^F<@N> zi$T{PUN1cdddcXRH6<8~U^WRON?pt^U2;TZD+#v= zT{K8yM#%KQB5R5I@jPzwa`>mh-s!|fXHhvEY;#Z|qsU3aNk1JY`|?YpJpAhSp|r>v z#yznC;y#9FZel}5?(qieLKD~WtgnQKzsQsnG%)Jc%n@-!8ATzdu=O6rGiZUGL;|U^ z^$yjR*oip2%Voo554oPTTkob+;bhY6ujV@Xs&t!1%I(l<2-&lm8gc(7{{a*ehyvX} zNBF0Bygu^;0&agEbZ@XpF2dGNkH9?S5R=uM@qTvA(gt;>Z0?&ydMqSO>lIF)w-APy z`_(*&t9BLsFxMBebYq?!g^)22ps8w74o(O+o}>FLaDJoe_}&HQuph5; zwkGdTb2jdCKhzTG9kHukj19Gn4nNU8zgKN>s8waa17Nc{7Oa>StKgsx=LWe9m9 zU&rO(B4mk474^oVoOdwLiFLiQzb<<%$<{~D4ehDMK>qpAP2Y{mhBrQ%;B8FII27vnnYL;w$(4qS2f<#v;=5Hq+_9E*qh$ z*V#U8tolA<)Xtv@`NR3b4`a)nf{`p3%ruh$ab4^k&= zz2x4p@mo*lWtYLeCob}*?rx=fi!q2M*(|L+r_5xL-N1Godg~l(*uC%LTTY8h15_KI zj#YD@ViouKpmK3&FSY&>xkn?;uc&J6t*{J`Y3{tmY@19f+Q8A2QpX(w);uGNQ2UvDK? ztM<-91B^BAXSinZIT>2sC#~_#$lqqfnlH8~mRUXba<(&kArw!OdGrwKRLpJz(TrQ? zbmD&HNe+{{{)#$W-sqWULxa^gj*zS=JI~@trkqzdOvb5^lMHWbl%FDsph+uvKzz#R zCxSc)1PIsGpm;i0dU2;n?9yyu7Y*#}u<9@q9JWj>SY20|ijbZ>@7-^*w?-n+H*9q;#;~VtUds`k zP!4=S4@{tfUFbj2bcsTWsXP8KEGkha$+zHB)yHKvGAiTjCIXk1%G8}`*WCuYz{oiZ zBRm)$Dv5K)|7>%TL{x+24fDzS88U^nH6*&CE|j-ttDBw9-MN_ej=9}IN^G^ZNtp$q zmddocv@|@x=C^VLRhW`@-ULbTHB>I$yvN50PmJenL)&UhewzkTyaoN$yRoPvsw zMxEyN2D?bBR%~eah~;>WeQeRk1|7xPHo3qvl_uud!1zveSb2<|cHSixp<+5YGPk=)x*b8!x| zhz0`!xtMUiqJC5g*Yj0Xg&-@YA!OKF4k53P7CaEqo~T9De-z=*l_3D|xJ zF00oIJy(KSX{xJBj}HgB9S%~#Maqc%P7KTF_CoSeG-Y;FZ`#My8!JOMJVe=DS5MrV-8^ z8Lmv0GwqjyLok}98xfMIB=HQU4U9ES=QV4(nz;&#p=TgJ3}}=~mIy$XCQ8h~6R&B2 z0)TMQ#KaK}HL=Jf?!Clf?}mgz`!hk|Lr2)DpIZ?U4tqH~G}14#CaB_B{rm0CMstUo zqqKy#K8D1rdaDej!%Y5Fxx&?$)2Vh zqpT2Bx-#j#OvaX)Sv^>R@`$V=49%D+w_NVMG_lldaLni3K^XnCVbQbiD$+k(SJ@y# zOv4=8i4MfqP@kn5n=ClMtMXL0e>F|sd&Pho zvSMqa-87I)HsSd+5^%2eSPrvs*2FNyRS-aWxET*sOca{`Wptz`;yX!O6P!F>o%CL^ z7zL#K?M4kt@+K_$*6j6Hd+^mpuRWgT{#K}O#0+O}VkjAXEf*TPCA6wYI_)paU|H+& z3?nAJC%fxogot);1JZ>#b{|pa0bjjR4IH%buFDL0T3`>J4Ogh%;s>f?os1Q}VLa4N zBouc84otX_@05uwX(FFXcs`P8C81-C)Uo>(fO?mfKPPgoXFcy~p88~BacA=oIZlLx z`?mg!yePd>8KhRAsZL@rPb3eF?Le?j-kBQ$3!EpQ38gHXo%?gt@`UtcvS>Ll6hFvb z;ksWoPQFL%KSqp*qWpq`l!!AT7&1C7bZW99G6C;(w`tb6#_nfvyG2XwIJdsxhBMAO zT#XObBQaFby%y|&%4x>PH5*E^Z#&eg=uSjN6Asz7jfsMB{`x8iPKz}-BqglofqjF5 zf{AA?m|aSP8J5I7KNGweizM^AtlC-}>J(#Q!^MmsxJORqbS?ZT4Rll{BDducIn8r* zIlRYYMBU1F@VN5v&e3z*-Fp7dw$H7j$dQk6V>UQ)oFBM?xf}L+DQFm}dCxS48TyIO zCAY*SHWLG)zEHh$Sw#KrdC&TrFm~(Hil|dQzDmzvn^+k>@3U@JBCBF55MSF72 z7Z#&=#XRwY5ZO2_lC6(({f&`W@KZR=wLt=9;TYbq$z)KE_+1Vui|R^|6ItOQD_{Fc zR5>4q%UU7Dmp{VGa?#~ zk($*V`>a%sNZ>smNl4&{6tW;VitPh;AB(;PKWS&ki3+HVvG*I_uyV5C1gHk@Fj!PCx_OSi3 zAqUy2O3zsYImt&|?i(zmvQtR7bJ+QvmX@D{$gTNz8q+d8s7x!N7jNK}8ed?QkLE9X za&%o6i^uf7sM~%9|HV1X4)kee08}n*gd1mtxP2wUc zy<-2$5-(@w=inr}IJ)(*PNzc;61x*c4MN>JVdSDP=y#*?8#LL;Q;*8=#&wEiD$M_oYZR`w zhYrb0NqQvKG|6eT%8%RU=H{-uRHq_Qx~UQKXU`sLiCNIqHXOxRC>ZEVSY)7F&U-rT zKUXCg)F3Q=x^jRFr?q)8PQT~A*5<9m4UeJ(vVgpFAN)WSi8iRTdA3SEPaRAUh+OF8 z&*aCFD%M}_x!lfsGAgLtlMCdwfv36vPBxrD0VYLLZJ1;r8H@ERZb>U_JES3;F+3qh zbSu6|-NTAnhM9mf2|bzM_e2LNB8dPI8cA2j|J4P^KgkpF5FOvv^{8nCZ_z>vmZOHz zf-o&JoOx1Hm$KhWbf=mP>6A<{MMOVtuIPPBNGXPfWMsojLOei-V`p~#s?BtRhjP$D zc1-%z2DLPzuvKlPnxdp55j#Ba!Yn_0AQ1bLLCe@cYhIFd2nu5sW>1E+k_%AgU)#Mp zBZwOr;U+ou7=K|?ffb~U)-~BPWKH9?x?OfJJUnwLNzvdQ&^oo5i;H5B1(w`eQsLgj zPoL4yD(iHDTCTDAZtqF>S%g>4$jLbSpjx|hGTb~GzOf~fUFMD{)@WhyhifoPD_XaO zvPWyTqmLjOu z_;Oe}W-92p1V>2W@}c(bjw~?E(p{$qdx)?>nEbfIGEPhu-De0z$pLn|y`#kt9!Lqh zs-|^jza=3g8XqyaTwgNxtlkk_TI;zuWY~UcBdV2enj*>a66_#gnU_fz&R2@nxkAA! z)GB`w@9b12$P{Q@)uzhFZ8PHhKOecRr$opz9B>TWjRlG;3Kh_uVo=sG!qlK%nRG0-DlGx0(*18%VV zvmXVlH#3Zhh*p|buPc4DDtcZ;IX^AEpWXu~HFl23$Al|ca#*DqS*^7zVVXpKb@Yb6 z8Rowk%Kv0`I-8Lhmon^!qSH{&unuC)-LKK)YF*k!m4^qbiM;jrGI!EvggiKzoi;SO zwBmX3KHoi?OiEXV!$G^mM%g=SLS=q$UL;KBIu_hruP{Da_jo7E=w;XR{hvNpQh_@o z^V-RwuC9NZ+iUTKM&KkKmgLvxg{5LL;QF3CWw#IcU3eiwe2^kpd z>K|fbkseIoKmMJu3H?8V)>y5Mo^H*PBPmQR30-YP1It(ltDt*-zbM0$^tNZQk9o9- ztSUpl$8Z_8BDr3&iX{b z19|{_N)yQ6lS#|l8gRcK66@@GBRSh%3SXM23Z!{s1hx>(o9Dh~zwT$}n4m~_PG>NibC`62TY-KKSRsL!E z{^}5rRHt@-cG1;NI+78#w0vrw@9KWf50&US_wqWDY)$HS<{i>vhp(>=U6U|T zogQ!I&Tg<-x545y>A5jGz~$IDMlmo5teCKkoLFh|$EsIknfGTrvYg`&w;}Tz`zVugzB)C9_3z+xRO2j_eu&1+ACpyEM1OoMA z&j5%K!6aru|M~;Crwamzf61ez4xu~CL5&=;1RpR*4lNW}BmH;k>GXczY`FMQ>78^D zD&J|&YI_t89Cp~-5zJl$p_A~%sj)`w-PL#}=@~FGZk>>T>3KFPJTnIq%ySmvWul=TEiIOwmofzM?FzIH88`SdYN3VsJ z!MW4`y0OkZ0#U^6ny8f-kaX578G{nn!Uu3B#VtqrGG5N8q~8mZOB}&|!^hOU^*>Js z(c>Y{g=uUY@-?*ZAuExg#t}W&N%xb?&W3+4(WKTc%pG2 zR5M-Gx63oS@7Drh#!yR`cZBGIR#4_;>4vJ`{>Xo!S^*iatbAd0{BmH(sAb^Fsi5+P ztjAXkR)akBJE-BcLqBJU#lOUY-;~gOOf7>~-M{1IxkI?ix5Bi@ZVdfgz|u zl(3qRAse+Fy)~bo%0)XhRx}+$pJappRt`S5r2%1^dFu<~Qf#7j*b3`2sFL9u6c;x) zDFSeag}9+0Q-*0L?`*XH8orE-oWS}*=o%lGkc6OKlyrX-df~<-TC1yUC?!o)`%Sc4 z=})K<7g*=b55q9Sv9?cGYqlp{ef*hSLuq#1&;(kxY=WQPPQAC#aEr%6Lm3*CfoTBHyveZk6DR1IRS zp$FB;bt^DM|FRyc{P6Q~|A3$=jDEstag(u|+}6vFVD+90aZMX8ub4&LBkQGD8Ka&- z3Dfr<@8?}BAV8}I(#j^)>SF<&1%rlj(HU6Hfe=LEqsD?4bG~;cCdlmwB*D1+g}^6x z{~f2`>%?YNHLc98UVnCbb5z%*K1st)$EHXqSmpwMXJ(WqrL7y1yzNLp%Q08`(cSQ1 zJW|jt{KcKlKxZ+|(~ZpgITdzg-?!bUisL3%i*gU zB0Ad*DOKH;Me9=|WJPAX-}qg4%7ydRRjLuL_Z`~o?&n&bmw%=kumF{}fDyB4<1-7F zG!TZ`Njep@Nzz3T_$hR`D11!O5mKnk3L9`>eLP?9aXh5dInCYm1AekY%o! z25BTT1X-e^Ba5xi)p^R%a$w-?a}}NZby;9n5~v1A19RXMOvs4`V*cDx)+AN+eXh@C$E*oh|5io#`OcR_UDc~`jOn-ZHB+| z>bro;0Mlt{b$h>Dr*GJ_=iY?2S3VI`-SS5*Bvia!c zxrk_=H*Bq^-xrU!^s~HrRgH)~S)G+C6!Gi*apj_wx8_+AUgbz5_#eB|sxqhUS}2A`85&n#_4{SV3XOIOurQJe zSVRM4@(Z_{D9$#s*Z4w0FNcEMjUX=nS)zAmWg0~T7mxE0XY?bGXtjp(H^H#hW7IGf zRulY*xjoQSlU#?mjWoj3=y>Pka0tdcJZxf339M7p1Gj0SEGri6*~GXMk)`flBa(T> z=*LGe4?kY(@LrnptRqC4;Vrs6d;E>O;zjQ+Zo4(c|AJ*HK%IBTw4-edN5}fDhM+B6 zyUpoSX!QZ=({FAPiX(T}Op-ym|MdEz7C0wyUENc98JRyPv4Ox?7YZXsTjb^M^9{3( z){x~m6*%V=0juZY#nk8l1oa+5k@Hamn%Krs&vb7LOXr5|NrPIzyY*8zI{xqbrX9j z>#lOAvQi?3l|%<+T4+wi`V(g*;$lJNGMeU#TG7rJ8O`^Ai03--C4T{YJs+oeG}GVlNubvc5h95KhU09)KuDg~Lpiwe5 zZ{3&Fs&#l@2Rb0zu1UOn?s%4eKTj>J6O+i#TtLWBmUzR6Bk%-MCzBbq@DYgLpLQNz z?@zH$2I{5Opk-tUF&2OiWclDj!s5ny#hPAnK#wAS|3ff(w(;?=zalV=G&yv144YvS zR~}?NnTGPP@B3=DldqaX*x@!dV(K3%Z{Sgi(zZP#F;eC?(#*)UcGHN9qwPk!gEJuT z_JN0wLFEKGa1HcVsY`lhCRmGNP;pAvtOmoA_`v2pr15F-U_e`WsStEBzV;Z^x6rOn zH_<}@ZA!s?snJ)U7-#!#``NhtlNV6rd0(ZZZysJW0>L4<9F2 zlf`B0p@Y?bj!n#jEP|pTN7jhyB;a=gn`nOk2N=DzJ!(zu%*@P5Bg5YRMkchBpF9Zk zvV()+U4+M=39)|=c&P;$Wi;JP?EzaPn`%^vg(9_RG}h?hAcI_TY-SF6qhJw>Kt;5k zwiZ6#iA9j3UOW2}3yI>(&Bwr(EE?gYXHiQv2;A}*wO|)7#Z_ug+SF4`%9w18%oP2? zVb*gUr?8#G?8@(yr)}|a3`Pv>wdgdlzVANw->V)QNL-Z7Z(Gglg%z_24+XG-di(*i z1)R#8;O9stQNp7+BUOZ0e2x9qYW(^W_aevm|1mtFp-W#>;=aL~#{Vnp|Lz-#&^#Mx z7kTIt*YSydjt(#rw3)-%rKct>@6T*(LXBP{csHV?0$$>KKq2@Z*hq-?rKhqWSILW> zeR*Gf0uV8!{0uXam^T5MD-Zy%gF2r|*W;Ub{@-W*wqQOJaIc$5OdawvNd>hfk1rU+>1-u99bNf|j= zvf!@Txc7(HQ~Vb8S2wUV@&5VXVn7tSY`!I_pf4#2t!3*f#DO}gg#!2Sa4#AB&oDXQ zjg;bn)Mz4v^i;V(RFnRllKdOr5hqt&~^)VtM0@w+K!sp8(=wJC#fT{s- zzh&lPwZ{8@0Jg-9U8cQ~RH~3G3hXlQ8#0!PL$AVm7ir}k_$(CPU(R}rfFlsqO94Aa zC(JLNx{Svzqh6K%1}BrkWB05Xpn%Le0q>#X%+Bq1I1(vxCq*{Hp19emT zAIS(1CL$zwqmTivGpH=k!hgE$HI-n^JAC)IhDJa)XvuubR+lvp8!I&ZHyHjs2{?Tc zekAWf%#!i@oBwzDivwzMYyRTK{EvstJ%Bt@8*m61f=A)g)u!+tf}lxnhiKEz2!1)QOAh>TYC)%pdjF@ zNd@4uxK!iuTEjt}XTpRB{j2@t&T#N!FjO^T{t=^Iv#0CO6m_%SoemuTZK6Oca!yRx zLRP3#3jn*c25ybE4waMZG%tUXRK^~rfidLxwt;`xbBcqXa9R@7gKGA11{c{)1k`Kl z=KBYCuJ>Yq%{yR9zz_1>SYw5#@jc1(Y+!yA)j`A?>5bQ~7XQ`-Z{dTxH>YQI{9}JG zd$5;rO7w=hawhp8%)*FSW?xv)ZJok>mYw0pVH_}H5nyJFIzz;(G_8bqBiCd8mAH?K zp@tL5gV*-KQ0!;V$4oUDC}k8|8M$YsJeJP1Es>wAJnDjj(a;ST#(9oUTbVzG)kMJV39Z7Jga>*m`3nQq_swvai*W`;ca zZjO^YMv-$YhYCy|sV*>LBDoTiB=Rpv_+g#XY_d;3PaNvh-dJ;Q|29aXnX5?jtMS5nZ^(-kVy^qhS9nia1u z_48n7`9(Yw7(P=b;eECTN5ZMJJx;oHvj%>LY0`g~+fZ&~WesD?qn-R@^{WNe`js^k zsgop?JB_Y9lL)w3RA}#wo2aX`zB%^kD6Ah*%f>TKl6vHV;W8<5X|gYaZP~Q!q+G|r z(i7)8CaRioH>)A#Ji~leT8fy7v+Kdk!m=m$PyNrc0utpWI>N3GX%hy8=MMEcsiVd? zKCu)L!YL)@H7>s|<@Q=eyuhB(z-Id9bv*XK;C9`-f!%SQX3Q!xkUMSZAElMtab0)% z#NoZWH-!JWeJ<#AT9e~3OK+x>(%~#4J8amOi>NKPMtntC9QQ?S+=QEsa=&ch-$IwS zMubffe6~) zXLF&U6&u|CO7_+*ksnTW!x?ArDhenZ(50-`xy zbk{nT-P5qZ>KBQ$0w{ZUDL&nxU5u2Ky3KI6%!et>=9xkk51e#Ly>cmNDoCu39mba%cc`^OZ|k2yHcGwgr!G4fRX$aR zYAVYTKUOD#EU}M-G3hJfWsh`NmYei`z^X+K6G`P&*q)+DE;Qld$FXc@q!<^kBXrVt=MP6nR(BjALtHsYDFM2} z6S6is?yn;hnZ+~TlPE9mimpuKj1Pz~qBn#`aQZYhENH22J@_(2qJ`S)Hf7l0;;QPE zBqwtiSv^^lkbHW^!+r7Nrc-IJBhX~!Ax?71tKW6b+Th)pqpf6&V?Ud4qzmbP;-4|GI9}2>$f zmtcFMqq4WXrH`A@36!le(QqNCzGggaBBZeG)N#}+V1!tN%hUtf>>K*=`80Ud<7Xd} zUok0_ztRp>a<#9A;GU6-+xdYp63E)RP`Ppz*XAXcFaIxxvkU0==d>Txm$J4Q+a6V) z9c`sbE(T4l@2%Zrb>QyKja@;Ev(QsBiJh4cnpRC> zck($01>I4Wnrlbi@NDF**WyHTS@9l7932tZZjG-Fa++KaYkAbmYwWHnIxrBmsRAzC zyi~b2Q?#nVVJMNmqc&jUe565J@}#KHSTN2^!e&GILsAa0?YQ4rFRD17FNqB9Y3EJ0 z8@H`{Su9{9rhWq;vk};HZv6e+%&i~cd*aX5r^w1udJIi$kFt)QzJF%W~5FY?UoqPg7r$qH{}qwm%oom>x7H zYmL!vHnbOg=fc3-%S+*q=R;a@g$(HN>KMBm-wF6**s-+6KjjeC3eA*v6u=WLI%RlYb)UwjEDIi~yHut) z=vnD@-=Ct~tKAQz1Gq%n;=9N+1s!zA|5it zS$%>?OfDYF}j}Z8m zmDgM>6atax#jmi=4r*Wmrg6+UAyH|JMLYxwgMU!T1=TYI&9(2kH8Bh)od5a{K!a#O zRP%v<>may66BDhH8C3Y*MbH;1?PBNtO~k6K0vKUFDct6VU`T>c5($~NJ`iYB#Ag|o l6d=}SvN|FLiv7Qwj{Ftv52jKGh&Kd$?5v%vSOo9He*h4 Date: Wed, 27 Apr 2022 10:46:57 -0400 Subject: [PATCH 416/478] Updated link description --- content/rancher/v2.6/en/neuvector-integration/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/neuvector-integration/_index.md b/content/rancher/v2.6/en/neuvector-integration/_index.md index 9ae34e2eac2..8514291c823 100644 --- a/content/rancher/v2.6/en/neuvector-integration/_index.md +++ b/content/rancher/v2.6/en/neuvector-integration/_index.md @@ -5,7 +5,7 @@ weight: 22 ##### _Tech Preview_ -New in Rancher v2.6.5, [NeuVector 5.x](https://open-docs.neuvector.com/) is an open-source container-centric security platform that is now integrated into Rancher. NeuVector offers real-time compliance, visibility, and protection for critical applications and data during runtime. NeuVector provides a firewall, container process/file system monitoring, security auditing with CIS benchmarks, and vulnerability scanning. For more information on Rancher security, please see the [hardening guides and benchmark versions]({{}}/rancher/v2.6/en/security/). +New in Rancher v2.6.5, [NeuVector 5.x](https://open-docs.neuvector.com/) is an open-source container-centric security platform that is now integrated into Rancher. NeuVector offers real-time compliance, visibility, and protection for critical applications and data during runtime. NeuVector provides a firewall, container process/file system monitoring, security auditing with CIS benchmarks, and vulnerability scanning. For more information on Rancher security, please see the [security documentation]({{}}/rancher/v2.6/en/security/). NeuVector can be enabled through a Helm chart that may be installed either through **Apps & Marketplace** or through the **Cluster Tools** button in the Rancher UI. Once the Helm chart is installed, users can easily [deploy and manage NeuVector clusters within Rancher](https://open-docs.neuvector.com/deploying/rancher#deploy-and-manage-neuvector-through-rancher-apps-marketplace). From 8defd30bccffbd46c12c8f16462497b73b9432d4 Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Wed, 27 Apr 2022 20:18:18 +0530 Subject: [PATCH 417/478] Update content/rancher/v2.6/en/backups/examples/_index.md Co-authored-by: Brad Davidson --- content/rancher/v2.6/en/backups/examples/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/backups/examples/_index.md b/content/rancher/v2.6/en/backups/examples/_index.md index 4670c938ef1..b1282f9c3ca 100644 --- a/content/rancher/v2.6/en/backups/examples/_index.md +++ b/content/rancher/v2.6/en/backups/examples/_index.md @@ -276,7 +276,7 @@ The snippet below demonstrates two different types of secrets and their relevanc The first example is that of a secret that is used to encrypt the backup files. The backup operator, in this case, will not be able to read the secrets encryption file. It only uses the contents of the secret. -The second example is that of a Kubernetes secrets encryption config file that is used to encrypt secrets when stored in etcd. **While backing up your etcd config, be sure to also backup your EncryptionConfiguration.** Failing to do so might result in you not being able to use the restored data. +The second example is that of a Kubernetes secrets encryption config file that is used to encrypt secrets when stored in etcd. **When backing up the etcd datastore, be sure to also back up the EncryptionConfiguration.** Failure to do so will result in an inability to use the restored data if secrets encryption was in use at the time the data was backed up. ```yaml From bb4ce4514a90c213f037eb0c1368db5e97e96e71 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Wed, 27 Apr 2022 14:40:19 -0400 Subject: [PATCH 418/478] Updated NV limitations --- content/rancher/v2.6/en/neuvector-integration/_index.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/neuvector-integration/_index.md b/content/rancher/v2.6/en/neuvector-integration/_index.md index 8514291c823..89a0ae2f08c 100644 --- a/content/rancher/v2.6/en/neuvector-integration/_index.md +++ b/content/rancher/v2.6/en/neuvector-integration/_index.md @@ -76,4 +76,8 @@ To learn more about NeuVector's architecture, please refer [here](https://open-d ### Limitations -* Currently, NeuVector feature chart installation fails when a NeuVector partner chart already exists. To work around this issue, uninstall the NeuVector partner chart and reinstall the NeuVector feature chart. \ No newline at end of file +* Currently, NeuVector feature chart installation fails when a NeuVector partner chart already exists. To work around this issue, uninstall the NeuVector partner chart and reinstall the NeuVector feature chart. + +* Users cannot access the NeuVector UI from Rancher for a custom RKE1 cluster. To work around this, restart the controllers; note that while the controller pods are restarting, it will take additional time for the controller pods to become active. + +* Container runtime is not auto-detected for different cluster types when installing the NeuVector chart. \ No newline at end of file From 9fd2aa46d4551de9208e0fe8a20e856c7037fc61 Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Thu, 28 Apr 2022 13:51:27 +0530 Subject: [PATCH 419/478] Update _index.md --- content/rancher/v2.6/en/helm-charts/_index.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/helm-charts/_index.md b/content/rancher/v2.6/en/helm-charts/_index.md index d225e2f5854..ca9a26eae82 100644 --- a/content/rancher/v2.6/en/helm-charts/_index.md +++ b/content/rancher/v2.6/en/helm-charts/_index.md @@ -75,7 +75,7 @@ To add a private CA for Helm Chart repositories: ``` -- **Git-based chart repositories**: It is not currently possible to add a private CA. For git-based chart repositories with a certificate signed by a private CA, you must disable TLS verification. Click **Edit YAML** for the chart repo and add the key/value pair as follows: +- **Git-based chart repositories**: You must add a base64 encoded copy of the CA certificate in DER format to the spec.caBundle field of the chart repo, such as `openssl x509 -outform der -in ca.pem | base64 -w0`. Click **Edit YAML** for the chart repo and set, as in the following example:
      ``` [...] spec: @@ -85,6 +85,7 @@ To add a private CA for Helm Chart repositories: nDxZ/tNXt/WPJr/PgEB3hQdInDWYMg7vGO0Oz00G5kWg0sJ0ZTSoA10ZwdjIdGEeKlj1NlPyAqpQ+uDnmx6DW+zqfYtLnc/g6GuLLVPamraqN+gyU8CHwAWPNjZonFN9Vpg0PIk1I2zuOc4EHifoTAXSpnjfzfyAxCaZsnTptimlPFJJqAMj+FfDArGmr4= [...] ``` + > **Note:** Helm chart repositories with authentication > @@ -128,4 +129,4 @@ If you have a legacy app installed and want to upgrade it: - The legacy [feature flag]({{}}/rancher/v2.6/en/installation/resources/feature-flags/) must be turned on (if it's not turned on automatically because of having a legacy app before upgrading) - You can upgrade the app from cluster explorer, from the left nav section **Legacy > Project > Apps** -- For multi-cluster apps, you can go to **≡ > Multi-cluster Apps** and upgrade the app from there \ No newline at end of file +- For multi-cluster apps, you can go to **≡ > Multi-cluster Apps** and upgrade the app from there From 982a23bcada299ce0d2b323d3ac89f4400009ed4 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Thu, 28 Apr 2022 09:17:51 -0400 Subject: [PATCH 420/478] Fixed chart link --- content/rancher/v2.6/en/neuvector-integration/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/neuvector-integration/_index.md b/content/rancher/v2.6/en/neuvector-integration/_index.md index 89a0ae2f08c..7f726bf15b3 100644 --- a/content/rancher/v2.6/en/neuvector-integration/_index.md +++ b/content/rancher/v2.6/en/neuvector-integration/_index.md @@ -18,7 +18,7 @@ The Harvester Helm Chart is used to manage access to the NeuVector UI in Rancher 1. Click **☰ > Cluster Management**. 1. On the Clusters page, go to the cluster where you want to deploy NeuVector, and click **Explore**. 1. Go to **Apps & Marketplace > Repositories**, then click **Create**. -1. In the Target section, select **Git repository containing Helm chart or cluster template definitions**. Then enter the index URL of https://github.com/selvamt94/charts.git and the branch **neuvector**. Click **Create**. +1. In the Target section, select **Git repository containing Helm chart or cluster template definitions**. Then enter the index URL of https://github.com/rancher/charts.git and the branch **neuvector**. Click **Create**. 1. Go to **Apps & Marketplace > Charts**, and install **NeuVector** from the chart repo. When configuring Helm chart values, go to the **Container Runtime** section, de-select **Docker** and instead select **Containerd Runtime**. Finally, click **Install** again. **To navigate to and install the NeuVector chart through Cluster Tools:** From 3492e0cc0c84576dc9d310f7106c1a0c392e4ec5 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 29 Apr 2022 14:08:31 -0400 Subject: [PATCH 421/478] Updated per QA feedback --- .../v2.6/en/neuvector-integration/_index.md | 42 +++++++++++++------ 1 file changed, 30 insertions(+), 12 deletions(-) diff --git a/content/rancher/v2.6/en/neuvector-integration/_index.md b/content/rancher/v2.6/en/neuvector-integration/_index.md index 7f726bf15b3..49a79259a09 100644 --- a/content/rancher/v2.6/en/neuvector-integration/_index.md +++ b/content/rancher/v2.6/en/neuvector-integration/_index.md @@ -3,7 +3,7 @@ title: NeuVector Integration weight: 22 --- -##### _Tech Preview_ +### NeuVector Integration in Rancher New in Rancher v2.6.5, [NeuVector 5.x](https://open-docs.neuvector.com/) is an open-source container-centric security platform that is now integrated into Rancher. NeuVector offers real-time compliance, visibility, and protection for critical applications and data during runtime. NeuVector provides a firewall, container process/file system monitoring, security auditing with CIS benchmarks, and vulnerability scanning. For more information on Rancher security, please see the [security documentation]({{}}/rancher/v2.6/en/security/). @@ -17,35 +17,40 @@ The Harvester Helm Chart is used to manage access to the NeuVector UI in Rancher 1. Click **☰ > Cluster Management**. 1. On the Clusters page, go to the cluster where you want to deploy NeuVector, and click **Explore**. -1. Go to **Apps & Marketplace > Repositories**, then click **Create**. -1. In the Target section, select **Git repository containing Helm chart or cluster template definitions**. Then enter the index URL of https://github.com/rancher/charts.git and the branch **neuvector**. Click **Create**. -1. Go to **Apps & Marketplace > Charts**, and install **NeuVector** from the chart repo. When configuring Helm chart values, go to the **Container Runtime** section, de-select **Docker** and instead select **Containerd Runtime**. Finally, click **Install** again. +1. Go to **Apps & Marketplace > Charts**, and install **NeuVector** from the chart repo. +1. Different cluster types require different container runtimes. When configuring Helm chart values, go to the **Container Runtime** section, and select your runtime in accordance with the cluster type: + + - RKE1: Select `docker` + - K3s and RKE2: Select `k3scontainerd` + - AKS: Select `containerd`
      + + >**Note:** Only one container runtime engine may be selected at a time during installation. +1. Click **Install** again. **To navigate to and install the NeuVector chart through Cluster Tools:** -1. Repeat steps 1 - 4 above. +1. Click **☰ > Cluster Management**. +1. On the Clusters page, go to the cluster where you want to deploy NeuVector, and click **Explore**. 1. Click on **Cluster Tools** at the bottom of the left navigation bar. -1. Select the **NeuVector** chart and then click **Install**. When configuring Helm chart values, go to the **Container Runtime** section, de-select **Docker** and instead select **Containerd Runtime**. Finally, click **Install** again. +1. Repeat step 4 above to select your container runtime accordingly, then click **Install** again. ### Accessing NeuVector from the Rancher UI -1. Go to the cluster where NeuVector is installed. In the left navigation bar, click **NeuVector**. -1. Click the external link to go to the NeuVector UI. +1. Navigate to the cluster explorer of the cluster where NeuVector is installed. In the left navigation bar, click **NeuVector**. +1. Click the external link to go to the NeuVector UI. Once the link is selected, users must accept the `END USER LICENSE AGREEMENT` to access the NeuVector UI. ### Uninstalling NeuVector from the Rancher UI **To uninstall from Apps & Marketplace:** 1. Click **☰ > Cluster Management**. -1. On the Clusters page, go to the cluster where NeuVector is deployed, and click **Explore**. -1. In the left navigation bar, click **NeuVector**. 1. Under **Apps & Marketplace**, click **Installed Apps**. 1. Under `cattle-neuvector-system`, select both the NeuVector app (and the associated CRD if desired), then click **Delete**. **To uninstall from Cluster Tools:** -1. Repeat steps 1 - 3 above. -1. Click on **Cluster Tools** at the bottom-left of the screen, then click on the trash can icon under the NeuVector chart. Select `Delete the CRD associated with this app` if desired. +1. Click **☰ > Cluster Management**. +1. Click on **Cluster Tools** at the bottom-left of the screen, then click on the trash can icon under the NeuVector chart. Select `Delete the CRD associated with this app` if desired, then click **Delete**. ### GitHub Repository @@ -74,6 +79,19 @@ The NeuVector security solution contains four types of security containers: Cont To learn more about NeuVector's architecture, please refer [here](https://open-docs.neuvector.com/basics/overview#architecture). +### CPU and Memory Allocations + +Below are the minimum recommended computing resources for the NeuVector chart installation in a default deployment. Note that the resource limit is not set. + +| Container | CPU - Request | Memory - Request | +|------------|--------|---------| +| Controller | 3 (1GB 1vCPU needed per controller) | * +| Enforcer | On all nodes (500MB .5vCPU) | 1GB +| Manager | 1 (500MB .5vCPU) | * +| Scanner | 3 (100MB .5vCPU) | * + +\* Minimum 1GB of memory total required for Controller, Manager, and Scanner containers combined. + ### Limitations * Currently, NeuVector feature chart installation fails when a NeuVector partner chart already exists. To work around this issue, uninstall the NeuVector partner chart and reinstall the NeuVector feature chart. From 9dae2ce00b47564355ebc0fb136cf0050804e1e5 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Sun, 1 May 2022 20:22:43 -0700 Subject: [PATCH 422/478] Update RHEL 8 installation steps --- content/rke/latest/en/os/_index.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/content/rke/latest/en/os/_index.md b/content/rke/latest/en/os/_index.md index 08855564c8e..f41f8cc7ece 100644 --- a/content/rke/latest/en/os/_index.md +++ b/content/rke/latest/en/os/_index.md @@ -154,6 +154,12 @@ If using Red Hat Enterprise Linux, Oracle Linux or CentOS, you cannot use the `r systemctl disable nm-cloud-setup.service nm-cloud-setup.timer reboot ``` +> +> In addition, the default firewall settings of RHEL 8.4 prevents RKE1 pods from reaching out to Rancher to connect to the cluster agent. To allow Docker containers to reach out to the internet and connect to Rancher, make the following updates to the firewall settings: +> ``` + firewall-cmd --zone=public --add-masquerade --permanent + firewall-cmd --reload + ``` #### Using upstream Docker If you are using upstream Docker, the package name is `docker-ce` or `docker-ee`. You can check the installed package by executing: From 8983a4e2ce0dd410397014c17a59d585a9425c05 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 2 May 2022 19:22:17 -0700 Subject: [PATCH 423/478] Remove RKE2 tech preview verbiage --- .../v2.6/en/cluster-admin/editing-clusters/_index.md | 4 ++-- .../editing-clusters/k3s-config-reference/_index.md | 2 +- .../editing-clusters/rke2-config-reference/_index.md | 2 +- .../v2.6/en/cluster-provisioning/rke-clusters/_index.md | 6 +++--- .../cluster-provisioning/rke-clusters/node-pools/_index.md | 4 ++-- .../rke-clusters/windows-clusters/_index.md | 6 +++--- .../v2.6/en/installation/resources/feature-flags/_index.md | 2 +- 7 files changed, 13 insertions(+), 13 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-admin/editing-clusters/_index.md b/content/rancher/v2.6/en/cluster-admin/editing-clusters/_index.md index c9e257784be..cab7cdd0d06 100644 --- a/content/rancher/v2.6/en/cluster-admin/editing-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/editing-clusters/_index.md @@ -12,8 +12,8 @@ For information on editing cluster membership, go to [this page.]({{}}/ The cluster configuration options depend on the type of Kubernetes cluster: - [RKE Cluster Configuration](./rke-config-reference) -- [RKE2 Cluster Configuration](./rke2-config-reference) (Tech Preview) -- [K3s Cluster Configuration](./k3s-config-reference) (Tech Preview) +- [RKE2 Cluster Configuration](./rke2-config-reference) +- [K3s Cluster Configuration](./k3s-config-reference) - [EKS Cluster Configuration](./eks-config-reference) - [GKE Cluster Configuration](./gke-config-reference) - [AKS Cluster Configuration](./aks-config-reference) diff --git a/content/rancher/v2.6/en/cluster-admin/editing-clusters/k3s-config-reference/_index.md b/content/rancher/v2.6/en/cluster-admin/editing-clusters/k3s-config-reference/_index.md index 47ee18b44e2..00d784cfa0c 100644 --- a/content/rancher/v2.6/en/cluster-admin/editing-clusters/k3s-config-reference/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/editing-clusters/k3s-config-reference/_index.md @@ -1,5 +1,5 @@ --- -title: K3s Cluster Configuration Reference (Tech Preview) +title: K3s Cluster Configuration Reference shortTitle: K3s Cluster Configuration weight: 6 --- diff --git a/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md b/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md index 54539ceb934..7211d96d859 100644 --- a/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md @@ -1,5 +1,5 @@ --- -title: RKE2 Cluster Configuration Reference (Tech Preview) +title: RKE2 Cluster Configuration Reference shortTitle: RKE2 Cluster Configuration weight: 5 --- diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md index 0b5c79028c5..58b176bbc79 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md @@ -15,10 +15,10 @@ RKE clusters include clusters that Rancher launched on Windows nodes or other ex ### Changes in Rancher v2.6 -_Tech Preview_ - Rancher v2.6 introduces provisioning for [RKE2](https://docs.rke2.io/) clusters directly from the Rancher UI. RKE2, also known as RKE Government, is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector. +As of Rancher v2.6.5, provisioning for RKE2 is GA. + RKE2 provisioning is built on top of a new provisioning framework that leverages the upstream [Cluster API](https://github.com/kubernetes-sigs/cluster-api) project. With this new provisioning framework, you can: - Provision RKE2 clusters on Digital Ocean, AWS EC2, Azure, and vSphere @@ -26,7 +26,7 @@ RKE2 provisioning is built on top of a new provisioning framework that leverages - Choose CNI options Calico, Cilium, and Multus in addition to Canal - Install custom RKE2 clusters on pre-provisioned VMs or bare-metal nodes -The RKE2 provisioning tech preview also includes installing RKE2 on Windows clusters. Windows features for RKE2 include: +The RKE2 provisioning features also includes installing RKE2 on Windows clusters. Windows features for RKE2 include: - Windows Containers with RKE2 powered by containerd - Added provisioning of Windows RKE2 custom clusters directly from the Rancher UI diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/_index.md index 3c89deb26c9..4b31f58bfa3 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/_index.md @@ -27,7 +27,7 @@ This section covers the following topics: # Changes in Rancher v2.6 -_Tech Preview_ + Rancher v2.6 introduces provisioning for [RKE2](https://docs.rke2.io/) clusters directly from the Rancher UI. RKE2, also known as RKE Government, is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector. @@ -148,4 +148,4 @@ In our [recommended cluster architecture]({{}}/rancher/v2.6/en/cluster- - At least two nodes with the role controlplane for master component high availability - At least two nodes with the role worker for workload rescheduling upon node failure -The implementation of the three node roles in Rancher means that Rancher managed RKE2 clusters are able to easily leverage all of the same architectural best practices that are recommended for RKE clusters. \ No newline at end of file +The implementation of the three node roles in Rancher means that Rancher managed RKE2 clusters are able to easily leverage all of the same architectural best practices that are recommended for RKE clusters. diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md index ebd32e5397d..5db4add3d41 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md @@ -30,11 +30,11 @@ This guide covers the following topics: # Changes in Rancher v2.6 -_Tech Preview_ - Rancher v2.6 introduces provisioning for [RKE2](https://docs.rke2.io/) clusters directly from the Rancher UI. RKE2, also known as RKE Government, is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector. -The RKE2 provisioning tech preview also includes installing RKE2 on Windows clusters. Windows features for RKE2 include: +As of Rancher v2.6.5, provisioning for RKE2 is GA. + +The RKE2 provisioning feature also includes installing RKE2 on Windows clusters. Windows features for RKE2 include: - Windows Containers with RKE2 powered by containerd - Added provisioning of Windows RKE2 custom clusters directly from the Rancher UI diff --git a/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md b/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md index a1f92902d3d..25baf0c06a2 100644 --- a/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md +++ b/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md @@ -26,7 +26,7 @@ For example, if you install Rancher, then set a feature flag to true with the Ra The following is a list of the feature flags available in Rancher: - `harvester`: This feature flag is available starting in v2.6.1. It is used to manage access to the Virtualization Management page where users can navigate directly to Harvester clusters and access the Harvester UI. For more information, see [this page]({{}}/rancher/v2.6/en/virtualization-admin/#feature-flag/). -- `rke2`: We have introduced the ability to provision RKE2 clusters as tech preview. By default, this feature flag is enabled, which allows users to attempt to provision these type of clusters. +- `rke2`: Used to enable the ability to provision RKE2 clusters. By default, this feature flag is enabled, which allows users to attempt to provision these type of clusters. - `fleet`: The previous `fleet` feature flag is now required to be enabled as the Fleet capabilities are leveraged within the new provisioning framework. If you had this feature flag disabled in earlier versions, upon upgrading to Rancher v2.6, the flag will automatically be enabled. See this [page]({{}}/rancher/v2.6/en/deploy-across-clusters/fleet) for more information. - `continuous-delivery`: In Rancher v2.5.x, Fleet came with a GitOps feature that could not be disabled separately from Fleet. In Rancher v2.6, the `continuous-delivery` feature flag was introduced to allow the GitOps feature of Fleet to be disabled. For more information, see [this page.](./continuous-delivery). - `legacy`: There are a set of features from previous versions that are slowly being phased out of Rancher for newer iterations of the feature. This is a mix of deprecated features as well as features that will eventually be moved to newer variations in Rancher. By default, this feature flag is disabled for new installations. If you are upgrading from a previous version, this feature flag would be enabled. From 85d550c5710728a74421d9742b771d975163fa2e Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 2 May 2022 19:07:41 -0700 Subject: [PATCH 424/478] Launch RKE2 + Azure --- .../rke-clusters/node-pools/azure/_index.md | 87 ++++++++++++-- .../azure/azure-machine-config/_index.md | 109 ++++++++++++++++++ 2 files changed, 188 insertions(+), 8 deletions(-) create mode 100644 content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/azure-machine-config/_index.md diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md index c918601b214..92dba8f3be9 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md @@ -6,7 +6,7 @@ weight: 2220 In this section, you'll learn how to install an [RKE]({{}}/rke/latest/en/) Kubernetes cluster in Azure through Rancher. -First, you will set up your Azure cloud credentials in Rancher. Then you will use your cloud credentials to create a node template, which Rancher will use to provision new nodes in Azure. +First, you will set up your Azure cloud credentials in Rancher. Then you will use your cloud credentials to create a node template, which Rancher will use to provision new nodes in Azure. Then you will create an Azure cluster in Rancher, and when configuring the new cluster, you will define node pools for it. Each node pool will have a Kubernetes role of etcd, controlplane, or worker. Rancher will install Kubernetes on the new nodes, and it will set up each node with the Kubernetes role defined by the node pool. @@ -25,29 +25,31 @@ For more information on configuring Azure node templates, refer to the [Azure no - [Creating an Azure Cluster](#creating-an-azure-cluster) # Preparation in Azure - + Before creating a node template in Rancher using a cloud infrastructure such as Azure, we must configure Rancher to allow the manipulation of resources in an Azure subscription. To do this, we will first create a new Azure **service principal (SP)** in Azure **Active Directory (AD)**, which, in Azure, is an application user who has permission to manage Azure resources. The following is a template `az cli` script that you have to run for creating an service principal, where you have to enter your SP name, role, and scope: - + ``` az ad sp create-for-rbac \ --name="" \ --role="Contributor" \ --scopes="/subscriptions/" ``` - + The creation of this service principal returns three pieces of identification information, *The application ID, also called the client ID*, and *The client secret*. This information will be used when you create a node template for Azure. # Creating an Azure Cluster +{{% tabs %}} +{{% tab "RKE" %}} 1. [Create your cloud credentials](#1-create-your-cloud-credentials) 2. [Create a node template with your cloud credentials](#2-create-a-node-template-with-your-cloud-credentials) 3. [Create a cluster with node pools using the node template](#3-create-a-cluster-with-node-pools-using-the-node-template) - + ### 1. Create your cloud credentials 1. Click **☰ > Cluster Management**. @@ -57,7 +59,7 @@ The creation of this service principal returns three pieces of identification in 1. Enter your Azure credentials. 1. Click **Create**. -**Result:** You have created the cloud credentials that will be used to provision nodes in your cluster. You can reuse these credentials for other node templates, or in other clusters. +**Result:** You have created the cloud credentials that will be used to provision nodes in your cluster. You can reuse these credentials for other node templates, or in other clusters. ### 2. Create a node template with your cloud credentials @@ -82,17 +84,86 @@ Use Rancher to create a Kubernetes cluster in Azure. 1. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user. 1. Click **Create**. -**Result:** +**Result:** Your cluster is created and assigned a state of **Provisioning**. Rancher is standing up your cluster. You can access your cluster after its state is updated to **Active**. -**Active** clusters are assigned two Projects: +**Active** clusters are assigned two Projects: - `Default`, containing the `default` namespace - `System`, containing the `cattle-system`, `ingress-nginx`, `kube-public`, and `kube-system` namespaces +{{% /tab %}} +{{% tab "RKE2" %}} + +### 1. Create your cloud credentials + +1. Click **☰ > Cluster Management**. +1. Click **Cloud Credentials**. +1. Click **Create**. +1. Click **Azure**. +1. Enter your Azure credentials. +1. Click **Create**. + +**Result:** You have created the cloud credentials that will be used to provision nodes in your cluster. You can reuse these credentials for other node templates, or in other clusters. + +### 2. Create your cluster + +Use Rancher to create a Kubernetes cluster in Azure. + +1. Click **☰ > Cluster Management**. +1. On the **Clusters** page, click **Create**. +1. Click **Azure**. +1. Enter a **Cluster Name**. +1. Create a machine pool for each Kubernetes role. Refer to the [best practices]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools#node-roles-in-rke2) for recommendations on role assignments and counts. + 1. For each machine pool, define the machine configuration. Refer to the [Azure machine configuration reference]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/azure-machine-config/) for information on configuration options. +1. Use the **Cluster Configuration** to choose the version of Kubernetes that will be installed, what network provider will be used and if you want to enable project network isolation. For help configuring the cluster, refer to the [RKE2 cluster configuration reference.]({{}}/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/) +1. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user. +1. Click **Create**. + +{{% /tab %}} +{{% tab "RKE2 - Cluster Template" %}} + +### 1. Create your cloud credentials + +1. Click **☰ > Cluster Management**. +1. Click **Cloud Credentials**. +1. Click **Create**. +1. Click **Azure**. +1. Enter your Azure credentials. +1. Click **Create**. + +### 2. Add your cluster template + +1. Follow these [instructions]({{}}/rancher/v2.6/en/admin-settings/cluster-templates/#adding-a-cluster-template-to-rancher) to add a cluster template to Rancher. + +### 3. Create your cluster using a cluster template + +1. Click **☰ > Cluster Management**. +1. Under the **Use a Catalog Template to create a cluster** section, click **catalog-template**. +1. Enter a name for the cluster. +1. Select cloud credentials to use. +1. Select the **Infrastructure Provider**. If you are using Rancher's [example cluster templates](https://github.com/rancher/cluster-template-examples), select `azure`. +1. Choose a **Kubernetes Version**. +1. Configure your nodepools. For help with configurations, refer to [Azure Node Template Configuration.](./azure-node-template-config) +1. Click **Install**. + +{{% /tabs %}} + +**Result:** + +Your cluster is created and assigned a state of **Provisioning**. Rancher is standing up your cluster. + +You can access your cluster after its state is updated to **Active**. + +**Active** clusters are assigned two Projects: + +- `Default`, containing the `default` namespace +- `System`, containing the `cattle-system`, `ingress-nginx`, `kube-public`, and `kube-system` namespaces + + ### Optional Next Steps After creating your cluster, you can access it through the Rancher UI. As a best practice, we recommend setting up these alternate ways of accessing your cluster: diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/azure-machine-config/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/azure-machine-config/_index.md new file mode 100644 index 00000000000..400ad6a9e6d --- /dev/null +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/azure-machine-config/_index.md @@ -0,0 +1,109 @@ +--- +title: Azure Machine Configuration +weight: 2 +--- + +For more information about Azure, refer to the official [Azure documentation.](https://docs.microsoft.com/en-us/azure/?product=featured) + +### Environment + +Microsoft provides multiple [clouds](https://docs.microsoft.com/en-us/cli/azure/cloud?view=azure-cli-latest) for compliance with regional laws, which are available for your use: + +- AzurePublicCloud +- AzureGermanCloud +- AzureChinaCloud +- AzureUSGovernmentCloud + +### Location + +Configure the cluster and node [location](https://docs.microsoft.com/en-us/azure/virtual-machines/regions). + +### Resource Group + +A resource group is a container that holds related resources for an Azure solution. The resource group can include all the resources for the solution, or only those resources that you want to manage as a group. You decide how you want to allocate resources to resource groups based on what makes the most sense for your organization. Generally, add resources that share the same lifecycle to the same resource group so you can easily deploy, update, and delete them as a group. + +Use an existing resource group or enter a resource group name and one will be created for you. + +For information on managing resource groups, see the [Azure documentation.](https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/manage-resource-groups-portal) + +### Availability Set (unmanaged) + +Name or ID of an existing [availability set](https://docs.microsoft.com/en-us/azure/virtual-machines/availability-set-overview) to add the VM to. + +### Image + +The name of the operating system image provided as an ARM resource identifier. Requires using managed disk. + +### VM Size + +Choose a size for each VM in the node pool. For details about each VM size, see [this page.](https://azure.microsoft.com/en-us/pricing/details/virtual-machines/linux/) + +## Advanced Options + +### Fault Domain Count + +Fault domains define the group of virtual machines that share a common power source and network switch. If the availability set has already been created, the fault domain count will be ignored. + +For more information on fault domains, see [refer here](https://docs.microsoft.com/en-us/azure/virtual-machines/availability-set-overview#how-do-availability-sets-work). + +### Update Domain Count + +Update domains indicate groups of virtual machines and underlying physical hardware that can be rebooted at the same time. If the availability set has already been created, the update domain count will be ignored. + +For more information on update domains, see [refer here](https://docs.microsoft.com/en-us/azure/virtual-machines/availability-set-overview#how-do-availability-sets-work). + +### Purchase Plan (LabeledInput) + +Some VM images in the Azure Marketplace require a plan. If applicable, select a purchase plan, formatted as `publisher:product:plan`, to use with your chosen image. + +### Subnet (LabeledInput) + +The name of the subnet when creating a new VNet or referencing an existing one. + +Default: `docker-machine` + +### Subnet Prefix (LabeledInput) + +The subnet IP address prefix to use when creating a new VNet in CIDR format. + +Default: `192.168.0.0/16` + +### Virtual Network (LabeledInput) + placeholder: [resourcegroup:]name + +### Public IP Options (Checkbox) + No Public IP Static Public IP + +### Use Private IP + +Use a static private IP address. + +### Private IP Address + +Configure a static private IP address to use. + +### Network Security Group (LabeledInput) + help: When using a Rancher managed or providing an existing NSG, all nodes using this template will use the supplied NSG. If no NSG is provided, a new NSG will be created for each node. + +### DNS Label (LabeledInput) + help: A unique DNS label for the public IP address. + +### Storage Type* (LabeledSelect) + +### Use Managed Disks (Checkbox) + +[Azure managed disks](https://docs.microsoft.com/en-us/azure/virtual-machines/managed-disks-overview) are block-level storage volumes that are managed by Azure and used with Azure Virtual Machines. Managed disks are designed for 99.999% availability. Managed disks achieve this by providing you with three replicas of your data, allowing for high durability. + +### Managed Disk Size (LabeledInput) + +The size in GB for the disk for each node. + +### SSH Username + +The username used to create an SSH connection to your nodes. + +### Open Port + +Opens inbound traffic on specified ports. When using an existing Network Security Group, Open Ports are ignored. + +Default: `2379/tcp, 2380/tcp, 6443/tcp, 9796/tcp, 10250/tcp, 10251/tcp, 10252/tcp, 10256/tcp` and `8472/udp, 4789/udp` \ No newline at end of file From 5b23b7fae53bcd5d0716e6cfe5e3446a319e7b52 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 3 May 2022 11:30:59 -0400 Subject: [PATCH 425/478] Updating per feedback --- .../rancher/v2.6/en/neuvector-integration/_index.md | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/content/rancher/v2.6/en/neuvector-integration/_index.md b/content/rancher/v2.6/en/neuvector-integration/_index.md index 49a79259a09..c5705871a5f 100644 --- a/content/rancher/v2.6/en/neuvector-integration/_index.md +++ b/content/rancher/v2.6/en/neuvector-integration/_index.md @@ -18,14 +18,17 @@ The Harvester Helm Chart is used to manage access to the NeuVector UI in Rancher 1. Click **☰ > Cluster Management**. 1. On the Clusters page, go to the cluster where you want to deploy NeuVector, and click **Explore**. 1. Go to **Apps & Marketplace > Charts**, and install **NeuVector** from the chart repo. -1. Different cluster types require different container runtimes. When configuring Helm chart values, go to the **Container Runtime** section, and select your runtime in accordance with the cluster type: +1. Different cluster types require different container runtimes. When configuring Helm chart values, go to the **Container Runtime** section, and select your runtime in accordance with the cluster type. Finally, click **Install** again. - - RKE1: Select `docker` - - K3s and RKE2: Select `k3scontainerd` - - AKS: Select `containerd`
      +Some examples are as follows: + + - RKE1: `docker` + - K3s and RKE2: `k3scontainerd` + - AKS: `containerd` for v1.19 and up + - EKS: `docker` for v1.22 and below; `containerd` for v1.23 and up + - GKE: `containerd` (see the [Google docs](https://cloud.google.com/kubernetes-engine/docs/concepts/using-containerd) for more) >**Note:** Only one container runtime engine may be selected at a time during installation. -1. Click **Install** again. **To navigate to and install the NeuVector chart through Cluster Tools:** From a2f8cbf4763d07abb267d049ece60927ebca4dd7 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Tue, 3 May 2022 15:08:44 -0700 Subject: [PATCH 426/478] Update content/rke/latest/en/os/_index.md Co-authored-by: Jen Travinski --- content/rke/latest/en/os/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rke/latest/en/os/_index.md b/content/rke/latest/en/os/_index.md index f41f8cc7ece..16d05b3b9c6 100644 --- a/content/rke/latest/en/os/_index.md +++ b/content/rke/latest/en/os/_index.md @@ -155,7 +155,7 @@ If using Red Hat Enterprise Linux, Oracle Linux or CentOS, you cannot use the `r reboot ``` > -> In addition, the default firewall settings of RHEL 8.4 prevents RKE1 pods from reaching out to Rancher to connect to the cluster agent. To allow Docker containers to reach out to the internet and connect to Rancher, make the following updates to the firewall settings: +> In addition, the default firewall settings of RHEL 8.4 prevent RKE1 pods from reaching out to Rancher to connect to the cluster agent. To allow Docker containers to reach out to the internet and connect to Rancher, make the following updates to the firewall settings: > ``` firewall-cmd --zone=public --add-masquerade --permanent firewall-cmd --reload From 0199887ef3f7b0a2ac68aa47dfd5b1b7b45ece62 Mon Sep 17 00:00:00 2001 From: Brad Davidson Date: Wed, 4 May 2022 11:18:10 -0700 Subject: [PATCH 427/478] Update RKE2 HA tutorial for modern versions of RKE2 --- .../resources/k8s-tutorials/ha-rke2/_index.md | 83 ++++++++----------- 1 file changed, 34 insertions(+), 49 deletions(-) diff --git a/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-rke2/_index.md b/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-rke2/_index.md index f1a1c52bab1..da2ee82468f 100644 --- a/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-rke2/_index.md +++ b/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-rke2/_index.md @@ -128,55 +128,40 @@ Now that you have set up the `kubeconfig` file, you can use `kubectl` to access Check that all the required pods and containers are healthy are ready to continue: ``` - /var/lib/rancher/rke2/bin/kubectl --kubeconfig /etc/rancher/rke2/rke2.yaml get pods -A -NAMESPACE NAME READY STATUS RESTARTS AGE -kube-system etcd-ip-172-31-18-145 1/1 Running 0 4m37s -kube-system etcd-ip-172-31-25-73 1/1 Running 0 20m -kube-system etcd-ip-172-31-31-210 1/1 Running 0 9m12s -kube-system helm-install-rke2-canal-th9k9 0/1 Completed 0 21m -kube-system helm-install-rke2-coredns-6njr6 0/1 Completed 0 21m -kube-system helm-install-rke2-ingress-nginx-vztsd 0/1 Completed 0 21m -kube-system helm-install-rke2-kube-proxy-6std5 0/1 Completed 0 21m -kube-system helm-install-rke2-metrics-server-9sl7m 0/1 Completed 0 21m -kube-system kube-apiserver-ip-172-31-18-145 1/1 Running 0 4m22s -kube-system kube-apiserver-ip-172-31-25-73 1/1 Running 0 20m -kube-system kube-apiserver-ip-172-31-31-210 1/1 Running 0 9m8s -kube-system kube-controller-manager-ip-172-31-18-145 1/1 Running 0 4m8s -kube-system kube-controller-manager-ip-172-31-25-73 1/1 Running 0 21m -kube-system kube-controller-manager-ip-172-31-31-210 1/1 Running 0 8m55s -kube-system kube-proxy-57twm 1/1 Running 0 10m -kube-system kube-proxy-f7pc6 1/1 Running 0 5m24s -kube-system kube-proxy-rj4t5 1/1 Running 0 21m -kube-system kube-scheduler-ip-172-31-18-145 1/1 Running 0 4m15s -kube-system kube-scheduler-ip-172-31-25-73 1/1 Running 0 21m -kube-system kube-scheduler-ip-172-31-31-210 1/1 Running 0 8m48s -kube-system rke2-canal-4x972 2/2 Running 0 10m -kube-system rke2-canal-flh8m 2/2 Running 0 5m24s -kube-system rke2-canal-zfhkr 2/2 Running 0 21m -kube-system rke2-coredns-rke2-coredns-6cd96645d6-cmstq 1/1 Running 0 21m -kube-system rke2-ingress-nginx-controller-54946dd48f-6mp76 1/1 Running 0 20m -kube-system rke2-ingress-nginx-default-backend-5795954f8-p92xx 1/1 Running 0 20m -kube-system rke2-metrics-server-5f9b5757dc-k5sgh 1/1 Running 0 20m +/var/lib/rancher/rke2/bin/kubectl --kubeconfig /etc/rancher/rke2/rke2.yaml get pods -A +NAMESPACE NAME READY STATUS RESTARTS AGE +kube-system cloud-controller-manager-rke2-server-1 1/1 Running 0 2m28s +kube-system cloud-controller-manager-rke2-server-2 1/1 Running 0 61s +kube-system cloud-controller-manager-rke2-server-3 1/1 Running 0 49s +kube-system etcd-rke2-server-1 1/1 Running 0 2m13s +kube-system etcd-rke2-server-2 1/1 Running 0 87s +kube-system etcd-rke2-server-3 1/1 Running 0 56s +kube-system helm-install-rke2-canal-hs6sx 0/1 Completed 0 2m17s +kube-system helm-install-rke2-coredns-xmzm8 0/1 Completed 0 2m17s +kube-system helm-install-rke2-ingress-nginx-flwnl 0/1 Completed 0 2m17s +kube-system helm-install-rke2-metrics-server-7sggn 0/1 Completed 0 2m17s +kube-system kube-apiserver-rke2-server-1 1/1 Running 0 116s +kube-system kube-apiserver-rke2-server-2 1/1 Running 0 66s +kube-system kube-apiserver-rke2-server-3 1/1 Running 0 48s +kube-system kube-controller-manager-rke2-server-1 1/1 Running 0 2m30s +kube-system kube-controller-manager-rke2-server-2 1/1 Running 0 57s +kube-system kube-controller-manager-rke2-server-3 1/1 Running 0 42s +kube-system kube-proxy-rke2-server-1 1/1 Running 0 2m25s +kube-system kube-proxy-rke2-server-2 1/1 Running 0 59s +kube-system kube-proxy-rke2-server-3 1/1 Running 0 85s +kube-system kube-scheduler-rke2-server-1 1/1 Running 0 2m30s +kube-system kube-scheduler-rke2-server-2 1/1 Running 0 57s +kube-system kube-scheduler-rke2-server-3 1/1 Running 0 42s +kube-system rke2-canal-b9lvm 2/2 Running 0 91s +kube-system rke2-canal-khwp2 2/2 Running 0 2m5s +kube-system rke2-canal-swfmq 2/2 Running 0 105s +kube-system rke2-coredns-rke2-coredns-547d5499cb-6tvwb 1/1 Running 0 92s +kube-system rke2-coredns-rke2-coredns-547d5499cb-rdttj 1/1 Running 0 2m8s +kube-system rke2-coredns-rke2-coredns-autoscaler-65c9bb465d-85sq5 1/1 Running 0 2m8s +kube-system rke2-ingress-nginx-controller-69qxc 1/1 Running 0 52s +kube-system rke2-ingress-nginx-controller-7hprp 1/1 Running 0 52s +kube-system rke2-ingress-nginx-controller-x658h 1/1 Running 0 52s +kube-system rke2-metrics-server-6564db4569-vdfkn 1/1 Running 0 66s ``` **Result:** You have confirmed that you can access the cluster with `kubectl` and the RKE2 cluster is running successfully. Now the Rancher management server can be installed on the cluster. - -### 5. Configure nginx to be a daemonset - -Currently, RKE2 deploys nginx-ingress as a deployment, and that can impact the Rancher deployment so that you cannot use all servers to proxy requests to the Rancher pods. - -To rectify that, place the following file in /var/lib/rancher/rke2/server/manifests on any of the server nodes: - -```yaml -apiVersion: helm.cattle.io/v1 -kind: HelmChartConfig -metadata: - name: rke2-ingress-nginx - namespace: kube-system -spec: - valuesContent: |- - controller: - kind: DaemonSet - daemonset: - useHostPort: true -``` From 5a00fe35df60522210c986c73263ac9029a9d95a Mon Sep 17 00:00:00 2001 From: Brad Davidson Date: Wed, 4 May 2022 11:21:26 -0700 Subject: [PATCH 428/478] Update _index.md --- .../en/installation/resources/k8s-tutorials/ha-rke2/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-rke2/_index.md b/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-rke2/_index.md index da2ee82468f..f69c494b175 100644 --- a/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-rke2/_index.md +++ b/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-rke2/_index.md @@ -89,7 +89,7 @@ To use this `kubeconfig` file, 1. Install [kubectl,](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) a Kubernetes command-line tool. 2. Copy the file at `/etc/rancher/rke2/rke2.yaml` and save it to the directory `~/.kube/config` on your local machine. -3. In the kubeconfig file, the `server` directive is defined as localhost. Configure the server as the DNS of your load balancer, referring to port 6443. (The Kubernetes API server will be reached at port 6443, while the Rancher server will be reached at ports 80 and 443.) Here is an example `rke2.yaml`: +3. In the kubeconfig file, the `server` directive is defined as localhost. Configure the server as the DNS of your control-plane load balancer, on port 6443. (The RKE2 Kubernetes API Server uses port 6443, while the Rancher server will be served via the NGINX Ingress on ports 80 and 443.) Here is an example `rke2.yaml`: ```yml apiVersion: v1 From fb98abdde401636191ef9999cd866f7e0598e93e Mon Sep 17 00:00:00 2001 From: Daniel Cerejo Date: Wed, 4 May 2022 23:15:19 +0100 Subject: [PATCH 429/478] Update _index.md correct Example docker push mycustomreg:5000 should be mycustomreg.com:5000 --- content/k3s/latest/en/installation/private-registry/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/k3s/latest/en/installation/private-registry/_index.md b/content/k3s/latest/en/installation/private-registry/_index.md index 1abbc473cd1..523ae6c8586 100644 --- a/content/k3s/latest/en/installation/private-registry/_index.md +++ b/content/k3s/latest/en/installation/private-registry/_index.md @@ -163,4 +163,4 @@ Example: `docker tag coredns-coredns:1.6.3 mycustomreg:5000/coredns-coredns` Last, push the images to the private registry. -Example: `docker push mycustomreg:5000/coredns-coredns` +Example: `docker push mycustomreg.com:5000/coredns-coredns` From b93e7d65a3886b201adfa319d8f8cad34a2f3e9c Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Thu, 5 May 2022 09:52:45 -0400 Subject: [PATCH 430/478] Adding limitations per feedback --- .../v2.6/en/neuvector-integration/_index.md | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/neuvector-integration/_index.md b/content/rancher/v2.6/en/neuvector-integration/_index.md index c5705871a5f..a829c3d5b6b 100644 --- a/content/rancher/v2.6/en/neuvector-integration/_index.md +++ b/content/rancher/v2.6/en/neuvector-integration/_index.md @@ -95,10 +95,22 @@ Below are the minimum recommended computing resources for the NeuVector chart in \* Minimum 1GB of memory total required for Controller, Manager, and Scanner containers combined. -### Limitations + +### Support Limitations + +* Only admins and cluster owners are currently supported. + +* Fleet multi-cluster deployment is not supported. + +* NeuVector is not supported on a Windows cluster. + +* Airgap is not supported. + +### Other Limitations * Currently, NeuVector feature chart installation fails when a NeuVector partner chart already exists. To work around this issue, uninstall the NeuVector partner chart and reinstall the NeuVector feature chart. * Users cannot access the NeuVector UI from Rancher for a custom RKE1 cluster. To work around this, restart the controllers; note that while the controller pods are restarting, it will take additional time for the controller pods to become active. -* Container runtime is not auto-detected for different cluster types when installing the NeuVector chart. \ No newline at end of file +* Container runtime is not auto-detected for different cluster types when installing the NeuVector chart. + From 22c7b8f9fa38753e2fed1b52c06b299f59d6b8ba Mon Sep 17 00:00:00 2001 From: Nuno do Carmo Date: Thu, 5 May 2022 16:28:00 +0200 Subject: [PATCH 431/478] Cluster Provisioning: added RKE2 section Fixes #3752 Split the Cluster Provisioning between RKE and RKE2 documentation. To keep a "reading standardization", both sections have the same sub-topics. Once the structure is agreed, RKE2 content needs to be updated. --- .../rke-clusters/_index.md | 58 +++++++++++-------- 1 file changed, 35 insertions(+), 23 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md index 0b5c79028c5..e8caef08713 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md @@ -3,7 +3,7 @@ title: Launching Kubernetes with Rancher weight: 4 --- -You can have Rancher launch a Kubernetes cluster using any nodes you want. When Rancher deploys Kubernetes onto these nodes, it uses [Rancher Kubernetes Engine]({{}}/rke/latest/en/) (RKE), which is Rancher's own lightweight Kubernetes installer. It can launch Kubernetes on any computers, including: +You can have Rancher launch a Kubernetes cluster using any nodes you want. When Rancher deploys Kubernetes onto these nodes, you can choose between [Rancher Kubernetes Engine]({{}}/rke/latest/en/) (RKE), which is Rancher's own lightweight Kubernetes installer, or [RKE2](https://docs.rke2.io). It can launch Kubernetes on any computers, including: - Bare-metal servers - On-premise virtual machines @@ -11,29 +11,9 @@ You can have Rancher launch a Kubernetes cluster using any nodes you want. When Rancher can install Kubernetes on existing nodes, or it can dynamically provision nodes in an infrastructure provider and install Kubernetes on them. -RKE clusters include clusters that Rancher launched on Windows nodes or other existing custom nodes, as well as clusters that Rancher launched with new nodes on Azure, Digital Ocean, EC2, or vSphere. +RKE/RKE2 clusters include clusters that Rancher launched on Windows nodes or other existing custom nodes, as well as clusters that Rancher launched with new nodes on Azure, Digital Ocean, EC2, or vSphere. -### Changes in Rancher v2.6 - -_Tech Preview_ - -Rancher v2.6 introduces provisioning for [RKE2](https://docs.rke2.io/) clusters directly from the Rancher UI. RKE2, also known as RKE Government, is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector. - -RKE2 provisioning is built on top of a new provisioning framework that leverages the upstream [Cluster API](https://github.com/kubernetes-sigs/cluster-api) project. With this new provisioning framework, you can: - -- Provision RKE2 clusters on Digital Ocean, AWS EC2, Azure, and vSphere -- Fully configure RKE2 clusters within Rancher -- Choose CNI options Calico, Cilium, and Multus in addition to Canal -- Install custom RKE2 clusters on pre-provisioned VMs or bare-metal nodes - -The RKE2 provisioning tech preview also includes installing RKE2 on Windows clusters. Windows features for RKE2 include: - -- Windows Containers with RKE2 powered by containerd -- Added provisioning of Windows RKE2 custom clusters directly from the Rancher UI -- Calico CNI for Windows RKE2 custom clusters. -- SAC releases of Windows Server (2004 and 20H2) are included in the technical preview. - -Windows Support for RKE2 Custom Clusters requires choosing Calico as the CNI. +## RKE ### Requirements @@ -58,3 +38,35 @@ For more information, refer to the section on [custom nodes.]({{}}/ranc # Programmatically Creating RKE Clusters The most common way to programmatically deploy RKE clusters through Rancher is by using the Rancher2 Terraform provider. The documentation for creating clusters with Terraform is [here.](https://registry.terraform.io/providers/rancher/rancher2/latest/docs/resources/cluster) + +## RKE2 + +Rancher v2.6 introduces provisioning for [RKE2](https://docs.rke2.io/) clusters directly from the Rancher UI. RKE2, also known as RKE Government, is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector. + +### Requirements + +If you use RKE to set up a cluster, your nodes must meet the [requirements](https://docs.rke2.io/install/requirements/) for nodes in downstream user clusters. + +### Launching Kubernetes on New Nodes in an Infrastructure Provider + +RKE2 provisioning is built on top of a new provisioning framework that leverages the upstream [Cluster API](https://github.com/kubernetes-sigs/cluster-api) project. With this new provisioning framework, you can: + +- Provision RKE2 clusters on Digital Ocean, AWS EC2, Azure, and vSphere +- Fully configure RKE2 clusters within Rancher +- Choose CNI options Calico, Cilium, and Multus in addition to Canal +- Install custom RKE2 clusters on pre-provisioned VMs or bare-metal nodes + +The RKE2 provisioning also includes installing RKE2 on Windows clusters. Windows features for RKE2 include: + +- Windows Containers with RKE2 powered by ContainerD +- Added provisioning of Windows RKE2 custom clusters directly from the Rancher UI +- Calico CNI for Windows RKE2 custom clusters. +- SAC releases of Windows Server (2004 and 20H2) are included in the technical preview. + +Windows Support for RKE2 Custom Clusters requires choosing Calico as the CNI. + +### Launching Kubernetes on Existing Custom Nodes + +If you want to reuse a node from a previous custom cluster, [clean the node]({{}}/rancher/v2.6/en/cluster-admin/cleaning-cluster-nodes/) before using it in a cluster again. If you reuse a node that hasn't been cleaned, cluster provisioning may fail. + +For more information, refer to the section on [custom nodes.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/custom-nodes/) \ No newline at end of file From 4cdbea889198f4f51ba08df08e42328ef1557a8c Mon Sep 17 00:00:00 2001 From: Nuno do Carmo Date: Fri, 6 May 2022 09:36:34 +0200 Subject: [PATCH 432/478] Applied suggestion Co-authored-by: Billy Tat --- .../rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md index e8caef08713..108c17cd55f 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md @@ -45,7 +45,7 @@ Rancher v2.6 introduces provisioning for [RKE2](https://docs.rke2.io/) clusters ### Requirements -If you use RKE to set up a cluster, your nodes must meet the [requirements](https://docs.rke2.io/install/requirements/) for nodes in downstream user clusters. +If you use RKE2 to set up a cluster, your nodes must meet the [requirements](https://docs.rke2.io/install/requirements/) for nodes in downstream user clusters. ### Launching Kubernetes on New Nodes in an Infrastructure Provider From e9c26b1a1b0d649c0111301dd60e1588bafcd108 Mon Sep 17 00:00:00 2001 From: Nuno do Carmo Date: Fri, 6 May 2022 16:06:18 +0200 Subject: [PATCH 433/478] Added "Programmatically Creating RKE2 Clusters" sub-section to RKE2 --- .../v2.6/en/cluster-provisioning/rke-clusters/_index.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md index 108c17cd55f..72064be3399 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md @@ -69,4 +69,8 @@ Windows Support for RKE2 Custom Clusters requires choosing Calico as the CNI. If you want to reuse a node from a previous custom cluster, [clean the node]({{}}/rancher/v2.6/en/cluster-admin/cleaning-cluster-nodes/) before using it in a cluster again. If you reuse a node that hasn't been cleaned, cluster provisioning may fail. -For more information, refer to the section on [custom nodes.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/custom-nodes/) \ No newline at end of file +For more information, refer to the section on [custom nodes.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/custom-nodes/) + +# Programmatically Creating RKE2 Clusters + +The most common way to programmatically deploy RKE2 clusters through Rancher is by using the Rancher2 Terraform provider. The documentation for creating clusters with Terraform is [here.](https://registry.terraform.io/providers/rancher/rancher2/latest/docs/resources/cluster_v2) \ No newline at end of file From fe38a1fd3c5833942b0336d7896e10e74a30e87f Mon Sep 17 00:00:00 2001 From: Nuno do Carmo Date: Fri, 6 May 2022 16:07:50 +0200 Subject: [PATCH 434/478] Applied feedback from Jen --- .../v2.6/en/cluster-provisioning/rke-clusters/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md index 72064be3399..6a2e8f58ac6 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md @@ -60,8 +60,8 @@ The RKE2 provisioning also includes installing RKE2 on Windows clusters. Windows - Windows Containers with RKE2 powered by ContainerD - Added provisioning of Windows RKE2 custom clusters directly from the Rancher UI -- Calico CNI for Windows RKE2 custom clusters. -- SAC releases of Windows Server (2004 and 20H2) are included in the technical preview. +- Calico CNI for Windows RKE2 custom clusters +- SAC releases of Windows Server (2004 and 20H2) are included in the technical preview Windows Support for RKE2 Custom Clusters requires choosing Calico as the CNI. From b4fa08dbb5b546042bd2a71cd941c6cdb5ce2726 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 6 May 2022 15:40:07 -0400 Subject: [PATCH 435/478] Updated issues per Slack feedback --- content/rancher/v2.6/en/neuvector-integration/_index.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/content/rancher/v2.6/en/neuvector-integration/_index.md b/content/rancher/v2.6/en/neuvector-integration/_index.md index a829c3d5b6b..5082c3b844f 100644 --- a/content/rancher/v2.6/en/neuvector-integration/_index.md +++ b/content/rancher/v2.6/en/neuvector-integration/_index.md @@ -104,6 +104,10 @@ Below are the minimum recommended computing resources for the NeuVector chart in * NeuVector is not supported on a Windows cluster. +* Hardened cluster NeuVector installation is not supported. + +* SELinux clusters are not supported. + * Airgap is not supported. ### Other Limitations From cc241d97cef8e322da65c660517e196d3979cec5 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Sun, 8 May 2022 10:21:54 -0400 Subject: [PATCH 436/478] Updating page per feedback from QA --- content/rancher/v2.6/en/neuvector-integration/_index.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/rancher/v2.6/en/neuvector-integration/_index.md b/content/rancher/v2.6/en/neuvector-integration/_index.md index 5082c3b844f..2efefea8934 100644 --- a/content/rancher/v2.6/en/neuvector-integration/_index.md +++ b/content/rancher/v2.6/en/neuvector-integration/_index.md @@ -104,17 +104,17 @@ Below are the minimum recommended computing resources for the NeuVector chart in * NeuVector is not supported on a Windows cluster. -* Hardened cluster NeuVector installation is not supported. +* NeuVector installation is not supported on hardened clusters. -* SELinux clusters are not supported. +* NeuVector installation is not supported on SELinux clusters. -* Airgap is not supported. +* NeuVector installation is not supported on clusters in an air-gapped environment. ### Other Limitations * Currently, NeuVector feature chart installation fails when a NeuVector partner chart already exists. To work around this issue, uninstall the NeuVector partner chart and reinstall the NeuVector feature chart. -* Users cannot access the NeuVector UI from Rancher for a custom RKE1 cluster. To work around this, restart the controllers; note that while the controller pods are restarting, it will take additional time for the controller pods to become active. +* Sometimes when the controllers are not ready, the NeuVector UI is not accessible from the Rancher UI. During this time, controllers will try to restart, and it takes a few minutes for the controllers to be active. * Container runtime is not auto-detected for different cluster types when installing the NeuVector chart. From 7ee7ed7e479091860f0934468bfbcbf3f0c633dd Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Sun, 8 May 2022 10:26:11 -0400 Subject: [PATCH 437/478] Added workaround note --- content/rancher/v2.6/en/neuvector-integration/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/neuvector-integration/_index.md b/content/rancher/v2.6/en/neuvector-integration/_index.md index 2efefea8934..1c58d6e200a 100644 --- a/content/rancher/v2.6/en/neuvector-integration/_index.md +++ b/content/rancher/v2.6/en/neuvector-integration/_index.md @@ -116,5 +116,5 @@ Below are the minimum recommended computing resources for the NeuVector chart in * Sometimes when the controllers are not ready, the NeuVector UI is not accessible from the Rancher UI. During this time, controllers will try to restart, and it takes a few minutes for the controllers to be active. -* Container runtime is not auto-detected for different cluster types when installing the NeuVector chart. +* Container runtime is not auto-detected for different cluster types when installing the NeuVector chart. To work around this, you can specify the runtime manually. From 57d97ac23fba93520f6a0fae80ea1b53992e761b Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 9 May 2022 10:59:39 -0700 Subject: [PATCH 438/478] Fix placeholders --- .../azure/azure-machine-config/_index.md | 40 ++++++++++++------- 1 file changed, 26 insertions(+), 14 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/azure-machine-config/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/azure-machine-config/_index.md index 400ad6a9e6d..4c5304eb1e2 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/azure-machine-config/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/azure-machine-config/_index.md @@ -52,27 +52,35 @@ Update domains indicate groups of virtual machines and underlying physical hardw For more information on update domains, see [refer here](https://docs.microsoft.com/en-us/azure/virtual-machines/availability-set-overview#how-do-availability-sets-work). -### Purchase Plan (LabeledInput) +### Purchase Plan Some VM images in the Azure Marketplace require a plan. If applicable, select a purchase plan, formatted as `publisher:product:plan`, to use with your chosen image. -### Subnet (LabeledInput) +### Subnet The name of the subnet when creating a new VNet or referencing an existing one. Default: `docker-machine` -### Subnet Prefix (LabeledInput) +### Subnet Prefix The subnet IP address prefix to use when creating a new VNet in CIDR format. Default: `192.168.0.0/16` -### Virtual Network (LabeledInput) - placeholder: [resourcegroup:]name +### Virtual Network -### Public IP Options (Checkbox) - No Public IP Static Public IP +The [virtual network](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-overview) to use or create if one does not exist. Formatted as `[resourcegroup:]name`. + +### Public IP Options + +#### No Public IP + +Do not allocate a public IP address. + +#### Static Public IP + +Allocate a static public IP address. ### Use Private IP @@ -82,19 +90,23 @@ Use a static private IP address. Configure a static private IP address to use. -### Network Security Group (LabeledInput) - help: When using a Rancher managed or providing an existing NSG, all nodes using this template will use the supplied NSG. If no NSG is provided, a new NSG will be created for each node. +### Network Security Group -### DNS Label (LabeledInput) - help: A unique DNS label for the public IP address. +The [network security group](https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview) to use. All nodes using this template will use the supplied network security group. If no network security group is provided, a new one will be created for each node. -### Storage Type* (LabeledSelect) +### DNS Label -### Use Managed Disks (Checkbox) +A unique DNS name label for the public IP address. + +### Storage Type + +The [storage account](https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview) type to use with your VMs. Options include Standard LRS, Standard ZRS, Standard GRS, Standard RAGRS, and Premium LRS. + +### Use Managed Disks [Azure managed disks](https://docs.microsoft.com/en-us/azure/virtual-machines/managed-disks-overview) are block-level storage volumes that are managed by Azure and used with Azure Virtual Machines. Managed disks are designed for 99.999% availability. Managed disks achieve this by providing you with three replicas of your data, allowing for high durability. -### Managed Disk Size (LabeledInput) +### Managed Disk Size The size in GB for the disk for each node. From 940ba6e8a2bd3e888d796c9d287e7be6348c10b5 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 9 May 2022 13:09:31 -0700 Subject: [PATCH 439/478] Add missing step --- .../cluster-provisioning/rke-clusters/node-pools/azure/_index.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md index 92dba8f3be9..c1e07f396d9 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md @@ -115,6 +115,7 @@ Use Rancher to create a Kubernetes cluster in Azure. 1. Click **☰ > Cluster Management**. 1. On the **Clusters** page, click **Create**. +1. Toggle the switch to **RKE2/K3s**. 1. Click **Azure**. 1. Enter a **Cluster Name**. 1. Create a machine pool for each Kubernetes role. Refer to the [best practices]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools#node-roles-in-rke2) for recommendations on role assignments and counts. From c95004382fe6693e47efa8da2ddbe0e59c40e8e9 Mon Sep 17 00:00:00 2001 From: agrewel <88514485+agrewel@users.noreply.github.com> Date: Mon, 9 May 2022 14:13:27 -0700 Subject: [PATCH 440/478] Correct typo in cluster agent name --- .../v2.6/en/installation/resources/update-ca-cert/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md b/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md index 3c01e5f7eaf..057ca0f8c77 100644 --- a/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md +++ b/content/rancher/v2.6/en/installation/resources/update-ca-cert/_index.md @@ -133,7 +133,7 @@ Using a Kubeconfig for each downstream cluster update the environment variable f ``` $ kubectl edit -n cattle-system ds/cattle-node-agent -$ kubectl edit -n cattle-system deployment/cluster-agent +$ kubectl edit -n cattle-system deployment/cattle-cluster-agent ``` ### Method 3: Recreate Rancher agents From fa82ee66404660f4023947f4ed823bbc976aef05 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 9 May 2022 15:50:27 -0700 Subject: [PATCH 441/478] Remove duplicate content --- .../rke-clusters/node-pools/azure/_index.md | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md index c1e07f396d9..342c977a835 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md @@ -84,17 +84,6 @@ Use Rancher to create a Kubernetes cluster in Azure. 1. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user. 1. Click **Create**. -**Result:** - -Your cluster is created and assigned a state of **Provisioning**. Rancher is standing up your cluster. - -You can access your cluster after its state is updated to **Active**. - -**Active** clusters are assigned two Projects: - -- `Default`, containing the `default` namespace -- `System`, containing the `cattle-system`, `ingress-nginx`, `kube-public`, and `kube-system` namespaces - {{% /tab %}} {{% tab "RKE2" %}} From d4a62fec9a20986dd7f679d69bac236e4ef54e6b Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 9 May 2022 19:09:33 -0700 Subject: [PATCH 442/478] Update cert rotation for RKE2 --- .../certificate-rotation/_index.md | 46 ++++++++++++++++--- 1 file changed, 39 insertions(+), 7 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md b/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md index 664af10b1fc..c38a4dd0d5b 100644 --- a/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md @@ -9,6 +9,9 @@ By default, Kubernetes clusters require certificates and Rancher launched Kubern Certificates can be rotated for the following services: +{{% tabs %}} +{{% tab "RKE" %}} + - etcd - kubelet (node certificate) - kubelet (serving certificate, if [enabled]({{}}/rke/latest/en/config-options/services/#kubelet-options)) @@ -17,6 +20,24 @@ Certificates can be rotated for the following services: - kube-scheduler - kube-controller-manager +{{% /tab %}} +{{% tab "RKE2" %}} + +- admin +- api-server +- controller-manager +- scheduler +- rke2-controller +- rke2-server +- cloud-controller +- etcd +- auth-proxy +- kubelet +- kube-proxy + +{{% /tab %}} +{{% /tabs %}} + > **Note:** For users who didn't rotate their webhook certificates, and they have expired after one year, please see this [page]({{}}/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/) for help. @@ -24,17 +45,28 @@ Certificates can be rotated for the following services: Rancher launched Kubernetes clusters have the ability to rotate the auto-generated certificates through the UI. -1. In the **Global** view, navigate to the cluster that you want to rotate certificates. - -2. Select **⋮ > Rotate Certificates**. - -3. Select which certificates that you want to rotate. +1. In the upper left corner, click **☰ > Cluster Management**. +1. On the **Clusters** page, go to the cluster you want to rotate certificates for amd click **⋮ > Rotate Certificates**. +1. Select which certificates that you want to rotate. * Rotate all Service certificates (keep the same CA) * Rotate an individual service and choose one of the services from the drop-down menu -4. Click **Save**. +1. Click **Save**. **Results:** The selected certificates will be rotated and the related services will be restarted to start using the new certificate. -> **Note:** Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher launched Kubernetes clusters. +### Additional Notes + +{{% tabs %}} +{{% tab "RKE" %}} + +Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher launched Kubernetes clusters. + +{{% /tab %}} +{{% tab "RKE2" %}} + +In RKE2, both etcd and control plane nodes are treated as the same `server` concept. As such, when rotating certificates of services specific to either of these components will result in certificates being rotated on both. The certificates will only change for the specified service, but you will see nodes for both components go into an updating state. You may also see worker only nodes go into an updating state. This is to restart the workers after a certificate change to ensure they get the latest client certs. + +{{% /tab %}} +{{% /tabs %}} From 11e0db0309bc1459798a15b981760b1d936d158b Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Tue, 10 May 2022 09:00:00 -0700 Subject: [PATCH 443/478] Launch RKE2 + DigitalOcean --- .../node-pools/digital-ocean/_index.md | 66 +++++++++++++++++-- .../digital-ocean/do-machine-config/_index.md | 34 ++++++++++ 2 files changed, 96 insertions(+), 4 deletions(-) create mode 100644 content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/do-machine-config/_index.md diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/_index.md index 4c1903b9f63..9375a3106d1 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/_index.md @@ -5,10 +5,12 @@ weight: 2215 --- In this section, you'll learn how to use Rancher to install an [RKE](https://rancher.com/docs/rke/latest/en/) Kubernetes cluster in DigitalOcean. -First, you will set up your DigitalOcean cloud credentials in Rancher. Then you will use your cloud credentials to create a node template, which Rancher will use to provision new nodes in DigitalOcean. +First, you will set up your DigitalOcean cloud credentials in Rancher. Then you will use your cloud credentials to create a node template, which Rancher will use to provision new nodes in DigitalOcean. Then you will create a DigitalOcean cluster in Rancher, and when configuring the new cluster, you will define node pools for it. Each node pool will have a Kubernetes role of etcd, controlplane, or worker. Rancher will install RKE Kubernetes on the new nodes, and it will set up each node with the Kubernetes role defined by the node pool. +{{% tabs %}} +{{% tab "RKE" %}} 1. [Create your cloud credentials](#1-create-your-cloud-credentials) 2. [Create a node template with your cloud credentials](#2-create-a-node-template-with-your-cloud-credentials) @@ -23,7 +25,7 @@ Then you will create a DigitalOcean cluster in Rancher, and when configuring the 1. Enter your Digital Ocean credentials. 1. Click **Create**. -**Result:** You have created the cloud credentials that will be used to provision nodes in your cluster. You can reuse these credentials for other node templates, or in other clusters. +**Result:** You have created the cloud credentials that will be used to provision nodes in your cluster. You can reuse these credentials for other node templates, or in other clusters. ### 2. Create a node template with your cloud credentials @@ -46,13 +48,69 @@ Creating a [node template]({{}}/rancher/v2.6/en/cluster-provisioning/rk 1. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user. 1. Click **Create**. -**Result:** +{{% /tab %}} +{{% tab "RKE2" %}} + +### 1. Create your cloud credentials + +1. Click **☰ > Cluster Management**. +1. Click **Cloud Credentials**. +1. Click **Create**. +1. Click **DigitalOcean**. +1. Enter your Digital Ocean credentials. +1. Click **Create**. + +### 2. Create your cluster + +Use Rancher to create a Kubernetes cluster in DigitalOcean. + +1. Click **☰ > Cluster Management**. +1. On the **Clusters** page, click **Create**. +1. Toggle the switch to **RKE2/K3s**. +1. Click **DigitalOcean**. +1. Enter a **Cluster Name**. +1. Create a machine pool for each Kubernetes role. Refer to the [best practices]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools#node-roles-in-rke2) for recommendations on role assignments and counts. + 1. For each machine pool, define the machine configuration. Refer to the [DigitalOcean machine configuration reference]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/do-machine-config/) for information on configuration options. +1. Use the **Cluster Configuration** to choose the version of Kubernetes that will be installed, what network provider will be used and if you want to enable project network isolation. For help configuring the cluster, refer to the [RKE2 cluster configuration reference.]({{}}/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/) +1. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user. +1. Click **Create**. + +{{% /tab %}} +{{% tab "RKE2 - Cluster Template" %}} + +### 1. Create your cloud credentials + +1. Click **☰ > Cluster Management**. +1. Click **Cloud Credentials**. +1. Click **Create**. +1. Click **DigitalOcean**. +1. Enter your Digital Ocean credentials. +1. Click **Create**. + +### 2. Add your cluster template + +1. Follow these [instructions]({{}}/rancher/v2.6/en/admin-settings/cluster-templates/#adding-a-cluster-template-to-rancher) to add a cluster template to Rancher. + +### 3. Create your cluster using a cluster template + +1. Click **☰ > Cluster Management**. +1. Under the **Use a Catalog Template to create a cluster** section, click **catalog-template**. +1. Enter a name for the cluster. +1. Select cloud credentials to use. +1. Select the **Infrastructure Provider**. If you are using Rancher's [example cluster templates](https://github.com/rancher/cluster-template-examples), select `digitalocean`. +1. Choose a **Kubernetes Version**. +1. Configure your nodepools. For help with configurations, refer to the [DigitalOcean Node Template Configuration](./do-node-template-config). +1. Click **Install**. +{{% /tab %}} +{{% /tabs %}} + +**Result:** Your cluster is created and assigned a state of **Provisioning**. Rancher is standing up your cluster. You can access your cluster after its state is updated to **Active**. -**Active** clusters are assigned two Projects: +**Active** clusters are assigned two Projects: - `Default`, containing the `default` namespace - `System`, containing the `cattle-system`, `ingress-nginx`, `kube-public`, and `kube-system` namespaces diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/do-machine-config/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/do-machine-config/_index.md new file mode 100644 index 00000000000..0ae2f8d831a --- /dev/null +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/do-machine-config/_index.md @@ -0,0 +1,34 @@ +--- +title: DigitalOcean Machine Configuration +weight: 2 +--- + +For more details about DigitalOcean, Droplets, refer to the [official documentation](https://docs.digitalocean.com/products/compute/). + +### Region + +Configure the [region](https://docs.digitalocean.com/products/app-platform/concepts/region/) where Droplets are created. + +### Size + +Configure the [size](https://docs.digitalocean.com/products/droplets/resources/choose-plan/) of Droplets. + +### OS Image + +Configure the operating system [image](https://docs.digitalocean.com/products/images/) Droplets are created from. + +### Monitoring + +Enable the DigitalOcean agent for additional [monitoring](https://docs.digitalocean.com/products/monitoring/). + +### IPv6 + +Enable IPv6 for Droplets. + +### Private Networking + +Enable private networking for Droplets. + +### Droplet Tags + +Apply a tag (label) to a Droplet. Tags may only contain letters, numbers, colons, dashes, and underscores. For example, `my_server`. From 7ad845359691eea0dc1643d08e4f8079204c8022 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Tue, 10 May 2022 09:02:13 -0700 Subject: [PATCH 444/478] Launch RKE2 + EC2 --- .../rke-clusters/node-pools/ec2/_index.md | 74 ++++++++++++++++-- .../ec2/ec2-machine-config/_index.md | 78 +++++++++++++++++++ 2 files changed, 147 insertions(+), 5 deletions(-) create mode 100644 content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/ec2-machine-config/_index.md diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md index 4e50330f632..55d985b1a3a 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md @@ -6,7 +6,7 @@ weight: 2210 --- In this section, you'll learn how to use Rancher to install an [RKE](https://rancher.com/docs/rke/latest/en/) Kubernetes cluster in Amazon EC2. -First, you will set up your EC2 cloud credentials in Rancher. Then you will use your cloud credentials to create a node template, which Rancher will use to provision new nodes in EC2. +First, you will set up your EC2 cloud credentials in Rancher. Then you will use your cloud credentials to create a node template, which Rancher will use to provision new nodes in EC2. Then you will create an EC2 cluster in Rancher, and when configuring the new cluster, you will define node pools for it. Each node pool will have a Kubernetes role of etcd, controlplane, or worker. Rancher will install RKE Kubernetes on the new nodes, and it will set up each node with the Kubernetes role defined by the node pool. @@ -23,6 +23,9 @@ Then you will create an EC2 cluster in Rancher, and when configuring the new clu The steps to create a cluster differ based on your Rancher version. +{{% tabs %}} +{{% tab "RKE" %}} + 1. [Create your cloud credentials](#1-create-your-cloud-credentials) 2. [Create a node template with your cloud credentials and information from EC2](#2-create-a-node-template-with-your-cloud-credentials-and-information-from-ec2) 3. [Create a cluster with node pools using the node template](#3-create-a-cluster-with-node-pools-using-the-node-template) @@ -38,7 +41,7 @@ The steps to create a cluster differ based on your Rancher version. 1. Enter your AWS EC2 **Access Key** and **Secret Key**. 1. Click **Create**. -**Result:** You have created the cloud credentials that will be used to provision nodes in your cluster. You can reuse these credentials for other node templates, or in other clusters. +**Result:** You have created the cloud credentials that will be used to provision nodes in your cluster. You can reuse these credentials for other node templates, or in other clusters. ### 2. Create a node template with your cloud credentials and information from EC2 @@ -59,20 +62,81 @@ Add one or more node pools to your cluster. For more information about node pool 1. Click **☰ > Cluster Management**. 1. On the **Clusters** page, click **Create**. 1. Click **Amazon EC2**. -1. Create a node pool for each Kubernetes role. For each node pool, choose a node template that you created. For more information about node pools, including best practices for assigning Kubernetes roles to them, see [this section.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools) +1. Create a node pool for each Kubernetes role. For each node pool, choose a node template that you created. For more information about node pools, including best practices for assigning Kubernetes roles to them, see [this section.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools) 1. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user. 1. Use **Cluster Options** to choose the version of Kubernetes that will be installed, what network provider will be used and if you want to enable project network isolation. Refer to [Selecting Cloud Providers]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/cloud-providers/) to configure the Kubernetes Cloud Provider. For help configuring the cluster, refer to the [RKE cluster configuration reference.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/options) >**Note:** If you want to use the [dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/) feature, there are additional [requirements]({{}}/rke//latest/en/config-options/dual-stack#requirements) that must be taken into consideration. 1. Click **Create**. -**Result:** +{{% /tab %}} +{{% tab "RKE2" %}} + +### 1. Create your cloud credentials + +1. Click **☰ > Cluster Management**. +1. Click **Cloud Credentials**. +1. Click **Create**. +1. Click **Amazon**. +1. Enter a name for the cloud credential. +1. In the **Default Region** field, select the AWS region where your cluster nodes will be located. +1. Enter your AWS EC2 **Access Key** and **Secret Key**. +1. Click **Create**. + +**Result:** You have created the cloud credentials that will be used to provision nodes in your cluster. You can reuse these credentials for other node templates, or in other clusters. + +### 2. Create your cluster + +1. Click **☰ > Cluster Management**. +1. On the **Clusters** page, click **Create**. +1. Toggle the switch to **RKE2/K3s**. +1. Click **Amazon EC2**. +1. Enter a **Cluster Name**. +1. Create a machine pool for each Kubernetes role. Refer to the [best practices]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools#node-roles-in-rke2) for recommendations on role assignments and counts. + 1. For each machine pool, define the machine configuration. Refer to [the EC2 machine configuration reference]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/ec2-machine-config/) for information on configuration options. +1. Use the **Cluster Configuration** to choose the version of Kubernetes that will be installed, what network provider will be used and if you want to enable project network isolation. For help configuring the cluster, refer to the [RKE2 cluster configuration reference.]({{}}/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/) +1. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user. +1. Click **Create**. + +{{% /tab %}} +{{% tab "RKE2 - Cluster Template" %}} + +### 1. Create your cloud credentials + +1. Click **☰ > Cluster Management**. +1. Click **Cloud Credentials**. +1. Click **Create**. +1. Click **Amazon**. +1. Enter a name for the cloud credential. +1. In the **Default Region** field, select the AWS region where your cluster nodes will be located. +1. Enter your AWS EC2 **Access Key** and **Secret Key**. +1. Click **Create**. + +### 2. Add your cluster template + +1. Follow these [instructions]({{}}/rancher/v2.6/en/admin-settings/cluster-templates/#adding-a-cluster-template-to-rancher) to add a cluster template to Rancher. + +### 3. Create your cluster using a cluster template + +1. Click **☰ > Cluster Management**. +1. Under the **Use a Catalog Template to create a cluster** section, click **catalog-template**. +1. Enter a name for the cluster. +1. Select cloud credentials to use. +1. Select the **Infrastructure Provider**. If you are using Rancher's [example cluster templates](https://github.com/rancher/cluster-template-examples), select `amazonec2`. +1. Choose a **Kubernetes Version**. +1. Configure your nodepools. For help with configurations, refer to the [EC2 Node Template Configuration](./ec2-node-template-config). +1. Click **Install**. + +{{% /tab %}} +{{% /tabs %}} + +**Result:** Your cluster is created and assigned a state of **Provisioning**. Rancher is standing up your cluster. You can access your cluster after its state is updated to **Active**. -**Active** clusters are assigned two Projects: +**Active** clusters are assigned two Projects: - `Default`, containing the `default` namespace - `System`, containing the `cattle-system`, `ingress-nginx`, `kube-public`, and `kube-system` namespaces diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/ec2-machine-config/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/ec2-machine-config/_index.md new file mode 100644 index 00000000000..729406449b5 --- /dev/null +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/ec2-machine-config/_index.md @@ -0,0 +1,78 @@ +--- +title: EC2 Machine Configuration Reference +weight: 2 +--- + +For more details about EC2, nodes, refer to the official documentation for the [EC2 Management Console](https://aws.amazon.com/ec2). + +### Region + +The geographical [region](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html) in which to build your cluster. + +### Zone + +The [zone](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html#concepts-availability-zones), an isolated location within a region to build your cluster + +### Instance Type + +The [instance type](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html), which determines the hardware characteristics, used to provision your cluster. + +### Root Disk Size + +Configure the size (in GB) for your [root device](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/RootDeviceStorage.html). + +### VPC/Subnet + +The [VPC](https://docs.aws.amazon.com/vpc/latest/userguide/configure-your-vpc.html) or specific [subnet](https://docs.aws.amazon.com/vpc/latest/userguide/configure-subnets.html), an IP range in your VPC, to your resources to. + +### IAM Instance Profile Name + +The name of the [instance profile] used to pass an IAM role to an EC2 instance. + +## Advanced Options + +### AMI ID + +The [Amazon Machine Image](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html) used to provision your cluster. + +### SSH Username for AMI + +The username for connecting to your launched instances. Refer to [here](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connection-prereqs.html) for the default usernames to selected AMIs. For AMIs not listed, check with the AMI provider. + +### Security Group + +Choose the default security group or configure a security group. + +Please refer to [Amazon EC2 security group when using Node Driver]({{}}/rancher/v2.6/en/installation/requirements/ports/#rancher-aws-ec2-security-group) to see what rules are created in the `rancher-nodes` Security Group. + +### EBS Root Volume Type + +The [EBS volume type](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volume-types.html) to use for the root device. + +### Encrypt EBS Volume + +Enable [Amazon EBS Encryption](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html). + +### Request Spot Instance + +Enable option to [request spot instances](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-requests.html) and specify the maximum instance price per hour you're willing to pay. + +### Use only private address + +Enable option on use only [private addresses](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html). + +### EBS-Optimized Instance + +Use an [EBS-optimized instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-optimized.html). + +### Allow access to EC2 metadata + +Enable access to [EC2 metadata](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html). + +### Use tokens for metadata + +Use [Instance Metadata Service Version 2 (IMDSv2)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html), a token-based method to access metadata. + +### Add Tag + +Add metadata using [tags](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html) to categorize resources. From d80995fd00bbd6ed357f91d6575bf46b25ab2d96 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Tue, 10 May 2022 09:33:57 -0700 Subject: [PATCH 445/478] Remove extra space --- .../cluster-provisioning/rke-clusters/node-pools/ec2/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md index 55d985b1a3a..91a1343c46d 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md @@ -94,7 +94,7 @@ Add one or more node pools to your cluster. For more information about node pool 1. Enter a **Cluster Name**. 1. Create a machine pool for each Kubernetes role. Refer to the [best practices]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools#node-roles-in-rke2) for recommendations on role assignments and counts. 1. For each machine pool, define the machine configuration. Refer to [the EC2 machine configuration reference]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/ec2-machine-config/) for information on configuration options. -1. Use the **Cluster Configuration** to choose the version of Kubernetes that will be installed, what network provider will be used and if you want to enable project network isolation. For help configuring the cluster, refer to the [RKE2 cluster configuration reference.]({{}}/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/) +1. Use the **Cluster Configuration** to choose the version of Kubernetes that will be installed, what network provider will be used and if you want to enable project network isolation. For help configuring the cluster, refer to the [RKE2 cluster configuration reference.]({{}}/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/) 1. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user. 1. Click **Create**. From 4ad6b9c1f515b16dddc31499d72c41c4b6a8c7aa Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Tue, 10 May 2022 09:34:44 -0700 Subject: [PATCH 446/478] Remove extra space --- .../rke-clusters/node-pools/digital-ocean/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/_index.md index 9375a3106d1..06644803c43 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/_index.md @@ -71,7 +71,7 @@ Use Rancher to create a Kubernetes cluster in DigitalOcean. 1. Enter a **Cluster Name**. 1. Create a machine pool for each Kubernetes role. Refer to the [best practices]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools#node-roles-in-rke2) for recommendations on role assignments and counts. 1. For each machine pool, define the machine configuration. Refer to the [DigitalOcean machine configuration reference]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/do-machine-config/) for information on configuration options. -1. Use the **Cluster Configuration** to choose the version of Kubernetes that will be installed, what network provider will be used and if you want to enable project network isolation. For help configuring the cluster, refer to the [RKE2 cluster configuration reference.]({{}}/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/) +1. Use the **Cluster Configuration** to choose the version of Kubernetes that will be installed, what network provider will be used and if you want to enable project network isolation. For help configuring the cluster, refer to the [RKE2 cluster configuration reference.]({{}}/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/) 1. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user. 1. Click **Create**. @@ -119,4 +119,4 @@ You can access your cluster after its state is updated to **Active**. After creating your cluster, you can access it through the Rancher UI. As a best practice, we recommend setting up these alternate ways of accessing your cluster: - **Access your cluster with the kubectl CLI:** Follow [these steps]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/kubectl/#accessing-clusters-with-kubectl-on-your-workstation) to access clusters with kubectl on your workstation. In this case, you will be authenticated through the Rancher server’s authentication proxy, then Rancher will connect you to the downstream cluster. This method lets you manage the cluster without the Rancher UI. -- **Access your cluster with the kubectl CLI, using the authorized cluster endpoint:** Follow [these steps]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) to access your cluster with kubectl directly, without authenticating through Rancher. We recommend setting up this alternative method to access your cluster so that in case you can’t connect to Rancher, you can still access the cluster. \ No newline at end of file +- **Access your cluster with the kubectl CLI, using the authorized cluster endpoint:** Follow [these steps]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) to access your cluster with kubectl directly, without authenticating through Rancher. We recommend setting up this alternative method to access your cluster so that in case you can’t connect to Rancher, you can still access the cluster. From f097d17c5bb694b22ece7fc352f47d64fa5ce5b4 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Tue, 10 May 2022 11:45:05 -0700 Subject: [PATCH 447/478] Add Prometheus Federator --- .../configuration/receiver/_index.md | 31 ++++++-- .../prometheus-federator/_index.md | 75 +++++++++++++++++++ .../guides/customizing-grafana/_index.md | 8 ++ .../guides/enable-prom-fed/_index.md | 62 +++++++++++++++ .../guides/prom-fed-workloads/_index.md | 18 +++++ .../guides/uninstall-prom-fed/_index.md | 14 ++++ .../prometheus-federator/rbac/_index.md | 29 +++++++ 7 files changed, 229 insertions(+), 8 deletions(-) create mode 100644 content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/_index.md create mode 100644 content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/guides/customizing-grafana/_index.md create mode 100644 content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/guides/enable-prom-fed/_index.md create mode 100644 content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/guides/prom-fed-workloads/_index.md create mode 100644 content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/guides/uninstall-prom-fed/_index.md create mode 100644 content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/rbac/_index.md diff --git a/content/rancher/v2.6/en/monitoring-alerting/configuration/receiver/_index.md b/content/rancher/v2.6/en/monitoring-alerting/configuration/receiver/_index.md index d1754f86d81..3a9daaeb6ce 100644 --- a/content/rancher/v2.6/en/monitoring-alerting/configuration/receiver/_index.md +++ b/content/rancher/v2.6/en/monitoring-alerting/configuration/receiver/_index.md @@ -24,7 +24,6 @@ The [Alertmanager Config](https://prometheus.io/docs/alerting/latest/configurati - [Trusted CA for Notifiers](#trusted-ca-for-notifiers) # Creating Receivers in the Rancher UI -_Available as of v2.5.4_ > **Prerequisites:** > @@ -33,11 +32,27 @@ _Available as of v2.5.4_ To create notification receivers in the Rancher UI, -1. Go to the cluster where you want to create receivers. Click **Monitoring** and click **Receiver**. +{{% tabs %}} +{{% tab "Rancher v2.6.5+" %}} + +1. Go to the cluster where you want to create receivers. Click **Monitoring -> Alerting -> AlertManagerConfigs**. +1. Ciick **Create**. +1. Click **Add Receiver**. +1. Enter a **Name** for the receiver. +1. Configure one or more providers for the receiver. For help filling out the forms, refer to the configuration options below. +1. Click **Create**. + +{{% /tab %}} +{{% tab "Rancher before v2.6.5" %}} + +1. Go to the cluster where you want to create receivers. Click **Monitoring** and click **Receiver**. 2. Enter a name for the receiver. 3. Configure one or more providers for the receiver. For help filling out the forms, refer to the configuration options below. 4. Click **Create**. +{{% /tab %}} +{{% /tabs %}} + **Result:** Alerts can be configured to send notifications to the receiver(s). # Receiver Configuration @@ -72,7 +87,7 @@ The custom receiver option can be used to configure any receiver in YAML that ca | Field | Type | Description | |------|--------------|------| | URL | String | Enter your Slack webhook URL. For instructions to create a Slack webhook, see the [Slack documentation.](https://get.slack.help/hc/en-us/articles/115005265063-Incoming-WebHooks-for-Slack) | -| Default Channel | String | Enter the name of the channel that you want to send alert notifications in the following format: `#`. | +| Default Channel | String | Enter the name of the channel that you want to send alert notifications in the following format: `#`. | | Proxy URL | String | Proxy for the webhook notifications. | | Enable Send Resolved Alerts | Bool | Whether to send a follow-up notification if an alert has been resolved (e.g. [Resolved] High CPU Usage). | @@ -81,7 +96,7 @@ The custom receiver option can be used to configure any receiver in YAML that ca | Field | Type | Description | |------|--------------|------| | Default Recipient Address | String | The email address that will receive notifications. | -| Enable Send Resolved Alerts | Bool | Whether to send a follow-up notification if an alert has been resolved (e.g. [Resolved] High CPU Usage). | +| Enable Send Resolved Alerts | Bool | Whether to send a follow-up notification if an alert has been resolved (e.g. [Resolved] High CPU Usage). | SMTP options: @@ -100,7 +115,7 @@ SMTP options: | Integration Type | String | `Events API v2` or `Prometheus`. | | Default Integration Key | String | For instructions to get an integration key, see the [PagerDuty documentation.](https://www.pagerduty.com/docs/guides/prometheus-integration-guide/) | | Proxy URL | String | Proxy for the PagerDuty notifications. | -| Enable Send Resolved Alerts | Bool | Whether to send a follow-up notification if an alert has been resolved (e.g. [Resolved] High CPU Usage). | +| Enable Send Resolved Alerts | Bool | Whether to send a follow-up notification if an alert has been resolved (e.g. [Resolved] High CPU Usage). | # Opsgenie @@ -172,7 +187,7 @@ The SMS receiver is not a native receiver and must be enabled before it can be u 1. In the upper left corner, click **☰ > Cluster Management**. 1. On the **Clusters** page, go to the cluster where you want to install `rancher-alerting-drivers` and click **Explore**. -1. In the left navigation bar, click +1. In the left navigation bar, click 1. Click the **Alerting Drivers** app. 1. Click the **Helm Deploy Options** tab 1. Select the **SMS** option and click **Install**. @@ -224,11 +239,11 @@ You can also set up multiple receivers by using the `continue` option for a rout To set up notifications via Slack, the following Alertmanager Config YAML can be placed into the `alertmanager.yaml` key of the Alertmanager Config Secret, where the `api_url` should be updated to use your Webhook URL from Slack: ```yaml -route: +route: group_by: ['job'] group_wait: 30s group_interval: 5m - repeat_interval: 3h + repeat_interval: 3h receiver: 'slack-notifications' receivers: - name: 'slack-notifications' diff --git a/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/_index.md b/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/_index.md new file mode 100644 index 00000000000..59d52d235b1 --- /dev/null +++ b/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/_index.md @@ -0,0 +1,75 @@ +--- +title: Prometheus Federator +weight: 7 +--- + +Prometheus Federator deploys a Helm Project Operator (based on the [rancher/helm-project-operator](https://github.com/rancher/helm-project-operator)), an operator that manages deploying Helm charts each containing a Project Monitoring Stack, where each stack contains: + +- [Prometheus](https://prometheus.io/) (managed externally by [Prometheus Operator](https://github.com/prometheus-operator/prometheus-operator)) +- [Alertmanager](https://prometheus.io/docs/alerting/latest/alertmanager/) (managed externally by [Prometheus Operator](https://github.com/prometheus-operator/prometheus-operator)) +- [Grafana](https://github.com/helm/charts/tree/master/stable/grafana) (deployed via an embedded Helm chart) +- Default PrometheusRules and Grafana dashboards based on the collection of community-curated resources from [kube-prometheus](https://github.com/prometheus-operator/kube-prometheus/) +- Default ServiceMonitors that watch the deployed resources + +> **Important** Prometheus Federator is designed to be deployed alongside an existing Prometheus Operator deployment in a cluster that has already installed the Prometheus Operator CRDs. + +## How does the operator work? + +1. On deploying this chart, users can create ProjectHelmCharts CRs with `spec.helmApiVersion` set to `monitoring.cattle.io/v1alpha1` (also known as "Project Monitors" in the Rancher UI) in a **Project Registration Namespace (`cattle-project-`)**. +2. On seeing each ProjectHelmChartCR, the operator will automatically deploy a Project Prometheus stack on the Project Owner's behalf in the **Project Release Namespace (`cattle-project--monitoring`)** based on a HelmChart CR and a HelmRelease CR automatically created by the ProjectHelmChart controller in the **Operator / System Namespace**. +3. RBAC will automatically be assigned in the Project Release Namespace to allow users to view the Prometheus, Alertmanager, and Grafana UIs of the Project Monitoring Stack deployed; this will be based on RBAC defined on the Project Registration Namespace against the [default Kubernetes user-facing roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles). For more information, see the section on [configuring RBAC](./rbac/). + +### What is a Project? + +In Prometheus Federator, a Project is a group of namespaces that can be identified by a `metav1.LabelSelector`. By default, the label used to identify projects is `field.cattle.io/projectId`, the label used to identify namespaces that are contained within a given [Rancher](https://rancher.com/) Project. + +### Configuring the Helm release created by a ProjectHelmChart + +The `spec.values` of this ProjectHelmChart resources will correspond to the `values.yaml` override to be supplied to the underlying Helm chart deployed by the operator on the user's behalf; to see the underlying chart's `values.yaml` spec, either: + +- View to the chart's definition located at [`rancher/prometheus-federator` under `charts/rancher-project-monitoring`](https://github.com/rancher/prometheus-federator/blob/main/charts/rancher-project-monitoring) (where the chart version will be tied to the version of this operator) +- Look for the ConfigMap named `monitoring.cattle.io.v1alpha1` that is automatically created in each Project Registration Namespace, which will contain both the `values.yaml` and `questions.yaml` that was used to configure the chart (which was embedded directly into the `prometheus-federator` binary). + +### Namespaces + +As a Project Operator based on [rancher/helm-project-operator](https://github.com/rancher/helm-project-operator), Prometheus Federator has three different classifications of namespaces that the operator looks out for: + +1. **Operator / System Namespace**: this is the namespace that the operator is deployed into (e.g., `cattle-monitoring-system`). This namespace will contain all HelmCharts and HelmReleases for all ProjectHelmCharts watched by this operator. **Only Cluster Admins should have access to this namespace.** +2. **Project Registration Namespace (`cattle-project-`)**: this is the set of namespaces that the operator watches for ProjectHelmCharts within. The RoleBindings and ClusterRoleBindings that apply to this namespace will also be the source of truth for the auto-assigned RBAC created in the Project Release Namespace. For details, refer to the [RBAC page](./rbac/). **Project Owners (admin), Project Members (edit), and Read-Only Members (view) should have access to this namespace**. +> Note: Project Registration Namespaces will be auto-generated by the operator and imported into the Project it is tied to if `.Values.global.cattle.projectLabel` is provided (which is set to `field.cattle.io/projectId` by default); this indicates that a Project Registration Namespace should be created by the operator if at least one namespace is observed with that label. The operator will not let these namespaces be deleted unless either all namespaces with that label are gone (e.g. this is the last namespace in that project, in which case the namespace will be marked with the label `"helm.cattle.io/helm-project-operator-orphaned": "true"`, which signals that it can be deleted) or it is no longer watching that project (because the project ID was provided under `.Values.helmProjectOperator.otherSystemProjectLabelValues`, which serves as a denylist for Projects). These namespaces will also never be auto-deleted to avoid destroying user data; it is recommended that users clean up these namespaces manually if desired on creating or deleting a project +> Note: if `.Values.global.cattle.projectLabel` is not provided, the Operator / System Namespace will also be the Project Registration Namespace +3. **Project Release Namespace (`cattle-project--monitoring`)**: this is the set of namespaces that the operator deploys Project Monitoring Stacks within on behalf of a ProjectHelmChart; the operator will also automatically assign RBAC to Roles created in this namespace by the Project Monitoring Stack based on bindings found in the Project Registration Namespace. **Only Cluster Admins should have access to this namespace; Project Owners (admin), Project Members (edit), and Read-Only Members (view) will be assigned limited access to this namespace by the deployed Helm Chart and Prometheus Federator.** + > Note: Project Release Namespaces are automatically deployed and imported into the project whose ID is specified under `.Values.helmProjectOperator.projectReleaseNamespaces.labelValue` (which defaults to the value of `.Values.global.cattle.systemProjectId` if not specified) whenever a ProjectHelmChart is specified in a Project Registration Namespace +> Note: Project Release Namespaces follow the same orphaning conventions as Project Registration Namespaces (see note above) +> Note: if `.Values.projectReleaseNamespaces.enabled` is false, the Project Release Namespace will be the same as the Project Registration Namespace + +### Helm Resources (HelmChart, HelmRelease) + +On deploying a ProjectHelmChart, the Prometheus Federator will automatically create and manage two child custom resources that manage the underlying Helm resources in turn: + +- A HelmChart CR (managed via an embedded [k3s-io/helm-contoller](https://github.com/k3s-io/helm-controller) in the operator): this custom resource automatically creates a Job in the same namespace that triggers a `helm install`, `helm upgrade`, or `helm uninstall` depending on the change applied to the HelmChart CR; this CR is automatically updated on changes to the ProjectHelmChart (e.g. modifying the values.yaml) or changes to the underlying Project definition (e.g. adding or removing namespaces from a project). + +> **Important** If a ProjectHelmChart is not deploying or updating the underlying Project Monitoring Stack for some reason, the Job created by this resource in the Operator / System namespace should be the first place you check to see if there's something wrong with the Helm operation; however, this is generally only accessible by a Cluster Admin.** + +- A HelmRelease CR (managed via an embedded [rancher/helm-locker](https://github.com/rancher/helm-locker) in the operator): this custom resource automatically locks a deployed Helm release in place and automatically overwrites updates to underlying resources unless the change happens via a Helm operation (`helm install`, `helm upgrade`, or `helm uninstall` performed by the HelmChart CR). + +> **Note** HelmRelease CRs emit Kubernetes Events that detect when an underlying Helm release is being modified and locks it back to place; to view these events, you can use `kubectl describe helmrelease -n `; you can also view the logs on this operator to see when changes are detected and which resources were attempted to be modified + +Both of these resources are created for all Helm charts in the Operator / System namespaces to avoid escalation of privileges to underprivileged users. + +### Advanced Helm Project Operator Configuration + +For more information on advanced configurations, refer to [this page](https://github.com/rancher/prometheus-federator/blob/main/charts/prometheus-federator/0.0.1/README.md#advanced-helm-project-operator-configuration). + + + diff --git a/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/guides/customizing-grafana/_index.md b/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/guides/customizing-grafana/_index.md new file mode 100644 index 00000000000..f5cc1e5653d --- /dev/null +++ b/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/guides/customizing-grafana/_index.md @@ -0,0 +1,8 @@ +--- +title: Customizing Grafana Dashboards +weight: 3 +--- + +Grafana dashboards are customized the same way whether it's for rancher-monitoring or for Prometheus Federator. + +For instructions, refer to [this page](../../../guides/customize-grafana/). \ No newline at end of file diff --git a/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/guides/enable-prom-fed/_index.md b/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/guides/enable-prom-fed/_index.md new file mode 100644 index 00000000000..867e126ea0e --- /dev/null +++ b/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/guides/enable-prom-fed/_index.md @@ -0,0 +1,62 @@ +--- +title: Enable Prometheus Federator +weight: 1 +--- + +- [Requirements](#requirements) +- [Install the Prometheus Federator Application](#install-the-prometheus-federator-application) + +# Requirements + +By default, Prometheus Federator is configured and intended to be deployed alongside [rancher-monitoring](https://rancher.com/docs/rancher/v2.6/en/monitoring-alerting/), which deploys Prometheus Operator alongside a Cluster Prometheus that each Project Monitoring Stack is configured to federate namespace-scoped metrics from by default. + +For instructions to install rancher-monitoring, refer [this page](../../../guides/enable-monitoring/). + +The default configuration should already be compatible with your rancher-monitoring stack. However, to optimize the security and usability of Prometheus Federator in your cluster, we recommend making these additional configurations to rancher-monitoring: + +- [Ensure the cattle-monitoring-system namespace is placed into the System Project](#ensure-the-cattle-monitoring-system-namespace-is-placed-into-the-system-project-or-a-similarly-locked-down-project-that-has-access-to-other-projects-in-the-cluster) +- [Configure rancher-monitoring to only watch for resources created by the Helm chart itself](#configure-rancher-monitoring-to-only-watch-for-resources-created-by-the-helm-chart-itself) +- [Increase the CPU / memory limits of the Cluster Prometheus](#increase-the-cpu--memory-limits-of-the-cluster-prometheus) + +## Ensure the cattle-monitoring-system namespace is placed into the System Project (or a similarly locked down Project that has access to other Projects in the cluster) + +Prometheus Operator's security model expects that the namespace it is deployed into (e.g., `cattle-monitoring-system`) has limited access for anyone except Cluster Admins to avoid privilege escalation via execing into Pods (such as the Jobs executing Helm operations). In addition, deploying Prometheus Federator and all Project Prometheus stacks into the System Project ensures that the each Project Prometheus is able to reach out to scrape workloads across all Projects (even if Network Policies are defined via Project Network Isolation) but has limited access for Project Owners, Project Members, and other users to be able to access data they shouldn't have access to (i.e., being allowed to exec into pods, set up the ability to scrape namespaces outside of a given Project, etc.). + +## Configure rancher-monitoring to only watch for resources created by the Helm chart itself + +Since each Project Monitoring Stack will watch the other namespaces and collect additional custom workload metrics or dashboards already, it's recommended to configure the following settings on all selectors to ensure that the Cluster Prometheus Stack only monitors resources created by the Helm Chart itself: + +``` +matchLabels: + release: "rancher-monitoring" +``` + +The following selector fields are recommended to have this value: +- `.Values.alertmanager.alertmanagerSpec.alertmanagerConfigSelector` +- `.Values.prometheus.prometheusSpec.serviceMonitorSelector` +- `.Values.prometheus.prometheusSpec.podMonitorSelector` +- `.Values.prometheus.prometheusSpec.ruleSelector` +- `.Values.prometheus.prometheusSpec.probeSelector` + +Once this setting is turned on, you can always create ServiceMonitors or PodMonitors that are picked up by the Cluster Prometheus by adding the label `release: "rancher-monitoring"` to them (in which case they will be ignored by Project Monitoring Stacks automatically by default, even if the namespace in which those ServiceMonitors or PodMonitors reside in are not system namespaces). + +> Note: If you don't want to allow users to be able to create ServiceMonitors and PodMonitors that aggregate into the Cluster Prometheus in Project namespaces, you can additionally set the namespaceSelectors on the chart to only target system namespaces (which must contain `cattle-monitoring-system` and `cattle-dashboards`, where resources are deployed into by default by rancher-monitoring; you will also need to monitor the `default` namespace to get apiserver metrics or create a custom ServiceMonitor to scrape apiserver metrics from the Service residing in the default namespace) to limit your Cluster Prometheus from picking up other Prometheus Operator CRs; in that case, it would be recommended to turn `.Values.prometheus.prometheusSpec.ignoreNamespaceSelectors=true` to allow you to define ServiceMonitors that can monitor non-system namespaces from within a system namespace. + +## Increase the CPU / memory limits of the Cluster Prometheus + +Depending on a cluster's setup, it's generally recommended to give a large amount of dedicated memory to the Cluster Prometheus to avoid restarts due to out-of-memory errors (OOMKilled), usually caused by churn created in the cluster that causes a large number of high cardinality metrics to be generated and ingested by Prometheus within one block of time; this is one of the reasons why the default Rancher Monitoring stack expects around 4GB of RAM to be able to operate in a normal-sized cluster. However, when introducing Project Monitoring Stacks that are all sending `/federate` requests to the same Cluster Prometheus and are reliant on the Cluster Prometheus being "up" to federate that system data on their namespaces, it's even more important that the Cluster Prometheus has an ample amount of CPU / memory assigned to it to prevent an outage that can cause data gaps across all Project Prometheis in the cluster. + +> Note: There are no specific recommendations on how much memory the Cluster Prometheus should be configured with since it depends entirely on the user's setup (namely the likelihood of encountering a high churn rate and the scale of metrics that could be generated at that time); it generally varies per setup. + +# Install the Prometheus Federator Application + +1. Click **☰ > Cluster Management**. +1. Go to the cluster that you want to install Prometheus Federator and click **Explore**. +1. Click **Apps -> Charts**. +1. Click the **Prometheus Federator** chart. +1. Click **Install**. +1. On the **Metadata** page, click **Next**. +1. In the **Project Release Namespace Project ID** field, the `System Project` is used as the default but can be overridden with another project with similarly [limited access](#ensure-the-cattle-monitoring-system-namespace-is-placed-into-the-system-project-or-a-similarly-locked-down-project-that-has-access-to-other-projects-in-the-cluster). +### Prometheus Federator on the Local Cluster + +Prometheus Federator is a resource intensive application. Installing it to the local cluster is possible, but **not recommended**. \ No newline at end of file From c1537b0af822dbdd2d42f5377f3ac49d1c63701d Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Tue, 10 May 2022 18:36:26 -0700 Subject: [PATCH 449/478] Rancher CLI not compatible with feature charts --- content/rancher/v2.6/en/cli/_index.md | 16 +++++++----- content/rancher/v2.6/en/helm-charts/_index.md | 26 +++++++++++-------- 2 files changed, 25 insertions(+), 17 deletions(-) diff --git a/content/rancher/v2.6/en/cli/_index.md b/content/rancher/v2.6/en/cli/_index.md index 89928a7dc9b..81b7b55c876 100644 --- a/content/rancher/v2.6/en/cli/_index.md +++ b/content/rancher/v2.6/en/cli/_index.md @@ -1,5 +1,5 @@ --- -title: Using the Rancher Command Line Interface +title: Using the Rancher Command Line Interface description: The Rancher CLI is a unified tool that you can use to interact with Rancher. With it, you can operate Rancher using a command line interface rather than the GUI metaTitle: "Using the Rancher Command Line Interface " metaDescription: "The Rancher CLI is a unified tool that you can use to interact with Rancher. With it, you can operate Rancher using a command line interface rather than the GUI" @@ -36,11 +36,11 @@ Before you can perform any commands, you must select a Rancher project to perfor **Example: `./rancher context switch` Output** ``` User:rancher-cli-directory user$ ./rancher context switch -NUMBER CLUSTER NAME PROJECT ID PROJECT NAME -1 cluster-2 c-7q96s:p-h4tmb project-2 -2 cluster-2 c-7q96s:project-j6z6d Default -3 cluster-1 c-lchzv:p-xbpdt project-1 -4 cluster-1 c-lchzv:project-s2mch Default +NUMBER CLUSTER NAME PROJECT ID PROJECT NAME +1 cluster-2 c-7q96s:p-h4tmb project-2 +2 cluster-2 c-7q96s:project-j6z6d Default +3 cluster-1 c-lchzv:p-xbpdt project-1 +4 cluster-1 c-lchzv:project-s2mch Default Select a Project: ``` @@ -78,3 +78,7 @@ The following commands are available for use in Rancher CLI. Once logged into Rancher Server using the CLI, enter `./rancher --help` for a list of commands. All commands accept the `--help` flag, which documents each command's usage. + +### Limitations + +The Rancher CLI **cannot** be used to install [dashboard apps or Rancher feature charts](../helm-charts/). diff --git a/content/rancher/v2.6/en/helm-charts/_index.md b/content/rancher/v2.6/en/helm-charts/_index.md index ca9a26eae82..68f8c757fcd 100644 --- a/content/rancher/v2.6/en/helm-charts/_index.md +++ b/content/rancher/v2.6/en/helm-charts/_index.md @@ -9,7 +9,7 @@ In this section, you'll learn how to manage Helm chart repositories and applicat Starting in Rancher v2.6.0, a new versioning scheme for Rancher feature charts was implemented. The changes are centered around the major version of the charts and the +up annotation for upstream charts, where applicable. -**Major Version:** The major version of the charts is tied to Rancher minor versions. When you upgrade to a new Rancher minor version, you should ensure that all of your **Apps & Marketplace** charts are also upgraded to the correct release line for the chart. +**Major Version:** The major version of the charts is tied to Rancher minor versions. When you upgrade to a new Rancher minor version, you should ensure that all of your **Apps & Marketplace** charts are also upgraded to the correct release line for the chart. >**Note:** Any major versions that are less than the ones mentioned in the table below are meant for 2.5 and below only. For example, you are advised to not use <100.x.x versions of Monitoring in 2.6.x+. @@ -20,25 +20,25 @@ Starting in Rancher v2.6.0, a new versioning scheme for Rancher feature charts w | external-ip-webhook | 100.0.0+up1.0.0 | 100.0.1+up1.0.1 | | harvester-cloud-provider | 100.0.0+up0.1.8 | 100.0.0+up0.1.8 | | harvester-csi-driver | 100.0.0+up0.1.9 | 100.0.0+up0.1.9 | -| rancher-alerting-drivers | 100.0.0 | 100.0.1 | +| rancher-alerting-drivers | 100.0.0 | 100.0.1 | | rancher-backups | 2.0.0 | 2.1.0 | -| rancher-cis-benchmark | 2.0.0 | 2.0.2 | -| rancher-gatekeeper | 100.0.0+up3.5.1 | 100.0.1+up3.6.0 | +| rancher-cis-benchmark | 2.0.0 | 2.0.2 | +| rancher-gatekeeper | 100.0.0+up3.5.1 | 100.0.1+up3.6.0 | | rancher-istio | 100.0.0+up1.10.4 | 100.1.0+up1.11.4 | | rancher-logging | 100.0.0+up3.12.0 | 100.0.1+up3.15.0 | -| rancher-longhorn | 100.0.0+up1.1.2 | 100.1.1+up1.2.3 | +| rancher-longhorn | 100.0.0+up1.1.2 | 100.1.1+up1.2.3 | | rancher-monitoring | 100.0.0+up16.6.0 | 100.1.0+up19.0.3 -| rancher-sriov (experimental) | 100.0.0+up0.1.0 | 100.0.1+up0.1.0 | +| rancher-sriov (experimental) | 100.0.0+up0.1.0 | 100.0.1+up0.1.0 | | rancher-vsphere-cpi | 100.0.0 | 100.1.0+up1.0.100 | rancher-vsphere-csi | 100.0.0 | 100.1.0+up2.3.0 | -| rancher-wins-upgrader | 100.0.0+up0.0.1 | 100.0.0+up0.0.1 | +| rancher-wins-upgrader | 100.0.0+up0.0.1 | 100.0.0+up0.0.1 |
      **Charts based on upstream:** For charts that are based on upstreams, the +up annotation should inform you of what upstream version the Rancher chart is tracking. Check the upstream version compatibility with Rancher during upgrades also. - As an example, `100.x.x+up16.6.0` for Monitoring tracks upstream kube-prometheus-stack `16.6.0` with some Rancher patches added to it. -- On upgrades, ensure that you are not downgrading the version of the chart that you are using. For example, if you are using a version of Monitoring > `16.6.0` in Rancher 2.5, you should not upgrade to `100.x.x+up16.6.0`. Instead, you should upgrade to the appropriate version in the next release. +- On upgrades, ensure that you are not downgrading the version of the chart that you are using. For example, if you are using a version of Monitoring > `16.6.0` in Rancher 2.5, you should not upgrade to `100.x.x+up16.6.0`. Instead, you should upgrade to the appropriate version in the next release. ### Charts @@ -86,10 +86,10 @@ To add a private CA for Helm Chart repositories: [...] ``` - + > **Note:** Helm chart repositories with authentication > -> As of Rancher v2.6.3, a new value `disableSameOriginCheck` has been added to the Repo.Spec. This allows users to bypass the same origin checks, sending the repository Authentication information as a Basic Auth Header with all API calls. This is not recommended but can be used as a temporary solution in cases of non-standard Helm chart repositories such as those that have redirects to a different origin URL. +> As of Rancher v2.6.3, a new value `disableSameOriginCheck` has been added to the Repo.Spec. This allows users to bypass the same origin checks, sending the repository Authentication information as a Basic Auth Header with all API calls. This is not recommended but can be used as a temporary solution in cases of non-standard Helm chart repositories such as those that have redirects to a different origin URL. > > To use this feature for an existing Helm chart repository, click ⋮ > Edit YAML. On the `spec` portion of the YAML file, add `disableSameOriginCheck` and set it to `true`. > @@ -116,7 +116,7 @@ After installing a chart, you can find it in the _"Installed Apps"_ tab. In this Most Rancher tools have additional pages located in the toolbar below the _"Apps & Marketplace"_ section to help manage and use the features. These pages include links to dashboards, forms to easily add Custom Resources, and additional information. > If you are upgrading your chart using _"Customize Helm options before upgrade"_ , please be aware that using the _"--force"_ option may result in errors if your chart has immutable fields. This is because some objects in Kubernetes cannot be changed once they are created. To ensure you do not get this error you can: -> +> > * use the default upgrade option ( i.e do not use _"--force"_ option ) > * uninstall the existing chart and install the upgraded chart > * delete the resources with immutable fields from the cluster before performing the _"--force"_ upgrade @@ -130,3 +130,7 @@ If you have a legacy app installed and want to upgrade it: - The legacy [feature flag]({{}}/rancher/v2.6/en/installation/resources/feature-flags/) must be turned on (if it's not turned on automatically because of having a legacy app before upgrading) - You can upgrade the app from cluster explorer, from the left nav section **Legacy > Project > Apps** - For multi-cluster apps, you can go to **≡ > Multi-cluster Apps** and upgrade the app from there + +### Limitations + +[Dashboard apps or Rancher feature charts](../helm-charts/) **cannot** be installed using the Rancher CLI. From a2a3f7a43b4d214597db5e5836db75427c13af99 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Tue, 10 May 2022 20:53:17 -0700 Subject: [PATCH 450/478] Update CLI download steps --- content/rancher/v2.6/en/cli/_index.md | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/content/rancher/v2.6/en/cli/_index.md b/content/rancher/v2.6/en/cli/_index.md index 89928a7dc9b..258e477e351 100644 --- a/content/rancher/v2.6/en/cli/_index.md +++ b/content/rancher/v2.6/en/cli/_index.md @@ -1,5 +1,5 @@ --- -title: Using the Rancher Command Line Interface +title: Using the Rancher Command Line Interface description: The Rancher CLI is a unified tool that you can use to interact with Rancher. With it, you can operate Rancher using a command line interface rather than the GUI metaTitle: "Using the Rancher Command Line Interface " metaDescription: "The Rancher CLI is a unified tool that you can use to interact with Rancher. With it, you can operate Rancher using a command line interface rather than the GUI" @@ -12,6 +12,12 @@ The Rancher CLI (Command Line Interface) is a unified tool that you can use to i The binary can be downloaded directly from the UI. The link can be found in the right hand side of the footer in the UI. We have binaries for Windows, Mac, and Linux. You can also check the [releases page for our CLI](https://github.com/rancher/cli/releases) for direct downloads of the binary. +The binary can be downloaded directly from the UI. + +1. In the upper left corner, click **☰**. +1. At the bottom, click **v2.6.x**, where **v2.6.x** is a hyperlinked text indicating the installed Rancher version. +1. Under the **CLI Downloads section**, there are links to download the binaries for Windows, Mac, and Linux. You can also check the [releases page for our CLI](https://github.com/rancher/cli/releases) for direct downloads of the binary. + ### Requirements After you download the Rancher CLI, you need to make a few configurations. Rancher CLI requires: @@ -36,11 +42,11 @@ Before you can perform any commands, you must select a Rancher project to perfor **Example: `./rancher context switch` Output** ``` User:rancher-cli-directory user$ ./rancher context switch -NUMBER CLUSTER NAME PROJECT ID PROJECT NAME -1 cluster-2 c-7q96s:p-h4tmb project-2 -2 cluster-2 c-7q96s:project-j6z6d Default -3 cluster-1 c-lchzv:p-xbpdt project-1 -4 cluster-1 c-lchzv:project-s2mch Default +NUMBER CLUSTER NAME PROJECT ID PROJECT NAME +1 cluster-2 c-7q96s:p-h4tmb project-2 +2 cluster-2 c-7q96s:project-j6z6d Default +3 cluster-1 c-lchzv:p-xbpdt project-1 +4 cluster-1 c-lchzv:project-s2mch Default Select a Project: ``` From 3df24afdbbc90fa73af2b27e02c9ca1b7287c02b Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Tue, 10 May 2022 21:03:15 -0700 Subject: [PATCH 451/478] RKE2 req: remove outdated info Referenced step removed in #4071 --- content/rancher/v2.6/en/installation/requirements/_index.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/content/rancher/v2.6/en/installation/requirements/_index.md b/content/rancher/v2.6/en/installation/requirements/_index.md index c60d529b881..171d558d5f9 100644 --- a/content/rancher/v2.6/en/installation/requirements/_index.md +++ b/content/rancher/v2.6/en/installation/requirements/_index.md @@ -68,7 +68,7 @@ net.bridge.bridge-nf-call-iptables=1 For the container runtime, K3s should work with any modern version of Docker or containerd. -Rancher needs to be installed on a supported Kubernetes version. To find out which versions of Kubernetes are supported for your Rancher version, refer to the [support maintenance terms.](https://rancher.com/support-maintenance-terms/) To specify the K3s version, use the INSTALL_K3S_VERSION environment variable when running the K3s installation script. +Rancher needs to be installed on a supported Kubernetes version. To find out which versions of Kubernetes are supported for your Rancher version, refer to the [support maintenance terms.](https://rancher.com/support-maintenance-terms/) To specify the K3s version, use the INSTALL_K3S_VERSION environment variable when running the K3s installation script. If you are installing Rancher on a K3s cluster with **Raspbian Buster**, follow [these steps]({{}}/k3s/latest/en/advanced/#enabling-legacy-iptables-on-raspbian-buster) to switch to legacy iptables. @@ -82,8 +82,6 @@ For details on which OS versions were tested with RKE2, refer to the [support ma Docker is not required for RKE2 installs. -The Ingress should be deployed as DaemonSet to ensure your load balancer can successfully route traffic to all nodes. Currently, RKE2 deploys nginx-ingress as a deployment by default, so you will need to deploy it as a DaemonSet by following [these steps.]({{}}/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-rke2/#5-configure-nginx-to-be-a-daemonset) - ### Installing Docker Docker is required for Helm chart installs, and it can be installed by following the steps in the official [Docker documentation.](https://docs.docker.com/) Rancher also provides [scripts]({{}}/rancher/v2.6/en/installation/requirements/installing-docker) to install Docker with one command. From 453445122343fd595cd65ad175f858fd0190a78d Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Tue, 10 May 2022 21:13:02 -0700 Subject: [PATCH 452/478] Add reasoning for avoiding nested groups in AD --- .../v2.5/en/admin-settings/authentication/ad/_index.md | 6 +++--- .../v2.6/en/admin-settings/authentication/ad/_index.md | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/content/rancher/v2.5/en/admin-settings/authentication/ad/_index.md b/content/rancher/v2.5/en/admin-settings/authentication/ad/_index.md index 0cce01d449d..2c9c82a4374 100644 --- a/content/rancher/v2.5/en/admin-settings/authentication/ad/_index.md +++ b/content/rancher/v2.5/en/admin-settings/authentication/ad/_index.md @@ -101,7 +101,7 @@ The table below details the parameters for the group schema configuration. | Search Attribute | Attribute used to construct search filters when adding groups to clusters or projects. See description of user schema `Search Attribute`. | | Search Filter | This filter gets applied to the list of groups that is searched when Rancher attempts to add groups to a site access list or tries to add groups to clusters or projects. For example, a group search filter could be (|(cn=group1)(cn=group2)). Note: If the search filter does not use [valid AD search syntax,](https://docs.microsoft.com/en-us/windows/win32/adsi/search-filter-syntax) the list of groups will be empty. | | Group DN Attribute | The name of the group attribute whose format matches the values in the user attribute describing a the user's memberships. See `User Member Attribute`. | -| Nested Group Membership | This settings defines whether Rancher should resolve nested group memberships. Use only if your organisation makes use of these nested memberships (ie. you have groups that contain other groups as members. We advise avoiding nested groups when possible). | +| Nested Group Membership | This settings defines whether Rancher should resolve nested group memberships. Use only if your organization makes use of these nested memberships (i.e., you have groups that contain other groups as members. We advise avoiding nested groups when possible). | --- @@ -153,7 +153,7 @@ This command performs an LDAP search with the search base set to the domain root Since in this case the user's DN is `CN=John Doe,CN=Users,DC=acme,DC=com` [5], we should configure the **User Search Base** with the parent node DN `CN=Users,DC=acme,DC=com`. -Similarly, based on the DN of the group referenced in the **memberOf** attribute [4], the correct value for the **Group Search Base** would be the parent node of that value, ie. `OU=Groups,DC=acme,DC=com`. +Similarly, based on the DN of the group referenced in the **memberOf** attribute [4], the correct value for the **Group Search Base** would be the parent node of that value, i.e., `OU=Groups,DC=acme,DC=com`. ### Identify User Schema @@ -166,7 +166,7 @@ The output of the above `ldapsearch` query also allows to determine the correct > **Note:** > -> If the AD users in our organisation were to authenticate with their UPN (e.g. jdoe@acme.com) instead of the short logon name, then we would have to set the `Login Attribute` to **userPrincipalName** instead. +> If the AD users in our organization were to authenticate with their UPN (e.g. jdoe@acme.com) instead of the short logon name, then we would have to set the `Login Attribute` to **userPrincipalName** instead. We'll also set the `Search Attribute` parameter to **sAMAccountName|name**. That way users can be added to clusters/projects in the Rancher UI either by entering their username or full name. diff --git a/content/rancher/v2.6/en/admin-settings/authentication/ad/_index.md b/content/rancher/v2.6/en/admin-settings/authentication/ad/_index.md index a919075bdaa..251039f2c97 100644 --- a/content/rancher/v2.6/en/admin-settings/authentication/ad/_index.md +++ b/content/rancher/v2.6/en/admin-settings/authentication/ad/_index.md @@ -101,7 +101,7 @@ The table below details the parameters for the group schema configuration. | Search Attribute | Attribute used to construct search filters when adding groups to clusters or projects. See description of user schema `Search Attribute`. | | Search Filter | This filter gets applied to the list of groups that is searched when Rancher attempts to add groups to a site access list or tries to add groups to clusters or projects. For example, a group search filter could be (|(cn=group1)(cn=group2)). Note: If the search filter does not use [valid AD search syntax,](https://docs.microsoft.com/en-us/windows/win32/adsi/search-filter-syntax) the list of groups will be empty. | | Group DN Attribute | The name of the group attribute whose format matches the values in the user attribute describing a the user's memberships. See `User Member Attribute`. | -| Nested Group Membership | This settings defines whether Rancher should resolve nested group memberships. Use only if your organisation makes use of these nested memberships (ie. you have groups that contain other groups as members. We advise avoiding nested groups when possible). | +| Nested Group Membership | This settings defines whether Rancher should resolve nested group memberships. Use only if your organization makes use of these nested memberships (i.e., you have groups that contain other groups as members. We advise avoiding nested groups when possible to avoid potential performance issues when there is a large amount of nested memberships). | --- @@ -153,7 +153,7 @@ This command performs an LDAP search with the search base set to the domain root Since in this case the user's DN is `CN=John Doe,CN=Users,DC=acme,DC=com` [5], we should configure the **User Search Base** with the parent node DN `CN=Users,DC=acme,DC=com`. -Similarly, based on the DN of the group referenced in the **memberOf** attribute [4], the correct value for the **Group Search Base** would be the parent node of that value, ie. `OU=Groups,DC=acme,DC=com`. +Similarly, based on the DN of the group referenced in the **memberOf** attribute [4], the correct value for the **Group Search Base** would be the parent node of that value, i.e., `OU=Groups,DC=acme,DC=com`. ### Identify User Schema @@ -166,7 +166,7 @@ The output of the above `ldapsearch` query also allows to determine the correct > **Note:** > -> If the AD users in our organisation were to authenticate with their UPN (e.g. jdoe@acme.com) instead of the short logon name, then we would have to set the `Login Attribute` to **userPrincipalName** instead. +> If the AD users in our organization were to authenticate with their UPN (e.g. jdoe@acme.com) instead of the short logon name, then we would have to set the `Login Attribute` to **userPrincipalName** instead. We'll also set the `Search Attribute` parameter to **sAMAccountName|name**. That way users can be added to clusters/projects in the Rancher UI either by entering their username or full name. From 34806680d06f1284d7dfc568a4e6e749ac56145f Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Tue, 10 May 2022 21:45:04 -0700 Subject: [PATCH 453/478] Update contributing guide to change from UI to Dashboard --- content/rancher/v2.6/en/contributing/_index.md | 4 ++-- static/img/rancher/ranchercomponentsdiagram-2.6.svg | 2 ++ 2 files changed, 4 insertions(+), 2 deletions(-) create mode 100644 static/img/rancher/ranchercomponentsdiagram-2.6.svg diff --git a/content/rancher/v2.6/en/contributing/_index.md b/content/rancher/v2.6/en/contributing/_index.md index 3900cabb57f..cb8d8332c8e 100644 --- a/content/rancher/v2.6/en/contributing/_index.md +++ b/content/rancher/v2.6/en/contributing/_index.md @@ -24,7 +24,7 @@ Repository | URL | Description Rancher | https://github.com/rancher/rancher | This repository is the main source code for Rancher 2.x. Types | https://github.com/rancher/types | This repository is the repository that has all the API types for Rancher 2.x. API Framework | https://github.com/rancher/norman | This repository is an API framework for building Rancher style APIs backed by Kubernetes Custom Resources. -User Interface | https://github.com/rancher/ui | This repository is the source of the UI. +User Interface | https://github.com/rancher/dashboard/ | This repository is the source of the Dashboard UI. (Rancher) Docker Machine | https://github.com/rancher/machine | This repository is the source of the Docker Machine binary used when using Node Drivers. This is a fork of the `docker/machine` repository. machine-package | https://github.com/rancher/machine-package | This repository is used to build the Rancher Docker Machine binary. kontainer-engine | https://github.com/rancher/kontainer-engine | This repository is the source of kontainer-engine, the tool to provision hosted Kubernetes clusters. @@ -36,7 +36,7 @@ loglevel repository | https://github.com/rancher/loglevel | This repository is t To see all libraries/projects used in Rancher, see the [`go.mod` file](https://github.com/rancher/rancher/blob/master/go.mod) in the `rancher/rancher` repository. -![Rancher diagram]({{}}/img/rancher/ranchercomponentsdiagram.svg)
      +![Rancher diagram]({{}}/img/rancher/ranchercomponentsdiagram-2.6.svg)
      Rancher components used for provisioning/managing Kubernetes clusters. # Building diff --git a/static/img/rancher/ranchercomponentsdiagram-2.6.svg b/static/img/rancher/ranchercomponentsdiagram-2.6.svg new file mode 100644 index 00000000000..f63b84b3e75 --- /dev/null +++ b/static/img/rancher/ranchercomponentsdiagram-2.6.svg @@ -0,0 +1,2 @@ + +
      Rancher 2.x
      [Not supported by viewer]
      Importing Kubernetes Clusters
      <b>Importing Kubernetes Clusters</b>

      • Any Kubernetes cluster                      
      [Not supported by viewer]
      Provisioning Kubernetes Clusters
      <b>Provisioning Kubernetes Clusters</b>
      Rancher
      <b>Rancher</b>
      Rancher Launched Kubernetes
      • Nodes Hosted in an Infrastructure Provider
        • Amazon EC2
        • DigitalOcean
        • Azure
        • vSphere
        • Any (pluggable)
      [Not supported by viewer]
      Rancher Agents
      <b>Rancher Agents</b>
      Provisioning
      <b>Provisioning</b>
      API Framework & Types
      [Not supported by viewer]
      Utilities
      [Not supported by viewer]
      Rancher Server
      https://github.com/rancher/rancher
      Rancher Server<br>https://github.com/rancher/rancher<br>
      RKE
      https://github.com/rancher/rke
      RKE<br>https://github.com/rancher/rke<br>
      docker-machine
      https://github.com/rancher/machine
      docker-machine<br>https://github.com/rancher/machine<br>
      Rancher CLI
      https://github.com/rancher/cli
      Rancher CLI<br>https://github.com/rancher/cli<br>
      Norman
      https://github.com/rancher/norman
      Norman<br>https://github.com/rancher/norman<br>
      Types
      https://github.com/rancher/types
      Types<br>https://github.com/rancher/types<br>
      cattle-cluster-agent

      cattle-cluster-agent<br><br>
      cattle-node-agent
      cattle-node-agent<br>
      Rancher Launched Kubernetes
      • Creating a Cluster with Custom Nodes
      [Not supported by viewer]
      Rancher Agents
      <b>Rancher Agents</b>
      Provisioning
      <b>Provisioning</b>
      RKE
      https://github.com/rancher/rke
      RKE<br>https://github.com/rancher/rke<br>
      cattle-cluster-agent

      cattle-cluster-agent<br><br>
      cattle-node-agent
      cattle-node-agent<br>
      Hosted Kubernetes Providers
      • Google Kubernetes Engine (GKE)
      • Amazon Elastic Container Service for Kubernetes (EKS)
      • Azure Kubernetes Service (AKS)
      [Not supported by viewer]
      Rancher Agents
      <b>Rancher Agents</b>
      Provisioning
      <b>Provisioning</b>
      kontainer-engine
      https://github.com/rancher/
      kontainer-engine
      [Not supported by viewer]
      cattle-cluster-agent

      cattle-cluster-agent<br><br>
      cattle-node-agent
      cattle-node-agent<br>
      Rancher Agents
      <b>Rancher Agents</b>
      cattle-cluster-agent

      cattle-cluster-agent<br><br>
      cattle-node-agent
      cattle-node-agent<br>
      User Interface
      [Not supported by viewer]
      Rancher Dashboard UI
      https://github.com/rancher/dashboard
      Rancher Dashboard UI<br>https://github.com/rancher/dashboard<br>
      Rancher API UI
      https://github.com/rancher/api-ui
      Rancher API UI<br>https://github.com/rancher/api-ui<br>
      Catalog Applications
      https://github.com/rancher/helm
      Catalog Applications<br>https://github.com/rancher/helm<br>       \ No newline at end of file From 5014e8953ab1d24a0aa304e8dd146707cef41c0f Mon Sep 17 00:00:00 2001 From: Nuno do Carmo Date: Wed, 11 May 2022 14:46:42 +0200 Subject: [PATCH 454/478] Applied suggestion from anupama2501 --- .../v2.6/en/cluster-provisioning/rke-clusters/_index.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md index 6a2e8f58ac6..cd160113aa2 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md @@ -11,7 +11,9 @@ You can have Rancher launch a Kubernetes cluster using any nodes you want. When Rancher can install Kubernetes on existing nodes, or it can dynamically provision nodes in an infrastructure provider and install Kubernetes on them. -RKE/RKE2 clusters include clusters that Rancher launched on Windows nodes or other existing custom nodes, as well as clusters that Rancher launched with new nodes on Azure, Digital Ocean, EC2, or vSphere. +Rancher can also create pools of nodes. One benefit of installing Kubernetes on node pools hosted by an infrastructure provider is that if a node loses connectivity with the cluster, Rancher can automatically create another node to join the cluster to ensure that the count of the node pool is as expected. + +RKE/RKE2 clusters include clusters that Rancher launched on Windows nodes or other existing custom nodes, as well as clusters that Rancher launched with new nodes on Azure, Digital Ocean, EC2, vSphere, Linode or Harvester. ## RKE @@ -54,7 +56,6 @@ RKE2 provisioning is built on top of a new provisioning framework that leverages - Provision RKE2 clusters on Digital Ocean, AWS EC2, Azure, and vSphere - Fully configure RKE2 clusters within Rancher - Choose CNI options Calico, Cilium, and Multus in addition to Canal -- Install custom RKE2 clusters on pre-provisioned VMs or bare-metal nodes The RKE2 provisioning also includes installing RKE2 on Windows clusters. Windows features for RKE2 include: @@ -67,6 +68,8 @@ Windows Support for RKE2 Custom Clusters requires choosing Calico as the CNI. ### Launching Kubernetes on Existing Custom Nodes +RKE2 provisioning also allows you to install custom clusters on pre-provisioned VMs or bare-metal nodes. + If you want to reuse a node from a previous custom cluster, [clean the node]({{}}/rancher/v2.6/en/cluster-admin/cleaning-cluster-nodes/) before using it in a cluster again. If you reuse a node that hasn't been cleaned, cluster provisioning may fail. For more information, refer to the section on [custom nodes.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/custom-nodes/) From 7ccdc8765343ff365a4a87358f6329b037504e1c Mon Sep 17 00:00:00 2001 From: Nuno do Carmo Date: Wed, 11 May 2022 15:57:34 +0200 Subject: [PATCH 455/478] Split RKE and RKE2 clusters in `node-pools` --- .../rke-clusters/node-pools/_index.md | 83 ++++++++++--------- 1 file changed, 42 insertions(+), 41 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/_index.md index 3c89deb26c9..0fecd8264e2 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/_index.md @@ -3,58 +3,55 @@ title: Launching Kubernetes on New Nodes in an Infrastructure Provider weight: 2205 --- +This section covers the following topics: + +- [RKE Clusters](#rke-clusters) + - [Node templates](#node-templates) + - [Node labels](#node-labels) + - [Node taints](#node-taints) + - [Administrator control of node templates](#administrator-control-of-node-templates) + - [Node pools](#node-pools) + - [Node pool taints](#node-pool-taints) + - [About node auto-replace](#about-node-auto-replace) + - [Enabling node auto-replace](#enabling-node-auto-replace) + - [Disabling node auto-replace](#disabling-node-auto-replace) + - [Cloud credentials](#cloud-credentials) + - [Node drivers](#node-drivers) +- [RKE2 Clusters](#rke2-clusters) + - [Node roles in RKE2](#node-roles-in-rke2) + +When you create an RKE or RKE2 cluster using a node template in Rancher, each resulting node pool is shown in a new **Machine Pools** tab. You can see the machine pools by doing the following: + +1. Click **☰ > Cluster Management**. +1. Click the name of the RKE or RKE2 cluster. + +## RKE Clusters + Using Rancher, you can create pools of nodes based on a [node template]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/#node-templates). This node template defines the parameters you want to use to launch nodes in your infrastructure providers or cloud providers. One benefit of installing Kubernetes on node pools hosted by an infrastructure provider is that if a node loses connectivity with the cluster, Rancher can automatically create another node to join the cluster to ensure that the count of the node pool is as expected. The available cloud providers to create a node template are decided based on active [node drivers]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/#node-drivers). -This section covers the following topics: - -- [Changes in Rancher v2.6](#changes-in-rancher-v2-6) -- [Node templates](#node-templates) - - [Node labels](#node-labels) - - [Node taints](#node-taints) - - [Administrator control of node templates](#administrator-control-of-node-templates) -- [Node pools](#node-pools) - - [Node pool taints](#node-pool-taints) - - [About node auto-replace](#about-node-auto-replace) - - [Enabling node auto-replace](#enabling-node-auto-replace) - - [Disabling node auto-replace](#disabling-node-auto-replace) -- [Cloud credentials](#cloud-credentials) -- [Node drivers](#node-drivers) -- [Node roles in RKE2](#node-roles-in-rke2) - -# Changes in Rancher v2.6 - -_Tech Preview_ - -Rancher v2.6 introduces provisioning for [RKE2](https://docs.rke2.io/) clusters directly from the Rancher UI. RKE2, also known as RKE Government, is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector. - -When you create an RKE or RKE2 cluster using a node template in Rancher, each resulting node pool is shown in a new **Machine Pools** tab. You can see the machine pools by doing the following: - -1. Click **☰ > Cluster Management**. -1. Click the name of the RKE or RKE2 cluster. - -# Node Templates +### Node Templates A node template is the saved configuration for the parameters to use when provisioning nodes in a specific cloud provider. These nodes can be launched from the UI. Rancher uses [Docker Machine](https://docs.docker.com/machine/) to provision these nodes. The available cloud providers to create node templates are based on the active node drivers in Rancher. After you create a node template in Rancher, it's saved so that you can use this template again to create node pools. Node templates are bound to your login. After you add a template, you can remove them from your user profile. -### Node Labels +#### Node Labels You can add [labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) on each node template, so that any nodes created from the node template will automatically have these labels on them. Invalid labels can prevent upgrades or can prevent Rancher from starting. For details on label syntax requirements, see the [Kubernetes documentation.](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set) -### Node Taints +#### Node Taints You can add [taints](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/) on each node template, so that any nodes created from the node template will automatically have these taints on them. Since taints can be added at a node template and node pool, if there is no conflict with the same key and effect of the taints, all taints will be added to the nodes. If there are taints with the same key and different effect, the taints from the node pool will override the taints from the node template. -### Administrator Control of Node Templates +#### Administrator Control of Node Templates Administrators can control all node templates. Admins can now maintain all the node templates within Rancher. When a node template owner is no longer using Rancher, the node templates created by them can be managed by administrators so the cluster can continue to be updated and maintained. @@ -65,7 +62,7 @@ To access all node templates, an administrator will need to do the following: **Result:** All node templates are listed. The templates can be edited or cloned by clicking the **⋮**. -# Node Pools +### Node Pools Using Rancher, you can create pools of nodes based on a [node template](#node-templates). @@ -83,7 +80,7 @@ The recommended setup is to have: - a node pool with the control plane node role and a count of at least two - a node pool with the worker node role and a count of at least two -### Node Pool Taints +#### Node Pool Taints If you haven't defined [taints](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/) on your node template, you can add taints for each node pool. The benefit of adding taints at a node pool is beneficial over adding it at a node template is that you can swap out the node templates without worrying if the taint is on the node template. @@ -91,7 +88,7 @@ For each taint, they will automatically be added to any created node in the node When there are taints on the node pool and node template, if there is no conflict with the same key and effect of the taints, all taints will be added to the nodes. If there are taints with the same key and different effect, the taints from the node pool will override the taints from the node template. -### About Node Auto-replace +#### About Node Auto-replace If a node is in a node pool, Rancher can automatically replace unreachable nodes. Rancher will use the existing node template for the given node pool to recreate the node if it becomes inactive for a specified number of minutes. @@ -99,7 +96,7 @@ If a node is in a node pool, Rancher can automatically replace unreachable nodes Node auto-replace works on top of the Kubernetes node controller. The node controller periodically checks the status of all the nodes (configurable via the `--node-monitor-period` flag of the `kube-controller`). When a node is unreachable, the node controller will taint that node. When this occurs, Rancher will begin its deletion countdown. You can configure the amount of time Rancher waits to delete the node. If the taint is not removed before the deletion countdown ends, Rancher will proceed to delete the node object. Rancher will then provision a node in accordance with the set quantity of the node pool. -### Enabling Node Auto-replace +#### Enabling Node Auto-replace When you create the node pool, you can specify the amount of time in minutes that Rancher will wait to replace an unresponsive node. @@ -109,7 +106,7 @@ When you create the node pool, you can specify the amount of time in minutes tha **Result:** Node auto-replace is enabled for the node pool. -### Disabling Node Auto-replace +#### Disabling Node Auto-replace You can disable node auto-replace from the Rancher UI with the following steps: @@ -120,7 +117,7 @@ You can disable node auto-replace from the Rancher UI with the following steps: **Result:** Node auto-replace is disabled for the node pool. -# Cloud Credentials +### Cloud Credentials Node templates can use cloud credentials to store credentials for launching nodes in your cloud provider, which has some benefits: @@ -132,11 +129,15 @@ Node templates can use cloud credentials to store credentials for launching node After cloud credentials are created, the user can start [managing the cloud credentials that they created]({{}}/rancher/v2.6/en/user-settings/cloud-credentials/). -# Node Drivers +### Node Drivers If you don't find the node driver that you want to use, you can see if it is available in Rancher's built-in [node drivers and activate it]({{}}/rancher/v2.6/en/admin-settings/drivers/node-drivers/#activating-deactivating-node-drivers), or you can [add your own custom node driver]({{}}/rancher/v2.6/en/admin-settings/drivers/node-drivers/#adding-custom-node-drivers). -# Node Roles in RKE2 +## RKE2 Clusters + +Rancher v2.6 introduces provisioning for [RKE2](https://docs.rke2.io/) clusters directly from the Rancher UI. RKE2, also known as RKE Government, is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector. + +### Node Roles The RKE2 CLI exposes two roles, `server` and `agent`, which represent the Kubernetes node-roles `etcd` + `control-plane` and `worker` respectively. With RKE2 integration in Rancher v2.6, RKE2 node pools can represent more fine-grained role assignments such that `etcd` and `control-plane` roles can be represented. @@ -145,7 +146,7 @@ The same functionality of using `etcd`, `controlplane` and `worker` nodes is pos In our [recommended cluster architecture]({{}}/rancher/v2.6/en/cluster-provisioning/production/recommended-architecture/), we outline how many nodes of each role clusters should have: - At least three nodes with the role etcd to survive losing one node -- At least two nodes with the role controlplane for master component high availability -- At least two nodes with the role worker for workload rescheduling upon node failure +- At least two nodes with the role `control plane` for master component high availability +- At least two nodes with the role `worker` for workload rescheduling upon node failure The implementation of the three node roles in Rancher means that Rancher managed RKE2 clusters are able to easily leverage all of the same architectural best practices that are recommended for RKE clusters. \ No newline at end of file From 568bb3823b06217fdc55792385cb079a5bc9652d Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Wed, 11 May 2022 14:24:25 -0700 Subject: [PATCH 456/478] Apply feedback --- .../rke-clusters/node-pools/ec2/_index.md | 32 ++----------------- .../ec2/ec2-machine-config/_index.md | 5 +-- 2 files changed, 6 insertions(+), 31 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md index 91a1343c46d..26d8d3c4576 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md @@ -74,6 +74,8 @@ Add one or more node pools to your cluster. For more information about node pool ### 1. Create your cloud credentials +If you already have a set of cloud credentials to use, skip this section. + 1. Click **☰ > Cluster Management**. 1. Click **Cloud Credentials**. 1. Click **Create**. @@ -91,6 +93,7 @@ Add one or more node pools to your cluster. For more information about node pool 1. On the **Clusters** page, click **Create**. 1. Toggle the switch to **RKE2/K3s**. 1. Click **Amazon EC2**. +1. Select a **Cloud Credential**, if more than one exists. Otherwise, it's preselected. 1. Enter a **Cluster Name**. 1. Create a machine pool for each Kubernetes role. Refer to the [best practices]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools#node-roles-in-rke2) for recommendations on role assignments and counts. 1. For each machine pool, define the machine configuration. Refer to [the EC2 machine configuration reference]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/ec2-machine-config/) for information on configuration options. @@ -98,35 +101,6 @@ Add one or more node pools to your cluster. For more information about node pool 1. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user. 1. Click **Create**. -{{% /tab %}} -{{% tab "RKE2 - Cluster Template" %}} - -### 1. Create your cloud credentials - -1. Click **☰ > Cluster Management**. -1. Click **Cloud Credentials**. -1. Click **Create**. -1. Click **Amazon**. -1. Enter a name for the cloud credential. -1. In the **Default Region** field, select the AWS region where your cluster nodes will be located. -1. Enter your AWS EC2 **Access Key** and **Secret Key**. -1. Click **Create**. - -### 2. Add your cluster template - -1. Follow these [instructions]({{}}/rancher/v2.6/en/admin-settings/cluster-templates/#adding-a-cluster-template-to-rancher) to add a cluster template to Rancher. - -### 3. Create your cluster using a cluster template - -1. Click **☰ > Cluster Management**. -1. Under the **Use a Catalog Template to create a cluster** section, click **catalog-template**. -1. Enter a name for the cluster. -1. Select cloud credentials to use. -1. Select the **Infrastructure Provider**. If you are using Rancher's [example cluster templates](https://github.com/rancher/cluster-template-examples), select `amazonec2`. -1. Choose a **Kubernetes Version**. -1. Configure your nodepools. For help with configurations, refer to the [EC2 Node Template Configuration](./ec2-node-template-config). -1. Click **Install**. - {{% /tab %}} {{% /tabs %}} diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/ec2-machine-config/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/ec2-machine-config/_index.md index 729406449b5..e7d21027f48 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/ec2-machine-config/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/ec2-machine-config/_index.md @@ -3,7 +3,7 @@ title: EC2 Machine Configuration Reference weight: 2 --- -For more details about EC2, nodes, refer to the official documentation for the [EC2 Management Console](https://aws.amazon.com/ec2). +For more details about EC2 nodes, refer to the official documentation for the [EC2 Management Console](https://aws.amazon.com/ec2). ### Region @@ -33,7 +33,7 @@ The name of the [instance profile] used to pass an IAM role to an EC2 instance. ### AMI ID -The [Amazon Machine Image](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html) used to provision your cluster. +The [Amazon Machine Image](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html) used for the nodes in your cluster. ### SSH Username for AMI @@ -76,3 +76,4 @@ Use [Instance Metadata Service Version 2 (IMDSv2)](https://docs.aws.amazon.com/A ### Add Tag Add metadata using [tags](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html) to categorize resources. + From cabbdb337390863b90929bab2606b653b1bd4a86 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Wed, 11 May 2022 14:41:02 -0700 Subject: [PATCH 457/478] Apply feedback --- .../node-pools/digital-ocean/_index.md | 29 ++----------------- 1 file changed, 3 insertions(+), 26 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/_index.md index 06644803c43..7d3e103cd1e 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/_index.md @@ -53,6 +53,8 @@ Creating a [node template]({{}}/rancher/v2.6/en/cluster-provisioning/rk ### 1. Create your cloud credentials +If you already have a set of cloud credentials to use, skip this section. + 1. Click **☰ > Cluster Management**. 1. Click **Cloud Credentials**. 1. Click **Create**. @@ -68,6 +70,7 @@ Use Rancher to create a Kubernetes cluster in DigitalOcean. 1. On the **Clusters** page, click **Create**. 1. Toggle the switch to **RKE2/K3s**. 1. Click **DigitalOcean**. +1. Select a **Cloud Credential**, if more than one exists. Otherwise, it's preselected. 1. Enter a **Cluster Name**. 1. Create a machine pool for each Kubernetes role. Refer to the [best practices]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools#node-roles-in-rke2) for recommendations on role assignments and counts. 1. For each machine pool, define the machine configuration. Refer to the [DigitalOcean machine configuration reference]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/do-machine-config/) for information on configuration options. @@ -75,32 +78,6 @@ Use Rancher to create a Kubernetes cluster in DigitalOcean. 1. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user. 1. Click **Create**. -{{% /tab %}} -{{% tab "RKE2 - Cluster Template" %}} - -### 1. Create your cloud credentials - -1. Click **☰ > Cluster Management**. -1. Click **Cloud Credentials**. -1. Click **Create**. -1. Click **DigitalOcean**. -1. Enter your Digital Ocean credentials. -1. Click **Create**. - -### 2. Add your cluster template - -1. Follow these [instructions]({{}}/rancher/v2.6/en/admin-settings/cluster-templates/#adding-a-cluster-template-to-rancher) to add a cluster template to Rancher. - -### 3. Create your cluster using a cluster template - -1. Click **☰ > Cluster Management**. -1. Under the **Use a Catalog Template to create a cluster** section, click **catalog-template**. -1. Enter a name for the cluster. -1. Select cloud credentials to use. -1. Select the **Infrastructure Provider**. If you are using Rancher's [example cluster templates](https://github.com/rancher/cluster-template-examples), select `digitalocean`. -1. Choose a **Kubernetes Version**. -1. Configure your nodepools. For help with configurations, refer to the [DigitalOcean Node Template Configuration](./do-node-template-config). -1. Click **Install**. {{% /tab %}} {{% /tabs %}} From d664327c2eb8e3b7527729d03568ce0e12b6195d Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Wed, 11 May 2022 14:52:05 -0700 Subject: [PATCH 458/478] Apply feedback --- .../rke-clusters/node-pools/azure/_index.md | 29 ++----------------- 1 file changed, 3 insertions(+), 26 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md index 342c977a835..8e7deb9bf62 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md @@ -89,6 +89,8 @@ Use Rancher to create a Kubernetes cluster in Azure. ### 1. Create your cloud credentials +If you already have a set of cloud credentials to use, skip this section. + 1. Click **☰ > Cluster Management**. 1. Click **Cloud Credentials**. 1. Click **Create**. @@ -106,6 +108,7 @@ Use Rancher to create a Kubernetes cluster in Azure. 1. On the **Clusters** page, click **Create**. 1. Toggle the switch to **RKE2/K3s**. 1. Click **Azure**. +1. Select a **Cloud Credential**, if more than one exists. Otherwise, it's preselected. 1. Enter a **Cluster Name**. 1. Create a machine pool for each Kubernetes role. Refer to the [best practices]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools#node-roles-in-rke2) for recommendations on role assignments and counts. 1. For each machine pool, define the machine configuration. Refer to the [Azure machine configuration reference]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/azure-machine-config/) for information on configuration options. @@ -114,32 +117,6 @@ Use Rancher to create a Kubernetes cluster in Azure. 1. Click **Create**. {{% /tab %}} -{{% tab "RKE2 - Cluster Template" %}} - -### 1. Create your cloud credentials - -1. Click **☰ > Cluster Management**. -1. Click **Cloud Credentials**. -1. Click **Create**. -1. Click **Azure**. -1. Enter your Azure credentials. -1. Click **Create**. - -### 2. Add your cluster template - -1. Follow these [instructions]({{}}/rancher/v2.6/en/admin-settings/cluster-templates/#adding-a-cluster-template-to-rancher) to add a cluster template to Rancher. - -### 3. Create your cluster using a cluster template - -1. Click **☰ > Cluster Management**. -1. Under the **Use a Catalog Template to create a cluster** section, click **catalog-template**. -1. Enter a name for the cluster. -1. Select cloud credentials to use. -1. Select the **Infrastructure Provider**. If you are using Rancher's [example cluster templates](https://github.com/rancher/cluster-template-examples), select `azure`. -1. Choose a **Kubernetes Version**. -1. Configure your nodepools. For help with configurations, refer to [Azure Node Template Configuration.](./azure-node-template-config) -1. Click **Install**. - {{% /tabs %}} **Result:** From 95ef4af25166a8a264de9488313dc5430b0b8a50 Mon Sep 17 00:00:00 2001 From: Caleb Bron Date: Tue, 3 May 2022 06:43:21 -0700 Subject: [PATCH 459/478] Update language around scaling cases --- .../rancher/v2.0-v2.4/en/installation/requirements/_index.md | 5 +++-- content/rancher/v2.5/en/installation/requirements/_index.md | 4 ++-- content/rancher/v2.6/en/installation/requirements/_index.md | 4 ++-- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/content/rancher/v2.0-v2.4/en/installation/requirements/_index.md b/content/rancher/v2.0-v2.4/en/installation/requirements/_index.md index ef77bd8dd89..fbf442d663e 100644 --- a/content/rancher/v2.0-v2.4/en/installation/requirements/_index.md +++ b/content/rancher/v2.0-v2.4/en/installation/requirements/_index.md @@ -78,7 +78,8 @@ Performance increased in Rancher v2.4.0. For the requirements of Rancher before | X-Large | Up to 1000 | Up to 10,000 | 16 | 64 GB | | XX-Large | Up to 2000 | Up to 20,000 | 32 | 128 GB | -[Contact Rancher](https://rancher.com/contact/) for more than 2000 clusters and/or 20,000 nodes. +Every use case and environment is different. Please [contact Rancher](https://rancher.com/contact/) to review yours. + {{% /tab %}} {{% tab "K3s" %}} @@ -93,7 +94,7 @@ These requirements apply to each host in a [K3s Kubernetes cluster where the Ran | X-Large | Up to 1000 | Up to 10,000 | 16 | 64 GB | 2 cores, 4 GB + 1000 IOPS | | XX-Large | Up to 2000 | Up to 20,000 | 32 | 128 GB | 2 cores, 4 GB + 1000 IOPS | -[Contact Rancher](https://rancher.com/contact/) for more than 2000 clusters and/or 20,000 nodes. +Every use case and environment is different. Please [contact Rancher](https://rancher.com/contact/) to review yours. {{% /tab %}} diff --git a/content/rancher/v2.5/en/installation/requirements/_index.md b/content/rancher/v2.5/en/installation/requirements/_index.md index 3c8c1dd3f20..41eda67564e 100644 --- a/content/rancher/v2.5/en/installation/requirements/_index.md +++ b/content/rancher/v2.5/en/installation/requirements/_index.md @@ -126,7 +126,7 @@ These requirements apply to RKE Kubernetes clusters, as well as to hosted Kubern | X-Large | Up to 1000 | Up to 10,000 | 16 | 64 GB | | XX-Large | Up to 2000 | Up to 20,000 | 32 | 128 GB | -[Contact Rancher](https://rancher.com/contact/) for more than 2000 clusters and/or 20,000 nodes. +Every use case and environment is different. Please [contact Rancher](https://rancher.com/contact/) to review yours. ### K3s Kubernetes @@ -140,7 +140,7 @@ These CPU and memory requirements apply to each host in a [K3s Kubernetes cluste | X-Large | Up to 1000 | Up to 10,000 | 16 | 64 GB | 2 cores, 4 GB + 1000 IOPS | | XX-Large | Up to 2000 | Up to 20,000 | 32 | 128 GB | 2 cores, 4 GB + 1000 IOPS | -[Contact Rancher](https://rancher.com/contact/) for more than 2000 clusters and/or 20,000 nodes. +Every use case and environment is different. Please [contact Rancher](https://rancher.com/contact/) to review yours. ### RancherD diff --git a/content/rancher/v2.6/en/installation/requirements/_index.md b/content/rancher/v2.6/en/installation/requirements/_index.md index c60d529b881..6cc10d26f71 100644 --- a/content/rancher/v2.6/en/installation/requirements/_index.md +++ b/content/rancher/v2.6/en/installation/requirements/_index.md @@ -110,7 +110,7 @@ These requirements apply to RKE Kubernetes clusters, as well as to hosted Kubern | X-Large | Up to 1000 | Up to 10,000 | 16 | 64 GB | | XX-Large | Up to 2000 | Up to 20,000 | 32 | 128 GB | -[Contact Rancher](https://rancher.com/contact/) for more than 2000 clusters and/or 20,000 nodes. +Every use case and environment is different. Please [contact Rancher](https://rancher.com/contact/) to review yours. ### K3s Kubernetes @@ -124,7 +124,7 @@ These CPU and memory requirements apply to each host in a [K3s Kubernetes cluste | X-Large | Up to 1000 | Up to 10,000 | 16 | 64 GB | 2 cores, 4 GB + 1000 IOPS | | XX-Large | Up to 2000 | Up to 20,000 | 32 | 128 GB | 2 cores, 4 GB + 1000 IOPS | -[Contact Rancher](https://rancher.com/contact/) for more than 2000 clusters and/or 20,000 nodes. +Every use case and environment is different. Please [contact Rancher](https://rancher.com/contact/) to review yours. ### RKE2 Kubernetes From dafbd72a47734aed27fbdb466bef22ffccd8432e Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Wed, 11 May 2022 16:15:42 -0700 Subject: [PATCH 460/478] Fix typo --- .../rke-clusters/node-pools/ec2/ec2-machine-config/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/ec2-machine-config/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/ec2-machine-config/_index.md index e7d21027f48..d29a7567669 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/ec2-machine-config/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/ec2-machine-config/_index.md @@ -23,7 +23,7 @@ Configure the size (in GB) for your [root device](https://docs.aws.amazon.com/AW ### VPC/Subnet -The [VPC](https://docs.aws.amazon.com/vpc/latest/userguide/configure-your-vpc.html) or specific [subnet](https://docs.aws.amazon.com/vpc/latest/userguide/configure-subnets.html), an IP range in your VPC, to your resources to. +The [VPC](https://docs.aws.amazon.com/vpc/latest/userguide/configure-your-vpc.html) or specific [subnet](https://docs.aws.amazon.com/vpc/latest/userguide/configure-subnets.html), an IP range in your VPC, to add your resources to. ### IAM Instance Profile Name From ac1bb4ccf1290bb4d198e684dd7be15395fda937 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Wed, 11 May 2022 19:13:30 -0700 Subject: [PATCH 461/478] Add dual-stack to RKE2 config --- .../rke2-config-reference/_index.md | 24 ++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md b/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md index 7211d96d859..3e1ee54d5db 100644 --- a/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md @@ -41,6 +41,14 @@ Out of the box, Rancher is compatible with the following network providers: For more details on the different networking providers and how to configure them, please view our [RKE2 documentation](https://docs.rke2.io/install/network_options/). +##### Dual-stack Networking + +[Dual-stack](https://docs.rke2.io/install/network_options/#dual-stack-configuration) networking is supported for all CNI providers. To configure RKE2 in dual-stack mode, set valid IPv4/IPv6 CIDRs for your [Cluster CIDR](#cluster-cidr) and/or [Service CIDR](#service-cidr). + +###### Additional Configuration {#dual-stack-additional-config} + +When using `cilium` or `multus,cilium` as your container network interface provider, ensure the **Enable IPv6 Support** option is also enabled. + #### Cloud Provider You can configure a [Kubernetes cloud provider]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/cloud-providers). If you want to use dynamically provisioned [volumes and storage]({{}}/rancher/v2.6/en/cluster-admin/volumes-and-storage/) in Kubernetes, typically you must select the specific cloud provider in order to use it. For example, if you want to use Amazon EBS, you would need to select the `aws` cloud provider. @@ -103,12 +111,24 @@ Option to choose whether to expose etcd metrics to the public or only within the #### Cluster CIDR -IPv4/IPv6 network CIDRs to use for pod IPs (default: 10.42.0.0/16). +IPv4 and/or IPv6 network CIDRs to use for pod IPs (default: 10.42.0.0/16). + +##### Dual-stack Networking + +To configure [dual-stack](https://docs.rke2.io/install/network_options/#dual-stack-configuration) mode, enter a valid IPv4/IPv6 CIDR. For example `10.42.0.0/16,2001:cafe:42:0::/56`. + +[Additional configuration](#dual-stack-additional-config) is required when using `cilium` or `multus,cilium` as your [container network](#container-network) interface provider. #### Service CIDR IPv4/IPv6 network CIDRs to use for service IPs (default: 10.43.0.0/16). +##### Dual-stack Networking + +To configure [dual-stack](https://docs.rke2.io/install/network_options/#dual-stack-configuration) mode, enter a valid IPv4/IPv6 CIDR. For example `10.42.0.0/16,2001:cafe:42:0::/56`. + +[Additional configuration](#dual-stack-additional-config) is required when using `cilium ` or `multus,cilium` as your [container network](#container-network) interface provider. + #### Cluster DNS IPv4 Cluster IP for coredns service. Should be in your service-cidr range (default: 10.43.0.10). @@ -166,5 +186,3 @@ Option to set kubelet options for different nodes. For available options, refer Instead of using the Rancher UI forms to choose Kubernetes options for the cluster, advanced users can create an RKE2 config file. Using a config file allows you to set any of the [options](https://docs.rke2.io/install/install_options/install_options) available in an RKE2 installation. To edit an RKE2 config file directly from the Rancher UI, click **Edit as YAML**. - - From 4444e6dd68f379aa36483e4bc7de524f3fd5523d Mon Sep 17 00:00:00 2001 From: Nuno do Carmo Date: Thu, 12 May 2022 13:33:56 +0200 Subject: [PATCH 462/478] Applied suggestion from anupama2501 --- .../rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md index cd160113aa2..931311dee70 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md @@ -57,7 +57,7 @@ RKE2 provisioning is built on top of a new provisioning framework that leverages - Fully configure RKE2 clusters within Rancher - Choose CNI options Calico, Cilium, and Multus in addition to Canal -The RKE2 provisioning also includes installing RKE2 on Windows clusters. Windows features for RKE2 include: +The RKE2 provisioning also includes installing RKE2 on clusters with Windows nodes. Windows features for RKE2 include: - Windows Containers with RKE2 powered by ContainerD - Added provisioning of Windows RKE2 custom clusters directly from the Rancher UI From cb2e360178c96dbcbdb61034de6eab160d72becb Mon Sep 17 00:00:00 2001 From: Nuno do Carmo Date: Thu, 12 May 2022 15:54:08 +0200 Subject: [PATCH 463/478] Added note for RKE2 Cluster template --- .../en/cluster-provisioning/rke-clusters/node-pools/_index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/_index.md index 0fecd8264e2..49a0173f123 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/_index.md @@ -137,6 +137,8 @@ If you don't find the node driver that you want to use, you can see if it is ava Rancher v2.6 introduces provisioning for [RKE2](https://docs.rke2.io/) clusters directly from the Rancher UI. RKE2, also known as RKE Government, is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector. +> **Note:** For RKE2 cluster templates, please refer to [this page]({{}}/rancher/v2.6/en/admin-settings/cluster-templates/#rke2-cluster-template) for additional information. + ### Node Roles The RKE2 CLI exposes two roles, `server` and `agent`, which represent the Kubernetes node-roles `etcd` + `control-plane` and `worker` respectively. With RKE2 integration in Rancher v2.6, RKE2 node pools can represent more fine-grained role assignments such that `etcd` and `control-plane` roles can be represented. From 3d66905b1a0ac3f2f5224a2dbe50fb2edec96979 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Thu, 12 May 2022 15:01:22 -0400 Subject: [PATCH 464/478] Updated per feedback --- .../rke-clusters/_index.md | 23 +++++++++---------- .../rke-clusters/node-pools/_index.md | 14 +++++------ 2 files changed, 18 insertions(+), 19 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md index 931311dee70..28fd974c021 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md @@ -3,7 +3,7 @@ title: Launching Kubernetes with Rancher weight: 4 --- -You can have Rancher launch a Kubernetes cluster using any nodes you want. When Rancher deploys Kubernetes onto these nodes, you can choose between [Rancher Kubernetes Engine]({{}}/rke/latest/en/) (RKE), which is Rancher's own lightweight Kubernetes installer, or [RKE2](https://docs.rke2.io). It can launch Kubernetes on any computers, including: +You can have Rancher launch a Kubernetes cluster using any nodes you want. When Rancher deploys Kubernetes onto these nodes, you can choose between [Rancher Kubernetes Engine]({{}}/rke/latest/en/) (RKE) or [RKE2](https://docs.rke2.io) distributions. Rancher can launch Kubernetes on any computers, including: - Bare-metal servers - On-premise virtual machines @@ -13,8 +13,6 @@ Rancher can install Kubernetes on existing nodes, or it can dynamically provisio Rancher can also create pools of nodes. One benefit of installing Kubernetes on node pools hosted by an infrastructure provider is that if a node loses connectivity with the cluster, Rancher can automatically create another node to join the cluster to ensure that the count of the node pool is as expected. -RKE/RKE2 clusters include clusters that Rancher launched on Windows nodes or other existing custom nodes, as well as clusters that Rancher launched with new nodes on Azure, Digital Ocean, EC2, vSphere, Linode or Harvester. - ## RKE ### Requirements @@ -43,7 +41,9 @@ The most common way to programmatically deploy RKE clusters through Rancher is b ## RKE2 -Rancher v2.6 introduces provisioning for [RKE2](https://docs.rke2.io/) clusters directly from the Rancher UI. RKE2, also known as RKE Government, is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector. +Rancher v2.6 introduced provisioning for [RKE2](https://docs.rke2.io/) clusters directly from the Rancher UI. RKE2, also known as RKE Government, is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector. In Rancher v.2.6.4 and earlier, RKE2 provisioning was in tech preview. + +Note that in Rancher v2.6.5, RKE2 provisioning became GA. ### Requirements @@ -53,16 +53,17 @@ If you use RKE2 to set up a cluster, your nodes must meet the [requirements](htt RKE2 provisioning is built on top of a new provisioning framework that leverages the upstream [Cluster API](https://github.com/kubernetes-sigs/cluster-api) project. With this new provisioning framework, you can: -- Provision RKE2 clusters on Digital Ocean, AWS EC2, Azure, and vSphere +- Provision RKE2 clusters onto any provider for which Rancher has a node driver - Fully configure RKE2 clusters within Rancher - Choose CNI options Calico, Cilium, and Multus in addition to Canal -The RKE2 provisioning also includes installing RKE2 on clusters with Windows nodes. Windows features for RKE2 include: +RKE2 provisioning also includes installing RKE2 on clusters with Windows nodes. **Note that currently Windows nodes are only supported on custom clusters.** -- Windows Containers with RKE2 powered by ContainerD -- Added provisioning of Windows RKE2 custom clusters directly from the Rancher UI +Windows features for RKE2 include: + +- Windows Containers with RKE2 powered by containerd +- Provisioning of Windows RKE2 custom clusters directly from the Rancher UI - Calico CNI for Windows RKE2 custom clusters -- SAC releases of Windows Server (2004 and 20H2) are included in the technical preview Windows Support for RKE2 Custom Clusters requires choosing Calico as the CNI. @@ -70,9 +71,7 @@ Windows Support for RKE2 Custom Clusters requires choosing Calico as the CNI. RKE2 provisioning also allows you to install custom clusters on pre-provisioned VMs or bare-metal nodes. -If you want to reuse a node from a previous custom cluster, [clean the node]({{}}/rancher/v2.6/en/cluster-admin/cleaning-cluster-nodes/) before using it in a cluster again. If you reuse a node that hasn't been cleaned, cluster provisioning may fail. - -For more information, refer to the section on [custom nodes.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/custom-nodes/) +If you want to reuse a node from a previous custom cluster, clean the node before using it in a cluster again. If you reuse a node that hasn't been cleaned, cluster provisioning may fail. # Programmatically Creating RKE2 Clusters diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/_index.md index 49a0173f123..1de5cadd416 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/_index.md @@ -72,12 +72,12 @@ The benefit of using a node pool is that if a node is destroyed or deleted, you Each node pool must have one or more nodes roles assigned. -Each node role (i.e. etcd, control plane, and worker) should be assigned to a distinct node pool. Although it is possible to assign multiple node roles to a node pool, this should not be done for production clusters. +Each node role (i.e. etcd, controlplane, and worker) should be assigned to a distinct node pool. Although it is possible to assign multiple node roles to a node pool, this should not be done for production clusters. The recommended setup is to have: - a node pool with the etcd node role and a count of three -- a node pool with the control plane node role and a count of at least two +- a node pool with the controlplane node role and a count of at least two - a node pool with the worker node role and a count of at least two #### Node Pool Taints @@ -141,14 +141,14 @@ Rancher v2.6 introduces provisioning for [RKE2](https://docs.rke2.io/) clusters ### Node Roles -The RKE2 CLI exposes two roles, `server` and `agent`, which represent the Kubernetes node-roles `etcd` + `control-plane` and `worker` respectively. With RKE2 integration in Rancher v2.6, RKE2 node pools can represent more fine-grained role assignments such that `etcd` and `control-plane` roles can be represented. +The RKE2 CLI exposes two roles, `server` and `agent`, which represent the Kubernetes node-roles `etcd` + `controlplane` and `worker` respectively. With RKE2 integration in Rancher v2.6, RKE2 node pools can represent more fine-grained role assignments such that `etcd` and `controlplane` roles can be represented. The same functionality of using `etcd`, `controlplane` and `worker` nodes is possible in the RKE2 CLI by using flags and node tainting to control where workloads and the Kubernetes master were scheduled. The reason those roles were not implemented as first-class roles in the RKE2 CLI is that RKE2 is conceptualized as a set of raw building blocks that are best leveraged through an orchestration system such as Rancher. +The implementation of the three node roles in Rancher means that Rancher managed RKE2 clusters are able to easily leverage all of the same architectural best practices that are recommended for RKE clusters. + In our [recommended cluster architecture]({{}}/rancher/v2.6/en/cluster-provisioning/production/recommended-architecture/), we outline how many nodes of each role clusters should have: - At least three nodes with the role etcd to survive losing one node -- At least two nodes with the role `control plane` for master component high availability -- At least two nodes with the role `worker` for workload rescheduling upon node failure - -The implementation of the three node roles in Rancher means that Rancher managed RKE2 clusters are able to easily leverage all of the same architectural best practices that are recommended for RKE clusters. \ No newline at end of file +- At least two nodes with the role controlplane for master component high availability +- At least two nodes with the role worker for workload rescheduling upon node failure \ No newline at end of file From 55a5d2cb438424ae22d5c7e4c5a966dd6f7b00b6 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 12 May 2022 12:32:10 -0700 Subject: [PATCH 465/478] Update back restore app steps --- .../en/backups/restoring-rancher/_index.md | 28 +++++++++++-------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md index 468b179d348..cad6c716aa3 100644 --- a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md @@ -3,16 +3,7 @@ title: Restoring Rancher weight: 2 --- -A restore is performed by creating a Restore custom resource. - ---- -**Caution:** Before performing a restore or rollback, note the following: - -- In Rancher v2.6.4, the cluster-api module has been upgraded from v0.4.4 to v1.0.2 in which the apiVersion of CAPI CRDs are upgraded from `cluster.x-k8s.io/v1alpha4` to `cluster.x-k8s.io/v1beta1`. This has the effect of causing rollbacks from Rancher v2.6.4 to any previous version of Rancher v2.6.x to fail because the previous version the CRDs needed to roll back are no longer available in v1beta1. - -- To avoid this, the Rancher resource cleanup scripts should be run **before** the restore or rollback is attempted. Specifically, two scripts have been created to assist you: one to clean up the cluster (`cleanup.sh`), and one to check for any Rancher-related resources in the cluster (`verify.sh`). Details on the cleanup script can be found in the [rancherlabs/support-tools repo](https://github.com/rancherlabs/support-tools/tree/master/cleanup-rancher-k8s-resources). - ---- +A restore is performed by creating a Restore custom resource. > **Important** > @@ -22,6 +13,21 @@ A restore is performed by creating a Restore custom resource. ### Create the Restore Custom Resource +#### Additional Steps for Rollbacks with Rancher v2.6.4+ + +In Rancher v2.6.4, the cluster-api module has been upgraded from v0.4.4 to v1.0.2 in which the apiVersion of CAPI CRDs are upgraded from `cluster.x-k8s.io/v1alpha4` to `cluster.x-k8s.io/v1beta1`. This has the effect of causing rollbacks from Rancher v2.6.4 to any previous version of Rancher v2.6.x to fail because the previous version the CRDs needed to roll back are no longer available in v1beta1. + +To avoid this, the Rancher resource cleanup scripts should be run **before** the restore or rollback is attempted. Specifically, two scripts have been created to assist you: one to clean up the cluster (`cleanup.sh`), and one to check for any Rancher-related resources in the cluster (`verify.sh`). Details on the cleanup script can be found in the [rancherlabs/support-tools repo](https://github.com/rancherlabs/support-tools/tree/master/rancher-cleanup). + +The additional preparations: + +1. Follow these [instructions](https://github.com/rancherlabs/support-tools/blob/master/rancher-cleanup/README.md) to run the scripts. +1. Follow these [instructions](https://rancher.com/docs/rancher/v2.6/en/backups/migrating-rancher/) to install the rancher-backup Helm chart on the existing cluster and restore the previous state. + 1. Omit Step 3. + 1. When Step 4 is reached, install the required Rancher v2.6.x version on the local cluster you intend to roll back to + +#### Create the Restore Custom Resource + 1. In the upper left corner, click **☰ > Cluster Management**. 1. On the **Clusters** page, go to the `local` cluster and click **Explore**. The `local` cluster runs the Rancher server. 1. In the left navigation bar, click **Rancher Backups > Restores**. @@ -74,6 +80,6 @@ In some cases, after restoring the backup, Rancher logs will show errors similar ``` 2021/10/05 21:30:45 [ERROR] error syncing 'c-89d82/m-4067aa68dd78': handler rke-worker-upgrader: clusters.management.cattle.io "c-89d82" not found, requeuing ``` -This happens because one of the resources that was just restored has finalizers but the related resources have been deleted so the handler cannot find it. +This happens because one of the resources that was just restored has finalizers but the related resources have been deleted so the handler cannot find it. To eliminate the errors, we need to find and delete the resource that causes the error. See more information [here](https://github.com/rancher/rancher/issues/35050#issuecomment-937968556) From 3d3fe53fa6f06fd151b00bd448cef7dd5d690661 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 12 May 2022 13:14:48 -0700 Subject: [PATCH 466/478] Apply suggestions from code review Co-authored-by: Jen Travinski --- content/rancher/v2.6/en/backups/restoring-rancher/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md index cad6c716aa3..644986371cd 100644 --- a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md @@ -24,7 +24,7 @@ The additional preparations: 1. Follow these [instructions](https://github.com/rancherlabs/support-tools/blob/master/rancher-cleanup/README.md) to run the scripts. 1. Follow these [instructions](https://rancher.com/docs/rancher/v2.6/en/backups/migrating-rancher/) to install the rancher-backup Helm chart on the existing cluster and restore the previous state. 1. Omit Step 3. - 1. When Step 4 is reached, install the required Rancher v2.6.x version on the local cluster you intend to roll back to + 1. When Step 4 is reached, install the required Rancher v2.6.x version on the local cluster you intend to roll back to. #### Create the Restore Custom Resource @@ -80,6 +80,6 @@ In some cases, after restoring the backup, Rancher logs will show errors similar ``` 2021/10/05 21:30:45 [ERROR] error syncing 'c-89d82/m-4067aa68dd78': handler rke-worker-upgrader: clusters.management.cattle.io "c-89d82" not found, requeuing ``` -This happens because one of the resources that was just restored has finalizers but the related resources have been deleted so the handler cannot find it. +This happens because one of the resources that was just restored has finalizers, but the related resources have been deleted so the handler cannot find it. To eliminate the errors, we need to find and delete the resource that causes the error. See more information [here](https://github.com/rancher/rancher/issues/35050#issuecomment-937968556) From 52949fea225db8859efb0c9726934aee7e6bae04 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 12 May 2022 14:01:49 -0700 Subject: [PATCH 467/478] Update feature chart versions. Add Neuvector --- content/rancher/v2.6/en/helm-charts/_index.md | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/content/rancher/v2.6/en/helm-charts/_index.md b/content/rancher/v2.6/en/helm-charts/_index.md index 68f8c757fcd..c15af98f328 100644 --- a/content/rancher/v2.6/en/helm-charts/_index.md +++ b/content/rancher/v2.6/en/helm-charts/_index.md @@ -18,20 +18,21 @@ Starting in Rancher v2.6.0, a new versioning scheme for Rancher feature charts w | **Name** | **Supported Minimum Version** | **Supported Maximum Version** | | ---------------- | ------------ | ------------ | | external-ip-webhook | 100.0.0+up1.0.0 | 100.0.1+up1.0.1 | -| harvester-cloud-provider | 100.0.0+up0.1.8 | 100.0.0+up0.1.8 | -| harvester-csi-driver | 100.0.0+up0.1.9 | 100.0.0+up0.1.9 | +| harvester-cloud-provider | 100.0.2+up0.1.12 | 100.0.2+up0.1.12 | +| harvester-csi-driver | 100.0.2+up0.1.11 | 100.0.2+up0.1.11 | | rancher-alerting-drivers | 100.0.0 | 100.0.1 | -| rancher-backups | 2.0.0 | 2.1.0 | -| rancher-cis-benchmark | 2.0.0 | 2.0.2 | -| rancher-gatekeeper | 100.0.0+up3.5.1 | 100.0.1+up3.6.0 | -| rancher-istio | 100.0.0+up1.10.4 | 100.1.0+up1.11.4 | -| rancher-logging | 100.0.0+up3.12.0 | 100.0.1+up3.15.0 | +| rancher-backup | 2.0.0 | 2.1.2 | +| rancher-cis-benchmark | 2.0.0 | 2.0.4 | +| rancher-gatekeeper | 100.0.0+up3.5.1 | 100.1.0+up3.7.1 | +| rancher-istio | 100.0.0+up1.10.4 | 100.2.0+up1.12.6 | +| rancher-logging | 100.0.0+up3.12.0 | 100.1.2+up3.17.4 | | rancher-longhorn | 100.0.0+up1.1.2 | 100.1.1+up1.2.3 | | rancher-monitoring | 100.0.0+up16.6.0 | 100.1.0+up19.0.3 -| rancher-sriov (experimental) | 100.0.0+up0.1.0 | 100.0.1+up0.1.0 | -| rancher-vsphere-cpi | 100.0.0 | 100.1.0+up1.0.100 -| rancher-vsphere-csi | 100.0.0 | 100.1.0+up2.3.0 | +| rancher-sriov (experimental) | 100.0.0+up0.1.0 | 100.0.3+up0.1.0 | +| rancher-vsphere-cpi | 100.0.0 | 100.3.0+up1.2.1 | +| rancher-vsphere-csi | 100.0.0 | 100.3.0+up2.5.1-rancher1 | | rancher-wins-upgrader | 100.0.0+up0.0.1 | 100.0.0+up0.0.1 | +| neuvector | 100.0.0+up2.2.0 | 100.0.0+up2.2.0 |
      **Charts based on upstream:** For charts that are based on upstreams, the +up annotation should inform you of what upstream version the Rancher chart is tracking. Check the upstream version compatibility with Rancher during upgrades also. From 7fb7f8c7e24093b47cc25b01c6b997648e1dcd31 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 12 May 2022 14:04:26 -0700 Subject: [PATCH 468/478] test --- .../v2.6/en/monitoring-alerting/prometheus-federator/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/_index.md b/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/_index.md index 986023efb5d..46d47432504 100644 --- a/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/_index.md +++ b/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/_index.md @@ -3,7 +3,7 @@ title: Prometheus Federator weight: 7 --- -Prometheus Federator deploys a Helm Project Operator (based on the [rancher/helm-project-operator](https://github.com/rancher/helm-project-operator)), an operator that manages deploying Helm charts each containing a Project Monitoring Stack, where each stack contains: +Prometheus Federator, also referred to as Project Monitoring v2, deploys a Helm Project Operator (based on the [rancher/helm-project-operator](https://github.com/rancher/helm-project-operator)), an operator that manages deploying Helm charts each containing a Project Monitoring Stack, where each stack contains: - [Prometheus](https://prometheus.io/) (managed externally by [Prometheus Operator](https://github.com/prometheus-operator/prometheus-operator)) - [Alertmanager](https://prometheus.io/docs/alerting/latest/alertmanager/) (managed externally by [Prometheus Operator](https://github.com/prometheus-operator/prometheus-operator)) From 05de097afe6ba2a5eae6049457a45c32a78f4b5d Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 12 May 2022 14:13:13 -0700 Subject: [PATCH 469/478] Apply feedback --- .../v2.6/en/backups/restoring-rancher/_index.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md index 644986371cd..2ec7691aa79 100644 --- a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md @@ -3,7 +3,7 @@ title: Restoring Rancher weight: 2 --- -A restore is performed by creating a Restore custom resource. +This page outlines how to perform a restore with Rancher. > **Important** > @@ -11,14 +11,14 @@ A restore is performed by creating a Restore custom resource. > * While restoring rancher on the same setup, the operator will scale down the rancher deployment when restore starts, and it will scale back up the deployment once restore completes. So Rancher will be unavailable during the restore. > * If you need to restore Rancher to a previous version after an upgrade, see the [rollback documentation.]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/rollbacks/) -### Create the Restore Custom Resource - -#### Additional Steps for Rollbacks with Rancher v2.6.4+ +### Additional Steps for Rollbacks with Rancher v2.6.4+ In Rancher v2.6.4, the cluster-api module has been upgraded from v0.4.4 to v1.0.2 in which the apiVersion of CAPI CRDs are upgraded from `cluster.x-k8s.io/v1alpha4` to `cluster.x-k8s.io/v1beta1`. This has the effect of causing rollbacks from Rancher v2.6.4 to any previous version of Rancher v2.6.x to fail because the previous version the CRDs needed to roll back are no longer available in v1beta1. To avoid this, the Rancher resource cleanup scripts should be run **before** the restore or rollback is attempted. Specifically, two scripts have been created to assist you: one to clean up the cluster (`cleanup.sh`), and one to check for any Rancher-related resources in the cluster (`verify.sh`). Details on the cleanup script can be found in the [rancherlabs/support-tools repo](https://github.com/rancherlabs/support-tools/tree/master/rancher-cleanup). +> **Caution** Rancher will be down as the `cleanup` script runs as it deletes the resources created by rancher. + The additional preparations: 1. Follow these [instructions](https://github.com/rancherlabs/support-tools/blob/master/rancher-cleanup/README.md) to run the scripts. @@ -26,7 +26,9 @@ The additional preparations: 1. Omit Step 3. 1. When Step 4 is reached, install the required Rancher v2.6.x version on the local cluster you intend to roll back to. -#### Create the Restore Custom Resource +### Create the Restore Custom Resource + +A restore is performed by creating a Restore custom resource. 1. In the upper left corner, click **☰ > Cluster Management**. 1. On the **Clusters** page, go to the `local` cluster and click **Explore**. The `local` cluster runs the Rancher server. From 49b7b59b43d825b75e6c0332ba245ca6b5ff0cd6 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 12 May 2022 14:24:22 -0700 Subject: [PATCH 470/478] Update min versions per feedback --- content/rancher/v2.6/en/helm-charts/_index.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/content/rancher/v2.6/en/helm-charts/_index.md b/content/rancher/v2.6/en/helm-charts/_index.md index c15af98f328..aab00dd91dd 100644 --- a/content/rancher/v2.6/en/helm-charts/_index.md +++ b/content/rancher/v2.6/en/helm-charts/_index.md @@ -20,18 +20,18 @@ Starting in Rancher v2.6.0, a new versioning scheme for Rancher feature charts w | external-ip-webhook | 100.0.0+up1.0.0 | 100.0.1+up1.0.1 | | harvester-cloud-provider | 100.0.2+up0.1.12 | 100.0.2+up0.1.12 | | harvester-csi-driver | 100.0.2+up0.1.11 | 100.0.2+up0.1.11 | -| rancher-alerting-drivers | 100.0.0 | 100.0.1 | -| rancher-backup | 2.0.0 | 2.1.2 | -| rancher-cis-benchmark | 2.0.0 | 2.0.4 | -| rancher-gatekeeper | 100.0.0+up3.5.1 | 100.1.0+up3.7.1 | +| rancher-alerting-drivers | 100.0.0 | 100.0.2 | +| rancher-backup | 2.0.1 | 2.1.2 | +| rancher-cis-benchmark | 2.0.1 | 2.0.4 | +| rancher-gatekeeper | 100.0.0+up3.6.0 | 100.1.0+up3.7.1 | | rancher-istio | 100.0.0+up1.10.4 | 100.2.0+up1.12.6 | | rancher-logging | 100.0.0+up3.12.0 | 100.1.2+up3.17.4 | | rancher-longhorn | 100.0.0+up1.1.2 | 100.1.1+up1.2.3 | | rancher-monitoring | 100.0.0+up16.6.0 | 100.1.0+up19.0.3 | rancher-sriov (experimental) | 100.0.0+up0.1.0 | 100.0.3+up0.1.0 | -| rancher-vsphere-cpi | 100.0.0 | 100.3.0+up1.2.1 | -| rancher-vsphere-csi | 100.0.0 | 100.3.0+up2.5.1-rancher1 | -| rancher-wins-upgrader | 100.0.0+up0.0.1 | 100.0.0+up0.0.1 | +| rancher-vsphere-cpi | 100.3.0+up1.2.1 | 100.3.0+up1.2.1 | +| rancher-vsphere-csi | 100.3.0+up2.5.1-rancher1 | 100.3.0+up2.5.1-rancher1 | +| rancher-wins-upgrader | 0.0.100 | 100.0.0+up0.0.1 | | neuvector | 100.0.0+up2.2.0 | 100.0.0+up2.2.0 |
      From 33867c087397e6ba0efe539ac723e15e9fab791c Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 12 May 2022 15:00:40 -0700 Subject: [PATCH 471/478] Add warning about field type change --- .../configuration/route/_index.md | 20 +++++++++++++++ .../prometheus-federator/_index.md | 25 +++++++++++-------- .../guides/prom-fed-workloads/_index.md | 4 +-- 3 files changed, 37 insertions(+), 12 deletions(-) diff --git a/content/rancher/v2.6/en/monitoring-alerting/configuration/route/_index.md b/content/rancher/v2.6/en/monitoring-alerting/configuration/route/_index.md index 4fc0019c79f..4366f20a9a5 100644 --- a/content/rancher/v2.6/en/monitoring-alerting/configuration/route/_index.md +++ b/content/rancher/v2.6/en/monitoring-alerting/configuration/route/_index.md @@ -42,6 +42,21 @@ The route needs to refer to a [receiver](#receiver-configuration) that has alrea ### Grouping +{{% tabs %}} +{{% tab "Rancher v2.6.5+" %}} + +> **Note** As of Rancher v2.6.5 `Group By` now accepts a list of strings instead of key-value pairs. See the [upstream documentation](https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#route) for details. + +| Field | Default | Description | +|-------|--------------|---------| +| Group By | N/a | List of labels to group by. Labels must not be repeated (unique list). Special label "..." (aggregate by all possible labels), if provided, must be the only element in the list. | +| Group Wait | 30s | How long to wait to buffer alerts of the same group before sending initially. | +| Group Interval | 5m | How long to wait before sending an alert that has been added to a group of alerts for which an initial notification has already been sent. | +| Repeat Interval | 4h | How long to wait before re-sending a given alert that has already been sent. | + +{{% /tab %}} +{{% tab "Rancher before v2.6.5" %}} + | Field | Default | Description | |-------|--------------|---------| | Group By | N/a | The labels by which incoming alerts are grouped together. For example, `[ group_by: '[' , ... ']' ]` Multiple alerts coming in for labels such as `cluster=A` and `alertname=LatencyHigh` can be batched into a single group. To aggregate by all possible labels, use the special value `'...'` as the sole label name, for example: `group_by: ['...']` Grouping by `...` effectively disables aggregation entirely, passing through all alerts as-is. This is unlikely to be what you want, unless you have a very low alert volume or your upstream notification system performs its own grouping. | @@ -49,6 +64,11 @@ The route needs to refer to a [receiver](#receiver-configuration) that has alrea | Group Interval | 5m | How long to wait before sending an alert that has been added to a group of alerts for which an initial notification has already been sent. | | Repeat Interval | 4h | How long to wait before re-sending a given alert that has already been sent. | +{{% /tab %}} +{{% /tabs %}} + + + ### Matching The **Match** field refers to a set of equality matchers used to identify which alerts to send to a given Route based on labels defined on that alert. When you add key-value pairs to the Rancher UI, they correspond to the YAML in this format: diff --git a/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/_index.md b/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/_index.md index 46d47432504..1d61b9b90ca 100644 --- a/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/_index.md +++ b/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/_index.md @@ -21,13 +21,13 @@ Prometheus Federator, also referred to as Project Monitoring v2, deploys a Helm ### What is a Project? -In Prometheus Federator, a Project is a group of namespaces that can be identified by a `metav1.LabelSelector`. By default, the label used to identify projects is `field.cattle.io/projectId`, the label used to identify namespaces that are contained within a given [Rancher](https://rancher.com/) Project. +In Prometheus Federator, a Project is a group of namespaces that can be identified by a `metav1.LabelSelector`. By default, the label used to identify projects is `field.cattle.io/projectId`, the label used to identify namespaces that are contained within a given Rancher Project. ### Configuring the Helm release created by a ProjectHelmChart -The `spec.values` of this ProjectHelmChart resources will correspond to the `values.yaml` override to be supplied to the underlying Helm chart deployed by the operator on the user's behalf; to see the underlying chart's `values.yaml` spec, either: +The `spec.values` of this ProjectHelmChart's resources will correspond to the `values.yaml` override to be supplied to the underlying Helm chart deployed by the operator on the user's behalf; to see the underlying chart's `values.yaml` spec, either: -- View to the chart's definition located at [`rancher/prometheus-federator` under `charts/rancher-project-monitoring`](https://github.com/rancher/prometheus-federator/blob/main/charts/rancher-project-monitoring) (where the chart version will be tied to the version of this operator) +- View the chart's definition located at [`rancher/prometheus-federator` under `charts/rancher-project-monitoring`](https://github.com/rancher/prometheus-federator/blob/main/charts/rancher-project-monitoring) (where the chart version will be tied to the version of this operator). - Look for the ConfigMap named `monitoring.cattle.io.v1alpha1` that is automatically created in each Project Registration Namespace, which will contain both the `values.yaml` and `questions.yaml` that was used to configure the chart (which was embedded directly into the `prometheus-federator` binary). ### Namespaces @@ -36,20 +36,25 @@ As a Project Operator based on [rancher/helm-project-operator](https://github.co 1. **Operator / System Namespace**: this is the namespace that the operator is deployed into (e.g., `cattle-monitoring-system`). This namespace will contain all HelmCharts and HelmReleases for all ProjectHelmCharts watched by this operator. **Only Cluster Admins should have access to this namespace.** 2. **Project Registration Namespace (`cattle-project-`)**: this is the set of namespaces that the operator watches for ProjectHelmCharts within. The RoleBindings and ClusterRoleBindings that apply to this namespace will also be the source of truth for the auto-assigned RBAC created in the Project Release Namespace. For details, refer to the [RBAC page](./rbac/). **Project Owners (admin), Project Members (edit), and Read-Only Members (view) should have access to this namespace**. -> Note: Project Registration Namespaces will be auto-generated by the operator and imported into the Project it is tied to if `.Values.global.cattle.projectLabel` is provided (which is set to `field.cattle.io/projectId` by default); this indicates that a Project Registration Namespace should be created by the operator if at least one namespace is observed with that label. The operator will not let these namespaces be deleted unless either all namespaces with that label are gone (e.g. this is the last namespace in that project, in which case the namespace will be marked with the label `"helm.cattle.io/helm-project-operator-orphaned": "true"`, which signals that it can be deleted) or it is no longer watching that project (because the project ID was provided under `.Values.helmProjectOperator.otherSystemProjectLabelValues`, which serves as a denylist for Projects). These namespaces will also never be auto-deleted to avoid destroying user data; it is recommended that users clean up these namespaces manually if desired on creating or deleting a project -> Note: if `.Values.global.cattle.projectLabel` is not provided, the Operator / System Namespace will also be the Project Registration Namespace + + > **Note:** Project Registration Namespaces will be auto-generated by the operator and imported into the Project it is tied to if `.Values.global.cattle.projectLabel` is provided (which is set to `field.cattle.io/projectId` by default); this indicates that a Project Registration Namespace should be created by the operator if at least one namespace is observed with that label. The operator will not let these namespaces be deleted unless either all namespaces with that label are gone (e.g., this is the last namespace in that project, in which case the namespace will be marked with the label `"helm.cattle.io/helm-project-operator-orphaned": "true"`, which signals that it can be deleted) or it is no longer watching that project (because the project ID was provided under `.Values.helmProjectOperator.otherSystemProjectLabelValues`, which serves as a denylist for Projects). These namespaces will also never be auto-deleted to avoid destroying user data; it is recommended that users clean up these namespaces manually if desired on creating or deleting a project + + > **Note:** if `.Values.global.cattle.projectLabel` is not provided, the Operator / System Namespace will also be the Project Registration Namespace 3. **Project Release Namespace (`cattle-project--monitoring`)**: this is the set of namespaces that the operator deploys Project Monitoring Stacks within on behalf of a ProjectHelmChart; the operator will also automatically assign RBAC to Roles created in this namespace by the Project Monitoring Stack based on bindings found in the Project Registration Namespace. **Only Cluster Admins should have access to this namespace; Project Owners (admin), Project Members (edit), and Read-Only Members (view) will be assigned limited access to this namespace by the deployed Helm Chart and Prometheus Federator.** - > Note: Project Release Namespaces are automatically deployed and imported into the project whose ID is specified under `.Values.helmProjectOperator.projectReleaseNamespaces.labelValue` (which defaults to the value of `.Values.global.cattle.systemProjectId` if not specified) whenever a ProjectHelmChart is specified in a Project Registration Namespace -> Note: Project Release Namespaces follow the same orphaning conventions as Project Registration Namespaces (see note above) -> Note: if `.Values.projectReleaseNamespaces.enabled` is false, the Project Release Namespace will be the same as the Project Registration Namespace + + > **Note:** Project Release Namespaces are automatically deployed and imported into the project whose ID is specified under `.Values.helmProjectOperator.projectReleaseNamespaces.labelValue` (which defaults to the value of `.Values.global.cattle.systemProjectId` if not specified) whenever a ProjectHelmChart is specified in a Project Registration Namespace + + > **Note:** Project Release Namespaces follow the same orphaning conventions as Project Registration Namespaces (see note above) + + > **Note:** if `.Values.projectReleaseNamespaces.enabled` is false, the Project Release Namespace will be the same as the Project Registration Namespace ### Helm Resources (HelmChart, HelmRelease) On deploying a ProjectHelmChart, the Prometheus Federator will automatically create and manage two child custom resources that manage the underlying Helm resources in turn: -- A HelmChart CR (managed via an embedded [k3s-io/helm-contoller](https://github.com/k3s-io/helm-controller) in the operator): this custom resource automatically creates a Job in the same namespace that triggers a `helm install`, `helm upgrade`, or `helm uninstall` depending on the change applied to the HelmChart CR; this CR is automatically updated on changes to the ProjectHelmChart (e.g. modifying the values.yaml) or changes to the underlying Project definition (e.g. adding or removing namespaces from a project). +- A HelmChart CR (managed via an embedded [k3s-io/helm-contoller](https://github.com/k3s-io/helm-controller) in the operator): this custom resource automatically creates a Job in the same namespace that triggers a `helm install`, `helm upgrade`, or `helm uninstall` depending on the change applied to the HelmChart CR; this CR is automatically updated on changes to the ProjectHelmChart (e.g., modifying the values.yaml) or changes to the underlying Project definition (e.g., adding or removing namespaces from a project). -> **Important** If a ProjectHelmChart is not deploying or updating the underlying Project Monitoring Stack for some reason, the Job created by this resource in the Operator / System namespace should be the first place you check to see if there's something wrong with the Helm operation; however, this is generally only accessible by a Cluster Admin.** +> **Important** If a ProjectHelmChart is not deploying or updating the underlying Project Monitoring Stack for some reason, the Job created by this resource in the Operator / System namespace should be the first place you check to see if there's something wrong with the Helm operation; however, this is generally only accessible by a **Cluster Admin.** - A HelmRelease CR (managed via an embedded [rancher/helm-locker](https://github.com/rancher/helm-locker) in the operator): this custom resource automatically locks a deployed Helm release in place and automatically overwrites updates to underlying resources unless the change happens via a Helm operation (`helm install`, `helm upgrade`, or `helm uninstall` performed by the HelmChart CR). diff --git a/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/guides/prom-fed-workloads/_index.md b/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/guides/prom-fed-workloads/_index.md index eba115a9873..18be42c63be 100644 --- a/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/guides/prom-fed-workloads/_index.md +++ b/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/guides/prom-fed-workloads/_index.md @@ -5,7 +5,7 @@ weight: 4 - [Display CPU and Memory Metrics for a Workload](#display-cpu-and-memory-metrics-for-a-workload) - [Setting up Metrics Beyond CPU and Memory](#setting-up-metrics-beyond-cpu-and-memory) -- [Custom Metrics](#custom-metrics) + ### Display CPU and Memory Metrics for a Workload @@ -15,4 +15,4 @@ Displaying CPU and memory metrics with Prometheus Federator is done the same way Setting up metrics beyond CPU and memory with Prometheus Federator is done the same way as with rancher-monitoring. For instructions, refer [here](../../../guides/monitoring-workloads/_index.md#setting-up-metrics-beyond-cpu-and-memory). -### Custom Metrics \ No newline at end of file + \ No newline at end of file From 6b00613262b41c7170ca6aac91f4ace3fdfd6ae4 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 12 May 2022 16:19:39 -0700 Subject: [PATCH 472/478] Apply suggestions from code review Co-authored-by: Jen Travinski --- .../prometheus-federator/_index.md | 36 +++++++++---------- .../guides/enable-prom-fed/_index.md | 16 ++++----- .../prometheus-federator/rbac/_index.md | 8 ++--- 3 files changed, 30 insertions(+), 30 deletions(-) diff --git a/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/_index.md b/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/_index.md index 1d61b9b90ca..cc88321bee4 100644 --- a/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/_index.md +++ b/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/_index.md @@ -34,31 +34,31 @@ The `spec.values` of this ProjectHelmChart's resources will correspond to the `v As a Project Operator based on [rancher/helm-project-operator](https://github.com/rancher/helm-project-operator), Prometheus Federator has three different classifications of namespaces that the operator looks out for: -1. **Operator / System Namespace**: this is the namespace that the operator is deployed into (e.g., `cattle-monitoring-system`). This namespace will contain all HelmCharts and HelmReleases for all ProjectHelmCharts watched by this operator. **Only Cluster Admins should have access to this namespace.** -2. **Project Registration Namespace (`cattle-project-`)**: this is the set of namespaces that the operator watches for ProjectHelmCharts within. The RoleBindings and ClusterRoleBindings that apply to this namespace will also be the source of truth for the auto-assigned RBAC created in the Project Release Namespace. For details, refer to the [RBAC page](./rbac/). **Project Owners (admin), Project Members (edit), and Read-Only Members (view) should have access to this namespace**. +1. **Operator / System Namespace**: The namespace that the operator is deployed into (e.g., `cattle-monitoring-system`). This namespace will contain all HelmCharts and HelmReleases for all ProjectHelmCharts watched by this operator. **Only Cluster Admins should have access to this namespace.** +2. **Project Registration Namespace (`cattle-project-`)**: The set of namespaces that the operator watches for ProjectHelmCharts within. The RoleBindings and ClusterRoleBindings that apply to this namespace will also be the source of truth for the auto-assigned RBAC created in the Project Release Namespace. For details, refer to the [RBAC page](./rbac/). **Project Owners (admin), Project Members (edit), and Read-Only Members (view) should have access to this namespace.** - > **Note:** Project Registration Namespaces will be auto-generated by the operator and imported into the Project it is tied to if `.Values.global.cattle.projectLabel` is provided (which is set to `field.cattle.io/projectId` by default); this indicates that a Project Registration Namespace should be created by the operator if at least one namespace is observed with that label. The operator will not let these namespaces be deleted unless either all namespaces with that label are gone (e.g., this is the last namespace in that project, in which case the namespace will be marked with the label `"helm.cattle.io/helm-project-operator-orphaned": "true"`, which signals that it can be deleted) or it is no longer watching that project (because the project ID was provided under `.Values.helmProjectOperator.otherSystemProjectLabelValues`, which serves as a denylist for Projects). These namespaces will also never be auto-deleted to avoid destroying user data; it is recommended that users clean up these namespaces manually if desired on creating or deleting a project + > **Note:** Project Registration Namespaces will be auto-generated by the operator and imported into the Project it is tied to if `.Values.global.cattle.projectLabel` is provided, which is set to `field.cattle.io/projectId` by default. This indicates that a Project Registration Namespace should be created by the operator if at least one namespace is observed with that label. The operator will not let these namespaces be deleted unless either all namespaces with that label are gone (e.g., this is the last namespace in that project, in which case the namespace will be marked with the label `"helm.cattle.io/helm-project-operator-orphaned": "true"`, which signals that it can be deleted), or it is no longer watching that project because the project ID was provided under `.Values.helmProjectOperator.otherSystemProjectLabelValues`, which serves as a denylist for Projects. These namespaces will also never be auto-deleted to avoid destroying user data; it is recommended that users clean up these namespaces manually if desired on creating or deleting a project. - > **Note:** if `.Values.global.cattle.projectLabel` is not provided, the Operator / System Namespace will also be the Project Registration Namespace -3. **Project Release Namespace (`cattle-project--monitoring`)**: this is the set of namespaces that the operator deploys Project Monitoring Stacks within on behalf of a ProjectHelmChart; the operator will also automatically assign RBAC to Roles created in this namespace by the Project Monitoring Stack based on bindings found in the Project Registration Namespace. **Only Cluster Admins should have access to this namespace; Project Owners (admin), Project Members (edit), and Read-Only Members (view) will be assigned limited access to this namespace by the deployed Helm Chart and Prometheus Federator.** + > **Note:** If `.Values.global.cattle.projectLabel` is not provided, the Operator / System Namespace will also be the Project Registration Namespace. +3. **Project Release Namespace (`cattle-project--monitoring`):** The set of namespaces that the operator deploys Project Monitoring Stacks within on behalf of a ProjectHelmChart; the operator will also automatically assign RBAC to Roles created in this namespace by the Project Monitoring Stack based on bindings found in the Project Registration Namespace. **Only Cluster Admins should have access to this namespace; Project Owners (admin), Project Members (edit), and Read-Only Members (view) will be assigned limited access to this namespace by the deployed Helm Chart and Prometheus Federator.** - > **Note:** Project Release Namespaces are automatically deployed and imported into the project whose ID is specified under `.Values.helmProjectOperator.projectReleaseNamespaces.labelValue` (which defaults to the value of `.Values.global.cattle.systemProjectId` if not specified) whenever a ProjectHelmChart is specified in a Project Registration Namespace + > **Note:** Project Release Namespaces are automatically deployed and imported into the project whose ID is specified under `.Values.helmProjectOperator.projectReleaseNamespaces.labelValue`, which defaults to the value of `.Values.global.cattle.systemProjectId` if not specified, whenever a ProjectHelmChart is specified in a Project Registration Namespace. - > **Note:** Project Release Namespaces follow the same orphaning conventions as Project Registration Namespaces (see note above) + > **Note:** Project Release Namespaces follow the same orphaning conventions as Project Registration Namespaces (see note above). - > **Note:** if `.Values.projectReleaseNamespaces.enabled` is false, the Project Release Namespace will be the same as the Project Registration Namespace + > **Note:** If `.Values.projectReleaseNamespaces.enabled` is false, the Project Release Namespace will be the same as the Project Registration Namespace. ### Helm Resources (HelmChart, HelmRelease) On deploying a ProjectHelmChart, the Prometheus Federator will automatically create and manage two child custom resources that manage the underlying Helm resources in turn: -- A HelmChart CR (managed via an embedded [k3s-io/helm-contoller](https://github.com/k3s-io/helm-controller) in the operator): this custom resource automatically creates a Job in the same namespace that triggers a `helm install`, `helm upgrade`, or `helm uninstall` depending on the change applied to the HelmChart CR; this CR is automatically updated on changes to the ProjectHelmChart (e.g., modifying the values.yaml) or changes to the underlying Project definition (e.g., adding or removing namespaces from a project). +- A HelmChart CR (managed via an embedded [k3s-io/helm-contoller](https://github.com/k3s-io/helm-controller) in the operator): This custom resource automatically creates a Job in the same namespace that triggers a `helm install`, `helm upgrade`, or `helm uninstall` depending on the change applied to the HelmChart CR. This CR is automatically updated on changes to the ProjectHelmChart (e.g., modifying the values.yaml) or changes to the underlying Project definition (e.g., adding or removing namespaces from a project). -> **Important** If a ProjectHelmChart is not deploying or updating the underlying Project Monitoring Stack for some reason, the Job created by this resource in the Operator / System namespace should be the first place you check to see if there's something wrong with the Helm operation; however, this is generally only accessible by a **Cluster Admin.** +> **Important:** If a ProjectHelmChart is not deploying or updating the underlying Project Monitoring Stack for some reason, the Job created by this resource in the Operator / System namespace should be the first place you check to see if there's something wrong with the Helm operation. However, this is generally only accessible by a **Cluster Admin.** -- A HelmRelease CR (managed via an embedded [rancher/helm-locker](https://github.com/rancher/helm-locker) in the operator): this custom resource automatically locks a deployed Helm release in place and automatically overwrites updates to underlying resources unless the change happens via a Helm operation (`helm install`, `helm upgrade`, or `helm uninstall` performed by the HelmChart CR). +- A HelmRelease CR (managed via an embedded [rancher/helm-locker](https://github.com/rancher/helm-locker) in the operator): This custom resource automatically locks a deployed Helm release in place and automatically overwrites updates to underlying resources unless the change happens via a Helm operation (`helm install`, `helm upgrade`, or `helm uninstall` performed by the HelmChart CR). -> **Note** HelmRelease CRs emit Kubernetes Events that detect when an underlying Helm release is being modified and locks it back to place; to view these events, you can use `kubectl describe helmrelease -n `; you can also view the logs on this operator to see when changes are detected and which resources were attempted to be modified +> **Note:** HelmRelease CRs emit Kubernetes Events that detect when an underlying Helm release is being modified and locks it back to place. To view these events, you can use `kubectl describe helmrelease -n `; you can also view the logs on this operator to see when changes are detected and which resources modifications were attempted on. Both of these resources are created for all Helm charts in the Operator / System namespaces to avoid escalation of privileges to underprivileged users. @@ -69,13 +69,13 @@ For more information on advanced configurations, refer to [this page](https://gi ### Prometheus Federator on the Local Cluster diff --git a/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/guides/enable-prom-fed/_index.md b/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/guides/enable-prom-fed/_index.md index 867e126ea0e..ae4ff801de2 100644 --- a/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/guides/enable-prom-fed/_index.md +++ b/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/guides/enable-prom-fed/_index.md @@ -10,17 +10,17 @@ weight: 1 By default, Prometheus Federator is configured and intended to be deployed alongside [rancher-monitoring](https://rancher.com/docs/rancher/v2.6/en/monitoring-alerting/), which deploys Prometheus Operator alongside a Cluster Prometheus that each Project Monitoring Stack is configured to federate namespace-scoped metrics from by default. -For instructions to install rancher-monitoring, refer [this page](../../../guides/enable-monitoring/). +For instructions on installing rancher-monitoring, refer to [this page](../../../guides/enable-monitoring/). The default configuration should already be compatible with your rancher-monitoring stack. However, to optimize the security and usability of Prometheus Federator in your cluster, we recommend making these additional configurations to rancher-monitoring: -- [Ensure the cattle-monitoring-system namespace is placed into the System Project](#ensure-the-cattle-monitoring-system-namespace-is-placed-into-the-system-project-or-a-similarly-locked-down-project-that-has-access-to-other-projects-in-the-cluster) -- [Configure rancher-monitoring to only watch for resources created by the Helm chart itself](#configure-rancher-monitoring-to-only-watch-for-resources-created-by-the-helm-chart-itself) -- [Increase the CPU / memory limits of the Cluster Prometheus](#increase-the-cpu--memory-limits-of-the-cluster-prometheus) +- [Ensure the cattle-monitoring-system namespace is placed into the System Project](#ensure-the-cattle-monitoring-system-namespace-is-placed-into-the-system-project-or-a-similarly-locked-down-project-that-has-access-to-other-projects-in-the-cluster). +- [Configure rancher-monitoring to only watch for resources created by the Helm chart itself](#configure-rancher-monitoring-to-only-watch-for-resources-created-by-the-helm-chart-itself). +- [Increase the CPU / memory limits of the Cluster Prometheus](#increase-the-cpu--memory-limits-of-the-cluster-prometheus). ## Ensure the cattle-monitoring-system namespace is placed into the System Project (or a similarly locked down Project that has access to other Projects in the cluster) -Prometheus Operator's security model expects that the namespace it is deployed into (e.g., `cattle-monitoring-system`) has limited access for anyone except Cluster Admins to avoid privilege escalation via execing into Pods (such as the Jobs executing Helm operations). In addition, deploying Prometheus Federator and all Project Prometheus stacks into the System Project ensures that the each Project Prometheus is able to reach out to scrape workloads across all Projects (even if Network Policies are defined via Project Network Isolation) but has limited access for Project Owners, Project Members, and other users to be able to access data they shouldn't have access to (i.e., being allowed to exec into pods, set up the ability to scrape namespaces outside of a given Project, etc.). +Prometheus Operator's security model expects that the namespace it is deployed into (e.g., `cattle-monitoring-system`) has limited access for anyone except Cluster Admins to avoid privilege escalation via execing into Pods (such as the Jobs executing Helm operations). In addition, deploying Prometheus Federator and all Project Prometheus stacks into the System Project ensures that each Project Prometheus is able to reach out to scrape workloads across all Projects, even if Network Policies are defined via Project Network Isolation. It also provides limited access for Project Owners, Project Members, and other users so that they're unable to access data that they shouldn't have access to (i.e., being allowed to exec into pods, set up the ability to scrape namespaces outside of a given Project, etc.). ## Configure rancher-monitoring to only watch for resources created by the Helm chart itself @@ -38,13 +38,13 @@ The following selector fields are recommended to have this value: - `.Values.prometheus.prometheusSpec.ruleSelector` - `.Values.prometheus.prometheusSpec.probeSelector` -Once this setting is turned on, you can always create ServiceMonitors or PodMonitors that are picked up by the Cluster Prometheus by adding the label `release: "rancher-monitoring"` to them (in which case they will be ignored by Project Monitoring Stacks automatically by default, even if the namespace in which those ServiceMonitors or PodMonitors reside in are not system namespaces). +Once this setting is turned on, you can always create ServiceMonitors or PodMonitors that are picked up by the Cluster Prometheus by adding the label `release: "rancher-monitoring"` to them, in which case they will be ignored by Project Monitoring Stacks automatically by default, even if the namespace in which those ServiceMonitors or PodMonitors reside in are not system namespaces. -> Note: If you don't want to allow users to be able to create ServiceMonitors and PodMonitors that aggregate into the Cluster Prometheus in Project namespaces, you can additionally set the namespaceSelectors on the chart to only target system namespaces (which must contain `cattle-monitoring-system` and `cattle-dashboards`, where resources are deployed into by default by rancher-monitoring; you will also need to monitor the `default` namespace to get apiserver metrics or create a custom ServiceMonitor to scrape apiserver metrics from the Service residing in the default namespace) to limit your Cluster Prometheus from picking up other Prometheus Operator CRs; in that case, it would be recommended to turn `.Values.prometheus.prometheusSpec.ignoreNamespaceSelectors=true` to allow you to define ServiceMonitors that can monitor non-system namespaces from within a system namespace. +> Note: If you don't want to allow users to be able to create ServiceMonitors and PodMonitors that aggregate into the Cluster Prometheus in Project namespaces, you can additionally set the namespaceSelectors on the chart to only target system namespaces (which must contain `cattle-monitoring-system` and `cattle-dashboards`, where resources are deployed into by default by rancher-monitoring; you will also need to monitor the `default` namespace to get apiserver metrics or create a custom ServiceMonitor to scrape apiserver metrics from the Service residing in the default namespace) to limit your Cluster Prometheus from picking up other Prometheus Operator CRs. In that case, it would be recommended to turn `.Values.prometheus.prometheusSpec.ignoreNamespaceSelectors=true` to allow you to define ServiceMonitors that can monitor non-system namespaces from within a system namespace. ## Increase the CPU / memory limits of the Cluster Prometheus -Depending on a cluster's setup, it's generally recommended to give a large amount of dedicated memory to the Cluster Prometheus to avoid restarts due to out-of-memory errors (OOMKilled), usually caused by churn created in the cluster that causes a large number of high cardinality metrics to be generated and ingested by Prometheus within one block of time; this is one of the reasons why the default Rancher Monitoring stack expects around 4GB of RAM to be able to operate in a normal-sized cluster. However, when introducing Project Monitoring Stacks that are all sending `/federate` requests to the same Cluster Prometheus and are reliant on the Cluster Prometheus being "up" to federate that system data on their namespaces, it's even more important that the Cluster Prometheus has an ample amount of CPU / memory assigned to it to prevent an outage that can cause data gaps across all Project Prometheis in the cluster. +Depending on a cluster's setup, it's generally recommended to give a large amount of dedicated memory to the Cluster Prometheus to avoid restarts due to out-of-memory errors (OOMKilled) usually caused by churn created in the cluster that causes a large number of high cardinality metrics to be generated and ingested by Prometheus within one block of time. This is one of the reasons why the default Rancher Monitoring stack expects around 4GB of RAM to be able to operate in a normal-sized cluster. However, when introducing Project Monitoring Stacks that are all sending `/federate` requests to the same Cluster Prometheus and are reliant on the Cluster Prometheus being "up" to federate that system data on their namespaces, it's even more important that the Cluster Prometheus has an ample amount of CPU / memory assigned to it to prevent an outage that can cause data gaps across all Project Prometheis in the cluster. > Note: There are no specific recommendations on how much memory the Cluster Prometheus should be configured with since it depends entirely on the user's setup (namely the likelihood of encountering a high churn rate and the scale of metrics that could be generated at that time); it generally varies per setup. diff --git a/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/rbac/_index.md b/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/rbac/_index.md index fe2b2fd4fc8..d656246d982 100644 --- a/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/rbac/_index.md +++ b/content/rancher/v2.6/en/monitoring-alerting/prometheus-federator/rbac/_index.md @@ -1,10 +1,10 @@ --- -title: Role-based Access Control +title: Role-Based Access Control shortTitle: RBAC weight: 2 --- -This section describes the expectations for Role-based Access Control (RBAC) for Prometheus Federator. +This section describes the expectations for Role-Based Access Control (RBAC) for Prometheus Federator. As described in the section on [namespaces](../_index.md#namespaces), Prometheus Federator expects that Project Owners, Project Members, and other users in the cluster with Project-level permissions (e.g. permissions in a certain set of namespaces identified by a single label selector) have minimal permissions in any namespaces except the Project Registration Namespace (which is imported into the project by default) and those that already comprise their projects. Therefore, in order to allow Project Owners to assign specific chart permissions to other users in their Project namespaces, the Helm Project Operator will automatically watch the following bindings: @@ -17,7 +17,7 @@ On observing a change to one of those types of bindings, the Helm Project Operat - `helmProjectOperator.releaseRoleBindings.clusterRoleRefs.edit` - `helmProjectOperator.releaseRoleBindings.clusterRoleRefs.view` -By default, these roleRefs correspond will correspond to `admin`, `edit`, and `view` respectively, which are the [default Kubernetes user-facing roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles). +By default, these roleRefs will correspond to `admin`, `edit`, and `view` respectively, which are the [default Kubernetes user-facing roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles). > **Note** For Rancher RBAC users, these [default Kubernetes user-facing roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) directly correlate to the `Project Owner`, `Project Member`, and `Read-Only` default Project Role Templates. @@ -26,4 +26,4 @@ If the `roleRef` matches, the Helm Project Operator will filter the `subjects` o - `helm.cattle.io/project-helm-chart-role: {{ .Release.Name }}` - `helm.cattle.io/project-helm-chart-role-aggregate-from: ` -By default, the `rancher-project-monitoring` (the underlying chart deployed by Prometheus Federator) creates three default Roles per Project Release Namespace that provide `admin`, `edit`, and `view` users to permissions to view the Prometheus, Alertmanager, and Grafana UIs of the Project Monitoring Stack to provide least privilege; however, if a Cluster Admin would like to assign additional permissions to certain users, they can either directly assign RoleBindings in the Project Release Namespace to certain users or created Roles with the above two labels on them to allow Project Owners to control assigning those RBAC roles to users in their Project Registration namespaces. \ No newline at end of file +By default, `rancher-project-monitoring`, the underlying chart deployed by Prometheus Federator, creates three default Roles per Project Release Namespace that provide `admin`, `edit`, and `view` users to permissions to view the Prometheus, Alertmanager, and Grafana UIs of the Project Monitoring Stack to provide least privilege. However, if a Cluster Admin would like to assign additional permissions to certain users, they can either directly assign RoleBindings in the Project Release Namespace to certain users or create Roles with the above two labels on them to allow Project Owners to control assigning those RBAC roles to users in their Project Registration namespaces. \ No newline at end of file From 8093683a08b961f87d6fb2f1e853b7f4650c722a Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Thu, 12 May 2022 19:27:32 -0400 Subject: [PATCH 473/478] Removed note per feedback --- .../rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md index 28fd974c021..67edade6514 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md @@ -57,7 +57,7 @@ RKE2 provisioning is built on top of a new provisioning framework that leverages - Fully configure RKE2 clusters within Rancher - Choose CNI options Calico, Cilium, and Multus in addition to Canal -RKE2 provisioning also includes installing RKE2 on clusters with Windows nodes. **Note that currently Windows nodes are only supported on custom clusters.** +RKE2 provisioning also includes installing RKE2 on clusters with Windows nodes. Windows features for RKE2 include: From a0c5126214be977fd303d141179675fa4b88a5aa Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 13 May 2022 11:10:18 -0400 Subject: [PATCH 474/478] Removed Rancher CLI from QS; added to main CLI page for 2.5, 2.6 --- content/rancher/v2.5/en/cli/_index.md | 58 +++++++++++++++---- .../v2.5/en/quick-start-guide/_index.md | 2 - .../v2.5/en/quick-start-guide/cli/_index.md | 41 ------------- content/rancher/v2.6/en/cli/_index.md | 40 ++++++++++++- .../v2.6/en/quick-start-guide/_index.md | 2 - .../v2.6/en/quick-start-guide/cli/_index.md | 39 ------------- 6 files changed, 84 insertions(+), 98 deletions(-) delete mode 100644 content/rancher/v2.5/en/quick-start-guide/cli/_index.md delete mode 100644 content/rancher/v2.6/en/quick-start-guide/cli/_index.md diff --git a/content/rancher/v2.5/en/cli/_index.md b/content/rancher/v2.5/en/cli/_index.md index 0413cdde5ed..cb66982e658 100644 --- a/content/rancher/v2.5/en/cli/_index.md +++ b/content/rancher/v2.5/en/cli/_index.md @@ -1,11 +1,9 @@ --- -title: Using the Rancher Command Line Interface +title: Rancher Command Line Interface description: The Rancher CLI is a unified tool that you can use to interact with Rancher. With it, you can operate Rancher using a command line interface rather than the GUI -metaTitle: "Using the Rancher Command Line Interface " +metaTitle: "Using the Rancher Command Line Interface" metaDescription: "The Rancher CLI is a unified tool that you can use to interact with Rancher. With it, you can operate Rancher using a command line interface rather than the GUI" weight: 21 -aliases: - - /rancher/v2.5/en/cluster-admin/cluster-access/cli --- The Rancher CLI (Command Line Interface) is a unified tool that you can use to interact with Rancher. With this tool, you can operate Rancher using a command line rather than the GUI. @@ -38,11 +36,11 @@ Before you can perform any commands, you must select a Rancher project to perfor **Example: `./rancher context switch` Output** ``` User:rancher-cli-directory user$ ./rancher context switch -NUMBER CLUSTER NAME PROJECT ID PROJECT NAME -1 cluster-2 c-7q96s:p-h4tmb project-2 -2 cluster-2 c-7q96s:project-j6z6d Default -3 cluster-1 c-lchzv:p-xbpdt project-1 -4 cluster-1 c-lchzv:project-s2mch Default +NUMBER CLUSTER NAME PROJECT ID PROJECT NAME +1 cluster-2 c-7q96s:p-h4tmb project-2 +2 cluster-2 c-7q96s:project-j6z6d Default +3 cluster-1 c-lchzv:p-xbpdt project-1 +4 cluster-1 c-lchzv:project-s2mch Default Select a Project: ``` @@ -59,8 +57,8 @@ The following commands are available for use in Rancher CLI. | Command | Result | |---|---| -| `apps, [app]` | Performs operations on catalog applications (i.e. individual [Helm charts](https://docs.helm.sh/developing_charts/) or Rancher charts. | -| `catalog` | Performs operations on [catalogs]({{}}/rancher/v2.5/en/catalog/). | +| `apps, [app]` | Performs operations on catalog applications (i.e., individual [Helm charts](https://docs.helm.sh/developing_charts/)) or Rancher charts. | +| `catalog` | Performs operations on [catalogs]({{}}/rancher/v2.5/en/helm-charts/). | | `clusters, [cluster]` | Performs operations on your [clusters]({{}}/rancher/v2.5/en/cluster-provisioning/). | | `context` | Switches between Rancher [projects]({{}}/rancher/v2.5/en/cluster-admin/projects-and-namespaces/). For an example, see [Project Selection](#project-selection). | | `inspect [OPTIONS] [RESOURCEID RESOURCENAME]` | Displays details about [Kubernetes resources](https://kubernetes.io/docs/reference/kubectl/cheatsheet/#resource-types) or Rancher resources (i.e.: [projects]({{}}/rancher/v2.5/en/cluster-admin/projects-and-namespaces/) and [workloads]({{}}/rancher/v2.5/en/k8s-in-rancher/workloads/)). Specify resources by name or ID. | @@ -80,3 +78,41 @@ The following commands are available for use in Rancher CLI. Once logged into Rancher Server using the CLI, enter `./rancher --help` for a list of commands. All commands accept the `--help` flag, which documents each command's usage. + +### Limitations + +The Rancher CLI **cannot** be used to install [dashboard apps or Rancher feature charts](../helm-charts/). + +# Using the CLI with Rancher + +Interact with Rancher using command line interface (CLI) tools from your workstation. + +### Rancher CLI + +Ensure you can run `rancher kubectl get pods` successfully. + +### kubectl + +Install the `kubectl` utility. See [install kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/). + +Configure kubectl by visiting your cluster in the Rancher Web UI, clicking on `Kubeconfig`, copying contents, and putting them into your `~/.kube/config` file. + +Run `kubectl cluster-info` or `kubectl get pods` successfully. + +### Authentication with kubectl and kubeconfig Tokens with TTL + +_Requirements_ + +If admins have [enforced TTL on kubeconfig tokens]({{}}/rancher/v2.5/en/api/api-tokens/#setting-ttl-on-kubeconfig-tokens), the kubeconfig file requires the [Rancher CLI](../cli) to be present in your PATH when you run `kubectl`. Otherwise, you’ll see an error like: +`Unable to connect to the server: getting credentials: exec: exec: "rancher": executable file not found in $PATH`. + +This feature enables kubectl to authenticate with the Rancher server and get a new kubeconfig token when required. The following auth providers are currently supported: + +1. Local +2. Active Directory +3. FreeIpa, OpenLdap +4. SAML providers - Ping, Okta, ADFS, Keycloak, Shibboleth + +When you first run kubectl, for example, `kubectl get pods`, it will ask you to pick an auth provider and log in with the Rancher server. +The kubeconfig token is cached in the path where you run kubectl under `./.cache/token`. This token is valid until [it expires](../../api/api-tokens/#setting-ttl-on-kubeconfig-tokens-period), or [gets deleted from the Rancher server](../../api/api-tokens/#deleting-tokens). +Upon expiration, the next `kubectl get pods` will ask you to log in with the Rancher server again. diff --git a/content/rancher/v2.5/en/quick-start-guide/_index.md b/content/rancher/v2.5/en/quick-start-guide/_index.md index 7e1ae5e682e..6e8bb1f38ee 100644 --- a/content/rancher/v2.5/en/quick-start-guide/_index.md +++ b/content/rancher/v2.5/en/quick-start-guide/_index.md @@ -13,5 +13,3 @@ We have Quick Start Guides for: - [Deploying Rancher Server]({{}}/rancher/v2.5/en/quick-start-guide/deployment/): Get started running Rancher using the method most convenient for you. - [Deploying Workloads]({{}}/rancher/v2.5/en/quick-start-guide/workload/): Deploy a simple [workload](https://kubernetes.io/docs/concepts/workloads/) and expose it, letting you access it from outside the cluster. - -- [Using the CLI]({{}}/rancher/v2.5/en/quick-start-guide/cli/): Use `kubectl` or Rancher command line interface (CLI) to interact with your Rancher instance. diff --git a/content/rancher/v2.5/en/quick-start-guide/cli/_index.md b/content/rancher/v2.5/en/quick-start-guide/cli/_index.md deleted file mode 100644 index 954e27f6a70..00000000000 --- a/content/rancher/v2.5/en/quick-start-guide/cli/_index.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: CLI with Rancher -weight: 100 -aliases: - - /rancher/v2.x/en/quick-start-guide/cli/ ---- - -Interact with Rancher using command line interface (CLI) tools from your workstation. - -## Rancher CLI - -Follow the steps in [rancher cli](../../cli). - -Ensure you can run `rancher kubectl get pods` successfully. - - -## kubectl -Install the `kubectl` utility. See [install kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/). - - -Configure kubectl by visiting your cluster in the Rancher Web UI then clicking on `Kubeconfig`, copying contents and putting into your `~/.kube/config` file. - -Run `kubectl cluster-info` or `kubectl get pods` successfully. - -## Authentication with kubectl and kubeconfig Tokens with TTL - -_Requirements_ - -If admins have [enforced TTL on kubeconfig tokens]({{}}/rancher/v2.5/en/api/api-tokens/#setting-ttl-on-kubeconfig-tokens), the kubeconfig file requires the [Rancher cli](../cli) to be present in your PATH when you run `kubectl`. Otherwise, you’ll see error like: -`Unable to connect to the server: getting credentials: exec: exec: "rancher": executable file not found in $PATH`. - -This feature enables kubectl to authenticate with the Rancher server and get a new kubeconfig token when required. The following auth providers are currently supported: - -1. Local -2. Active Directory -3. FreeIpa, OpenLdap -4. SAML providers - Ping, Okta, ADFS, Keycloak, Shibboleth - -When you first run kubectl, for example, `kubectl get pods`, it will ask you to pick an auth provider and log in with the Rancher server. -The kubeconfig token is cached in the path where you run kubectl under `./.cache/token`. This token is valid till [it expires](../../api/api-tokens/#setting-ttl-on-kubeconfig-tokens-period), or [gets deleted from the Rancher server](../../api/api-tokens/#deleting-tokens) -Upon expiration, the next `kubectl get pods` will ask you to log in with the Rancher server again. diff --git a/content/rancher/v2.6/en/cli/_index.md b/content/rancher/v2.6/en/cli/_index.md index 8998916acd2..f039804ffe2 100644 --- a/content/rancher/v2.6/en/cli/_index.md +++ b/content/rancher/v2.6/en/cli/_index.md @@ -1,7 +1,7 @@ --- -title: Using the Rancher Command Line Interface +title: Rancher Command Line Interface description: The Rancher CLI is a unified tool that you can use to interact with Rancher. With it, you can operate Rancher using a command line interface rather than the GUI -metaTitle: "Using the Rancher Command Line Interface " +metaTitle: "Using the Rancher Command Line Interface" metaDescription: "The Rancher CLI is a unified tool that you can use to interact with Rancher. With it, you can operate Rancher using a command line interface rather than the GUI" weight: 21 --- @@ -63,7 +63,7 @@ The following commands are available for use in Rancher CLI. | Command | Result | |---|---| -| `apps, [app]` | Performs operations on catalog applications (i.e. individual [Helm charts](https://docs.helm.sh/developing_charts/) or Rancher charts. | +| `apps, [app]` | Performs operations on catalog applications (i.e., individual [Helm charts](https://docs.helm.sh/developing_charts/)) or Rancher charts. | | `catalog` | Performs operations on [catalogs]({{}}/rancher/v2.6/en/helm-charts/). | | `clusters, [cluster]` | Performs operations on your [clusters]({{}}/rancher/v2.6/en/cluster-provisioning/). | | `context` | Switches between Rancher [projects]({{}}/rancher/v2.6/en/cluster-admin/projects-and-namespaces/). For an example, see [Project Selection](#project-selection). | @@ -88,3 +88,37 @@ All commands accept the `--help` flag, which documents each command's usage. ### Limitations The Rancher CLI **cannot** be used to install [dashboard apps or Rancher feature charts](../helm-charts/). + +# Using the CLI with Rancher + +Interact with Rancher using command line interface (CLI) tools from your workstation. + +### Rancher CLI + +Ensure you can run `rancher kubectl get pods` successfully. + +### kubectl + +Install the `kubectl` utility. See [install kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/). + +Configure kubectl by visiting your cluster in the Rancher Web UI, clicking on `Kubeconfig`, copying contents, and putting them into your `~/.kube/config` file. + +Run `kubectl cluster-info` or `kubectl get pods` successfully. + +### Authentication with kubectl and kubeconfig Tokens with TTL + +_Requirements_ + +If admins have [enforced TTL on kubeconfig tokens]({{}}/rancher/v2.6/en/api/api-tokens/#setting-ttl-on-kubeconfig-tokens), the kubeconfig file requires the [Rancher CLI](../cli) to be present in your PATH when you run `kubectl`. Otherwise, you’ll see an error like: +`Unable to connect to the server: getting credentials: exec: exec: "rancher": executable file not found in $PATH`. + +This feature enables kubectl to authenticate with the Rancher server and get a new kubeconfig token when required. The following auth providers are currently supported: + +1. Local +2. Active Directory +3. FreeIpa, OpenLdap +4. SAML providers - Ping, Okta, ADFS, Keycloak, Shibboleth + +When you first run kubectl, for example, `kubectl get pods`, it will ask you to pick an auth provider and log in with the Rancher server. +The kubeconfig token is cached in the path where you run kubectl under `./.cache/token`. This token is valid until [it expires](../../api/api-tokens/#setting-ttl-on-kubeconfig-tokens-period), or [gets deleted from the Rancher server](../../api/api-tokens/#deleting-tokens). +Upon expiration, the next `kubectl get pods` will ask you to log in with the Rancher server again. diff --git a/content/rancher/v2.6/en/quick-start-guide/_index.md b/content/rancher/v2.6/en/quick-start-guide/_index.md index fe180303614..b6b0ba33866 100644 --- a/content/rancher/v2.6/en/quick-start-guide/_index.md +++ b/content/rancher/v2.6/en/quick-start-guide/_index.md @@ -15,5 +15,3 @@ We have Quick Start Guides for: - [Deploying Rancher Server]({{}}/rancher/v2.6/en/quick-start-guide/deployment/): Get started running Rancher using the method most convenient for you. - [Deploying Workloads]({{}}/rancher/v2.6/en/quick-start-guide/workload/): Deploy a simple [workload](https://kubernetes.io/docs/concepts/workloads/) and expose it, letting you access it from outside the cluster. - -- [Using the CLI]({{}}/rancher/v2.6/en/quick-start-guide/cli/): Use `kubectl` or Rancher command line interface (CLI) to interact with your Rancher instance. diff --git a/content/rancher/v2.6/en/quick-start-guide/cli/_index.md b/content/rancher/v2.6/en/quick-start-guide/cli/_index.md deleted file mode 100644 index c0787bc4c08..00000000000 --- a/content/rancher/v2.6/en/quick-start-guide/cli/_index.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: CLI with Rancher -weight: 100 ---- - -Interact with Rancher using command line interface (CLI) tools from your workstation. - -## Rancher CLI - -Follow the steps in [rancher cli](../../cli). - -Ensure you can run `rancher kubectl get pods` successfully. - - -## kubectl -Install the `kubectl` utility. See [install kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/). - - -Configure kubectl by visiting your cluster in the Rancher Web UI then clicking on `Kubeconfig`, copying contents and putting into your `~/.kube/config` file. - -Run `kubectl cluster-info` or `kubectl get pods` successfully. - -## Authentication with kubectl and kubeconfig Tokens with TTL - -_Requirements_ - -If admins have [enforced TTL on kubeconfig tokens]({{}}/rancher/v2.6/en/api/api-tokens/#setting-ttl-on-kubeconfig-tokens), the kubeconfig file requires the [Rancher cli](../cli) to be present in your PATH when you run `kubectl`. Otherwise, you’ll see error like: -`Unable to connect to the server: getting credentials: exec: exec: "rancher": executable file not found in $PATH`. - -This feature enables kubectl to authenticate with the Rancher server and get a new kubeconfig token when required. The following auth providers are currently supported: - -1. Local -2. Active Directory -3. FreeIpa, OpenLdap -4. SAML providers - Ping, Okta, ADFS, Keycloak, Shibboleth - -When you first run kubectl, for example, `kubectl get pods`, it will ask you to pick an auth provider and log in with the Rancher server. -The kubeconfig token is cached in the path where you run kubectl under `./.cache/token`. This token is valid till [it expires](../../api/api-tokens/#setting-ttl-on-kubeconfig-tokens-period), or [gets deleted from the Rancher server](../../api/api-tokens/#deleting-tokens) -Upon expiration, the next `kubectl get pods` will ask you to log in with the Rancher server again. From d4e3d2fbeffd9fe9af26adfaf688a627ff6f92b2 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 13 May 2022 13:33:41 -0400 Subject: [PATCH 475/478] Added features per feedback --- .../v2.6/en/cluster-provisioning/rke-clusters/_index.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md index 67edade6514..21f9d9de5d5 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/_index.md @@ -61,9 +61,12 @@ RKE2 provisioning also includes installing RKE2 on clusters with Windows nodes. Windows features for RKE2 include: -- Windows Containers with RKE2 powered by containerd -- Provisioning of Windows RKE2 custom clusters directly from the Rancher UI +- Windows supports the vSphere node driver - Calico CNI for Windows RKE2 custom clusters +- Project Network Isolation (PNI) for Calico +- Windows Containers with RKE2 powered by containerd +- Provisioning of Windows RKE2 clusters through Terraform +- Provisioning of Windows RKE2 custom clusters directly from the Rancher UI Windows Support for RKE2 Custom Clusters requires choosing Calico as the CNI. From ee8b7fce32b9692292aaeab228d4a2be4de5f31c Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 13 May 2022 15:39:15 -0400 Subject: [PATCH 476/478] Updated sections and corrected nits per feedback --- content/rancher/v2.5/en/cli/_index.md | 39 ++++++++++++++++--------- content/rancher/v2.6/en/cli/_index.md | 41 ++++++++++++++++----------- 2 files changed, 50 insertions(+), 30 deletions(-) diff --git a/content/rancher/v2.5/en/cli/_index.md b/content/rancher/v2.5/en/cli/_index.md index cb66982e658..6996b6bdf3d 100644 --- a/content/rancher/v2.5/en/cli/_index.md +++ b/content/rancher/v2.5/en/cli/_index.md @@ -1,11 +1,23 @@ --- -title: Rancher Command Line Interface -description: The Rancher CLI is a unified tool that you can use to interact with Rancher. With it, you can operate Rancher using a command line interface rather than the GUI -metaTitle: "Using the Rancher Command Line Interface" -metaDescription: "The Rancher CLI is a unified tool that you can use to interact with Rancher. With it, you can operate Rancher using a command line interface rather than the GUI" +title: CLI with Rancher +description: Interact with Rancher using command line interface (CLI) tools from your workstation. weight: 21 --- +- [Rancher CLI](#rancher-cli) + - [Download Rancher CLI](#download-rancher-cli) + - [Requirements](#requirements) + - [CLI Authentication](#cli-authentication) + - [Project Selection](#project-selection) + - [Commands](#commands) + - [Rancher CLI Help](#rancher-cli-help) + - [Limitations](#limitations) +- [kubectl](#kubectl) + - [kubectl Utility](#kubectl-utility) + - [Authentication with kubectl and kubeconfig Tokens with TTL](#authentication-with-kubectl-and-kubeconfig-tokens-with-ttl) + +# Rancher CLI + The Rancher CLI (Command Line Interface) is a unified tool that you can use to interact with Rancher. With this tool, you can operate Rancher using a command line rather than the GUI. ### Download Rancher CLI @@ -51,6 +63,8 @@ INFO[0005] Setting new context to project project-1 INFO[0005] Saving config to /Users/markbishop/.rancher/cli2.json ``` +Ensure you can run `rancher kubectl get pods` successfully. + ### Commands The following commands are available for use in Rancher CLI. @@ -83,15 +97,11 @@ All commands accept the `--help` flag, which documents each command's usage. The Rancher CLI **cannot** be used to install [dashboard apps or Rancher feature charts](../helm-charts/). -# Using the CLI with Rancher +# kubectl -Interact with Rancher using command line interface (CLI) tools from your workstation. +Interact with Rancher using kubectl. -### Rancher CLI - -Ensure you can run `rancher kubectl get pods` successfully. - -### kubectl +### kubectl Utility Install the `kubectl` utility. See [install kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/). @@ -109,9 +119,10 @@ If admins have [enforced TTL on kubeconfig tokens]({{}}/rancher/v2.5/en This feature enables kubectl to authenticate with the Rancher server and get a new kubeconfig token when required. The following auth providers are currently supported: 1. Local -2. Active Directory -3. FreeIpa, OpenLdap -4. SAML providers - Ping, Okta, ADFS, Keycloak, Shibboleth +2. Active Directory (LDAP only) +3. FreeIPA +4. OpenLDAP +5. SAML providers: Ping, Okta, ADFS, Keycloak, Shibboleth When you first run kubectl, for example, `kubectl get pods`, it will ask you to pick an auth provider and log in with the Rancher server. The kubeconfig token is cached in the path where you run kubectl under `./.cache/token`. This token is valid until [it expires](../../api/api-tokens/#setting-ttl-on-kubeconfig-tokens-period), or [gets deleted from the Rancher server](../../api/api-tokens/#deleting-tokens). diff --git a/content/rancher/v2.6/en/cli/_index.md b/content/rancher/v2.6/en/cli/_index.md index f039804ffe2..553cb44c5c2 100644 --- a/content/rancher/v2.6/en/cli/_index.md +++ b/content/rancher/v2.6/en/cli/_index.md @@ -1,19 +1,29 @@ --- -title: Rancher Command Line Interface -description: The Rancher CLI is a unified tool that you can use to interact with Rancher. With it, you can operate Rancher using a command line interface rather than the GUI -metaTitle: "Using the Rancher Command Line Interface" -metaDescription: "The Rancher CLI is a unified tool that you can use to interact with Rancher. With it, you can operate Rancher using a command line interface rather than the GUI" +title: CLI with Rancher +description: Interact with Rancher using command line interface (CLI) tools from your workstation. weight: 21 --- +- [Rancher CLI](#rancher-cli) + - [Download Rancher CLI](#download-rancher-cli) + - [Requirements](#requirements) + - [CLI Authentication](#cli-authentication) + - [Project Selection](#project-selection) + - [Commands](#commands) + - [Rancher CLI Help](#rancher-cli-help) + - [Limitations](#limitations) +- [kubectl](#kubectl) + - [kubectl Utility](#kubectl-utility) + - [Authentication with kubectl and kubeconfig Tokens with TTL](#authentication-with-kubectl-and-kubeconfig-tokens-with-ttl) + +# Rancher CLI + The Rancher CLI (Command Line Interface) is a unified tool that you can use to interact with Rancher. With this tool, you can operate Rancher using a command line rather than the GUI. ### Download Rancher CLI The binary can be downloaded directly from the UI. The link can be found in the right hand side of the footer in the UI. We have binaries for Windows, Mac, and Linux. You can also check the [releases page for our CLI](https://github.com/rancher/cli/releases) for direct downloads of the binary. -The binary can be downloaded directly from the UI. - 1. In the upper left corner, click **☰**. 1. At the bottom, click **v2.6.x**, where **v2.6.x** is a hyperlinked text indicating the installed Rancher version. 1. Under the **CLI Downloads section**, there are links to download the binaries for Windows, Mac, and Linux. You can also check the [releases page for our CLI](https://github.com/rancher/cli/releases) for direct downloads of the binary. @@ -57,6 +67,8 @@ INFO[0005] Setting new context to project project-1 INFO[0005] Saving config to /Users/markbishop/.rancher/cli2.json ``` +Ensure you can run `rancher kubectl get pods` successfully. + ### Commands The following commands are available for use in Rancher CLI. @@ -89,15 +101,11 @@ All commands accept the `--help` flag, which documents each command's usage. The Rancher CLI **cannot** be used to install [dashboard apps or Rancher feature charts](../helm-charts/). -# Using the CLI with Rancher +# kubectl -Interact with Rancher using command line interface (CLI) tools from your workstation. +Interact with Rancher using kubectl. -### Rancher CLI - -Ensure you can run `rancher kubectl get pods` successfully. - -### kubectl +### kubectl Utility Install the `kubectl` utility. See [install kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/). @@ -115,9 +123,10 @@ If admins have [enforced TTL on kubeconfig tokens]({{}}/rancher/v2.6/en This feature enables kubectl to authenticate with the Rancher server and get a new kubeconfig token when required. The following auth providers are currently supported: 1. Local -2. Active Directory -3. FreeIpa, OpenLdap -4. SAML providers - Ping, Okta, ADFS, Keycloak, Shibboleth +2. Active Directory (LDAP only) +3. FreeIPA +4. OpenLDAP +5. SAML providers: Ping, Okta, ADFS, Keycloak, Shibboleth When you first run kubectl, for example, `kubectl get pods`, it will ask you to pick an auth provider and log in with the Rancher server. The kubeconfig token is cached in the path where you run kubectl under `./.cache/token`. This token is valid until [it expires](../../api/api-tokens/#setting-ttl-on-kubeconfig-tokens-period), or [gets deleted from the Rancher server](../../api/api-tokens/#deleting-tokens). From eed9b38297209afbd4a775ff92b6b7beb92a5908 Mon Sep 17 00:00:00 2001 From: Ross Kirkpatrick Date: Fri, 13 May 2022 15:39:38 -0400 Subject: [PATCH 477/478] update windows feature parity list --- .../rke-clusters/windows-clusters/windows-parity/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/windows-parity/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/windows-parity/_index.md index 8264e28c28d..6c4e690f3be 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/windows-parity/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/windows-parity/_index.md @@ -11,7 +11,7 @@ The following chart describes the feature parity between Windows and Linux on Ra --- | --- | --- **Distributions** | | RKE | Supported | Supported -RKE2 | Supported | In Preview in Rancher 2.6.0, General Availability Planned for Rancher 2.6.4 +RKE2 | Supported | Supported K3S | Supported | Not Supported EKS | Supported | Not Supported GKE | Supported | Not Supported @@ -38,7 +38,7 @@ Backup/Restore Operator | Supported | Not Supported **CNI / Add-ons** | | Flannel | Supported | Supported Canal | Supported | Not Supported -Calico | Supported | In Preview in Rancher 2.6.0, General Availability Planned for Rancher 2.6.4 +Calico | Supported | Supported Cilium | Supported | Not Supported Multus | Supported | Not Supported Traefik | Supported | Not Supported From ab92fa87d3ce85edff4d5fa2e9bb5e8c415ab119 Mon Sep 17 00:00:00 2001 From: Ross Kirkpatrick Date: Fri, 13 May 2022 15:42:06 -0400 Subject: [PATCH 478/478] indicate calico is only supported for rke2 --- .../rke-clusters/windows-clusters/windows-parity/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/windows-parity/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/windows-parity/_index.md index 6c4e690f3be..658b48e8b18 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/windows-parity/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/windows-parity/_index.md @@ -38,7 +38,7 @@ Backup/Restore Operator | Supported | Not Supported **CNI / Add-ons** | | Flannel | Supported | Supported Canal | Supported | Not Supported -Calico | Supported | Supported +Calico | Supported | Supported (RKE2 Only) Cilium | Supported | Not Supported Multus | Supported | Not Supported Traefik | Supported | Not Supported

      Please submit possible security issues by emailing security@rancher.com .

    -

    s:kx&u׾#cжӞ+m<D>=l(vv|]"Y~%[/ck}VS8yk;UIOz;3{ N{0鐸}+s"1Tt~^%"G+NGCl[{;lĽ7P<w9wݷ{?1s^YݐY0-W&=ey[ߪ^?m^=A +=o`ӡsgўlh2fzoN߻fm%7}n_`!DRO"y2s0ѫyNXWZyw6|ӃyNН,jf; FM}zE~4!BO|_/e=Nfz~C`!r|2dOGEZ߃$zud=>_z_t;1O;]󣭷(:CysWL|O]wsS~u7:좹#}i VC +mڽxee)q:<鷤_ד]v쩶qJ_5 m75/kebٻoEk>)mDtI"ӛ]]&U;(?- r:-ϯZwS0soQ:>y)z$;|zy5nE ub`OoH~mܪo9A3mJPMڼQ}nOmcۧ 3UmF?$#4~>rvؓ˰lE}q +O+. R @v56t ++9!Tӹ" $Ssq1UFZ>MdqP墉_. ?È8 edEvاԶcP売nR~[(t>]`"Kq{1IA \5źb3@CӶ[]ԂR(HuMLGssjӹ&ӦKZIwn oT{ +MJ*QeԖCL'Ft0/D)ڠ3Z:f$SŒ.l4[{Te) :Ԇgd72t+#BsK=PZ.ԑ/ԶqzTIUDK' "K'GU'B*ӮZ%ilV񼑨U1\ H[Z\Y^2&}"ݚLJ},%1ˊ*NVڧr%bkb[27;m{Iw[mbW}qdr '6ӋC]a &n4eVv>A͸/ySڪNt ?H[b(Gڌ-T֙d;s@^T1*BH {!i +f_U; +endstream endobj 575 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 96.573057 101.433071 77.823057 ] -/BS << -/W 0 ->> -/Dest (cb71-1) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 574 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 576 0 obj << /Filter /FlateDecode -/Length 4722 +/Length 4718 >> stream -x]ێ}y I $& Ilu9EQg0;V/%XP/93˧R>ޞ0~2`ϟHUޝO;l?yY 1:%2z{aUJHͨW1*'b -fXoY<01XN3RQz0Cyi8̐zF%JVC1Z1:iFwN"I8փFZb+~'YdamTӡktj -V# ?:l 9,aq-\k䖏(U&I8}rVGdR>4֏JAՓC}A|>Ǹ%{}x(s[J`Rv9RٰpRX 1UWh]P0ϛˢ;2"o𭐕l]|4e^\wΗٍkhU,8ȓ}yVsJe%b,.64B]G\+76UP r:Rye4uSw~Rvu]HϽ3U#}k"-s8ԺBujBCT̲a4?{ܻņKc_Kg=,w6:U?n/v{Sz dɚ~17+5+v7㯍PssQ3w9*u?h6mf7OWZ}FcՀ#d]GͭϜٶݍ7L -_) -W[ޗp{} W8È9cgوupiO[z70mqEcNGyT[^:235[W1\>uRlɑ;FsOt/UMDKS/|`H\on_[Abmڍ}y~-1uf u#ZI\_)9c'^kSG-RʦnDlwS8)5s8HtB(yhU唽j;s8nE(VPti0s_# ۙhueԫ#ҟguWQΡXxm5$(a?uZv_6s ۹noVς x7l@u -3EF}:=۞}f$fqb>7͔i&caz; Z)Ji)vS9!S}tW'hN֞o{>r6â>\ړA}yy56;;3XmM25+[F*3qӖ -ʜlnKU -w>b_z\CRn,b~ȕTe5jH+>'qhC2nƽ~IIc +x][q~_V&Y>8A L`6:/J-uX݃nUR$?~,Ԕ*N!~xQCp +-jet]`!$g_e_\{G_͐7]UCPNP%&Aq^Py=)I*5v +0æ$̰DAa٠iJ0m%AF)QCdvG{Igc2It0hj%].J: [\RZ9ⴵJK1H:[ȓu@.I.+:آҒ.RV%T q3 .)IMuQ$-^$`#e$<((VóiI`1:؂xآ(3h`^80dD&` I4`OAR:%" [-3WJV2 $. -ƒ@*i |kf* K[  (% KN $. .9o$. .%. .Y$.]"u8$qVA 42`TK\ &F%qkQAwCk2XK\ %z]P=t$.@a["qO`A%.p]1|. :Džy^IBE8.3J\ xWVjI&) x~p4 Z. *(qX$. d<(x.$q*G$q* GF5a +s BҁwK:R!I\lJ\ L>!%.IAON₠ p,Q[l(qA0 AxCl\-%. 1Y+qAp1ft-"t:H\k "& % `tJ\lTK !*81p#w_-m$c/X|/r?Y7iLx\ζ-a#BjFjtc#cMEMl3[fgb1VE[Kk# a3Dcf@׀/05/嗿v_qF)h b:*{ßlgwQO7}= +;4LW$Dz\X]N?oO&&ZZedz> WӼ5;8~ +c|\l]8ڠͪk!HˮɽmSQ\ۨ^|45iA(]jV]n/e(:$zRW.6A{]_}۫[y\lq-U+:W >H2eTzm81p;y4S> Z;P2LCP R5R—F2 ?wo2;h73.d_NS7fҗw+]!2NiR9 RAJAۍΒ +sv̸dH̘mYQ`ێ53wD(.g!+۴`ڎq66Zc(T4cyΆV^A_# +RoQ`䌑1 pYZ(gԼZŦ#uIxRZky:{?c9ӷPkuK2a`ӡf=Ϲf4,U9J^e>=TOp+#{[ثwxGϽu˝Η#3rm͏;s:>>Y_ovdo73z/]7Py0Py|rKiVOO7|F̀gdG4a,<̭IO/$4lו#n4״/crdK|1r͞zviu,wjca:rluwK6s0uYSfoU]Dxm2{k.@ʟF7u_7ߛ-Py$>\Q*ٴ;]|.VՃyN}"2 Nan(רhΩxdO=ty*niOj5beMuN+O'w;"-E7D>\|Y>"=Q۰Xo$fz{yΆ޸T}NBm> ߣDҽmX|~.nW2bǃyNTS[?k@q >%s;~흻+u|ߏyj] 4Az;O})R~==P.ܼg5.zYyΆĴ7$E9"mo0۶5J!#4=c=t=c}wyhl}Zv+OaOV9jwK3V7įQ9ZkDYg_wOforl燒-S>.j9j ۔7Jvpo?Eo(h8M`-+v>'7O]AW 陲r&Or.K}z뾶gF!mAnжNs;_|zgGrVSu>i^8hïz;u!]d2L:wn/C>9c113j7TGS._b=(fUղ. b CZ$7k3WQ|J6>˪ɰcł9^jГa|5`VӶ[]& Zb3k&]/iMvAR~sF)QUFQJ]IYqD N-QGa,@5]*"JsuBM[TzҠNv }4I#׹ccb.֙Ԯqrzr8& SfHJym+v*YN徲z@vݥCKG%gҭkͤ]uyLRN[0_٥K%MlT]ZeRhFY\fke'~EX&.eU=i~;Le"o_{rUTn%"Ӧ~ҺmU#RWU ]Nl*tgmыՑֱi xIq|Z,d_E\Ʀ$_"qIے5]F\ⲫ05ff2 Jj׳ +⺺΍Kj:ۖپ"˭/4G0> `i*}掠a,'K)_e]s(Z&oZusӦFs-h'-۔"UZJ"%bn-b/S4_vNtUZ.x[ΡN՗ԶTd^ffoj*SQ *r$D,V2ɪ˯ +6v܏#"%Vפ9JF&C]Qͻr&=B(9B2VߦJF~ \P&Oi>js endstream endobj 577 0 obj @@ -6961,1056 +6969,1086 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 576 0 R /Resources 4 0 R +/Annots [ 578 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 578 0 obj << -/Filter /FlateDecode -/Length 4823 +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 713.673057 101.433071 694.923057 ] +/BS << +/W 0 +>> +/Dest (cb68-1) >> -stream -x]]q}_VG @{$FbanƬus◤Z;h`HX<<,R[_~/bL始SS,.{wՊt]d SH}_]̣fJUdCPNP%ʹ)㼠zBST02UA):I3Ș("̰ݪ0A: (%`"Fi7y8K:'I.@tN>vZҥ{#Ғ-dctXo-&+l1Nt]Q啖tN.E"QS1ĭ(7htZOش= -䃠3+DlqVIga Gҁ' 1 -pjI`1DlAK `Q&q˓>I\ 'F#jI\8L&]Q&bwAKF“`Q&IK\2P J:o@ע.B!ЄXK\%.O.I\3$qAH]E ES4%-%.@ D[ J\M,+ 0Bc. WK:R<όD` u4!qڇ'NL~04GH O71&7ID|$'%.CIG7 I\~(qA -ML~f lqQDlAД~ N|$b:Ѹ/o뿁O?Y5:7ΕVt4^K]yKvYuԈr. õ]}6%OIPg)\l-9Q߷s?-gE3xHǷCe/^ NˮypqUҸsƚUH{hfģ'<2{h/9lGs<2]0RYzUF+sfXE0<<RrI|usy1/;hyYs)7bӓy 86'G_.¿B(ysyk-sf<<,kRF:@#u˛Wlhw<~4$*-bej9|OMesP~EUolj36{tAn {'<r﬇ckܴ~V?xm^#kCBۄqNJ_æmdh|K mǬ9qw@ - mU3{?W>k6~+2> ee!As$h+W֕]s "r=2jcΫ }`ҕ6ߝ^&JY抇P_|ȾeNz*M~[~εܖOg1ҖZqPg3|^ϕKh~>q.6ڔ˽ eAG~t?|aWUܰt*v3~*OԝHd6}`㚽9tWyh\|9aɣe +fj$~Dc<.P{b~{ў{CI9,ٻ2mrxk-i߭=%!\\{y|)H{d(;^ 2mBMs#=D:Lv2ϓL4B@PmF[@RFe"jXk@cxw{#zƁٲ{w~D?v}Ud~3ҿ簏ce ]eT̓y 8:&_0cthg² pAaO>}2ӡ8n+)vqˤQmZFŦ5 f9BAp+586t>E{#U>Og3=ϵ>`?M3JG^&̻Ay/e{Q?+/y}XZR?ܼxyzT}_q -m+=c&e{UZ>A|Wg/}i2i IF'3ycsIuLXnڦ1՟z7 U]3nj4=4I-ut>kUkݯ&IHW>0*K6ΎםZr2r܌EISn/:; )*]vSI&',,U+tMd7b:%o*S+BfHD66X"[1^M$8r) {4wڪAB5ܮ U{4\绰>N_Ӛ04vmZ&JZTQMfR5vD Fբ C)0V QKj:AtJiThbϚ)66 " CQ~\ywkkkܘv6ⷋ Bj׹B -Qhr8.QOUg 3U&e45H9߄f/4}c<)t t[汅tp @y,źªWBU5(-N׺Sf^pw.;Fqh-Pfo+w|Fk1C?֛tQm70Bw}[;ɤv%s:û9|e!wZq[ƭ 87rēb*lfhui]ECǍzvՉԍAuӎB}8Mv;V^lm>`ϗa,[X\Ʈ}HE⊓!Z2CF\ra-d@7igil -.0/mQfǢ,bH؎cǛ=wd_{K7(mci#> +stream +x][亍~_QAlv䡧f:O}ؿeKe j4zLBQ'U)~tQS +JEa_rq:?)fob]pɋ]uL9_S V`y?h|XAOb b۲"p9y11I`%a]vD$GF)As<gR6YEt4)Dxy +!$dYi!)YMQbU"ċ@;Y%J"v99'2x*Ŵ'UO6Ê$( d gYUFY#Ɣjhu[eŘDdK`dQ1H4.I`b\6NK +'`d?Vi*]jrEdIX` dA ,Y ,Z$,[oA J ĵ)8 , %,\ 씰tܣk}0Xu)HX`i%aZ"%,:NV'+aZed$,N ale2)) p$$,p]8a Z px Aڹ+#ag0 Do ;Y`X dHX:c4j) H&p5*(B80͆S$"!VкH1g%Viӏ_׿O?J!nקPal(JKrԭe[K9kNy]UMz392*mٰeTe6k=E&sdLg?OQ}v|ʷ?|skqPLM ̌CS{:LM7ns"Ӎ[YwS}-L7.A'L3+S*1ݣzl] Қ33#ֶ 1CǡI8=Xۺ+mھOy:vwy܌iC/zֹQ`36 %7ϛ\#AkS8v<'_Ly:k뎡иVղ<\YhUa߸~kz~ +0VӟxBڳT/{γY]q\;cy_vn?7k;c.7[:Ogj~V8z{guo+r!U,ԶϾt_]Y?ĕ5FJ&mv~@dă$@re}n5wsN&m] :Oy63k> +M/j3Ճ殃=? qg;/zYA&"6vmw=}O$=WM=l=:Y, scH^ MOy: =ȯ̲FeBX9:;Yz4X:fv1ffDWqx\ktMb?jjZ7e>`{qd);Yrm".qY>:>!w?<׶>3L2^1Id9k|/S)spJ+ _\UN2a&r-Ho7ʹ=eN. m3ܓN1P},6>ҽ +A6:((gBڞn[gͭ"_F7RĤDxNǖbʁ{Nvӧ24tZVA& y:tT?YI}){ا^楺դCSfAh==iYݠf=yޖդ2)g:g9es혓ur2o9fU(i-y떐˒^@j|>ｇOfo꬟~d'.vg,Eđ?3_i%=p[ٽ#҇Fa#k=W5ŵwVp0w=`dg[}=x([6m)l/pT]qY:͢xmIAҚ90oxX& lBЏh(bWͲ_?Sk=e5kŒ]_O&^g5ݴ0Kiseojkg ̋Y1lK(Vrr +i҆D'5|2NiES|!O#C4Oe&U!#D#B[d".Uk νh7dXZ>&Vsl9ipX f[2^Mz!w".WBF :^7+UDźdE&_/e3 o^/}qQ -Ld4$۲aDwNqc^^]u`%uCPݸ452;۠| {uptWFRlߒI\QѾ (.YK wTO;>b̍KyoJ+`E[~vwWB?yC]DmިoFx2Ֆ˰l{-7jmYlsr讅[]peԫ-+MJؔv׼% 9ѩ^I^Q]/i+m۷[]w+낄^oJ>ΐuJ՟ ѩh-RG_]bw׹+fDj阜*jFY7015UQ8)@HuSLP, v)To&R,'=VوP +endstream +endobj +580 0 obj +<< /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 578 0 R +/Contents 579 0 R /Resources 4 0 R -/Annots [ 580 0 R ] +/Annots [ 581 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -580 0 obj +581 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 381.573057 101.433071 362.823057 ] +/Rect [ 101.433071 270.123057 101.433071 251.373057 ] +/BS << +/W 0 +>> +/Dest (cb71-1) +>> +endobj +582 0 obj +<< +/Filter /FlateDecode +/Length 4714 +>> +stream +x]ێ}gI@^ KMt7sz$6p*~l{XE9=X@pu.U +)r^!x[!#zetgf;8c[õm?vpiOX'ܛ~_`ڌJZ'ݻ5Kyt[0e,]m] +7,~۴oulu-c9CpuӃŗ^f|ms4|ho7}uW+.Ғa}>:;~)I]FL'٘p$TY6T5a-Jh^<69VB`g޹w7߽0PU=%҃tZ\`cájŻꂈ@.\oGzgwuuDjM[1ѐH{bVUe Rh~sӡ+Qzj,ǎS+G=8GlAhw/k)7fՍy~c"2$nbs5J{T2O.߃;}jOG79zo4XဢKSn*=w>BwD69BW.Eѹ#ҟguO3yh/^ozXo2q55U_I_6J3f2Уm_W=ns8ĮOm6jG5i89WOWgwis&Pdskݖp]BizCE(3xp`c.LmTr'O]'7صƕF+찠_!-ѐhW⦯$ەr[۶lU#k(̼ns8nV36xI~{wkFYy + ɧ[+_%Wxecáu?*oc&:}^Xns4ԺUJX]m_§yybЍy۾gI"[uiO+34M!Nɮ0M7<g1Mڡ柡cD̀jS}[x.;bzGtwߟٿos8ony?(,H-Ȯ^rk.z-E!m6WG~RӮ]A{69o mj9tv:.yCuw^ kC{YoơN0 iyi2{Ȍ2sL9{F?/yK;HBL`;l3KЀծOt`cw%6w7D8A70ŷǦ}?nJe"c.XJ4f۷^֞ey{yƍ1ק´Ź@Iۮjb zi~cO&^"Rw+Zo/BX5' ⽝=_/E׹zv_h NRf嚺z#oi`GV +r7`e;+q]/='jᆍLjgv1ᐼ򵌴ife29vmut?W˻VuKtisB/[Î}+ֳ=(1~#ޜ~7qyzw q%zɫWkf5ژp^~޽^_io} f7ݘp]~fQ~!tg*6!Aԇmyk-5sL]w;}if{ip o~7-:*>r9@m5 +xc0駇1LAQа꼐s8cI5J,A鐪ŘN*? r/N57p(KYFEvWzd?R8Q|7)>FD4ms"Ssq{)(NA+XmhڴqUH6B;ʦ*&ۣҩm\ۦSM7yKx9ZϬ4ʭeQcT,RS1h, jWa@2%]ĦK|Ij֘[RN4<#htx3F$SK=Z7z&)#O3m +i3Z!5q/U|OYΟJ_ib2R zU+Ic]aõ2mKy_0۶ +IH.-66M}%*1"Nۧpe+TWŶ@y"v2T\S m)]VKt ``> /fzq~ȕTe5jH+>> +endobj +584 0 obj +<< +/Filter /FlateDecode +/Length 4834 +>> +stream +x]َ$q}g7%$0$ۀ%ACOm F_Wz3$+r֨dO+#D`2K_~/bLNjSS.7 䣻 ve\{G_͔7]=N!JP)msSyA[LIR н* JI*ADAa* 4I* J+ءR("kvG{Igc2It0NK4y]t[\RZ94tl u`%]-]-@WuEy%]KH%T ^g\VI:'lZQNAK8#Άjxt[esŘ@%0% +$0!L I$`(RX4QVD>-UőjBDX[@ka!+q"qݒJZ % 3k' ,(PJXpwJ\`AA ֵ ,hRX%$. )` ,qq:Z k +xH\^C/q25Q5S Ơk2xא(Gxdw`%.|-wu'iդc8>Q&¸E+O$qb8.3J\0 xW[ԒMR8.'q0i8`~tE]TQ- 0 O*ID]$-qxRC%.]LIUZ Q'\; Dl@MQ``5F`` \ LIp[)J\&b" 8ZUy3u:$.&LZA/q~bwI& B-*`*g.4l-q<]贖 oPh"V^I\kI4#(qA$?(q V`JQ[@x$.M,sDl$.r3J\#l1H\lz3H\l'qAR~b7Y8tJI\tzӐތ$Oz^o E8MI$7NH=7p3ބG/"7.ft]x^\` VZ+ deg# +0!lĘI L,VJ (/19ԇ<0g70,}]sdv#/?}{.?ɑ  +$tqc'f&)'R3R]?,l:rc]9n\?(NXc}`xl&?!]-ښdy>VLXB݁< Am6{.mk$w/& ptbC3? J-z +ĺH*/>]@s ^vӘ8~?w?^3i{ï?S\d~kPankhѽ.SQWfmWԺ|,YtTliJ2k͞ZΗV?Tt˿|Z,2xTQ\)#R7p7їZAPFC~n'C> Ns?$d(.ңy2ϳ+]rt۽SPD=B^CˮyˏQdBn@aiAY&#_1 3zm$qȨ@h-X|#tȥ]}d2L[LY)"zՊݪD']mbn_of".Ųg۰k*7 IKܪsZ~}.w:_֌ír_nNcps|jW-iol^^?}qC* PgsPr /UU]M6XK۹ܞԹ<o9۽{/s C?3ma]*=cZ3;lf\_mO_/GZI4Lq|?Iw>fݭۦbHw6_$*#7,oƣmsynpl|{T #u8Ȗ,%xe/zcȿEOgg`KS4a7NyTgR[ PbƁQiQW/kvᶽ]~'[!k(cZ~{E2a\C/UѴu-rн,3˺{Ωi=]ѳ7@hk~dC۾M#[>bQ'+k3*gl ~#jQۧ63TFkh>#93a-Yh=zg>G.%7P|@ǧb'iQx.ӡpo>x[yDFuzYEH|i2i֯^ 3OcG+!l bj O<}чxﳀ-HsyAjr͑e7Xj~D>fϝcigu23zow}Py} v~lWβ+mu%'#gyQ^N{zGN?3|"Zg9t:y0Qm7wy!6OWoF/帅xo6y$>\Q*ln<wJѬz2ӡdDj9cv|1{|@;vFOy:<7DCsS'ѿOwDNy6ju`m)L w [ w/ ;=8gyVGu^uR=Lr@_zxm/=j=aHgq|4x9_acf$Fj>2}W~»{'U프W]U|Wݺふr̮gu.-gnt~ǩq҆_~4f8ro~7 bv(@壪eg SSZW^ƕd7*l~'\ DN|jҋߞ'\j +V i[-X[ ݽPu5bm֦MXMNw_ҚuvAvR~gs)QUf;Rv~D N Y]/ga,@.tv-S-k*-LiP6 u/ uQ|\{k;ܘ;⨎&~ v++녶+jxiKSah7U)3OBٮZ%<6xHW!4k.Bl^:*!=nM][l%횬:&Jkb>+{*F&vo+qաTľr[/5ȵ[0_<(fRIUgVY'l[Zى|lLqo\4g3|[%,}~B//œq*[ʭ+q?XēbV"æhuli]ACǍZvՈԕAuBڰ +]m2nGxZ:2_7mž/m9>ίP-Vᢿ\ƦmJvE⊓)Z2]F\ⲫ05Vf2 Jjӳw庺΍KtԦپ"w% l`}ie`Wb/#ګci%> +endobj +586 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 536.373057 101.433071 517.623057 ] /BS << /W 0 >> /Dest (cb74-1) >> endobj -581 0 obj +587 0 obj << /Filter /FlateDecode -/Length 4698 +/Length 4924 >> stream -x]M$>H' Inc#sϣZUj{fDziUTX,Q-}VTz!zNjVXbv0¯gVG$ ?hwϧ}rϼ>!Fg=MR1 >xP)M{crz%(`lx0c -f1APA5-UfYR TZmu0D1t$у DQH:yVK88lt [lTZYb5t)xI` 9RIyb;QtQ[SZEl ̢.BKQvHI: lÈt8e-t[?{OO pEq0pLI% a#u>V#5hqJ%#1凙0TN1_O&cz aNoA2Fj_c pJxĭX,5Xw²/C*e @9&v9"CR?W#iDS6LeOZ -K8\PP7ciޓ&er &yƨ󜝷acvqn$y~.Pz3D\3o!Vx;^] ! -2Wj!+Zߧ+ - -:te>*2zjNӗGLN^ѳpW6l mc\ۜU9nj=P=sJ↟2bk<gjs7Gi5Lw90owg܎ 7rϿPti~Ms_C _ s8nė~ދ 較L =.w]Sld?h[Aͽл| TJoAP(^]l6_ :CF<{(~o5_(rQ<ubڈk-Q]D=o*B&m!t_!v\x-7^P$ E&K^g>f-GM;m3oZ?诵Of]\@츠B:CF dvDncۖamjrEr;rJc/<ͦe_[}9_\ ȭs4dbvU!zMt7Z9Zţe>˲l^&-s8nW >J [Ur޶(|Z:w,V@>tg!vY"g Vz~ESQ1t~%"v2p{;2O 5Ԏ?:GCvOqaife29vkut?W-ۻTuKwisJ/[Vw9:7 ֋ѾV˜i?5w'J'cd>s8dndR"y2r\٫u\/WZ!xmĦ; a# ڎƷBĢL [Wpٲ_37Duw=sgV>}s7c+\*o>=;uX5wGcAND^fZ~xAnhCߩn?d,K7x>!-ntlW{or2q:GCcyu,vyn}kig=8,n9Fhۇvc~i!RjnCw9r7w`kʷԾ,Z ά _Md-:j@TE6eӻM~tې^aI [՟//\_z׌[ 'rIS02( uuuKar˕ܤ;5} 7H6 ڷӹ{6ls 6_m?=J0h^iyv<]>R"MzX}^9Rjz7J K890:\./?ľ$KdGcդ6WK` !j:W]aS6CXlmVkR.9]u -m;o /'z(MoM5Ȩ1*%CI]NSf8]!K I,7f|)j՘{RNt hrf(b<}B^NHBi[B VHMETKOYR-<RMN$"wR+wuX;mK{_0J(H.=66]}%*1낺"Npe+TmL\edN7p*v;[/\n,ORFٮV@ -U\iyZicdҌ{9}w9CD|p[&(K2_'>1:Unۙ,8wga6pCUC-k3JKմ42HD02+S_~R1/5EX?V.N^g8M ~ 粎)`'R9;*CTO1UN1gI3|tƭUfΘ$̰.jVeav +f죠 +vh!9kSIgR6YEt4)Dty +!$lYiIa)I[MQbU`tKJv99'2t*Ŵ'UNVaEaBt峨-*#,lqt ocJj5ZybLt`%0$ + +$01N.'Ivr%LʓJ4`\Q4tFKD`l.HL`5lqX$.l ,֩%.[tpaqm +N kX.{uF ڵ. ,x:$.p]kQSXdu8*J\XFF ɤ$.p]wM uq88swWF5 h +r8[@Cghl2K$.]5 tA '#F\XI%.]8*+q> H\SK:6YI\äH\6i芺< Z2 O*ID]$-qxRC%.],qA*oQ[l2 VXV'e4fXҁwY%)qA$0I8! +6c dB>Q&{ DlqI\z6' - -$.@D0e[E8؂HQ0ٔsDèJ`Aע.A1 XK\Ԕ%.O.I\3Nₘa pES2%-%.@ $[ J\L.3( ࡱPK:h$.H.L*J\e&RЄl{ fQ[wdh$.H e$.6i%. + ⓸ 0Q,qh:$.:aiXLdOXoF -!-nIo$]-&; rL ~Hߌb3Iҁw p&"[io@>">vI(PoS + oŜILL,SpPj% [q=STp)If, 9z1Q˟.dFPJ;WX&c=oӷ8Vۦ5S- ܑi  V@ P'bl+(. ي{n2hO?_~?c>]oVioqXmr3Ųz|vr+-]}x;n234Bs6^nW;4c}L970Fg~~>-AX"1H%*_ۿ\sޅ+U(l~ZNSvNvx;˭ wYtj\2 HG j u Qo$1DTr"D2VL;Jd28!!\C/Zkw -’ ]|,+@&Zsm +ќ+{ǦJ;#\C~5vDn[I_a6mۺ^n"t[%su^186cR6hFF3a0Ӄ7mkQ;&"Ǔ^Pj51 +_!z=\]d72Z8ImH`vl:y]RxZ<yړu^yگ}kF`uE ?mH;7ʓŶcC z{A3>ĉyޙ{;zmeJP)瞫o0m~AꟸodC}gg| +u:g:ޟu0;avr{12EOy9ddR_lG!w<+@M=^r>ȥ~~z}*w>[?<j o,kaw4~-> +,uvLtsu^k㞙]{;ciGyݻGe>7ygr;:Z 9}>:!W?|_ۯm}f,\_u7Oy9Dǚ9[ѐ6 ^|g_XTFc|"p#6??7cCkH1|:/܃|LZW2EGṻgmHhS`;dO͊5v4_<NwQb/ I[G4\~1pocy FK#KJ~^l-sҶw}PC (+j#f="Yu{ s7aѾZzܾg}in'Xz($=x|N:¡)m١GaB@3! mߑ\"ƙ"js3>e\ϕq-O GCLElE(|?1 +Ɏv̬ƌ3I=Uqqc*pwIem ݹb^h,zAeuz<?'=0,琉sJ萘> =0LO{osou746O> JM.ӵkɢ>Lc CG78(};[\K0z!nQu< +=F%}|~]nPFnaAg68,r@5p]?'-tD6)&#=YenOگbճG<{:׆ehܴycӲ)kWYxJs~_.<8\G&mRWSWzXyR:M n,)zs=L#?R&gpf5$.QE Q~W*9A\$?֖-L`XNF{,OG ZφZS-{w,Q3赘^MzkdL!oޠe{X[ń~-T.6ڣ5mB6i6l: ]pjSutj2ˌMk6!͓ ]w60Mf^)p +$ZN.b5f*RWu)6d7ߍ=FbƵVƬwm%vG\|Zn'ҥtOf*|5HKQf/Cc'veåcl㥓mR6dLs5HRꚘ(OJ.TtžA}!vTj[]wsql3 .|ފcsj']lTv3&솁{ةLltld6b dtnþzrwSTpOlwW$hw:*7Ca-$@NГO #vn7]e,X=O//PWI7;#i#ҞJDg%Rhɶs8~vlddnRK*[}Wo{e!GWO3k^g:HOɄGtƖ,8ћK,5p\:#Rs%'LUQ eޡ +T}\-+!iN2A卩jsIH[EzA2R:F˜t#.'45F endstream endobj -582 0 obj +588 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 581 0 R +/Contents 587 0 R /Resources 4 0 R +/Annots [ 589 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -583 0 obj -<< -/Filter /FlateDecode -/Length 4675 ->> -stream -x]ێ$q}gK>0,/ k Ȇkg$Vz3yv֚FMUF$O,sDFcOWR,.{MQyCYࢊ/\/U9koYEN*CTޫ*&,`di0r -fIP%(Uea!I3LQP ;ZM䬠3^tzt֨͢.BgtΩx# -!$"-` %]-.8-`MI[,z' [$`HωHeti+ӒM'00H! -: [Yﴕt$x»0[-ntXI 6DAyIlI"DIbD6{E!G6Y#ӰSBL8 [@`%'q"qݒF%m 3R (P8pwJ\@Qu>X hQ -8#%. s)` ,qQ9uFG id%.*0H\(6i60޵M<7xzm%. %$.PGxp`%.: PK$.]9 R& quY-zY G$.]gQk<K\8(@7e4+9% ~ 14nuߔjsCen750IbuN}fSV~q6O̚M:Ю՘5Qp+'|p6 -+~:_Sq99qJ]q9_Ś`^MJU.[^ +ʵB0::uM47{yq juUsU<~[M,o%} -n{Q -+2>b_u6.Pro݆ s=L@Ǫ7w=d=Q}n.{UD8C}㈅=sމcT{C&=շ -P -ejәBuSu۲cӦӎ7lm[#y Q~S=adNϙ}T ;ZG={7zj6kD=a!W{g2!`WܶL?a.zw(5(l糝`zʙ|AGE5X&9@vլDZ>"Pw`ˑAmzMo[-_Ͻc)< 1n'dmRj8ͣ_OYu?b(oK(rpVyR|w3|#Sɔ5םhZ|eNj9Oe !L'["N^t˅O6'ALI1 珺E&lx5N -g|p~_sk"W\*V̭b>>)7_f -Rф@{CqzPujD[ׅ.l]gimvAn-}|&u-Mr qD Fע èɞ0U QKk:At|R5מt:^>b#ՏK1SZ7v#]۴_Jxn6FyhCR=]&ƆٱLBz&ݖB:t $c)6 uMVq(TžAe!v6Un3ݷr84|űjUx+b~ta7 ŝF_Ncdǽ]r)n:o >FY?H^ɏ[6n]GOƿґNW;MAhi.6 ͏[;5{Mi ָgmՋ-ڱ{t\Fj.2u.:+N]:d Pa-d@gi -u C먻ٱ*+ vX0ҼG0}69FM2J[XOrrUZYn{9}jЂ#Fi~lQiu. UJզ0gRZ^-ҿ=QiQ \nx-Zr-#co)[,Ys7)ʶuӲmC3zd{6I&{ORտbR?Lt֕_;)pVDJȫ+Խ& "t4u /PcPTM;9[b^VPYͦpQٶ,B2RqЛU6is>) , -endstream -endobj -584 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 583 0 R -/Resources 4 0 R -/Annots [ 585 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -585 0 obj +589 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 639.873057 101.433071 621.123057 ] +/Rect [ 101.433071 101.373057 101.433071 82.623057 ] /BS << /W 0 >> /Dest (cb77-1) >> endobj -586 0 obj +590 0 obj << /Filter /FlateDecode -/Length 4914 +/Length 4725 >> stream -x]KHn篨0氀a{^Еݵ RDP!*.7ntW )U~Q){r6N1{ _~wub/_S V`y?h|XAOŜ%eEr b8cJú햕!I,K+ȡR"(xOJ)lȋh$SN{-BI9CS8 Dd1)Z!vK֕DdQAisrNeTi3O>Y$֓mZ"( d gYUFYW') jȻZybLt"`%0$MK'@$;䒄&h%0O.(U<% -x$$8xȃ,6; ,h a8+a:XpTXS:HX`SIX`6'a”kX.=JX`#aZkV8வ) Xdu8*JXp##aVu `+IIIX&)'a-@ >h%,p]q 5^ p8$,L%F]@=xJX&D۟@I$,]|"/O:BB˓!KXب L'F;jKXs4 MZtE^TNI, O*ID^`HZJX޳r{DdHX<V'e4VXwY‚ܥmS‚`pBl$,M9 aA -<|"/LDd<⢓mNDY1DY2HX`ѷ@8ȂHQ ٔsDA/)EK(aAnV%,@.5%8% xIX3dHXhJӐAtZ‚d A I2;4rIZ9Eyf 0Q(a&RAXJH~l"yz'aAJ$aAJ(#al(aAVYd )%aA q/)Ldo"6@f ;<Ȃ) ~ LB tx$,!P$,@|XHoF\$񀻈L@VGg23QƙĊzb@{[Ef#E2jmLIJ"sLOD`{ftnݷ7;_tgl/JJk -n`2#ָ}Jʟ"!| sR l?$$:z#/ -T v@2CRОEϡB~i,kWJ>/kʣGW.>%e"$pHVȌjARܪ>]Rs]2,i:ƿ|ÿ+?g\~NuX4E0UukvW?42cY ʹSx_^}eٌ3Ue:3V?˧.im%5 Q.9w`|ol7Mv\~6jMmc֎-huy_I2?sMk'<"iWYujYj}h6۱Z#r՞tVncZo8+V0̾}ZM )FL&^0mRm4ze aa,j[Jrty: x6x3Ө^VẄv 8jʰWa_ڨuu,VS(5xe_wd\O2qFn֡v,-\qh^fulM`T5?CY5X(ORn,J3,dZŬ-̵xlL _YUVْOy6K6cT,m<ֱ,,D͡DaNv"'_Ly:k8|}RڳT@,{ϳYz uO}ƹ֬@;:8Hٓ}ΊoGb~ NHzX kWVlܤ}uףص>O^{!z֘*tt'<%i+pkE :"6gfSpso8Yd}d7s3l1\zV| ٝu{ݏU `dܺ7kP<=׽ q1idgNwٕ5`9/g橃&^&ǟٍ{^=0ޱbѓ}2*O|2dla >Ogߢ?{gZY@lzYA}7V57>X,uv+C y6 ׶[93{&*]w/{|qnz{?ntVw;6OG7,\8 ␇k{ w|R0Yx8F-kGyYX#W˱w:+ȪWg^;\qfcĕ'<5y5x_ӡ*t.gIAxC|`蛼&L{ZNIB rLPh6/ց\&Eԕ~=yQѿvQ(QofRc:f5d-ёdhk?yG4%Pk6R9CƤL{NӌVeWg) wDҡΙO&-zV#;*b>O27[>p{M1s<4TaҎ[jT]؟c梇xРةum5,^5aa/z8l_&25ґ_@ 2K4/7嗦j瀭zt%(S%| ru_d&*@άK(Gr -i҆o%~2CjˤbN-Vw(:˛q-/墳HPW #B_s9I&Q  -8S[1 Բ׻v/l9qX g[2ݽB/H]BF:޶;UDŦd<6n Dlk[r"^/֎wJסvj4˄ʍk˶ @^Vkrm'2o+[Ի.J7uZB;GdLVٍ'vGX|5=NlFNKk'f Q yI1OBk%qzh$ h{[.cY/О@n[Q=*T5Y7kd}3雫R`!ݷq;94|V\әM6.J͍d2T'dn'c.@;rֆN|cw2iǽ^|)ۜP OOy7iغ"󝌾0($UbsF4~'j m7UR7Սˉ됑M3]-ӌAZl̷M߰K۟KUWpolߒ_ؐ}K|P\ sl%&$w|),.XA\fЕV5Ali>i^#{}/"Dmިn d-a}[ -yXmANwZQFMI]&E Tc),ݪZ'QKgiW)U 4nZd[9~wldhnT[Js݆낄oZ>g:HR ѩҏh-_RGߝ]bܮl+"VgrLZ5},;_)wJ :̩M%|ZP*W&Z -z}STZ~3uUR% +x]Y~_,>1^ <f󐿟(Uj{cnU(?KY C;s|<}:[) ۳VF# |ʻ um;gGSҞ@*QEԌ{err)ȩ`F T0(Ux3S gTR`u0Dvpht\*:i=8o.98-6 +,l`s:[ӂt(Ndt]tQ6cX]N:%`ւI9X`S:(tN'lduj8-GADe8PA& +q0kTqsV[ Xl1p\z: -Z) -p8.G0D ]]O01xCr:A׬.@'=ޛSk!`s\]f@' >  0 A3t.tRr\l7qAPL'8. $AqA0n W 4&8.@br\X:آ EqAE qIMqAQd @ qAMe8.f j&x̸zs\ lpQXlq NzlQp\fnِ֛@g]L q\7rk{ l@z-V6d <3 _Z#Aepl*Ra?f0F<$#w_5^I6~&==.E򟄃R@Et-qa,aJ}FId#0ѿRݼZ`7IhX[fzEw'tT6vd +lx?~\{:+>a6.0=yLk-HDiݷmّyT|?&ûttZNDi4m5}c8818?,>F2NE\Pj[0 teS7O?|nhVL|xn:7.1>ɦ4P7M(nLl W'+?zɦ r!ٱYp +N[?;log!\As4o_!ywd'oC>>ꕚm'4Hs$(VO rq)KHQB^ߕ4 sTa<-cp{?2*ysY7qGF"MKσT!x pG愺3jZi6DLeŦ@ȡk& + +$SNT*!{OչNѣku&*~4bB}yZwc3_[^MhzY63|fy{pi={ע},dܬ9{ݽ>6WCXAp+%ݝ!j }ћx/;A +gq;gs7.)xsSO4±"x(ckkZ]r|oJb;FKڇQu-9a5y΃WMۍ}y >n>v#.Ն=M9t]KM]%+sٙpkOw,]iehiEՖ3Py}5jnׯuɣVO8s]ؙhUG\l 71x+HlM/x%0Nج~DK\P]4]ڍm.z'f՝y~>2S>5oq}ꯜWMV{ǕѝyލH +. Tz3K};w; nÿ\zwDl^| +C?b;B;:9tW 2WwoWݾޙp݈ ^}%!Ë٠gD-=0УmߖW{ܙpg/lV +'7^Q-s8oW. bu_+xRBw9B/W)ZxO7n(wvq?>!7?j][\{w97o$ەr3MtXꪑ5W +Bs8V 6xI~ޭmٯSXA՝yڍ/B4p(; a?&Oc%:ݙƱC#EP/P_/5y*%l㶍/\FӲ׹b;;aT.$..U[J}1ϠOpi{bzm:&$Tu-+ۯes84 bIݯsygKݮk < N4/L+>lIpV@dn|unzr]4Q{4STwnLO0&h(u㧼ZMEԶm{4m{-Ry+ޒ.mى6wRgٲn3;϶4L5UTlv.g{mq_PKDmJ#;9pML Mh> endobj -588 0 obj +592 0 obj +<< +/Filter /FlateDecode +/Length 4753 +>> +stream +x]َ%9}_qGKx $4, T4 gzIgR5E2tnFx Ng^}WRHz1Ooo¿buտopw(LN'[0L.Ϸ?~q:)%o N!JP)msSyA&$` dh +0Rt +f1QPEa)hU%a&I3trAPi;QJEdnptFO>&D]N#鬝| KEIG%%-N)I[ %OEMf;,um^Um]a;r:?}u5h/vkY~0L : +GݠFC.¡¢jbW7(toʣiC\1]dP2gz1ϣ+C$ۡKtŤ$&>?W oGAږWVӏݵ&&eU'Si#uR&a:y8t!^Y(X`kNzvUCRs暡}$=#l+A+ыyǁj/i#'^qGkTF*c2^ 9GaAKr{yElz1ϣ!Ǧ EgCAp,3_p>_l9uOW;gGVRf>@#u ڼ˛y-á86+Oc< < 9a[濶/嗲>t\8=eS`7qgykeo1lvv?~Z8r/3h_W^hh'{nw*V1reS`|OM 2h+6xAn Ћy'/*7#Ϣ#O"9D™{b݂.]áhOK }&ޟ_lSϫlceQI^80CqE5c>:k>Ѥ6[D`K4Ejy9.$W Nح0I%~ iLg`(-49Ptc^,Sr3)w̞zyud3*|^'5:v~Yvh0"!Ǧ[NX1.BdNxqQJk۽ wDω-*#{օZ:AЕ@Gܧ޿5/#vM3u,XqfAzd l4bC8LNp?Y'so odo-tsoN,zESmF:ޮV{!gn\ Hif[})Ճ k*x\{t|DQ)h)œ#.y8C^;?OgG.j}ˇ!/y8c=y "{ʳ^eoesꭶbC{nP[ףhx5Goc<qY-[L:u}:Og|q<8L)u~T3gOwbFgdZCI$ +rW.!~-<?vSߕL)nuQQ֣aL.HZ9$?y[\yp~1ϣ!^;$ +~Mo_sͫCϧINZ6ŷ/S6}sɯ nZ^/Crɔ5嗣=iY6loI~mdҝB%]IgNj_ʯ_],M>5#|~WhE?]$ڡ1 odO 01uZ>t|`h\i w%ÌTId[!rzsդ1oՑ7ԮqrzvVqT /M/?ah+gpU̓?heV *^;:$y@Shi;w*f{騄L5uJڹTc늺*f ++\ U15P~^Uje^wpw&;{q=էZn"|b~,4QukufH>gqmI3< gV(K4_7:rǍla*L/{ Nh&ֱu u7kjU#RWU ]a'6F3@4x2?oڄ=_8>/-Vo.c6%߻"qI۔-.#.BqUe+3}%l?]a #6i/r+$mL4~`i*}a,'Km:| ZƞAN-EN[%+"[UZ&J"%b_GKMӮDߤrˌW%[ 9֩ƒQ>wRKil[7.k5C|LU6)_;saAJU~Ne˘Ikl,Bm8^vG5;&V߄& E:WtEoI%%6eͩNP*7e"7vg +f$W +endstream +endobj +593 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 592 0 R +/Resources 4 0 R +/Annots [ 594 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +594 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 160.323057 101.433071 141.573057 ] +/Rect [ 101.433071 371.373057 101.433071 352.623057 ] /BS << /W 0 >> /Dest (cb80-1) >> endobj -589 0 obj +595 0 obj << /Filter /FlateDecode -/Length 4805 +/Length 4727 >> stream -x][6r~_ XK@@89@y>`|/JʶӪD~X,JM}U"!<]o?]~!8Q>]08|tןX`3_._w&.3ϣfH*C!('TJ[Aq^Py=ST02TA):I3Ș("̰]0A: (%`"Fi7x4tF>&D]N#| KEIG%%-N)I[ 3wL-$%qop qA+@WԥA%.p]В"Dԅ@?T$.]嬕wuF#q0l1 guPL!J%xW$.]6%.&J\xFiH!x |Ru~ ((K -$q!%.Xc$.e4oqy[q}@`!&" XU%7C kQAhT%.Zjv$.i $؂"q!xN8ӅNk -%.&bDSK:RΌD`` u4!qN,~2GH /71&7Ix|$v%.CIG7 I\q(qA -M,qf lqpQDlӔq Nz$Mv_(,4vݦk?O[1-e=?2N^wpNHyNj6RJ R;q=roQ{Qz-|eqޑ82"l5dt>.6{uun4n -G9i~~Je%b,.5:Fo;vUPr:rye4u9RtZwu];HｭsDG*jCKJj9j6f0]<:Cofr̰e_rNbí/쭳W^y/˝Η##rmՏ;>s6mS#kLaf3GԵܝeT'̃yNm?h6mfOOWZ}FrfZ3z,кg>G0/7VfK6 -9 -йVL׭ѥ@rNwmo{ `4g43yY9l7]i -_yY[9/etg}м<wy7\Zu-ͼ/0MӸ2\}_K:cؚqܯM>ۺHGKڗ{V5ɖp5{CWM;cyN>n>w\ G6𦖙l5%+s}9trƽ'z>WPD,"%ys6TN;񍪻_*y~, ]8t8"> xq${l(;~n "VchAc=t=c-=ޭ4(mh}ZٯSXAՃyΆڰ(g)Dh Or0z1>g}Y>wOfqlhPK/ɧ=s:W >J{m Q,cv,VD<`!؛%$Eu^Rvk3k36\>gŧ4^ 5#Wް.+1TDt9t>뵳ϐ>`!8y?,H-S(۳ftBq4,mm!5jv-<>Wg9}T mj9uv:.8Cww^hCϲnƱN;cO=t00 - [?#3N_dfr6F?ykOHL:zk6 %͏shj^ާx`w'6+wȏDT8A70uķzs?Je"c.XK [/{{Y1=u0И\ӋbvY[oC:`=6ik&Rs7Rз,`x{?cYYt썆~Vnr.â~=R|SLtCqs7au%x%ttۋ)ctщnfэjG/Gw &A1 E:',ۅ?)5Wp~*r";*rX"K1߽$O`+_Lq> a-ڴqWjn)TMuUl(ۣt -msZ.7Qʇ.rUd1*)KP'AtT.ЙE]u $*RN'n1T+=JXՔ -uK &i1l:{*61 ⨌*~ v+k)xR~ C3*\2_4H]Vc}aZq )`m/I.-66MC1IuA]3)\ -U6U+P~ U=WuwWʭb_Ob+rgmب3c*]V@ -U\imZ؉O_ fϗq3֙/j>X{|B'Yq -[­3q;1񠘏2lXǚe4y==t2ή*町0.Vj6bSkmZmo]+G}S'7j,E{;Ug|m'S:dh eSad@g -u5NmY6E.m/ڂI=Owd#ڋci!9PlB#َ,#"9VքZ4bi_6)gKJ@U[Ei;,ǀP Tti^l +x]ێ}VHVy 0ym{¿1bT_oZ.I@~/']_N_y}6Ch{I4ི*B4 *kuֳ J*A`״TEafI3t^Pi;QJLFi;84tF.DEN{#Y[-A1lQiIgaJ%-H:b'IaADA` DlQNiIi10 +>,uF"%,I# +传3)El#t K>a4ItYtDAC%G @ $0좗xhHNbҰ1rEl-H ql1Lؖ t*j |J;  3ƥXJQSb{ K K%J!-`ǁt KZy ad$.@XLJX)@c$.`𮱸i 5lQ7X- X 0CgH6%X𮎘1 tN '=Z\hA;%.]LT$q>3w5at]mw7X A۠+bX.hH\YxPL" i @ƃ*qbz8D8b=P0VpVe4zXҁwQMӦ' ^NtpDpm%. + u=K\z2Fo` \  Qp [)J\&Bd[ZU93u:%.LZA/q~H0:[0T$.T4\i'[xi-qA0ޠ234֒hjI*3ݐ\E 0LS:V,~2G,qA&-7!fZoz -$. M4RD4,qeZo ")7m$֛^ȰEuNS-8 MsD :֛AXo£C!7.ft]xN\` VZ+deH+ F bnC +܋ʋ1Mk$1h3 N`ZR+1lx Srǜ|Ɉa˚&dؿ; 6F򏆃0fW&-o's"d! |$O2j-NAd$05VOYZ}*wfyCGmP49gNV\c1%lw_>< : ׿|t=s:|.ܣy_Dl&y/M}^KT'.S|\uaބLj6ӵL,\723AYԭ>~ӯ?!3l_נ.,Jon:vWPs|sx?Ԕd&.KN).~/v96Gz쏛z^g +ԋsUU~(޹wߌo/sdGs ZAUuإoj_ájõŦ^yKrv.SFӆv2Fݷ]΅ܼH^u\P|3D3o!T/x˽@Bdk!+Z+ + +:te>*2z*NӗGLN^ѳp6Fi-7f՝y:sWNJ=$n!8,s?k<gN乛Ge['w|fn82784h[ݗp-4 iM:݇@y [qB}wR=?OSFBK׻z΍܃Ao68V_ss8nUoh޿le?VD-= УmߗW+@qg!6Cˏm6jGx4v ~ JKuO-m@]_YEha޹-s8k_3W;T12wɲ|ޣ&OO{- #k+h[HܗpH܈lWmor;#º7WR6d1֝yPc-=ޭ4(mhٴk>Fy ++} 3P5QR^Ak3ݍ}y}e>˲l^u:磋[ݗp݈>|xzWq.yY<fs4۾gI"[uyO+34O!Nٮ0O7>g)Mڡ_cB͈j1Wɻ⧣;}ߝ3/؍{Dz )|#W]sAg^nE/m67Fyn] 'yɏ `o mj9tv:.\xԡ;DN7FX'-ΘFs8Loxž`32nuGS.^kN)p?Ϋ5曹?4bk/qFiSįS v9~FlVיִo=q+oajo{덏]t界+nE؏v]&i̶ol=rtyƝ1算¼ť@IۮjVb fm~cM,uU>s8nkL}{'5жў+m+(n<ѽOfw9o{Zt]wOlgֈ^(Oﳎck>)OCY*TYܤߧV w4y'o>6,<ݟuic7}Czg!2n|7{: +lW{b+h|ܙph܈yYΐ{q+&>YݮsP~u3:.좹#X}C"3Ц݊s8nCJo}Y xODS. ڤ#Sώs:'(bI +9ǃf?Tٳ*G"L\L?IGRw='R`E9,SGUbا$бN646Most~ L Btz)Nw=YaS6CX 6m-fkR. g{t:4bzt;o /'TKEsQu*2jEjs!\I]N ftf7ɺ +Ct1Dn*͖%UYcnjJ:llIQ?.@kܘr\FbRfBj-*^4=Ľ~̲tPJH4HU$"7R+wuXj;mK{_0۶JHH.-66M}%*1낺"Nۧpe+TTWŶ@e&v2T\ m)]ΗVKt[`> /ƽ8A?Jب2a5 PŕF_FqoM>A&͸?N4gȚt:ŴH[?cQ-L֙ҙa8e4B W5h(1 _sͮ*町0.Vhk6bSk45-co/]+G}S'%C5\Vᢽ\:%"q)Z6MF\ⲩ0Vff&@Osj.7"]Rqfۢl& \`j/ڂYƙ=Wd# I K+-7d)n~Y:> endobj -591 0 obj +597 0 obj << /Filter /FlateDecode -/Length 4726 +/Length 4741 >> stream -x]ێ$q}gK~ =0l/`k ؆zj%V~dE^5*SA&3[]%~S/Z%bL)S.wUT]" "$]t9&WYQW-RZ~$5"cT * rNgT^ 41%N3\ޫ̰):N3֑QEalP^`r* JIءHkft {N1t*hNg*8]{9-.IlqZ`51p:[7thx'1[`RqdKZV1{NhtJ lVNiK8#53Ӂ' 12U6(N`:؂@{"(#H/qC6iˑFh#:&aC0 )p<`N+-z -#,F$آm-qZ|k.̔0r\`@Rs pq^s\`@Fq$k r:s\vFEq%a9.@ -s\wu S cp\`ڡ Nj ,xW[9.PGxp`9.|60p\*ac4J<"%<Ό[xY(p\q8^`F829xW$9.p] A(`~J. bwAKBF0 @RDqbzOxtp\"auDq0l1`UH t]Ü+eHx.M@9.QG+R$tXv e:bH&E -Fk -8.@D B.` ®,lAqLd-yUN絈t"t*p\XKAq^Pq̀NY B-*`*Q#2t - .tJq\5lA4qAL/9. $\鬤uf Z/(T+M0%- ?v`&9g9.Qr3r\#lRs\lz3p\$lAqA^Pqh:)9.H*b-ތ$#xZo -! --3nIXo8-:Y ތ z=%iK`&NEd9.֛lWFZqFv@zVv@{1[v@|inL,gw 0B$m ',O "okl$[˯_0^_坲 Nn[cQiTmH,",ld&oE^iWtZX`_L4/ ~w,ys\ׯU~JsҪUei^)m)CɾOZ-¡wh,_?,SڅA.Rus l&oA'*[U/Ͽ×2ULdg0Vs@#ȮiZ=u\ +P"1M=zp:"a3gg< Z|@7y37y:Ǧh ߍ9^=yow5Ƽoj+$Oײ>\2=0̓zJDlGLC2-v,wgyAM7׳5Nmkmx^jnTlq6eLB[=6gl~ ڦ퉞t= }`k2\LhC̓;<̬ <+ ~to]7\Sj[/O=Km}-*_F - /_ˁI:{_NdX)azVگXpVĔ^xv)_ȕ+vz~S|;2ja\^ʻ۔qMjHW'oϾjsCeׯjaq"r Q~h6mo9yoOqScК+/eVƇ6ޱT#K x*}K kMvPҞpS(uL/\u~]Ovi/| $NV>]>0svC_knz -Nج0Q?J˹뇍EY6I8^rۘ{syM45зڰ?l5Q'&:v~'qQcEa.^حc -yNQx6oCу ->XɣDgJ h|&0zbrx`d'Y6 S+Rr1=iݹ[q'<,kd垧P>$+Y|ڂ/f@dߪp~yh{8c:K;B1'< RC2ߔgn?*_y{{GGEQ3h=wymVtwfjCǽyo0G&jSӇOy6FϱDst ifi/^9ڪ6!í]ѳ7=;=thۏ)_}TO7-ۼ;̨c_?y8o=?xy2ӡr?@_ :-}th=3A#WXۏy-"~=t[Qx.ϳ0Ǎ1"n>CkVu/`⼇9c̼:q(gexh#Ǖ[G'<cчx3 Hq8<~7E6nLMⓎܲsM;vvN\Ad>> .݆3옯s{PŶpdkxGs2ϳ!J0'|zGҭƿf:~( =jzט+p@UMQY?Fjsl -~'/MGpr9Ei.qB;E{6|pdZ0,0p$Rp譕_ %`n{T~7Q(M/z+!]]hQj7Xuș_sKU.ŠR܍EIs.*YAϧ{eG]/BolZOIXVU5a@A9qBNʗP~WћL~R1#DNz)T[07SW혶3 P]k[Q:߅ujV; 5һvkQջZ6JMj!#]wmљM?p -$ҥ.lRk=ZسnJ,H#ԯk1o}-}']m#..0] -*Fm(;^|Ь2zPkRbE)zgclⵓFoc9(z]*_$D-uJ:lT#j&& -i\9 -e5ukP~[ U'[e^ pw.;Fqh=V*b~tm nH;eqkd܌{9m(ze!s}2kB7n]Ǚ@<)FPm Bmb{ZWq=^SƠiG>ĺAW+3xo[ }'维W_Vp16LC}J!#.Bq9Te+3 c%dP]FХ:ۧٱ*˭ 6XUciecW{1@FM6J[H|חm1`wC,3=ӂ>4zhaW#FiJ7VjlUi(]@&Mdn-B)􏣧+͉nʭ3^L ['{KFFMj{JSeuuuͰ#Sٳ%ϴ?y'D_LVM+N2z"`5pW2ք=.ބ7(ұb(.>[lsiN?ȒP Td(g#TW' +x][q~_Vx} p.836<+7IfdkAnUR$?~,l}UNHz1Oۏ.j +N_NU+ +Gw6L!9Vc~qe}5SJhwWVB A9AR +* MLIR V`$ c0RvJ0M +f䂠 +vh!A^=Lu:vӒ.M{%t8M$l!zDl11XI`A$Aa ElQ^iIR$u :Cr*IM+00H>:[rIgt$x0[ ntH DA&!LE & +J4`ȧ U:%" +8X [3WHk` H\`-l1d%.`[Z$.[RIK\`paqm$qJI εN ,H=H\`y#qZ^ ޵޵9El%.;NVG+qwVAb 0p%.V&&*&` uax84AZ)#qw /q2 wA!Nv` V+q +  xW',œ[M:&/qui=.[O8.*+q> +wJ-$%qop qַI+@WԥI%.p]В"Dԅ @'?T$.]嬕wuF#q0m9 guRL!Jc%xW$.]^6%.&J\'xFiJ!x |Ru~µ ((K +$q)%.Xc$.e4oq{[q@`)&" ؏W%7S kQAhR%.^j'v$.i $؂"q)xN8ӅNk -%.&bXDWK:RόD`` u4!qƇ7Nl~6GH o71&7Ix|$'v%.CIG7 I\y(qA +Mlyf lqpQDlӔy N~$ɰmpfrhQ/ +ceh|V-%{;(i1=rUKZT_9])8mNu/liy~gy-3,kY/6zJ[yS=cvkFk[^nH_ڹ +amhVs'[i/-cshɖAQGx~SmQ]ssÞe<[c^xO({-*pMBbK46a ^rctE{r;?%1rgϤX]a|;=D_^'P8b~eO;Rvz9dw<8A (78[y[m?eǦKei~?ZOrV<@<>G{FǕ칼SA3T'uho|uh2"Ryt:C/=o9v8kEiŃQdl]x,.jmU^;huqqJ*Up'<Zk*1MVQYBr}d5hR/eզ3uI5riWu5~[}s3}%%7LG=PK9ws#Ϲf4=UdOeZ9ut :F[|:3#w+<ߧG K~ؽqm8 u03Fׯ<\wP?dC}?-b[vL󷶲*wh=̷-WXwv1\C}C ܫo[ѥAOwc:PoEWu s7>s{}ÝfvJ͏kQdC}_MW],y3;8\xn9x#e^$kú苠<έO/mʑb7G[ڧŖps=wAhY|h +{x7q6|iʎunZv^<^N;?g6wP5D,"%syp:yͣa|ܵ_Dڄ!; p:VqM|z_.#m}c >8D"dGCb%O<]!-|޽]qmtg[ ҝ͝vQ7]| uT<}"2+Nan(hΩxd3z2á੸U)?{#7{[}GdCnKQ]t#_W櫭0g鉎ֆdž̝|'AoM{y 6+lxڤ{ڰFʷ\^[v<続z|Qy8wn6 bw~3W;b!Ng<BFS2|#o{vHrwٟ7m]?kD9aW2 a ZN?LnUHo;_kk}[nph ]9v+86pWa/n{qU&> +AhK{˝8wM;A|oanTkMrI>%>^J~jdhCD{wm OVx]^>i!]8Ǩ,:L:w̿ZSKU~@|e)hχ0CUGS/‡Γ &'9YX>Vv0TaJM|G|p~WaؘzŘ+V̭W.b>?N\f +Vф@{CjP uj^[.l]iMvAv-}|\x-QMfR qD Nբ è񡫳0V QKj:AtJiThbϚjwS:ml/n kd#֏K1Z7f#]ůԮsrz6qT/]ʞ SJ +פ<)>v_Jxn6FoCRh +=]:ٱtTBz&ݖB:t $c) uMVq(TTŮAu!v6Ujy=ݵr7|š3Ux  X+bj+0Bw}:[;ԏ}I+K^uOV4.tz뼎4n]Ǖ@%Ta6@]cO*:nԳN5n vއ4mqwU/6G[Ǧ/󥭍㓵j.2vKu(W/В2b,C[09VҺq(,5\ n_ڮ̎EWYnŐ./ƂI=^> endobj -593 0 obj +599 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 422.823057 101.433071 404.073057 ] +/Rect [ 101.433071 627.273057 101.433071 608.523057 ] /BS << /W 0 >> /Dest (cb83-1) >> endobj -594 0 obj +600 0 obj << /Filter /FlateDecode -/Length 4629 +/Length 4916 >> stream -x]Ms$@ $p@9=6Uj{촪HD>*ؒ>+|_z1oϗO'5o,1;_7V6 N'cPBr& u鯿:{^G͐7ڝ6, !JP)Mʹ!㼠z%$` إ* T0Ud* T0C'VCD Q֒t %у$QH:ti޻(,lqIiI`*I[, C%.CIG727֛X 6 qA!DuAS-8 M$+qA>73DD/b^o1]u $L8zW ^ʘWQ(PoS - oĜ54XYF/f VJL(/1k<3c0-,hh5?wWchci -$ CqGPBHlDHH ZnH0=pxʣ|-+OoQ!TvVw'u|K,qwO/o=k3775y_xuک5ᬕzӵ\m'^1aY{njsj/S{X[:X^mB{Wz0_;dK^&t:ޘ9iYw4"w9F+ ,[+yQuckuZ'_yٺv9w\Qr,_լƞ?\V@,ᐺ=A煶\~QY$:GCxogku)ݱeW2Z#B~2}rLg3I?ęկBM}j5"<:CFw XP(/d3ɸ|6mwo6 -yk;[}8rn?_+cVGsղ[ߪ^m{.?ougáscޑ∕hߨeδߟߜw'JoZo22:GCfȤlE*eY VS#ţW;ԟ#^{o5CĦ;՟Yv4BXZ(?.n!x_!vZeffDuw} |~-}s7c+\#x:GC]; 9!xD^fZ~xA}~7!w_}_/m}`,ݟui#~Czg!veٞ~Yjz} -+w97rn}t츰-6$2CNm|:CF>&V>-hEtϓ7xY+:i{t"|Bx rM#\tnf؆c5,ɏo`6Uqgo4s~@Tdu&=v>_޹kx+/cSOږե`]_aH}Ir:ɕƕ][oU)Dۯ'R^ zwŁ#_Mq akVqSI1[ -;][$|Vyi6 l8o /'z(o*M5ʈԕu@l'At9 Tib0Z~?U l-J9At9\PKV5o4S/>!4E\V,u&6k\\kjxi| SWpUgmT~CJ;j's徲z@ʲ!TQ 3ҵfReLR1/T%XWUq?+P#p&v3qթ -yjM+w>sq#n]" XNFUoNƄ0B7}eVv:}lLr&'ƣ,}/|u!W?nTe Su&,3wa6Lh,&ֱu Տڶ{)+BMz^^KǦ9!i(hX~98MG%Y8EKVQf H~~ˇ #!5mn7]dU"'M3{^/d_f@Vjg.d)~~X}Aj[ MZ(Vm*ImNZE TCOJW^ -5hyO;>*(-FKT թVƒQy^Jm+IE' 1gI5|tmEj$Θ$԰.jeavj +zh("9kSу$3z +),"d:If^K<|d$k$.Φ(t*Q]LVEb`,t(.*(-ɲ|NΉ J1meF'k$zeXQ.A,ʠH2 ]~$xۘZ nd(.|L.*&%LI$`\rIbb 'rx* X] X ]V(.6; . q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZe8Yk8.:A`e2)) x$$.p]8a Z xx Aڹ+#qgQ7x. X Cfl2pK$.] kl5锃OIGX\XCx.6*+q> ;wN-d%qo qI+@WI$.]ВD @'?T%.]孕 w#ʠMF5a +k Bw K2R1K\mJ\"$q BrS1H\ .( QDtqI\z6' . .p$.G0e [  "SL6c$ fJt-d:J\k KM ^DP2$.`H\hJ$Nt!Zd A I2;4bIZ9Eqf 0(q "M0(. 0?l{  D#ʠNₔ IₔQF`(qAVYd @)%qA q`]R$.V!D'lśQ젋"ʠ ,[pM$ d'qA$q ěŔ@x3`&Iޅg$.MxRl@>?"$f coS +܋*9IL@MD)Ylj% pœ})8D) 3wb^Tcc.( ɘn[c6I?EC(6D]I Z\n$?s~XiIuF\(n|0Q!(F|`h*?P!_-Mm%p5S=}E%*S`/xm(c!Mp}* +c |BUtK-Z vԇ~d~z(ʷh?~NuXopkp7CKWoK[䵣OMX^w,vEWz.EVu.~QNgշ~>XB:vɹk%G@6绐_զCsm`4P =.,C<Փm po g-~W^zm6tX,|sm>>``ig43aenc5ե9t4{xy?4ʶ:o˜3IٶJ>εy:w<_=^;Vgv] 2aP_6mGqLU>(:a5u6U`RF6O~h:6&0$U>Ÿ cʓE!0cC x9smZ;'; 629(:zeJPM=suo0;}~bu1tllt Y(~Pۜrn:H٣oErݸ3}d=yI}Cޖy$+@ލ^lt>ȥ8*o>;|ӓm՟YhZ}g3_ү '8mcfLTz_83H;?j6y7}7Oy:Me158fyڞ|A{4t|Cx_}0N2~$m"ϵy:D5?r{!mA:|gjlWlthdgCn8ȇ>o\^Fwц'ܼ6$߻' 橼 S-./:P[,l'-blxaM:"u=9RG9_ohmni\d٥Mћ{z~ntuhYt,[2n]? ]{vwosrm_Ijj[EiLf>\f 7qF:3[:r]ӛi'KI~2ye/e=T4fޛDɠ Y{dgɗ/)-sf/uӂvr-`yetQ9̏g:iVoÚޱ{m0[mɶRwe6تu{ü3&e;%5i=^;iZ6Io|'ԩ>ρ1eitGDk;G.$?[).K\8]|#曾!Xr@k[}kݽatpJKW^ ~\DGzڥrg>G}ǜIC28B|;Z;[Cay: QQk75gy VYrpctENڃw踷d#sVsҶN@ee^9m&0: +ہd_}8I}}l{W^DKmz򼵯RvGVؙ@+.--7?7Sn9_.zږsAb5V9X9[]KcQE:Q\aCX|!S<~s*[/k \nZ\Ũ 0Qw|m'YtO_ǰ.!9*Ikpe+$::]IN?Z7v(:ěp-/? !%/R cۅ] A1.Uhe7fX=A<ڌNzEo,ebRLP&\ +;wxaoxXb~[zqUM'7Ӆ^Tlk]t+]p[;t.~ZרVfRZMk$.B7v0MfN Skr'.b7f*Z7]uᅲEF:@mUb1Ż{G\|/VTK/OXfg𭔘|ЮAWW&6[H<4q.3aK'%'mVd<T#unkDa>+yJv7(-U͂fp^wf\aM/|-͍Toҋj]+슁zqѷR\Wkcr0/2iǽ]r)ۜP2# hCOok6)?eD endstream endobj -595 0 obj +601 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 594 0 R +/Contents 600 0 R /Resources 4 0 R +/Annots [ 602 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -596 0 obj -<< -/Filter /FlateDecode -/Length 4702 ->> -stream -x]ێ$q}gKk%Vz3y֨VFMUF$Y,sDFcOWR,.;MQyCYࢊ^~.U9k/YEN*CTޫ*&,`di0r -fIP%(Uea!I3LQP ;ZM䬠3^tzt֨͢.BgtΩx# -!$"-` %]-.8-`MI[,z' [$`HωHeti+ӒM'00H! -: [Yﴕt$x»0[-ntXI 6DAyIlI"DIbD6{E!G6Y#ӰSBL8 [@`%'q"qݒF%m 3R (P8pwJ\@Qu>X hQ -8#%. s)` ,qQ9uFG id%.*0H\(6i6b uQa: k= ]뵕l@Q-z]P=tI\”["qO`+eRxI>Qqaޢ !K\X LVT+qZҁwZޅ%. q7e4+9% a鯗_HY3k¹o*vp-/@l! |O6"n-A76K1|mdX683e[rAy>VޖF$>Á9 lLhпtAq[4~9 |dK/?}z|/~dp])'4rU&=/ŕ|NANqL)}ѿӤcsK6S~wSJՔ4w҄07=+ITF٩RF3kJ:xc֭`; Tmf :6 -gb2 \TUö+M9'Kev`ޱCxoD84GIܛ Mkxs\Z&IiK<<a50QmG/-ןMfH7ݚuߔjsCen750b2ugril -Cj5}?ٿ%»TXahI(s_Q%J⇾IB{7̵e1Mb1VRN}ۚ;gogِܼ+0ǿ~*ko\q'88t -c.[˩=e9Z*-.e9iZ!XDZif/ Β_Ꮓbu3.vb+3WV:.0]uD2vQB(7A(*{AkM8(&NuOj.{U“s +{1/e'WBO G t]r;r%=oL;(ܭe;[60ȳn{Z6n\}r)UGI^9pKG{F>OQV#y@ -;?LnPWn:t27HɹפDtsy)lo=xyYYV. O+C в] b[xjmUY;hqQe,r֓y.ޫh [4YE]ze9 -e#h˝P`rVH-;U%Ϙkzߖm%LE-5/ysy>VXn~Ui0U{W娏SGpkF[¶|:3#w+<W嫏@7+{V} :uVu;|y2ϣ23-V5j4h+WOe3 -{Ⱥ֓y~[+.mD -ȻRy> -y8?ހνy̺Պ.y>ݏ>X@^1̵Mu-Vnm?Es/_q<c<՛8L(w>jϴce }-;v^<^N;?g2wP5D"e{yp:yͣa|ܵ_D"!; hJ*T|y$oǓhY$pH%O<[! -|޽Y3g^{S -н1o7Jw6wEwq>hSm'<NFYȬ8ܢkoDwNŻ&;}ǝѓyOŭ"ML3 u>rS]ѿwDNy4rݖԻ|GW[aXϘ! ;OV^xT-ysy~흻 BhL8 \GC}U2|%oC|nHrٟWm]Ak=a@G#EQ+=wnK3yfu{(Dw -rc﵆I=%~Z[yX@ϽʷayjNt?aT(\ gOu8_cYƐu?'oK(ߙrg_)yKڑdJǚNrO-|ؼg2Ŝ2?^L⩧? 8zů>1',?Vn Ш:Js+B9}l#]rdT D`bnVfI*4S &Ҙ3Ӄoz-U{ ٺ.ta3}:3 Mk0 uk(#kQwn27הm@ ]7M̦FƜZ\ EL7HŖ*|7Cݥ,kѮ~\d6: .~(+n(xROU -U&e) 5HѠWs4CczPi216̎e3ԭҡy<&FKikb?+GF. ʯ qӷu,šq(m m[Yh-fZI[V^ 솁k؉~LZqo?_2g|Op-,s?7imܺ+E:)6mؤW4uځgםkJ4(mе =o^l̗M_KOXVbl.S׹$_"qI-!#.Bq9Te 3c%~q]F:XtV Ib,Xi^#> `i&}a,m'K] ˶rOZYn{99}jtׂ#Fi~lQi](]@MaV8Oѥ{ڏ:я6iܺ5o5ȏpulddaݤS*M˺j{Aݐ=SݳMw{xxHIdi,dXN!C!RB#os?VXXCs:7لW(b($-kIo!insԱ)S% .#og;$j#v>-'% -endstream -endobj -597 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 596 0 R -/Resources 4 0 R -/Annots [ 598 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -598 0 obj +602 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 609.873057 101.433071 591.123057 ] +/Rect [ 101.433071 180.123057 101.433071 161.373057 ] /BS << /W 0 >> /Dest (cb86-1) >> endobj -599 0 obj +603 0 obj << /Filter /FlateDecode -/Length 4881 +/Length 4786 >> stream -x]M$7rׯJ ~ ``a>LLKX|ؿ$Ɍ̪i f2`1"ghbL/'5X<Y+&s&PBr& /;mYG͔7ڝYCPN`%&q^`y=a)I,5v -æ$İD!٠iJm%F)Advҽ3z1$x:G4`/M{%,.)-dqZ% $,I HidqKH@X\Y(Y @KZ$, UIKX@[SIX@@\JX@\R씰XAF쒍^J %BMY`'ґ$,]*HX`XFF;V&wMTV 5[  IX`a 5N ,pX%,L%z]@=x$,@c["aOX@I%,p]1}"/M:@º'}wQ 'FՄZwIJ܅$,9L&`"/M*(a؅'$"/L0$-axRC%,]lIUHUnȃ,kò4I *x]Bw)a`pl$,N)/aO -<|"Oxvd럔ro4~xPŁat0ԙŪmv2NvZarwfⶬJ" K<Oaitÿ.4Fvzʗyt21A;7!8*s>(2a5e6U~/[a>Q >X,C5c3n<G"RGyV2+n+ ēaywVbzm8T}|nX2ݏ<%QY*jy-,m XJ\yDaN<K@٦|;yO/z ֹQug?mfdr-bSx`ߝܬ` =8|IDp[`SG|[)M8n8WR"!"# }"ٺO5!{uγY#̹r,j6r f+vrqW_?KkRey:Kz'uO}ڹ֬mG:3O{كuΊo{-c~ FHz5XY ϠolVl RS}8Lg3I˕+kBZMiy:K>j)7=u~ޚE<ǷaPq6q,d7cl96=L=X,kiO,F :21v/:meJ³r^E`/Cq<\6I Y:Og;άy+>ut<3RdvIH|ƮϽa}4hcw&npX_boGWkY,q@!76 Vw|Sm0Yx d~c{q{yYm_=g˲3d٫#Wy WG}s5ʃuNmꔇhq[e̩:ROVp`ΡfDžS4|w߰_=Cy:ɇޱ'q+λh'ougm.]19Ec#ثÿg;Qn=r'Y1!b>N9w|Ri7?/qK\WmfMf-v \QG\뽖Q6īxIu>VQ;3:oQPh;7N4ts=ZK 4jASo.=ܩ˵WU|O~hjKeZ)_ \S4Y46oےCTcעlRIhnz[kثc5ӊRl96ey-\YGZ敭Mӭ8׽oqL&sXzQ7Evn\!6Z@IWz~ZxVتu{-jwSOnSc%>Vlˮ0qX#$ -dU>Wk(t1`/њyHo'3uLeզ_c爯:G4c_>?˸'_L.F5%V;:]􎎢k;]tQbq>dg: &yWlVBm9 y<EWr#<{PMv6Uv5dUyz1;zK|wCu>ܫ @4o*.ɶm>0c>: eNJwgpNܡӲ;0_>*:MP]v v[n@[*MoA|Q>?kX6Oӳwu{`'ӕn̦3?E>gc$gմrQ].V>No8{;_ /5Ӥbyf_ZnTC ӰuA;YxV۲aDcwqc^^]u`%uCPݸ45f ebsdtn}}6ﰮRog$rѾk (YK3$朗>oTP=07"?Rپ+ L7l54-~xy}"2A{qjX6T9TʺxZ[5'/ZQF\Nm-:E TCժZʈ|NkYiJt|Vlnx[9nΡN͗ڍj{Iuvwml gz5*=vuT-بd|ClF`#K]vdcD*Śo`}k~\-)qH)@HuSLPfrr$cȡb"ENo_a/Ih +x]ێ}VH@Y <I\H}F fT#qjL-$%qop qA+@WԥA%.p]В"Dԅ@?T$.]$.]e:BH\: [aLYSH:aIU*$ 'R3R[6_2=VOzx@i>/&(2&b:wfyCGm=P29 @@&Wb1l;˿?Oчs_~_ ׿p` +>a;e6S#>7fҗO[]ϓNvŨФL~cZF{T|N0|x S;LFh^ey ^&jo vǦ+}e7?oi#yõUWX| 3vW&kuג.1elMzTG϶1NqZ)Vl)w[g]=}"Mۋy >f}uW+.g o{X9Nfž􀗳3u<=г~:WP"Z{&ys8TmD~`޹wߌoT{+{[ayJ]>貭P`H^n?ǓhYi/w9oaf?5tKR>]2~ͧ՛S9nlҡ`'>\Q*=ٴ]ڍe~W~# 7f՝y~~"2dn(yhUT|js8n"M9V84s_C w;860?l-jw9j7?^ĭUrܖu>/'+{ 3MI"[uyOJC-5ͮK>,>;x:&Ԍ^yúx.;bhsFc?빳egOߙp ~PcYTZ㑇z)容(shBiXJ<6Fyn%֮ z^A{v9mCl=qa)Rb㰬y% we1:iw4oM=<+ ,+ֹQu?effr6܍~^vHl86oj:o:ͺ5u-j|f)QUF̨Tbk? I~JYeWa,@5]*$JsBM[TZҠN6 h|p7#׹(}"ÍY/'gHl◓ Bj׸B=.$VnGҤً~,|S*\fh[!OikW<6xH\+X --k.B,o/>nM][l&eM!2IUuE]g ++S U15P~UT56šGU{k Ex'6ۋ3c] a &n42h씏/_ f8r&'O^>i_'{c9:UTnL;"Æ e:0-j^Rʠjе6dbSk4q7#ھi͡ʇpoMgV$r6Ck ˈ ^(.YY633WR>oyWP]07"_R6l .0 ^ռ4G0~Ledi*}zcYZ OxuΡs(P-أ䴡\ ;eزM ٬2QTLY-14xQlP}&R^񋴹2Uo8C;RV_2 +2sWm)Ȗuye=۰> endobj -601 0 obj +605 0 obj +<< +/Filter /FlateDecode +/Length 4778 +>> +stream +x]Y$9~_QH}HVHKZ1bAiEZxWfF;N*#|ß?luBh1oo/]N_N1UISGw&r1囟]5ϣZr$5"cT * rNgT^ 41%N3\ڮUfVȨ"06(V% +fRv(-%!Zri%|L: +#|)NENgaKRq:[Vr:bM duE`8]-I.+:"T.R%d q N)M0I>0: [tgtXp:3!FfjFl:XV[h[d` %t&m9mX@$l>TiY1Qb:bh؂[5Z8.0[+oT…5[ (PJpwr\`@5k h9.0]cwANV[` ¨h8.]dw14Uz cXr\`:` +`uA`  ,xW;4Iqj=H6B,ӆ&4 xW%L̘[ wUD$TǙq / }w1Q x9. ̨U35*$q\8oBI@%!S8.hIs\YX&auAHC9.]Lޕ ˵+N HOy}Pظ1Ew[+eJ-ʨz9}b)T_=]ҪE ,YW̫ J/i)h,){`]Ӵzt|_z#*Ó6U4ϞhŊiL f%zCkxsyvcT=N kdTYtK.G=%Z4oMtsyui-ë; G<#B39~.?GژM-f6F=>DkYN|X=0ÃCHۼ:*y.!r?|"iq y9SÀ.5f:s.8?[=[m ^|<+ʓy z?\zpƁfP4QJOE.cZέĕiU|Zm*(˜+2m,Pm/is_lOȘi+jnL7ؤt1w+iR6x_ڏ `&?]uXB+)7~mٶXmhm'igs>p6[/(F~c 2ݮ?e\۔Y1nӲqYsmߛg +m?ִk| omO:؛ʍqAgg9H}!r9e=Cyϵzk9>8K=O:v~7vQcEd.^حch`9`'2mmA,p4[:آB^TG;aSyd۸K})m9 +\0Fetm=Me|嗯,{Hl( P!1MtF`mXЊ\ jQ +zF;w#dC!mopuUѕ{B YͲZe.A_E}{]4hs٧P{I+C5'<R0 -M׼e7xkvyP΍@Zn~IFMwz2áٍ*Ybq8m#}郋'<j>.nV5<Ѵq+d[mTfynUƛi(Í]ѳ7!Sqgymg嫷@W3#1:g T"2ncQ#=3cG+!l Ǖ-GGOy8Ǣw^EwE{[^<~"^ƤA3>yWtGIZ{>b(cS98_|;nini:6J+[·v)rco_iM;y_kx諻Owުϴca: }-]l wK6(dC~z4@հuyU`g޹wߌod_@Cꑒ)tѾ<*%«{y=ON;7qo5(~]ޛzamDrx Sa/\U>1(^nUU);sZ\ʏub+icwe>MSivP_3_^Wv W/tx8\ʯ{fSa܆U}wx*U(_D!]}|Qj73v^ińNj^=r#?5Zfq_.pˈ폗IXVUi*@H˔ YGZ(Uj6z53*fZLB1y= +S|36a/Ўi{=X9Z(Xj7u6.lSC״: ݹ']PYJ_X)UeԤlb[?1ۅ~!kC[3'a@-]¦+S=ktnc_0F_bznJx8Fb\\`RUB3QvtiUUF'pMJ̓( E WM0[Aj'(Q?7e" 0CAo?]f'/ +endstream +endobj +606 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 605 0 R +/Resources 4 0 R +/Annots [ 607 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +607 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 141.573057 101.433071 122.823057 ] +/Rect [ 101.433071 461.373057 101.433071 442.623057 ] /BS << /W 0 >> /Dest (cb89-1) >> endobj -602 0 obj +608 0 obj << /Filter /FlateDecode -/Length 4767 +/Length 4675 >> stream -x]ێ}y I $& Ilu9EQg2;V/%XdK,!9_>>bvY -+ >Z6鯿:{GSҞH*QEԌ{err-ȩ`F T0(Ux3S gTR`u0Dvpht\*:i=8o.98-6 -,l`s:[ӂt(Ndt]tQ6cX]N:%`ւI9X`S:(tN'lduj8-?GADe8PA& -q0kTqsV\[ Xl1p\z: -Z) -p8.G0D ]]O01xCr:A׬.@'=ޛSk!`s\]f@' >  0 A3t.tRr\l7qAPL'8. $AqA0n W 4&8.@br\X:آ EqAE qIMqAQd @ qAMe8.f j&x̸zs\ lpQXlq NzlQp\fnِ֛@g]L q\ 7rk{ l@z-V6d <3 _Z#Aepl*Ra?f0F<&#w_5^I6~&9=*E򏄃RW*-o d %-Uc5J fwj%yYoɜuoW6Z`(QX_`6@L;0o 8Qb\f'Ɋ1P[.|?VFO~N5xc -s+ u${M)s:gRVҡ^ەeS U[w߼CMZw)B j?R6Q}dي_9@ -^FoL{H7A>IWajed[/ 04?@H+()Qst'OC'~A֟P3镚7MNh8ّڍ=ԏ BeIȦ^p4-sT@ -#aeVxGoACDžMܑ!xod@T!x pGѺ/ЪU^+斈)شӼ9Vnm @2tHh.P=6~{[gBGji,ϬbQ@ڝyZ}c3_tmy{5Ckfa4?{ܻņKc_Kg=,w6:U?n3v{Sz dɚ~17+5+v7㯍Pss_A~x|5Ѵڗh2ѽ}M}F\݆=_M9&.narv9{9i鎞/}^f -^4Qmy;UQwnWQws{~w+TUO8:.ۊ s8TmxW]qWhIO_~Tx. -6ݏ[Y5o֬3P3"ՏG&"q -q×\-Ѫ~5YA;;HS:)N{-7;RtwDv9B7.EWyG?WvӟNt{v 2W'A7Vo_ss4kWb^]7HCη}[^]xĺ;b;KjZAq ,97+ 4X]r9s& m!t_!t 7J& v7?Ea&W61нgw9F drXn[NO0mjbs8V 6xI~6g)>R8=|los6z̈́9N/Z+fRLw/9镐aӕ+XmhڴqS,hv)MuULG+Jӹ*,M'iorB>Rz].*Ebڜt)Ĉ.'FEtf7F!ɔt1cDn*͖%UYcnjJYjI:@kܨr*~>YϤ+k)xR:;~2z -?R-Rbf sUf:ki|M4`m/H.-66M}IeA])\ -E6U-P~ U=Wdw[ʭbWNU-6KL/&\I+QfZY#sZ؉޸?A͸4)mU%lH~u2?-T֙ռa^՛e4BeگbjZPq65ĞS h[m؈Ui{ExZ82/:a:^l.e:]sS$(i%=ɻɈP\6jLd[Iizߴ]q#RWl[thE[mqfc> i"}nHZtegȃP)K7cO'ZEFj)m+5Y64O. YVJ&7e͒8OQ?-m^)h^qTn񊷤d[8zw,d`d]Yγ S q35];c.?)"C}&j#V ΁C ֛ЄFns=VXI[c0Z /ۊU|([PP9d -KOKE;eENe/צG]f?Ы +x]Ms$@C^ v{=6q; C%.CIG727֛X 6 qA!DuAS-8 M$+qA>73DD/b^o1]u $L8zW ^ʘWQ(PoS + oĜ54XYF/f VJL(/1k<3c0-,hh5?wOwchci +$ CqA&;LRBHlDHH ZnH09xz3z*h֣ % C\ޝɊk2/Ɲp 0ztJ9'munTRe?8LG r@͙|a~^[y[FOL}KW]SҖ~q:XwRveci}q9 +5en}U^rXހ\n8FH0T8]ːꇳ ˨ۀDf-SY{s.O5tZa^ϩ9oNӕk0s{iY ݜ/@Dkn`wg]Yz C91ՑLr>r9}Rʼz!GajokR{較y:zT]snz 'lf?l[Ao 2edbu髠¢ 5G +oYX>dr У lߖW +b|_~ibbTq(Yh(6qm"J C">H"Ũ6!k~ ڗƫGvj +L#x}ZyX;i7pOny|L4;JMnp~ I7@m9'1(zs(%k*BȰs8˱V 2$U?ΛVsHAF-=[Yh1苲oS^A+˙F:Cx_1:zvkP|B:CF~ë5J۲X§esbaCw9nǞ/J&Iʀnա#ݯhм\4O̻2.ȋŧ2i^ 5#m!+9T@t9t_Qǡe[SE:GCݗ ]F)#Fx<4JA-zhZ^(a\ 08!PO+H~`/:CCl=qaiRb";6IfxNZ֝1i;s8LoDž_:3 +nuGܵS5kN)p \UF}<#a8Fv%z~2~yuߍܬY?*:]%"{[;Wφ“mxF!}s #2 s4$|-u#ʼn#ye29vkut?W-[6e;owGzƨ瞋o0+m n[Yp'wd+G9~k|mޝ0k+fs Xtg!s#zɫ얹g%3@XM=^s8oR~xw\^k?<s4,kj; +fE- |;~޲_3{sgV>Gp_y7x:Cwe19حtǵMnhCԿڿ_8Y? dqoHs8Dގ5_s,Q֏ ^YϿy>ϳv{ޗ3]yq:GCcyYzjrǮW|O]w#nfv\Eswgwؐ 9;;?'ʭ]T5>O\M.6(赬;'?/6S7x 4mT&}Usuבh:+{i,`O';4:ftl/J|ίS6zD4?'MS~d~ϻSsOS_\)?;eَOc_~9=7844i=>f nZ>l<zi׆&(&m +Tɛp}X8eT)]]a U}۠^7^>,7xaqNmMfm8v \b~]YAlm,>ږՕoԗ$WF͈\h\\ߕj)VB4>zbA^/ՠ'q~cXh:-/l7ŚP50Q7a5wf_ʚri>T]QJ])YqD D-٨=\rDXnjՑ +TlUSfJ:œiȯ@dsDQ8<eUd1 lM|rA(W(WDžڭ^4o9~,*\f?h[!wюIܬy'qc6ttTBLtuT$Uc.uU)OJ.T]Ltud^3nʝ\joma/c8C?4Q۵1a3 čFGqƧSN$dbSk4q7k ұizHpʯ )V_cQsg$rҡUo섩Y633v}|.vˆ|HMgMxB`aI臧׋}2ٗګKei%> endobj -604 0 obj +610 0 obj << /Filter /FlateDecode -/Length 4772 +/Length 4740 >> stream -x][q~_1Dz0`8A675$g:(ggU})vU\}UJHz1O/j -N_NoU+ -Gw6L!9Vc˟~u2)%o{VB A9AR -* .* JI*ADAaV` $AF)QC5Nɣѽ3z1$t:Igi%].J:-.)-lqHI:B6IaV:bb.I.+:آҒ.ɥH$t*&UNVaD|tx咨-*#,l!H:!FaVY-l1&-|-*x0&%L%C h'%01Mh$7OA4tFKD`lq%&F-6$ZbJ\`H\`AoIi/qL%qI kX.{uF ڵkI+ k-r:K\vVZ02W'K\L&F%qwMT$qwM uax8܂)#qw /q2 wA!N` V{茕Maܟ0VK\:D]t@ ):?I\%` l[1[2H\`Jѷ8=-8? ؂HQ0yЪΛ)е qA4k 0" % `t$. `H\W4E\i؂ [Di-qA4ѠD2sI4#(qA$?q(q f`JQ[@x$.MLsDl$.t3J\#l1H\l|3H\lA'qAR~0Y8tJI\t|Ӑ<ߌ$0Ozo EMI$7NH=730DD/. DoqIҁwz p&"[in@. >gQ\1P^*.(p/U ȗH2zqnJeE+Lzɰ-bh7. bżN.ѴѸ.7O E)J\ [ѭҀ+]t|؅!_)>lQ;}L)Q.sampvYGie]2|manq&6U;4ZO\yVUɸ[|n  uU*9xhè6[j>m v -M>2y:d.o!Zy͉f+:v0e%#QJ/9V w#&x`<_$d>>w;"ӓy)L+/_ FFbQUxy f?~mr=a=>]Ls=]#jO}(Yyn|=Mc͓yui[Z cw@-y@\n{0ÃC&jy.!r?b٬V{pX:3⋹Ez+^;h|G\y2ӡ`D%ERzjj9|OMesP~E٥h^?=eZۡГy `=ָi؀ɞm^͞!m9J a7 -ot0#xͭ7PBCBW^uu˵4w7zS.=n^"aN5S)c6[ȗRյ]}bp-V[I2y7|S1n]j_Ƒѫd)r_ 弖n[=vŏ!lｔwOmfI6~+2> eeC9(|Ϯ:{WBOT>|+50BLWPJ&=+}XWv{ZMno*eUQԯk>džV|jOe:<}S{Ya umv1 kVmS/;]Smlg髆 L*W{cS=yǤG,ei{FWmdjتs`& t>Ïɛ::%s.ϻJ}`⚽0d䩞Qr"p0`&~`Ua<<: [irA(ѽ妘^(Sr3)7PE/{B&?J;-l>u'p>rsh0"Ǧ+_*9SkŐ- VA6g?-4;睭0:p2ϓL=;ܧ^FsRIzsve T,/ ;Kѯ;H .!< NpOAiw (+9Xܕ@hJŠWWp`mW$hzCY/P>JV~s~WB7oNX$߼)::`KWipm|?JtzR(y[>ǺJW[ڗޘjbK]pu>AQmy-Qp -!ɯjxQa =[[z x5J - -/qcٗ9|n7N\Ny'},7D^<9l*v:ip2_OI ,N%~WQ ibtEeInҹaNV[w~n/Jspщ&n||3Yeq4.RnĄI1 W"]6 Niݤ -qn8eij"_6W,뭘^Mq7S$NiL ڪAB5Tņ=_ٚwa3}l:=tMkН{ڵMkQuj2;ՔC ]WM̦z_J9 ctDZO*|7C,QK Q~]okܘvqFb]\RUB;Qut)sfYeJ? -פ<)~-gle#rXzڡt c{!>3ԭҡyH<&FKnkb>+GF.v o qӵTžq(5c0_h-fZIռ]lv@ -]i-hm_@PA&y寗uzc4orF50[ѓ'' Ahh.ֱu ͏35{M 6 Fۡe܎jԾ{c*\uP$8iwВ2b,C[09VҚ+,5\ a_ڮfǢ,Ő!/ƂI=^?ߋɾ6joҷQnd͗~y|'n-ʲس-C1:HcVREQ4LUY+1T|V%q[)K:{5{orhɶȍpTOb(IUuWo{n!Ggs9jAJUJZ`u=8o-yJ+"ud 1*hk oPcPTslr[zNsjN^t B2TĖ7_ Jˏ2],h - +x][q~_Vx} p.A9glyWoRZɸ{sUKXRSc +ΗO?¿bqտopg(LN'G0L[]N鿗yL)y/XEv +1UJi+B0 *'41%I3\ Cת3(E'`Uת3L$`N.*`6J:tM%ѓ$QH:k'H;-wQlqIiI`DJ1H:[JtNt]Q啖tN.E"QS1kQnrZ%鴞iEfAg`W.:2O8bfmՒc:؂xآ(3hb^80Q2$vHQbD!XLr$JCgDVG^ba a:bI\` lA -lK@tK*i ,X.TX0$.\@)I\`)qb ,X:o$.]KK\`"-`h%. *H\@]L##qFudbTxDEx,.LV&H+7x8e$. !%.P&.(lJ\:c%.@a["qO`I%.p]1|.M:Džy^IBe%.p]g?aE58X%xW$.p] Nap$.6i芺4 Z2`T0HZJ\Xޓx"=h$._0Nʀ)$xWi*˦>D `/H\#M)/qO +:|Ove:B$.c=%k #-n` "SL6D$qAp1ft-"t:H\MXKM^0:M[0U$.R4E\i'[xi-qA4ޠD2+4jIGQH~bWQL4&$.fI\6:bI\f Fbf )O₤nq蔒 ! 0/y%.HVa-0o $-.-p0oIo$-&{oF f` ^ Do1\u $L~W ^;(F amC +܋*1=4YF/F B6P_ct si Qy!`͌0-}sdv#˟N~{^#eG|X}2 ry&m [FԍԠtc#cMA/Ml3[FzU+E[ཌྷb6JF%޵#y|]/^pƱ=9稱?؄< ӯͿ(*_|vس;(y۱rycZEqVf(cY.\]N,/&&笳9zZe}1=^nki^u9ok. 6!]mk!HɽMjr)uϖ&mt \E5737V]14^ΟC. u]˾˿[>/6vj.us^koSngHCʿB vo̜1NYuS6Nڂ_o8q#tvoֈB`h6_hdagJ|\Ziںf/|eI$;3ehk lVL%[*lg,d~Dc2\Dqᰵ={Mc&xiIiQ23rn}+e^Z1P8b~eO;Rzlx'{:vq/Q=OIb7BX +-ޮ܋MbK[a +kh/dƋLv1H<7H%+,0xsy}nqz՘0ra$ڌLTkfDlRKy fz(˓[N? 9mk6,fN_4bЫ +oߜr&`'E/M\|09l߸,ZRq(.xSi\ +T.@JmRڱY Cʱ>YZ_9ջj߂vf`FU+*3y6T~=b[vL󷶲*uh=кgރ{, v1nXCmCtnշЭ̸BOwco:P9X땼^ԒSj7ifaݯ\>G9|*+ +hgl=wy+o-?\`KW|/ڰky&IqSVۗ$[|uH#-\ߘjbK|9r͞;?h!hQ|tac?"m1>Ҏ;Sf.ݒ5?tƟ3 T -=q0ӡj' +W杻GFk~w; TuO<gC8PvU*>PzǑpg[ǓhQ$tHX':_B3Z﫺yzft)^{S +vн1ćJ;J +ˠQ~oU=Pw0"_̊S~~1k|hΩxd=лT*ҔR==^t?Bl;*-E7@W[aXϘ! OWñ IvY>W3.@LdO剟2I~Zc#l!SOOێcݷ>dr]>f-}OW>2ÕxO9: ʯG ,NL~nհt,aϓWX/9{|~qTt&;V7rR)>̟r8^?M[6TGS/oY!AL bE&l 6LiҺI=l,R5 BZ̭W.b~SMl> {4bm tB5Tņ=O6o]绰>v5a[ ڵM1jQwj2;Քm@ wM̦FOZT ILWJsmBK{T{ҡncxAHzk#֏K1Z7Jx99j3N.] +*Fm:^#~'L*3*\2~+N徱I=)CwfQ t[c eF50[q%7Ńb>& +۴b{ZWqc]ub)ucPݴ>ĦAh;!z92`ϗ6lUu/H\qҾCKfȈP\nLXIzơ\p1|i2;]eCv &=VF?<=d_gK7(m ci#?˾m endstream endobj -605 0 obj +611 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 604 0 R +/Contents 610 0 R /Resources 4 0 R -/Annots [ 606 0 R ] +/Annots [ 612 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -606 0 obj +612 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 415.323057 101.433071 396.573057 ] +/Rect [ 101.433071 713.673057 101.433071 694.923057 ] /BS << /W 0 >> /Dest (cb92-1) >> endobj -607 0 obj +613 0 obj << /Filter /FlateDecode -/Length 4697 +/Length 4918 >> stream -x]M$>H' Inc#sϣZUj{fDziUTX,Q-}VTz!zNjVXbv0¯gVG$ ?hwϧ}rϼ>!Fg=MR1 >xP)M{crz%(`lx0c -f1APA5-UfYR TZmu0D1t$у DQH:yVK88lt [lTZYb5t)xI` 9RIyb;QtQ[SZEl ̢.BKQvHI: lÈt8e-t[?{OO pEq0pLI% a#u>V#5hqJ%#1凙0TN1_O&cz aNoA2Fj_c pJxĭX,5Xw²/C*e @9&v9"CR?W#iDS6LeOZ -K8\PP7ciޓ&er &yƨ󜝷acvqn$y~.Pz3D\3o!Vx;^] ! -2Wj!+Zߧ+ - -:te>*2zjNӗGLN^ѳpW6l mc\ۜU9nj=P=sJ↟2bk<gjs7Gi5Lw90owg܎ 7rϿPti~Ms_C _ s8nė~ދ 較L =.w]Sld?h[Aͽл| TJoAP(^]l6_ :CF<{(~o5_(rQ<ubڈk-Q]D=o*B&m!t_!v\x-7^P$ E&K^g>f-GM;m3oZ?诵Of]\@츠B:CF dvDncۖamjrEr;rJc/<ͦe_[}9_\ ȭs4dbvU!zMt7Z9Zţe>˲l^&-s8nW >J [Ur޶(|Z:w,V@>tg!vY"g Vz~ESQ1t~%"v2p{;2O 5Ԏ?:GCvOqaife29vkut?W-ۻTuKwisJ/[Vw9:7 ֋ѾV˜i?5w'J'cd>s8dndR"y2r\٫u\/WZ!xmĦ; a# ڎƷBĢL [Wpٲ_37Duw=sgV>}s7c+\*o>=;uX5wGcAND^fZ~xAnhCߩn?d,K7x>!-ntlW{or2q:GCcyu,vyn}kig=8,n9Fhۇvc~i!RjnCw9r7w`kʷԾ,Z ά _Md-:j@TE6eӻM~tې^aI [՟//\_z׌[ 'rIS02( uuuKar˕ܤ;5} 7H6 ڷӹ{6ls 6_m?=J0h^iyv<]>R"MzX}^9Rjz7J K890:\./?ľ$KdGcդ6WK` !j:W]aS6CXlmVkR.9]u -m;o /'z(MoM5Ȩ1*%CI]NSf8]!K I,7f|)j՘{RNt hrf(b<}B^NHBi[B VHMETKOYR-<RMN$"wR+wuX;mK{_0J(H.=66]}%*1낺"Npe+TmL\edN7p*v;[/\n,ORFٮV@ -U\iyZicdҌ{9}w9CD|p[&(K2_'>1:Unۙ,8wga6pCUC-k32j&UgNU\EMKŮ˹.g^z,Ӻ:yui,&SLqq ˆڲAXNlldTeLRdRtmA6_z VX A7YR"-uV +72YbOZV`L Ŀ2U_;lߎ<%C,Қ=33;{XX:Vft7C.( x~Kv[w4Mw:Og'Ӟ^s?"\7mKH94{f팲pv'K}dӭk/qG헹MFܙ^t{Kw-DZHVo:vZ Jkc?\JJ89zq^OК>C0ouO։5^lh}1wتq)f'`Z>lwo}ZoO}wB;R{Oz__bc_v%:Yۉ>wtp+f(tyZ{l<{ +dV8z{gu+r!U,ԶϾ,uzPVy6AG;;<%ikSoQЬ,o-b|f>>xcE!0c%>.x^r\6gzγY=a?`݉n.XdسXmo/PNʭ{}76ou1Mں™u^ty^YVP9S=Xn:H٘H?|ƩϽcE/y:<ɤ>YDfڮSܷD? +w[pG/g.y: >ɥ-ݱyU^y|:f$ }lΌcә_t|쿶r3Q:7ǛMivWG |wqӿ7y:;Meckqqĵ=M Vw|Rmat׵8F,I3V,r읎fi ՕxgyVq\ϙW^lOr~v6oyϏVo6q Y9գRj^do1B{q- Uc7>c?ˇ^t{}&q{EE8ys,}4.L`e= >iND[T-Ů?Z1 ߤ#\ӛ_( =6s[.Cڙi,MQXgDIv|~"GksUU=GWG4Sl#LW䅿yյMX$a% [:j.Ii"im;ҧm;e UHP},Hfm$ Yh{:I䕓w>`u+b/[Ɵm,852/ln+Twά,L[f|ek4Lj2ǾD]Vkd +llU뽖oav湎aF Etf6:(RǕֲou={dݖ/sAr^HŎ-׵nay7e(F=9ٜs +歮ҿˬ]l}oEUvYwaccV]=խ/7_eY:˚҇sI1O7c#)l6Uwu9kutQ}ܭF9'ҝ܂yv;aRNq:Օ?n<(_jcӡg!as&.S rhz$q:zg>t;4OAu!GƤa= 4- k@cnI:&2ӁlCee^ֺG})tΓ Gا>I)%W|w5סF ᡂpX-u;o7yt [냅C|9jpسw?Uy;Rsv:~Hi2jWu UqrS>E=t8 GEm9I/(vS"']5=W箇cCtM6ÑN/?,OK.kvLU^/G~VUTXĒgi y==*BmȃɳnO_ǰnɫ +A6t4=>NK:]INrOrƽco|vL7MyF5/ +} +qe6rR^:> 0_aiVfHP\hLN$wZV:NҀve16I t[馱cH5XuF&iXɉ +:7S~]-UZgA3sN ;_99tllecs#L?N:٨ P\WkCr r>nmXo(ҹ2_>nTC ӰuE;}FHڨĶl8S/5}׮WWkIT7.'CF6tL3oaϷytk +7|8Mg|gM⎊-\gXEFq:]dz񩠔ans}MWZ+ްӼӼG}9@ʩm`Dm'Sm ۶ؒ keڳKnumQSSWiNF4UiXe +K2$j)6S54%z>+aSڭ;^ls<7GzK&xFumnwml gz5).{ڙ YT)بe* q5%ys\6#Rs%'LUQӷ"Mtr!MB*Üd `IH"}%7їDכ(W endstream endobj -608 0 obj +614 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 607 0 R +/Contents 613 0 R /Resources 4 0 R +/Annots [ 615 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -609 0 obj -<< -/Filter /FlateDecode -/Length 4761 ->> -stream -x][#9~ϯJK&a%ha$39 tiၿWnߺS9 YLUϟiGiIO1|IM))Y^09|tX`3_Nou9&9ߗyL)yYEv -1UJi+B0 *'41%I3\ Cת3(E'`Uת3L$`N.*`6J:tM%ѓ$QH:k'H;-wQlqIiI`DJ1H:[JtNt]Q啖tN.E"QS1kQnrZ%鴞iEfAg`W.:2ŸO8bfmՒc:؂xآ(3hb^80Q2$vHQbD!XLr$JCgDVG^ba a:bI\` lA -lK@tK*i ,X.TX0$.\@)I\`)qb ,X:o$.]KK\`"-`h%. *H\@]L##qFudbTxDEx,.LV&H+7x8e$. !%.P&.(lJ\:c%.@a["qO`I%.p]1|.M:Džy^IBe%.p]g?aE58X%xW$.p] Nap$.6i芺4 Z2`T0HZJ\Xޓx"=h$._0Nʀ)$xWi*˦>D `/H\#M)/qO -:|Ove:B$.c=%k #-p-%.M1I\G<^tL1E]N B K1%.O.I\3$qAHSE,ES4%-p%. D[ J\MDXK%)3Į&4&$.p$.@`a-֑171&ǛA₤` <> ơSJ₤#MC`^r%.HV!D'd=ǛADEuNS-8 &IybI\x3J\7&[TpX3cF&L wbH6//yiߒcB8W ryζ-FԍԠŲFb)r^ f g&"T+E[{lIk;FUːW= 7O(T ~/рlȝp׿cO__W -gګ\ i(z_ +yIeP)å9]*rNS2Ӕz\nN\xR7oM54I,6\6t>% -chou ]y(a|e{e&ic=62\urq7~]]rr;Tvoءj{Si㥴_Wʞ˼Cĭe5fsmkWisc&۞ -i`:V8oX 6!]Cm6=&7y]K}Ŵ8lCj5}?ܞkc &>u]qi[&=V XU20\^ea1_mU7ɮQŶv্qs2o4 {NK^?w -ck־L[]4_eq9ߘAݞMWޝYy=ҕ5 ԙζΡrwWY.ڶn^fF`I\߲ACgKFZ#xvF]0HK;@=ApڭƜiظ|}(-jT=a]ce.X4bЫ -Wdy78XABc,&|/$W}(wxٮ7%8U4|g]*cHq|OS&)e Hfx)"ց9[qtGg=/*yiXS] υljl`oR6_VuMR(T4|cm<Z&ޫh׈i3{^#gޜfY Z(g-t.}ZP]Tkt{=L\&=p[¬z}9ՌRW;YeZ9-6\^VѳcOGf u?~,ϣo~YZ[wZ-kgfԍ_չ˨3y8TnCUn1h>#93!mph3A=WX(> Ǯ)Ump(߄@U.͌+$q2K?u8~3gjG؍4pݯ>99}ѻxq0~nz-f_C)>\}(_7t~3[|ub74Os| -u;W}ޤ2ݴ:vk|H;Vvs{PNm wKn^<m/'{zƟ2|7P5hYu;<.w7{0eT)1d{<v>@]׏#ζ޹ݦH<ᐸݳOa]!-6U>ZGoFr\%7uY`spCtgViwvwUh[Uy8ܑZŽ̊S~z{ר_m}ŝуy i[qn= s܃蟊G@hz<r-RD+vj|Y#DFշWoл7zHB|aDJ$aoٟ׫}<姶'7y4kn^"6_jF3?j8ũr7 Z긢\([ 'R#'P}٫G$O)WއwrX}&g4^vAfRlV~= -agqFRt5l?|>ZOU6|[!8,:L:w>șO*+>ۖ58^?^53|hEqĄ je b SZnRcjkGjk808R5ǡ BZ̭W.b>=N\f -?߄@{]jkbC}]LN_Ӛ0 rBv-}|\t-QMfR qD |jфlaY+K5 t4F*TgM)6d4/Q sDq)泠X8\ /'Gm&v!\\(CMUKX -SB -פ<)>v_Jxn6FoCRh -=]:ٱtTBz&ݖB:t $c) uMVq(TTŮAe!v6Ujy=ݵr7|š3dUx  X+bj+0Bw}:[;bԏ}I+S^uV裗BoۉοgpQ-Lօx\4A1Fi3 : |M=^SƠiG}8Mv!z92:6}/m?LX>Z9]g|'K:d Pa-d@gi -u /cU[1$ lNj`cia`'{1FM2J[XO|闗mͱh:y{0lsr-.FسnlQi](]@Mdݒ[^ -ͧҿ=QiQWiܺ5o6ȍpuldd~ݤS*u<4!{gsW)_;RwBtVc&TB[5rwW2քZ4l i_1UnNΖؤ:@ -4wuο)-P *OYvz#IPZ>H9o,O߿ޘ -endstream -endobj -610 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 609 0 R -/Resources 4 0 R -/Annots [ 611 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -611 0 obj +615 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 609.873057 101.433071 591.123057 ] +/Rect [ 101.433071 221.373057 101.433071 202.623057 ] /BS << /W 0 >> /Dest (cb95-1) >> endobj -612 0 obj +616 0 obj << /Filter /FlateDecode -/Length 4895 +/Length 4786 >> stream -x]K8r{X=m6Еݵ Jkq+AR`L}UAR]o?_~)z?ꢰZ8yCן`71\.g.}L9/_S V`y?h|XAOb b۲"p9y11I`%a]vD$GF)As<gR6YEt4)Dxy -!$dYi!)YMQbU"ċ@;Y%J"v99'2x*Ŵ'UO6Î"( d gYUFY#Ɣjhw[eŘDdK`dQ1H4.I`b\6NK -'`d?Vi*]jsEdIX` dA ,Y ,Z$,[oA J ĵ)8 , %,\ 씰tݣk}0Xu)HX`i%aZ"%,:NV'+aZmd$,N ale2)) p$$,p]D^k< ynHXƙ a e(1B@+a  $D]H X\n$$n?$$:z#/ -T I1C>>"GD>hY֮*~߮+Iw(Ym[LM)o 4;X;|!($bl+jO"\[nL|!nϗߡOw܅^>ہvciw\/;}qsf2vdh:/sd› P{sB~ZWgBaݵs]f=3fq6&8uroi_VGY|d'=X dܵϓ}@mqZ+e_g몫=Z3,au^۽u_U{h{]/6^s𾮁΍ig7t^VkDz!PdZwW7lEXk0[>Og<][̮Wwg}hm;ljY - !搏\#qaYa;hVRtCpͥyݎ=k<ʶ;oz #R)`ߵ}س뀏FuJM[n5̻2,`KjU>2186mGqNU1YgQF9ѭ۷u f1i >,~ǬWY[q%U8*E :ʳɗ^q+XfXdj^6U_;s}ΒǨY&ky=,c XjY8?D% ct2Xi}WH#tzy:>`L>52[qFEԃn$druދ7{g˝Q=o43M6_PA_Gת Ny6Y~WzqŮ%Hj]'cĶR~ pq˹dCF8G쵩~lSdY'Y'<5j-jvj f/wj~W<?SK=׮>˞tz?L=S'h벶}X;V"ѳOfOy:+';"bx}xbTecבdvl>y,TUݤёwiOy6KtuG-:<'bCί{M$Y&yv*Nن:8Bnu"2pJ9ԓ}ΒvX!N,fw631(;z?Vm۫6rd`/=B\}V'eVOguNJ=]f9<,O\ԗoϟouU]``q#`6"Oy6 c͏\-h6 ^{=wp}5k| Ogwx0k<}ܫm==kv4)[4/XZ#f OO#D4:EYHMyo{zKiW4zFc\5JZk2f]fJeײEcT上Vuv6D4C_k&pm~-.aڭU/5ܫO_uòJUtjv]}lY/q#8E/eXɨ=9TO22-FLس1ظ9R}~u$mZ,\ (e7n_w,L[ְVwF}e*sX_~loHSVTvqLͭ]wM(O)l4ojGVLBax$`Qwkɰg{s;Kؗ{ma߸E C*@Cb[- :NyШ |ׇxh_ڢB pSh4/ 3:ܰzYZV͓ˆKDyzKX37? `U?4N:әP]Bo'7J&eˤbugN_Zk^NeK_|M&o+T!cvpٹɜ$qXN׆vS[cnT P_QM"o,3-f&kMdD!ӈ}@{C:ٸ*cB'6ѹ4[D nkGH/SCU"4˄ʍk˶ @]Vkrm'n2o+[Ի.J7uZB=Ml([?ɔȷVٍoN䷋Bk߱BjzhٸTNMOؚFҿ3TF%)k&Er~ڛV:NҀve16I t[릱cH5XuF&iXɉ -uo"w9}۪^ݷq;94|V\ M6.JF2~7d7c.@;rݭ QOǾ${RܜP2q?h#]P=qZ+2dR$n۶aDwN1 ]:ז!n\N]lmfmb dumÞ/m/KgWpy+WԴtpaq%a$7i'_ -Kb,KyY>tY&-;oWB?yCDmިo&Fx2Ֆ˰l>ǖnޮ6e{϶ oZQFMJ[ݴ:Jk#*SXU'QKgiW)U 4nx-Z-ܜc-[,ZҶv{Wo{ep]#SջMˇ3RS*!:tv:Zct07-EXi}JZ+wrLZ5},_*wJ :̩M%|^yeT`RЛ{53I_3> +x]ێ}VH@Y <I\H}F fT#qjL-$%qop qA+@WԥA%.p]В"Dԅ@?T$.]$.]e:BH\: [aLYSH:aIU*$ 'R3R[6_2=VOzx@i>/&(2&b:wfyCGm=P29 @@&Wb1l;˿?Oчs_~_ ׿p` +>a;e6S#>7fҗO[]ϓNvŨФL~cZF{T|N0|x S;LFh^ey ^&jo vǦ+}e7?oi#yõUWX| 3vW&kuג.1elMzTG϶1NqZ)Vl)w[g]=}"Mۋy >f}uW+.g o{X9Nfž􀗳3u<=г~:WP"Z{&ys8TmD~`޹wߌoT{+{[ayJ]>貭P`H^n?ǓhYi/w9oaf?5tKR>]2~ͧ՛S9nlҡ`'>\Q*=ٴ]ڍe~W~# 7f՝y~~"2dn(yhUT|js8n"M9V84s_C w;860?l-jw9j7?^ĭUrܖu>/'+{ 3MI"[uyOJC-5ͮK>,>;x:&Ԍ^yúx.;bhsFc?빳egOߙp ~PcYTZ㑇z)容(shBiXJ<6Fyn%֮ z^A{v9mCl=qa)Rb㰬y% we1:iw4oM=<+ ,+ֹQu?effr6܍~^vHl86oj:o:ͺ5u-j|f)QUF̨Tbk? I~JYeWa,@5]*$JsBM[TZҠN6 h|p7#׹(}"ÍY/'gHl◓ Bj׸B=.$VnGҤً~,|S*\fh[!OikW<6xH\+X --k.B,o/>nM][l&eM!2IUuE]g ++S U15P~UT56šGU{k Ex'6ۋ3c] a &n42h씏/_ f8r&'O^>i_'{c9:UTnL;"Æ e:0-j^Rʠjе6dbSk4q7#ھi͡ʇpoMgV$r6Ck ˈ ^(.YY633WR>oyWP]07"_R6l .0 ^ռ4G0~Ledi*}zcYZ OxuΡs(P-أ䴡\ ;eزM ٬2QTLY-14xQlP}&R^񋴹2Uo8C;RV_2 +2sWm)Ȗuye=۰> endobj -614 0 obj +618 0 obj +<< +/Filter /FlateDecode +/Length 4751 +>> +stream +x]ێ$q}gK~ =H0 ȖAˆm F:-QYj=UK0xxd2UU"޾|"89"J J>w$0At׷ .o?uu"%[RY#B A:F0*DyF@ST0V`Mq*a* c2[U:(˩`J.0*%aR:"5)'<9VǤ Щ91tIx]t$s)k%-I:/p8.buqkL [ [2p\@$]]X؂H0Z XkET +0+ p[0T8.T$FdlAq"] j؂hエ#V^r\kIYIqA^Pq V`JV[@h8.M,sXl1r\f Fآؤf I؂$08tRr\TzS[ 0.i9.HFb%3n $ [BV[4%f܂;q:[t$i9.@&"zvK z3]Ls\ 7rk{ u쎁:̭얁b +잁4XYF`ZRIv@ ',O "okIO`.?;eG!@ȩ-+ ѷBbf`CڐY +DX,Lxȍ?DzT ɥ[,"4Kv[shr@Lm|4;8<o+&T,b}GL09jwo?"(||ZW>˵+N 0'<ӾvQ]l\ҘMvL'R\߁M9jkKNQY|3~_?AWS_RаsY~ O;Py5MGϥ<lw9MnqB\"꧛;!0{jGM3Z4滼<[47cw@yEF1W|sޛ]~1oZ +5̈́6FĽҾDkYN|[F!lm^vG<k~do4Ը !v]2KwtbΜSgl;q:znͨѨWlhq&D͠h2S1X-Vʴ&>6eLB[=6gl~ ;1G=鐻O>25nzf.ă?,=-3kCB'&A)GÅ +~_ 3sUՍ%=smr{3R2Ӑ+s3JїζZ9k-?jFWg|z˲V!M6 --׹ū%vhEuzKJ|i_}SCfK;L]Gln*m9kisn1޳CALFX'5jS򽶕챡ɷoGeuץlRC҇u+o`sCen믣6vW:\)s?4жwj8c;~?eWKu\_AX`}g~zvf? 6޲]{2?~cm5T8!ɷ/n^ʣ&oًGt/i2[ƥV_NVZ];l %jL(7pMgg9H}Ρʼ,2! 뼹㡯]zky<8K=O:v~qQcE>6]*[Dgx6o[C + ͽ`oLQO}B`*;84q*ϓ,]yOۯr#ٛ1:%6TMxa5}xS ^ AII.5Ue:^'c;L[Z?ðEz|IV~sekKPfCڳVOV2GGlNy#bJAJiY7>|;2b\xYofo#o8BkЍЏ"ɨT.ZOy:]^wfu۾*~jt=ttqͲ}Ï/Oct#"΍oӦK_ֽ>rNH 㭵pqF'oOlqdC~U#zLzawo"u03OuwP8dgCe܏3>yofynji'd?xp.ӡ |_a]n?2ψ{OtgcωܲsM;vJnY|t:C_=~EQ}|unʡZvܙ#;yQQN􎞥;쿃aG#'<vμp~~7wxCꑒ*tѾ<φ*%«Gy#Q<7qo5(E)8ڈ~R$p_/>1(^nUU)^\y3g+eԎV|Gd"8'Ǽ혵[p<_55N nT~[Q(MSz+C4VnRٱ&g~ -Uy/Wk +s7%(zG.#yE][89|,+Uv Y\(Uj6z5o7[*fVLB1= +S|36a/Ўi{=X9V(Xjv6.lSC״: ݹ']Po\ղ`TjRWShl0V ٖ.tvaӕ\RŞ5UwS:MlgdA@Xb#ԯk1=wZ7z#]m#..0] +*Fm(;^4* *7 U&%_m^ &^;i:󀲡ܥBhIOR7yH<"FkjkbƕPV#P]巕PuUwb߸m^ m[,&ZIkf^ 솁[)g|탌qo?_47p>FYH^[_Z6Ѝ[Wq&OcTa6PہXŞU4y\끯m.;ה1jQn q;оrijYzk +csp):+Jڧth2b,C[29V\O۱+ 5\ a]}܊! B`3^[5VV0F{x~/&:HڨIFikIR/9&?SoP+ cϴ ZňA{*[UZ'F*k%j/٪[r#b.i7Js{oRukђizdObImOil[]]g =2=ۤ|g,y].U;!*Pc*m{p? lFγW{%cMaA_Mx"+_%610[Af'(?7e"E0CAo?d6'oK[ +endstream +endobj +619 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 618 0 R +/Resources 4 0 R +/Annots [ 620 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +620 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 137.823057 101.433071 119.073057 ] +/Rect [ 101.433071 461.373057 101.433071 442.623057 ] /BS << /W 0 >> /Dest (cb98-1) >> endobj -615 0 obj +621 0 obj << /Filter /FlateDecode -/Length 4764 +/Length 4848 >> stream -x]ێH}g5yIhVBJFBx讝^~.pUzvUS刼3O m}VBHz1OwOjNߘbv0'V lBr& umӟ~v<>!%o;#!JP)msCyASLIR R`$ c0RvJ0M -f䂠 -vh!A^=Lu:vӒ. {%t8M$l!zDl11XI`A$Aa ElQ^iIR$u :C\r*IM+0I>:[rIgt$x0Z ntHtDA&!LE  -J4`ȧ U:%" -8X [#WHk` H\`-l1d%.`[Z$.[RIK\`paqm$qJI εN ,H=H\`y#qZ^ ޵޵9El%.;VG+qwVAb Ыp%.V&*&` -uax84swSF2^e(B3V6%8N1 tL^'ҠZ\hA{$.p]LTV}F fT#qjZҁwIJޅ$. @oVKJ1J\%#qfAE0 %. -~=I\Y+q*#`F5a -c BҁwFK:R!I\ҐB'c'qAP8P-H8C)J\ lH\ l q0&+rb';W _ V]?۹|LIץ|Dnvf! M]}I2O.l3˜]+OP&7sb8s[w"(Ke 2Zg֌7@MW!ס2;'|O^[f׸y>(s ^M*F4alV1>n8 >2{|ccy)XM^Mh ))l;RZX#0^{gƊ/ʧy^jq䎌%e!kcr s/]К -G9qRѰz Fzm~"˨12r2ZnYZ(C*WFS=uIu\_3#} |-ϬaiڝyZ{c3_[s^!7ld9fX4O^o9xنKc_Kg=|3"WV39%_i -_y>-s8E⽌gk}y.cf^ L4LdžucIyL[:2䣚kk}aUSlɑw\^n>W\WުGgGf -^d\P*]٤.FD5~[>petgáwcW\iXሢK97ݳ#sD!@ng!tÿRzDl^| -C?b!Ҏrǂ̕|N㍶; ~#6zZ ߢgD-= УmqX@qg!vß=|n{W+(nnGP/P޸KuO}=W+mb!Rs8nD]RyZlrgWٟwϵ?Ea&W61н{w9FrDn[@\5Jېs8V 6hݭMG)mv_6nW >J[m Q,mXCw9ݩ\"IR\w=鵧4XcA_ٵvb6jFTa]V8v|WS 6lmL3xF>HJ_ ={rǧtumnM'm,mXi|gisxN믟XN^T.̒᪟了{hzw9amߟ=I8h<{xҙ_7׹ذs|%M\L;N4pȿObL`$ KbN?U)tNXd )3Aן.gUʉkł9^ՠ'1X2v:M[ 7ڪFBTWņ=_DTWa1m:tNkBӝUrQu*2唥C *M̢oz_ -t $*RN'.'1T+=JXՔ -uK &i76cDs.UlpcQUzrAH*W( -mSnGUR C3**\2?m:JxlZ/CR h -5m\:ٶtTBz&ݒL4Y#)$Uc.uEۧpe+TTWŮ@u&v2T\ ])}VJk~U`> /Fs%UlTjeRJ8N2iƽq9cIW6^>i':6#:Unۙ_wYXM#4~XӺ25{N ma#6Fۦe k|j zhɡoV=ƪuJ>7E∓)]󓼛8h aSad@g -u5NmY6E.mڂI=OdGK k+-'BxԎ~~X{+|hc +ޞ/?~<)8JEQZ09|t3NpɋߖuL)y_b $B0 *'t1%I3\ƮUf֘(" 4U f: (%`nt/錞|L&FM>XKEIgaKJK:[VI:b)Ia yRHb0:IEtEQ[WZ%\֊!uFE"%鴞I+ +䃠3+Dlq#b#Bj5yu"-l1&XQ[0[T`M$0!L6+4h&Ɇ@ &SxhHgau lA `$qm-"qnJZZ…JRVJISb K K6z KV+ ,x5El%.;N#I\`Uw 8+QI\`&*+q „5HXq)#qkQb489- X 3$q  xW'?aM&wu4-Fy' x$.p]g? xW<jI\8LoVKJ1J\%#q"Dԅ @'8Tޅ{OxrDx{Dlh$.@\Nʀ)$xWḭ*ݦ>d QG;>):?I\%` VS%.1[2H\`Jѷ=-?`)&k%.c?QtL1E]N B\{)bK\r$q̀N[ B-X*M 2t Ȗ.tZK\ lA4(qA4L$.^C-(qA~ʡX&i)ElMH\ɛm'q6?lb#` 9+qA&o71fo -$.HO9L4R$4V˼ߌ$Rob'D>7EMIX$7Nߌ ~ytx%0"2MD^x]@|&+cqF1c@UL(p/Us +Hbfbg5[R+1m'Cό!w2aYXDmыFk~9=dFPJ[WX&ao)3Ie a#u!u#5hqNe#0r{jOg"hU`GJ& REtPg+9v̇fw?0zrik_ b_g\Y^e9f}Psf_XVeٖs;.-~_{ɁU_uSrCۯC{[K{lbk;_Ni ]^S榛;V[7 ׆m) +~Rti)HiB;W?z^ }z vOu!i]Y[e[2tsfA6Z݃u ":/3. Q/Kbj3w|r))J*VF:OP{_WV:P@f/,˴02̮^r#>/ =Bzyնd:h<zo 6 $o̾eb n}Z{0|l?Wb|{!v'}*~yW2MQmN`gCىk- Q]"67_[OX]\Mlx!q'iHrC;"-Fm[oD|DփurmƇ + ߒ_M}9ҟ] ȭl17e?»S!z,gz<ZţYW_GnycY +0zO{=VP_} .7.%ͮ,nu<@Ѓuac5$e˙w4mfhYnCW]\EsBnjjQ5x ~ȡ0|EjlYLy<\4J!63$ՑxY +jsD**G4m%;Wyn%6 z@gy:$ߎQ!mky-.m \J,\ECц1:j,uȘv:OV8X5082\x].1x[Qo2 y Q-o43[/x`u/ѣ~ y:f.yiH"ecǦĶRs_E%eG9[eke9uu `uq)]F.lo=ɥkIJ<Rwεx&u׹#ж3c?(f'<oG|s캔A.2ltRS}.Uil:i]RxNE{<:Oĝ=<vƊ=]]sYȋ>O\P? Owk[' Oy],n<<"oǚ9[hHge?<;Y3\ߗޗ3 +ʃu q'gguCx~t[s NԼbU|:+csq=6ߝ?7cC"3Ԧˇtɇj~g/= zֆyTl7Lo,_Z̓!o~'ʭST->!d/ I[GyDe]>9zaϧCYf]<ڽ~ifÁ6ut g|8\{Rw#5>2uJͿ|]z3xmW52Kb#+_F2/wUS~WwxܞnS"u;j׵ϥ߷qK'ҵ~A Gvsuj=ccs6q3w^-S"پ|ټݑX篵^D1r6v$]7Ƚec׏FUpvO2׽zXR@{ݒ0 {!?upE+ qӮJ}?&( ׿K w-;5+^a>c\2+V&.S1_Y;*7m3k2O]w Mc}pik tyuq&Q9*!*N.5lޠΈ\2? TS^襊8zoB7+kGGڲ9* SK_<&Ѹڛ\j|Ƃ5^sդgq~)^h-/wŚPu_҆wa3f_˚rmi*T]QI]-&ĶyD Nզ-&٬\ɶrDXnn͵ +TUSnJ:6¢ʐֈq)Ik^Nζo'Үsrz\H&K',*˯Rk<僶 R.$&^:VmC/ˆK0KG%ϤJ[Hِ1yHռLR.X/lw*+`E [oF?yg}]YڨI߸u,KR*~y|E]}Z[ /Z(^m.Mm-nZE TC갔GqB)|6ϊ_Vע%jpwlddnRKRm̺a!GWs#kZg:HOɄGmu C%*z=F\:#Rs%N ޠH +25ZRb!iN2A}yMIː씃ޘ*4"}R~ƞ8C endstream endobj -616 0 obj +622 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 615 0 R +/Contents 621 0 R /Resources 4 0 R /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -617 0 obj +623 0 obj << /Filter /FlateDecode -/Length 4749 +/Length 4701 >> stream -x][,q~_ςMB!k6k0Ü 3+X_d孲gGC{}9Ȉ/"/U?(1始I%V~*ip*?_.o]W먫)yo?b1Ta9'B3,n1%1\nYbǂVȰ"06(e% bRr(-%˃ ZrCi%|L: -#|)Eg!KRq<YVrr\ i!\ -yTc"ö_1d4OI4y@))C#<\ -V@%&=ʘ)1vUw_."ŲN.)G_~~yot(|ڸ|:W>2@5+N -0+m~gв?`J\ltYduݗ}A0-xt2Nzh5O/^~emyVUh\c3Ni׌4u8R7<z~ïc~W_lښ<<5h2o2Ѵ[[L9ζ5N&8CHPr,ldg3NU?`+;W}m*;@3ݟlqjSe)U^طsu2.nY@%hyD :0fmiDڨ|`gzPy& ho<'H c-XA|7#3=Y,t?7;ӊcZY\ah2X:fz?mr0&a9Ofg :R{?*zojZ7e>6:Ogui[Z1;XqiNu Y+ǂ9u.nśܿ_:`rm)af6zuTY:OgGfja|sEz.W}l5#qW8eՓZs2|`vu'=d ~2uyK);)ߏ)ؒwa~󵗯q]w6v%Ϯ̬;IKtW7ܾ׺7~s"k -? V=ke6^_[Z"3Ni_˧- }ߗm׺o{.~Zt߸pARiE>}utdd'.6}=A+7 F2!alخ6mǍˇe68$,8UCA_ڑ:MZoxyX:Ogqc5f[V:-코"ŞM?0n[tæ.ֳNnvvy~γY[>>²T/vޱfs_?yyL3Oy:3?zl?-?c=gN b_aw -{x'<獟ޝ2n>l2.ZɹiYb+#G3͜!ܱW*ZWƇu͂OFj2A -k^/iz>,rֺ(}UM/YIzMW @obw|yn>NXt]Y c*{9>B8;[^n9hS^>h#<I#i3l?]|~#o> -Wo -JoXUIeŪ띚e?R^J[^>\?|/Xfr.jːd"eU-h7Ei.ikj5VwYY c^mtRB}Gaʕo}#X7+mr讓(z?dS&:5 -K[ 53[kSUZ6Jj6 C]76m1?q!jHKC]r5F*RWMU]n&63B  ~]ikkevlN~v+7n#GSU,7f -ר<ͤmwBk%tPrP6TfG}(t؊:lT#j&fuLVӰr$*dLmErtݵv;7|ɡW6y[W-6;clѮw6`N0[:d\Ľ]raNl7ޤ=fY?(-~bX_ݸq-Z膭+.ēd; f j;~'˺j -k=eZR5U;]@t2f6i%2?wlz^.MBzg -2v!:4+*C:Vq16ˡ%[I9vTOq( 5\ i]γ=̎MWZR`3^ [5vV0B۽~}6hoԷn xɗ~}bv {%95zjaWثnVڪ(\&+LTjwY-St_FMqT8*~SڭeK%@n4N- ͏Ҷ}u5^۰]3S٫Mw{|g3:pO^ Qڪ`JF!AqXyZvE=a85FE t${K)Y -0'7+AOu .#)# ti>Z>? m85 +x]Y~_>1 8A`6|Eѽ`vZU<ǏŒW/$ F!DE +K)fIz{肽~"Vyw}MzgȫbtJ>eT*!5v^YǨ9̰(Tyab +f +0C/Rap*!J +!cbt8 QEV硓^q:獴9g3F!9-V#8l1:xN`vZ:آלމ.+:".` ЉRlZp:) ljVAr)ℍX-ӰӁ'!0UBKNgaRް:؂@9"(3h ^8@y? G*8P!{рv0.z)1`:آ@+؂h [hZ8.Р[#@o …  4(Phpwr\A ) 4hW8.]mwFNV[` As\`Z +qb) 0p8.VwUUKwEP2q\ z]P=tJs\ ޕ3V q\`2`X]G3.?{ߗHY6.m._ <&mE YCFX)FFb)r僜 f g&VAbcm;ϛ + >65r/u]v eL +a{4/>\c]lxçϿӟ1Z^.Ra/䘆;ٍ28k)ceK2 +MqMeIg2J0@i)꓍ڕ2eΧ';]SW1Pަ嫿]?zcۏ'ӟkӋitvyN_ C[s6o Jԍ)ҭ]mӽai?R,ەd}:)eN^ض[_jɼ.e&h)Cu|;Ft!flN4B1(8bm u zOLa:***]‚~Lur)-©5 I%7񷿯lf %u @OAX._*l$jD#'\xDpaw={c6O41L-J=Sfe+=d>Ne^913w.m=vUL=OWt|;rӸ7a`\(l)~?N8vWDt5?t^t^Df/fAn`D +vBzL`VYld +tlvޱ-[?Ι-*QOu?/ +֮8vagNs9nޚSeNo[I1/? lM鯡>~u+5o֛}5Ͻ8YTkR9 RAJAӌN/̙vD t|mY1qGFRlصyd*2kmDk(qh=lh` wuk(!gQmdHi?lӑI١:)zt 6o{[gj,|il"s:Ԫm|^oyG5CkV{V'{2]gí/쭳W^u-˝Χ#3rmՏ;s:m~Wo,Y/V}+v Lk}_չ⯠?`ӡrϼ:OiVwOWZ}FcՀ#dmX-I"G>BHdm`ӡpo|>kt $7tۦX?|_3ĜS{}&%;! T5-Mh<9v`?0=o7߽0WPU=% 3W+mb> R񛰛=ty3wJ&?o?E:`.W61Уs6$Ɲ; vܶa:ۺkb#4>c=t=c-#4(m9H?idW +js:o({?)Dos:Gξ,k>wOfrljCjt&j9j6acxomJ^ngL×eosˢ@1b4b'S5 v(<*#秮HzWDOGƲg陲[Dy0jt粤gP*ctFt\:.NCLiM!wi ]+8~s^)?3;,0Nώ6,KGtܽpaއsufG|Ah#0Ա3EHл4Ŕ4.2g8Ǘ$*_T^c{PL(e اvX +fƏ|lt"9Nӎ3Btr)֋ANbzNt)t[MX3.H:xtbzuVf8 ս;rQw(2e@L'Ft0/D.`05:} $SŜ.l4[FʗTf):gd&75sDq.v4yEhpŚ2b=V6C"J)<~2:B)1O M_j%47xI1\Hkڦm D%u鱙Fc6H\, ꊘ(,OV(mL\eZQ*s-V+ڊ}qIg{K 6Ӌ !WRJծVa *4yvuq+KZ+:iIi,y:Da Uu&nW2zY8(!LFLCU,CMk3:TצfsJYTm+*UR7=c7#cSRIt~ +mspN%+JZthj2-MZ63VR7PhhUg2eMh 64a~xz}O&<HZH_[iiI R.9:'oRn.NNյ04lSVjlVi^( +]@&Mnʖ%8OQo{ڶR:ѶiܼoIȶpu,d`d]YΫiꙊ.R>E \"!2Է`6kӋaEpb^ބ&4rwX2"c%mMdZ / P}EST~/- +Iu +4|Ezc;PUWjrz 5PY$S endstream endobj -618 0 obj +624 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 617 0 R +/Contents 623 0 R /Resources 4 0 R -/Annots [ 619 0 R ] +/Annots [ 625 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -619 0 obj +625 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 370.323057 101.433071 351.573057 ] +/Rect [ 101.433071 713.673057 101.433071 694.923057 ] /BS << /W 0 >> /Dest (cb101-1) >> endobj -620 0 obj +626 0 obj << /Filter /FlateDecode -/Length 4725 +/Length 4862 >> stream -x]ێ}gIV~0$1N m`C~?j"RZ{ӪDKTS~>/B釓U7]Y+{> >Z6o3ϣfm?~TL++"TJvX'p1J*a=^<lLTf{MKUkT0CGVCD QdC;IgB4Qy7hpՒ.9$tXͬ$la -^9B-&xtNt]A唖tЩRgl RN$0I :[QKH:-ICFIiIga1ElAK `lQI4$^8x?p4, 4p q`I.zHi茖l$& [#W,q؂$qmh@@0SI\@`\ -%. P.%. p.;%. .d@I\@]b$.`.r:K\vHFF: $.` %.`D0I[fnH\]I\ %z]P=t$.@a["qO`A$.]}.ڣŅqVsQ DEX.3H\0 ,xWfjI&* ,x~p4 0 Z.* q$d<(8.(q*K$q*#` #q0l1 guPL!J%xW)%.p4mJ\| q  \!z$.pQAOԹV ,Q[سpH1H\ l!c$.e5oqy[q}`!Df uXU%3CkQ^yT%.Zj.I\3,qCELEC0%-p%. [ J\L*) 0Cc-t:3H\ U+M0- ?im%.M,sDl!`r3H\l1H\l *O₨ܐd @)%qAM`\f zK!*8x̙ ﾬ9j2ZIv|)?˜_a5n@>N̉0<8ݒҿrX=#fki -Xߙ VXauHC$vW*% @@ec>K,O=S_L~9I>\%]cx*{{.S|\uaބLj6kXjne*g̃4[=}o!3l_7p7uW+(9^﹏Ύzjg2m v\Sߋy(Mn!*⑞%qS_A5zcxnj_áw;w4_uetV+C-Ts8TmV4 4oIήejrPݮдc~^ƨ9۹pӵB97 wޫKjoȕ{-$Vj?9oaWHqCm:|}EtEWAAGASYFO؉{ҡ`ik!z6s҆ۨ3ߕ%֬3Pgnj=P{ ?pu͐guթFVP@lugávyKo1&fџ~e>˲l^u:磋[ݗp݈>|xzWq.iY<fs4۾gI"[uyO+34O!Nٮ0O7>g)Mڡ_cB͈j1Wɻ⧣;}ߝ3/؍{Dz )|#W]sAg^nE/m67Fyn] 'iɏq}TjXg;a sYR.<n]W"{'^qygL#cwv97踰Oc ̐Bv+3ᐻcw\+U-fт'ouf-Hj:)[44pTsB$ tc.*QEFQHmNY:K? I~rь,9YWa@.trMS -5k-_MPP^m4I}:<#ǹإ}B^NHBj[B VHMETKOYNJ_ibtRXYFj宰K-״Msi fA ԥfҦټDR1uǍ*la -Lμ; ,,ænhuimFCǍikvU=ԅAuѶB[۰]i{CxZ82/:a_/)tZ -2T)Nвi2-MZ6334}ۮTWsѸ钪4e]4IS{̺4~xx']IZH[i$-'Kit29][[EأԡQ] ]mfضRβYy(tʲR6)[nJU]Ҷ҈H3^8@wjKAE5%eٲnםgss\ q3U5]|;<]AJHILԬ=:!ynJ+ikBw LVLx"n+3:lQt_Jsj *>-mkV!ʽbh(% +x]Y$ɑ~_ς }Ê=@YI=ttI,5><-<,颻307H/}WNR?~)z?ꢰߵrq:?)fobpɛ?}L9_S V`y?h|XAOŜ%eEr b8cJú햕!I,K+ȡR"(xOJ)lȋh$SN{-BI9CS8 Dd1)Z!vK֕DdQAisrNeTi3O>Y$֓mZE +Q"xijG') j!1щ<ȂŗȢb ;h"\08l&%$0)O.F+~r!G -UŻ !Րa">2$V ÷%셷b@|)Ge +bnLIJ"sLOD`>3EɌmݷ7;?vg8R)?Bi_a5n1H=}HHH?s~XIItF^2?#?03os*rD탖ev]Iˊ)4N>/D.>%evRh \VȌjِk Pn_>݀Rs]2,ix~?b1?+i^}Z?c|? +-|\/}k6΅u;pk;`}^}˺^]NWl}f򍲏Te6k=E&sdli}M?FYҔ.bA~09&03jߵD?(Ot3&1'2ݸAt7x2btxt"=~am>VYe3=o}͐rYe֬^\dG5uϱ90Ƒd2]!l|ٴ;DC/zyQd[01 %?Zh3=zmy +p~g>-3 (^ϵg>f8-8VG v<~nvyNJY$J)][>OgkBm&^$Yzc-a(gMjW_GzDŮ,}zqgYRIAGg߼V{YI"j%D :"6gf6E0JF}C] x,es<%kCX0d7 Ϗmf2bYvvڎWm(m ' ֽs fgo[mA]L.pb2 }gʱXkĂ/y6 vkc̞gG n5}(ｩ>n|=ᦳo͋}cSttwD\pLwq>Og'5O:"m=9|EMcn[(sJu<Ei9XeKjN\=[.vcxէj8t-V6c!4{~5}zuf(2EӏE;aQKtQtТ܃waӲ2o KlQ}\H:HC{Y,L +ʙns/X.:7_]TES׵_Atqw_ !}wVSƲ|y_qPd\dSh|ՎKֺZlhYec+ sU+mGZ7r˨6pd-ZqfK%bY3yތ8.{JͲu)0y̨ D7߁))z7L|]fc< f.<ƤTH* cvg& Yf_Ɔ/3*?[ LI":6>ھɋ&ym/,h[ eUF!ȼ0Lg r%ZL<(_zT +A笷SX3w ֞jȔ3+vGC?գӻwCGiCtT|gi݀|]2e!۷Mz<ǘv15kd\pToV:0ӱ_äeg^ +5 +dE=L8S~GGm9-(vhP[&'k\5=宇fÐtM-N=,Om)Y[ň~KTlN6ʣ\ɦЉMt:͖5-qôvT:UkTY&TnT_[qm&Suhl|jtLLՐ\kk;|[Z5WwQ/R=l&SAJn̆yvb'|ZWDm䤺t*}aYitB;CoTBAfRtel䵒8=4q-S,חNJhOZ7Les@ǚ52AXOJNTULɾmz& ovrhɱ#Km\f(͍d2T'd1b F_ ֆN帀cd}~+nXoy6#g?nTC ӰuE枌~_CHPm0q ;YWkh~׮wWkKT7.'CF6tL3o]K[owtXh +vp:v|gC⊚v3#.d.JL2H>IS=RP_0.mfЕV5Ali>i^#뾈 jF}vcDm'Sm sl{5ƲlC 6ʨw[x>դQ4MUZ1Vҭq[Lѩ|U=_iKVע% 9Se%@ wVvnz;  =2Uߴ|g}ԪJNd8j5+B8%VysZɶ"Rk%|&,UQo0Ex#3Pݲom +JAԦT~M) +P*o&EQi,*> endobj -622 0 obj -<< -/Filter /FlateDecode -/Length 4732 ->> -stream -x]ێ$q}g%x} H^6@ ?tNKz fKF5^a02 -?iIO1zEM))VY#~jEar:?)$g^p'WYW3v׿f)T *rn -8/Ĕ$p ݫ̠dLTfX -ޫ0A: (%`"Fi7yttFO>&D]N#鬝| KEIG%%-N)I[ ):?I\%` l[1[2H\`J޷=-? OQ0yЫΛ)е qA4a)`/5ELz @K 4I\lTK ơSJ₤#$.f Y&x¼M~3H\8(iJ¼'a vtD$y%.&D53nd´ xuђٍds| /{yU [򼱶\%7jvp /@l! |O6"f-.A76K1tdX6k83e[^y>V:׋(y:t%Bx%س>{@őeT8 맟/ݧ܏ 0˲^)'ΟthrHKqKK0ȗtȞe.iLe$JZ>Ph~O?w[ #\Qϋp?6}Z>s>ՕwyJ C1ru{Na u- KJ:V!-xxXnzy:?ݗ-{p9JxWNcKY~,vҞңKoKhG"0PvziΟQ$O/yb[Jl] W_Bb.CSm}lņҞ,[}϶%OO9}ֺZ^21ޢ9z, }4UǡOg[3 -xi\vJ|b/'͂bo%߉1qeN6^Wn쫌elV&R9[~U.+r-w;i?n3}neo29¬w77˞DboS}mOpRꪤh2"Ry4]<ڃԍ՟;|- -#Ze@:/uc掂%eCvZy8]^WSeu;#g!}dUhyoײbәi=ԩFt n{_Fg&jSKJnr0P{.ϣ֫}-|a^yέG5i@V[d}ZVSFp+#{ףgofә)7?~2ám|-Jraޡ}+:u:W T -y4}C ܪo̸CrOw} (~A㸒ޓZs/y4;!ͯJ>'9 - 4opFs<9x=B˼{w|-8OTi~p.yk>jr͑ioLrbK|9r͞;?!EN\ׁg1Mcg\ 5g11^خenݒ5^<{OY-ϗ/*v-=q2á -O7jwsG~wo; T5O<.!; p:8]|x_'mg#m}c >hi$pHX'ӌv>woF/帅m@pEtgs) u~FU\GC]:8ۋQޣkoVwNŻ&2z;p=x*n4'u{V}GdC9D(&:/yՆ; m>Vdnyٶ^=<ރGwji]|o .ݓІouyuk@;b'<b:ph`k-X?.Gw#ۼN=Lr"3W=~WE6^ %HQ=eyДi]u5pϭ5+4k^ܗq>9?oJz-nٳ: -!vM_.>I>ihHW>R.*K 9TaW0K_|Lkjfcє&~$ዚb.U-tIXe7oҘҺI-S-_ ?WZ]*l>kX"bn"d+_MןH}V`x(VuBw/T]uMlأu }nKZ.֎WQGJUe3*U+)P'AtT)0Uߍ8 ctDn)Ց -5UlYSfJ:-}HB7G-b>n̝vqTgb^\RBە[Q54i05gpU̓?h/Uf;:$vݥCKG%gҭk]uyLRǴ[0_(fRIUWVY'lkZى|lLZqo^2g3|,}?_9:nTe Su%W2xR_PutBC7-+h1_Sˮ2^ZvbSkzoC/VGKǦ-m'p7l[]mIL}*LͲ Ⱦl?Cas#6e/r+$pmL4~q_LeR{0V“6_e]sl>LC,=[65kA4lKWJE,. SEVK &d+ݒ[^ -էhҿ=QQwiܲUoVpudd]R"u5!yesw);R#!:PeX*z!>@ 9~>"Rb%}MUAך&^¼+WْBA{mrl3e"e7o|KI"J -endstream -endobj -623 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 622 0 R -/Resources 4 0 R -/Annots [ 624 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -624 0 obj +628 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 594.873057 101.433071 576.123057 ] +/Rect [ 101.433071 240.123057 101.433071 221.373057 ] /BS << /W 0 >> /Dest (cb104-1) >> endobj -625 0 obj +629 0 obj << /Filter /FlateDecode -/Length 4958 +/Length 4787 >> stream -x]K$9ׯ3&~_ -q^Ϯ錬̪iF2#,}Vc -ΗNߟŸbqQ_pg(LN'La -əo'7\o?e}6SJhw";r+XM!Ă.5+@ JI,AD!횕 $F)A5OC^=Ly<ijv/M{%Ax8M$d!zDd11X vEdQ^iR$y <C\r*`VDa|xxȃ,*#,d!x gCi5t[esŘ@"`%0% 2.I`B(@D;Q(i&| -X3Z #/!ՐprEd$,BCV %XpK*i ,X.TX $,\Rs-S qXuHX`w-i%awEOY`'V awq v%,L&F%awMT$awM yap8,A]㔑2 w!N V{MaܟpVKX:bD^tƅs -O$aQY p%,OFZwIJE$,9LoV0]&bwKFxIE  IKX0P S%,IG䛆$,f Y|)pn9 $,!ȃ,pnI7NCH‚}73o"K1A,w]2I<."S/a.o"r{ǔ9b@z|X2P^x 7Hbb"^X6P_c„k-6K2vw[e¾\[^kO8\]W;ըsהvxϳ"͛@, FK X0epE6nZm5KZ}By: X9xXjxeպnVCf؝?vzp׹uE{bTa=tzYte,zZ{hyZy:k=ӂ/lz*m'LZP8|Cijy65cGBP`xw泲Cpy]=kܱ]T7*ZŲHm됟#fvl>iyx,TEd|HE;tS}S.o}"14kXE2zqi8Yd:2 -u9ԁȀx5[%<%kCX0nd7 ϗuf2b^vt?V۪6g ֽ^zx`1gĭSOgc-bt4KwU_;Yg/faĕ<5<-l2kkJuŌ'tx`Cݭ O#ç~r{lhm~MGnzYN=&>q滏[w͢GsW,-b#CW W_3OGOQҲ6 ǃcoWOI2=Z-Of-^yWa6q1M}R0h򺬆iJ2ZbZsu'f]m~Y~IzeXPu=U7/([~YWd|.Vc}-|uQer]m}z$UՓ/2 6UƲ|9dfC~Cq$1Y.k[[.c=BC,(gC  sU+l_#*뾩˸ҥDJ<cT"[f1uw`O\=S*^7#v -aimT^u6LNLN'=|u>mƿ67iغ sOJ-$VvlNֱu75{mDuȦіi ^-@s;xc{Te<] ܴtpɰMd 1AIķ #)Ub(\*L~VRVE-St߸ߕDwůqkђmTob(<ݨ[J[M˹=ePTnn!{\ UU[*!:/&+iUB[EVZɺ"Rk%|&lD֪ "lr%ݧaN*A% .CNxAiV|.,'9e +x]ێ}VH@Y <I\H}F fT#qjL-$%qop qA+@WԥA%.p]В"Dԅ@?T$.]$.]e:BH\: [aLYSH:aIU*$ 'R3R[6_2=VOzx@i>/&(2&b:wfyCGm=P29 @@&Wb1l;˿?Oчs_~_ ׿p` +>a;e6S#>7fҗO[]ϓNvŨФL~cZF{T|N0|x S;LFh^ey ^&jo vǦ+}e7?oi#yõUWX| 3vW&kuג.1elMzTG϶1NqZ)Vl)w[g]=}"Mۋy >f}uW+.g o{X9Nfž􀗳3u<=г~:WP"Z{&ys8TmD~`޹wߌoT{+{[ayJ]>貭P`H^n?ǓhYi/w9oaf?5tKR>]2~ͧ՛S9nlҡ`'>\Q*=ٴ]ڍe~W~# 7f՝y~~"2dn(yhUT|js8n"M9V84s_C w;860?l-jw9j7?^ĭUrܖu>/'+{ 3MI"[uyOJC-5ͮK>,>;x:&Ԍ^yúx.;bhsFc?빳egOߙp ~PcYTZ㑇z)容(shBiXJ<6Fyn%֮ z^A{v9mCl=qa)Rb㰬y% we1:iw4oM=<+ ,+ֹQu?effr6܍~^vHl86oj:o:ͺ5u-j|f)QUF̨Tbk? I~JYeWa,@5]*$JsBM[TZҠN6 h|p7#׹(}"ÍY/'gHl◓ Bj׸B=.$VnGҤً~,|S*\fh[!OikW<6xH\+X --k.B,o/>nM][l&eM!2IUuE]g ++S U15P~UT56šGU{k Ex'6ۋ3c] a &n42h씏/_ f8r&'O^>i_'{c9:UTnL;"Æ e:0-j^Rʠjе6dbSk4q7#ھi͡ʇpoMgV$r6Ck ˈ ^(.YY633WR>oyWP]07"_R6l .0 ^ռ4G0~Ledi*}zcYZ OxuΡs(P-أ䴡\ ;eزM ٬2QTLY-14xQlP}&R^񋴹2Uo8C;RV_2 +2sWm)Ȗuye=۰> endobj -627 0 obj +631 0 obj +<< +/Filter /FlateDecode +/Length 4776 +>> +stream +x][q~_Vx?؉^FX!?_QIԳ tb"EiU")<]o_~)89"ZQN>,a +əo]yL)y_XEv +1UJi+B0 *'41%I3\ C[UT0* KAۭ* 4I* J+ءR("kvӽ3z1$t:Igi%].J:-.)-lqHI:B6IaV:bb.$Aa ElQ^iIR$u :Cr*IM+0I>:[rIgt~$x0Z ntHtDA&!LE & +J4`ȧ U:%" +8X [#WHk` H\`-l1d%.`[Z$.[RIK\`paqm$qJI εN ,H=H\`y#qZ^ ޵޵9El%.;NVG+qwVAb Ыp%.V&&*&` +uax84A)#qw /q2 wA!N` V+q +  xW'L˜[M:&/qui-WQ1P^U2P^VA3P _^#0+]LPj%n(/1p¼4nQy!`Ό0,}[sdNy,!&W&o[8̦s!u4lYuea+Lec+!ϫUܓK',"0LۦJqF\"[#v< +l墳5uhݤ6M`Gݖ_7cm(P@ aȧm͈о69ikɖ~r}}ݶo0=ܖJf?e_=;ToGfKWd|xMsRˈs[1V +7r i2"r?l=|jCvG|)Hwcӥ u"'I;^\, a]^ ِħW}B`snٜ$ }^=S/tgf[MOl֢z˧初ñVJ3 a,I~<9g l4bЫ +pDJ y~[3 ^g\o}.T +ޘUOwgMfBuheל$Hô>acskn}"Q2xux`Zi~sdC{hhgY { y AwQK/O`Aə k\CAZ²~X{Oǘ?xTC~՟Sߙ7R$ l !;tfrQh8J3GwJևyCW]Y@=Hsy`?o Ich+dpm|%1ul})KޖzSer}|y#w>!ݴ:uz|L;Vvs{P2Ŷptڏrw,iGfgT ;Zg8Pu ;wsq;lH=R"B l z䙙'\?Cm}pF^oC9w^ cj;Lrzez^gy>Em*~טxR˗_#Ur^4y%=1`}̧i|5rPԗWt[N^nhmtߑ{R6"I0+/*KvΎ9h_Pq(E7jۣUGS/o'AL:9|U,*@Ô)Tt@Wjk8nj"k6W,뭘[&]8r)| {4bm t[bCol]L]iMsOxZR~s-zר&QI]M:Z? E~jфl홳0V QKj:AtJiThbϚ)66 0X?)1eץWj}.Hⷋ Bj׹B +Qhr8. +C݃LIyM R~+K'rX$h +=.B/Bz&ݖyl!\6C1I5XuC]3U45(-N׆S2VnƝo82fo+w|Fk1C?Jب6a7 ŝF߲N kdҌ{咧9cVn1E_/t2y7iܺ3%xR +۰b{ZWqc]ub)ucPݴubӠk͎EWYnŐ!/ƂI=^?ߋɾ6joҷQFxKls͏=ʲس-C1:HcVREuhtVb6%8^ +-ҿvc4'W&-[g-ΡN-̏zJ[eۺiYwmC3{dz6I.{ؙvT'_?t(? +([#+Խ&tD֪o&ACQْNsj8PޟB2R70 Joû>?s. +endstream +endobj +632 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 631 0 R +/Resources 4 0 R +/Annots [ 633 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +633 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 119.073057 101.433071 100.323057 ] +/Rect [ 101.433071 461.373057 101.433071 442.623057 ] /BS << /W 0 >> /Dest (cb107-1) >> endobj -628 0 obj +634 0 obj << /Filter /FlateDecode -/Length 4752 +/Length 4832 >> stream -x]ێ}gy I $$L`6:ċRK3kvyxX,](_JBޙI -K)fI>ޞ0~2`IUޝO;l??<R=཰*B%fT+N1FN37,Uf,FKTE4 -fh=vH%!C;NBTyWNy#tqp lQHNgaN[9آ5Eu"  -'$z1"t")aNaDgt -8a#-V 4l1t }hU4ВYآ79P8 -8P&*Ñ -z0T^s4-$tJrDlqL%l1h8. - Ze4lk 4ֈ(9.[#@pa@qup "h.@uu &8 4xW)8.0]es\`F: A 8.0]w19.0]eq - UV( xW8.P`.(lr\:9.@a[qʈ`A8.]}.ңřqVs D9.]g?`FUXԘ9xW(8.] ap8.6H貺8 ZR`D:?H r\#+80p{XlAq\: [fLYSp:aNG xM ' -^3D. -:7r\`8C1p\lJq\lq0)BJm_a%N_;,0e0어T( ld;w^Y -CW+qzM$4{3:CWh6,N+8itTDp~% ib ԖCm6ďQw?Z1~K y/w-Y?7,6.Eo$zٮNbÿ=]TnjGK1*,_mm,&Q:}۱ui`MJ -l Z2hwy  -R -s[}I~C'>I8}#UԤϟ7o;adDŽ?3a~p|q)Kqɦ^p4-sT@JiAN=roNۣ:T>wdD.[!+Աk9h,8ɼ}yV%Zi6DL?^C 9toܤ@VAdJ!dO] ;T:E _֙ЪZVgh, @L3ü[ɽ[l4垽t ksmprgaψ\A[v;m}7@36zLk}_չ9㯠?sgáyjGm63!:Z9Zy Zo܂_%yZBlu;WйVL׭ѹ@rNmw 7g43yY=9l\i&aկtow97^FwF#5pwpƾ6L֕"v4cZ4ɖcsq:ݔC׵dۥZ2G;y^NtGҕϙ}^f -^4qBs8n]tRH͋]aGLGwGG9cAJN㍶; n#6zXE]ψZ{`ΡGy۾-WEa&W61нs4$ vܶLρ0mjb#cݙpc-=ޭ4(mhg??OawVw9j7$J -+hiy}<>˲swg*6~6j9jF|ݫջ6pO_pG,H-]sSUQ4+pnڵx{WPw@< {v9Abr5.eu\sqy% wze4:2ixL&vhP!fF,W{^R8h_dnS}Y5u8+*z{7vz2z-qjjY[gSӹcKH6j3wi1=K8)?w*'ds.Ē~ʷSݍ=fzw9amN.m!M…A*@>ϴUH_nay%gSI5m)h,3eA9J$iډ$f{644`ISL(eDo}Jm1pzS|6lф9N[-3Btr)Ĵ)dt)e!6m-fK-] -ES]+푴Pi:Wd9Mw^^NVgVJ[r*Qd1*)KOrb_\Ag}k( H9#tSi/BsWS*u( RMRO6cDs.vEhpɚ2d=V6C"Jfv(HHy@ڣZ "7R+wu i.}l^2&=nI]Zl&m#*1˂"& -Slb[<W;m{[Ůps+%OU-6KL/&\I+QfZY#sZ؉? fS收*Ӓ[l,y|ϿOǼ8+QBnۙ6 ;ŴYoaiheimFCǕj{N) ʢma#VJekȼo=|rFP*PuNHQ:Kzwm8l*ղȶdiBS]AFС:Sٶ,Kg$ ۃ`#J軇׋}2@BEJˉ/˜tomRnƞ.NNյ04lSVjlVi( -]@&Mnʖ%q`[Jh[ڶRѶi<oIȶpDMY|\HMMlYםgssg*j6Hy3v<]ԁKR$D#&j#V ΁C SMhB#7+YFDr 1ۊ PmES - -nk&TiN,"AiLrihcUV@*{o6' +x]ێ}yb `x'00ӻc# C~?HRK3NJb-ɳ#w|xtrAV_oR?X]IUޝO;şOyyVCNI{CR=཰*B%fT+.1FN37,Uf,FKTE4 +fh=vH%!C;NBTyWNy#tqp lQHNgaN[9آ5Ew"  +'$z1"t")aNaFagt +8a#-V 4l1t }lUivk%E)oXls lq4$^8@y? G*8P!{рv0.z)1`:آ@+؂h [hZ8.Р[#@o …  4(Phpwr\A ) 4hW8.]mwFMV[` As\`Z +qb) 0p8.VwUU.sPs\`8 UV( xW8.P`.(lr\A!,wec4j!: ,xW qfޢ\w4 xTqJ OREq"nDq  bX.hIq\/<&au~$ A w#+80{XlAq\:L[fN#XSp:aNG x7M O8.`q f; \!cun ,( c+آ+؂DCl\-9. !q1*sjtts\%XK % `tp\#lTh +9A6t゠` A +Xe:q<4֒jNgDZg qC +9.4JL` hOZl[ bV[5r3p\lQBq\l +؂(ܐd @ qAMe8.LqAM,yKMqA4"DauASd-8 MsEEqAt.73DDϦBZoz6]޵L8z- ^ʐVPoeS oٜ54XYf VM/11DSTp}]sbzؘӗp{z]Δ!60 Tp[DHQ%ǜH*Y禎)AS- fou=}ϧ7.(,_{o ,m;r+û:Y1@!1aӗoѻºkoddSYKyı寞'5yM_m)9c͇Nivm?u8;]~?D1]P_wߜn]O K\S⦫W%% n#CJ͇¡@2/A2,Y:̒i:]kڥüS)NӕkPs{Sn "Uc6.,=0B0':rING#_#Pݨ2-e^HQus8Z +:o:z~^΄Unt^剠7YGm+mA -&`gáz@**(hC0C(. cCԢs =ʻmyu_ 6_(V-F5)A <*ub9Z*8D.;o ɕU0 dm!t_!z\x֐QPAsՃwrG/Ǭ4)wC4.j]\I6/跐ᐸ4}$ٮؖr#Lu[Ds|]E֝u}9:JcRg#yV}x;r; z ,[xWJrѺк/Woξ"mgǒ8`tGPP_#.5y*%l$iܱXAНug勒I2[uH+:2z^C'] \S4@DŽjӮ#_WA;ڭJUݑ?6n6v+8`CbʽYh6r(eȈ+GTz㑻Fɋ]M+WSU84+p&Zy +$߱`g!z Cl=qaiRMEa9dw.*am裓ϯ|N;cvWpވ`=_=:3 +nuGfbv)_絈zm'IHsy>0]˼C]^'p{`gw#7w=O5GA+460'27}/*+nEG.X+SDO9u/ˊes44ڝ9קn¼ǹ@-KW5+vjss&}Us8nkrO}{5жџ+}+(&;;ףz-eл;JF+#)u}_*Ǻ:q>;UIOF[<:CFw HPamXD2v2p; 'mpF&}u #2p s4$|F3 e29vkut;W-[67]#M9jJ/[Vw9:7 Y +((ދeδߟ_u'JYo+ȼ#YpȤlE*enY `VSw#ţW;wWZyw:GCȯ~fYWV3cI,j9ǯ[kfrO]ww Ww3˼5Yp;92uֻ/O;DHNKGY^W_A7:CX5Gː=i՞stg!w#zcw\ZFhEtϓWxn ”7 Ko,I-Abz?}AIvmNq:o[k 乏tjS(ת_K8q:0Gd~R>(n2lI:IhIOb0ajO_tzvz˲1]Oš]ˬ?0W8aLq14@q\}d'Z_iןSS5Me+4fzl-ycԾYLwD6r2\Pqf}ʆ*'>sز]dilq. 8AЌ &u:wfOoN{^R8A_]f |uyf9ޯ ,Lo8Dquڍ׋>K9{l폄KC<SG[?aOiB׾%pd-[a1lN.T@қ E>Ӌ Facyf~_ߧZjzHoIotG{_%8rϧ5Èi^eCGQ2:" CKj[N<売jR}[Q + Č5\ՋANʺ0US+6C4lkUK-.)u $RVy2ׄN{3+M/*MU41*V-%뀘:Nrb_Ҵ`V=Q +L-K9Ft9l)_KV5o4P;]H;8|S@RnF-5u&6zm\!ljnҤi S#U*M̓?HS!^ҎIܬy'QcƷdLDttXK$Uc.uU(OJ*mLudNnʝTjom`/ٱ^IXɈRhFY\fkexcdǽ~:e7Uep4ʒ7ɜZ>2q%*[ʭ31dաa8J!Be7 -h~\)צUKIYTV-ևD*tԤgȼtlu8Fp@/tsg$Rҡ5Tm䄱Y633v}С\䀄P7in6]d*HІ'3{^/dWf@Vjg*x·n~X}>2y[ն4{9mj(F4jSKOjlv(*]@&MnV%_q`{טI=mNtTܢljx-Y +g߮N5 UjZI]ds=0"SѪEɻ3\3!2uQ"81-\2#Rr%Lh-VLx"n+HSӫjQt[0Fsb oSwSrBTL/O) 靯^H>S4}+#$) endstream endobj -629 0 obj +635 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 628 0 R +/Contents 634 0 R /Resources 4 0 R /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -630 0 obj +636 0 obj << /Filter /FlateDecode -/Length 4795 +/Length 4660 >> stream -x][,7~_1H1_$$D8ÞI6 |5ݽjLWR.*_ګ?)1I)V%~*ip*__.oz\?yUVe1VK*ð!hWMLcA [V6EDZ :21 lY b,ǂ*JK hPxZ N,/xr%wYTAXx#Yd1 vËYd^*p)Zx2i鄋HpM0I>0< YtAgxXp<3!FfjFd:XYhYd` %t&m9mP@$l>TiY!QbZB$C H A,E2)rX4d1ZsX4dAa"ovzY`.BDDLrX| Zx^,/!XW8,\JD z % xrXdPHDȜ)Ȃ D)aAԐ QG2sIYIaA^Pa f@JYh8,MLsXd1rXf FȢIaAIzAa2q `\|3rX|S3jd°ۜ'3w-c'87<,!0 tBw;D -7&Y4HTmH], ,l$nd$,rc&iItؓKcFKvY_P䀘 ]u4;(y_Hk!^^ȃ^$z1gclwڴrRPGx_#"Hc& -XGU_~L:}{GL~׿_a/§˧s. -oJTjNt! CRf}F^-w: D̕<&SuM= IoqG۠IvC_?|qՇqYU1N>sY~=fҮkw ] o2;_yǜv4^~\iksLffFyyʚd!7UDtL݇]iҎS14U!6Oy4Ĭ:O~+PWֽApUܦ3s4S,xfkè[j>XHۛRe}<,^RgL[^ =mVL:Z/#` -_ϼق{PjVYZ4طsy΂؟߱X6N|!2=,t?6;ӊӵOf`=ĢCOy4 kYt5 y2;[`՞^{P0ֺImڼ7Oy8ۏMʍX\ǐ5={,kKVZk9_MǖfvppiWGݑEpkgolVV?bZ8r[0co+Oy8kvt\w҆tdߤ`%v,=qj,.iZ#;аM )uaN#tnL 5( Vm/`؞)8k#~. ~Jr1=v<gw1fCWm/c-'ZʹӖEʆEk]Nq>_)^wҊ|NyKg9c)MVn`-e1!՝ל 6w-cGu(H2jz_l<gfۇO#ioܞ#{ /O)^e~韏1n}Tǿco3Oy4Lq{R<'OykM=fN <,x?}U{ހ<ƕܲtM;yvT At5CͪQt^rUU5}IxEfS;A_:+Ų/MFe#(#r)GE1u;&_>4qA$m_|M?Bi ; JEiݤbN|-Ui]tr P;JV|+C'\Vlː-'D,_e+˪n Ҝ8! --v5lt[5u-3DjKK -n”'D# c^`xHVFD%ʡNֶʣ&ʦ:߉MQujV; 53}Ƶ]- BFu5e!. 3Yzn\mRMǐn6])͵ --UYS|M -PaHSt vqN~v+7Pn#GSҗfѝzQ yeIѽWBcJ龡4liu͎B|'mVAe=*T5Y5kd#QV!P]'f/+rӵJ' ѫ]+}ΗZ+loٱٙLk%ev(trїLS|탌˷qGz1R ^W/\ -tydI2ŇJlf j;~'Ӻj ͏k=eR5U;]@t2f6i2?o^MkE^J9xgKE≒vCF' Br:.䯗o~v4j]TֈCQ%29vQy%Ĕ8pjTaSt +fX#0ؠR`r* JIءHkft NN+c҉TМUNq$.r: [\9┵kbto$-:l"l"-K.EkY]N:-p43 +ӰKXlqFjNg`O8bdfmQeu1EQf ^8@ lҖ#FtL†`8 SxHV [[,f.-&Y -Hq1E[qZ2) J9.0 \)9.0`\rqp'8.0`]v5VI ,xdu( 5J ,xHs\QX:Fq(-VwCXs\d.(lr\:m8.@aB-wUiP1y xWE KB83oBy8.p],T}F +wJJ'qopBPeuI# Z`2IX]d,$P ZB$ H(,pE2)r\4l1Zs\4lq<ov{[v`a |5ːd9?v etqR)ק:;F=u+eόv>ci)W~J?suϦ?W},7T6%\}/IXqˌ ++2x@xPOz3,V=DZ*tY^{K{:\ jVuNکs6ܡpWYCÈ8ML6y|ס4֣v{@eޭ ū2NۂP) Fg;O0UG`/3T>M Bv Y٦v< LZ0QGdFuZ`/ Yh=lhu;~=h +r+z~QW1m`ӡpo|>kMt=:73HO}M_8_nIN9u/}dݝfVJE_DUcyNm_.+.{fм8t=ϛyõWWX<o6wA>+qI<\s:ʣq.mr iȮ\?R"n\._ި/yfw3f +9l[Ao}0wbo7Io{QtOL(˫k@`!vǟ=VZVPr0ɿC[=tݹ9QXR^AF9th=揾˯1g}E}}3{c;?X: +2sV6Q{,PK] {oSJ>p9u,[bn GzٝYqdFH噁W5;pz +gx@K +t){ޏS6j(<:˹,s؆'2IKSZ/rz [^ChJ)W/uLKwGryU>](g\պt$pƪ2L*wO!t>>E%f +Q&~ЃK,#XbI8~,J*H 9~Lp:`f=o]FfYY|P1#DNbjj_0㕯iU +}V`˸+VFvBʮ&ֶأu }שnKZ.̥9Q*eΨTb81ۅ~!KYݨ݃0 ٚ.tvaӍ:R-k*=LiP7v<#}4J=ͪ#ҔS(c-c.֙įԮqtztVq /MJ1fѱ@Jye+v*YN徲z@vݥBKEɤ'ҭkM]uyDR> endobj -632 0 obj +638 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 385.323057 101.433071 366.573057 ] +/Rect [ 101.433071 713.673057 101.433071 694.923057 ] /BS << /W 0 >> /Dest (cb110-1) >> endobj -633 0 obj -<< -/Filter /FlateDecode -/Length 4698 ->> -stream -x]M$>H' Inc#sϣZUj{fDziUTX,Q-}VTz!zNjVXbv0¯gVG$ ?hwϧ}rϼ>!Fg=MR1 >xP)M{crz%(`lx0c -f1APA5-UfYR TZmu0D1t$у DQH:yVK88lt [lTZYb5t)xI` 9RIyb;QtQ[SZEl ̢.BKQvHI: lÈt8e-t[?{OO pEq0pLI% a#u>V#5hqJ%#1凙0TN1_O&cz aNoA2Fj_c pJxĭX,5Xw²/C*e @9&v9"CR?W#iDS6LeOZ -K8\PP7ciޓ&er &yƨ󜝷acvqn$y~.Pz3D\3o!Vx;^] ! -2Wj!+Zߧ+ - -:te>*2zjNӗGLN^ѳpW6l mc\ۜU9nj=P=sJ↟2bk<gjs7Gi5Lw90owg܎ 7rϿPti~Ms_C _ s8nė~ދ 較L =.w]Sld?h[Aͽл| TJoAP(^]l6_ :CF<{(~o5_(rQ<ubڈk-Q]D=o*B&m!t_!v\x-7^P$ E&K^g>f-GM;m3oZ?诵Of]\@츠B:CF dvDncۖamjrEr;rJc/<ͦe_[}9_\ ȭs4dbvU!zMt7Z9Zţe>˲l^&-s8nW >J [Ur޶(|Z:w,V@>tg!vY"g Vz~ESQ1t~%"v2p{;2O 5Ԏ?:GCvOqaife29vkut?W-ۻTuKwisJ/[Vw9:7 ֋ѾV˜i?5w'J'cd>s8dndR"y2r\٫u\/WZ!xmĦ; a# ڎƷBĢL [Wpٲ_37Duw=sgV>}s7c+\*o>=;uX5wGcAND^fZ~xAnhCߩn?d,K7x>!-ntlW{or2q:GCcyu,vyn}kig=8,n9Fhۇvc~i!RjnCw9r7w`kʷԾ,Z ά _Md-:j@TE6eӻM~tې^aI [՟//\_z׌[ 'rIS02( uuuKar˕ܤ;5} 7H6 ڷӹ{6ls 6_m?=J0h^iyv<]>R"MzX}^9Rjz7J K890:\./?ľ$KdGcդ6WK` !j:W]aS6CXlmVkR.9]u -m;o /'z(MoM5Ȩ1*%CI]NSf8]!K I,7f|)j՘{RNt hrf(b<}B^NHBi[B VHMETKOYR-<RMN$"wR+wuX;mK{_0J(H.=66]}%*1낺"Npe+TmL\edN7p*v;[/\n,ORFٮV@ -U\iyZicdҌ{9}w9CD|p[&(K2_'>1:Unۙ,8wga6pCUC-k3> -endobj -635 0 obj -<< -/Filter /FlateDecode -/Length 4733 ->> -stream -x]ێ8r}ϯFK,a1v CuN.~%^DEJro ٙ%<< RJ*}_$=Ř/5/X]dxwՊt]f SH}Ovo.ΣfJ*S!('TJ[Aq^Py=)I*ڪ̠dLTfX -nU fIR \TZmu0DY#贛<%ѓ$QH:k'H;-wQlqIiI`DJ1H:[Jtx' [(`JKd'"KЩVg\VI:'lZQNAK8'Άjxt[esŘ@%0% -$0!L I$`(RX4QVD>-UőjBDX[@ka!+q"qݒJZ % 3k' ,(PJXpwJ\`AA ֵ ,hRX%$. )` ,qq:Z k -xH\^C/q25Q5S Ơơ 5N kx h -qr8[@`X PdH\:a4j1y xWGtK0nI{$.p]LTV}F fT#qjZҁwIJE$.&@oVKJ1J\%#qfIE0 %.O -q=I\Y+q*B#`F5a -c BҁwFK:R!I\ҔBC'k'qAP8P-HS)J\ lH\ lA q")iD.` "E dSLDW%7S kQAhT%.Zj'$.i $؂"q)DN ҅Nk -%.&b%)^gF "CE 0LS:Ëm'q?Xlb#`u$qAQaQF`כA₤` "> ơSJ₤#֛$.f Y&x¸Mz3H\8( hJ¸'a vtD$y%.@&"zqK z3]LK\ 7Jk{u񙬌⎁:̭▁b -➁I4XYF/`ZR+q@цݧ~sf ȄaA뚣%wc/|oNY% k^"JoՔ#0lB-HeT 맟/ݧ˿܏ 0b`eiqE}Ƌta/="?nK> fNy-4_s: -Ů\o)-^?~8]T疢~Bu܄ŅEWõKsܔŽ -6ž!Oq}{7hb9h~]@^2Or)m~m_v]ءJ{omm]Z'aܾF.E5fKPJj~UZvxƶiܩ?Y_g;-uI=0h0>\e֕zb[|hG1OGV 0M'͂2BK7K$_q2fNe>;{u;]?ٍ|y~::O#R3SWYqE^Mi_nWvyew?e|en[9vP8o>6]cooXR@< -}l2N6^caRT4kX-ήںj/V^!Q9ZuŕEg|vWJ;TX2K=ehlZA(ѽo^x/s)9;Oc OK :f"^u`ϒw&doV| -AnQn7p5y,bM^حRWMAu%mɷ{X*#%[z5 5 yqz駳}Qt0 #ttnЧ2iip[.y_fez!Zziy\ulPuPъ4Q Vw)P)PM(Oy:LǸ x>,q-,[BʼPۦ7KX˫VTz)HGw2ϓ =Azg`z(NYI~|Y-ee&"l[!k?ϳDͷ=:S9 -8% E* -P΀ԼkYL]RP]T#~[sކG]RKJnr0P{.ӡsl 3x9Ռe˫ye_԰IӕQ񈼃ǝOy:~ߔ>YVڷ⯃QǾ~pƿwę'<*~H[HLX xF.ZOy:ę+˭DW)> -y:Ǎ^}+ݰFF:龴^@Y<L^W{/jͩEW9BWj ->#tޏEᩭ~nw<<~ WayW˸S@aZqXۗ;nii_:9Z_l);n޹ȝv -nY|t:]_=~EQ}|unZf-3GwD9'<|=wuAUe)dC._wqؽ0EJi貣}y U 7%*wl~ =x2ct'<GV?wkn4%^ݿGߛ (8@8b(lҐ`G*vqFYdCq~vdNanQnQ-ov;];}ǝѓyO ;M)_!usS'ѿOwޝlM尻-RE;vl^c8b'B':jwOkwn!:'g  qҖ=_~t_=P69u[/h5'Xk[@!S*|ip{U9W"M_oj' -5囇 ܔ6H9WxJo9?`U~9ҡguCRt_.>=ʃ O4ͣ|aTt&wrS>n/&O5Pnє&~$&sR壪e.  SSZ7cW(ƕp~WayJ"+V̭W^|}r)|@O -lڪNBUĆ=BMXM]/iMsOxZ;JD)]*5lgTRWROvߩR435>t$RI'n1R=jزfJ,hn([>|Uk;ܘvqTGb]\RBە[Q54)GM' "#*\2*Xv*Yk'r_Y$h --m.Bl/I[I;uyLRA&͸˟.y3>;[GQ^y7ܺ3H<)):l:Xǖ4yܘeWKJ]TWm/t͇Tm;ϸmb doڄ=_v|m -}spζ)+Nڦthtqˮ,[ɀ+g -uu]M}E[%Al`}ie`Wb/#ګֆ,ү/c1Be6ղl7l rh.zvز- \_)٪2QTLY-1%8^ -5h?v}T'W&-[f-ΡN5ZJ[dۺi]wm]3[dZ6I.{.Rc;5`?ԦlwD^I_c"kU{ oPcEWT9>9[Rbshns̴ο'P TXFe|4*v֌ -endstream -endobj -636 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 635 0 R -/Resources 4 0 R -/Annots [ 637 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -637 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 609.873057 101.433071 591.123057 ] -/BS << -/W 0 ->> -/Dest (cb113-1) ->> -endobj -638 0 obj -<< -/Filter /FlateDecode -/Length 4965 ->> -stream -x]M8r%{X=m݀a{څc`}?R"B)evwR!% -?ibL/5X]  Gw9(L!9 ?:jϙei -1VKiXM!Ă.Xc1lNbA kLXb 1LVbA \XZAmyDYKFi7y(K<'I"/xDV;-wQYAUXAyBȃ,&xh' Y`]QA啖x&"/b[QnrHI<'$IAK"8RFdx G!FaIxȃ,| ,*x K&@DlQBdC Lr)H8@Jg ^BҐb@)&k%,#V%7S kA‚섭XKXXjX.IX1V‚ ؊hK< YdKXO<%, (+ C#%U9ΌD*JXeHH) `BO~l"y F(aA(#al3ǛA‚ <> Sv%,IGěJXu(aA"x!no ,.ȃ,pnI7NCoF f ބG/b7.dx]x^\ ބg+ -3sŌ:b@{[1g9Feb*Zi?f70gx wb^v^ߔLYpJi -$L1|Bл*:Y$ݲJrEGmE>携$*Ò15:-JB>hYڮ,qז(>JZjSrܯ L$` V@cPxȉcDyk|OgJs3aލiթMƚajhiS.}W-%V}]jX{UΥRtUe:מ;#t<֓u^h޵F0-EX+ǭ\V{c;۞im1[~s~Wioo[a;V˜Q#ӑ՞rV{q}),3Lk |i6Z}N* 2;Ȝn[ع:/ga}φ>4Cgz gкpԼݕai-n.QXX(C~o;c2W"sV]oPSu^͂}?Y^:63KpY -,,ug,3V(ͰJ<ZVl%׆oL*%X|Y}m{րύaYzJDFd{Iۺ+m=꼜Mx~lQ#nn3#cyϣެQ.wnF?#t+*:KQ8e Ny9= -w-DT<6uƷOc?JJD9Dzq^O5[8dNy5k9aZRQN.C7ꛛCgr}Z:/g}{UC;_sGzޱb扞/{Y}eIƇ63U~'U,g_|Y?ĕ5FJ&mw''뼜%i'+pksy :?"6̏ǻ7aPq6qdwcl96#L=Y,kiO,F; 621(:zeJ³rD`oCq<\W6I Y:/g YVP9u"Gً=qg;/zYA&"yZH[!zڂ?z:{uYA.hOǑVyq'|ӓu^BA~W5'>r4QXR[ϳk[>/Ա}F8duёX-YMSgk!lLi|e W[9bE1Oi2ji<^cev1\uVC4+mv3(a֜7kV8^6_&;)D(0@0xη}/5y7E*#C,.A:rzg٪7 +EՑ -{q&R:ޞ'B} 6 ݌޲7f_nLYҜWI 8zs2[d50Vgx]^Nڈ1_3Z9C| { Ia{6Yaʓuqܵdm,Ȯ١|ϿݸsvIEO { c-NUykDek6;0L,КϠqX`ۃ+_yݣC%&p,!~vm@'/۝γfκZg7{=5A%x+#7*N.םU0RaT>0><:],)E';(orPM/&+!9eu+4y#[gWGZ-jU-Dѹc^oyj 9 r(WA Z^7+F҉nKTN6ʓOЬSs\uM-SH"R;jSUF51RZMm$nM[LfY'YX ɶrHXni͵ -TUS|:ŦxVtPC~[#MN6*21l[PuP'kҩQfs3TFS>hL*ݯz'ym6ZIXIچ^KlKG%ϠJ7LeR/T5Y7k aU? +9QU!]'f_V.kKթ֙]k}/ڌ|0{loec#9~tQm1b Fr] )RǾȤvls>'3½,}/~׿[8|ڿiغ",*$TUb[6h,Nֱu>n k۫쵤n]!#f95o#s7 CH*.pp;|eM*[:ְud+1ANOs#%u,o(X/xVNJA觗W"+ S7Nmx2ʥ__=.ޮGKvumQcpS[iNF4UiPeK2(j)4S54%:>+~S6[w-Qs7GzKFyF$UڶoW6 3U۔| -Y;s! ?%c6j*oT{`/h -6uJ+=a:&KiEF:f;\jICzLB*ÜdʋC8%!.C{9);1N,(-?o0^2s$ -endstream -endobj 639 0 obj << -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 638 0 R -/Resources 4 0 R -/Annots [ 640 0 R 641 0 R 642 0 R 643 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] +/Filter /FlateDecode +/Length 4930 >> +stream +x][$m~_NY !FFv{wls!?U%b]fvN EQ)VZ~~/9=cpOoj^_)(7V.N^'"8M .yuu}7ShWb9;+XO1VĂ>:㶬1\N^bA gLX bXݲ20Q;1tQ`i9QJA5O)@A=My<ijv +i%^B>I<Y|VZysJAgSx`ȃ,&E+"d1Nx ȃ,*(-|NΉ J1myF'kzM+0I! +<YYAox8H<1%aZVY-3EdƲp۞;_|'8)?B)_a5o HB:$D]H X\n$$o?$$:jc_(?)"ΩBZu%:/+.:kucq+4zت2cv@ZoiF$}6W5ZU7zo}Z=O}wB;R{Hz_{j^ljcقs;8+NavkW,fm'wE߱_tV|V+{vZa E}g1tVl R>:]5vmf+o+k܅*ʛ::ڋuOw$)W7V(!bhuod>1k,t|5T, yq+JdSd9.SLV,$_kĂavgwü`LF=eJBuov`{y7ĭǠ.I[C8΋u:qzyfXAEmszuvfcbvr{1e#X,$d;6vme'=Wzxrb\/т߽>iK[d:Og'_X,Y;3VŢN4M'|γY;_jhuwMb?{o`20=tyYqln.X〈>,w\P au;׶>3LYH/瘤?ku"c͏-Ǟh6 ^]|gjl5#X$ggphd^˘S=z* O6]#?e?؋6qf,ESyj]w<%4ۿo_')Z4@')eK-cl{*2l ^ cge\˸䠓d9TJjf$FLB\WHm}un. J׵_VK,e-eljqW$pHiYd_3_/zez5lֈt]tjWEDZVe :QP3QB͊]u^nlSz wd]u)q*8Mz]Gz2= dޱ8׵8]7LgIòE6zշˇrZnݗ]u8Gq2 yP)n.EUkuɋ#y-\j#Da< 0L V8LjRgEc.Т9R9+Q>LcΤ1[I{!St> }[wN.ۦ_=c0VqҺ,Xv/0taÆN*YTr&F{vb'7yO}%°xաoxjLxXsH0$:;}dfj6sQ9]y>MSv-ыuΦ> h\RNCrSf%,7j߱{{4}Φ=/yKapT +Ygy1d{>gCsrZVYm90(vV"'&Y!{]G6cmB$rb[Kªފ)i%2o,b]MŇ,13ݴ$JKboBW 9g!3cLϷPNDT\Ҥ nUw:1)t&];5˗ J-?Hb:rrvLO7D/rV*d~$x'i2_n  +} +qe6rR^:^?aiV4IP|Юۯz'6y$N ub/ԥcl6Z(OJ7Les@ǚ52AXOJNTUtɾmz: ovrhɱ͸]f(͍d2T;d1b F_ ֆN c_d}r+nXo(y2ѩ7iغ"sOF{.{P*-F4~'j ͏{-DuȦіi[ s|i(MVpy;kWTtpaq%0wVbANI~ǧti;u7˛2 +V!ayy% 7"r+ SOr֗ؒkeڳ-KnumQSSWiNhpb2ZUKq[Lѩ|V=)KVע% 9ѩ^ŒI^Q]/i+m۷[] uABLU7%߅Y;s! ?%S?lh-RG_]b79Εl3"5W{tLZ5},+(WJ :̩M&|TaPUo~&š |I +endstream endobj 640 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 167.823057 101.433071 149.073057 ] -/BS << -/W 0 ->> -/Dest (cb116-1) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 639 0 R +/Resources 4 0 R +/Annots [ 641 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 641 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 148.876036 99.933071 130.126036 ] +/Rect [ 101.433071 240.123057 101.433071 221.373057 ] /BS << /W 0 >> -/Dest (cb116-2) +/Dest (cb113-1) >> endobj 642 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 129.929014 99.933071 111.179014 ] -/BS << -/W 0 ->> -/Dest (cb116-3) +/Filter /FlateDecode +/Length 4725 >> +stream +x]Ɏ$Wـ(0|`@ zJK2#nS4j2K$dU3Q"蝹޾|[CŠ +/oJ/.wI@^hwח ./iu"F) QE"Fe^[Ǩ9̰h3Wyab +f +0W4WE2 +fh=Rv(-%!ҌNYi%\:: 獲EᜳbT +9B$-:xthNdt]tVNK+l N)aMbuQ$-N`%9?NC`FN$)Ngaް:؂@;"(#H$^8@{/LԆ#H`:Da't¸9 ӊ#1)b0rYlh8. ["آ q\@`[p\@[#⸀F*qpa一Ḁ@R一一@u Q%BNV[` T x.*Cq"tA xW{L Aw-p37xW[9.0]m@z]P=t8.@aB-wUnjiP!: ,xWtBy83nB99.]LTq>xUs\`0Ss:Qr\`,Pp8.&tY]2q4 `V8. ?9.p]i8.p]i:BAs\: [fLYR)8xW*0J#M O8.^#%tpXx e:b^Қa \ }[)r\&!q1*sZfu:9.LŊD/q̀N |-*`*A3t +.tJq\4l7qAL'9. $֙`H"&Xi)YlMp\Imq?Xlb` YqA:-7!-5fZoz -8.҉&s\NJ +XojqeZo "I7cm$֛h`` Ȍ[p֛`'N`\Zo f` lk#Ӂw: p&<[nm/A?!81^ Hp/f+ $7ؠ286jiJ%ٰ33NG9t #y>V#hq %#10z*G1 `,_`cY`f[4ub'@~4ĿpPG+1r٘aw><_K)Mg +ߍk3>5LѽrݧQ71vZbMys~6?<)ps|UmoLfW~S D8$^,X@6wKn d,wpu,x!KWڵņ[c_[gm.faۖ;O{#Ϥ'wv9ذZ%$@ 崮5+v7!8.?\W?^"@r_ӡҬrS| M=j4?i=m:e3<{q4XHK, Ѻ/кd>G/?-gVЦ_Cj~\o˽'#&!Զ>υ3,S{}cw l.3G~J<973}чx/;#7-8=;,yåUXm5 uٙtZr*,7~UD(zؙl(w7qDq~^W qa8l+.3P]uqY| {_s#{}0oMi79GbVUe ߩCw g/Qzj,ǎM:l1ć JǚKJ_MYu_ӡngDL)~|19ja,Z?9e5s6uv+Ptk4s'_S @ng!tÿ\z"y6/Z1nGGcAB~'FzkyNލ[Wr< ҳY'zw|ǝyN TckQljWeGmvFs6 vn "?m\- B9B7v_gdk^P$ y&䧹Zxt;y?=njDîMlb{ws:$nMI+޷m9FaU#k(̼s:V36xM~GwkFxԺ՝yΆZ5QV^@os:G,k>w;9CF|tq ~ëջ6pCw9}SDVj Mqȴmk#L OY|LvgQ3zeœw=C⧃;}^>?}g!~PcY[C|\YftBJmo5JMowuOؙtH^QAlr%.eu\J98LSֆ;ơN0 ڙt`=yw}zgdF{9}n<꥝\$!~&W6 ?4`k/vFioxzs RZw erB?]?)ߎu7 elY}qÙHj8O:_:{uF'k>^9LAQа꺐s8njnI]Zl"mK$Uc*VuE(,OV(mD\e2Rn/ؗWbo)|ކ+b-lW+k0BW}yv~5~X7.^iNtmeKy1?󸖅-t։a8e4BmگbjZPq65ĞS h[m؈uVԴ]޺V,kNK7j(E{; UGuJ6E*%S:F7q˦X-VR>oڮTWsѸ钪i-:ˆh-ب81zu&<P{rcIZp馗eΡkȃP)GɩCfrbmL`JMM*E d}ɍr wVŧoۖmFmYTnD-};YS_202.RSSR6Ӻl{mnTC\Lefg)ߑsEToPDm'Mטܝ8ĤC Mh<뱒yD$JښI^ۊV>[-=L(ҜEHBҧÑ2td A& +endstream endobj 643 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 92.034971 99.933071 73.284971 ] -/BS << -/W 0 ->> -/Dest (cb116-4) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 642 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 644 0 obj << /Filter /FlateDecode -/Length 4546 +/Length 5011 >> stream -x\K$I ׯ3aKZ +Z S̀P/ȌGV+{zӕv<lɹN֤`\TwM,'\9%J)Orn|ONqgoJޅ> ɤ -e)LJ>D- FH 4`89ec1\ Ia9 9VAL^`"5w&K5]pc!K(iYc0"dHVAiY[ְ>!daw}-h0p׳P Ǫpt`5,@ϓx%+O%jX.cT^1.ABX4,]*Ұ wY`AD#DjuX pyCа` ߌ0]W-9kX%aH!9 "հ wދkkiʃ,k*>dXx]km*D஄M b@@,kX3R԰  R> ɂY*pb XB%kX'RXq_܀+S Yv"!|K"!,n"$B1m9n+2$zg<ϋJa(겾;:tek t#H`zϻuw(I}]T„t{;*^]Ho?t{YH+hEyX/]jLIN&I_=VHъFUfygNu BFЬߟ~gTr12uߴq_=VY9Fek;YdnGǺI?^ bKHv>y+'+Vϵix R\[ -nzG~f '.":"y}Ɏy^60mI" EY>s;^K ˂8 DijhyA,djơ>J슞a -ҕ/Nq4^s^/OD8x˔c~Fv6韘S͐7} E!B,8YIveH>=CthBY>^#۬ΊyG$7. Yo[oR%w@'x|RzsEz§m|{RG롸[$b2bbr٫kyrPWMw{ -s} h]~D#9bfK2z]Ingpƪðs;Dvmr1xu!Xű.c=bfMqJ`KeQ6/̪O(+PQx}$REm@Wp<7}r61v(wGc}/cc+}izja/wpƾWR++M()j&O-đ:.Z,;&MM|5r4Pw}u/ߔ&ߠ6͝s?{ӁZnWۨf7#*ϲ8c6D;_nǩтU[[ Ge~4O]Ub[`Ɛ/u;ɗdd ; p9TeOK.aDD q{\Y9Ӻt5_WuIC ,ͲpݮF9!o;Gɲ,_(ϖصerUi?V?HVޮ"_8_ IGo|^Bf6 YGbv1rƮK\b2u#˞R_&V-Yaz(ȻK'yn;wɲ?hsɫ& vgչi[[G0-]SUm]o;&Jֲ/uRHBʶӪkbnĽ]i夶[G }RoG4?DN+^U$B|R%GY6OvotސO!) -Dl .X>5M4//P:U~pMJ^|1$⛝ULuXӀ4Nr)uU ]cꤲJO@ǖu@XOʙhnC7 y'n2رy&NbN6߈,$,& 0F+ykG'y3c8LO5y -^6"9y)לe[_@,qێcHW:6bwyAvy z~kuu;DtI3rŞ|ڌ\Ҩ~cB퀧S^e9TwI h=IpZbщGA'FLE lS)ݚZgUKYa^0Ji+㶈׳% P9e%BsNђvnݢy đ-ܴ|w>WZSwB\MBٞ꫰m 5>JnwD^<0MN^j FgLC9rKS4`շ !/k7˻7uXaw=a  w!Aw VyҰDÂuӟ2V5,]}*qeBX4,]LTaA>xkX0Sk`OQ ɅYÂ"1hUEor\ KSӰK@ kX +dPѰSsNtsNÂ! A ψ2հ34bIZ㱕83kX9q5,0A Ty0aGasTd% Y6%L YiXPl4&kXZ ˈ7=kXq)fְEOěI%EQyNSQ-0 &IE kXPbx3kX7&KT0g$, #I/~{\fWo,;*${Ub6!l"&`܇뇟.__/;/?3/歬{V~\>+[pؖrT^>LgB5 ]y{-Mi{:~~ZNƮl(He;%̷G+j sKfh3ug~uG-M~f7G1՛4fguwΓyo>[2od9e *("$5}[+n-mfga}u qV~+ȭϻFAB4 pdv*`΢Vh~\{vwZ9/SY #)E A4ߧHJSnHZ4;&>DKڀ8ϭupxՐmxi*kطݯ] ߩٞ.r -*e.D2i/[ӅQZNkkﯰ4}6'E+{$ >>[] Q>ɣ+R9ʙ항wS@\#`.^Mïv+wh֭ w#2eU3;M)R@E1(.'t}/tyj="+XeUW7n:wYuC @{ICZJ4pJ)Cړy9CeL%`no,-L32unÄel6مs92=M {ٻܻ%oN@΂܆G-TXv[{ؐT,ww͈w[0M̑VWdc<ʏCL;v42|SYG1YP?ˡGynvಧwR(!u.d.Ө6-frrVjauVyq UĜ{8{'I\rݓy=%Ę₅n3ªmqu-mŴb}<*)LSJrm_=u ݕW*L|+S߄{B_i=7hM^S =yPQN8HDz,OEd=K[]z'l|*?sygo ZJҺ?AЦU# )D㔦} AlWEgX#7.HypOr/DΎydCE%;^ l| Cz<$9{#+,>$;> @@ -8029,14 +8067,265 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/Rect [ 101.433071 510.123057 101.433071 491.373057 ] +/BS << +/W 0 +>> +/Dest (cb116-1) +>> +endobj +647 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 491.176036 99.933071 472.426036 ] +/BS << +/W 0 +>> +/Dest (cb116-2) +>> +endobj +648 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 472.229014 99.933071 453.479014 ] +/BS << +/W 0 +>> +/Dest (cb116-3) +>> +endobj +649 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 434.334971 99.933071 415.584971 ] +/BS << +/W 0 +>> +/Dest (cb116-4) +>> +endobj +650 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 415.387950 99.933071 396.637950 ] /BS << /W 0 >> /Dest (cb116-5) >> endobj -647 0 obj +651 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 396.440928 99.933071 377.690928 ] +/BS << +/W 0 +>> +/Dest (cb116-6) +>> +endobj +652 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 377.493907 99.933071 358.743907 ] +/BS << +/W 0 +>> +/Dest (cb116-7) +>> +endobj +653 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 358.546885 99.933071 339.796885 ] +/BS << +/W 0 +>> +/Dest (cb116-8) +>> +endobj +654 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 320.652842 99.933071 301.902842 ] +/BS << +/W 0 +>> +/Dest (cb116-9) +>> +endobj +655 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 282.758799 99.933071 264.008799 ] +/BS << +/W 0 +>> +/Dest (cb116-10) +>> +endobj +656 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 263.811778 99.933071 245.061778 ] +/BS << +/W 0 +>> +/Dest (cb116-11) +>> +endobj +657 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 244.864756 99.933071 226.114756 ] +/BS << +/W 0 +>> +/Dest (cb116-12) +>> +endobj +658 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 225.917735 99.933071 207.167735 ] +/BS << +/W 0 +>> +/Dest (cb116-13) +>> +endobj +659 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 206.970714 99.933071 188.220714 ] +/BS << +/W 0 +>> +/Dest (cb116-14) +>> +endobj +660 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 188.023692 99.933071 169.273692 ] +/BS << +/W 0 +>> +/Dest (cb116-15) +>> +endobj +661 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 169.076671 99.933071 150.326671 ] +/BS << +/W 0 +>> +/Dest (cb116-16) +>> +endobj +662 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 150.129649 99.933071 131.379649 ] +/BS << +/W 0 +>> +/Dest (cb116-17) +>> +endobj +663 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 131.182628 99.933071 112.432628 ] +/BS << +/W 0 +>> +/Dest (cb116-18) +>> +endobj +664 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 112.235606 99.933071 93.485606 ] +/BS << +/W 0 +>> +/Dest (cb116-19) +>> +endobj +665 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 93.288585 99.933071 74.538585 ] +/BS << +/W 0 +>> +/Dest (cb116-20) +>> +endobj +666 0 obj +<< +/Filter /FlateDecode +/Length 3977 +>> +stream +x\[\ ~_1H"u?4(P Ѵ(zNQG3Ý^g EIfk2;sIwkRW[*pt @ɤ|ǧ;{\?~}w]8VXL&lPX,Ha`R!* XƂ!KV\rX ++C U O5p%$,pZA,3y炉Pzxޙ/*/xD&&vibb!k<,Xd j<”Ƌ"YY|NdNQxʃ,6Z +P2+ٜ%`B&9`Qؤ,ц K 5AƏNJ9+ŻɒxxXAl>B #aOp񬁀d8sPb8%``8Yw, sUd,hadLЖa-mq𖭋bZ K9ȅ) KN  wOPB`8G K쬆 %BOY` L0pM0pn5,a԰b|VlY K"7p5,`g5,U. $djXx' 0HK4,]WZK԰ w]b\hXTaA>x5,]G|.a8$ ga*[rְ wK^Dac3D%CrEaA" "p" "p2Y({ ׀U|ɪHa5pT4,] $5,Yװ f6%aA,<|*/< !Td 6Jְ yBkX`ȂLQ ɅYÂ"1hUEor\ KiXZd8x#钆<Y* 쑙k<YdkXL<4, ԰ *3Z QKBԙYÂHa&RA)(~PlQykXr3kX3dkX۔z3iXP,dAƧaAHa`'3qY_{le޶c{}Ӷ砾.ɛwlwJs6I،K$nnkj@>߼jb- oxHe&5tQJ-ι~3x osUxqkzme&|ؕo:}(-I8͒϶Wѷ=pkB{b.FwOg;~ǼLk^f"3j~E>\$cqtWh&h17=Xb[TjVxmH>\giDS2=‡MHj+TZ^ iΒi5RfuâRГj m֖Ǧ;1ҟf=XGB*tYCkxm?yf,IVP=EXOdf9{K.Ok#obw +譭 $fqrTKn}I[=߇Ob:<.U526iu.C"5u"HVl5Y\VklYM_2t*\p@^q"ɧ6r3rMWW99\KW_dXcLe잼'?og6y:W-YB=Qѥyr 'ױ=mҮWu3l-2w{H}]GmMJ(}:-upC%zwS?3Pm]xr>gX֕6y{lF6_kDw!KQtgti+~ tz|Zږ}qDc6Wo'#x| /'Uҹ~_j e>>7~|7{۞?'ߟqr~P"1u'Ϩ +n 9A$W+j !u}Œ',"&iM %yM|ox*&D<$ex7z6FU[C4%`ϴ[|VjM -P?N["?;?@8? +=/kP]L:o}CB42#~6C+Ʈ!IG_˕7 ,C;f!cKValj=Q¨̛B|],yoĭ98}ϑ{ޏ|XGysE]]ZLkxumt8/_&;F6R9l]&W_{?ZoY/4-Pֳߠ 䧃|2< Ab{kXB)-Zl{;O $؆}5?n D$6M3K-l=!` ym;oY-pItP]!:loӲ׈sJ>T׮FPePCo96>)A!~mЌeFݐx+B:vm0v*Vyv-]Siꔇi9KG,{ +yA<$]!) +DZlL**fK0I7y갦i]R6 %^@wQ-TxRO+u,Lt*Ǹ1uSCc,Z|F3]c{Xmt٭5iI{p1b2֭8ZJ#_VMuWú+񢭌#Ȗh$@a54WggˑKfރʳ%uܼG ę-\(:hO= qy~]"O(h\?+<g%LD698O`یesnŪK0<]K?PoTBfwN!v'q*S +endstream +endobj +667 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 666 0 R +/Resources 4 0 R +/Annots [ 668 0 R 669 0 R 670 0 R 671 0 R 672 0 R 673 0 R 674 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +668 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb116-21) +>> +endobj +669 0 obj << /Type /Annot /Subtype /Link @@ -8044,10 +8333,10 @@ endobj /BS << /W 0 >> -/Dest (cb116-6) +/Dest (cb116-22) >> endobj -648 0 obj +670 0 obj << /Type /Annot /Subtype /Link @@ -8055,10 +8344,10 @@ endobj /BS << /W 0 >> -/Dest (cb116-7) +/Dest (cb116-23) >> endobj -649 0 obj +671 0 obj << /Type /Annot /Subtype /Link @@ -8066,324 +8355,125 @@ endobj /BS << /W 0 >> -/Dest (cb116-8) ->> -endobj -650 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb116-9) ->> -endobj -651 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb116-10) ->> -endobj -652 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb116-11) ->> -endobj -653 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb116-12) ->> -endobj -654 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb116-13) ->> -endobj -655 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb116-14) ->> -endobj -656 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb116-15) ->> -endobj -657 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb116-16) ->> -endobj -658 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb116-17) ->> -endobj -659 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb116-18) ->> -endobj -660 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb116-19) ->> -endobj -661 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb116-20) ->> -endobj -662 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb116-21) ->> -endobj -663 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb116-22) ->> -endobj -664 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb116-23) ->> -endobj -665 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> /Dest (cb116-24) >> endobj -666 0 obj +672 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] /BS << /W 0 >> /Dest (cb116-25) >> endobj -667 0 obj +673 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 321.391563 101.433071 302.641563 ] +/Rect [ 101.433071 662.437950 101.433071 643.687950 ] /BS << /W 0 >> /Dest (cb117-1) >> endobj -668 0 obj -<< -/Filter /FlateDecode -/Length 3191 ->> -stream -x[[\ ~_1"u -?(h =NpwS/3"uDII|&|*Z[z|<}:Q(oqUo[ҙIKHrM&JK |uu>Z?~g*Pj)UXUJ0<`QU0CchaW5STpp$ruBa"\[l@%z:rbOB9UOKX<2HrukOW%:U`X({&!tTKEJ!Ut!aoÉ""dJKNEIJiv=]:`{ 3P%b)A[TbUGK10(NiqD`A D%x\ `[n@@J=.g  qqf@@J - +)G +Ze@"hcqwx\]qV5`f WB<.Pn(x7WWΠx\ݘ0swcqwq6J wA!q=tQ<.@g!", w9glqArι<.H]8* wAp|G$. <rlqA"nH`;Fq[`uu-P-E U0+=.BqA½7 2xKqpl3`5PSx:.1VӁwJ wmz\ bqAZ):|. H,W,Z֡I,% B ƈX]@`P%ec1vu:.=.@.* ` pEFD枎AtcF`A4qAYf& ࡑKԞNqA,T& h%$?H6:`-ݬ -,؛o  "> `aq<.h\oFqAB9Mウ:`AԜs NB vtXbS ZΖoV f DD^ T7{]M L( DdM񙯬qVƀ@ ս2 p/Uq k9{i,kvo Vdr xL8a}Z2CϬ&p,9f5y~?oWMYal~lubz֟"DB|IQɠ@ݶא03mfz5.RZIv~v/߾=_|^,CFo?ӛ?wٝ}bӐ^2˄uuɄ]c]#tiݙl>VC}^}> SjYd|@ogaF2ncVe;-xWw L,A5fm=ꐏ1GLG"$62 LyZ7;OYGl8=e2zc>fZU17M'-~iGOb;,X66<c#MgǑ[];&wQVWOH>1Vg{>t| _דMRs,/۱hOؗcy_ܾ>þw|g߼_`gs2}|kn\h¿~E2DQBmhE,.yQr*̉iR'Ԑ -E/GM3,iE"mool.3m ./£"Ofh7fs%(I^=c><q9yuʡ%Zߙv#~hl _ -6I+W!unW3h yi;yp*.cٞ; eweslz+_ Six9"@ -StL̤|l|]>I0 -N d9{2y4fhWu.::vՠQ lX:|4ff\]+SLӺ*Èi]|WoDK2n2gG%#k!YS~l{2 @Li6Kw5_/9;cRVnB'pEl@5gpgEr5m+w%HX"T ŇE{^tDoȝW{w\bT@,d!!7kTZ -endstream -endobj -669 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 668 0 R -/Resources 4 0 R -/Annots [ 670 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -670 0 obj +674 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 653.673057 101.433071 634.923057 ] +/Rect [ 101.433071 289.190928 101.433071 270.440928 ] /BS << /W 0 >> /Dest (cb120-1) >> endobj -671 0 obj +675 0 obj << /Filter /FlateDecode -/Length 4763 +/Length 4752 >> stream -x]K$qׯ~ dÇ F$#UY#ך>,fj|c'{r.)E4)\ISbODpIl LwZUJ&\XީSA`q+ Q`E0R$[g%K bxkdܞU MK,aJHha"hx&Gg"x&Y眊ɛ`$^Q1Ɛ%,h#d {- w9IY\tZAx Xh Y`]YAxũP"s{A윖xƨt"IIYu("sG'K9 jɻvFbm"`%%)% lJ%)}P|JN[$ 6Y#Ӑ%(!3sEdqKX,dA ,; Z$,p[o6QZu9z  T$,p\씰tIu!Z `%,p]獖wCMY`3IX$aU;VYKX6k/aڄ%@%tx rwmVܵF `( -h  r8Y`: ИK$,]S > R&(aAyE ~ -+c wP9 p%,+V‚5+[!HXsPXߔ0]W.9KX%+aVa3D%C2F*aAby/DIX#ye+aංO#XU)$pW̰jK˦1f Bl%,٫R  B>IY"%,@`+Y‚d!V‚d! B b}d,%,\ | ZxѪ"/g)yHX\Je8xEᒄ<%,HU$,REd. dA-a"] [ȂhP‚l3̨%, -\x^S%,>* -%, R<CvM9"%,R%,Xm%,mR$,( ⓰(L0oZ/a,aAq&RCl_p9Z,bM(ܖLs+w;ƄykBKв)MH3(=CһDnBQ4N] H}uܿRN7r1|ɸ޸:WsHu c3El-}uN\y_93!'B|=m|cHZդ_mQ6ZP^ʷԹֺ \9/5ΨS7W[EYe-)}me=W硬,a/r]Q؇ pS`x-^yWt$O_f뇏VkआІ5XS!,ײ_7y u?m͸dCsJ2Pf_%˿|JFRP'i$Z.MJ_zom4 *r]빕gtArz@F[Ρ#Cv6 V+GGr6uᕂltt,j^|gy_.Vc+kY-fڙY:a\Ǒ=8^(7Y>+'a`hm4eo/r'7ʽak˘d9g7|.0 29e}vE]qtwZ1OV0?Hk D[]XÛYC \,TC&:*R+?DŽySWAWbq.Y92_b1:uKTZ1B؈e;,QBGPM` u֣-ҶqG}' -cyTw 36rh,4yf=CtZ=z X0Zkޖ[ -hX,:5;UA-Fg!D}ۈg-DW^HܮCYgn6xF'Z]q$1]+X`o ĠrB'%N+*fC X&Q:?';sf0n,6Һwuo[QV`{fTh)jm%ގg.OSvwp=nArW;M.[J͇mwm1[ڙ,zqKk2XkN \wg>wVhXM;Oͳs0,lU>,.Xވ3SI';˻3vNףgf5s׿dAyk}z>ny[g fm0ROf5Oeo{-3!0vfk}Cyλͮe -62Y[2Py/ό\=[vHv3owe8NNyλ.vfk9[LM|ٯewzo'7+cG;gV_nLIJ܎edwg'?O2&v{$1쉚u77y = .bΰoembyx[7S_E*=f5մku9&TJ }6#~[la 17C\i"[[ }R/G4?DrW@:Z|DvK\K*/VLk2uk6=.P:1=q\N7;y$Nu(eR6e]c*S~4T-tdnC7 y;{rɩϸgovy{V6?sd`A0Z[;: ɤv.sK/EgQ<2E_eغ!󕌾x $4bwF <ʆf }Vt5ˉa萑m7]kLCMZϝ`/n8Ww >\scI&qEEǒ".xd!FL2HIW=T8]0.Aoi#fC{rjQ;TW/9ލԜwh \pe<7ڦӶPtM7Zo15Z8ZJ=?rM>+]Jܕvۊף%9QǒYE^S(m߷V+Q-J ;PR<ڛ䬫_sOO>+9~, ӡs:*.YW0ck}M\hqH)@ -0{\RPL*W/9 -z3}cD/ +x][$7~_1Hi|)ߤ + " .:ၿW]]=Ndv|)>Wy=l?sIΗ'3`_-JS%pTK|?KYONXױg7 1rJ&(^a0BTXNb) bD1䠱 9V{V.YXÖ5:cT1D)<GsqE%lr)&j2CxYB1V,x|N/BQy5^,) +/CXWVyDc5^S(HLNys&L!{o4Smz$Ťd&Y7NyBxSΊ:nox8HAL.BqIDő.2e \.5p%LKp xYE ,UyҰ;ȂxYy <Ж`-x-b5,[26jXhX>GҰraJEN <@4,@]Ӱv=azFz*5,:Nfaw5I v5,L.gaw]6aw]p A[.awa e5B@Xs^469%-XZM6aAڌSye WZlEÂB5,]gְ?aEuX5p׺b4,] AdhXmdJ.`iXUx2HC'8TÂ^4,]װ w !QygaඊO#XRh<றa5& "pM bb@ QӰ fJJQÂX xT^p4,HRyiXz*d ,9 ,4,@D0[M E R԰H6BaA +r\ MDbar)5,O.iX1aA*a);DB Z ,5,.#ˌF%jG̬aA8qa&RANH~l"QyҰ gfְ gӰfҰȂOÂbaqѰ،|ӑK7H->r4,(YBY4oI7N/BWHÂ#Y7ѫ[ͤnwC2i<."Өa.o"r{ ̜qfuzVu{Z%u|9GR7 &2],`Zn/1a¼$"!ảY?(6}OԝǶIӘmW0NPCĵQAΈL7dneqKx9 2;q9R +J1|ɤޤ?;g9_y E-}vNXyI)>0TF:2xCy*_Rz&[.P9z^jN yq>>\JPQWB*|S~/ٶ_ ҟPߜ0 MD~cIﺟ|8/'ϛ|i @Rcy ^xM5_^yqYo0ZNVd/ƥ oʜ,VNdg_/=.޹,KNogz0),[F諵|\s U D۵lMNoY֪ak,6-Z#[$ZC# k]sRK8bHȓD=ת,У3 wr=;>o,\}M0c,+}\O)Qhp=[hsmCןo.jW\gc+{Ymy/ ;lAC:/-@YNj@eKL#MPM`YFM֣Ҭq[)1ܪ Uik4SC:M3î[ 6y]nyX׹9/5>%!.B g-DdG=֑]>>=aUMj*GA>hօO6n:p|@v? du-#54OrY={e]:W' ޼EۢR1T:sϮ'ny]g v0l +kxJާ2_gYY}q" lfZd-Nf}R&l,rvs5ܲ[qG,X}a3)Ybwvo5 ޼kXٵ,Vְl%}g\=7kv<ymy`X]p5Yz2,zl6ZLE|ٯewjygW77⸧JΖGi> = +wCޖ>d[|mpHGWGl?_QH{#"k)E=܊z~lLrhzވP}>,nDطst#gR8A?_x~MEn`i7ΨQ$?iĔgRah2'uE8uk*寝o6 #ǙhLw]bz4aiY3/XcMS&"Ets<3?,OM烚y{ކOt-.'Jή] L +h8 2Es]}>Lf8b]hU`i|}ܱBDhdBGV/Wg;q4HhpTIbn5y,?Ⱛ.b]Ίoe]yx9[>T~PnkiI_y!TJ >O +o0idv5~L͐+BrKkTZ(}Wh0&~5o8)zQ= e':=`^ǝh:r%w :?6YC_ǝxMJڎs%1  + W{ }f,oM*\2KY4+.:tpɉRtXd+1 e'],?ɩܗa_ʦBAl촬Q~{}y_DڡS%tq}_Oj;4|rkЂVF5jK ;F[uF-&S\5gUKtҕ]Ynx=Z= +Ҝ%{,Z;FIhiw[mb4#25Zؕ|wh_ y< 5䝯?dr'bk:J+{tLILKr!j?W+Fc +P?c믩!/I̿h׷oClS endstream endobj -672 0 obj +676 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 671 0 R +/Contents 675 0 R /Resources 4 0 R -/Annots [ 673 0 R ] +/Annots [ 677 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -673 0 obj +677 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 529.294475 101.433071 510.544475 ] +/Rect [ 101.433071 548.554475 101.433071 529.804475 ] /BS << /W 0 >> /Dest (cb121-1) >> endobj -674 0 obj +678 0 obj << /Filter /FlateDecode -/Length 4587 +/Length 4591 >> stream -x]M$ȳ Sw0sm5>QȨvowP>(|"J~2r.)ˏR %V-~Si -?0)`S>_g(?_~_uNDkoݔrJVSX!L)V4XƂ!y1|AcA omVXb8۳ -İx1L Ia<B;L"&=jk(`s|JN[cI82Y#|Ԑ*5,pA띆ha-8b4,p[O&jX4,p@\װraJEuN @4,p@]հvQuސj<ְ89 % YxN9U^$ Rbar)5,O.iX13^ÂT \E,ES5,5,@ 1d Y jXmFI%1YÂġpd@JY@?l D ^Â-YÂ!%alͤaA!ȂOÂBq0Y8xDoZaͬaAq|)E7CEAME[`MƋaAͬa 䛈-fR 4pi԰7j=xCB|33gY1 @oڪnUR 9i1Y`YӐm@_c~ ܢ053'd[xD=ܝbt~S~ Xkt,@a"ض5uXTlXܖkc"Cb #~*EU"BU|Tt]oX~f?Uس>Y=Y[Şe*K&;',QϨ=A -5cX~ 9"x_o-/|ﾑg$ᦑ5MrsL;ey!gufWm}řV5z!'o׾\tHN,F"a&,.w0 NRn&KON' i~[OV(߮ʽejme> m1.9˸i#'Pm m[Zx~w8nq[RK|Wɢuy a5O,zziWAJiwrr -R<5ѸEっ*p~?j m~ vs묄"ԦPUK?i_h& %QmRi3u7qZ($A#)sWgjaDkFR ao}$G6wm>%]WmI;&/yDE5}w!eVW3g}%G/>Λ9_&uŗ9D_ӏ38x+&BkgӚ8߮?MduG _4~ n6Ny#jw|Fa~p>_~/OWs.߯O(Nyf^[k@|ˀul(T6T$uQۼ,{9 m~])鶧(ӢD -g/~ <4`9P?a/ޡb=Zd,_y9C-EMNީY' _bT5ʇU?\L͡TٶA~^!{?ٓd&.oM+i7Rʶ$<70@K(FCƷ~xj\bX!f4{2&<)vQ8ѠeGCq$aO$ [1|S8]t9uFIx[>T5fR9!TJv't(į5Zەfbn{)E-R/Gf~2L> -BM|r{)]הv { ?_BRJIvra/xw*B27w}ד$鱣f4ʊ2)ue2)t{>c+2AONkV am~:VJ"5! n+3tW ;F{r,ɩkea]ޮFՅolu2Ȗj7:!@a>Wr֎N|r{;L[qo?_2g]/ee@o]4:Z؎+\|n6hA6y :nk?Vt5+a̡ n813xbd>U7c:I923*+g4=ꪌ#bs̕fJ)O/4EOWJ +xE5q&? )foc>_k87똫r/n)F ++E), ++ CYcA !5`kJq4nF b29%RyUxOJϚ)lʋh5sSlxy +!LFy 3i<.E Td):!vKޕTd@Fe7U^RL{%?iX `q +8cC0p9Tyaqr&9  E id5,U'aа2ٔHDawm94,`rw'aw-۠ae w!^ VYa, 2Id iXMBiYK7Mxʼ.H5, YȐXd6fx/R[:]VXؓu>h#>ᱏ +F]l_`f]0O~?}xw=GĉHXL|ËA[>{|_@ 5V}?wWʄޅ𼟟J3M:ZD3;?-uk_aehyy0^+)85vqvmPU]2dŕn8*/*Zm:?PhKn)[{a?R|\ȽdZQ!2y{0Q˸iёt8m m[ZxY;7B-/Kq k 8E +d5M"zziWAJiwrJ2RquVM{47y0pRß/ց+#S6s9}6jS}MʔJK?Yh_h섢Ң1UG}@iQ}2mCwGCaiji JK-ٯyqfZx۫g[y9xNl8#sʪ +٬UmJ!ϛFNѯ}^,xw+K`VP Z\Az EB,vӂ +wz_ϺR6dOX7.UY, [CI07zft_>ggٳЫy߸|'u}f9WOL=uޚAGw&nhZ|H0=^ױvu_5 e4/WyqhJkۍig< +|=Wyfx߽+s +w7+l_r7ӻ[31Ɓ'9>Ǹl;*jec~5Oy՘I@*= COxF ";cSHd7lŭþmW=q'Cz-<='6BS>YVOld>'cX33Qˡ:>cجs;{nm93-/AUEj.k=:GäUgͨ=)h|ڇV{ qOCiSz_>^ۤ¹_X 'nbSKH'b`p(c>#{r`ߵ }>'Փv~ݦ_}X]ꛊz8al]*vp+M_/9ç\TuldLL&|?}/9s58y+6Նj~?&;=:F*l) =;Y獤 p 4x _erkJMy`k7]gT nKEEyHa9j0Kx~y]fS!V趥(L CfzHgYx[ Ҁ<~rÊ)lQHr 3͉UnuIT3XsS\^s+%A"L)f?'ɇ݃TևN~ݓ{R,#شn8mIxZ>D^`PFZMa\cX!f0{&4)4Q$i e{Cq4HCwlc侧ЉMQuf0-k`#nݖRTծFsPQ}- N +vQ_Qma&w/T[\)E-曥b+z\5ERSB ]Q.$qMfkJvfb'?_|TJD7ȉt|>Ԭ4F~PU|0\JnOVH uXӀ216e)t[馱uP@ki^aU? +G"U!]'+rӷuɡaHFkv[YxKONV@:s!IG$VKYV3r3e̷xW1븥a:PSc\iNB4b2ZUKqR[Lѩ?Uh++EK@~tGGd%B cF^Uھo^]W0 Rw%_;]ZSvBLbfu0Jiyq㽒H+{2r9Fg]g0cT_Gj!LVPjjW6cTQ' 'Ao #93y[m׃` endstream endobj -675 0 obj +679 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 674 0 R +/Contents 678 0 R /Resources 4 0 R -/Annots [ 676 0 R 677 0 R ] +/Annots [ 680 0 R 681 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -676 0 obj +680 0 obj << /Type /Annot /Subtype /Link @@ -8394,266 +8484,185 @@ endobj /Dest (cb124-1) >> endobj -677 0 obj +681 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 155.626036 101.433071 136.876036 ] +/Rect [ 101.433071 160.426036 101.433071 141.676036 ] /BS << /W 0 >> /Dest (cb127-1) >> endobj -678 0 obj +682 0 obj << /Filter /FlateDecode -/Length 4552 +/Length 4592 >> stream -x]Y$G~_ϖ\#` a% ]#|UyTVTunQtEǗYU9c -._¿\bu_U+ -Gw 6L!9˾.ZW3vc)X ,rn -8/0Ĕ$p mYbPNbA 2& -1,m1L$ N., 6J<xMJd `$xi޻(si"% $,[% JY ^,( JKd'"Kg\VI<'ߴ"# d%YUFYBx gCBnxHA_B! -^Dĸ$a adHD&B &)H8`h ,VCBIX '̨F3jIXw4 0MZuE^TQ, 0 O*ID^HZ񤐇JXޓx"="h$,@^Vi$2@ -Ux]Bwyڔ&(a |)%,IO N‚@p,Y(HdS b ȂAdSȾd,%,M1IXz ZxL1E^O B Sk)"%,O.IX1$aAH"a)dOC$ Ok ,%,&b镄%)^gF "SE &Xi)EdLHXbIXXۨ yk_{4X;[{|?~+X_HJQT{߸vz?Psf|'|e(~뛯6ewMVwb5M]!c4*EWo|JMFT:UQ/uEj6\n\6o_/}fl[|@[h~c񱭎1 |Sk-r7-rr /Qu{~u9nϩG򝞶uXdc Bkd&6f#/;V uڇir9Zs~mfl\)^"yA[<ɞ^=^Yꤵ~z e4HMe^J װD4"=/=Wc;='[`B;v^d:am̻[^!:0*>oIuc>q0Hm10IE'˙qfWs~mcnoS*3K|gY\)#=DOrv#o6VЖ-y 85j@ф1Y]|_6Yc vzűm;YYcK[P,vPe]殍q<;?se]Aׂmtɡ&F}x0oM~̏KŸ󪇎G68\Ʀ^ vle2 nmX("-jSz/sSrT{us=vѝ6!;N[Q"~+VsXkO{<6\;:t^x=xuu[1~zG}#'<猟^suC-͇y՝Qn;޷yTp9 lm>!0>4vgy LSz0y(kf e'<@n=6WjwiYpJm܅Y݅H%!1l烋t>N8iç^=M퐮|XRTt1ΊםLk`'QRl.:Ϸv*`n$?_HWȄ\$WU"] -V¯$jjꝿWF]G*l>lfX [2^Mz!q˕s%/lUm뮑 y4VUޫNw/eMyD]Э",MUi*U+%AI .sU&;f31GZ.rv-jPKV57QX/вjsQ|]1jk;1Fb#?_\J뉶kjҨ Yh| ?CTFESu)>ԭ]N86+y+ꐤ>Aoh;곽tTByZjlETC*1HUXuJf+XU5"79] Ujg^wj+v>P-*omB前F2~,4Quku&@>gr֊N|xڂLqo\4g3|k[Yep6FU0[W~&I2W^5l:YVo8uWW KI]TWnOtMT5vq۠Ś|mڄ=_p|6^ -pp϶)5+.ڦtptq7ˮ$[wRUSo -}u]M}ӅGA -la}i% K0B{>:0V6_eslS\ieس5iR Z]>Qcp}ThNDQ*b(2ZQKqjNѨ5zT%*~S6I<,>k#3eKoГb*kvMdLf.sY7s]xlAiO3ꄞk,; .zBMC46M -[y40 Oe)ـ3ٗ78m[&MZ,~[Np_ږvMm.ޓlн- }Ɇ,=^ҫmu=xeSսi/6m*:qsܶ,>g]]ǵ>lke/0Gc;_bO.sBc\'-e+/ mzk=MfIC6K}~-GG{reA}o.vvuy9ӊ.Jׂmϣ/g]M]q3wm%r&U~5гy^U2q! dtWVah;irnP{+7Fjߴ]U=_}o<2︙n'i"q&sC(s-'SX%/"lQ?{ÿp)?~G`G)>%ISc>:Ai>/idq覹yKO/i im̹GP[SE*F\ڵ TnT_S6P@gM0fV3'bD-]$KRJ=ktWw)^]x`#%wt5[4/'O'vG!Xx(on(ҩtYi|"?AoTFrajz%7yꐤ>l(;泣1t[ꦱuP@ cI6!aHUTɾz* fpwаy$fqG6y[W l&ZI'[F^@:s!Љv^N&ӏ2Y- ceAGlq_?W;O endstream endobj -679 0 obj +683 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 678 0 R +/Contents 682 0 R /Resources 4 0 R -/Annots [ 680 0 R ] +/Annots [ 684 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -680 0 obj +684 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 304.323057 101.433071 285.573057 ] +/Rect [ 101.433071 324.123057 101.433071 305.373057 ] /BS << /W 0 >> /Dest (cb130-1) >> endobj -681 0 obj +685 0 obj << /Filter /FlateDecode -/Length 4533 +/Length 4506 >> stream -x][d7~_H9|P P`%] %<ǷS}fvthvTR.\vc -ΗoOߝ¿b_7V- lXBr& Mc_~q6>%%o;UdCPNP%ʹ%㼠zAST02WA):I3Ș("̰ݫ0A: (%`"Fix8K:I.@t.>vZҥ{#Ғ-dctXo-&+l1Nt]Q啖t..E"QS1Ľ(htZ/ش# -䃠3+DlqVIga Gҁ' 1 -jI`1DlAK `Qqaˋ>I\ ̨F3jI\8,]QbwAKF‹`QIK\2^P 8иoOϿ_̽y -k/>Kq\ygSנtJ#p~a1Z]*iVNTy/et.le=q٦m}nmy۫o7gmW~/O~`^+Dl4E;=C0C@5#Pm]V]Nhi J{h2(4&n`2CSKvi%4,k-/_͎OCn[5X{HdB^<Lo!{F;h^Ҝ=͋{ҋg̃y&6=eлAϼP2<Լ̥H&!i%S+(Aay XC퀏M0LgGf͛uwi=rQ@jBՑjF#ˬ]8";-Pm %a<]겶D2vgN,E-cٳ0ྜRiG>"ڡj{oJ/ZzE'kHf#WF[A+Vw}󆎴XP}vf, _Gk>+}k|vV+^BO7YGßu:#OqWӻ7=7v80uӆ' <cOF']~;jԏHf/qH1t;#k'\0y@*4<]\Cܫ% z<D^n=r;$>rE!?C+7uζ] Z(xlm<^kΣ ҈kJެc -e>s/8ˋa936` Pn8#C*ͬp0j(gl>MO_9p(σ,@ozt TO?.Z 5<oe_VPmWȆT "I$*=R+O<=u[T~߮g^64q7/)[h%)eZfzM v{CLs-yeloۚ"kO|@XS A> g;6%O0?kGUp(\8υ7nǫ\zC5~$| Ѹ{h=osjzqB}^l#X;qܧ?ۃoh(NcO 2/׃ywO}ɏ}?am| <c{Q>0ávt/&ALbE&l -,iNɧ -1Kjk8r/R5[ Bz/֫E1_[|3φ6a/ƴX[5^PGōu 5 Cw^NgQ֢wj2;ՔC gM̦z/Q\ZT ILWJsBK{T=MP9^eioƈVi}^Ni'~> v+v(xRX_ahV_ATᚔ' H^ &:i:$y@SiwfG騄L-uF:ls׊iNt}SqǍjlanL_  Ahh.ֱu m7fkU'R7M; -] 6 F32y27}^m8|g -cs)<'Nڧth 0ǡ-ۘɀ+igi -u COcU[1$AlLJ`cic`{1FMLΖؤ9@ -4v;A;bajPd/w.?SD +x]K$ȳ15 , 76=t0ja?*BP0#cQ]I}LjJ)௷._<ojL1E33=_/uժ5tGfybQ`iRX( 1g1(z1|N$ 6 1YbhĂ&SXFCcyD{3$5*lȋh%s*DoHB$,xYx%d.E NHH d"%,pA띄h-8HX^ aBL-a W8`vJXQu| +8FKXΡȃ,p` ʙ$,]gtw1 +ʦ%,]wm tx% AZwA8h1BH VY'aSa5˟0Vʤ$, I0Dh\в2!d IX@]gZ kVj56k $,;(@ohJ$, .`JXUX$yQcJXX޳9 pW{="d%,@\0*m ,,Z,aA)aALI[ B*$,YOg j% ^*$,8k%, dѷ=,pq! "E d*e%,V%^*EK(aA^a)6`/&xᒄ<%,`HXH%\Ȃ [D#aAѠ&2+4PI‚PQL4"&$,}xM`&9"8dy$,H Xm%,o~3JX5dA'aAAq,a`<%,&aiLdOoF ,EAMY$7N/@9o& f`^<Hߌqp2Iw &"[io;$h@/am 4U 4H2*Fx0a9}!bL1-<ܝb| g夬5Ji +f}  ٛ +s1w p=fcFV¢6vBwc`OicU:E }0]Gc]Ioe%61PH5dV;bŎ"Iˋ |A5ʸlyb}>W)8(`9t? >Oڇ2;vi" e|}^۴x{?屙)Zh[ח_}1!7^-m}aMWd*GilZ~\d2G5ÅV])iV*W93z lg-+zy?Wa{4jPGo0[&`hOqUnS:=#Xd pg5jzsqU{^a([f5OF8x2l\٬S[_YR_E"w9z tz6\d7q?T͊;=qg{[$oV%mÙ *Ʀ_~˳{mV־5cٖy1.;z:i:^k묷Qe6yo2p*{)tyZҋO)6S[Ʊe n84a q=z[ÄU04;ΠZer(pݷ^};zע#9ݑCl6˜dT Yh{yY(z[DKYWuojŦv[uֱulo\?'U_K]zm ØPOqS{W֮#Nrll9a4Xh#}%]-Oyw5_;yHV3sMy~35_FS' QDrnNP@- bt洙 +Ŵ5l=ۢuPnCZOjTByTIK`1oQC ْ);t-j~0=VY"q6#V`5)y"~Myas.s0ClMvsz3gMTPu% 8;WI 77?h_(-v3_ C/ܧAL)# pՏ8W6hS}dg‘=KyZ8g !y_ZǮe;Xv{[?88< u˺XێKMƣwO'Tw<;l_=v zxKc5Uك<ڸt^p^ o5_6+5_=憏 t[y6oSV;/4yEgXs0o7*V\=/g:wsyqs_?,pf5s׿AwR}oMZsr4tx/{Ϫ;8dsqG]qv^R%Gq闺Әr 3v7}[otxSJ 6"utX)ɵI©|^wm73$g5;8t*:8N'tV~MO=~;yqSvNOzy4\K6)>& +6boЏe{Cqz Ҟ:*ƚB'6Gՙ9 u3U򥕵] BFZ7; E ~klj|BLՑ|+k9t֨Y*RWU]% asDqK/4[4om&v녢P:Vh7n#'SpcYi|q@5*#O`|s)?Nxn6VI#=4.cQ_&i5Ǖq5rs-S~0@MZN}m: E tc)ժZʈbN˨iҔHU®,[W-αN-L-}mu]#SݫѮ=sg3:HrbR; 7YW;Bx:4YD=;F14UZަ(Üޝ٠y7Qz 6 + endstream endobj -682 0 obj +686 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 681 0 R +/Contents 685 0 R /Resources 4 0 R -/Annots [ 683 0 R ] +/Annots [ 687 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -683 0 obj +687 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 456.573057 101.433071 437.823057 ] +/Rect [ 101.433071 498.873057 101.433071 480.123057 ] /BS << /W 0 >> /Dest (cb133-1) >> endobj -684 0 obj +688 0 obj << /Filter /FlateDecode -/Length 4515 +/Length 4514 >> stream -x\K$9ׯJ#VBJFB8N - r3HgTVU,ӕ~#_.RΏNOZE<l4EMɟ?0E1Ooz?:lU=ȩb^`eq{A`0Ĝ%,YbPN^bA 6 1E 1l4$ > -,!Z<xƫg -),"x&Z -7/O H<Y!KQ"ċB;Y%J"蠍ND^O<9-QDf%hEdN[ G') v!Dd%$ RKeK%J -ؔ$+ -9J8 ,@yeYȂ8Y,9 Ж-8-l$,p[&HXSKX.rJYuN @=JX+a:JAudu5EdKXtT$'awQbY `U? WMIKX@]4IX@]D^TNZ!Hkpג QGpt`%,@: ИHK$,]9 R& a󉼬Lƅy -+Bw L"wCx]cw7x  M yY霒 X -+$"/*8`4P p=KX;'aAjB# KV5a -sɪH!u.M BdM@@,JXc d R>QY"P$ Xr Z⬕ ZȂAd*d]AdTDDV%^*EK(aAXKI/a^q$aϐ1CL T%,H%,@ 1$ Y JXl*3h %i^g& ũ&Xi)EdLHXbKXX<[T3SAfL BvPlӗyzwxax^adrb !K1w! `qtc!n}0[!1l̔Ѧ_, l(u>!%B6( yU;?\2:# V^YJQCH7qT$ȑ-/o`O؏ -1`9褯=h ^kJ N~i-'ZGJ2߾_%ЙFO_.Ƚ ?۰}.m>7W;&Qc+aAӕҊBBPU+}Vi(Z5)"//8$* 61՘ոxn|o'8΃^ۮbdӍ\:n-macW# L ^ۥn"{ANh{q%glgTN*Yإ'E_iΙ,V|nٖ0ɚYOtv`.VU;[_j~h'wS|Ȭ~e wҜ.5P=vs>wA}QxRco:US1__ <~[ûhXu>cbU1>u9Oo1>Cogk/yԾ<¬QҬ[$GWV}} (:1zYQs?Hy=O;ꬬV/ߖ -7Bٮ}Ϥ qom;WlyZ+s4os.i&/<Ss9z0-So #\03ǜ:W\a TR:n:(7! --k)!\6j303j]Ր-]vm{cҞly4Mr M iþUOF)j|`!b6޷ ?|0ʚ0uZP`,uW['/n:%S&7hfM W/,&AM;nPsJ^*v#']䭜;2Dϰf/zi긆K-foڼX8Xd)x?Yqxe2{wu֒16o1B;ǗuKUnxk2 n7yuj15nBs+6Uo<[S0q+_z|ý|zG߶wcWy9KnB.|D ;wKמ'[^Nu6aXc9䘓6ofFއg|AycW癷噳G4 L+wZO9 d']CYuOx7x4{q;7ymޚ7'//Y)5&Ox雥z+.gp̔|ah{ʞ{hUF՟CϼΫrMdWV"/Z}ot}[u^q#hXTBU.bro¼Y܄3$J.zogV܀Wj$bRŷyu^|]۹%Rvc'Eq1z[晬 -m[qf$oW^l@n7oo5v2cg>OʗЃj+n&eL_ܾ[ףXxc_\j=CշlV/Gw571r1/tێvo8lK>ñ~=7ȳ9lO|aݔKKt@t|9rl牿T3XsPZ|c 7Э"/aMUZhn*7%AI =]&U 1UGV.r$[[RJjtWw)^;sDqK: ~cwǓ6;PwоHtCtNu+/S>j.ŗy F*i:$iPeuώ2I t[馱 uP@ cK6!aHUtɾmz: fpwаy$fq74y[Wc l4SnѮw6`N0\u6t&>ɤxTœu _46fY/?f%[6lݐHR|Me%i3- &zCxM^KqG:ȶ5nЌ? >NZļڦoYwT0\I5zjAGj~*mi  .@ӕZUVj)#Nb):Q~JSveZZGw}tldhaݨKJM۾k=à.H虩%sGF*UNI.(j2YW)` Ұ5rw㽒H+{99eCSwZSanw9)7}Ͳ!#/bnIoD6DbmOϿ  +x\K$ȳ^b6 `CuM x"$1"Y3wP]I}J7r]p&G桱R6T{&lr>ev붎zSk.^YL.9ۨ*XǤ3b bL 1 y_V GV>;X՘ykUD+<MғΤR}Uy< L.:WMJ)G%V4^,YY(d )XY|Ae⡝ +dwYlN`b-D*gK.GxΙ *3 +FJYyȒl*` 1RyvƋL*YlN`% |Ά' | + |r  5ցBHIC a<*iXFLXvU;d̒yӂݏ5,n[ϟ|NYqp@+#0l{@,!|O"),n,$B1mn+2$f62􋥂BRe}s]ք5WٛQ^w=~#d/oV>:/>]{;vSxG|~_w?v^.'`?q XVF:oѭӣT>/t=kY,'mkyg2ۧ}zYrf[O=㷮~CRsc"ڱr]iMRxV >EֿP"q :$~%:o +cQ:;DmN3camiF~FMvKMi%`ͭ3O>:qI[7vaCXǖNY\/2w縮.{}З'┹ 8ݯ,oŧe>bԵa-G{I)۽6]_5]zven?m>oq[);뿏ehv|`uD_MqH˞~ڴl̔aN&c-,Cz\Ie\f=6}y~3GȸlP?5Ɂ 9::;u3彞ɤ<{nGfk3}CvNg VmZ6/yocwĻŰ S:BZ7w3 ^5bAE5х8dDL˿]v5$s "-FaMV~_so;+ߞ˽T!TyՎi[@A1Րo(pCCeЮ2~Z*ly[Il^p[ZTc5>1KT'|?brƻ~"INyssWdzQr?o& +cG*nuP`&o;E~m8` )p3xI#~RϨ{2/ˋ%5)dz ~W~ȱHݻA 'ԹC>T:3|Ǥl& IpH,<6XuxG|6cXvT xɝ5l7ZߗmW S}GVE7<U{cu>MSz ԉ22b<-۳mjLho{y<5-ʥ^^; ';`|8[V/t'_$V ~)7q9ox ߇6<g%wV"ZcV+}Gu>qO#yd۞@^roHZΐ*%[#[f~+mGF(;;^X9߽G"nĺ/{;7<3_pثB}xX!frG2nb(|ng$gŻd,01Vt7ɞ<K8Dsœg {JzS]ZBA0 ;)B |a5b!H4^N!=_rkkqX*ReV]S +g̗=9bC%ak[iI~Ĭ+l'A;NT^,05;o>8.7{̧ A*I@4(ϲB].R_X<(=4 + z]<[^7 a]?+%v!$ʯ3,9q;i`$aq״ yG;6ړKdnv&S0$O}m>[:ՓdZ}œ:&,wo ~rk.8@ ?uC,NF= ؟dWfؽaq^Ӭn'n \ISzf yő|mf^C /HRAe W$  ţN6bCNY~ܗxi?ɣfeӝF! A6LNvZ7(B{z}WSL>:x:5Ǵ}1'S}N {a$9sjԂ6Gjk(;Ntŀ ls)պZڈ> endobj -686 0 obj +690 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 432.273057 101.433071 413.523057 ] +/Rect [ 101.433071 439.473057 101.433071 420.723057 ] /BS << /W 0 >> /Dest (cb136-1) >> endobj -687 0 obj +691 0 obj << /Filter /FlateDecode /Length 2788 >> stream -x]9WJ]/ b%DqmvN\y79IhΌv]~\^x+])5'\o6q9 -®~w/]5xy]1ty﮸V5\)x2u,*T╨bt9*y[`FQa -fX -P^Uf썩`11@t>AOLKJu:өGtեba:-g[7-%3]-T2l Jt -I♮Q]NJ. Ţ*L罋M:(LRD`KXDt -[ /'Rj mug[BFul\c@Y :+VBrVPT3《.x-1-KuE1h-X -[)coa,P֤zoM|b,Pf -cZ1( W -*X.{f,PPWc - -쪕XசwUq%80ce,0pWdwcfc|ŅRP [e5[`;7wXGqhB"` Xh%YӠ&Ƃ飺|ƈuQv>X]lTX]0;j`,WLP "cyߜ.U'ƂKP]vp$X;AX]l U +`X:,[: Ӂ1LXݶm20@(80b RQ]r(GƂ,D `ec,@`Xl r- }]h~`"cHJ5c,1!è2] -d -t>3l[g,@. -=cZX3X+lRa,VJ@dt f,@ %D%dI C#P3I3 cAZXeL:L0`~Z DCuE1ZY J-Ac|囙 -lAXP%&3Љ0T_oc,lfa,*7u[5|33T-! -M[0 &t j5o7#L XA&w&o"e1#>2BO [鑁ح2=3Hf",`[ =6=0vQ%CƞYrɊeaG1G~q-6ˏ}G6WXb#oׄp }Ii( l(lwd) }wۊ]-|Y-HW/hpkB.8RT7v9Z7o|׿m޼+_rC~=p 5vQQQ'<-i~;H&a,MuEomuζŷ-e簫_xvy;ƸY?.o^m~sv= -P ,{D4]K|Hi?}Z㽋edcte#׍N\c{eU=ϺJwArA{dpg< -@G륽:bd=-fi^ɅQX鶆ۄkMbE`>ym\;MZt{mvJmۄ OǣŞC~>li~ނ!C*izi=}>+XFɖî{-}oq*oвj{֞B#8 )n㫌Cv۲55:9Ѹ5~7/k!Ko!LQ^?INqz01N٠ugg^eG,Mqno4u2nt~JxЭK"2]C{1!6扈޴a2~߄;z#F1Sy*G~2]]x"hzY#Y FJ4&<2F{?m1qBbwUKC\d˔"s< -KZPgmT;I[C|Uu<.s>/B7cNeyݼ↰>>Pnp姓xRΒ_=v8 v>OtXqt.=G/і.kOG3 -TX}tyQ!Z:demJe}X;.t)u:+c:+nkx#Z՝;5G,Y,W͚e}۹^۰iHCͯ׬5wV'!cll(%%0le9k>}Vx"J֞0T%SnyT) -/>xTGF~ 47ڂ~ -ӣ!}; -:: +x[$S̳a咪t1\xBփ& 󐯟zZ$g3*T-~R^/<󮔚]ow{SaWw/]5xy]1ty﮸V~j |SS\rHT*JT1CLD-T0#f 0jL3,BTfe +3BT0ט A`i :] ' ޥRC ρT]gRJ0X3]-ћ Ӓ.M*T[BtN%[]`$LWZ̨B'%G]bQERV&)e %IT[J`:-ӁQs)dU3]-!d:؂g HN XAq1 cE+Tg9+@Yq@C< +l ʥ:آ 4T`,P-@A[0(pkR=c&>1( 3@A\- ȅ+Usd,P@=3(1vJb,PpW c` tt2^2cXFB)X`n(b-TwC- QcBb,8Gh4!e,~]P4Ƃ포iRcAw}Q]u>cɺ(;Re,.6*e,.Y x50Dp+vjw}X] <o \ꪓZ +cAwX]II.;8g, e,H.X] CCuEK`,@\-YV]awEre,Hn6 RnP `C R1WsN +t.9#cA"EuŲ1 vUka,h9 \iz[.4?0؂H$s1䘐aT.W2pMu: r63 rw-\b,yc,`0`+r% 2g:[d3 ҅{Ƃ` AƂ +$ءKbΤ噅Xr-Td,2A RRl& 0?-َH~l"͡:آ J -, XP c,\  qD /71`]|0THȺZ ` J-|tb[B5ƂR7 c 䛈@ifn ӁLc +7ٲ^ޘqeig'F@^Vr$zh3YDO Bxp;}Z!c,dŲ0D#=nc}ooO#@k+,P1ѷkBp[>n4iCfwyr~wۊ]-|Y-HWOhpkB.8RT68as?"/n_?|?m^_rC~=p 5vQQQ'<5iq;H&a,MuEomuoζ׋-e簫_xvy;ƸY?.~{;XhُK|Hi?}Z㽋edcte#׍N\c{eU=ϺJw]9ɂVy7K{u:&9!Tq "8:zZ&_:'FIb nm 7Ym 䵁OsVoo7yhuu|)}^o&?{6ri{=y vD (6cmi{c'[Zs{ ~ym۪B.FO[{ +aD$| 22+lˮZGݴcEHB/5uL2Gq{q'9QJ8ug֝ {Et7=ecס!/!uCz/}v~ܛ꣋t1i5DŽؘ'"nDBzӆeZ~H6^wLQKkitu-clCۣegqj3) nALj +V.q/S*,.k9LCEFRbf'mmyVy16 y:^ߠ;j;I![v> -endobj -689 0 obj -<< -/Filter /FlateDecode -/Length 4380 ->> -stream -x\Y$~_QD^ ޅZ%E$ut%V+#x/LwBΔRsɚ-k-6-~s<;KDWSOL}N]ϧ?mw]<fQ0lª`YV&gJ`j,3y:2ĠZƂ}QXb.YbHcA WcVXBUy\4 JO;JUe\/24^5)X4AXxDGd5dPK%`Ud%!v+UTd:W --yFKV9g"l3<(lR -CdcUy%5^,!Vϧ;4^,gRy!OANa\0lz@`PPj(PYÁ`xi@,d4$Nʃ,C4а )hXkѰ nVaAޒuIÂV % S`nvjX8Y 1y `7PIn g5, n X  pkX]5äalRŒ.@e34, ஏX湁>Zaw=a  w!Q V{|аDÂuO9@+JMD+>WиrneRD.Uа wE`GD |D.↨a8ga*[KѰ wK^xac DeCrEaA½W p4,H]K{Td kX<[L#X5)4p:Z nS -B4,HՂO%aA D@ʃ,I֦Z4,5, dаѷ@dAa̔JaA 7%U^e r&W4,@.e -xᒆ Md YaAu' p.9,`o"Sm ͬaA%<Ȃ*|d4,)qY4,@|Z(of\܍Ȥ񀻈L@V-7fg:pYԊFVd`VYX/Hjb",IZ6_ct$KT 3KEV Bt?r,\i/|/ZmD>i춯O'(!$ D;rL״'E#^N(btdutZ&A~>!Y@F#8$1q'yYPTS;~/?a?16*n"܅9l=x+s[\%ZVcyM֦jJfbY7, p[2gϽ-> I:n,c:nS1!&TzOiZ˘N %Մu.zN5~p%#u|\'@^=dRoR XX(bk>,r 7;x/ 9@(Zִξ<׬5}ng\Zy|Ri -^CRe}q7fW^=G!#aެ y -9P1qQ }ϛﺜQ }ϛZ1EdDR 7Xo+Ҿ{2r?|_oO+k-.?YK~ ~Ar9Ɏ6]_Zfc\fd>svyG_ۡ{am1COK7ƍdr7mcUL?%oZjҮ}byYThhٿuE"BF2U}7kI;44 cr_N{l;I/*A,#˛c^gbY[^aI_C.iݲ2ۮXSfelmotMX]n yt'?= ں^2Lb}/܋~)_?^_}팰O;be+s{亇ZY1BM#d~~~0C 67w|!ih&}Ka.x5zښhkj%@w kaq-$oG\!2ӇIl k2]K ;f"hmW7A>?&)ݲ{>$x'>xon#$Nn=>׏[_t 3հ>邋} Skk;-ˋW+6ݱ|iAnX^Gn o~ˎqarB뉯]^n4}q+Y[uu= )6?npݺu+cw;W;5[]ݜ"܆wNW~:ܱұN/d2,V'oO-VV'ܵo[c}4+K&ۅa%Nr~6">Nޣ;v1+y+,snLE+ u6 shᑊ]ײ=w򭋜3ec׵'"浀Δ_WK?saM+Z>iDl+yYQ4GM;#EcE^/OY',,B[=<ݯz$5nDv:p Omii|1Ӓ [ ߢxz%SMNj?xkK,Bx -͋i^OORtg,n'Uª`׵-> IU>iH -o< -KM+x{lɊb90E&ۭ!muBqJ=x$(}M}7]= dӞc6]7[nՇ!l f~Yt,YWGau+lcdqL+\BB##F#buee{-d(u#«:i;'8C=cr}\S;_nyZ_xg8mxbmm𧓫dX^Ne?'~9)d"$3qhXzA.]K8)~cp\GjqQhM/+DLHT׮PuPco96>)$M@ 9b tCѮv -rRۭűSy*k횟LSe(^5ogĆqKk[rBOr{4:N$1 ;eR>f *2II՜ o$iipg[.Y/WҞAwP=.- dhn0 yQvL08Ɲ4Yqqw96ړKdnN&S0$O}n~Z:3y4{9ܜsy+ǯNQ;|=ŏ{;lݐ'mNF= ؟dWfحaq^n'n \ISzf eؽ{ &u_L^.,7.-#.䠸)FL6H9P=Or+$/DahY9tU&֍<Я>^?zWS?L>ϒ:x:5˴>'JW?SCc ^A<3ͅQA- I6vG14iceJkj)bR&5 %F+ЖoDKa@Qs%BKl:87m,AS4#S;CWkΎ ֪J+Vpr𡽰ܖ!TDi}nJ\I΄0͎_= FCݪU2( s'\{p+ и̜*ߐMFǸ)t- -endstream -endobj -690 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 689 0 R -/Resources 4 0 R -/Annots [ 691 0 R 692 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -691 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 559.294475 101.433071 540.544475 ] -/BS << -/W 0 ->> -/Dest (cb139-1) ->> -endobj 692 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 203.747453 101.433071 184.997453 ] -/BS << -/W 0 ->> -/Dest (cb142-1) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 691 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 693 0 obj << /Filter /FlateDecode -/Length 2896 +/Length 4368 >> stream -x͚K\ )f -)R/"@@[5EM.tѯ?9z^?/3"H_UB$¿Ʃ_UҕIKHrMw&JKꏗﾺ܆1#/?J%Z -%Gՠ"GR(%2WTPpfbٰ-9f5@~엟._{?_m7e lAlX23 MPxQw=ԣ Y~ܴ{nߟ{ms_mo_q0•g||5'->fn?6:%{'f̣Pcm\o7^u򌏎猋 =v>|r} t[}d;/OU^,J#NǮo>K~-1݉mN{Kx;7}X}WGeK2-pgGlN)}}:;ǹɼe;梤! W{kKu]~G'zAG!]8"`κ{8c\x9M<C -ӜEFef‡Y̗<0b*AN#tUG:( ئe'3!Aԛ.XKa #(S])*e-+=џxs&hU:̤xTb>Ǚ#W+;gh%ޓ̭1C =V]u6;*uPӠlXMh֧e{R1ŔtZWeLbZW%յ~7%PZݹ̧YsĒՑ)]v?uy lj~>gmnnZo :}A\$Z9!j(ZOn]H+YGrh߄G(󊥫iY#>m>5ֽnmיۅ(KbAo_bjh>$O< +x\Y$G~_HN$+ B<^EZxEVefTU1㱽qowE_8SșRjNt|<}:Y梱Wgg)j* !\t?KONqgojMeK6* +uAahr1) XƂ1#+C %j,AU F‘U!ώ4p5f,pZA,Q +E3T_U^eB0)NUREd:!KtDVA +%kYB +VA_rxxh*Y`]EAx5X ʫْˑm4`5s&6É&d^dű D#•fK}?=9}I?ȇ0 =D\ tGVhI[Ӗ4!\[ "V"O'$ HwG9$9$ϕ< \jjG6cjָ+]؞6Ѓ2׹e-]ۡn5vZdm'F\tIn+ur%sӁ1Iޚ#2s6 YaB䘦$QPRMhPTS;~/oG9dv>!z;|o%/qrB[~;|o=y!v{NȉJEyk\ִξ<׬%}ng\Zy|Ri +^CRe}vWW^=G!cpʼY^rZ[ى뼏Z}^}式Z}^]9ۜH?wmὒ!*J(.wO?ů? ןY h!u4Zx@a˿z;nb^ +sili՗/pG2;B}m)+eW~벮2K6n\ v@q_mr)ef^IH+fl{j/li&a >~Xw i<8N +-Iuik8ߒ#krع}}wIK؋%15dYֵEXb02oqv*Grݺye؏2w[}=+F.kzː3ps/z&?SK_~gQleuri QLe'[ #\dBmΘtxԀJy_]|/֋<wmMXIG}E5҅8-oaqW+p_Z1'l k2]L ;f"i=2p{a|_J%/>oａ}}w7#`7Z[\NϏe}òEV . L턷,/"^(dBtYz:ŒĦi?z}]v4X +sJ7 'v9>h64dWñfoA{XĺEWw[۹rܩw wsXr:9_]usJ:Aʸʳ[=K|!{ȿ9e~{/&aGio吝upny=VFv)ׅQٔQKDc*n'|2qQ5y/{2ϱ͋2 4/ʨyQFnXF-?`u;bVE&X_Q$>^.%4U]€mckb9DEЯ?!muLqJ YoqLBp ^qHX#zF~ɝ]9dvV} + l9%Q8nwm !.IwE#YH]~d(zVf$߯{tfcm y6J]ڏ]{@M8Op;'ž1@bM)֝lϽ4Z³t~2T׮PuPco96>)$@ 9b tCѮv +rRۭűSy*k횟LSe(^]D]2,W}$Kgcmv)8~4ql'VMOw2tUhv?]"*#Oh?d^IlVIꐦGyr9r*tG롱 ULs1H ؒݰAfX) &9S~ڐqhd scIN;$9w!W|'^c=MI&d8(LѧFu?YL?N=RpP5exD_,~ہ~`,=?> endobj 695 0 obj << -/Filter /FlateDecode -/Length 4779 +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 563.554475 101.433071 544.804475 ] +/BS << +/W 0 +>> +/Dest (cb139-1) >> -stream -x][$9~_QHk| $HX О3 -3 ԃ4p™dfTVV ؞VOgFG|v9YRΗO'WJ,n -{F6&ϟࢊ'?~:lUGfS1Ũ`i*F -Fa9K,#Yڲ"ĠĂdmX b8mYbhHbA }XFCcyD9+WJRYEL9"o$^V!$AxxC%d! Ed):!vK֕DdA9 N1myV{sZ<❶ANxSղw;H"`%$)% l% lr% lʊbt %pڀgNCOABg sEdq$,pAKN%XpK:  8.8 K$,p\RsSЅG P`%,p]G)HXΡȃ,0` ʙ$, 3:JX@]`A؊)i k& k#Bȋ ->$, k+aw- a E w!^N V{𬓰)D5Oi2) U׎L籍MJDXcC>h`|F@˘\Dy%r1< ,Wy~0[N֦&a~Dho{J+}َ7kTգ =t M]z"F-]n"N}o'09Ԛa6:o1za&M"n.W ˿EYs\V#=F|htmMZM{Cfkf!:*V<}٠ڇ- 2ƹnuUi2iȄ4dX$k5٨Ʀ~Xeܶ٦CYYg59tOG-]}uZ= b)>[w%q=iLJǒ79X3EyQ9gA Wl#lI:52T{Tn$=gݔ)?iȔ.=1&j9(0Ӫ?I͉ -Ovh]V>& --[1K|/Q[4s&XKCߟuXkkmIoKna4tqΣD# M̀hU7$o_7]3^+[6Zblޮ䦥Ɨ#c/~wŊ"ċGe.3䰫qmY3S-dBИⒶbCxtsY{>~)FN)[j>vo1!߰ԃuR}/ GF.vۤufQԎ+e|0疕pV#nin\Yzz{ݰd[-Z=a v̥#^"3S/\Epxx/N9ԈLug@T|]\a6: vc7SN.oؖ+7n#'SckV7*#O0L_z'웍TH uHҀ216դPAn[P x R :K\2 0nT%]me5ڞaP$Tj~SEQ%?e'ĤFvj2YWdO!ߓixuJ| ӡ9 ],36ch~\-kqH)@ -0y)ߗU,ˆPTs&VaYltj -endstream endobj 696 0 obj << -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 695 0 R -/Resources 4 0 R -/Annots [ 697 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 212.807453 101.433071 194.057453 ] +/BS << +/W 0 +>> +/Dest (cb142-1) >> endobj 697 0 obj << +/Filter /FlateDecode +/Length 2895 +>> +stream +x͚Id )l`dR6 !FYÃAø琯?{Z^{CQS%R DDrׇ7 +%m5NM-^%]-t}c)K>^Mqx˿mCk9rTBPrT *bqT)Rbʎ*s#`F*^U`<0Cܫ̈S n8*&R8IϞ.rȵ +t\ ('t-St +[R#t $V%O[TjtHru%"ixWuu2kRAG{]R!O|S\v)GaK\lIB lQy:p"I٭vK%Ƣ`= [dA1 E Z= +ڂ"bKAs+`K@(v-cD؂ + D`KTX [<pcJ= 3cRz, <+`t݋u%@]њ=+@]tut U<(+LcFcV5Jwc%Xn,8\] ؃@ݘ DcQcXG  $?-EXBDX p9{ +\[X]X>W̸o1ˁsn J<$p 5z,H. NjOrl C` p&kZ  ,E8UՕGbq ġ 2y,.%%E`q tضΞF(% +{:p4ܵccA.&c ǂ\5Rǂ:|.ǂB$ -uhҪǂa豠D؂c"ѷ(lA$ z,()#ìzC-qXPT `ǂ` EFD枎a ltcXP#lA4豠Ɗ,3%1՞N걠j*z,6A R:Lx,X< A4I걠hfXP+l=7-, D| `a`:"+ͨ /-߬ Mxξm-, –Mٷ`Mez,h9[Y= @޽oM dt."䛈lܞTjguo M8[+{qZ΀_ˑK̲f*L zEgf- BݏcVwT~+_syvSV[_aĆN/.h>P4LgNvoѥx> 4ܸ"y5|F ڌ:Ң T//pÊtYR7DE*1]_|?}ݟ +'z x^wt0Í^ri1z'sχuN=YJ^M7{hQ=uۖ^_~s˳ 8FuX򌏽_OZjp)w}_cznS*|Rn< >VO/y㵽]/xθذxcw÷ʹ-G;*!OGżO:{$[%r=D<<Խos(?LNtns[۹ݟ~{@X/ w}3yjˈ}o!:u ݾw_n0"X>Pdw\ޗ3mSnk.1ޭ/w1yym}~S?X_{XlwtسgH%o)"oׄԜ}2CZZU/owܾ}};j_ȒZ~[o~satyy612t+~ؗgSH/^qmMDcGxmtn!14>f od>2؞b9Jy P׺Y1ӽ8jjL]a:u,˲O .VnԾ]EZeՆ4cAt#z8ԻV,/fGvGQz;zKcʨUgg~2]]xG!-egqkL~M>\8ŏTiRwU(KC\i˔ڧ +[,wT!5lXK,AloyVyQoXˬL2|v/7cNe Rg1bCXUH 7iI҇M;ƺWM۸:sbV, B^ m߇?+k= +endstream +endobj +698 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 697 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +699 0 obj +<< +/Filter /FlateDecode +/Length 4817 +>> +stream +x][$m~_NY!F9<ٱX!?U%Uٵ;>"u(VUٳeS%E:_>̔ZbuQٿo +gk(M3|R . m.eO:=l8O)d*`VSJ.D! FHhJJ bsYae)Yg%1l IaY93FAC³aPzxN1WT^&b"+S1dG%c5^,Y"dY\N^%⠝2dueYL4V?T^xc[ sTdk"d1)j4 p)MTi ಟ(SP2QJ^WD$ 97%PԐ[B\Y|! ,(aőװm ֢aܒ)V%c 1s$ < T4,\԰tI!: <`Sx'k4, Xmp[4, .iXY`Qr6peCp%,*/MAaw]qpבP&Q. $djX<5,@cCXaAڂOids͘>W&qoX4,],T^Â|f VTaAZZw+FÂE4,9LX&k`*LaAX'$*/M0$ax2C5,],EÂ5{ "pY|v n48 x]cRѰ wy԰ &&a; b5,ŀO AÂd@,Y(Kְ 9Ӱ 9ȂADS\ "E dS.DA/)'٤aAJ4a) 2^ᒆ70[OwzM3 i)}p.Uag +~/k]BqswQ>sǹ[ 4R8sO86hRL v枹li7w,QrJی{6.wꇦEvkcKc|:ZV[Fj۞˚pDuMeD Cb4I3Uceq?Cn>4퐵Yg};7|@hߎY5Yب*wfel|P,V+m7n(-WXAZp(ꤥEꖶlKo뙶h2~M+:*Q5ѣZ{q5)χGeb;2Vn}n1n} +^V(d^Zt{m ӅD6þ~UU[gl]r×PC߃DBC4|eI.^^o+-m$`ΈeI2!tn, o:{ |I=j^W"> ]Ӫ+ ;`A&Pd@ r'X|u\6s6YBn"-踹mvWCZ?%qui_oE4u(sR!IY[>̢wS8X|")>qe˼b1qW|࿕3~ڷ[gekfumXl]nZث]"WEYѱ:bECl7yѬ@5}µ̆g|iGe%Xr8]i4[Ld)i; #W_q*ɎOT޶cu*ml&€ya=K]#,ZVY!uSo#->fŦ "P#7-`Gt'~Jfiƃk+^MV]gdk~w3\bů9&>$~z?A\v\5]aIv[֌7u}[Y/7n՛LwϥFrCcqKܸo7 yV7u ir٥> r_pq +rfɶiU|f}-ȗ^jySᇇc׈:O 53O7]Ձ2ѸG"ln )dg>$>tVIys +5ݓyf ߌ'\. +pՉAeG]FÞhDwcI]uqRuVL+뒘[ -E[SMtBN d";5MO5rSHZni-JTUKe] +"U?GodCϵn܎x9!E>Rf_: 0$zn'g3ePSnk6?"t*#O`?y\N7;y$IuHӀ4 +uٔJ}aW3]c+P# 2cM:!c$&MeEr΢z;vHr3n!]ޮFԅd6:dgj7:!@aTr֎Nq8^N:en-sBFY([׉Ҟ4tp[WdA2#l(5u94쭤j;WС nzpxh2`ϗ c7p!> +endobj +701 0 obj +<< /Type /Annot /Subtype /Link -/Rect [ 101.433071 508.294475 101.433071 489.544475 ] +/Rect [ 101.433071 512.554475 101.433071 493.804475 ] /BS << /W 0 >> /Dest (cb145-1) >> endobj -698 0 obj -<< -/Filter /FlateDecode -/Length 4753 ->> -stream -x][8~_H|> !`%@ GBx{fvy9I 9ʗsY "!wY`3_N;_N_):?I\%` l[1[2H\`H޷<-> OQ0yЪΛ!е qA4`*`-5D z @Cv$.i $؂"q!xN8ӅNk -%.&bDSK:Ry%.*J\a&RЄ蟼v`&9XGhr3J\#l1H\lf )O₤d @)%qAMC`\f Y&x¸Mf lqpQDlӔq Nz$O_>a=ߧ矍 In[GGah! |$O6"f-NAl$Ɋk 21_b1LƝ?|w/?W@W_Fq:vt)ȞikYӻmr[mO\stS9SAc'>co_~aAFQČ,Xހ#\k錙|رOSnw\i5hheAdȖru=w|^ m/)C s4as u4*"k#!FD.]LI |&+Ky=m2 -mGBs8Drru7TͽHly;UQw7nt~Fs4Tцw}[Gzg w. -Yi79oaNEsO|TI]ڍ1+Έ[Z\|C?b'B':5tw+2WOo޿ޙp݈ |%ëЕD-= УmߗW>{tskZAes8o7.o̕Pb!R~; ~WggY;ʝex͟ ڿjvصŕ@ܸBB -Bs8/u+J^Ok_y -+} 3Pq5QRxeg5GmDQG_ݓkCCi {RV*9n|: -=ݙpx {nա=+ >Xfg62.-f)M~B_cB͈7늧,ގ7l7P{<ߙpHވeFax|YLzZUnU#m{.sY)>iБNqضI6Ģlq=-bxI)=W2ƟN\>itH(mf7vent5p -gN믟x,'q W|7p\E}^Az/N8h7={rl-sޟ(*KtVWr~_SM;Y_ިm/;?vw'h຋є&~9]TI f8 CU"]VԧnPa[W+W-nC$.׊!rzWy'8WS/6C -$2nULBŪkbCw.M盰ΛN/iM`yKx9ZK_DiUZר*̨TB$PhBgV=뵼U K% tSiTb˚J7Sm /6!oƈp.J_pcQMrrAHW(WDž[Q54i~zYdy*\f4UH}Y$*7:$Ҳ!TQ 3ԵfRdLR1/T%XWUq>+P#P] -嗙PKe^3Znʝ/\j)^0_qb^K%MlTZeL )4qїQ\Fke6Ȥriu&[x^>i':l*vǍla*|&;ǝCxaÄ7-+h1eWKJ]TW-ֆLl*te kȼoڄ}=Pp/lϬHmJ ˈ^(NYY633WR>O+l07"ڦ6l -.'`Ҽ4G0~Ledi*}zaYZ OOc B,ƞNN͵ (ƖmJxTdJDQ2UdPlS,GB)ڈ_zK:@9S-e%  \z -endstream -endobj -699 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 698 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -700 0 obj -<< -/Filter /FlateDecode -/Length 4831 ->> -stream -x]ێ$q}gK~}`^@V ?tlKz &oɌ -+`+#xd2Y*U"~t"8?"ǿJ J>$0At .⯗:EJ^+wFt*A%aTΉ+[LS [U6Eǩ`:23 lU f,*JK`hFt>&X]N>XK{"%8-NY+9l&NaF:آc0.I.+:"T.R%d q N)M0$-^`3Rs:[,r:3!FfjFl:XV[|-2x0:a h6r,c6рNNXF*H(b1sYl1r\`4lA - -ЭIq\`V*qLq- (% 8׀;9.0 ]Lq5klJr\`Ơ&-0`GaT4XQ2p\`FxU`E%X.Aqj["7xW;9.]m@f]P:m8.@cB#-wUBc4J<"P#[P' xp\q8^ j xWDjNU:I xyp - oBI@%!S8.hIs\(,d $qXHx.{w3ޕi-&j @ii$Bj0Js:!q\69.:r\`qV<>I:/p8.buqkL [ [2p\@$]]X؂L0Z XaT9"5ЩqAV + t[0U8.@(Q#3t - .tJq\5lA6qAL/9.@ZC鬤uf Z/(U+M0%- Zl; bV[Ĩi9.h9.6i8.H I/(M4$ԖKZoF Xobd<7$M$7N,{ZoF f` vx%0"3Md^x]@~+#8#c A2^DH/Me*J|n8a}<3cL}[sbfز??\~{_//;eBK[W:ٷ؂F7nCf)af#uae+L%cQ+!OcpOnb(m}s&>(>Fc}8[\mM>b卼Scźhg+}Ѧ͔DN ZX0=FRL~c4XbУI"(hkiW2-V,r09Bp/7?"~~ 5*. KR rU>ܯ*nԗ+?zշܦj|ջu~>:v*[вd_{_?WI ;Vocyʗk2CXqsb^6A#N_"ftVVڨzI{?|)S%X)K!~Oy4cOٵL!XNÞp;O/n;kv<$XjZM{>W|h&h kX{xFcg:Q{F_àuSy7;x\CqnZEsx3wۚX^kDPChzX8ku+WH%گm=\<[fA=BGDhǹGzxM3o񆎷W#[GvN~m[F_a$6PV=Qڗܭ@fm2/%)~jvGqjs{mnǀf~Ҭm֗l.uܫ]se26dӄ?76(u8n~3ϚuhKuwhO=;b·9{&L,:G_Y;=c6fB;ܒ_ԘGD -v;~#MVz.mIy\Er{޳ܫH>jXN=CߍC>Fvĝ;21C_ChOxhZiE0QM "cѕM> hl3Mڣ!(dO2Aߜ蛄Sy$wH.HS iwX:Dj\p|n|9[n%Q^/U<-ʧgSF^᧮}r`CK^*]R3*x4l -j -fTZR1Nlcmϋz0o ۺ-J;r=xY.v{4No러ps;^<#ޏy*;1A{p jw!NxZz1A|[yG6W#. 3{Yw) #('<Jq~6~=c:6i\ʽmؾo窦wSIzW @/_cr{e[~''냌|2$\zF>yCr"(:u;O$#D/َ;? 3~=2س:R=lXP,VjBҋ -4VU7֖U`AqB5NOdQlj5z͝/z[:fVLw/*bz%}\f -hޠ{Żbe t[bm=^aچwa3}:5apvAfRzvmMfRZ96?1ۅ~#klk:E+l+j9FtJky*RWMu)&gdy44ZLep76SuBo&Kl'L*1 U&%m &^(u,7ʆ^v.EgPB'mۈÐ yDRIE受q=zecCO{M}ǵllc$_ OWTa6PہX^U48׶WkIT5(t} n #i["{46^j.e:CuhWTth*blC[29v҆췣+ 5\ i]=̎MWYR`3^ [5vV0F{z}ߋɾ6joQnxɗ~}b!#23-Svu1bt^pcV@2YePmZ|Ǒr.8nJD7zoR5lɴȍpd/rXIm/il۷]]u =3۔|g,u]TwBTF*mX{pߒlF\xd#RJƞaA/Mx"W M_WK iNnvoK[yC]Z*/G3F.A*Kϛ+ -endstream -endobj -701 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 700 0 R -/Resources 4 0 R -/Annots [ 702 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj 702 0 obj << +/Filter /FlateDecode +/Length 4755 +>> +stream +x]ێ}I@Y ;1q;EDZDwۭ*^Jat>+}_z1oϗoOߝ¿1`TOpglN>Y@aə/'/?y}6CJhwsVYB A9ARsCyASLIR KU6E'`5& +3MKU&h+`N.*`6J:%#<K:I.@tDV;-wQYҒUXAyB-&tNt]Q啖t.AbKQnpHI:lÈB' l%Q[)#XI:0ZMݤHK:[ VtDAC%LMJ$`" 6(i!D&$ 3Z"RY/1ib1rEld%. [@"b,I\@`[ H\@[Vi/qpa@R@AF풍^J %BNQ[` HX.i$.] ##qzu`bTXJ\`&` +ua$ ,x84swSF 5x Do +q;[@`ΐ(l0pK$.p]0 cl5蘼#OԥA0nʃ>I\H}F fT#qjL-$%qop qA+@WԥA%.p]В"Dԅ@?T$.]$.]e:BH\: [aLYSH:aIU*$ Ʉaa5GKF+ɮq >=l? aLm_av5N<:ZЎGd#BjFjtFb3acTOm@&B|c; +#̶i(NJegNV\ca ?|{o?Lc|INƎ~)z~k_hۺ{:€) MtiݔץlG]?YV$ty4[?s H>Oа}Y^rXހ J'ҕ.dewptu5ժ/P=\@.rᗣLy9jy@pn!p YZh'*t{i׺CuS Dx 92x#ZLar7HsxE  fXngá97MO8l-"^)n ҳ7qܚ"w=6Fk/tI{Wz d~1?osX;{iD]:wun+l.~Ts8Tf\ZU~gwOe흍w9Z͆wZ¼܊$WP;/38op_áO&|p:42Hft}n0II~Ac?׵sj/}f:|VJ/jl!x_!x#`xt}мؗp-/ڪ+,>Fnqnƕd뱤yL[:2-?k +Ot+OGz~Eٍy/cWwbV}<:;|d&.RAx9;QGz܏}^g +XDr/dpetgáOHS(0D=͹Agע} z3_vm)J"e6Zw1!+;A7d:u{gmUoPտd 鞄sQ˫k +b=s8nl^ +y:<A_{. 6\ @C4B9B7{.<-}{Q*k|e?Z0ҳhrHܙhHqw@m噦(zs(Ś+ + ocXw9BXkw+J^wk[&VP@lugávzk1Fٙph現"W;860?!ڝyڰ_}/7*%nyY\XAНyix\w=鵷4ԲXcAʸgŧ4= 5#W+r1T@t9t?빳?}g!x_,tAˊ*1-V-{XRVǥυaYJDz錄heȯrz顝y ++ֹQu?effr4܍~^" y 3[QHi>]{3 +?Ot`gw#6+w7=qvzc}y%㊲[㑯 Ҕy"Yֵ3и3ڿj0[\&vq?Xv]H}ݙpH~ou{ жў+m2D^ݙh(NWZt]wWlg[ υRvzLo3I6#_*5U`cOiw97}wJ`qy zy&oɸ|4,ގ7l7P;EQեذs܎jڡWMM{=diQM9hSM +bkSOU˲$ 4 OInPT 'W~W&w%[ƪ}^ Bz)g=qWS/6C +mEx, \``yif`>JU¥IJ,C|PokZGiCvv1ʤe8^-Yet*Zb(6)[iJM oi{6iseƫUq8vvddRRR-l{fa!yes#c皧:H ѱmlj@);{p͛dYh> +endobj +704 0 obj +<< +/Filter /FlateDecode +/Length 4886 +>> +stream +x][q~_Vx?8"N`aώ`6:/Jj9vc33*^ǯW4Stx颦~jEar:?)$g_p'ZW3v׿*S!('TJ[Aq^Py=)I*ڪ̠dLTfX +nU fIR \TZmu0DY#贛<:K:'I.@tN>vZҥ{#Ғ-dctXo-&+l1$"l-+-钝\D.Ab[QnrZ%鴞iEfAg`W.:2O8bfmՒc:؂xآ(3hb^80Q2$vHQbD!XLr$JCgDVG^ba a:bI\` lA -lK@tK*i ,X.TX0$.\@)I\`)qb ,X:o$.]KK\`"-`h%. *H\@]L##qFudbTxDExQ&A+qwC$ 5N kx h +qr8[@Cg(l2K$.p]9 tL^'Ҥz\I{$.p]8*+q> H\SK:6II\äH\6i芺4 Z2 O*ID]$-qxRC%.]$q*ga-6 @i+i2` +IU#,J$q۔(q  |)%.IAO N₠ p,Q[(dS b ؂ADS҈l\Dɦ$.c=^tL1E]N B XK\1%.O.I\3$qAHSE)DN ҅Nk -%.&bXK%)^gF "CE 0MS:Ëm'q?Xlb#`u$qAQaQF`כA₤` "> ơSJ₤#֛$.f Y&x¼Mz3H\8( hJ¼'a vtD$y%.@&"zqK z3]LK\ 7Jk{u񙬌⎁:Vq@{ᭂg@F7 `&VыpPj%n(/1p¼oQy!gL辮9Z2l˟.|/o;eG#@ȩ In[(Me%jCjfifV"7VBW.r5W ɥXև59 &HA˶v}:Ig3}ѶhA-| + xDil2AAX(Z%bżO_/;i8Gx~O~v)E?;.-k\;y|.Յ*KnCy]i+z(K\WM9bkM? ZfڧkPT%a ` 8>kp-9@X4}]$j%Ó6Ҵ JϞlŊفLO/j;kvl]"f|.!9J78#.lQd; 0Fg}5MOh.o*7 7#O\lfc68%ܾgX\MFڹd4jr6B]8půqvbEw6qm\wel붍Xn֟ߋ]]k5NKd/\go\۠a9 43~/qx1K=| D`?:t*8C>1p wʕg 7)WۍRnO*c!C^w7 FnƦ K*%{)槨)9Dz{,? ;-jMˣKz%h&E,@C$},e[븎1D9-/fiW 2N3MDPiArƝ;y2ϓ,EwueIsލB`f:=%얇e lʨ13rrtflutx 5֋uˋ.qFggT-a !Ψ4y&PBM4bCG)p`ѧnl h6DO 2˦mt|f_R2=;( +M'< Ih8P}!4euLr.;/m6FӗyZdVm]K9jsTvuH]8*p,ĚydC,!JNVb[,x0=|n,6|ڄ|cn75F}Y[ԲבH]kڗ^v\PoaʺxkGNy:ǠFF[ae]??K, fz6jufmp ip?[wFiSU +»I@ܚݾꪇWpޢH[' /w#lyԨG!PQѵZ7{|l9o1KNVxcU\|t;vW/:{VG܆Ͱt:X8i_|p43 ьʒ.äsNu?T7H(~4P4c)ǘ<緽,\4Oܽ#fQղ80 SSZ7c;,7JJ6~ # Bz+֫I/bƄ8WSXO +lUm {4avojzu+OsJxZ;JE)Uzר*QJ]IY8 E~Jфnm0 QMJ:At\PSŖ5o4X;^ݺ#ʖk1cb.Ll Bj׸B^hr8& tfB*\2*}Usם}ez@Shi!T\HϤ[S[I.!*yźJT셪U(NWS2;Znʝ8jo-|޲cQЏ&6zVY'l{Z)e&qo?_3> ",}-~B./Q-L֕d5񤘿ɦ鄆:ob[ZWP1_Sˮ2^ZvbSkzoC/@kǦ9Җv~mr +}sp6|'m.Z2]F\ⲫ05Vf2 Jj׳庺.Ktl_tVtI/t_iZ#㾘 `i*}掠a,'Kmsl>&^&oZ枭AN-EN[%+"[UZE TC/JGB)}O~Tj'~T&-[<^l \ZZKFAUJ--mݴxk jmR~>2w<îIkl@Km> +endobj +706 0 obj +<< /Type /Annot /Subtype /Link -/Rect [ 101.433071 377.823057 101.433071 359.073057 ] +/Rect [ 101.433071 401.373057 101.433071 382.623057 ] /BS << /W 0 >> /Dest (cb148-1) >> endobj -703 0 obj -<< -/Filter /FlateDecode -/Length 4661 ->> -stream -x][8~_Hk|)$HX ‘ fzwY>%N.gԧ*۩؟?+N[%>S/!D|I -o%M)'K|=+I^X]oxޝ_O;m?yYVϯ{iUJ*èkS#֓ r*AZF`!Za8PzF$PZJVC$ьNYPi%\::#'e9g#bT$-dtg$-:x gUH t]œ+8n69.p> t -xHD.J:'pn9. bu_.Mme||yʷYS_|^5A,z8-Xo@SHKKmr;в|l&X9%5sW1i~S)&J B#}ݵeFTlLZ8Zɓ[+f5!/'tH iv8r~6lH߄BQj{P .stqcyTɛ[σ-oWtw7v>8r[^/z"TʪGV&_z*9X0>\>/Kd,?7FE];4r0P]uqU| {_]>;SN6"q0ѐnav`}'>\P=XS:s`yTL)15j>y*Z?9el'yޝ%HS.v7ߎ:VtD;| _Vg_黏v+B:qt%z^/s9zNl=P3 z^]ysOCηX^6@q0_oGW(~͌k=ӤSkdz= _Ls4$ ߛ嶍w3a֛ƇI@16`áu1>G}Y>}Vfoqllߔs4Ɲ~χg)au%m|[?>O,6@륳cgOs8BGJk, rw> -endobj -705 0 obj -<< -/Filter /FlateDecode -/Length 4935 ->> -stream -x][F~_1H1}I P`%=9A)競vys j㪾ӣ -_$=Ř5_no7V&=lBr&./?u}5SJhw׷";r+XM!n1%1\ C[VX+B KA-+A 4I, K+ȡR"("kvǢ{gc2It0NK4y]xY\RZ94xl Cy`%^,^,( JKd'"Kg\VI<'۴"; -JAK"8ijG' 1 -j 1Dd%0%$ 0!L I `(RP4QVD> -UőjBع"DXY@k!!+aE %xKJ{ ,b* ,FOX@.L)IX`)ab ,P:o$,]KKX`֢ȃ,0` JX@]UFFhuz `+QIX@]IX@]D^5 ynqHX@]CKXC?J'+a=xJX&D O@I%,p]>&¾*O$aQY p%,OFZwIJE$,9LoV0]&bwKFxIE  IKX0P ) SJ‚#MC`_r%,HV!D'd=A‚D!DyAS-0 &IybIX|3JX0&"z$9 bIwz p|+ df3ub@{ᭂX3P_ΑĢDfX5[S+lh s/QyCόo2a[sfv\w~rrkB|m`}kܾF ;f) RR ]VCpyO$ʣb}f}Eҵ~вmyZIϻs8B5~_y9e=Eu$VAV'h-qwa+$=d؛")Z5H1e'>VQw㯾_`/R) ]X3LmtkgB3KNq_yL[[],v9j?S'/Ժ\lbikkOWa\/[<|~kylHt`|/7j - v 5e0ʂ]:N{ 3/lȰ:ް@ݼa )3Ű(9UlYxϣ#VW+5f(+mSg#͕uVUO?z-3'W|X3sZW}R.nf]pQoqn?5k;Xϝ58^+Q~Lt.ݷs}Ί -Vx=Xb\^XFl}Mj۴Wk;|6Ky{CY<,GnGkt\q-_kZdoQBP=-o-b|}*lwC,[X5J>TLNDFu)>[%s'<%1lꐕN[KbvyLF=ʎ^UJ `luo2NΘRBupy?n=YVxak_-@#:)3k{ɕ٫g;Xd̃2e$Uvmw#1}M&c!zxtdZOтߜ{gZi,x7Ħ'<ڃOj^Y+VENG|Yz1gwgG ,n5^{S(}kݴy{M<~l?rm".yY֧Oѿ:`cweG]/Ϛ;s}"ǚ-^訖6j^zXg-8rٽHo+Oy4k-굦Bg-cM[)xOLe12VDžh^#+w׿tYA=bDߩ迳=+d8f-O^˘(7VM.TYbW|Rbud<%ǹWv{KAij1w k-mڸS?gӁLZ[ZY.ﳹ Z7ob''dK0ڙe_~٤-wǒDS.BwܧmJeoO|"]Vh# -x~+ʑOP~f-(> cϖܳ*Z֙ܶK6t/ׂy湳bsc=pK5];gXVovG46M"#Vދv~J:z[=\=E!{w\8#dh>WӲv)$ESX&E!\-v!1O8P>bo ~f)`f,O&+r1XNœ_<>ARu:q\^SӒۆ -z cήwHTIz'[#O?{jU˺!AC~>0ώ8]X}h{'{o*%q68L/7jKPPt{mT, կ^C2XQ'I VԝZ;/Qzr|4>]N*W6ŰR4k;}^#X~e+F/RizWU~b͇"lgbUSFv&U~y䶩TU{Y\^O]EQMv#KޚkK5ԺP.wo~n:Aݝ\nX [2߽Bcd+_EἳۀԷmdmUGt[kdCEǦ֥XENw/mMyx`Z;R_D*]*kTNT -'t/TGX jT El檦Bm[TVLƺ-B Q|\]u͙⢂uvqTwb#\\Z뉶jҨmf*\2I!M{׋}EV@Shm!T ОA+vKC*1HUXuJf+S'"kdWMeEnrUyݙ6ғCոyu d6X&idku&@dr٭Ƕ${ݜpQ[Qm\rǍha*Ƚ'#'$XMG4~#ںb Տ5{i+퉮aG6tʸ;۰5\4=_X> Hvp6|7m.\2]G\ⲛ05VbAԥgW幺.Kxl?t E?0~ҴG`jJ}ƘZO|ח\o.Pv{ mZꢷю['B[MZE TC/ʲ;*S4vV"^+~Ӗ-FK@7N5+ZK[h۹i=w6 [dZ7i&{ޙ UU+!:3IklY72GؕF^~d[)~&c"kU}/`cF7T>[R-nRP9_hʥ\SEA6Aoߑ J/oqiU> / -endstream -endobj -706 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 705 0 R -/Resources 4 0 R -/Annots [ 707 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj 707 0 obj << +/Filter /FlateDecode +/Length 4737 +>> +stream +x]ێ}g+~?8"Nac# C~?HR3vv0;*^JbIjɳ;C;s|<}:[cޞ0~2`@G;?_sH?eyVCNI{2z{aUJHͨW1*'b +fXoY<01XN3RQz0Cyi8̐zF%JVC1Z1:iAwN"I8փFZb+V1̺(ҹqQi ,x8. ޕӁw E`9.A +@A8.]В^xL I @ƃ@q½G xWX9.p]a:آq tX̚F:t]!1Ü+8nr8*p\Dw(C܀cqXP- XQqWE+qW!(}[)r\&B4ocUN<{3K = !K G؂q\"sN'a l B'%ADtxh%1ԜΈ *r\e&ٶ`&9hk8.Af آLMqAQ!ơ(p\uエ16jh`E` Ȭ[p`'N`\o f`M lk#Ӂw: p&"[no/@#>!81^ ʦ ʳ9M{$6i3 B)6_cf S3O', F)?|٘)?X 2Pm}Kvh9B3Z禎)As- u>‹OcG +ؾAbU^`CUb'@q0¿}Pg+h9$_b3l=xo?0zto0}Nak/5`@o2랖e/)WY樂nnemdǤ965φ2iǪ.5Y>xȹn,lщ/Bo?:|cD:ADwW%x_k0m@3TY2| 7Z,aS8A<aff6E~6sUծ-{ 6%LrW1Yh V')1#!ܮif4}%&Ĕ_".+$Yq Q.KS쿐;w9M|gr"IvW[z\K5±h˴+4P=`PA*ؾ:CN qTT0x5)˜ξ:CNh?z p̌ڦa>y~9&T/Aԇ)L(*c -Ŭ~;_JΗuHu=Lqs8UzC>۩LG% +] m˹fcYy]k+mPVMFC6PWcDRSPWpWjwC9鍐5"J7,?w}yOQ(e$KC`_!/xk%2ٟ+{"TϑԟUم]s8]C2c#̺9Fz㛇 N!ٔ2C2{WsqWx皗tvp?_sYa1s4$qڛk K+Oavr?;7PIr}ݨs8Tޖ|!̛ŧh%[7s8v{zK*;ru¾tn]{nqOws)I2׊ڸ̣ݭ>\c2$݇휡qL7z֧}b;KهtcBiͶ̇)rOt<-us8|DF1M6GcG{<&VmrdGt9G9㕹;fV۟7~UdtE^Yh;YwnWQuqF쾗w\s8TDWMqAoJGzcw*I}uq-9ݻSPvܒ.(lnS:w/nI]WpH4痣\-US ^wǕ:GCyZ4\Q/E!zG_v< ;25Wѱz:{9j@}Yp ^}'!VK|IeɓkmZ7ꖿ@:CN<{(~yW<Oft9}S]"6u@(Ɂ0Hms{s8xMyXǬ4)wCSte=5Pa.Wۿ1ᐸ7}${ܶLO0mk ޑcs8iv+$[{֦6jg6\oI- +hi:Ck_<&Oc%^}nXv\_áv'zG\xk]J؛]mI,|^ȇv9vB(<@3uLo}KCi5fD+Rzʋez +3jFTo,x'p{ޠ𻓛e+ȏD< +MLĶמOC_T2(a`Liҧ^kY_sgy=Dnĭ_&_pN?-܌% dH/rD} /LKq"34qqi5M[ruiY'M!Oe;5 zscX~/ڷsĞ KsXMۧ# ҋ] }<~I+5~*7Ҽ¤`.i'͐?-mbfjup(J[FEv!%1Ƶg\-eƈ\HY:fZ^ r7†AGb]ڠekXjAv-*V&#й*,ӡdsYt^^NVgVCʣDibT,RK 1e߉ܴd=6I2L)s9Ft9l)_JZ5摯TPc4K}z5Y#BKK3Z^N֔X'ҶrzTIEDKOXYޅib4R}fvf/]aÍ4%%/%`'-ˈ-dȈl^"BK,+Day| +WRF* qӖ +Μ$p*v;ؗt.|^FfZq~ȝTΈRJϣ8N7"x4Y{9ui,(F4jsK;5Y4;B,+-la8KLQ?БtV Z:+nU6=^t ,g'jKFh"5βufwgrjd*j5*yݳv:Mց+L upFz9p'81%\:#s%'L`^o&> +endobj +709 0 obj +<< +/Filter /FlateDecode +/Length 4922 +>> +stream +x]Y丑~_;Xw nᇮ15~ؿ_H!*Re r Օ"_J)@.ZEo*oW)*orH=\T1{˾Ͽs]\9X,r*X,m^h}X(b bH1('/ YVq[V6XdѐXED +X `Q +8#%, s) Xr&9 댎pJXYU atEٔܵIܵ&@E5$, rwVZA(hB@Y'aSnk2̟Vʤ$,]0}"/+1º(+Bwa L,wx]cw7x M yY霒 X ++$"/*(`4P p=KX;'aAj# KV5a +kΪH!`%pW%,]6$, +^ $R9 aA<|"/(\{ DdHV$aAY+aA.T6@] $pi7JLf&81Ѐ^* 4*9 IL@LD)YU0 60gU:D&31G+v}wGw|Ŕ)+?T_a، n8v 0ws4+Y!* ڈGX5p掁=S0e+d}sC#||,k6HoC sݯ(Q_7N'+Ю̓J`l;Xqٲ,"Ѵ*.E9O_/;G_.~_.B_ 燲0t[.kY,7ÿ_ʇm6U~Y8<ܫ뮽cz/^Zi "ੱ|j=5)(61кajjyhsSqUwBf6SyWOy6%FO=`,2]z&9fP}MfDͺk7|K^y{C\Y<,Tƨhzi"G5^XfHӴq}nU܅fy7cV`{ +NNa;mǝq'ӜRXs(CL=W4[g3㒤5>ߚ5hthT돖ڶW-mTvp^k[LUmi+V\PIBcGyi}wЂ +ӧ_;^i̎8襰lִGa\/ٞQOܲf|ѓuM3}_":nw=}K$S!zX?z:ui}gǑYz' ޳dЃ,k^i+t<_cf915Dg٤{YMuSy7~;nlZ5rn988֦/yK]C[GKK;Sn]7/Gyi}_=gqfg^|g-8rYo˙h~:O9O?;U0ۂ|ee̩n|έO6iiѲ s~ьavo^;mkRS}t{}4H;wUGsŲ|Ǯ/\e WXZoj:ϦitN|ZG[b$2bL%/teV{Ɋs#'Nhv"#kL쥟tv"K3h5KffF>bf6̴YkO3/3Tn י)3Ve,t<xG-Ցq }@)Bmf%ii 4mMZS4Eo6tOx(GW:piem?̣;suNc}}6;JKAEus?|ҳ.o:Mx;q֮Yir?Sӟt;m߰Xj7㾷UX=f7W3uoU9b a(M3t8`r%,K{99mQ%4sf>[Bs)\Dzo&n9]jӠ_<$|{L0La!)cyW~gҎL&3 ԜZj /N_,&ɤxz"'[.N@m/|Ե- v݀Q$oض49 ?Z_RIr{"j%ke2CRn +UNBWbkVl~K]wlcuB#V3n)nH}^T]+uBJd$n.M&YTj\ E,LZ*|:6nݶ䯬ֈv̻u9mLA[xx+_/> +} +D׵[I7}iT~ Kݦ RyJUf%:$veb:ۏEiJDJؔvūޒ9ӭd%@ }JVڶoZ] jVoJ>ΐuJ)bR{= 5講P!_:)u7׹+fDJ ӡ9 ,+5URxKo!`No2AӗM)!T/#]_O|gpZ +endstream +endobj +710 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 709 0 R +/Resources 4 0 R +/Annots [ 711 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +711 0 obj +<< /Type /Annot /Subtype /Link -/Rect [ 101.433071 246.573057 101.433071 227.823057 ] +/Rect [ 101.433071 288.873057 101.433071 270.123057 ] /BS << /W 0 >> /Dest (cb151-1) >> endobj -708 0 obj -<< -/Filter /FlateDecode -/Length 4515 ->> -stream -x]ێ}gy)ހ$`$L{F0`!CI*=cNyxX,JCy\?Or>8KNbpFߘbq1Y -rzs> -\0 5u>;gGUҜUQԌʘ9e,r-`qhr07 -fRQyIV$N3d0QI;Afht*:ti=XGHNk` Br:[$Yآ(4sEu+$ z0ίuJxr0fuQ$-V`Bq: [?,GAC%sE (9P> h@3 -$tJrDl1d9&F.-:Z$@kآHs\p\A$@oIHqLqjo h.@u -I - 5r:s\vj)0RWr\ {qwqw܀19. 2n*#U,7- X 0C4(lPpK8.0]01cl5H,+=ՅA:83nʃ6p\`4 ̨ޕ35J p\8 )]VwAKƒ`VIr\2P ,x{wњ kðe4A(0 -t]!\wquQ<0p8.\>Vg\ Xl!G`V` \  Afpa[)r\&| ZY5xfu:8.pLŒAq~0:I[0T8.T4xϜI'xIqW ^y234֒hjNG"3=]E 0LS:ۆ,~2mU\nz -J( ͸t[q\qh:!8.c˸-A۸t-. --p3nIXo8-*ڸz=qpx03Mx^x+}\qz6b @s+2^Vo\#Al*Ra?F+NOusw&kLo$c?~{>#eGAS+ ޷k(BxOh H ZnHLyea9 7VsT=qp,,1+,8lkF _)h'ub|̗X 2ߟ_:7k)|._~.~c)b.]7{}us22|m$SNKdSO]"F4G7u7\1_i{XޟҼMק߾_pL'P<nX^эTA>Me%e U%?"|u洲.yH~gӫxs4b5uDQFD:l{u eB h65TA6`Us4>lFoZuemKo+ -*fJhe.*JuN0'\mH\ifU<} 7PV1&bVJy>hWVtS&5<Ѭ7U)Z?k\?7PX(s8^1wTK{WGqmQiXϼ=>wGU~`3\zܿoSH#Lֺ`R; z'eʎ G.6Luo=mz 06PV= -f0^e}U5ܚ bu\DѢ*9r`13bFD˳4UzJ^Ev9w6x˚OҌL)21+ĎV~%mѦiG`,T^*ؾnBGx*/>;{s8~bX䩆kH,\#B5bF fx3PfvC32b#SGz N).U]]=fI.w]ѷ?ޙpH)_dI9,ۮ\nu6ub}ݨs8T|[t V[lܗph -E"G#ؙh(ʼnyJt>n<nnt6Reܬ~s3vdD71C[J$==֙p{^l5wpF_õN Mu3}<׎gtoƓʯ=^r]ٶK[1G;MH1>cYH1\JI(uWeLUpY9rlLY\KEi&<^Ks>Nj4xK t5tvr(-.jVR_ L])%٢4QdL$Y.%-5xǞm%}"niSJnDS]/{K:;@+w'JKzFfYJ%Nuݴ;Ͷ6bg*J6Jy3v{K5 -*4'V =9l9KEƣ(s'$",''> -endobj -710 0 obj -<< -/Filter /FlateDecode -/Length 4930 ->> -stream -x]ێ$q}g"$C5^+?}JK4z2a02+S_~/Z=Řۏ.j -N_)8(U+&cPBr& ײ)%okVYB A9ARsSyASLIR kU6E'`5& -3MkU&h+`N.*`6J:%#贛<%ѓ$QH:ti޻(,lqIiI`*I[, :[rIGH:-?<((Vg7)Ғcu/1E/QfДyId H6J,`bl$рIn>Hi茖lqKL@X\Q[(Y K-֪%. UK\@ \$. 0.Eo%. P.$. p.;%. .{休@ddwPSXD:KZ ,xH\QC/q2kX XD]0I 5 ]㔑w5^e(1BX3$q  xW',œ[M:&/qui-181P^UL(p/V 7Ĥ2z1keJĴ"+Ngxkf $Etm˯?c/* In[ M0gFԍԠ9閍]JԺOX"hU>`V[2Lf'@q¿tPg+9vzͰ5˯?0zP@ooXun>_TW> mul49pC}usuY^LXebaU;v묫-vFUot?-X;xm=W[,{_/ՆCr`m0P =N,C5g:Vvz87od~We/oaF'P{ӡs^o<: -Ƒ|G&s[#'&^0mR뼮Ϸ46;oza, j^aa<?~fˀrȌArvQVWƥ \F.1(5̜ ~m>SO2avYCo |!x?mcPFxG5Jm4.p(͸J-5J̯_XꏯVF='<~J i]S=lqamkRb*Ⱜ=?D% ct2l,}ҺidL|a 㼦ugTF={%筈z5wF[i![xFt+eW~2~yuY ?nGv? vSFpGOgNy:R~xU}7WwĦ'<B򫿰чs!+bQKoģlvk[-=3&*] ZwfW\ԗoϯwk[/. mM!\C~e= iՙϞ=\83@;ʓu9O=:p#6??=ew|odgC?ȇ>w\VFWц'wx9+7_U^緒g^==mғui팔/^_Ϲ̩=ye@+XǻnHEkx7!kh5︖~!Z:8Xjwr_'%=2>rܙ{/9zZi歸J?v [3\gfVܳO)hFz!}>jQ>r۷5h-Yr5Ó/B_|un$EvGGDuv{6XnP!bKxγ!1ǹvjug5,GiuNxĿVk m>%33&7Iy7u~lwv+J[ܓ{ڍ۞uC+={2ܽSZ2cfqpwQP/nbcPvUAg'(?{foTe/\|Y)?.?yNfܖߵ#-;T=okѶ l'2ҽ~AgyUD85g\*uu% -P_S ,`ϯIh9Gs|f};_==;ю}ǽ>:>Ky l|_>|oZϩa`mbi͙ї".hws?e W=>j/sقja-7W6)̭7̭f0E/;/ث;e5k[W\P1 ٧lK{Y Gs~Uv>mjcg@IR a# CkT~W쉈->,rHXBx?cOMwP"2)}J1Wb8Wͩ8殜Z}ưgfik o~&fn/cpگxe,LbdZ O_Sˣʕ6]&WoL!]q"0X}ݨYS+5Fg?񢓝| TGS_a9)jmY] 6 [0$ͼEqlr}WZU QycA^դgq~ Jh>-/ŚPjn]LlkYp otKMW/Ԧwj2bF&udI.;UFZ~]+l+j9At\J^5UwS:)6 Y[QT?.9Xoc"ÍY ol4JvqA(:W(WDžm:^4? SwpM|жA*?»Nl⥓7ֱ ,saKG%ϤJ7-eLR5/T#X75qƕ\讋]BtmtzZ]wqqh#؛]*͎ X;bj;cnH;qʃ}I+KY 9ίQ|߿^_Q-LօdeT8 -۴aBcwhh1m:ג1nZ.t݇Llt&# ^l̷M_SPЫU8ৃuԗ+kGh_ҡUo-[;i[>b,ȇu/*+g &~wF{z}&:Q{qi;,m'Ka[sjm{Ԃ>5zhaL{*[tZF*k-jU3B)/ӎJsWesukq8~vlddnRKR˾j{ea!GWs̝{! ?%cj*/T{pe -6us%H͕0%RA׳&AVZR)=!iN2A|kIÐuޘ"/t-'m } -endstream -endobj -711 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 710 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj 712 0 obj << /Filter /FlateDecode -/Length 4684 +/Length 4504 >> stream -x]ێH}g5yIh kAiyq:vUz刼3O l}VBHz1O˷NjNXbv0opg( N'[0L⯧?y}6CJhwGVB A9AR -*.* JI*ADAaR` $AF)QC5Ncн3z1$t:Igi%].J:-.)-lqHI:B6IaV:bb.I.+:آҒ.H$t*UNVaEa|tx咨-*#,l!H:!Fa^VY-l1&-|-*x%L%C h%01 h$7OA4tFKD`lq%&V-6ZbJ\`H\`AoIi/qL%qI kX.{uF ڵkI+ k-j:K\vVZ22`VK\ &F%qwMT$qwM uax8)#qw /q2 wA!N` V{茕 aܟVK\:bD]t ):?I\%` l[1[2H\`Hѷ=-? ؂HQ0y0Λ!е qA4k " % `t$. `H\W4D\i؂ [Di-qA4ѠD2{I #(qA$?p(q v`JQ[@`~x$.MlsDl$.v3J\#l1H\l~3H\lA'qAR~0Y8tJI\t~ӐXߌ$OXzo EMIX$7NH=73DD/"7.ft]D^`V+ deg3 -[Ŕ[1g@G0;Ŭ*ZiEu~L>vg>;6+뫬p];]{/>+UY-B 7:\[[{ ```cmseYY[ Ȼc̎ K' _Q ~̤Ͽt×eqg:iVԞs Q*l Oi4E-sU]EK7¾نE2deƧL\(܈,3LLf3]0yLm=|EmEs -s=~kH*Nr_á2sۊOdq8%}dE-g~.qF_"O牛b<;\أ!nCz ~*wH!^F @%/"vg!v#~Γ-W& s2$HRr3_Ƥ3/佽+{^M/m[[E9@ik=u AF#AqJWw9J?;zsk7P}uZڈYl(1-݁bS~AUd6݉u &vzecfl#㯹}|=:vs|ȟ L=7mQmc̑w-e-Ɇ̕9^>7PēvJ;e1mfVxμhowp_áp=lٔk9o|ƽJ -@cs44}{f?1T\ķ4'6ᐺ|̲zicG#g\;]M#RF7PV=JnpŜ-s8Lj2e4;>{]˖ϲE}Ms&c.݉QVD+^* -ʐ;FCr"w97?=VrfzW|~ƷoLf<5.$Rܞ;v9bF,^+?r;u92߇&n^t?_s8Dn\ҝF]|v28(ٝlv%\ZX^WGJ`8{1"y44ln_án}43NLj zV5#u=1nF'71]:S~`X宆5_ȘeVlE Mϙs8m\S2O:3ionpJM)3tifo5{-zּ_;㮧*<ݚu|NzdZ~_9\uw}nzlr}QPy_~]ز3->&~9Zy=Qs8[Do']{IOwms)akE}̣ݽ>&\c&܇9XJևv9}f}u7por!ߣ,6"G=T~9sx>i>c&.Ւ>"=s8DG9㕹O c쿁۸;gPy}7QZw߈ݷ遫;UUG\ru#s3}ln$s4$jݓ8;= S捛*}==:8+_WU킵"F\>ϟ&}w6R -xɤ~9U^~z^.t13dj|"}S7>i_yYnSŴ}w z i`ҙ_%I7jo !Rn!~8Tq=D?K(&T_FUwY8}T-ҹ`]N jJGp}IBv|cA^/|jГ_;b -?kԖ ֊bmU#tKjbC/Z)C竰n?55nm/}T]6F"ud*$.'AM&Y㗞\1J I,7LR*֪)|5B2lIMQ6=@kܘrrTVb\JeB۴[QUTiy4__)3ASNxm|Z/Ch -l3\:v3effyH<&Bs.+b<>+[F*vʯ3qӕT[žpk+e5ç[m0ѱQ/fIU]V@ -U\iuZ؉K?E&yaK` j~%]eP+Dw\Q-L֙dӸS/4²lXZe4?nLTJ칤. :mq+K7%yT}=la:[]iG\th4q6æT-ɀl;)CS;j0mQumY6ES!mچI=/7d+ڋci!ǎlȋPi6kϖ .Zh#TR:͎d*J!jyX3(STۑvAtEYn7{-Ρ%K,ok)Ւ6˖}ӼmiP5TjnQ!{d\tYT3!:ַQE*z!~gؤF+YfDr 1*h PmE5ZR)7B*ҜZdw:1!Too J!=^:OƟ2 +x]ێ}gy)ހ10yi{lyP/J-vxޖx)ŒԔgO%$t?}8cɨ +gR ֛(np(g'לɟO|r2t)N`I#9]s:-& l1Hp:B;NgaZ:آӜ ˳:".Ot;)aNaDct +Xa-F 4l!q:{f8Вآ#V[( [` 8P q$ȓX@0s@68)Ő@KB@h[a"qqݒ %!- 3% 4(P +hpwr\A * 4hWh&)8. ` qqk pxHq\^Cq2(U^USsƠ渀PxW(Gxbxw`9.|A-wenji }>V̸E+qb.s\0* xWjԜ+U.q0H8`~tY]D-) 0 ƒIX$qxC9.]L Fk ,xWV[WÖpV+$zӁwp ލ&E^zstpXpn8.pbuq\z:x -Z) -p8.G0 ]]lqlg,chUNgy90K <= !K $q\lPS!* 88̙ŋ >9J2lL{zd? aLM0 T@wx-:ZF a=y.#%hqE#1rXSqľX#̶itP9VL1|ZaR雯W響C?87:vw:'1]ʌmSF[JҤ\)_>Un#n9_~->jwrGU~`z3Шv|Gͧ|{r#Z {Hs8^oᷖk4-:'oR |pk[ӖIgPjceߣ`̶Q֗p(#ZO4(R^KRKu +`iFV̈ty<2^\^k@ l|, ]Pחp۹]OWYuqADn]v]&ԽKH Mv9/x%O5\CeE)w稊5hwO1vv;fh_)R[Xg!%.{}y;7x6}(FgxFk pmҡ2jb~^HDzd"kqz1Ywfl6d3@ӖK]ԢPTd;y妳EMNVݟ*Wu5ju+}fq?TTj]%LWF,5)eĈ.'FHE:3^jMBD9]HĦK3\NK֐ZR}nxF6,uqjb{ nJx9#O1M +ajb/ +^4# ${'0Yg,q/N4QV˸ieK|}_&[uqh¸>nmdCCr|ok>{K endstream endobj 713 0 obj @@ -8963,82 +8956,85 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 712 0 R /Resources 4 0 R -/Annots [ 714 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 714 0 obj << +/Filter /FlateDecode +/Length 5038 +>> +stream +x][$9~_QHk|HÑ]3 BH K35ͪ_,J|_JĘw/R'X\UISGw.L!9KZǟ\Zr},kD!HǰXRA;ϰbJ b`]İ):1֑aEalPfJCe9P$PZJAF3<儇=Jtby<43F`S/ ｋBx8exŚ8, pY4^, RqdKZ15OK'\4Fr,X ӆ4&4 pW%?fMsX*bX^*@̺>qXpT|F UsXSs3<Ȅeac3c^ONYQJi +@'LC0|wY !#u! !`ne!BrEGmE>Du>s:"D?(^֡*'|OkEs@-Dw+vvüW3~[N5T\E-OK,Y,_G,㲜:yeiT)&m8ʸe2YNdddnGLRdR}7|{γ0] '3= D0-u)V +WY$+@/LǗ&%#:Ogv nEL=N&,5 KPSSH0&ҧY] ot>Wl |qE:3uGܽ͌RV8Z;,Tn +p6|^CV'}_J+#=Ww?>wIZ"XHVhl:ԙvZMJocE%%y=Ҽ`Ly6?!+u`'<5XwΆf4m4H[{+^~_֓Lcu) As{H|_@,{Y~,[pnT 3͎dp}ڹج@:8H4?)Uo<G +-0q"IGޖWb2cUɵ>Z'-Wޖ`W֜J7ttإ=Y,`Q |`ra}nub"n_fymH[b-3 jh8Ydq,ddws{rlGzγY9د5ӌOqb0/X>֙ɌGjnC);YxPjݫ eD(=7ߠ7ՌԆ(#tydIiHesߓ +ɦ޽:Y,`/hǙVyq:f`GkQY;VĢG|Y~ڽ3{ܣuvʏW_we-x.cMntVһK,Gߖ8┇zǵM}n;ߩܿz!_$qcJ#q-ǭݢgY%ys3WU^[ +n=#iK;W,^yy?Z˜ʉgSJ^&+ e{~ۭ-M)͚7?FpOy:K;N"K.3\뤳gf3ƝyZO3U܊Kh#v +)$SZ$ulO>nYnYgB2=9bܒC,w #0C?=\OLe%{b-oˬsX,j<jU~j[8*m.5yJ}}>^UߥsfG^el49\k|~h cjsؾkDC]Y]:N}-;`kFػS7tp^jَAtRRWeɻ3imuy,<5t:\e-_Z۸R9pUdsn-]{s{}$i>eFq9U@Kz*">Y#>0v]^kEtH#%A͓ .> &/dqN6wUn[-jL6m>{V΋0g\=6P{& +oix`D&a܈ir2ڴXDmM5VUmՍ>椆Ǡ`-Ϧ1>ql0SE~_ 2(Q8#a kY~vUӹhK. +V1od5FkwJVvӛjw1"˘n?|;>d*:-){'yqAUVŗcGU9zZ*MqV0k>4JcU&U5=K>d>;z/Pٖxe!cv/d Q$gb({[VdnpA$T֏#c>QV|o]ʴ2{ 5ZP_jWK'--;HBtk$ MAESd[YtotkfKG鷦v4CJZ>!C]75m1Of-H|'fHKC]r5g*RqTMMCa&v3U +-=dH>.yC5ra7zE]+q..0 +Q!vr^5c Kq;TNS>(M**o[qlv&gӏAֲ{! +<`jT"> +endobj +716 0 obj +<< /Type /Annot /Subtype /Link -/Rect [ 101.433071 797.673057 101.433071 778.923057 ] +/Rect [ 101.433071 146.373057 101.433071 127.623057 ] /BS << /W 0 >> /Dest (cb154-1) >> endobj -715 0 obj -<< -/Filter /FlateDecode -/Length 4717 ->> -stream -x]ˎ8rWz|,0l7`m_``^5@}*E2DUSVtv"'!VJ_~_$=Ę5Xbv1ZQN>OY`3_._wɋ]RF*C!('TJ[Aq^Py=ST02TA):I3Ș("̰]0A: (%`"Fi7x tF>&D]N#| KEIG%%-N)I[ ߻I#D| -#x[26NJE¿rP'+9żf~ۿ׿;`}w|6Mۼaͣu?^Nf7 ]Tʽk=ձ]aX/}6>>ӕ{0s{{wyo9Fw@"1"UyŖwu*ʰ tcp: ݴ&9y_"Ϝ/`˛ -Dnn`;M(.P7) 2u%u\w/ =Bzն^ۨfP2{:C/m뇠B 5G +OsڊpstE=(5Xs:_7,RNXӡx' sTDIwc(DĿu l7>[+!ԴB;=Xl5q{#;bڡ'$" ޽|V޳ʰ/-'Ds=4-ޤ7x鐸~\׎m}l9f㺭F k+<'uƻ uь2Lat7ӝ7m'Hu -jȬs:nǠJwBVrGzjţ'^"sV -jYއj9jwOą?ޥĽUrޖu.'+{"z{V($)]t3cQ tLQM>wt6I[q.ΘFƴ}9w"X@8aQw#ffv)y-^; e=-o3koxhj7^G)=78Xt -s,v#yv:J~;;nGدG/X+SD^O5,ϲ9\_Yr,լ}Uχ~1֐ꞈe9Rι֍gR[=< m;2㼂b cuNg;{^ˮK,sԶ;XkϮmLu|qePfyZv<{"O{鐸+s"1Tt6KD," ['W“maC 3p鐼݌wqavewüܙ;zeƲ_OGzƨ瞋o0+m#nO[=Xl;άh2gڟڙSigIf|n̽'bуuN̝Lv$rZ摝ga74[ڝ -+9wrn}v?&٦0l.fAg, -QeӑA"Jtgeyl'M_Z~־fm8vb~z|/q&8i5#*KLV_Wj@K IdS  y⾿-NhE]IvY8}T-ҥ`aH}Iʷglqnr}W8*{ǂ5^ݫAO8WS/6C$^5*ULBźkbCS7a5f_ʚsKx[KDi~[iQUfQJ])Y'< E~Jӄɬz6km9wa,@Z.rvM:Sj*#LiP h -YF-bg̵ 7f!]ՕoҮqrz\hYUUK惂OXE5 -Wy*U$*:$ʲ!TL(I#6!cy*yź3\ɅU(NW*^:vW|Pg\?U{k Ex X:ibk1a3 čFFqYo>E&yOLou~!Q{ ]<Ǎla*ܓ7ƃ&"ˆ 1ob[YWP1UWKI]TW-6Ll*tld܆֍b d;7a/m9tckUසt+kWhsВaq%05fff@NgO} FKt,oƻ`E[~&;M3{^^d_V@Vj7.7d/{emYl rh.8F4jS;"uZE TCOʰwQ -5h?v|V :>+~Q6[<^l shwZKFAy*Vٲo]5C|LU%gνNuJ1c{5`D!_(us%ˌHɕ0YVLx"+XSoӛjIFsj _> DŽP yVc~eqPZL |', -endstream -endobj -716 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 715 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj 717 0 obj << /Filter /FlateDecode -/Length 4714 +/Length 4571 >> stream -x]ێ#}W9y)c I $$ìyn{fv7hH*[>+/bL釓SS,.+;kEar:߳)$g??rLt˯NZg3va)T *rn -8/Ĕ$p ]̠dLTfX -^0A: (%`"Fi7yttFO>&D]N#鬝| KEIG%%-N)I[ Q'\; Dl@ MQ``5F`` B LI#p[)J\&b" 8zUy3u:$.&b-qRSĤ?q$q̀N!L hK: [dK\H:%.  UWCc-tx%.'%.4JL)` hB/X`e-֑1^nF b-F M^o -$.HO&K\N) XoכQd֛X 6Y qA":؂) &IybI\fa֛- nw]3I:."S/q.Dd+g23; -[- -➁I4XYF/Bmݧq>3nd´ Dmѓ=}{ߧ_坲~Kֆ}p2 ry&m-/FԍԠŲFݦs&bY#-EX*hm* ?mQ2r/u? v{6JG3}@Ż#v0 -1!w~?}?Kݻ?;0wt|FΑ(|vENjJtȞ_XN,ʦG.E2mZ_uݗz! oqU7ča#3rCqCÝ> -bVsVБB@8*y[qi-T;7wx˱M?*'L,i 26^JhzE&[㓁zvK;cI6e{s5v3_SơhXiٿi_Umj}qP.۶VlvE{~vse1No2Vَ`o\ڠVNHF"&zoF~e)卸s͡sjK,܌ʼn2.y^5^]MW#1UrZiںf//t\~v+WzAY!Box_jUa<4Sv&DݸBq/7 ^g/Sr3)V:gya{ȗZdc@ZۛGBI -Knu7)bM"ƢKg7axA<Ȑ{t=@k7o)*=y䬳o"hxIr&,\76N=Hj fwUtK|!Efپ9Dx2[:2̌>?t]m-Z4e͡IIgtL*(I{,0e\vyCy8# FjlT[p1RCDrfIŠWn§㧝A?NF5>F@_V2^٪gxs^EW͑ߊ]+>nv`ӳi{f(hхuVXXG~ϭdmK &W]2XˑnvU;JYFr*Ϩ6t_oI~LF%GMXu0ϽBee2z8`YyuSGQ F6_SDiS뙑V>X|=Km>e^ ^ًHq_1Rx`{CߎW?7+ez0ݡv'fcǼ 47VTG QswގabWo,ocm(6c36{_l):&R{?E̱Gf>mbCʺw?7P6ēXUR:Pa55 -+xsG+0 Qso( 1xϦyꈖ#7vTH= 4q@"#1`/`{CbܹwSc=Sݙ>_cG{kbf=f<бDžďy`CN,џ^?+_?1swV/wltY_be[eq4N|: b|T,5a]aJM|Lp~Ѹj6>TMdosł9sդO-W§d4a/ƴqWZPGɦ|6Ǯ״& ù%P]KD)]kTԤlBm$ߨZ4a0~5>et -$jRM'.'1])͵ --UYSnJY" Q~\H6XWuܘ+.~: v+v(xkWajVTᚔ' ^ &^v(uHMK0;JHϤR[H.!Uy,źj45(?-NצS2VnƝO8|hn;` -/ٱZЏ.6y^ 솁S؉~LwuVcA/ο~ܨqBNC,;=ۂ>5zhA4l%+*[TZE TCɗl[rK]n։n˭EK@nsS=e% c&Vuݴz ]|d'K_ ѱ GM:Xc/=83akyJwD^Xc"kUz OP}PT}=9[RbVPsuU7e"f7O哣y/Ox +x]ێ}gy)ހ10yifϡ$^DZ잙fUK<<,բ< |.'9xI S,.F7u,`9rteg,ȳBJOos0Q38eTV80UfPS R3*349ת3ĩ` 1*)`TB:"bt n9AV砓Nq:H`5l1AHNg`Dq: [Ղt(N`t]atA&x"VN 3tRԬ# +dS +Xl1Z(Na Ӂ'v3Uѭ:؂@Y"(#hqrn#@<ʇ `q Ct9.C'Az7q\qכ゠֛X16hכ@EauNS`-8 ME XכXo£gC>7.ft]x\` ϖ[ qx+NF `neC܋ʱ1k$6h3`ZR +6l h SQYa.d xyQdS|N_<`=ӻHYp +@t-qb9ZnI+u%As-.;?,,,u>NQH^hۃ4VC90k1Y|c4X`"*R(_AĿshRjcNʜ߼?}?} +yw\+_\BF~טoLCWeNn>_6\^SNYM*7o_7_Eb;41¼‹o/2J75S-QFsxWhJk +`DO0!2ٻ.2i8Zby3^chŠ󕱕wj;veu;X yidpG/I(z<5g*iiǁ*7c`L})X=> a XK%/APT̆} EMV,tˎ`RGFddj\s9 j B:-e+3VMTSdWyʾlFoZuecmKo+N}8]']vǴi  =VeQ)civizd˵ +SU{ 7PV1mbVJy>hWVtS&5"8tC]_q_yfI YuqADn]v]&Խ3||g3y/Kd,?WfňPM;ʣU[lܙph -U"~w;ߕyF}sy:ޖm$ʸY+jgn6f*o`wnc2rMjs8}l wpF_߉}gkݧ2{,s8|xFK5c}jwN] ޱ3ڙpDių淣8?݇@ѻYդcqwgG=k|0.rw,k<t"3q=&|3]C;=tnp1rx4[**Y+B2w~bD#\ Un&O@.trbͥS.%kH-_L)P>7<#hxk5FNb{ nJx9#N1M +ajb/ +^TIOTa42! _RIYlZn3\I[5t.cn/>nN[l!̋$c)uY),OZ(MB\4y2++\n̝Olo.|^ƉZqOy+UbH >4Z3;3h2ȸr4NsJj,y|t4+Ben],V;$æ*h/iMBCǕJvQ=AeBSڰ ]%u2Ҵbvd7ež.u9TII*\ԷK_tLH\ŤeJ UF\ԅⲪ0fF@֕䦏S:U]TnDEGeN.$pu}QL4,a{x=gmQ=Kji(̈́Kxiyxoi\ƞNNŵEJK9+$[T&L$%dfسOQ?-m^ɍh^4eoIgpvDI}Il;KIu\ClLEfV){Δ:p JCtw:Uh2Vܰv>1 endstream endobj 718 0 obj @@ -9048,262 +9044,281 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 717 0 R /Resources 4 0 R -/Annots [ 719 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 719 0 obj << +/Filter /FlateDecode +/Length 4797 +>> +stream +x]]q}_L ~ ^6<ݱ pED>g;VIS[W4V1始SWJ{wʆ䣻 v!/v.;fHUCPNP%&Aq^Py=ST0kR`MI*a* AR` J* J+ءR(k:Nd `$NK4x]tsik-bt'%`$]-]-@WuEy%]hKЩRg\$RN$00H>:[rIGH:-?<((Vg7)Ғcu/1E/QfАyI` H6J,`bl$рIn>Hi茖lqKL@X\Q[(Y K-֪%. UK\@ \$. 0.Eo%. P.$. p.;%. .{休@ddwPSX@:KZ ,xH\QC/q2kX p. $qK<7x8e$.]c@?J'+q=t$.@cAX"q'iՠc8>Q¼E/$qQ xT#qjt]mw78 A#m +uiP)F xd$.T0HZJ\pIUHUa-kô4A0*t]Bw۔,0Q8 +6h'B>Q; DlJ\zH2F`` B  I#p RL6dyЫΛ!е qAv+`-5DLz @C$.i+qAHSE!DN ҅Nk -%.&bXK%Uy%.9T+M0- 0>y$.M,sDl!g%.f Fb qARI!ơSJ₤#֛J\yכQD +M,yf Y:؂) &Iyb yכQXo"S17.ft]D^`VZ+ de+(f ) +b@|ILL,pPj% ]p=STp1L}[sLh=??]~OdFPJ[W&ao'R41ggd#BԠ1閍3aNDŽSkoU>|x[2Lf'@q¿tPG+9v̇bw~ }z_to㱟mr3|?ߦZ; _29ې8˸Q7ֱ94Bk6ܮv+i2zl]ũF;-O9Kd:0=V=[-xw_|H[r-p*s= צXnA:ͩө~6〣q;>Xl +k Q$1DTr "D2fLgk&uURLp=s:m}_cg٨vhhya K#xwm{#VvMyf˽>嵶 3k+&_ۼF:Cv5vDn[I_am}p/pakGW|]vF:CNLڏxX!@1QcM7:#ݍtM_[zɾHAFIP(rW9jv @ټ?W:Ŗzz,ۯ 2:E-f [A-CFCi;'GOR*9ib6 _Hby aOdC9¶c5$uW4mdh^CW]\Mc:@Ljj;]G~ŃvȯJ3$՞xQ +l!g^f|Q@f\l%;gn%֯_Xz]A2=1*1-V-.zXVǥEa9tw.*m裓Ϸfc9'-ΘFƴ{9w"[wlXqFeԝn񈻷]b[Qm2 yuQ7 ӭylGB+bQK=s:oǯ[kfvOT]w ޛ{e>Wygs:|NJ]]sȋ:܌w\ԗwwC"n d,K<ƣߐ>Xt܎5?r,ѐ֏ ^Y|ngp/},g*1<Ws64[.lgGxϩnJy'uW8wPw.Gl~8x֯ Ms:C`k5}\myrgUlgϓ=Wnܯo!3,r{i;툔ƌX?˟sCk4CKVfn|q"FXYz's:Kw{^jQ5okR&YrzʚIc\u:bţ=ոqquOYnPcIx鐸s-7zoKA~棴صw^ӎ߾G `Ql!1 $!^6ү߳ةO^a ߊ+.9!#rx!<,{0(L?o2 0v3^]֧eJywq +פym*$yn6񼓸7ֱRht tTBLt뱙uT$c. uM)OJ.Tn巙xӵ +דyZ7|F\W4{[ Ux+ XO2jn:N&DoE\gkcl4${Rܜ!g>xMZ> +endobj +721 0 obj +<< +/Filter /FlateDecode +/Length 4758 +>> +stream +x]Yȍ~_FqLa +ə௯7_/uL)yEv +1VKi+B0 ,'\bJ b@1(E' V[V&hXC'VCDQD<&{gc2It0NK4y]xY\RZ94xl Cy`%^,I/BXWyEy%^KH%T q3M.Z$֓mZAAK"8ij'Άjxv[esŘ@"`%0% $ 0!L I `(RP4QVD> -UőjB"DXYP@k!!+aE %xKJ{ ,b* ,FOX@.L)IX`)ab ,P:o$,]KKX`֢ȃ,0` JX@]UFF;V&&*&0aZ k.A]㔑2 w!N V{Maܟ0VKX:bD^tƅy -O$aQY p%,OFZwIJE$,9LoV0]&bwKFxIE  IKX0P ZȦ͢[+[bM~%ƾhVjaef!QVFm#VpV~߻OyjzYAc/޲;4GPͲoXpsu΂cj1q +iL\XF}\kYx沆b@{^صE;#uwe~v"Cʒ;/_BVœ[EUrR:YѬǠFF[a;/G+[ųVxY~߳r޻:Hha]xvsY|:wLcĿHy]K=W, ¹;wQx.&ERG7{͜#+;WѬ,Lj bX2dW٢.1˘KOb񪗦fufHkOeh>C"[bxC.dă{oxr(kL%3}+G<{b,3.YE#OK,)ܲՓmu'owa]vpz27xZºj= +ߐk yOu ti⇍CQYetVި_UC-xC{8c!hboPM9i i2!d?Ifrj[KJ{P)%rj㼑|xܷT`IB6:w,Q-^Mz!Zd3_E*5H}`xHVuD%F6TѼwUo*z: )kB7{ #U;"JSEFUJJ: TI =_74MFwڞrHҚ#jت&J3uZB n([dyݘ F~ v ++mn%GQC,,4ާU*#O>TMogVROuHҀv!T3Uc+jRAǚU2CXOʞ讑]5TuvugȾbkOu5o_v6_ٱHfӏF6zYGlk&Zщ_U$>mHmmn䴩B Z6Qcp}ThNp*b(2ZQK(j)ԘQkRQnx5Z5r9vudh]JBM뾋vAM"SժM7[掸TLUpԤ56}TE!/ +us%یHɕ=iY"]SrKOB* E9B4Rj9w):'#:" +endstream +endobj +722 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 721 0 R +/Resources 4 0 R +/Annots [ 723 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +723 0 obj +<< /Type /Annot /Subtype /Link -/Rect [ 101.433071 639.873057 101.433071 621.123057 ] +/Rect [ 101.433071 713.673057 101.433071 694.923057 ] /BS << /W 0 >> /Dest (cb157-1) >> endobj -720 0 obj -<< -/Filter /FlateDecode -/Length 4746 ->> -stream -x]Mܸs,~, E0!?jCTNdiUT||*Q-uJ`!zgΗO')7 YIU{䅏V{w~>-|NQg-btZOʐ{iUJ*bT -u)KS 6s&˩`:03xEsU+é`3*%aR:"!8V…#)9p(8]98-6J,l`9-H:آ'NaFDF` XlN*NIau:|봴"$VAri⤍Xl1t K>f4Ith -|-;0D%Dm8Ё &p,C{h@G+ -:8" [q-3Ұ8. -5@ 52* |krfJ K  (E KN 9. .Y9. .8. .%9.0]"du(HwIIqbi 08t+B 9.0]w$ xW[\rwF; 7X- X C4&4 ,xWE,̜[ wU(G3,s BEX.3p\XQ5+5*% r\8oBI@E!cX.hIs\UX&au^HC9.p],ޕޕn-4kôe4U!5Ӂws:>r\i$Ё(k \0"z8.pQB9cqXP- XH1p\5l!9.e -7 lqLh :cUNtts\XD/q̀N |-*`)A3t -.tJq\4l7qAQ`F,tF83p\U&l[  D` YqA:``3ś(a <> t"ơエMm8.Lf D\7= 8M$ě`'N`\7p3o£gS!śMwm3q:.9  =u>V#hqL%#0TN_O -!4;<`C: RIoߜъk6cD0l=xw;`_Ki7_i{_ xX|o[&6W;fQ.RhD B*M9ln]ѝ[zmu㷝2OB׫ ,L'8t/uҽsTG5 sP_v5LߞK"o[$vhPm)|zuNv|ms8|xF{Ǹ]qxutvP>mN/zo{9 {F>/UpNE籱Puݣ0g/5\@UK)u ZV`cájŻi=gK1HZU\!&\$6#q[!vOSTUb:e}CW>zjlǎS+g=8GlAhw-KJ?qQnmUXh~c22$nrsܕ5K{T2._;eƿzjcáOhLS(4z;2r]_C tGnc!tſ\z;2y5/Zw1etՔcABz{ٶp̽л|I_6J73f2Уm_W+fGqc!֬m5jG5i-9WwWgwirlZ@hA(2޹5ns8l{گ4ڡIL-sC4o S]w@|LZ&C@muĕ+ v-'2(,z3jr#ȱns4m92]1Cid'#wid_Սuڕ/ɒBZoe> anG>tc!= _LW]ԡ#G4edhZCl]aZn#ЯcC?CLjզ^GHx.;rzGtwߟٿ79B<X$xd(y95x{frW- -;~n+rqp+5Zx!O Hޱ`c!J fQˡG0q)509Tw+am轓~/8u'LczC+,'0/Xǫ+c]{m31;ǔnG$9ܯoF?ay?vŮ(u:Gï_2='4ObM;Lmmo=im^Qva?۸`L^'ҜmzY{YsO(is9Rjr z)vjugK]?"Rw+Zoܓk1{ ,BOtٍuv|]2I~!5 ;=JuXz3oi`gVJ9ɛԊGyڍuİ} }c(4sD< od\v63۽noP<9u|mq'F M -/Ȥص~wIHo566_ෆV79:W l;gG,G{/9~#~pyz^@_tc!s%zտ5gMEp:GCp\ɥ~{GZ{?M79BW_X\Aݙ/jHP~mukY-'뙃>Q݌=2E=u+X5wGgsANX^p=q-wS߽~{7!?<5ݟuiƒߏg =ryGj_ޑ_qN?=܈'gAR8A4ѧw$?U _xnZH]UMOaC8\isCaX J P\ cغʺyh'dKc馒'܍=Ca6lNnxGޓ']J鞝i^ ɨ>R#ǩإc-C=^N֔X'Ҷrzv8Ȋ*M)'L,KJ_ib2Rq$"vR+wu Z.}l_*H|"RDtY#1HT -8QX•Pf#p*qӖ -9ݖv|nžJ/,vgeXL/N$UeYa5 PŕFq?IƭӏaduG*۶(~u2?䗩]q- [­q7f,,Ӧj~Pڌke%\RUE -mF tg ȼtl}=|q8 ep^CQ]M8JEME9aMLlOR>oڡtq#!Ult W LA۰QI> HBEJ˅%i!<^Já5 OC-j'NZAFjmOjlrҼPLfYigX-wpŁ%_|*iێJDێMxKT ׫d%#sm"5$efzڞ0W=SYY]g\tYT2!*׏b6ʓsLNpbK Mj:s%HΕgpC$Lx"+7բd/`RA,D4*>6!W{P&y' -endstream -endobj -721 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 720 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -722 0 obj -<< -/Filter /FlateDecode -/Length 4823 ->> -stream -x][q~_Vx}0$Y6>y8gF0`}EQ%zά0|sUKcc -/?]¿bu7V&# lBr& }~qu}5SJhw";r*ATM!.* JI*ADAaV` $AF)QC5Nɣӽ3z1$t:Igi%].J:-.)-lqHI:B6IaV:bb.I.+:آҒ.ɥH$t*&UNVaDI>:[rIgt~$x0Z ntH8_ba -^yIDɐD&ډ"ELL`%0MSx* X[y -+`M$q5 $.X--X-%.[RK\`A0SI\`6zr$qZp$.`]뼑v-E/qZJZ'V qw1z Ĩ$. 𮉊$. D]05MfnqH\@]CK\L%F]P=tJ\&D ӟ0VK\:}.M:Džq^IDe%.p]g?aF58𮶘%xW$.p] Na$.6i芺4 Z2`T0HZJ\ޓx"=h$.@\0Nʀ)$xWixXҁw -IiSX`0pBl$.'B>Q'\; Dl@ MQ``5F`` B LI#p[)J\&b" 8zUy3u:$.&LZA/q~pI& B-*`*Ad.4lA-q"]贖 ؂hPh"V^I\kIt#(qA$?q(q V`JQ[@?v`&9XGhx%.e$.6y$.H - ⓸ )?q,qh:$.H:biHK^oF UXob'd=7`C"` $[p֛`'IaI$qAכQXo""7]u $LzW ^+((P*n(p/f (/MeU( m8a}귨<0gL辮9Z2l/ǿ\^wʏFS+ n[!JՆ e„+[a*X y^KK\:aYp&Z?hG}$[rC ':ՋEP1@=郍;J 0_7ASgY>`<"B46AAX(Z%է tbާZ6? z4_oѸvqKa{[uN̒"OMW-ih]_pe9.6PnjѐoOՍVQj֎|?O]`ye4e߃qL59]SaW 7k97kfab1NӏX ͏A!/Ö(bf4E;=ـUrqC~/1}n^a! -WھCֲJ$QW5d'7,^m<"N;H8y:!G^c|i=Ƚgҋӌ^-i<ݡe@Af5uaQ׵}=m3!#nK@v,`f/?b'Ql붍Xn֟ߋ][w8qN҆UVqO7T_}w]_EЍ{!N{wNl cReR>o$ESXMXHz!09 ]b(=ot f+gTy'#JsO,۠<ҭrg)|ﺅ%_?#ʥy -5X9Oæ7|aSq!TEgT'awa?"#LPu \E}bCG<]'<+`GZ618 2^MPj"nݽYD:Bھ*vӚ7|vP yEQ4c -K7Kecƭe}[eRNA4?զc{U7.{ 5'<*9涃菸Vrf>kيܺ(om><[m_¯ydC,! s!xέ'<jĬh(c==1EBx,y:ǰ#fcd0,ocm(y>:X͢nN[-U9?$t[{ʢVf_G#uZ~ɶ -W[sؿ.7!sye1)v^zȻ% -OT" 6^ @4Lֽr>?Nѯ&^tEeI7ܱ3Gjy%O?^t¤?Zeq4墉.pD9)fQղHUv))1ѸJ6~= Bz+֫I/b~zr)| -[ԧmwڪNBUĆ=_Y7a5:ݹ5svAvR~s)QUf;R:"Qh3s$RI'n1R -5UlYSfJYE!1lw*v1⨎&~ v++녶+jxiKWahDU)3OB_ڮZ%<6xIW!4.Bl_~L5uNR1IZ+ꪘ)O^]Jtu:U+󺃻6֋C淺V{k'6 X*ibl*0B7}2Z+;W3, fO< ?旔Qi^Vy7ܺ3E<)毸(:l:Xǖ4yܘeWKJ]TWm/t;5v=k i|icTU蛃tM׮H\q6CKˈP\vfLd_IzzWXMGm.܊. B`_+M+{=ɾVjҷ^ZJxKsϽzegkӆF -hucƖmIJVdjl[rKM]ډߤrˌW%[ 9֩ƒQ>wRKil[7.k5C|LU6);saAJU~N="bTBb5p㽒H+k;&V_&E*_'gKJlc l5S-?y{2oKER/Ao" J/q}{u -endstream -endobj -723 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 722 0 R -/Resources 4 0 R -/Annots [ 724 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj 724 0 obj << +/Filter /FlateDecode +/Length 4812 +>> +stream +x]]q}_V&Y?8q wf󐿟CHG̝VISW4V1始S7U+cPBr&uϼ!%o4r*A4 *.Xc3lNR kLTf 3LVR \TZmu0DYKFi7xttF>&D]N#vZҥ{%%-N[$l<)Q[L $l1$"l-+- .EkE]N:"tZ$QAAK8RFlt G!FadQG;>):?I\%` VC%.1[2H\`Hѷ<->`!&k%.c=^t 1E]N B\k!bK\r$q̀N[ B-* 2t Ȗ.tZK\ lA4(qA4L$.Z]-(qA~ȡ&Xi)ElMH\ɋm'q?Xlb#` 9+qA&/71f^o -$.H9L4R$4V˼ތ$RXob'D>7EMI$7Nތ zytx%0"2MD^x]@|&+c^qF1c@UL(p/Us +Hbfbe5[R+1m'Cό!_d´뚣b؟xW81SV~4E|i`!ָ|h=B;ZAS- ]fS=}>;/0daUU;M=6}-mtllaWiZñ0ocЍBi.;Uj^oȕk{Hl!q$s:$naeTHHzKR2UQСQEԖS;n%u(Aw?c8:wRve6 \ uf;VKCHS2758.? ijsG%?tqfpa񝲃6ZcuN혰Fn Q_TG>Bs:ėaދ  t>Ku¼L =n97ry]+CPo6q7>>Xt ~>|%>dr/ Qr_kQŶ˫kJF,={$P{P_}".|4*%,uܱȇs6سE$Ipݭ:|My'lF^|*w tLQmuկx.rhsfc?뵳eߧws:˅.vb#XV$xQ +jk.,ˌ8 +;ai+C94p+~uZ'OuNƃ9nǥ@-W5+vs?gK?*Re9Rwnܓzh { ~Yhϕ>HكuN{;{^ˮK,s 6yyrLg3I?ęկBM}j5"<:gCb~|>*:X%"W+gCѶ~vܰQ{oD9wS}8rn?ߖ+cVGsղ{']#Mcs76's:t8:>[/XM-sxrѝ0k+'ޏWD,z鐹I=يCv< Epl:gCpɥ{5}׼|"6=Xtɯ²Fd*X@{_9-53'*{虃>n}U|{9vbwGs!'uֻ/;DXNKY^y0 i;F?p,Q֏ ^Yz>ϳv{K˙`ӡq'GgC9{#83,n9Fhۇv<:Cνv;!~1S/o\К⺧/pwӹ=c]+װ.~||/z;!]󻤢"0cuj-*X1Tev0i/:!7QM9hK~uPGU۲1 /InPT'W>W&wZ~U⹟XKqz5I|5b3A˶[]&ńn)TtMllGծMXM]&.8-7QUZ*kT3*U+%:NvߩҴ`V=Ʒ0 Z.rvM:Rj*=LiPX;^}4IC~ :#ǹ(c"ÍYogLlⷋ Bi׸B=.$nGҤy;feT43A +λvNf;}e+eݥC8R(I=6.cy*yź3\Ʌ5P~NUkwWmb_Cq_`X2mtlgr&6zv2&l(.6${29C$|xy2__ ~ܨrL=Y~{{<(os/:mXFMc+ +7mU#RRWU˅! +]޺^{Ǧ9!i(:X~98MG%_Y8EKVQf H~~ˇ #!5mn7]dU"'M3{^d_f@Vj7.d)~~X}]Aj[ MZ(Vm*ImNZE TCOJW^ +5h?v|Tj':>*~Q6[<^@9Sd% vVlyn;?wWv[dZ5(=3wuT+Sᨭdr"`#K<\g;Ẅ\ ?cD*hmń7(Ҿ56mVxIu +j4 hJ? zRѥ*b'SC-C]d +endstream +endobj +725 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 724 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +726 0 obj +<< +/Filter /FlateDecode +/Length 4821 +>> +stream +x]Yq~_Q#}`%^ k%V~Id>fU5.F"2Wo4Stp ~jEar:?0)$g\p|諙RF럿g)X ,rn +8/p)I,ڲĠĂdLXbX +nY bIbA \XZAmyDY#<%ѓ$H -UőjB"DXYP@k!!+aE %xKJ{ ,b* ,FOX@.\)IX`)ab ,P:o$,]KKX`֢ȃ,p` JX@]UFFXuz +QIX@]IX@]D^05 EnqHX@]CKXG?J'+a=xJX&D O@I%,p]a>&qaB˓>IXTV|F "wEx]mw78 F aۤ\WI%,p]QxRH"G'0D ,HX#M)/aO +<|"Ovd;@i?Q5~_Z%Zm5ZV mڞnD`s\oSNRni7_닆{zЭ zv_^iv:@gRp窼O{t=lTlH[S L]봔 +Xӗnv*^ uhβTy!QdGsDmXV[l1̺ږ+@{^wlw0,Cm5=f+YTgzeyJ~׬]}SNs|7 7 }54Zsyny[<̥Meo뺕oJFw\)^(:/Yf羝j̺byn`?w~ 3cү]},:D;˶oy7d={r>,j613n `$=kksMŦ].k_dL_/˛.e;_7>gCч+[vGT_ѝyWf]ۨڗdve\5}VBCSi$ːF䞞iwf}* +o~#or;:z_"77myG?m쩼d7-|`㪼!MpĄ' tR/BlT w% ,<.Т{>M1O{/sT)9L}Oc9=Ԟ_d~O{Gi 2iiٺWߠMR4u?6)b^"![}A8d{ZUdmRO$+:͚9"_+M qNy]:֩}xZۼھL-rڙaUR%rۜC0L兾5!q.^28*M|?ǰEg’u|Ţ>bf,M)=rTLq9s:Z?WAvgh,7y[O2)vKʮ39 +VH \EnZݘ~޻iƋB(WtNy/v]/z4v(r66"~=uQb\,K_fkumݖK;f]O2OSX6>ZҫS7rNy4>YݶjE-3X6_Vufgo ;x^YxwrwtcqdXqG[.ꝘW<~ym /˘7/Yw ?:屚ǫ\CgnK{O][kn_]P^א˺| htyu;+ʺ% +Nr][yz:~m7ώhm!z+/;偧_8Wz:gN;y[ⷛOGzy:燯,];x<` +k3Icf!Me-ߣ=vyqayuqz\X2ددKObj s5> k=1a-dGtwS%bL>=ˌ#jVs:|3Op{K~Oy8K SEk/Փm7bnj|bdsP&Be%:owb5hI"6 h~6GiV9W'^L[crWp6ט+LjU;,rfuQHW=?~cM6^ Xk_vKi$ 坒<\"[v5|}3M~dya8xbs;AM>> +endobj +728 0 obj +<< /Type /Annot /Subtype /Link -/Rect [ 101.433071 490.323057 101.433071 471.573057 ] +/Rect [ 101.433071 570.123057 101.433071 551.373057 ] /BS << /W 0 >> /Dest (cb160-1) >> endobj -725 0 obj +729 0 obj << /Filter /FlateDecode /Length 4717 >> stream -x]]q}_@g$an c6:9DDZX뽃-UDKRS]%Q/Z%bLO)7XL  ©䣻&v)Mv.ΣZr׿UֈCQ%29vQy%p)q*v -0æ8̰ZGFaA* T0C%Ci)Y 9VǤ Щ91tIx]t$s)k%-I:/p8.buqkL [ [2p\@$]]XO0Z XU9"5ЩqAV`*V`-%"= x% `tr\lPS9SN6tSエa A Xezqfh%ԜʼΌDEv9.0JL` hO^l; bV[Ĩr3r\#lRs\lf I$n2q `\f &x̸Mf Yࢰ:)1&؉yآ yכXo£gC17.ft]x` ϖ[K xe+F $aneC܋*1 k$6h3`ZRI6l  Qy!`Ό!_d°뚣%3;_t &)RV)aV|JLB;Yɓ@K-/nVM>a N.|b|#̶iLҙ9Ү@]caˏ_?#` F{@M9KǠ$祬Rghe,ǹ[˹k&*e˷N ّˡnDzp2w]8 -Du9Iú۩S1tUhtK :Sbg-2ȣZVcQBy`+wi'<R* RĻJ`~%=^Dr\y6AZ;d_"l9tw2OS/1^Z|ޒc7(F+Aps%M_ :-Z:e.@5/A]sϋ\ti8BXӡS9͌﵉> YLr㼻r8qp |y}#9ijp]\HA7{F=9|77xsyΆ2}߫%hzƱ'l[4ZI={ߖ⮗J7I+#$9iW,ofc+iB]$7ʱ#9b^16{3e7iɌIkӯK,^G|p|r]֢7yw[Jٖ5Ei_:$Ŗps\?{Wr5t:cWq1m>Ύ|Cыm7rdgOx9yΆ({˙=ѳ}DLE1t:y0^wGQzqgt0{'t]) -Wv/)7՞;^tODk|"_..Zw1!9hAo||=t= ~>|%!7ëIЕDmҽ0Уm?W+`!◟lYx3c0P|޹A:~3W;%126xб6`ӡu1>g}EF>wOfr,CAއj'GORQJ>nK|: -_Dz":lo!uTpխ:Ժ~ JfW¥9,Ot,Pu]'⧓͡Y;}FyNXAˊ7s6,U;yF~$\ (Voajķsߏy%ӊ[㑮 Ҕy"Yѽd5th6-&v?Xq]H}—s:=g vО;mp;(&\_'ùyXpm -yo m^Niij՚[Ot~q&.7}ح&x -~Le-S98K}ᢜ?dR7g*Ñkp6O{i_8P:o{V5_H׼QĢ_nRSêNiݟje^72%OSxQɊyϻeIu9iK-2b͠8 CY˲$3ԧ4N0+ڕ]ɖw$2>.sŌ9ڊKqq6 -jf[mbe$PXb;զMXMMH:']Po4sY*ebTRWRhάzkyY lMJ:Ft\PSŖ5o4XMmHCBiZsFou$6&k\!]RnGҤC^K*\fVIUn$*u,ʆ4 -bII-&#y*yŪ3\IU(NW*^*rW|P{\諾\"MTZٮUF0B7}eVv~I}9lqo?_iNQy/We"ͷbR6q-+[ʭ+1qPw/:lP[BMbK -<5k۲F% -]kC"Z2ֵbud7mžOM8Tcs*il:Ӧ+)g9iҡd -,[I+M+L7"mEt$ \`COhVJ觇׻}1ٗګJei%<^jS>s2x[ ղ {:9mh4®N(F4lKG+EL. EVK &d+2]qd[)TIL[^hM\nd(C:RV_222OsWm)Mml{%a!yesO3cgEToضDmU0\Svw76yJ+5;5FE:VޖJlIX0Fsr 2,) TOC^*4mY-c[Pe.|2 - +x]ێ}gI@^ <fϡ$^D.LfUK<<, +|)ײ>8O9#O1יuFc\05u_\5# *i?*M èTB2sN˨p!p*aVzr0Co8JyFai'i +0C99̐8F%JVC֤4E[Ndg}P9SNK#9]謵s: [LbւMq: [Ȓ`uEyG ˳:".Pgךw~St N'egMbuQ$-V`!8N0gFINg`RN:؂@Y"(#qrAiN{9P>t9h@i$$tJrD@m9& [4F.-4` p\@[& l tEV i9. .(P +8Hq\@`]2Vq\@]r\@]Rp\D` qر# %)a8.@vX U^h 4xW9Luq*[fn2Bq\J+qҁ wA!w` )u +n +?fL:wGIg-Z xq\`Oq8Ì8.0]I9xW 8.0] p8.I貺Љ= ZR`:Hq'r\`+ +4V[+ @aˌi8P` +N=Bqi@y ``/Xq\`stpXpm8.pbuE;q.P8[H) -p8.G ]]hO0Y8cCr::@׬C'Skcs\q̀Nj \-*`*꼂g$lq<]+oYtz-GD#\(FJtFbaw}u++,V+ ,0Z";r+$ :Z1@ee>K,2w/_?|?F._J5~w6㵑5i7FW?V]BO29桦N1狿vP:;3ޛQ1&Rq}w8H!ckk ai\K{(=&VHj~e]Zs.uJti5tZ؛9lruaO <|xŨ +SIgz(2nOhlgd_3vdXE)!Vů$w9պ/z%t'=rB3Z|27[u# RVQ8\sG5)ncU>]uI=_C$rhK +{<~+׾<׆gt퀋*{>su?TϤFn#xcrv9ֽ#=Kfϣ^Amy; U?ݽj|3(ί_ݷBT<%mitV\`gӡjûj∳@n\Gzg wsu*ڴ~=1׏NA-X}])9cF^Ϧn +6ݎ{cMݤ݈HQwŗ(pSvsVݗtj#i8%r-ϢUS ^}BDv9B7&Ey ҟf5Ovt{h>fd.kwo-ܿޙt݈ ^}%!fóY+>O{`Ey۾-.W ={ܙtgO/lVbS|T_[ڥ/Pl6ڕ3UX\zs*|'I;k/j;#]j:&g3aw'?}{TS!|2kj]\Y@LBn[y>' ;ݙtx =yf!=ݮhr4];&64]D4q^5=ް+:?mvhlg=5/t; n_,tAqeFRjG]sgS7ۨkv<^ +j$ 3鐼R٪=xK\j*sqx% we]}4;aڙt`=iw}zg$F쏘Sކ[%zi'Ic LUF?a:y?z6(} v9~7b ~'G$ jԾi=+fE؎z]&qol=gY; ~g%?mq.pw7ʞM,uEew9R7It!cD n,r9/YCjbJ:oQq>N6@k+ܨv1:"~Ǥ6+IЫT^i\04,didRrU*c3Tmf͵ԮK:1[II7-6VMV]HE1ˌ,'se-TW&Cy".v oĦ[qOy+UbH >4Z3;?~,qo.4Ȩd<^6(Ԟϵ4Xf_es/--ˢjQvr(\dRdJD2dDlc,{\)M+M+v6f-QvL gWNֹٗTd4^[ ɆI/{ۍ endstream endobj -726 0 obj +730 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 725 0 R +/Contents 729 0 R /Resources 4 0 R /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -727 0 obj +731 0 obj << /Filter /FlateDecode -/Length 4916 +/Length 4936 >> stream -x]Kqׯ 5^+E`2d - M22d7ES)x~tQSp -rEfZQN>La -ə௯7\_/uL)yo?0b V`97`X^ObJ b@1(E' V[V&hXC'VCDQD<&{gc2It0NK4y]xY\RZ94xl Cy`%^,I/BxWyEy%^KH%T q3M.Z$֓oZ# d%YUFYBx gCl50D (HX#M)/aO -<|"Ovdv`&9"XGhx%,e$,o~3HXdA'aAR~0Y8xJIXt~Ӑߌ$Ozo AEAMI$7NCH‚=73DD/"7.dx]D^\`V+ dfg3 -밶)jĜIL@L,XVJL(/1`œ}STfL9Z1{؜_.~{//ʙ ҄ -$!eYB 0wRK4]VBTjΛ1'NcG`xlΡ1AZ)Iu>\֐s!_Qȣk/V|_wg+}жΔF +I奿U>P` <"B26^A(Z tbN|tqO?^~oӟၟ^.R-m ej@́uf[CazK7r>26WVy ή2c~YEOoNҠ*[o˿~Z;gU-~2|ʗ)]љJ[e9L_uǝv -T=QںhvQͪhpov޵k[L|sur=1]lӴiW:|iq4Bcy' sw<#CPv{ 0>ћc7VRO;iMsZc3y8Ϥ]Y<ǯu7̺ŧMxX7YZ7IRGM=4yy~lZS+7avcnkqq؇sq˯=[gK[&v>k-3`7^qGyy~bdF v٫3e.o|G\yyAݷND%X[UXjȩnbέO6ii9Fhx0uoNߟ:ES~Oy4ϵ7`0y;^EG8seee6;'7,mӂ[qM?-rc /pa2嶋{:yȢ4[meb*7 -uY)K'-埅yP! -!=:7mG˞H]nP8On/sr:D*Y~z.*Myێx?ºm'[/[si{e9TbQjVעl(<$Ͳf2V[?s{qi(r-v2#y|69k;ͦZ'8z`ȴұ\?ֳ,_ΰEoݰ8_gʶ}i_wtSw9B)׆+/~:yMBRn^NAs7[7QU&[|A7]#_S8K[W\ˠ05m|~o?vu3̫ H'3L=?&~*xyAx=wVv.4Zl= .<]M7̔Zfѽc59Yt?>?2&Tp(n#=b{xGzңV!L 3'c[,og{iXu"Ykۗ ]uMmx` -F<1/ǟK9%G-Xj*7~h*rev=z@W?Άs}<헛~<%+ǰ1O|"muWOwoʒ.fYzfj{J__,M|B%\er4墑_/{Ȅ I2E6Li,iݤ6qe4\ߕjARoߛ;̣W^=q˕Jl R_5*Um뮑 y4W7bW_ʚЙsx[;R_E*4UkTNTj'toTi`x8rHXniUKZ*h\ƪxuPI7G-d> Umb7fC] P5P^O]UFW8͟05 ߐP*'T]rۮZ'<7+y+ꐤMԥC> <Co?u^Ǎha*JO[ -NhFֱu:nLԪ쥤+'Îlm;͸mb d6m/m;#l,,H~8gے|mK:deajd;g7徺.KxԖپBˣ E0ӴG `jJ}u`L'Sm˺|`Lަږ枭AN-E5jKwJ,.@SV[ E&T+j#B)]oD[oreūђ9ѩVƒQvR+i m7.5A|LU6%߅;s! *?9c{I:jNE!_](v7ϕl3"%WsLd -Pt*n(WKJ ̩M&(UeP UoFgVh +x][q~_#@\Ë8yWHZ={8fUKc)~tQS +JEQ_rq:?)fob_pɓ_諙rF_)T*~ Ĝ%UEr +f8cJ0úVaI*J+ءR(tON)lh$SN{-BI9ҒS8 Dl1)ZIawKJv99'2t*Ŵ'UNVaDBt峨-*#,lqt ocJh54ZybLt%0$ +$01N.'Ivr%LʓJ4`\Q4tFKD`l.HL`5lq$. l ,֩%.[tpaqm +N kX.{uF ڵ. ,x:$.p]kSXdu8*J\FF ɤ$.p]wM 1h%.p]ik (Gxp`%.| ,wu'iդSxN>Q'qa˓!K\ L'̨F3jK\8L&]Q'SwAKF“J`Q'IK\2P x{ wVUa-6 @a+i2` +IU=,J,qAҴ)qA$0I8! +6c dB>Q&\{ DlqI\z6' - -$.@D0e[\E\8؂HQ0ٔsDW%]0SkQQ݄XK\Ԕ0%.O.I\3Nₘa dK: [dK\H:%.H  UfP`ZtN:3I\\(T+M0- ?`&9X$.Hr3I\l1H\lz3J\lA'qAVa0Y8tJI\uz8 0.i$.Va%0n ތd[p>WX#dS_!FGۚ,˂Z~-r-0e}ԶSmAsy~"iBܺ)ttqNuҬ8,zڡm/K?6nF?[th<*G86 Uzu j9%3ljӂ9F("c@hg@8r;6c=GO3/3BI7~֙BY͔U2t#<BlBVoV|ǻ{ȭ=m܀[m Δu'/_9씸̊I. :mE֠#bX{H2,݂2?`vO}st䷼kfS`V,S8kY+mCX|2{TϺϨ#y>3˸X8FNrԃf8U70^:1S&D5d| +sTCuJ)]n͓B^ns!Ô=L}P=KOM`wNlCMkEwiw]9o:hK*97Xfq@䠠= R"g<ȁ6p'2=c2TZdGKPZ1OFfD\s)l% .j6.;٧ +0:tX<φh&O݀˭, +o, vawo8vcnjH[IØX7_vPbE[u'< AhUbJmK#ovkIX7>Ͻ]~͸-ݶo벌^ʩUاMY&'<*1Nn{21tZ8 +ʧ;sy I! |yyǂ2t?ǶR^?pHx̢;vqc݃y+#?ֱw<0RZ'`:G=s2ӡ8>m  C8+^4xyWOy:ǫ?_!z>Cmlwb_ʾw̻м9WJȖy~~=x4 +y:ǘ]hx^zcQ_]48dgCV6&z`:^>e"E6] P#N<d\s.A!,QXM͇ t73 r@pyŴԪ jsG'~(?2d$[`#guy/mtOPީ{uUH6kp}1_=IYk7X}Y৖jE/5ZnKJxMrm\q2/y'I|T,)*`ǔOjGkk(-NDoX"g[1^MzdLÁM tC ˈ ^(.Y[2+i' +Ku FХ:קY^tV$-;++{?<C$mޤ\FFxԖ˰ls-=ʲlC eԳ- > endobj -729 0 obj +733 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 325.323057 101.433071 306.573057 ] +/Rect [ 101.433071 423.873057 101.433071 405.123057 ] /BS << /W 0 >> /Dest (cb163-1) >> endobj -730 0 obj -<< -/Filter /FlateDecode -/Length 4568 ->> -stream -x]ێ}gy)ހ$AaX!CI*=cvJbI -R"/ONRx+o(1;۳U{~ |a[NQg-btZ%2TQY+1*.1FN3'MKT0* C^* q*JIءH"¡Judu:53F8O*NsNGF8-VIN[l1HV[tyآ;tV[E#l D.B'KV`tJ lVAri⤍X#53٪6(Nga֞Xls lq$/q5q$(p,Ch@G+E -:8"0Xr[3a -p\` ld8.0`[Z8.0[Qq\`$paqMpqJ5N Hs\`:q -5$55Yl9.; -ḀFIqw14U: CxWIxW{VḀ8 Vj I; l4X>- X ӆ4&4 ,xWE?fN -q\`*`X]ʣǙy^ʹqQ ,x8. xTq*OJGq"nB!M( 貺(d  -i `V8. 8ޅ{8p\:bq t̜F*Sp:TaNޕG x7M O8.Q{q:| [ Xl!O qװhqװ!DTl\DDDxCr:EkVSI+ H0:E[0U8.+A#2t - .tJq\4lA4qAL'9.Z]Huf )T+M0%- 0>im9.M,sXl18.Af آLMqAQ:d @IqATMM`^f &x̼ƥ lQXlAy Nzlё8.Υfa֛ٔ@HMϦ 68xXo"k=3^Ҋ3 l@{<3 ߴFb0+ج*Ji E3tӂݗ5G-fV?}{φLYQ҄ -@G Epa4X禎@S- _foӛr/>>9%ä?wOFb-˗i '֟2eލI7!;oNV1㦽=f X|-F{r]_CM-:9~"4-qoJ~O}7ކ}U^_,{%t]i8=P_{ 9<dǦ-m@~۲ylu S;C0UǰXg; I*v9Ȱ"]یMFD`3'n٪#^[6$h;ڙ))#oGr~_B߮(Wp(\7 ,R-: HHh>R62knoƎO 4m 20}uƍ +H-s8^o[σ-o# wy挻; -w98ֽۤ>(mLxCWQPLjޓ4}lrԍUDPn;\7_?#]TQPfP+kD-+Hlbyg!z[1ZzϤ8mW|i*K/&E#ݧo :o_G:GCkd7s|v,h5t03\ZX^5y> -(&C|q+1"on_áz\ٮOYmqAfn]v]'ͨ{Q&K-9uMH̑1\޳vxY-.lܾ:C=e.c7ب]Ak;;s{zK";r;r/[]9wﹿE:ݶ徫LIq^Wm*RQȭs4ƍ/ɒwE!zwк/}1G}Y}^&7v9j7wą?^ѕ|޶׹c;;ao!h3[uHvk -T&=_cB̀7ˊ'?wCUߑ?llz}~3-*3kdBf .7g[OC7!xicT)H_uP&iQB͍dhbHC\z%9a±kJe;5} yxK`G};gh6`5, {a4P:mzv$ҳ>Ӿ;ARyбRs^C)58+&tiq;`*a'(Hrv%FLwp*K[r"w}IcҸjR}][HBfطd<1#DMtRIvX LGb] ekXR(UlJ;rsUXLoN5ßj 5Ӛ^JӾܻZiEjs2 TƉ]Ns& f7v!J1ˉ-7fHR*Ԫ1|5B݄lIӖ&]<24 d*~>Yϔ+kixtSdeioHH _HQ=IEn)]zl&mK$Uc.VuE(,OV(8]癸iTɜjnKU -w>b_F\ފYxORZoWOa *4> -endobj -732 0 obj -<< -/Filter /FlateDecode -/Length 4141 ->> -stream -x\ێ}gK ` Hb 6YH,Br6 }_cVq?e -1UJTΩIR Z`$`k08Z̰& j-`f&+S%5d Й`%3.)ｋaKH:[a֒0 Qtު@ע.Bg!+6 R^0:[T$.+R"2t Ȗ.tH\-lA4(qAYC#PK:9όD*` S:m'q$HsDl!hs%.Xm%.6s$.H ⓸ ir,qh:%.H&"ߴ,qe74MxºMs$.H [BQ[4%a݂o$-6oF f DD/n ĜoqIҁwz p|k degw 4[ o= 9i3YF/Bimx ݧ~>3| ˂לb<}vʏA0fWX6ao'6;LRB:و8oe#r~j ^}vx`_}x<7;exlyqw~W?\hu8ueln lO×n|ׯ_9m#vն2elJ{z(7hk7\+SS?|w%8yx>V5x S -rsZ_2(}r⮌>ڑlCߗ '.hFt~\DsoFv u<\q ; W:ݙ2]̴.yzFFDvzYOrE/ZcU%>eRWpd:w_~x |tS1:~6#cu;4'NFMϗuf2r^v|Z0ڣ{=7؍6_r -|~:oǭg־ -f/z ۙ#)3*/+%߳sȤĢ2ig'2:ӴDHes +@Ȧ^޽:XkDsL=m? 6=X+5z+b}u(SC:wkc=]awgGls7V{Ph]y{M̓u u|;6ퟎn{YȋCn'i+OC7D7K}]Aƺ=DswklqNGE8Ց|Ywj=jq|t/+ֹ;4yY!Yŧ[wX%q-ë~?sw}_ǭ7#OYuȓwT5{JWXl-x(ֹ7g<#y(ߏ\PN! -Wy+i,uf/:,veB P>n-]Gl!톬T$Uc)6uU)O^讉]Btu3o:nʝO87hjom|^&ƣ8C?NZgRhFONwmIr49K&|dIq}eEX&q+[ʭ q83ZutB7+h~ڎU׍KISTm/tm ;еq7ak ڹizI CmUo騹s$rҡeUE(.SlafdIl?SA #%5777]d]tES7̦4-~z&R{>zcYZ Ot闗9_FEڣ䴥B ^\U S.EQTLYm1\ tQPc&iJDϊ_W%VƒQvr+IE}o{n!EUs/⿗kaA*U~a^plYg{p#6nkunwD^IC1&/EWtMSjI<m;AQ!T/CNꔃޘ ڈ[C&opYlL?( -endstream -endobj -733 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 732 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj 734 0 obj << /Filter /FlateDecode -/Length 3178 +/Length 4749 >> stream -x[M$ 賁E>9ۻ6X]Xݜ!z(|T:G"jB^/Oj86|(5d\C9rh_O?|s:{IϿSp֘Q(;C)GT(`{"$yU!eO5$`ď5R%DPz"+"Q# -^y\ФM=.@` te4qG7l~6ǕAqAkI֠K7=Bd|X!N $ .u<.ωE.%#EqeISw&ɓ蒺x\Kfi#ws3y2.2q -o"ě+3_tX[#jU3={h5l=5 -!E 'NU;T ;B=ǪT۷X|?lod R4f;u ym1pCfz3hz{p;ؖH=zılnC^;j z1#1vwpΫ΂]ՠkЫeϾeMJŲA||7#:&.%j#q1:v,{_x-c}چ2o|!#k2#]Wj5C \Vׇٝ&Z{yKjΏ_=Xgg`7c{ YWϏ_ f~ { / >7Ⱦ,|& _%~g)~oNlTзU4oNϯ|?a>|b =G|; >/9y~}GUrk2u7* z/A7;wry |\ٱlѭQno6 c4yΨ]zi =>V{+m#lze ?#]{YVT`S{?eYBGM?=SXc;ow˟|=8>L:afJT1iWk//z2*yɼ6.8nen|K31)|Ծro)>;{j,bft^v^Pk,fmÿMGf?@s&ǕhSϨFPyˏ_4:Z@GLuC̻S^MVOgfsA[o&U|[bB~jmLh&F5CgcxF,-P "uYBch3,yraoFjdPR eC麉X&Yq&2unւ}+ڕ'!C+pPlKkI>&QҪkITy(þ4;i;WNk_`-ZfmFa f[ NAGV'̸E+OҹqbX.3p\0* ,xWjԜ+UX.q0I8`~tY]D  -) 0 O"IX$qxC9.p]LVk xW=8._-3NB)8xWH0 +#M O8.`q f; \cun± ,( pc+آ+xSl\-9.M!q1*sj +tts\ཙ0K = )K G؂q)(xN8ӅNJ -9.*`DSs:#:3p\q V`JV[@br\X:آ ``37=Qx|D&s\N Xo*qeZo Xobnjۨ]Zoz -. +-p"3nIXo8-* si8.&'c3R[2_wXYÿZ},7 L @`$? XauHJf\Ŋ9Z/6^x~ +}y aou-aol.4Yda3_1&E;yúL\klgshuDz2sXǪf]8ٛmiX`bXށئD!%u!փBYuY)t]d-)[p]oѕt5$vhPfun7R{[_l݃a/p\^p0ـ#dW),h5?lRC@;ۢOӏFYbulK#Ď9b]n#m㟬N)CMGU %G|]\iˈK{Ze>14 !s,yMonjarQ|e>U$S/<w_Џͣa8z'FzknK|{/+;{":t;x +Y{n!=Zvk,3+] 6&ݡGoб&z )w=CUOO;Y;}yNXAˊ[5i +x`0ِ mj9uv:.x!;N{Y\]1 's:Lx=ugF=عSœ=zN.p?Ϋ7 XڋQy Yvs|$X (Voajķ}ƼVx낽4eHc>rt-+>> stream -x]ێ}y)$# ;V|ÿyѪ5[VS1ŨPi*F냠 -F9K*#Y:WEA9yI3$p;Wea!I3LQP ;ZM䬠3^tzt֨͢.BgtΩx# -!$"-` %]-.8-`MI[,z' [$`HωHet\gW>9%1N0H! -: [YﴕtJ:w1%[-{H:[$` _b`Axb^8ƨ([H&(QX(F'р^QQ tHD4l$&p$. h4swVZAE wA!^` VY'q -Sak2?Vʤ$.]0|.+ߢ !K\ LfT+qZҁwZE%.A q7e4+9% `=^tAע.Ag1Tl$.ZJ%8 x0:C [*`*R"2t Ȗ.tH\,lA4(qA ̠%. $Zґuf QP*J\7JL)` hB/X`e-Γ)Y^n& R-V[ M^oF -$.:(%.C$7-I\f ;&xfx%.[{?ߔIAm1,׆A qBd;tM r kaٵ(a#;FRU]*:XsN=6HOCKHWb[^( .-yѽ;RbߏeDLk.gtrP܇`r.qhCGhd> b&FBq,(2-żziqt&\@~*XZuMBZ z-U7 -GBMݫ#,ˑ:9$;No;!/:ocrO+s [9ޯn 9(T_(w&*F:ڬl<*_J֭|l8N-^m]m9ϫPQ .JiݮAݥM&؝^ 0.0Iro+|_5F_-~rIkow¹/y|&nw}Oo;nr4*׵i-}b#O! Ig$%A6e>o.׻Yo<#+|TgVLvem[NH0UfksLy9% m漜خpp;tm44߈SA(L(`m1Vt C.ϣpH 9dN|K&eb{'4h&+w*-}fD^o<G|x4 ϪWU˴4{#Ou<螖bpjɋ0lǵپ%`/#F$ԉ֜TΞem,|=msg{ç7>c'q?di^|zkg}U= 5h3U H vCh ) Rd bi1ʣ3hc*yidL3 Bv1?,ǁêͧUfGyq}LѺ/ݡ5\{m1MVQweeu̅rnY F(gԲ6 -KYiO]R]֩@*,h1K\/66$j;Z<痣:mY7<a9#p[G{#z܅w>Hmqgy mzQ5eziZ-k 7ܜ/q6d^ȷzky{W_IwÏkQg6Qm?.^. {;b7ٻ_l+FnkY0ޛplFh{P\\ -zB׹=c4qAlLl2q<ܸt@y0VCrN{?r燞Jqݗ_aJ_ΓܶG(;s}j! nW{# 5 -lBy)!)c7@7#?Avd0ұx!gLjr - 'seL&_wP8z b2~nee%;Yu2+=V8?6Z_[}o%]٩bAZY_Igh7a/ƴqSl\R[ׅ.l]gi*uk(sԢjZdn0*7)ۀP'A:~kфla-0U QKk:At:|R5מt:^>?5vp)wsi='vqyyj߹B -Qr8鎗.wLGp*wDU&e)=W¾N塱I=`(Cwf2I t[c euOǡHq>~Ӑ'c8*ݲ ȱl?CḮd#uiv,J+$x2Lf4/~{}&,mޤϣ5d+ayW^RP+ Z]81:HS6'cTeJD2]eXm -s-Ib.ai?JD?J8KEK@~s=e% c&Uyݴζǡ =2=?K"{oNRտe'ĤLd|U!4;g[)%z? *&rJ6(uB0)UtX!KU\rT0ϊ* RU`O5p%$E,pZUC,3yE炉31_T]%LLtCt [BNt)'Ma EH%1:EeteU[lN2dfUW9KLd5s&갢0I1):[ E@k:-OJ9+&KN}bU[0[l`%|Jg|&Ù>)Fñ$:ӈ,l 5& [+W*qy؂ϤqmhѸ@lӸl]Ը@0j\@`\ʑ5. P.T4. p.;5. .{Ҹ׸@9j\@]bg5.`.j:k\v42i\]r6i\],#qfQ` ٲ .@%5H0x\>Xqw=qb?Vq=t4.@c#,Ѹ w]S4ʸ\2OF\Yeb,.i\Ϭq8z x<:_!h\8@7,ꊱ%g x5.66IT]2Ӹdl,P "xh\6i\:Bk\:,[eM#X5փ)4x:̰Z+nS゘D0 +̦5.BOEqAP-X֦P$[{ -4.@D`Cn`  RԸLfraָ FUEor] Ki\XK k\ +lRѸd\9؂ [D9qAѠg2ո{I c+̬qAh$TԸ;M0- 0?`&9P` r [L [i\Pl4&k\Z ozָRYBMlu[(~3i\P( h*ʺ'a vte5.@&"z5%etx70"2MDނxCB|+81ߪ ,*9 =4Yf VtVMX/1siLQE!g$Y,}sbt9?/=ϖLY8KiF|e ; v|/gnSf9f`c+LfZ~ܯ8NƆu>+l(C d$-o +\8g=`><$͇wΛ΂ΝmYT_m.e~9ɧU~Ҷ[ kS\E;|hjӞo1?_lħg`JqM,)X% W)~XTd0.a{NbG~5QzDsZl]]kN[{ĎO?QO˩;<WI/E O͆HѸADZ&;%"2=hlAj$ؖq7l<;O. +# r{!orjU?0[KjF+@tHjg7%\u^sǧmK ݭɦ%dj_isWq=el=tpY +(X0u@qwfvMSҸ_5{f4 :۱mGL7#9}6\V= ɒҺu v D7wZ+!/Mwy8ގMk)B2z}u-=ۄiXwgWIky<@+\U/}uucӖ]9)kw@?my@i.uHy圗;pהVہk;&Sti6wΣ!nǚ9[3٪y՞ϝ'^y9+h|A\áN3\D̶M2T/bΩO.jӊs~EF?ggw+~l=:;gxM/FFhC̓7xzVb,_U]e.걇xp7y8W:~,evgsJN(lē䇉#ʢFùhH;"no%w}ff>so%i=ϲVD K7OpYa2<~Λb1o#t_CҬ2yJH?SEhRaq/oܺLYw6Uؖ <~ˆǽ{uۉtA]ӎp]hpCxF2:7aO^!y`ZrpK>MLv-"NFq:tXe3c'm~d#䔺*"i<f7vZ6(Fxy}&ǺDڨIFi06ӥi9txhX{Ԃ4zh4jk0vU:F*k-jS\aY8ZLѥ?#YiYeZD- +#S:KX2+8nR%.mnH쑩EKιΔuJϒ q?(G.6ay}K> endobj 738 0 obj << +/Filter /FlateDecode +/Length 3198 +>> +stream +x[M$ 賁) b drXwm=9籺$9ClQ%QD4LyI Z|y:?Qoq(lS9Ԑc/-jϩ_wE[zӿs +׷*Ju(#9ԚrqD% wO5r$ +5쉠Q,5CTx"{(ȕAbF/,PZOݕUbM9*1GOC)%7O&%w,CEȓAV=Y.\\tI'%:ݑ5j P:ܛ+QQ(ܘɓ2|]" +T#KХP d~<x"sm͉֤ѓeRW]0]AAyTk#8H@j=H@9HY0A,cE p 8AT$a l+ t+ԣ BM܊x\\R Aqu9qvYZ,<..3teq1plqw9R@qf5Z# MK+1x7e [)S@IR?f]PH=d=.@c!!- wc4*֋ϕ+,-b) Bd.y\XQ+' Eސ=.;o!\ו@5 2x<.*I\Y pq8P +x{w)3{\P$H{\t<.@^։i$“w)b=xv +xWM JU 5 `@<.(MBx\P:Aϕr reEx\:t゚ qAM)BȾt.=.E<.`?zBkW Z%`)`/|tY j. {]d{\L=.h ]f! Bc/ S{2!g6 4 &<.f;{\62Y<.h-vy\tI<.o~z\ S &{\I<.@\~y\ЙωE.%#EqeISw&ɓ蒺x\Kfi#ws3y2.2q +o"/llz3VȀX{f@ _#P;VS,Fr |L8vd +ܡblU~9V5~|ןO_{?w_m'eG}#k1۩cN0k2;Aӣ.ȵ܃۩^NƶcG;䵣͠3_O,`Gz,(\ Z{9~oXT,kt#/xD5~v8טjl;EfƎv\֌>TmCUyŷC >ő5 oE]Wj5C \Vׇٝ&Z{yKjΏ_=Xgg`7c{ YWϏ_>#f~ { >7>/|& _%~g)~OlTзU4ϯN_~ca>cyr{OYnr}v]<}GUrk2uwk>v8¼j_,E/T]n6z> \n6o_on=o+;1cfV}۾Qw^Oe~ogtu1ԭ,:l k˽^6 52Qbo eפ*CO_>\nm%O֣o^f7n'zNZVf #G7fSHRN#dئ}]У!>ۊnouyo/m\vvuӥFc^v=fԔWm`ٷg9s yaޟ/n=^={_l4Ͱ̓5~h]5mH([p-‚'), +_i%qG"kuWsZ8)y9[s֣}X~\4]LbWjkN2皚b$3mkYMne؂BhLߡU*l_L{:؜H/uij@sZZ{FN}%Y{Z$#MX)lgri(+_3PJ4g .;sƣ^jv-lrɂnufHaFac$۪7u<%ײEf Ԃyinl,?^8:7ky ݰ^'Z`b[2^K4V]K:̃(FQ4AMuH4/v*X2FhL2k6 +S)0ۂmXq\F(:}W΁): Gy+cq9|eX +G c{l;: Ť `4b:am͵R9BvVPW+̖x&@ٺs]Us}zjcc=aR̔cߗĎ{?IHljoIp*|3_zL5߸*\!߿uryx>"n䴽fVQ5my@zG(m" +endstream +endobj +739 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 738 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +740 0 obj +<< +/Filter /FlateDecode +/Length 4786 +>> +stream +x]ێ$q}gK>X0`ȒA ݵ#?udVdeVOk;^ 3i?Ȩr t|:}>iƿbqQog)*orH.z1_wǜ9X*r*T*m^h}T(41gI3|$Kת3('/`YUqת 3l4$`> +*aZ:tƫNRYEL9"o$]V!$txC%l! El):IaEdA` ЕDlAI9 N1]'紤3Fy`Ӊ:x)DAgaK>:❶OxSղw;팤H`%$ +)%l%lr%lʊbt %p@gDNOAbg` sElq$.p KN%E%|K fj ץ@8P.%.p\tQu>X hQ +8#%. s)` ,qQ9uFG  7`Tp$.VMIK\@]4I\@]1NZ&H37xzm%. %$.PGxp`%.|u0eH\&c|lLA5 '2=.-zYI\$q8^aFxq%xج%.] ^A`~SF.+SwAKVJ'0 +@2F*qAbzI\:⒕q tp[*m FXҁwYiSY`0P! +D*$.YCOk/qAxP-I*$.8k%. dѷ<-> ؂HQ0JHcUIJt-t&J\#)LFTK\W.I\33$qA̰"q","sIg` l BgD$ ZXK%i^g& šp4&$.bK\X:[Tp3SFf!okm$ӯ0_줠iO'tk ~8!2]hZ4 #u)Ǫ.PA9l%V+-mn^n^U/0П2zoT"5Ίp3`9x(cCm0[H84ˡHX#4 TЍcsNC 8b^=״t%\@~*XZuMBZ z-U7 +GBMݫ#$ˑ:;_HvކOCn:ocso s7ѥXܮƎoZ"{Ҽ뭝iLUSF燌Q5vr0σ @Jq9bz"2Zj$m B2/iDh.Bւ^<0wXìZqg,?t<ZM^kWdu7PFNYl[t;j(0B9+QXʪMGgF[թA*,h1K\7P_RC<tcWQ_rTMR0* yZ9-¬6\֑nވ[@.wOGhh cW,_/FWx`AU38`C8xh1˭Q;6t=f$ou<Zw{zO6"z~$](["it^@+3y[=%նC4,{\i۴ƅh|,ϣ!8ގE⽊gq0~*^߅|A7g{M|߲ytVߚq!c]eO;-TCa|i#wN5ױ<c<]c&\ 5Gڱc}]rm wK6(`C({zƟ3|v"eyhJ;`?1=7]O(ȨJ=R'-`y8TDWO^=r} $Mx,!vv>󰆮 +)?Nh)/ݿG՛5s9~%7uY`kgTI;;RiTP4*ͪ<HYؑYq +so5_~nΩxdo3z0ϣ7<i*O==~7p݉/W.&:߰_g0=fDDGkcCF m<zwUﾒЛOÏ{QW鞄6Qm.nW}<؝x6j77}=h(6z'q{.$6¿}j|eMo\98̆$;0>Tpu\(_hm9 üW=? M/f*}i't,{rWҗ/zIns|0|u2z~!6\ S(gr~I/9Rek|#Sɔ5獜@[MA_GO.:LrPꡋ8zů'~ b~TŽG"N^ YG ŵ5l|.ȕf!rs-kef1')7_f +A {4b B=TŖ=ORo]>vq[ պUBU{&sQI}M8 ">_JEQS'a@.trͥ6RJ=k=MPwu GD~#ՏK1Z7Jx9yjLԾsz 6q/]S*fDIyC R|{ꕰo6FyhCR=]&ƆٱLBz&ݖB:t $c)6 uMVq(TžAu!v^ʂ[]wF!V*b~tm nH;qN;4^N9i:o sfoH;ωMՍ-lօx e領XVmؤW4yځgםkJ4(mе =o/^l̗MKWǧ*\e:קP$8iҡ%;dX(. +sla&ru=OP8kt]G}Ҋ! B`7^+ {^_<ɡzK7(m ci#> +endobj +742 0 obj +<< /Type /Annot /Subtype /Link -/Rect [ 101.433071 589.294475 101.433071 570.544475 ] +/Rect [ 101.433071 593.554475 101.433071 574.804475 ] /BS << /W 0 >> /Dest (cb166-1) >> endobj -739 0 obj -<< -/Filter /FlateDecode -/Length 4512 ->> -stream -x]M$9ׯ3Jh+!`%@ #!@kwzf9yvHgdevM3*ite?">+|Oz1oϗOOj -NO)(o7V6LN',0L.yӟq粎>)%o;!,M!JP)Mʹ)㼠z-$` ص* T0Ud* T0C'VCD Q֒tMNd `$NK4y]tsik-bt'%`$]-I.+:آҒ.RV%T q3M.)IMuQ$-^$`#e$IpbfɳiI`1:؂xآ(3hʼ$q aXLF%01M6h$7Y4tFKD@ -8%& [,f-d` -H\@[% lk tkU*%. .T(PJ8H=H\@`]rH\@]K\@]ZI\`D)` ,qq"I %id$.NXLJ 5QY ,x,.L$q[VnqH\`/q2 wA!N` VMa?aN&wu4 ^IBE8.3J\ xWVjI&) xqp4 MZ.M*(qX'$.Ld<)ġx.$q*G$q*GF5a -s BҁwK:R!I\yٔ,0Q8! -6h'B>Q'\; DlJ\zJ2F`` B LI#p RL6dyUIZEt ;a)`/5ELz @S$.i+qAHSE,ES4%-%.@ D[ J\M.+ Bc/ WK:>3J\r(q v`JQ[@`|fI\6:BJ\(qA(#qA₤` "> S%.CIG727 6 qA!DuAS-8 M$+qA>73DD/bo1]u $L~W ^ʘwQ(P* Us -Hbfbg5 -Vb@'\Oa/[[1#ů+lzd2;r+] @@%3%6ָO_O/=K쇯wvК?ӠSPS:7A.2?묝n~ׯǥ+ڭ6|;Oر7˛vu_}oNzW8G[\_dl3ggdN-7yΣD9xXzxR|EW5 3HQ{^o}>ҋ_l5jN}XϦG_զ#}mE:l -C:Z{WWx -hqph=nwB1~vt?쫲FͰ Բ0}H>XC0 m0>#I[7CxKn{ָymv^6 #sr:ƒhu avyGˑw4mdhYQ+t̨)>};C~/Tm7,(6a6e6~`SF:qh:63$Ui]w42|az'㼦ugTFk%5[jpz%pCT}k5 ӭe+k|.c-cr\W3njߩG1r2V+NGJ\X۱t~/ʽiJ DzUv Q -ep2uJ!x]5O1/27UyB2ˍa*UoG9%.Ƣ}7Y@'1Oax4]NT>NcMNT:L8V7j?Ry*QV.xNrx9;Xq4_Nh+AqUkZ.”ƒN:Տջ] z1Xkq{5YߎW|ޠe{XbB*][:߅t:͆5 -ni|omzW3*5%ۀ6Nr_4"lىWa@\$[smB+{T=MP/Ȋfi_(戢q)qCknJx99fb\JUq!v8.ͯ\?ajVY>y.{ -פymwf/徱xdkeQɞWRF50[bA{M&4~˺{-B}ĦAhbq7-Ա .P>Z ~;]G}I>&q%ZkXE\Fq:LݲlCA/vˆ|I]g2˛rB`ayia`}6ڛKۍei#*͉_EK ݩ^ŒQy^Im/IU.݆^ͭJ̝k! ?%c?| Ձ R{p_ ldW׹+YgDj, -:3l i_&WKJ9`"gWÔ%!.C*oAi9^|E -]P1[ -endstream -endobj -740 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 739 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -741 0 obj -<< -/Filter /FlateDecode -/Length 4175 ->> -stream -x\Kϯ|_Ⴡ $p"Hd#XsW&Y];;l9^VXvgr/NOh\47,e]M%1!dk9Ngw)ߝmw];X՘ykUD+<MғΤR}Uy< L.:WMJ)G%V4^,YY(d )XY|Ae⡝ -dwYlN`b-D*gK.GxΙ *#gs 2ik첞];fcK +k = -KrsYƬPeF-Ͻ->I:-c:yEP>TzOiIРEϩv4^#g\.AAٍvyom&t|+ '+xs=s=2 {\yO@>s1%'6&Po@ӭkִM#CJ%]u}_L;ͼak}HZC4UޘoU|d&竗'(Q+Ҿ [42g_;}o|{:A#N_Y=~exnQf891'O:, ~yux(Ƽ{;oWQ:7,zS؋y)o2*\\/_p_,$* I\}mGoV>).7Tlk;^ecV9fkg&wjQڢj&n%y?jt.p>^v]NJS\5и.ІR~^eцK덇ija>lyL8)&|oq:]o=,Ğӭ~M}ھu\%5\ɒOUɜV{Ix=uz<^VÑV"V\v~U5*GWuM{}L{@(I]PWv{vi0lt{UScQȴtߦ]>io㍟uL'}s8w;j&_1cXcqY: -{mJFh;i/#ypdh}>9#ugxO:fXva_M~Dkj5O󮲌?v R{] uۯ{Z{-| 'g8h&G>9ycpXfvf;8-La>-ֹ{s|U~ǐV얗d/+2^ks(nDFe3;s6|U7tlUEɖ:f^t޹ bP5zҚhk?Vtg]T3.pC^LwW8e"m]逖z5dl;wuP`?ԓyJJvmWSΑHCLM"{RkM/e;N_A㍴N(7jqvrJ]}.W WZ=!DƐS^X}RCbV|6Yj"3ۛkfhsYi6k[f7E5/sI݂\>fP]I^G퇣u%nje|ūRsumVk!{#^p0X+?*e{ -O-n(Q!zn?FPcQW7^_@ NY5O8_xx1mdHp+znxo vV8X*ĞbO̷x=T!PuoϧMk# qB{L3YаڃM0Y~ɔm֮[̏Ʃ9;--Wq|n{0]j qu?^nG 1~?8lNuಆ/f{JN뷩?D&#-6frM|O%Ti+fw'Wɰf{ىm$ߝe7 F2׏vJhTk:Į壏}5?n"("z&w$Qd~aP1aJC c@m瀳d #ъ&SCuiRuNYr´aOS>T׮PuPco9 BN -<_>4/{/F)ImhUf5?EPBk:Z߀&bĆqKak[r4"q۝qbo=w2tU!4;>8.ŏϫ9 o$iipg[.Y/WҞAwP=.- dhnp yGF;&KN{Nry'yX c\xidv'doG  0FG@'~[8L˸|υRp*YekD?[ė<@ ?uC_Vn$=8F= ؟dWfؽaq^n'n \ISzfeQ<63a/a~H \ 3%Ő3K^tąb:%ۈ)'gI"\B|&fCwZ[h8 9099iȣd"L>w:x:5˴9'SCc b/"g,-hs!}TP6rRͤ=Q v1wڭZʣ復PbVIڒ0f8yt}W 0͎_epF}!9ֻU.q -3#J˲qɷx~umࢷ%Zj -endstream -endobj -742 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 741 0 R -/Resources 4 0 R -/Annots [ 743 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj 743 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 237.094475 101.433071 218.344475 ] -/BS << -/W 0 ->> -/Dest (cb169-1) +/Filter /FlateDecode +/Length 4530 >> +stream +x]ێ丑}ϯg# ^60`ڋrl,j a) Q*;Bu"x '!K_/Z=Řۏ.j +N_)(U+&cPBr& 叿m]G_͔7]%,M!JP)Mʹ)㼠z-$` ح* T0Ud* T0C'VCD Q֒tM%ѓ$QH:ti޻(,lqIiI`*I[, 3J\r(q v`JQ[@`~fI\6:BJ\(qA(#qA₤` "> S%.CIG727 6 qA!DuAS-8 M$+qA>73DD/bo1]u $L~W ^ʘwQ(PoS + oĜ=4YF/f VJL(/19STp1LX}sbSlΏ/_~/( In[ M3Ie a#u!u#5hqIe#r}Z ^toHl͂bؾ9(CdvW**Oub΁Kf>%6ָ/OR˯ghM/iЩ'<Ԕo2A旟at0Y}ڙg\Xʽjɷ2ǎms\ޜկ|?}ZD3ALwxؾށ᷀@Bvo+_-. o3gdN-ӻak|%a0mRnĞ5nVe[f0Ȝ$Z"dgC{6x3Q=:zMZW]r9aKAǂj׸A;wcxOq΢bsV]oP;f1it61kc3nKbv>W0}82aQ#nn33Ĕcy/ެnwz7DHne~XCxߧ_Rlܬ8˞tH{&\) /v0;cp<;(f''<G-c~ NHz5'A ϠOlWVA6nRS}ۄ욆f+o+k܅*ʛ'<AQ>\os"14t~ٛ-"6g)MjQ>uYqN6xGc1픑6;=;2LWt7lǣzeOBZ}̋j.NQuCboe^ڪ3cQ嵷1s?^xzu>.Zژ{Yj匝pFa=s_{c&m +<*L3ˆnym2T8$,C,L\埴LAU.4oۮQj륱jUt6ŗst9KS8iF9Cۢ"42SQS+ZAHsvL`o;aUԋ.~ 8 eu!UvC<4$WOb\h\\j/j!*g_ Bz+w&)q7S6CloW<kRLBźbc=:؆wa3f_˚vA4JDi>6UGר&#fTjRWK m"Silz6kY+l+j9At\J^5ՑtSl/n, 5~\sZE.ζoҮsrz\H&KK)',*gpM|жA*1ٯz'ym6z7ֱhzY6\:Y>^:*|&VJʆCej놺&Vǧq%jbנw;][{kwb߸Cq mvVvF5o;cnH;q]ʉǾ${Rܜ!g>xke_{zǍjlaܓ忖O_O¶lXF]c/*7U'ZR7M˅!]# K7n(Y\ƮI\ݥCk (.Y[23w҆>oTP]0"_RfyUVAL7l54~xy}/&Q{qi,m'K\e9tujm[{Ԃ4zhaWL{*[uZE TC/갔;(St_H;>+m)ۭEK ݩ^ŒQy^Im/IUۮnvC|LU6%G\g:HWɄ؏(:WTb6Ȼϕl3"5W{tLH~l%>쾂5U\-)7g=o9TLyQB2b{QޘEPZγaB)_ t;D +endstream endobj 744 0 obj << -/Filter /FlateDecode -/Length 3981 ->> -stream -x\Ko$ ϯ-X/@d$p9h+6:|WPV+804Yt=~_YlM%E>>Ȥ@YZl.xp[bBɤ\ǻ.w:k)%:{rJVWX!\ -+Z% FH 4`sU K5İ%$e rXG 1{l0JYsqE%lr{`5^11Ɛ5CPjYe&Y"dѓʃ,.'dqNQxʃ,jM(Y(|sLޓƳئWy(lRL -AH<<9! W'O9+Ļ=ydq.ʃ,| \, #aKpqp次pJ^WX,xj@ x Y /aw 4,8x-Z4,[b5,[&5,\Ix ϑ5,\RѰs=SЅ' -E#aq4,(6#taRͬaA|)G7!K@ -0 &IE -kXPb|3kX0&"z$%Lj -IwF p|7$g:3KƙՊzVd@^VIWr$h1YV piI-aZ}KTpf$,p Ftslǟ}j_aiͰg+b>"\$`i+2ZdpFR*7(?DRe^ 2://!<(rBDPe*:d}tgby^&C?˘Tv -v9qp_n]߽9^? yq8ro_conFqD  ^40Hچ8y=Xd -7ou$ KDe#3!\,9Vg|q3 DK|qnև&lilV+//##8[u[]f _LviGo|8 &|~Wb:a}WNxLvUȳ:D,7c =֕*O+oY]V/-ۊJ?ӤaC m@UWǫmZiiݙn.D/YwuuexQGAHyE6$X@ -UVH/_қQ=LUXjչeNmc̋M6Ffl -67g< }ڸm];U{j!s=2^W]]+VT0N/I5h}`=VlQr_8 =5y594J.'"Mvٺ{e'E^CH?ntƑnq[ptƩHz7]b;P!A+Fry.*l8 ts;*/g'ǬˮjrmrK|eaLPAprM~+7*ؔɏwGz}"mۻ齝 GT38%yExyn~ 檛"[;$[YrL6?\Ř";CV5Ňyu ̪ݨ ~rȫ)MhxY ƕY|Rw^JfA>=ծgExf)nkx R2ϻ:u]YŅ-,>/B؞^} ~j -h*Yj\L%zFr}nG(R6s=]mVH2C+cu̚PZʒi ԾKmK4"Wu^ 8+M6A#xZA|Z* j4Լy8h*]ԙ]_4KrF䶨fvu>_:mA63.mآ2fU4݌E+|ilrzlye_`6⿝8pgqGwCƓe=&X^=a1Q"c˧!oXܲvҋifxyyΕF -% \o>k)zg -G9r~Ҿ6y`o8mw^s`HygX 6Ѫk\ӷWTSkaK<+vuiNn秫|7O#~ߌIM~$solEN>FC9ʳ<۶MvQ=sydCoU'yNX.j?&"+- gV`օZ75˽ -=='ꁋ,OgU좄dCs1 zHtc)8]Yuv֥i;/OL;*Ϫvu*Z˾!I! -Ӯ?+17Cޮv -tPBߩ[ѵ4QUj||{%K5ntwa`fz3Ovra/rS\y BETAnRrovVI3=vaMh;˦mv֗ͤ6Ie=&T-vd3nC7 yE;{ry7Sq+uy7i9xOmAvO1DyBnINχs>8Iע<e5^<wulݐL#_Ioh6lh5s\nM;t쭥j;w&É:'̈́ N=ؽzHˣcM*\ez߫ȱyP;wL j<˸g_jyX~=߃#l5nA'FLQS)nM-ˊcAytw+1̻ʸђP9hcɬܻSyv>7onqZALit g-OQ1U]*!6GfqPM[( a"y*> endobj +745 0 obj +<< +/Filter /FlateDecode +/Length 4213 +>> +stream +x\Y~_1D(^\!NAhJIVwJcǫJUZaw=aZ w!Q/ V{|аDÂuOiq& "pOU24-l\JUÂE +D.hX7Ȩ^ÂuZwVÂE5,;@7,\WUck)D.`kX,lllHNC5,H]aA k eʃ,x P׀UbŪHkm$.M Rf/@@*kX +sҰ U J> قY*P& PXjѰ {װ {ȂAT:T]ATLD䘰V5^d+๬aAdKװo\ҰbHÂ\! BE"S<*s l P眆CT_LVdh%jGEÂBpa;M ʃ, `lG fYB$ J,Y7y5,ӰdLְ0TWaEÂ,)q[Cfְd(QTdAT&a tx JԔxY4,@&*zH~3XL4iX 7Qj{{ ,,ꉁFV{zf`GR &v%H`:X/1:`r$!#g̋ Bu?Yl9׷/ goDR4+`{6 #ӽ-5Ԣ/'AƶctKPB6A Hwg1$wJu.zN5r ǘd5:ԃlsta[:m]ֳK`Gt[[lli"aemGG^uIn.+֘ur%ŧqC!IGԽeL8(>Tt*‡ +Z1Ͷc:I>TԹ9ԎKO"Kus>~PPvz@^ ބ_%~bO>?<#bR~ { gd+9KO,SrbSh%<'w7[6n)ŖwN}z} δ +և>]R3 ͼO5~Rl߄< iwTJO_|?|?aNZa uko,--,JzBkeqe{YW%ڀALUx<8))|qRݺhzkڹ6sdɧdNN6j6Gힺw",댗U?qBP }/M}'2N[\/rS״}$iδ ar YsZȕ@&Zvmt)ͱbuV۴5mӸ鄾/sGD/(o8G:>(Ho杹6:{/g6p*!n2"'g? ^/S3H 3HѸd_Mo#eE3lDێjW=,covyVhu' ׽oN&۟!9M9M~9s!.% +ktqo"ŹnSis盺->ĩe!{Y/-ơQMQhw\blz-d{lEɉj>9?찙ZT/_C0N:*V +Zy>u:7bP5zҚhk?tg]T3.]C 3??LM;w_b[t5[ti'Fm7SΑsO%E*߮{B!΄e^!no;tw[Q{2;~pzKʮ'\>?PQn$ oxUj~.f1"}[BH^8 S~ܵeI[RT[DwTp;|EP]QW7ۭ^_l? t̂_ـLvGH sz|Cwz}}~ ^6&wpT=1Ϟ+moΛMl³?Ogn$ʑ<]؟ć7>5"wYi3ОBMV<5&OxQ~k0$(OEFZmC?\wB_=gf=tO~w?O|x;gO<35bvg~J@5źePFP_ //kOac.I~<|H!ͳ'L\?1.Igp]?l>pػ3d{О2\&Vܑ̫ƭd~R1aJČc@m瀳d #ъ&SCuiRuNE"^N6쩏*҇vЂj-AhI!M+ۇ&sYX#hW{;t9TZ(CWhOܒak[r4"qۍqb$1q/KWBI`w8<탣R4plVIꐦGyr9r*tG롱 ULs1H ؒAfX) &9W~ܐqjc䄻1$a;>߉hOf/}Ivd9 N +63a//}R..rpY&/̔|C⊛Δ.yrP\ l#&;d'is QFe> -/Dest (cb172-1) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 745 0 R +/Resources 4 0 R +/Annots [ 747 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 747 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 245.381993 101.433071 226.631993 ] +/Rect [ 101.433071 265.954475 101.433071 247.204475 ] /BS << /W 0 >> -/Dest (cb174-1) +/Dest (cb169-1) >> endobj 748 0 obj << /Filter /FlateDecode -/Length 4873 +/Length 3991 >> stream -x\IqׯIH ÛR? #E27QE74K02IƟo IdTJ9~x*zJEa_!LpQm ׷ \.U9koEN+Xޫ+[YbA Ҟ!% kJQ4nFC b2rȃ Yg -Pzx֨"/gxΩx# -!$"- %^,.8- MIY,^,$ HωHetiϳ+aNaGaBxȃ,i+d!x bJnvFybm$YYt `)% l% lr% lʊbt %pڀgNCOABg a<2IX,dA ,hK t68-i$,p\%,p@\IX0,a:`%,p@]烕v a:2Z:"%,:*g(awXU; VMIKX@]4IX@]D^T؃NZ[<7pzm%, %$,(. dJXu`0eHX& {hLA5 '2-LY܅rx.3IXWV5ZwZE%,9(@7e4LWesJx.`JX/t`HF҈C%,],aAj aȃ,.Y ׀m+iJ[ jx]c wmJX"l*DV‚H!k򉼠p%,y"IXZeBgB  "P s,%,$,> V%^*EK(aAȥT¦8\bgH‚! pE*YD@  ,%,H6! ZxhP#yf QP*JXmLH) `B'^$?H6<$pi7JLf&8X1Ѐ^* 4*5 I,@Ld)UU0xvTU9D&3!9h4[c/p׿R)k Qڲ6cWG%a!bBb-ppȐe6fʝj^ -k(|}N9y^E!JǁH7 ycBwX8%%>O<$JN$PS\<Ť&8T{χkvwAן.tb͸\*䯟~ǿ۷2Alc7|G8z)-|,jv^tonC<]!M7}Ynʿm㕶ӷ4g/C!T)7I-0m -o_ǶFq;9, E1 -('VYnM#]6 ҁFOW-8+nk?Npnrocr`ߑC IocYAЄ(ͲEF6ZȖfdFu*}i{5yVZiunS1C6Ffl vBGu/6//g}yLѧ뿯=59uO+cΚ>y$L&]Kv=H}˽4\&߆pKuf[^ͧ\t9qsReN~{|oc> \#9iںJ$luE58W~W݆;XҿKpw:$:sv3]9Ѭ\5H 9O*hc"Am3w3FKZ`1*odk݌su\wD*4'/IĹ>?:11J-,LUmPf>oioLtD; Z\Zۗ6SM#P29d\,&wcr.*_~qs_2 g&D1ʑmΏmB3 >H9W?UV=zWB)}6%j.qìZ*u7-QzU4g-=(Bqů\hɺnVo3qh$+wz^ iDŽJ_qW -ߓCl|T髖aN2Y"3USQϿ?wt"e"SuZTh<^+OMq1Z>5J6e]C]M"Hy/)>v).z?w#£%мs -;US"$Jn} -Vq %i˯'k>C|.i@l?QcuIˆg<*2QtsXV`Zqv?ζк8#"\Rv*Hz;A@}Jra]N1g4Y`C6p(2B0.t`.0OTc>C^BV~ץ}o0c+D[̀f,JW {׻oZ) x0d,@fј=be($^×RU39;?O_)GPZr -_,|$w`b>a!pƓhw3t:2#:E?oKD -1Z_~jM`Y3I's33HpmáHFCHN6~hiVdfs1ծGgSMA)ُ%jڻwx}:p4b S+1(> -?^m}]?~{ kyƃwݚ*WFrv_8竁+~ ? C?$C0A~@ g%{#}` xuSY76` ^4~|}cT|7m.Xt5*%;P^?:Z &#+FHꇥc|9t8QFG:s;%B"ɵ3=O {CЏbO۪C9޸k_&ٌ{lCg\y7E *P; /sCFJMw4F%\G4=Lw;^ꎼj$R{-ۏPH`Wi4d'0reJ-)5;=~_4?Qq, Å#Xi.]ɶA~H ҇d&֟l7*m g_ai}[7~tk[=ٓ2߻KիE|Nv 8:zn-5y . b}VqZGӺ-MWPM&rֲ/uH@F ӪJbjD]n"RJkn Sw+^UjxN{m0U_k>\`lA]<8o~`f䤇 *pl4@TFP7)>=$7;y:ꐤ.cmvoϠ[w&zM<kV aM?+gnB`AݔV![>Y0> o397.owFF[2~j ۍ& 0F -֎N9sl2.7gBgKrse6\ŏ[vl]gOM'Ff"Z`Mm}ǭFw=4AMD?t8m7]>&74o-@Kf8ҍGoToipiH\q%;u<(. l%&[1RTBL3&Rp5 !g4Fqd_iy&,"t4%~Y701c}_xKSP -0)b./P*? e*? +x\Yo$~_1L~ p"N`A;Y<+vH +WjGXGge&"O?Ȥ@W[l.*kp[bBɤ\LJ]m{tl8NXM)QPX,^a`Rr!*h XƂ!sV\rX ++C sV.YXÖ%aʃ ³D(=j; ׀ciBwb5p( "pWܦ1 e A4,MI)jX OEaA" KANakS|$Ys$Y2hX[M E R԰Hfraְ | Zxљ*/g)+ 2^pIe R,8*k< YdkXHŒ21ECc=8~zAW|[t<]׵cqOWPV{j!s=2jФuu[`W]kKNֳ$msA[Rtef* 'bwkZdl|届rdde?}cg=3WY#5օ1ydcZ "c'ō&[OmC ߠ L>b8bŊB-mۻ齝 X{b4 }^^>_>b1k)l%bPUM)~Ys]dL W/7PSF=?v"_d&G\YTχß-,J㙥_m- ~-Q vYtŅV_ b#,~XsY00˷cD#Qk{3~$9/^s*oJ_6sIf ښ5) -eZLo36\iɓeyY(riW:;icrXJgc",S;KlAS^g?{LD~'Scn.S'h+fCTtyl;݇ǔ~-}Py, 9BnM~L8<6Ƽ۲OYkwqv9M12GL4 +[u1"7尖B>^]ff,6̶R-ˣH<$78^4"F r +,> E;sDo*ZǯyVw%]>C{~!wWt8籢lvHbW\{}Gq0Gg &@:ɭ;uE9|M1׷ލTGBY讫qڞH&:ݺuno5IMM@ m g!GFl}l@'8F6^1Lm&[kocZ_@̦V#C&9\_&V9YVOƮdy!A6~]yn;Ή4M7ȎY> ǎ39ld;|#c=YL?IQvc8( чJn}LNJ[yh~u۳ewulݐgO&/7E1؏Dt< <چf ݏ;754Am0t8]7]gpxi27a/-NTb +rp|ĕ4.\vSG\̃r 6bAΓtՋbj2ŵ[SK]qVzL1?̚t%yWY[y-ٜX= +-ν;GKhsvm2xGdJ[8k,{YZS+!6&|}!,HIȓ\WDZd a{JV^FΘjQԻR4> @@ -9544,304 +9544,361 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 639.873057 101.433071 621.123057 ] +/Rect [ 101.433071 606.123057 101.433071 587.373057 ] /BS << /W 0 >> -/Dest (cb176-1) +/Dest (cb172-1) >> endobj 751 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 280.181993 101.433071 261.431993 ] +/Rect [ 101.433071 296.981993 101.433071 278.231993 ] /BS << /W 0 >> -/Dest (cb179-1) +/Dest (cb174-1) >> endobj 752 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 261.234971 99.933071 242.484971 ] -/BS << -/W 0 ->> -/Dest (cb179-2) +/Filter /FlateDecode +/Length 4874 >> +stream +x][$9~_QHk| $ $#!FЊiEZx8/efTeUM0%t昳WJ)@wOZEX]hʛ?Up~;cs9;g똳U9k_EN+Xޫ+!, diϊr bI`%(gea!1LQ` 9ZAM3^(=H V%^*EK(aA KE/a^$aϐ1C, dK<YdKXO d i-aA6 % .9Ldo"mv(aA&ᢈ<) x$d$,!p$,xHoF1]$L@ V5Gg23qęČzb@{[E1g#I21kmLŴ&,٧9E`{f<ȌeA{1+Ŗؿv 6}zYɔwJ` f7Jdcᰄ:,DCHXI7[1|_ZdH283ed\ pw^~m<*|(#!/ArX +sCKWz'i5s#bSRu]se}λˊe/xa~Dž~h4ph}_揿?c^OSZ 4=/5MhdlqЄ9XM#-Tǥ+=n^*=k]E c0D/}:׉V>a6wßԜ ̈́Jy}CWX˼:O֗êڮͣNkCguI=c:6E]F_iv|q9couWdK|zlR0S݆e R263Mҝ _RV + #X1M;G9!ϣu +8hT(.[z댨{Bz]T/]^_~?P*ʰ)\V:WC@3g65l*_[50ExIjeɦ,zF6ӫu7mu;mW^-u];9g]wWkn1ʒYQNF] }u~%嵆(M0UwO8MyC&Ƶ ?/m,p8CqFd@oܝu4s +hr? +?S^|j/}k|#t2DV7kr֚P7b~;og rW}3#IX7M:~Han7,.2E5,od8[M@ܰnqU֛k(Z7 K*ggMMYaJp-mBꗓm>Tc a뺰}au2Ba +ZbEsOkpnƏ𩴑6kYtu.SUqìonfYg3\g2Ƹ˵袵׺(ȣgPF߽m[!X&+wH1-| nNÚoAz׾2\5Rlrr~9ݓZgi,y3^7u;덯[jĿk9X=KPeiTh<ߥL]KCM߯c|Ynfʼ:' sU^hSr֥D]˭ 򄝭K,~&J# )99%b&GLԿ-UuWwH焨Lt9wc2@ʥ"o3U~ +ǯd+.{mU!8g}E?C^bTƗ/{gAI2迆[!r@s`$pye+̛Mfp]mǦݷM.ёd[(Nе:jYPв/2w!g &u^7}h)C$8wy&1(c){$O*5MTV<ڝa2lmA_GcP[^5bh2$m<'(QBe\PtEG9gTf*?ou~{ȋ uJ/f:Xʫ4Ѧ|H&@[}Y$j͏DL{_/ϗ:O@)0 +Y4fb($#BqlxfLNXi|V/.܁Hd-a|\q #G/E">LJF}^rCI_|>ni3DT;s3/WLcLʜHD!9DZq&3ɬvo8:B $Uu"goR=kZ6صk_Qď<#ǤTPj_߽gg Xh4ኟ]~`N'{xd:_\-OVM> WWTk@־]A㺟!' k/ϭ]Nu[n6юlr"뛼f +!C6Q5%8`xʔk@y~ ?( Q|[b`T?N_ PjPFG:̩Y浅rLS(:d7#`C,F9296luD6#[wzR7S#~ pdw94R0[gs 7..3)o\y{Vȕח"j'2KիEv;q4HsxH6NOD'ꩻA1^0]YufVi:o/'t7ojM5§l47 ;շ}Bϓ@W5MΟfߑS3$r+'.'\mTUseK]2i63Ou +S_vQ(VhLo&NNzˠN7,F7LSyCݤq5:k%Q$ M t{鮱uRD cM6:!cLMt7Ⱦۊ<}z; f2wбm&>_N6߈і̦Z'luFgqPoVkG'~T}Lq/6gg ve2?Nt}{eʲ[vl]睌w$O/hiA6i>n4쭤j:w&Élf e|܌ {tmp-lIy8LƖ|[:dad;gi +}MnhlsӍVF1 拹a2sy% 罊 +`jN}}`L'S] ˾縒3hwh妵纓3p-hu1DMZ-NVhzj2$j)vbP>kϳҕY ngsctzdhaݩ4JFMn{AC0> -/Dest (cb179-3) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 752 0 R +/Resources 4 0 R +/Annots [ 754 0 R 755 0 R 756 0 R 757 0 R 758 0 R 759 0 R 760 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 754 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 185.446885 99.933071 166.696885 ] +/Rect [ 101.433071 713.673057 101.433071 694.923057 ] /BS << /W 0 >> -/Dest (cb179-4) +/Dest (cb176-1) >> endobj 755 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 166.499864 99.933071 147.749864 ] +/Rect [ 101.433071 373.781993 101.433071 355.031993 ] /BS << /W 0 >> -/Dest (cb179-5) +/Dest (cb179-1) >> endobj 756 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 105.552842 101.433071 86.802842 ] +/Rect [ 99.933071 354.834971 99.933071 336.084971 ] /BS << /W 0 >> -/Dest (cb180-1) +/Dest (cb179-2) >> endobj 757 0 obj << -/Filter /FlateDecode -/Length 4690 +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 335.887950 99.933071 317.137950 ] +/BS << +/W 0 +>> +/Dest (cb179-3) >> -stream -x\[%~?< `!bI؇t*]gf'FOWPTʝ-~r/39|ɚjMegg)v%f>$L*SdNQxʃ,6ZJ0\2+ٜ-!XafPyXQ,rQy/@NpH9+68ǐD*`55 -2K O e -\ 4 Œ4ցB!AprUd 4,!@OAÂ%XpK8 𖬋.Ĵ nȑ4,\RѰ sSÂrOn5,@9jXհ!ʃ,0` &4, np6iX@],#afspgKp' `а1sw=[aw=a  w!a=x>hXƌGXaw]S4ʸ\ uӧq W-l\EQ   <װ.Sk[T3sA, BtsQ,\)_NYqji=cfD f tM6 -NI!ȃyj\q! Y_ 1A9 K;4wٛٹFӃ@ln#7A}I8<j?Ib2PSiRlCM*!E,GQrAf/w5̙:ShY`C6pG29i0i.L; NX\'9mTyDڻ{+OLv0F2F`\*^}o9c0Mbއ}yv;a -hUiG\r*RZK/_x_-twgfANJ+c_u9PHKzWHȉ]0\,',7Ft<Ӽ ΎsvSr+qv^޿,!8sCb6%^y҃9ǙǞ/WL$ybj"y]]y/DMY(&ҰܛZ&]5aLfu&}>ү["GT G|[JwxC;>{zaZﱐyFX#MZGRgӫ/\>ET:\'>%9u\=VW,GӐ+ 6^:d0ފ/sMYJUyr߼b}#GNo9YYc}us𩣘-F+- x/QSƤѥ2ϭ|ơiP2vetp~tQYe $vV#~vmbܺGN Rg+"w3GEtK{\3qsOY^Uڠs瞎Ttuvsv:vuhJnN]W}ځϝ:%Gr,w(^yie\eޮ!o1ǰףQNރ/ano[ύcZ#|r̓]YKL/]rvt7i?=F^,ŢgIC}!4=-r' -n񽋳PڦhR(JI`%mޭ',Myx9۰T JkiN PSB}idv4kZB͐+Brkkg*RyT-MCa!w+[k]ny ^Nqt 8)y`fz31Lvr^q*,Fr*SyꅣnRb䭒fzCX;PvJfg}ɫt؆:l%nu,ӱr&&d!9/U&s ǎo39w.oowFTF{~n ۍ& 0F*֎Nv9q/l?s2':eqo;ZqA|2&dGYnv4n#ܙCwӕRfbd>un^nAOФ< %&q'EKT7s:,Cbs']"?Sf -#6  7;7huSa&7wZ6(B?>yWc[Bީo3Ltjq{}NO^mi䌥1B 6:QSjMQt6Zo15Z8ZJ=Կ͚yVyx(+6ף 9QǒYŹv(7mn< qDvTCɧ~0A+~N,pr<Ƈ]c|--QF]^qG=a: `&"Q3jŪCzs[ԯfǦuC&I#A^y%nJ?OZ9 -endstream endobj 758 0 obj << -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 757 0 R -/Resources 4 0 R -/Annots [ 759 0 R 760 0 R 761 0 R 762 0 R 763 0 R 764 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 279.046885 99.933071 260.296885 ] +/BS << +/W 0 +>> +/Dest (cb179-4) >> endobj 759 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 585.573057 101.433071 566.823057 ] +/Rect [ 99.933071 260.099864 99.933071 241.349864 ] /BS << /W 0 >> -/Dest (cb182-1) +/Dest (cb179-5) >> endobj 760 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 566.626036 99.933071 547.876036 ] +/Rect [ 101.433071 199.152842 101.433071 180.402842 ] /BS << /W 0 >> -/Dest (cb182-2) +/Dest (cb180-1) >> endobj 761 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 547.679014 99.933071 528.929014 ] -/BS << -/W 0 ->> -/Dest (cb182-3) +/Filter /FlateDecode +/Length 4697 >> +stream +x\Y%m~?< %Q`̃qAzܶ 0C~>JKU3۷BQGJ*{&|e_fkr.)jMe)-q2!dR . n?:L)p˛؛S +Xd +BTX 1BbGV\rX ++C #@ ,k,aKH +䰎HAbN`"5&K4&&jbb!k<,xLIE'Y\N^%⠝2dueY(xśP2+QNsLޓƳئWyXQ,BQy%xrCƏNrVV[ sUdk"d5 +2K  g +\ 5p%%i8ɂ K!rUd5,C^eXpTxd 1I9 S*x`vjXXI!: <`sxgK0p{Tyax  2r`V 0jX[1.gҰ.kX]T^2X^!h9 E `(Cj4=,X s^4f p?eM%jX6cT^16AʺhXpT^Â|f iXSkhXRykX_AA  "0"V R԰Hfraְ 39U^& RbWl5,^d,z F% x5,H`hXWdCd,dAa"]հ ;ȂhPÂ2v4,^xLdFBE LR<а#a6?lb aANYÂ!#alSIÂB0Y8xDta֥7)(ͤaAa<Ȃ(&IE +kXPbfְa#,ͤwC2i<."ӨanDd 3eǙVȀVI=3 Ce*c"&,OU9$̜d˂=([|ӧ_ՓcalK]0+SۃY +,+UD/U1RbZz&bs[!HmԱcl,fG]+}!idM0IMoĹk}P&u6B+|W:/Nju'Wv !+_EA4 H[~W8r7=q^ž׺M?ײ?ziZ_ʕoxi/IVc["S~fˬo?nv"BUV^6oa })Y\VUqVFxdcQ"ױ%ǍvǪ[rtMc':w2Olr7J"Rdei֧kWM״9-poն e&۫핛qqsx^o>}}A#k S`1,k`貭9 COWב"JMQp &@KK%v:/'xdӃH +6o]ލ6i\\ ٛYhMx-^ö=J,k[ +laF:U|Gz]To]ޘo@V<@sa+<K5oe],oۻ: `=Hg(} 7֖R0#Lݔ:_"D"2l`4?[rX[ă&׉ڝ@gU'3ӎg}:xIr\O}WBGZ}纗+%h /2WCᲈ !~?L-ļ3&8"hB |Hp:.A&@5&: q*24宆CO(9e0lXƋrB ߔ4TM4C-6E$ʓ\Oocu{B +#-n:Xʛ)ncu~9%G%"Glh-6CdSNy9ǙǞ/WL$BY2XxD1",)4,+6&3ɬۤ~+"9Tk#u[J6jOxC g}]>^5% y`E!eJZG¯n{+s y4R)]S:$G:Î\h/նgX&|RZBulzAd<yfa[Xm@P{yy#3"W-sldldȼ0'k@t0 RVS୼G=JS|Q%d.9g+vz VI_>9f ( mSnVݗq + (bݼV3Oߛ)SRyHӪ+kfE\uso$-ϱZP5SgV)m.8R@&Mt˱ǒ. 캻݆=6Gկ[9ߡכe6 :d6ka}j .y?&&1q_վZ>&qm}a52\szΘj&HYklݿ}+xhMŃήEMivH5rnIvݚ{ldMj=o4|f>:kDGy^:kva]]ӗFz˖C|lzT}Lɻ__mkqLkdxe-2:L}vmn#YwiL9ly6gxqlxC$9=ݲfe@sl秉{m+~vslvS~+➗rxȒ=(ɀ[߯/ݥei\3E񵩳enϛФ|msMQLzC^|z<ךn°9mx楬;8]o f޴<$ƿ%ea~Z/UF#C&3B tQ3#YFOƮdl.vQBl28hpTK&b8in7y|桫.b}Vui[ =]ǂZSM:OBN d.'Ӭ'bnĽ\i外[[ }R/G4?DsWBLmNk|ܒ%sMyw ^NŃ~ +I)VPh7n'g2ꬪl4ya]_"t OMJ>:1F'6;y;갦ѳ*N/ySX^@P'MTxR{Wc[Bީ3Ltq{}mi䌥1B 6:QshNp5Zo15Z8ZJ=?Ϛt%yV⡬<^|liFKfڝʣoc߼y4 Ҩ%_¿W֎T'!6oQK3Ԕc|I0qFsx"J0d`qZ!uH)@9 +0w:Ml͡B6VQ> %DWR?ꃋ]D +endstream endobj 762 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 490.837950 99.933071 472.087950 ] -/BS << -/W 0 ->> -/Dest (cb182-4) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 761 0 R +/Resources 4 0 R +/Annots [ 763 0 R 764 0 R 765 0 R 766 0 R 767 0 R 768 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 763 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 471.890928 99.933071 453.140928 ] +/Rect [ 101.433071 653.523057 101.433071 634.773057 ] /BS << /W 0 >> -/Dest (cb182-5) +/Dest (cb182-1) >> endobj 764 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 410.943907 101.433071 392.193907 ] +/Rect [ 99.933071 634.576036 99.933071 615.826036 ] +/BS << +/W 0 +>> +/Dest (cb182-2) +>> +endobj +765 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 615.629014 99.933071 596.879014 ] +/BS << +/W 0 +>> +/Dest (cb182-3) +>> +endobj +766 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 558.787950 99.933071 540.037950 ] +/BS << +/W 0 +>> +/Dest (cb182-4) +>> +endobj +767 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 539.840928 99.933071 521.090928 ] +/BS << +/W 0 +>> +/Dest (cb182-5) +>> +endobj +768 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 478.893907 101.433071 460.143907 ] /BS << /W 0 >> /Dest (cb183-1) >> endobj -765 0 obj -<< -/Filter /FlateDecode -/Length 3012 ->> -stream -xM +H}I.qoyYUn`-R%QR5_ ?orۧ ¦%]-td)K>_箸V5rtTBPrT *bqT)Rbʎ*s[T0#*0C[M -fhQU!ZXU f`TH`JttBӳrmDB.ʉ=] 9T=–Ԉ=]-UZ<]-\l+%;U؂誮P&tMBjU5訖B"CBlÊ$"lɔ-I(z:-ON$):5t XLGa !+(<RbUGX[R@l)hnClI=uuEz,[Pcl* UDn{,Vpa&y,WjV"sX .{X =+ZwE<(+']lA{,p - -SX.QXY b@XI=( WW֠x,Pp7& ۹ݘ(z,Pp7j (!7wX( XHK<$p?gMVk Z;^sX]lT gXcAwYS{:pc# Eސ< #X-0!t]] jX]`)z,.${,!X]lcAw)x,.)W[Fkòu4@t.1fӁDy,m r1A ``@=䪡=F!su9< YhQHCV=[$F%  ȾlA-=d6U%eUOcvu:. Jр=,*>Xf@걠4؂[Qc؂$c2]=[ z,┙cvh%jOd걠j*z,2ItuXvX8:"I=Y= -["EM;o` 2>r4c0ǂͨ .Y=4!7qsmlⱠ)lIHQ\lAԜu & :y [bS-g;oVH3pDF^ T;oM dt.27zg{xSA~+8{c@@o^؋ݪwɽ48Y`[ɽ6 >0a}Z2¡`Ϭٰ,8sjB~ן/{ﶛQ KiܭEBvqDM.ǿO0OJ1 K]S/Zw=pI~WG=xQִ6>WUxw[mC}ɷ˰a߆ПyZoEzcچom,x6n[{tw9^W;ˢ.#?zNtLr -Wԏ 42;#Pz< vvj3 RѮ>F3M˄isƐ o?:pLz> -/_ev+vI3sL}XXkfRc|R>>_c3<}_qYmpv/k^ywB[t?=ڼgmǜ==mBEIJw3-YepHྡྷ1[4iKqD[#kK֎0Is:h3ږe^BxTo}˳~ŞTZa>_v4zr )r 6jqՕ4Xu&{-R8Y #=^&8݋/P1+&<>hKWۅ@6?Gcϧz%َ3{ǎOf~)!5QÔu;~QB0= -inv{.W2n,t&]ЭK]Mu8eՆ4cBt̓#]MC̚]IG9ŭwLQG[4exG&ɲFHdzr1T}?_Rqj -J=V,q/SZjwfٕQȳ}`!e׆4;9g'<XˬK1+9 Il3H xk{Ƀ<0M.8B7,Iow^aE7[Q[:ܒK(YչCqyQ۴dpٯT4Š2u:ٵ.FTA -,kamXyq09`ҁ!}^c`&8Z/і,kOF3L-TXctQ!j:demc-ۈ2r)etZge81Z}ْ(\hdudy}zHu֔.{[} C!yf4K5߲vgnZg ::aV.e"1՜o~~W*B+ P/+Cmx⎷q!4Ŏ`7 -n{U+ -to -endstream -endobj -766 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 765 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -767 0 obj -<< -/Filter /FlateDecode -/Length 4222 ->> -stream -x\K$qׯd{`Z6@F5 FWfFWW+L*#c;3ɹۧ jEe8`KI>TKt˵巿m^)%:؛S -Xd -BTX,1BbgV\rX -+C 3@ ,k,aKH -䰎HAbN`"5&K4&&jbb!k<,xLIE'Y\N^%⠝2dweY(xśP2+QNsLޓƳWy()& KPTd huݞx8XA_C! A".iR2\k 79k(r1``8' x,BF< kXdA ,h xiXcx] -iXpchXX몼baA؅ e Kd5,BaAb{/D.5,]b=*4,@^Vi$BwK+ۦ1 e A4,MI)jX OEaA" KANakS|$Ys$Y2hX[- E S԰Hfraְ z Zxљ*/g)Vl5,@-e2^tIe R, 쐙k< YdkXLr/Y䚭"B-+YO HF9JsI+yZssMoaSmM"݅YbT-6vtvojXZlZh16ӢuWreIwd{[|;w.4{ZH~l BPF#9-cPT]hPTS;~o_%p%SdW5| [k} YE/Euŋ"5{eAx_gxI9QQPΉ!Ԣ(-}Wrץ[SO*x7o{>_H֩ 7/>_\뼏>_\ -R{(Ɨ} -]}&`7⳰aOrGQ?\}?w~Ed!%[!r& -qq ?^}wLob3٪$s`,lo,CY09˭]:[q\5O<`>yKxiTm) dǵ~u"mL**֪-vMMZ q';v|HPC,uVpǹv/򰽄qYn{VU?v} 4l -~_p@ !mܭ}%}uwOkG]%oh}vU>{v=m}kL|Ӣ|ɮwNZTy>iη}{!xx wV*\sKwuqpx%paEI_<}x}1M>/O]sGշ>_/i?b%|k^g~3ݝ'a|qӻZ#Qxg1,M>Ăֺ}TWr8 58 L5>릚qvȋVr-EĽnA]G|nFxv 0aOl{Te!u`QpT}}&Ҝ3s|_Lyh 7{ud(`BW;c#9Frx8{^ :ǽpگ#=ZqxE6Z~yӝgR wt׫s&O70i3N/r5 N`rc>r}7_yޟ\rG7E#ʓa/7ΝIЖs.qcjZݩQ?7yCjp"ҫΕȩ"T*f?}YyLqNRw1ӥ8;]䞓&thƘVWrce/q+ZUcpGyv{pY*l/>iN^t-CN?$[M&\1CX^f8/G#ַv3dƺO`P}zB^g?>aK- -@h\&)^,K O.ԟh5 - -endstream -endobj -768 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 767 0 R -/Resources 4 0 R -/Annots [ 769 0 R 770 0 R 771 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj 769 0 obj << +/Filter /FlateDecode +/Length 2687 +>> +stream +x]dϯk咪!1`EȐ/6͎5sW}t;z9JJ="W1J9aQ׸+'Nj.J|h.r6z(o?~o/՚_7%gDUD9DT; V1[gUVKd*a!*0C-{}VU7LT^`"TCL&=1].*e|LR6=UR *"lLt hR:JV˰%`v*؂UHtU]Ō*tRry.Ua:]TGaR&[Ju%Sbf:p"j.xkhޭ"l !,>#@HErb%ƀA uV0 +R Fgf] *%Zb$P[ KuE1h-X +[)cXI +ޚX.q$c,P [2(`'cpX U+@]5/%l`ѩ/X`zɌcVa&JwCc,0p7dT|P C`'7wX D=tA 20DpWħA+KMGu'~Yv>X]TX]0'j`,WLP "c p9/غTWR " ,N +HBua#y PƂx ܕX]1=T[5mO#Xu@ +wcɕ d,H Ba,Qp`,H\91*!䣺PY @XU آ!0[20 "p#lvD +Ռ DŽ| t)k+X9Ş+pz޵pf@獱 WWa,QJ@dt f,@ %D%dI pB#T3I3 cAZX7A RRl& >-َH~l"͡:آ J -, {囙 +lAXP%&3Љ0T_oc,_|0THVM-̌`KDBuAS%~ &!.PX0&"zz%PZu+t."XMD,7fg\YZY荁g+2Uw^Ld%[Pz"'&OUv83Knp Ct?rYMߨv܏;~ߔ?lZڍ1ܗ7_u8Ă<xb9eQ226?`b^g㧜|^Gripg|uiRoZl=`qǣ~_^{cN:m+_Mvgn{szVϟ;_:~9z\uٟҗ~W/j-cz\¾ֈe7y% p8 =Ix^Z8gTicuGdp;s?={oxpQݑq+oyh0/_;"$hٶY}^-WyxqMo[(6">S܄磌w!occMdr>rgcopĨڞ?:&BLYF/Οv^4LAFRpֺᯊ"BY`ߒ1ui +e{ݐ[}ި]WEeU4cAl]7"Z 9˪Dlԫ]7Z|[+G2>Ӕյ'}Nin.>"ũ@_kDs߄'uCPoO3'+$ +uyeJܟSf*6ȸ{*O*O:f[u9=Η/B7c˔-\y Rb?v7\ҍ@wSV݉q*6{,e)NUNJ{{=߅`Gqw2Ai7;[0@a'Fo{S,?N'c'uqۏ1T<$$HW(_:.yqw$kzAp" `}uc a2kAP?09\alu aG {fGQЍ[:Bg)bJ\g:2&1oDK:n> +endobj +771 0 obj +<< +/Filter /FlateDecode +/Length 4233 +>> +stream +x\K$9ׯ3&a;V{`xI Bzkw@i gڎE;?Lw&|_aRs㉖ ZEc9q^!}NO_}wKɻx3EU" VK>&܂%j Fk b`8pdUc1\`9<B<'ݒJe\/%evYbx Yb%g"d,dPK%@&ːC;*&P"gjXb-&G%#S\b ,sKoR6x$A[Y?8C.ňV/(8!Md- PN % | W.\,.s`׸p@<, Y"' ,5y%T xȂY< Ж--Su-K.$ 7@.\ZXiaA"ܳbn,,,,`ni \ 0p780pa-,UaRBlaw}` 0pG,ڹ>}hka{|-i*?#V+5YX|&..CFBˋKZXب ,‚u;:_‚E-,;, Gp]WXX%oav +,,/<‚^-,H]!XXH{Ld [X<HV@ +% [<.Q$l,_,, `oaA*ԜxHL^Zp-,Bd<™-,@bPCཅC  #XCmb Y)ZX$[Je DŽz Zx/%M^e r[RI,,9 WȂP[R<2s l 眅Cd_Pe&;4jI1IY,,(I-,@R<b;ZX&YBd JRn J,M7 2> *Ed YXP]Aĥԛ‚&J<#nkHRof *CA$MՈ[`MKW$fiMd@z3XL4YX ԛlڞ1#?E*b7bo5 ؋*g<4,K2O <6 /1>`z!c,YY~Yxz>Ͽ~(A +}?k"?\^`kb;hIx㞎4!Z+Vȏ' H1s:MLsI+yTԹ9Ԏ+cjIW=G7CL4]ۛ[k )#[?*5*krXlPe=Yĝ Mޅ4Ow1mp!] &4eLڅB:=ڱ{L]_ ڙk`Au)>ߏ,XX)bٟS} +d/K9O)~dE8Y]*n|uˁVUJT}z_ +^!:u#ߓnWwysYoU!'vW4|SGˁiwysy5}Bޝ@|V^KӥQ/wN?Ęޟ9\K 9a54nl^*9@5B"Sg3JnLgoH[+:oֶj ~I~nt5[zPmhӔ}ZɚZ&::%s5|vl.&BsëaQL_sIA"&w]iMm)9hE?'b#S6.#X^V=791 7nG.MY.j~]iwѶnx'wzl=xS6v8߯_зpRk}KWa=ЦҰ)? !me*m7ݭ#{ ^_k&;[v=<_oM\25˜7kzS_/&V|ZP܍e6|&XiMǧ|8߅#c:/]xQsi_+zlG/橓Mikӷw8QnonuǴEƭvW%?[z#Nnj]"(3/Rvp9_CrKU>jrw!W|'^dq'dOc) 0FG@'y[:q/6C>:r/o6_qO-Ydr'Y׉#lѳIve>ki{o8u~wAi& ^8ja/y@ +z9,|VCJ-\#.T)NLqH=PAR*0yPC%*Kz|k/l/qTwIz/p^ +endstream +endobj +772 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 771 0 R +/Resources 4 0 R +/Annots [ 773 0 R 774 0 R 775 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +773 0 obj +<< /Type /Annot /Subtype /Link -/Rect [ 101.433071 484.294475 101.433071 465.544475 ] +/Rect [ 101.433071 488.554475 101.433071 469.804475 ] /BS << /W 0 >> /Dest (cb185-1) >> endobj -770 0 obj +774 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 423.347453 101.433071 404.597453 ] +/Rect [ 101.433071 427.607453 101.433071 408.857453 ] /BS << /W 0 >> /Dest (cb186-1) >> endobj -771 0 obj +775 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 106.050432 101.433071 87.300432 ] +/Rect [ 101.433071 115.110432 101.433071 96.360432 ] /BS << /W 0 >> /Dest (cb188-1) >> endobj -772 0 obj +776 0 obj << /Filter /FlateDecode /Length 3943 >> stream -x\[dG ~_HT]7)" - aɀ)ၿ:us=h;...lɹwO֤`jTM,'\9%J)Oo\?ӿǸ7DodRNUV&%Š`h,{>Ƃ}VXb'GGV>9XÕykU &BQygb.K^1b %8f SN/BdUd9KC;Ee*h+dB*gsGLd5s&6IpH1)<Y EA@k<,rVՋw%d>ʃ,8| |,6E AFpIYp次pJ/p,I<4 YG AjXC1f]@Hհ 2.aASyŸ+~ -cѰ wHÂ|f kX5pb5,] AqH4,@|3tU^1aAf K4,kX `aAlJJQÂX,xHT^4h !Td 6Jְ yBkXOE=ߧ_JYq0~("n pet &rm/G|""2EtVrlypC^!uY*y /dn2EH/T!)2ۺc޻Bu=Ǽ'Yoqٶz}lz}l{U~m)8KߣSoN*w4y9fVwO~/7O>CckC!܍@G<~\6E;7u4@/KB^js1pͩWE]8UGڔ*^5D`\aD{q_uSh: -2Rƹz[?T3Og(cs'j !ZnaYKH e]{W޷qo?]]#81xE6gMuR5Ȩ.6|_iE|hSѦp -nz7Lޥ X޻u:yyc>dcmMdLZtmVTSmbIY+ -~C7 -͢bm_~~^B+澯OskݏZ΢j!5UM_}Κv]vC K/ך껲_KZvؾt9-Xǂl9oQk{@,t-C__u]]LB"=mWbnEf٣ۋ\9*,ӆ|䮮YaAʾ/RdQt˧./럥9ݧl/[R|HKW՝+$˱Z9Bhj)ݏl9x un-;seIؾ?kW19sd#(Y>֝-bW{3Ni_+lbÇI~>IQ2^1q.&S=q}e˝r{)59>a`Տn +DH[Y͆Z+QB28'p|Ñh&sCuqrOq#^NXg* v4Z*zq /S%]gH2uR4˔JL1uzף Yki,i4ixuNX Nn]\ɣjD:}PWؘPTx1{Py\$gL-BsXEӮbhƌ۰j)bRj:2S2ox#[՜ܝ=G.Z\G*Ϟiǵzm6x -gfjp*{hO<^DfSB*c|@⼔FyZɱ"k%J8D69j1]g0ˌecb-n>?T[\ B(_%Efdow+J/e/l +x\Y$ ~_,K"u ?8`x;0n{lyGU.1:At:(D-~?uٙK|<=;XOmJ,'\9 +I%9?mw]8򣰘L)٠ +X֑ +CTX,1Bb{V\rX ++C h*' brr8oʃ sD(=j'x xh( Y`]YAxL(YlNy6s&[ְ>PyI%h'7p5,`g5,U. $djXkX `aAlJJQÂX,xT^4$ Bd<‰5,@`m +aA򐅼װ yȂAD8DjzY`.j~@2 )DcЪƋVy<4,H bar)K@ kX +dhXd\9Ȃ [D9aAѠgdjX$TJ5,Mi)UdLhXd;hX&Y(9{I79CoM7BD|VÂ2M/%7)~[(J4,( YBY4oI7N/B_XÂY7ѫ%,fRPL4jX 䛈lxCB|3dYX@o٪ ,URk+9Z4,sT8VtV-X/1aR}KTpf$,p Ftsь.4[ct O9<|R+e$El7 &bm/EDHekMDAöL]"Op(O /DnyUo5)qFrbqޝϋ+t޽ :` O}}^^Ӽw>/.kL-jx}@T|6hpx~{?}߿_?{ ZOx$7bx,<~y|Ꮿک^…ؽbSeDY[* G*^5HaD6~(tȄJmU?P|2O+Q_WqJO_xqb !!lbK6H esgޏkq~^WY_mXbk1NlvO7ዖj`Q7]m/iE|y5g:ݏIԅT`&;{]*̀XWm>!۷oMڊNͤN[6Ϯ3I~9Y' dW%$vWyW 2lekV  }m)KVlI 8u^Zl_␩ᕾ= rkk_xxkoѐջO;/eƋu$=II~kS9H +gve8xhA2vb'UuuLHULͮ-\*VL,?٬b~7lr\m8_?<߂|yǡ< G1$HswIOx<-pٹF6-5q79+MŬV' ;֘{N(WUvK 3]^87pڲU]}`'.7ktMOvzrOg <~-Z=d&ܴK|=jc{Wp|lt.eRIG.#wDԝ}>A=Ma "M+,Sx),maSIӝ}>ž-e9#?b'(Wu^eQj"7%ozV0XpTov 7j쎛m!\G$$mUMr|\!YL{ 2esi{B=8:z g2ghkmۻC[ȍ8/#ATrwĮmu =zf+;ɽ˓]෈wm%g. %:V#xA\Nw)-LH$\Jh ̶5z2BDdY5n%üz(HXJ'yn;oqMİ'iAq@W].:7mkӴ׈sJGPMvMBN eNmC36]1bnĽ]i頶[G }RoG4?DN+^:ɷL>bݒ%W{md7~G<wOCHJ0†fz3q;9a/rS\6v@ETAq7)ye\I7;y;갦iR6;e6Ie=&T-ud36!0 nʏ3tW Od;ȱcLN}ǝNCJ#\SG\̃r 6bAΓtՋjx5DS#04>k%H3a; kt(P+nŪKz.>?Tg~\ B2I(_+Ef6dǙj6%? endstream endobj -773 0 obj +777 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 772 0 R +/Contents 776 0 R /Resources 4 0 R -/Annots [ 774 0 R 775 0 R 776 0 R ] +/Annots [ 778 0 R 779 0 R 780 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -774 0 obj +778 0 obj << /Type /Annot /Subtype /Link @@ -9852,58 +9909,62 @@ endobj /Dest (cb189-1) >> endobj -775 0 obj +779 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 453.376036 101.433071 434.626036 ] +/Rect [ 101.433071 458.176036 101.433071 439.426036 ] /BS << /W 0 >> /Dest (cb191-1) >> endobj -776 0 obj +780 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 392.429014 101.433071 373.679014 ] +/Rect [ 101.433071 397.229014 101.433071 378.479014 ] /BS << /W 0 >> /Dest (cb192-1) >> endobj -777 0 obj +781 0 obj << /Filter /FlateDecode -/Length 4511 +/Length 4519 >> stream -x\[,m~_1T ~0$`J$B6UX]Vk,4Ytj|e_"R1始Vk+-V-~MQyCࢊ/\W_1Wr`9S 6N`yb>`Ă>=+B K,A& hܞ!$0Ge40VkA4x Q!eE^D+S!FeBIdY!7DZAr)JY\pZAxXh' Y`]IAx)ӞgW>9%16ȃGaBxȃ,i+d!H`Ui x]mu.$, -Q $R9 aA<|"/(\{ DdH V$aAY+aA!T6\ "E d*e" ǠUJp-x&JX#)FR*%,+$, fWGJ3At3F‚d! A M2'4rIZ<3IX((%, R<ɶM9"8Od9LY69ߌd YIXuP&KXOk I7-IX|3IXFOQ‚L#DyAS|$d$,!p$,@|XHoF\$񀻈L@V5Gg23qƙĊzb@{qZEf#E2jcLŲ"&,էD`gf D=ܝfK} y޳j=eE^)9MyE!5~(2i:]jON 9©Nyw>.+NswE :՘7!k"r҈ʉžB+H\Gd\'_=l@+`@+-ψtF:jODRuK~ivAV_?x~z|5bl5|en_ow:^?}s0BEF0&6,C:թy}c_>5(:oƢ-=yE*E,- 6$ s[O%G:4}dGjDԯ -NM;E!o&ۓ1e4bp_Xb$~rI ﲲpgN[ A_}\V~Lj%ͤegE FA_-OM_mil'fDwk66feg[[lKUݸ&Ol" ~}vZ]yƕ =C}6?oէU((ng%gTJ,,MTgLc?1SۢaBm?iEṅ4WmvdÞY/\G[a_qb(gxHtO= o#cK-'IwXcf=;KG?WmhwcvtKzWV=O'1]wf~Zj:~B ,hxoue{/ u-pa  ^cہ-rQܶDw۰Po$ژ0_11Ƀ_1iiW4{e}:m2+S{PWA X"_iҷΟX%@wcʫ i1Vۧ6sbvYC;gq`뢈*a8`c _si/o%iUxxx16h?n0_h~~nC(WrHE{9"\ k'|H[o*';UBy@_Ʒ%[ç+k'|JViQ+k*ko$󗬬'=EՀOheW~KMIk\bݵ -qcmmTn+kjd=N/>9S%^cŹ;ˋYՆoQMdbyC씎,oa`nXB~:ő !ݮ"}f3%O&\,|vhk'|[(ZɀoK&[4[Z zf|[֬i6mxr2mVT頉jaɺJ&ݱ.ۓq!vد|Coߌ#]oGR+W[>9ĩm{OqcklZ>:cCzT{zA29"bw/Y\ym.`Ϭmt`u& E~ٍᛐ2=٪BQa3VI:L=HlƷ!7Y0> /397.owFd6&di7&C0 })yp2Ľ]t)ǜu~ue_߅k/8b6غ"'h/$D4 4f vkt5;Dtqfbd~ތ{t -M*\e<74$8%;u<(. l%&5 ԃ4/efTVvO^ir/pp3U+R/?\^_*hʛ~Up}MqrgۘU9k1)FVK'W1ZV0 +SYbA Ҟ!% kJQ4nFC b2rȃ Yg +Pzx֨"/gxΩx# +!$"- %^,.8- MIY,^,$ HωHetiϳ+aNH! +< YYAﴕx~$p»ୖig$,Fy/! E A^‚A,Y(Uv9IX-dqJX-dA a" oxY`. "E d*e" 8A/X"Z%L FR؊8K8\bgH‚! \ElE*YD@  ,%,H6ءq%i>g& šp4"&$,aKX8<$pi7Jg{ L|Lb@z=V1eح3_>#Ie +b*Fi E5(:2_?I[{IsT,XZmIN炷kЌNy_Eq~Pt.݁-1fnH[G69v~1O:Mx}]&ֹ6V~ 7c;F)r,zʄX=;$P|Ɓ7$J_(H?i0-ym>Nʾtn= \4/%3pA2pj^/%FG K\-YnsSP%]a7f'9ɗG%^m6c>K Yq=Oswb" _QdbyCl~4ryoيH!Xg~>iHˇ(G*g xrRG,Kjvr)#[+'r-w¼~2-d멊i6:G)ض`itDkkTJݰJ&ɺݱ*ۓq!v_%~쇆wߖ_ػގ%W'65zkEC|rǢJU} K,sefo3~uy nښ[Ow񝠇w+<^cn_4͋)8sm>ymd!oAzlVJ='X<|cuSͽ=OqcklZ6:cCz{zANsDf_2( +]Gޮ?bJC߉c򱥞k,+:L˻FlC\Cjo\y6陰U{Y~57t-1#?(CLߐؚ-F-3To+zz!y~J\yл(ez;6o'yV7 r=9K(2t 85NڑidbNzZ,o৤wfMZ_L&/+lt!' +roBI LuLzhKyl[yq?S\Gm?ZJUre`<{L%kr(>4A\wt8>$'4 [j~m@W].:3-k㴜Gú-EgZWMVwʝ[; I .+ݺ&,fOƏ/ z EW{}bF4?DRW@Mwx#n5i#.'GX}3~;9a/SS^i4@TFP7)~(A7;y:ꐤj̎c6;$-gVIe=&T5td3Q7!0 n/+wWd;ȡcL} loec-M?Aۍ& 0F_ +ykG'~^8Lqo]6g|#8/X,s ~~>o;NƯK'zFn3-M?&YCǭFs=4AMD?t8m7]kܤ@m6c^M8~D +y:(scKN]Uǖ.٩! +s(N!JL6yzp> endobj -779 0 obj +783 0 obj << /Type /Annot /Subtype /Link @@ -9914,7 +9975,7 @@ endobj /Dest (cb194-1) >> endobj -780 0 obj +784 0 obj << /Type /Annot /Subtype /Link @@ -9925,95 +9986,44 @@ endobj /Dest (cb195-1) >> endobj -781 0 obj +785 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 404.429014 101.433071 385.679014 ] +/Rect [ 101.433071 409.229014 101.433071 390.479014 ] /BS << /W 0 >> /Dest (cb197-1) >> endobj -782 0 obj +786 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 343.481993 101.433071 324.731993 ] +/Rect [ 101.433071 348.281993 101.433071 329.531993 ] /BS << /W 0 >> /Dest (cb198-1) >> endobj -783 0 obj -<< -/Filter /FlateDecode -/Length 4756 ->> -stream -x]ێ丑}ϯg#y0X{b?Tl5~R*v ٕ%d YGR^tHDp$. -uI\zJ6E - -H$.@F0%[\E\lA(qlH SN%.CIG7 I\(qA -M,Mf lqHQDlAҔ'a vtD$z3J\4Md@ nw]3I:.2S/q.Df+g2gw an U 7MeU( m8a}[Tp3c7쾭9z1Sl.?{_/?+;eG#A( $ Cq#64XPmH, "\ٲYVEm|^G,RhSZ',"0y>\9A7Z۝$p(!sH1d+_Ox[A - nE~e#ؠ%S7brΔ'hsvL}&V26<ɃCAK(\CqUFDTέSRe[^L1 v/l0IC;]ʌT,Q/{VTۋ2>OjP}+#רydgC9לnبܠ@ vFYn@}mhQ`W=pbX׫BNT4v }{0;h}Gxӡ8z=?G_p6[=wbVCVٞ#Rr+suwʗ'n1tEw'8:?#s[p0ǐ=Hza:YxG:R]mʨ79af^糜{$SkmL5{DX`g'ޱzγsN>#e/#1Kc!G};s{{+!?3!7Ai+)?uo6Jy:=F4Gk?ki }dO\~lR)hbMrƋ>/ۯu|0 I9enz;܆~2r [E~]msZtyP̟iP[_x:N |oyB=ף'oS+jvx1un+<21yHռLRgY7?]z<4n]LOI'*laÄwhh1WWkIT7-C&6 F[w ^l׎MK?46W\Ʈ}J&q)Z2".xdn HIs}P`iD]G}MWY V)aҼӴG0㾘kdi&}vcYOrחmαe_{eYٖ.8F4jK;*[uZ'F*k-j_U;B)ӎJs7esukْm pT/r(<ݤK*Ml{eA3SիMw{bg3:HO ѱMtƖ6| uJ;"uZtA oP -TBr[zVP9 *8Ε vR1ޘJˏ Q}P/X -endstream -endobj -784 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 783 0 R -/Resources 4 0 R -/Annots [ 785 0 R 786 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -785 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 224.073057 101.433071 205.323057 ] -/BS << -/W 0 ->> -/Dest (cb201-1) ->> -endobj -786 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 163.126036 101.433071 144.376036 ] -/BS << -/W 0 ->> -/Dest (cb202-1) ->> -endobj 787 0 obj << /Filter /FlateDecode -/Length 4057 +/Length 4757 >> stream -x\[,9~_QHclG&x@Z28áz|-3ۥ*GG|pfZrٙK|}bM -ƮPYN&s~/J&S>_P\?_~_m՛RwdRNUV&%Š`h,{>Ƃ}VXb'GgV>9XÕykU &BQygb.K^1b %8f SN/BdUd9KC;Ee*h+dB*gsgLd5s&6IH1)<Y EA@k<,NJ9+ŻɒxxXA,>B #aOp񬁀d8sPb8%``8Yw, sUd,adLЖa-mq𖭋bZ K9ȅ) KN  wOPB`8G K쬆 %BKY` L0pM0pn5,a԰b|VlY-@%$ ]װ}԰b?Va{avQECžL-9f5zv>?_~<GI!b_+Scdl@"!|O"),C7[1r_^dH,2;3ufZQTe}s$瑏"z{\z]}TX:,ƵO6Jw=9|;Y\LzO/R><]~56+kϏ?}-!42oX2ިyâ,onҁy}7>Pf_^hO[][ƫ}ĽL*pC+~\'Tsu:hlʈ('{ʲ2FT^Kmn}lW>:%80".Da*t'npO̙[_}>mAy.nSeCh]X*M6n5]4uS>52h'Æ_uh[{?JNEÙVGuWaw])gw]?-m\}{zbc}D}-]+? ;9/ss Uо3:4>o}VwZyON6B㹍` [j?e_&WNzmx^7=b6(&>}V<6>}B(z:as]>YWK{K턾Gt|ZUџc.]]pl2-zr/w\vkv̭/~~33p{{j4O# D\TwWM v[ۼ+[ir*^Aޑs}M5( yc45_%qmu1y/X"rc0qcZlCCOrH],ȉD]M}THd@r2:5h 9#M7c!y&[mucp_fk"]~fzxۮz sGm=;gQrDAʾ` i!q!bs/a˶o?7-Ai˛;l.nN0jqοlln9M )cȑt>@s> -*5=g;rl',qjy@)U|2SrTv^4gFjwO"cwӢs?zM"=-.#+o -/k'Tfީ]? ;m(4<"AO:;:˞4~'wu^[{r0"pWo'\d玶|an=jcSWm̢?|XwE0oǎBml[11܍2uO٣͇Eu=²<N ŞҾ#bqWs\s|vQ;8Z2x҇?.3mU;/&`)m*x%aw$Jg[2s v"s?[{IO}?|m\`A+|L&lxv~|?nk=$Z/]}*]O߶[Rzpl*1w7]ᖢ]S$x6\ܞv=~~kf$~QH-uG̡}ƶv^6~Cj.|FaY~r˲ӲpbW-1kd#IC*W9t]_&W/O0jx<#toO.V_\a;l%g |<,Վv8Xl9֔}-s9ܾe>fr#,^ꭠ --;eָFVVC y;; _%; 1vn=wy<0T'q-,=aH}V\kAE2 ckbjFݐx+B]z0V*Zy6-]SiꔇZQ&y -K,Xk'xx$?_BRj6t[;N{Ԕ&k *  -/I#4佒VzÚYwQKi/R_@wQ-4'au,3r%.0LyGr[=~'9|^ig;V76>sdl!N -@ ?uG^w2 Y~L,D O˳n0qN`5@P7+1L.d?L;Z4o-@Sfn[fI\RNY`3_.o.u}5SJhw";r*ATM!n1%I3\ C[UT0* KAۭ* 4I* J+ءR("kvӽ3z1$t:Igi%].J:-.)-lqHI:B6IaV:bb.$Aa ElQ^iIR$u :Cr*IM+Q$-^$`H: [?):?I\%` l[1[2H\`Jٷ<-> ؂LQ0yUIZEt 0k "^% `t$. T$.T4E\i؂$[di-qA4٠D234֒p#יQH~ʩ4&$.Ŷ,6u: FQaQF`37Id|$姜&K\N) XoqכQd֛X q qA"␢:؂) q Nz$,b>su>ޯ~=WmE +VѺ_{?6} `.獘3 ڜ0SգM&O`n,+^.ŊvGک1wǿw`~z'J97:o-a^䵜Kܣyo$tdy &>ג.1 dϬ/Xx˾} ?ŖRmid@nox?Sea\ڿb)Aah eY;xobm_?WJGtγ #4}\>Lg4Ѥ"wPeguUtQ'|tuB\u 8_sva~[{s5gV߯Gi6j~GdYz+Y"EY_}ba] +;Q6y:O^ONy:4SkI@G1hu*5Q{/?7桛6D+-֭Ξ' wyӡ81٬_F<1p_ˉ1$EAEan9"z'CU:φ({kVDxFk1_3zWQ3Bl7^ M<hvΌg,T4Mzy:?(Ol6]"[-Y cg{HMRy:+_t߻SPݝm{C qYT|rdCqHmvc +gN(:޸7"`X>#yrhWOm6"f'!3Նac|z~:φV:QW; G8bfls/E%,Vq`̍gwxF\@ܴw=Խڸ{(=WPzgtxڎvѰٯE=Jkst=Jmϖ\CqA;V R7 婏y+=~iG}t=Jc'|<:k999gTU8Cw"w0'T>lzGy&OJ!qs$yoH 9'1_oqE6z2!?sYVX^o96x,[⸍Ҿ6!nSiov|<>'}\=}byf$mv;}xOضS֗{>=;Tvy=|:Wd|.y[gT\__1>vu"-v6R'?+V1zSdyuƖYU_'Ky F~ՏaY/8nݮmC66na|Gc;gʋMLuVc~;Zۨu<h{tG4Y۸)~[xbEq90cf'是J?/pf|)O9l~2-O(.π^~N-tόChr8g3y]sżJPcȟc~:G7l>|̨M| +ٹ:.\ۥyǥp]0QA0I|aM&Ǜ4⇩2HE nJcŅ;I0NSL[ȲSu@II@@2TBN?ގCݘm})J#)#w=\͞3W֖WxT>//哩N> +|%Щ3\'ىOeyY}܇}yi!qrFp0i[Jќ_oO_ᬂ5d>iƫKSȇӈ0XZ!|xYH qY٥&=` 6߲,2{Vܧ8l?\|9TI6ݫ)!]ANQYutq,J-G|a>j>ߘ],(EIͰUEpuD}K8 EU 4Dhm߆:ij| ZȖp!jzW^87S6C$^7+kmuņ=:\绰]ײ&<.֎7Q +MU"î2ˌJMj6 I.U& fӳQǭXD\"[ZsmB+{T=MPϫ}ٍmU|9e۵8Vl]vqA(:W(WDžQutiU*ˇUgpM WMv:$y@Set _:*|&Vyl%e.cyyź3U4BU@w]VnkTkwb߸CqOlvV&6vFٮwƄ0Bw}+w=Ȥv˥Ls:u|.ϲQxB_yܨqJg|tz<)GWa &4hue]ECǍa|M^KƠiu2i52ϸmbKdvl=_zssUසuOW$r>CKUo-[;i +b,ȗO*+w 7LwVF;z},mޤo\n,KR[.9kv,=ے=(^m)xTeND2UePmKrQRh9E{QiNt|Tlnx-[-rΡߝ%[.絛zI[e۾iwm6{fz5).{Ou]T);!:J1Q'hTB@m<\xd#RJxOUA?&$E`M?4$WKJ luS$\j!/9\-/B)?C_Q endstream endobj 788 0 obj @@ -10032,36 +10042,46 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 579.873057 101.433071 561.123057 ] +/Rect [ 101.433071 228.873057 101.433071 210.123057 ] /BS << /W 0 >> -/Dest (cb204-1) +/Dest (cb201-1) >> endobj 790 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 518.926036 101.433071 500.176036 ] +/Rect [ 101.433071 167.926036 101.433071 149.176036 ] /BS << /W 0 >> -/Dest (cb205-1) +/Dest (cb202-1) >> endobj 791 0 obj << /Filter /FlateDecode -/Length 4038 +/Length 4070 >> stream -x\[I~_HDfF$4H+`$v5` j<  L)pޤU"V&%Š`h,;g%%1ع2𜬿ge1l IaY<B)<Lңs\\Qy <6XWL1dǐ%/@`IA9iY| kYS^, ExJfVy<)5UN6)& KPTd W'O9+ Ź*`5pP% \Jc \3g \.S  ǒ4dsVO%pԐ[8*xY@!ca2Ee*VeQaYȅ) <0;5,]a9G x4,]5p׺B.↠aXK0]W 5,]Ӱ^Pd`HV!ġD.{Ѱ w)xaA#Qygapl3`ՐRh<.YaA԰ &!a41))E b!hp4,HBd<‰5,@`m/Y wN B b}dCDL.A/:ZelҰ %6pVR&kX7.iX1aA*GE""sg! l gADdeFҰ$T$dFBE pLi)UdLhXd;hX&Y|` rvnf r,M7 "> -E#aq4,(6#taΥY &R<%L,!ʃ,rnI7N/BWXÂY7ѫ%,fRPL4jX䛈lܞ!!>әY2άV [Ւ{᭒Z3 Hjb"QiI-aV}ZKT3sE Ft?r̿lϗJYka$ֈq\~La"vDB!}DT؊n"$\1mv/2$-2͋Tb|Te}sO$#đĈޠ|z.>|rY#ʞx?*k_˟W66`OuG7>Pe8<7|r>|rYK-zCZOx]mz|q}o7X|B=\9a$ \tM6mO8Z6^o=lcq\wӤ*} i+2Nkj|;[\}ʪX{wq 2&oxvܶv?<5&lw*nmW/};6o<.m|9/"p}Ѫ\e>.K;c0TGj0k?zu?1k.Ӧ݅=z:?*S[k1lxL~O׉~NpWmxW݌&28k)ߝ".cL#}>6鋓RI*MquS͸> yDuT/kUʊܶk5 1#&8!Rl*R>L(sPklعeO _te~c5#0?1 Ukq܀ߦl cq_Trx뾦=!:̣w[deǍׇZfr6z sGmqGtN!/]aҺ/O<F`/tf7[ޞnoޞTSmŒ -`q^A| Zc)[3шc(gxAƲ4't'qL[5ΞnVz⪞QiEi4+ bG!O!m}c;o7h.5G߉[]Vڌkp,&PIGV8K 8\*ֳw&G/Ay{zXc{Yd*ezn4sֶޞqYr̃{X RP,p;pnӽHG}zG>L뙾ҽ/k)oѦ$+>)Ƀ)$g'h36,g ~mdWK~F`/ƀrbC}~G5bq>cv?Y0 '֧PO>_Zț/gةٕonZq`}}>t0Wςd@aHy֖$.)nAM'U#n Uri -Q \fגhыsd o7'[S0$O}~Z:eiv˥9烓2z+JQm^n)ydAF'c/?6϶[-xͳ;M`-@P;+1L.d7LYh&o-@cf:❗TY^MOPJ cd2U]3#<$`̲W7e&"_o?]~I]T7%N&s$L*x}_]k^)%:QXM)QPX,^a`Rr!*h XƂ!3+A .9h,e!dU K5İ%$e rXG 1{l0JYsqE%lr{`5^11Ɛ5CPjYe&Y"dѓʃ,.'dqNQxʃ,jM(Y(|9 +&dIYklӫWMив1 pkXϬa0 : pzDjܵ!hXs0 oLWC%g p4,@6$*/հ`ly^4,] +kXH{TdiX'LN#sH9" ܂ݏc6wmc|˧_ՓcaRkɱ xex +ɶ$B!RBZb;t!nu|{!lԕn^ +{*|!YR"do>_\>_\LgԲyU!_kt^]B}>\;eӓ޺|׿?_ jݷO b#7$Ƽтmc遈DFnb+GZҖxB轟dO_vGq/Go?~ʪDDSYb[ +VI}.[%~]U h27"c[]\%H$aں|96Ux8KVO5&Ok~$GL䠹<98ѵ*Gb2v5g49z7MMa}EƬr1uC}Y=^;vx|\Dy@{r9\jkg8nsew].P]ן>y,Ioy..^+7VߴEz̯c=2Z;@ICN6fϞ}] ӆCh<8c`Kk{!k}ͧ5 + aƫ`MG'.m|I|vPO'l{u;j`I[F;N1b;aF{Uw?ZJ燺:xFe~q岶[_qμmbo~&~Vsr'VrC&ljb@k>TZob'GQdXpuS͸> y)+jE??/lw+v);aܔ8Lӱ +ueK-6sWC~iPd&Ht7bZiFRNwπXJu \OГ}~1roSĽ&ޝ*CKYmoT[vQ h}DzMx[de7o3tmQ!iAzw䱉"7(֝crgb}>k~>}~b9]l&-taspm$-ͭ'*r;%+E}?Q>tOsΞwѶ,Jc{ώAϨ*nsF9a5[?,EW0t,ǩުyûpW=<7{@,`0˟F(cbO*QWN"܋: ފBӃq|S&/࡮ vS,OAm=ӻjsWm̢?|;qKczoۭ ut_bT7ivJ9j^vj.h=Knq ZG-?-o8ݤT +فvv|_s̡D1f:VPe_t{^pI~{׿m̮ﱖeb{k$R<7~xX~Tһo0̿w#QW#ؑ'yޫM^9;?GȺãZ"%y9ȱWd4gjVe pS{ c Fwg5:fXc,Q35KklwzY\ ߶}lUY߄yj/G/%ooN/uBc{p/2R%g/&"X!3 +Y#؎iŖcK 3*Qnwz#_&V,'cY^Ʒ8D ׶sUÙHtc呡8CUuv֥e;oL* v _*z˱!Bܓ%!{Myw".'N%$uXAJ˸iˤU4y ^ߠ" O`y2$⛃WJuXӀ4.) ]e3)tG롱uQBO' 5cOY g`J.0LeGr᪁d.Ƹv4v{IC1bxd1'dG# 0F_*{@'q:qo?_js>8yN z+ٮYy?:8hغ#L!?I/i6 ll58܂<Bvtfő|̀]8L占..2O! +i:C:얎X2a\'y +/s-K!~xuNX :0uҲGD:}P_VXPT_/r_;54Lט.V]yvk :)wn(\F6FL]غugUKiUaݕİJUeRQKқ4Yq#niwR* endstream endobj 792 0 obj @@ -10071,7 +10091,7 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 791 0 R /Resources 4 0 R -/Annots [ 793 0 R 794 0 R 795 0 R 796 0 R ] +/Annots [ 793 0 R 794 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> @@ -10080,118 +10100,122 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 683.673057 101.433071 664.923057 ] +/Rect [ 101.433071 582.273057 101.433071 563.523057 ] /BS << /W 0 >> -/Dest (cb207-1) +/Dest (cb204-1) >> endobj 794 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 622.726036 101.433071 603.976036 ] +/Rect [ 101.433071 521.326036 101.433071 502.576036 ] +/BS << +/W 0 +>> +/Dest (cb205-1) +>> +endobj +795 0 obj +<< +/Filter /FlateDecode +/Length 4094 +>> +stream +x\Y#~ׯsExb0yXl;F3;,hQ,:-{$}b_fkr.)L +梲+%N&s8O&R<>oGgJΆ/?I9% + +E+LJ.DKX#$vg%%1ع2߳ +pɲƂ,AT!f &BQ9kb.MNyobb+&c +Y K̤ 4^,>zRy5^,) +/CXWVy"YW %3 @,Y8M%kXdiXdAȠa"S,o5=,05?`ȂHQ ɅYÂ"1hUEgr\ MjX\dz F% x5,HhXWdCd,dAa"]հ ;ȂhPÂ2HC#5YÂHa 2M ʃ, ?l D aANͬaAΐőӰ)fҰdAħaAh$Lְ0f䛎5,|3kXP$Gݯ;^y}^]V/9"rYO5~R:/Olp{{UF"3CugW:zˊ>_xP=ޑۢx1yw_y8|@2^p~E c? *^&|v/ /H1N* H;#|o[pTy̓9^6~jm\WN9/讬ZTyۆSNsUTQ__2xt ͱLrESSkl,]-T$: +oݢqщ|aMdoW lk.Ӥم=z:_?ԕS[k1\Z?Fq^_~o3umfW ߟݛ +~Hj|7);وD+>ϋCC\L_dHdxK>Y50Dh 'ᨢDeATbDNjb]G7H!H}bB:Zc[]m.C~^e&t94QEԃz/n@.åa%\ \'7 >!H6em@/7Ď5X.&亯ic|[9x>ۮ#y>b"Nl}J͓ۼĜI|\他I^1z_7`Ki o}'nzm{pqkOnkŵ|HIh\.6+EZmsb{x=euCu?c~/cjb>?; +w7==nqiWD$ܣfF[פ g{nZ5GdJ?W;,pYם"[d\WMnEeXj> x41f'zCُɀb] 9p~As-}ªV)~zZN4Ͷޞ۹?=+Y\&=KzXڋf(y Ù.Nیus/6s^3M/_ɧe$O\j|$Z&?L[9n6h{o[=G=+dKfr~nx4YyݣzM;^;}-Rs>?X}A-=ŝxbkÎIϩ/סU تWY]GGv2!_1!1RlE[=/ҼKR(uYnWVgULoTVXϮޗ|ԕDBTV9hwWVG| _YN_B熳HYWἻzgƀ19+ۉ*9fk2_VeUn,F6|lBj;5\폾+RUx{ CWwc}:Z}:r͞]`N[Ҫo7;H}d3^Πl^VzUV{~nmM#ay$!r쀮'u1 >ɗg۷V㕞~ڏԱ0ө^9Vc̣1C \6PuRͤQ :mLuj+Ϊ҈)&UaݕİJܵqђPX9l9bɬ{Pyswo{\S8#S®%gG}Jkj%d05䝯?F9F`u$Ki}nJ^+YgvEx> +endobj +797 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 698.673057 101.433071 679.923057 ] +/BS << +/W 0 +>> +/Dest (cb207-1) +>> +endobj +798 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 637.726036 101.433071 618.976036 ] /BS << /W 0 >> /Dest (cb208-1) >> endobj -795 0 obj +799 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 260.429014 101.433071 241.679014 ] +/Rect [ 101.433071 295.229014 101.433071 276.479014 ] /BS << /W 0 >> /Dest (cb210-1) >> endobj -796 0 obj +800 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 199.481993 101.433071 180.731993 ] +/Rect [ 101.433071 234.281993 101.433071 215.531993 ] /BS << /W 0 >> /Dest (cb211-1) >> endobj -797 0 obj -<< -/Filter /FlateDecode -/Length 4752 ->> -stream -x]ێ$q}gK =0l-`k Hzj%V~̌IӨb/A0yisDFcWrE=>_!O,pQm ׷ $ous*`GVS1ŨPi*F냠 -F9K*#Yګ"̠dmT f8UfhHR }TFcu0D9+W$5*lЙh%s*D2HB>I:->k#xJ\at]cw7x eH\M 芺tNI-Y +$.*H\2V~=K\;'qAj#`KV5a -kΪL!`%xW%.]6%.6I\`+qAHrAₐ5tpD]PH{ DlHV$qAY+qA.T6.b|@`22cUIJt-t&J\#)lFR*aK\W.I\33$qA̰KElE*Yx8Ӆ -%.H6! ZЈ%1Ԓ4ǙIDA(q "M0- 0?l{  D#`$qAJ$qAJj+qf kO€b7Y8tZK\MBiIK7iěu]x3J\ x(iº'!;I[l& ro& f ބG/ $7x\$LH ބg+#3Y8L≁z⑁b♁r$LD)V4Z<6_ci> -CĞ"w2cYslN|O{yU9)k?w8U|Taٶ0#e؈XHln1ka1l̔Ѫ] -sh|%[-Qxod>sgdn+-XN.XN2Q9wy`d@oס%xLg }EDOTG3R!䯟~?wO{*L oZ>-M >|=3>TōCVTc \}~Oߝ<wWz߹R|/ )6tЌt3|֗ryE#/4v-mtַp1ak`}u N'}=/Y+wq/ޱCɥ1Fϭ&pPwlLix|4pXǢc2!A2mѯU>bؕjʿN}J㟷c^W›dbY>w>qqnsƪZmڇ %ڮ}0hLَ)5,}(/9p{p~<}p<.W;{cchlxuYbi9L@U2׿t8N~7Nuix0t xwi^?AnSGo1{8>;g.wc|^ߎ _dfmYGUj~ZZڞ~=u`+^-N|f^in'| />5;7nV¶xn6Ax?h܎ -[}l+ӧP+`K6]MR sh2 -k$,ne˧ZyMxc MO绽|Ќ o)aXNFQP8DީK7O@'< ($1nQid5uF n=>]~^vЬ]ѿKmMOu/J]/୻ov1+o-3{qo0yRcd/9[` e7'|->s~kƚ:^궑ubmǶNr.+g6_4&wsC%1 _F9Fܹ2Oav#sG,.8tܝ_ H*g4xĀtÖ"t|='< ;0x,Q%Gm>5#m2q|n#ut7L#`ռL4z"a}%o=+yt2lO"\'A0;C~G}ՙMXL&^nYv_ie:v=&-?э2c1\gCcԇ;Yl^6lԥkieϜ'o,W6|[3}<(sow Ct+t<59ѹܷzI瓫%p[Kg6c`uo>ȏ|rse * -}ȡ4]TpFu+lm-?.4'sF׹0ekzRO6j^FE夢}!Pmik|OQ :see~/av?ҍtM+Ŷt4pֹ2Oc?w"sBػ4ӯ;ATpԹ2φ|||>7D{wl,t:;cgOgO'<N=MgNk~N,_E{喧# 9J^_ZNz "5N R'<rKm#9ޝ+OMsM'<Zpr~9]nS_kKy{ @{{L~df٠'ql}J >=aoOLz<>w%w+7=[~15b5+g%iGM)kwJ׉s7j~pfy蔨.dR< 6@]ɶ])Dʞ~ս.2-c@QmN畮_soa[Mo-mK1旆!JsT1Q3)WSCQ!yGCqzPO f70 CML8MvAn+}VU]MF.-g$nAnU&Y!-ԀD=_n"櫵>SJhn#?LPw +cT_<׵%sӄ.JⷋBn?H To'=21l2~ PRfPjF#6x=Hnug ۹u%w2~q:)77a_6DCl>n4A- jv1vZ㦑f#s36%;Zj5d:7T%RulВ -"1W`d@΍gi -mMɍ:\u^LY91WLfn4y&XکKfiK;RWa{+;F妵纓3p-h1:I(V3QjUmtn^cl6Z KqG)vbH> -endobj -799 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 564.873057 101.433071 546.123057 ] -/BS << -/W 0 ->> -/Dest (cb213-1) ->> -endobj -800 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 503.926036 101.433071 485.176036 ] -/BS << -/W 0 ->> -/Dest (cb214-1) ->> -endobj 801 0 obj << /Filter /FlateDecode -/Length 4676 +/Length 4831 >> stream -x]K$I ׯ3&p$ +FB8 ԋpEd<ޝFiTlGVeWEK)x:_9}{RKp -JEa8|to2%$g?tɛӿ},)yߟ2b V`9`X^/XbJ b@1(E' V{V&hXC'VCDQD<{gc2It0NKx]xY\RZ94xl Cy`%^,I/BxWyEy%^KH%T q3-.Z$֋oZ# d%YUFYBx gCn5yw[esŘ@"YT`-$ 0!, I `](RPĴPVB> -UőjBع"DXY@k!!+aE %xKJ{ ,b* ,FOX@.\)IX`)ab ,P:o$,]KKX`֢ȃ,p` JX@]UFFXuz +QIX@]IX@]D^X5K"7p8e$, !%,,%f]@HX"RK<6IIXpE#m -+ҢR8.`HX($ya#i ƋB*a"' d@YGZR^xHD_p$, -yIXzI6E , ,H$,@F$[, E SHD$aAp*Yb\@ B%,/9]bI‚ EK4%,H%,@ DY JXMD镄Ш%jG*יQ‚H~ɩ&4"&$,}r$,@beȃ,֑1\nF b,F $YIX_r,a`<$,H:4$ae7*ԛ(}f dqHQDdAҔ} LB txD$s%,@zx$sK@&Ef%,MdRm. ?1WQ<1P^*(`/U 7HDexj -Vⱁ"&Obf y ۂc4WcOrR~4Қ_as;d˷)AiCbia=fb!5 ި|ZD=etB(9d}Mrto,)I>o%Li6!;-.D}:BţM&<6/2tE?p–RC;_?ӟϧD)~ίf}P_jr4׏Oi}EB?˯s<봶@ʑ_8M>Kom֐1j;gio嶔xhӿ?|}Õ|8\>615|~ґkvWl*s%a-qާ$u{](w撻9V>W[w'ż;7BxGެF^m =k^ Sp X:5yNd*iR[Y@ugҥ6Wvhs(\Ht{{X{ؗ=Օ4ydTQ>HGL~X܆Y _#i.,lvTN.Sfb9a6){azg8G8гŚ%fy)1g烃97_#Ϝld DM~x+)ߘ1QwK8ionѰk#M{bwU|n.;A6KRy_w^Qit7@cQϽ3˔::~oB?jӮŢ"ʇzwM^]ǥa}W"5{E'a"3s7t{C\Eֿўmͺ\\CapoWtuGd~`m54&|zn2뢣ǯ/ƭ7 -mvyl?;TksMŷ:3ٌn=2[i}M~ck{Zۚ9\ujM GNsEWf'7+ΔMDHW2ޚf3?peIװݕ=D~84mOmϹw;n>;^/:V]CwLVcmpV+--[|٩YTysYL㾙e:(׭{4hvUr602[üěY_bzql MqL1isc<4{a纼),9w6o߹DMl-!l;qKϾć]}'vra)6k˾@~I%}Po}%HQ -4&VeF 6V+R**EgAI4jecnWU FBNJ>^f令* -}uq6ImA].zAkEfQlX i/l-ɹXfmQr[mX릭۪f K8!S-m<Z( 8EmܖkPjw*kb¢4} GSj?L?cjW4Fb>~ۓLM28N;}{&K]s҉r\ -9v1/hGDcn ;r4nQm;8|iw[~ȖN DzOΫWx̸z(7Ao;oUDŦdCMUU[[93E򵡚v4˄JZnvH@J |fh#QoZ;t9h[*VqtMMC6v J yl 0)5f(:\Lvkj)+B)\ӎ[+q]өԪdzIkls*z @ҒB'k'qAP8P-H8K)J\ lH\ l q<%ix.` R-3>oqb\þF)QdʃQw|<EKH*aݵRwumu;ãy~]wlSCKp9)#zTWv#7~_ߦ*#z-ʑ@2Ϸlbu}2F_wrœV|XXFѫMr[u,k;2۵^8m}8+z ='H1yu;B/1Y,.}B4/%%*VdC뱟WGNwy4HC%=\OD]rfL8}~~mejA~e4P2y.ӡwuo?nGݽ'Zcin=U?wեf?tSƄ:r>.:Gw\COLwj}gp󣻾pv?w<}FMx|H)_Eʹ x'LG:y;-=~hD{.ϳtHXpQyyU{ר&QI]M8 Ejфlaû0V QKj:AtJiThbϚjwS:ml/ri9lEmUpc6Q]vqAH:W(W7 +PnGҥ!֮WTᚔ' G=^ &^w(uH~No(;ٱtTBz&ݖJ:t $c- uMVq(TTŮAm%v6Ujy=ݵr7|šs;Ux b~tQm nH;eqoԯ}I+K^uOV1ԣ4]:nTc Ӹu%W2Ai3 : |M=^SƠiG}8Mvw Mo`/mm|bf +csp%:+Nڗth q1ˡ-[ɀ+i]8.7/mQ_fǢ,bH؎cJOob3ڛm,ү/ۚcaujea] Z]g+ X)U٪ҺP4LUY+1T|V%8Oѥ{ڍ:э7iܺ5o6ȍpuldd~ݤS*Mj{A=SճMGxhH`,Ԥ56'(w9l#"5V2քXZ4/ل7(cPT_r&PPe[EMm"(M%|G endstream endobj 802 0 obj @@ -10201,7 +10225,7 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 801 0 R /Resources 4 0 R -/Annots [ 803 0 R ] +/Annots [ 803 0 R 804 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> @@ -10210,410 +10234,482 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 332.073057 101.433071 313.323057 ] +/Rect [ 101.433071 638.673057 101.433071 619.923057 ] /BS << /W 0 >> -/Dest (cb217-1) +/Dest (cb213-1) >> endobj 804 0 obj << -/Filter /FlateDecode -/Length 2995 +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 577.726036 101.433071 558.976036 ] +/BS << +/W 0 +>> +/Dest (cb214-1) >> -stream -xZ[\I ~_+.nR P - -M<|ԥ=LDF3]HySCd=>>(Dhlw-Ȥ%$n'H X?W͵Zˑ񗏦R BQ5QJ);ؚT4꭪<`hQU-,z*bD@HU2=]kDO'rQNZ9XR#t XZ<]BXb- -DX9 -,ꀅ2kRAG[]R!O|S\N6)G%SjXPt,OHRjuNk-$X 6cJ('(/yK ڢz$Z=-E<-ͭx< E@Xf Eqr]HS $ :x\ ,Q**5@J=..`ƕ•pq/XWRhWf +qwE0 cqwx\]qv5k% + -ލ!Օ3((x7&<1Q@Qc?f]PH`z\x] 0YHK<.H]nΙ[-{\\}.sna97 xJ<.H]gQ ˂Hy\pH<.@| Lp]WZ=.H]RQ8PHq8P 2xy\D<.]R=XF @ci$"ӁwÞKTka\LG rJF!su9<.(Ae:`Ѣ MZD`=.(X2x\ 4FwqdBmQ.P Ux\PbT8Kt,8* {:$ Ӆ٠5VT<.@F- S{:%3UsTT`JW, ?Vl' PDEz\Pkrz\P+D7,4d|4d @y\иތqΥ՛&z%snd7M%!Equ9z2Ħެ @޽VoӁwf @֫ ě -3_Yzb{e@^Dj$0QY B^pipY=dñPdn_~:|ӿwm7e -f 6l7*l) -L 1M Rܯ "1m;| x 1#ٞKeQ'06JK|#@82cUukgX#LЖ^|o?܂=o?? /qfkDt߾Ń;5NR%=3ïo'÷էv-AfqD֒$_8E۶OE ZTS؃kh_ldI`6Eڌ??e.5yůXIv^UgW S"S֏u_cv*pʃvA.b ]g Z采݇K ڶaWx9z=?@ R/v ͻ\7#*+#e}mK^p/#|gǘ;-h΋*&;/7ݎ5tgݡJwG۞lhf75Wn;tw쿲+&3?>S\|+{'HaXLK>;d'l}TWIƥ#cJ{EbŚp͈"{DCj m|vs5Hbm3lncpw>&߸>Ǒ<y_~\N{lW}6GZ!gxsmydr M4 hDoo#G>-/m?۟_&7` :bTebi̥; QBI6&zhtO}JlyaGox+do%9}sbZVHrSaS8e{X|Lx:`Y޻R{q֧֍4djCzϱ!:9ˮYX#z?Gt:ة2z9uO(ե;Fwr3B?^@kt)?N+(u[;ĕLiT8]f7LiHyåv"v6H<Qe]ť ]ŕF؅t1"GAAcyZl_"SiD"@ -S> +stream +x\Y$m~_Q6 =X0` h`S`X#`f{zwN*8$#ٙjsI/?\̒bsQٿo +Wk(-{&\ח ]/?>R/" +eWX!,)V XƂ!#+A *9h,Ae!dU K4İ%$e A w +φ%BQ9\\Qy <~l,1Ɛ5APxKd4d!ƋGoTdq9y vːޕUd1XWJ&Ry Kg^aGH1)<Y EAx~4p"[nox8HA_C!IQ젅qIBő.2e \. 5p%,Kp xYE , /aw 4,8x-[4,[2jXdl԰p!Ѱq}a•끝x.{Ұu}N =z<ְx$ m4,Ua԰uِu !@{kX@]-rw]0N:rQ81j6=,X s^ 8%-ʞZ-6aA 󩼲+Z^lEÂE.3kX_Qk="ZW!hXwX, k*,aA‹@8հ`D.{Ѱ wM^Â5GAköU48  k<1hX65, .kXdNÂi))E b1!Syquа  KAJa5,Hx4,H eаR,o<,p> ȂLQ ْ )DcЪƋn p2x6iX-VRKƦװpaϒ@l 쐙k< YdkXL\l PD aAΎͬaAΐa|ͤaA1ąd aA# /oPoSmͤaA!<Ȃ(z"dq4,(1r5,@zz$Lqp7 "3&2[7ސgVO 7 G؋h3I=4,sTO VF=60_ctIQECB̉Y-9f3z>\~{\UOEP[+lW`b\ 1O1/Y!* ި"W|^式>%,ܔI(Pp9 Q7A|0/'@Mt6)Sq)GFg]~?z|~'gҗay;쫿[\m;/<<7oy}sz?ݗ:v8icy]j]BgSx꓏u1\SW$8͍4!7 h뮽m5mgygBi޽ݶ}6Ye+6cOn&Sm]s ۵yNU[}>ߚ?ha hi{݂W1v,z==^ʹ3Zx~׎1xOR?`ek^XoKSirhZa~`mgItoOV(^W1ؽ=2] e@^Lv\~{c}9`8,bc)#\{Ayz/GotowI_Yvv ;gj_bzw<Wtc"7qsՎm~Q6αX drQӔ~F9ϪŇW + _i3۹*^) ڐ um J7Vc*c[^O=W[oX?ljooǩY\cۯ՚"*>ߓ5qiZ?#e 'WѐE,z }iRvb}T몣'&w*%gjr멾A_BOU6^3O3瓲Vjda=~ +uXi}]iqc[{Zۺ'F&Wro&*So:癝U9iQlzv&V#(Nkn(t瓡c;{<^O]ch f?ymR~nc5td3ϊ :`rcߩ(V}n#euǏE/bMgbuYqu {H~r ߄}-i^BecܰqȝO͝-n.fVICك}u{K0ME]?l/n8j5Խ%SbM3۷F3rp%y n+^9y$7!c6..m\lyWP̽Vs; +JriW.zE?J/j]5-yL/" +875ȑ'WnDZo3z6=͂`z}'=[Ox)o@9խ?6'[>o""[lp6o->r+JY%[tͷOs=o?c֩c6Wo AY|>|rIob>۷~}'Йë:n9}\??Pg?~}vcicxň;{;y 罰KÜq58n닏ƭS=swy|U6vpӋo5XF7Nuuk>Pm9ig9>sToL׽KKKL?C7lsCNݰ9q# nqy w˯?9M7o8?؇)&nG&~#[26Y;o@c'N%$uXaBw=IbAfˤUi=BETFp)~mƼ䭒$=!Ml+eS>+DiϠ;ZmBeJAjǖl 2CXJI4]L7aˆ< c3&V{Nr"iX;Pc\xdv'dgF  0F_*ցNQun2-.0|pGo^2˲E.t5;3 lݐe$@BNF ؟dgнaq^n&v \I S:f Hd63`/x~H +r9̓gH!qMgH 9(.ńeJRN2T4ąH#O0+ +)r`rҲGD}0u@HXST_/r勾yX^=?5fjA 飂g I6@14ice[WK]qVFN1*CAZ%=lɏ(HwNsufdVhQT-}=^2h +gfjfph.{YNV<ߺ@M6y담MB.DYYDș`7+u^(3Puzb%Mw__udIP}'n}ĥ"sқ͝X/O>mP; & +endstream +endobj +806 0 obj +<< /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 804 0 R +/Contents 805 0 R /Resources 4 0 R -/Annots [ 806 0 R 807 0 R ] +/Annots [ 807 0 R 808 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -806 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 770.673057 101.433071 751.923057 ] -/BS << -/W 0 ->> -/Dest (cb218-1) ->> -endobj 807 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 709.726036 101.433071 690.976036 ] +/Rect [ 101.433071 426.873057 101.433071 408.123057 ] +/BS << +/W 0 +>> +/Dest (cb217-1) +>> +endobj +808 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 130.126036 101.433071 111.376036 ] +/BS << +/W 0 +>> +/Dest (cb218-1) +>> +endobj +809 0 obj +<< +/Filter /FlateDecode +/Length 2863 +>> +stream +x[ Ss+H݀ +b4)>8ۜqsvt/{Cj$DDj/ Ɵjm%f{Q(ooq]҅IKHrM7&JK?O._l>×ZˑןLJ-jPJ)SvT5O3RѨ3`XU^`F, +fpKQ1DDG)dLztC-6WW=HE9k!眪SؒK%*y:آR˰E-tDNst-=]ZUuu :"y:QX\]-Rsu% EO'EtDRѢ[H%cQW[b-TDP0.y mQ=*AVR܊!.!ؒ4{$-uuEz,[cl* Uxn{,Vpa&y,WjV•sX .½x,PWR cL =Awx,Ppa=`U0{,X+y,Pp7VR +Ƃ-Օ +ƄGvnp7& ܍8J] $l`=`.t" ωi*pmcAwb\] \0Nb<$px,H.Y=;jX]ԞcAw7$pH<` Lp]WZ=$pX  + @C=dp{X]J" 2KcNL#Y A +Oc=KTǂ ڶ dcAZ)cAnR>WǂB$ -uhҪǂa豠D؂c2ٷ[[(lA$ z,()ìzC-qXPlTz|tc̀cAi[Qc؂$c2]=[ z,;4jILS:z, &4AJW[ X+?(6Q:"I=ܬ j-՛cA#؂cA,MXCG䱠qEc걠 DmlfX$( ijN܂I7A'OaKl걠lfX4&2zHZYp75ӁL\DfWV8{b@@o؋ݪgZLT5Vdr E>wL>GTPgb~|ן/_c/N"aw(0kG@ MPt6Z&]l,0yaN8J?-fYgmPyt&؟6shH' ϗcw~l'pRusvZק[?|d'g"Oy ÷6. ]mLM=3Osvdti?!ER6׍"& v|ss5' 0<  +t}>&zA^B">xpB1bGZ!gxtny/5x?n"xCQ# b.VޠQw/λ}\ fc6CxŨ4Sf_¨#Fn?Pl#{!n%Bmtnzh?,9Fm`G;3ߋ)!/j*S1!vv8o|VB0 inv{>)S,>uðTJwgEbT[ѱN9ԻV,/f7a펤]usReg~2]]xG!-#$YmZ"~ މTiRwU(KC\i˔p> +eV*Ґyåf^A,6WrtG1c'2enAj,uCl3X +8 W~i"Nf?((tEusmSǸZ4[ (*LsqYI^Hd>wm}pF4[qpYN|Yĕ5[:qve6-;i2u)Z.4.etnk]?)kdc'gar`ҁ!}\L:Ke˱^34%d$934fjGi :viоQ \@F]6z,ݦ|֧eR9ŔtZWeLbZW%ߵ~7% PZݹ̧rՑ!R~l=w: 33y[kIعk_IyZHTsCԾ[/Zg%'"d T +Ol}h+oqίCvj?eR~R)V%H!vc {x:B_ +endstream +endobj +810 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 809 0 R +/Resources 4 0 R +/Annots [ 811 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +811 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 797.673057 101.433071 778.923057 ] /BS << /W 0 >> /Dest (cb219-1) >> endobj -808 0 obj -<< -/Filter /FlateDecode -/Length 3904 ->> -stream -x\K$ 賁^Ⴡb ,Clk# !?z=3;kAt,ȏZlO!gJ9dM?Mbs?Y&J<`B&s:?gw)O?~uw]<3(\rQaU -+FIa%g0Z5Ԉ<YjP-QcA (5e -5|v1+,g֪<(bWx.'I2x.{I\tR,Ki]#P(Y%R*:U**dƫZT^ϖ\gCՓCTC9 |RN`K!ApЅ*J] aASа m ޢaAܒNÂ%뒆 5J"  T5,԰ tY 1y `7PIn g5, nSA8@G\ p785, .kXY5äa|RŒ)@e pG A]װ|Ұb?Va=x>hXƌGYaA4ʸR -OU2,-l\JUÂE -D.hX7Ȩ^ÂuZwVÂE5,;@7,\WUck)D.`kX,lllHNC5,H]aA k eʃ.x P׀UbŪHa5p\5,H]N_4,Uװ 25aA<|*/\G !TtL65ԢaA%xaA%Lut.5,R4,1a=jMɀkWsY ; 2AapaϑBHExTA9 .5,(`XK,3RQ V@J]`~x5,M,sTt 4,(rhXP -tkXfְZ肊OÂj2Y8xjXP]zӓK^o jXobm כYÂJ%DQyESU&I%+iXPSfѰe֛-ͬnwc2i<.*Ӥa.De-7fg:;[- EꞁI4XY 鬺m` 'E9ddEXXbu_N_? WmloDR4fW !$ȏ T;rLYkۮE#^Ne)>nX FݡB7A HwNik$Z{9(Xd5:ԃlssk.!sɖS$fYQQWX]ˊ1f݇l(3mɼ|xw n|h>$騚ŇCEPӒIФAu4^D%rT񍂲1|fm&l%, O*,F, /% O 7K} ?X=<{{fP W2D}gBrp_\xѾ7Oӧ5wn+zʵnbMyÊ?o%&P|f0eW}YzJxwzǃryGrM-4=۱r#vfk{ṟF}=ۊ]wKi>[_}wi70{ΪKWVq!avv?I7ı6lswO-=wwz~Yse%vKoSD@k l~iwCAZi~mvmMWmJ[mx/:=f-6Y%og.аcזioKU{ף[>k_C6]%2x.?^k5Η{͏];a;7M*| ِކ z?g03}n5|`_}Vza_V?mJ̚'a5d_ɉO]|L~le?J$5>^]fY;U]ry=^>]=Jǫv{1YxjEݭ¯l7+6n`Feآ`${؆yF9l܁eGm]u&`Ooپг=G7OV !rdr~Iv -b<n= }?:4Mq.MYt#^N6쩏*@M z;iA(U'59!4I!;&LYx2\r -rRzkqTReZ*CWhF-D0n\̹E?/H38JDž6ד ڝb,j.TA *27KLju±9[#IzC%+r>+Ut؆*L&&xlnz$3 LD;@w+?nK8C>:KN{.r(yθҦ]xidv2:Ydog[ R FyDD'vq/_O-}SvCֲrB{u_Ʃkvغ!L_QI#58F= _dWl0inI7M$eCAu 2,d^;7+a_/Zσ p!˲xahW,R:ōRtXf5!e'?ɩܗe_ţfeӃF!DPy!&';}?9^=]4"'QR:Ov33_]m{a9+4ViA 飂Zm] Ni6D14;h)LP6;:]G0 ;j!7(VO-Erdߥ퍓_-?km -endstream -endobj -809 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 808 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -810 0 obj -<< -/Filter /FlateDecode -/Length 5337 ->> -stream -x]K$9n# 0a{:jFYQR("\l+z1$#Wڳw%SJ9>_~>r2SJCIџ8yC矅@qٻ_NogroN.cn98~$)W2%%)F烒WYK>}Rג;6}R.Z֒>*IրQa&Y?tzҜB.ii6:-h -ZZB>ii ^|6VK[f^(QK^z'+i @^L0VK4մ4bڧ9'f!A0H!*i㳚^<xahi O1%E[h7Z/EV _CAh$aqXhIC1.CHsV2sА,xah^( 2hX@^eHeecFR -ar!JYSBݣ%%NA[awPRM/` D0p0pj4,Nàader) a "L' iX] -:o u삆 cTo ;^#͑lrpK4,]aZM6aڄSd#z\[dCx. iXϤa0~Eux%Xj- k]6x.aap4,}iy29% 4.<Ӡao³b{$LꌁzVu{a:g`#`e -*Q 0:OQCLQ^2C-}9lt#u~<}{~SfꏅX/ e7j*1B\X*$lļi󴛰 c ]3 k wF`1Ztn/wNf8wEs@ ҧOۏ/v1I<$&=ƚ[| =>\rY:5%uZyC>]*5]Ukۭ|KHK5oy˵Bjo}>nTِi-tݝףN~˃n_g;ma8Lq=;gm]H ]'J#ShUW AD22RY0]ne'(N|m !ΪzyU;Vyxg-*";#eAvrneq̹v2MR|ۣ%؍tÍttwVr[tLN;ˆ9̻YW8A"w+!V#{s U ]2nVerŹ\WCE.澴ʉK0: Ǐ~&ȃK)k\&×=l5/pCq.,^ok1c;Fˁh ira`:Y/d0&Y&~_`,fA$ _U^89`lrJ׉SKQxAeF3LO#h>M4-&c8Y? -z$EmY]8r<n&CH{q 3X{Șg ֤l/qy9ˆQ1;RK|o 7>Cz)8G$09s y>g oHUe"Հl#re2apnW{?h/9HHỉl %MfÆ;=Zۑ6/ֿV*Xۣ$jueiӓ$g¾%ceƄ6u^ #hnؘZmg[-kJF<js6eK Lčk*웮; j;EK76,@Y%28Pڱ2ϣP@E{(n=:?nC;luyɥe}2muol&{Rٵp_K@:OdnDn.ct]1SngwqGmͧn]:c띳f<&,48 R,7*[I͌(ؚ{krMX*'{}Pzez1;yNBbe~h_ױZb}i11~ëŬ]eb@m=$u>pcN_57I. -a N`Q7mȣtegշCs[jhaGuv"[oGA]|`4([{މndj\E6'yTCSJ[gߏi7jk fJ,YAsce*2_ddkt6Z-VG"03`02#F-{Ɣ=Uohp[ܘH.%'H87y Gip/{gi1 hpr 23r5r_6/w|:y^l#sE@rɖC oC1-־X6zvZ㶓$qJ!yF)xQ a.r}U+4.hB49d.&C1mݝռjxo sov3~6pHg&GgƊ<iC'Վ͓-L+ߺ.,zun8/'4K[*_aRLQTnT_s6N -rRߙZ5c0[z7jr q˗k>t9|rh=: -Lh #PڤNn܎x9G%_*z=z9E^c~jV\-_7 O`̹/OK#㒷.cپl2J~ݖ؊uYG' cMMY Oʞh*hn!&_VOT՛XVB ;F4~[W6ޒESmd!K_ŧ5 - y/\\V?.JYOby'K +_{Y~_3 -\drj$˗UbS踃lӒWihvܹy)n`9mCPR{_#&ry3|,Hd\QruHnulisW%$bґʮ+R> -endobj 812 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 724.923057 101.433071 706.173057 ] -/BS << -/W 0 ->> -/Dest (cb221-1) +/Filter /FlateDecode +/Length 3997 >> +stream +x\K$ 賁^Ⴭ,6Q]XUYAT,ȏßBΔRs-~ꤱOGg)j* !\xͩZaw=aZ w!Q/ V{|аDÂuOiq& "pLʫeX\[XٸD4,]gѰoQ2:_!jXw0oYʫR4,]װY$QyccQjXHUÂܵ1 p]Ba4Uc=Bw k<வjX65,H hX `aA*djIÂT-x(T^28d Bdy1Vv _||Ra1bigkߝ}%煀| %~4k7%CT-}-Oo~?~|u<m}:2 EŊ>/Ƿ?]ЃMzpE )n"ܔqϛy5 F_C-_x-yp,˚л3!+EhFk w]6_(>_{Zx>qa ڴvX{8{[[Y#EV# )0(ه5Ч{o'(-~W^qX<ğ}\эoI|JsOK"NZu~a+o<{4#|m|fFtϗ^?pN[0Lu=f԰mJ[}[jɖMuf>o]`fk#p-֖^ݺ0.ck=5t-<ɹHxNv> +=>_ڦo},]c; on"n:4]y<V`{a{_}]Q,K5M5Ȭhz+sDk9\Ix_^_2Y~,o,]Y~K 5T~#3 Yo+/>mQmv#ng6TrGe*=yҽF9l_ 4PV2Jed +nú FS_1܇}ucCEGћ:d.lQY:RڰlyOnlQ삜V߶>D^[iU>·#Pg'FQkÛW7kxo羈/6\oW|փWmvZ91V7ĎXԅ^f ]­~ht9?U [x—,.V8bLi󹫸Q7pcNOzrIgƾ^]mg}v/pu]ݓdlnVg,6[;p=3nA +|=qCp3^nq/#:G{M0y_aPGcr[DrGHć55;:d!"#! E/v+ٜtX+r'i{ qd]M7\Ugy}oQ$/ ē{M; kd|7rʂm.(>t?~ǥ)ҿF=^>bn>R{4ĵm*y~1aȏ$ק5ú+[>E roi'6PIhMF.L'L4+'L\h(L:tpHhr8}4|} dPh;V2=Go[br*1uA $`1Vt7ɞ>TK8Tsbb:OtGʏ;u M&sŬCcgbDCv9t:rKkqTRe^Z*CWh'Qg~,U}It̵-ox:D8펝tXacw=I A.vˤP\L4~"*#O;p4\gA^I@,(OYa.Yi/W"Ϡ;VTa2Aϵ 5cMv!g`$ڮ8\qEzpYrhwGIc?9 +SKl%${;LbI0=Z:{] 2-Z!tǏ* ׁx-Yf2~L/6I$2ecǽxMr;Knp%1N +]WG!ܹ |MV8i0SQ43)\BFq*:S쐲az֟TK2OLNk"(< ֕>_^ϞE#QR:Ov֧##m{a934fiA飂Ze@R:bhF딖˺Yڈj> -/Dest (cb221-2) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 812 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 814 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 687.029014 99.933071 668.279014 ] -/BS << -/W 0 ->> -/Dest (cb221-3) +/Filter /FlateDecode +/Length 5430 >> +stream +x]K$qׯ0t`%C-5_2̨JVM ltd$"tg??8əKt~ɚ[$>;Kɰ+1G!dRaㄿ6}q5;{SJ}$ +&,+II%٤9*Ib)ZDI bPɬ%A >+IbJ. +ɑ1\$9 9VM (x%ͱhygb.i i.y--9vZZ11FZA.ii YY- PIK%`4s +ZZ,S Y]YM,6Z`d"5 i޲Ҝ3 jF:)&%ChiZZ,?ZpCY^Fwii YOAt>BAFpIILYCX:yA)jHd!\5 BYA aAEÂ%[xKE bZ 7H@.ThXةaAb' P7pn5,@jX@A(@G\p784, .װjQ9[ % L `а +z^zQ(XBXw V{a +3n uO@+r0petVKhqeܢhX]awY`E0pXj- |0p~kXu0oYV-9kX]װV $QӒ"9 հ waދk9 "p5 5,_4 [eLY5)4ua- km*D஘M b@@/kX3R԰ 4|jZ4xf YjdD6%aA%xaA.Lq@] l)2v~3"00F9q J}q'. MY@i1nѢs=Rߘ_I~v#\_"O[Me-iq"sGӘP`ľ}pk^t]hژ#̆0X>jYUѸW?zi^Ji/2+hIŵkou2`jw7f m魜T%wͲu>6oonAK6e>LdG"ۃvi-yk"=Ua ko{Æl,[Km(uk6]xm2Tk^S QmAgYϹ.WV1Q3ǗU#*Nm^bC˰(fh$Dv9+܇֔eg&nvl&{Ț2TQڡ +h +e)]vӑ7e㲜9R1Qw05˥ ow(ު1o-6& +Svug],˼gG%' +,C,ϣ$;񛾃aX+̄ lLrnC, f=n&Ho_}.9YKѢ\M̃<Ϸ "'(ujaxͺ{w칫rw&]m;do᯦hV)mh9eq%) +⬺QTDvvN2Fnۥ+1_Lv{ə&{>f U5cAH0K 734V݊]#p +~Mq$y c&Vn2[7|yVF-FvJvŘxX{cPVFyn/pt=vV2Ϩ29Wz`9ʛR@Kr8ޭr{Ko@Gwϩ4 7-!ynn(wUD޸hcyUIrM"O[;6Os4!'ZFwq˸ȤXȿJ~;ݲHvގmwisC,@PVK>͡-(R>&7e(ɍ_KeF&l#tM׉)zn&mYo}[]`<ݖ['tqԲk9yS}j-y;nM~M,md0?,ޟ- M6;_咿A)ST;Ǔ8͗oLJ~~X')d.C_m+ ^aڒ)ۜ~m@?lr?+9S=6Uݞ,oo6)6Q}#.Rw)pa<$`;"n!{q]tq!6s]y}jÖRPsQszh4*9[P'zR?عh8Lw&ظH9Bz=ҸTjZ_DYT= +DMnȽs?d^͝+J;lj<^O ]/ UBo3MP _U⨩j/OK%26yH==6!%o\.}{l-wkk.7Cc55kd}VD; 27UX9 UYuέ܅v~z'cNgk5l%繒,¬>PX ~TPlŪt_(SA GU?! $T/,^d:5Tx֛PN +endstream endobj 815 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 668.081993 99.933071 649.331993 ] -/BS << -/W 0 ->> -/Dest (cb221-4) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 814 0 R +/Resources 4 0 R +/Annots [ 816 0 R 817 0 R 818 0 R 819 0 R 820 0 R 821 0 R 822 0 R 823 0 R 824 0 R 825 0 R 826 0 R 827 0 R 828 0 R 829 0 R 830 0 R 831 0 R 832 0 R 833 0 R 834 0 R 835 0 R 836 0 R 837 0 R 838 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 816 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 649.134971 99.933071 630.384971 ] +/Rect [ 101.433071 766.923057 101.433071 748.173057 ] /BS << /W 0 >> -/Dest (cb221-5) +/Dest (cb221-1) >> endobj 817 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 630.187950 99.933071 611.437950 ] +/Rect [ 99.933071 747.976036 99.933071 729.226036 ] /BS << /W 0 >> -/Dest (cb221-6) +/Dest (cb221-2) >> endobj 818 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 611.240928 99.933071 592.490928 ] +/Rect [ 99.933071 729.029014 99.933071 710.279014 ] /BS << /W 0 >> -/Dest (cb221-7) +/Dest (cb221-3) >> endobj 819 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 592.293907 99.933071 573.543907 ] +/Rect [ 99.933071 710.081993 99.933071 691.331993 ] /BS << /W 0 >> -/Dest (cb221-8) +/Dest (cb221-4) >> endobj 820 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 573.346885 99.933071 554.596885 ] +/Rect [ 99.933071 691.134971 99.933071 672.384971 ] /BS << /W 0 >> -/Dest (cb221-9) +/Dest (cb221-5) >> endobj 821 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 554.399864 99.933071 535.649864 ] +/Rect [ 99.933071 672.187950 99.933071 653.437950 ] /BS << /W 0 >> -/Dest (cb221-10) +/Dest (cb221-6) >> endobj 822 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 535.452842 99.933071 516.702842 ] +/Rect [ 99.933071 653.240928 99.933071 634.490928 ] /BS << /W 0 >> -/Dest (cb221-11) +/Dest (cb221-7) >> endobj 823 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 440.717735 99.933071 421.967735 ] +/Rect [ 99.933071 634.293907 99.933071 615.543907 ] /BS << /W 0 >> -/Dest (cb221-12) +/Dest (cb221-8) >> endobj 824 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 421.770714 99.933071 403.020714 ] +/Rect [ 99.933071 615.346885 99.933071 596.596885 ] /BS << /W 0 >> -/Dest (cb221-13) +/Dest (cb221-9) >> endobj 825 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 402.823692 99.933071 384.073692 ] +/Rect [ 99.933071 596.399864 99.933071 577.649864 ] /BS << /W 0 >> -/Dest (cb221-14) +/Dest (cb221-10) >> endobj 826 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 383.876671 99.933071 365.126671 ] +/Rect [ 99.933071 577.452842 99.933071 558.702842 ] /BS << /W 0 >> -/Dest (cb221-15) +/Dest (cb221-11) >> endobj 827 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 364.929649 99.933071 346.179649 ] +/Rect [ 99.933071 482.717735 99.933071 463.967735 ] /BS << /W 0 >> -/Dest (cb221-16) +/Dest (cb221-12) >> endobj 828 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 345.982628 99.933071 327.232628 ] +/Rect [ 99.933071 463.770714 99.933071 445.020714 ] /BS << /W 0 >> -/Dest (cb221-17) +/Dest (cb221-13) >> endobj 829 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 308.088585 99.933071 289.338585 ] +/Rect [ 99.933071 444.823692 99.933071 426.073692 ] /BS << /W 0 >> -/Dest (cb221-18) +/Dest (cb221-14) >> endobj 830 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 289.141563 99.933071 270.391563 ] +/Rect [ 99.933071 425.876671 99.933071 407.126671 ] /BS << /W 0 >> -/Dest (cb221-19) +/Dest (cb221-15) >> endobj 831 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 156.512413 99.933071 137.762413 ] +/Rect [ 99.933071 406.929649 99.933071 388.179649 ] /BS << /W 0 >> -/Dest (cb221-20) +/Dest (cb221-16) >> endobj 832 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 137.565391 99.933071 118.815391 ] +/Rect [ 99.933071 387.982628 99.933071 369.232628 ] /BS << /W 0 >> -/Dest (cb221-21) +/Dest (cb221-17) >> endobj 833 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 118.618370 99.933071 99.868370 ] +/Rect [ 99.933071 350.088585 99.933071 331.338585 ] +/BS << +/W 0 +>> +/Dest (cb221-18) +>> +endobj +834 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 331.141563 99.933071 312.391563 ] +/BS << +/W 0 +>> +/Dest (cb221-19) +>> +endobj +835 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 198.512413 99.933071 179.762413 ] +/BS << +/W 0 +>> +/Dest (cb221-20) +>> +endobj +836 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 179.565391 99.933071 160.815391 ] +/BS << +/W 0 +>> +/Dest (cb221-21) +>> +endobj +837 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 160.618370 99.933071 141.868370 ] /BS << /W 0 >> /Dest (cb221-22) >> endobj -834 0 obj +838 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 103.777305 99.933071 85.027305 ] +/BS << +/W 0 +>> +/Dest (cb221-23) +>> +endobj +839 0 obj << /Filter /FlateDecode -/Length 3914 +/Length 3623 >> stream -x\[K ~_1H(]7 񀄀#: AC$ ]qff79"YMvʮe?+B?p.Gǡ㙼d+5'w\?ӿc\)P<].9h*X`r1DXł1KkVRKXCB(@ L|ͪ#d1lC -ޛ<E8<.ArPM^rx.eHR,O K,^,DŃ,%[Y87y%/CTW <'WZDL^ϗ\yG xD.6I)YA>X<,K15wgxAl!A da@I b@(HP $g` $l{/!Kd!dxɃ,\,,`,A -܊daoS[X@\.I,,`@.LZX\vZX]{S,%YX]p#Md[XttL-,.pn,,:aB)` `Enn>XX !YXCqof]@H`2XXT Z9*5YXT}&:ив@D.XXw‚%Fx] -[X0GH,,@|sa&:_K wKDa eC" # wޫ # iɃ,\k>dx]Oa>W pWæ)+! C,,HE\9YX)KhaA D@Ƀ,$֮r-Y8 r,H,,@F*!6s1,-,RE,,1V-^ -d+Q gqdaj)WK@ H,,U,,@(r% 3xYd[XL<" J,-,(LDhԒPufHr*ZX7A 4y0aaGha(sLd(,Y6TYYXP}r&[X{ *ԛA,,_jY,,Qo3rz3[XPD(& iPo,^,5%7H3Po"7֛<. -dx]d4Po"j{,Zqz#bydV<3_Cʲ$aL汁"+LN#sȈ%EV 5Ɵ趝履C=??i'e`,I .*ptBI_3Fu -IMD(Ƙz_(2$V L2YE@*N/d:B]*֭JB6/uEI/e4?8k -y]X3^/,$u Pࢼ8#$Nԣ3",pȗs,jB/A; uC_9{ȍ|So?/,Wǰ.v;ioqOƜ}\]k\w?ͷRl#@\+m. `THQ߽feC1V~4Y36bȀ 謹= @6y.oPw0JUK(;.ؐWЏ9EsU8T]]nܛet=}iE[  -.#\8{} -_ܙ6*dTw ܡ=(( Ch) _l8@FkE|ZS1&f07hacub/Yy=]Yk?|۩ ::]{CPȬO؜fQwS;O p syƮ8-| Ӱg4W2i].^ Lw%ZƎ x/0)AM%XmM'b>yǭwӒMq梊Ը̊h'O9'?b?nYvd쓗]qJnXݰUbucvk+MkCQYcA(>.x`z<=6k(okq9m}\!T;Q鈆kb˱^v6EݖԆjG!Y>?->PLYuWltTe(*ѪQ'guyu|}m'=>-?$֧fyk0`Çrj~J trb ً٘[X[E>}] *G~y1pm<7 9/c5 };:&lko\׺|uL}θXg'폇DX_&#r'j\?K3]d`)0*bR>Je&hSM59Nn汻{+$75֍jluOu  -5~ W)G=QPH4 -zgMKOlo0z/y}_[{"cD{97r 1'}9J c.qОeW/{":&cb0}hM|mazN̊㽕(1uAwN8%~YnG:!:Z y[ħKI2Oյ"T{ Od}jfkpF,ݐdAz:ة+;N@T;O{T}i4}Rߠ""OB2LJ @4@gE]U_T_Aw;P-\x -Rwofޚ+>g%J'>0}2U8Kz s$vfRQ k[ >t8Bi?< +x[K# WleVb`x;rUvl9cwף%';u`ȏdu _z+])5'9>>HYz ;x$E_SJr!Κs_՚_+K3EU"+Fs`%pZ,de!D1$b +`ɞ/YbbA _c6X D&KPzxTj&/sx.e[RJX<,xD/Bldd K(-^,ک@XW1yyWZDL^J.@L{alQؤ ^,b5y%2ǐEks)n&/B<Ȃͷ $B9YrK N BNrf BNR0y DI,5yXX̐%[X@[XX[-,`୐O0b ” e` Ѕg 1 R edaw1A@GǾeOU;LV\(,,n($p7d|-,n+rwC`awda hka=x-,d. - w}E3|h|‚g7Zv>jaA"P ,"j w=#R[<,,] H,,@|s`&:XX`a$1ycGC-,H]jaARd wI<%XX{+:tĸ̈بYI(Rn1yII" *!گk yMX7n!ou~e!Ac !="$3ƞc!Vzq ٨Hvߖ_!$7Mn|8|?e<-@ߏo}zzFޯ IKi|GoL̜唷)P2 yX?co͡D'n0SEDtߐYЯa8agS٭:Nipηj 7Tc#Ұ˭} lTS=[fوmx +U4,7Q||q89j濛vQtެg}+STW^_ ٭WȻ)n4/innImw O_&ewe/^O?(To@_M"]([dV^Z'aP @n'q UsbWMbJM~*}d6 {}n]<Yn7)ww0)}|b&N|vǵ7ӒEqƢ +;M2?6|JkXxf0yHO7Xh-EiY]Y^R~Չ ?muݢVe -Y[Y临85~k5p/UoggoU6w@Ӛ9̢PPI }Z渷&Wlf7fSu jmѥ&>_͗Gy ߓ3~ņOf<*_vm;mt7tmIqHMc3Owk|]>dxZK[d)Y3DyBnI.Yt11fboY?}?rS{ j:Z;;LN~L /olx^N[OwLC9t '+ә{"{3vs\_kR1ex4%Zutp%Lј'EsZvbA΋tի2oZScJ#Ƀ'#S7rS<7ϋ֝> endobj -836 0 obj +841 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb221-24) +>> +endobj +842 0 obj << /Type /Annot /Subtype /Link @@ -10621,10 +10717,10 @@ endobj /BS << /W 0 >> -/Dest (cb221-23) +/Dest (cb221-25) >> endobj -837 0 obj +843 0 obj << /Type /Annot /Subtype /Link @@ -10632,10 +10728,10 @@ endobj /BS << /W 0 >> -/Dest (cb221-24) +/Dest (cb221-26) >> endobj -838 0 obj +844 0 obj << /Type /Annot /Subtype /Link @@ -10643,10 +10739,10 @@ endobj /BS << /W 0 >> -/Dest (cb221-25) +/Dest (cb221-27) >> endobj -839 0 obj +845 0 obj << /Type /Annot /Subtype /Link @@ -10654,10 +10750,10 @@ endobj /BS << /W 0 >> -/Dest (cb221-26) +/Dest (cb221-28) >> endobj -840 0 obj +846 0 obj << /Type /Annot /Subtype /Link @@ -10665,10 +10761,10 @@ endobj /BS << /W 0 >> -/Dest (cb221-27) +/Dest (cb221-29) >> endobj -841 0 obj +847 0 obj << /Type /Annot /Subtype /Link @@ -10676,10 +10772,10 @@ endobj /BS << /W 0 >> -/Dest (cb221-28) +/Dest (cb221-30) >> endobj -842 0 obj +848 0 obj << /Type /Annot /Subtype /Link @@ -10687,155 +10783,80 @@ endobj /BS << /W 0 >> -/Dest (cb221-29) ->> -endobj -843 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb221-30) ->> -endobj -844 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> /Dest (cb221-31) >> endobj -845 0 obj +849 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 567.702842 101.433071 548.952842 ] +/Rect [ 101.433071 605.596885 101.433071 586.846885 ] /BS << /W 0 >> /Dest (cb222-1) >> endobj -846 0 obj -<< -/Filter /FlateDecode -/Length 4346 ->> -stream -x\K$ s˒HAId# r=6QUzTg{=*R"?jUGdv&"/oON֤`_-/I,'\9 -I%O'?:M)ѻpa1SAa#Iɇ3b) bĞ1䠱 {VёU O5p%$,pZA,3y炉Pzxޙ/*/xD&&vibb!k<,Xd j<”Ƌ"YY|NdNQxʃ,6Z -P2+ٜm0!Y MRy(LRL -ChCQy% O'odiYO &_C!MQx\0dx@g29k(s1i0K0Kp; BQCr*Pa Cаx& h˰ p˶8 xE  1ĥY”%`Ѕ' K!z K%vVʃ,0` \& K&  7`V 0jX[1>gaw}aw} CVnkX]>jXC1F]@Hհ=x4,@c#,Ѱ w]4ʸ\2O4-l\EÂBE.3kX7XQ+:_!hXs0Xߌ0]W-9kX%aVac3D%CrEaAby/D DDe=*P n4Uc=Bw k<வhXljX|ְD^ÂٔXhp4,HRykX*YÂ! yaA!Lq\! "E d&f RǠU p2x.iX,NR&5, 4,9ְ WѰKsAtsNÂ! A 2հ+4rIZ㱕<3kX9 5, R<а#vаM9*P` rnf r,z `o& ,4,(6 5,ge䛞5,_J5,(do"SP|3iXP(* h*o4^,%F73o"WI.dx]DQ Dd3%ꎁꖁbJꞁJn@Ld9XVtV6_c|eiޢ053'd[0sbLeoO?`=oNY⤀i̶/'(!8@ΈLwdL׸']J&2<}ґJs5ғl2d"?, #ݑCeGw31vyiAv4^N_bm mT5pl ԐLeLn]ءN5fZzi&5Ý>NCL $%K@ܘ oMh#iһsl*&du eޓCһ EՄ:u zt5qǕH];/3Vwgl۬~et>^&OZ|Χ:Bg}p_$DRhP0xZǐI#!9[V:3QZ˹_y#gNo yUY_\˚T$1EV59@ߣ ޜ0 \c$Ioޞ>>y<k]S[|zq2r|7Ძl|~PfkdNI3uӏ'Ckvĭv)[^zB")5riԋ˧^mFWkZ5MQj@:vU:u"wUWnr^AF{Yf`wM -m6׶Yv"rN߃ȲFtWL&GeҶ:yjͰv -n{NCOprɶvYumۿ[myaSGUVn"n k;ڸ\kT;>а! ]MInϰīO9w?Q&F?ö*K "~fyBt:8YC:ҭcۯzuԟHXzSۻG+x[oyxWIb<{c;V.^*N99~0`<~<^c3k +Lwmx^9 MarN'+ ?z&jv8^ZUۚh/0^Cˡk->pz]Tof]zޏ<-7 Vh \6kl[HD(Gw78XBmI'sTΏҧץs9stV 9MZ}G9\ѱvjAN,Fyų[<;P7y89glVm#%e@Ph}jMS>j= v/zUpȧ,[Q#ˆ=vg؆̈́P|TNuPZoGSbuu2.kVUYpː\Nwednp}~&WrxULqFRfn!uߍ`{q8+9CÔ]0#tYqVyRTBݝHb6]wsڷ$x/y?-X4)-<3IшXB@xFDXV;l VFȼإ銆|hD4񞈆Biر=lwfaQ*՝ʞVag}۠ COC> -endobj -848 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 408.694475 101.433071 389.944475 ] -/BS << -/W 0 ->> -/Dest (cb225-1) ->> -endobj -849 0 obj -<< -/Filter /FlateDecode -/Length 4407 ->> -stream -x\[$I~_QH8"7 V:=g$iEZQtWe6L+8+3ɹoOߝȤ@W[.*kp[boI%ϯ'?}ٙROboRN*` -+ QaEkR4Y bpAcA v.+ 1<'1\ -!),K:"A;gPzxΚ+*/gxޛ1BV,3i<>'!Tdq9y vː֕UdHVoB*G9=Q0!{OZ`^I1)<Y" K4,>x Ź*`5pP.%ű.{Ù.)y \ cIx9'8jH-daxʃ,A4а{kX kѰnհol԰p!&iX>GְraJEN <@4,@]Ӱv=azawGOY`kX]o)iX]Ӱj`Q؊q9 uX#@%0p,A;.Ӱ]԰b?F]@Hհ=xkXCXaAڂOiD pfl+&h\[hkXϬa0Du85p׺B.↠aX|3`**9kX%aNaCH!Y ƆjX8ދK{ "paʃ,>; ׀U|!x]a%JEÂܕcSÂಆ -v̦5,Cȧuа  'ְ)d ,9 ,4,@D`E Y)jX$30kXBD>jLNkIÂ( 2NaHaϲ@8Lv5,5,@ dY jX]FI%j$yfְ s4*jX7A Ty0aGa$HsTd5,I5,8r6%L,4,(#Ұ،|ӱK7Mx%L,!ʃ,$@'!+aAQͬa 䛈Ւ@|3n(@&Ed5,MDZnOސ,gV+ 8[Ւ{qZ%f@_ɑԢDfZ5 -%l@_cÄKi.QEC™,-}9F3FK}= zY %.`Wǵ~#B -@q)8qؖs`C^"yZ *]>ԑS)eU[oJyᆐ@Bjy$Z=j|]=j|vYS, -‰eGa!o5BN#.ad8L=~vϿDP ~g|NP;e)G D J KN*C(CJ_`8W<m֋+jc읣߯? e/]rXrUoO؃$e>$Oc6Ѓ_hmN?x8)qLzFI!Zw҅[N[Tlw+" Zfߚic <: ;KDw <97lVod8?1 8Kob_׭ѤxEmE/׽>^~m=`ۯG֬K Ջ#vO lC^m84`렰QÉ.^6e6m0豭{LFFvͼmknUV}e%sp1ny-6MHw!LF?(m AjۅDZo8+gbV `n鐻GrH}j>DDPrN]CP#wcsE@^Ҿ8<  /7ݪ6~8ԇRٹwh ex)c+sQO=oUPa_3*G4m00(ppFERm XJ `.7G}/C~ܱ^?Va?D@3?ba=鵲l-y{+#%W]S*׬^LY.~-WN4 _5* %>'ɂٻ]f.?~%2U{iᷫ2$OǾvݶ}wS[_?@1D`WqLܲM*ɉ޳Jobi]oO`/eJFדD⬐;HXl[N{>ɽe-K\§Gjh&B/+DvOՓ Y^l_b%&3c@ێGǛdi"=Yim]XEUgom]$ۖRu*m]G'Jֲo}RH'ӮCbnĽ]iImN*i~2LxVuPm,Pkʓݸ{ BRZ8.˞q;9ӰAM -hHЩvǜ7[yee+iϨ_qG-\y>s Ym6lh5sܹ yt쭥j;w&É:'̈́+{ }fؗK?J T> +stream +x\K$ s+HÇY v^lu*=v`'.R"?*U'2;sIϗ'kRWKl.*M,'\9?I%O']şN_mw]8L)٠ +X֑ +CTX 1BbGV\rX ++C *' brr8oʃ sD(=j'x xh( Y`]YAxL(YlN6s&[ְ>a PyI!h+7p5,`g5,U. $djXkX `aAlJJQÂX,xT^4$ Bd<‰5,@`m +aA򐅼װ yȂAD8DjzY`.j~@2 )DcЪƋVy<4,H bar)K@ kX +dhXd\9Ȃ [D9aAѠgdjX$TJ5,Mi)UdLhXd;hX&Y(9{I79CoM7BD|VÂ2M/%7)~[(J4,( YBY4oI7N/B_XÂY7ѫ[YͤnwC2i<."Өa.o"r{ ̒qfuzVu{Z%u|%GR7 &2],`:nX/1>`²4oQECš -}9F1zز?7_{_;eGl#1۾`?kD~9#2ݑ 0\Xw-*rȈN,iKGV+}!\KOM4tBtG81:={9}81 PIX֤*]؞6PC21˺ubn;՘iyIֺ8wRL; 1&憒ܖ,s+oƄykB3O3ޝeS1!L(ⰖLM(&ԩcУMWQW"uw>~Q@v!uYo_~f_:&OZ:߫T'{YC:ޫ%!'BCF92>,&kjtH6ǖU>Rz&*[>p9/z^șS~Ck=EUe0*KE__T!o)]sR6VPԯޜ0> \W1${7N7yֺۧ_z( (|.:R>~/NWIO5~My""gOw^{ JvjBʊn-0ou|\J[ۯm4.5M)߯{~ܵYe8VmWYaоSyDV{Yg*ǹ]X2\kB2 N$!kT]e Ukr$vW^ NMYE>mund?SE/{z8..VG?Ua ~_[ُڽ<{՟q?~ۣ[}3m\Ae*% nN>Z_0Ħk$gXeZHHr>$ ~*hu$jS5YYk]nUm}qt^v]Z#󭞛$:mCY#Yޯ<44lW997yq^>Rv z\g>m9icaó?M*hgrI`9ף5Ts&:tkb~x /E dquQMtӒ_wI + YC =d~\] 0ca;ϙ#j*D}v]:93;HߪGI}(g7:֮#[-ȩ(tݺnuL-Y)(NΡ<7Nl8njg?5ߥ7\4|Z3ǔZkoP)O^sū$А6{{`;|ػ:?6 ys3IЀ;[%Fq*~O{Fad\ȭl{s[k1y[LFsC훐 3C}؎{Cb2yIQn6 =qR (wÌ-gOY9蟉BXWM3p1~S .tr\Rv9F=[ϵ-rb V7Mem0tK*Ol#.#$ "ѸV;EmnaT<]ѐo&P(-;7,XD~@,@Sj]Ya6hr~dxۡUsXOj nkpC}cq Uyiiݖ{&i6甝(,߀;|H-šfUci۫z>/PyK>콗_TqŊѶcَق8%-m,(㵋5 :t_$hX;} Sn.}=YtԄWh/m7퇵I} 0mO>,jMȆdYΖصirU}W{%XVދ!Di/j|_5}=$A=+d qj{[hr2rWR@l:^Ė>HЪɃX}_:Vݑ,ƭdyS6^.JMf9 hpTIvd'b8 {n8yI@W].:7M+4׈=IʫfZSMb&JVOyRHrt@ĶӬ 17C^r +rR˭>Sʣji S.Sp-vXj_d\<ٍ?/>+lh7ij2)7U5Mw TN_wWщf'o4cG48\Jfg}lt؆:lKDݛj?u',y/19F`{iku<•'La"Z r15^UW+Vl ;> -/Dest (cb228-1) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 850 0 R +/Resources 4 0 R +/Annots [ 852 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 852 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 399.731993 101.433071 380.981993 ] +/Rect [ 101.433071 432.754475 101.433071 414.004475 ] /BS << /W 0 >> -/Dest (cb231-1) +/Dest (cb225-1) >> endobj 853 0 obj << /Filter /FlateDecode -/Length 4206 +/Length 4380 >> stream -x\K$ ˒HFId rmfsGUU̬uީ"(#w\R,g7>)d+1{!P26s_>;뼏;zSJ.z',&rJ6(uB0)VtK,EcA 4`89ڳ -ɱƂ[ e&\0J;sE%\.8WL1dǐ%4^,1[YrxP$ ω4^,) -/CXWVyF4^!JfVy;LXN#sH9" ܂c4 ͖~8|{߇IYq0~(u7 2u8X׮J_GHe롛Pp[ EfdyQ)8lE]gz9d>M*7#w_/QȽ^NqE!߼?|}yx6d -}?o=|󦮏d)nlVـ+zR3ȶVE`qHڰrCKr<Y%[G+jc읷UYo߆W/EaovW~Z@w[L.԰0o -=Jksl㞿ڭ 9`͍v҅[F]ۭQ:\͓vtAέt[ӷ=1!;Y(B Œ/ĭ!8z2F%}f_Fd>j= v/zUimܼq lΓaT XUd/ mC^ɋzԡ\&Vӧ]ʸm[>O͘O9bz. -ni73T {XvgO"4CmN5ԯ|bQ5#<̄95߅٨ EI}3^/a wVĶqm>w!]M>:^DuQ|)r|:.`3y{՛2-dj y _q==w"W'Ö$]K-1y~F޷&yT7Idae!'cح-r"ٍi> Q߮|+u=u]BxaYgmQ4puг^_, Px^ ERǥ=܇VUecRD3$ IeKռGoH_n}^ss^⾌ׄt;lmxX' {$3fEBb!Kx&:*ނؔY YQlր3o|j%_gcu:*ɸW,irK Z]O%crb1Vo~qk?,\yZ_?EVM3a_\4ujͪiM]{i I/<|d'|A(ǩyXr٫rxI;|]WK;&#FJ(cB).rձۘ"VO\~7^'nc|aSqUaf}kzCY[sݿa{U֮ >lڷrm)WZXu빼pon'4tOZ9 qig{vsXH : d5^IvMuOxIO$:,קilw._84URߍfQ?C3FKXvq; -)bO~=.y^׿9>JNCۯ-1|زy>3Ŗ;%>Rh=H+6^γꞛ'y5]!mux.ap:Dz~Rac9?.`tʮ>s~dhxc[>&y&.jLޏ]}@ßEN>%ŎM.hq]}V/;Op3洜;IY\Ǻއ4 v佧aTqo;Zg9_w噇Fn3=O?.YCOxͣZsgb:Ⱦw4i&\!6ZkfFI^jRf^niHIe?u<(n ːLL1yz kfbjy`vLE׫}96jN}}aB퀧Ss>ԜwhEQOrkԂnfyt[yRnI[pm>bj2ŵ[SK]qVzN1?Κt%yW⮭"^ϖ'@a64VgG˞Kfޝʣ%5~n>E đ-Z^;wZSOB\"Ps_9F`Hg~V?ig%LD69qO`یinŪKzs$ ~T FfS&Mc 9F gG( +x\K sWXU` @< 8l{'A0`琿!ӭnAv0;-,ɖdτ,lM%E>_=}w"bu1Ζ8`K|26cW8{Ǟ)%:{rJVWX!\ ++Z% FHxJK bsYae9Yge1l IaY<B)<Lңs\\Qy <6XWL1dǐ%/@`IA9iY| kYS^, ExJfVy<)y {x֚*MI9)Y' @,Y8M%kXdiXdAȠa"S,o5=,05?`ȂHQ ɅYÂ"1hUEgr\ MGհpz F% x5,HU4,QdCd,dAa"]հ ;ȂhPÂ2HF. Uk<&3PQ 2M ʃ, ?l D aANͬaAΐőӰ)fҰdAħaAh$Lְ0f䛎5,_J5,(o"S(fҰ0d QTdAT&!:iY\a Jof f DDI-wC2i<."Өa.o"r{Lgf8Z1 @o٪ ؋*5J &2ժU0-e"&էDa gfN`D-+8 9=b %"`Wfbw""Eť&" a[] yEbPfZ"O(UI³S)eU[oJyᆐa!o5~[!Sey0a=e8r8XuM9NHҐB98<}Q1zgs2NbV8p!%^5Շevi}h*[Gߞ~}~x>}93!9,u\i~߿?|yenT$q^-!O%~aBSQIkfhЃ4_\N$ oudnuR&b:O[He.-~',EtĈlp3RȩY@ciĮB[I a`O]w}m ۯmY|X#T,L))c]7IJ&. Y +f 6vl.vyͿ鲴ㆎ@mc222^l[cdߧ[Vcp1ny#6c}` em᡹l[C81^Q`gҺ -cuW7)DBkŎzqVf몾i6fC8 ZtY*oϝabip8^*84)惩-oqш8}'pF`Cz>Ȳ7-0lW4*@#GBJ na1 r-ޯ?KIqi^d pBtԠUs"A<S"l|׿.{0"̹|N0_ yk^}TlBͤ2V-z 79ǾO}ccׇ9Wن0nן{}s42HjIh?)ҢT`9m.;L[&'SNJqSGo?\ZӚ.&M9"ܫ{"f܏MK9FUoJ~LSױD@+-w>踮uƿ7ޮmb4o*]Zվ?z| Yc qᡏS*Yx4VP+#y̫:[H3Tܥěg6=, ;/7s'rù#Rד^{ +ڎW-)jm(?ކ+z#z +!sDs l]^҅B!wW ۍC,}A=j=o[ڇl16rH`E}jfzۑއF搋2+}ݍ3܈/7ݪ6~ܸ9,?}=^k-c{SV澣$x +藅P=oyD5{"6}ylDN%_݅}Ɉr~ RjSWʲ lL~}a=5 J5-'t~DPr?"- +[]qx,/Ou%7D,%Ae)׶e-!>/4uy8*%,O~J䠾JJnK+~_u?:^KMSb+Yn< OύFgj&7z?]0CʋO KgP7.7YoYtMGr2v1 XZ\9&QԥAyq2|O/WeAm amߝ􌩝3@1ED><ך#E\NWzNoA"yɃ<;mxnoq2,޾BqXؒ_N޳Bf bJ @D^mlB]ܙTybɲz2v!UlXec>`xl= İ'0]';Xy⽩.vb}Tuik -E{SPUBF en.'աî31WC֮v +rR-SʽktS)^]@7+!_?C<؍/֕-:tPMo$aFSSkV<+PUg`<߯$⛍VH uXӀ)5e3)t[릱uP@O' cMY aH*LeEr檁dڸvvm+2l%:I'|d P/zkC'yA\؝L;q/c譼hh%~u9kغ"'I.$˛*@t<~'ۆj wnkݩ{mip fA3 +b d~{uqƠJq9̝|ĕ4G܅놎0a钭'iy +/s C!Е6bh؏lIJE"r 2R„O2/ۙv {95zhFjݖa+m5i=(\FFLUtjVU-St?GMqWø+qVƭ'^| hΩzKfލʽܼa=2-Z>gSuZ՟bs} j;?r%Ci>k%H3a; {Oʻu^(PzBSR +0GJr ..]y3gy`"cK%J(C` endstream endobj 854 0 obj @@ -10845,7 +10866,7 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 853 0 R /Resources 4 0 R -/Annots [ 855 0 R ] +/Annots [ 855 0 R 856 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> @@ -10854,264 +10875,260 @@ endobj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 770.673057 101.433071 751.923057 ] +/Rect [ 101.433071 797.673057 101.433071 778.923057 ] +/BS << +/W 0 +>> +/Dest (cb228-1) +>> +endobj +856 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 446.531993 101.433071 427.781993 ] +/BS << +/W 0 +>> +/Dest (cb231-1) +>> +endobj +857 0 obj +<< +/Filter /FlateDecode +/Length 4385 +>> +stream +x\K$ ˒H^ 8C~>Jt̎"(#jw\RO'kRW[l.*M,'\9%J)Now97:}_>M)ѻpL)٠ +X֑ +CTX,1BbGV\rX ++C *' brr8oʃ sD(=j'x xh( Y`]YAxL(YlN6s&[ְ>!daw} z G `(cl  z:Y ރI f< p?ŧV5,]}*qoeb,.iXϬa0 z p":_!hXs0 oY+Ɩ5,]װQ $QyccjXEÂܵHÂܵGA^5mFjRhʌVDhԒPc+ufְ s4*jX7A Ty0aGa(sTd Y6L YiXPl4&kXZ ˨7=kXz3kXPȢDm(fҰ0d HQTdAT&:iY|a JRof fDF d7z\ ȤL@V-7$g:3Kř ꑁ"Z%|FR &*SU0U ,0a9}"!!f$,p Fvkьi>=~ROڏG)/n*$쪄5}DT?ȐXdvHfxVQe}q7;9#ľBj|S:[B +-o,$ydC}D5W$ Ş[Ȫ"ZQ-,o NuKGɍЭw?>´OOmqq~ՕHi[C%`a ߆z֦57[Aׅc (I]…[C[٭Q"$1u9|kȬ`^[۲k/!91%0Bu2xdɺ5 W, <3`r@2Pld]~ ߯o07 gP"+ҵ")UX˫` Ѭ$ i;lq 'e|>lلU>O[.;9bw.;emluoP%aAvg$#CmN5W{p9GjFp/8|\bF}MJ"x|}"*} ޛ>@Ob.gvV'0CRI))}Jķ\>K#L>͌oFY6Ce.. ޷9$9t809qr0lA"ŒpK*qrt_끫eIn"is;pnkXd+vo8|rCZ 8>p+(JcK_v rxZþ`HxC?O<CR7_7kXmH("̹~NPXXZV?&{A4+bIexW0p^/7>rKTYt&mj/)ozOۯIXGxŊB8[QMtVUޣ)%v^ ݬ!z_~kB4q155m(CtТZ-Qo>Zvvb96 _c*ܓ74^VwZn* n>y0}<σ&^`/,O[n<@8V<vaz59䩞gE'uX"<!Ţ]ˣUncN{_mH~E/sz6}l߯:rWk6W&->voKtجS+7V]R:Nle辷旵5ԶLVtgW9<4_u,Xt{/nؓNsD4}SL~_Y-xG mlq!v.[2@aIMjdT؜=L_\mia0\2ބ{xse&h}F7DZ=&~m{s˴idžz}QUƽ79\Cgڏ[jcܖ>ܞ׎MS^Q='qI{pm5۝f_ee#{tsÊj}oƎS~٢IhsM(v \CrvcPy?><|+RudkUDCau%ֳ f?Zd#BֻT꣎R|mgCUcG^ӛn'gIEnB!HRJqiěJ}1BևpW+ȣ"T_vzjƭv;ޱ=0JIjz3.p]o] +|ɍ-۽~Vv7*z'Ә2}%^{>;W}t1CY)W\}-J{#Α5l*֝YmJ;>VbmS- /JF䧓e<2d!m]OrrزoIȞчZ7ymkD5ebɲzkJ/Ȇ֫Eǀ<7ɎD GdM'/(vAϪs>Myx9aZSTކjEh4 U:5}CB⧶ ΟvM^\vSHn-JU]Ke:xv*$ߠ3qK͓r +=qN!) +Dl jMUpFW*B +IjL"[%Q5 8N.RY_.[no5N*4:xlɮ[]' 5t 9tS~ڐj}&s}A;fr;.owF{~n =ڍ& 0F*ykG'>q8q/N5y +^,˝6_'>;qo;Zd"Fn3=O?.YCOxͣZsgb:Ⱦn}k&\!^vŻ%i +rpFH>OCJ.#.Aq9MXd1 IE~dbJ#Gn R`/͓<ЯvU<@;i Nz=P}9P&ߣ o.fyt[yRnͤ-PtLqRWU-S ü+]aޕxh+㶈׳% P9ѲYŹwhIvsh{C82S;CWk|g;uZzxZ^=T@!,߁8OG#/sx"J晰lrUO`یi5zb%LQЀ9{8 ߅VŭB2I(_}HfƦd*(isR  +endstream +endobj +858 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 857 0 R +/Resources 4 0 R +/Annots [ 859 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +859 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 797.673057 101.433071 778.923057 ] /BS << /W 0 >> /Dest (cb234-1) >> endobj -856 0 obj -<< -/Filter /FlateDecode -/Length 2795 ->> -stream -xM+ltUI@@AF0 - 琿͏ye-vլbba3"O1J9qQoqW7Nj.J|l.r6y(o߿sWk ->^~L].9K$ -x%]!&Ja2̈ق=2̰Z"S Uj볪Œ15f;|:"fGtTjT90K|LW]J)3x%z3a:bZ2%آI`K(Y.ÖT+UHtU]Ō*tRry.Ua:]Dl*aEaR&[Ju%Sba:p"j.Vz%lT[0!ɉ!+5.1` bQ ,ge5:K53xg P-#zbXT[c؂ -%2(hknMg,P'pa0(%cX` -bgu5XZI -ya,0pWoRlA3N}QwKf,0p(0`V01 V\(E EݐP]vXX`n۹%0,$f.y:[Xe,@c. -a,யȚ/51DpLU3O2HӚF2g8d{RFVgKIzol41m0Yt{= iM{E%wU.^Pe*6G1|C]Uݶ^N>v[jcƿ}=uO{ӧ w{0e,SO>-ݮ,|?uu-RȢsca_.?KǂYp TisDGx~4Q~v dy2]Z $\]ْ"; -})9t&?LzLy[B?/%k˒س.} i>miϘ~kӷq -JlNs\*IǚeP~h}A-`x s.f[?ž̺GCXxmu`5 Uq.o^oaEC7.eU(AL-4R:th-,/6aݙrdoThk),iD+fצlR)akbW/<ɩ&h*k<.սcK+;=4eHrҘ]evVkewb2b6}ąz)bJZ=YN묤ݾlIGpst2k\YZR5˞n{YaӐ43Sŧ_ſY;;VoB|بg PJJ`jW]H+Y{t8S7E 7(/+HkU~>{ -y!47%}! ߯5JB`: -endstream -endobj -857 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 856 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -858 0 obj -<< -/Filter /FlateDecode -/Length 4838 ->> -stream -x][\~_QF#  $dwE{':sX7i O됺PRh;2;sIOkRX=TI,'\9? -I%/y븣7DodRNUV&%Š`h,{޳Ƃ}VXb'G{V>9XÕykU &BQygb.K^1b %8f SN/BdUd9KC;Ee*h+dB*gs{Ld5s&6I0I1)<Y EA@k<,?8(x&KN}bY0Yl>%ų>YCH_Xdxi@@, Uy -kX@D3iX@@[hX@[iX@[.jX@\i5, . T4, `.;5, .=iX@@] -kX@]5, .0p5UdkXt42iX]r6iX]װj`Q؊9[ e BK>H0p A]װ}԰b?Va=x4,@c#-Ѱ w]AS|he\.QÂuӧq WZ6.ƢaA"P  "װ w!RkcXKB3TQ V@JY`~d4,M,sTde5,x5,mz3iXP,dAƧaAHa`- uYV~VkQ]˱W88|KxאvwtQ,waÜW-r"v?@?ZdQ̠A6<'aә9'.NpA9吮5tns4 ~8Y(|ji_}~9U“^x!/g ߋdK&L%H|>m}n(*[u9u[ԯ>gw=K]̒)Xp6Gm-#s /aϿyӢo&ev i\Z rn>L+σעoh2IWuF.td७V|$G}>47K[OWخQosZZkk}i灂s&橎j<2Hf&!˩-W.IO ]?o8b--4̶.y0$O+ƟuYKeUEQ0x9HaM%[.{\h.J~?yzlP|դo$M%?里wDr,[ zS;:3z=ODD|m"* F\/Jz,Ko(j/P⺗Pe/ӣ+ p]kL[>}ZjZq 'YN!rs)Wj;;$ASw\1]-ZTOszc"YSsfLymf7f6Y2͞5^*0%@Iq#]%-fA>ƘQ+ၹο:` yV1٤ u?b7&z-HmޞvTZ;, ^5m`1; -ҽnx;` [RM# j,9/oo:բ)kI.Ex+!ۃL[I i vf0{}wW .O0`V]*qIr 8 /{J%|fjL吜_:oೕWW5g);]7h=u-Nn1:$`J|λ83f*&;'p] u+. 'oAz^j/ij{_:/S9iO[:Yjjv!EC^tB -y3)K@Tt0yRo{a^.c?ߪ!p c!/*,X16{Fin̮7pڀCݓv6y{;WfVX.IUy7=wnN:7燳YvXymaR&=ÝuLSE!$=godMs?M@ǀ&v L˴՝{F8q&w3nbv;&(GQȗ^'vEI} yOė7L})d6!c+T^wWn>ٯW]<wG`M!k?#WG_Vl KoY) uUw@:)[@wy;Oɖ^'i$ot+ zms[J_)DjQ7w/nh,*'_}-H1!vxN} ,pj3L r;zŽY8'"C s;b/κ?Pk/Ҟ㸷-|ydru,Q6bwyAvy z~kVuu;DtLB> -endobj 860 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 383.944475 101.433071 365.194475 ] -/BS << -/W 0 ->> -/Dest (cb237-1) +/Filter /FlateDecode +/Length 4887 >> +stream +x][\~_QD !$ bvE{'Qut9.ng:.E~tT;ZyWfgr.)`M +#~R8:WbOBdR >mOuuw]8QXL&lPX,Ha`R!* XƂ!=+A .9h,g!qrgc1\ Ia9 9VAL^`"5w&K5]pc!K(iYc0"dHVAiY[ְ>!daw} z G `(cl  z:Y ރI4f< p?ŧV5,]1}*qoeb,.iXϬa0 z p":_!hXs0 oY+Ɩ5,]װQ $QyccjXEÂܵHÂܵGA^5mFjRh`ȂLQ ɅYÂ"cЪƋVy<4,H BӰk)K@ kX +dhXPdGfdAa2]Ӱ {ȂlPÂ3VjX$T:3kX9I5,` Ty0aGA,~2GA +aA^YÂ!^ئ7Bd|VÂ2֛5,_z3kXPb%ⷅ7!K@ -0 MƋְ(ͬa 7ѫ[Y֛I.dx]dQ<`V[[oHtfgVw ,7 [؋h= 5i1Q5@XYuλOU9$̜dnc c_qSmqR4f!8@L7dL׸%]J<&2@'c5+}ym+=6QOH&H7FL `|V@T\;De%z12M4q\Mvcm( %A5Yϭ,>+ tdMZzwNbCYOC^t&soo|QKg8,4Y+|ߜ=T'{^y!977s礜X(oCƇɚh#טB]/t}-*>p9ԑ3uWui_5]K]0EN@$.>t7/hO[2~l8+ m~<~h 4~[䐓 +]ZAK}jퟖ?G[ ZMO;wygAcklƥjn|ֹ yN$y NT>,*9KroҪ+hǢ]mF*M]'lkzkYz-=/z7쮕* ǫzn~khm뿍CtXi4dɯҦs ugЯt\Ǿ#;/e}Ҽ~mpUq2ɜ7m5kY Oإ2֛}9-ϋE^'-wEa36#чD:9K'=6t㊉BPڷt.ﱮ)gXd9?'+!yAZu^ZV@!Prš`K]FuyW~JꁯAI :౷Wʿ,|BK,18%f + 75U5DGGⵉoo.XjrCͪR}2(N7y(qK +"/ۣ; p]kL;zr=-ttbANY7>C1R vvHM7L.pۘ}-cS%/Y@A%ٝuޞ9%062`@*,ek3c1ϒaP)`čw/q1sJcV//0 CNc0h4G'!ܘ8R* ޷y{ڑRqfj,|xm[ԴyBfVrqlb!S׍o4laKiD{A-rϽ,WgK&P"}YA8q!5v8ۙu'erj_1<ˆYuxR%ys.@/]TRi׋#TbDz\T_:oX5g);]7w_36F'7ܒPtÌ9֯K4ہ3ckksnk7oɛ>fbK,ڞTN֥&h5lVڇ%3QK'p_7dQة` +V]TxvVv߅/*,X16fCݘ]o,ڵcݓv6y{;WfVdRgbUKꌻ[7^6ӵ9?2Gmk bF?yΛ␆3ܷ kmin=v Lyq3~W{/׈'nF }Ft vxLɞeF!/%_'vEI 7]D|檷9 &dcl;]:oǕY-'"F}D}F5Nn[ZD1z`m|#:>%bJxB#ʉS vA.$:mO3.g$y[ lлoVj7TJ&RČ(hls՞_t%9MYVN^}-H1!vxN} Y. fr 'hX7wy;_ŨǿY7:om>R ߈˕ ; p4Ӆ6Z56[d+DԌnO#_rm6<.JMfG< 7ɎD {dM'uAϪs>Myx:[RTܲٚj.6MBN dK;;ۚfLfO&wrSHZni-JTUKe:xv'{K,\<ٍOyù#/KDl jMUpF3TNwD|J鱣kpFI].n\Jy^klET6Si HuX]NkX9m r"9Cw`{gMz;v>g{]dxd1:dI& 0F*ykG'9>'"C s6bhvo>W9{wl]H&;ry#v'dGЬq'Q`o%]GP׹31 NdMẄ́+F=ҹHmpһ&ᐜq<!85'):B:짊xa;y +91?Li<sӍVG1A +L0ӲGC{>>0vөT:CsޡMG=1R ^=6:QshN[pmbj2ťZSKqVzN15YJ ]YiE-QOliΎ= +-ε;GIj}߼E4 đQ-J^;Z<.Dsgbs+iku\jr a&'.6cj+=zb!=OVЀ S ^!,_^!Iz\+AxFɫ- +endstream endobj 861 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 364.997453 99.933071 346.247453 ] -/BS << -/W 0 ->> -/Dest (cb237-2) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 860 0 R +/Resources 4 0 R +/Annots [ 862 0 R 863 0 R 864 0 R 865 0 R 866 0 R 867 0 R 868 0 R 869 0 R 870 0 R 871 0 R 872 0 R 873 0 R 874 0 R 875 0 R 876 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 862 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 346.050432 99.933071 327.300432 ] +/Rect [ 101.433071 393.004475 101.433071 374.254475 ] /BS << /W 0 >> -/Dest (cb237-3) +/Dest (cb237-1) >> endobj 863 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 327.103410 99.933071 308.353410 ] +/Rect [ 99.933071 374.057453 99.933071 355.307453 ] /BS << /W 0 >> -/Dest (cb237-4) +/Dest (cb237-2) >> endobj 864 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 308.156389 99.933071 289.406389 ] +/Rect [ 99.933071 355.110432 99.933071 336.360432 ] /BS << /W 0 >> -/Dest (cb237-5) +/Dest (cb237-3) >> endobj 865 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 289.209367 99.933071 270.459367 ] +/Rect [ 99.933071 336.163410 99.933071 317.413410 ] /BS << /W 0 >> -/Dest (cb237-6) +/Dest (cb237-4) >> endobj 866 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 270.262346 99.933071 251.512346 ] +/Rect [ 99.933071 317.216389 99.933071 298.466389 ] /BS << /W 0 >> -/Dest (cb237-7) +/Dest (cb237-5) >> endobj 867 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 251.315324 99.933071 232.565324 ] +/Rect [ 99.933071 298.269367 99.933071 279.519367 ] /BS << /W 0 >> -/Dest (cb237-8) +/Dest (cb237-6) >> endobj 868 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 232.368303 99.933071 213.618303 ] +/Rect [ 99.933071 279.322346 99.933071 260.572346 ] /BS << /W 0 >> -/Dest (cb237-9) +/Dest (cb237-7) >> endobj 869 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 213.421281 99.933071 194.671281 ] +/Rect [ 99.933071 260.375324 99.933071 241.625324 ] /BS << /W 0 >> -/Dest (cb237-10) +/Dest (cb237-8) >> endobj 870 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 194.474260 99.933071 175.724260 ] +/Rect [ 99.933071 241.428303 99.933071 222.678303 ] /BS << /W 0 >> -/Dest (cb237-11) +/Dest (cb237-9) >> endobj 871 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 156.580217 99.933071 137.830217 ] +/Rect [ 99.933071 222.481281 99.933071 203.731281 ] /BS << /W 0 >> -/Dest (cb237-12) +/Dest (cb237-10) >> endobj 872 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 118.686174 99.933071 99.936174 ] +/Rect [ 99.933071 203.534260 99.933071 184.784260 ] /BS << /W 0 >> -/Dest (cb237-13) +/Dest (cb237-11) >> endobj 873 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 99.739152 99.933071 80.989152 ] +/Rect [ 99.933071 165.640217 99.933071 146.890217 ] +/BS << +/W 0 +>> +/Dest (cb237-12) +>> +endobj +874 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 127.746174 99.933071 108.996174 ] +/BS << +/W 0 +>> +/Dest (cb237-13) +>> +endobj +875 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 108.799152 99.933071 90.049152 ] /BS << /W 0 >> /Dest (cb237-14) >> endobj -874 0 obj -<< -/Filter /FlateDecode -/Length 3218 ->> -stream -x͛K )ez$ r7`@!_?t=zڝdZfτ/UPk+YNOJ"J.6-̤%$n;H X.⏧c>Z?}o*Pj)UXUJpy*FU&O34*-,3baT0[* vp$ru0T%::N!E\]Kt"!ĞsNaKjĞ.Ī`J-.BZ*lAtUW[({&!tTKEJ!Ut!!6aFarqtdJ$=ŏ'Zmv {[b,` #@̰JKb)A[TJЪգ@-h)a 4q@@$ ab:"M=H-(@D*cJ=xc0<+5rJcvz,@ӽx,PWR cL AMW[ @ \cT<(i=`T0{,@X+y,Pp7VR -Ƃ%Օ9( ܍ nL=(5f @Hz,z]h,D%  ˟3Ae su-pǝy /ιy,H.*X]z,V ,X=˱ǂ"oH x,jz,H.=`TAWW=Ɓz,. D<dpi-R5a:sjRx:p#]<dpזM V00  rJ r#p< YhQHCV=[$F%  ȾlA-=d6U%eUOcvu:. Jр=`/*&>Xf@걠4؂KQc؂$c2]=[ z,bcVh%jOd걠j*z,4NtuXvX6:"I=mY= -["EMo` 2>r4c0ǂͨ 0/mY=4!7smlⱠ)lIHQ\lAԜy &a :y [bS-goVH3DF ToM dt.2o"WVqVĀބ=2 Uq ={h3=5 -%{l@/1ai=5ɆiǞc7X|?WIYahu) -[s -@ -f! :fDiHC73K1v_h2,6vgc$gu(Z$$Xklazg׵$b.c~:/i|g6RzX jҒҗ#~,W(%-`cWFz(0wy0.m*<7_o߿<*Z⒰ZZ{_}YSP pG'Wt5dO89gc[*}hmsv۝:sI/}U~1[`Wq=>}w!75, 9AǺ-.mA /N۬F*AS.﹉g{8ثvYX[Rzm揼kփ4vZ?}?遨־xXwԚ._ʤ^&^B kKn,*+?`w" {t X̗ǸkpNJ:eZBnc9}>\p q// A fl=Ԓ,V{8J\=DZ 6mL>bOг5"1ޓzgOI.ǂOD->o.#2r="6Y]1\Z?|宾_uRSQ7"pK}-QgiV7;n#BKUOEz_u__Z),|"ޞob9Qb3-G5_y?;=y:Ur ;4i/UaH8j+vXA%H߶=0-'K ZrL{=h^ozl潝ҿكaUi{G 3!{xu=lOy;?*!sBrݪ= -bvf_Iěc۫iGm5*r 7  ˛%kSx7x؄Wm)C _B.D69vSz5Mz!\qndY<>\yq$2:6s\J9t#[vpYN|^ĕK:Rk\:lӲk'fC!rv)Ss]."HeXV^;m{?zz}&>L:>tܘI|lx9΀m2d$9sjBk.:کv١ӾP \@F]6Z,ݦWn^*#WOuT:*W-He͒#,TgI۾w_mm4$̔ftS1sR+,ElmD5gGlؒȋ<}Vr{"J֞0AEݘo#yT2Z#^s@h\* %^o.v d(p_ -endstream -endobj -875 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 874 0 R -/Resources 4 0 R -/Annots [ 876 0 R 877 0 R 878 0 R 879 0 R 880 0 R 881 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj 876 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/Rect [ 99.933071 89.852131 99.933071 71.102131 ] /BS << /W 0 >> @@ -11120,16 +11137,52 @@ endobj endobj 877 0 obj << +/Filter /FlateDecode +/Length 3166 +>> +stream +x͛K$ )l2%zb`x;rXO6guݜ5bgԃEQ?Qx$|Ojm%BQ[M ~#I [z|g.4M%r-xÿc +ˏBTQRfGc-`Ir*0CZUO3$*`)U fSش8H#&"WCH2=]!ז+Œ<sEFOBYآSآQ<le™T {[]-` eqVE\]j׺D21(b]f)G`K&m(St [?P.:5fT Ga !3(<R$R UGT[R@j$q)B&آ=p-` 7X fؒ=0h+ +豀[=0 3c\x,` <0`t1݋uYsX.K e@]ftut +{,p#b%Հ8 +!J Mc` pu%`wMJcIRX@  c{{,@c!!-XnlX9 ZX[Xn>WB,3osn B >0>`EM ܍Ӂ15X.Xp o!Bյ@V +KcV@$qu% 8P<dpcAwI:5y,@^3J w)b=KTǂ ڲ dcAZ)cAnR>WcA!ruEx,@b걠$)y,( eX ?؂LcHjXP4c?zB-Ⱡ XBŤXK< x,( `x,RjBf"lA.t1z, XPS.3K՞NcA,UXi&H` 0cmX6:* jMݬ j-Ħ7ǂFǂF9XcA$ 0/mY=4&7smlⱠ lQ( ijμ<]-ǂ7o"w7{\j<4{,l=Zj;ЫX[#{Z̀_#0;˚S,PFr E>&WL8>GTPfb70-sbD/?xo?NODdXM0Uؚ퀇f! :fDi,nf$b,8salw&k)D gDNY &ዓtc1;|rN'yΧrFF(|:_nHp6VOl$~@`Ҏے],ƧqcjF)nv2¿{}OOb6+lw/_뷇i}믟i rfYkր Wǭ߿>Y {|W܆'uOTRB*o8^ll l|˰&ExN@J?Ƽ.bQ:8ͼ[j^m=tVzqY}v*Hn~X6ݭ;di9^&B>$ Dcco؝u߀a/m4T8q qIbTsݠ̗K *Å=硦ߏ{yA&|QZCMy Ñt{(6;MAEۘ<гqz_Ir~e 3QKoϛӈHzRO#%+wcnDT}-Qg9V7;#NZEE=aۣҧ?oώw7(l`f>`1^$+a& IZ0uW +yvT'W}O(r:x*iҼamUϧ߁ͼ=V7{p?Y@h_{d0ëa{9nܞ2ec6hgǕXƱEO^z?JoM=HC+U^6I0[pM\Sǃ"X$;&ܿhKb/8d%˒NmqcIX},7x;{;uQ3k=-xfg Ί7ői교8I'S-_J]% DCƋQmH"c~Ni`2j$=dk#z8tTں)3Թ;Gk!_F5%nҕ2f?8u*!4eJK2;O!5l_g\jvbssϝxRf]b%Aw;..[Hh42F<ahw.|6['lN)}}:Kdފp-s5ٖ=so,+2__9?9-`x]mz1maS,=:kiqhWN.4B7E^<.8`.q]:u<$\ҡT(.۴L ȵz_֡`kX䩓̮MwvK^ K\;mg8FqM}t}HW1R.Xsx;wzh̩1S 9XctYm/kegb2b6ZwvR9ŔzZQNuTUYkx#[e͒#,TfIېiH)jzU!sT+X+X%N ՜=aÖH]F^\~VL%/&> +endobj +879 0 obj +<< /Type /Annot /Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] /BS << /W 0 >> /Dest (cb237-16) >> endobj -878 0 obj +880 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb237-17) +>> +endobj +881 0 obj << /Type /Annot /Subtype /Link @@ -11137,10 +11190,10 @@ endobj /BS << /W 0 >> -/Dest (cb237-17) +/Dest (cb237-18) >> endobj -879 0 obj +882 0 obj << /Type /Annot /Subtype /Link @@ -11148,71 +11201,39 @@ endobj /BS << /W 0 >> -/Dest (cb237-18) ->> -endobj -880 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> /Dest (cb237-19) >> endobj -881 0 obj +883 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 662.437950 101.433071 643.687950 ] +/Rect [ 101.433071 681.384971 101.433071 662.634971 ] /BS << /W 0 >> /Dest (cb238-1) >> endobj -882 0 obj -<< -/Filter /FlateDecode -/Length 3339 ->> -stream -x[Mϯ$>!V`@!?MzVڕjw_b愳ϛ?ˇǓw%y%7]~K:ťrMPqXzŸ[]z?τstןDJ-'C QJ!Y" -G&K58j* .E jAR1DC7eP3S4d! gK˵f -dDKFrᐂ%k.眪%c蒚,A%.LX ](7e%B@4CV 2K2ˢO.U"oBp I AŐE}j $ђtaX2DRQ<KKMt[ 3t%[rKR J+WbmK!bKs+`y8[L@0"הAjlqEAdqmbqnٷ`qoهlqpT3[\@\R@bqu)hqvk[\]"SH,S]H]V-.(P]2X\\@>`L0ₒ2c%6eP,.(`qR"-.;I,.4PS% It!  A jXefoqfh%ajK^֙Ihq+M0). 0>N`&9 Pb jܬ -]7eY,.h 㳸$M4PތlqR֛FM,meY,.h ]RS]45#nIXo,Y.-gYoV f`,vx750%"3MdރxSA~f 8cA segAF27 &V5V! 6_c| ޢp9dCX0Xbد?}{_oNHivl'CYW LQokIXxc5X;C^;J+zQ=QV7pJlN]Uӫe˾ӏ菺eMJ&A|0΁Gd,K[c0{(!cCFj+*pGXϣ,-CG4e6d^1|>TUS^egs>MjjYDz5r/+;_,{; ݔ_5~c_9_ ª~ { d/K9{ X=?_ C5lk oli}8}?y*~~l1>Sڮd)O!ogR-jx,lW UF~ynuYșVa|BMn)?ymn{i'^v ]69^o[=۶] ÷֙6\ֺV{Y4ڍ,xYϛcf֣_Ї] ˇj~_O&ٺ~=(6҃b~Jw ltv5tc2sͨe<Ӳ u].ڟlgU+㱽噞ܔOڜo")TOF۰+c3bj=_Ϗvsޫ*ԯ/korş~s6k>;$3}=/c )=1SXω[mt=uݔ~:ze/;>izkhrAUT~76ۣZ"HQnw[oS7٫E{gK$jP馊q+?-d)i\}Ri{eZ &}\P~Mu][CvwRns?aD6p7lOՅ(Gϙ88a -ݰē`Yj?+ҫ>N|L?;\Y$ـ]|&,~g]F]NdtSeS1i<&ُB߸n  #a9^wywઐuUzp tz܂#}% k5l,j8?^V]DDjX7RM4s@x|GՌr5jrgp$(g@Yn-͑*T]arumEbӸ<’s̱UM/37UK> z'\򗅖:LU -ӥdӺ[HlNh$:lY pYeB)gBFy!YzZ*)$#MX(lgrP-8MWg -g=z'w^5\96*Ol| ȂjLK1‚^;qlox-g2N}&,oaȊ*7y> -endobj 884 0 obj << /Filter /FlateDecode -/Length 3184 +/Length 3336 >> stream -x[ˎd WȔHËY@8 ʌ&8~Uz*ݍPW(U3ǟ"ޕRsÉ\Vp?ٓd}M%+CN nOߜ}|Ɵ5ϿU%gBD Q.!JޡZ"ye!DK5$b -`ɞEjA _c6DD CK0zdTj,Csd.e[RJX2.dD/B ltdʠK(-Y.֩@xW1eЅyKVZDLYJ.@L{lQ Y.b5e%2KEks)Fn&,B2 $B9YrK  NBNrfBNR0yȂ DI.5eЅX\%[\`[X\[-.`O0j • ep Eg 1 R edqw).p` }a ˞E 0~,.P -Y\ PH,.nȘLYvA@!  p!3B@! lq*si+?#VΗ,.]_0|:aq#naeSD.&* wApÌ,.]Ϙ-xׇJD.hqy$`~s຦:X\`qfaGLbʲ#y @ƎZ\ޫ K%Acʠ `qFL#Yu K#lDZ\:mZ\X\`qA*jT 2|,9G 2,S]$H]Z,.p]2X\U\@>L0+Uc%K 6e2-.YboqR -.;M,.y WPS+%It! A J(Xe&34֒0%ufHr*Z\0JLiʠ h.X`e).R.7@@7 2> *%iqȈ,.`ĥ7 M,񌸭t-.]"RS]4U#nIXo,Y.5%]o f`(vx7V0%"3MMdڞ@1#?EW1 PojnU6 k$sjbeYkiBO'v-wȘ3KNV kU)vӷO|?S6~7)h*F ym+f( rM`۵hXzc5X5vt֓ XqzzrԲe' 􇽎eMJƴA|<5#:]%J#Xcu!Fjqfn.1>2(C >Ў#k2:>Tl*cZegs;P2}hӫe˾Ds~0X`هv@>dm _ҟ|~z/|/gٗK,>?|\ C5_ʼn:@g<~o?/N|?1Q=E! |">?<Ӟ5iAZV7Dk:{m>۽'4ZX;lA͞u_ܮezFR{g:^n0jM7Hˎ2ރXџki=SN=CMxt+'?G˿a;Fmyv)#{OoZCkh.|^'y0}'^[c=u;]l^|ݷڙD:GXm۶}Fo-AL[QpRf`% å&PlYp,-Wr:r ɚ+S$ݡݼrه80lNK<|$uYbc|3??d;a'WI۱c2M)3jp fד2Ayf]G]N5+Qr2}>(ǭaē?{0kfqTpP'aϴx}?M8UMeCކcB&FUú&ƛRuq"s H9ۨ[X#,WG9r8G*Re=Z*չLXQG=bx\aXS&id,%|gw{adWҝf Dzfi&63ri(+_3Pƒ=z&w^w8zhd;|~6=_F# 4g.@ - ^4zmNz~\ fSPuܳ,/ϿNr&[ɭx|LXWaA6_/l068-b%dP?; 78L 7ď;+D淎͚oV -7{wp[ה|ުĝ]S:qWۭ4;72M>mm7[dٽꁵ^lE~W,~o1UN#>Ύ): Fݦs7#xf]$gJ-p膖X/Fe`FD1 l֘N?6z\L+S,qiĸJz(ofK<s^UrDe=-Ƕl{޺!K2SZŇ__;VUj_15L3n<8Dxm|3_{Hjo ᄙ*\!lUڏU2exb/7 -mChf]*wYޢ_ű(O-?# +x[K$ 賁%z1r9v<6QUXݜݙ]9xvvKE~Tpyrp|yp$ơoI๸Z^T\i)|禨_O?|uױM8GZ!QXLR|2X ,`J)ؚłp{VjXcB  F,--<{A<3EPzx1\[l&JxD.)XrΩZ<,`dI[`*kZ=/R%/`dQX\ ^,٧f K"-AƏN$*ŻSx XA,1C_ 'da@,ql@rP ` 8b^ , sMdP,`adLЖa-} }bz K5ȅ)5 KN  w/PR`f K %BKY`J0p/0pn-,:abƂ` ܍ S"7p7&-,`n-,87. $dZXx^$ ЙHK,,H ZP[ wCB ]ȹYXTdaA>x-,H@b$.da$ a&9j wKDa+C +GjaA"7 2p'" 2p3YF ׀5|ɪHa>`-p,,] "X-,Yp WvlaAn<|&/;ŃY&pa XFZXP"d-,( ekٷ=,0s@2W%eǠUpm*xXXP +;`aR-,;I,,4WՈȂ$d`aA٠5V2{Iⱗ}frv*ZX7NHi `l`mɃ,‚Zl7B装Mo ,,,h>;I-,罅-T7#[Xf~[D~2Ɂ\a}D)9v]qY:Is9fSyJq7dzXkeʆzfs̽~ʬv6$,lNtQ^D׽Dmކ砱a;mtv@`Re4B1PqD~{ћ?hYqCſ2OrwOE@Yq}Dmn2lJ> {#j?тt7:۽\0iӁȏ.nd߿_ ٫IۆgT > +jХ\fEV] +T˖dC$cZKNVx?nt7zdl]RćݜOjYXd4plNՅ(ϙ+8e +]D~}ìߨrN.XlUa/{D!vyĝ~wrד~f̼'BÌv9]MMJ+`R1H4[i$q淁 "ZpO{v R`&quȺp5$9WtOjE< rh./].ucQ1;1ET:E0)&nβ?=~yaǣh':7y3͞An/rn0x +y5 G04L&CEtc F3ҵY{+Ҙ!F6BAOźxBYuT]!\! +SՀmIvS R2U/^ +TARfu׃g &]sЃ<П^_yxP'OUSĄ:ϦR/cq:Ka8싔LrkԂmZWB҃bh~feȔfC-}R9Ţ5L%&*;"̖h&@IsY%A˺Iv?6K2S;+0'! +E߈5g`˗Z +Wu46{ySpLK"\hff͛Szl ˍMg?"[E.3I[+X?cJ/a endstream endobj 885 0 obj @@ -11229,19 +11250,14 @@ endobj 886 0 obj << /Filter /FlateDecode -/Length 4208 +/Length 3182 >> stream -x\K ϯzr$p k#Xsz9ٕZvbȏdMw۳2%"/ONfI_iTMl %s8dOK*x~:]Sv:k-DgE~I9%VXBXRr!*h,1B"GGVTrX -+C O#@ ,i,aKH -a1*" Kңsvx69`5^Yb!k<,d h'!ިWqoX4,]*aA>iX#RkFLXOU9$̜xnAG1+~9}{?oIYa준i+'(!(O gd;L׸'SJY>mr,r[&A~:X@E#0$1q'yIPTS;~/џSƗ"݅YSmWV2"K`;ۭN^M$(+.bnBId{_|:7&4[t$?XtæbBF7!#L(ⴖ1$J \jjGq/˙:;?( +3QwȫN&&u|s'+Z:߫=T'{^y!_`wy,xwd-mIDۿ-w|g}Sych +7My~j̸gl]<>V0J]F|&Y\iURvZܧ(5iK[5+/4>VV 5x^{kkK^)B[!Ե=6:难"V:^Yo\,Պ6V:{a}m:2U}'] v^u!iٯdǽLC_K鮇*:1c湯{x> k+qYxLѥYFSQyqOP5? -+ ĽF7;@*p jn 8nbՆvsȈ󡯇s";<5]p8vT ]}xou=abį;N>X`.m-lq+=q%kD/Mqb.f^= -6ֱ~n}n)t>$~yWp#5gl2-_~0cܰYhh77+Ϊ<F ?Y*>U?7قЭzk{BD29D<#+mǪtݗo.XUw"W"A(L+T}u_.rk-Z=5hs5}5Xc߻ےbJZmVT=9Auqnɇ1zz@ĈӾ{^p[&;u2Z[n%:ۉGjm_oՅm.m3W+3tZe|(]<Ⱄ3?7ް=5'5m^Qw[ |ameV}H8?!5=lkuM`8`6Vd#qc۟շlRm^˵+u{B ~3::QE%tݷ<Έ+=?kXL -g.tDg;Yg)DVTߴo]K 6ڞqdDyBQyQe'}='%qwRm&G󠗟~;qWзm^teK3Y* 4 @Ϧg"c?#`ԭNkn/77=Um+ZXoczjwY%{/]]"3NꋡD?Q{aEUgsz\7㻾O7luhՌyrob?s<[ӻv_t}_9Kш[-wt}Wr~x0$3vJEˍjy䏫Y3cT`*9ޘ2$3}4c,]N&>,},cpGj/'sN>NqeG2,-y(!v1 ɾsygA GM..$ѥ%cR>T׮3PePC96>)$@|cЄ|kJݐh+B~m0v*^y^Z(}WhUG@Gd^,Sቓ\?;+L'^;L{Td4~~_" *#O`i?:[sA*I@4`);B]6aR_6?=4 - z*]<[V7 a]?+%t!0$aO3 WɢƸv>Ir;n!W|'^j`=M?I&ٙd8(LѧJ:Љ_R?N'"멆9+|~ -e-~u_kwfغ!Ho3wF8F ؟dgЭaq^ӼL`=@P; u ̈́N#ҽ{mY8ϏvАA3O!,Dΐn6Bq!rP4ńeJ RN2T -sH#'fCwZ]ˆlQ~{}7ch'I c!|&`@!?8͏y+[!.v,lN8{ +W5Z[z?}8yWO/qs_I൸Z)K>?v/tӿo Z1?HŕZOD A(%WJLrpbkL5RѨ5DPCcDTh (jP#L5BK!zOePīJ$\3rmQY,d". )0Ys9TLKj>0Y.)z&.*0Y.StaFd*A}`&.Je 2_K}E\"Bp )T BddA$>2@/'ZIFn,ARt3 X@je,ksZ0-9ͭ0 x43&]KeE2.]Pqt* lUߪqpg\ `\Y(8W p/ +)GqwEg\]*k.X-B΍qAb 3jd\A0S3x7$.ĸ\p]*kηZ$.h)2.,|PYqpd*qA(ʠe\5iqAEbd\P"tAk7]@ ](tAȸLjSe\PRz Ve]-k*¸u\E3.;K@ Ȃ2.( T`*r5"3g]d3.@ Y j.X̞qfh%aj&Soʸjv*2.@` 2`\vb\XPt jܬ j.GM[oCd| dqȼg\Bz3*ĥ7+&M,H6ɶ, Bʠ F&؉2tMmY z=,tL3`̖=7g\XmY鎁&̭t{1[gAFP+˚U|L8oQeCYu!,\sbL?|N;e|#Y1ڱaߟ`, ~\eA6RC0}űߚC^;Jome?XNizz򴡫ӫef; 􇽎eMJfA|0΁Gl,K[c0{(anCm6ʬ͎{7pw٭P+*p-GY\=7>[qdM[fsCP|=*;݇2Nu}//\KxAX:y@>d7vl|/; l?x +x7čgK' OK9 ȗ{ Yq'h೩Su/y~77;֏ߝ/\?xkOkR  oiޚxrƪUxm7׽5^] ?ZX;lb6Jv{W<맶oϘ6:t9z2Zϴaģ^ݮzne+zgv- p^$|ʛp=4Us}[ғ;טo;,haj0WBYrnz |'mQzh9tK]!??ƠGHn1Ct#9k̍=:vp"1vuYYz G,3:ˡC^z(=ܣrkh7ǖZ?k)H{"#G[}ϨN"#<{XHΨ@2v"lp, +dwRF뺾wޛý.׻𼽥އ40lN# Յh)Y~l cB7l8?d?~a:Nz;b/(U>~zwq৓T.Ϻ4yd`SRJJr\q=cVǝaawfur +r6UeW_ Lߚ[pԡO7tyStaQ6m8?^.vkT5Yb`)&F9 :lj@>Z1S=u8rm#D9Re6,TY.u`-!+v|/yK ty,W4\oew/Y(.wJi<"t);?V#5Ҏ:,B)gw{aaCb7f rϪ$[8LQذC 44]^zpXYΧ.săz7OlzȂjlb /}Nv}\ c3өOsQRl%6YV8e߿NzO[o}&Wv2~3l60F uM<׺G04Le uc2#Ί3c&뭌ΡcC+m]2YSywVtMj^)nFMsȽiz_kk%5Ub+Xb {FgoC<"I}1C'qTmsfЬKؓX>u=vH{:FD1ج 0KqV*3XO>*ӈiP3̖d&@iwzWəKV*){l[oy.ELz,=,ء[Ȭ;!g5ҿQkCE5|᧽% S_}7AeV(yڥO3_o +м-T%վP3/Fy{` endstream endobj 887 0 obj @@ -11258,16 +11274,18 @@ endobj 888 0 obj << /Filter /FlateDecode -/Length 4501 +/Length 4325 >> stream -x\K$qׯ和 0 m= >z$V> Vѕ3-ӕ|D_9XÕykU &BQygb.K^1b %8f SN/BdUd9KC;Ee*h+dB*gs{Ld5s&6IaGabRxDʃ,xY?8(V/,9 Udk#d)jd4 ).5 g -\ D  ǒ4 N%pԐda\Y! hX@Y<eXe[e뢆VRaraJESb' K!z K%vVʃ,0` \& K& m5,a԰b|VlY$ nA]װ}԰b?Va=x4,`#,Ѱ w]S4ʸ\2O4[hٸ GE.3kX7^ÂuOaA"nCaq%g p5,66IT^20$aXġD.{Ѱ wm Ұ w-#Qyװq xضʞFjRhl D ְ g/fְ gװ)fҰXȂOÂb0Y8xjXP\FYK7,Mxʾ-%L,!ʃ,oI7N/B_XÂY7ѫ%,fRPL4jX 䛈lxCB|3dYX@ooUK oԚJ &2ժ*Ϊe E<;LWU9$̜& #9hF4Op?˯j8?q5X|zLJL@UDHUDTDL8c8rZh,R;3x51բKN$PSYMoĹk=5;;>.^8DžG#w8y!{p -z$%O?_ϟ#VӗI]rV*_f_m<~N?ӏ߻JA>/ yLUin^ĩN8hv ]w[jɭ[oi:nuRij߰ |^ir+4kwѪJraQ[s4*ZUۥU֗Jxz*՛dzVѷ鹚O^ƿX&{D@=/krtFie|K T 8AN#vk,[G*_ -fx قm`zWC􎺼+m|/%<-9 yg/|ʲyAt7r_<\WH1"hW9jvoQ8Y -bM\@V:ɣD?|dnkt^q~EbLRD$XИ6}7cXԇ۶ =\hN) z?OP#ż͌__[koǍ AfAuc$y2?0N/Ia{~lݝ,pp֛TlAҲx:qfj"oQӆW̃XRvl"??63=>i0L#W9C 3D%WN>'|< 1f#tL{5ɹ@R8z? F*|O}"RzWpmBnƻ>-61e7Tx#ȔVoQ0^03Ԯ1M sôkA\=k {CY_s45#,8@A&+qM 0`M$mvJk O61:aѩ`ul?+v[1VkU!%-!'aPa \foGp~ZIrx,8oU"/t}69C6!0|-Dj%ɛl*~`nyɎa]; ~滑텴~yDwWm?>nOql??q}:teo!Tp :< ˖صerUJFV?HVA^8_, 61wJξ] E2s;D}H3ٍvÆOl[b;c?=^nhAG]'Vݞ,wo[rb>Zb%&3i@ێGC#;ÞhsI.b}ViZGҖR%`hC5zi4 U:5}AB]w tujn!qoWZ;tB_[ѵ4QSWhUG 5M{R&U};킠wKHJ0†fz3q;9a/rSfɛ*B -IjL"{J鱣kpFI].n\J{޺klET6Si HuX]NkX9m r"9Cߪɢ=q9v|ɩq'o[ul%6 KOl" -<`n$G0DZ4{Rݜ U57Qګw?mG ߱uE=|Z>IwLoyAvy ~kuu;Dt嵮xh2ߺ6a/!yɿIvH[w |ĕ4.\SG\̃r VbAΓtՋk%H3a9 䛇u^(njizb[zRЀSՓV B2I(4Kfdoe )V% +x\K$ 賁- l d|fsG(=ݳcHDQGRUhRJ)Of_j4_њhk*>/F6MWGԚ~&VK.9*Xz㒳Ia%`j,spa#5U =B mX֘5:cT1!xl\4K*Ui<V% %Vc5^,ц`4d d Oި&aP5SA@5,]oMְ wFN;LVWѰ w]1AÂu!@>5,]-rw]4NÂu% `( Ǩpt`5,@y 0␖hX")> ZlIÂܵۧb34-ؔ@5,]gѰ : "pzDjܵ "pyC԰X$ -tU^]L-EÂ,9 S$*//0$ax1C5,H]aA轆 kY|q n48 x]crհ w)ljX2\Ѱ.Ȃ4,HՀOaA6 D@ʃ,! X/עaAv;aAv)j}dA,5,-aA [J\baj5,/.iX1AÂ\! \E8dB$ Z ,5,(LFDhԒP ̢aA iTQ *M ʃ, ?TlG PD AÂREÂR 3N&՛YÂj 2> I 3FÂj M4,_RY4,ޠDmͬaA %"EQyISUzdq5hXPSzhX4&2zHPn@&Ef4,@&2[7ޘBgQO 7"G؋h3I=4,KRO VF=60_ca 'yD`1dZd[dn~9|{?ǯImDrR4vUym' 2 /5mԢOAFtdOk:b:\ ID(Pn1s:ILsI+yԹ9ԎGlg9&@%#ѭHwa{4έ.=zӴr&k? 5 +KrXĬPe5gqeB6!IG262 aB䘦$QPRMhPTS;~Ooq\q\'!/:ԛ9'+X[9ߛ|ݗr^p7{s?ݞr YN ְPڧ!}O߾?P?<cl7m7'o:`+vh|gl]|H}hg|!Β|~3iC*uIYkҡMƓ$ўi|My%^U1FU]1NJm4SX?d6[]1h;)5k>q]cX˩[C')7eutj?IqAkrdwIee;!ldKUr=?̽o'*2O4ν}Z hxUuc!uqOSkzhrx^ci?Xk9g([( (PdӲBI Of1g͵~G;ڬQX@RcZjGNzOZxUaeⷱ*Ә:7lg^K{>Ʈs5Y9Ű{3uI_@>?w٢Эz[[BR2cu:kF՝ȫ C>y_r'ю˧qb6{yϯk/K^g{={DZ-+vfO5eN jK6G˾qoɻ1d<}snx]\?u2eC 3ģKܨenjuVn3.e1.iR]n6ݰ?7^=5kEζ* ȏ5r8mF:GŶylR68rF5wsGrxFG9 Z"qF`?cqxP9ǛX'>p+se>Yk͙?]>I1O:V│c9P4wRg뜚 +&q;5)^{OMc{nDW=uV;>eN׳kT:b=2s g"{Py=yRum} [J3Mֶҹj߰.'NZ dɕw!N2G;NK矟}wr2=ŝ-GYݦ[aya۵TVKNVƮ_}_OAONO8Sޞb? i§ 8qOkݮU +(z]!- W' "nk]mFLLJknuPwl,WN"m31ȭFǠasַ +Ϲ nrQ 婘>! F KҾ?}\շvc*ldze^os6_?o[$|f'BU9#am=|h&:zC j`Gz,om w|~ =OO~$’8(rF.tײŒlϐ/r tb匦>򥋼?m\0ɷ+DܙL7dzMY|o!JL,3}m d9YFhtcQ衺4Ct:+ +u7OL'J/X BAslH ;;Cl]ǒ†FűSy*ʚLSe(^Dƙ]]G5צq;In_ ++LdӓD/bLj.*&N qP yڅ äٚoZIM6W7=/xzBC.2y~-:C:ѐ)&Sdrz?ȭ4h4~ rhU.Hlȁ֕C y۪Qt. E}ʶ.gځhҧ^)-nl.> endobj 890 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 709.923057 101.433071 691.173057 ] -/BS << -/W 0 ->> -/Dest (cb241-1) +/Filter /FlateDecode +/Length 4317 >> +stream +x\K$ȳ%Xa~65 }GeHdeDu횚 `PG(2=~ ppԜ|ɻ, >Ysvj*rA ]s:'5 >+咳U 9J2X)8b bH 1Xc,@ U!F́-U +rɃ ,^ .-KW]JIc"'Exd %&Ēej +duY|UrR ɫ=/zqR lLv)e!KRMddaX‚A@Ƀ,֮R-Y(F r,,,@Dj@mb Y)ZX$s2[X%!V-^d+laAȥ\4\b‚\! pEDD/@ / J,-,( LxhPcyfpr*ZXmLHi `&ba$HsLd!a Jn J,G `of ,,,>9 -,罅5䛑-,|XXP#DgJIlaAe"QLdAT} LB tx Ԕ4, @, 7Y.J2Y<."da.o"r{f8Y1^o5K o͚jd &2˒̪*eE%s%MVl Ft?rZO?}=o/?i`IkƊ\6#ՠkBRtS!ny"Cb9 iw-h\tרczϻuwU%'!{w#|ǎIa!N{:O!Xfx\w8#a|D:]yO繢ׄPsTժgKӺe1hY؜oOvtѩWըq 2Hw>U2"\ݪ~׫Ua2eYʕ}\B!yҷVB$ GucÅc~sz $Cܐ)kN.[BOkJEH +!Sæߠ,1`&_$ +;=]{;eZteYʌWzupѺ+w3cFC~zJ+Ɣ[YF=1=l^Oǒ[o"ޓ`gNȡ[6\P!(,/ekfoNn~ǸcZPCPbaF}Elc{S kϿajօik͟;gd1Cʜc/;'.L-=ؚ-jzy<`uARFq1G,Hz9] 8rh'*}>m +ABsڏ ݽXduK VsyÈUE0ɼ/U(~l'r`2?nn/JAJ)qcɎ_I1o̢&7CK[5g*3Nfz0'aZS䧛o\Z< [|#}|͡pD%K.ʗA\lgw?EXM#Aw4^]nr}߆}ٓ>vK"ٲ]Cs-99=Pއ>z};-z:=%?j|* fmuqL~;lq}^- 𹹾qfL e`G vx|"5 3Hއ bnV u1s4X 쓣O%Iaw ^kهCM r-c fv)Sx Z80yI\ylk|ccD}.kx=xƷLK~;kXpG +_!nftsdIdJ$Q+#ps{ǨFH=F.?O"0k=szxzbyv)ޏ˯\9y$1Ik蹤q1 +B5ͰqTT38} |c]>E_ޓ8a]d[`Z=n^@jb=b]ةc]>^1P26xDaFvVr_k1#k{߲:8)`i]3BFzO?u +E^Q;-PUjїG©Y2Zv'_|x?JT~']~/TWi1=7L#z-i>RvOU_}jzރ RY:qOKrZD~71iı`uGV7,*/@%9YrY[ir[R*% Y\[6#wVܱ.ګC@cw}akɎ~<&$ښ/h f}Ƅ:W\+4lX*6fԭUqyDw7i2b?NnƗeI^6̸xJc88oug}@VwˤW?@8uC=~T9H֓8D1coݭzަSx +B2k߅I +YjeYJ(]c +endstream endobj 891 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 690.976036 99.933071 672.226036 ] -/BS << -/W 0 ->> -/Dest (cb241-2) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 890 0 R +/Resources 4 0 R +/Annots [ 892 0 R 893 0 R 894 0 R 895 0 R 896 0 R 897 0 R 898 0 R 899 0 R 900 0 R 901 0 R 902 0 R 903 0 R 904 0 R 905 0 R 906 0 R 907 0 R 908 0 R 909 0 R 910 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 892 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 672.029014 99.933071 653.279014 ] +/Rect [ 101.433071 766.923057 101.433071 748.173057 ] /BS << /W 0 >> -/Dest (cb241-3) +/Dest (cb241-1) >> endobj 893 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 653.081993 99.933071 634.331993 ] +/Rect [ 99.933071 747.976036 99.933071 729.226036 ] /BS << /W 0 >> -/Dest (cb241-4) +/Dest (cb241-2) >> endobj 894 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 634.134971 99.933071 615.384971 ] +/Rect [ 99.933071 729.029014 99.933071 710.279014 ] /BS << /W 0 >> -/Dest (cb241-5) +/Dest (cb241-3) >> endobj 895 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 615.187950 99.933071 596.437950 ] +/Rect [ 99.933071 710.081993 99.933071 691.331993 ] /BS << /W 0 >> -/Dest (cb241-6) +/Dest (cb241-4) >> endobj 896 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 596.240928 99.933071 577.490928 ] +/Rect [ 99.933071 691.134971 99.933071 672.384971 ] /BS << /W 0 >> -/Dest (cb241-7) +/Dest (cb241-5) >> endobj 897 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 577.293907 99.933071 558.543907 ] +/Rect [ 99.933071 672.187950 99.933071 653.437950 ] /BS << /W 0 >> -/Dest (cb241-8) +/Dest (cb241-6) >> endobj 898 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 558.346885 99.933071 539.596885 ] +/Rect [ 99.933071 653.240928 99.933071 634.490928 ] /BS << /W 0 >> -/Dest (cb241-9) +/Dest (cb241-7) >> endobj 899 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 539.399864 99.933071 520.649864 ] +/Rect [ 99.933071 634.293907 99.933071 615.543907 ] /BS << /W 0 >> -/Dest (cb241-10) +/Dest (cb241-8) >> endobj 900 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 520.452842 99.933071 501.702842 ] +/Rect [ 99.933071 615.346885 99.933071 596.596885 ] /BS << /W 0 >> -/Dest (cb241-11) +/Dest (cb241-9) >> endobj 901 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 463.611778 99.933071 444.861778 ] +/Rect [ 99.933071 596.399864 99.933071 577.649864 ] /BS << /W 0 >> -/Dest (cb241-12) +/Dest (cb241-10) >> endobj 902 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 444.664756 99.933071 425.914756 ] +/Rect [ 99.933071 577.452842 99.933071 558.702842 ] /BS << /W 0 >> -/Dest (cb241-13) +/Dest (cb241-11) >> endobj 903 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 425.717735 99.933071 406.967735 ] +/Rect [ 99.933071 520.611778 99.933071 501.861778 ] /BS << /W 0 >> -/Dest (cb241-14) +/Dest (cb241-12) >> endobj 904 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 406.770714 99.933071 388.020714 ] +/Rect [ 99.933071 501.664756 99.933071 482.914756 ] /BS << /W 0 >> -/Dest (cb241-15) +/Dest (cb241-13) >> endobj 905 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 387.823692 99.933071 369.073692 ] +/Rect [ 99.933071 482.717735 99.933071 463.967735 ] /BS << /W 0 >> -/Dest (cb241-16) +/Dest (cb241-14) >> endobj 906 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 368.876671 99.933071 350.126671 ] +/Rect [ 99.933071 463.770714 99.933071 445.020714 ] /BS << /W 0 >> -/Dest (cb241-17) +/Dest (cb241-15) >> endobj 907 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 349.929649 99.933071 331.179649 ] +/Rect [ 99.933071 444.823692 99.933071 426.073692 ] /BS << /W 0 >> -/Dest (cb241-18) +/Dest (cb241-16) >> endobj 908 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 288.982628 101.433071 270.232628 ] +/Rect [ 99.933071 425.876671 99.933071 407.126671 ] +/BS << +/W 0 +>> +/Dest (cb241-17) +>> +endobj +909 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 406.929649 99.933071 388.179649 ] +/BS << +/W 0 +>> +/Dest (cb241-18) +>> +endobj +910 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 345.982628 101.433071 327.232628 ] /BS << /W 0 >> /Dest (cb242-1) >> endobj -909 0 obj +911 0 obj << /Title (CIS v1.6 Benchmark - Self-Assessment Guide - Rancher v2.6) /Dest [ 6 0 R /XYZ 85.009843 502.818898 0 ] /Count 141 -/First 910 0 R -/Last 1046 0 R -/Parent 1051 0 R ->> -endobj -910 0 obj -<< -/Title (CIS v1.6 Kubernetes Benchmark - Rancher v2.6 with Kubernetes v1.18 to v1.21) -/Dest [ 298 0 R /XYZ 84.259843 782.570079 0 ] -/Count 2 -/First 911 0 R -/Last 912 0 R -/Parent 909 0 R -/Next 913 0 R ->> -endobj -911 0 obj -<< -/Title (Overview) -/Dest [ 298 0 R /XYZ 84.259843 700.022079 0 ] -/Count 0 -/Parent 910 0 R -/Next 912 0 R +/First 912 0 R +/Last 1048 0 R +/Parent 1053 0 R >> endobj 912 0 obj << -/Title (Testing controls methodology) -/Dest [ 298 0 R /XYZ 84.259843 161.276079 0 ] -/Count 0 -/Prev 911 0 R -/Parent 910 0 R +/Title (CIS v1.6 Kubernetes Benchmark - Rancher v2.6 with Kubernetes v1.18 to v1.21) +/Dest [ 304 0 R /XYZ 84.259843 784.970079 0 ] +/Count 2 +/First 913 0 R +/Last 914 0 R +/Parent 911 0 R +/Next 915 0 R >> endobj 913 0 obj << -/Title (Controls) -/Dest [ 303 0 R /XYZ 84.259843 609.981496 0 ] +/Title (Overview) +/Dest [ 304 0 R /XYZ 84.259843 704.822079 0 ] /Count 0 -/Prev 910 0 R -/Parent 909 0 R +/Parent 912 0 R /Next 914 0 R >> endobj 914 0 obj << -/Title (1.1 Master Node Configuration Files) -/Dest [ 307 0 R /XYZ 41.740157 784.430079 0 ] -/Count 21 +/Title (Testing controls methodology) +/Dest [ 304 0 R /XYZ 84.259843 166.076079 0 ] +/Count 0 /Prev 913 0 R -/First 915 0 R -/Last 935 0 R -/Parent 909 0 R -/Next 936 0 R +/Parent 912 0 R >> endobj 915 0 obj << -/Title (1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 307 0 R /XYZ 84.259843 682.791496 0 ] +/Title (Controls) +/Dest [ 309 0 R /XYZ 84.259843 608.631496 0 ] /Count 0 -/Parent 914 0 R +/Prev 912 0 R +/Parent 911 0 R /Next 916 0 R >> endobj 916 0 obj << -/Title (1.1.2 Ensure that the API server pod specification file ownership is set to root:root \(Automated\)) -/Dest [ 307 0 R /XYZ 84.259843 532.191496 0 ] -/Count 0 +/Title (1.1 Master Node Configuration Files) +/Dest [ 313 0 R /XYZ 41.740157 784.430079 0 ] +/Count 21 /Prev 915 0 R -/Parent 914 0 R -/Next 917 0 R +/First 917 0 R +/Last 937 0 R +/Parent 911 0 R +/Next 938 0 R >> endobj 917 0 obj << -/Title (1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 307 0 R /XYZ 84.259843 396.591496 0 ] +/Title (1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 313 0 R /XYZ 84.259843 684.651496 0 ] /Count 0 -/Prev 916 0 R -/Parent 914 0 R +/Parent 916 0 R /Next 918 0 R >> endobj 918 0 obj << -/Title (1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root \(Automated\)) -/Dest [ 307 0 R /XYZ 84.259843 245.991496 0 ] +/Title (1.1.2 Ensure that the API server pod specification file ownership is set to root:root \(Automated\)) +/Dest [ 313 0 R /XYZ 84.259843 553.851496 0 ] /Count 0 /Prev 917 0 R -/Parent 914 0 R +/Parent 916 0 R /Next 919 0 R >> endobj 919 0 obj << -/Title (1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 309 0 R /XYZ 84.259843 799.370079 0 ] +/Title (1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 313 0 R /XYZ 84.259843 423.051496 0 ] /Count 0 /Prev 918 0 R -/Parent 914 0 R +/Parent 916 0 R /Next 920 0 R >> endobj 920 0 obj << -/Title (1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root \(Automated\)) -/Dest [ 309 0 R /XYZ 84.259843 648.770079 0 ] +/Title (1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root \(Automated\)) +/Dest [ 313 0 R /XYZ 84.259843 277.251496 0 ] /Count 0 /Prev 919 0 R -/Parent 914 0 R +/Parent 916 0 R /Next 921 0 R >> endobj 921 0 obj << -/Title (1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 309 0 R /XYZ 84.259843 513.170079 0 ] +/Title (1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 313 0 R /XYZ 84.259843 146.451496 0 ] /Count 0 /Prev 920 0 R -/Parent 914 0 R +/Parent 916 0 R /Next 922 0 R >> endobj 922 0 obj << -/Title (1.1.8 Ensure that the etcd pod specification file ownership is set to root:root \(Automated\)) -/Dest [ 309 0 R /XYZ 84.259843 362.570079 0 ] +/Title (1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root \(Automated\)) +/Dest [ 315 0 R /XYZ 84.259843 739.970079 0 ] /Count 0 /Prev 921 0 R -/Parent 914 0 R +/Parent 916 0 R /Next 923 0 R >> endobj 923 0 obj << -/Title (1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive \(Manual\)) -/Dest [ 309 0 R /XYZ 84.259843 226.970079 0 ] +/Title (1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 315 0 R /XYZ 84.259843 609.170079 0 ] /Count 0 /Prev 922 0 R -/Parent 914 0 R +/Parent 916 0 R /Next 924 0 R >> endobj 924 0 obj << -/Title (1.1.10 Ensure that the Container Network Interface file ownership is set to root:root \(Manual\)) -/Dest [ 311 0 R /XYZ 84.259843 760.623057 0 ] +/Title (1.1.8 Ensure that the etcd pod specification file ownership is set to root:root \(Automated\)) +/Dest [ 315 0 R /XYZ 84.259843 478.370079 0 ] /Count 0 /Prev 923 0 R -/Parent 914 0 R +/Parent 916 0 R /Next 925 0 R >> endobj 925 0 obj << -/Title (1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 311 0 R /XYZ 84.259843 579.076036 0 ] +/Title (1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive \(Manual\)) +/Dest [ 315 0 R /XYZ 84.259843 347.570079 0 ] /Count 0 /Prev 924 0 R -/Parent 914 0 R +/Parent 916 0 R /Next 926 0 R >> endobj 926 0 obj << -/Title (1.1.14 Ensure that the admin.conf file ownership is set to root:root \(Automated\)) -/Dest [ 311 0 R /XYZ 84.259843 458.476036 0 ] +/Title (1.1.10 Ensure that the Container Network Interface file ownership is set to root:root \(Manual\)) +/Dest [ 315 0 R /XYZ 84.259843 170.823057 0 ] /Count 0 /Prev 925 0 R -/Parent 914 0 R +/Parent 916 0 R /Next 927 0 R >> endobj 927 0 obj << -/Title (1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 311 0 R /XYZ 84.259843 337.876036 0 ] +/Title (1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 318 0 R /XYZ 84.259843 694.023057 0 ] /Count 0 /Prev 926 0 R -/Parent 914 0 R +/Parent 916 0 R /Next 928 0 R >> endobj 928 0 obj << -/Title (1.1.16 Ensure that the scheduler.conf file ownership is set to root:root \(Automated\)) -/Dest [ 311 0 R /XYZ 84.259843 202.276036 0 ] +/Title (1.1.14 Ensure that the admin.conf file ownership is set to root:root \(Automated\)) +/Dest [ 318 0 R /XYZ 84.259843 578.223057 0 ] /Count 0 /Prev 927 0 R -/Parent 914 0 R +/Parent 916 0 R /Next 929 0 R >> endobj 929 0 obj << -/Title (1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 315 0 R /XYZ 84.259843 799.370079 0 ] +/Title (1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 318 0 R /XYZ 84.259843 462.423057 0 ] /Count 0 /Prev 928 0 R -/Parent 914 0 R +/Parent 916 0 R /Next 930 0 R >> endobj 930 0 obj << -/Title (1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root \(Automated\)) -/Dest [ 315 0 R /XYZ 84.259843 648.770079 0 ] +/Title (1.1.16 Ensure that the scheduler.conf file ownership is set to root:root \(Automated\)) +/Dest [ 318 0 R /XYZ 84.259843 331.623057 0 ] /Count 0 /Prev 929 0 R -/Parent 914 0 R +/Parent 916 0 R /Next 931 0 R >> endobj 931 0 obj << -/Title (1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root \(Automated\)) -/Dest [ 315 0 R /XYZ 84.259843 513.170079 0 ] +/Title (1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 318 0 R /XYZ 84.259843 200.823057 0 ] /Count 0 /Prev 930 0 R -/Parent 914 0 R +/Parent 916 0 R /Next 932 0 R >> endobj 932 0 obj << -/Title (1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 364 0 R /XYZ 84.259843 733.820079 0 ] +/Title (1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root \(Automated\)) +/Dest [ 321 0 R /XYZ 84.259843 799.370079 0 ] /Count 0 /Prev 931 0 R -/Parent 914 0 R +/Parent 916 0 R /Next 933 0 R >> endobj 933 0 obj << -/Title (1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 \(Automated\)) -/Dest [ 427 0 R /XYZ 84.259843 541.781993 0 ] +/Title (1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root \(Automated\)) +/Dest [ 321 0 R /XYZ 84.259843 668.570079 0 ] /Count 0 /Prev 932 0 R -/Parent 914 0 R +/Parent 916 0 R /Next 934 0 R >> endobj 934 0 obj << -/Title (1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive \(Automated\)) -/Dest [ 486 0 R /XYZ 84.259843 409.152842 0 ] +/Title (1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 345 0 R /XYZ 84.259843 184.188585 0 ] /Count 0 /Prev 933 0 R -/Parent 914 0 R +/Parent 916 0 R /Next 935 0 R >> endobj 935 0 obj << -/Title (1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd \(Automated\)) -/Dest [ 499 0 R /XYZ 84.259843 799.370079 0 ] +/Title (1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 \(Automated\)) +/Dest [ 436 0 R /XYZ 84.259843 702.470079 0 ] /Count 0 /Prev 934 0 R -/Parent 914 0 R +/Parent 916 0 R +/Next 936 0 R >> endobj 936 0 obj << -/Title (1.2 API Server) -/Dest [ 502 0 R /XYZ 41.740157 784.430079 0 ] -/Count 35 -/Prev 914 0 R -/First 937 0 R -/Last 971 0 R -/Parent 909 0 R -/Next 972 0 R +/Title (1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive \(Automated\)) +/Dest [ 499 0 R /XYZ 84.259843 563.129014 0 ] +/Count 0 +/Prev 935 0 R +/Parent 916 0 R +/Next 937 0 R >> endobj 937 0 obj << -/Title (1.2.1 Ensure that the --anonymous-auth argument is set to false \(Automated\)) -/Dest [ 502 0 R /XYZ 84.259843 718.791496 0 ] +/Title (1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd \(Automated\)) +/Dest [ 499 0 R /XYZ 84.259843 234.881993 0 ] /Count 0 -/Parent 936 0 R -/Next 938 0 R +/Prev 936 0 R +/Parent 916 0 R >> endobj 938 0 obj << -/Title (1.2.2 Ensure that the --basic-auth-file argument is not set \(Automated\)) -/Dest [ 505 0 R /XYZ 84.259843 274.820079 0 ] -/Count 0 -/Prev 937 0 R -/Parent 936 0 R -/Next 939 0 R +/Title (1.2 API Server) +/Dest [ 508 0 R /XYZ 41.740157 784.430079 0 ] +/Count 35 +/Prev 916 0 R +/First 939 0 R +/Last 973 0 R +/Parent 911 0 R +/Next 974 0 R >> endobj 939 0 obj << -/Title (1.2.3 Ensure that the --token-auth-file parameter is not set \(Automated\)) -/Dest [ 510 0 R /XYZ 84.259843 556.070079 0 ] +/Title (1.2.1 Ensure that the --anonymous-auth argument is set to false \(Automated\)) +/Dest [ 508 0 R /XYZ 84.259843 720.651496 0 ] /Count 0 -/Prev 938 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 940 0 R >> endobj 940 0 obj << -/Title (1.2.4 Ensure that the --kubelet-https argument is set to true \(Automated\)) -/Dest [ 515 0 R /XYZ 84.259843 799.370079 0 ] +/Title (1.2.2 Ensure that the --basic-auth-file argument is not set \(Automated\)) +/Dest [ 511 0 R /XYZ 84.259843 277.220079 0 ] /Count 0 /Prev 939 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 941 0 R >> endobj 941 0 obj << -/Title (1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate \(Automated\)) -/Dest [ 518 0 R /XYZ 84.259843 331.070079 0 ] +/Title (1.2.3 Ensure that the --token-auth-file parameter is not set \(Automated\)) +/Dest [ 516 0 R /XYZ 84.259843 558.470079 0 ] /Count 0 /Prev 940 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 942 0 R >> endobj 942 0 obj << -/Title (1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate \(Automated\)) -/Dest [ 523 0 R /XYZ 84.259843 537.320079 0 ] +/Title (1.2.4 Ensure that the --kubelet-https argument is set to true \(Automated\)) +/Dest [ 521 0 R /XYZ 84.259843 799.370079 0 ] /Count 0 /Prev 941 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 943 0 R >> endobj 943 0 obj << -/Title (1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow \(Automated\)) -/Dest [ 528 0 R /XYZ 84.259843 743.570079 0 ] +/Title (1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate \(Automated\)) +/Dest [ 524 0 R /XYZ 84.259843 352.220079 0 ] /Count 0 /Prev 942 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 944 0 R >> endobj 944 0 obj << -/Title (1.2.8 Ensure that the --authorization-mode argument includes Node \(Automated\)) -/Dest [ 531 0 R /XYZ 84.259843 293.570079 0 ] +/Title (1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate \(Automated\)) +/Dest [ 529 0 R /XYZ 84.259843 558.470079 0 ] /Count 0 /Prev 943 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 945 0 R >> endobj 945 0 obj << -/Title (1.2.9 Ensure that the --authorization-mode argument includes RBAC \(Automated\)) -/Dest [ 536 0 R /XYZ 84.259843 574.820079 0 ] +/Title (1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow \(Automated\)) +/Dest [ 534 0 R /XYZ 84.259843 799.370079 0 ] /Count 0 /Prev 944 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 946 0 R >> endobj 946 0 obj << -/Title (1.2.10 Ensure that the admission control plugin EventRateLimit is set \(Automated\)) -/Dest [ 541 0 R /XYZ 84.259843 799.370079 0 ] +/Title (1.2.8 Ensure that the --authorization-mode argument includes Node \(Automated\)) +/Dest [ 537 0 R /XYZ 84.259843 352.220079 0 ] /Count 0 /Prev 945 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 947 0 R >> endobj 947 0 obj << -/Title (1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set \(Automated\)) -/Dest [ 544 0 R /XYZ 84.259843 256.070079 0 ] +/Title (1.2.9 Ensure that the --authorization-mode argument includes RBAC \(Automated\)) +/Dest [ 542 0 R /XYZ 84.259843 633.470079 0 ] /Count 0 /Prev 946 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 948 0 R >> endobj 948 0 obj << -/Title (1.2.12 Ensure that the admission control plugin AlwaysPullImages is set \(Manual\)) -/Dest [ 549 0 R /XYZ 84.259843 424.820079 0 ] +/Title (1.2.10 Ensure that the admission control plugin EventRateLimit is set \(Automated\)) +/Dest [ 545 0 R /XYZ 84.259843 183.470079 0 ] /Count 0 /Prev 947 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 949 0 R >> endobj 949 0 obj << -/Title (1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used \(Manual\)) -/Dest [ 549 0 R /XYZ 84.259843 213.273057 0 ] +/Title (1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set \(Automated\)) +/Dest [ 550 0 R /XYZ 84.259843 352.220079 0 ] /Count 0 /Prev 948 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 950 0 R >> endobj 950 0 obj << -/Title (1.2.14 Ensure that the admission control plugin ServiceAccount is set \(Automated\)) -/Dest [ 552 0 R /XYZ 84.259843 691.623057 0 ] +/Title (1.2.12 Ensure that the admission control plugin AlwaysPullImages is set \(Manual\)) +/Dest [ 555 0 R /XYZ 84.259843 520.970079 0 ] /Count 0 /Prev 949 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 951 0 R >> endobj 951 0 obj << -/Title (1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set \(Automated\)) -/Dest [ 556 0 R /XYZ 84.259843 199.820079 0 ] +/Title (1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used \(Manual\)) +/Dest [ 555 0 R /XYZ 84.259843 314.223057 0 ] /Count 0 /Prev 950 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 952 0 R >> endobj 952 0 obj << -/Title (1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set \(Automated\)) -/Dest [ 561 0 R /XYZ 84.259843 424.820079 0 ] +/Title (1.2.14 Ensure that the admission control plugin ServiceAccount is set \(Automated\)) +/Dest [ 559 0 R /XYZ 84.259843 799.370079 0 ] /Count 0 /Prev 951 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 953 0 R >> endobj 953 0 obj << -/Title (1.2.17 Ensure that the admission control plugin NodeRestriction is set \(Automated\)) -/Dest [ 566 0 R /XYZ 84.259843 556.070079 0 ] +/Title (1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set \(Automated\)) +/Dest [ 562 0 R /XYZ 84.259843 314.720079 0 ] /Count 0 /Prev 952 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 954 0 R >> endobj 954 0 obj << -/Title (1.2.18 Ensure that the --insecure-bind-address argument is not set \(Automated\)) -/Dest [ 571 0 R /XYZ 84.259843 706.070079 0 ] +/Title (1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set \(Automated\)) +/Dest [ 567 0 R /XYZ 84.259843 558.470079 0 ] /Count 0 /Prev 953 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 955 0 R >> endobj 955 0 obj << -/Title (1.2.19 Ensure that the --insecure-port argument is set to 0 \(Automated\)) -/Dest [ 574 0 R /XYZ 84.259843 256.070079 0 ] +/Title (1.2.17 Ensure that the admission control plugin NodeRestriction is set \(Automated\)) +/Dest [ 572 0 R /XYZ 84.259843 708.470079 0 ] /Count 0 /Prev 954 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 956 0 R >> endobj 956 0 obj << -/Title (1.2.20 Ensure that the --secure-port argument is not set to 0 \(Automated\)) -/Dest [ 579 0 R /XYZ 84.259843 556.070079 0 ] +/Title (1.2.18 Ensure that the --insecure-bind-address argument is not set \(Automated\)) +/Dest [ 575 0 R /XYZ 84.259843 145.970079 0 ] /Count 0 /Prev 955 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 957 0 R >> endobj 957 0 obj << -/Title (1.2.21 Ensure that the --profiling argument is set to false \(Automated\)) -/Dest [ 584 0 R /XYZ 84.259843 799.370079 0 ] +/Title (1.2.19 Ensure that the --insecure-port argument is set to 0 \(Automated\)) +/Dest [ 580 0 R /XYZ 84.259843 427.220079 0 ] /Count 0 /Prev 956 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 958 0 R >> endobj 958 0 obj << -/Title (1.2.22 Ensure that the --audit-log-path argument is set \(Automated\)) -/Dest [ 587 0 R /XYZ 84.259843 349.820079 0 ] +/Title (1.2.20 Ensure that the --secure-port argument is not set to 0 \(Automated\)) +/Dest [ 585 0 R /XYZ 84.259843 708.470079 0 ] /Count 0 /Prev 957 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 959 0 R >> endobj 959 0 obj << -/Title (1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate \(Automated\)) -/Dest [ 592 0 R /XYZ 84.259843 612.320079 0 ] +/Title (1.2.21 Ensure that the --profiling argument is set to false \(Automated\)) +/Dest [ 588 0 R /XYZ 84.259843 258.470079 0 ] /Count 0 /Prev 958 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 960 0 R >> endobj 960 0 obj << -/Title (1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate \(Automated\)) -/Dest [ 597 0 R /XYZ 84.259843 799.370079 0 ] +/Title (1.2.22 Ensure that the --audit-log-path argument is set \(Automated\)) +/Dest [ 593 0 R /XYZ 84.259843 558.470079 0 ] /Count 0 /Prev 959 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 961 0 R >> endobj 961 0 obj << -/Title (1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate \(Automated\)) -/Dest [ 600 0 R /XYZ 84.259843 331.070079 0 ] +/Title (1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate \(Automated\)) +/Dest [ 598 0 R /XYZ 84.259843 799.370079 0 ] /Count 0 /Prev 960 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 962 0 R >> endobj 962 0 obj << -/Title (1.2.26 Ensure that the --request-timeout argument is set as appropriate \(Automated\)) -/Dest [ 605 0 R /XYZ 84.259843 574.820079 0 ] +/Title (1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate \(Automated\)) +/Dest [ 601 0 R /XYZ 84.259843 352.220079 0 ] /Count 0 /Prev 961 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 963 0 R >> endobj 963 0 obj << -/Title (1.2.27 Ensure that the --service-account-lookup argument is set to true \(Automated\)) -/Dest [ 610 0 R /XYZ 84.259843 799.370079 0 ] +/Title (1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate \(Automated\)) +/Dest [ 606 0 R /XYZ 84.259843 633.470079 0 ] /Count 0 /Prev 962 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 964 0 R >> endobj 964 0 obj << -/Title (1.2.28 Ensure that the --service-account-key-file argument is set as appropriate \(Automated\)) -/Dest [ 613 0 R /XYZ 84.259843 312.320079 0 ] +/Title (1.2.26 Ensure that the --request-timeout argument is set as appropriate \(Automated\)) +/Dest [ 609 0 R /XYZ 84.259843 183.470079 0 ] /Count 0 /Prev 963 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 965 0 R >> endobj 965 0 obj << -/Title (1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate \(Automated\)) -/Dest [ 618 0 R /XYZ 84.259843 574.820079 0 ] +/Title (1.2.27 Ensure that the --service-account-lookup argument is set to true \(Automated\)) +/Dest [ 614 0 R /XYZ 84.259843 408.470079 0 ] /Count 0 /Prev 964 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 966 0 R >> endobj 966 0 obj << -/Title (1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate \(Automated\)) -/Dest [ 623 0 R /XYZ 84.259843 799.370079 0 ] +/Title (1.2.28 Ensure that the --service-account-key-file argument is set as appropriate \(Automated\)) +/Dest [ 619 0 R /XYZ 84.259843 633.470079 0 ] /Count 0 /Prev 965 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 967 0 R >> endobj 967 0 obj << -/Title (1.2.31 Ensure that the --client-ca-file argument is set as appropriate \(Automated\)) -/Dest [ 626 0 R /XYZ 84.259843 293.570079 0 ] +/Title (1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate \(Automated\)) +/Dest [ 622 0 R /XYZ 84.259843 183.470079 0 ] /Count 0 /Prev 966 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 968 0 R >> endobj 968 0 obj << -/Title (1.2.32 Ensure that the --etcd-cafile argument is set as appropriate \(Automated\)) -/Dest [ 631 0 R /XYZ 84.259843 574.820079 0 ] +/Title (1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate \(Automated\)) +/Dest [ 627 0 R /XYZ 84.259843 427.220079 0 ] /Count 0 /Prev 967 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 969 0 R >> endobj 969 0 obj << -/Title (1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate \(Automated\)) -/Dest [ 636 0 R /XYZ 84.259843 799.370079 0 ] +/Title (1.2.31 Ensure that the --client-ca-file argument is set as appropriate \(Automated\)) +/Dest [ 632 0 R /XYZ 84.259843 633.470079 0 ] /Count 0 /Prev 968 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 970 0 R >> endobj 970 0 obj << -/Title (1.2.34 Ensure that encryption providers are appropriately configured \(Automated\)) -/Dest [ 639 0 R /XYZ 84.259843 331.070079 0 ] +/Title (1.2.32 Ensure that the --etcd-cafile argument is set as appropriate \(Automated\)) +/Dest [ 635 0 R /XYZ 84.259843 183.470079 0 ] /Count 0 /Prev 969 0 R -/Parent 936 0 R +/Parent 938 0 R /Next 971 0 R >> endobj 971 0 obj << -/Title (1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers \(Automated\)) -/Dest [ 645 0 R /XYZ 84.259843 162.841563 0 ] +/Title (1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate \(Automated\)) +/Dest [ 640 0 R /XYZ 84.259843 427.220079 0 ] /Count 0 /Prev 970 0 R -/Parent 936 0 R +/Parent 938 0 R +/Next 972 0 R >> endobj 972 0 obj << -/Title (1.3 Controller Manager) -/Dest [ 672 0 R /XYZ 41.740157 784.430079 0 ] -/Count 7 -/Prev 936 0 R -/First 973 0 R -/Last 979 0 R -/Parent 909 0 R -/Next 980 0 R +/Title (1.2.34 Ensure that encryption providers are appropriately configured \(Automated\)) +/Dest [ 645 0 R /XYZ 84.259843 670.970079 0 ] +/Count 0 +/Prev 971 0 R +/Parent 938 0 R +/Next 973 0 R >> endobj 973 0 obj << -/Title (1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate \(Automated\)) -/Dest [ 672 0 R /XYZ 84.259843 718.791496 0 ] +/Title (1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers \(Automated\)) +/Dest [ 667 0 R /XYZ 84.259843 506.287950 0 ] /Count 0 -/Parent 972 0 R -/Next 974 0 R +/Prev 972 0 R +/Parent 938 0 R >> endobj 974 0 obj << -/Title (1.3.2 Ensure that the --profiling argument is set to false \(Automated\)) -/Dest [ 672 0 R /XYZ 84.259843 145.744475 0 ] -/Count 0 -/Prev 973 0 R -/Parent 972 0 R -/Next 975 0 R +/Title (1.3 Controller Manager) +/Dest [ 676 0 R /XYZ 41.740157 784.430079 0 ] +/Count 7 +/Prev 938 0 R +/First 975 0 R +/Last 981 0 R +/Parent 911 0 R +/Next 982 0 R >> endobj 975 0 obj << -/Title (1.3.3 Ensure that the --use-service-account-credentials argument is set to true \(Automated\)) -/Dest [ 675 0 R /XYZ 84.259843 330.123057 0 ] +/Title (1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate \(Automated\)) +/Dest [ 676 0 R /XYZ 84.259843 720.651496 0 ] /Count 0 -/Prev 974 0 R -/Parent 972 0 R +/Parent 974 0 R /Next 976 0 R >> endobj 976 0 obj << -/Title (1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate \(Automated\)) -/Dest [ 679 0 R /XYZ 84.259843 508.820079 0 ] +/Title (1.3.2 Ensure that the --profiling argument is set to false \(Automated\)) +/Dest [ 676 0 R /XYZ 84.259843 167.404475 0 ] /Count 0 /Prev 975 0 R -/Parent 972 0 R +/Parent 974 0 R /Next 977 0 R >> endobj 977 0 obj << -/Title (1.3.5 Ensure that the --root-ca-file argument is set as appropriate \(Automated\)) -/Dest [ 682 0 R /XYZ 84.259843 631.070079 0 ] +/Title (1.3.3 Ensure that the --use-service-account-credentials argument is set to true \(Automated\)) +/Dest [ 679 0 R /XYZ 84.259843 332.523057 0 ] /Count 0 /Prev 976 0 R -/Parent 972 0 R +/Parent 974 0 R /Next 978 0 R >> endobj 978 0 obj << -/Title (1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true \(Automated\)) -/Dest [ 685 0 R /XYZ 84.259843 799.370079 0 ] +/Title (1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate \(Automated\)) +/Dest [ 683 0 R /XYZ 84.259843 511.220079 0 ] /Count 0 /Prev 977 0 R -/Parent 972 0 R +/Parent 974 0 R /Next 979 0 R >> endobj 979 0 obj << -/Title (1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 \(Automated\)) -/Dest [ 685 0 R /XYZ 84.259843 591.770079 0 ] +/Title (1.3.5 Ensure that the --root-ca-file argument is set as appropriate \(Automated\)) +/Dest [ 686 0 R /XYZ 84.259843 670.970079 0 ] /Count 0 /Prev 978 0 R -/Parent 972 0 R +/Parent 974 0 R +/Next 980 0 R >> endobj 980 0 obj << -/Title (1.4 Scheduler) -/Dest [ 690 0 R /XYZ 41.740157 784.430079 0 ] -/Count 2 -/Prev 972 0 R -/First 981 0 R -/Last 982 0 R -/Parent 909 0 R -/Next 983 0 R +/Title (1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true \(Automated\)) +/Dest [ 689 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 979 0 R +/Parent 974 0 R +/Next 981 0 R >> endobj 981 0 obj << -/Title (1.4.1 Ensure that the --profiling argument is set to false \(Automated\)) -/Dest [ 690 0 R /XYZ 84.259843 718.791496 0 ] +/Title (1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 \(Automated\)) +/Dest [ 689 0 R /XYZ 84.259843 596.570079 0 ] /Count 0 -/Parent 980 0 R -/Next 982 0 R +/Prev 980 0 R +/Parent 974 0 R >> endobj 982 0 obj << -/Title (1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 \(Automated\)) -/Dest [ 690 0 R /XYZ 84.259843 363.244475 0 ] -/Count 0 -/Prev 981 0 R -/Parent 980 0 R +/Title (1.4 Scheduler) +/Dest [ 694 0 R /XYZ 41.740157 784.430079 0 ] +/Count 2 +/Prev 974 0 R +/First 983 0 R +/Last 984 0 R +/Parent 911 0 R +/Next 985 0 R >> endobj 983 0 obj << -/Title (2 Etcd Node Configuration Files) -/Dest [ 696 0 R /XYZ 41.740157 784.430079 0 ] -/Count 7 -/Prev 980 0 R -/First 984 0 R -/Last 990 0 R -/Parent 909 0 R -/Next 991 0 R +/Title (1.4.1 Ensure that the --profiling argument is set to false \(Automated\)) +/Dest [ 694 0 R /XYZ 84.259843 720.651496 0 ] +/Count 0 +/Parent 982 0 R +/Next 984 0 R >> endobj 984 0 obj << -/Title (2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate \(Automated\)) -/Dest [ 696 0 R /XYZ 84.259843 682.791496 0 ] +/Title (1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 \(Automated\)) +/Dest [ 694 0 R /XYZ 84.259843 369.904475 0 ] /Count 0 -/Parent 983 0 R -/Next 985 0 R +/Prev 983 0 R +/Parent 982 0 R >> endobj 985 0 obj << -/Title (2.2 Ensure that the --client-cert-auth argument is set to true \(Automated\)) -/Dest [ 701 0 R /XYZ 84.259843 537.320079 0 ] -/Count 0 -/Prev 984 0 R -/Parent 983 0 R -/Next 986 0 R +/Title (2 Etcd Node Configuration Files) +/Dest [ 700 0 R /XYZ 41.740157 784.430079 0 ] +/Count 7 +/Prev 982 0 R +/First 986 0 R +/Last 992 0 R +/Parent 911 0 R +/Next 993 0 R >> endobj 986 0 obj << -/Title (2.3 Ensure that the --auto-tls argument is not set to true \(Automated\)) -/Dest [ 706 0 R /XYZ 84.259843 406.070079 0 ] +/Title (2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate \(Automated\)) +/Dest [ 700 0 R /XYZ 84.259843 684.651496 0 ] /Count 0 -/Prev 985 0 R -/Parent 983 0 R +/Parent 985 0 R /Next 987 0 R >> endobj 987 0 obj << -/Title (2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate \(Automated\)) -/Dest [ 711 0 R /XYZ 84.259843 274.820079 0 ] +/Title (2.2 Ensure that the --client-cert-auth argument is set to true \(Automated\)) +/Dest [ 705 0 R /XYZ 84.259843 558.470079 0 ] /Count 0 /Prev 986 0 R -/Parent 983 0 R +/Parent 985 0 R /Next 988 0 R >> endobj 988 0 obj << -/Title (2.5 Ensure that the --peer-client-cert-auth argument is set to true \(Automated\)) -/Dest [ 718 0 R /XYZ 84.259843 799.370079 0 ] +/Title (2.3 Ensure that the --auto-tls argument is not set to true \(Automated\)) +/Dest [ 710 0 R /XYZ 84.259843 445.970079 0 ] /Count 0 /Prev 987 0 R -/Parent 983 0 R +/Parent 985 0 R /Next 989 0 R >> endobj 989 0 obj << -/Title (2.6 Ensure that the --peer-auto-tls argument is not set to true \(Automated\)) -/Dest [ 723 0 R /XYZ 84.259843 649.820079 0 ] +/Title (2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate \(Automated\)) +/Dest [ 715 0 R /XYZ 84.259843 333.470079 0 ] /Count 0 /Prev 988 0 R -/Parent 983 0 R +/Parent 985 0 R /Next 990 0 R >> endobj 990 0 obj << -/Title (2.7 Ensure that a unique Certificate Authority is used for etcd \(Automated\)) -/Dest [ 728 0 R /XYZ 84.259843 499.820079 0 ] +/Title (2.5 Ensure that the --peer-client-cert-auth argument is set to true \(Automated\)) +/Dest [ 720 0 R /XYZ 84.259843 183.470079 0 ] /Count 0 /Prev 989 0 R -/Parent 983 0 R +/Parent 985 0 R +/Next 991 0 R >> endobj 991 0 obj << -/Title (3.1 Authentication and Authorization) -/Dest [ 735 0 R /XYZ 41.740157 784.430079 0 ] -/Count 1 -/Prev 983 0 R -/First 992 0 R -/Last 992 0 R -/Parent 909 0 R -/Next 993 0 R +/Title (2.6 Ensure that the --peer-auto-tls argument is not set to true \(Automated\)) +/Dest [ 727 0 R /XYZ 84.259843 727.220079 0 ] +/Count 0 +/Prev 990 0 R +/Parent 985 0 R +/Next 992 0 R >> endobj 992 0 obj << -/Title (3.1.1 Client certificate authentication should not be used for users \(Manual\)) -/Dest [ 735 0 R /XYZ 84.259843 682.791496 0 ] +/Title (2.7 Ensure that a unique Certificate Authority is used for etcd \(Automated\)) +/Dest [ 732 0 R /XYZ 84.259843 595.970079 0 ] /Count 0 -/Parent 991 0 R +/Prev 991 0 R +/Parent 985 0 R >> endobj 993 0 obj << -/Title (3.2 Logging) -/Dest [ 737 0 R /XYZ 41.740157 784.430079 0 ] -/Count 2 -/Prev 991 0 R +/Title (3.1 Authentication and Authorization) +/Dest [ 739 0 R /XYZ 41.740157 784.430079 0 ] +/Count 1 +/Prev 985 0 R /First 994 0 R -/Last 995 0 R -/Parent 909 0 R -/Next 996 0 R +/Last 994 0 R +/Parent 911 0 R +/Next 995 0 R >> endobj 994 0 obj << -/Title (3.2.1 Ensure that a minimal audit policy is created \(Automated\)) -/Dest [ 737 0 R /XYZ 84.259843 718.791496 0 ] +/Title (3.1.1 Client certificate authentication should not be used for users \(Manual\)) +/Dest [ 739 0 R /XYZ 84.259843 684.651496 0 ] /Count 0 /Parent 993 0 R -/Next 995 0 R >> endobj 995 0 obj << -/Title (3.2.2 Ensure that the audit policy covers key security concerns \(Manual\)) -/Dest [ 740 0 R /XYZ 84.259843 312.320079 0 ] -/Count 0 -/Prev 994 0 R -/Parent 993 0 R +/Title (3.2 Logging) +/Dest [ 741 0 R /XYZ 41.740157 784.430079 0 ] +/Count 2 +/Prev 993 0 R +/First 996 0 R +/Last 997 0 R +/Parent 911 0 R +/Next 998 0 R >> endobj 996 0 obj << -/Title (4.1 Worker Node Configuration Files) -/Dest [ 742 0 R /XYZ 41.740157 784.430079 0 ] -/Count 10 -/Prev 993 0 R -/First 997 0 R -/Last 1006 0 R -/Parent 909 0 R -/Next 1007 0 R +/Title (3.2.1 Ensure that a minimal audit policy is created \(Automated\)) +/Dest [ 741 0 R /XYZ 84.259843 720.651496 0 ] +/Count 0 +/Parent 995 0 R +/Next 997 0 R >> endobj 997 0 obj << -/Title (4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 742 0 R /XYZ 84.259843 682.791496 0 ] +/Title (3.2.2 Ensure that the audit policy covers key security concerns \(Manual\)) +/Dest [ 744 0 R /XYZ 84.259843 314.720079 0 ] /Count 0 -/Parent 996 0 R -/Next 998 0 R +/Prev 996 0 R +/Parent 995 0 R >> endobj 998 0 obj << -/Title (4.1.2 Ensure that the kubelet service file ownership is set to root:root \(Automated\)) -/Dest [ 742 0 R /XYZ 84.259843 547.191496 0 ] -/Count 0 -/Prev 997 0 R -/Parent 996 0 R -/Next 999 0 R +/Title (4.1 Worker Node Configuration Files) +/Dest [ 746 0 R /XYZ 41.740157 784.430079 0 ] +/Count 10 +/Prev 995 0 R +/First 999 0 R +/Last 1008 0 R +/Parent 911 0 R +/Next 1009 0 R >> endobj 999 0 obj << -/Title (4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 742 0 R /XYZ 84.259843 411.591496 0 ] +/Title (4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 746 0 R /XYZ 84.259843 684.651496 0 ] /Count 0 -/Prev 998 0 R -/Parent 996 0 R +/Parent 998 0 R /Next 1000 0 R >> endobj 1000 0 obj << -/Title (4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root \(Automated\)) -/Dest [ 745 0 R /XYZ 84.259843 733.820079 0 ] +/Title (4.1.2 Ensure that the kubelet service file ownership is set to root:root \(Automated\)) +/Dest [ 746 0 R /XYZ 84.259843 553.851496 0 ] /Count 0 /Prev 999 0 R -/Parent 996 0 R +/Parent 998 0 R /Next 1001 0 R >> endobj 1001 0 obj << -/Title (4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 745 0 R /XYZ 84.259843 419.879014 0 ] +/Title (4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 746 0 R /XYZ 84.259843 423.051496 0 ] /Count 0 /Prev 1000 0 R -/Parent 996 0 R +/Parent 998 0 R /Next 1002 0 R >> endobj 1002 0 obj << -/Title (4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root \(Automated\)) -/Dest [ 749 0 R /XYZ 84.259843 799.370079 0 ] +/Title (4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root \(Automated\)) +/Dest [ 749 0 R /XYZ 84.259843 763.220079 0 ] /Count 0 /Prev 1001 0 R -/Parent 996 0 R +/Parent 998 0 R /Next 1003 0 R >> endobj 1003 0 obj << -/Title (4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 749 0 R /XYZ 84.259843 443.429014 0 ] +/Title (4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 749 0 R /XYZ 84.259843 454.079014 0 ] /Count 0 /Prev 1002 0 R -/Parent 996 0 R +/Parent 998 0 R /Next 1004 0 R >> endobj 1004 0 obj << -/Title (4.1.8 Ensure that the client certificate authorities file ownership is set to root:root \(Automated\)) -/Dest [ 758 0 R /XYZ 84.259843 733.820079 0 ] +/Title (4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root \(Automated\)) +/Dest [ 749 0 R /XYZ 84.259843 163.687950 0 ] /Count 0 /Prev 1003 0 R -/Parent 996 0 R +/Parent 998 0 R /Next 1005 0 R >> endobj 1005 0 obj << -/Title (4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive \(Automated\)) -/Dest [ 758 0 R /XYZ 84.259843 313.143907 0 ] +/Title (4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 753 0 R /XYZ 84.259843 519.629014 0 ] /Count 0 /Prev 1004 0 R -/Parent 996 0 R +/Parent 998 0 R /Next 1006 0 R >> endobj 1006 0 obj << -/Title (4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root \(Automated\)) -/Dest [ 766 0 R /XYZ 84.259843 799.370079 0 ] +/Title (4.1.8 Ensure that the client certificate authorities file ownership is set to root:root \(Automated\)) +/Dest [ 762 0 R /XYZ 84.259843 799.370079 0 ] /Count 0 /Prev 1005 0 R -/Parent 996 0 R +/Parent 998 0 R +/Next 1007 0 R >> endobj 1007 0 obj << -/Title (4.2 Kubelet) -/Dest [ 768 0 R /XYZ 41.740157 784.430079 0 ] -/Count 13 -/Prev 996 0 R -/First 1008 0 R -/Last 1020 0 R -/Parent 909 0 R -/Next 1021 0 R +/Title (4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive \(Automated\)) +/Dest [ 762 0 R /XYZ 84.259843 383.493907 0 ] +/Count 0 +/Prev 1006 0 R +/Parent 998 0 R +/Next 1008 0 R >> endobj 1008 0 obj << -/Title (4.2.1 Ensure that the anonymous-auth argument is set to false \(Automated\)) -/Dest [ 768 0 R /XYZ 84.259843 718.791496 0 ] +/Title (4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root \(Automated\)) +/Dest [ 762 0 R /XYZ 84.259843 195.693907 0 ] /Count 0 -/Parent 1007 0 R -/Next 1009 0 R +/Prev 1007 0 R +/Parent 998 0 R >> endobj 1009 0 obj << -/Title (4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow \(Automated\)) -/Dest [ 768 0 R /XYZ 84.259843 325.547453 0 ] -/Count 0 -/Prev 1008 0 R -/Parent 1007 0 R -/Next 1010 0 R +/Title (4.2 Kubelet) +/Dest [ 772 0 R /XYZ 41.740157 784.430079 0 ] +/Count 13 +/Prev 998 0 R +/First 1010 0 R +/Last 1022 0 R +/Parent 911 0 R +/Next 1023 0 R >> endobj 1010 0 obj << -/Title (4.2.3 Ensure that the --client-ca-file argument is set as appropriate \(Automated\)) -/Dest [ 773 0 R /XYZ 84.259843 672.873057 0 ] +/Title (4.2.1 Ensure that the anonymous-auth argument is set to false \(Automated\)) +/Dest [ 772 0 R /XYZ 84.259843 720.651496 0 ] /Count 0 -/Prev 1009 0 R -/Parent 1007 0 R +/Parent 1009 0 R /Next 1011 0 R >> endobj 1011 0 obj << -/Title (4.2.4 Ensure that the --read-only-port argument is set to 0 \(Automated\)) -/Dest [ 773 0 R /XYZ 84.259843 294.629014 0 ] +/Title (4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow \(Automated\)) +/Dest [ 772 0 R /XYZ 84.259843 332.207453 0 ] /Count 0 /Prev 1010 0 R -/Parent 1007 0 R +/Parent 1009 0 R /Next 1012 0 R >> endobj 1012 0 obj << -/Title (4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 \(Automated\)) -/Dest [ 778 0 R /XYZ 84.259843 638.926036 0 ] +/Title (4.2.3 Ensure that the --client-ca-file argument is set as appropriate \(Automated\)) +/Dest [ 777 0 R /XYZ 84.259843 675.273057 0 ] /Count 0 /Prev 1011 0 R -/Parent 1007 0 R +/Parent 1009 0 R /Next 1013 0 R >> endobj 1013 0 obj << -/Title (4.2.6 Ensure that the --protect-kernel-defaults argument is set to true \(Automated\)) -/Dest [ 784 0 R /XYZ 84.259843 443.570079 0 ] +/Title (4.2.4 Ensure that the --read-only-port argument is set to 0 \(Automated\)) +/Dest [ 777 0 R /XYZ 84.259843 301.829014 0 ] /Count 0 /Prev 1012 0 R -/Parent 1007 0 R +/Parent 1009 0 R /Next 1014 0 R >> endobj 1014 0 obj << -/Title (4.2.7 Ensure that the --make-iptables-util-chains argument is set to true \(Automated\)) -/Dest [ 788 0 R /XYZ 84.259843 799.370079 0 ] +/Title (4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 \(Automated\)) +/Dest [ 782 0 R /XYZ 84.259843 641.326036 0 ] /Count 0 /Prev 1013 0 R -/Parent 1007 0 R +/Parent 1009 0 R /Next 1015 0 R >> endobj 1015 0 obj << -/Title (4.2.8 Ensure that the --hostname-override argument is not set \(Manual\)) -/Dest [ 788 0 R /XYZ 84.259843 421.126036 0 ] +/Title (4.2.6 Ensure that the --protect-kernel-defaults argument is set to true \(Automated\)) +/Dest [ 788 0 R /XYZ 84.259843 445.970079 0 ] /Count 0 /Prev 1014 0 R -/Parent 1007 0 R +/Parent 1009 0 R /Next 1016 0 R >> endobj 1016 0 obj << -/Title (4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture \(Automated\)) -/Dest [ 788 0 R /XYZ 84.259843 198.526036 0 ] +/Title (4.2.7 Ensure that the --make-iptables-util-chains argument is set to true \(Automated\)) +/Dest [ 792 0 R /XYZ 84.259843 799.370079 0 ] /Count 0 /Prev 1015 0 R -/Parent 1007 0 R +/Parent 1009 0 R /Next 1017 0 R >> endobj 1017 0 obj << -/Title (4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate \(Automated\)) -/Dest [ 792 0 R /XYZ 84.259843 524.926036 0 ] +/Title (4.2.8 Ensure that the --hostname-override argument is not set \(Manual\)) +/Dest [ 792 0 R /XYZ 84.259843 425.926036 0 ] /Count 0 /Prev 1016 0 R -/Parent 1007 0 R +/Parent 1009 0 R /Next 1018 0 R >> endobj 1018 0 obj << -/Title (4.2.11 Ensure that the --rotate-certificates argument is not set to false \(Automated\)) -/Dest [ 798 0 R /XYZ 84.259843 799.370079 0 ] +/Title (4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture \(Automated\)) +/Dest [ 792 0 R /XYZ 84.259843 208.126036 0 ] /Count 0 /Prev 1017 0 R -/Parent 1007 0 R +/Parent 1009 0 R /Next 1019 0 R >> endobj 1019 0 obj << -/Title (4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true \(Automated\)) -/Dest [ 802 0 R /XYZ 84.259843 593.570079 0 ] +/Title (4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate \(Automated\)) +/Dest [ 796 0 R /XYZ 84.259843 542.326036 0 ] /Count 0 /Prev 1018 0 R -/Parent 1007 0 R +/Parent 1009 0 R /Next 1020 0 R >> endobj 1020 0 obj << -/Title (4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers \(Automated\)) -/Dest [ 802 0 R /XYZ 84.259843 295.023057 0 ] +/Title (4.2.11 Ensure that the --rotate-certificates argument is not set to false \(Automated\)) +/Dest [ 796 0 R /XYZ 84.259843 138.881993 0 ] /Count 0 /Prev 1019 0 R -/Parent 1007 0 R +/Parent 1009 0 R +/Next 1021 0 R >> endobj 1021 0 obj << -/Title (5.1 RBAC and Service Accounts) -/Dest [ 809 0 R /XYZ 41.740157 784.430079 0 ] -/Count 6 -/Prev 1007 0 R -/First 1022 0 R -/Last 1027 0 R -/Parent 909 0 R -/Next 1028 0 R +/Title (4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true \(Automated\)) +/Dest [ 806 0 R /XYZ 84.259843 670.970079 0 ] +/Count 0 +/Prev 1020 0 R +/Parent 1009 0 R +/Next 1022 0 R >> endobj 1022 0 obj << -/Title (5.1.1 Ensure that the cluster-admin role is only used where required \(Manual\)) -/Dest [ 809 0 R /XYZ 84.259843 682.791496 0 ] +/Title (4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers \(Automated\)) +/Dest [ 806 0 R /XYZ 84.259843 392.223057 0 ] /Count 0 -/Parent 1021 0 R -/Next 1023 0 R +/Prev 1021 0 R +/Parent 1009 0 R >> endobj 1023 0 obj << -/Title (5.1.2 Minimize access to secrets \(Manual\)) -/Dest [ 809 0 R /XYZ 84.259843 517.191496 0 ] -/Count 0 -/Prev 1022 0 R -/Parent 1021 0 R -/Next 1024 0 R +/Title (5.1 RBAC and Service Accounts) +/Dest [ 813 0 R /XYZ 41.740157 784.430079 0 ] +/Count 6 +/Prev 1009 0 R +/First 1024 0 R +/Last 1029 0 R +/Parent 911 0 R +/Next 1030 0 R >> endobj 1024 0 obj << -/Title (5.1.3 Minimize wildcard use in Roles and ClusterRoles \(Manual\)) -/Dest [ 809 0 R /XYZ 84.259843 411.591496 0 ] +/Title (5.1.1 Ensure that the cluster-admin role is only used where required \(Manual\)) +/Dest [ 813 0 R /XYZ 84.259843 684.651496 0 ] /Count 0 -/Prev 1023 0 R -/Parent 1021 0 R +/Parent 1023 0 R /Next 1025 0 R >> endobj 1025 0 obj << -/Title (5.1.4 Minimize access to create pods \(Manual\)) -/Dest [ 809 0 R /XYZ 84.259843 290.991496 0 ] +/Title (5.1.2 Minimize access to secrets \(Manual\)) +/Dest [ 813 0 R /XYZ 84.259843 523.851496 0 ] /Count 0 /Prev 1024 0 R -/Parent 1021 0 R +/Parent 1023 0 R /Next 1026 0 R >> endobj 1026 0 obj << -/Title (5.1.5 Ensure that default service accounts are not actively used. \(Automated\)) -/Dest [ 809 0 R /XYZ 84.259843 185.391496 0 ] +/Title (5.1.3 Minimize wildcard use in Roles and ClusterRoles \(Manual\)) +/Dest [ 813 0 R /XYZ 84.259843 423.051496 0 ] /Count 0 /Prev 1025 0 R -/Parent 1021 0 R +/Parent 1023 0 R /Next 1027 0 R >> endobj 1027 0 obj << -/Title (5.1.6 Ensure that Service Account Tokens are only mounted where necessary \(Manual\)) -/Dest [ 835 0 R /XYZ 84.259843 409.152842 0 ] +/Title (5.1.4 Minimize access to create pods \(Manual\)) +/Dest [ 813 0 R /XYZ 84.259843 307.251496 0 ] /Count 0 /Prev 1026 0 R -/Parent 1021 0 R +/Parent 1023 0 R +/Next 1028 0 R >> endobj 1028 0 obj << -/Title (5.2 Pod Security Policies) -/Dest [ 847 0 R /XYZ 41.740157 784.430079 0 ] -/Count 9 -/Prev 1021 0 R -/First 1029 0 R -/Last 1037 0 R -/Parent 909 0 R -/Next 1038 0 R +/Title (5.1.5 Ensure that default service accounts are not actively used. \(Automated\)) +/Dest [ 813 0 R /XYZ 84.259843 206.451496 0 ] +/Count 0 +/Prev 1027 0 R +/Parent 1023 0 R +/Next 1029 0 R >> endobj 1029 0 obj << -/Title (5.2.1 Minimize the admission of privileged containers \(Manual\)) -/Dest [ 847 0 R /XYZ 84.259843 718.791496 0 ] +/Title (5.1.6 Ensure that Service Account Tokens are only mounted where necessary \(Manual\)) +/Dest [ 840 0 R /XYZ 84.259843 449.446885 0 ] /Count 0 -/Parent 1028 0 R -/Next 1030 0 R +/Prev 1028 0 R +/Parent 1023 0 R >> endobj 1030 0 obj << -/Title (5.2.2 Minimize the admission of containers wishing to share the host process ID namespace \(Automated\)) -/Dest [ 847 0 R /XYZ 84.259843 583.191496 0 ] -/Count 0 -/Prev 1029 0 R -/Parent 1028 0 R -/Next 1031 0 R +/Title (5.2 Pod Security Policies) +/Dest [ 851 0 R /XYZ 41.740157 784.430079 0 ] +/Count 9 +/Prev 1023 0 R +/First 1031 0 R +/Last 1039 0 R +/Parent 911 0 R +/Next 1040 0 R >> endobj 1031 0 obj << -/Title (5.2.3 Minimize the admission of containers wishing to share the host IPC namespace \(Automated\)) -/Dest [ 847 0 R /XYZ 84.259843 212.250432 0 ] +/Title (5.2.1 Minimize the admission of privileged containers \(Manual\)) +/Dest [ 851 0 R /XYZ 84.259843 720.651496 0 ] /Count 0 -/Prev 1030 0 R -/Parent 1028 0 R +/Parent 1030 0 R /Next 1032 0 R >> endobj 1032 0 obj << -/Title (5.2.4 Minimize the admission of containers wishing to share the host network namespace \(Automated\)) -/Dest [ 850 0 R /XYZ 84.259843 574.229014 0 ] +/Title (5.2.2 Minimize the admission of containers wishing to share the host process ID namespace \(Automated\)) +/Dest [ 851 0 R /XYZ 84.259843 589.851496 0 ] /Count 0 /Prev 1031 0 R -/Parent 1028 0 R +/Parent 1030 0 R /Next 1033 0 R >> endobj 1033 0 obj << -/Title (5.2.5 Minimize the admission of containers with allowPrivilegeEscalation \(Automated\)) -/Dest [ 850 0 R /XYZ 84.259843 203.287950 0 ] +/Title (5.2.3 Minimize the admission of containers wishing to share the host IPC namespace \(Automated\)) +/Dest [ 851 0 R /XYZ 84.259843 238.710432 0 ] /Count 0 /Prev 1032 0 R -/Parent 1028 0 R +/Parent 1030 0 R /Next 1034 0 R >> endobj 1034 0 obj << -/Title (5.2.6 Minimize the admission of root containers \(Manual\)) -/Dest [ 854 0 R /XYZ 84.259843 555.281993 0 ] +/Title (5.2.4 Minimize the admission of containers wishing to share the host network namespace \(Automated\)) +/Dest [ 854 0 R /XYZ 84.259843 603.629014 0 ] /Count 0 /Prev 1033 0 R -/Parent 1028 0 R +/Parent 1030 0 R /Next 1035 0 R >> endobj 1035 0 obj << -/Title (5.2.7 Minimize the admission of containers with the NET_RAW capability \(Manual\)) -/Dest [ 854 0 R /XYZ 84.259843 404.681993 0 ] +/Title (5.2.5 Minimize the admission of containers with allowPrivilegeEscalation \(Automated\)) +/Dest [ 854 0 R /XYZ 84.259843 252.487950 0 ] /Count 0 /Prev 1034 0 R -/Parent 1028 0 R +/Parent 1030 0 R /Next 1036 0 R >> endobj 1036 0 obj << -/Title (5.2.8 Minimize the admission of containers with added capabilities \(Manual\)) -/Dest [ 854 0 R /XYZ 84.259843 269.081993 0 ] +/Title (5.2.6 Minimize the admission of root containers \(Manual\)) +/Dest [ 858 0 R /XYZ 84.259843 584.681993 0 ] /Count 0 /Prev 1035 0 R -/Parent 1028 0 R +/Parent 1030 0 R /Next 1037 0 R >> endobj 1037 0 obj << -/Title (5.2.9 Minimize the admission of containers with capabilities assigned \(Manual\)) -/Dest [ 854 0 R /XYZ 84.259843 148.481993 0 ] +/Title (5.2.7 Minimize the admission of containers with the NET_RAW capability \(Manual\)) +/Dest [ 858 0 R /XYZ 84.259843 453.881993 0 ] /Count 0 /Prev 1036 0 R -/Parent 1028 0 R +/Parent 1030 0 R +/Next 1038 0 R >> endobj 1038 0 obj << -/Title (5.3 Network Policies and CNI) -/Dest [ 859 0 R /XYZ 41.740157 784.430079 0 ] -/Count 2 -/Prev 1028 0 R -/First 1039 0 R -/Last 1040 0 R -/Parent 909 0 R -/Next 1041 0 R +/Title (5.2.8 Minimize the admission of containers with added capabilities \(Manual\)) +/Dest [ 858 0 R /XYZ 84.259843 323.081993 0 ] +/Count 0 +/Prev 1037 0 R +/Parent 1030 0 R +/Next 1039 0 R >> endobj 1039 0 obj << -/Title (5.3.1 Ensure that the CNI in use supports Network Policies \(Manual\)) -/Dest [ 859 0 R /XYZ 84.259843 682.791496 0 ] +/Title (5.2.9 Minimize the admission of containers with capabilities assigned \(Manual\)) +/Dest [ 858 0 R /XYZ 84.259843 207.281993 0 ] /Count 0 -/Parent 1038 0 R -/Next 1040 0 R +/Prev 1038 0 R +/Parent 1030 0 R >> endobj 1040 0 obj << -/Title (5.3.2 Ensure that all Namespaces have Network Policies defined \(Automated\)) -/Dest [ 859 0 R /XYZ 84.259843 532.191496 0 ] -/Count 0 -/Prev 1039 0 R -/Parent 1038 0 R +/Title (5.3 Network Policies and CNI) +/Dest [ 861 0 R /XYZ 41.740157 784.430079 0 ] +/Count 2 +/Prev 1030 0 R +/First 1041 0 R +/Last 1042 0 R +/Parent 911 0 R +/Next 1043 0 R >> endobj 1041 0 obj << -/Title (5.4 Secrets Management) -/Dest [ 883 0 R /XYZ 41.740157 784.430079 0 ] -/Count 2 -/Prev 1038 0 R -/First 1042 0 R -/Last 1043 0 R -/Parent 909 0 R -/Next 1044 0 R +/Title (5.3.1 Ensure that the CNI in use supports Network Policies \(Manual\)) +/Dest [ 861 0 R /XYZ 84.259843 684.651496 0 ] +/Count 0 +/Parent 1040 0 R +/Next 1042 0 R >> endobj 1042 0 obj << -/Title (5.4.1 Prefer using secrets as files over secrets as environment variables \(Manual\)) -/Dest [ 883 0 R /XYZ 84.259843 682.791496 0 ] +/Title (5.3.2 Ensure that all Namespaces have Network Policies defined \(Automated\)) +/Dest [ 861 0 R /XYZ 84.259843 538.851496 0 ] /Count 0 -/Parent 1041 0 R -/Next 1043 0 R +/Prev 1041 0 R +/Parent 1040 0 R >> endobj 1043 0 obj << -/Title (5.4.2 Consider external secret storage \(Manual\)) -/Dest [ 883 0 R /XYZ 84.259843 562.191496 0 ] -/Count 0 -/Prev 1042 0 R -/Parent 1041 0 R +/Title (5.4 Secrets Management) +/Dest [ 885 0 R /XYZ 41.740157 784.430079 0 ] +/Count 2 +/Prev 1040 0 R +/First 1044 0 R +/Last 1045 0 R +/Parent 911 0 R +/Next 1046 0 R >> endobj 1044 0 obj << -/Title (5.5 Extensible Admission Control) -/Dest [ 885 0 R /XYZ 41.740157 784.430079 0 ] -/Count 1 -/Prev 1041 0 R -/First 1045 0 R -/Last 1045 0 R -/Parent 909 0 R -/Next 1046 0 R +/Title (5.4.1 Prefer using secrets as files over secrets as environment variables \(Manual\)) +/Dest [ 885 0 R /XYZ 84.259843 684.651496 0 ] +/Count 0 +/Parent 1043 0 R +/Next 1045 0 R >> endobj 1045 0 obj << -/Title (5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller \(Manual\)) -/Dest [ 885 0 R /XYZ 84.259843 682.791496 0 ] +/Title (5.4.2 Consider external secret storage \(Manual\)) +/Dest [ 885 0 R /XYZ 84.259843 568.851496 0 ] /Count 0 -/Parent 1044 0 R +/Prev 1044 0 R +/Parent 1043 0 R >> endobj 1046 0 obj << -/Title (5.7 General Policies) +/Title (5.5 Extensible Admission Control) /Dest [ 887 0 R /XYZ 41.740157 784.430079 0 ] -/Count 4 -/Prev 1044 0 R +/Count 1 +/Prev 1043 0 R /First 1047 0 R -/Last 1050 0 R -/Parent 909 0 R +/Last 1047 0 R +/Parent 911 0 R +/Next 1048 0 R >> endobj 1047 0 obj << -/Title (5.7.1 Create administrative boundaries between resources using namespaces \(Manual\)) -/Dest [ 887 0 R /XYZ 84.259843 718.791496 0 ] +/Title (5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller \(Manual\)) +/Dest [ 887 0 R /XYZ 84.259843 684.651496 0 ] /Count 0 /Parent 1046 0 R -/Next 1048 0 R >> endobj 1048 0 obj << -/Title (5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions \(Manual\)) -/Dest [ 887 0 R /XYZ 84.259843 598.191496 0 ] -/Count 0 -/Prev 1047 0 R -/Parent 1046 0 R -/Next 1049 0 R +/Title (5.7 General Policies) +/Dest [ 889 0 R /XYZ 41.740157 784.430079 0 ] +/Count 4 +/Prev 1046 0 R +/First 1049 0 R +/Last 1052 0 R +/Parent 911 0 R >> endobj 1049 0 obj << -/Title (5.7.3 Apply Security Context to Your Pods and Containers \(Manual\)) -/Dest [ 887 0 R /XYZ 84.259843 312.591496 0 ] +/Title (5.7.1 Create administrative boundaries between resources using namespaces \(Manual\)) +/Dest [ 889 0 R /XYZ 84.259843 720.651496 0 ] /Count 0 -/Prev 1048 0 R -/Parent 1046 0 R +/Parent 1048 0 R /Next 1050 0 R >> endobj 1050 0 obj << -/Title (5.7.4 The default namespace should not be used \(Automated\)) -/Dest [ 887 0 R /XYZ 84.259843 176.991496 0 ] +/Title (5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions \(Manual\)) +/Dest [ 889 0 R /XYZ 84.259843 604.851496 0 ] /Count 0 /Prev 1049 0 R -/Parent 1046 0 R +/Parent 1048 0 R +/Next 1051 0 R >> endobj 1051 0 obj << -/Count 142 -/First 909 0 R -/Last 909 0 R +/Title (5.7.3 Apply Security Context to Your Pods and Containers \(Manual\)) +/Dest [ 889 0 R /XYZ 84.259843 324.051496 0 ] +/Count 0 +/Prev 1050 0 R +/Parent 1048 0 R +/Next 1052 0 R >> endobj 1052 0 obj << +/Title (5.7.4 The default namespace should not be used \(Automated\)) +/Dest [ 889 0 R /XYZ 84.259843 193.251496 0 ] +/Count 0 +/Prev 1051 0 R +/Parent 1048 0 R +>> +endobj +1053 0 obj +<< +/Count 142 +/First 911 0 R +/Last 911 0 R +>> +endobj +1054 0 obj +<< /Length1 41004 /Filter /FlateDecode /Length 7588 >> stream -x| xUut;YH',-11 EF0, E!( Ā $FQCgTuo?}{WCݺ]9sOG -Q"BJf' -$պ'?rFvz;}ݯWRnAƾiv'x`drPy98P4d}M^SW8u;? -bzojNQ!`a*[X7Ơ;b)9Q珥T#*υ-\*ϜI `3 -&X0.G%̚XaU2H=rfNIH~vhn'0_>/3ᯔ 僪;ab P[Kv!BvRQ~a$@Lߢ~zzt= 0洴\9~ADtتj߃c=ofTCVuBOMKKX1\W-ѫT/~ݺnпunXʪ%gՒ ήLq$b*TUf,\\IZv5rǥK8Z_Dz%8Gb/.⸐cV\`&qn#5F݈ 88#s|Ozt$N㘿R!'s17f7D N+9k5X>&=c8GQ.lPIr2os߆8'C9li @8sO&׈CDZ/{vH8@nf 2|-'{sNF&tbtÆf303$L6cnF k*v앺b$ًILLJbf)>f1&Ihzr1#I\@7i1;0*q T`.NANm 梕c%X -h֖`4s4Qf -G\HBEN^& ݐ8)/"X:9S]TR:jCQ+Q.e)ý"!FI`0ы9Y/,8\<,kīy)li^521ӰN/Z2ǽ͢~QPL8Y9#D<.wrQVv:?r%q&gh3 ]b&B#iIZݤK]ykd!fQ5g -.8?a+Xq85ٰެB]buta7ba*yX!íkl#XFO#aLiQ8ݰHrOEd^˞~ O~ ~%g 5ʁĆSzK[їljJ.D:' r2ыx$+Y٤|` 5I'tI'tI'tI'tI'tI'tI'tI'tI'tI~21HffP"," Dۧ )AѮ\!+aN'= -HnHΩxs*Q0@QQl8:pZjk\i 7h֡#ǎa1P&K4;qMy iڹW,T3^f"]7l%u -P].Ib?v*:frP5 vZff¦1ݗغ]%#GMl&6 #=>fZ#t? -/ z&Aoe'eIZi$OJǞ}mRcu8('|A_:Y>d;(E"PtUOEIF;MU2N"Fh6tZ5!߈2TgR~K|X$D ŜB0^2 r!^7z"{B&y9/Օn.mot)Qa]>:)\QN{>^bXL~ utFCV"Z힕Qܵ55!bB9 V vmOh}z,9'ìȔOJtJL_/}1YYYQY謘„Q1 U "ۺujɎ.,*F/\Գ4:3'=6B iGZt3X8qyjkj֭'&!Ȩ)'u!-xRG5?7/ԎWO:JVw7!I-W** a%[%ZW2ڐy9`s96e7پ3—WK":V'W?ʛo_?`ݘ bI!4?ÒdUk'y]]D> lU- :ܒY=2+ V$`@0M[6nyhU˫!c馌ӧƩcv- -)ϕr@ bT#Q=~߫>ܔ?ymS2v}1r5RƲ;7ө@`w?:ҎX.ʤٵ",^\+N)l~Xغm뉝ͥy5>EJY(#l.>|B<u2[SFjnM d6Ϙe6NojbOUhc g"_%Y2eYB{[4O:`%&dviVxڮB m^Vjf"GD BE# S"aL(~<#TJŃ`1Dc WeSZf`؋/JG o>0b A7FTZgjeg4vF~!3bA `k= W)LvЪ+C@# .Kikl*eWܡJXnjjdd8ݐ/(%.+0<赸q-qF \㦡4䲗OΙvWO[p>,[0u% (jַYl\vO&VѼf! ǚP#AtjՃV rD)1JŖkI`^ -f'!U9~.߿/_={of 7o "odw5CC;Kl4cXg0 -(^"yA -$6]X[؊n<찟;|ԑ7Yh:l p5yW&:WB[s3X 3f@[b:W@ǭO[ ꖜ6nKwr]]-}}L}},fxXhJ4wJv&:'F&F%yVVWZV8_%A6f`Z1m0b1!9o#I%IKʓ'R9 K nTǗMZ p3Yf>߾>@bQΛʶ=>Ye[GVޓߤdt:[%%iRj2|9kC̿/X8?LjSbbhѫ^QZ*m[\U6|; ;/'o5&V笱rNtoQ۬uRfAt& =JgmRM}zv5lvbPSq*ݴKl'_BgP"w9{zD0i\__]@%{K \7GbDX), ;EH;G'$CBo+>h`:^HPP\NM #18KԪX[Fm<}Ye5Nk屧/0$EQl:,XϞEk{"pvc]251aXL=[1MCr͞lM tN%+qƘao*t6i - gۉm!Wש9l ϿʭٳGvUy%JH !}ȝ0|9-!UkMZv*v%lSnhBn5a/813@:ܲnA2M0 Bݞ=ve F^nUmN;E2.kC!Wh#I7jA0yٚblxk^'˃ -a!́i0a.x & x R(7Zx Et́)3+YԾ;D>VVB)g> f>(i>ͥ,jC}SQ7Q >9hS9Def;y͞=}(EtUg-Ҿ(4K;-[>Ek}c҂ۭwZ_>Q @$]qdLuJi:io)ͤud0Q:4`4t04:dQ`3wI~9-dӧ̙EfL$P4UZjT mZO?_jV-no?ZDͭ ZCޡ)oZ}CMkmZ,Dju\8bٖaxFVj5AOÃC!@=v^"ZSH H#uJΙ2sfQ)fzά(SQS#37gMWk -̄9fQ˹yR3F[ӦoDy8f!ϐ@a>,A(tR2-Ue&meX:Ϧj5meߚ J8V;/Ƹ~|y.3$k"Ii&.= +x| xUut;YH',-11QZM`D!Ȓ@XAM @aDp\*qЙhԘp{F6K5;Sc')A k*<Ex©3g9Q}Ss +@S2u¼7OOɍZ?͠Ta}.lR9.ǶOl#>Q09qx/a̜ +C +Fj3sJ·w@򳋅Es[> 4zy)} D)T ׼y#C*>vkz޽r!;~P?LA9z!B~Z6D#cVV&mbC^[Ka5@.,tUvlC嵿tݠFXkc?Rx{oVk%^wO#}Z%~[ F3o*?W*֏+_&KWd/9J'x ~t?5` ^8H/ K8q|8J|\sv* +_;8_X8cv]j9=.pwXq{.VQJqsi+,0iK.>&=mɄ9n 6p +TQ럱J+>݈ʏK8(xqOfuwi I{lY*s*3REi.$M +;evi9ev|R%}-/Y"=q\ţ]Rq\1+.|8qN#nBgq9>j/=: +q_Sq +\9Na N+8g78>&=c9.lҨPIp2GgFpφ9'8bᐈi  8pW&ۈ=DZǻrHw;@.f 2|-7pͱWOԫ{I=#,aĴL,rÌ)f)%ؽQnnF욊]:{.9!ubR=xYD8r h3ځ\jH!2#Mts oN1 +aCs141:cG5pph[h` 8Z%M64rTD9Ez(jײIB7d6xuf5p-lΦ*yT:;ʄnT jY +pl(Q-G7h8LcfN #xzEy1[,biC+7!8,DA Ep 4Vq/|E_=ka'/NV%B0jHa3Q=?϶ 1.F]"G %t y< E"H Ѕ{kF`7Fסf ;iYTb O +1V-~ `67}/,ME좈e\(*Ί'̢$&*D{?m#4:oD3vV}ХyCHms, +bHL`]bN!CD/xW9==X!e ++\&]ç 7_+]|zV_A2,,DFE*F`"̑Qks}h]^2H9*1an0gL M 5>S3`ۛ +fVZo$RΑoߚ 6\tL|Bzp7MHO3.-5X\#/`ע/?WniqÜJ76 ~7zX:򔨰.wfz|n'YB1M,&::!F+ kvʨc `hQ1GOņTo4>xS=ԓaVJDJdJT'%:%_/y|ѾȬ,OVtVLVBaŠҨROi򄪄 m]:uȎ̎dGFFz +F.ZYz˙N~!4#-,M55V?^ܐ}dWO/vL!]^=GUBrB8hW*$&ZZGe;%(. nZ<*jI" +#"ލ!~/\jHV]MP +WAqlU|0EMGLt~aIM_2Cª͵V 'y]Y/f"|/Lt}n,\g `0JJ@ySu&-U<ڪՐ1tSm1lJvrUTZ?roi |KVWxUvnʟ)[;>E_wher^c`b#ԝT} h ;viG~][ieNsk/_[yv6?$lݶRټuJw",տ6@U>!:Ab)A5g2f dd7S51* ʱ3/JR,,-Hbl0e2;4r]n>tޕΕP܌}F+Vru؇qk@%gMnҝxWsWK_c_S_s_'$͝ɮQI踄敖W AM-V Da' GaLHNHRIҤ򤪤IBξ=Rۃ,Uwz ee;?7sϷo;,;8zoH-GbcO`X70b$G7i+Y9VI =~Z̤c:mj!K:i@E.TV꫗vJ[6Wؼ}!{-[i }};l9k,2][T}j6+pTY ~nuTSsyb`DŽ]9۶)T?ouܭJ1dɗǙ 7d@/ FΞ^% =wG~t =Ci#Wn`QX(V +KuNAQ'2+ ;ϒ0I(`1EɄL6`٧l<Bo+>h`:^HPP\NM #18KԪX[Fm<}Ye5Nk屧/0$EQl:VVB)g> f>hi>ͥ,jC}PQ7Q >9hS9Def;y͞=}Q(EtUg-Ҿ(4K;-[>Ek}c҂ۭwZ_>Q @$]qdLuJi:io(ͤud0 S:4` t04:da@`3wI~9-dӧ̙EfL$P4UZjaT mZO7?_jV-no?ZDͭ ZCޡ)oZ}CMkmZ ,Dju\8bٖaxFVj5OFC!@=v^"ZSH `CH#<@;j$FC;xuJΙ2sfQ)fzά(SQS#37gMWk +̄9fQ˹yR3F[ӦoDy8f!ϐra><A(tR2-Ue&meX:Ϧj5meߚ J8V;/Ƹ~ByO54Q`1> endstream endobj -1053 0 obj +1055 0 obj << /Length1 7648 /Filter /FlateDecode /Length 4714 >> stream -x9yxSU眛&-PڴItM=M4{%K%m/PRVy#3"C6Py*~Q\oFf:*f7# -MZZD{==sr~IF@t2a}%Bх&gU@?̙ oj3Qf@=#m"-DHBhhG7{`n/̝送p H;tdc!׳[ے -o/ޏQz2yМwa+/ %OEv_cT?{$m?JK -\.3'+BX'#@™Ns990Hc>/`^ml7 %/-:nX\2 -ZpvdB~N爜9o&-jHC=H@=P%TwR|bJ&%IVE0f!k&2*dAےߣT׊SA0r? Ǒ} U30^0/CzhgAc6CDr$c )Όba< BwB}Ǩc$ȷ)` xZ]"auWB; ff0*4E7b?=j؇6PV(FfH-}T#7GڅB -Tlfo]>=_O,/_v8z 9EŸ§?H)&w7;|, b6NfsBP)<,8! '@ثP>kX , 2OD$)|UxE"2NMeFDF"Z"6F<|Ļ_ML %mQH)-*3"86LB^8c7ၹ$ -<(& -E:9YIiDdY td0(O$ƅBIFQ_qb KhTu{T)n[nJIA~֎\AEExkmUܮ:F,'^%*a9,WRF(9_30 3=#%sE!$d!̊Jdg:=8y+`e]pTQBHfQF{@c@wӉ.r9}@)0#IE -,KRdIAx|]#ѶIkbhQnk ]p$2ڌkOoQRd29wً(k$|n" e,@ԬF3OšrKkD.ki(iZ2ґRk"â9n|%VlyZNAGji4 Eɩ1+f%2X7|uzJ%N^o>m4[ !H$qo)N ӹ}:#UsHT] #[.,\\[`,5VK.В?4`3鄈M::A ; dՊ,.n_a?u̞^Sit;;w6 ztxyW2koRuMOm |sCrl.Eẃ9s ≓A!89BB5v{wVV+tf-*7;OGdžqkYZ[-myjo)bm$TIT7 -Q<^ E*DyɢuIs3]m3\vNS٬.[珏>~1[je ym"9󤗠` aPI;9gj o<PJJbXa3M;5U>yotGPEW<ĝ Ҹ &iڍ&Rq/^u*+1Ijuc]N[)754Z'#\Krgw E^exbO=|ꀧ`Xr3 }m?e2 Ndb6DŻ_vv $@eMn&ϽNƸaeh: +hn -L҄ n};-\ { z c!y;?7Q -CY&\312n1݌mN$ _'| d<1X̒7w?&) d hAJ{: --rdg"EXz<{̇!*y{{~waZǫۨ!g xĀɨHgTȂ[ݟZK/n;Wpp- R S'>orR㤒Yw3@[Ϝ ׷7i|ϨaޙƚQq/sV֫q:oZ-x9x}1yf)4r@1`Ki1)@%+LpUS!K!ث0ȶ8ęih^ S -sJ5wE9"v2>*F(ʩhXTNΘ(f벁DP)?25z2؜>JuTL,`%r8lg/q aPbccޏ> -#4`j65#bߴ?zʻpއ5ĠGIqX>Ct-5 GB#@X)=\`/Ŕ'&F4J.N+g23I,3@M88sv=.hLb&LF35 ;k l%RGu/].:#/13y!Q/G3  -&`^<$ð6YVe˺JV)qz6?ߖQh,dfx4YE5B.㚜8QłpSb]e9;V׻ڌVrǓY_ - -a97Ů`r#rFJ[7KgV65G5mi)1PV-=*Wqò i]"-OK˪2Yo! ۞qq9qFh@j+K kKo/jH+(pWJ+k1nPblRj :͓Ydn3?s>)9SeO(x.NfjDlM=Პ{#mAi,$Jmeq[jEDZoc<4\^h4ZFϺݿ_ s2P;5yIy\I6-N 0,U\ $*銗vM{xKe)i\8`>C ŵI◗ҧ_gq? |d--6f.S\J223۵dCUFcyؓ){Ry]z+y:Icx -0{Y;Q~K* _aͷi4;"1 9SK=V2{ӺƣG7m|8z-o_x8$E|CǭG p23v1< -Sp$O6 Z؉^fP xb}J&d&af~Չn7pu/io 7gB G'C4] }iзljH~4Q'jGh"eu!rH+> -stream -x} xEh-]=wIn{/&5 pŰ#DDd $@N"$ @p"F " (.l/d|;7:3{{=:u$ (($cKGWж!P3{Oܗ؞9bz{_ ")<:6S!71S_Ppž^o"4t7BdPa)ɤ+3W˟^@ܛMUk"Ba/VG%<bx)%&ApEcOm93B)S,AA?5JAK@EK΢a0_u'dU 2{z-uS#pn5P!jTdG!K$CZN"5*M GD &RY"DmC)>:]܅˕)OAo]#}g);L =L'b'_G(z KG]7NAϓսdC{A.!Nߎoqzovd雯ı7;bto틥{߰3{F0tENNwp=nJ}ynj -%Vb.}-%N7s"8N7ramtIQZxem"]5 yNW?[s7s%AVKC*NWvt"1TGë3]U?鏜> |xC 9}'9]BN<d 8}"H1NMWsLs:9ήUYΜt&ZZJiI^MͥpZ\ԒSj:Nt"8?Ƨqӂ:+tNdž1u6LG4?W<`yn:J#9t܏t86ap7,tH5p}J{l`59,`ޝHu~nڷu>^մg=\{5;ʲm.+vguwBwi8;+j.-vNciGN\N;8ifF, Ҍ.K3Hu kIͬ If6mki1NڪeG֪tYˎX|,M崙D;XJ"M`"m h4&9hdaMiF!>&&҄x/Kx{inOKqbR/ Kc8vP橦nsk,u:hwpjKmV;9dS<O,ԜNM05I!ITTTf:9e:e!It,$#aEw㱏--AH@Åh/;B Z2 -V+ TGCG 8O6"ˤ"_h\x/ڃ.ۏŬ&ZɋG6²H"MHۥGТT*APfl4 ~trrRg w;ʎ3 ΁h&{{яw$__+tQ9ZyJq"MW!-6}d|gx"am^AD3K H&r 'a}͑''-Lh;ݠ!Z3B.ij0Ny9G`^0:Afrto{b[ ǁ9?DOmя~8O,8 F8 -G3A .B1bT9R @;!sg$F \weh7n$ɿBC=G!ǚ?'~RLPD跍QzBezYl xJ-T~'7Žo즡M͗-р,+˺zVhOpGEE]vb`#F0`#F0`#F0`#F0`#~.uEaTɿ,%j9kp dE%Ѫ?.[S+=pw:ww=oߓkF! (oZ!#j>^Э33*=I x.lSW.*esK?g~KrQHIu -8E)r?@dڱ m& Em?J<9S׍T3ֹA9dyXncg~"~utݗ L(%ZVWV 9ZDb`$1*4lONj";v؎~0Juœ9'Ι=?OC -\ȿ| -^O!&:jrӭ+hȱ0lT -8jic;W SUXrGy=By] z2$&EcOLcR R"j^%1nǍkoeА;pC5YY]Z{(v%Gtbg6dP|/\V6  9U{ ثpNEF0hHF$%|nf+Lu $o8"P0 -n/X{=FF -J4۴8IDmW<^I?-[pTRZP{6MrH8^gΆh DŽ#G?_%%EzY?>B8.=Pc,m⿝fg -F!e/55][}u2#E9mgQqAZD'l\$wҹ_Mtr_2䤁p.׾_ < F!7:-<*舵F3%H8= n ;=D3DE,ڥ -<=sBay%Di{ߞ_R$_J@aBi!t@O3 C K{nɱ[@M^V;]E6^? -| ].t`;A}+탆CbP莡fg!è^ʄ.#?`u*#H*4I58hPδҏU!,W)>!znˆđaE EE"@\bXaz\bo<ɴɼɲ%aK@\ẓ#ExErz),└pR.IGg;~ѣCK7W~%KiÏ_؏6C@?33ww=% p 6{څrO [ ' 'lV!Yw2nzi{g#P -a 'Dd$h Kdw.A>D'0_H8;J"hCchSjO|?B:O pۥ!uxJKLk@)zʂ$Pb0 sPp# MbREP$8oI!XMuk>Fu7̮u?`GpYWNO 8dnMeDi$=$FK^V]Z)֜Bƚ #]Jgirka]i1pFc@uv)\pJKu6Ij`.2Ϥ3 ԅ]d}MͶ}oH7q ~7 x*_˳?U z["EןU7jquJK40tG8_]rV7&KkTp[<*+W4]!߽91y%.O\۞X /vct2"[n!~O"ɩ0S` ֯OOOI}MG׿;[cG|wo]ƣ;Bq:IZ^i;!椗v -Ř5KYWér9mļD7ZRcx 8 ^fM>{>;KO`xtg^ ޼v֬ywZ]9 S! Vб>-YYNҺhQ͂\n]S\lW&7#XC8.x z~Q!/K]i>mYV?n>oz U:tXN+G꒐b: ^ mp*22CvژyĶp'X?QcݴY^2cFޘέ9,'^3] -oX;fk5QG+Du[P6:jy"8wY&"mL#<׼aYA:_}q.|̼񿷓v?|W6Jk3p4[ -NRMb3lVx `wĩ EcKwm&^:Wt>t(Ƚ^Se,~FCl2O%@;M`*wu/|cʮt_j2FfG;S:8z{:iX -$gΝ;tΜRP ~_=׭{YyCPR@3B 7Jݑ1&dDFQ~&xوP%x($o=ڝQ@D4#6+MawGg FQlQИgFP!o2F( ŕtfCԫmq#Ds<&+0=c=PtقT{0 -0 -AuD߮DѴMnEռmqoSm{jeb܉qSЧLD_"Uc%ëf#qsY\979Mn&" MT?Ĵ&C0R4]3&fcIXK5Rm[Z[[RYj'W114ϴQh{===U*VժYukTMY-_16BG;kI_L{J\ YWehmҒ־cgRo1+EM\q ύbLuC]tդ Lejٷ!(#kYáYá/+v6͑Crh;DE l)fdAߍ͏޶};{Ux:4> kR6u^i;d6'4{l6BM7OdN>|3FΘ'V'4 󔷎❤x8qIH $ ocٍX &dYJš.O~n@/C4VJFMq *e8fIijCĖ'[ @+*JZ5:mzs?7{8ޓϔj|}}/ 0{3m~D{7#~?[$=MQdL7u`!@?wz`\ǔ,UnК6 ۓNQajI=^t4X 2 5DH3c ]y!,( #-?@p5THzA~&<+CO0!jHtp( T7d%N-8FA 'IW)dnMt\a:}N.Ohv֎vt6N֦ӇG ]j6AR'f&}j^dy#Ku,ZNʥUrBQ$oJoBNH'G$9/M>ԿFoяrG !4Cj=>Ͼ c I;qh;/@n6˖l`ef ٠-hՉ!} E;6ISG/ooZ#yg8(;OpQ X6tXb󩀔e=c8z#a20Ճ-T6v͔3,k;>Rw]G -qyeY,Ezx/-Uj-['G-Gm$coO^p Ԟ;QҴ{Am %k})B KsЅ;bbu+PI[բoBBfH#o׏>cBPp;qXZحe(f)K-IAϮF-*6ɺ(P J{ab 9aaf|o^\c䁻5A*QM]3_(?BEB4G%(A4i)%FS}kM7nޙXhfu4ƚLւ|x7b6\MRh1o3C/S,6 Ƴe:PTS C_EH@[;ju.P7Ђ_>"uuFK䉢% O8'oXLP%@A-lB ,΀e6e6UûoN/b@ wp%ZIӦa1<#fC?-%I3Su6SXɨ˲uuu:Iݮq[+uK4/Muo[[WWuo[* ̾/GA Onv )~xos_WJOЗ"ůJoe8anJZ;xM7\(y]Z 8R}/[PwPp_jeceߦQߦ0زLt+D.;3܇a,?%o&ûYnzv~K G9 -9$5Aha t /\;aCaan!K_@e҇FKM?-?u: A9kdt\A\V0 -?ڌ/ 5棥hIh\tZThYR8uE YN0.-qf0GMP3 d;Yi9_pn({?Z -endstream -endobj -1055 0 obj -<< -/Length1 17264 -/Filter /FlateDecode -/Length 12303 ->> -stream -x|yxTŶo {s;ݙ:N!d" @a0Oa!ȅ D(AA DD8@NVD]{xzCZV[ko@!db - -|f F٫?ڝz<#1=?$cʯRgA*BxGL;i>?E)O,V)ói Cf_'-\dP~hY:mFj:p4i P_4 -CЊw?h4ݻ_=!oʒ(PQ~[Ha̻<hXh~Ҙw -b~U ޸+tJrC -c갳W`& -[p]w)3b<i.ɇH1v2NQ#z!ZݢhMZxb/62QGWt] -bYK=VT;C37Qh -goG+/_p(VU,ܼ/Eo?MNONHlf9]kEwZoaWg/#ʿ+ -399 -'SF?٠?qЏWЏ&h4u=*gCcF>mF}6zFF0zz}SmFgmFAX?'G8O8⥇=TA{o2Z E&F1WlWW}yU|9ҿ,u})]h0|" /X*vd;یjkGѭi%_YA+;"V0sGs–gqtO賌n#/-aۍvAODY-zVu0vU\+FW35_|j]htW+ -Mr]F`t"La(,2EDŽ6'\bF{Cw-VE{‰|>\G|>,[i~A3=̴G>-_AC+Ϡ 4|EBwF n\F&.怀shpshV]b4?.vO3h:ܘh\N 4j).Q*vw>I=&0o|ۋ38Fcf1QOLYAcitꆑ݌F1 d4f%"3ƨQ',d14:ёLة 1jέ#XdfjdTE3*5 -5pʨ.**3*AR`,.8" uh&/5x!~tкh#70w#?WJOlóΖړF j -ȃ/CoA'`B碗krs>ZIHBk}TfuNj:J \C~)0nBҍLNBo6B+gD׃BI&'PT'8m7~ A<< cc3Fk :Bg&Ɏ8T.MKڶGq }NB8F *qdvh^m&p'@2ͧ0|\P lZkARHs>퉲a(:ZH^M>${(Cj#IGхB0I8$K])Y~rWy[ S&^]RU5M}J}UDD?bV]MѦQ55(Emf=li+=ck Y=>;cЇB'|ەZu3l,ҢsE̴DZ)1jۜRSqQk#bScl;R@ -[FQzBA\h9 Yn@mtk^N@xѴ (E~H\FQ]YYo5F"#]b6 N pc𞓓{!7ן 0 ɠVBx2=Zq4qsf3o91~8Sf`[&l6vM/Rm;[Nu=;/-"_]מbq`oiщn{iF\n-N ""&Ƙ@pnʩ fg?zy'ܺnXs6'dVVf$9V||Bfh)+;3 :Lӂ/f,{O;=qʻg-ƒw !['D~?/,?1p_Oڊ珘^t"GoO3l#7S9h/ŝigͱfoN|&f+2" fRRzj'}dbio\gs8{|& 8j\pXIԘ ˤn栁 4noaǎKղ>q9s9s]RW[vxmI4ksf .91eQޚoxįτ g ɋ{=Tǣ̜_ -'>>udN`rc"NYbZcmIXiFJrZ-tWتd#JIJD=EN#!DIy"%ysN@D\741zps buB([L?@ TGb*!!k3.A!JBqa6dAdM@YY$W'SR5M SX]uEI dvҖsi3b -]܂<ݻ5]W\Nӈ0RYۛ`TIi -0a?Œ V"X5in2ʈ$RMTzk[586g\~br#+K'8>/e%fvS`|zKBH{:[ۦl^_sj1k-&F0a x"k~ +Zj.&7Es;qߏYԴB@EnDܔަ `ӗ~ wU9GNU_8V6T*UɃ"bnOt;ѵ\ S}BRh"H)rKQSy(<'yR<`4& h@&;N;NiS٩۩C>}>enOGQzT8*GQ}N& eGamMcH,ZlWI/fu28s5JK7l,-͛?x=dHvA;ΰp*8=Vؓx3^Q3xV -R\'J')̋Mz T*fz3\WL { 9TWV56=k"$©3+Ib^!J,*k,~1nbItșY(;՟dfn% /&̢c]0Ԥϰ~TQ禚ceWlkxlQFAD tJ)4fwde\Tx}h0wMc@/|٪-fPMM?2wmDSeMlݶtǦg,GߋX\ON=۝Tᩪ.\x8&7E|C0Ԉ(5#+ELAEnĔv&ύ抮- ",'\fǞN:R"F3^b;pQ.r\2b9*RZ6+3V5nFN7Vc%ͧ!U+ rbi%7ZFv[ؗ,99hI/qGְM3]3)&x V B퀺89:R (TVXnoH9`g, OŚ%܁"DP@(qwRk}ÍK3~[إU[Znx7]ffg& onsDKa6-P/LJW|IEeAsk)7[ /bA0mOUͭ6í7T=,@2bl|_y3Le>'SL ,.n!ز{pXl/cO-~UHbB{]hЁ'k :Z_H`X[A?{U*(,W9x{ |wS_ɅhTXzD7&*cpi#;}c'Ļv]|V -Da) TK)"0ؐ p&ڪR(xx7w.^_ 5J^ïI&L:C۵ln6M (Fh/_,$oXxaQ"037*C*zP!lDij14: pn ?<$n\ %1|8-mp<[m):0y/=}n^9ĸv; a˹ <(p*U]mTmՇE(DD&wCn[/ B|EPx"hikl{<W]j ՛_fon|ó4}NJvgy,P -9 V\ { , -Zn@iRj8'wG v8~#î8G5_͈ ' _پ= <\վn>|| J,*uPYBfL iےj2< 7=jYCx3Exb5;1maŀq0: #JMuJw4PAhO '['GK8)iRC3BYB= uI tN-cԖ퍼>5-Z0( - 06Ve+20Z\ @D˿+{~6 {3bJ-klgeǏV-AnQIi.\6`jXABc{r(SW\Wn尾JKt".$ -eYU"7P f:`@%9TC8N/PDUjE& 46F75rLw uj]# :hO \>F\} K/|pig q-Ŧ/>rjU~<@Lz;ڭ般z-`]V:zYVXݪ>:BF94cSU@ \F%HeFe92ji;s.%!ǚcc/=Ycg^U57-l<^~5MJ%'ܷ K~]02~ߑi6wOF^v1 AfjCU,x춦5 -"ֽ 3y'8 春#F>1̚Yp.757k9WouҥkptV-0JlIk7 t QISyx Q7V;*q* 3sM\) 芯'x?TU*Qք aWE&^J ȀȐT^A1,ٞ^F)W6p?Ap܂̽KǕh|4UMRy:N}̷:Ց.~tɡȾg'G?Aɇ_x̂JÎQK6 -AKZ^ OV9 -~e~bmn#{'n푓;c;lv.앮ݹ\6 e&{Re۩Sզ'~J> ->]Wױwgncuk֔Y#ּaH;gd.~~鳋\@O/_)M:O۸|A|/$2b+XNzu^)z|PktX\}| awDJCBue236Hk!OШ8Gc7n=! qEzS>AGy{6Wm2 KoL?BɆӒZ>l${}H|38EP!ZX! ԛ"NJo@.Rt/rkPfk֔䪩}{@ˡC$Sap6Pen2ddEafd=EVZiUIB -ش- -$\x+zkAlƠcME8Òj!~ACm@S],Cr^ْ^6H@MZig0tG.-@`/usY2o*1*!ʒ=WbEޗo?Ҽ' њTy ݛpH!X>~748v/[{SًgFrvȰL;V>W9eTq1Eo^>p䮈/ -LLQJub3ݏ4o6h 0}VJ]lgPC|/oͻr=O#*7`5EE O^Ӈ=x_|ѓwvTtep8W$4{@>LBP1qŢHXO)Tx i K㊎^({;խ ŀ^zpNi -d&ɓ@rHN8INč?NNIu^'Q4"4R#uj>q{/qJCs9C5R - #BH(42NftSOeʟtjɏ01ZVH؝ts>(u)PtRX&I]@n s'u %$SMl:$$G%@ LÿU:^ |U`U$S ArkbuPcq0ۖ:6#}qNgXPi2r#.xi ~Z&i2-!Fdҕ'!V36+؁Ĵs_Z~NԨ:۴7Ȃ Q-f7ś;[ZFU'ds|{Jlǧnl <>g,>~2hж :sȿ&.ER'ᨲP$HrL4?с -'ԑE;+h?e$-TYbLQ8ƞ/ir -nyNyE z0o;4͗fv%.ҋ1:TѝrԆ5T]hRbG1aT\EO-@t V3l~!UԬi@ x =eݻooG̛?Ѳg\rQ?]\>ro ظ"RT7"^Rԯ_,_v7"`V"0 PVjމ8e w48£,H/h߆{~^_#6>͗~x|Q受p3+_r :k1VN/uzyឺ\`]h>ZL4@D4b M;bP>ܳ-8&gypG@s`ACZq*<N,aZ wL{'A/ӵ;c^~3 aIڵ{w̓e> Z@Eʾ֧[t4 'wjwj//׎A;+'$ ; T¾;>6 M=Fq#ܳ`pGh'p?'i'=>i2J9(uSg9y0? W +x9yxSU眛&-Pڴ P&鞦M=ݒ%;m)tR"oTe(::q ysޟ}{9wo9#fQ e\Xм`tUQ3O+qj{a z|}L|E[p߮J5k;@ն@ahٿgc!{E/Ee>;Yvn^LY,BsޅGV T@_GqW0 #?EO2+))A Y \B)~y~m +!/-:nXݦ +ZpvdB9s&LZ>=*E{eǏew2|i a=J$%NNV0f%k& Bd5вmQdkANFi$9wПȉJ*aym1;"P9{ 1g_gA0;y^^~cԁ1lT'$ҍIQ}D -!5*hT܍aB Ff?HB&Z# T,xcoDh.gR`Ky`ȃjn@Ь& ;lۗO Ǘ^=ނr}bfq!iB += _. Lg A$@+p :N +Ňyz ;* .6w +_^%,{ED}>#|vxIx_s򈦈E<nWfCY~IF\HdOϟ1Tf\nqPhS"\d⤚Qk34:r'B$FQJ-zO2gi+}aBW-;S$/7cGe,x.XЗu +].QCX(,+*LIDI#pI醙 9c2XHfH%s]}]m^p(NEtp.wFJ j15Qjظ,"Jkj8щwʎ#'u<܎O:RT3D ed7+ߝ8mVn߾h]CL-2T=P1;Pk.ЏD# Fd_u;D`؂+oY:V#qp*N2K(/U(g峅xVXCNb,x?U 3O]?">E/ >A(f|D"1Q9+.Ui]݇HY*5 f)G~+mʚ56ۚ>!հb8E/u!aĢp2| + +9QL"6](Idgk7L`miWq ޼^a[33T(<hhjH7E#װZ8>h5g8ΟW&EzHsp{[ sdy+Zsl{4z"g4 'Rbl1inc_/sn3 +yOyF,hɾ^JXFs5jW{vEyǦՑn}Iii$f9>N\\'2P]/.`]@š#)/Ӏͤ"4h +w&8>UXUضVhLo#*uwQCxEgكr3먯WSdNަ'6FsxnHň._\к9 gZm7׻]덆ρV x'r1\]?/:2B*"cvlvmi/Lr\.<k>w_#6H%/Rhk;)1yu1l/U195Y0fki֭xJc26P0oc#WXjqaJMNBQvTn;Z|ƿhw6Ky;b 9Dw&ʘ'cZo7[y:#FH8lx8&D% Nj*d)dTztf6ؗfr;ÛlyY"p͝QzeV]Q8 hfG.r5@A(5_;yl?Ya:c*&jv0P!OYcن@͵55xTegU`8=C(~{GN0cI5Ԛ1 oZi9uut`c8am,spţsQ .Mr{bJWAA#U%`7ܳdI$XNa Ɉ&U_9d4z&!& '褃Btzn7(5#J}Td /odqjzte*e+T}IКoyu4YEN5L.㚜8Qł[p]d[m9;V֙6],rۛ^*a9Į`r3r[6Kg74F5mi*6RV+U]Mݙjwit.NeiuCVNNmK +;D!wjHZ,9%@cZqmi +RJҊ|"\#y2RJL+*FCv]YULĵ3y4k Xc6w䦯9%>oWz+Z%;^wTéL̓5E4xuWW?T}_dMT]>("83DB*lRULӃL&K+u2df #Y5fK3>h: 5˹A,M ީ {Q6t>[2Y?~Q_ p[#K +~tX Rޣ5Pmf/蜯 g5ׁ̓As7@j\;}f^pqR^p?(~grS<; a0 kʊnduK; &˳{g%]nM@J0!q$+yS}ⳁ^oX5jwʥJ/Ovo,*h*Mzo2ox:o@B:iU~r1[zx j7nY?+]nv5?#EjL5~:ϕD+;qRW!Nw)%R*L(S793TOkҳ<9INu\!G +4KMKI s:Ue "䩉XOɅO Y K 2۶Z9ui뉯Է怪YDP4Tpod*@4WXBOukt㳼A0Ƴx|n˖#?sŀsN #AOCJ3X&wmZ_Xۦu;sGYo OǑEF/|b{㖣Oōq8`)y8ێq~ݎwl؉^fP xd}J&䞖=~Չn׏tuj/io 7gB EB4] }iз ȀV>4PjCh" +u!rH 0e~cY-Uh>}f*,< bG" endstream endobj 1056 0 obj << +/Length1 47128 +/Filter /FlateDecode +/Length 11769 +>> +stream +x} xEhUw2353IH0<W $0 s1bVA +nD֋.rO$XoΡNwUPBH + 3e㫞$Xҷw_}p?+< B{~0!/oCΌYЭx?|Œ H'dxvmsyF݄affrD|^5xv9 myyOr7%'\y}"﷜g异M}jfwj~i\KT)>$ӼA>ReֆmWFߓ|u$]H2Y$~e+9 1A b 1A b 1A b 1A b 1A b 1A b 1A b 1A b 1A b o*v#S$?<<+D~/A$t%I2 !-d$G;.R[xAҊ#|(n>/&/ k~WË+(itUpՑGj۠&CPjR aZ khvݴUn{`M#Ra5.0Qy/N|`z]%]]{[D3 @čeKBqڒ]:a٢N^ e,D,Sͧ)ďe2JhY7DL0KYzĩ׼@8tRYϝ杼j60:;OjV7J u `:YT7Blf)Pw<֞_OUs^,3bf 5KiX !b[^'b[p/~ 8'48+'ƀo ր77j ޜpZK>pJgpD~r"|'֧ᓏZ8 y?R }.V~,Xϵ>~>jGȟWm[bN290f-[emaf-̨0MTSL`s`(h Q&77ˋWBu"/3`Bc~ѣhnT20n0# ,`X䁡7Z!7Zan>  A^8z`@W }xx_/@Z( pz]jZ0Dz:yD@8xO'=ytCU@%rx^r;{xnW:v)rl:Et; +@vmvmBz"d h7L Ӡe:2M4HwC b-j!PD z `@ZyjR<)g<$!?'-?|:o<! qxN;_qH{-rSH1`D]&"@WpxDQj&b@rs&{9uM'޻m!Rډ䯄d#f@bfC ?Eld O"-lGc05q9Md4gjێh2r/yk!Y9;f[msTWyqVj+@=d !E@+Ֆ#~nd4î[]֑-֋޶glg +ϱqYsMstŝc01a c01a c01a c01a c01 }^[=AZG$q͖M U4bu+.`N\~~G⪫ɦ 9KHe^O(տ_f-ZT)~} zD'EWf`&bUױ95Mvf!_,!ЬUZpy$}E'uѽKv{=C)(u +CelN8)[O˧wckd++8hG!}:Yw/gz~ƿ +d?M;t'gF%+I x U޵UgKP}qDI:}u62[nSNuPOY`һ~XI3h3g77DD̠l:.3&+HAZE]a ٮkjDNț眯9fN8ww&6t&vF?+~ž7%"Y$UJ%ry"q,sZ*9ġ4~קFDa5#q/woaq9s'[\-h$%N ؂HhKrr{OBDg!)nYTG.B,wPͺMgh2םS]?kӮ;>xg@×Ya+2(҆x*52|JU|uZuU/!./僀'Ӳ\ujQ8}tJXxu6?|^jIQKRs/ {{BT=uI7=iG~|:M!y`g_4+ S..>uM +_ScP:0"AaVvNaNmIR5A>`M)ǺנyG|( ;]* F-Zux~~)l**Q\|GbI]TeqtTYvsd}U 4g+)lU|%&N#5!Wr1R[ۑM'?ϿD6<|8.?81v灊i'KgJ[.@v6n됪^kF~ NF`vm^۱89q>@YLS$p?X#;+X\NBDgʏ7o(-X-3 /yiPJXf}G~㋊}BOI7*іYEԪ4R-z cF?j3+*fUTfm|7UnjʲϾeЛG9H~*́O2JBB]r +-I Eݔщl2.Q=좪-Hn&yȠMDuh~wQg4ZhK=SʒRTAyP'-mb`gۻF ك"m%;*L!UH' "R$-Ȱ5ǂW"!**7R5\,U + +(6]S5 W% +Bv4i::g35RtpԨ$RW 2\qZz_j0RoQ'ORls|zRks}je%__^%o7ػ״ɇC &ҧ~8ewYXX>L]?^ۆP7{ћ>ӈɐH8ܧD)Q%K9d4B9&[hTR:_I W-PhaΤ.J2F;ͩS_߂Sa]BJa(?Xc-1~|oA[n$K'>cZXF6I.qF]%3ZFUorj >fW CbE+~5uӆvn%nxBAF䩚o4x~} Ә =͔09h\!~tc!('!!-/|W#]IN)-rF쨻S}CӋ甈 O=-Q2XJHa%_%~rIf&eQM^Y?M_6_<m|`=-VĈ5# (}#|UJ]lGkajt@G?%ՌP͆OuٺC7 h #x &I R'[lpRnWOfId9֋ Ԇ|6N+b|VnGCKgBsh?ϤwH.?B=βAsUrX> Ynr]+#,RKlONg,,2MN CDCfXP;*FGz^5(G帨]Lf|,ՙSs5ڰ 2na#-#ɬRf`˴eӬRm$)TGraJspm>1Nm^W{PLKD/y'tߢVm'NDR-y/T?qZXGł6ou~\N1j0Pկ^Cp:RbD'E=gI߰N8f6RʦX੔Iv3/LBbRgU^4H<ٶ[=nbPa=QdBdR9t|J(]h{Y%MwQk}b܌7zbzr$'9S} LIH>#BvےJ;{K5#$ wTu$eq͓*|LLzHNL'%%''y|}ý}CJ%4%gM>s#eM2odpyt #:zT:B%~GKˇF,G={&y*ҚO۰/}]񾞸ݭlujfXwx,\DH#ݡ Fh˥/3"TIF_jY ]Cʭy0tW, ,laÍ*]fbbB쒇0]i\o/{_a08swq6] w=y'#1bX6F5bg:]VcWI$[&kJ+)#cGólKwt>J?[`(6 +nVnCա(fk26&+-%d}1:Vf s۬[ n6\tz[q:Fg@](ו@ZvXC j)ӓRiDLRE}Eo]iҨqƅQ,†">2(I!vl̐l6nˌ5S!V!T7U gSo(W qb>#TPUֺJ+su;x8nʺCU6vn[\渣a$DOg٠==B=3^* fۺ3xg<á'O >z%Jț.-)mH`BZQ޴EivU\ҋ]Zݡ\4V+6s[GX\uq~7͛g3vvzaЀu][J ohߞSR}4\IV7؎:*MG+.hI.3d圏R]7Ľي LL/z5 ͛={vUHŮb -z[^iv||xQ#X8~#2EYqDclH@%Yzىەkg]?"Y+zr$kwՅ +zj"ÞE/ana3JiNsO<\NGq"ՏK@csEyu7*! < +HR/k7+-N?]:}WffcS)͙En QqDD#svn5oe#~8a Oa;{57WHxB1F?J\wȶ*%40[If'sgJ,g$]Ŵ QFJUGst mA5C,[4.֩;+5i.MqxmyŠR]<'7FR\ڴ *]G69ԝN'7ҽt~`t{:uV F""!Ւh4Mwu%oNsğĚ;z֥`p[E ~9Sw(PHF]\*~Ⱦ3}C'(d؈{ݲny |ǻj/ g$P%|.+gl1H={?y\"t-]_ @F=OG~ Eȕ&&ɾ3!d/|odsmF݅&S"Y8]jItMCi;St)q[$r9XE?c"fi]O_j—X$OgcXK567 EH3i1_HDqw&\jf E&ښ y,J?b{0BZ] +Q +6E6a_t?ԨIPscs;tB`Q!}PDsIF?(4=9ѫ(j:vxpV Z>Sv,.ǝx7|maK qբ\1ptl1cʺ+盒yH[rkefp1;UuЭVծ;yz-ɞHt`Mftvulsms{=cum=P3k\.,͖?16BǕNXܓDmw }1g3z~|݄O0:)M{өsZ?J|MFynOb0#6Nm14t4WcFj,̬af /g kwNO:Ğg8]N6xXD'*g'7N1W&n։*fnޱwO@?FOb7Hz"Rd'c"Am'|2RΘNf/4 nޥXUh]&gTfYo4%r?ң?+N]??X 2Wtr57El[k(G<`m!@AZ64lC1b+Et1+JV++u+@_#zN}\ԋaLoڏݏ,#:οq#Feh Qȿ7|̃+8R]M1| ڒYjkup\ڙu]ծ.5,Wg Õh}um)yZd)&E +Vj\c[Q=}ևlKjۖ9a4ź͆Q_^I!8>R>g_Y6o!P?:f+ cb+{<\( +Xh^g"}T+꩚N@jJMEYɓ"|:NIXG) +=eX+-jkM \^asAATl,EI⍀Z(hȶ@(GRmY(5J)I:v|ξWQ>7~&?]/Lѷt:7t>{~,]좃OœC9i^:g*qsrb+47ga0': ;]NUפGB/jZ3yg:(Otq0Xj6_vXraztZ9cN+Q:pfᚏzWZZjKk Oͳ;Io:(you+QcŎJ\\vle`i^حTƫ֗/9fuaz|xtk!Td}#oJ@؅y/[ׁB>u<I Hx6pMQ tթ{?s+~F +F)2fDzܢk.\p5|u6;IyxEC%P/FBP_ *EkH-+ rO ēdsd%z*ST{w }X+`ÇH"ĔgnZB;pUi0Z oȝ]:.(HKkJK?q楹Q JfV% -#̋A-#Pڠed,b'v+t^&tۑxIS&ec;w-\jL%'%G5j +4⸼L4XuҖrb3k܅1H͉fV)_#u5iݠ+&Lb/\泷S{kYϻ/HAZZdxg|m+I.$<޲wa M +oh%B{kԅ;SCru+TW+b`jjL31WG/kw!g(E$$m\JUޡgWS'bCz*y֦KNWJib7LK9`! 4޼ćwkF4ڧHnV]sHg6^$G#e#2L&s̯O@IFWE6sl^f#Ee~< ^z>ܤj6Ufu"]xvފ A-e@`4WO/[j{Kgv y(qT,[(ʵ-IG,;!RTROb"u, L + 6yUa +3hqL/3$JJfDڣTS|3>-EY35lc%d/67T4lnM^W>۰aٿC1=Si޸apyUSYUC8+Vb, GD%ʣOj qyMqA̫s y`_䗸beF,El9U4]sËDɳ 7ɡ(!_RӞ޹\6?o^4k]4E[v ne%}ӷtG"HtcL/W觔+`Cnt\r^r]x#D~pnD1)h^#yHAD RtEM(DF!KB:n@tb|}ߌF?G_9ıG!zqc/}TK(U<,+5c&Y6~VlBXN.YɲI%ex=iV4lrLl3d> +stream +x|yxTŶo {s;ݝN$B&4<a<*C &P"ǃA<!=9\q@#z= +݉N]VZހ0B;̔=/ ӫw~ ;:dx.FAc 8h_Cf4nh:oB|qS,j "DҦ/1o,s ̘h!aCm1wi&Ews ˞ ' ~ p9'̂]0urvlDüO.?_õM s-\;03G-r(#@HD\VdBϞ?Q]~"!-bhd<'cYބ=Fzkg&.HYPQC8WL +~%UBxN](-̎tRwrꄳDA@⅒ -p8h +ޏ7A)rMM([ +/ +ʊYTxW%qJk}*D+ edš{Rl +ү=ch?i=t\F2؎ke?:Q5uóQZ-uA~"ET< +{&M$Fh"Z~1 &߹s߷5MYJ0kG|*}w7}X g\[wB!ROG}>.^N0`halv^prx!Ty N޽k|}M;ufӖZ(I7t"Z +B+ѧtk-atjVb)kp'?/W0te&'}ŏf#1}쨰FG}х.?\\PAK\Fdٌʠ3otF1Z)q*SE⡓DF'ыLt|. v:FOA t#}8->AG0:a>etftN1:0Dsshmb?%eh]C̷u =b~L{Dp1 :1@_$`;h$څ\pn!v@sNٌf "Nh&2̀3M4-B-E;ŎiJ01NS*v8B>1|="g4DF/zvfh,1Mil +@=0hF@QF¬DinF]:g waj0/NmQ+pnͧb&h6SsPv&* dgTdw@0訁VgTNTFuTPQ s8t)Y(E~5?ux83%d֭E#}uÇ ` +Uz@-pmמ,ߠ-t0gPRxC^| z[(p :e<_ +G2 z~_CF6sVT-*CpM1p =Րd:wzۊU \9C& M.86?:.\n[8 FehGB ltFl\GtDm8 aAW)Wh{ ` vm_K>rH+V4~YpȢG}ulG>cj+?l{jr9u?u"/>z<O墑TONtR\95=)َ͛賮dIIuj1j|sr]|3ܪqygfp$SvfFSc.>.'b/Y͙;p𬒺5E;f*Y[ !4hNI]qJJ5%u8o9͝=`ZVzGL;'}5d\3{0\HIYs:eR8X-fvh4t AfdvsN¢lN7P2+mq^_V%Q%5(BNוi +aJ-mΖϛ w"⺡ ԃK+7}O37 Fbm^::cP\[ qU  $ &k:!:1io&L!msپEl_.ζ⡋PұSY ^8x +i7g ++ӿp4@ke :a+ +>EGVYkQ50 kG#^]/dKpUX<_tRv 8ۉW΀r4=z( 6m>pB#tD>Q Pt0Q(M'*u|?x<kk:hbJ}v9(!^_Z~CioɵCs:H)v}p6iI=Şk +f&x9%R ZUxCa^0 m3$V1˗ib]kxixFX<r@0Q!{%厠H$J{* g`G&^2&љ1:#geV m$X| +6}wጓ?EjjjN=VY!3cz7Z&>@oXC-2VJ1*+*+= b@fěA5rrHK7f MM7f|4c;Sv߿e׌.`qIe^:W_-TBY~#P +"ȓ 8@iR7.^Fǁ$a`o)9dM#oy}Hdfs ? 2QT&2{h1<81{c`ҚYhUu%_+k1L],굛cWn?o\Y+W؝,-^lI19QUe붌X+x8}Sէ''亿8*8j$T7԰R'UFUU$ctCOͭ6í7T=,@2cm|XiLee>'RL ,.m&ز{hVֱVA*$j1YHv=NIR4m $,-G>=*P4c+i; +IvB^X"<zD7&*cDpi#%ۗ/}e;w|V +$a  TK)"2ؐ p&ڪR(xy7/_s?5J^ïI[s5aYuBѷkل]l›;PrVÃ2"SY4H>w +w~tHmF1RzCeXE׉KfKc?<`C5>ZtZBs~ +=G鑺jS&y +{'hlNY7lt{z+72DT3D(-l*ӓE8ɠD:u{ v{YF)ɀd;0v4ؽɆY@º5m8O545h 4X,b{Cx%n`gUh"Tf8Jlas9sV3ߪa/;5m.ؖ=77-oYOngomV>mvA^zydovGۅ?ex '/f~UZDA"DQ@>Gk5J"iY AF4,Vh6WUS)*2rDA'K(xL0x2 "o1"n%lݻGXܨRUJ1V;&L!"2yŌtҼ|ц+5S!L[+>]fŏ?~쪕Y|_W2~cTe]G ?R7ֽ`?ScRܨ?:^I[*u*",ÀҥNpwEA웝#9]fqsP'N/}{\}3ygd_X!U֢J:fe%dx]_FՒiZ;OAH܋j]q_<'T~8jz.q4*U,eBmJ&r>2lhy T3ĉ#<8xp%^'.+̠~ L)wqD$ qRI.:.ӂr\e+PI ;Kǯk$[>V29ْ˥x +z^kysGF9:B;GF`vg'qn8e'AW+QSZ~)>tPφJw-G'4Kf4.:1A&a2J)eD"oJ;Hr҅}>X:J, +Q>);̀p,5nigߠtIh)JPǍlHl +|#%wPʔ#2HaMUIRU KU m0T0&iKUۉsbu*.]nOlK:YMFy!}#!V%͇*v_o%hحOC@[aQz02}&*V wEO҉ &8KnO(RDfˋRYuI@TI AT(1 !C +RxCg{z^{ d%nw]:DbhLlʓ1dw'< &):>E,U6@#RHG #űXy2JWo4, KtA1aaSܞ4>6 |.JO\5dP@z~hE (#=X Iz`{C\ \އ!,K)ܟClKLI/?IOMY1+vx!NJV|,B4XS )ҧYn}ْJV,NqF;ϫΫ,* +XFB7у:m"rɂs>e^lMS-S 3gdZMRLD@KIotxXd/-P~;"{㣶%q#֑i-~S#/ (8՛6VO/%}%; zcT8{;:22F\fպ24HtYz[ˈ]ۤJ^:77e@C>kn(NIMUj\Mjjg]ar9Y2x#_ҹ[^v}o/xͦ GN?\Xz{B,|dᴅزrWķw>fIva26qNNan(pt̬+sT#eh,##CV+cb%!O=XzOYۦjcQUǺ:хϚ~<9BĨ'(z| y7JGJG-}4Zt<TZZxQ~ ϰ moW3iKda@{vg.w I\Dd(3˔*S=FD }6}_.>ʅPQݯ阺UEW;=m+3]t,yG؁8gtM]hzz jn^2#~]Vo$ʢ P(%D[Cc.+\-ׯiA'|H>VA% +_yYDz_ꄍkWﱐ c7&/a/N|ev>`AnaH͂ J6tL%a2҉Ѭ%7tD7 }$kCh,W4kw֙Iǔ,PvEIݵo>v2V֑3|̧ DEvs|8X]FوBdҙ(¼Zoџ:Ԗaf jIܚy"~dei]]E{Զ'doyi\ja^0QG[Eu:&ZcI &Js[e( LG<[yxcIrO)ztqHgZZji0mǔ6Bt,H&|RYm: >*dʾKN*]v_ri6w5vEqqp )C,:%NDp &m,KR/nhW'eIDQ‰Kt)Yd1y\(n.-E.%&IrWŗpş13<Y?e3EGJPK#-2A` (נF g1 s@@pvr]{NO&IirKSyykv!OШs8`n=)qGzS>NEyû6Wk2 O<]7ߞ^* ⅒-$|(QF2pֱaBX6Ro<>>\zn_5xy0'Vĵz"5h߯ɏ ⣂qUf|֪` +bHd'KIAyO +npH4DkR径tw!ۦ|ٸ7[3t g/K=бC7El_p||}Viŋ{*"+02 +DȊ)PJt/hޭA 1zV2d&,>sL  XyKlH&!|)LoWU~2) +.6hpn§>x0Gƻ狞,s|.y$$i7 sc>a0D.~F0oxH GH[X_tGأ?'AܮnM-lփTu*LU K4INp`ryWr%'qr"hMR:Abp4Q[ECJI^j/+ $[̕rLOWoFGYt0K,T{TbV݄'?b&d!vSd8S]FV% +a'u20e~~Zvk -tj2e+Ձ I=z0,d~`$ -ԩ*V櫲fj"qh+ YЎ<ϒKdI@P1HUuDUp"L` p]cp[nI-߶YK\l~s:JԆN qY6{Nb4Nɘo 3"L>n5 ZFѴ)~a<~'{ҺrF5X٦A,[bUlnۘ`J0w6> endobj -1057 0 obj +1059 0 obj << /Type /Font /Subtype /CIDFontType2 -/BaseFont /IBRUDV+DejaVuSans +/BaseFont /EREYAA+DejaVuSans /CIDSystemInfo << /Registry (Adobe) /Ordering (Identity) /Supplement 0 >> /W [ 3 [ 317 ] 16 [ 360 317 ] 20 [ 636 636 ] 25 [ 636 ] 36 [ 684 686 698 ] 42 [ 774 ] 44 [ 294 ] 53 [ 694 634 ] 68 [ 612 ] 70 [ 549 634 615 352 ] 75 [ 633 277 ] 78 [ 579 277 974 633 611 ] 85 [ 411 520 392 633 591 ] ] -/FontDescriptor 1056 0 R +/FontDescriptor 1058 0 R >> endobj -1058 0 obj +1060 0 obj << /Length 744 >> @@ -13197,20 +13223,20 @@ end end endstream endobj -1059 0 obj +1061 0 obj << /Type /Font /Subtype /Type0 -/BaseFont /IBRUDV+DejaVuSans +/BaseFont /EREYAA+DejaVuSans /Encoding /Identity-H -/DescendantFonts [ 1057 0 R ] -/ToUnicode 1058 0 R +/DescendantFonts [ 1059 0 R ] +/ToUnicode 1060 0 R >> endobj -1060 0 obj +1062 0 obj << /Type /FontDescriptor -/FontName /RQONIJ+Poppins +/FontName /CHSCVX+Poppins /FontFamily (Poppins) /Flags 4 /FontBBox [ -27 -132 753 704 ] @@ -13220,24 +13246,24 @@ endobj /CapHeight 704 /StemV 80 /StemH 80 -/FontFile2 1053 0 R +/FontFile2 1055 0 R >> endobj -1061 0 obj +1063 0 obj << /Type /Font /Subtype /CIDFontType2 -/BaseFont /RQONIJ+Poppins +/BaseFont /CHSCVX+Poppins /CIDSystemInfo << /Registry (Adobe) /Ordering (Identity) /Supplement 0 >> /W [ 3 [ 266 ] 5 [ 291 ] 7 [ 621 ] 10 [ 158 453 453 485 ] 15 [ 197 550 209 475 627 319 574 588 628 627 634 545 630 629 212 ] 32 [ 722 ] 36 [ 673 612 771 706 512 503 777 691 245 ] 46 [ 598 431 860 702 785 578 787 607 586 540 674 675 975 ] 60 [ 583 540 422 ] 64 [ 422 ] 66 [ 732 256 675 675 606 675 619 328 675 639 245 247 514 245 1029 639 639 675 675 372 521 363 639 560 819 478 562 454 ] 95 [ 290 ] 204 [ 218 ] ] -/FontDescriptor 1060 0 R +/FontDescriptor 1062 0 R >> endobj -1062 0 obj +1064 0 obj << /Length 1430 >> @@ -13285,26 +13311,26 @@ endcodespacerange <0047> <0064> <0035> <0052> <0015> <0032> -<001b> <0038> -<001c> <0039> -<0013> <0030> +<0016> <0033> <002e> <004b> <0045> <0062> <005a> <0077> +<001b> <0038> <0052> <006f> <0030> <004d> <0031> <004e> <004a> <0067> <0029> <0046> -<0033> <0050> -<0016> <0033> -<001a> <0037> <0017> <0034> +<0033> <0050> +<001a> <0037> +<0018> <0035> +<0013> <0030> <0028> <0045> <005d> <007a> <002f> <004c> <003a> <0057> -<0018> <0035> +<001c> <0039> <005c> <0079> <005b> <0078> <0027> <0044> @@ -13342,20 +13368,20 @@ end end endstream endobj -1063 0 obj +1065 0 obj << /Type /Font /Subtype /Type0 -/BaseFont /RQONIJ+Poppins +/BaseFont /CHSCVX+Poppins /Encoding /Identity-H -/DescendantFonts [ 1061 0 R ] -/ToUnicode 1062 0 R +/DescendantFonts [ 1063 0 R ] +/ToUnicode 1064 0 R >> endobj -1064 0 obj +1066 0 obj << /Type /FontDescriptor -/FontName /COQUPR+DejaVuSans +/FontName /QVTIIS+DejaVuSans /FontFamily (DejaVu Sans) /Flags 4 /FontBBox [ -9 -92 733 729 ] @@ -13365,24 +13391,24 @@ endobj /CapHeight 729 /StemV 80 /StemH 80 -/FontFile2 1054 0 R +/FontFile2 1056 0 R >> endobj -1065 0 obj +1067 0 obj << /Type /Font /Subtype /CIDFontType2 -/BaseFont /COQUPR+DejaVuSans +/BaseFont /QVTIIS+DejaVuSans /CIDSystemInfo << /Registry (Adobe) /Ordering (Identity) /Supplement 0 >> /W [ 3 [ 348 ] 11 [ 457 457 ] 16 [ 415 379 365 695 695 695 695 695 695 695 695 695 695 399 ] 36 [ 773 762 733 830 683 ] 44 [ 372 ] 46 [ 774 637 995 836 ] 51 [ 732 ] 53 [ 770 720 682 ] 57 [ 773 1103 ] 60 [ 724 ] 66 [ 500 ] 68 [ 674 715 592 715 678 435 715 711 342 ] 78 [ 665 342 1041 711 687 715 715 493 595 478 711 651 923 645 651 582 ] 5038 [ 741 ] ] -/FontDescriptor 1064 0 R +/FontDescriptor 1066 0 R >> endobj -1066 0 obj +1068 0 obj << /Length 1182 >> @@ -13402,9 +13428,9 @@ begincmap endcodespacerange 61 beginbfchar <0014> <0031> -<0013> <0030> -<0015> <0032> <0016> <0033> +<0017> <0034> +<0018> <0035> <0011> <002e> <0003> <0020> <0028> <0045> @@ -13429,13 +13455,12 @@ endcodespacerange <004f> <006c> <0050> <006d> <0019> <0036> -<0017> <0034> <000b> <0028> <000c> <0029> +<0015> <0032> <005a> <0077> <001d> <003a> <004a> <0067> -<0018> <0035> <001a> <0037> <001b> <0038> <001c> <0039> @@ -13444,6 +13469,7 @@ endcodespacerange <004e> <006b> <0049> <0066> <0030> <004d> +<0013> <0030> <0010> <002d> <002e> <004b> <0045> <0062> @@ -13469,20 +13495,20 @@ end end endstream endobj -1067 0 obj +1069 0 obj << /Type /Font /Subtype /Type0 -/BaseFont /COQUPR+DejaVuSans +/BaseFont /QVTIIS+DejaVuSans /Encoding /Identity-H -/DescendantFonts [ 1065 0 R ] -/ToUnicode 1066 0 R +/DescendantFonts [ 1067 0 R ] +/ToUnicode 1068 0 R >> endobj -1068 0 obj +1070 0 obj << /Type /FontDescriptor -/FontName /HSGBYZ+DejaVuSansMono +/FontName /YKWSLN+DejaVuSansMono /FontFamily (DejaVu Sans Mono) /Flags 4 /FontBBox [ 0 -155 598 728 ] @@ -13492,24 +13518,24 @@ endobj /CapHeight 728 /StemV 80 /StemH 80 -/FontFile2 1055 0 R +/FontFile2 1057 0 R >> endobj -1069 0 obj +1071 0 obj << /Type /Font /Subtype /CIDFontType2 -/BaseFont /HSGBYZ+DejaVuSansMono +/BaseFont /YKWSLN+DejaVuSansMono /CIDSystemInfo << /Registry (Adobe) /Ordering (Identity) /Supplement 0 >> /W [ 3 [ 602 602 602 602 602 602 602 602 602 602 602 ] 15 [ 602 602 601 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 601 602 602 602 602 602 602 602 602 ] 46 [ 602 602 602 601 602 602 602 602 602 602 602 602 602 602 602 ] 62 [ 602 602 602 ] 66 [ 601 ] 68 [ 601 601 601 601 601 602 602 602 601 602 601 601 601 602 601 601 602 601 601 601 601 602 601 602 602 602 602 602 602 ] ] -/FontDescriptor 1068 0 R +/FontDescriptor 1070 0 R >> endobj -1070 0 obj +1072 0 obj << /Length 1570 >> @@ -13624,1105 +13650,1107 @@ end end endstream endobj -1071 0 obj +1073 0 obj << /Type /Font /Subtype /Type0 -/BaseFont /HSGBYZ+DejaVuSansMono +/BaseFont /YKWSLN+DejaVuSansMono /Encoding /Identity-H -/DescendantFonts [ 1069 0 R ] -/ToUnicode 1070 0 R +/DescendantFonts [ 1071 0 R ] +/ToUnicode 1072 0 R >> endobj -1072 0 obj +1074 0 obj << -/IBRUDV 1059 0 R -/RQONIJ 1063 0 R -/COQUPR 1067 0 R -/HSGBYZ 1071 0 R +/EREYAA 1061 0 R +/CHSCVX 1065 0 R +/QVTIIS 1069 0 R +/YKWSLN 1073 0 R >> endobj xref -0 1073 +0 1075 0000000000 65535 f 0000000015 00000 n -0000001097 00000 n -0000001231 00000 n -0000040568 00000 n -0000040702 00000 n -0000043394 00000 n -0000043593 00000 n -0000047599 00000 n -0000048089 00000 n -0000048290 00000 n -0000048493 00000 n -0000048628 00000 n -0000048764 00000 n -0000048922 00000 n -0000049081 00000 n -0000049314 00000 n -0000049548 00000 n -0000049763 00000 n -0000049979 00000 n -0000050220 00000 n -0000050462 00000 n -0000050685 00000 n -0000050909 00000 n -0000051141 00000 n -0000051374 00000 n -0000051588 00000 n -0000051803 00000 n -0000052030 00000 n -0000052258 00000 n -0000052467 00000 n -0000052677 00000 n -0000052906 00000 n -0000053136 00000 n -0000053347 00000 n -0000053559 00000 n -0000053774 00000 n -0000053990 00000 n -0000054187 00000 n -0000054385 00000 n -0000054604 00000 n -0000054824 00000 n -0000055025 00000 n -0000055227 00000 n -0000055455 00000 n -0000055684 00000 n -0000055894 00000 n -0000056105 00000 n -0000056320 00000 n -0000056536 00000 n -0000060832 00000 n -0000061428 00000 n -0000061659 00000 n -0000061891 00000 n -0000062094 00000 n -0000062298 00000 n -0000062517 00000 n -0000062737 00000 n -0000062938 00000 n -0000063140 00000 n -0000063277 00000 n -0000063415 00000 n -0000063609 00000 n -0000063804 00000 n -0000063994 00000 n -0000064185 00000 n -0000064376 00000 n -0000064568 00000 n -0000064760 00000 n -0000064953 00000 n -0000065192 00000 n -0000065432 00000 n -0000065647 00000 n -0000065863 00000 n -0000066071 00000 n -0000066280 00000 n -0000066476 00000 n -0000066673 00000 n -0000066869 00000 n -0000067066 00000 n -0000067265 00000 n -0000067465 00000 n -0000067665 00000 n -0000067866 00000 n -0000068064 00000 n -0000068263 00000 n -0000068497 00000 n -0000068732 00000 n -0000068931 00000 n -0000069131 00000 n -0000069334 00000 n -0000069538 00000 n -0000069740 00000 n -0000069943 00000 n -0000070143 00000 n -0000070344 00000 n -0000070540 00000 n -0000070737 00000 n -0000070926 00000 n -0000071116 00000 n -0000071307 00000 n -0000071500 00000 n -0000071690 00000 n -0000071881 00000 n -0000072066 00000 n -0000072252 00000 n -0000076372 00000 n -0000076971 00000 n -0000077183 00000 n -0000077396 00000 n -0000077611 00000 n -0000077827 00000 n -0000078041 00000 n -0000078256 00000 n -0000078458 00000 n -0000078661 00000 n -0000078863 00000 n -0000079066 00000 n -0000079277 00000 n -0000079489 00000 n -0000079710 00000 n -0000079932 00000 n -0000080161 00000 n -0000080391 00000 n -0000080592 00000 n -0000080794 00000 n -0000080992 00000 n -0000081191 00000 n -0000081404 00000 n -0000081618 00000 n -0000081817 00000 n -0000082017 00000 n -0000082228 00000 n -0000082440 00000 n -0000082586 00000 n -0000082733 00000 n -0000082947 00000 n -0000083162 00000 n -0000083354 00000 n -0000083547 00000 n -0000083758 00000 n -0000083970 00000 n -0000084189 00000 n -0000084409 00000 n -0000084608 00000 n -0000084808 00000 n -0000085016 00000 n -0000085225 00000 n -0000085422 00000 n -0000085620 00000 n -0000085757 00000 n -0000085895 00000 n -0000086087 00000 n -0000086280 00000 n -0000086479 00000 n -0000086679 00000 n -0000091203 00000 n -0000091802 00000 n -0000091959 00000 n -0000092117 00000 n -0000092330 00000 n -0000092544 00000 n -0000092740 00000 n -0000092937 00000 n -0000093129 00000 n -0000093322 00000 n -0000093545 00000 n -0000093769 00000 n -0000093970 00000 n -0000094172 00000 n -0000094369 00000 n -0000094567 00000 n -0000094764 00000 n -0000094962 00000 n -0000095122 00000 n -0000095283 00000 n -0000095480 00000 n +0000001104 00000 n +0000001238 00000 n +0000040577 00000 n +0000040711 00000 n +0000043403 00000 n +0000043602 00000 n +0000047323 00000 n +0000047729 00000 n +0000047930 00000 n +0000048133 00000 n +0000048268 00000 n +0000048404 00000 n +0000048562 00000 n +0000048721 00000 n +0000048954 00000 n +0000049188 00000 n +0000049403 00000 n +0000049619 00000 n +0000049860 00000 n +0000050102 00000 n +0000050325 00000 n +0000050549 00000 n +0000050781 00000 n +0000051014 00000 n +0000051228 00000 n +0000051443 00000 n +0000051670 00000 n +0000051898 00000 n +0000052107 00000 n +0000052317 00000 n +0000052546 00000 n +0000052776 00000 n +0000052987 00000 n +0000053199 00000 n +0000053414 00000 n +0000053629 00000 n +0000057395 00000 n +0000057860 00000 n +0000058057 00000 n +0000058255 00000 n +0000058474 00000 n +0000058694 00000 n +0000058895 00000 n +0000059097 00000 n +0000059325 00000 n +0000059554 00000 n +0000059764 00000 n +0000059975 00000 n +0000060190 00000 n +0000060406 00000 n +0000060637 00000 n +0000060869 00000 n +0000061072 00000 n +0000061276 00000 n +0000061495 00000 n +0000061715 00000 n +0000061916 00000 n +0000062118 00000 n +0000062255 00000 n +0000062393 00000 n +0000062587 00000 n +0000062782 00000 n +0000062972 00000 n +0000063163 00000 n +0000063354 00000 n +0000063546 00000 n +0000063738 00000 n +0000063931 00000 n +0000064170 00000 n +0000064410 00000 n +0000064625 00000 n +0000064841 00000 n +0000065048 00000 n +0000065255 00000 n +0000068823 00000 n +0000069301 00000 n +0000069497 00000 n +0000069694 00000 n +0000069890 00000 n +0000070087 00000 n +0000070286 00000 n +0000070486 00000 n +0000070686 00000 n +0000070887 00000 n +0000071085 00000 n +0000071284 00000 n +0000071518 00000 n +0000071753 00000 n +0000071952 00000 n +0000072152 00000 n +0000072355 00000 n +0000072559 00000 n +0000072761 00000 n +0000072964 00000 n +0000073164 00000 n +0000073365 00000 n +0000073561 00000 n +0000073758 00000 n +0000073947 00000 n +0000074138 00000 n +0000074330 00000 n +0000074523 00000 n +0000074713 00000 n +0000074904 00000 n +0000075090 00000 n +0000075277 00000 n +0000075489 00000 n +0000075702 00000 n +0000075917 00000 n +0000076133 00000 n +0000076346 00000 n +0000076559 00000 n +0000080257 00000 n +0000080760 00000 n +0000080962 00000 n +0000081165 00000 n +0000081367 00000 n +0000081570 00000 n +0000081781 00000 n +0000081993 00000 n +0000082214 00000 n +0000082436 00000 n +0000082665 00000 n +0000082895 00000 n +0000083096 00000 n +0000083298 00000 n +0000083496 00000 n +0000083695 00000 n +0000083908 00000 n +0000084122 00000 n +0000084321 00000 n +0000084521 00000 n +0000084732 00000 n +0000084944 00000 n +0000085090 00000 n +0000085237 00000 n +0000085451 00000 n +0000085666 00000 n +0000085858 00000 n +0000086051 00000 n +0000086262 00000 n +0000086474 00000 n +0000086693 00000 n +0000086913 00000 n +0000087112 00000 n +0000087312 00000 n +0000087520 00000 n +0000087729 00000 n +0000087925 00000 n +0000088121 00000 n +0000091980 00000 n +0000092451 00000 n +0000092588 00000 n +0000092726 00000 n +0000092918 00000 n +0000093111 00000 n +0000093310 00000 n +0000093510 00000 n +0000093667 00000 n +0000093825 00000 n +0000094038 00000 n +0000094252 00000 n +0000094448 00000 n +0000094645 00000 n +0000094837 00000 n +0000095030 00000 n +0000095253 00000 n +0000095477 00000 n 0000095678 00000 n -0000095813 00000 n -0000095949 00000 n -0000096132 00000 n -0000096316 00000 n -0000096508 00000 n -0000096701 00000 n -0000096860 00000 n -0000097020 00000 n -0000097241 00000 n -0000097463 00000 n -0000097666 00000 n -0000097870 00000 n -0000098093 00000 n -0000098317 00000 n -0000098521 00000 n -0000098726 00000 n -0000098957 00000 n -0000099189 00000 n -0000099402 00000 n -0000099616 00000 n -0000099845 00000 n -0000100075 00000 n -0000100293 00000 n -0000100512 00000 n -0000100748 00000 n -0000100984 00000 n -0000101201 00000 n -0000101419 00000 n -0000106107 00000 n -0000106722 00000 n -0000106857 00000 n -0000106993 00000 n -0000107186 00000 n -0000107380 00000 n -0000107591 00000 n -0000107803 00000 n -0000108006 00000 n -0000108210 00000 n -0000108401 00000 n -0000108593 00000 n -0000108807 00000 n -0000109022 00000 n -0000109225 00000 n -0000109429 00000 n -0000109634 00000 n -0000109840 00000 n -0000110030 00000 n -0000110221 00000 n -0000110458 00000 n -0000110696 00000 n -0000110927 00000 n -0000111159 00000 n -0000111363 00000 n -0000111568 00000 n -0000111776 00000 n -0000111985 00000 n -0000112193 00000 n -0000112402 00000 n -0000112555 00000 n -0000112709 00000 n -0000112906 00000 n -0000113104 00000 n -0000113265 00000 n -0000113427 00000 n -0000113609 00000 n -0000113792 00000 n -0000113957 00000 n -0000114123 00000 n +0000095880 00000 n +0000096077 00000 n +0000096275 00000 n +0000096472 00000 n +0000096670 00000 n +0000096830 00000 n +0000096991 00000 n +0000097188 00000 n +0000097386 00000 n +0000097521 00000 n +0000097657 00000 n +0000097840 00000 n +0000098024 00000 n +0000098216 00000 n +0000098409 00000 n +0000102247 00000 n +0000102734 00000 n +0000102893 00000 n +0000103053 00000 n +0000103274 00000 n +0000103496 00000 n +0000103699 00000 n +0000103903 00000 n +0000104126 00000 n +0000104350 00000 n +0000104554 00000 n +0000104759 00000 n +0000104990 00000 n +0000105222 00000 n +0000105435 00000 n +0000105649 00000 n +0000105878 00000 n +0000106108 00000 n +0000106326 00000 n +0000106545 00000 n +0000106781 00000 n +0000107018 00000 n +0000107236 00000 n +0000107455 00000 n +0000107590 00000 n +0000107726 00000 n +0000107919 00000 n +0000108113 00000 n +0000108324 00000 n +0000108536 00000 n +0000108739 00000 n +0000108943 00000 n +0000109134 00000 n +0000109326 00000 n +0000109540 00000 n +0000109754 00000 n +0000113833 00000 n 0000114320 00000 n -0000114518 00000 n -0000114720 00000 n -0000114923 00000 n -0000115072 00000 n -0000115222 00000 n -0000115404 00000 n -0000115587 00000 n -0000115808 00000 n -0000116030 00000 n -0000116243 00000 n +0000114523 00000 n +0000114727 00000 n +0000114932 00000 n +0000115138 00000 n +0000115328 00000 n +0000115519 00000 n +0000115756 00000 n +0000115994 00000 n +0000116225 00000 n 0000116457 00000 n -0000120738 00000 n -0000121257 00000 n -0000121475 00000 n -0000121694 00000 n -0000121898 00000 n -0000122103 00000 n -0000122279 00000 n -0000122456 00000 n -0000122655 00000 n -0000122855 00000 n -0000123050 00000 n -0000123246 00000 n -0000123444 00000 n -0000123643 00000 n -0000123795 00000 n -0000123948 00000 n -0000124135 00000 n -0000124323 00000 n -0000124517 00000 n -0000124712 00000 n -0000124858 00000 n -0000125005 00000 n -0000125207 00000 n -0000125410 00000 n -0000125577 00000 n -0000125745 00000 n -0000125901 00000 n -0000126058 00000 n -0000126265 00000 n -0000126473 00000 n -0000126617 00000 n -0000126762 00000 n -0000126964 00000 n -0000127167 00000 n -0000127381 00000 n -0000127596 00000 n -0000127781 00000 n -0000127967 00000 n -0000128145 00000 n -0000128324 00000 n -0000133129 00000 n -0000133368 00000 n -0000133624 00000 n -0000133831 00000 n -0000134037 00000 n -0000137600 00000 n -0000137831 00000 n -0000138028 00000 n -0000138217 00000 n -0000141861 00000 n -0000142064 00000 n -0000145488 00000 n -0000145691 00000 n -0000149530 00000 n -0000149761 00000 n -0000149895 00000 n -0000150029 00000 n -0000154200 00000 n -0000154519 00000 n -0000154653 00000 n -0000154785 00000 n -0000154917 00000 n -0000155049 00000 n -0000155181 00000 n -0000155313 00000 n -0000155445 00000 n -0000155577 00000 n -0000155709 00000 n -0000155842 00000 n -0000155975 00000 n -0000156108 00000 n -0000156240 00000 n -0000161465 00000 n -0000161936 00000 n -0000162069 00000 n -0000162202 00000 n -0000162335 00000 n -0000162468 00000 n -0000162601 00000 n -0000162734 00000 n -0000162867 00000 n -0000163000 00000 n -0000163133 00000 n -0000163266 00000 n -0000163399 00000 n -0000163532 00000 n -0000163665 00000 n -0000163798 00000 n -0000163931 00000 n -0000164064 00000 n -0000164197 00000 n -0000164330 00000 n -0000164463 00000 n -0000164596 00000 n -0000164729 00000 n -0000164862 00000 n -0000164995 00000 n -0000165128 00000 n -0000165261 00000 n -0000165394 00000 n -0000165527 00000 n -0000165660 00000 n -0000165793 00000 n -0000165926 00000 n -0000166059 00000 n -0000166193 00000 n -0000170767 00000 n -0000171166 00000 n -0000171300 00000 n -0000171432 00000 n -0000171564 00000 n -0000171696 00000 n -0000171828 00000 n -0000171960 00000 n -0000172092 00000 n -0000172224 00000 n -0000172356 00000 n -0000172489 00000 n -0000172622 00000 n -0000172755 00000 n -0000172888 00000 n -0000173021 00000 n -0000173154 00000 n -0000173287 00000 n -0000173420 00000 n -0000173553 00000 n -0000173686 00000 n -0000173819 00000 n -0000173952 00000 n -0000174085 00000 n -0000174217 00000 n -0000179169 00000 n -0000179672 00000 n -0000179805 00000 n -0000179938 00000 n -0000180071 00000 n -0000180204 00000 n -0000180337 00000 n -0000180470 00000 n -0000180603 00000 n -0000180736 00000 n -0000180869 00000 n -0000181002 00000 n -0000181135 00000 n -0000181268 00000 n -0000181401 00000 n -0000181534 00000 n -0000181667 00000 n -0000181800 00000 n -0000181933 00000 n -0000182066 00000 n -0000182199 00000 n -0000182332 00000 n -0000182465 00000 n -0000182598 00000 n -0000182731 00000 n -0000182864 00000 n -0000182997 00000 n -0000183130 00000 n -0000183263 00000 n -0000183396 00000 n -0000183529 00000 n -0000183662 00000 n -0000183795 00000 n -0000183928 00000 n -0000184061 00000 n -0000184194 00000 n -0000184327 00000 n -0000184459 00000 n -0000189050 00000 n -0000189401 00000 n -0000189534 00000 n -0000189667 00000 n -0000189801 00000 n -0000189936 00000 n -0000190069 00000 n -0000190202 00000 n -0000190335 00000 n -0000190468 00000 n -0000190601 00000 n -0000190734 00000 n -0000190867 00000 n -0000191000 00000 n -0000191134 00000 n -0000191268 00000 n -0000191402 00000 n -0000191535 00000 n -0000191667 00000 n -0000196747 00000 n -0000197266 00000 n -0000197400 00000 n -0000197534 00000 n -0000197668 00000 n -0000197802 00000 n -0000197936 00000 n -0000198070 00000 n -0000198204 00000 n -0000198338 00000 n -0000198472 00000 n -0000198606 00000 n -0000198740 00000 n -0000198874 00000 n -0000199008 00000 n -0000199142 00000 n -0000199276 00000 n -0000199410 00000 n -0000199544 00000 n -0000199678 00000 n -0000199812 00000 n -0000199946 00000 n -0000200080 00000 n -0000200214 00000 n -0000200348 00000 n -0000200482 00000 n -0000200616 00000 n -0000200750 00000 n -0000200884 00000 n -0000201018 00000 n -0000201152 00000 n -0000201286 00000 n -0000201420 00000 n -0000201554 00000 n -0000201688 00000 n -0000201822 00000 n -0000201956 00000 n -0000202090 00000 n -0000202223 00000 n -0000202355 00000 n -0000206626 00000 n -0000206929 00000 n -0000207063 00000 n -0000207197 00000 n -0000207331 00000 n -0000207465 00000 n -0000207599 00000 n -0000207733 00000 n -0000207867 00000 n -0000208001 00000 n -0000208135 00000 n -0000208270 00000 n -0000208405 00000 n -0000211947 00000 n -0000212170 00000 n -0000212305 00000 n -0000217240 00000 n -0000217463 00000 n -0000217598 00000 n -0000222619 00000 n -0000222842 00000 n -0000222976 00000 n -0000227786 00000 n -0000227989 00000 n -0000232911 00000 n -0000233134 00000 n -0000233269 00000 n -0000238041 00000 n -0000238244 00000 n -0000242998 00000 n -0000243221 00000 n -0000243356 00000 n -0000248351 00000 n -0000248574 00000 n -0000248708 00000 n -0000253516 00000 n -0000253719 00000 n -0000258554 00000 n -0000258777 00000 n -0000258912 00000 n -0000263717 00000 n -0000263920 00000 n -0000268805 00000 n -0000269028 00000 n -0000269163 00000 n -0000274145 00000 n -0000274368 00000 n -0000274503 00000 n -0000279342 00000 n -0000279545 00000 n -0000284424 00000 n -0000284647 00000 n -0000284782 00000 n -0000289526 00000 n -0000289729 00000 n -0000294717 00000 n -0000294940 00000 n -0000295075 00000 n -0000299927 00000 n -0000300130 00000 n -0000305090 00000 n -0000305313 00000 n -0000305448 00000 n -0000310258 00000 n -0000310481 00000 n -0000310616 00000 n -0000315417 00000 n -0000315648 00000 n -0000315783 00000 n -0000315918 00000 n -0000320746 00000 n -0000320949 00000 n -0000325683 00000 n -0000325906 00000 n -0000326041 00000 n -0000330983 00000 n -0000331206 00000 n -0000331341 00000 n -0000336147 00000 n -0000336350 00000 n -0000341362 00000 n -0000341585 00000 n -0000341720 00000 n -0000346509 00000 n -0000346712 00000 n -0000351547 00000 n -0000351770 00000 n -0000351905 00000 n -0000356889 00000 n -0000357112 00000 n -0000357245 00000 n -0000362042 00000 n -0000362245 00000 n -0000367143 00000 n -0000367366 00000 n -0000367501 00000 n -0000372274 00000 n -0000372477 00000 n -0000377227 00000 n -0000377450 00000 n -0000377585 00000 n -0000382574 00000 n -0000382797 00000 n -0000382932 00000 n -0000387812 00000 n -0000388015 00000 n -0000392816 00000 n -0000393039 00000 n -0000393174 00000 n -0000397878 00000 n -0000398081 00000 n -0000402858 00000 n -0000403081 00000 n -0000403216 00000 n -0000408172 00000 n -0000408395 00000 n -0000408530 00000 n -0000413372 00000 n -0000413575 00000 n -0000418422 00000 n -0000418645 00000 n -0000418780 00000 n -0000423552 00000 n -0000423755 00000 n -0000428591 00000 n -0000428814 00000 n -0000428949 00000 n -0000433919 00000 n -0000434142 00000 n -0000434277 00000 n -0000439116 00000 n -0000439319 00000 n -0000444143 00000 n -0000444366 00000 n -0000444502 00000 n -0000449302 00000 n -0000449505 00000 n -0000454312 00000 n -0000454535 00000 n -0000454671 00000 n -0000459704 00000 n -0000459927 00000 n -0000460063 00000 n -0000464890 00000 n -0000465093 00000 n -0000469963 00000 n -0000470186 00000 n -0000470322 00000 n -0000475095 00000 n -0000475298 00000 n -0000480106 00000 n -0000480329 00000 n -0000480465 00000 n -0000485505 00000 n -0000485752 00000 n -0000485888 00000 n -0000486022 00000 n -0000486156 00000 n -0000486288 00000 n -0000490909 00000 n -0000491300 00000 n -0000491434 00000 n -0000491568 00000 n -0000491702 00000 n -0000491836 00000 n -0000491970 00000 n -0000492105 00000 n -0000492240 00000 n -0000492375 00000 n -0000492510 00000 n -0000492645 00000 n -0000492780 00000 n -0000492915 00000 n -0000493050 00000 n -0000493185 00000 n -0000493320 00000 n -0000493455 00000 n -0000493590 00000 n -0000493725 00000 n -0000493860 00000 n -0000493995 00000 n -0000494130 00000 n -0000494266 00000 n -0000497532 00000 n -0000497755 00000 n -0000497891 00000 n -0000502729 00000 n -0000502952 00000 n -0000503088 00000 n -0000507750 00000 n -0000507981 00000 n -0000508117 00000 n -0000508253 00000 n -0000512880 00000 n -0000513103 00000 n -0000513239 00000 n -0000517847 00000 n -0000518070 00000 n -0000518206 00000 n -0000522796 00000 n -0000523019 00000 n -0000523155 00000 n -0000526018 00000 n -0000526221 00000 n -0000530676 00000 n -0000530907 00000 n -0000531043 00000 n -0000531179 00000 n -0000534150 00000 n -0000534353 00000 n -0000539207 00000 n -0000539430 00000 n -0000539566 00000 n -0000544394 00000 n -0000544597 00000 n -0000549503 00000 n -0000549726 00000 n -0000549862 00000 n -0000554598 00000 n -0000554801 00000 n -0000559811 00000 n -0000560034 00000 n -0000560170 00000 n -0000564760 00000 n -0000564963 00000 n -0000569968 00000 n -0000570171 00000 n -0000574930 00000 n -0000575153 00000 n -0000575289 00000 n -0000580081 00000 n -0000580284 00000 n -0000585073 00000 n -0000585296 00000 n -0000585432 00000 n -0000590253 00000 n -0000590456 00000 n -0000595354 00000 n -0000595577 00000 n -0000595713 00000 n -0000600505 00000 n -0000600708 00000 n -0000605699 00000 n -0000605922 00000 n -0000606058 00000 n -0000610701 00000 n -0000610904 00000 n -0000615120 00000 n -0000615323 00000 n -0000618576 00000 n -0000618779 00000 n -0000623640 00000 n -0000623863 00000 n -0000623999 00000 n -0000628586 00000 n -0000628789 00000 n -0000633039 00000 n -0000633262 00000 n -0000633398 00000 n -0000637454 00000 n -0000637685 00000 n -0000637821 00000 n -0000637957 00000 n -0000642905 00000 n -0000643176 00000 n -0000643312 00000 n -0000643448 00000 n -0000643582 00000 n -0000643716 00000 n -0000643850 00000 n -0000643984 00000 n -0000644119 00000 n -0000648884 00000 n -0000649147 00000 n -0000649283 00000 n -0000649417 00000 n -0000649551 00000 n -0000649685 00000 n -0000649819 00000 n -0000649955 00000 n -0000653042 00000 n -0000653245 00000 n -0000657542 00000 n -0000657781 00000 n -0000657917 00000 n -0000658053 00000 n -0000658188 00000 n -0000662206 00000 n -0000662445 00000 n -0000662581 00000 n -0000662717 00000 n -0000662853 00000 n -0000667439 00000 n -0000667686 00000 n -0000667822 00000 n -0000667958 00000 n -0000668094 00000 n -0000668230 00000 n -0000673061 00000 n -0000673292 00000 n -0000673428 00000 n -0000673564 00000 n -0000677696 00000 n -0000677927 00000 n -0000678063 00000 n -0000678199 00000 n -0000682312 00000 n -0000682559 00000 n -0000682695 00000 n -0000682831 00000 n -0000682967 00000 n -0000683103 00000 n -0000687930 00000 n -0000688161 00000 n -0000688297 00000 n -0000688433 00000 n -0000693184 00000 n -0000693407 00000 n -0000693543 00000 n -0000696613 00000 n -0000696844 00000 n -0000696980 00000 n -0000697116 00000 n -0000701095 00000 n -0000701298 00000 n -0000706710 00000 n -0000707101 00000 n -0000707237 00000 n -0000707371 00000 n -0000707505 00000 n -0000707639 00000 n -0000707773 00000 n -0000707907 00000 n -0000708041 00000 n -0000708175 00000 n -0000708309 00000 n -0000708444 00000 n -0000708579 00000 n -0000708714 00000 n -0000708849 00000 n -0000708984 00000 n -0000709119 00000 n -0000709254 00000 n -0000709389 00000 n -0000709524 00000 n -0000709659 00000 n -0000709794 00000 n -0000709929 00000 n -0000710063 00000 n -0000714052 00000 n -0000714347 00000 n -0000714482 00000 n -0000714617 00000 n -0000714752 00000 n -0000714887 00000 n -0000715022 00000 n -0000715157 00000 n -0000715292 00000 n -0000715427 00000 n -0000715562 00000 n -0000715698 00000 n -0000720119 00000 n -0000720342 00000 n -0000720478 00000 n -0000724960 00000 n -0000725191 00000 n -0000725327 00000 n -0000725463 00000 n -0000729744 00000 n -0000729967 00000 n -0000730103 00000 n -0000732973 00000 n -0000733176 00000 n -0000738089 00000 n -0000738416 00000 n -0000738552 00000 n -0000738686 00000 n -0000738820 00000 n -0000738954 00000 n -0000739088 00000 n -0000739222 00000 n -0000739356 00000 n -0000739490 00000 n -0000739624 00000 n -0000739759 00000 n -0000739894 00000 n -0000740029 00000 n -0000740163 00000 n -0000740296 00000 n -0000743589 00000 n -0000743852 00000 n -0000743987 00000 n -0000744122 00000 n -0000744257 00000 n -0000744392 00000 n -0000744527 00000 n -0000744663 00000 n -0000748077 00000 n -0000748280 00000 n -0000751539 00000 n -0000751742 00000 n -0000756025 00000 n -0000756228 00000 n -0000760804 00000 n -0000761171 00000 n -0000761307 00000 n -0000761441 00000 n -0000761575 00000 n -0000761709 00000 n -0000761843 00000 n -0000761977 00000 n -0000762111 00000 n -0000762245 00000 n -0000762379 00000 n -0000762514 00000 n -0000762649 00000 n -0000762784 00000 n -0000762919 00000 n -0000763054 00000 n -0000763189 00000 n -0000763324 00000 n -0000763459 00000 n -0000763594 00000 n -0000763730 00000 n -0000763922 00000 n -0000764144 00000 n -0000764270 00000 n -0000764416 00000 n -0000764556 00000 n -0000764753 00000 n -0000764987 00000 n -0000765218 00000 n -0000765474 00000 n -0000765713 00000 n -0000765960 00000 n -0000766190 00000 n -0000766432 00000 n -0000766657 00000 n -0000766901 00000 n -0000767129 00000 n -0000767360 00000 n -0000767574 00000 n -0000767809 00000 n -0000768027 00000 n -0000768271 00000 n -0000768498 00000 n -0000768730 00000 n -0000768977 00000 n -0000769196 00000 n -0000769431 00000 n -0000769635 00000 n -0000769811 00000 n -0000770006 00000 n -0000770211 00000 n -0000770417 00000 n -0000770624 00000 n -0000770878 00000 n -0000771108 00000 n -0000771331 00000 n -0000771542 00000 n -0000771753 00000 n -0000771968 00000 n -0000772184 00000 n -0000772398 00000 n -0000772648 00000 n -0000772863 00000 n -0000773082 00000 n -0000773300 00000 n -0000773516 00000 n -0000773728 00000 n -0000773933 00000 n -0000774140 00000 n -0000774345 00000 n -0000774546 00000 n -0000774773 00000 n -0000775003 00000 n -0000775232 00000 n -0000775449 00000 n -0000775666 00000 n -0000775892 00000 n -0000776128 00000 n -0000776372 00000 n -0000776588 00000 n -0000776801 00000 n -0000777029 00000 n -0000777243 00000 n -0000777455 00000 n -0000777638 00000 n -0000777852 00000 n -0000778056 00000 n -0000778281 00000 n -0000778514 00000 n -0000778727 00000 n -0000778949 00000 n -0000779146 00000 n -0000779320 00000 n -0000779510 00000 n -0000779707 00000 n -0000779899 00000 n -0000780110 00000 n -0000780318 00000 n -0000780522 00000 n -0000780757 00000 n -0000780970 00000 n -0000781179 00000 n -0000781374 00000 n -0000781571 00000 n -0000781754 00000 n -0000781926 00000 n -0000782109 00000 n -0000782301 00000 n -0000782500 00000 n -0000782721 00000 n -0000782939 00000 n -0000783177 00000 n -0000783398 00000 n -0000783646 00000 n -0000783877 00000 n +0000116661 00000 n +0000116866 00000 n +0000117074 00000 n +0000117283 00000 n +0000117491 00000 n +0000117700 00000 n +0000117853 00000 n +0000118007 00000 n +0000118204 00000 n +0000118402 00000 n +0000118563 00000 n +0000118725 00000 n +0000118907 00000 n +0000119090 00000 n +0000119255 00000 n +0000119421 00000 n +0000119618 00000 n +0000119816 00000 n +0000120018 00000 n +0000120221 00000 n +0000120370 00000 n +0000120520 00000 n +0000120702 00000 n +0000120885 00000 n +0000124723 00000 n +0000125194 00000 n +0000125415 00000 n +0000125637 00000 n +0000125851 00000 n +0000126066 00000 n +0000126284 00000 n +0000126503 00000 n +0000126707 00000 n +0000126912 00000 n +0000127088 00000 n +0000127265 00000 n +0000127464 00000 n +0000127664 00000 n +0000127859 00000 n +0000128055 00000 n +0000128253 00000 n +0000128452 00000 n +0000128604 00000 n +0000128757 00000 n +0000128944 00000 n +0000129132 00000 n +0000129326 00000 n +0000129521 00000 n +0000129667 00000 n +0000129814 00000 n +0000130016 00000 n +0000130219 00000 n +0000130386 00000 n +0000130554 00000 n +0000130710 00000 n +0000130867 00000 n +0000131074 00000 n +0000131282 00000 n +0000133585 00000 n +0000133880 00000 n +0000134024 00000 n +0000134169 00000 n +0000134371 00000 n +0000134574 00000 n +0000134788 00000 n +0000135003 00000 n +0000135188 00000 n +0000135374 00000 n +0000135552 00000 n +0000135731 00000 n +0000140534 00000 n +0000140773 00000 n +0000141029 00000 n +0000141236 00000 n +0000141442 00000 n +0000145032 00000 n +0000145263 00000 n +0000145460 00000 n +0000145649 00000 n +0000149334 00000 n +0000149537 00000 n +0000153277 00000 n +0000153500 00000 n +0000153634 00000 n +0000157398 00000 n +0000157621 00000 n +0000157755 00000 n +0000162461 00000 n +0000162852 00000 n +0000162986 00000 n +0000163118 00000 n +0000163250 00000 n +0000163382 00000 n +0000163514 00000 n +0000163646 00000 n +0000163778 00000 n +0000163910 00000 n +0000164042 00000 n +0000164175 00000 n +0000164308 00000 n +0000164441 00000 n +0000164574 00000 n +0000164707 00000 n +0000164840 00000 n +0000164973 00000 n +0000165106 00000 n +0000165239 00000 n +0000165372 00000 n +0000165505 00000 n +0000165637 00000 n +0000165768 00000 n +0000170770 00000 n +0000171169 00000 n +0000171302 00000 n +0000171435 00000 n +0000171568 00000 n +0000171701 00000 n +0000171834 00000 n +0000171967 00000 n +0000172100 00000 n +0000172233 00000 n +0000172366 00000 n +0000172499 00000 n +0000172632 00000 n +0000172765 00000 n +0000172898 00000 n +0000173031 00000 n +0000173164 00000 n +0000173297 00000 n +0000173430 00000 n +0000173563 00000 n +0000173696 00000 n +0000173829 00000 n +0000173962 00000 n +0000174095 00000 n +0000174229 00000 n +0000179035 00000 n +0000179498 00000 n +0000179632 00000 n +0000179764 00000 n +0000179896 00000 n +0000180028 00000 n +0000180160 00000 n +0000180292 00000 n +0000180424 00000 n +0000180556 00000 n +0000180688 00000 n +0000180821 00000 n +0000180954 00000 n +0000181087 00000 n +0000181220 00000 n +0000181353 00000 n +0000181486 00000 n +0000181619 00000 n +0000181752 00000 n +0000181885 00000 n +0000182018 00000 n +0000182151 00000 n +0000182284 00000 n +0000182417 00000 n +0000182550 00000 n +0000182683 00000 n +0000182816 00000 n +0000182949 00000 n +0000183082 00000 n +0000183215 00000 n +0000183348 00000 n +0000183481 00000 n +0000183613 00000 n +0000188611 00000 n +0000189074 00000 n +0000189207 00000 n +0000189340 00000 n +0000189473 00000 n +0000189606 00000 n +0000189739 00000 n +0000189872 00000 n +0000190005 00000 n +0000190138 00000 n +0000190271 00000 n +0000190404 00000 n +0000190537 00000 n +0000190670 00000 n +0000190803 00000 n +0000190936 00000 n +0000191069 00000 n +0000191202 00000 n +0000191335 00000 n +0000191468 00000 n +0000191601 00000 n +0000191734 00000 n +0000191867 00000 n +0000192000 00000 n +0000192133 00000 n +0000192266 00000 n +0000192399 00000 n +0000192532 00000 n +0000192665 00000 n +0000192798 00000 n +0000192931 00000 n +0000193064 00000 n +0000193198 00000 n +0000197785 00000 n +0000198176 00000 n +0000198311 00000 n +0000198444 00000 n +0000198577 00000 n +0000198710 00000 n +0000198843 00000 n +0000198976 00000 n +0000199109 00000 n +0000199242 00000 n +0000199375 00000 n +0000199509 00000 n +0000199643 00000 n +0000199777 00000 n +0000199911 00000 n +0000200045 00000 n +0000200179 00000 n +0000200313 00000 n +0000200447 00000 n +0000200581 00000 n +0000200715 00000 n +0000200849 00000 n +0000200983 00000 n +0000201116 00000 n +0000206097 00000 n +0000206608 00000 n +0000206742 00000 n +0000206876 00000 n +0000207010 00000 n +0000207144 00000 n +0000207278 00000 n +0000207412 00000 n +0000207546 00000 n +0000207680 00000 n +0000207814 00000 n +0000207948 00000 n +0000208082 00000 n +0000208216 00000 n +0000208350 00000 n +0000208484 00000 n +0000208618 00000 n +0000208752 00000 n +0000208886 00000 n +0000209020 00000 n +0000209154 00000 n +0000209288 00000 n +0000209422 00000 n +0000209556 00000 n +0000209690 00000 n +0000209824 00000 n +0000209958 00000 n +0000210092 00000 n +0000210226 00000 n +0000210360 00000 n +0000210494 00000 n +0000210628 00000 n +0000210762 00000 n +0000210896 00000 n +0000211030 00000 n +0000211164 00000 n +0000211298 00000 n +0000211431 00000 n +0000211563 00000 n +0000215574 00000 n +0000215821 00000 n +0000215955 00000 n +0000216089 00000 n +0000216224 00000 n +0000216359 00000 n +0000219555 00000 n +0000219778 00000 n +0000219913 00000 n +0000224854 00000 n +0000225077 00000 n +0000225212 00000 n +0000230250 00000 n +0000230473 00000 n +0000230607 00000 n +0000235414 00000 n +0000235617 00000 n +0000240561 00000 n +0000240784 00000 n +0000240919 00000 n +0000245691 00000 n +0000245894 00000 n +0000250695 00000 n +0000250918 00000 n +0000251053 00000 n +0000256050 00000 n +0000256273 00000 n +0000256408 00000 n +0000261217 00000 n +0000261420 00000 n +0000266288 00000 n +0000266511 00000 n +0000266646 00000 n +0000271495 00000 n +0000271698 00000 n +0000276574 00000 n +0000276797 00000 n +0000276932 00000 n +0000281905 00000 n +0000282128 00000 n +0000282263 00000 n +0000287124 00000 n +0000287327 00000 n +0000292165 00000 n +0000292388 00000 n +0000292523 00000 n +0000297432 00000 n +0000297635 00000 n +0000302594 00000 n +0000302817 00000 n +0000302952 00000 n +0000307972 00000 n +0000308195 00000 n +0000308330 00000 n +0000313147 00000 n +0000313350 00000 n +0000317920 00000 n +0000318151 00000 n +0000318286 00000 n +0000318420 00000 n +0000323269 00000 n +0000323492 00000 n +0000323627 00000 n +0000328610 00000 n +0000328833 00000 n +0000328968 00000 n +0000333776 00000 n +0000333979 00000 n +0000339042 00000 n +0000339265 00000 n +0000339400 00000 n +0000344189 00000 n +0000344392 00000 n +0000349443 00000 n +0000349666 00000 n +0000349801 00000 n +0000354679 00000 n +0000354882 00000 n +0000359675 00000 n +0000359898 00000 n +0000360033 00000 n +0000365029 00000 n +0000365252 00000 n +0000365387 00000 n +0000370176 00000 n +0000370379 00000 n +0000375288 00000 n +0000375511 00000 n +0000375646 00000 n +0000380645 00000 n +0000380868 00000 n +0000381002 00000 n +0000385802 00000 n +0000386005 00000 n +0000390833 00000 n +0000391056 00000 n +0000391191 00000 n +0000395993 00000 n +0000396196 00000 n +0000401012 00000 n +0000401235 00000 n +0000401370 00000 n +0000406361 00000 n +0000406584 00000 n +0000406719 00000 n +0000411580 00000 n +0000411783 00000 n +0000416636 00000 n +0000416859 00000 n +0000416994 00000 n +0000421744 00000 n +0000421947 00000 n +0000426762 00000 n +0000426985 00000 n +0000427120 00000 n +0000432113 00000 n +0000432336 00000 n +0000432471 00000 n +0000437332 00000 n +0000437535 00000 n +0000442361 00000 n +0000442584 00000 n +0000442719 00000 n +0000447642 00000 n +0000447845 00000 n +0000452621 00000 n +0000452844 00000 n +0000452980 00000 n +0000457917 00000 n +0000458140 00000 n +0000458276 00000 n +0000463138 00000 n +0000463341 00000 n +0000468192 00000 n +0000468415 00000 n +0000468551 00000 n +0000473458 00000 n +0000473661 00000 n +0000478396 00000 n +0000478619 00000 n +0000478755 00000 n +0000483760 00000 n +0000483983 00000 n +0000484119 00000 n +0000488919 00000 n +0000489122 00000 n +0000494208 00000 n +0000494583 00000 n +0000494719 00000 n +0000494853 00000 n +0000494987 00000 n +0000495121 00000 n +0000495255 00000 n +0000495389 00000 n +0000495523 00000 n +0000495657 00000 n +0000495791 00000 n +0000495926 00000 n +0000496061 00000 n +0000496196 00000 n +0000496331 00000 n +0000496466 00000 n +0000496601 00000 n +0000496736 00000 n +0000496871 00000 n +0000497006 00000 n +0000497140 00000 n +0000497273 00000 n +0000501325 00000 n +0000501596 00000 n +0000501731 00000 n +0000501866 00000 n +0000502001 00000 n +0000502136 00000 n +0000502271 00000 n +0000502407 00000 n +0000502543 00000 n +0000507370 00000 n +0000507593 00000 n +0000507729 00000 n +0000512395 00000 n +0000512626 00000 n +0000512762 00000 n +0000512898 00000 n +0000517565 00000 n +0000517788 00000 n +0000517924 00000 n +0000522505 00000 n +0000522728 00000 n +0000522864 00000 n +0000527453 00000 n +0000527676 00000 n +0000527812 00000 n +0000530675 00000 n +0000530878 00000 n +0000535321 00000 n +0000535552 00000 n +0000535688 00000 n +0000535824 00000 n +0000538794 00000 n +0000538997 00000 n +0000543889 00000 n +0000544112 00000 n +0000544248 00000 n +0000549078 00000 n +0000549281 00000 n +0000554242 00000 n +0000554465 00000 n +0000554601 00000 n +0000559413 00000 n +0000559616 00000 n +0000564613 00000 n +0000564836 00000 n +0000564972 00000 n +0000569551 00000 n +0000569754 00000 n +0000574867 00000 n +0000575090 00000 n +0000575226 00000 n +0000579872 00000 n +0000580075 00000 n +0000584947 00000 n +0000585150 00000 n +0000589983 00000 n +0000590206 00000 n +0000590342 00000 n +0000595229 00000 n +0000595432 00000 n +0000600328 00000 n +0000600551 00000 n +0000600687 00000 n +0000605479 00000 n +0000605682 00000 n +0000610693 00000 n +0000610916 00000 n +0000611052 00000 n +0000615876 00000 n +0000616079 00000 n +0000619954 00000 n +0000620157 00000 n +0000623430 00000 n +0000623633 00000 n +0000628494 00000 n +0000628717 00000 n +0000628853 00000 n +0000633458 00000 n +0000633661 00000 n +0000637949 00000 n +0000638172 00000 n +0000638308 00000 n +0000642374 00000 n +0000642605 00000 n +0000642741 00000 n +0000642877 00000 n +0000647826 00000 n +0000648097 00000 n +0000648233 00000 n +0000648369 00000 n +0000648503 00000 n +0000648637 00000 n +0000648771 00000 n +0000648905 00000 n +0000649041 00000 n +0000653813 00000 n +0000654076 00000 n +0000654212 00000 n +0000654346 00000 n +0000654480 00000 n +0000654614 00000 n +0000654748 00000 n +0000654884 00000 n +0000657646 00000 n +0000657849 00000 n +0000662157 00000 n +0000662396 00000 n +0000662532 00000 n +0000662668 00000 n +0000662803 00000 n +0000666821 00000 n +0000667060 00000 n +0000667196 00000 n +0000667332 00000 n +0000667468 00000 n +0000672062 00000 n +0000672309 00000 n +0000672445 00000 n +0000672581 00000 n +0000672717 00000 n +0000672853 00000 n +0000677685 00000 n +0000677916 00000 n +0000678052 00000 n +0000678188 00000 n +0000682333 00000 n +0000682564 00000 n +0000682700 00000 n +0000682836 00000 n +0000687005 00000 n +0000687252 00000 n +0000687388 00000 n +0000687524 00000 n +0000687660 00000 n +0000687796 00000 n +0000692702 00000 n +0000692933 00000 n +0000693069 00000 n +0000693205 00000 n +0000697819 00000 n +0000698050 00000 n +0000698186 00000 n +0000698322 00000 n +0000701260 00000 n +0000701483 00000 n +0000701619 00000 n +0000705691 00000 n +0000705894 00000 n +0000711399 00000 n +0000711798 00000 n +0000711934 00000 n +0000712068 00000 n +0000712202 00000 n +0000712336 00000 n +0000712470 00000 n +0000712604 00000 n +0000712738 00000 n +0000712872 00000 n +0000713006 00000 n +0000713141 00000 n +0000713276 00000 n +0000713411 00000 n +0000713546 00000 n +0000713681 00000 n +0000713816 00000 n +0000713951 00000 n +0000714086 00000 n +0000714221 00000 n +0000714356 00000 n +0000714491 00000 n +0000714626 00000 n +0000714761 00000 n +0000714895 00000 n +0000718593 00000 n +0000718880 00000 n +0000719015 00000 n +0000719150 00000 n +0000719285 00000 n +0000719420 00000 n +0000719555 00000 n +0000719690 00000 n +0000719825 00000 n +0000719960 00000 n +0000720096 00000 n +0000724516 00000 n +0000724739 00000 n +0000724875 00000 n +0000729330 00000 n +0000729561 00000 n +0000729697 00000 n +0000729833 00000 n +0000734293 00000 n +0000734516 00000 n +0000734652 00000 n +0000739614 00000 n +0000739949 00000 n +0000740085 00000 n +0000740219 00000 n +0000740353 00000 n +0000740487 00000 n +0000740621 00000 n +0000740755 00000 n +0000740889 00000 n +0000741023 00000 n +0000741157 00000 n +0000741292 00000 n +0000741427 00000 n +0000741562 00000 n +0000741697 00000 n +0000741831 00000 n +0000741964 00000 n +0000745205 00000 n +0000745460 00000 n +0000745595 00000 n +0000745730 00000 n +0000745865 00000 n +0000746000 00000 n +0000746136 00000 n +0000749547 00000 n +0000749750 00000 n +0000753007 00000 n +0000753210 00000 n +0000757610 00000 n +0000757813 00000 n +0000762205 00000 n +0000762572 00000 n +0000762708 00000 n +0000762842 00000 n +0000762976 00000 n +0000763110 00000 n +0000763244 00000 n +0000763378 00000 n +0000763512 00000 n +0000763646 00000 n +0000763780 00000 n +0000763915 00000 n +0000764050 00000 n +0000764185 00000 n +0000764320 00000 n +0000764455 00000 n +0000764590 00000 n +0000764725 00000 n +0000764860 00000 n +0000764995 00000 n +0000765131 00000 n +0000765323 00000 n +0000765545 00000 n +0000765671 00000 n +0000765817 00000 n +0000765957 00000 n +0000766154 00000 n +0000766388 00000 n +0000766619 00000 n +0000766875 00000 n +0000767114 00000 n +0000767361 00000 n +0000767591 00000 n +0000767833 00000 n +0000768058 00000 n +0000768302 00000 n +0000768530 00000 n +0000768761 00000 n +0000768975 00000 n +0000769210 00000 n +0000769428 00000 n +0000769672 00000 n +0000769899 00000 n +0000770131 00000 n +0000770378 00000 n +0000770597 00000 n +0000770832 00000 n +0000771036 00000 n +0000771212 00000 n +0000771407 00000 n +0000771612 00000 n +0000771818 00000 n +0000772025 00000 n +0000772279 00000 n +0000772509 00000 n +0000772732 00000 n +0000772943 00000 n +0000773154 00000 n +0000773369 00000 n +0000773585 00000 n +0000773799 00000 n +0000774049 00000 n +0000774264 00000 n +0000774483 00000 n +0000774701 00000 n +0000774917 00000 n +0000775129 00000 n +0000775334 00000 n +0000775541 00000 n +0000775746 00000 n +0000775947 00000 n +0000776174 00000 n +0000776404 00000 n +0000776633 00000 n +0000776850 00000 n +0000777067 00000 n +0000777293 00000 n +0000777529 00000 n +0000777773 00000 n +0000777989 00000 n +0000778202 00000 n +0000778430 00000 n +0000778644 00000 n +0000778856 00000 n +0000779039 00000 n +0000779253 00000 n +0000779457 00000 n +0000779682 00000 n +0000779915 00000 n +0000780128 00000 n +0000780350 00000 n +0000780547 00000 n +0000780721 00000 n +0000780911 00000 n +0000781108 00000 n +0000781300 00000 n +0000781511 00000 n +0000781719 00000 n +0000781923 00000 n +0000782158 00000 n +0000782371 00000 n +0000782580 00000 n +0000782775 00000 n +0000782972 00000 n +0000783155 00000 n +0000783327 00000 n +0000783510 00000 n +0000783702 00000 n +0000783901 00000 n 0000784123 00000 n -0000784359 00000 n -0000784612 00000 n -0000784834 00000 n -0000785011 00000 n -0000785207 00000 n -0000785434 00000 n -0000785653 00000 n -0000785862 00000 n -0000786094 00000 n -0000786315 00000 n -0000786538 00000 n -0000786746 00000 n -0000787001 00000 n -0000787249 00000 n -0000787472 00000 n -0000787699 00000 n -0000787911 00000 n -0000788106 00000 n -0000788306 00000 n -0000788485 00000 n -0000788685 00000 n -0000788868 00000 n -0000789083 00000 n -0000789288 00000 n -0000789479 00000 n -0000789664 00000 n -0000789903 00000 n -0000790135 00000 n -0000790371 00000 n -0000790593 00000 n -0000790787 00000 n -0000791004 00000 n -0000791217 00000 n -0000791418 00000 n -0000791612 00000 n -0000791802 00000 n -0000791999 00000 n -0000792187 00000 n -0000792392 00000 n -0000792562 00000 n -0000792760 00000 n -0000792955 00000 n -0000793126 00000 n -0000793331 00000 n -0000793564 00000 n -0000793767 00000 n -0000793948 00000 n -0000794012 00000 n -0000801691 00000 n -0000806495 00000 n -0000818352 00000 n -0000830747 00000 n -0000830981 00000 n -0000831385 00000 n -0000832183 00000 n -0000832336 00000 n -0000832567 00000 n -0000833164 00000 n -0000834649 00000 n -0000834799 00000 n -0000835034 00000 n -0000835573 00000 n -0000836810 00000 n -0000836963 00000 n -0000837207 00000 n -0000837802 00000 n -0000839427 00000 n -0000839584 00000 n +0000784343 00000 n +0000784583 00000 n +0000784805 00000 n +0000785053 00000 n +0000785284 00000 n +0000785530 00000 n +0000785766 00000 n +0000786019 00000 n +0000786241 00000 n +0000786418 00000 n +0000786614 00000 n +0000786841 00000 n +0000787060 00000 n +0000787269 00000 n +0000787501 00000 n +0000787722 00000 n +0000787945 00000 n +0000788153 00000 n +0000788408 00000 n +0000788656 00000 n +0000788879 00000 n +0000789106 00000 n +0000789318 00000 n +0000789513 00000 n +0000789713 00000 n +0000789892 00000 n +0000790092 00000 n +0000790275 00000 n +0000790490 00000 n +0000790695 00000 n +0000790886 00000 n +0000791071 00000 n +0000791310 00000 n +0000791542 00000 n +0000791778 00000 n +0000792000 00000 n +0000792194 00000 n +0000792411 00000 n +0000792624 00000 n +0000792825 00000 n +0000793019 00000 n +0000793209 00000 n +0000793406 00000 n +0000793594 00000 n +0000793799 00000 n +0000793969 00000 n +0000794167 00000 n +0000794362 00000 n +0000794533 00000 n +0000794738 00000 n +0000794971 00000 n +0000795174 00000 n +0000795355 00000 n +0000795419 00000 n +0000803098 00000 n +0000807902 00000 n +0000819763 00000 n +0000832159 00000 n +0000832393 00000 n +0000832797 00000 n +0000833595 00000 n +0000833748 00000 n +0000833979 00000 n +0000834576 00000 n +0000836061 00000 n +0000836211 00000 n +0000836446 00000 n +0000836985 00000 n +0000838222 00000 n +0000838375 00000 n +0000838619 00000 n +0000839214 00000 n +0000840839 00000 n +0000840996 00000 n trailer << -/Size 1073 +/Size 1075 /Root 3 0 R /Info 2 0 R >> startxref -839676 +841088 %%EOF diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf index 5a5582ede24..2df9a1dae27 100644 --- a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf +++ b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf @@ -3,7 +3,7 @@ 1 0 obj << /Type /Pages -/Kids [ 6 0 R 8 0 R 27 0 R 32 0 R 41 0 R 58 0 R 75 0 R 90 0 R 129 0 R 165 0 R 202 0 R 237 0 R 277 0 R 317 0 R 357 0 R 391 0 R 430 0 R 470 0 R 510 0 R 534 0 R 568 0 R ] +/Kids [ 6 0 R 8 0 R 30 0 R 45 0 R 53 0 R 67 0 R 77 0 R 99 0 R 129 0 R 169 0 R 204 0 R 241 0 R 280 0 R 320 0 R 360 0 R 400 0 R 435 0 R 475 0 R 515 0 R 538 0 R 572 0 R ] /Count 21 >> endobj @@ -11,17 +11,17 @@ endobj << /Title (Hardening Guide with CIS v1.6 Benchmark) /Creator (pandoc) -/Producer (WeasyPrint 54.0) +/Producer (WeasyPrint 54.1) >> endobj 3 0 obj << /Type /Catalog /Pages 1 0 R -/Outlines 586 0 R +/Outlines 600 0 R /Names << /Dests << -/Names [ (TOC) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (cb1) [ 32 0 R /XYZ 84.259843 592.520079 0 ] (cb1-1) [ 32 0 R /XYZ 101.433071 590.823057 0 ] (cb1-2) [ 32 0 R /XYZ 99.933071 571.876036 0 ] (cb1-3) [ 32 0 R /XYZ 99.933071 552.929014 0 ] (cb1-4) [ 32 0 R /XYZ 99.933071 533.981993 0 ] (cb1-5) [ 32 0 R /XYZ 99.933071 515.034971 0 ] (cb10) [ 391 0 R /XYZ 84.259843 799.370079 0 ] (cb10-1) [ 391 0 R /XYZ 101.433071 797.673057 0 ] (cb10-10) [ 391 0 R /XYZ 99.933071 627.149864 0 ] (cb10-100) [ 470 0 R /XYZ 99.933071 344.444542 0 ] (cb10-101) [ 470 0 R /XYZ 99.933071 325.497520 0 ] (cb10-102) [ 470 0 R /XYZ 99.933071 306.550499 0 ] (cb10-103) [ 470 0 R /XYZ 99.933071 287.603477 0 ] (cb10-104) [ 470 0 R /XYZ 99.933071 268.656456 0 ] (cb10-105) [ 470 0 R /XYZ 99.933071 249.709434 0 ] (cb10-106) [ 470 0 R /XYZ 99.933071 230.762413 0 ] (cb10-107) [ 470 0 R /XYZ 99.933071 211.815391 0 ] (cb10-108) [ 470 0 R /XYZ 99.933071 192.868370 0 ] (cb10-109) [ 470 0 R /XYZ 99.933071 173.921348 0 ] (cb10-11) [ 391 0 R /XYZ 99.933071 608.202842 0 ] (cb10-110) [ 470 0 R /XYZ 99.933071 154.974327 0 ] (cb10-111) [ 470 0 R /XYZ 99.933071 136.027305 0 ] (cb10-112) [ 470 0 R /XYZ 99.933071 117.080284 0 ] (cb10-113) [ 470 0 R /XYZ 99.933071 98.133262 0 ] (cb10-114) [ 510 0 R /XYZ 99.933071 799.173057 0 ] (cb10-115) [ 510 0 R /XYZ 99.933071 780.226036 0 ] (cb10-116) [ 510 0 R /XYZ 99.933071 761.279014 0 ] (cb10-117) [ 510 0 R /XYZ 99.933071 742.331993 0 ] (cb10-118) [ 510 0 R /XYZ 99.933071 628.649864 0 ] (cb10-119) [ 510 0 R /XYZ 99.933071 609.702842 0 ] (cb10-12) [ 391 0 R /XYZ 99.933071 589.255821 0 ] (cb10-120) [ 510 0 R /XYZ 99.933071 590.755821 0 ] (cb10-121) [ 510 0 R /XYZ 99.933071 571.808799 0 ] (cb10-122) [ 510 0 R /XYZ 99.933071 552.861778 0 ] (cb10-123) [ 510 0 R /XYZ 99.933071 533.914756 0 ] (cb10-124) [ 510 0 R /XYZ 99.933071 514.967735 0 ] (cb10-13) [ 391 0 R /XYZ 99.933071 570.308799 0 ] (cb10-14) [ 391 0 R /XYZ 99.933071 551.361778 0 ] (cb10-15) [ 391 0 R /XYZ 99.933071 532.414756 0 ] (cb10-16) [ 391 0 R /XYZ 99.933071 513.467735 0 ] (cb10-17) [ 391 0 R /XYZ 99.933071 494.520714 0 ] (cb10-18) [ 391 0 R /XYZ 99.933071 475.573692 0 ] (cb10-19) [ 391 0 R /XYZ 99.933071 456.626671 0 ] (cb10-2) [ 391 0 R /XYZ 99.933071 778.726036 0 ] (cb10-20) [ 391 0 R /XYZ 99.933071 437.679649 0 ] (cb10-21) [ 391 0 R /XYZ 99.933071 418.732628 0 ] (cb10-22) [ 391 0 R /XYZ 99.933071 399.785606 0 ] (cb10-23) [ 391 0 R /XYZ 99.933071 380.838585 0 ] (cb10-24) [ 391 0 R /XYZ 99.933071 361.891563 0 ] (cb10-25) [ 391 0 R /XYZ 99.933071 342.944542 0 ] (cb10-26) [ 391 0 R /XYZ 99.933071 323.997520 0 ] (cb10-27) [ 391 0 R /XYZ 99.933071 305.050499 0 ] (cb10-28) [ 391 0 R /XYZ 99.933071 286.103477 0 ] (cb10-29) [ 391 0 R /XYZ 99.933071 267.156456 0 ] (cb10-3) [ 391 0 R /XYZ 99.933071 759.779014 0 ] (cb10-30) [ 391 0 R /XYZ 99.933071 229.262413 0 ] (cb10-31) [ 391 0 R /XYZ 99.933071 210.315391 0 ] (cb10-32) [ 391 0 R /XYZ 99.933071 191.368370 0 ] (cb10-33) [ 391 0 R /XYZ 99.933071 172.421348 0 ] (cb10-34) [ 391 0 R /XYZ 99.933071 153.474327 0 ] (cb10-35) [ 391 0 R /XYZ 99.933071 134.527305 0 ] (cb10-36) [ 391 0 R /XYZ 99.933071 115.580284 0 ] (cb10-37) [ 391 0 R /XYZ 99.933071 96.633262 0 ] (cb10-38) [ 430 0 R /XYZ 99.933071 799.173057 0 ] (cb10-39) [ 430 0 R /XYZ 99.933071 780.226036 0 ] (cb10-4) [ 391 0 R /XYZ 99.933071 740.831993 0 ] (cb10-40) [ 430 0 R /XYZ 99.933071 761.279014 0 ] (cb10-41) [ 430 0 R /XYZ 99.933071 742.331993 0 ] (cb10-42) [ 430 0 R /XYZ 99.933071 723.384971 0 ] (cb10-43) [ 430 0 R /XYZ 99.933071 704.437950 0 ] (cb10-44) [ 430 0 R /XYZ 99.933071 685.490928 0 ] (cb10-45) [ 430 0 R /XYZ 99.933071 666.543907 0 ] (cb10-46) [ 430 0 R /XYZ 99.933071 647.596885 0 ] (cb10-47) [ 430 0 R /XYZ 99.933071 628.649864 0 ] (cb10-48) [ 430 0 R /XYZ 99.933071 609.702842 0 ] (cb10-49) [ 430 0 R /XYZ 99.933071 590.755821 0 ] (cb10-5) [ 391 0 R /XYZ 99.933071 721.884971 0 ] (cb10-50) [ 430 0 R /XYZ 99.933071 571.808799 0 ] (cb10-51) [ 430 0 R /XYZ 99.933071 552.861778 0 ] (cb10-52) [ 430 0 R /XYZ 99.933071 533.914756 0 ] (cb10-53) [ 430 0 R /XYZ 99.933071 514.967735 0 ] (cb10-54) [ 430 0 R /XYZ 99.933071 496.020714 0 ] (cb10-55) [ 430 0 R /XYZ 99.933071 477.073692 0 ] (cb10-56) [ 430 0 R /XYZ 99.933071 458.126671 0 ] (cb10-57) [ 430 0 R /XYZ 99.933071 439.179649 0 ] (cb10-58) [ 430 0 R /XYZ 99.933071 420.232628 0 ] (cb10-59) [ 430 0 R /XYZ 99.933071 401.285606 0 ] (cb10-6) [ 391 0 R /XYZ 99.933071 702.937950 0 ] (cb10-60) [ 430 0 R /XYZ 99.933071 382.338585 0 ] (cb10-61) [ 430 0 R /XYZ 99.933071 363.391563 0 ] (cb10-62) [ 430 0 R /XYZ 99.933071 344.444542 0 ] (cb10-63) [ 430 0 R /XYZ 99.933071 325.497520 0 ] (cb10-64) [ 430 0 R /XYZ 99.933071 306.550499 0 ] (cb10-65) [ 430 0 R /XYZ 99.933071 287.603477 0 ] (cb10-66) [ 430 0 R /XYZ 99.933071 268.656456 0 ] (cb10-67) [ 430 0 R /XYZ 99.933071 249.709434 0 ] (cb10-68) [ 430 0 R /XYZ 99.933071 230.762413 0 ] (cb10-69) [ 430 0 R /XYZ 99.933071 211.815391 0 ] (cb10-7) [ 391 0 R /XYZ 99.933071 683.990928 0 ] (cb10-70) [ 430 0 R /XYZ 99.933071 192.868370 0 ] (cb10-71) [ 430 0 R /XYZ 99.933071 173.921348 0 ] (cb10-72) [ 430 0 R /XYZ 99.933071 154.974327 0 ] (cb10-73) [ 430 0 R /XYZ 99.933071 136.027305 0 ] (cb10-74) [ 430 0 R /XYZ 99.933071 117.080284 0 ] (cb10-75) [ 430 0 R /XYZ 99.933071 98.133262 0 ] (cb10-76) [ 470 0 R /XYZ 99.933071 799.173057 0 ] (cb10-77) [ 470 0 R /XYZ 99.933071 780.226036 0 ] (cb10-78) [ 470 0 R /XYZ 99.933071 761.279014 0 ] (cb10-79) [ 470 0 R /XYZ 99.933071 742.331993 0 ] (cb10-8) [ 391 0 R /XYZ 99.933071 665.043907 0 ] (cb10-80) [ 470 0 R /XYZ 99.933071 723.384971 0 ] (cb10-81) [ 470 0 R /XYZ 99.933071 704.437950 0 ] (cb10-82) [ 470 0 R /XYZ 99.933071 685.490928 0 ] (cb10-83) [ 470 0 R /XYZ 99.933071 666.543907 0 ] (cb10-84) [ 470 0 R /XYZ 99.933071 647.596885 0 ] (cb10-85) [ 470 0 R /XYZ 99.933071 628.649864 0 ] (cb10-86) [ 470 0 R /XYZ 99.933071 609.702842 0 ] (cb10-87) [ 470 0 R /XYZ 99.933071 590.755821 0 ] (cb10-88) [ 470 0 R /XYZ 99.933071 571.808799 0 ] (cb10-89) [ 470 0 R /XYZ 99.933071 552.861778 0 ] (cb10-9) [ 391 0 R /XYZ 99.933071 646.096885 0 ] (cb10-90) [ 470 0 R /XYZ 99.933071 533.914756 0 ] (cb10-91) [ 470 0 R /XYZ 99.933071 514.967735 0 ] (cb10-92) [ 470 0 R /XYZ 99.933071 496.020714 0 ] (cb10-93) [ 470 0 R /XYZ 99.933071 477.073692 0 ] (cb10-94) [ 470 0 R /XYZ 99.933071 458.126671 0 ] (cb10-95) [ 470 0 R /XYZ 99.933071 439.179649 0 ] (cb10-96) [ 470 0 R /XYZ 99.933071 420.232628 0 ] (cb10-97) [ 470 0 R /XYZ 99.933071 401.285606 0 ] (cb10-98) [ 470 0 R /XYZ 99.933071 382.338585 0 ] (cb10-99) [ 470 0 R /XYZ 99.933071 363.391563 0 ] (cb11) [ 510 0 R /XYZ 84.259843 284.621735 0 ] (cb11-1) [ 510 0 R /XYZ 101.433071 282.924714 0 ] (cb11-10) [ 510 0 R /XYZ 99.933071 112.401520 0 ] (cb11-11) [ 510 0 R /XYZ 99.933071 93.454499 0 ] (cb11-12) [ 534 0 R /XYZ 99.933071 799.173057 0 ] (cb11-13) [ 534 0 R /XYZ 99.933071 780.226036 0 ] (cb11-14) [ 534 0 R /XYZ 99.933071 761.279014 0 ] (cb11-15) [ 534 0 R /XYZ 99.933071 742.331993 0 ] (cb11-16) [ 534 0 R /XYZ 99.933071 723.384971 0 ] (cb11-17) [ 534 0 R /XYZ 99.933071 704.437950 0 ] (cb11-18) [ 534 0 R /XYZ 99.933071 685.490928 0 ] (cb11-19) [ 534 0 R /XYZ 99.933071 666.543907 0 ] (cb11-2) [ 510 0 R /XYZ 99.933071 263.977692 0 ] (cb11-20) [ 534 0 R /XYZ 99.933071 647.596885 0 ] (cb11-21) [ 534 0 R /XYZ 99.933071 628.649864 0 ] (cb11-22) [ 534 0 R /XYZ 99.933071 609.702842 0 ] (cb11-23) [ 534 0 R /XYZ 99.933071 590.755821 0 ] (cb11-24) [ 534 0 R /XYZ 99.933071 571.808799 0 ] (cb11-25) [ 534 0 R /XYZ 99.933071 552.861778 0 ] (cb11-3) [ 510 0 R /XYZ 99.933071 245.030671 0 ] (cb11-4) [ 510 0 R /XYZ 99.933071 226.083649 0 ] (cb11-5) [ 510 0 R /XYZ 99.933071 207.136628 0 ] (cb11-6) [ 510 0 R /XYZ 99.933071 188.189606 0 ] (cb11-7) [ 510 0 R /XYZ 99.933071 169.242585 0 ] (cb11-8) [ 510 0 R /XYZ 99.933071 150.295563 0 ] (cb11-9) [ 510 0 R /XYZ 99.933071 131.348542 0 ] (cb12) [ 534 0 R /XYZ 84.259843 449.668756 0 ] (cb12-1) [ 534 0 R /XYZ 101.433071 447.971735 0 ] (cb12-10) [ 534 0 R /XYZ 99.933071 277.448542 0 ] (cb12-11) [ 534 0 R /XYZ 99.933071 258.501520 0 ] (cb12-12) [ 534 0 R /XYZ 99.933071 239.554499 0 ] (cb12-13) [ 534 0 R /XYZ 99.933071 220.607477 0 ] (cb12-14) [ 534 0 R /XYZ 99.933071 201.660456 0 ] (cb12-15) [ 534 0 R /XYZ 99.933071 182.713434 0 ] (cb12-16) [ 534 0 R /XYZ 99.933071 163.766413 0 ] (cb12-17) [ 534 0 R /XYZ 99.933071 144.819391 0 ] (cb12-18) [ 534 0 R /XYZ 99.933071 125.872370 0 ] (cb12-19) [ 568 0 R /XYZ 99.933071 799.173057 0 ] (cb12-2) [ 534 0 R /XYZ 99.933071 429.024714 0 ] (cb12-20) [ 568 0 R /XYZ 99.933071 761.279014 0 ] (cb12-21) [ 568 0 R /XYZ 99.933071 742.331993 0 ] (cb12-22) [ 568 0 R /XYZ 99.933071 723.384971 0 ] (cb12-3) [ 534 0 R /XYZ 99.933071 410.077692 0 ] (cb12-4) [ 534 0 R /XYZ 99.933071 391.130671 0 ] (cb12-5) [ 534 0 R /XYZ 99.933071 372.183649 0 ] (cb12-6) [ 534 0 R /XYZ 99.933071 353.236628 0 ] (cb12-7) [ 534 0 R /XYZ 99.933071 334.289606 0 ] (cb12-8) [ 534 0 R /XYZ 99.933071 315.342585 0 ] (cb12-9) [ 534 0 R /XYZ 99.933071 296.395563 0 ] (cb2) [ 32 0 R /XYZ 84.259843 177.438971 0 ] (cb2-1) [ 32 0 R /XYZ 101.433071 175.741950 0 ] (cb2-2) [ 32 0 R /XYZ 99.933071 156.794928 0 ] (cb3) [ 41 0 R /XYZ 84.259843 799.370079 0 ] (cb3-1) [ 41 0 R /XYZ 101.433071 797.673057 0 ] (cb3-2) [ 41 0 R /XYZ 99.933071 778.726036 0 ] (cb3-3) [ 41 0 R /XYZ 99.933071 759.779014 0 ] (cb3-4) [ 41 0 R /XYZ 99.933071 740.831993 0 ] (cb4) [ 41 0 R /XYZ 84.259843 460.085993 0 ] (cb4-1) [ 41 0 R /XYZ 101.433071 458.388971 0 ] (cb5) [ 41 0 R /XYZ 84.259843 395.388971 0 ] (cb5-1) [ 41 0 R /XYZ 101.433071 393.691950 0 ] (cb5-2) [ 41 0 R /XYZ 99.933071 374.744928 0 ] (cb5-3) [ 41 0 R /XYZ 99.933071 355.797907 0 ] (cb5-4) [ 41 0 R /XYZ 99.933071 336.850885 0 ] (cb5-5) [ 41 0 R /XYZ 99.933071 317.903864 0 ] (cb6) [ 41 0 R /XYZ 84.259843 236.153864 0 ] (cb6-1) [ 41 0 R /XYZ 101.433071 234.456842 0 ] (cb6-2) [ 41 0 R /XYZ 99.933071 215.509821 0 ] (cb6-3) [ 41 0 R /XYZ 99.933071 196.562799 0 ] (cb6-4) [ 41 0 R /XYZ 99.933071 158.668756 0 ] (cb6-5) [ 41 0 R /XYZ 99.933071 120.774714 0 ] (cb7) [ 58 0 R /XYZ 84.259843 300.231496 0 ] (cb7-1) [ 58 0 R /XYZ 101.433071 298.534475 0 ] (cb7-10) [ 58 0 R /XYZ 99.933071 128.011281 0 ] (cb7-11) [ 58 0 R /XYZ 99.933071 109.064260 0 ] (cb7-12) [ 58 0 R /XYZ 99.933071 90.117238 0 ] (cb7-13) [ 75 0 R /XYZ 99.933071 799.173057 0 ] (cb7-14) [ 75 0 R /XYZ 99.933071 780.226036 0 ] (cb7-2) [ 58 0 R /XYZ 99.933071 279.587453 0 ] (cb7-3) [ 58 0 R /XYZ 99.933071 260.640432 0 ] (cb7-4) [ 58 0 R /XYZ 99.933071 241.693410 0 ] (cb7-5) [ 58 0 R /XYZ 99.933071 222.746389 0 ] (cb7-6) [ 58 0 R /XYZ 99.933071 203.799367 0 ] (cb7-7) [ 58 0 R /XYZ 99.933071 184.852346 0 ] (cb7-8) [ 58 0 R /XYZ 99.933071 165.905324 0 ] (cb7-9) [ 58 0 R /XYZ 99.933071 146.958303 0 ] (cb8) [ 75 0 R /XYZ 84.259843 683.476036 0 ] (cb8-1) [ 75 0 R /XYZ 101.433071 681.779014 0 ] (cb8-2) [ 75 0 R /XYZ 99.933071 662.831993 0 ] (cb8-3) [ 75 0 R /XYZ 99.933071 643.884971 0 ] (cb8-4) [ 75 0 R /XYZ 99.933071 605.990928 0 ] (cb8-5) [ 75 0 R /XYZ 99.933071 587.043907 0 ] (cb9) [ 75 0 R /XYZ 84.259843 201.605324 0 ] (cb9-1) [ 75 0 R /XYZ 101.433071 199.908303 0 ] (cb9-10) [ 90 0 R /XYZ 99.933071 685.490928 0 ] (cb9-100) [ 165 0 R /XYZ 99.933071 325.497520 0 ] (cb9-101) [ 165 0 R /XYZ 99.933071 306.550499 0 ] (cb9-102) [ 165 0 R /XYZ 99.933071 287.603477 0 ] (cb9-103) [ 165 0 R /XYZ 99.933071 268.656456 0 ] (cb9-104) [ 165 0 R /XYZ 99.933071 249.709434 0 ] (cb9-105) [ 165 0 R /XYZ 99.933071 230.762413 0 ] (cb9-106) [ 165 0 R /XYZ 99.933071 211.815391 0 ] (cb9-107) [ 165 0 R /XYZ 99.933071 154.974327 0 ] (cb9-108) [ 165 0 R /XYZ 99.933071 136.027305 0 ] (cb9-109) [ 165 0 R /XYZ 99.933071 117.080284 0 ] (cb9-11) [ 90 0 R /XYZ 99.933071 666.543907 0 ] (cb9-110) [ 165 0 R /XYZ 99.933071 98.133262 0 ] (cb9-111) [ 202 0 R /XYZ 99.933071 799.173057 0 ] (cb9-112) [ 202 0 R /XYZ 99.933071 780.226036 0 ] (cb9-113) [ 202 0 R /XYZ 99.933071 742.331993 0 ] (cb9-114) [ 202 0 R /XYZ 99.933071 704.437950 0 ] (cb9-115) [ 202 0 R /XYZ 99.933071 666.543907 0 ] (cb9-116) [ 202 0 R /XYZ 99.933071 647.596885 0 ] (cb9-117) [ 202 0 R /XYZ 99.933071 628.649864 0 ] (cb9-118) [ 202 0 R /XYZ 99.933071 609.702842 0 ] (cb9-119) [ 202 0 R /XYZ 99.933071 590.755821 0 ] (cb9-12) [ 90 0 R /XYZ 99.933071 647.596885 0 ] (cb9-120) [ 202 0 R /XYZ 99.933071 571.808799 0 ] (cb9-121) [ 202 0 R /XYZ 99.933071 552.861778 0 ] (cb9-122) [ 202 0 R /XYZ 99.933071 533.914756 0 ] (cb9-123) [ 202 0 R /XYZ 99.933071 514.967735 0 ] (cb9-124) [ 202 0 R /XYZ 99.933071 496.020714 0 ] (cb9-125) [ 202 0 R /XYZ 99.933071 477.073692 0 ] (cb9-126) [ 202 0 R /XYZ 99.933071 458.126671 0 ] (cb9-127) [ 202 0 R /XYZ 99.933071 439.179649 0 ] (cb9-128) [ 202 0 R /XYZ 99.933071 420.232628 0 ] (cb9-129) [ 202 0 R /XYZ 99.933071 382.338585 0 ] (cb9-13) [ 90 0 R /XYZ 99.933071 628.649864 0 ] (cb9-130) [ 202 0 R /XYZ 99.933071 363.391563 0 ] (cb9-131) [ 202 0 R /XYZ 99.933071 344.444542 0 ] (cb9-132) [ 202 0 R /XYZ 99.933071 325.497520 0 ] (cb9-133) [ 202 0 R /XYZ 99.933071 306.550499 0 ] (cb9-134) [ 202 0 R /XYZ 99.933071 287.603477 0 ] (cb9-135) [ 202 0 R /XYZ 99.933071 268.656456 0 ] (cb9-136) [ 202 0 R /XYZ 99.933071 249.709434 0 ] (cb9-137) [ 202 0 R /XYZ 99.933071 230.762413 0 ] (cb9-138) [ 202 0 R /XYZ 99.933071 211.815391 0 ] (cb9-139) [ 202 0 R /XYZ 99.933071 192.868370 0 ] (cb9-14) [ 90 0 R /XYZ 99.933071 609.702842 0 ] (cb9-140) [ 202 0 R /XYZ 99.933071 154.974327 0 ] (cb9-141) [ 202 0 R /XYZ 99.933071 136.027305 0 ] (cb9-142) [ 202 0 R /XYZ 99.933071 117.080284 0 ] (cb9-143) [ 202 0 R /XYZ 99.933071 98.133262 0 ] (cb9-144) [ 237 0 R /XYZ 99.933071 799.173057 0 ] (cb9-145) [ 237 0 R /XYZ 99.933071 780.226036 0 ] (cb9-146) [ 237 0 R /XYZ 99.933071 761.279014 0 ] (cb9-147) [ 237 0 R /XYZ 99.933071 742.331993 0 ] (cb9-148) [ 237 0 R /XYZ 99.933071 723.384971 0 ] (cb9-149) [ 237 0 R /XYZ 99.933071 704.437950 0 ] (cb9-15) [ 90 0 R /XYZ 99.933071 590.755821 0 ] (cb9-150) [ 237 0 R /XYZ 99.933071 685.490928 0 ] (cb9-151) [ 237 0 R /XYZ 99.933071 666.543907 0 ] (cb9-152) [ 237 0 R /XYZ 99.933071 647.596885 0 ] (cb9-153) [ 237 0 R /XYZ 99.933071 628.649864 0 ] (cb9-154) [ 237 0 R /XYZ 99.933071 609.702842 0 ] (cb9-155) [ 237 0 R /XYZ 99.933071 590.755821 0 ] (cb9-156) [ 237 0 R /XYZ 99.933071 571.808799 0 ] (cb9-157) [ 237 0 R /XYZ 99.933071 552.861778 0 ] (cb9-158) [ 237 0 R /XYZ 99.933071 533.914756 0 ] (cb9-159) [ 237 0 R /XYZ 99.933071 514.967735 0 ] (cb9-16) [ 90 0 R /XYZ 99.933071 571.808799 0 ] (cb9-160) [ 237 0 R /XYZ 99.933071 496.020714 0 ] (cb9-161) [ 237 0 R /XYZ 99.933071 477.073692 0 ] (cb9-162) [ 237 0 R /XYZ 99.933071 458.126671 0 ] (cb9-163) [ 237 0 R /XYZ 99.933071 439.179649 0 ] (cb9-164) [ 237 0 R /XYZ 99.933071 420.232628 0 ] (cb9-165) [ 237 0 R /XYZ 99.933071 401.285606 0 ] (cb9-166) [ 237 0 R /XYZ 99.933071 382.338585 0 ] (cb9-167) [ 237 0 R /XYZ 99.933071 363.391563 0 ] (cb9-168) [ 237 0 R /XYZ 99.933071 344.444542 0 ] (cb9-169) [ 237 0 R /XYZ 99.933071 325.497520 0 ] (cb9-17) [ 90 0 R /XYZ 99.933071 552.861778 0 ] (cb9-170) [ 237 0 R /XYZ 99.933071 306.550499 0 ] (cb9-171) [ 237 0 R /XYZ 99.933071 287.603477 0 ] (cb9-172) [ 237 0 R /XYZ 99.933071 268.656456 0 ] (cb9-173) [ 237 0 R /XYZ 99.933071 249.709434 0 ] (cb9-174) [ 237 0 R /XYZ 99.933071 230.762413 0 ] (cb9-175) [ 237 0 R /XYZ 99.933071 211.815391 0 ] (cb9-176) [ 237 0 R /XYZ 99.933071 192.868370 0 ] (cb9-177) [ 237 0 R /XYZ 99.933071 173.921348 0 ] (cb9-178) [ 237 0 R /XYZ 99.933071 154.974327 0 ] (cb9-179) [ 237 0 R /XYZ 99.933071 136.027305 0 ] (cb9-18) [ 90 0 R /XYZ 99.933071 533.914756 0 ] (cb9-180) [ 237 0 R /XYZ 99.933071 117.080284 0 ] (cb9-181) [ 237 0 R /XYZ 99.933071 98.133262 0 ] (cb9-182) [ 277 0 R /XYZ 99.933071 799.173057 0 ] (cb9-183) [ 277 0 R /XYZ 99.933071 780.226036 0 ] (cb9-184) [ 277 0 R /XYZ 99.933071 761.279014 0 ] (cb9-185) [ 277 0 R /XYZ 99.933071 742.331993 0 ] (cb9-186) [ 277 0 R /XYZ 99.933071 723.384971 0 ] (cb9-187) [ 277 0 R /XYZ 99.933071 704.437950 0 ] (cb9-188) [ 277 0 R /XYZ 99.933071 685.490928 0 ] (cb9-189) [ 277 0 R /XYZ 99.933071 666.543907 0 ] (cb9-19) [ 90 0 R /XYZ 99.933071 514.967735 0 ] (cb9-190) [ 277 0 R /XYZ 99.933071 647.596885 0 ] (cb9-191) [ 277 0 R /XYZ 99.933071 628.649864 0 ] (cb9-192) [ 277 0 R /XYZ 99.933071 609.702842 0 ] (cb9-193) [ 277 0 R /XYZ 99.933071 590.755821 0 ] (cb9-194) [ 277 0 R /XYZ 99.933071 571.808799 0 ] (cb9-195) [ 277 0 R /XYZ 99.933071 552.861778 0 ] (cb9-196) [ 277 0 R /XYZ 99.933071 533.914756 0 ] (cb9-197) [ 277 0 R /XYZ 99.933071 514.967735 0 ] (cb9-198) [ 277 0 R /XYZ 99.933071 496.020714 0 ] (cb9-199) [ 277 0 R /XYZ 99.933071 477.073692 0 ] (cb9-2) [ 75 0 R /XYZ 99.933071 162.014260 0 ] (cb9-20) [ 90 0 R /XYZ 99.933071 496.020714 0 ] (cb9-200) [ 277 0 R /XYZ 99.933071 458.126671 0 ] (cb9-201) [ 277 0 R /XYZ 99.933071 439.179649 0 ] (cb9-202) [ 277 0 R /XYZ 99.933071 420.232628 0 ] (cb9-203) [ 277 0 R /XYZ 99.933071 401.285606 0 ] (cb9-204) [ 277 0 R /XYZ 99.933071 382.338585 0 ] (cb9-205) [ 277 0 R /XYZ 99.933071 363.391563 0 ] (cb9-206) [ 277 0 R /XYZ 99.933071 344.444542 0 ] (cb9-207) [ 277 0 R /XYZ 99.933071 325.497520 0 ] (cb9-208) [ 277 0 R /XYZ 99.933071 306.550499 0 ] (cb9-209) [ 277 0 R /XYZ 99.933071 287.603477 0 ] (cb9-21) [ 90 0 R /XYZ 99.933071 477.073692 0 ] (cb9-210) [ 277 0 R /XYZ 99.933071 268.656456 0 ] (cb9-211) [ 277 0 R /XYZ 99.933071 249.709434 0 ] (cb9-212) [ 277 0 R /XYZ 99.933071 230.762413 0 ] (cb9-213) [ 277 0 R /XYZ 99.933071 211.815391 0 ] (cb9-214) [ 277 0 R /XYZ 99.933071 192.868370 0 ] (cb9-215) [ 277 0 R /XYZ 99.933071 173.921348 0 ] (cb9-216) [ 277 0 R /XYZ 99.933071 154.974327 0 ] (cb9-217) [ 277 0 R /XYZ 99.933071 136.027305 0 ] (cb9-218) [ 277 0 R /XYZ 99.933071 117.080284 0 ] (cb9-219) [ 277 0 R /XYZ 99.933071 98.133262 0 ] (cb9-22) [ 90 0 R /XYZ 99.933071 458.126671 0 ] (cb9-220) [ 317 0 R /XYZ 99.933071 799.173057 0 ] (cb9-221) [ 317 0 R /XYZ 99.933071 780.226036 0 ] (cb9-222) [ 317 0 R /XYZ 99.933071 761.279014 0 ] (cb9-223) [ 317 0 R /XYZ 99.933071 742.331993 0 ] (cb9-224) [ 317 0 R /XYZ 99.933071 723.384971 0 ] (cb9-225) [ 317 0 R /XYZ 99.933071 704.437950 0 ] (cb9-226) [ 317 0 R /XYZ 99.933071 685.490928 0 ] (cb9-227) [ 317 0 R /XYZ 99.933071 666.543907 0 ] (cb9-228) [ 317 0 R /XYZ 99.933071 647.596885 0 ] (cb9-229) [ 317 0 R /XYZ 99.933071 628.649864 0 ] (cb9-23) [ 90 0 R /XYZ 99.933071 439.179649 0 ] (cb9-230) [ 317 0 R /XYZ 99.933071 609.702842 0 ] (cb9-231) [ 317 0 R /XYZ 99.933071 590.755821 0 ] (cb9-232) [ 317 0 R /XYZ 99.933071 571.808799 0 ] (cb9-233) [ 317 0 R /XYZ 99.933071 552.861778 0 ] (cb9-234) [ 317 0 R /XYZ 99.933071 533.914756 0 ] (cb9-235) [ 317 0 R /XYZ 99.933071 514.967735 0 ] (cb9-236) [ 317 0 R /XYZ 99.933071 496.020714 0 ] (cb9-237) [ 317 0 R /XYZ 99.933071 477.073692 0 ] (cb9-238) [ 317 0 R /XYZ 99.933071 458.126671 0 ] (cb9-239) [ 317 0 R /XYZ 99.933071 439.179649 0 ] (cb9-24) [ 90 0 R /XYZ 99.933071 420.232628 0 ] (cb9-240) [ 317 0 R /XYZ 99.933071 420.232628 0 ] (cb9-241) [ 317 0 R /XYZ 99.933071 401.285606 0 ] (cb9-242) [ 317 0 R /XYZ 99.933071 382.338585 0 ] (cb9-243) [ 317 0 R /XYZ 99.933071 363.391563 0 ] (cb9-244) [ 317 0 R /XYZ 99.933071 344.444542 0 ] (cb9-245) [ 317 0 R /XYZ 99.933071 325.497520 0 ] (cb9-246) [ 317 0 R /XYZ 99.933071 306.550499 0 ] (cb9-247) [ 317 0 R /XYZ 99.933071 287.603477 0 ] (cb9-248) [ 317 0 R /XYZ 99.933071 268.656456 0 ] (cb9-249) [ 317 0 R /XYZ 99.933071 249.709434 0 ] (cb9-25) [ 90 0 R /XYZ 99.933071 401.285606 0 ] (cb9-250) [ 317 0 R /XYZ 99.933071 230.762413 0 ] (cb9-251) [ 317 0 R /XYZ 99.933071 211.815391 0 ] (cb9-252) [ 317 0 R /XYZ 99.933071 192.868370 0 ] (cb9-253) [ 317 0 R /XYZ 99.933071 173.921348 0 ] (cb9-254) [ 317 0 R /XYZ 99.933071 154.974327 0 ] (cb9-255) [ 317 0 R /XYZ 99.933071 136.027305 0 ] (cb9-256) [ 317 0 R /XYZ 99.933071 117.080284 0 ] (cb9-257) [ 317 0 R /XYZ 99.933071 98.133262 0 ] (cb9-258) [ 357 0 R /XYZ 99.933071 799.173057 0 ] (cb9-259) [ 357 0 R /XYZ 99.933071 780.226036 0 ] (cb9-26) [ 90 0 R /XYZ 99.933071 382.338585 0 ] (cb9-260) [ 357 0 R /XYZ 99.933071 761.279014 0 ] (cb9-261) [ 357 0 R /XYZ 99.933071 742.331993 0 ] (cb9-262) [ 357 0 R /XYZ 99.933071 723.384971 0 ] (cb9-263) [ 357 0 R /XYZ 99.933071 704.437950 0 ] (cb9-264) [ 357 0 R /XYZ 99.933071 685.490928 0 ] (cb9-265) [ 357 0 R /XYZ 99.933071 666.543907 0 ] (cb9-266) [ 357 0 R /XYZ 99.933071 647.596885 0 ] (cb9-267) [ 357 0 R /XYZ 99.933071 628.649864 0 ] (cb9-268) [ 357 0 R /XYZ 99.933071 609.702842 0 ] (cb9-269) [ 357 0 R /XYZ 99.933071 590.755821 0 ] (cb9-27) [ 90 0 R /XYZ 99.933071 363.391563 0 ] (cb9-270) [ 357 0 R /XYZ 99.933071 571.808799 0 ] (cb9-271) [ 357 0 R /XYZ 99.933071 552.861778 0 ] (cb9-272) [ 357 0 R /XYZ 99.933071 533.914756 0 ] (cb9-273) [ 357 0 R /XYZ 99.933071 514.967735 0 ] (cb9-274) [ 357 0 R /XYZ 99.933071 496.020714 0 ] (cb9-275) [ 357 0 R /XYZ 99.933071 477.073692 0 ] (cb9-276) [ 357 0 R /XYZ 99.933071 458.126671 0 ] (cb9-277) [ 357 0 R /XYZ 99.933071 439.179649 0 ] (cb9-278) [ 357 0 R /XYZ 99.933071 420.232628 0 ] (cb9-279) [ 357 0 R /XYZ 99.933071 401.285606 0 ] (cb9-28) [ 90 0 R /XYZ 99.933071 344.444542 0 ] (cb9-280) [ 357 0 R /XYZ 99.933071 382.338585 0 ] (cb9-281) [ 357 0 R /XYZ 99.933071 363.391563 0 ] (cb9-282) [ 357 0 R /XYZ 99.933071 344.444542 0 ] (cb9-283) [ 357 0 R /XYZ 99.933071 325.497520 0 ] (cb9-284) [ 357 0 R /XYZ 99.933071 306.550499 0 ] (cb9-285) [ 357 0 R /XYZ 99.933071 287.603477 0 ] (cb9-286) [ 357 0 R /XYZ 99.933071 268.656456 0 ] (cb9-287) [ 357 0 R /XYZ 99.933071 249.709434 0 ] (cb9-288) [ 357 0 R /XYZ 99.933071 230.762413 0 ] (cb9-29) [ 90 0 R /XYZ 99.933071 325.497520 0 ] (cb9-3) [ 75 0 R /XYZ 99.933071 124.120217 0 ] (cb9-30) [ 90 0 R /XYZ 99.933071 306.550499 0 ] (cb9-31) [ 90 0 R /XYZ 99.933071 287.603477 0 ] (cb9-32) [ 90 0 R /XYZ 99.933071 268.656456 0 ] (cb9-33) [ 90 0 R /XYZ 99.933071 249.709434 0 ] (cb9-34) [ 90 0 R /XYZ 99.933071 230.762413 0 ] (cb9-35) [ 90 0 R /XYZ 99.933071 211.815391 0 ] (cb9-36) [ 90 0 R /XYZ 99.933071 192.868370 0 ] (cb9-37) [ 90 0 R /XYZ 99.933071 173.921348 0 ] (cb9-38) [ 90 0 R /XYZ 99.933071 154.974327 0 ] (cb9-39) [ 90 0 R /XYZ 99.933071 136.027305 0 ] (cb9-4) [ 75 0 R /XYZ 99.933071 105.173195 0 ] (cb9-40) [ 90 0 R /XYZ 99.933071 117.080284 0 ] (cb9-41) [ 90 0 R /XYZ 99.933071 98.133262 0 ] (cb9-42) [ 129 0 R /XYZ 99.933071 799.173057 0 ] (cb9-43) [ 129 0 R /XYZ 99.933071 780.226036 0 ] (cb9-44) [ 129 0 R /XYZ 99.933071 761.279014 0 ] (cb9-45) [ 129 0 R /XYZ 99.933071 742.331993 0 ] (cb9-46) [ 129 0 R /XYZ 99.933071 723.384971 0 ] (cb9-47) [ 129 0 R /XYZ 99.933071 704.437950 0 ] (cb9-48) [ 129 0 R /XYZ 99.933071 685.490928 0 ] (cb9-49) [ 129 0 R /XYZ 99.933071 666.543907 0 ] (cb9-5) [ 90 0 R /XYZ 99.933071 799.173057 0 ] (cb9-50) [ 129 0 R /XYZ 99.933071 647.596885 0 ] (cb9-51) [ 129 0 R /XYZ 99.933071 628.649864 0 ] (cb9-52) [ 129 0 R /XYZ 99.933071 609.702842 0 ] (cb9-53) [ 129 0 R /XYZ 99.933071 590.755821 0 ] (cb9-54) [ 129 0 R /XYZ 99.933071 571.808799 0 ] (cb9-55) [ 129 0 R /XYZ 99.933071 552.861778 0 ] (cb9-56) [ 129 0 R /XYZ 99.933071 533.914756 0 ] (cb9-57) [ 129 0 R /XYZ 99.933071 514.967735 0 ] (cb9-58) [ 129 0 R /XYZ 99.933071 496.020714 0 ] (cb9-59) [ 129 0 R /XYZ 99.933071 477.073692 0 ] (cb9-6) [ 90 0 R /XYZ 99.933071 761.279014 0 ] (cb9-60) [ 129 0 R /XYZ 99.933071 458.126671 0 ] (cb9-61) [ 129 0 R /XYZ 99.933071 439.179649 0 ] (cb9-62) [ 129 0 R /XYZ 99.933071 420.232628 0 ] (cb9-63) [ 129 0 R /XYZ 99.933071 401.285606 0 ] (cb9-64) [ 129 0 R /XYZ 99.933071 382.338585 0 ] (cb9-65) [ 129 0 R /XYZ 99.933071 363.391563 0 ] (cb9-66) [ 129 0 R /XYZ 99.933071 344.444542 0 ] (cb9-67) [ 129 0 R /XYZ 99.933071 325.497520 0 ] (cb9-68) [ 129 0 R /XYZ 99.933071 306.550499 0 ] (cb9-69) [ 129 0 R /XYZ 99.933071 287.603477 0 ] (cb9-7) [ 90 0 R /XYZ 99.933071 742.331993 0 ] (cb9-70) [ 129 0 R /XYZ 99.933071 268.656456 0 ] (cb9-71) [ 129 0 R /XYZ 99.933071 249.709434 0 ] (cb9-72) [ 129 0 R /XYZ 99.933071 230.762413 0 ] (cb9-73) [ 129 0 R /XYZ 99.933071 211.815391 0 ] (cb9-74) [ 129 0 R /XYZ 99.933071 192.868370 0 ] (cb9-75) [ 129 0 R /XYZ 99.933071 173.921348 0 ] (cb9-76) [ 165 0 R /XYZ 99.933071 780.226036 0 ] (cb9-77) [ 165 0 R /XYZ 99.933071 761.279014 0 ] (cb9-78) [ 165 0 R /XYZ 99.933071 742.331993 0 ] (cb9-79) [ 165 0 R /XYZ 99.933071 723.384971 0 ] (cb9-8) [ 90 0 R /XYZ 99.933071 723.384971 0 ] (cb9-80) [ 165 0 R /XYZ 99.933071 704.437950 0 ] (cb9-81) [ 165 0 R /XYZ 99.933071 685.490928 0 ] (cb9-82) [ 165 0 R /XYZ 99.933071 666.543907 0 ] (cb9-83) [ 165 0 R /XYZ 99.933071 647.596885 0 ] (cb9-84) [ 165 0 R /XYZ 99.933071 628.649864 0 ] (cb9-85) [ 165 0 R /XYZ 99.933071 609.702842 0 ] (cb9-86) [ 165 0 R /XYZ 99.933071 590.755821 0 ] (cb9-87) [ 165 0 R /XYZ 99.933071 571.808799 0 ] (cb9-88) [ 165 0 R /XYZ 99.933071 552.861778 0 ] (cb9-89) [ 165 0 R /XYZ 99.933071 533.914756 0 ] (cb9-9) [ 90 0 R /XYZ 99.933071 704.437950 0 ] (cb9-90) [ 165 0 R /XYZ 99.933071 514.967735 0 ] (cb9-91) [ 165 0 R /XYZ 99.933071 496.020714 0 ] (cb9-92) [ 165 0 R /XYZ 99.933071 477.073692 0 ] (cb9-93) [ 165 0 R /XYZ 99.933071 458.126671 0 ] (cb9-94) [ 165 0 R /XYZ 99.933071 439.179649 0 ] (cb9-95) [ 165 0 R /XYZ 99.933071 420.232628 0 ] (cb9-96) [ 165 0 R /XYZ 99.933071 401.285606 0 ] (cb9-97) [ 165 0 R /XYZ 99.933071 382.338585 0 ] (cb9-98) [ 165 0 R /XYZ 99.933071 363.391563 0 ] (cb9-99) [ 165 0 R /XYZ 99.933071 344.444542 0 ] (configure-etcd-user-and-group) [ 32 0 R /XYZ 84.259843 432.234971 0 ] (configure-kernel-runtime-parameters) [ 32 0 R /XYZ 84.259843 692.570079 0 ] (contentsbox) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (create-etcd-user-and-group) [ 32 0 R /XYZ 84.259843 315.936971 0 ] (ensure-that-all-namespaces-have-network-policies-defined) [ 58 0 R /XYZ 84.259843 799.370079 0 ] (header_bottom_text) [ 6 0 R /XYZ 85.009843 422.718898 0 ] (known-issues) [ 27 0 R /XYZ 84.259843 213.933496 0 ] (overview) [ 27 0 R /XYZ 84.259843 413.481496 0 ] (reference-hardened-cloud-config) [ 510 0 R /XYZ 84.259843 477.917735 0 ] (reference-hardened-cloud-config-for-suse-linux-enterprise-server-15-sles-15) [ 510 0 R /XYZ 84.259843 350.369735 0 ] (reference-hardened-cloud-config-for-ubuntu-20.04-lts) [ 534 0 R /XYZ 84.259843 492.916756 0 ] (reference-hardened-rke-cluster.yml-configuration) [ 75 0 R /XYZ 84.259843 500.493907 0 ] (reference-hardened-rke-template-configuration) [ 357 0 R /XYZ 84.259843 193.712413 0 ] (set-automountserviceaccounttoken-to-false-for-default-service-accounts) [ 41 0 R /XYZ 84.259843 699.833993 0 ] (title-block-header) [ 6 0 R /XYZ 84.259843 502.818898 0 ] ] +/Names [ (TOC) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (cb1) [ 45 0 R /XYZ 84.259843 441.572079 0 ] (cb1-1) [ 45 0 R /XYZ 101.433071 439.875057 0 ] (cb1-2) [ 45 0 R /XYZ 99.933071 420.928036 0 ] (cb1-3) [ 45 0 R /XYZ 99.933071 401.981014 0 ] (cb1-4) [ 45 0 R /XYZ 99.933071 383.033993 0 ] (cb1-5) [ 45 0 R /XYZ 99.933071 364.086971 0 ] (cb10) [ 400 0 R /XYZ 84.259843 697.970079 0 ] (cb10-1) [ 400 0 R /XYZ 101.433071 696.273057 0 ] (cb10-10) [ 400 0 R /XYZ 99.933071 525.749864 0 ] (cb10-100) [ 475 0 R /XYZ 99.933071 249.709434 0 ] (cb10-101) [ 475 0 R /XYZ 99.933071 230.762413 0 ] (cb10-102) [ 475 0 R /XYZ 99.933071 211.815391 0 ] (cb10-103) [ 475 0 R /XYZ 99.933071 192.868370 0 ] (cb10-104) [ 475 0 R /XYZ 99.933071 173.921348 0 ] (cb10-105) [ 475 0 R /XYZ 99.933071 154.974327 0 ] (cb10-106) [ 475 0 R /XYZ 99.933071 136.027305 0 ] (cb10-107) [ 475 0 R /XYZ 99.933071 117.080284 0 ] (cb10-108) [ 475 0 R /XYZ 99.933071 98.133262 0 ] (cb10-109) [ 515 0 R /XYZ 99.933071 799.173057 0 ] (cb10-11) [ 400 0 R /XYZ 99.933071 506.802842 0 ] (cb10-110) [ 515 0 R /XYZ 99.933071 780.226036 0 ] (cb10-111) [ 515 0 R /XYZ 99.933071 761.279014 0 ] (cb10-112) [ 515 0 R /XYZ 99.933071 742.331993 0 ] (cb10-113) [ 515 0 R /XYZ 99.933071 723.384971 0 ] (cb10-114) [ 515 0 R /XYZ 99.933071 704.437950 0 ] (cb10-115) [ 515 0 R /XYZ 99.933071 685.490928 0 ] (cb10-116) [ 515 0 R /XYZ 99.933071 666.543907 0 ] (cb10-117) [ 515 0 R /XYZ 99.933071 647.596885 0 ] (cb10-118) [ 515 0 R /XYZ 99.933071 533.914756 0 ] (cb10-119) [ 515 0 R /XYZ 99.933071 514.967735 0 ] (cb10-12) [ 400 0 R /XYZ 99.933071 487.855821 0 ] (cb10-120) [ 515 0 R /XYZ 99.933071 496.020714 0 ] (cb10-121) [ 515 0 R /XYZ 99.933071 477.073692 0 ] (cb10-122) [ 515 0 R /XYZ 99.933071 458.126671 0 ] (cb10-123) [ 515 0 R /XYZ 99.933071 439.179649 0 ] (cb10-124) [ 515 0 R /XYZ 99.933071 420.232628 0 ] (cb10-13) [ 400 0 R /XYZ 99.933071 468.908799 0 ] (cb10-14) [ 400 0 R /XYZ 99.933071 449.961778 0 ] (cb10-15) [ 400 0 R /XYZ 99.933071 431.014756 0 ] (cb10-16) [ 400 0 R /XYZ 99.933071 412.067735 0 ] (cb10-17) [ 400 0 R /XYZ 99.933071 393.120714 0 ] (cb10-18) [ 400 0 R /XYZ 99.933071 374.173692 0 ] (cb10-19) [ 400 0 R /XYZ 99.933071 355.226671 0 ] (cb10-2) [ 400 0 R /XYZ 99.933071 677.326036 0 ] (cb10-20) [ 400 0 R /XYZ 99.933071 336.279649 0 ] (cb10-21) [ 400 0 R /XYZ 99.933071 317.332628 0 ] (cb10-22) [ 400 0 R /XYZ 99.933071 298.385606 0 ] (cb10-23) [ 400 0 R /XYZ 99.933071 279.438585 0 ] (cb10-24) [ 400 0 R /XYZ 99.933071 260.491563 0 ] (cb10-25) [ 400 0 R /XYZ 99.933071 241.544542 0 ] (cb10-26) [ 400 0 R /XYZ 99.933071 222.597520 0 ] (cb10-27) [ 400 0 R /XYZ 99.933071 203.650499 0 ] (cb10-28) [ 400 0 R /XYZ 99.933071 184.703477 0 ] (cb10-29) [ 400 0 R /XYZ 99.933071 165.756456 0 ] (cb10-3) [ 400 0 R /XYZ 99.933071 658.379014 0 ] (cb10-30) [ 400 0 R /XYZ 99.933071 127.862413 0 ] (cb10-31) [ 400 0 R /XYZ 99.933071 108.915391 0 ] (cb10-32) [ 400 0 R /XYZ 99.933071 89.968370 0 ] (cb10-33) [ 435 0 R /XYZ 99.933071 799.173057 0 ] (cb10-34) [ 435 0 R /XYZ 99.933071 780.226036 0 ] (cb10-35) [ 435 0 R /XYZ 99.933071 761.279014 0 ] (cb10-36) [ 435 0 R /XYZ 99.933071 742.331993 0 ] (cb10-37) [ 435 0 R /XYZ 99.933071 723.384971 0 ] (cb10-38) [ 435 0 R /XYZ 99.933071 704.437950 0 ] (cb10-39) [ 435 0 R /XYZ 99.933071 685.490928 0 ] (cb10-4) [ 400 0 R /XYZ 99.933071 639.431993 0 ] (cb10-40) [ 435 0 R /XYZ 99.933071 666.543907 0 ] (cb10-41) [ 435 0 R /XYZ 99.933071 647.596885 0 ] (cb10-42) [ 435 0 R /XYZ 99.933071 628.649864 0 ] (cb10-43) [ 435 0 R /XYZ 99.933071 609.702842 0 ] (cb10-44) [ 435 0 R /XYZ 99.933071 590.755821 0 ] (cb10-45) [ 435 0 R /XYZ 99.933071 571.808799 0 ] (cb10-46) [ 435 0 R /XYZ 99.933071 552.861778 0 ] (cb10-47) [ 435 0 R /XYZ 99.933071 533.914756 0 ] (cb10-48) [ 435 0 R /XYZ 99.933071 514.967735 0 ] (cb10-49) [ 435 0 R /XYZ 99.933071 496.020714 0 ] (cb10-5) [ 400 0 R /XYZ 99.933071 620.484971 0 ] (cb10-50) [ 435 0 R /XYZ 99.933071 477.073692 0 ] (cb10-51) [ 435 0 R /XYZ 99.933071 458.126671 0 ] (cb10-52) [ 435 0 R /XYZ 99.933071 439.179649 0 ] (cb10-53) [ 435 0 R /XYZ 99.933071 420.232628 0 ] (cb10-54) [ 435 0 R /XYZ 99.933071 401.285606 0 ] (cb10-55) [ 435 0 R /XYZ 99.933071 382.338585 0 ] (cb10-56) [ 435 0 R /XYZ 99.933071 363.391563 0 ] (cb10-57) [ 435 0 R /XYZ 99.933071 344.444542 0 ] (cb10-58) [ 435 0 R /XYZ 99.933071 325.497520 0 ] (cb10-59) [ 435 0 R /XYZ 99.933071 306.550499 0 ] (cb10-6) [ 400 0 R /XYZ 99.933071 601.537950 0 ] (cb10-60) [ 435 0 R /XYZ 99.933071 287.603477 0 ] (cb10-61) [ 435 0 R /XYZ 99.933071 268.656456 0 ] (cb10-62) [ 435 0 R /XYZ 99.933071 249.709434 0 ] (cb10-63) [ 435 0 R /XYZ 99.933071 230.762413 0 ] (cb10-64) [ 435 0 R /XYZ 99.933071 211.815391 0 ] (cb10-65) [ 435 0 R /XYZ 99.933071 192.868370 0 ] (cb10-66) [ 435 0 R /XYZ 99.933071 173.921348 0 ] (cb10-67) [ 435 0 R /XYZ 99.933071 154.974327 0 ] (cb10-68) [ 435 0 R /XYZ 99.933071 136.027305 0 ] (cb10-69) [ 435 0 R /XYZ 99.933071 117.080284 0 ] (cb10-7) [ 400 0 R /XYZ 99.933071 582.590928 0 ] (cb10-70) [ 435 0 R /XYZ 99.933071 98.133262 0 ] (cb10-71) [ 475 0 R /XYZ 99.933071 799.173057 0 ] (cb10-72) [ 475 0 R /XYZ 99.933071 780.226036 0 ] (cb10-73) [ 475 0 R /XYZ 99.933071 761.279014 0 ] (cb10-74) [ 475 0 R /XYZ 99.933071 742.331993 0 ] (cb10-75) [ 475 0 R /XYZ 99.933071 723.384971 0 ] (cb10-76) [ 475 0 R /XYZ 99.933071 704.437950 0 ] (cb10-77) [ 475 0 R /XYZ 99.933071 685.490928 0 ] (cb10-78) [ 475 0 R /XYZ 99.933071 666.543907 0 ] (cb10-79) [ 475 0 R /XYZ 99.933071 647.596885 0 ] (cb10-8) [ 400 0 R /XYZ 99.933071 563.643907 0 ] (cb10-80) [ 475 0 R /XYZ 99.933071 628.649864 0 ] (cb10-81) [ 475 0 R /XYZ 99.933071 609.702842 0 ] (cb10-82) [ 475 0 R /XYZ 99.933071 590.755821 0 ] (cb10-83) [ 475 0 R /XYZ 99.933071 571.808799 0 ] (cb10-84) [ 475 0 R /XYZ 99.933071 552.861778 0 ] (cb10-85) [ 475 0 R /XYZ 99.933071 533.914756 0 ] (cb10-86) [ 475 0 R /XYZ 99.933071 514.967735 0 ] (cb10-87) [ 475 0 R /XYZ 99.933071 496.020714 0 ] (cb10-88) [ 475 0 R /XYZ 99.933071 477.073692 0 ] (cb10-89) [ 475 0 R /XYZ 99.933071 458.126671 0 ] (cb10-9) [ 400 0 R /XYZ 99.933071 544.696885 0 ] (cb10-90) [ 475 0 R /XYZ 99.933071 439.179649 0 ] (cb10-91) [ 475 0 R /XYZ 99.933071 420.232628 0 ] (cb10-92) [ 475 0 R /XYZ 99.933071 401.285606 0 ] (cb10-93) [ 475 0 R /XYZ 99.933071 382.338585 0 ] (cb10-94) [ 475 0 R /XYZ 99.933071 363.391563 0 ] (cb10-95) [ 475 0 R /XYZ 99.933071 344.444542 0 ] (cb10-96) [ 475 0 R /XYZ 99.933071 325.497520 0 ] (cb10-97) [ 475 0 R /XYZ 99.933071 306.550499 0 ] (cb10-98) [ 475 0 R /XYZ 99.933071 287.603477 0 ] (cb10-99) [ 475 0 R /XYZ 99.933071 268.656456 0 ] (cb11) [ 515 0 R /XYZ 84.259843 179.686628 0 ] (cb11-1) [ 515 0 R /XYZ 101.433071 177.989606 0 ] (cb11-10) [ 538 0 R /XYZ 99.933071 723.384971 0 ] (cb11-11) [ 538 0 R /XYZ 99.933071 704.437950 0 ] (cb11-12) [ 538 0 R /XYZ 99.933071 685.490928 0 ] (cb11-13) [ 538 0 R /XYZ 99.933071 666.543907 0 ] (cb11-14) [ 538 0 R /XYZ 99.933071 647.596885 0 ] (cb11-15) [ 538 0 R /XYZ 99.933071 628.649864 0 ] (cb11-16) [ 538 0 R /XYZ 99.933071 609.702842 0 ] (cb11-17) [ 538 0 R /XYZ 99.933071 590.755821 0 ] (cb11-18) [ 538 0 R /XYZ 99.933071 571.808799 0 ] (cb11-19) [ 538 0 R /XYZ 99.933071 552.861778 0 ] (cb11-2) [ 515 0 R /XYZ 99.933071 159.042585 0 ] (cb11-20) [ 538 0 R /XYZ 99.933071 533.914756 0 ] (cb11-21) [ 538 0 R /XYZ 99.933071 514.967735 0 ] (cb11-22) [ 538 0 R /XYZ 99.933071 496.020714 0 ] (cb11-23) [ 538 0 R /XYZ 99.933071 477.073692 0 ] (cb11-24) [ 538 0 R /XYZ 99.933071 458.126671 0 ] (cb11-25) [ 538 0 R /XYZ 99.933071 439.179649 0 ] (cb11-26) [ 538 0 R /XYZ 99.933071 420.232628 0 ] (cb11-3) [ 515 0 R /XYZ 99.933071 140.095563 0 ] (cb11-4) [ 515 0 R /XYZ 99.933071 121.148542 0 ] (cb11-5) [ 515 0 R /XYZ 99.933071 102.201520 0 ] (cb11-6) [ 538 0 R /XYZ 99.933071 799.173057 0 ] (cb11-7) [ 538 0 R /XYZ 99.933071 780.226036 0 ] (cb11-8) [ 538 0 R /XYZ 99.933071 761.279014 0 ] (cb11-9) [ 538 0 R /XYZ 99.933071 742.331993 0 ] (cb12) [ 538 0 R /XYZ 84.259843 294.539606 0 ] (cb12-1) [ 538 0 R /XYZ 101.433071 292.842585 0 ] (cb12-10) [ 538 0 R /XYZ 99.933071 122.319391 0 ] (cb12-11) [ 538 0 R /XYZ 99.933071 103.372370 0 ] (cb12-12) [ 572 0 R /XYZ 99.933071 799.173057 0 ] (cb12-13) [ 572 0 R /XYZ 99.933071 780.226036 0 ] (cb12-14) [ 572 0 R /XYZ 99.933071 761.279014 0 ] (cb12-15) [ 572 0 R /XYZ 99.933071 742.331993 0 ] (cb12-16) [ 572 0 R /XYZ 99.933071 723.384971 0 ] (cb12-17) [ 572 0 R /XYZ 99.933071 704.437950 0 ] (cb12-18) [ 572 0 R /XYZ 99.933071 685.490928 0 ] (cb12-19) [ 572 0 R /XYZ 99.933071 666.543907 0 ] (cb12-2) [ 538 0 R /XYZ 99.933071 273.895563 0 ] (cb12-20) [ 572 0 R /XYZ 99.933071 628.649864 0 ] (cb12-21) [ 572 0 R /XYZ 99.933071 590.755821 0 ] (cb12-22) [ 572 0 R /XYZ 99.933071 571.808799 0 ] (cb12-23) [ 572 0 R /XYZ 99.933071 552.861778 0 ] (cb12-3) [ 538 0 R /XYZ 99.933071 254.948542 0 ] (cb12-4) [ 538 0 R /XYZ 99.933071 236.001520 0 ] (cb12-5) [ 538 0 R /XYZ 99.933071 217.054499 0 ] (cb12-6) [ 538 0 R /XYZ 99.933071 198.107477 0 ] (cb12-7) [ 538 0 R /XYZ 99.933071 179.160456 0 ] (cb12-8) [ 538 0 R /XYZ 99.933071 160.213434 0 ] (cb12-9) [ 538 0 R /XYZ 99.933071 141.266413 0 ] (cb2) [ 53 0 R /XYZ 84.259843 753.620079 0 ] (cb2-1) [ 53 0 R /XYZ 101.433071 751.923057 0 ] (cb2-2) [ 53 0 R /XYZ 99.933071 732.976036 0 ] (cb3) [ 53 0 R /XYZ 84.259843 654.779014 0 ] (cb3-1) [ 53 0 R /XYZ 101.433071 653.081993 0 ] (cb3-2) [ 53 0 R /XYZ 99.933071 634.134971 0 ] (cb3-3) [ 53 0 R /XYZ 99.933071 615.187950 0 ] (cb3-4) [ 53 0 R /XYZ 99.933071 596.240928 0 ] (cb4) [ 53 0 R /XYZ 84.259843 282.344928 0 ] (cb4-1) [ 53 0 R /XYZ 101.433071 280.647907 0 ] (cb5) [ 53 0 R /XYZ 84.259843 217.647907 0 ] (cb5-1) [ 53 0 R /XYZ 101.433071 215.950885 0 ] (cb5-2) [ 53 0 R /XYZ 99.933071 197.003864 0 ] (cb5-3) [ 53 0 R /XYZ 99.933071 178.056842 0 ] (cb5-4) [ 53 0 R /XYZ 99.933071 159.109821 0 ] (cb5-5) [ 53 0 R /XYZ 99.933071 140.162799 0 ] (cb6) [ 67 0 R /XYZ 84.259843 749.870079 0 ] (cb6-1) [ 67 0 R /XYZ 101.433071 748.173057 0 ] (cb6-2) [ 67 0 R /XYZ 99.933071 729.226036 0 ] (cb6-3) [ 67 0 R /XYZ 99.933071 710.279014 0 ] (cb6-4) [ 67 0 R /XYZ 99.933071 672.384971 0 ] (cb6-5) [ 67 0 R /XYZ 99.933071 634.490928 0 ] (cb7) [ 77 0 R /XYZ 84.259843 716.781496 0 ] (cb7-1) [ 77 0 R /XYZ 101.433071 715.084475 0 ] (cb7-10) [ 77 0 R /XYZ 99.933071 544.561281 0 ] (cb7-11) [ 77 0 R /XYZ 99.933071 525.614260 0 ] (cb7-12) [ 77 0 R /XYZ 99.933071 506.667238 0 ] (cb7-13) [ 77 0 R /XYZ 99.933071 487.720217 0 ] (cb7-14) [ 77 0 R /XYZ 99.933071 468.773195 0 ] (cb7-2) [ 77 0 R /XYZ 99.933071 696.137453 0 ] (cb7-3) [ 77 0 R /XYZ 99.933071 677.190432 0 ] (cb7-4) [ 77 0 R /XYZ 99.933071 658.243410 0 ] (cb7-5) [ 77 0 R /XYZ 99.933071 639.296389 0 ] (cb7-6) [ 77 0 R /XYZ 99.933071 620.349367 0 ] (cb7-7) [ 77 0 R /XYZ 99.933071 601.402346 0 ] (cb7-8) [ 77 0 R /XYZ 99.933071 582.455324 0 ] (cb7-9) [ 77 0 R /XYZ 99.933071 563.508303 0 ] (cb8) [ 77 0 R /XYZ 84.259843 372.023195 0 ] (cb8-1) [ 77 0 R /XYZ 101.433071 370.326174 0 ] (cb8-2) [ 77 0 R /XYZ 99.933071 351.379152 0 ] (cb8-3) [ 77 0 R /XYZ 99.933071 332.432131 0 ] (cb8-4) [ 77 0 R /XYZ 99.933071 294.538088 0 ] (cb8-5) [ 77 0 R /XYZ 99.933071 275.591066 0 ] (cb9) [ 99 0 R /XYZ 84.259843 652.281496 0 ] (cb9-1) [ 99 0 R /XYZ 101.433071 650.584475 0 ] (cb9-10) [ 99 0 R /XYZ 99.933071 423.220217 0 ] (cb9-100) [ 204 0 R /XYZ 99.933071 780.226036 0 ] (cb9-101) [ 204 0 R /XYZ 99.933071 761.279014 0 ] (cb9-102) [ 204 0 R /XYZ 99.933071 742.331993 0 ] (cb9-103) [ 204 0 R /XYZ 99.933071 723.384971 0 ] (cb9-104) [ 204 0 R /XYZ 99.933071 704.437950 0 ] (cb9-105) [ 204 0 R /XYZ 99.933071 685.490928 0 ] (cb9-106) [ 204 0 R /XYZ 99.933071 666.543907 0 ] (cb9-107) [ 204 0 R /XYZ 99.933071 609.702842 0 ] (cb9-108) [ 204 0 R /XYZ 99.933071 590.755821 0 ] (cb9-109) [ 204 0 R /XYZ 99.933071 571.808799 0 ] (cb9-11) [ 99 0 R /XYZ 99.933071 404.273195 0 ] (cb9-110) [ 204 0 R /XYZ 99.933071 552.861778 0 ] (cb9-111) [ 204 0 R /XYZ 99.933071 533.914756 0 ] (cb9-112) [ 204 0 R /XYZ 99.933071 514.967735 0 ] (cb9-113) [ 204 0 R /XYZ 99.933071 496.020714 0 ] (cb9-114) [ 204 0 R /XYZ 99.933071 477.073692 0 ] (cb9-115) [ 204 0 R /XYZ 99.933071 458.126671 0 ] (cb9-116) [ 204 0 R /XYZ 99.933071 439.179649 0 ] (cb9-117) [ 204 0 R /XYZ 99.933071 420.232628 0 ] (cb9-118) [ 204 0 R /XYZ 99.933071 401.285606 0 ] (cb9-119) [ 204 0 R /XYZ 99.933071 382.338585 0 ] (cb9-12) [ 99 0 R /XYZ 99.933071 385.326174 0 ] (cb9-120) [ 204 0 R /XYZ 99.933071 363.391563 0 ] (cb9-121) [ 204 0 R /XYZ 99.933071 344.444542 0 ] (cb9-122) [ 204 0 R /XYZ 99.933071 325.497520 0 ] (cb9-123) [ 204 0 R /XYZ 99.933071 306.550499 0 ] (cb9-124) [ 204 0 R /XYZ 99.933071 287.603477 0 ] (cb9-125) [ 204 0 R /XYZ 99.933071 249.709434 0 ] (cb9-126) [ 204 0 R /XYZ 99.933071 230.762413 0 ] (cb9-127) [ 204 0 R /XYZ 99.933071 211.815391 0 ] (cb9-128) [ 204 0 R /XYZ 99.933071 192.868370 0 ] (cb9-129) [ 204 0 R /XYZ 99.933071 173.921348 0 ] (cb9-13) [ 99 0 R /XYZ 99.933071 366.379152 0 ] (cb9-130) [ 204 0 R /XYZ 99.933071 154.974327 0 ] (cb9-131) [ 204 0 R /XYZ 99.933071 136.027305 0 ] (cb9-132) [ 204 0 R /XYZ 99.933071 117.080284 0 ] (cb9-133) [ 204 0 R /XYZ 99.933071 98.133262 0 ] (cb9-134) [ 241 0 R /XYZ 99.933071 799.173057 0 ] (cb9-135) [ 241 0 R /XYZ 99.933071 780.226036 0 ] (cb9-136) [ 241 0 R /XYZ 99.933071 742.331993 0 ] (cb9-137) [ 241 0 R /XYZ 99.933071 723.384971 0 ] (cb9-138) [ 241 0 R /XYZ 99.933071 704.437950 0 ] (cb9-139) [ 241 0 R /XYZ 99.933071 685.490928 0 ] (cb9-14) [ 99 0 R /XYZ 99.933071 347.432131 0 ] (cb9-140) [ 241 0 R /XYZ 99.933071 666.543907 0 ] (cb9-141) [ 241 0 R /XYZ 99.933071 647.596885 0 ] (cb9-142) [ 241 0 R /XYZ 99.933071 628.649864 0 ] (cb9-143) [ 241 0 R /XYZ 99.933071 609.702842 0 ] (cb9-144) [ 241 0 R /XYZ 99.933071 590.755821 0 ] (cb9-145) [ 241 0 R /XYZ 99.933071 571.808799 0 ] (cb9-146) [ 241 0 R /XYZ 99.933071 552.861778 0 ] (cb9-147) [ 241 0 R /XYZ 99.933071 533.914756 0 ] (cb9-148) [ 241 0 R /XYZ 99.933071 514.967735 0 ] (cb9-149) [ 241 0 R /XYZ 99.933071 496.020714 0 ] (cb9-15) [ 99 0 R /XYZ 99.933071 328.485109 0 ] (cb9-150) [ 241 0 R /XYZ 99.933071 477.073692 0 ] (cb9-151) [ 241 0 R /XYZ 99.933071 458.126671 0 ] (cb9-152) [ 241 0 R /XYZ 99.933071 439.179649 0 ] (cb9-153) [ 241 0 R /XYZ 99.933071 420.232628 0 ] (cb9-154) [ 241 0 R /XYZ 99.933071 401.285606 0 ] (cb9-155) [ 241 0 R /XYZ 99.933071 382.338585 0 ] (cb9-156) [ 241 0 R /XYZ 99.933071 363.391563 0 ] (cb9-157) [ 241 0 R /XYZ 99.933071 344.444542 0 ] (cb9-158) [ 241 0 R /XYZ 99.933071 325.497520 0 ] (cb9-159) [ 241 0 R /XYZ 99.933071 306.550499 0 ] (cb9-16) [ 99 0 R /XYZ 99.933071 309.538088 0 ] (cb9-160) [ 241 0 R /XYZ 99.933071 287.603477 0 ] (cb9-161) [ 241 0 R /XYZ 99.933071 268.656456 0 ] (cb9-162) [ 241 0 R /XYZ 99.933071 249.709434 0 ] (cb9-163) [ 241 0 R /XYZ 99.933071 230.762413 0 ] (cb9-164) [ 241 0 R /XYZ 99.933071 211.815391 0 ] (cb9-165) [ 241 0 R /XYZ 99.933071 192.868370 0 ] (cb9-166) [ 241 0 R /XYZ 99.933071 173.921348 0 ] (cb9-167) [ 241 0 R /XYZ 99.933071 154.974327 0 ] (cb9-168) [ 241 0 R /XYZ 99.933071 136.027305 0 ] (cb9-169) [ 241 0 R /XYZ 99.933071 117.080284 0 ] (cb9-17) [ 99 0 R /XYZ 99.933071 290.591066 0 ] (cb9-170) [ 241 0 R /XYZ 99.933071 98.133262 0 ] (cb9-171) [ 280 0 R /XYZ 99.933071 799.173057 0 ] (cb9-172) [ 280 0 R /XYZ 99.933071 780.226036 0 ] (cb9-173) [ 280 0 R /XYZ 99.933071 761.279014 0 ] (cb9-174) [ 280 0 R /XYZ 99.933071 742.331993 0 ] (cb9-175) [ 280 0 R /XYZ 99.933071 723.384971 0 ] (cb9-176) [ 280 0 R /XYZ 99.933071 704.437950 0 ] (cb9-177) [ 280 0 R /XYZ 99.933071 685.490928 0 ] (cb9-178) [ 280 0 R /XYZ 99.933071 666.543907 0 ] (cb9-179) [ 280 0 R /XYZ 99.933071 647.596885 0 ] (cb9-18) [ 99 0 R /XYZ 99.933071 271.644045 0 ] (cb9-180) [ 280 0 R /XYZ 99.933071 628.649864 0 ] (cb9-181) [ 280 0 R /XYZ 99.933071 609.702842 0 ] (cb9-182) [ 280 0 R /XYZ 99.933071 590.755821 0 ] (cb9-183) [ 280 0 R /XYZ 99.933071 571.808799 0 ] (cb9-184) [ 280 0 R /XYZ 99.933071 552.861778 0 ] (cb9-185) [ 280 0 R /XYZ 99.933071 533.914756 0 ] (cb9-186) [ 280 0 R /XYZ 99.933071 514.967735 0 ] (cb9-187) [ 280 0 R /XYZ 99.933071 496.020714 0 ] (cb9-188) [ 280 0 R /XYZ 99.933071 477.073692 0 ] (cb9-189) [ 280 0 R /XYZ 99.933071 458.126671 0 ] (cb9-19) [ 99 0 R /XYZ 99.933071 252.697023 0 ] (cb9-190) [ 280 0 R /XYZ 99.933071 439.179649 0 ] (cb9-191) [ 280 0 R /XYZ 99.933071 420.232628 0 ] (cb9-192) [ 280 0 R /XYZ 99.933071 401.285606 0 ] (cb9-193) [ 280 0 R /XYZ 99.933071 382.338585 0 ] (cb9-194) [ 280 0 R /XYZ 99.933071 363.391563 0 ] (cb9-195) [ 280 0 R /XYZ 99.933071 344.444542 0 ] (cb9-196) [ 280 0 R /XYZ 99.933071 325.497520 0 ] (cb9-197) [ 280 0 R /XYZ 99.933071 306.550499 0 ] (cb9-198) [ 280 0 R /XYZ 99.933071 287.603477 0 ] (cb9-199) [ 280 0 R /XYZ 99.933071 268.656456 0 ] (cb9-2) [ 99 0 R /XYZ 99.933071 612.690432 0 ] (cb9-20) [ 99 0 R /XYZ 99.933071 233.750002 0 ] (cb9-200) [ 280 0 R /XYZ 99.933071 249.709434 0 ] (cb9-201) [ 280 0 R /XYZ 99.933071 230.762413 0 ] (cb9-202) [ 280 0 R /XYZ 99.933071 211.815391 0 ] (cb9-203) [ 280 0 R /XYZ 99.933071 192.868370 0 ] (cb9-204) [ 280 0 R /XYZ 99.933071 173.921348 0 ] (cb9-205) [ 280 0 R /XYZ 99.933071 154.974327 0 ] (cb9-206) [ 280 0 R /XYZ 99.933071 136.027305 0 ] (cb9-207) [ 280 0 R /XYZ 99.933071 117.080284 0 ] (cb9-208) [ 280 0 R /XYZ 99.933071 98.133262 0 ] (cb9-209) [ 320 0 R /XYZ 99.933071 799.173057 0 ] (cb9-21) [ 99 0 R /XYZ 99.933071 214.802980 0 ] (cb9-210) [ 320 0 R /XYZ 99.933071 780.226036 0 ] (cb9-211) [ 320 0 R /XYZ 99.933071 761.279014 0 ] (cb9-212) [ 320 0 R /XYZ 99.933071 742.331993 0 ] (cb9-213) [ 320 0 R /XYZ 99.933071 723.384971 0 ] (cb9-214) [ 320 0 R /XYZ 99.933071 704.437950 0 ] (cb9-215) [ 320 0 R /XYZ 99.933071 685.490928 0 ] (cb9-216) [ 320 0 R /XYZ 99.933071 666.543907 0 ] (cb9-217) [ 320 0 R /XYZ 99.933071 647.596885 0 ] (cb9-218) [ 320 0 R /XYZ 99.933071 628.649864 0 ] (cb9-219) [ 320 0 R /XYZ 99.933071 609.702842 0 ] (cb9-22) [ 99 0 R /XYZ 99.933071 195.855959 0 ] (cb9-220) [ 320 0 R /XYZ 99.933071 590.755821 0 ] (cb9-221) [ 320 0 R /XYZ 99.933071 571.808799 0 ] (cb9-222) [ 320 0 R /XYZ 99.933071 552.861778 0 ] (cb9-223) [ 320 0 R /XYZ 99.933071 533.914756 0 ] (cb9-224) [ 320 0 R /XYZ 99.933071 514.967735 0 ] (cb9-225) [ 320 0 R /XYZ 99.933071 496.020714 0 ] (cb9-226) [ 320 0 R /XYZ 99.933071 477.073692 0 ] (cb9-227) [ 320 0 R /XYZ 99.933071 458.126671 0 ] (cb9-228) [ 320 0 R /XYZ 99.933071 439.179649 0 ] (cb9-229) [ 320 0 R /XYZ 99.933071 420.232628 0 ] (cb9-23) [ 99 0 R /XYZ 99.933071 176.908937 0 ] (cb9-230) [ 320 0 R /XYZ 99.933071 401.285606 0 ] (cb9-231) [ 320 0 R /XYZ 99.933071 382.338585 0 ] (cb9-232) [ 320 0 R /XYZ 99.933071 363.391563 0 ] (cb9-233) [ 320 0 R /XYZ 99.933071 344.444542 0 ] (cb9-234) [ 320 0 R /XYZ 99.933071 325.497520 0 ] (cb9-235) [ 320 0 R /XYZ 99.933071 306.550499 0 ] (cb9-236) [ 320 0 R /XYZ 99.933071 287.603477 0 ] (cb9-237) [ 320 0 R /XYZ 99.933071 268.656456 0 ] (cb9-238) [ 320 0 R /XYZ 99.933071 249.709434 0 ] (cb9-239) [ 320 0 R /XYZ 99.933071 230.762413 0 ] (cb9-24) [ 99 0 R /XYZ 99.933071 157.961916 0 ] (cb9-240) [ 320 0 R /XYZ 99.933071 211.815391 0 ] (cb9-241) [ 320 0 R /XYZ 99.933071 192.868370 0 ] (cb9-242) [ 320 0 R /XYZ 99.933071 173.921348 0 ] (cb9-243) [ 320 0 R /XYZ 99.933071 154.974327 0 ] (cb9-244) [ 320 0 R /XYZ 99.933071 136.027305 0 ] (cb9-245) [ 320 0 R /XYZ 99.933071 117.080284 0 ] (cb9-246) [ 320 0 R /XYZ 99.933071 98.133262 0 ] (cb9-247) [ 360 0 R /XYZ 99.933071 799.173057 0 ] (cb9-248) [ 360 0 R /XYZ 99.933071 780.226036 0 ] (cb9-249) [ 360 0 R /XYZ 99.933071 761.279014 0 ] (cb9-25) [ 99 0 R /XYZ 99.933071 139.014895 0 ] (cb9-250) [ 360 0 R /XYZ 99.933071 742.331993 0 ] (cb9-251) [ 360 0 R /XYZ 99.933071 723.384971 0 ] (cb9-252) [ 360 0 R /XYZ 99.933071 704.437950 0 ] (cb9-253) [ 360 0 R /XYZ 99.933071 685.490928 0 ] (cb9-254) [ 360 0 R /XYZ 99.933071 666.543907 0 ] (cb9-255) [ 360 0 R /XYZ 99.933071 647.596885 0 ] (cb9-256) [ 360 0 R /XYZ 99.933071 628.649864 0 ] (cb9-257) [ 360 0 R /XYZ 99.933071 609.702842 0 ] (cb9-258) [ 360 0 R /XYZ 99.933071 590.755821 0 ] (cb9-259) [ 360 0 R /XYZ 99.933071 571.808799 0 ] (cb9-26) [ 99 0 R /XYZ 99.933071 120.067873 0 ] (cb9-260) [ 360 0 R /XYZ 99.933071 552.861778 0 ] (cb9-261) [ 360 0 R /XYZ 99.933071 533.914756 0 ] (cb9-262) [ 360 0 R /XYZ 99.933071 514.967735 0 ] (cb9-263) [ 360 0 R /XYZ 99.933071 496.020714 0 ] (cb9-264) [ 360 0 R /XYZ 99.933071 477.073692 0 ] (cb9-265) [ 360 0 R /XYZ 99.933071 458.126671 0 ] (cb9-266) [ 360 0 R /XYZ 99.933071 439.179649 0 ] (cb9-267) [ 360 0 R /XYZ 99.933071 420.232628 0 ] (cb9-268) [ 360 0 R /XYZ 99.933071 401.285606 0 ] (cb9-269) [ 360 0 R /XYZ 99.933071 382.338585 0 ] (cb9-27) [ 99 0 R /XYZ 99.933071 101.120852 0 ] (cb9-270) [ 360 0 R /XYZ 99.933071 363.391563 0 ] (cb9-271) [ 360 0 R /XYZ 99.933071 344.444542 0 ] (cb9-272) [ 360 0 R /XYZ 99.933071 325.497520 0 ] (cb9-273) [ 360 0 R /XYZ 99.933071 306.550499 0 ] (cb9-274) [ 360 0 R /XYZ 99.933071 287.603477 0 ] (cb9-275) [ 360 0 R /XYZ 99.933071 268.656456 0 ] (cb9-276) [ 360 0 R /XYZ 99.933071 249.709434 0 ] (cb9-277) [ 360 0 R /XYZ 99.933071 230.762413 0 ] (cb9-278) [ 360 0 R /XYZ 99.933071 211.815391 0 ] (cb9-279) [ 360 0 R /XYZ 99.933071 192.868370 0 ] (cb9-28) [ 129 0 R /XYZ 99.933071 799.173057 0 ] (cb9-280) [ 360 0 R /XYZ 99.933071 173.921348 0 ] (cb9-281) [ 360 0 R /XYZ 99.933071 154.974327 0 ] (cb9-282) [ 360 0 R /XYZ 99.933071 136.027305 0 ] (cb9-283) [ 360 0 R /XYZ 99.933071 117.080284 0 ] (cb9-284) [ 360 0 R /XYZ 99.933071 98.133262 0 ] (cb9-29) [ 129 0 R /XYZ 99.933071 780.226036 0 ] (cb9-3) [ 99 0 R /XYZ 99.933071 574.796389 0 ] (cb9-30) [ 129 0 R /XYZ 99.933071 761.279014 0 ] (cb9-31) [ 129 0 R /XYZ 99.933071 742.331993 0 ] (cb9-32) [ 129 0 R /XYZ 99.933071 723.384971 0 ] (cb9-33) [ 129 0 R /XYZ 99.933071 704.437950 0 ] (cb9-34) [ 129 0 R /XYZ 99.933071 685.490928 0 ] (cb9-35) [ 129 0 R /XYZ 99.933071 666.543907 0 ] (cb9-36) [ 129 0 R /XYZ 99.933071 647.596885 0 ] (cb9-37) [ 129 0 R /XYZ 99.933071 628.649864 0 ] (cb9-38) [ 129 0 R /XYZ 99.933071 609.702842 0 ] (cb9-39) [ 129 0 R /XYZ 99.933071 590.755821 0 ] (cb9-4) [ 99 0 R /XYZ 99.933071 555.849367 0 ] (cb9-40) [ 129 0 R /XYZ 99.933071 571.808799 0 ] (cb9-41) [ 129 0 R /XYZ 99.933071 552.861778 0 ] (cb9-42) [ 129 0 R /XYZ 99.933071 533.914756 0 ] (cb9-43) [ 129 0 R /XYZ 99.933071 514.967735 0 ] (cb9-44) [ 129 0 R /XYZ 99.933071 496.020714 0 ] (cb9-45) [ 129 0 R /XYZ 99.933071 477.073692 0 ] (cb9-46) [ 129 0 R /XYZ 99.933071 458.126671 0 ] (cb9-47) [ 129 0 R /XYZ 99.933071 439.179649 0 ] (cb9-48) [ 129 0 R /XYZ 99.933071 420.232628 0 ] (cb9-49) [ 129 0 R /XYZ 99.933071 401.285606 0 ] (cb9-5) [ 99 0 R /XYZ 99.933071 536.902346 0 ] (cb9-50) [ 129 0 R /XYZ 99.933071 382.338585 0 ] (cb9-51) [ 129 0 R /XYZ 99.933071 363.391563 0 ] (cb9-52) [ 129 0 R /XYZ 99.933071 344.444542 0 ] (cb9-53) [ 129 0 R /XYZ 99.933071 325.497520 0 ] (cb9-54) [ 129 0 R /XYZ 99.933071 306.550499 0 ] (cb9-55) [ 129 0 R /XYZ 99.933071 287.603477 0 ] (cb9-56) [ 129 0 R /XYZ 99.933071 268.656456 0 ] (cb9-57) [ 129 0 R /XYZ 99.933071 249.709434 0 ] (cb9-58) [ 129 0 R /XYZ 99.933071 230.762413 0 ] (cb9-59) [ 129 0 R /XYZ 99.933071 211.815391 0 ] (cb9-6) [ 99 0 R /XYZ 99.933071 499.008303 0 ] (cb9-60) [ 129 0 R /XYZ 99.933071 192.868370 0 ] (cb9-61) [ 129 0 R /XYZ 99.933071 173.921348 0 ] (cb9-62) [ 129 0 R /XYZ 99.933071 154.974327 0 ] (cb9-63) [ 129 0 R /XYZ 99.933071 136.027305 0 ] (cb9-64) [ 129 0 R /XYZ 99.933071 117.080284 0 ] (cb9-65) [ 129 0 R /XYZ 99.933071 98.133262 0 ] (cb9-66) [ 169 0 R /XYZ 99.933071 799.173057 0 ] (cb9-67) [ 169 0 R /XYZ 99.933071 780.226036 0 ] (cb9-68) [ 169 0 R /XYZ 99.933071 761.279014 0 ] (cb9-69) [ 169 0 R /XYZ 99.933071 742.331993 0 ] (cb9-7) [ 99 0 R /XYZ 99.933071 480.061281 0 ] (cb9-70) [ 169 0 R /XYZ 99.933071 723.384971 0 ] (cb9-71) [ 169 0 R /XYZ 99.933071 704.437950 0 ] (cb9-72) [ 169 0 R /XYZ 99.933071 685.490928 0 ] (cb9-73) [ 169 0 R /XYZ 99.933071 666.543907 0 ] (cb9-74) [ 169 0 R /XYZ 99.933071 647.596885 0 ] (cb9-75) [ 169 0 R /XYZ 99.933071 628.649864 0 ] (cb9-76) [ 169 0 R /XYZ 99.933071 514.967735 0 ] (cb9-77) [ 169 0 R /XYZ 99.933071 496.020714 0 ] (cb9-78) [ 169 0 R /XYZ 99.933071 477.073692 0 ] (cb9-79) [ 169 0 R /XYZ 99.933071 458.126671 0 ] (cb9-8) [ 99 0 R /XYZ 99.933071 461.114260 0 ] (cb9-80) [ 169 0 R /XYZ 99.933071 439.179649 0 ] (cb9-81) [ 169 0 R /XYZ 99.933071 420.232628 0 ] (cb9-82) [ 169 0 R /XYZ 99.933071 401.285606 0 ] (cb9-83) [ 169 0 R /XYZ 99.933071 382.338585 0 ] (cb9-84) [ 169 0 R /XYZ 99.933071 363.391563 0 ] (cb9-85) [ 169 0 R /XYZ 99.933071 344.444542 0 ] (cb9-86) [ 169 0 R /XYZ 99.933071 325.497520 0 ] (cb9-87) [ 169 0 R /XYZ 99.933071 306.550499 0 ] (cb9-88) [ 169 0 R /XYZ 99.933071 287.603477 0 ] (cb9-89) [ 169 0 R /XYZ 99.933071 268.656456 0 ] (cb9-9) [ 99 0 R /XYZ 99.933071 442.167238 0 ] (cb9-90) [ 169 0 R /XYZ 99.933071 249.709434 0 ] (cb9-91) [ 169 0 R /XYZ 99.933071 230.762413 0 ] (cb9-92) [ 169 0 R /XYZ 99.933071 211.815391 0 ] (cb9-93) [ 169 0 R /XYZ 99.933071 192.868370 0 ] (cb9-94) [ 169 0 R /XYZ 99.933071 173.921348 0 ] (cb9-95) [ 169 0 R /XYZ 99.933071 154.974327 0 ] (cb9-96) [ 169 0 R /XYZ 99.933071 136.027305 0 ] (cb9-97) [ 169 0 R /XYZ 99.933071 117.080284 0 ] (cb9-98) [ 169 0 R /XYZ 99.933071 98.133262 0 ] (cb9-99) [ 204 0 R /XYZ 99.933071 799.173057 0 ] (configure-default-service-account) [ 53 0 R /XYZ 84.259843 561.590928 0 ] (configure-etcd-user-and-group) [ 45 0 R /XYZ 84.259843 283.686971 0 ] (configure-kernel-runtime-parameters) [ 45 0 R /XYZ 84.259843 539.222079 0 ] (configure-network-policy) [ 67 0 R /XYZ 84.259843 599.840928 0 ] (contentsbox) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (create-etcd-user-and-group) [ 45 0 R /XYZ 84.259843 169.788971 0 ] (ensure-that-all-namespaces-have-network-policies-defined) [ 67 0 R /XYZ 84.259843 564.092928 0 ] (header_bottom_text) [ 6 0 R /XYZ 85.009843 422.718898 0 ] (known-issues) [ 45 0 R /XYZ 84.259843 799.370079 0 ] (overview) [ 30 0 R /XYZ 84.259843 272.631496 0 ] (reference-hardened-cloud-config-configuration) [ 515 0 R /XYZ 84.259843 385.582628 0 ] (reference-hardened-cloud-config-for-red-hat-enterprise-linux-8-rhel-8-and-ubuntu-20.04-lts) [ 538 0 R /XYZ 84.259843 360.287606 0 ] (reference-hardened-cloud-config-for-suse-linux-enterprise-server-15-sles-15-and-opensuse-leap-15) [ 515 0 R /XYZ 84.259843 245.434628 0 ] (reference-hardened-rke-cluster.yml-configuration) [ 77 0 R /XYZ 84.259843 191.441066 0 ] (reference-hardened-rke-template-configuration) [ 400 0 R /XYZ 84.259843 799.370079 0 ] (set-automountserviceaccounttoken-to-false-for-default-service-accounts) [ 53 0 R /XYZ 84.259843 522.092928 0 ] (title-block-header) [ 6 0 R /XYZ 84.259843 502.818898 0 ] ] >> >> >> @@ -42,27 +42,22 @@ endobj >> /Shading << >> -/Font 607 0 R +/Font 621 0 R >> endobj 5 0 obj << /Filter /FlateDecode -/Length 2578 +/Length 2579 >> stream -xˎd 602%R^Ɔi$1,_gϯSKus8BwH#H*Wbpo$fqo(VCx>j9?Es|g_)VR_*PVDՠDs5BT% Q܍ cAw7dCH B.յ ͝ Rb,@ Gq䡌ExoܕXP]1=T[cmɞF$LJ -3+RcAw{d,( 3,81j- tH3cA2EuŪ1 M3[4%Ƃ` RdEdߴ<-pZlAXof5cU+)xΡV őTplz>tf@6؂XPqR6^ίVza]9f! gC>5~QF>~m(3KK-v`(w~Ã?ǗO'J_B gL_+?,H_Ċ6S -ui__׷]í/BL8?}lu{r'5^y\W|\~%ٻg,rXˏmdDrwR|8D#:A|ݷ_/lirrDxTm'5c]l}ڹg H!,DŽ;<^q%sO[0{Vr=˒C_K?yq#]x{+^(- ieOr{5'e]e= J}:0Uσ=U)Hwp]AqTلQ(pKl{0,4}-궜^NV_JB[E2݌jSGϹ 6׉.'"|%ֆŜmz.p$GDw[+Ug/_1˔s옣=":ދK_Hߤ儼ϧ\IX!y.SeIަ -[sz&^Qxp\֫Z9ˤVWmbg.=gNM&m!5q/릸#ld.a[<]Nsf{]2\KiCx9w1'n a/>['md,^N043Za(>_';3RkO2i&[{$GtC8&LayxÌ)mu,q4N.k7qn3#ř޵YpF{Q8Bc4}tvKzҡ]~S4۲ s/ƖF.0zȎغ ֽ>hw2v@NO.֥x\G7gsoͻfhK3Y[cv}t!ڐ :d2duTni9,ՙS,/L}U$}UC~f3ʻ;tz\҉WO:dc#ڞǰeHYCOߧz`zq}!P&z|I0GT|;׼$cq#a9Jj܄g(ڇۭƷeM# x"=^Ws;șK$ITDzx^; +xˎd 602%R^I N"b\AOqy:UT?.tw9⑨Yz-V/oONj=|b5؊.j˩ ^4ϧ}q5Bk%|2 kLT *JT9ZS.DUb#T0#WK0Úg Q`Fј +fĖ+QE1P 3MDs(t)-5ŚN5j1Gk &2lLze[PlI^*lIFt[]NuEDkrs3kЉW%!0]!7갣H]-Er:ؒU)l1ZnM}whd [RFu +lZBc@5XK \9@VeH-+2DRd P- +#FbعT[c&؂%2(hknMZd,P$pa0(^@\Rc,P0WNt+cKb,P`W cjQ UŕT[cX`Fb%jJHX`nr1wSEݔ,r)Kb,0p7Y*p] $t%e,BBZXȞBV 2Gu-Ċ'b) TX]  2ݘ0dpyCf,;-DR]  2 ,%D P] pXAXP]XP]ɪCCuE=1 ۖi$AHtD0Ӂ"1pMƂR 9c ȂcAq XP@J@;3T YT[cд9cAMESb, e`,@FZDMwd YfXPsA=YeWX jP PKǦg,CO `t j-*E2sI6c2]bd,[ 2xrTE QKbΤיXVBO MPiT[ O/3c(sh6Mg,p-Ic|כ lAXФ&3Љ071`_z +Mxd6-ެ`KFBuIS#LB :1]-cA+כX4&2zz$ެ db:pia,@&2[V +3^q:=17##{*=3HfBO VB E>fL>GTP3l~|O_A=_'ej֥\ow~~\?&s;Qeц2=cb7 }᧞<<|dW髾Z;uRpޞ_=po R$bE)hcr4ٯѯ[.!A~qx6= DzTcӉu?aj^T3`9YwP'tֶ\2"ގXKF;)\Pz"\ЏO@^`}i}[Dzoݩ;UIMX[:hvYRcz1!+w|\zӥָw, 6>"lƞ\ϲ#`bl`@\DqʼJBv9ExZ{޶ys-IYqY1Hhu_LGqzAx`zki +6놶]7\~TU6a~6'^?̩+K8Mߧ.n?-燄՗g*PVcvL7ڔs.u"ˉ_ɸa1~[_>f6DJץm2ex";&mW`57Ax9!)W;/VH u,YR䟷 WT)9ޠ(jf }oN$2clwX} ߡ;{nSkuHMx܋)3Y e8OW~/;ܪY`%n}Lv>:W҈ԥf[[7[mw?{{u\҉)}ޥtKh9zy {t&9kknR_:}PAGLlޱ1-;:s%i鼯ʜļJy;"̖t&@yw纞NVϙK:)Sql{D )+3uY~YClX:N00D7XoGq> stream -x]n$Wy ؇iASh w0+xQIJHdR*(zGrzM)I+'˟w7WStj?ieW;+ƅq䓡CWVfa dm?|Cʿ }C4kVkun HI nh5f=\$v1N(aJ{sVA V˶Ol=YxI#"qbf ht,pV#goo$[%_X2e x<4G"ǃ%]XQ=A#4GT?ghr^%=чNDSSSo$ѾIwJtJtJ $ -Ӻ; -ZNEXME r*w6snI@#%^JPQ ht8G9S|~#ق y(Dx0 u^x`Tø(XQ=ѢG~_"Q~ ݱE5SSS>^TH{"DDDH})>};-tCKq)E*,ANJq)QQ\!u6[-+~>PQ uht8GL-K<C d<0rWC%`<ypGr~D!tRY&DDD}潨蹈>t"}#HSSS5?2.hUEZބĀ 2D>lo܇ 1ж&qGT?߲HK`%:t_`<;t<YP%`kK= -TPQ htxY~eI#ق/ya\L<}Ń`#.iC<J< -T<0bnT?/(Ds?X"ĔAϼ=чNDSSSo$ѾIwJtJtJE ݯK?t?$',%[b^/O߿ӇRJ?k/Q/V۲ 24_d^k۹ݞZRc kSxbj5@WeUNKըi[TH:SI^|㏟ii!Q ,Rcir]۽p +pTMi ?7{*>R9hl)#[\>#/%@_[vj+ChΡ(}eTyyT-V\dzQ^փf/,j}OGyڭ9QUϏ%.僊ӅiZP?m+G`=D%ޖS{B6U㓓wk^u&ö>Zf'G6"VT4GM ~ohRI|aIY=I%C3]/k0 ոH+^ ZG=;[:<赵G* CG2m]Vh{kYz -Iim).1.tG.C25zˈ^n5?~F'i?N]ɓ -rD090rL}8ε1jngǖ{֯͸m5rѺkC)zqʠpܚ_`"guŇgöl/|V菠w vrmkanغ@mk"x>[{uQfjvjNڲOwvDf{X3kT ɵv@Sn7bk\3]R%m9Q& ¡0PV ;cBZzZस^YrX~^ -2lڵ Ifemq h-Kj/nk2&PH1A ֭\6V"j'þ򝀹I: 7 6v!:jmbsp)T0lT1anZsn,ތ{>~ڦ9ce܄[>Mk{vVb Chv:Zc\;)C(kv 4|ÛǭɁi*jA `jಬ!=-=掿۱Xn}NΖE/j6艭GzzaQ"uPkжX芭GT?޲ߘl(%C=Q樊tF4ND>НND'ud(Euw5NEMI DAʝHX ꜯW@#^JTQ DAP=6ΣG~e1"AatQ2iMD`y0|@yr< DAǒfByЃ<m#ՏK< (21NDx-*ŞчΈ&щ!GщD6!e]H]EQ? Jt4XpԹ n4^] +:жu="ʑ[4&[!;Bw":F׹*ʺD*5yv"N?zars KD>a?K.Msc< +բm pȑ[-d*0G`y=t)uyH2ָ٣PE p|"ՏK< (ND'DoEDECgDщD݉Dt"w[{aa ެ.bv=^?o:xo\s{2i( aym>wN>Q*)k@GQ;\ۚ2غӐDHcDnzUn5i:k˖ԑʽNUӎއ5bZ\un[bk\#]Rm1U&\PC@͵JP7 Oe9';=Cт&'jL5Tf5x2Ug{]+6,zhE@m!\:V/T}t[1B@vLRmnU2EU;AX U*,h(wyrlA:x6w-O FՎIeF7f's{ɐVӶM.˰TF^KmmqzYǍjisq%3>)ذ8Y։Z m7kǧ+kKfPEs A6txbȼ47`_mziUp8t=K&4%ޥ Z>\݂Q:{&Y +З;L-{Y4]mi8iaitE:}rMMG mv; 9v)^Pe=69o-85i{N]ՄӺP4Uf1>mĩDY n]nɶ r<:-^2ug7qK[o'}va8HM-t/k%nan=(Z%N +]54}792MD頋vztO N˪;sjonwra,>'g˦ /9 endstream endobj 8 0 obj @@ -103,7 +97,7 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 7 0 R /Resources 4 0 R -/Annots [ 9 0 R 10 0 R 11 0 R 12 0 R 13 0 R 14 0 R 15 0 R 16 0 R 17 0 R 18 0 R 19 0 R 20 0 R 21 0 R 22 0 R 23 0 R 24 0 R 25 0 R ] +/Annots [ 9 0 R 10 0 R 11 0 R 12 0 R 13 0 R 14 0 R 15 0 R 16 0 R 17 0 R 18 0 R 19 0 R 20 0 R 21 0 R 22 0 R 23 0 R 24 0 R 25 0 R 26 0 R 27 0 R 28 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> @@ -193,51 +187,51 @@ endobj /BS << /W 0 >> -/Dest (ensure-that-all-namespaces-have-network-policies-defined) +/Dest (configure-default-service-account) >> endobj 17 0 obj << /Type /Annot /Subtype /Link -/Rect [ 488.809749 529.011024 496.429134 514.011024 ] +/Rect [ 146.805601 529.011024 197.845152 510.261024 ] /BS << /W 0 >> -/Dest (ensure-that-all-namespaces-have-network-policies-defined) +/Dest (configure-default-service-account) >> endobj 18 0 obj << /Type /Annot /Subtype /Link +/Rect [ 488.893245 529.011024 496.429134 514.011024 ] +/BS << +/W 0 +>> +/Dest (configure-default-service-account) +>> +endobj +19 0 obj +<< +/Type /Annot +/Subtype /Link /Rect [ 76.423228 492.261024 504.679134 459.561024 ] /BS << /W 0 >> -/Dest (reference-hardened-rke-cluster.yml-configuration) ->> -endobj -19 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 234.738707 484.311024 313.229430 465.561024 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-rke-cluster.yml-configuration) +/Dest (configure-network-policy) >> endobj 20 0 obj << /Type /Annot /Subtype /Link -/Rect [ 489.877620 484.311024 496.429134 469.311024 ] +/Rect [ 488.809749 484.311024 496.429134 469.311024 ] /BS << /W 0 >> -/Dest (reference-hardened-rke-cluster.yml-configuration) +/Dest (configure-network-policy) >> endobj 21 0 obj @@ -248,86 +242,120 @@ endobj /BS << /W 0 >> -/Dest (reference-hardened-rke-template-configuration) +/Dest (reference-hardened-rke-cluster.yml-configuration) >> endobj 22 0 obj << /Type /Annot /Subtype /Link -/Rect [ 485.053890 439.611024 496.429134 424.611024 ] +/Rect [ 234.738707 439.611024 313.229430 420.861024 ] /BS << /W 0 >> -/Dest (reference-hardened-rke-template-configuration) +/Dest (reference-hardened-rke-cluster.yml-configuration) >> endobj 23 0 obj << /Type /Annot /Subtype /Link +/Rect [ 489.877620 439.611024 496.429134 424.611024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-rke-cluster.yml-configuration) +>> +endobj +24 0 obj +<< +/Type /Annot +/Subtype /Link /Rect [ 76.423228 402.861024 504.679134 370.161024 ] /BS << /W 0 >> -/Dest (reference-hardened-cloud-config) ->> -endobj -24 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 210.896178 394.911024 288.867613 379.911024 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-cloud-config) +/Dest (reference-hardened-rke-template-configuration) >> endobj 25 0 obj << /Type /Annot /Subtype /Link -/Rect [ 485.030452 394.911024 496.429134 379.911024 ] +/Rect [ 484.970394 394.911024 496.429134 379.911024 ] /BS << /W 0 >> -/Dest (reference-hardened-cloud-config) +/Dest (reference-hardened-rke-template-configuration) >> endobj 26 0 obj << -/Filter /FlateDecode -/Length 4818 +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 358.161024 504.679134 325.461024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-cloud-config-configuration) >> -stream -x\]$m}_F 0 d' ?L~iX?GDU\ܹ]HRW\5~>Ȩr t}t*ztQhʛ~)Up_7_~U9k/?9S 6N`yb>`Ă>=+B K,A&hܞ$0Ge40VkE4x` Q!eE^D+S!FeBItY硋7DZAr)J]\pZAxXX' ]]IAx)ӞgW>9%1#6ÌBxȃ.i+t!H`=J`Uk3Q‚I! R ^*咄Pαb!ϱl>^=us ^8z,=Ib!̱"oC7Xֽlj:ł;Fg=2KcNI<=Ős45WSSaDzйNi@f\Jr6G0eѬ@j[3Ekaa! >ѹ\nX0j˰dѬ3f|On_mc 4W_ն~ب/|iayoM>#f߰-|[jWj';qlG-X^q6U|oqK#ۓ۞؋spjڦm6asͅoSm>k68d;'m)w&?'lZL7ljxRu[֟]x]%`Z~ Ze3jKv!>8yX\p6+2 P 76~.ws^ɝpCngj{TN[s#-ϳRn5_vjYbŎ6:vr}c>CƲ|!^۸<-|rZԎi+yfj}x7Wlҙ=pG:._<ߴ; -~Ov_ 2_l D͞iqmW_ -Xs8?ߧ' O픶vj_tvTܾ< 8_^$Ina=]ӛ|[t6tϨdTgIuCՓpLj5{gm?[o'Ryس/gsj^okx/rieܶOpҩY~?ɪrBKlgVlFؽz灰}w3k -2;BPt꫁p_-~EepEj,#.J}E%O03l GV^mIߒq۾7|EgϡML0gWXu[g +XiOnM-m' -g.?R`I5Ֆ쮁T{bvdy[Ycez&.#"~/jߥ+yoK92`>I.t@l J;tb˧mzҭo/ D̞\FY z*>4AǍiF{f )gtӅAsF3nݖz&YNsLܩ't&8lǠz ElJSJ,?TR7@6ZvL.cA_|ZڷDvr#^5f*LF+?Z~()4jtr0l$NuH82s{r{t{nL17 -HuɦG]'kXɉ)Q6dC>OU{gp] wNrY7&6ڒK [ݳbA0z6[;:#F1ɤ{RӜuޖEp.ǫ#s+ -yo!K:y&+g'lFӆ-1dF[ߢqk^Ӹ]`o-MGPӹ Э2xX2H˥ϧHr4xn+ttpɲquf% y'Ep/vʈrF5A Lw'}zzʡ̀BީwN+x20_Ma.˱z3(-h1ʨiܶ6SjӖ(:\KMRGD+^S ꟹ=J7^ EnxZr<-{-Zww*}w˶W6 Qqߵ*#~9)v0Lot3u -Be7Rb[/sDZh{'Cs:r:D۲ORnX4vWTۭ?wq -endstream endobj 27 0 obj << +/Type /Annot +/Subtype /Link +/Rect [ 210.896178 350.211024 288.867613 335.211024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-cloud-config-configuration) +>> +endobj +28 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 485.030452 350.211024 496.429134 335.211024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-cloud-config-configuration) +>> +endobj +29 0 obj +<< +/Filter /FlateDecode +/Length 4946 +>> +stream +x]K$qׯ# 2 F3m F"+I3#{V ;f0{62)"/O_NfJyp1?'5`K >MzVr_gǞTJt6#O)d*`VSJ.DKXP#$re%A%5ȹ2߲ +pɒƂ!N0E8=j'\ !TtD/YÂ䠋wN Z LŢVS԰H6BaA +1xUE7Vy<4,H&,V쥦װ?qaϒ@XЙk< ]dkXN%v);lMg=hDc/'Aw葁בGt1#  E#W M皎n3T/e7:қbF)ߗӟ/%K󙚵ќ0JŊgr'B3 2$rØ e'ʘ ƬX{ԹR\; |raBɅ8b[F ~'Y/f}Ԥ +_N|KI6窪|>Ab:]ʑyЅYGIE|孋7ȵ׿eE hs,>s]/l҅Yt-w3K-F=bzCWsv_Cا ^6]D.iхô4ges:j"a̍=" {Q+ˁGVEQ#םxޱGvBēO$foӅx"_A/=_أ ;Ca밆x ?>]X.0j =|"~}?=s + }g4[{ta +=B}N<أ ;w!}~}i9з|{=bwх໌׻vO5C|c.߅7v?l\gQآb ̏+|/c|2>bL<~-82?6&O v?7Je.5^nc?l6/Ɣeް\Z]dۛy?vOHGoObCϲBCzY~Hg[n=s?o2Bs=,dž::O+I~G[oYޡ_Ưn/-q.wTmɕt|5/bҚ?iɽ4|o8|ǡfU_m\~|޹j==.8 d]TЛnC5+6Uk_xɼo1>Z#Vy(n=n+]ȂD/ּRQgkyfܮ G84?;7Ǚ*+ͶShݝ={Vjk!4nDNcY[^}>{x|8U쟷~`J}YrFn6r\}6Coѓ|6OsJs~kE훩u㍽xgû'PǍ/׵w¾W~q˴5"5}gYk?>쭸@s>b.YV?_-ΖS/`+lN?њoZ$7|>êu-mr] ]If!8K^^Z^_sazG1xI!d.s6q0 342SS~ebD0AWr٨\rnX(*n|qpP&NHg^%T -ZȨ 3y #$c*/HƓs+=-} 8_5_^,od Mo4539zі2Q?mCfiȶÛJ,2G"k?PC4DڹMqg[2[o&yUlXu $9 7%[o1lFLɎ>"\;.]gEXD8kUH]RQCB-N +rRߘ*Q7݈&qSH:nZRzSxv_s.jHk"^x9jSHб„zFΦK\]Ҭ4$Ш8h;zەݑ6Μ>u:LC װu ˕Ξ$+ :6fC[ǝxMvӁ AmJb>dRY/<[#vqߡմ* mp;%,D⊇%\rF\H٠&'' +s F<ˬ]ibZ`//`r2(zsc6hoԫ6ØO2mg=dyQ{594zkAÅQAe@R օhҚTum-YRj=EUz:Ȩ4'r׺% 9uLzɬТQƹj{fPW$f5Qj +Q#ac> endobj -28 0 obj +31 0 obj << /Type /Annot /Subtype /Link @@ -342,394 +370,511 @@ endobj >> >> endobj -29 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 293.575760 264.681496 442.798661 249.681496 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/) ->> ->> -endobj -30 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 84.259843 249.681496 285.368241 234.681496 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/) ->> ->> -endobj -31 0 obj -<< -/Filter /FlateDecode -/Length 5071 ->> -stream -x\[$m~_V u?,nemw]'&Q0lB YR&gBJkH`#ft$eAD6 -]8*ّFƬ[% -^h4w&Jˠ5Z&erijRJh4/Z"xj4BdKH4K-TV 4buk!Ri4[r9Ҽ&FsDfPi(LR -̓dcUi%5Z/ 8C.EVlp-34'bs d4 94%*T49h0k4jp Xw ^"% /Ui%TҰ x -^< Ж--4,[.iX`jX$Ұ rJU N @5,@װ vaArV* @5,:Jа٬awaF^̪& +Ɨb5, /4, XTZ6aw}#h+7pG5, '4,U. $xjX44,@g-Ѱ w]4ʸR -OU2$-l\JUÂB4,]gѰoz "p |D.a88`}3BuUZ5aAX-@ iX06~ jX6aAZۣK(^5ljRh4uaܵ6W pM R_4,^װ 25aA4|*-G EAd4B4,cmjEÂK^ \ }xxLDA-yS2Z\ְ g2XLkX7.iX6@saAa"S<\K 1D?|?}~xϿPҫ!dK|9_й q`_ ퟯ~'yhRE;ܷku Z-$l2c1n;e.ߦ79gaIW5S -:W&'|=QV:xs< =G$ND -#ף1x?RߴS(3`'ʻ1P9n904k>zngW"{~J 1iq\THG;^{0Y^4;[h3lNavId\E|u/=ѽDfg񷷧 { ;loT1'r\oB0쳊Jvܐ'H^;(sng,X5nw߾e(eFNa;H;#GV1{8,:v? ls $<ȥ䮀—۔1^S|`lhWIXIvHTyiGvR,c#,x8%ۧfSo/t<-6{w/u+[wCs-@Hn0op\8@26<ڎeO6%TgMOy2n<KYNC^6]z Zs46rF+[B_U:GRUigé˗=/~`Vu{\|R?9fe Ks3sw7`;9xF<Š|nZϵzL+&KznMpov]5TnU3_D7+1{M5Χ(0ȇ>r,o;'&c2y}f B3%>Do< -#o_&oy~J>{(<7:Wq|v/n]oyx@R2`ʝ=T'aVʞh։bt7wk,T_Ce8;  -x]iپ˨w MfK/ɤbV\|o,)D3yP̅}!K&\|^˥i}uu3ƺ erb~zkZ̟+&wiu!ɺa1xXhpS_u9Ysb{]t.6KRUKL/ :Jc9&<)ER]&sŬ}[F)EZo-ʣVMkdez-k2ZK3+S؈ r[x\" -oHg%fvX w;eEeQ8Jy(zn¶9BiiPs:+YϠ;jmJDy=b7n3u 3fq)|aюG8 |y̸ ~GB{-l/f/}YX`p2PFZqցN~9L[qo]2CХm;rC/t}JȲ{;l˕S,O'?{0QI,ve֍]:yW^ u* 㔡(Cu B2pd>un悽܆y~L -7qp[&-%*WK:ECNq+ r!zTK7oä\fe׽=/199h0󾲜pQ&Kǃq<4۴kNh9nSB l/ 'gt-hs#uTl6bFf],퉋*<|Y7)(ge1YIo_:tvdQʒl=Ji 86mU<MFLl5? ->viߖpe~W 5|hJ%%`.3xw1sr$Llv{7c_oVH™0wS1q9T䏜vz 5[Obt*4g -endstream -endobj 32 0 obj << -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 31 0 R -/Resources 4 0 R -/Annots [ 33 0 R 34 0 R 35 0 R 36 0 R 37 0 R 38 0 R 39 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] +/Type /Annot +/Subtype /Link +/Rect [ 107.173228 418.281496 162.214732 403.281496 ] +/BS << +/W 0 +>> +/Dest (overview) >> endobj 33 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 590.823057 101.433071 572.073057 ] +/Rect [ 107.173228 403.281496 332.953990 388.281496 ] /BS << /W 0 >> -/Dest (cb1-1) +/Dest (configure-kernel-runtime-parameters) >> endobj 34 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 571.876036 99.933071 553.126036 ] +/Rect [ 107.173228 386.659914 295.486949 371.659914 ] /BS << /W 0 >> -/Dest (cb1-2) +/Dest (configure-etcd-user-and-group) >> endobj 35 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 552.929014 99.933071 534.179014 ] +/Rect [ 169.605601 388.281496 200.056773 369.531496 ] /BS << /W 0 >> -/Dest (cb1-3) +/Dest (configure-etcd-user-and-group) >> endobj 36 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 533.981993 99.933071 515.231993 ] +/Rect [ 107.173228 367.909914 319.724254 352.909914 ] /BS << /W 0 >> -/Dest (cb1-4) +/Dest (configure-default-service-account) >> endobj 37 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 515.034971 99.933071 496.284971 ] +/Rect [ 169.605601 369.531496 220.645152 350.781496 ] /BS << /W 0 >> -/Dest (cb1-5) +/Dest (configure-default-service-account) >> endobj 38 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 175.741950 101.433071 156.991950 ] +/Rect [ 107.173228 350.781496 255.796275 335.781496 ] /BS << /W 0 >> -/Dest (cb2-1) +/Dest (configure-network-policy) >> endobj 39 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 156.794928 99.933071 138.044928 ] +/Rect [ 107.173228 317.031496 400.593883 302.031496 ] /BS << /W 0 >> -/Dest (cb2-2) +/Dest (reference-hardened-rke-template-configuration) >> endobj 40 0 obj << -/Filter /FlateDecode -/Length 5108 +/Type /Annot +/Subtype /Link +/Rect [ 107.173228 302.031496 397.449596 287.031496 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-cloud-config-configuration) >> -stream -x]M$9nE};^5>tV¨1`fFVW4z -II=BMg??=Kɚ,oj/™O&P9'Jp)_Oq~o;׺)%: -=KgrJ6(EEX) -BT" l%KZe( x_TK"A%$, gZF2 -&BQ+sdb.e eVlbH++&VK(^yo29',l2rb,,XWV&ZVPfs2g jeD&6Y-ÌbRx6 N+cG+NN9+fˤ\jx5p5 2K/k 2}Pb|J+Xl e4 ` ^0.^v/hX ^g ha-0B0[0lZ 9z  S*000@=iX@]iX]9jX]d5,]fT Xaʬa2٤ab9 U;VjX.[a%9x 湁.Xa:0j4=/X QX4f p -ܟ2Vr.eO-+$[HPEÂ܅b p5,xTaASke]rjX0C4,3dajY1aAf Z 4,8TÂ܅{/D D{2iXeʜFjRhe]KаVܵ6 "pWܦ1 e A4,ٛR԰ 2|jY4x$ Bde'akSd /윆Ɂ  "0}x/5,\װ | Rʢ39ղ2J \1iX\dLz F% kX -xTѰd\+# [D(#Ұ ;hPÂ2h5,F. QkeJ5,> 5,4A T `BGa$Hs2kXt3kX3xqiX۔|3iXP,xAħaAHa`ejXP(#t^K7-Mxʼ-%L^B h*ʼ&!:ie5,(1J5,@|$%Lrp7 VEd5,MDZno!!> dY]1ߪ.X`/UR ,Wr$ul"Q]5[E!Yu&\V%sH9 Gts_y>~>?g%2E\W6\w&RL`qYt&n˹BkLf/28>\xdD'!!膯*cu_SCHy"G -Ů )=X%;u<]fϳ$",TMG+l'1i>^齸1BeX ݊ -%X}{%3xH -9pS]GF!Zg~;??/_am<']⤦&2>M2VЉnʍr+oexGlY0g2ٶ]<Ɲ? Z}eMޔ_ݗΡe޴2yv4&?d]?5pIOd`k;.èb7v]]~u,|Dny^ٛ2j͖?]iȣ[ \_O_$]moEMYYkx$|Ze$Ǜ - 6n{ٝ[ pae`¬<ٕ/zn# ;R^6㑳'}#@YcĴ}ݵxb9ڪǛil0ş._^g6Iyz@g/ܡλ`ثno#1Sy+K] yfbnszp,KN]ϹzeNwh%6I+wNY맻4,Bphs2,Rh ]92jE3 EN\_ڸmBAuܺ!O g֐:=m_*p,Ǔ9˾'$zg:77^/z폾Pw^m^C_ߞ[ڧ -MYJ+w!XG `;1X7d#W~h3zlCkQuSj[S׷=_dɔYh*|7fN'rr**ڇrr}wUR(#L^UܕUyy^iyyxؗ3$_=iyumu~תy.,-bzGQL_O.4%7*Q>ݕ~%YǐU=9| Ļ%]0wiSۜ& x239^ .ý|#ȥ ^>[7}0Л/i -Ǝ'>֋b[6>K ,G4)gfaeu/kh^oI~!/E3S.Ӛ v~<|R<,@zK{hf8#wXM2{K9Q>!rCg]vWE>!Vxcf^h0v8xyηbgJIj4Mfv)?Wlmowe5], !U?ݫ]o6=߫mjY L Zcb:ߏqsW@ ͔PG>[yho^3P8R#ov׵G|\rauD̈MI*q7ƚ|bCpl;+Yq{0r#L8r؊ d*|,aL&y˥{̧8;/Z1=w}iJF[gKgn֡*ߏiՋMDrG -gY!L4]$u;i_ϴ dhR/VuG-q-1a&b K!:p;\OZ\t?丬v^܊)[gEN\B\')Ix -Wj ? YQĪ?Wv,Jm%g$zXmCm!(vf(ҧ,̗_2s]B|m7\:ViO[C YE8vXaC3SA[D+*B -_w#it"sB鱣$@>w'qSv.uDO' cMnu,ӱr&MuE|>UE=v9v|ɩk$Pv'oħ,[',G&` 0F_+֎NsuL2>zn1 22mstD;<m?lG ױuE=ܽ.Ff":? Sf ݏشIu;IA0d8]7]Gm/pؗGnsr_ -pG|ē:\|1力xa; -f0Byfbz!0sò0*+~> +/Dest (reference-hardened-cloud-config-configuration) >> endobj 42 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 797.673057 101.433071 778.923057 ] +/Rect [ 293.575760 126.231496 442.798661 111.231496 ] /BS << /W 0 >> -/Dest (cb3-1) +/A << +/Type /Action +/S /URI +/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/) +>> >> endobj 43 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 778.726036 99.933071 759.976036 ] +/Rect [ 84.259843 111.231496 285.368241 96.231496 ] /BS << /W 0 >> -/Dest (cb3-2) +/A << +/Type /Action +/S /URI +/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/) +>> >> endobj 44 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 759.779014 99.933071 741.029014 ] -/BS << -/W 0 ->> -/Dest (cb3-3) +/Filter /FlateDecode +/Length 5107 >> +stream +x\I$9ׯ3R7 !"`ئġH^"3#L+i;bIgşw+L)5':_>u&G;6K7dzMt5x̄Mt~9KyO?8sǝ5y(\rQih.(M1}LJSrKUk1cSTKԚy_6eMlHkƬ49 >Vm#(xE ygRmm.{-2贶jRJhm^bNk%:" +%km ^|AkC:Ui+U6buZ[ &BUْ˱hb jmΙ jvKm%뵶^6D ezE}& @^lN`% |Ά' | + |r  5֡; /UKaA7hXx4,@[hXdӰ oɺaAMaA→HÂȅ)U 07;5,]laAꆘ$ p7p7T X  pkXaҰb|)VbI e=4, ஏX湁>Zaw=a  w!Q V{a3a*ܟVƕ4,]W>!qeBƥT5,]8aA>x5,]ੵ6jX0hXfmZ X [$j[60$aXġ$.{հ wm AÂܵGm/x נ VV@ + k4wUÂeaALE0h{ R!SsNjцOmKQÂlA, P& XjѰ {װ {AD:Djz^`.j~@@2S*9&c֖)paAdȥLװo8\Ұl͑l L̵6^dkXHmiXP[ +'pZoe7,_s+_˴%vC|Z/t=7_3ۘ9l! (+ ߡ? +[l<5.B<^luZx>7ekzgƾ8N-|ƇErQQ/,xy4aR~=8w[}]M9ڮQ(k&שŊp]WyΣ+z8Cd ޹ %u,"!P0g%oVWar/z<72U+Lx~~zf r`! | +HaBfI=}}-_föX=|z0B*ch)%'2C^ ;W;.N:}J_(bxٜS潷nM&џuj0+f=tiMT-JpLunب Ǡ埄֘ibHE>U}^&ncj7r|襝޾?OoR~> ++ľ_n5}/&IdL)kۦc^tKs#?Rf2;`Z +?4YssOy6@/sm޹E[jm}v}`kcW9N>K|r+J#sY*p,c/gL1*qB_5X!; 3>?Lj1l5t_%i;zo=9vtu.1L~s`5j{;U3>l@;o ׀><; +=(";4;3CK7'*ư ظ8ʼnn (BNXE?f@QY.jth+|; kIY Vj9a9χ,E>o ~bzfvӹ:o6/o{e^ ;Ovܪb)Q0urdFHg {.GNݴ&i ƥ>ϊEn9:);._פasJ-[ <_>WkNukvlnj5Q<UgpWn\: ^JQ{Ψ>#5o,#Ⱦ\{{ #>췔CJ{i㉚-oTH+80uܱ!\Eg+[}^[|Ӧ蠻]9YچzǺVwY)G#Cxyv2ף*%u7ǁ*t"+7 W +]|;nhǠo+RO ~ы5nr)g]MN.9v@Uۙg}܌;|u}gݳo[* Yj-BA _|r))s܁/!*}_/NgsΏ>ݒs3έu=Y;SѶ[G-ױg#,}i5 ۳]y-V3(~lq^7^Fs#(dNJ⟘)ц{#߈Ǎ%,9ȕoz^;rE{K4θcى^sKDǶ{˝mtXxAv/Cn!P㵷v8?JscjõqvrLG1W?f/tҽ[>bYv#,z x\ʴ#ˋvj_uI=Y>Gerb_N)dA2O;"7@.'K;C40ľ{7~MWl +=;yָFOUyqH9x&1VL7ɞ:??2D&q.E> u"^N6/*?$ՇETiA0U5;BhI!]N +C9څ|tCq_)I̮K~2M=!xvշߨ{ĆsKWr4v$bV+l'A;N{T3MTؚ3Pg.՜r䭐$= !M|;aR^tCbc4cKv!g`$8LeC|ƱU%'=q'9 |<421N,d6'do d 0F_r߭dǽ~Zܜsʑ㏥ȝ{~8uՏ{;lݐ'A2jǶDO'ٕyo0ivn  ]<1$o/;)@Ku3zץs \K>!qŷNV#.䠸نM6H9=OR"0hY9t- B59V0zo,:}P_$u,tjX.r/wJh #ș[c6*evk7D9)uf(\f;m;OubYV\T)SLߥbZI{;OZz9:;dQhITwN;M۹=ed$np5{G}WkSpe~ +\>,(%%`)2QxDZkr&r6;ؼ 1TޭZuI @)L; VSEx࠷7Q+V9?j\K +endstream endobj 45 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 740.831993 99.933071 722.081993 ] -/BS << -/W 0 ->> -/Dest (cb3-4) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 44 0 R +/Resources 4 0 R +/Annots [ 46 0 R 47 0 R 48 0 R 49 0 R 50 0 R 51 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 46 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 458.388971 101.433071 439.638971 ] +/Rect [ 191.048717 658.622079 244.661998 643.622079 ] /BS << /W 0 >> -/Dest (cb4-1) +/A << +/Type /Action +/S /URI +/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/admin-settings/pod-security-policies/) +>> >> endobj 47 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 393.691950 101.433071 374.941950 ] +/Rect [ 101.433071 439.875057 101.433071 421.125057 ] /BS << /W 0 >> -/Dest (cb5-1) +/Dest (cb1-1) >> endobj 48 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 374.744928 99.933071 355.994928 ] +/Rect [ 99.933071 420.928036 99.933071 402.178036 ] /BS << /W 0 >> -/Dest (cb5-2) +/Dest (cb1-2) >> endobj 49 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 355.797907 99.933071 337.047907 ] +/Rect [ 99.933071 401.981014 99.933071 383.231014 ] /BS << /W 0 >> -/Dest (cb5-3) +/Dest (cb1-3) >> endobj 50 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 336.850885 99.933071 318.100885 ] +/Rect [ 99.933071 383.033993 99.933071 364.283993 ] /BS << /W 0 >> -/Dest (cb5-4) +/Dest (cb1-4) >> endobj 51 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 317.903864 99.933071 299.153864 ] +/Rect [ 99.933071 364.086971 99.933071 345.336971 ] /BS << /W 0 >> -/Dest (cb5-5) +/Dest (cb1-5) >> endobj 52 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 234.456842 101.433071 215.706842 ] -/BS << -/W 0 ->> -/Dest (cb6-1) +/Filter /FlateDecode +/Length 4933 >> +stream +x]K$qׯ和 0 @ {- ; fY+3̨^FwUF ~A2s?ɹח/\I_-?7Lp%pYL*xx\smw]L)٠ +X֑ +CTXb) bĞ1䠱 {VёU O5p%$,pZA,3y炉Pzxޙ/*/xD&&vibb!k<,Xd j<”Ƌ"YY|NdNQxʃ,6Z +P2+ٜm0!Y MRyQ,ц K 5AƏNJ9+&KN}bY0Yl`% |Jg |&Ù>)ñ$ :Ӏ,d 5$ Y3WA*ayȂAϤam֢anaoٺap!հ#kX@\RѰ԰IR^awհD X!IIby 0v5,հ>[ְ>d0I[<7p5,`g5,U. $djX' ИK4,]W9 2.aASyŸ+Z6.ƢaAQ  <װ wSk#ˌVxhPc+yfְ s4*jXiLH `B$A$?H6]d:f[JuQ;Ug+f率TiMw.&5!IS:oٹߡ$M֧뼹^3 8%Ug+f'Ӥ}[H{߾ X:uNo<w?_G^/?d6O'"G$_:zLX{Ƶ>q^zeiBkq;<[d-tA_Fg.jm0HၡLj:~ewFoo)|w9`'e:lsԩ)O-9kATltjL 5> p+h_i p2t~~g1 CuڔW/@9MAZjX w?7!;1]@-Y5K-uC䭉Tc۬26>Y`mۼ}Y g tYxMn6r)M?bzcAx{e异"C^GU y-9Z/$E@G*_z8ea7"'_-{:$v\ sbQ(nSU q4ѫW(]?oaˀ"[Gr =/M܃;Y:9:ݓCANv DD~l ݝی=>;'GkGIJ[s&ucR BNN&dN?m=eVOձ3fGv_Ni87עSo1)$wGG ,xky/?˟~a^aN[_ͥeTഷd=#n37),>R0u]7FoτRږ̮GuT^6aHlΡuި[x鞦տ^vӸ׬I'c%lc*4wXa{?Mi; +@;ձqTVW4YQ~euk[}m07rgy_:;s>>Ҏ(&=ޝ/7p}ڳSc|ogx.:΍~}| <EmQb3Qv ɱGbZU>Wc6hryxo}OVa]1sjhRv4Q'ƌ<}KAmM0MLxN`ul?ǜNVn&y|3vdH%ңmݓu"\IȀeiE=&Sc9`IO8Ik=%{S $aȢN-QN>G%hW8VvT;ٜ r̤o6ǣ{܇-lT{s'Bξl!uN3zJOC9npN_F)!9$/Gd]JBU>_-⚼զ-v5hgzTL<+onn}n\w_Sy:_k<( H{b{J8k{=?O ҅B"L'n6"F?9#/IWOT0V9j +KJWgrJCv[mz.Շm'Y>|W/X[z(kXe*Wy+DYW7j֗K_"I^Q?_EP1.Y[]f+9v1/:V ׯŮgjrgʾ$R~ogv\5VM)TұBDd{kJ!Zb%&3AˎGŇd1vn=7y/.b}V/tK{G*okM5zi4 U:5}@Bz(olk1?\!q/WZ9rQ˵%}R/G4?DN+^Lt#-Yc- ;/}&KHJ0†fz3v;9a/eUfɛ/Syݤ$WULuXӀ4N%0:vJy^klCT6Si Huؒ]NkX9m rqCr>UE7{rq&>sdRbu2Ȓ 6M!@a~6[;:IuL2\vnSGrf9:rE?.|ev[7ٓ{XI<ӈ}LDˣlhM쭤:w&ÉzGfN=ܱ{vs@(/jRb\ᒯSå~Q\N!FL1ȹz硐b +#nzS4_ ;-y?yz}"6ڡS?~cB퀧S^e9T`lwhEܣ䌩1B \6:QshNpmbj2ŵZSKj)bP6k:̣ҕQnx=ZٜӸ;;JX2+8T%ю}mm$ԎjPST+.+C\"O}6 ay%i<-i<]q%q=a8 &EFy̘jk^XS3`^jj[reTQDOfyn{\,ԟR +endstream endobj 53 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 215.509821 99.933071 196.759821 ] -/BS << -/W 0 ->> -/Dest (cb6-2) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 52 0 R +/Resources 4 0 R +/Annots [ 54 0 R 55 0 R 56 0 R 57 0 R 58 0 R 59 0 R 60 0 R 61 0 R 62 0 R 63 0 R 64 0 R 65 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 54 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 196.562799 99.933071 177.812799 ] +/Rect [ 101.433071 751.923057 101.433071 733.173057 ] /BS << /W 0 >> -/Dest (cb6-3) +/Dest (cb2-1) >> endobj 55 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 158.668756 99.933071 139.918756 ] +/Rect [ 99.933071 732.976036 99.933071 714.226036 ] /BS << /W 0 >> -/Dest (cb6-4) +/Dest (cb2-2) >> endobj 56 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 120.774714 99.933071 102.024714 ] +/Rect [ 101.433071 653.081993 101.433071 634.331993 ] /BS << /W 0 >> -/Dest (cb6-5) +/Dest (cb3-1) >> endobj 57 0 obj << -/Filter /FlateDecode -/Length 5125 +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 634.134971 99.933071 615.384971 ] +/BS << +/W 0 +>> +/Dest (cb3-2) >> -stream -x]K$qׯ|`lk! fJ;+Ef fFeU >x=G0LfZ|W!gJ9Ś-,%#~s:KDWS/L}Nח /?_sw]gfQ0lª`YV&gJ`j,3y:2ĠZƂ}QXb.YbHcA WcVXBUy\4 JO;JUe\/24^5)X4AXxDGd5dPK%`Ud%!v+UTd:W --yFKV9g"|3 قY*P& XjѰ {װ {ȂAd:d]AdLD䘰V5^d+๬aAd0; 2AapaϑBL5,H5,@ sY jXP|*3Y 0Cc- Uk<,JSE &Xi)UdLhXb;jXX<"iXPfѰװͬaA&iqհ' ,`O7 KD -0 MKWҰ͢a 7ѫ[כY. -dx]dI`V[[otfgQw ,7bnU ,UV ,Hʲ$u*Ϊ|>-wȘ3KAV!kQ,)ϗ?b/씵PxaH*傔p'/D=쥃) -5|c}5B=fDVZ'79AtHGDm?tN&zQhJ%b] dcA6oζ7\ {|. -+1P)+; PiꮰyB -qvx;ê=NW>zѣД; I;n(ZbނME6g,D±k$?I"Vɸ -I$wz͇ !|7n&1)^?||w=zӯ/s7bJȲco|^h2'V.vO_a*/[ao->-kVor/-rݶ~nOiJ(0,M4x}2dc.0~vjZ#obWe]!fۦ*7T'6svϫQd2cZyi6.0Ž"o<:cmcYVvʪ귗?+m7M('kyVn0!&|r6hxW77^Wҿ>NOSICn+ыlҧIIq|q m} dzO8˨!u~wLguG=o]^$dla>1]_w>y{'}:^|dZ֗iX$|NMcr'{dn#XΝYnN|gPkLwi>>%f,БWũ^O2ƴy)/5xc,~Fo96vXQ`>GQyCx3y4E>qX'{ly|v7aS=}5+c N6"UawM_giZŗdʇם݆m1t9ϙI`[-/ȳKLuȼ5 o啜 ^䒫\|wj_azr!AßޞujFz&%ک*zz>{'q_w倻\]ZLW UӱLt9v9*&~75sw9$Qͮ-v9[NdsG!FoX54:<]}$smjF{Xkx䜝wxZxe5;C~r+tRϜhEk2W꺗g)fW> ͨ|y?UZףOUw~4iu.)qZ:vs1:ڜ|)6HD62Y7+ߴm{'9#4FjAӍQA-V NѦND4hdJ[eER9ŠEj:Jt%Fit(gK'@Qsd%BKv(7}*AC42S;C7[bG=j?+~?ćΖ!TĖƫqw2 0͎ ]0chzj!N΀.90zxw tw?C8 -endstream endobj 58 0 obj << -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 57 0 R -/Resources 4 0 R -/Annots [ 59 0 R 60 0 R 61 0 R 62 0 R 63 0 R 64 0 R 65 0 R 66 0 R 67 0 R 68 0 R 69 0 R 70 0 R 71 0 R 72 0 R 73 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 615.187950 99.933071 596.437950 ] +/BS << +/W 0 +>> +/Dest (cb3-3) >> endobj 59 0 obj << /Type /Annot /Subtype /Link -/Rect [ 287.395585 575.570079 323.513505 560.570079 ] +/Rect [ 99.933071 596.240928 99.933071 577.490928 ] +/BS << +/W 0 +>> +/Dest (cb3-4) +>> +endobj +60 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 280.647907 101.433071 261.897907 ] +/BS << +/W 0 +>> +/Dest (cb4-1) +>> +endobj +61 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 215.950885 101.433071 197.200885 ] +/BS << +/W 0 +>> +/Dest (cb5-1) +>> +endobj +62 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 197.003864 99.933071 178.253864 ] +/BS << +/W 0 +>> +/Dest (cb5-2) +>> +endobj +63 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 178.056842 99.933071 159.306842 ] +/BS << +/W 0 +>> +/Dest (cb5-3) +>> +endobj +64 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 159.109821 99.933071 140.359821 ] +/BS << +/W 0 +>> +/Dest (cb5-4) +>> +endobj +65 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 140.162799 99.933071 121.412799 ] +/BS << +/W 0 +>> +/Dest (cb5-5) +>> +endobj +66 0 obj +<< +/Filter /FlateDecode +/Length 4925 +>> +stream +x\[$m~_V u  lǃ!Ù<$X}ά"K*q3ԜzŚ-kg?ǫMt5x !\v_Cy?qw] (\rQaU ++FIa%gZ5ĈiXG1V]@Hհ<4,dƣ,Ѱ w]ESbhe\IÂuSyո +q -Rհ w , 2װ w]@x]հ wQ7D ơа8 UyZ X [$*/8Ӱ`l,P pjX6aAZB٣ K(^5!lFjRhU;d̒yaAǞcN˷/H?S886֞Wxe|p FP8RYDHA,FSLXL$c$z?ZhR;3mm06  +I~ iO`̽BHy~|7~ GZ*;>k߸p.}>}l;i*J9mS;W}˯?AbT"ϘǯSm١wc'Zs*@|DWd2k׿ݿ۴KU1G+>8u(\𕵋`V쾰ϰ\d8ɗh"HZ2i&SY؇j E;5hrKKpDYhIkow/.A=Փ3=/ @ -bm`8q'~r_bHwc?'ݥ͗kU,KtN7z2*WB|';$a1 ԥ{#QTЅ8EsIn rW8*t;^3yr]h +X}SB뫠ΰeEf ;vE<7G`~ Wc[ +n;{OMm ǧbˑũ~9/:<ܚNHލ?ݪ}\ElBwmVk˙^ƳG-#[u߯xJqX@y %|j:vyeHnTs=]|NC鲟EϘsnX6V.<J֓2?B&F P +θ0} oCmhRjne@^Rth—gdv +~$=36\Nt# b~[H\<7#KσؚK?! WEB.e˅?2mOŞxi?̕"GǃR*WidBe*szjǵ*Q3*BGV-Uow?{^gjeib}9C.IoҹZ[SPJW=ZWۭzo߮n_O\$MaNvyeESԉ^UE/]wj{SuuavCe/wY)N9Z.GVsLkwUWڦif^hv[cq}׽b.%֛-LQ;Ot~&zUC7/"r\2+|zގx4 ;)簕&ik>dgt\6>qq[h/52ǷkhƗ^mA:Y,>uHȼx tU)C_/}~rJ,֯W^_RciQ9|NMkr'{dM_]wOd6'~UV?'*]@/|2 l|:r?8Փi(5mc~TH^Sz+.KeYky,mTLz$m?e ,ēďo| 8c_BOazM[?aX#ɺ޴3:8?D`GVjzϸ[NYçxm{) 9 +3GH&k{Yv{ƳR}?󙺋N{vz6{ULmz^vWvoWVMO+ +>U*Oe?a\u$ts{]jW~ك7ȪN7{6Ϳ]{.<uO)l^R۾zڢ=Okw!CGO?7~6]-֡=Lno592\3|o<]-Q/qs悽)uZUmnoLY]MsR,;>?JACx ﹭% X^oIb|x8b)B}gmU_Sړ>jl;u%ҝ]Wg){8xyhe.ڇ=,+󗿮 xW~>@5Y7Ho7˃{boXɤsGv]BFA$3qi\wiu{f7?Ca?s|" +#ۓyָ̟ vx9JC\͘s9!+qOrCuiRuN0veÖRCE}]o-~0 ;)E!~ccz#88̡k~2]=xv6eN"Fl?趶EoH#'rvXBA;N\/w~kO E86y$IOuHӀ<r93莳VT2Aϵ 5cMv!g`$..7qۊ<#TKN{Nr&yXKc^xkdv/2ގl7/&S0$O}k 2-.4C-JǸduP$_.tǽh2˓d~G'<7voy{4 L7 $ƩCAu B3xhq2_k/ ݐ.rpX&/̔|SO)b 8S"C,?IS8eɣfԝV!NA 䁜h]ɣj/"L>o:x:5ô>9'\И+ ș1K ZH2-'DyQE{p1c2eXWK[qQGM1*CQZ%y{RP;jH;i W%r'mI BLE4=DZda(\ !:ׇU.} +PZ85[4ra":p[:YW +endstream +endobj +67 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 66 0 R +/Resources 4 0 R +/Annots [ 68 0 R 69 0 R 70 0 R 71 0 R 72 0 R 73 0 R 74 0 R 75 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +68 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 748.173057 101.433071 729.423057 ] +/BS << +/W 0 +>> +/Dest (cb6-1) +>> +endobj +69 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 729.226036 99.933071 710.476036 ] +/BS << +/W 0 +>> +/Dest (cb6-2) +>> +endobj +70 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 710.279014 99.933071 691.529014 ] +/BS << +/W 0 +>> +/Dest (cb6-3) +>> +endobj +71 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 672.384971 99.933071 653.634971 ] +/BS << +/W 0 +>> +/Dest (cb6-4) +>> +endobj +72 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 634.490928 99.933071 615.740928 ] +/BS << +/W 0 +>> +/Dest (cb6-5) +>> +endobj +73 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 287.395585 321.344928 323.513505 306.344928 ] /BS << /W 0 >> @@ -740,11 +885,11 @@ endobj >> >> endobj -60 0 obj +74 0 obj << /Type /Annot /Subtype /Link -/Rect [ 84.259843 545.570079 111.294999 530.570079 ] +/Rect [ 84.259843 291.344928 111.294999 276.344928 ] /BS << /W 0 >> @@ -755,11 +900,11 @@ endobj >> >> endobj -61 0 obj +75 0 obj << /Type /Annot /Subtype /Link -/Rect [ 308.171464 426.948497 401.561844 411.948497 ] +/Rect [ 308.171464 172.723346 401.561844 157.723346 ] /BS << /W 0 >> @@ -770,254 +915,255 @@ endobj >> >> endobj -62 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 298.534475 101.433071 279.784475 ] -/BS << -/W 0 ->> -/Dest (cb7-1) ->> -endobj -63 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 279.587453 99.933071 260.837453 ] -/BS << -/W 0 ->> -/Dest (cb7-2) ->> -endobj -64 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 260.640432 99.933071 241.890432 ] -/BS << -/W 0 ->> -/Dest (cb7-3) ->> -endobj -65 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 241.693410 99.933071 222.943410 ] -/BS << -/W 0 ->> -/Dest (cb7-4) ->> -endobj -66 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 222.746389 99.933071 203.996389 ] -/BS << -/W 0 ->> -/Dest (cb7-5) ->> -endobj -67 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 203.799367 99.933071 185.049367 ] -/BS << -/W 0 ->> -/Dest (cb7-6) ->> -endobj -68 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 184.852346 99.933071 166.102346 ] -/BS << -/W 0 ->> -/Dest (cb7-7) ->> -endobj -69 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 165.905324 99.933071 147.155324 ] -/BS << -/W 0 ->> -/Dest (cb7-8) ->> -endobj -70 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 146.958303 99.933071 128.208303 ] -/BS << -/W 0 ->> -/Dest (cb7-9) ->> -endobj -71 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 128.011281 99.933071 109.261281 ] -/BS << -/W 0 ->> -/Dest (cb7-10) ->> -endobj -72 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 109.064260 99.933071 90.314260 ] -/BS << -/W 0 ->> -/Dest (cb7-11) ->> -endobj -73 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 90.117238 99.933071 71.367238 ] -/BS << -/W 0 ->> -/Dest (cb7-12) ->> -endobj -74 0 obj +76 0 obj << /Filter /FlateDecode -/Length 5600 +/Length 5585 >> stream -x][%m~?<Z] lƓā6<磪$X3ICf0ӧ"?ڞ ~g_&;\R闓R0SkjOJS%pTKrGY:׺=l83RNX0BThE`#$r/J`JZ Rd ,iE`Ö"kuƨe`y0E=jeN1WԲ2V`2CbVKDF+/s"x VtR +eDcP2ZVPfr2gF+v -M0I1)eDZ^7N+W+NrVձu{Vs2EbR 41.iR8@e?QebIxcQހ@QCo r2 iXxA /hK 3gY]10ߪ.`/UR s$ul"Q]5[E5겁"&̫Or*B|fNfA{1j| >=)rbD\t!8iJe `%7fζf2L}/"O(UNm8u7$%&JF\r!%}#n1b]"|9!x+/Hl[:U]W -v^N؁5= t1bf]?A IҖg#^톬ҐɊ^($@K Y5!CT׆ot ctDR@QW`tJ]2"BU.ĵ. )-h ˈ+J.x ۋty_&߉M~YrHϒ8!,tTwtoWx¡hL>[LFp| -o` Vk-8Gq^+0yO(؆( uO^m?wW GɈV}r7ќӋ]ƅ$gz瀟y~QCzrԀhf\W_av& 22o7>]>BP,p5@dӏxo(us2ԥO3~nmYܶ/3E_q:6z eX\&XverfF?"bfU~" ,R&>XI2 !M??W_)jR6SSjm7T,er[v@?cJ6KCER[®mfiՀ7(muk:y[ձ+UgTޔSXOú߯zġv#wݪWW7ԃ]dd\S߂UvycE9C9ƅ".?vI* B6oCכkjlXhdԄtve4\쬖zf8~.ސժ_Q.G_9Vu:gy6DPf#ZYeCpwOwFy1OƦҾGٴ6F[Vs(ي> )ͱ8Myyۼ1ܤ#y|M -OBIH3#ʷphOk:Y|1KvX`@d5M{1C p4Z;FNfߌnq;1TY]5<xCޒ፳xy__og>JmfT 5cW ,݁):6t-_n7[MZߡ*jmτ $󭥖;ۼ5z{׭;_@zW:reAZn̲>SQ4tn7lub?E熟_JT7|=T\Cc|.aq(N!ĘHx+m)e - O"!7S93qmx>F"mz6~7SWeZJCExSW*sY>/[~ۊG_~ {mݹ\[!Ā5F~jӊRAn\+JVoJ5mO+}T%;HdMSGV1^o*J;/8RO1dT 5eV:E x -dEӔ÷ 2c}js$S#0}zR<>3wWޥwu!Rg*m/Tټ?>ZD+[MR#Ѧ.ɗ !|֜ bV _x෫w>1蝿) yc˝ߕ eNXͽ;{6gvLյɈg{lmuG42F[Zu2}swgg^Cby8x:'H??|=䖣y[@s㝿i+7 F[RX9j:0,剷z6BmxEfhye71MZ,tZ=b-߇_= _^"ylcF> "<ѬqeU`| ߰ {Luς_uuXUwnaeTw5y\먔:8'kri;fi['=E,v˱P{|tG-m_-h_Wl3Gtٟ_y[oA%DTzV؊om*w^#VVf\l[yl~jmLj:ZR[}!nԁ,9M#y5(y}Lw &G o-zZ'j`ţXʼnJ_r06G*06FTHB?/X't]K_đ~[2 =G1?q0Nā6tlO/(g-oaDlbN!o}1zկPß<ِF:*7-F,`O7YTF>}G̛%j, 9 -.틭r#Aբm9z 1ˏsQ~ك烖_z-$׳Ua?/9BS\gSٵA~9ߤƎ 2Eލvlk[> ]hoCkƷ1}d --ݓ_]<)vVg#I7A { Ə6 v֥謘V%1׈[J[WMtLN f.'i]&Y[/gbnD^i[z }RG$?XsB2Z59 6Y/@R; 0$zo'g3ePSni6_t/oTNe&:OcN^ IcG$`)B\6R^6>n% - z*=kZ aM>+%4&ΧN]_VgL,Z;ȱc$>/q~7:6ڒYsdn &1 }fS4{9Tݜq;etdG_Ot}stp[Wd7X;- :?6iC `o5mGPK%1  - W{ s3f(%Exå[@4ăb28[ -)gINă#я2nVvh-D^>ȎAˊWWrl"ŘO׏3?4}ya{94FhAGBRmhzfM,*cAt҅]]y-i5{,Z;FMhi=vg4#25Y|vEZ -h8j"LBepk!GtL佩XxAA] jMoVJ @Y0?f|]鏉SE^̿z$;ƞVK'23jg0U$ɶgXN)|L)O/5'osH(N1{6__N?uM9gi)F㕢"cI)~;a9kE`Gv/`sZ`Rq/`EZذGa1j12)ZQfʈz)Vgc2^e6ZxaJQ+  I+A:Y)K֕2bZYĬeӾ?Dd2k'$ %9jxdVFW+Nx))Ļɐ,O6BBʓ !kXH|& fTaZLwFE5,9L&k`jYLNI,9 0 O&IԲ8 հ w1g px" p0 Pr AViq@ + k,4wYÂܕiSÂ`pB4,cа d2|jYkX a)SND^9 /4,@D0e[M E R԰H6̬aA7Vl԰ F0[ KM Na~pI2 ^*`*CdY [D(V A K2Ѱ34rIZ+c#yfҰ q$T԰nLHЏ$^$?H6e$f4-}Y^;+B 8:#+{+jn>܇>ׅr34몙VpS#^(5tifY#ǟxXY ǕDِ1g!I`@(C3;Qb6N A݆n[+H7FCBR|{[Si;(z$#"-.ES0s`or#' +:W"&7(N)!Qfx*{+]Lc]L*Wz n%Y 켑^1ـ  Ʋӷ?Ⱦ¿1^/< !~$Cvr;Nao$5ȓ3eG*GҠмLNR EI*3N@v>˩}Eb\^A\8AT`? Fy'CT֔#܎hШ%|])4g|O $O ki,}B/C3eɦL +cEZ~W)}./͟<>^Ws}|uҞwQ8I f XU0Wo_-nBf|E1Xd|F>${G[ +;|vsX +<{*3^>V66e us,Jce?RrGwgcPyݠ4qCc'.gMV]heGNj`/&dd!DG|d wUy?0sQ5y\[s!qSFuTecp[y?JC10'~5I׍~AHywՙʲԮj˴jj52(yƭQ곺!AN:GYݿmmwUy7FHUS +\ +4$<n6")C|YsW&H:G$AfCF?.js%>o,=ϝG Ρ\A88j!'9yMgbj'!Dew궥UD֡kڪяJ>gϋ"pbrY*^D^6[xWĔdW c׿aBտ9#nS 38BWxi_Rvx9IRY˯U{c^K\MrLZ8 D#l|_r.=j^5 ݮ-O,=hՏ>Ls=BtỪ'9}|U?^5~_p^[uz9uN"uz9չnqu7u;7ۥ}$o ]8].^v/ea[-UaKOî]^Pjܝ u]aHE6=D˲V~:7FymkkUsmntza؞R/.enMQUXOqlMnf^DCbM ND ql.ˋibJ #ۓߕxjٯv}|~5/qlǪ#Ă`&G[& e2)%&;gY3~YN_"^}Y&zMY$Gwyi|^5c#=~+asSRZ  +{Idb/. Bthy3[KB_9ː\uӏvv{vvڐ]wc,'+pVM>-gXiRm+U6FLtK +OG43oVmо[q<0Áj|`O&L4Z;zNiXFvw4Y@,A>cbCПQ$lUxyg1;Nf,M .fJڞ0PU]wt fm3Qrˡ}m6RxZ;s}}wMu3G#yOxl:LYZr/뭷_} Wz-vplVZx6}yds;/eH8KE۞tWH˱oh _$LO FQ_$  +Er.>\ mw,jA1FJLYux˪eG3r_2GS~G[~s[:#WKTקۋq;Vo6h'+mLE؍u)99_Hy[vrJ$:QmV7hTݢ8' $im;Ѿ„ؓR;Bu&wÛ_1aLZW"}w-J`w›njWDYNQ$g(O?}?@oLMNx39) WmxՌm'VuWC]KD:U# `Dځ(KhAS\nQP:o".5~WԷ<*:7=6dy++|@-}{wW; juaϭ4{N=_YQnS(+{eC hyt$n i睸fD[n5"T'0AWnxҳEĞ,tZ" r8Curg)d9%xV9B\>Dv9;}d=1l:k5ˏM[++D vOћ.dw?M| 2Vbog{!ْ~O4Cw,^g]Al.E-m/*UnMUb4ʍM!.'M3ɝ31UC\)I}ni7MTUs|g:&xvR냏`rU#9M툗扝rQyw0HFNKU.'fɍ Qyͤdu띈o6ZH#=4aMQvfGydtMb+ ܴC56kd*#T&F͔_VΧoM,}kCΗƭ\m6_2,j',/Ui @;rֆNkMdڌ{9T9GIX.ZEGI9Jln36g}6˭:qC{}6t$.Á:Kd e#|n=:8tCrnJ˨OI|GRvCE|ס9[)9vD/ +/C!_qfǦ+bx!0_ƆeW(L{}C6hoԗ&x:װ*-Ujm{Ԃ=՗FjՖ)Wڪ:Q4TZk1VR8R-ԿV{Vڭ3^@~4Gg-L +-Tiywm03zdjz5{K|G]P֞ +MqLr\Q=r& aU Ӱpk1uLLd|\04U[^-uH @Y0_v/jYi_H$&oZ:)q endstream endobj -75 0 obj +77 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 74 0 R +/Contents 76 0 R /Resources 4 0 R -/Annots [ 76 0 R 77 0 R 78 0 R 79 0 R 80 0 R 81 0 R 82 0 R 83 0 R 84 0 R 85 0 R 86 0 R 87 0 R 88 0 R ] +/Annots [ 78 0 R 79 0 R 80 0 R 81 0 R 82 0 R 83 0 R 84 0 R 85 0 R 86 0 R 87 0 R 88 0 R 89 0 R 90 0 R 91 0 R 92 0 R 93 0 R 94 0 R 95 0 R 96 0 R 97 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -76 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb7-13) ->> -endobj -77 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb7-14) ->> -endobj 78 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 681.779014 101.433071 663.029014 ] +/Rect [ 101.433071 715.084475 101.433071 696.334475 ] /BS << /W 0 >> -/Dest (cb8-1) +/Dest (cb7-1) >> endobj 79 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 662.831993 99.933071 644.081993 ] +/Rect [ 99.933071 696.137453 99.933071 677.387453 ] /BS << /W 0 >> -/Dest (cb8-2) +/Dest (cb7-2) >> endobj 80 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 643.884971 99.933071 625.134971 ] +/Rect [ 99.933071 677.190432 99.933071 658.440432 ] /BS << /W 0 >> -/Dest (cb8-3) +/Dest (cb7-3) >> endobj 81 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 605.990928 99.933071 587.240928 ] +/Rect [ 99.933071 658.243410 99.933071 639.493410 ] /BS << /W 0 >> -/Dest (cb8-4) +/Dest (cb7-4) >> endobj 82 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 587.043907 99.933071 568.293907 ] +/Rect [ 99.933071 639.296389 99.933071 620.546389 ] /BS << /W 0 >> -/Dest (cb8-5) +/Dest (cb7-5) >> endobj 83 0 obj << /Type /Annot /Subtype /Link -/Rect [ 298.350419 416.193907 391.740800 401.193907 ] +/Rect [ 99.933071 620.349367 99.933071 601.599367 ] +/BS << +/W 0 +>> +/Dest (cb7-6) +>> +endobj +84 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 601.402346 99.933071 582.652346 ] +/BS << +/W 0 +>> +/Dest (cb7-7) +>> +endobj +85 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 582.455324 99.933071 563.705324 ] +/BS << +/W 0 +>> +/Dest (cb7-8) +>> +endobj +86 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 563.508303 99.933071 544.758303 ] +/BS << +/W 0 +>> +/Dest (cb7-9) +>> +endobj +87 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 544.561281 99.933071 525.811281 ] +/BS << +/W 0 +>> +/Dest (cb7-10) +>> +endobj +88 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 525.614260 99.933071 506.864260 ] +/BS << +/W 0 +>> +/Dest (cb7-11) +>> +endobj +89 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 506.667238 99.933071 487.917238 ] +/BS << +/W 0 +>> +/Dest (cb7-12) +>> +endobj +90 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 487.720217 99.933071 468.970217 ] +/BS << +/W 0 +>> +/Dest (cb7-13) +>> +endobj +91 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 468.773195 99.933071 450.023195 ] +/BS << +/W 0 +>> +/Dest (cb7-14) +>> +endobj +92 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 370.326174 101.433071 351.576174 ] +/BS << +/W 0 +>> +/Dest (cb8-1) +>> +endobj +93 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 351.379152 99.933071 332.629152 ] +/BS << +/W 0 +>> +/Dest (cb8-2) +>> +endobj +94 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 332.432131 99.933071 313.682131 ] +/BS << +/W 0 +>> +/Dest (cb8-3) +>> +endobj +95 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 294.538088 99.933071 275.788088 ] +/BS << +/W 0 +>> +/Dest (cb8-4) +>> +endobj +96 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 275.591066 99.933071 256.841066 ] +/BS << +/W 0 +>> +/Dest (cb8-5) +>> +endobj +97 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 298.350419 124.541066 391.740800 109.541066 ] /BS << /W 0 >> @@ -1028,11 +1174,44 @@ endobj >> >> endobj -84 0 obj +98 0 obj +<< +/Filter /FlateDecode +/Length 5342 +>> +stream +x]]q}_./?_@` n/Ewmy)JTjwg~vUd%aDFcE53G5&_XࢊZ]_/:jU'N"bQ{!)#I'$yb>I(bR,m"̠3$$%(M0FCR0G!hab D +iƫFR5*lfҜS!FJ*Fgm4[!Rl!` NiŦ褴[,Z' i ]IL-:h#e|NDbZFN1mӬ'純fQ4 [YL-i+9BŔoN;#ybm$1 %$ +)%l%lr%lʊbt %p -ieY؂ 8[,9 ؖ t68-i$.p \%.p`\I\@RsS҅G X`%.p]G)H\ASL-`GLrx%. .J\^UaXQ6%-qwm$qwm Etxz܂4rwVZAE wA!^` VHN, `Ui ڠ41K\6udԇ_hQ4\|\雌\ζ$(\CHb[a[?`%̲l6_s~?ɪϳ:l3c㔇\*u{[rK~[uc[hM[k­vg?¬WMd^$gP5||}E??Ϙq" E^$LBį0?X]ӌyV7doRYvJ6m]ga O\hao y֍:ͻn#a"( jY +:6>SG0aaqnٟۈ6@>v]?#Z!it>4yJy"]yxy" xOK #Z8썼 + ̈ҥ~ᔧUhM7-ӧ.,T9UqYf+kԙ 2lH;6i2eua,{@/19LxQ9]a79<xa Dn?˾4?ʼ ǃVN<5'u;c_}ᔺ?~^upIZ6ʼgݕ}i/'yj-*wIX\к) xq9.Đ;)4aEoU.>虢_Tonszޞƕi5<< 1lX+8F\ qZEe4;{Y:?-yQ9nk:+i1YN;u +dVrٴzǻYs) P(`9&o2O(v.w6AkJƮ4 :VC0 Őg0X.l˖R<;kcj[Q(g"9&D!,;tD,{`;o[So}L/ N;`a@|+s'u#dG,x'<ums]bs?'_7a1A;s*OcoZ:5%ygpz[5> ͏5Y/ihe_?ҙ_AfegJWtq6ż(wվG3N;VŬҲN~a]w=c8<1Yu9tjp:*tB\n)TiztFD}uveH]U|zDw{fC +V+/%AX[^~3 (3=~ +GSΓ:"-{hQɂд$}͡JN'=Z1uO @>hs1Ѻ90cKi5 7&G;<weE%VT<M } 03KIjI^PPW|zUfa$ʻ!Cl`č ߅X*o4i}ykɼ<-+)CɋYT^ilm8^F}Mb L#Z7)p:r.3txJ x9PtH3@4^qNFпǀ|#2y%G@<<@l$ƇoE%ćam8A7gQ[Pv9^D`7ޢNܬJ +z< 7pZ*tV('o'uIsА{O[Vq\2&/a:b#3AZ\B,e}Rye#ݷ֢R-H}Ix}jQ- + 2BgݞSyy~cV0ZTR`zr_v+~8-B7g 4@pBTss:D]hQI j/`SC,~ x?-P_QtRi 5o|AhYIа5A۲ᠭc$ί?ǼjwU6^"vV'uV_@X'oy#X-*)7AjSCh?mC0%@ٞFyRy E~=!d4.2﷝l[1l}vV"He;QcDMVyESfJ>ըת;[]iS#-ڏ=DdQ ܸr.N< e2h[2.1,^UoXg:GNP(y>4K}d|~ha$;o}'U7#+4aN|1VSA=sU )ytzs?U҃-6̦ЯQ-q~/+#Sה1G_[. oGKst/ [-E] m bv̑G"ӎ8-ɧA;p=;AUM'zX* f+~-Y_B3Ňj3@⡘Bt +P][>*5]ftfơ; oTWQ_8RkuܤlB"еhBgI*5 ]|siTlRW͵).dfi2|Dq)upc7c mįܾs&NKcM׬2>OTᛔ|0 ^ f/i:$Gf#E16̎Gm3ܭҡ9bJ݊$_"qYT".Bq9Te 3c%~CQfǢŐ!/ƂɌ=^ɡzK7(m7Fxԕ˰lc+꼽ZYn=ׂ=ňAڜR-*E tc)jY'b)cKWZ#W&/[G-αߝ9[,YzNWeۺiYwmmP7$Tw5M-#-?eä'ٔlu +BmdҰ5JF]kBw(rNG_J,|0UXVZ@X4=QݵmBN ˖qЛ9aI? +endstream +endobj +99 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 98 0 R +/Resources 4 0 R +/Annots [ 100 0 R 101 0 R 102 0 R 103 0 R 104 0 R 105 0 R 106 0 R 107 0 R 108 0 R 109 0 R 110 0 R 111 0 R 112 0 R 113 0 R 114 0 R 115 0 R 116 0 R 117 0 R 118 0 R 119 0 R 120 0 R 121 0 R 122 0 R 123 0 R 124 0 R 125 0 R 126 0 R 127 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +100 0 obj << /Type /Annot /Subtype /Link -/Rect [ 289.074296 348.693907 316.109452 333.693907 ] +/Rect [ 289.074296 784.370079 316.109452 769.370079 ] /BS << /W 0 >> @@ -1043,519 +1222,326 @@ endobj >> >> endobj -85 0 obj +101 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 199.908303 101.433071 181.158303 ] +/Rect [ 101.433071 650.584475 101.433071 631.834475 ] /BS << /W 0 >> /Dest (cb9-1) >> endobj -86 0 obj +102 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 162.014260 99.933071 143.264260 ] +/Rect [ 99.933071 612.690432 99.933071 593.940432 ] /BS << /W 0 >> /Dest (cb9-2) >> endobj -87 0 obj +103 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 124.120217 99.933071 105.370217 ] +/Rect [ 99.933071 574.796389 99.933071 556.046389 ] /BS << /W 0 >> /Dest (cb9-3) >> endobj -88 0 obj +104 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 105.173195 99.933071 86.423195 ] +/Rect [ 99.933071 555.849367 99.933071 537.099367 ] /BS << /W 0 >> /Dest (cb9-4) >> endobj -89 0 obj -<< -/Filter /FlateDecode -/Length 5104 ->> -stream -x]ˮWܵ =Ơ1 uYoɨJ+#d$yxd2Ew$2*tU1&_~b*focxy߿ƼXsƿGVS1ŨPi*F냠 -FsTpG4"ܠdmT n8ͪ 7l4$> -*ᇱZ:8tƫJRYEL9"o$]V!$txC%|! E|):IEdA ЕD|AI9 N1:9-Qt= -%hE|N[I ᏤOxSz3k#:Ɨc(=H1/I`cT-I$`S(I,`SVhf((:k$"px -8_=WIg H\|$.p`[Z$.p[H\Mpᦖq] -$qJYuN H=J\+q:JAudu3I\@]gtFV)i k& k#Qkxג ( -h -r8_@`: K$.]1 }lLA5 '25.[Բ2!d `Ui t]m’u.$. -Q $R9 qA:|.(\{ D|H V$qAY+qA!T6|\DTDD0CJ`UkQ3QIa(6`.: xp:C _U$.PEd. |A-q"]茑 YhPdfAK\sIT#$qA8T3M0/ ><`&98Ody$.H Xm%.6y%. ⓸ 8L4d0ߴ$q%7i71mvQL#DuAS-8 M f $q 7ыKQ\. ft]DA\`VkdegW 4cl 4U 4ȗH2q*Fx&Nx_}1f7-}sdFO|_Ͽ(+eX{"6AWdGhhpKl؉x]tc'1c/ٺ g`b`T.ȾVZ.MgPLcՓ&S@@*-s':^MĿpA7B.1*?]~?׿/<ֹ_g\MUa_=]Q|瘏=tˋ{ߟwi5_og PUin_>[%*@`0 xk&_G oDo5:2Zj!f) -(l:Bo", 6âӴf/R!e8B5̝ -.]jR7`]5_Gayi eL3Mo݇@sbKj+Frզlw}1kS5)NߚTjsN$eLˣN#,wo.ӛ|;Kw~^r@]=%qV M!>CkI/8Y{0[A(`-WK'Wg~XR5#GIl`'y ,NMUMtef^\2eԒ6*[^.-<,d1?pB7-B4P1:#+>߅KL(f^yy~Ԅ@1?bBPI,Tl&f+Y/5h$.Dz8Sxk6#rۦW&8i^w2]LIqXfrG@\y Ux|O=š8Πہ?߃2y*mzgަ[fi‘vL: |9$'tk;h]"<{my4d}$7|L+I˩j\1E(XOj;kq{O44)gsky}B}$6luHʜ1l{@bjԆPpCGK&O#1[yh[H}٭ptB -:;#c^`OpѢ_J^m@)n r;B9A\6$ˋQGBk6!CyhSHа/vAS^8h>As yյfL/jU_6lV|Ba) oRS> 5Y\yHe>Zri 4Yx;ƥq_fٷY.}n6u >3W`8mg%Aj(B/ʣ,hi@ߤqDl-c]ɺS}uHSg[[ -w"2kmʱ<:ll_٨e"f4^/&m_8^wΥKCŭϋ6ӠtBя|-><[,"Yl¼m}S~fm!pBy.l}n ad(ϋ61gئه3[gs[3"T.fmx#7l yϳOg>>w0apty}(CpSȿjřlzFF&_b8ޚ@/k~Otx䦜m!sʕ6;S듾lWh_ig֖[\S,W|ǼYD7|bl›ٛl2!6dE Xy:~*@BG'Δ4Noj -cN=wd=9*##h<݇r=:LZW:T f.hc'<[գ%#g07wdM <t_ x$t7!Rbp3IħP>Y@u\C_! -~4h:kh4-GEHbvW(HV|>9qթ6tkM^ӱ#.{.KڀpMGwewJU׳,%o!=$!f5R|45B`ZTyaY>3sKBcD?TxqMsi.YWtR^vđ FHg,-/HS:gn;_Z_}5.ϯO+{b{1]_K]BsŇ3=C ᡘߍB? P\I5m?skscՙkZ'|XRW֮ͪMr5vDAYc&b~h5Jʻ0U QKk:Az]sbKi5]PwU +utFtG?-PZ7v^%IvQH;Wh_7 -ݐo'ҥ< ];U&e)? 5HwbU/fo+i:$?6y0;֗IZHϤRH*1WylŦj4:7(mOߺ׭`oƝo87џow|b~t1sS -1Bw}+[;w2i}R98;8߰#H; ~4}mܺ#4- Uغ 4~6[;5us݉4AMӎBp]kP3uW-ڶ7ǻs;+\u/C}H`1S\MXHzƦUF:uKŘ1?y?_ܽݯ.XڨIFi16“\es\yYv^C-/7=ׂ5zhA4uk?JU). Urէp5R8[Lѥkڏ*яoZZG8~wlddanR)]eӶ:ھ Aݑ#SKλn@JU g0PκxB3R4N_W2XCs: oPcŐ m+ҹ -p:i|]re"qЛSQqIY:)8 -endstream -endobj -90 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 89 0 R -/Resources 4 0 R -/Annots [ 91 0 R 92 0 R 93 0 R 94 0 R 95 0 R 96 0 R 97 0 R 98 0 R 99 0 R 100 0 R 101 0 R 102 0 R 103 0 R 104 0 R 105 0 R 106 0 R 107 0 R 108 0 R 109 0 R 110 0 R 111 0 R 112 0 R 113 0 R 114 0 R 115 0 R 116 0 R 117 0 R 118 0 R 119 0 R 120 0 R 121 0 R 122 0 R 123 0 R 124 0 R 125 0 R 126 0 R 127 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -91 0 obj +105 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/Rect [ 99.933071 536.902346 99.933071 518.152346 ] /BS << /W 0 >> /Dest (cb9-5) >> endobj -92 0 obj +106 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/Rect [ 99.933071 499.008303 99.933071 480.258303 ] /BS << /W 0 >> /Dest (cb9-6) >> endobj -93 0 obj +107 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/Rect [ 99.933071 480.061281 99.933071 461.311281 ] /BS << /W 0 >> /Dest (cb9-7) >> endobj -94 0 obj +108 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/Rect [ 99.933071 461.114260 99.933071 442.364260 ] /BS << /W 0 >> /Dest (cb9-8) >> endobj -95 0 obj +109 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/Rect [ 99.933071 442.167238 99.933071 423.417238 ] /BS << /W 0 >> /Dest (cb9-9) >> endobj -96 0 obj +110 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/Rect [ 99.933071 423.220217 99.933071 404.470217 ] /BS << /W 0 >> /Dest (cb9-10) >> endobj -97 0 obj +111 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/Rect [ 99.933071 404.273195 99.933071 385.523195 ] /BS << /W 0 >> /Dest (cb9-11) >> endobj -98 0 obj +112 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/Rect [ 99.933071 385.326174 99.933071 366.576174 ] /BS << /W 0 >> /Dest (cb9-12) >> endobj -99 0 obj +113 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/Rect [ 99.933071 366.379152 99.933071 347.629152 ] /BS << /W 0 >> /Dest (cb9-13) >> endobj -100 0 obj +114 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/Rect [ 99.933071 347.432131 99.933071 328.682131 ] /BS << /W 0 >> /Dest (cb9-14) >> endobj -101 0 obj +115 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/Rect [ 99.933071 328.485109 99.933071 309.735109 ] /BS << /W 0 >> /Dest (cb9-15) >> endobj -102 0 obj +116 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/Rect [ 99.933071 309.538088 99.933071 290.788088 ] /BS << /W 0 >> /Dest (cb9-16) >> endobj -103 0 obj +117 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/Rect [ 99.933071 290.591066 99.933071 271.841066 ] /BS << /W 0 >> /Dest (cb9-17) >> endobj -104 0 obj +118 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/Rect [ 99.933071 271.644045 99.933071 252.894045 ] /BS << /W 0 >> /Dest (cb9-18) >> endobj -105 0 obj +119 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/Rect [ 99.933071 252.697023 99.933071 233.947023 ] /BS << /W 0 >> /Dest (cb9-19) >> endobj -106 0 obj +120 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/Rect [ 99.933071 233.750002 99.933071 215.000002 ] /BS << /W 0 >> /Dest (cb9-20) >> endobj -107 0 obj +121 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/Rect [ 99.933071 214.802980 99.933071 196.052980 ] /BS << /W 0 >> /Dest (cb9-21) >> endobj -108 0 obj +122 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/Rect [ 99.933071 195.855959 99.933071 177.105959 ] /BS << /W 0 >> /Dest (cb9-22) >> endobj -109 0 obj +123 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/Rect [ 99.933071 176.908937 99.933071 158.158937 ] /BS << /W 0 >> /Dest (cb9-23) >> endobj -110 0 obj +124 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/Rect [ 99.933071 157.961916 99.933071 139.211916 ] /BS << /W 0 >> /Dest (cb9-24) >> endobj -111 0 obj +125 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/Rect [ 99.933071 139.014895 99.933071 120.264895 ] /BS << /W 0 >> /Dest (cb9-25) >> endobj -112 0 obj +126 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/Rect [ 99.933071 120.067873 99.933071 101.317873 ] /BS << /W 0 >> /Dest (cb9-26) >> endobj -113 0 obj +127 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/Rect [ 99.933071 101.120852 99.933071 82.370852 ] /BS << /W 0 >> /Dest (cb9-27) >> endobj -114 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb9-28) ->> -endobj -115 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb9-29) ->> -endobj -116 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb9-30) ->> -endobj -117 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb9-31) ->> -endobj -118 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb9-32) ->> -endobj -119 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb9-33) ->> -endobj -120 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb9-34) ->> -endobj -121 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb9-35) ->> -endobj -122 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb9-36) ->> -endobj -123 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb9-37) ->> -endobj -124 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb9-38) ->> -endobj -125 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb9-39) ->> -endobj -126 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb9-40) ->> -endobj -127 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb9-41) ->> -endobj 128 0 obj << /Filter /FlateDecode -/Length 4955 +/Length 4974 >> stream -x]MׯI?bZ ad10}bTI`%HdGf KΨr VkYrl./.*orH (zW}ϭ9[sƟb^HH҆$U!)[YJ>:Ƥ3\N^J$$%A.2̰8) f죐d40Vk1 h -iƫFR5*lf҈Tx#eBIJsgm4[qNKiQRZ-HiŦHRZ-[$2)sbZFN1iV{ҌQ$1 # -faK>iœRRxSLIG7i2R-F't6DAyIr:l"K ؔ$+rxA5- +N$. -֑u@u: | fj K)8  (e KN %. .`%. .$. .9%.p]"hi$w(qbY Ы -8 +ʦ%.p]wm Ӣ$ xz܂k+qZgh1BH$q -Sak2ܟ0Vʤ$.]}bZV&ŅqVV&,qQ L4." q.0Dd+5GgrbgW 4÷K o5 9h31LA\5[Eⲁ"s'\V%8D&3Ct_-vYN{jY)+ O. RKqm"t0-:lDHZ\Hb|ɰm6f;s})t:V*bal8k`Ą9ٙS[X8E2wb@ nNFkz oиV?tOߣ_N7ߙٟ};ubN:.xs*ίYy\|XeJXo(10VPMˈιGuZ݇-~[yy.Tg`3j{:셵S -u,DAvf>=ZghCJ WLF QnKSD)H!9/Qc`tR08| SV4DK9TqeA߳ފ_h|ƍczC'#esY8sN<:=h[s]X_8js>oh(yw8sFަYҍG:W9ם-{ᨽop'Y'ŷˢ}WmPmOtJ;,np ^`-܀{oiޓŜx ȫMiԞ{i<ºQ?@2&v9 HO ->DHo*8<:>:h ZѮ[qƁ:ǁcOzG'qXמ8p@,9Z|8sxB_6mQ N3EQYv|P~N|Z-Lq)@:*t[3z X{0Wۿ6_`mq>1b`9,|O|w8nw!bS,Z1ug\]VPIo%e ihuR8 MP1?DJ6֏[X@eWWgwqƺnrB$J;|vQ{#ypl+/št1&v0Y $Zl3ڳ'KPުmW:UB"櫸]ީT:=9̐qOi~yd}:-áǺL璻nYbQ0<9!˸#T.CeF? -'u8'lT2ձ<9ֶgc޷1߅f6:<؜q d}&6,Og rlx (3-TZ PIrEoN8#>s M%_tĜQ.<4s zg(VU@|[5Z3ηԿ=22G#I&:ǁ?:(9CoSIPϫ8m"eX9?A-_=5hy!Yߗ~s:ǁgi z*m*lX%M•6 -Ow?xُQ{mg`5?!%o_`eYB;s{Zt]| m?^mwܿƚo-Nc5z~kR04?{y̴7l`6; L@3embvK|R8 "~ !|&6-:wz?`R8KơT=Q.IJQ hg&uI139m[/0ڰg?`޷ gN#cv?`R87 $Tm%mڳ0j1`t6?50s z -b<<س0jB/l~9Gޔq ~m3GsgӋ c}ֱyuItiZWH2qɶ_۳5j[c%14{R8 "R, Tu[@*كؓ:^^*0;Vb94/x 9ΐI(A!ctq~?^׮$!/k9?y%)0dJKY@եUA!/q0o>١mÜq9\2WwSWjѮ6RmMg{zl;1sx$~ʊ&!#nV*݆k:oo xd${LwcN0X^mɛ76O1w!0ɣ +(fyķqۯ R:[G6ܵl~]6ħy\"uvcTbK, k35O^cVy|WWŖCs| -˷ = 0b>'FX, b74,\siXXtO'qȣ4yOZz9APNYkY|DJ6*_$k/Z_}Q1rXT,(ʬb~iR^jf[ -lż܄~ꮺ&kCXMt_u= ҵUJQu2UK! z9 t)]Wb.Tj\ o-מ5Wj|3ARmxA*nh*nŁ{5f 7vAzQWh_ +nxiR~f76 U*eY~1BӮZ%<6xH+{.F&ʯqסu,ġrk/ [0_/csb~*4۵:a3 čF_qT 2㾜~Zܜ%o9^d~}td<Gc.~rF{2k`Nh]GMlR ku#T55ֆVZC];—VMsؗK*7j?7TE;L-K>wE⊳6Tg;E\ⲫ076f2 Jjӳ -/0/fl. B`/+{?BN$. xswVZAE wA!^` V{Ȭ7Sak2ܟЧVʤ$.]|,+QBE-+Bw᨜ L d @i-qA6 MK_x3I\xC0XUy0nR8a.dq%βߙ!h6ڈlԞ^7h$gjy&¤qp U!Ot6iОw2C w7l첿tĈ3*䓀kbϤ֨oVkyבlL$9@q%>?zB<0M2X^˔k]lpte&3Ij^L,/pېe2d6;sZ"x&xW'inwr `?hi]7_;sz^D U! pB;.dlz邁 ܺ&u%TP1 y2jգ%cQßS] ]uН9t# U!˄uοĭԠX!\ )-S`BZsD9KD X +6nC=c V+&dS@ ._cyǐ9 dIA^u!RPw#|W^BsmGq +0wkv%fR89MN7w&MDwc6M>g|7M>s|6Ġ]Zy-ɏ!8sz٣B$WŻ1y9IIѢ=QN)HYOGԨv[NxR8`M>Yz_;U!%n= jT1Xr(UӘoۙvs:id-~{&73Һ:ű=NqG}Nei)N|0aT-XoЕS|XAP?G[Q{;CO  Gz 9sjpMׅi +v'?9L_G7@ޛ_`*q љ_DH +Y9,LK(K?q]v``kq T[kvlS9 ˛t^8p,kO8jG}q`0x[t8s:>F$Wqh˞8p&,6'F&uSgޢ1[Oo+p]jz?l5o?}mR8`HXB> x=gF}g{KB6 (5:sEgL.gƲ^DJPē 7wR8H( okօv,X|Ga6mFR+soBZuW:Û ˻p-vCHV90Nxbܲ.shrwhr> o?49s%ީeOܪgK31jB]wD9 G/~օ<&Gj(C:c#goU1M69G}i#\MpM: EB~C{MMEfY}NAͤŤqq*_K}[دܷ9I%k |d3:_|ڍtx[օcϙQ{ߙ]Axʄ4]rx'u^B 7]n0t&ۜ/`Mq=;rTfZ X,`G w6g'u'{Ѫ.`ey=050;~zaDtgT+ˮz⨾oM@ݠ7cT{}&ejY6)Gl[ +BX4Gr;W0? 0"3_i+ehDvUb|?k w..y#(~&p-~pP?|I%<ͼ#_>CvdJB?\?4F7M,_4̏'gs^y>7$!Lۯދݥ]qQ+}5כ;_~< ƄGcZ`d~zd~nRv)p&Rݰ)n&Dג%%HUg/ymQb}ꋘ_+*Ψ\S}Yj; I.ʻV\S|.'1nTRSͥ) .ՊҖ:FmG+yCqmknx9a!䣐7о@Ot}kr /-'k4: + +_Sy_ UHU+fM^WR*T.nT;ƊپLB~&ݚ*.=bT%uLa~*WZP~Y%7;}^‚}[r'?WU0_/cd~*dku0BKn4$Zى˯IriqsyQxpGG_yws?W?nue [u{2VoLomDKdZ^_P_SS׍KNSTi[vɶBՌx|j4}tPEp?.S-qYKl +Ͳ ȾZl?M%EFk2jnuI[˂yM+~svJJ5OƩT\e9ny)t鼭\\ rZh.zv2P*iBt4]c)J,OZ5hkR+|jj{8t嬱dB]St%m,eo{!E!-}s7[ * Dg9sB6R4v<g2G_Cs:^ ۂV/o j|rUx} L4 rMCE#QqJ\VS':* endstream endobj 129 0 obj @@ -1565,7 +1551,7 @@ endobj /MediaBox [ 0 0 595.275591 841.889764 ] /Contents 128 0 R /Resources 4 0 R -/Annots [ 130 0 R 131 0 R 132 0 R 133 0 R 134 0 R 135 0 R 136 0 R 137 0 R 138 0 R 139 0 R 140 0 R 141 0 R 142 0 R 143 0 R 144 0 R 145 0 R 146 0 R 147 0 R 148 0 R 149 0 R 150 0 R 151 0 R 152 0 R 153 0 R 154 0 R 155 0 R 156 0 R 157 0 R 158 0 R 159 0 R 160 0 R 161 0 R 162 0 R 163 0 R ] +/Annots [ 130 0 R 131 0 R 132 0 R 133 0 R 134 0 R 135 0 R 136 0 R 137 0 R 138 0 R 139 0 R 140 0 R 141 0 R 142 0 R 143 0 R 144 0 R 145 0 R 146 0 R 147 0 R 148 0 R 149 0 R 150 0 R 151 0 R 152 0 R 153 0 R 154 0 R 155 0 R 156 0 R 157 0 R 158 0 R 159 0 R 160 0 R 161 0 R 162 0 R 163 0 R 164 0 R 165 0 R 166 0 R 167 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> @@ -1578,7 +1564,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-42) +/Dest (cb9-28) >> endobj 131 0 obj @@ -1589,7 +1575,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-43) +/Dest (cb9-29) >> endobj 132 0 obj @@ -1600,7 +1586,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-44) +/Dest (cb9-30) >> endobj 133 0 obj @@ -1611,7 +1597,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-45) +/Dest (cb9-31) >> endobj 134 0 obj @@ -1622,7 +1608,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-46) +/Dest (cb9-32) >> endobj 135 0 obj @@ -1633,7 +1619,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-47) +/Dest (cb9-33) >> endobj 136 0 obj @@ -1644,7 +1630,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-48) +/Dest (cb9-34) >> endobj 137 0 obj @@ -1655,7 +1641,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-49) +/Dest (cb9-35) >> endobj 138 0 obj @@ -1666,7 +1652,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-50) +/Dest (cb9-36) >> endobj 139 0 obj @@ -1677,7 +1663,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-51) +/Dest (cb9-37) >> endobj 140 0 obj @@ -1688,7 +1674,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-52) +/Dest (cb9-38) >> endobj 141 0 obj @@ -1699,7 +1685,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-53) +/Dest (cb9-39) >> endobj 142 0 obj @@ -1710,7 +1696,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-54) +/Dest (cb9-40) >> endobj 143 0 obj @@ -1721,7 +1707,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-55) +/Dest (cb9-41) >> endobj 144 0 obj @@ -1732,7 +1718,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-56) +/Dest (cb9-42) >> endobj 145 0 obj @@ -1743,7 +1729,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-57) +/Dest (cb9-43) >> endobj 146 0 obj @@ -1754,7 +1740,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-58) +/Dest (cb9-44) >> endobj 147 0 obj @@ -1765,7 +1751,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-59) +/Dest (cb9-45) >> endobj 148 0 obj @@ -1776,7 +1762,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-60) +/Dest (cb9-46) >> endobj 149 0 obj @@ -1787,7 +1773,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-61) +/Dest (cb9-47) >> endobj 150 0 obj @@ -1798,7 +1784,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-62) +/Dest (cb9-48) >> endobj 151 0 obj @@ -1809,7 +1795,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-63) +/Dest (cb9-49) >> endobj 152 0 obj @@ -1820,7 +1806,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-64) +/Dest (cb9-50) >> endobj 153 0 obj @@ -1831,7 +1817,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-65) +/Dest (cb9-51) >> endobj 154 0 obj @@ -1842,7 +1828,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-66) +/Dest (cb9-52) >> endobj 155 0 obj @@ -1853,7 +1839,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-67) +/Dest (cb9-53) >> endobj 156 0 obj @@ -1864,7 +1850,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-68) +/Dest (cb9-54) >> endobj 157 0 obj @@ -1875,7 +1861,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-69) +/Dest (cb9-55) >> endobj 158 0 obj @@ -1886,7 +1872,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-70) +/Dest (cb9-56) >> endobj 159 0 obj @@ -1897,7 +1883,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-71) +/Dest (cb9-57) >> endobj 160 0 obj @@ -1908,7 +1894,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-72) +/Dest (cb9-58) >> endobj 161 0 obj @@ -1919,7 +1905,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-73) +/Dest (cb9-59) >> endobj 162 0 obj @@ -1930,7 +1916,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-74) +/Dest (cb9-60) >> endobj 163 0 obj @@ -1941,48 +1927,93 @@ endobj /BS << /W 0 >> -/Dest (cb9-75) +/Dest (cb9-61) >> endobj 164 0 obj << -/Filter /FlateDecode -/Length 5165 +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-62) >> -stream -x]MׯIF `>^, %F$Yd5FAI>>F0Lw2;sIO?~9YKŒpv ?I%'|_qgoJޅ?JI9%$HI -CT3R${3$eAIfXK$9 ;VM!悉hygb.i i.y-.8-cZÖPl ji)'--d4s"--)JZ-@WV`iiL(YM+H91`B&Zs&aDbRj\U.($lj\i4.@a-Ѹ w]iqD xetVKhqeܢh\H}f 3׸ waqAoиqUӊ%g x5.,lliHNC5.]LE޵H޵ GM-kai8z0޵=wMEޕiS゘D0 ̦5." . B@Yjl6Jָ yBk\&+E64\8[ -6@60XC<=lJVWrR1(xM{aGw*3Dsg Gy!L޾'+rgxfoϱk Y5)^i$pXR`X֞º^uyU[kO򊪼t/bvKB?K5}S%QZSNmJѿl=P7x90V]py; ԏw?vNLx#zY[T[]X)aNqDc|K( -]v񚷓_wƲ .AӞmRjoXXNHѺIǁK׮X-+DڦmoBJy/+ڣe,O-O*rl]=O<LО3]:oim\GNCsl'vVq_ř t[ RI_ܝyH&+}:#.PT[Lm%~ -["ccҞޡix]:]6{Foc_ߞ6xk}n= -$"i7bĘ }OsxRy8@S.H+s2 g`- R͹r18ɲQo]5me_:Kz]?uO?j+wzwr(%i8CvRy<_M{{%e^@q/Weo/w.r):w78]HN>(n)Kw/ n:-G:R7J߭xc b98y`?{Ф(crсkzƷ[2t5oٮ=w҄:0 -<XymԷ[LM=ȤbvNlqŸb/'ch#fy$y$"FKG+U} (ʅ)[=vqӾ|owta my3^?'Z(~Կ(+r#|j%QNOqSB 977뺿[§k*ԢjzdU4ԜC"z:)l-k]7 .\-_IͷZO+ofuʭF4ɇ1b܋@kYn |:A| -I6BRWnge\ -Cw*B -,?7HWMo^Z(;پ\J~!ݖN5Y'O'$c/v uM,Vۧqe/TCNP U]ıqs/Nǝ|0_Ob~lbypQ*넛a M"lǪ?A͸OiSFrE;rEO| ŗ8wKw^W2G_0MNȭrU֭;Q-FsvXY>Ɋօv$T/08Y>Stg3? -endstream endobj 165 0 obj << +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-63) +>> +endobj +166 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-64) +>> +endobj +167 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-65) +>> +endobj +168 0 obj +<< +/Filter /FlateDecode +/Length 5056 +>> +stream +x]MܸseH?$X,@``OlMy)JiQXUd%H%s_R]~|*z)O?.*orH (|_6寿{cV|$G*2!!{AH +Fs`κ>) `6 I f 3l4NJ&($ ;ZL!9B*уf +),Eh4"3HiY|lY)oRlq` bl)aEd!-+iEmL䜘SL}^D4c6ILÈB'(Ybl񤭔FᏔSFMaщi/1 E QFb^8ƨ\N"H6eb$lʅ% mfDawAb2ai,lA `u$qm"qnF:m…ZR +NJYSbG K>X K. Kh xbl%.;*2$.p]2:J\FV)i x&$.p]1iQa k=nAk+qZghBfI, `=V҂U)Ŵ4%.)LFT ]f 8 b-*`*R3 l-q<]#qAޠ&234֒hj)i^g& ]E 0LSi4!q^,~2GL-)Y^n& R-V[ M^oF -$.:(v%.#Mk IXoZ'q%74֛X 6Sf ;ᢈiNS-8 M`N7p3ބG/n $^oFq3IJ3 Mx^x}&'&^q&q@z=Vq@{1[Eq@|y$nL,Sw 0"hq@ᏹnOU"&3w_K6z!m?&?{i1? kCft7JM9tQM1/FFb*tY fgf3֋AWQm=VR8oWeƞ60S}\-s'^Va4Wۡݘ뻟.oD>_wߘwMU\KbGr:ۤoMXj+(ܨC\:}[}FLD {Œ1WŠN$bkU?܊qO ~Vz sn~}ބ}u^T|vx;@C҉B' 8N5B}R]&^e5a`PvGtNӥIPmu% #>]9܅}y$h-aϷeɰ#fѠy@dDy^U%Ck~Xz#,?7pu 9OW~`we(ΛMSw4nOMϿ}X筰9q{*m&oek"דv^|jZ;v6VFLkKs%nݿ?dt3d"B_rȬ*\v;e Ia-CPq7:۲s_f7A!Xh],yI߁w\?8"c:oLKJ߷ma`qנ/^W'6e2ZuS gR[Q)X~t9 ] n.UD 3Mϲz+v$ .}8uLkÐ)neU2\W] Yqd!'MØy$,Cpjۺim7ن^ +l}[_G E%ǘy9@> G .*݆k3O(o H ޷.ǘiN_]ɫGN6[L.ΐCЊI;9<,&C'=_2ɽеđAs_(uyc"72ו md~%{nT;&b1@߿3[U}Q{("cs]y^gXCdiy͝ѱܜ&4e5Zetއi`4ޤ8+Q`saGd)c Qfю1{qޜ$hL!',fvb,V{uRPH*y.5V4 )X1t=A^ REc^3U%踙kLXꑺ9nux'Ϭ^j=Xzkk'\ ~c:cbWگ㪒C>n!bH'Dcvv(q'αrέ^>s^XeȠlOó Cqc:zXwxʺБ)]%m9aR9DA@SQ9Oot|UɗQ;rD>vDEпaqk;[m D혲F ZU#*}]k^'ilz{O;be~xy8"W YU%l@_Ё^X@okyz뗧o 9 @W;?pJ:v$t>:} +aLp!xʘy F<~yH*: GVB3¿T x'#â֕#tH@},t׿ˀ_Ahn`Cu Ň2઒:[q$t>:߅1xc-kS;t?re'rTZ0=yj|L67{&+-Atɦy-u4w! eeתwV}PxΠyyƒAZ~EN x# zlb61gN)aL=󕿾4a <7\_М>2sCSD|jb1?]ylݾ'1/ # bBvPeq`FƋ*osWzkOݰ/jQ>*P!4|(f1g/)B5Ňb3Kͻ({BT%?ssmәK^'|ZJE)ݫUZ[QcTR_rqE~K)7a*@r5_.E7kOŚ+-buJF4C1\@kNtc⣐/\}^+*Nz"4f&U*e~W!_YJxlVZyt+f2I tkb+idMۊTyעV@ +xI\Fke'~Q~.Lq.LӜ%o'd vwdC.cdmܺ34 EXM#ElҒ4yچݢb/9MePSS[_ڰ +]kiGi|i,͡p.ӒF˔|mg]t:(-Myle&6=ڮEF%-infۢl& \`j/ڂRV^#>`i*}nXZ Ot֗uΡe.-TˢfQurnubEmJ]*-E tc)jY;Nb+S,-^^ ]^.x[q;䬾ddծR"vl{mn-3Ջr^3vn:)W3`|d 33!?]j4w2G[C9" H MQd5>)ұp h7oKE;ݥڈ[:V O?b +endstream +endobj +169 0 obj +<< /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 164 0 R +/Contents 168 0 R /Resources 4 0 R -/Annots [ 166 0 R 167 0 R 168 0 R 169 0 R 170 0 R 171 0 R 172 0 R 173 0 R 174 0 R 175 0 R 176 0 R 177 0 R 178 0 R 179 0 R 180 0 R 181 0 R 182 0 R 183 0 R 184 0 R 185 0 R 186 0 R 187 0 R 188 0 R 189 0 R 190 0 R 191 0 R 192 0 R 193 0 R 194 0 R 195 0 R 196 0 R 197 0 R 198 0 R 199 0 R 200 0 R ] +/Annots [ 170 0 R 171 0 R 172 0 R 173 0 R 174 0 R 175 0 R 176 0 R 177 0 R 178 0 R 179 0 R 180 0 R 181 0 R 182 0 R 183 0 R 184 0 R 185 0 R 186 0 R 187 0 R 188 0 R 189 0 R 190 0 R 191 0 R 192 0 R 193 0 R 194 0 R 195 0 R 196 0 R 197 0 R 198 0 R 199 0 R 200 0 R 201 0 R 202 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -166 0 obj +170 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-66) +>> +endobj +171 0 obj << /Type /Annot /Subtype /Link @@ -1990,10 +2021,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-76) +/Dest (cb9-67) >> endobj -167 0 obj +172 0 obj << /Type /Annot /Subtype /Link @@ -2001,10 +2032,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-77) +/Dest (cb9-68) >> endobj -168 0 obj +173 0 obj << /Type /Annot /Subtype /Link @@ -2012,10 +2043,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-78) +/Dest (cb9-69) >> endobj -169 0 obj +174 0 obj << /Type /Annot /Subtype /Link @@ -2023,10 +2054,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-79) +/Dest (cb9-70) >> endobj -170 0 obj +175 0 obj << /Type /Annot /Subtype /Link @@ -2034,10 +2065,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-80) +/Dest (cb9-71) >> endobj -171 0 obj +176 0 obj << /Type /Annot /Subtype /Link @@ -2045,10 +2076,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-81) +/Dest (cb9-72) >> endobj -172 0 obj +177 0 obj << /Type /Annot /Subtype /Link @@ -2056,10 +2087,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-82) +/Dest (cb9-73) >> endobj -173 0 obj +178 0 obj << /Type /Annot /Subtype /Link @@ -2067,10 +2098,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-83) +/Dest (cb9-74) >> endobj -174 0 obj +179 0 obj << /Type /Annot /Subtype /Link @@ -2078,62 +2109,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-84) ->> -endobj -175 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb9-85) ->> -endobj -176 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb9-86) ->> -endobj -177 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-87) ->> -endobj -178 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-88) ->> -endobj -179 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb9-89) +/Dest (cb9-75) >> endobj 180 0 obj @@ -2144,7 +2120,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-90) +/Dest (cb9-76) >> endobj 181 0 obj @@ -2155,7 +2131,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-91) +/Dest (cb9-77) >> endobj 182 0 obj @@ -2166,7 +2142,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-92) +/Dest (cb9-78) >> endobj 183 0 obj @@ -2177,7 +2153,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-93) +/Dest (cb9-79) >> endobj 184 0 obj @@ -2188,7 +2164,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-94) +/Dest (cb9-80) >> endobj 185 0 obj @@ -2199,7 +2175,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-95) +/Dest (cb9-81) >> endobj 186 0 obj @@ -2210,7 +2186,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-96) +/Dest (cb9-82) >> endobj 187 0 obj @@ -2221,7 +2197,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-97) +/Dest (cb9-83) >> endobj 188 0 obj @@ -2232,7 +2208,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-98) +/Dest (cb9-84) >> endobj 189 0 obj @@ -2243,7 +2219,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-99) +/Dest (cb9-85) >> endobj 190 0 obj @@ -2254,7 +2230,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-100) +/Dest (cb9-86) >> endobj 191 0 obj @@ -2265,7 +2241,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-101) +/Dest (cb9-87) >> endobj 192 0 obj @@ -2276,7 +2252,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-102) +/Dest (cb9-88) >> endobj 193 0 obj @@ -2287,7 +2263,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-103) +/Dest (cb9-89) >> endobj 194 0 obj @@ -2298,7 +2274,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-104) +/Dest (cb9-90) >> endobj 195 0 obj @@ -2309,7 +2285,7 @@ endobj /BS << /W 0 >> -/Dest (cb9-105) +/Dest (cb9-91) >> endobj 196 0 obj @@ -2320,1734 +2296,1319 @@ endobj /BS << /W 0 >> -/Dest (cb9-106) +/Dest (cb9-92) >> endobj 197 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] /BS << /W 0 >> -/Dest (cb9-107) +/Dest (cb9-93) >> endobj 198 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] /BS << /W 0 >> -/Dest (cb9-108) +/Dest (cb9-94) >> endobj 199 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] /BS << /W 0 >> -/Dest (cb9-109) +/Dest (cb9-95) >> endobj 200 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] /BS << /W 0 >> -/Dest (cb9-110) +/Dest (cb9-96) >> endobj 201 0 obj << -/Filter /FlateDecode -/Length 4557 +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-97) >> -stream -x][,9 ~_H۹I$x" !Y>k*TO/gt$劝vʄWJI/ߝ?yǿbb9bwJr_˱?:}]'՚(?U%g V6X1)&#j FBrCj bQ1Xb -1(X#Ԙ V#&x&Kd(T*U ,KYB R,O K>XYbldA*-^,ީ@XW1y',^ek1y<_r䑏.foBp&# -JJdI>VY"{x Y?89bV͞ŋ(Ƀ,P ɂ da줒X @) -PNrf F'f (X@DIp,k W ̐-,`Z,,`,,`,,`.0K  S000@=[X@],,`.KI0p%x ˌ&-,::-,.-,.YX:aoawx@L^vlaw), ܥP?ތhka=x1GK,,P1 rdaABFBJ‚܅b "pY,,;xT wS[@}$஺M RV CL",,HՃ%haA D@Ƀ,֮r-d,LdaA&ȂDDfzY`.f~ @2W9&cUȕ 6y-,Y\q+K@ XX+dPBdndAma"]BdA4haA,3y ࡑK-x3EP d@JY@?lG Dc GtXXP -d!O65TYYXP}r&[X{ j(7I,,|XXP#DgIlaA<Ȃ|dd*Ԕ4, @ޜ(ofs+w& p|{ölfь3[)셷朁jdN@Ld%p`oNx/1٧q*2|fBc)W͏/=埧O?fO$MP7M DIBH"EX'THbz_ZdH23ӓx_d -d:ϒ}1> xf< ;}7wAVN:ש،ĻT8pO9F9y_|;ӌ2+pMrwfo+zz8;g7v&kQɸH؋FqOދG|a|>0hZo|2o+_(?||} ߉"7#Ai'ť엵/S8csbEfUsz7W8 -̺4Kzln?__nH.ťD:;yݝuuGםuiXv㩏:+66Q~ӎ*4-]ŵ.5ó1ivG;Gg*1>;rtf lнcgtuAkZ؎=ʱ_|еt^J9Jt3I,$Y. aJ6!B ,ActsUD$|uƘNBݙh2ɴruݦ](>gAT͵I1ྦྷ -cSBjjg"*51pd>іuȒ 5u{uu!:Q 髾P 5mC>]ʹm,W'V+z비. 4:mc\L`VjV٩+lwFӽmC/QHH_+wuc -[naykU5ǡ Fgc Vm8V;úmYWCDV}_9{q uHxLrtle9HÙRuR9uQf9y&rU' - ݹ;9Y8*.VPWлVR nd_è${HH[[Fz7#8C:DΧWs;~lj4OzBS4C!G!Q8bQ4:$>L'd-;G!E\x=1c/x}]`z6rΌ_T5uez3ؤgObGʰt̽\ntAA.ǵq=4YI;w9p9/z vv3\{س}/ ʕSCz:QsTUR~pixbćo3H.R}_v7sn..p~hZ|HWзI'kj3}';睯mP\Um[WSqy{چ5}m|pT/&IʡܛhY0X쥾6`)}aӧEr )O^Y8`ݖrzB߻|?JB;J\UpTX%S}u><~V ksyjlc+[]G]EwmSVYٻaT6-2*u767v*~9[@؟e%⑖cpz'-rO/i4wZpz`5#] 3~/0JC piF2s9Ǐ-~>Mi%ep4g~ۋ3tOSdR4ZCJ{oz\I1ߝƍ>Zi~"O+IO[ F;Jޖ.Onh/mI_kocJ=֏ۢڕۍ "jpI֧.d=8R%&3K2]\*%1^pgԿ֮scׅA,A/'ܖW䶦Z4[ɮz2H/'oMkT7bi$\m ,7r/U"b\zfj#1}]jb7tA|9^ )ft\fz#v;^j.04MjoP;Ug\-7ѱN驣X=$/e -9w+oW{C \x -R<ЭZt -MuE^}Fo`Sבƃ6߈/c-YM,d-7`Dn&2,rirsđ4L,1: -/o'9>w+/dK؇@$`!'Z~V2t ;҇Rg ˦{ Y%mXlRb|\NjK>MJ..\".Fq9ܰ.Toһ^Q.0B/yfǦmzB`/Ɔ%7+y ^YFR;wHx6˴>@]z,Cc -du1@-K@o*is.@[M4Wk2=q1{)bu8jwb.jh{Gsd%AKcN$7e}mc"HZ"ST%¿G[lUL3,QKL<&_R Ss{r&qw:0oi"Q3ٲ}sbgc*7Oˬ$],.ECҙZd5}2I -endstream endobj 202 0 obj << -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 201 0 R -/Resources 4 0 R -/Annots [ 203 0 R 204 0 R 205 0 R 206 0 R 207 0 R 208 0 R 209 0 R 210 0 R 211 0 R 212 0 R 213 0 R 214 0 R 215 0 R 216 0 R 217 0 R 218 0 R 219 0 R 220 0 R 221 0 R 222 0 R 223 0 R 224 0 R 225 0 R 226 0 R 227 0 R 228 0 R 229 0 R 230 0 R 231 0 R 232 0 R 233 0 R 234 0 R 235 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-98) >> endobj 203 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-111) +/Filter /FlateDecode +/Length 4851 >> +stream +x]K$9ׯ3~I!-1̀P/әU]ӋrZ=]a;#/"l]-~q/39凋5)X%pu  I%o]˿u՛Rwb2)d*`YG ++QaEgh,{޲Ƃ}VXb'G[V>9XÕykU &ӣ\|Qy <#21 Nc Y1d : KpVA4^,ɪgaw}aw} Py`  ynkX]>jXC1F]@Hհ^xћ*/璆)+v 2^pIc R,*k<YdkXH<4, ԰ ,3Z ࡑK5[3PQ d@JY@?l D ְ g/fְ gװ)fҰXȂOÂb0Y8xjXP\FYK7,Mxʸ-%L,!ʃ,2nI7N/B_XÂY7ѫSYͤNwC2i<."Өa.o"r{ ̒qfuz|:e`VI3_ɑI2GunLgi E<L>ST3s,s1S6?_~{._~RgڏGI _n1L%r>SGHeI7\L}2LAUuY]dv_ ?l "9vD}g7X /؉/>]0fh 79s~_׿qO_.w?Ƶ~̓6 )P֢Mi&[3%>K>O|FTvp hb!6@X Yx+*בDy[@x.h]ke[姥`(Un(Uy( [AЉLjyilGQ16Ѓ(~q)h@kURJO9 CDeu|0 zpaf^xk^*<;.V_fB*ίHlԓjH؞U99<ҜTMFoSIMf"sHJ#fH:[bQg#%*6,]t:T4Fe-nhڴ4PfyÛQ+m/:N5f'M]9 +}@97Ο)R5ɃCsyAaR#< x/U!FiqC?cDbN2eQvψ9" +wQuid|_ jk2;kr͐ء+H +lms=zݶira(YY .~9%c&wZu82u 5ד!"u+=LmoWҰwsV(s]ySZw/s}ƩtEW $՗G7̜d +]Gx/:X4)ۓ+t;:FIsCvϦA,BK/[04szqitS #WEE Ǝ0(HDu +9 + `*TyP[AM- Js\S`oܴ0"ʲLv-6@{:fFhVKVA])ˍ[c ʴW8vy;ݕ\lJtE}Đ acձ:1`, cw _g_(AvFw9퀌RDV#=h KeoZxldHc'ǪGAѻۢ;4/{c0^%Jwy݃uʭ-z],;h1_٦=JU=F},I{ٛF^}iVR_A~ +*d1DHŨD뜧eݓjނ/wT"R9`hX$.䜾!*FCMV$!B "ʎ{FDZ:QEDOlLpO5Sͱ:QM8xnoUC::]uyT!/dICޤ%}sOiω}&2Μn}y|S.ǖ1RӃ2I)W-,, +V[; +ek;wz=FH}CA`m{:1,£n[XxƗN qe}k{JCa*xX]k8V؝a]d};PWItGqw+:1\ 9GOrtl2zʹ1_},aꜧIIF/`äw}bt<9:X<*VrLO.'O}OpO%QwLNoKz5+YNnD'G0^l YԽvީYOXAr,/?T|3 eTH\'V䷋ +?HduE{$S%);},q +i~h2ԮVo7Vݖ,Oorx64]. +҉s<+吆D;n&#K9]ܠV֧Aܖ7*GZzi4U:5]!^/ +ۚx7bnĽ\iE-7R/窥,l{+G5ɷ& cR$G@5Rnzk%$t†fz#v;9^fjʭ04MדoP:U~pMJWMdlvFzZ8Ns١\Jfr*t{c e=&T%ud?+GmBv39tS~[g9CE7{رm$q'vy{7kul&v,i47`<[%IlAy?.y +^HN#w/v^͏{wl]GO&_y\64k~yng`o%]GP׹#1}8}7]h|nf}prT4ڤ83f|ĕ]:쇊p2KS rIzGUkdznC4^ oZ(B?=ZȱvhԷLt*˸>+m=ۢaQr1mtT 7F[ܴ9F-&SnO^J={:ZFMYiy-Qhi~:;dVhqݩ> -/Dest (cb9-112) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 203 0 R +/Resources 4 0 R +/Annots [ 205 0 R 206 0 R 207 0 R 208 0 R 209 0 R 210 0 R 211 0 R 212 0 R 213 0 R 214 0 R 215 0 R 216 0 R 217 0 R 218 0 R 219 0 R 220 0 R 221 0 R 222 0 R 223 0 R 224 0 R 225 0 R 226 0 R 227 0 R 228 0 R 229 0 R 230 0 R 231 0 R 232 0 R 233 0 R 234 0 R 235 0 R 236 0 R 237 0 R 238 0 R 239 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 205 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] /BS << /W 0 >> -/Dest (cb9-113) +/Dest (cb9-99) >> endobj 206 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] /BS << /W 0 >> -/Dest (cb9-114) +/Dest (cb9-100) >> endobj 207 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] /BS << /W 0 >> -/Dest (cb9-115) +/Dest (cb9-101) >> endobj 208 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] /BS << /W 0 >> -/Dest (cb9-116) +/Dest (cb9-102) >> endobj 209 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] /BS << /W 0 >> -/Dest (cb9-117) +/Dest (cb9-103) >> endobj 210 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] /BS << /W 0 >> -/Dest (cb9-118) +/Dest (cb9-104) >> endobj 211 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] /BS << /W 0 >> -/Dest (cb9-119) +/Dest (cb9-105) >> endobj 212 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] /BS << /W 0 >> -/Dest (cb9-120) +/Dest (cb9-106) >> endobj 213 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] /BS << /W 0 >> -/Dest (cb9-121) +/Dest (cb9-107) >> endobj 214 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] /BS << /W 0 >> -/Dest (cb9-122) +/Dest (cb9-108) >> endobj 215 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] /BS << /W 0 >> -/Dest (cb9-123) +/Dest (cb9-109) >> endobj 216 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] /BS << /W 0 >> -/Dest (cb9-124) +/Dest (cb9-110) >> endobj 217 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] /BS << /W 0 >> -/Dest (cb9-125) +/Dest (cb9-111) >> endobj 218 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] /BS << /W 0 >> -/Dest (cb9-126) +/Dest (cb9-112) >> endobj 219 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] /BS << /W 0 >> -/Dest (cb9-127) +/Dest (cb9-113) >> endobj 220 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] /BS << /W 0 >> -/Dest (cb9-128) +/Dest (cb9-114) >> endobj 221 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] /BS << /W 0 >> -/Dest (cb9-129) +/Dest (cb9-115) >> endobj 222 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] /BS << /W 0 >> -/Dest (cb9-130) +/Dest (cb9-116) >> endobj 223 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] /BS << /W 0 >> -/Dest (cb9-131) +/Dest (cb9-117) >> endobj 224 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] /BS << /W 0 >> -/Dest (cb9-132) +/Dest (cb9-118) >> endobj 225 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] /BS << /W 0 >> -/Dest (cb9-133) +/Dest (cb9-119) >> endobj 226 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] /BS << /W 0 >> -/Dest (cb9-134) +/Dest (cb9-120) >> endobj 227 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] /BS << /W 0 >> -/Dest (cb9-135) +/Dest (cb9-121) >> endobj 228 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] /BS << /W 0 >> -/Dest (cb9-136) +/Dest (cb9-122) >> endobj 229 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] /BS << /W 0 >> -/Dest (cb9-137) +/Dest (cb9-123) >> endobj 230 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] /BS << /W 0 >> -/Dest (cb9-138) +/Dest (cb9-124) >> endobj 231 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] /BS << /W 0 >> -/Dest (cb9-139) +/Dest (cb9-125) >> endobj 232 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] /BS << /W 0 >> -/Dest (cb9-140) +/Dest (cb9-126) >> endobj 233 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] /BS << /W 0 >> -/Dest (cb9-141) +/Dest (cb9-127) >> endobj 234 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] /BS << /W 0 >> -/Dest (cb9-142) +/Dest (cb9-128) >> endobj 235 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] /BS << /W 0 >> -/Dest (cb9-143) +/Dest (cb9-129) >> endobj 236 0 obj << -/Filter /FlateDecode -/Length 4172 +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-130) >> -stream -x]M中ׯuQ$( Ed< ^? ,$dC%U[/nMJMm狀%'J؝,[9x..%WWj%_Otlz՚cH,&W V2X)Rb+[bAT8-@ ,` .nYbbAPS1XC7y3S4x! gRc5yP#rpHUsNbK%fo ! e&D)d -dN5xY0A}x\l*x^O. x!I&#b"d>UYh0~,p"Q15w`dɃ,01C_ da@,ql@r,, -DK! bMs-`yȒ8[H@0H0p7&܂1haw#la&x3B@Esi *Ÿ@+f p7g 7Zv!jaA"P  5ZX-p7-,H] LXX5y*baA ,,;<‚ ExdODdg=&D ׀5|ɪHa>}dஆM rQB C-,®-,ՃedaA $@Ƀ,\$֮R J,%B  #p5 6\0dAhaIejrtR&O ‚R! r4]b‚R! \"' It ٠-,@Zxu)gp4&&,,}t,,M,sLdD]n"%ha榮7Cd|T‚/u)TXobgmbaAeȒ<Ȃ~ Lzd2d-,9zS,,@&2z$ ,f*wf p&2[km ?+N1+Л[͒"ZfF2+KfaͲ"LTUt(R&+܂5֌4#w?[*e'`g]X'uXan[.0tp  !3}TR7!`q-^dH2$3˝8.V -l}>ƅa +]dNX)Ks#| -I1FN8^ϻƿ|w_*tќ?w?Bӻ/?߼Cj8%r/-~*g.65::N3_[&t~ӯ-1C(] kL.OM13E -Ť, mKGVh҂}c\ZqP2!҇+h%o^ir,Ȗ9EO!>2\9ສ{Ue| f,Σd~y&ul̏d㨹h>U?_T[[04!C iyk1hzZNy3dQtkOeWf! |İ1>m~;lwH -7[2$wLuҫĤ'/v2[ݾ4ermՑ'[< M9˼:4ŗȱK5t.7 -rR㛵mycvoCnֿޏpɑh/GnqEї -9je1ug-6N^w0jF3˹;|&zd.1 {},õ'<]uj9V#:mҝh?cbg?&$I "~*|LsCWL NxU?ko9[_}Z7`4zO"y'5d qeߓ}3 ·#c<'Bqkq %L+n 4Z3.1WN&\?]U:H~cTˮibX Յ\C68j&}%_TWW2,&H{=/ -?`Ǹrܹ>1y(,(Xڤa|嵺8eߓ}qUѭ=κ׊x˖?V.^7ӇǓa?xޣeG@u%xM~=鎐l~$YgkW`Nq%%/NFMw<ڙ=s%{V)ֳEI vAn:>$k^-mdvEU󷶱 |r°tM}5_TnFPSSk NdҚ5v`5B6Az9֫n[ֵ6olS+ޠ-:ZE |S;ܓZKmI:!R1Z +|jSo$pN͗h}ԩtOlD}J鹣[\B)}Ύ - -u؎:lS'>:Y!cHM Sʯ;&gꮚ|,a~ݍ;v-t.o0e l|M֩/m}v`q 7}][;:fps2+⾜rZ\5+t1; -o6H;ZĎ;twc$nǍf F`#ڦ6zqk޺ [4tHLrS74 \i'2?6[R9 CV -'T6m!<\gt r:d(N&NL ]*? k8=[/h] Mx2^8hc{h"Jީ#ߘR;TZNZ>oλi_ߣl;@ rmhK)ݚZ;SK/h4Z%ߴ불׳% Pso-{.)-;hc~mm&H2SuK7-¿g|Z`j?K#ȶ 5B%K֍~ P>o8n+1s8&%a -F}./m)(l0o*8ˆriѥIZҮ| f| -endstream endobj 237 0 obj << -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 236 0 R -/Resources 4 0 R -/Annots [ 238 0 R 239 0 R 240 0 R 241 0 R 242 0 R 243 0 R 244 0 R 245 0 R 246 0 R 247 0 R 248 0 R 249 0 R 250 0 R 251 0 R 252 0 R 253 0 R 254 0 R 255 0 R 256 0 R 257 0 R 258 0 R 259 0 R 260 0 R 261 0 R 262 0 R 263 0 R 264 0 R 265 0 R 266 0 R 267 0 R 268 0 R 269 0 R 270 0 R 271 0 R 272 0 R 273 0 R 274 0 R 275 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-131) >> endobj 238 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] /BS << /W 0 >> -/Dest (cb9-144) +/Dest (cb9-132) >> endobj 239 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] /BS << /W 0 >> -/Dest (cb9-145) +/Dest (cb9-133) >> endobj 240 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-146) +/Filter /FlateDecode +/Length 4260 >> +stream +x]A$m賁%( CMbdfX琿%ݭ5j̫"?QJ?#H-o?~>yWǟfa K:ťPOJJM \ݎOst?()'U VJkX#|*$18F1X1K[VX#T V#DM ^H.CXM^/h\.Rx圓X<,`dI[<$eBɃ,Q +YY"S @.1yg,^%0 +"KB-^.oɃGHYOAD>Z<,HTD o)XYb,l o!@̐ŗlA<).YKq\#[  QRȂX\x1X@@$P, 5y*[X@D%2YX@@[FokC[X@@\ ]ZX@\vZX@]{rĒ-, .q0p5MdA(YX] +XX]QVuE ܍Ƃ!$ ^1haw#la:x3B@da" p7T O\-,H 0ɫ.h[hم ,,H]XXwQ #X !YX 0uM^uXXhaFaHbCG +GjaAbxdODdg=&D ׀5|Ha>}d䢄(@@(8ZX]-%[X!‚AH,Y]*Y(F J,,,@Dj@mN 9?`ȂH laAI1hMP,,\ p^` J,p 09-^,-,@ ^H,-,(efoaFh%j^bapv*ZX7LHi `G'L~04AJlaHXX Yo|XXP=dAgaAila`<-,A0ߌlaRbaA%&xV:,T, !Ƀ,$7N/CX‚7o"7Sb ,pi7o" +3):3c c2^VxΑ̤R5 +ff &\Oc*;R%+܂9Vo?b=N?fɔOubEbWny-D^$Q!J݄ 5Bb(p["E*s@0b`*ʶ]kJ]y +节9D*_CR4@F)Q?~8/~;ȍќ~:_O}Mx;o#@+O?~a9̵ag@RVh{*/)1ftyӪ|e)qrKo*w{F7ߴS2Ac[{z.SZ˚=p׊PQn0+N9L_/(/qQ>Fʻ6:o4@w xK^PA"D 1W8-2 +KO+o_C u3XC6z ]K ̦c~j:1UT}A|k3@6\oxnn&c.b*暫ssEUYFoǪfg^wtN)9+Ϣ:1m1<28*ipr9¬:sX =W8ֵMn׉HD{}q"rlHa9cܗm=I̘GOJ:\tO9 "#+cGH |GhjEuc k+d~2Ye۠Sl׸g&uc,\УXE$. +l 7Y8jNĀZ_pɑhw>sV8_3#,1dèzwsb83UBl 7Y8#)JJtY(Zl 7Y8fHG51i҈Yw\v-<6\E“D~;n0-}JLu|Bu02 GsslË~09SUcW=6UtXfEˎpI>d(O +bҹ +^_Sݯ!/#.m2 OW՚n{! B_pa1Y<5q!F:IhΧzwa5}tݙ]jچfÍ\&zf*1~Q~3cӸ4\{.x+)Аc@-fF{oXȻ$Aǵ'4;=e NL#0OWaYtQSUcb\a{$e*X0 GO+&0۝r %ϥܿVn2|nwqT!ksU:1Ģ;yܙq@}\M ڙߑ6Y0]>d_f68Z/>BXcoEoGt?-ҷ/Krh^M18=Y3z΅߾_cS_*~۷OVZ)=}lSy-g˾Lʫ ^S^U Z>/1O= +Gӥ,iUoXwj.GKz=LSҋǛϋa~:xAkIOd5N^,]:s%)9^pJ26Z?jznahwW/ Dᖬo]Xzj8Zr%&3y,=ptKCsYnec vGՅl,9Nh&U +ljڍhvjj%A 7=q`jz҅(#q/W[9v2˭OKRjmDٺ:IWA[tRCm M0F`}!7o褋rs2k}; sRԨ8S0(euw8}GرuGG2==Y&zr#vA>85od:w$M9 IoWZ̗f/^͐դ:Gې|;- r*f|(n&NLc#]*? mk0;>і f|0Ѻeb"Jީ#R;TZn9МwP G=\c -xw3с*[@F5FO,MVkjYXL-SlԿNUh|SVF-Q؝v~+cI1hyݩFmm<o-2[tS%{w.uVd0lGbP(PxzpaR]q6rcK0c"_"`Q.f>OF +g9Yǟ5oN zE.>)%Ւv  +endstream endobj 241 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-147) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 240 0 R +/Resources 4 0 R +/Annots [ 242 0 R 243 0 R 244 0 R 245 0 R 246 0 R 247 0 R 248 0 R 249 0 R 250 0 R 251 0 R 252 0 R 253 0 R 254 0 R 255 0 R 256 0 R 257 0 R 258 0 R 259 0 R 260 0 R 261 0 R 262 0 R 263 0 R 264 0 R 265 0 R 266 0 R 267 0 R 268 0 R 269 0 R 270 0 R 271 0 R 272 0 R 273 0 R 274 0 R 275 0 R 276 0 R 277 0 R 278 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 242 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] /BS << /W 0 >> -/Dest (cb9-148) +/Dest (cb9-134) >> endobj 243 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] /BS << /W 0 >> -/Dest (cb9-149) +/Dest (cb9-135) >> endobj 244 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] /BS << /W 0 >> -/Dest (cb9-150) +/Dest (cb9-136) >> endobj 245 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] /BS << /W 0 >> -/Dest (cb9-151) +/Dest (cb9-137) >> endobj 246 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] /BS << /W 0 >> -/Dest (cb9-152) +/Dest (cb9-138) >> endobj 247 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] /BS << /W 0 >> -/Dest (cb9-153) +/Dest (cb9-139) >> endobj 248 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] /BS << /W 0 >> -/Dest (cb9-154) +/Dest (cb9-140) >> endobj 249 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] /BS << /W 0 >> -/Dest (cb9-155) +/Dest (cb9-141) >> endobj 250 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] /BS << /W 0 >> -/Dest (cb9-156) +/Dest (cb9-142) >> endobj 251 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] /BS << /W 0 >> -/Dest (cb9-157) +/Dest (cb9-143) >> endobj 252 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] /BS << /W 0 >> -/Dest (cb9-158) +/Dest (cb9-144) >> endobj 253 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] /BS << /W 0 >> -/Dest (cb9-159) +/Dest (cb9-145) >> endobj 254 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] /BS << /W 0 >> -/Dest (cb9-160) +/Dest (cb9-146) >> endobj 255 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] /BS << /W 0 >> -/Dest (cb9-161) +/Dest (cb9-147) >> endobj 256 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] /BS << /W 0 >> -/Dest (cb9-162) +/Dest (cb9-148) >> endobj 257 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] /BS << /W 0 >> -/Dest (cb9-163) +/Dest (cb9-149) >> endobj 258 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] /BS << /W 0 >> -/Dest (cb9-164) +/Dest (cb9-150) >> endobj 259 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] /BS << /W 0 >> -/Dest (cb9-165) +/Dest (cb9-151) >> endobj 260 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] /BS << /W 0 >> -/Dest (cb9-166) +/Dest (cb9-152) >> endobj 261 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] /BS << /W 0 >> -/Dest (cb9-167) +/Dest (cb9-153) >> endobj 262 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] /BS << /W 0 >> -/Dest (cb9-168) +/Dest (cb9-154) >> endobj 263 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] /BS << /W 0 >> -/Dest (cb9-169) +/Dest (cb9-155) >> endobj 264 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] /BS << /W 0 >> -/Dest (cb9-170) +/Dest (cb9-156) >> endobj 265 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] /BS << /W 0 >> -/Dest (cb9-171) +/Dest (cb9-157) >> endobj 266 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] /BS << /W 0 >> -/Dest (cb9-172) +/Dest (cb9-158) >> endobj 267 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] /BS << /W 0 >> -/Dest (cb9-173) +/Dest (cb9-159) >> endobj 268 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] /BS << /W 0 >> -/Dest (cb9-174) +/Dest (cb9-160) >> endobj 269 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] /BS << /W 0 >> -/Dest (cb9-175) +/Dest (cb9-161) >> endobj 270 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] /BS << /W 0 >> -/Dest (cb9-176) +/Dest (cb9-162) >> endobj 271 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] /BS << /W 0 >> -/Dest (cb9-177) +/Dest (cb9-163) >> endobj 272 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] /BS << /W 0 >> -/Dest (cb9-178) +/Dest (cb9-164) >> endobj 273 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] /BS << /W 0 >> -/Dest (cb9-179) +/Dest (cb9-165) >> endobj 274 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] /BS << /W 0 >> -/Dest (cb9-180) +/Dest (cb9-166) >> endobj 275 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] /BS << /W 0 >> -/Dest (cb9-181) +/Dest (cb9-167) >> endobj 276 0 obj << -/Filter /FlateDecode -/Length 4627 +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-168) >> -stream -x]Q8n~_N){8 yK,2A0LgAo<磫$6Jӛx]&E,“%ϗ_.ޕoi9X?IOsq),g%PqXvc˿_[]9䊔`@+%WJL`pZ, -G> -*bA Q @ ȪP# j -zɃ" e=[\+-˅C -s%U,^.)0{]X ](7y%J!WKu]|Ur -ɫy)rE\"oBp I&3 -%TMtI#xDEĘQg7y -/A < fK 3).YKq\#[  QRȂX\x1X@@$P.k U"tA Kd okCP[X@@\ T-, `.;-, .{rĒ-, .q0p&-,:: -B0p/0p(ZXQula|Eoawx 0ƄK"7p7&-,`n-,87. $tZXx^$ ЙHK,,HP9 rAj w`L^uƼ]ȹZXTdaA>`CD$n Dj z pyC \p]W"$.`)ZX(IL^qp`ayd.{ w}" w=#1yЅ$ZX),pz_a‚\(G d r!3y8YXP< e T‚ haA)\ Ⱦ] 2E dN*%ecI\</ JaP,,@-t^` J.* 9-^.H-,@ ^H.-,(2$Lmk)g&4&&,,h,,@beɃ.XX ]7,T]YXP}v&[X{ jԛ-,zS,,Qo3mf2tIHQLtATy LB txԜ fDFo. ֛\. -dx]dDfk -3)Zqb \2^DbxHDe)\5@X3xsOU;L)zӂcmF4/~A}_fY)k?ON:Ebpc[h#J*E7U>a24Vx y{ -@,>#A7|8FNLd7it;uz#3ӧ/?pO.Nӻn=`\X/'$Z7#%EVZ`N]k$,$"{5+S}Ƨɨ-}ɮס]0=v.~`.&2_kյyFΉftȁoMLDQ^V&m7's㡢L͍TM/~+a7'nƵOo}7ZȲxxeN9 wyX! dȡw )іߎP=XgE9:&=) Uz  ztu6QuYPk@ZeGLܵyL>P26,-"-m&ngԫmAյ¬ŐQjNgH.!liCȨ$R]]k/$QYqN,#r$ 97e~͸aR) n -'|>u}ɜ E7x}ICqkd+{<ܔ{6V\ԏ\z=Pǫ}Ҥ9/B'l7'u%KK~JymIӸ, \zKwd3S\%ǩB,N5)s"]C#jל-/pE,or](ϕXRCoR<4E\&nλҦwG!;j(ϐYE}Mʜ E7c*hN ޭ|tnYW,.$E8v$dsOO% ;'s^bMl:vmc}y C2vo 7ݤyt;o.yb{ļCm:}C?`Q`QmXgsM`&eIPt:.2?{wGùc[0qP [ {1Gf7MNʜDw~>6~*߼txhgm+bs=FYۤimyN(H&vM{ڮ-6'{Kf-s:zՏ7E`E$ J@~bN+V\o$o'_eil4} BETECR&h=Ni:lY@!}}vWoW6dԦT-9tdf#7%p+lȫOr=~Wr2KE~o%񞬮/$+Y75'bBn~CN2+>_zY\5-cvmyj;ZĎ;!dш}  kԼUܯZsGbZm8cwhLC|Y'2;6kR8-DM+CYy䧡Ki5q)UIU\F!<^u-W14A -Lر/Y} ={o*6ڡS_Fj0va9sɻZEܣScM-xs0@U 'FۜF=S5,W,J)V_GKqT8*VmgK4sYί-{.)-ҝkKjy{mUf~K¿̝nj~ 님9|!_PX%7_8d5LD4[0cU5[L4.m0pVkr﶐X'_Q|0tY>Y~J -endstream endobj 277 0 obj << -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 276 0 R -/Resources 4 0 R -/Annots [ 278 0 R 279 0 R 280 0 R 281 0 R 282 0 R 283 0 R 284 0 R 285 0 R 286 0 R 287 0 R 288 0 R 289 0 R 290 0 R 291 0 R 292 0 R 293 0 R 294 0 R 295 0 R 296 0 R 297 0 R 298 0 R 299 0 R 300 0 R 301 0 R 302 0 R 303 0 R 304 0 R 305 0 R 306 0 R 307 0 R 308 0 R 309 0 R 310 0 R 311 0 R 312 0 R 313 0 R 314 0 R 315 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-169) >> endobj 278 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] /BS << /W 0 >> -/Dest (cb9-182) +/Dest (cb9-170) >> endobj 279 0 obj << -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-183) +/Filter /FlateDecode +/Length 4524 >> +stream +x]A$m賁%( ! &1fX琿-ݭQ"%>*&=~ G88Z2_~>r$?K3tKfI矕@ŕb]_O鿷}9Zs 䊔`@+%WJL`kX#|*$18F1X1K[VX#T V#DM ^H.CXM^/h\.Rx圓X<,`dI[<$eBɃ,Q +YY"S @x<KUM^K[^%!/d0`\ ^,٧j K"-AƏN$*"l:Sx XAB!/ق da@,ql@r,, +DK! bMs-`yȒ8[H@0fɃ,T ,, ,2ܲ޲BLoaqI2[X@\R촰RK[X]"4ylaQ|FXE ܍Ƃ`$ 1haw#la w!N {"YX\DZbaAgi R 3yՅZv!jaA"P  5ZX-p7-,H]  H,,@|suM^uXXha$1yc瑇ZX‚ ‚ Aha0m9dx]`aT 2pWæ(!! daWKCgux A.lakW%B‚! R }dCdɜTf JʨǠU6y^(8XXZ &x钅 +Y0U,,@(r[Yd[XL,,Y ZX QPefoa"4jI:S,,NSE 0MPi)MdLXXh,,@beɃ,XX Y7,TYYXP}v&[X{ jԛ-,zS,,Qo3mf2dIHQLdATy LB txԜ fDFo. ֛\. +dx]d\Dfk +3)Zqb \2^DbxHDe)\5@X3xs &\V% w(RKVL FvkivY_O{fY)k?ON:EbWna"/BQ!J] 뢛 +Pp[C؊ Udff<B(۲GJ~(/a59.!)n@F+QYMite_r#3O7O ~O/0~\.Ïk_/\k{n1??GHԠ+2\s]eoa%ԞHǐJ2WG Y-BZXk|NJ Vf4X.,DZ7] u9Q,”9 &쿳,G +FKXs}fTK)Լ_fz~bΞn4WqVn}Δ_mm^6a7×avQ2UUw30s'(8 Umл whZQ&Qg9ԮI~>Q}ԊE"Y'yF|76ѭC0;[7 $h\>18*2OA ?NkY$fwq@ b +pcFULHQԣ~US9 DY0{o1ߎwˆ(E׵tRJ\:~a̫;$T*s3淩:@u)_w,&]~>Q^JN)oETw C^}&Fḩϻd"݁o9Jkc9PH1^.yM9."h9sOFzI5ܝ$Ou9n+fzt\W@H3 R,GZ#ǚsղ^+~&}5xNMΨmMr Wqͤ(=-Ǥ@LQRz!ݮޛ+,ɰn)$QiqqԘ573hWSTu7+˳Cؤ ?yd|:>t~f>1>Nyλo.{2j<~}c=E +?T(9y ^ħϖmlҍUul28홂}:@[Čf[GIୈ\?\H(ӳE>Q䫾߽BFaֈ֯sWb Z7Ysd;_>£l3CƸ0*/^DF˦G It=8f=[-b}`&$f.VyL9jd:YIx&}!:mUf0ղV%ϊDStg尝B$JTM82C sD", Nq}W{3cݡ 14x{) ,轸Ɠeٞ!W'|;Y,>y|qT9P}q>'f⼼NInL6 Β]NBS]cIrX~`WPwm4f}y>8`tvʨejѕ+D;E918#& ~l᥅څ0f!=t{ƁwA_0#az>Ot͠06V0-E#nCl>3GBŦ*pq +'(hܐ1F*=4rXc7s7L!fOCq{jw ,xS~/Ɗ˸K_N +>uiҜ3n{OZ!JVG.՘ 'ǥE7)JқAg\#븼09Nym/Iz=tg=Ij~G'3HB֔~O~=lI}Kh/@%%kRS6?nz6.kW꫗DᖬSJs|*wQRn2cuSc-[zCkmb}T]2ҞjR6T.hvjj-A w !t`5=BH vRTdZWQVW'7hԢsS%g@o {oȯTi +Dd񫿬T=V S+SyK)tzUHuҀ.*.쨯 h[wmzM<[r^ +aM?+GoBv+9uW~ݐW9S0{ܱu$nG +vy7xOVחv}*@a%0lǤ$"o%̡Č_g +zB͟N|vw[71y2IOydm78׼v+#hܑV]74_vZ̯/ԾnCz_ +> -/Dest (cb9-184) +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 279 0 R +/Resources 4 0 R +/Annots [ 281 0 R 282 0 R 283 0 R 284 0 R 285 0 R 286 0 R 287 0 R 288 0 R 289 0 R 290 0 R 291 0 R 292 0 R 293 0 R 294 0 R 295 0 R 296 0 R 297 0 R 298 0 R 299 0 R 300 0 R 301 0 R 302 0 R 303 0 R 304 0 R 305 0 R 306 0 R 307 0 R 308 0 R 309 0 R 310 0 R 311 0 R 312 0 R 313 0 R 314 0 R 315 0 R 316 0 R 317 0 R 318 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 281 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] /BS << /W 0 >> -/Dest (cb9-185) +/Dest (cb9-171) >> endobj 282 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] /BS << /W 0 >> -/Dest (cb9-186) +/Dest (cb9-172) >> endobj 283 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] /BS << /W 0 >> -/Dest (cb9-187) +/Dest (cb9-173) >> endobj 284 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] /BS << /W 0 >> -/Dest (cb9-188) +/Dest (cb9-174) >> endobj 285 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] /BS << /W 0 >> -/Dest (cb9-189) +/Dest (cb9-175) >> endobj 286 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] /BS << /W 0 >> -/Dest (cb9-190) +/Dest (cb9-176) >> endobj 287 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] /BS << /W 0 >> -/Dest (cb9-191) +/Dest (cb9-177) >> endobj 288 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] /BS << /W 0 >> -/Dest (cb9-192) +/Dest (cb9-178) >> endobj 289 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] /BS << /W 0 >> -/Dest (cb9-193) +/Dest (cb9-179) >> endobj 290 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] /BS << /W 0 >> -/Dest (cb9-194) +/Dest (cb9-180) >> endobj 291 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] /BS << /W 0 >> -/Dest (cb9-195) +/Dest (cb9-181) >> endobj 292 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] /BS << /W 0 >> -/Dest (cb9-196) +/Dest (cb9-182) >> endobj 293 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] /BS << /W 0 >> -/Dest (cb9-197) +/Dest (cb9-183) >> endobj 294 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] /BS << /W 0 >> -/Dest (cb9-198) +/Dest (cb9-184) >> endobj 295 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] /BS << /W 0 >> -/Dest (cb9-199) +/Dest (cb9-185) >> endobj 296 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] /BS << /W 0 >> -/Dest (cb9-200) +/Dest (cb9-186) >> endobj 297 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] /BS << /W 0 >> -/Dest (cb9-201) +/Dest (cb9-187) >> endobj 298 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] /BS << /W 0 >> -/Dest (cb9-202) +/Dest (cb9-188) >> endobj 299 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] /BS << /W 0 >> -/Dest (cb9-203) +/Dest (cb9-189) >> endobj 300 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] /BS << /W 0 >> -/Dest (cb9-204) +/Dest (cb9-190) >> endobj 301 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] /BS << /W 0 >> -/Dest (cb9-205) +/Dest (cb9-191) >> endobj 302 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] /BS << /W 0 >> -/Dest (cb9-206) +/Dest (cb9-192) >> endobj 303 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] /BS << /W 0 >> -/Dest (cb9-207) +/Dest (cb9-193) >> endobj 304 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] /BS << /W 0 >> -/Dest (cb9-208) +/Dest (cb9-194) >> endobj 305 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] /BS << /W 0 >> -/Dest (cb9-209) +/Dest (cb9-195) >> endobj 306 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] /BS << /W 0 >> -/Dest (cb9-210) +/Dest (cb9-196) >> endobj 307 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] /BS << /W 0 >> -/Dest (cb9-211) +/Dest (cb9-197) >> endobj 308 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] /BS << /W 0 >> -/Dest (cb9-212) +/Dest (cb9-198) >> endobj 309 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] /BS << /W 0 >> -/Dest (cb9-213) +/Dest (cb9-199) >> endobj 310 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb9-214) ->> -endobj -311 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb9-215) ->> -endobj -312 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb9-216) ->> -endobj -313 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb9-217) ->> -endobj -314 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb9-218) ->> -endobj -315 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb9-219) ->> -endobj -316 0 obj -<< -/Filter /FlateDecode -/Length 4998 ->> -stream -x]Mݶ_q~AEҢ).;A\gtHJK=+bľryx8CRjJ)O./ZEߔcq1%&䯟X@Qm Z]ٟ/?Ks*`b^HH҆$U!)[YJ>:3\N^J$$%A.2̰8) f죐d40Vk1 h -iƫFR5*lf҈Tx#eBIJsgm4[qNKiQRZ-HiŦHRZ-[$2)sbZFN1iV{ҌQ$1 # -faK>iœR?RxSLIG7i2R-F't6DAyIr:l"K ؔ$+rxA5- +N$. -֑u@u: | fj K)8  (e KN %. .`%. .$. .9%.p]"hi$w(qbY Ы -8 +ʦ%.p]wm E1H8iZk ( -Eo -;[@`G% PpK$.]1 clLA5 'ee"Z\heeBx.&*wAIpŒj%.]C4YK\2p$.tŴtNI-Y 0 +$bZTd4P x{ w' w#JV5Hð4U-BJjZ,qA)qA,I[ Br*$.Y# .QCAYblqI\ZeIha Y+qA.T6.b|` CJiAbZBb#qb)0%.+v$.H3Nₘa T̥4[dK\OiH\,l7(qA Qf`F,Ҝ83I\\P*J\aHL)Є~l"` y'qAJ$qAJj+qf kO€b7Y8Ҵ x: 0.9Ld҈7 6Sx3J\lpQ4) x$b fnMx@x3]LRxi7JLNLq&q@z=Vq@{1[Eq@|9F `&"ULH4Z\6_cSD93EɌaݗf~;L_{ilc~rkCft7JM9tQM1W# hFb*tY fgf3֋H(ȶ9VCjL?bi1u"rQ̝z[d^m\6vc6wh\o>]Bo>^~ݷ_]|Q& (qVx*~ʃۅUo5!F)r+(4D\:0[|DND mLU`=0$1(sX*zj0d+ -fYl08΄=!W@n9O:c 6s!BX5lY^g/ex\DGU)o 1̙7 kL<(#e]&տ{mI#i#jI@Y13֖ Efl@7|]ݻ|Y'&BD\`c:5T[`pbfnz>"0FǀЖ?_^"o'8 x6LdekO 0[-NStWJI+=t0ޱ-t$l` P1Pv#j`o*Ltk1e-O۰9"&xB#a(t7~ftJ>jk5"|LZ|X!R,\.A `xo{<\9"؏p2آQ}I׸'\ RRQ||z: 1i>`,t |doklF$:BLz]CGtɆ7 )ӿ("9$lHH. -} -61 ,۬3CJUfD|?h>k􈕋4s yL٣cҢ]@975?4\9 !=^{uE`@pȍo^ |'4\:MNjX~klyD5{z}VXQ8H6tN91[: ҲEW{'@t~&wNn>k1;F^߀G+]R91Ä8]>MPYOOKM Ҝ "A ]aCzTyYd{"M'/L{&w(W߂H_`x0sMtD삈9kg*Mg/LJ՝T] -Ww*~ ̯ձ%,QG8v@4sOOo@$Ty+O+ofeYwO0Aw:\fQT9>9DB)]x#pv.3?/hwv.!KS|De5><8sx~)#(m߽׳g޷(~LknZ<ӘyxJ|eZyo̶ O -_\wW5 -Yޭ^{VH:$d@יQmȍrQLkf̞IYsn^+v5Kw㰺kό͖/w`rF 4w< )|`dOQ9 i]޼ryC*-_=Sְ[@lanu#\VϑIҽ0IF&b -=8rxc6cyYV؍:i'D5 --, -mG};L]kpvk8uW߈7IyqA@)Mo#~]qPZEN}={"^{_$F䔀c}yD&>`Z3{$ys5_-sjwj[h-9~{m6pu?x -B߶s|NO}]{6%{}&iL'5s@%~NP<mk1 <e]wza: 1,k~.p۬1zk4e= -ϳ+u,ab#(tXq"ؚuvz}~W 62lΏ?u2sya,(HMyup0d]VuwfKo%&}s y@9&\5qKҊݘ_pRgמGz} -bCk>gsOǗmuN&<߲*ubʖ!cU@QNKy ySPȧT?5vkİG'cYfR|լ޵J?kG:73? -YKL<ݕMheH-o{=o -w4Ɩ߮%L_0gtc!y ja7\_М>!֟?_lNbRZɞ`QuNJR8ݰ]|{b* keb]Rt -f!6o-*>U{nb~ז9Ls^>]P-Ϣ55EFQHt+$.+=$7aJ<DO1߽4_z*\)J lƈR֩O>l߉/> -} -gBj-+^404gсQ/RfqRUzU+YFj塰Z1eX0۶IZϤ[r[H&k11IXMA]3STWž@y!v2T.ݗr8|nűO{K g4J )5jH+>OyvpY4>]~LӜ%odqwdC/%ypBd}4(2lu WI5PqkvU]Wbs B_۰]ki!|Zbqdo}Vᢽ\FuJ6E⊳)6h eSa-d@g]u5T\fۢgtM^;VFzx}qM`i"}nXZOteΡ)omR5cSFu-h#MUYt( -]@gY)16,'b)׶}+}+3^8@swkK&AZ"u5'Ͳn{mmjHj*{عV \iäQ/LD6vwRǟڌ.5Ku8y ݡx{g$ MQjԡpK@X©4ﾐS.#u^K? tX>(h -endstream -endobj -317 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 316 0 R -/Resources 4 0 R -/Annots [ 318 0 R 319 0 R 320 0 R 321 0 R 322 0 R 323 0 R 324 0 R 325 0 R 326 0 R 327 0 R 328 0 R 329 0 R 330 0 R 331 0 R 332 0 R 333 0 R 334 0 R 335 0 R 336 0 R 337 0 R 338 0 R 339 0 R 340 0 R 341 0 R 342 0 R 343 0 R 344 0 R 345 0 R 346 0 R 347 0 R 348 0 R 349 0 R 350 0 R 351 0 R 352 0 R 353 0 R 354 0 R 355 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -318 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-220) ->> -endobj -319 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-221) ->> -endobj -320 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-222) ->> -endobj -321 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-223) ->> -endobj -322 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb9-224) ->> -endobj -323 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-225) ->> -endobj -324 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-226) ->> -endobj -325 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb9-227) ->> -endobj -326 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb9-228) ->> -endobj -327 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb9-229) ->> -endobj -328 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb9-230) ->> -endobj -329 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb9-231) ->> -endobj -330 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-232) ->> -endobj -331 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-233) ->> -endobj -332 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb9-234) ->> -endobj -333 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb9-235) ->> -endobj -334 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb9-236) ->> -endobj -335 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb9-237) ->> -endobj -336 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb9-238) ->> -endobj -337 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb9-239) ->> -endobj -338 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb9-240) ->> -endobj -339 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb9-241) ->> -endobj -340 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb9-242) ->> -endobj -341 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb9-243) ->> -endobj -342 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb9-244) ->> -endobj -343 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb9-245) ->> -endobj -344 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb9-246) ->> -endobj -345 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb9-247) ->> -endobj -346 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb9-248) ->> -endobj -347 0 obj -<< -/Type /Annot -/Subtype /Link /Rect [ 99.933071 249.709434 99.933071 230.959434 ] /BS << /W 0 >> -/Dest (cb9-249) +/Dest (cb9-200) >> endobj -348 0 obj +311 0 obj << /Type /Annot /Subtype /Link @@ -4055,10 +3616,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-250) +/Dest (cb9-201) >> endobj -349 0 obj +312 0 obj << /Type /Annot /Subtype /Link @@ -4066,10 +3627,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-251) +/Dest (cb9-202) >> endobj -350 0 obj +313 0 obj << /Type /Annot /Subtype /Link @@ -4077,10 +3638,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-252) +/Dest (cb9-203) >> endobj -351 0 obj +314 0 obj << /Type /Annot /Subtype /Link @@ -4088,10 +3649,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-253) +/Dest (cb9-204) >> endobj -352 0 obj +315 0 obj << /Type /Annot /Subtype /Link @@ -4099,10 +3660,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-254) +/Dest (cb9-205) >> endobj -353 0 obj +316 0 obj << /Type /Annot /Subtype /Link @@ -4110,10 +3671,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-255) +/Dest (cb9-206) >> endobj -354 0 obj +317 0 obj << /Type /Annot /Subtype /Link @@ -4121,10 +3682,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-256) +/Dest (cb9-207) >> endobj -355 0 obj +318 0 obj << /Type /Annot /Subtype /Link @@ -4132,42 +3693,49 @@ endobj /BS << /W 0 >> -/Dest (cb9-257) +/Dest (cb9-208) >> endobj -356 0 obj +319 0 obj << /Filter /FlateDecode -/Length 4959 +/Length 4985 >> stream -x]ێ丑}ϯg!0.`{uCWNE{B)^RR5i U '"(i?XJlr ||=|2S3Vs9$*Sp~=a鏿:}cn98,ELSL1eKJS( V3|dۢ38' v.)E fGKۢ 3\ }TLN)~ -9;]V"ltZ"[o<|lVaF+-L)jeP "ie8NVlZ[L0V+4ղ2bږ9'VfMR00H!*eZ[<lahe O1%e:dje8Y--|\-&0&%\g D'N '4pOrxE-da ce2k\@ `cҸ h\@[6j\@[66h\@ \i4. 0.(P8H=j\@`]i\@]4. .50xjl5.;Ndi\]&j\]L#qFuR20x%0xE,Nqw%hq0xױ (Ǩxp`5.G# Ph\6)sl5ٔkO-˓qeޢ'BָwH}& <Ӹw-Ske]Ѹw7x "иmUdrJx.hi\/<&Q Y @ƓAqA½g xx" x0 Pr A2NƁ)2a kLM BK QӸ $rAゐ ea±׸ <(K--YS4.sD[2h\`ѷE RԸL6̬qAzU+ nJt%٨qA<[ KM ^$0e5.`h\W4%\+AtQfD$eq<4rItVF̤qA0Iq 2M0Z[@`|$ A4G--YゔIゔ`3N`SͨqA6لId @(3FlM`^J4.do"Sm fԸ 3lQ2؂)+|줕2k\C|3i\0&"zuI I`& 4h\䛈lހx}D|&8b`@U]20^xHDfjBkeE<N>KTp)EfL Ft_svqu}=} j^)+?'X{".cAW\ht1ҩ0=:bDH Z\Hb|dX,6[3q.2zXQRi+D9LB=/`vTyhHb(;NLDW'i4]uD>~'/٩qZ)3VUpn9vK_oґ,[ n?}G~WAXTmUkCemƘ|Xc*ֿOȒ8"z VuJ5.I7pğ;VƱcx7Ǚ+3s[Ĭ4%BG3ZT݁ڠ` yRI`._45j*.B!"D$Su3:3DŎ6CCU'iq; _n&S]H@M踶{`Ji -(y0l<80+= ޛRӭGl -Qw` cyY@""A%$Vlr<۶xV{P-sSEm0Rޠig|$V P殎}6VYj[TP'sBtiC*4y0':sjͥו?G=kmXVeZdLi>Omu_~? 䶕#Nd}̉(;3ۣx~|4y(ɋ* #ZW_=mH&>I)W٘`c\HΌG$:&/@P^ZU?>(VaL0,#XWZL~ v BiEgY d;%&sLP= < Ԣw7o<*SX_]W>v/=$)#I*ǣ -% >qˬwStPy x&4]@Z^?*j~m^J.N?l½A2/-ȇ"֕ycIqyåO=y#8L,1l-31iRbGey1ٟe1g'&l@x*w³.ޮXwV$KJWoށd[JWQo`4oT#Au,#X8$Ԍ|ogPyDHH8*i&Jyw+b E|4.w# \S=dVN|t\&;cRHzmXB3حXLv˷PM as[MXiB&mʹ~u!]g/ rBt+}Uy3UFQJ}9qRD"ƔY˻QdT\SDzR#Y͔uJG4תtsP2&uq$mį'} - z!uVq2 /MS*L"7*| -,WH5"sםCez@؍uX1MF9_H]{l%\ۊ* -+Sbkb_7;}ƂkM*wXGʆZo"̎oTibY*ufH2[+;cdǽvݜ#dA)"5eC٫wܺL & aNN踣& wkn{9VևU:K]k KǦ9!!Gq -02j.U#9tqWî,[)]/s?$mu]!ʸپ";!0}lFwO_<ɡVj^Z/Lt)͇a}X}͏JzEܣ䴩B ^-'Q.UQTY1¢VeR1EiߏJDߏJ؜+W%ՙvf%" vr;l6.]7CBLMS3;vVW0lj[QCo3)pDNݒa5JFY[pLLdGMxEA_UU;QW'K:NrY,(|IЛk|μԒV'F -C +x]MׯI ~005VX4c`~U*Fg1[9TCRg$#H&S_~'ZĘח/\Ÿ5Gw&jet]f%$g^e\YRF뿾p%&!ɹ%㼐GLIJ.XcǤ3lNJ֘($EA6h0A[) f䂐F)1 (ki-4IbZ@FJ#Z|i)--{4 [\RZJsik[, yB[L $bP;IHblQ^i)-RVLKHS11(H4lFAH3+4H)`ŏpbzM`1i/1E/Qz¼$q aXLF%01-6h$X4ҌlqKL@X\1 P- ql1$. Z$. ЭUIK\@[@0SI\@`\J\@\@)I\@\wJ\@ ]t quy#qvF/qwj%qASL-`Džt$ ,x +X.^`e11* ,xDe%.]0iaA$ ,x8<4rwSF 5x Do +q;[@`G! PbH\:a4j1y xWG4PBE-/$qb" x%./Q #&) x~pX4 0-ZbZZTQ- 0 +/*IĴHZJ\ޓ,1 P4AЧ.ʀ)4ha) THx.%. `#qvI!x |RH'N₠ p,1 `%.c$JQ`` #qA0.}l\xɖ 8x *y"t `( Z": % `Ҵ $؂"q%xR-p%.4%. (+ 0B#DUKiVq%./*J\nHL)Єh~l"` 9+qA(qA(#qf )O₤nq)%qA_r%.Ho"m"f Y࢈iNS-8 &IJ$+qA(q ě)f .4.ýs"(.=}֯ K[&o*!U6smS8`}3sa}r=1V6<Zʨ=47ƾA{m:kdhguV{F}^(^ +| J 9x]⑀ +}`PkgОﲲF'oA͛9@-`PwG:j]m9/cξmyl@lA{'F-k!:׬76s>a呜hy``>L߀%zK:灗 F#nxfe5>σfcy4ǨoC&E۾Yޛ90/LG+ o.w2ߨ0yЂim`7t#`Efϊgz{a}|%Բ:j. +[3<-8ls:UO[(/xSkA!Ce{ml%ᚷVͮL`C=ܑ +Powܳ.0j[`E+ލoT6 9aO + _?Dh>j1jτ5Q1NQ4cFQ{F#AH^{ &w5s Bf>Bw)sk+˿;~~6tȃ=܈څ /\j\N{).70jO1T9I I}5S*:rP6qJfah|Poh3l>Ǟ9{'DF}"<.;7wRWw݉-HP .Gc-]L- Xz=O 87^>![ ů-k_S# q++!*B~^V~𗒋Hxxa~3}E/yQz/YA GLYxUxσܢR8qiXe5>i+Ƃ^b~z w1/.tmXyzQU1'k*ma1:4kBӜ[— nKWQE`e圥Ali'Arߩ\4%i5M3lɗr>ArKsBj5_MPX*^utgG_{mx — oįܮrrzr8* 1Wf U"eYѶ@RMoq_IֱR ^ +=HQvm}騄L%wNTY#)$Uȣ낺"f +SlnWŮ@W;]Nyݕr|mš{K e죘M2|a5 PŕF_Wq]kd҈re 9>'ߛk#}?#b?q +[­qR_+m W5h(1 _۪*眺0.:lĦ@hjjm_j826u]R~8Odp>.cM:$_"qY됎TkE\ⲹauf2 ۛgmj.7/:̶EgM>˫h eZV~wvs`i"}mXZOz2:ɕ;oR5}SFu-lwbƪvڛ,nB,+%ljY8OQokڵR*ѵ⇼\nDr-C}:Us_2 +2j9){y6a!z!=}0[ ? `K;D!?ll4vlq3ycD*h ^'4E޿&[#a +Ҝfp6}"\Y _ endstream endobj -357 0 obj +320 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 356 0 R +/Contents 319 0 R /Resources 4 0 R -/Annots [ 358 0 R 359 0 R 360 0 R 361 0 R 362 0 R 363 0 R 364 0 R 365 0 R 366 0 R 367 0 R 368 0 R 369 0 R 370 0 R 371 0 R 372 0 R 373 0 R 374 0 R 375 0 R 376 0 R 377 0 R 378 0 R 379 0 R 380 0 R 381 0 R 382 0 R 383 0 R 384 0 R 385 0 R 386 0 R 387 0 R 388 0 R 389 0 R ] +/Annots [ 321 0 R 322 0 R 323 0 R 324 0 R 325 0 R 326 0 R 327 0 R 328 0 R 329 0 R 330 0 R 331 0 R 332 0 R 333 0 R 334 0 R 335 0 R 336 0 R 337 0 R 338 0 R 339 0 R 340 0 R 341 0 R 342 0 R 343 0 R 344 0 R 345 0 R 346 0 R 347 0 R 348 0 R 349 0 R 350 0 R 351 0 R 352 0 R 353 0 R 354 0 R 355 0 R 356 0 R 357 0 R 358 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -358 0 obj +321 0 obj << /Type /Annot /Subtype /Link @@ -4175,10 +3743,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-258) +/Dest (cb9-209) >> endobj -359 0 obj +322 0 obj << /Type /Annot /Subtype /Link @@ -4186,10 +3754,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-259) +/Dest (cb9-210) >> endobj -360 0 obj +323 0 obj << /Type /Annot /Subtype /Link @@ -4197,10 +3765,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-260) +/Dest (cb9-211) >> endobj -361 0 obj +324 0 obj << /Type /Annot /Subtype /Link @@ -4208,10 +3776,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-261) +/Dest (cb9-212) >> endobj -362 0 obj +325 0 obj << /Type /Annot /Subtype /Link @@ -4219,10 +3787,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-262) +/Dest (cb9-213) >> endobj -363 0 obj +326 0 obj << /Type /Annot /Subtype /Link @@ -4230,10 +3798,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-263) +/Dest (cb9-214) >> endobj -364 0 obj +327 0 obj << /Type /Annot /Subtype /Link @@ -4241,10 +3809,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-264) +/Dest (cb9-215) >> endobj -365 0 obj +328 0 obj << /Type /Annot /Subtype /Link @@ -4252,10 +3820,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-265) +/Dest (cb9-216) >> endobj -366 0 obj +329 0 obj << /Type /Annot /Subtype /Link @@ -4263,10 +3831,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-266) +/Dest (cb9-217) >> endobj -367 0 obj +330 0 obj << /Type /Annot /Subtype /Link @@ -4274,10 +3842,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-267) +/Dest (cb9-218) >> endobj -368 0 obj +331 0 obj << /Type /Annot /Subtype /Link @@ -4285,10 +3853,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-268) +/Dest (cb9-219) >> endobj -369 0 obj +332 0 obj << /Type /Annot /Subtype /Link @@ -4296,10 +3864,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-269) +/Dest (cb9-220) >> endobj -370 0 obj +333 0 obj << /Type /Annot /Subtype /Link @@ -4307,10 +3875,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-270) +/Dest (cb9-221) >> endobj -371 0 obj +334 0 obj << /Type /Annot /Subtype /Link @@ -4318,10 +3886,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-271) +/Dest (cb9-222) >> endobj -372 0 obj +335 0 obj << /Type /Annot /Subtype /Link @@ -4329,10 +3897,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-272) +/Dest (cb9-223) >> endobj -373 0 obj +336 0 obj << /Type /Annot /Subtype /Link @@ -4340,10 +3908,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-273) +/Dest (cb9-224) >> endobj -374 0 obj +337 0 obj << /Type /Annot /Subtype /Link @@ -4351,10 +3919,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-274) +/Dest (cb9-225) >> endobj -375 0 obj +338 0 obj << /Type /Annot /Subtype /Link @@ -4362,10 +3930,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-275) +/Dest (cb9-226) >> endobj -376 0 obj +339 0 obj << /Type /Annot /Subtype /Link @@ -4373,10 +3941,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-276) +/Dest (cb9-227) >> endobj -377 0 obj +340 0 obj << /Type /Annot /Subtype /Link @@ -4384,10 +3952,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-277) +/Dest (cb9-228) >> endobj -378 0 obj +341 0 obj << /Type /Annot /Subtype /Link @@ -4395,10 +3963,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-278) +/Dest (cb9-229) >> endobj -379 0 obj +342 0 obj << /Type /Annot /Subtype /Link @@ -4406,10 +3974,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-279) +/Dest (cb9-230) >> endobj -380 0 obj +343 0 obj << /Type /Annot /Subtype /Link @@ -4417,10 +3985,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-280) +/Dest (cb9-231) >> endobj -381 0 obj +344 0 obj << /Type /Annot /Subtype /Link @@ -4428,10 +3996,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-281) +/Dest (cb9-232) >> endobj -382 0 obj +345 0 obj << /Type /Annot /Subtype /Link @@ -4439,10 +4007,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-282) +/Dest (cb9-233) >> endobj -383 0 obj +346 0 obj << /Type /Annot /Subtype /Link @@ -4450,10 +4018,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-283) +/Dest (cb9-234) >> endobj -384 0 obj +347 0 obj << /Type /Annot /Subtype /Link @@ -4461,10 +4029,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-284) +/Dest (cb9-235) >> endobj -385 0 obj +348 0 obj << /Type /Annot /Subtype /Link @@ -4472,10 +4040,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-285) +/Dest (cb9-236) >> endobj -386 0 obj +349 0 obj << /Type /Annot /Subtype /Link @@ -4483,10 +4051,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-286) +/Dest (cb9-237) >> endobj -387 0 obj +350 0 obj << /Type /Annot /Subtype /Link @@ -4494,10 +4062,10 @@ endobj /BS << /W 0 >> -/Dest (cb9-287) +/Dest (cb9-238) >> endobj -388 0 obj +351 0 obj << /Type /Annot /Subtype /Link @@ -4505,14 +4073,578 @@ endobj /BS << /W 0 >> -/Dest (cb9-288) +/Dest (cb9-239) +>> +endobj +352 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb9-240) +>> +endobj +353 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb9-241) +>> +endobj +354 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb9-242) +>> +endobj +355 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-243) +>> +endobj +356 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-244) +>> +endobj +357 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-245) +>> +endobj +358 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-246) +>> +endobj +359 0 obj +<< +/Filter /FlateDecode +/Length 4962 +>> +stream +x]Ms$@CF'1H㵃`!?5k$jYd||(\5~a_rFcpח/\^ϒcu$_vQyCןY@Qm {쳿^˿:jUgNrbQ{!)#IW1Z`n1g) f"p9y) f8k`hhL0F$aBѰX4#+=Hi֨bZDVJ#R!:㍔U') d @HZlM$.x3I\I#D'L(qAvE` ,[pM`NǛI7ыK(.w}3Ii]xA\ ބg+#391qę [% l5 I\4,SW 0"hq@ᏹnOU"&3w_cv[O/?aˏYV_ X{"6AWj) e2e a{t؈x_tc#1cY fgf3׋H(ȶyTCmYp=z>!^0;SW$:iRs*I2µz"Ve.H*1Q0L{{yd UA֠| Y:PzYE8:l5sl!b.tQ<QF}e7(#Y^Ajt,:.tX Oc9"ĉ- s 6xu6zyEDj6tȏ`[L-yu/NWh`.( O90A d5hA9sPZ^A9>B?-n]x#9qh>#%:AFz[ŬVu[,>B'"[ہy ia<.tɞcχXᷤt]́N}5qԞYM8ViN˞'lه[ >FCX)?tN8LF+\KMU ;P +\Osڨ$]I`óSͤybjL\=DVuwy}5sƽ1Fڼ΢]vi D3R9OWy~$'&?ׅ{~t^ۥ`ҙ7, 3Yg( L~J|9h"oڎ.㻌Wcʸ^W?W +A )uӫǓ:ӼJ7#?&Zutw>+oʸm)0G`2s`{+pݬ<6Σbyf׍+.ǖʄ 6yǺAYR<(k;yHPFm3wE@霧xOuoE7ԮxTh D6 v1b35֔4ٳɜi5&8ߞa]huWFvXޑd>(#g!3r+A 372 ]=++=pRg>Q 8dCz~9t?@inzL\KbZ~a":e3D0 += ߾7n+GǞ[0|Ԇ -:Yr`.tf7E2XoUg"7APb.07s@y&o }]}F+,ǖ-9>E mU ҦT4ϯuDxVk^~]Ӽ׳6ak&̨mSɤy:$gnZ?sj94 'QkdgPo|FR:R[օ~9Wy-FcpouQ:=LLlBܠ.tY+VnS.׏,5/e숗2jRvقC6@L~񘲼[zF<=Z{1fF> l-I@2^C)>B?>>M#-Knbz&ȡ#ڨ}W8O1½|F16r/XLz*e{u[XBЊ9OUBuc 3ǧffmڹ9J )YF BmiyC[҉&{b׵.|Y:O +3CNǽ>-'PtR4Ț_p:ț3V1Чlϊڸ_d !|ڳRޤÿ́ĺвܿt_ #ҍ'm|\r]is-?#[I{y$oL)١ Οc0{2sxzaSOZg]0|\Xm8^݁G[n9s] ϒ'Zq@ݶ dD|6s '~&W,h:LwۮQ{Ʃn=BDxogR4pZS5}>6yt%^#/g}dgA}fr|B4cqT[ĉ(A[e♯Wp*,)\'@3 V{1n7o\-{ܿ\rY:g&qAO|Z9Ҽfis}Cs/5O~{_$c-\G녿18;)fW]]D0aT1'yZ8nX5>#7+bA`F1߽V.I*TS|(6C +t}V`S+MGkb>t\jztƮ;/TKWQ_)Eֵʨ3*W/9kO"Хhw" Sr'^.b{iTRSͥ) j ƈZJ_— oįܾqzr8醗&4fI*|2,W!_chWUn^*8x! Rcl^&i!?n][l%횬\c*f ++Sbkb_7;}^ʂkM*wX{5ELlQO&XV a &n4h{MʯmI3eCkWdKQwdE??/m4mܺ3W0M;EXM'&6 uku#T55ֆVZC] C+VGMoTn G-UoQ]mJG".BqUe+3}%~w?/:7/6Er]_;WWF{x~`i*}XZ Or֗uΡeJjYԍ=NN͵p45{WlUi(*]@MVe$R>EoiJmDJreƫUptY}$B]"vl{n5CBLuSCw{Ma@U.+&`'38'Kݒa5q%q5;#e^We5~Pc ,4 +U/ȡ"Y׽RBFm%e%O{ +endstream +endobj +360 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 359 0 R +/Resources 4 0 R +/Annots [ 361 0 R 362 0 R 363 0 R 364 0 R 365 0 R 366 0 R 367 0 R 368 0 R 369 0 R 370 0 R 371 0 R 372 0 R 373 0 R 374 0 R 375 0 R 376 0 R 377 0 R 378 0 R 379 0 R 380 0 R 381 0 R 382 0 R 383 0 R 384 0 R 385 0 R 386 0 R 387 0 R 388 0 R 389 0 R 390 0 R 391 0 R 392 0 R 393 0 R 394 0 R 395 0 R 396 0 R 397 0 R 398 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +361 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-247) +>> +endobj +362 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-248) +>> +endobj +363 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-249) +>> +endobj +364 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-250) +>> +endobj +365 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-251) +>> +endobj +366 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-252) +>> +endobj +367 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-253) +>> +endobj +368 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-254) +>> +endobj +369 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-255) +>> +endobj +370 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-256) +>> +endobj +371 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-257) +>> +endobj +372 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-258) +>> +endobj +373 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-259) +>> +endobj +374 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-260) +>> +endobj +375 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-261) +>> +endobj +376 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-262) +>> +endobj +377 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb9-263) +>> +endobj +378 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-264) +>> +endobj +379 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-265) +>> +endobj +380 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-266) +>> +endobj +381 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-267) +>> +endobj +382 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-268) +>> +endobj +383 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb9-269) +>> +endobj +384 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb9-270) +>> +endobj +385 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb9-271) +>> +endobj +386 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb9-272) +>> +endobj +387 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb9-273) +>> +endobj +388 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb9-274) >> endobj 389 0 obj << /Type /Annot /Subtype /Link -/Rect [ 84.259843 116.912413 177.650223 101.912413 ] +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb9-275) +>> +endobj +390 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb9-276) +>> +endobj +391 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb9-277) +>> +endobj +392 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb9-278) +>> +endobj +393 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb9-279) +>> +endobj +394 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb9-280) +>> +endobj +395 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-281) +>> +endobj +396 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-282) +>> +endobj +397 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-283) +>> +endobj +398 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-284) +>> +endobj +399 0 obj +<< +/Filter /FlateDecode +/Length 5083 +>> +stream +x]Ɏ$WY@7`Ѐ-FCcUUYZs3sqwpFVu+*Fh\a?Ȩr t}|UJEI3~MQyC,pQm \_/:jUGN"bQ{!)#I'$yb>I( ؂HQ0JHcJt-%(qA 0R ^pI4C [T$.@WEd.؂ [DH3Fda A Me-qzh%j)43PQ44blMH\ 61`$qAJIₔ`V`ǛQ€a "> d @HZlƛ$.@f ;&xB.x3J\ x(blAДv Nx$b3I\Cfaƛ)(Nw}3Ii]DA\`Vk#$hPG*Nhp/z(h/Ie +U$-Nh/1qmi +CD"?dF Dmѳl{t׿ӯLY1P |Jy&B+f!aᛔ،ĸLk`Ff )Fc`P[.>5ݻ]Y-闃K1Dhl|/-)7ڛ1HpF|%OK72G[ZDHRVǽrٮl)ܿltp!a:UQ鹄荵'.zO=קza(g’l=!yᖯcHv8?5_?_6`G+/tC +*f|z[|Z뢴um'gmy 6]`e=/N2*rȁ~ cvGIcʛzե3U:qFUӮzV8_ՋRٿ*;Ȏ +ᦼaXtIkh1=pM{sOak#Qo5,Ky~ +c5rJy\2 Q 3ǤDt9qMZF%mD 5]z4æA\i@un[Ic٥b#6Oz@(dA[ &%:q\иP 2ЛxؘАxY3yfA!pem6 +{2&{fX@Do̜TB{ +6Sm}`"3eNUbhM<w7fJ6ZbIqPa6=ڗW`:BTgqAoo +l?#.kH{GL:Jc|4:2ypt6q:D^Xm:vC'(Xu>K/ 3 DY#(#Hyd}Zåq؉~ag7-V|/M< N+=$g٤'LFx,O ,D3|ɸMyu$%p$hOMSox r=ѪzQAye;Ttb4"M1ҕO`~{Ri\!ETN|MNxU*yahxX2j~!4ΑZl9qM8y%RZ>N HSb~3F3?@㖝[Ņ]ACD $s:Σb\.%NB嫹;=Ȯ91D(&f+y>z"A8 hό^Y{]H2 Rtt5R޲p:OɒZo +Hq\axxV5MG<x6Q" j'>ܗw^0,G>y*(8MNΎiQu{`!eonS&yꎆ?\VYKayxJ[P[ЛyN t`yI{fz24|phZc"^9吏_xNSl;OQHgo##c#;~>sh= OY@;< Pg$hW7aLRPlz=fg#K{ǖ| FWA<aRyyz4F^H~[.K6紝æéM= (P6O"m <ˋw:4pMhu5,&l<^}y3^?640G/۾l=٬lgױ4oSX`+ysl'ޙ(.QL6%~mt/-Hw T3?A]mto@Wd˚sW f ++b:Ovgv~16ո!(0eL4FnlMZqlN!i]yw|m|?|ֺƩ9gt@!ϡO֮[Yr khLi.@;Z^NzmD>yRYe9Le!sp$>TnҘz@&MaՖm%S M9VS-} 8P:Ts=,_SCyhsŒvD32vo}"N^t{'A̽G"46J/c|#}UsHLDw f0{1?VfI*4S|6Il@⩘_Bv]lcЅufơ: _.J_E)]qVMkV!I\7M̖>wz +$jr'^.b4j*\nJKe8/ mDq-5V: ;Sk]zQ;W{m;^hn47MS>j_U &^;i:$ye0;$-gmVe0_/cM nH;qmx}\v)ݜurt\<^}=֏[6n]Ǟ$ML5Ahi.6 F{i: +} ָ3e|ivV]>8Zqpz]u(WwFq1ᆹ[29ޤ*kt=z7;]e),^x1Lfi^#j `i&}XOr֗qe'xmC,7=ׂ4zhA4u%oJUi(]@MaQn)OD/StFOVX+a˭=^\ ؟N-L,MJ=i}^ǠnH葩j~M#s*?eä~`8:j2YWN!_) Sܟd9NEhd^7jY)NsCi92.yoos&ҙ3jTK^M~ +endstream +endobj +400 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 399 0 R +/Resources 4 0 R +/Annots [ 401 0 R 402 0 R 403 0 R 404 0 R 405 0 R 406 0 R 407 0 R 408 0 R 409 0 R 410 0 R 411 0 R 412 0 R 413 0 R 414 0 R 415 0 R 416 0 R 417 0 R 418 0 R 419 0 R 420 0 R 421 0 R 422 0 R 423 0 R 424 0 R 425 0 R 426 0 R 427 0 R 428 0 R 429 0 R 430 0 R 431 0 R 432 0 R 433 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +401 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 724.970079 177.650223 709.970079 ] /BS << /W 0 >> @@ -4523,1068 +4655,537 @@ endobj >> >> endobj -390 0 obj -<< -/Filter /FlateDecode -/Length 4970 ->> -stream -x]M丑ȳIF 0`{X kCOME= ePYc Օ -2 RLw\RO/֤`oʱo -Wg9J(TOz>uߥzSJ.\EL)٠$$YGJR&%#%6) .9hI0JR6 kI0Õ$ga֪i02W\04L5-!%c YKcuZZ-1[- 0夥EB[|N%Q;EI˰jl:- %3ii6M6 &iQh4[ EM-0~4D[n䴴[O4>FAFxIY#p欱pJр/p,IiiD@-*qy؂ ϤqmhѸ@lӸl]Ը@0j\@`\ʑ5. P.T4. p.;5. .{Ҹ׸@9j\@]bg5.`.44k\v42i\]r6i\]t#qZQ` ٲ C i\] z G 7- X 0#͓pK4.]W0)}le\.Quͧj\鷨eb,.*Ҹ wAYp5.]G4j\qp4.ftմblY-y 0 -$jZ2Ӹdl,P "x{Ѹ wm Ҹ w-Q` eq*}ΪLwC ki]kSѸ weԸ &q 41))E bH˧EqAP[8pM5.H$[2h\[E0lq¬qA -1Ԫ teqAJl0; 02^wI4[U4.Pdg9'[xHsNa A ϘeFqFh%QZ[gf 2G#&i)4и#q&?lb -qA^Y゜a^`SIba <> Fd @HV2曞5.@fָ|S<2L-.[4߂0;iie5.&!8$9Ct ws6v_{]jGX"AWf+pGvg"=7<}E%"莭nL<ac&v_pi\ -=m x=D;^ SCs,|h'kX؎|A >ɿadMf-T1,JYoͬh IղśzFŭs-G`*}ŏc ib>vYJ;!vpbPs%a_Ɗ5~ۣ9e6c63Z0t ^xIm ȻypM왷_ Z/29h*idkTy Wu,{Ϭin>\V͸!چ7&k{R =d{VϦ~lMuAӀ-[UOr2m|Lb~\e;]kk;!7KHJ0sRw&v,'t*`U&>8nÜ竹M^V6Hqfr*t[Vc iWew$'_4{G{υ'qo[ƭ q?A|MQn =w?]󆊆6{5v&5u-;oЕ /Zl{foTN23UyNyHvĕdt9woˮ2[0SҪ^)H.:7B.iNyo]eStYSߘ]_hYأvki&}DOtm̡%yjQsr11IvBցх+\e펩jZ'j-Sҿ5ViVr:5oz8윳Y^IyIU-e=φ3Z|tV-W". ǻDw'aĹ i<8ƱdG_0MNS7ncVKdҙB-e>~` -endstream -endobj -391 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 390 0 R -/Resources 4 0 R -/Annots [ 392 0 R 393 0 R 394 0 R 395 0 R 396 0 R 397 0 R 398 0 R 399 0 R 400 0 R 401 0 R 402 0 R 403 0 R 404 0 R 405 0 R 406 0 R 407 0 R 408 0 R 409 0 R 410 0 R 411 0 R 412 0 R 413 0 R 414 0 R 415 0 R 416 0 R 417 0 R 418 0 R 419 0 R 420 0 R 421 0 R 422 0 R 423 0 R 424 0 R 425 0 R 426 0 R 427 0 R 428 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -392 0 obj +402 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 797.673057 101.433071 778.923057 ] +/Rect [ 101.433071 696.273057 101.433071 677.523057 ] /BS << /W 0 >> /Dest (cb10-1) >> endobj -393 0 obj +403 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 778.726036 99.933071 759.976036 ] +/Rect [ 99.933071 677.326036 99.933071 658.576036 ] /BS << /W 0 >> /Dest (cb10-2) >> endobj -394 0 obj +404 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 759.779014 99.933071 741.029014 ] +/Rect [ 99.933071 658.379014 99.933071 639.629014 ] /BS << /W 0 >> /Dest (cb10-3) >> endobj -395 0 obj +405 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 740.831993 99.933071 722.081993 ] +/Rect [ 99.933071 639.431993 99.933071 620.681993 ] /BS << /W 0 >> /Dest (cb10-4) >> endobj -396 0 obj +406 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 721.884971 99.933071 703.134971 ] +/Rect [ 99.933071 620.484971 99.933071 601.734971 ] /BS << /W 0 >> /Dest (cb10-5) >> endobj -397 0 obj +407 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 702.937950 99.933071 684.187950 ] +/Rect [ 99.933071 601.537950 99.933071 582.787950 ] /BS << /W 0 >> /Dest (cb10-6) >> endobj -398 0 obj +408 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 683.990928 99.933071 665.240928 ] +/Rect [ 99.933071 582.590928 99.933071 563.840928 ] /BS << /W 0 >> /Dest (cb10-7) >> endobj -399 0 obj +409 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 665.043907 99.933071 646.293907 ] +/Rect [ 99.933071 563.643907 99.933071 544.893907 ] /BS << /W 0 >> /Dest (cb10-8) >> endobj -400 0 obj +410 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 646.096885 99.933071 627.346885 ] +/Rect [ 99.933071 544.696885 99.933071 525.946885 ] /BS << /W 0 >> /Dest (cb10-9) >> endobj -401 0 obj +411 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 627.149864 99.933071 608.399864 ] +/Rect [ 99.933071 525.749864 99.933071 506.999864 ] /BS << /W 0 >> /Dest (cb10-10) >> endobj -402 0 obj +412 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 608.202842 99.933071 589.452842 ] +/Rect [ 99.933071 506.802842 99.933071 488.052842 ] /BS << /W 0 >> /Dest (cb10-11) >> endobj -403 0 obj +413 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 589.255821 99.933071 570.505821 ] +/Rect [ 99.933071 487.855821 99.933071 469.105821 ] /BS << /W 0 >> /Dest (cb10-12) >> endobj -404 0 obj +414 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 570.308799 99.933071 551.558799 ] +/Rect [ 99.933071 468.908799 99.933071 450.158799 ] /BS << /W 0 >> /Dest (cb10-13) >> endobj -405 0 obj +415 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 551.361778 99.933071 532.611778 ] +/Rect [ 99.933071 449.961778 99.933071 431.211778 ] /BS << /W 0 >> /Dest (cb10-14) >> endobj -406 0 obj +416 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 532.414756 99.933071 513.664756 ] +/Rect [ 99.933071 431.014756 99.933071 412.264756 ] /BS << /W 0 >> /Dest (cb10-15) >> endobj -407 0 obj +417 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 513.467735 99.933071 494.717735 ] +/Rect [ 99.933071 412.067735 99.933071 393.317735 ] /BS << /W 0 >> /Dest (cb10-16) >> endobj -408 0 obj +418 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 494.520714 99.933071 475.770714 ] +/Rect [ 99.933071 393.120714 99.933071 374.370714 ] /BS << /W 0 >> /Dest (cb10-17) >> endobj -409 0 obj +419 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 475.573692 99.933071 456.823692 ] +/Rect [ 99.933071 374.173692 99.933071 355.423692 ] /BS << /W 0 >> /Dest (cb10-18) >> endobj -410 0 obj +420 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 456.626671 99.933071 437.876671 ] +/Rect [ 99.933071 355.226671 99.933071 336.476671 ] /BS << /W 0 >> /Dest (cb10-19) >> endobj -411 0 obj +421 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 437.679649 99.933071 418.929649 ] +/Rect [ 99.933071 336.279649 99.933071 317.529649 ] /BS << /W 0 >> /Dest (cb10-20) >> endobj -412 0 obj +422 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 418.732628 99.933071 399.982628 ] +/Rect [ 99.933071 317.332628 99.933071 298.582628 ] /BS << /W 0 >> /Dest (cb10-21) >> endobj -413 0 obj +423 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 399.785606 99.933071 381.035606 ] +/Rect [ 99.933071 298.385606 99.933071 279.635606 ] /BS << /W 0 >> /Dest (cb10-22) >> endobj -414 0 obj +424 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 380.838585 99.933071 362.088585 ] +/Rect [ 99.933071 279.438585 99.933071 260.688585 ] /BS << /W 0 >> /Dest (cb10-23) >> endobj -415 0 obj +425 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 361.891563 99.933071 343.141563 ] +/Rect [ 99.933071 260.491563 99.933071 241.741563 ] /BS << /W 0 >> /Dest (cb10-24) >> endobj -416 0 obj +426 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 342.944542 99.933071 324.194542 ] +/Rect [ 99.933071 241.544542 99.933071 222.794542 ] /BS << /W 0 >> /Dest (cb10-25) >> endobj -417 0 obj +427 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 323.997520 99.933071 305.247520 ] +/Rect [ 99.933071 222.597520 99.933071 203.847520 ] /BS << /W 0 >> /Dest (cb10-26) >> endobj -418 0 obj +428 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 305.050499 99.933071 286.300499 ] +/Rect [ 99.933071 203.650499 99.933071 184.900499 ] /BS << /W 0 >> /Dest (cb10-27) >> endobj -419 0 obj +429 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 286.103477 99.933071 267.353477 ] +/Rect [ 99.933071 184.703477 99.933071 165.953477 ] /BS << /W 0 >> /Dest (cb10-28) >> endobj -420 0 obj +430 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 267.156456 99.933071 248.406456 ] +/Rect [ 99.933071 165.756456 99.933071 147.006456 ] /BS << /W 0 >> /Dest (cb10-29) >> endobj -421 0 obj +431 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 229.262413 99.933071 210.512413 ] +/Rect [ 99.933071 127.862413 99.933071 109.112413 ] /BS << /W 0 >> /Dest (cb10-30) >> endobj -422 0 obj +432 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 210.315391 99.933071 191.565391 ] +/Rect [ 99.933071 108.915391 99.933071 90.165391 ] /BS << /W 0 >> /Dest (cb10-31) >> endobj -423 0 obj +433 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 191.368370 99.933071 172.618370 ] +/Rect [ 99.933071 89.968370 99.933071 71.218370 ] /BS << /W 0 >> /Dest (cb10-32) >> endobj -424 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 172.421348 99.933071 153.671348 ] -/BS << -/W 0 ->> -/Dest (cb10-33) ->> -endobj -425 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 153.474327 99.933071 134.724327 ] -/BS << -/W 0 ->> -/Dest (cb10-34) ->> -endobj -426 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 134.527305 99.933071 115.777305 ] -/BS << -/W 0 ->> -/Dest (cb10-35) ->> -endobj -427 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 115.580284 99.933071 96.830284 ] -/BS << -/W 0 ->> -/Dest (cb10-36) ->> -endobj -428 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 96.633262 99.933071 77.883262 ] -/BS << -/W 0 ->> -/Dest (cb10-37) ->> -endobj -429 0 obj +434 0 obj << /Filter /FlateDecode -/Length 4533 +/Length 4531 >> stream -x]K$ s+H!F6HEc;A0䐿%=8 ](D#j dv&"_p&5M,'\9\%J)^//|.\˸7D_ -ɤ -e)LJ>D+FHyJPK jYaeAYjXcA WBRXBUyP2Wx.N;sE%\.8WL1d%4^.1[]rxP$ω4^.S^.򠋍iB&̬ -x6yLDV9g|TF%PTt d#Rh2ɒxxXA_CMQ #aOp񬁀d8sPb8%``8Yw. cXaw=a w!AO V{ ɂY*pb XB%kXcИK5[gf 2G#&i)UtLhXd;hX&NS[GĈy̞B9ɢ >ʜkdCJv#b7&Lu3[&G?}_~ږe=p]3AlwyXtQ6Ow}, lP< -V@H>-3b<ԡ /,0y21o}ۍnc:6kͶI.KD}gЌl<ڇ$NcLGB;#6<3!9:eٹ~12%MII,+L%51 qѲ:j&/+c͝.8M.EK`H<1)yFEy`).g9 G]>&s.P"}zTc#Y ljAKgdqw>h&}SV11 G1(sSF}߅~d|VvFyL!GmUlxI{ghpҠi&Z$>(J\{.0b]DJǒ_ !8>>fظC<7>a:AtMg "QQ>Z_4G{eYү_~˵$hʗÌɜ0ʮ$̻kNq!JAUg4vK?UB C1MN[-Q>kfzI>!tLOVx J?&tlqNnO _B sH4ac`o׺4U"gwuYoR%EzdW:JZEYsdY1ɾI}V|>ujN맓V>/ڹ pCHW/瓶/vL< ALHr`j9a1M_!h;\ѧ<߮7wE6f++p|@&]4I`7AhVһϪCx!ıɝY8ux~:Þ&zP4Rb̺Һb3PjDu}8 7ճEcBǸ(Zkx墈@z0$SjZᖊq1]5!/ɾ, iaTKۭ&G3&s ?=ԟA쓿(W;\E)}9Og}&i݂zkS W?\wd1Ә`%LM};z?fXLht3d~l4p]$ogU/}=_,\s̵ܧȁLVuqvx`c8:CMmmAx*o'(eoƹLڊ7f]wpTn)1(Y39ق\-ҏڽnw#9C+%ga.d/$(#vmrcK~ȵN YO mI -?KBC}UL֡$zkX!B2=Y,WgCSlXuqK!Y.İ'ڮ,WԲ, 6skY:sD|YRU\Z dQTiPK6pBz(/lZ&݈:rSHO\[hJT^DKE)WhS$wwcR&G@5otl;%$tX†z=z9_Ь4K{Ш<ͥiiDf#;dž:&u|/R^@n=v]S H5X]FӰ'ڪ[ȡP 5]ջc瞜ŝmv>_OS`-Y\?F|@눋bD,_.LO_0)xɭ#9Tώ?(k _WoqoZ+r -ȾwLxŖX,H>juHN{7-!U')tpwx+c`Y4[)7Һ^?ti<%UW]?-+}_=~gcBmި=PT.wVucZ %C5/bs7ʕjJk5SjLo^J-X{:Viz]YF-QKBiy;ldVhnT^JRu5^Edv ¿׌f@+UL+./"PKi|lr{-i<,~%q-lr2*wٙK|~xdM +=pv @ɤ|~.ϧvRƝ)%zο(,&rJ6(uB0)VtXƂ!-+A .9h,gqrec5\ Ia9 =VAL^`"=j'x xNQxʃ.6Z +P2+ٜm0!Y MRyQ0RL +ChCQy% G'w%t>ʃ.0>BAFpIYp次pJ/p,I<4 ]G AFUyЅ +kX@D3iX@@[hX@[iX@[.jX@\i5, . T4, `.;5, .{Ұװ9jX@]bg5,`.$UtkXt42iX]r6iX]t#ajQ9[ e  iX] z G (ch  z8]`ϓK4,]W0)}he\.QÂuSyŸW-Zٸ4,]gְo0z pFjuX pqCа` 0g*[rְ wK^f K4,8TÂ^4,]4,]{Tt5,@\ҧk,֦aAʰaALBY(h{ bfSRbCȧuа Y KANakSd .但C  "0!VwQ.5,\5,H!"CjMNksIÂ`(v 2^pIc R.*`(2#2x ְ.xiX=tA4aAYf`F.xl%dFBE Mi)UtLhXH4,@diʃ.XÂYÂ^IÂb "> Fd YaAqg /%7)P|3iXP(* h*J&!:i]|a Jof f DDN d7:] Ȥ񀻈L@V-7$g:3Kƙ [) h9 I4,sTg 0:m`x ٧~*̜! #o9\n̏w|?i88?q:H\v C;3y +>"#J2+I7QC1rnReh,:;3ӓq_/2SQu[SJ^t?3Hp;#Þ/;EZ"JQ x-/ + ]Zev]vZc$g47O_|7/͇?h7ߞz|VƌUbDwZgHyVA!*=E܆,ƽ˭>͗/W!z×m~F*l)yA"޳alIZN"4.LVMW^->\[zs9Z\ޫyK +Tcu2шٛ"=Bh 6NkEZKIu%90A\vL8. vwwE%eG{M:Hgl*3t(fzSɔHE*nrDt#;s1r-Xdr1_ 3"1v]-l +kOu$3N7+KTq2q//Wte%/Wr(:lv%$2e73; 7fD79IKN5-*y[]*tnT.za5H^");֌~[}὞zJ61ˌ 1n3&s qyӷ]z"v$q|y.wL8Λ +3}J]t8rhuXeqmj5!soye +!vL0E!q@e%5mkg0J7\[ȫK\?IuhjrӋR=ބƠq\cckܢdp&ƝnS]N @ EWCq / Y$mZ)+nÌi,(Nn4>承O8/SZ[&Ez}WB][p`#1"qupwd^S[qu)Z~ZTidY&ߘp? ," ON XA֞&O>w,BcT]<&sSgnHx񈩟^}rYhHKd㘱1D>@Ke4![uRx\BӅz쎘73~7$q +)[n(/@yP8M彯X(O;^%q\[@7(s&yc0}wӹ1}s`Mc21 ɪ$ ^eX;,'o21kHnj(l$c,kwZBbY΄k9$r)VVtoǷ]nA$9G9&rc)e%m5i5h޿WackU&[bQGVuu憋¸N#@J" gL8ҡk\VԍUU51(9\Ȑ3rļl16!9~ij9lacpJ{v\+*=.mW>&yVD+-h]2qͯpUK]#?X0EIM7fRʣSCqQVOi~[d-Pq9)bx}1YŐ$wO_5IFו('[sG/%J[2m#k/n麹917#i,6N,ǖeKjAt:/bjZ0Oa3_׵Y0'9\2?Hm7+ +.InN~>ȇ*&YV+K +mWP ]bS%Ī3 /;p%>DU7TZַĦzt3-SgΗO'TKkJcqj&+:JZI!~n%njr#q+Wj9tR]R+gR[~VevuʭFWj>b~\X 7~C|:R R:XaCuH}9_f_|B׬49M~_"4 qs)9^q+F鱡k- QPqU ҭԮ:z*U=Kk^a}VD[@u394W~^g=Cʢ=ذ'fq'ge6}};ħi`5Y\?JfLTiuY1Lay"INOO0)x #99?(-Yqۆa܏dEy,_PtDd粡zCǽgq;{-anÎzG]˄OVlo<`_.>[S*Vy<$[JC:;A\7eWa5[)WҚ^$uu]!4xf[W]_7fWZ(J?ܽ~ݯ*ڠQ{j{06ө4]esh[;B^=jA5Ђv<] REuhpvTuW,gR)f}K*Co)+#^@w4?KX2+K7*%Ҷu:ڞY8Gv #}"-J՟it^ yp!,g'ݔ2/qlg2G_a&'_ Fgt_yke +g9;92I(_Dfd:3M[LL? endstream endobj -430 0 obj +435 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 429 0 R +/Contents 434 0 R /Resources 4 0 R -/Annots [ 431 0 R 432 0 R 433 0 R 434 0 R 435 0 R 436 0 R 437 0 R 438 0 R 439 0 R 440 0 R 441 0 R 442 0 R 443 0 R 444 0 R 445 0 R 446 0 R 447 0 R 448 0 R 449 0 R 450 0 R 451 0 R 452 0 R 453 0 R 454 0 R 455 0 R 456 0 R 457 0 R 458 0 R 459 0 R 460 0 R 461 0 R 462 0 R 463 0 R 464 0 R 465 0 R 466 0 R 467 0 R 468 0 R ] +/Annots [ 436 0 R 437 0 R 438 0 R 439 0 R 440 0 R 441 0 R 442 0 R 443 0 R 444 0 R 445 0 R 446 0 R 447 0 R 448 0 R 449 0 R 450 0 R 451 0 R 452 0 R 453 0 R 454 0 R 455 0 R 456 0 R 457 0 R 458 0 R 459 0 R 460 0 R 461 0 R 462 0 R 463 0 R 464 0 R 465 0 R 466 0 R 467 0 R 468 0 R 469 0 R 470 0 R 471 0 R 472 0 R 473 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -431 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb10-38) ->> -endobj -432 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb10-39) ->> -endobj -433 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb10-40) ->> -endobj -434 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb10-41) ->> -endobj -435 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb10-42) ->> -endobj 436 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] /BS << /W 0 >> -/Dest (cb10-43) +/Dest (cb10-33) >> endobj 437 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] /BS << /W 0 >> -/Dest (cb10-44) +/Dest (cb10-34) >> endobj 438 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] /BS << /W 0 >> -/Dest (cb10-45) +/Dest (cb10-35) >> endobj 439 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] /BS << /W 0 >> -/Dest (cb10-46) +/Dest (cb10-36) >> endobj 440 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] /BS << /W 0 >> -/Dest (cb10-47) +/Dest (cb10-37) >> endobj 441 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] /BS << /W 0 >> -/Dest (cb10-48) +/Dest (cb10-38) >> endobj 442 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] /BS << /W 0 >> -/Dest (cb10-49) +/Dest (cb10-39) >> endobj 443 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] /BS << /W 0 >> -/Dest (cb10-50) +/Dest (cb10-40) >> endobj 444 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] /BS << /W 0 >> -/Dest (cb10-51) +/Dest (cb10-41) >> endobj 445 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] /BS << /W 0 >> -/Dest (cb10-52) +/Dest (cb10-42) >> endobj 446 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] /BS << /W 0 >> -/Dest (cb10-53) +/Dest (cb10-43) >> endobj 447 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] /BS << /W 0 >> -/Dest (cb10-54) +/Dest (cb10-44) >> endobj 448 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb10-55) ->> -endobj -449 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb10-56) ->> -endobj -450 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb10-57) ->> -endobj -451 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb10-58) ->> -endobj -452 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb10-59) ->> -endobj -453 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb10-60) ->> -endobj -454 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb10-61) ->> -endobj -455 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb10-62) ->> -endobj -456 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb10-63) ->> -endobj -457 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb10-64) ->> -endobj -458 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb10-65) ->> -endobj -459 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb10-66) ->> -endobj -460 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb10-67) ->> -endobj -461 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb10-68) ->> -endobj -462 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb10-69) ->> -endobj -463 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb10-70) ->> -endobj -464 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb10-71) ->> -endobj -465 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb10-72) ->> -endobj -466 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb10-73) ->> -endobj -467 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb10-74) ->> -endobj -468 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb10-75) ->> -endobj -469 0 obj -<< -/Filter /FlateDecode -/Length 4985 ->> -stream -x]Mo츱uaH?,$|aÛיIxL)HQREھaw%*UR]~r*zRbqP/.*orH3(|a_s)cV,G*X,mH`yb>`.1g5|tmYjĂ$  mYjhĂ&(j-v3^4zx֨"/gxD*DgxY|xă.RxP -M$^.^.$HLӖgW>igMyQ.A,'m%A_SFMDtAK`t1H$ 1*@&R.$MYIr!G H𬑀4t.HH@8\](; BXGZ$, HX@[MPSKX@@\JIX@\R씰QVKA3Z%ȃ.0` L" p8.`A؊)i p&$,p]D^T$aZK<7pzm%,p]l?Z/+a=x$,ɔEX"a 'i2) x+-lb$eS[h8(E2vb@ nQ7.FSv oиV_?|?P.ߢ(:t8Li8}~Z}w~巟=!|Cg,NyU'G!yeX{S}bW}iSO}owuzldt$(1AX $T>̠vw>Oݻ-|HBs3,BF(1טb@?!TtҘyL ud!ʞ7 z;n(+I!1tC`|^:m}eQ/&cWrO6)@FJ;Sė dL4b9oFȷOk fY@=7ګh$|34Ȋ3̼h"C1 ߐ DWjq^ a.O&aQPI+ty҇S)r]jex^< u6 '$D^g3#`ۇh3vnH -Pɮ*yB֡q#U1p޻"ΕH -&e2J^L80.k9ɇ;fUC[WlMP_<}Xn 2lIAѣfIqq ec~%Y/7cҍѥo:CFJeF98Ut,pܺ4%hI~1 +M2-͠yL$:"5Mr÷KK:dV_v?!x)k4PЂ@KPYaP;fbQ/NtP<yIitbBc6ʡ#ئ}Lƛ$H\u缷ߙG8X=lc21D$*Ek!.XdeҺiU=݌[m`VVnwa )hD`Eeca 4ޅ}<1ε?un9unEBuZOkxidwMqL<dY҇nw_鴽S٣UP׾uƻ^e' ?9 r3zoxP< |B|Ƴt1^ɐTh>M8`6|J5{neN^Z| CR7#j!+u1ṾbQ|V$՞VnEyyzp܆(g҃21i~%! cLzD1+7;]/od[vdfܠ6zsl1K#yYtnj_l&cC<3ExL(s#rǥ·uq[c.|+o,fxC9*{lc/yL2kޢңl8w#/{T˖ƛ \þKNVo+JksO*{ce mn&i :k~Lw ixƟujyf ly;RwPT,>Ps_j2+d≢ˏʎ즼Cf^\W>iךה1;egR$ͯDe/c~\Fۻt!Қ|wU9 8}\kE{D%+=}Wհb8/Gl"$ْ2MGC/;p%3on&m_ss}әkY|tA>T~P=Um]:rZuk$.]O4~k1UCr\E,7ͷTEsmY)h&jvcDS$ȜgӅؐ/> -Wԝe7 J *|2/5⽶磹l881*cپLByV؂5YG cI6!Oʞn&f oCVY0vޙv>zGWSqlnMfO̩k5VYG(F ֆN~q.7g[~VP]T_pV7 [ޓ{ XmtD:؟&e}ǭzZ45܆6ӵ/V/a^~Tp_~GKv]:v8Oîf7۟UtESПؙҼGP}R9Sۅ1LrPY_B\ԍ=jA<4-zi -RWiJhpvXu -XmrIlb}+}+aS[=^@78_KX2 K7KRmv˺vfEYoJ -^3vn2T-3&/;v&p' q -R7qX9LFkBw(G7*<ݩ[e1~BTc L0738U&raT> -endobj -471 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb10-76) ->> -endobj -472 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb10-77) ->> -endobj -473 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb10-78) ->> -endobj -474 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb10-79) ->> -endobj -475 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb10-80) ->> -endobj -476 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb10-81) ->> -endobj -477 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb10-82) ->> -endobj -478 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb10-83) ->> -endobj -479 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb10-84) ->> -endobj -480 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb10-85) ->> -endobj -481 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb10-86) ->> -endobj -482 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb10-87) ->> -endobj -483 0 obj -<< -/Type /Annot -/Subtype /Link /Rect [ 99.933071 571.808799 99.933071 553.058799 ] /BS << /W 0 >> -/Dest (cb10-88) +/Dest (cb10-45) >> endobj -484 0 obj +449 0 obj << /Type /Annot /Subtype /Link @@ -5592,10 +5193,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-89) +/Dest (cb10-46) >> endobj -485 0 obj +450 0 obj << /Type /Annot /Subtype /Link @@ -5603,10 +5204,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-90) +/Dest (cb10-47) >> endobj -486 0 obj +451 0 obj << /Type /Annot /Subtype /Link @@ -5614,10 +5215,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-91) +/Dest (cb10-48) >> endobj -487 0 obj +452 0 obj << /Type /Annot /Subtype /Link @@ -5625,10 +5226,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-92) +/Dest (cb10-49) >> endobj -488 0 obj +453 0 obj << /Type /Annot /Subtype /Link @@ -5636,10 +5237,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-93) +/Dest (cb10-50) >> endobj -489 0 obj +454 0 obj << /Type /Annot /Subtype /Link @@ -5647,10 +5248,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-94) +/Dest (cb10-51) >> endobj -490 0 obj +455 0 obj << /Type /Annot /Subtype /Link @@ -5658,10 +5259,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-95) +/Dest (cb10-52) >> endobj -491 0 obj +456 0 obj << /Type /Annot /Subtype /Link @@ -5669,10 +5270,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-96) +/Dest (cb10-53) >> endobj -492 0 obj +457 0 obj << /Type /Annot /Subtype /Link @@ -5680,10 +5281,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-97) +/Dest (cb10-54) >> endobj -493 0 obj +458 0 obj << /Type /Annot /Subtype /Link @@ -5691,10 +5292,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-98) +/Dest (cb10-55) >> endobj -494 0 obj +459 0 obj << /Type /Annot /Subtype /Link @@ -5702,10 +5303,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-99) +/Dest (cb10-56) >> endobj -495 0 obj +460 0 obj << /Type /Annot /Subtype /Link @@ -5713,10 +5314,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-100) +/Dest (cb10-57) >> endobj -496 0 obj +461 0 obj << /Type /Annot /Subtype /Link @@ -5724,10 +5325,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-101) +/Dest (cb10-58) >> endobj -497 0 obj +462 0 obj << /Type /Annot /Subtype /Link @@ -5735,10 +5336,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-102) +/Dest (cb10-59) >> endobj -498 0 obj +463 0 obj << /Type /Annot /Subtype /Link @@ -5746,10 +5347,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-103) +/Dest (cb10-60) >> endobj -499 0 obj +464 0 obj << /Type /Annot /Subtype /Link @@ -5757,10 +5358,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-104) +/Dest (cb10-61) >> endobj -500 0 obj +465 0 obj << /Type /Annot /Subtype /Link @@ -5768,10 +5369,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-105) +/Dest (cb10-62) >> endobj -501 0 obj +466 0 obj << /Type /Annot /Subtype /Link @@ -5779,10 +5380,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-106) +/Dest (cb10-63) >> endobj -502 0 obj +467 0 obj << /Type /Annot /Subtype /Link @@ -5790,10 +5391,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-107) +/Dest (cb10-64) >> endobj -503 0 obj +468 0 obj << /Type /Annot /Subtype /Link @@ -5801,10 +5402,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-108) +/Dest (cb10-65) >> endobj -504 0 obj +469 0 obj << /Type /Annot /Subtype /Link @@ -5812,10 +5413,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-109) +/Dest (cb10-66) >> endobj -505 0 obj +470 0 obj << /Type /Annot /Subtype /Link @@ -5823,10 +5424,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-110) +/Dest (cb10-67) >> endobj -506 0 obj +471 0 obj << /Type /Annot /Subtype /Link @@ -5834,10 +5435,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-111) +/Dest (cb10-68) >> endobj -507 0 obj +472 0 obj << /Type /Annot /Subtype /Link @@ -5845,10 +5446,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-112) +/Dest (cb10-69) >> endobj -508 0 obj +473 0 obj << /Type /Annot /Subtype /Link @@ -5856,44 +5457,39 @@ endobj /BS << /W 0 >> -/Dest (cb10-113) +/Dest (cb10-70) >> endobj -509 0 obj +474 0 obj << /Filter /FlateDecode -/Length 5138 +/Length 4945 >> stream -x]K$mׯ Ń= c1,cCOy[0k`?F+3Yٽ=t`2xdƟ JdTJ9~|*zJCaMQyCןࢊ_/k8z\g]\9XYTL1j/2X8彊 QxŜ%,YbPN^bA 6 1E 1l4$ > -,!Z<xƫg -),"x&Z -7/O H<Y!KQ"ċB;Y%J"蠍ND^O<9-QDf)Dg!K><❶A.$V˳ig$,Fy/! E Afb\0ƨ([@&(QP(F'^QQ xH@4d$$pfȃ,.B9bIXknIg#aޒ6AZu) S8`vJXQu>X `Q -8#%, s) Xr&9 댎pJXQU alEٔܵIܵ.@E9$, xswVZAh1B@Y'aSak2ܟ0Vʤ$,]0|"/+qaBʄ%,]8*'a>xj%,]%pج%,] ^2$,SFtE^V:$aJ' ȋ -d$,+8T‚܅{IX<⒕q xœFRH<6a:f pݦ!2& Bl%,T1HX! -^‚A,Y(Uv9IX-dqJX-dA a" o1=,01? ȂHQ JH‚1hUR\H -HX\J%Lz % x$,`HXWEd. dA-a"] YȂhP‚d̠%,F. UK<Ҝg& š&4"&$,p%,@diȃ,Γ)YN7)AM7YCD|dZ‚lMK`^r$,N#D'Q‚L#DyAS-0 &Ib3IXC|3IX0&"zqI q@&Ed$,MDRn>">3$h@o 4*k9h1Y ilh ӼD`>3E~ɌiA{1;Ŗ8_R)b3pJsd" u.Ba!bBb]tc!n`"Cb )oFs Y7 Y"R,B^iس>\sCMoQҺ1 cdMɒ$|㬀R.[KdV/qAV_?t@^/ǡߙ_O/\1F2pf(Qg_iѵ˺lp(3!fًc&)Tn*A{5YoyZׅ[Isx O2P]:܎L΢sU5p&"R'J2@[ck>y~adumɀ6uOFs Hߎs%nH~ -_́^ \ȑtj.Kp*4s:S~dutݖ@_֖ʵz}nsB=ei+Ŝ62dyΕ=<[rVlv84WJe 籎y%GsD`E%#6-eyK .󥖥|kl-L᥍Pj8Bx_ǡy@x=`<9X^B97ԟ]xۢp[ewinYDz'`y;_}x~3)oI 6\!}<!PeI|q*֬(d1n(8ƽ[wKq3&NDʽ$H~|bk7,21?Ǘ ;T\1?0 { h~=Ӆ6a2>c=\XOwT.0^9SgrɐwOz$vR]v|aeL?6s˿>{_~*7Y- (QR&"mpϯlUo m;>E#2y/qkV3-u1gA C[~ؒ^Gcv% ?T\Tg[e߷Jُwv v覻I3{JYOW,LI;1hzdϾ^vu!6 y!-FOkuqe<#v|rz}6Tޯ#UX\3V6[k}ϭU;ٶman9=w{kkYroðJ_菳DlO|{:~hfx;ݓo {pnO_$:7k9m|>.Vr✛;r|azGOn V,XPخCbڞZhTl@ʕ'G*?WV7!LtnzQTgS4"_|ۖ[!b4Ó #c;qds3v'Vl7@f<%?wGNUyۈt׺0-8my5'IYdyp=Yy]⻾U';7MMVwV.wC̟ H| C| qJa U(vfu߹A/4CAu&<2*׍\|oI $̾E[ y߻Ğݘn\F )w{k[/|~2}2TSBē>(⛯hJ>,CO3/|>]g{?_F&:,r0.m|Ŗ|!?I$r`rocIw7%u۬$?q,R]JPm\Me!_خ\Nl%o=NJ+wcxo4sS|^IP1Z20?]8|w,+źo_/jDʞ$3{[H~vDD%W{㼬ko}?ArYK5ٓ큃_NէEAh;q4HsxH5A{d2A+k9]YufVi8o^ RTpkiNsPS}+8 E ~[ӄil/L͐˭@]r5G*RiTMCa.u J 9;mfrhcd7vG]SҎPоLtSA -SwSyIw*f'4CG4`(Lfg} t؊:lc&nuӱr&&dM<}z; f2wбL} t۝loűі̦Z'Yx3DyBn_2j?I&y寗c C{PoKhǭha;ȳ'߸N704b6l(5t?n4쭤j:w&ÉlZ&F=c3LsM*<̯4xn$p*anSyH ry(x_h~~tGM7ZyB`7? ;+y=~WCLީ_gj1v)'@ +x]Ϗq ,M{`0I :Jz-G`gXd,~UEQZ/0/kro*9^ DWBlr>.ϗKw]Ga2sQa#Ǥ3R4Ԉ9ee +G5jPȎ5|vAcA WbVXBUyPĆ@^h:=iAAFpI  < XCńI_ d :Ӏ,t!iH@\] Cа@6Z4, miX@`]ҰPjX@@\4, @.LhX@\vjX@]Lau)&av)pҰհ w X!ǤaAYÂ4`T 0iX[1jXmа w} Py`#nA]װ w}IX5B@yҰDÂuO@+$ "p1O2z\eR*D.iXOְoQZw/VÂE5,9@7,LWc  X @ iX06q ^4,H]4,H] xzd6ȱNՃ"o)X /؉ ׆Et47[mϗ;$;W?P'$ŌZ)ĈoX;;-ݯod]WϏ˺'ٗo9R5$3v{ /OkA|Fx-V._[+VhnwQ !@9Q qrɜg,H CYY{?o{Bپt&Y7^K+\]]) S31Ә"\McTSjVΌ!<d'~ +?o|7(sC- ^= Fkp&Ƿ^֑sHD y@G.CxG7Da dM'4&sSp`1%sPC9 +0M_90voFzV0~޳y5d: IJܴz ʜ@<\{x[ YtoUV7blvphH<e8WQ"C,+"R/C",sHfΫ~>0Me_n{kl`Gm +| sH4 g+;Rw&6H~g%Tib Gky *;ee3Jc<>VVᎢ[5NC7&(0C _v!qxRyh$⒕ M!Ęy "¯q@9Pb1]g(hV^G'q>O%uw >$/V⸻3$jE@e)_{fP<&)K"z\(wKʧ{:a OOa.'[鑧gudy_81hp<]*Q7Elb>0`vH1"=r׳VZem +5q6OA_4Alg!.XdeҺeŎ+XVnaVu[mbގy7 +5}S](c\CQ綝#QVXԩ^W7ń1 7xoG1nzCD[]#yVz$"LY:ދ OQfpaפdcQ6jglG^(1ו7tn};`3nP=9eI+sѤG9b,ì6g݌l&3izPv9!;_Hh_M維#Vz:ȿn.T؏Ab7 ly;S\4K.m]G\VTZ?:sr쀐#b{V1(s3clkDld{^y3cp-LgDʙ3A .Og8qlܿt.i֋&❈GV#[cJoXs)$w21aAr4EՄc3osdmn%e3Q(oh~۶u$J{?cF_9I#((-]`ٚcEAjՕ> en^ +cW0I䄫a9i+vV۶VZm叡Uq8$e21IגRNogNC]4ԣտMEW5Qh hP~@"H"0?vRz)K r9f˗LyL<%Po㦼hT{Mg옳xF^M_;|‹|$'&AbrJt %مo:7]F y0Mqw;E9INDž8|UG_["UPRމ/tɎ[࢜\}@ӑ[T۟kWf"8r6K-cǡ^Q1tȗL_Ñ_0ۣmf2d2um-FGnԘ|s*?he}ouT&vmQ㦻0n7})(,Cr7!ȿw:]HN߹A5 E1uq/40?_OQ&35v"\/򙢠A?mKǭhOP,rnD>V19>ZކWb"$ےqw| ݯRS%3s/;W8 D57Zַ9M\7pD|YZSU|`VU{FNҨl8)B֪FMRhJ-.j{mTnx-gUfS'nЦ>S|#%9Աٍ.Ȇ|Y)g^OFf;L| SsQy.4竹줞*t[c je=T%5kd? +{J)?/ȳMh[cu[395|ɹN4}[Wš,ϵ,P5XG(F'r B9O2>]v2d/A~"'Q#w_%\ -|d=$'*MC3\6Vkh~,ng`%]CP׸=1}ؑ}3]iՋ-c3;%՛$򽇪.%<]WRtv ⢯]eldHz?CAVwхrI3/nҦ 8ѲGQW]TgP7sOm7&x:˴l> Ju=nQ r1aqhGY^ J[4ZE ls)jLwj/SԿ=QiQIRox-Zޜ|wv.bIVhn0J۶mWo{n#̊92Xܔ|fdVZgZp<:LO[N s9pqX5JF][p@dP* endstream endobj -510 0 obj +475 0 obj << /Type /Page /Parent 1 0 R /MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 509 0 R +/Contents 474 0 R /Resources 4 0 R -/Annots [ 511 0 R 512 0 R 513 0 R 514 0 R 515 0 R 516 0 R 517 0 R 518 0 R 519 0 R 520 0 R 521 0 R 522 0 R 523 0 R 524 0 R 525 0 R 526 0 R 527 0 R 528 0 R 529 0 R 530 0 R 531 0 R 532 0 R ] +/Annots [ 476 0 R 477 0 R 478 0 R 479 0 R 480 0 R 481 0 R 482 0 R 483 0 R 484 0 R 485 0 R 486 0 R 487 0 R 488 0 R 489 0 R 490 0 R 491 0 R 492 0 R 493 0 R 494 0 R 495 0 R 496 0 R 497 0 R 498 0 R 499 0 R 500 0 R 501 0 R 502 0 R 503 0 R 504 0 R 505 0 R 506 0 R 507 0 R 508 0 R 509 0 R 510 0 R 511 0 R 512 0 R 513 0 R ] /TrimBox [ 0 0 595.275591 841.889764 ] /BleedBox [ 0 0 595.275591 841.889764 ] >> endobj -511 0 obj +476 0 obj << /Type /Annot /Subtype /Link @@ -5901,10 +5497,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-114) +/Dest (cb10-71) >> endobj -512 0 obj +477 0 obj << /Type /Annot /Subtype /Link @@ -5912,10 +5508,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-115) +/Dest (cb10-72) >> endobj -513 0 obj +478 0 obj << /Type /Annot /Subtype /Link @@ -5923,10 +5519,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-116) +/Dest (cb10-73) >> endobj -514 0 obj +479 0 obj << /Type /Annot /Subtype /Link @@ -5934,286 +5530,10 @@ endobj /BS << /W 0 >> -/Dest (cb10-117) +/Dest (cb10-74) >> endobj -515 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb10-118) ->> -endobj -516 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb10-119) ->> -endobj -517 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb10-120) ->> -endobj -518 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb10-121) ->> -endobj -519 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb10-122) ->> -endobj -520 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb10-123) ->> -endobj -521 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb10-124) ->> -endobj -522 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 282.924714 101.433071 264.174714 ] -/BS << -/W 0 ->> -/Dest (cb11-1) ->> -endobj -523 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 263.977692 99.933071 245.227692 ] -/BS << -/W 0 ->> -/Dest (cb11-2) ->> -endobj -524 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 245.030671 99.933071 226.280671 ] -/BS << -/W 0 ->> -/Dest (cb11-3) ->> -endobj -525 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 226.083649 99.933071 207.333649 ] -/BS << -/W 0 ->> -/Dest (cb11-4) ->> -endobj -526 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 207.136628 99.933071 188.386628 ] -/BS << -/W 0 ->> -/Dest (cb11-5) ->> -endobj -527 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 188.189606 99.933071 169.439606 ] -/BS << -/W 0 ->> -/Dest (cb11-6) ->> -endobj -528 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 169.242585 99.933071 150.492585 ] -/BS << -/W 0 ->> -/Dest (cb11-7) ->> -endobj -529 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 150.295563 99.933071 131.545563 ] -/BS << -/W 0 ->> -/Dest (cb11-8) ->> -endobj -530 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 131.348542 99.933071 112.598542 ] -/BS << -/W 0 ->> -/Dest (cb11-9) ->> -endobj -531 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 112.401520 99.933071 93.651520 ] -/BS << -/W 0 ->> -/Dest (cb11-10) ->> -endobj -532 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 93.454499 99.933071 74.704499 ] -/BS << -/W 0 ->> -/Dest (cb11-11) ->> -endobj -533 0 obj -<< -/Filter /FlateDecode -/Length 4832 ->> -stream -x][q~_&Y0΃/ y95CRI-ٳY! fUKUj2;sI/?\~Xşbb)\d+1BdR >.⯗o:M)ѻpdRNUV&%ŠKX#$e%%12 N1|r +!),g!֪<b+<LĠG睉x.yGdbb+&cu/@ƃ,L9iY(UyD/A) -/CXWVyF4^!JfVyXaw=a  w!A V{ ɂY*pb XB%kX Fd YaAqg 0/%7)P|3iXP(* h*ʼ&!:iY|a Jof f DD. d7\ Ȥ񀻈L@V-7$g:3Kƙ ꒁ[%u|%GR &2UU0U ,o04.QECIn`Z0sbtm}3/siu0~(u) 2SsΉHRGH  W w[[ Ef`f3E*Oy'Y1BȋA(?"J?C}Ti^RІ ʹh6pů>Y=$EGgE/lQx ~AnDJ˯ӿ 郄~|88Yrnϖ>|/t?s -~=/mJuo?.:zqN7D>X7 -xߤ È4zUViݠ. y&;@;syEf/Ƴh2M]$=U/hn -ѰO:1 0EcG q@+e[lme'-qs}^KVQkn']DOY!fy=xl lMN):qUgݦա\ K>#[Q&9_!,ƞ<~l +,]u|g_zi(oI»"ɋ 18'+>}{*w.zk}YB.wze+!$"-M5Iֳn6'񀴔d-Q_0`ʜs՗bUS64yeӕ' e6V4-6C0&e!/K{C~/=]ޘLA:J>%*!~96*[ =zp/1sݲmmwC[ȷ݋͋-hDZtJ6 EcN -Xm{P{iTrp͝vo G~JGط -즾lFu?#oa*Xwuuc<,oy":Էyx6\Wvz뼮xG-霃M=GPoXUа̶yg#`r̾q:1>y+˻B\ڒ꜓fȗ0f8m_7;ۇ_<9X<-r lQ>7hN_<ɺtj ڶG/d1*eLuN2dr+ɓV7=ts0=\m{.#t.px)uΣ9fAwur*.%:f:Qarj7|Rw9,˳o,l ;4J@|[\J^n;:1"zGmXF^IRnUF֞_Ndn6rFzl8N0\.fxltu.:[ӱǒ5@X#V!]'fʯ r3l,CkcבƝm6_/c5YL?N:YvWi .@;N:[:[ԯ}i</!p$'Gё/?ֳ4o~l7l]GO&?1*MyNv ~kmZ5u;CÁzGȄė(@;%՛C7$Vp1.sQwסI\Ie?T(.Kl!IzGU5\ a\Rqwcӕ6P!0cNBE7OYXgP7Hm7&x:˸l>s#ڢaQ r/.FW SEQ4VZk1U\tYbN8aJ0j%nJhZFsNl/bɬXQJ˾]#S۫M7[έj@+UN+.ӧ%41CX~"q4xcQ8ƞD69i8]Knjqzb[zn%sv36 92I(?Ffd3:.L] -endstream -endobj -534 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 533 0 R -/Resources 4 0 R -/Annots [ 535 0 R 536 0 R 537 0 R 538 0 R 539 0 R 540 0 R 541 0 R 542 0 R 543 0 R 544 0 R 545 0 R 546 0 R 547 0 R 548 0 R 549 0 R 550 0 R 551 0 R 552 0 R 553 0 R 554 0 R 555 0 R 556 0 R 557 0 R 558 0 R 559 0 R 560 0 R 561 0 R 562 0 R 563 0 R 564 0 R 565 0 R 566 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -535 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb11-12) ->> -endobj -536 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb11-13) ->> -endobj -537 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb11-14) ->> -endobj -538 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb11-15) ->> -endobj -539 0 obj +480 0 obj << /Type /Annot /Subtype /Link @@ -6221,10 +5541,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-16) +/Dest (cb10-75) >> endobj -540 0 obj +481 0 obj << /Type /Annot /Subtype /Link @@ -6232,10 +5552,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-17) +/Dest (cb10-76) >> endobj -541 0 obj +482 0 obj << /Type /Annot /Subtype /Link @@ -6243,10 +5563,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-18) +/Dest (cb10-77) >> endobj -542 0 obj +483 0 obj << /Type /Annot /Subtype /Link @@ -6254,10 +5574,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-19) +/Dest (cb10-78) >> endobj -543 0 obj +484 0 obj << /Type /Annot /Subtype /Link @@ -6265,10 +5585,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-20) +/Dest (cb10-79) >> endobj -544 0 obj +485 0 obj << /Type /Annot /Subtype /Link @@ -6276,10 +5596,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-21) +/Dest (cb10-80) >> endobj -545 0 obj +486 0 obj << /Type /Annot /Subtype /Link @@ -6287,10 +5607,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-22) +/Dest (cb10-81) >> endobj -546 0 obj +487 0 obj << /Type /Annot /Subtype /Link @@ -6298,10 +5618,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-23) +/Dest (cb10-82) >> endobj -547 0 obj +488 0 obj << /Type /Annot /Subtype /Link @@ -6309,10 +5629,10 @@ endobj /BS << /W 0 >> -/Dest (cb11-24) +/Dest (cb10-83) >> endobj -548 0 obj +489 0 obj << /Type /Annot /Subtype /Link @@ -6320,236 +5640,309 @@ endobj /BS << /W 0 >> -/Dest (cb11-25) +/Dest (cb10-84) >> endobj -549 0 obj +490 0 obj << /Type /Annot /Subtype /Link -/Rect [ 101.433071 447.971735 101.433071 429.221735 ] +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] /BS << /W 0 >> -/Dest (cb12-1) +/Dest (cb10-85) >> endobj -550 0 obj +491 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 429.024714 99.933071 410.274714 ] +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] /BS << /W 0 >> -/Dest (cb12-2) +/Dest (cb10-86) >> endobj -551 0 obj +492 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 410.077692 99.933071 391.327692 ] +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] /BS << /W 0 >> -/Dest (cb12-3) +/Dest (cb10-87) >> endobj -552 0 obj +493 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 391.130671 99.933071 372.380671 ] +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] /BS << /W 0 >> -/Dest (cb12-4) +/Dest (cb10-88) >> endobj -553 0 obj +494 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 372.183649 99.933071 353.433649 ] +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] /BS << /W 0 >> -/Dest (cb12-5) +/Dest (cb10-89) >> endobj -554 0 obj +495 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 353.236628 99.933071 334.486628 ] +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] /BS << /W 0 >> -/Dest (cb12-6) +/Dest (cb10-90) >> endobj -555 0 obj +496 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 334.289606 99.933071 315.539606 ] +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] /BS << /W 0 >> -/Dest (cb12-7) +/Dest (cb10-91) >> endobj -556 0 obj +497 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 315.342585 99.933071 296.592585 ] +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] /BS << /W 0 >> -/Dest (cb12-8) +/Dest (cb10-92) >> endobj -557 0 obj +498 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 296.395563 99.933071 277.645563 ] +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] /BS << /W 0 >> -/Dest (cb12-9) +/Dest (cb10-93) >> endobj -558 0 obj +499 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 277.448542 99.933071 258.698542 ] +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] /BS << /W 0 >> -/Dest (cb12-10) +/Dest (cb10-94) >> endobj -559 0 obj +500 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 258.501520 99.933071 239.751520 ] +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] /BS << /W 0 >> -/Dest (cb12-11) +/Dest (cb10-95) >> endobj -560 0 obj +501 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 239.554499 99.933071 220.804499 ] +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] /BS << /W 0 >> -/Dest (cb12-12) +/Dest (cb10-96) >> endobj -561 0 obj +502 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 220.607477 99.933071 201.857477 ] +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] /BS << /W 0 >> -/Dest (cb12-13) +/Dest (cb10-97) >> endobj -562 0 obj +503 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 201.660456 99.933071 182.910456 ] +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] /BS << /W 0 >> -/Dest (cb12-14) +/Dest (cb10-98) >> endobj -563 0 obj +504 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 182.713434 99.933071 163.963434 ] +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] /BS << /W 0 >> -/Dest (cb12-15) +/Dest (cb10-99) >> endobj -564 0 obj +505 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 163.766413 99.933071 145.016413 ] +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] /BS << /W 0 >> -/Dest (cb12-16) +/Dest (cb10-100) >> endobj -565 0 obj +506 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 144.819391 99.933071 126.069391 ] +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] /BS << /W 0 >> -/Dest (cb12-17) +/Dest (cb10-101) >> endobj -566 0 obj +507 0 obj << /Type /Annot /Subtype /Link -/Rect [ 99.933071 125.872370 99.933071 107.122370 ] +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] /BS << /W 0 >> -/Dest (cb12-18) +/Dest (cb10-102) >> endobj -567 0 obj +508 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb10-103) +>> +endobj +509 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb10-104) +>> +endobj +510 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb10-105) +>> +endobj +511 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb10-106) +>> +endobj +512 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb10-107) +>> +endobj +513 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb10-108) +>> +endobj +514 0 obj << /Filter /FlateDecode -/Length 3110 +/Length 5015 >> stream -x͛Ko$ )ez 0A9@`C~ztծ7JMփ]Y+ Ưjm%݅BIfSLZBk5PZ%_/u]?^˿uCk9rTBPrT *bqT)Rbʎ*s#`F*^U`<0Cܫ̈S n8*&R8AϞ.rȵ -t\ ('t-St -[R#t $V%O[TjtHru%"ixWuu2kRAG{]R!O|S\V&)GaK\lIB lQ|{:p"IYVK%Ƣ`= [dXA1 E Z= -ڂ"bKAs+`K@(V-cD؂ D`KTX [<pcJ= 3cRz, <+`t܋u%@]њ=+@]tut U<(+LcXFcf5Jwc%Xn,\] X@ݘ DcQcXG  $?-EXBDX ܰ9k -\[X]>Wn1ʁsn J<$p 5z,H. vjOrl C` &kZ  ,E؅UՕGbq ġ 2y,.%%E`q tXΚF(% {:p4ܵmcA.&c ǂ\5Rǂ:|.' H@-ZcФU%cA!D1o7=-p7?P؂HcHjSXPRF>Qt9ZkWWⱠ ؊crP=%0:V,؊B= B챠F؂hcAYf&ءKb=cA,TXeLtuXd;y,@di-cA걠V)z,oZY<4-<4d8tD WQ=`]ZY=4!Hu$[Y<4- !-n$䛠˰%6Xr|z,@|{$P-,q]Dcno"r{xSA|+e=1 7aou nU3|-Gr `&2˚SlP2";&N# w(3klX~O/_c˛l'edK$6L7p$#`)q~L3i$m > fF0="S`Ldl/o-ZScoXSX,(%-;  -ew;o{t`/W<r -dƪC[VWoٛ(eئ^_ǥ޸YF[Էr|lV>S-0>}mh6x=-or|3w+wt@ cZb=:!9 pllEX"'W=/&14 Y<-rlk˾>lKcN Io|;K+#0MyZ l;|>7D:䡱1}dw9:!w9Or= 2b{m9?/8AOpR)؁J@a|? @~F{|8CFe[z9~ÿh_-kTS.l4eyYV|Tyf2#6|^Dk:Kqi^wY6]%&L7{&>AOMrg7_ѤCXyM<'5%Fbo6m)ږUj3yTz菲?I˴=e@{2i+)-y]v~gXd%k 6~jgD/o'jn>@۫D^61o/432}O~3ŏ{Cj/p6x=C%sII6/cOcSf'nJlgN!jfS]lo ] giC8ԵlpV|a[FqƜC8L_ecY9YJ3THC&QmHS/9&D<9#zӊe쓍vGQr[Kc(UgG~2]]xG.-߲FHQm\S]& .IJK*N4YA*!4eJKCev.loHCj.XKg;nvbksz#Zfex!qtG1b2dnAj(uCl3X -8 W~߅Ʀg~Lq4 PMW렓|/"v܇ϗmY;Y#eϿ.zc㶏#Eփx-B؅c,¨ ,7}<ƅ:{/Ƀ<01\qndYF&=#|8d~ v+ЍGd*ܬ:u2$ҡոT(n۴`9z_שkYӹͮMwKެ +=~&L:>tl|^a'8ۋrmTOC,zi!vt3:=l[G +x]K$qׯCkI> |.MK0z t#3*jzv +4G ~ e??JdTJ9:_~:|*z%⡐џ!Oࢊ'Z=O.˘U9k_DN)Hޫ).,diK`r lI %(%ea!6LQ  >ZM@3^ zh֨"-fhΩx#Ѳ +!$D"- %Z/.8-MI^,F' ^ ]Ih)HˠӖfW>9%1C6HÊ$(,x g^V9Bh bJjvFybm$^0^t `)% l% lr% lʊbt %pڀfNOABg a42IX,xA /hK t68-i$,p\%,p@\IX,a:`%,p@]烕v a:2Z:" @%,:*g(awU9 @VMIKX@]4IX@]DZTXNZ.Hkpג @PGpes`%,: P0K$,]5 R& aiY-FY E$,]gQk4D KXqPohHJ$,]ZX$iQAcaJXPY‚9 pW^\ VX0V@ +3,рZ,aAڔ DNI0`[ B"c A'҂³ j$x@H/I*$,8k%,dַx(aLL$aAFUR\H +HX_J%,z % h$,`HXUe. x-a,]Ќ YkP‚d̠%,/hL$ +ME Li)ExLHXagKX&^' Rn& R/V[ oF /$,:(6%,$$,d3IX OX7" ,[`MD f ffMXbH ppg D2 &,[ɷ^ag#[ŐB[E1f#A 21j +b@a +"w2cYslJ)>~{?Oo*c ;֞͘n* @tC0Hf"ΤݘIb|n̒ep<3g4 O`\yLj.qJ)hٱ>L"(n]m pK"lPYY#8EClgrٲ^дO'@n߰kO_wßf?>ο\O3m"OӢ L4%?Ü7}oy~sI Í L;eu*O˙N^Ln&rcEo!Xo" eNlCO.]7{ˍPNgb8[oѱl^<ςY>~A6(."ץ0|\cz棏IǼ$DO@1'kfe +Ų1ќazdmy:Ty)¤!$Mi!NcxpJe+4gݒ0Av`оV&rNv6^z^4u<^2Յ%<j>`v/¡T +2#*'YhQ~Ky3/Ut6Wkl9Qs\P|咒 +^J~RDZ2O#֥O(9yj8L+'oN23/=^6z ܾ!Ffڸ{I嘐Nh761oKq566ٽޯ:~Ġ]:;ިay󈧇"΀<.F Uhnrluv5c2J* K|7nsި Q*}$DK66-yлC"zs|f=c\дߥum\^gvx/It-?P>чx XF֪|qh^m%au8 . ?/bmjs+}fGh * \< D!UВ ȡQu'I7esj\aN PBB8a!f=X{;U"v 2Jy֎ խ:\ dWkf|!Zv-+~lˎ?Hb~ElЭn7x]tH n23=-0eP/,_н O*nNx ̅TEPȀ&}à沑Ixe9Ǻ$}u2SN˭XXNV:*y/.[\N|ڶ:f4f/=џ9c @mjwdmo]9-'> endobj -569 0 obj +516 0 obj << /Type /Annot /Subtype /Link @@ -6557,10 +5950,21 @@ endobj /BS << /W 0 >> -/Dest (cb12-19) +/Dest (cb10-109) >> endobj -570 0 obj +517 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb10-110) +>> +endobj +518 0 obj << /Type /Annot /Subtype /Link @@ -6568,10 +5972,10 @@ endobj /BS << /W 0 >> -/Dest (cb12-20) +/Dest (cb10-111) >> endobj -571 0 obj +519 0 obj << /Type /Annot /Subtype /Link @@ -6579,10 +5983,10 @@ endobj /BS << /W 0 >> -/Dest (cb12-21) +/Dest (cb10-112) >> endobj -572 0 obj +520 0 obj << /Type /Annot /Subtype /Link @@ -6590,280 +5994,1036 @@ endobj /BS << /W 0 >> -/Dest (cb12-22) +/Dest (cb10-113) +>> +endobj +521 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb10-114) +>> +endobj +522 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb10-115) +>> +endobj +523 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb10-116) +>> +endobj +524 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb10-117) +>> +endobj +525 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb10-118) +>> +endobj +526 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb10-119) +>> +endobj +527 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb10-120) +>> +endobj +528 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb10-121) +>> +endobj +529 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb10-122) +>> +endobj +530 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb10-123) +>> +endobj +531 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb10-124) +>> +endobj +532 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 177.989606 101.433071 159.239606 ] +/BS << +/W 0 +>> +/Dest (cb11-1) +>> +endobj +533 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 159.042585 99.933071 140.292585 ] +/BS << +/W 0 +>> +/Dest (cb11-2) +>> +endobj +534 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 140.095563 99.933071 121.345563 ] +/BS << +/W 0 +>> +/Dest (cb11-3) +>> +endobj +535 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 121.148542 99.933071 102.398542 ] +/BS << +/W 0 +>> +/Dest (cb11-4) +>> +endobj +536 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 102.201520 99.933071 83.451520 ] +/BS << +/W 0 +>> +/Dest (cb11-5) +>> +endobj +537 0 obj +<< +/Filter /FlateDecode +/Length 4885 +>> +stream +x][$9 ~_H8GZ!-1gz:suRUgw[t\N%iwa.9w'kr3X\L?_ggC6ѕ(\z˱?;s)ޔUXLmTX,Hahr1) 5b>lYjQcA=+,-@ ]XPÕykU!Wx.FO;2x.{GdR.:WLJ) %4^.х`5t Y%Bʃ.3i ]>iXG1F]@Hհ=x4,@e#,Ѱ w]iq\SyŸW-Zٸ4,]'kX7Q#:_!jXw0ߌp]W-D.`kXQXlHNC5,H] EÂܵHÂܵaʃ.^5*}Hkm.$ ,@A(kX8sҰ  B> قY*4,@`m +ְ {BkX=tAȠa"So5=.p5?@2% rLЪ/yp<5,9 NR5, 4,๠aA.]E E="s l 眆 A 3d5,\M<5, R<аd;jX&]( a3tkXߔ|3kXP,tAħaAHa`QrR@z{>>~im| 'pg^?=;>rۺx?qY"w|5 ò9OL!ikc"oa$mfqvYh$2NPEnK3c( W4tPi:rYh&;n/+T㮾} (@+W_w2&<R/yy}CgQiUd7m?2"씔{o!ˀ0Ww? J9Qǣ2|Y^ +baۂc:"RGCm ŲžyU@a8ec&|͎8@c>8qJL:,;De+}$>sX7&m\8]vvobN7@:4 I=sw{[4y1'VdEVlz؞o彝HqwBJ9(33^ޛb6)_ *ow4} +q5H}" =:DJψz:7lz_Vh# YϾot4B>e,Gf֎@lٿ2hV 1[ee9o0Sou&W;s,wn:i%OѴ<y4Ns& d266\sINYgy]w<Ȣ> j,*`aZ 5oABE]Vs"7_M*ǞyC7cγrm( I*z4Y%h+Vw~:G=YNgxPyQ0X#9]s"h Kgt 0O%|چp!w̰VߎdluM>8E6O,*[j~<^tkzlqAwѹ﵎t!pCHw"dxYM(k yyOVvM'Br0׎TlXqZrA:Ƶ hWoe~k~9l@H\(H_v#{utv#ސ2|FLTINH!=Y4˝>˓K^ktJhnPΝBJW/0+wgZA^=k޹e}'?P̽eɯlBwtR4z|_ +s;OADqo#$ ,3{FO/Myo>(SQ3wcX@ea(ಷT|tMˮ?qw|Aɻ{E+~?/fнQah +t$d311@B ~zM~WTE'7c㋬ %'wExJew97MoXBcɯny]mmƤ4m=eǜresq,,O~0q3L|LyL1RuOR)؜UzLiL,þEeoX^;K7=-2-stct|sAR>yr0J{sG6nͥEpğwy瑃`A=gQ鏻t{G6n\ȿqsiIrDNvieRKʼms鶎[K g,M^yN[9$ va>T +gEh~FU3ncnu EFN咰Brj+y]&IåӆڤBSYYb|ˋ+Me֯P>پ1*Nẹ;?7jQ +N@5i?)ڼnjw!9]+%d]7ۓ/[(l;e__OrzP!,mu!+XXheRC^}ULU"J|zcdyzkL|*K# +XWw2܉qK:Y+e}ZAlMײ>Gp[ZS_Ub]mѠTiXK6f't9)/l:?Xͷ7\)rSHZn-6KVh-UN^Mm4S>G,կKr T[[o6ڐ_O1+c +Dmd_:5sm*tJ+TF䙾\JCW&7yH#=5 Z Ȟ@ώ*t[b d=T%5kd> +GJv+.]غjf [v,dۦowJL[Xޤ%n6bN0:kom$QNO0)za99}?()'^qoZ 8zA9[> Ɏ{Xx^KqGbm8}s]hhxxYb dm}pbUΔZb|\rQC}H7AcnXf 5!Ǜh +y+4^ a\R>̎UWC4^7޴,Q~svUNA{`BmSiL6д#vB. wZ\ 7 i(\f+՘Ni2=1[Lѩ[:ViGMYx-Zѝs:KXZ5Ti{h{#tERLmo¿j@+UN3Yiy4)CE> +endobj +539 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb11-6) +>> +endobj +540 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb11-7) +>> +endobj +541 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb11-8) +>> +endobj +542 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb11-9) +>> +endobj +543 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb11-10) +>> +endobj +544 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb11-11) +>> +endobj +545 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb11-12) +>> +endobj +546 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb11-13) +>> +endobj +547 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb11-14) +>> +endobj +548 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb11-15) +>> +endobj +549 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb11-16) +>> +endobj +550 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb11-17) +>> +endobj +551 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb11-18) +>> +endobj +552 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb11-19) +>> +endobj +553 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb11-20) +>> +endobj +554 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb11-21) +>> +endobj +555 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb11-22) +>> +endobj +556 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb11-23) +>> +endobj +557 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb11-24) +>> +endobj +558 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb11-25) +>> +endobj +559 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb11-26) +>> +endobj +560 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 292.842585 101.433071 274.092585 ] +/BS << +/W 0 +>> +/Dest (cb12-1) +>> +endobj +561 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 273.895563 99.933071 255.145563 ] +/BS << +/W 0 +>> +/Dest (cb12-2) +>> +endobj +562 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 254.948542 99.933071 236.198542 ] +/BS << +/W 0 +>> +/Dest (cb12-3) +>> +endobj +563 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 236.001520 99.933071 217.251520 ] +/BS << +/W 0 +>> +/Dest (cb12-4) +>> +endobj +564 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 217.054499 99.933071 198.304499 ] +/BS << +/W 0 +>> +/Dest (cb12-5) +>> +endobj +565 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 198.107477 99.933071 179.357477 ] +/BS << +/W 0 +>> +/Dest (cb12-6) +>> +endobj +566 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 179.160456 99.933071 160.410456 ] +/BS << +/W 0 +>> +/Dest (cb12-7) +>> +endobj +567 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 160.213434 99.933071 141.463434 ] +/BS << +/W 0 +>> +/Dest (cb12-8) +>> +endobj +568 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 141.266413 99.933071 122.516413 ] +/BS << +/W 0 +>> +/Dest (cb12-9) +>> +endobj +569 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 122.319391 99.933071 103.569391 ] +/BS << +/W 0 +>> +/Dest (cb12-10) +>> +endobj +570 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 103.372370 99.933071 84.622370 ] +/BS << +/W 0 +>> +/Dest (cb12-11) +>> +endobj +571 0 obj +<< +/Filter /FlateDecode +/Length 3690 +>> +stream +x\K ϯE 0t`0$F` -*C~>t=XIV L`ɏduK¯"J9]s<"T8\ct]sto1ZSxe \r`U<b2X.V1b 1h P V,U!F$ bP`7yċp0x]¦'ȥRC5y<1"YRJX<,zxDldAP2[ YvY`]AX#r&%ldI>VY"`~,p"r.֠͞EBY| B,>' ANq€PIb@(Il@I^ C(B&"\Y :XX Y X _ފdap!\XX\R 촰plau9`avYJ,-,.3F< +[X ]&-,.(XX:aB)` `Enn>XX !YXCqof]@H`2XXT Z9*5YXT>WeeG)U "p-,]gQKHm w7D `XXtM^ubaA DGjaA"W pGf p Y ׀5|ɪHa񀻞a>W pWæ)+! C,,HE\9YX)KhaA D@Ƀ,$֮r-Y8 r,H,,@F*!6s1,-,RE,,1îZ\ɀkWlaAR-,;M,,XX+dXXPJ@fn ɶ.xDY ZXPBAШ%O֙‚"iha&AЏ?(6Q&p>}!#fY_v>Wo|夬%iaEBWnNP 8W R !njQ!rB`q=tS!nȐXe&$3˕ɼ.*8ٲ>{璕ۺp?Hގ5r9!CR,@B/A˦^FޜF4ln_}wXO_kzKzxBWtir:Ωk7{\I dNQcC>J=VPk"BQZ_ϲhv|ɻ#[!4DkGdŨ52QɃc^NpыP9FlꀵnaBv1/Gp?sZ?NP]WSxϸ+֘ՍTVO@rI\Qf$ 1/@(@T 4>ؔ7š2tL6Z6`VW7!SYWwF -)(&s4beES4-^EwciIncc^e,j`t7j& +o&(;~{OͨHNnj$,'=Н1#asF6Kި,ُ&%r{q!/T4a妩L>K3m滰/fx=]΂ ~zYrv{r^Rn34}8ޛ/-}qyD@1e=F. d͐ey5o2!ubʠk.y +%;Om`(ty=amy9cJM].xwh(L +yZJSf˄*YO*qzl̋Q>R"2Ulr*ä=-攷 JyƔvPo.R =doǩZ&M-CFjYYnݴdžH#J@&q3yn),9&'!gwEQhρ +fT^;쐢yC\1f񴓩y>0^CUizcQ{s{=ȐE.occ^Af}5K}lR\Eld75SWv݌sjJq)bFؘc)O?l'۠.WﳌzWn<>1A7oθCŽdׯ#'Cd0q5Nr ? }Pb s eD#)v A{C}qJizRn~3kBJNش=ӣv'ڝ#ӪtĔ-@5s>ԿPjxV&Y7^/]yikՀ}VZ2?˫v82Z-A_>:&qW,[,Զ 㕑+[z-.vC}WâՍo\OKO}F ~}.C}Oί_kcb0}J|˳@ "F&${G+YZ*Vꢠf8&p K&1^ 7.u4E5"X'Ji< U;5]!dNoS 34Cޯ~t0Ů{1 S7ޠ-{R9uKNk_& !JA~:l+|l7y2k6>P;UgBMJf'o7i:b + *ι_C +w߱ uڲkOAǖL:Y!OʙXnc7 yFK4{r4s8]>dxZj-2h7C0 }Z[;:Kp2+08M4gGt/|:9"tlݐHo6i#vA&d*olx^:w&Ʊ9t n{"vqz^]nR1_ex4%Zutp%Lј'EsZ6bA΋WeVZScJ#Ƀ'#S7rS<7扅EFCvO*rj4S)M奙sxy9ء>O=1R 4fe [;yQi͢-Pt7Z17:mrܥsAm8kob.-l{gssbwcvV`Pl P e_RHLGs$q+AN}&{*O`iVa՛ %COpo=ͬ ֤kٓyd/ +endstream +endobj +572 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 571 0 R +/Resources 4 0 R +/Annots [ 573 0 R 574 0 R 575 0 R 576 0 R 577 0 R 578 0 R 579 0 R 580 0 R 581 0 R 582 0 R 583 0 R 584 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] >> endobj 573 0 obj << -/Title (Hardening Guide with CIS v1.6 Benchmark) -/Dest [ 6 0 R /XYZ 85.009843 502.818898 0 ] -/Count 12 -/First 574 0 R -/Last 583 0 R -/Parent 586 0 R +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb12-12) >> endobj 574 0 obj << -/Title (Overview) -/Dest [ 27 0 R /XYZ 84.259843 413.481496 0 ] -/Count 1 -/First 575 0 R -/Last 575 0 R -/Parent 573 0 R -/Next 576 0 R +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb12-13) >> endobj 575 0 obj << -/Title (Known Issues) -/Dest [ 27 0 R /XYZ 84.259843 213.933496 0 ] -/Count 0 -/Parent 574 0 R +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb12-14) >> endobj 576 0 obj << -/Title (Configure Kernel Runtime Parameters) -/Dest [ 32 0 R /XYZ 84.259843 692.570079 0 ] -/Count 0 -/Prev 574 0 R -/Parent 573 0 R -/Next 577 0 R +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb12-15) >> endobj 577 0 obj << -/Title (Configure etcd user and group) -/Dest [ 32 0 R /XYZ 84.259843 432.234971 0 ] -/Count 2 -/Prev 576 0 R -/First 578 0 R -/Last 579 0 R -/Parent 573 0 R -/Next 580 0 R +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb12-16) >> endobj 578 0 obj << -/Title (Create etcd user and group) -/Dest [ 32 0 R /XYZ 84.259843 315.936971 0 ] -/Count 0 -/Parent 577 0 R -/Next 579 0 R +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb12-17) >> endobj 579 0 obj << -/Title (Set automountServiceAccountToken to false for default service accounts) -/Dest [ 41 0 R /XYZ 84.259843 699.833993 0 ] -/Count 0 -/Prev 578 0 R -/Parent 577 0 R +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb12-18) >> endobj 580 0 obj << -/Title (Ensure that all Namespaces have Network Policies defined) -/Dest [ 58 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Prev 577 0 R -/Parent 573 0 R -/Next 581 0 R +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb12-19) >> endobj 581 0 obj << -/Title (Reference Hardened RKE cluster.yml Configuration) -/Dest [ 75 0 R /XYZ 84.259843 500.493907 0 ] -/Count 0 -/Prev 580 0 R -/Parent 573 0 R -/Next 582 0 R +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb12-20) >> endobj 582 0 obj << -/Title (Reference Hardened RKE Template configuration) -/Dest [ 357 0 R /XYZ 84.259843 193.712413 0 ] -/Count 0 -/Prev 581 0 R -/Parent 573 0 R -/Next 583 0 R +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb12-21) >> endobj 583 0 obj << -/Title (Reference Hardened cloud-config) -/Dest [ 510 0 R /XYZ 84.259843 477.917735 0 ] -/Count 2 -/Prev 582 0 R -/First 584 0 R -/Last 585 0 R -/Parent 573 0 R +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb12-22) >> endobj 584 0 obj << -/Title (Reference Hardened cloud-config for SUSE Linux Enterprise Server 15 \(SLES 15\)) -/Dest [ 510 0 R /XYZ 84.259843 350.369735 0 ] -/Count 0 -/Parent 583 0 R -/Next 585 0 R +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb12-23) >> endobj 585 0 obj << -/Title (Reference Hardened cloud-config for Ubuntu 20.04 LTS) -/Dest [ 534 0 R /XYZ 84.259843 492.916756 0 ] -/Count 0 -/Prev 584 0 R -/Parent 583 0 R +/Title (Hardening Guide with CIS v1.6 Benchmark) +/Dest [ 6 0 R /XYZ 85.009843 502.818898 0 ] +/Count 14 +/First 586 0 R +/Last 597 0 R +/Parent 600 0 R >> endobj 586 0 obj << -/Count 13 -/First 573 0 R -/Last 573 0 R +/Title (Overview) +/Dest [ 30 0 R /XYZ 84.259843 272.631496 0 ] +/Count 1 +/First 587 0 R +/Last 587 0 R +/Parent 585 0 R +/Next 588 0 R >> endobj 587 0 obj << -/Length1 9900 -/Filter /FlateDecode -/Length 6561 +/Title (Known Issues) +/Dest [ 45 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Parent 586 0 R >> -stream -xz{\UUw^py? 8rP1 |d@ i)ȔLԌу433ciJʺ9sa vk{?w/]}>`G Y= b.O.,*Oq}2R>n]4_ȃY#I+b\9K l7]J-Y!)h3h6c3rJ@"o1wIȍ i?6Ϥ)% =sނǞ|Ϸ@"|lܢ99o|~XF6S?0g^~ORqQ`2KBMMv4ITЮoҞ' &B'uUuy"0}d -} l0;pV8ёķP7A -*KܱWf<@8,Vɶ汫?mf P)uuy|y[һǔ$(Ud8' -,NGkP? `>/7N|I)pR Ǵ'i6.]8PQ0ܯ EhvR  &}#XHK}>H9`vM[]Ca>;f<(ioo{(1n#=c&3)wumzȬYmoϜ(I<jM~ֻWFaiXeظz4L9mzg?e{*jSA+Uxo lq?oxK࿻VK-tO=ȿxbs ~ӂ&AP&Dii^/ڂY৉''~R ȁ.+O_/ 痗xwA -@o/B-w>'|(Yigm<-xR[xBx̎ n {8 -ommyV.p 7 T7 ZTS7X϶uzN -y3nv*ϸikVkOO=ի̼ډXEUyXItJ;r;Rr;>!B`@O-l.ò,/s|̊-Ȅ .h,i-X,H`8GlP>{8sΠN|y 3[p -"pIM|R N4//qquñN3ʏi_ A3GQ~82ć.0bz@T8!~Çx}q"p'؂'O66L6cPL׌}zy6bDy3{1΁=bݼǃیFb< kPb!4C|0$,0@ -얇$?]:!NڇmUşM64 -T Lhp2Md.Ql\̆ yYʧY o ^8O$mla>I`%,S(HQ+\[, d):ay앯Q1@./r)K|Cw -M9/rc5&a&[S ErSVNk/8YKeX9/V*E4mgcI QFvv:Ó%q$g ZJe OcD=핫!؛_M(`U(Ev5+.p>~VQ^yfZ½U[%ĻV4b9탯lC.~[<,ZHbF< f+(fCaܗ2(H*pzc-%L:=&F݁$V]&Eþ+KSDy;leZwKGxG\G9r-ٌa'OJ +umukܖHcp`_0F[MVSkV쎔<].uHlþAaAISXyl n2 -f__!^J6:Ͻ4qVQ\g=zq`3َT&B <`Px~Uc] ONhmMP'.ݰ$vEGR8"9/NfӞe↸clq6-#hx_xMT`ҵzyj OF C!MH8C -#'٣:wm|_n&KgR7@W% lFM>нO_IɳZ+vJZ5&E#fEv؉FD&wfllLLrDyD{~}?D\mEYs+U[>|7C+M rʟ~0,}կ u3M1eݛf0Zj ;嵯 @v10TbHa]jNL~xV+-ȤS8S z<OdfHfhfXfxfDfdflqʐЪ𪈕bboƆv-ZԵ ;4;,;<;8888""""=,y=*+$?)B!Y g҉O3g^|~#߳LSN>…t4:ؠ( Q%OV`` VgWXlȠJ-R MN7NH8ZZZLd9HP4 2q;赥/}K>wϾGiټ7/1JZpv;98Z?g{4mً d&pONo:|pΓ O&Fљe 1:*|!&hl}{HL >,zK짛:/.k{VI`ULwo%1pʡﷶPW?~#>_ޫoN1d2;}f#~@4ZRe{-LLRaN-,fu(ۥQd=K.]Zsa OvJھc]mUm{~޷NK+{ 5h8SeHWmC3Nf3b#׏uK}Nq~6gڹ vEh,9\BlMF3Y!3tץ,_7x-_lGeɤKRW'H TZ̗KuT7/J#7*M+Jcٖj\)W󧕵ɰ_G o~oĿ7SKb2c Ҝmgg,vV)~ !d08|A 1,U! j J] vOfݫtkD]uuTތ4=H[?(աao-DCµ{J?!~z>T6MϽb[}pF;GQu55uYlo]ҏm=X3hP\? cM7w :\ú3jSJ ,2PM2KOܷVn/s ߛ7&jq#Kp!nk]ꝳ_ofqBO -E'!EځtL4ckl4tJty=-($G Qa#{m{aб~}~D!Gti":np3י!ݡ3ZvVigC36HTgUw(}z{tb5l -6[Peellll1C8zz{uu#,.<.":TiT8(c3ZKoz0X1K{4<"n]\]͸nS%VZJwruuӻɧY&g?_pXN=أGVgdmGN$'OY@f(o'+U_|Q2It&VʇĎsЫ1 d[(әbV&VfUU|muգ=E؃dur`O^ <<-ݥ|JE5%q"[Q\0;A ;+^C-<-;&iٱ.v݁7qr6(pĵJ -( ޤ27fӝ=ޙQʚ 5p]FhlL** -iKRh$+v]qr ltHg#qG(uL`p@|. qe%dXM1RZIڊ|ԫoS(GMcN_٭YxvIh $daxF -7xǛ&i2̨gMɨwhV;Ĩɕe[G :ĀgGSw;%iJ6Ft4EǛ2MR!/0-!],J"mMR#_:!\2"I5aqI/wAjivYfQR,FnDj1a`bIK#0]CG=i"3vg,iYH91ZiXH 6Gǖ9 -',TL.Epᴾv~g(wCڮ[cJ{UךG~/:ê"w OmrgAk_T*w@CuO#: -tA(xTd'X&cHigun΂BN5C/)ߠsf't-&z]Z?}oW%G;{]ϓvO"ib&.ދ=\bO'+A7m> -stream -xYyxSו>Y2/l%,xӓ]-YE2^$/-8f1f)ShZIPp)!MHq K 4 iәC;$4>!97{='#t"a159>h)Ede@B oWynBB{gK`sw B"Bc뚼. P4#Thu=B{!{_;tB+<M2yТ({*R|/qDu`#brB {AOf1ǡ)B.'ᎠF 2_W+H8-y2$F(-`1=l %BS.X~bc2tX99k&6} Q;d~(P& ZïڇXI.bI!J%h%Y&(qHJP6ـ,.rP!#@ <*$/=/Bt -+x:gCd)#Gc(Con1X̯ҎIa}E,!%0p?ԳQ2nG1o&h.BsoQafJ,c&:8vZAaDuA-PXgJdbTcQlȁJ7v xŏO}Ϳ+ Ff^jP܇)tG\S.aIݗh-~WgƂbgqc?pekY\Y.yjo.r~6P~@p&/?QPPFI9pSL5YD=v'{B]ck]vԱ[D6󗇎]_iy*̖ -zr -Z -G4'> dyzf#B*E2?pcu[Օ O^u!)d` (dZFi+&ADx,wݿkjT8iј[bOcҺZ]JFڒjuGL M:D6eA<=):v-}};*G=r -.>}<FS٠,~De剞+W{w Ѳ|dt|m_*-ȷF.p^?[p55,|{7ʽ K-}`y$h.<zz_4}B=Ozy;Ws-Yk:AAI3p1H"“4n7nMM8{rhfЈ#nJLh"),X){ b-&,sGcA<~ sC#+wmBWpn@В%q8K>Xq$@Ό_$a/_U? e?Y}?(}刻0tmf~55z Y>q 5p.d/ښ͏WyKEg&O|z'EujKdT2fKdp2;͝+Ȅm -UZPboɐg[^l5o m dr3 -EeтlU:Ht4Qk9`㏓N+CHY4^n,cwu,T]UUG9s@f@9~Vܾ+=I}}z5`|'$~?3 -È ?fGF{i>4?'u_0iR4|RD۸IOC3 -uPÀ,, xLYƲ.ŲeJnQ8~9%׼ݙIMhsSS%Ars,F  [ (2%eָn֦4܇힔-_@Ȼf it4+v9Glp *L_}C{d^;h;ZVV2Rpԯ,Dҙn'HIYCYE @z&aS㑼Wᰥ%㶲ÀdST8\k}>:Y XA [6j[S{N2{FA3rL9z@7b<ªjn_I5foPԔ*Vh|f:LT $wǫ*5ŵY$If)-Z˽t{uR _G .M]35ne"ɯFhGgJfΌQ&h5O[g|PLN@Q'#FBxen }Tl9-6_m~9G&2Lȏi6fV\rH^f&$mvM@R :|v@63 ~GZ|ˢ=}dr8,aGZʕt*SKSg} m3'y=|'@}@@zM}K@܏M3<=YÿW|ы2!v%ڭ> -stream -x9 tUՕ}}_'/ y// !!' IB!)"&6UFc)ZQJ2,a2LE;әYkw9}g}7dIڧbi4vi% fi骲$A=K.* ^h3amjJ ]۴sjf!} [s 6xwku -ĸ 66t7߳>.D .'֮;KYWKE9Kh-^j!wP~F4REm]vhEOGg}Տr (h)#$hAyx~h@IDUPi97?UH` q|%x焗0߁!&4:DAC}6,dA쨦}T ,Mw>9=ɓKuz{GVS@Mt}dTkp,)/-ϟ~ pd9ilv|ڎߑķM5 8JԽ)x%O2~+ǜRN NC-CK8hnGx ^Çe|(7> ?x2[y_ws{x~8T׽@_}? -Yp-c/ vwï.+_%ۍ;i`gq]L| ;fNfaa;zݍmy-U4[ -[-ͧ98&T4aVq2`w|;p}+gEJV6ɸ.ke,/3r+pj_3K| KJƕ+\Qe,ev~.Wk,-n\hoyEf>OƢ^dƹ,,X0 "`8ǀsbl7$l7y^ 8xsv@f:ۍ~;b1qVϊYB033,<ӆ13,1^!h38s &`SK0%SKI5nLrXDO.ObB'Dc<52I\cm1(wC'FGxC2Ei-<ʆQLnFعЙ|S_ÈڬnVZh1WpK 2Wؘhpc<,qȵԆvjQv%Q<%rQ(Q@L鍌xxdnõXKb'xELvE¤RedIaBT`/.A-d -:'Hшc'-ܫb}[BPhc"%K1/ˆA#W.0=+Z| ֐ `c6L !8F -leJ'JM:AW% -,5Gjapjv.IZo/vUrBkSTiT@t(qę^|x@u>4\bC:o\?D. -\p\dzr" u4NuZf$:wWKFe%#+^ n9$C?+SC?MC#3X0Ӣ‚Ư"E,2LS:'-CߕqTf,+YU$_$۲<w|?}*L}/AZ-{/tD%D#F[eIl6\t9S?HK\+:Q@ Y'7N:A}5ClH7?8r"ܮ*Whז'II3HsHä{M9w_ѵ%X-5ot0agulϝ9tY^ᵴ ӾbDAV0:0ttmmhR^4m00~$lVHH|{ZyJ~0\TY5}G}pQAF -ffW>?<|Pzc.T+`D̎&mH\B2Ǒ0pY&`'f +eAlɒ}ߨ;[6nlk۸_<~27e*rltUE $Wمb`y049dkn4Vt1qI$8ݫƭP@5YYYY^uC99ջ5ʆ3OчlDQӐ?s&bXOuǾ yG;``tKg&B$- (©^D'#|*a|Y/_׎M?}dOZ"$zA&t>藄>6 A1+K*k*6sN =T:b2)Vy%0|QQO@xo'io:-8}Nz\@.oKI\RsP./u'M+˥Ɩxs5$WW䋒c,Z$h mo0aO5Df$ӴH"qod{wkj'9<{>Ѿ_*da3`;B-HɃbYb݅,BiЖd=OdP~;E) _).&E,=#y4G{ >}QX_/ޗ@@@ b}c3 l$z7wr*Rx6ۯi)W.Dwog g{ZW3-Vw-Z4G{?Cf6lz& _qyL1긲 X*?Xr,)a`cDŽw҅_mﮩbpUʝ;N v MCN.c[0lsSXZ!iM;w6o޹sE},l{*yNAk+~ p;ddc B\yo9f(00{\or@ձnpjT?+_cS[tAف:=80tt `p r-rCJ"USv"f>!ޫӋzC|Ȝ&$6y) 12k\ye"c\.NeMKdP% t]>ݐnL73>ϙJMKOOH%&:0 (IoJzRHQ^ZLEm?ʇ5oѸ᣿;i+S@Gʷݤ$EsfD;xT馝N#}C.G":p}3Hx{C|PD±16Rs/N=7*71z'Cv6mꂤA8eyWTر<%Dr4H\H.PB`" /U <hpa&}eM}nf %Haip btC'4C#4AqLMNmTrWKXD4] EPIˠ賨Zx(]Mꩭ9]Gz(f$MD[C\UJF%Dn"2aQQ]D-: uۈźq>Y7fc}) *@Q[c1@90H`6hE.` T$Jzo«).+^UY!O鬩7voKMGyw]|~'Aj - -endstream endobj 590 0 obj << -/Length1 16252 -/Filter /FlateDecode -/Length 11593 +/Title (Create etcd user and group) +/Dest [ 45 0 R /XYZ 84.259843 169.788971 0 ] +/Count 0 +/Parent 589 0 R >> -stream -x{y|TEo-w۝ҝI !IH -"  $L@ac' A#A#s:;uo||^ԽUw9uS|OBV (phg&y{lt= B=h5hO[P~8z y`PƤ[킁CRg~A*Bx7M=a9LEӓ\w'W DR̛:{y7=S'̟dPחm:kWύqB6yBI YrO~yQˊ6Y>Δw*>2~+XpNMEc9y6:x=뮝r 2j!bX MgH?ASK:MY(-l̆ʳ_{1˴;9w9"@ON4@qAɁf8_ etboR*@)r(k*ˡt54kQZg& -ZΠ (`t X; -l@Iꌺ"4 G#Ơewr;CI ޽{njdI(}y/>ZWr4r^4how Q∽b^Q -߻x)}AqѳGl=b={hx{E7iZ::w:dq.@[|3:ѹssm9Ct3 FiCt --atD8щ,Nt gtcGűF:~(`6:a>!>N2:>bt`?N3ۖ) -dӢV(.fzBh=i8#v/ݭ{=zuBA7X`A(v3nkzZo-2Xr1ڹ-e4SB;ElFmb}iHc_ FtFrZ$M)PK tabC4}lwlۇ*!#p#ڎmh" & +==iu3o2E2LcR'd4hm4Qh:ٓŰjE{2i(jVxʨFn)flLFh2QS@vU41 ]JC@vme zFUʨ.*f*3*iQF) ކ,\Lz\R'C<4K-G!QYȢuqz| a -UzgC-\pmמߢm/-Ρ,E~/p:X<_KϹh9# P M%4ꜳUh FB 8\c܄nZ҅Lh+^j 3tIl"I@u?h$nc9BT/d7m~#x~)JGTp UTIfbdCUJSba-#]-hڈO¹ھ2}z侑0[(pemA;D Bsi&>-6T [V}M8tA\iΥ=P6#^Cx?ehFcdBaP7D v+l~3UWAZ(~#a,ӶJ2^VN(?6vGuzA?\Cᝐ=}۷F&4شty{ts(`'qSC6;69t%Goe,tzMLZ(1j>לRSqdɰpq Ong`Ui--Cx@$AP盿lNC@1[FzU ƋfHx_l@Q(F; -"D*BMzKH3&:*2jMSai}6<:* 4)v=R >VM27ص>'b/Ϝo:,[Szk;cf?̻099z?`gXv Cʂ҃oxN 3g >PϳМwL&!`tۓI$3:ffiQAA'aQ6$/.YeCP[,KeP$Wx(KUZ]QJ9es|" "ne߬+OO=n -;/9a^nQn{dt(KW('g!^U;Jy٢? w!3% wNF͡+AZ3](Ya&WmQU#jonm4zE{DI ($f!>[|UU#LĘӑ#т]/VH3PvVk4y ܳI^H^/<3K -7''|#J:5. \{iW>Ȃn|[~ۢ^oϮv]>wTm]X(gIcmv/0|L'xt@Zx|TfǪ޵dmͥ/Y0tHxcq A }"ktؠ""H&CO $Wx)),Oq5gV*@2AU=N/K84Js{_H4w$D0(s>fva+WY#?Idٷ%3/ B/c[f|饃ս r&FB P U6n_Y!9ragג)e:lagkpWs) Rx ѐ7 >] M74)5vE JCJZ;GK1vS;xcW2۵Ux۵; `}[ZzOL2dnHT+x? .,9嶄xqYOEK0܃jٹ]wpoΝEb -Vz-'x&#aAh^WK!e446SƽqdP rؿǤږ.ej R^ QU:e4ܲ ׻%[CڗAuED0~HOΨeKN.FN<,v>јŝ=zIv5b/gУ?|vK><+.3l"vv5ź]Kx{kDZJ0V1MiAj@˻P޽ iwL'| j;)DNp)FiG̦Ne < 1!r]I?sI嵵JFu)@UDUDB)گJ|J7 `}i(wd1Lt( bE -cdR+!KR@E$ߔ(%^R/y.Kpe&]Bf@8f ˚pr "r M#[Z^'/h>V½̰Y x)W>9CKĦ Z- ^!SJTL\ʄ" ->UT%IHQ%i! -VDϤb4FTTSKhNshIg4ɰP@P= tݬf7°rv, -6-R~P(EH-(Umu~sҁ$\nGNpRBf Y aIT3vkfU!C:YSa Ȁ"$?\ U<}=Ƅݽi1M.qZvsQɿC! -T-dݧa^-a:ԂTH,i6iH 8EΒ%\Χ1IZ֢eVAn 3g/\sK/|pa3]l^☖bWn>DF\k.%@z3֩般zbc+`}zYy,m>6JF Q94ږu{?.qgB)2|L0G]&&r7>]v?O]qo㐋ĝw+}|4wxڇo639k{2."Nwe5Jg *Wkڂ=7 O3, &k` E y&jE«x䴤{>"操3y| Lq e2),1{\҅nf蜗9b,z?w;vzsDآeT0ϨGHRCH)FD" XxܔZx8Lα7Xsb8b<0KUtNPuTիz"ÜE&J Ȁ=PBQV1U I/+=?0Cpܭ̽YX+Ī|m*Ibԑdw#Z>"Ut}!L!W: CP<0q4J * bݓz7%#4Q7㕵<~Ӈ/ItϩVlZbK<@R - IEH(Oiv5~W103ڱ< xM6OL$/ ϲ":-RHFdǯ%;~-s!YXd_ FJDNu)֨+M&%$ۭ*%[Pӛ,^p`pN -=h_uMi -At@yu^о{CGvσY 8b+;$MakS[4x8CIFurUw8M:< FU2${G ]וXOir=`tIMKuנ\CjΰGMxMDMq vdgrxMgPp-z?/U|@7V;4Ȩ)ˏwI#ϛ<U2Ƭ^ձ>1qt3w`'i4JFt¤WE WA" c`d遥M-ZrFpm5!ZSzݺեkZ.6)P_OR>_~N\ PG=;>|zjc$R#fTq$+t <TiؚUu*@zO3?{E=tIJ N[??8{sW.X2""[dVT6X\ x$utd}}3W;=y+3)--//-]Cϑ62w\߂3ǟy[)؁dZ[/a"QRCIY&h9[c%"n״MP>VɁ們 ˇ_->2{Q/5{dHw;؀;_ٻ(f7¾ SFSqˤ\lF,^cWXxdQuN$}?/x R4\d\˛3|W=_gpI'(&J톊8u4,#I/ 7 ̓E wt jޕ *RRT}~X#?` { b0âx(_Txl})I2`<85BZ6Xi8XLQ"hx c=Î~ekזɧ4Hbq˺!#p60;|H7qKX2YO *IH֨ ㆞-q(YRQ*0ZȋAhdd =u ëzhy|nM`)pzZ bZ&nG`+ Hc(X$Km!Tnptuq7`BZz Yt[}֮opH݌o]sdzKߡãCq#/un̜4bE1nZk.*"30n,UTE#`fa|=Q<%C^Bl؅g/PC|lyz]gJ5O*>j3L}mVWzkEp&9H{=n>'=e p0rv7 s?a!GE B)k'ۗH -/(TxkZ..9{ {Դ[=6UW>*$O$H$G/IIz ;oMכֿVu>I1ZFc (# b;VrH#JR+1 Su# St:E.M?IO)O'"X5VM"IbWUS{#d8M]Jra\ ujyƾ ESClZ,I+ހAd  SoTNWA:H@,(q"E8)WQdMN@;<]~/%/]:#a#(c\\ف&\澇Da|˿Z;,&l&~tD0R+ qCa0?X!h )0 B>f1 M!|eϪX=CyD[9-o>ᨲP$"$TG .4c}Ψ=vRz>pZL3t*pЍ]ir2jyNeU->z0o4śa%.lыq.u:TONBt&,Ũb(.Iw'f y%*j:BE d偞^̊]xWoacXE3/[PDO6Up Qߪ0 t|/t#иgxc=QaG1(T>uTgyi7vU@.fB=Ɵ*IcsG_w\׮ om[+7]/lnVF#p -:7hA+P'0uyၺ7Xh.'t4MC hq( -APwġg 4M9puC`Cњ&q2<$KN 0 -;&T8sq@e=t/ NЮ -\4Ss5E~֧[b)^ݻڝVj^kG~p 69#rj㘥 karaF]Ga_ÞRAol~CAn~zWxBҮ'LxbD:iP'&D&̍s@?@R -endstream endobj 591 0 obj << +/Title (Configure default Service Account) +/Dest [ 53 0 R /XYZ 84.259843 561.590928 0 ] +/Count 1 +/Prev 589 0 R +/First 592 0 R +/Last 592 0 R +/Parent 585 0 R +/Next 593 0 R +>> +endobj +592 0 obj +<< +/Title (Set automountServiceAccountToken to false for default service accounts) +/Dest [ 53 0 R /XYZ 84.259843 522.092928 0 ] +/Count 0 +/Parent 591 0 R +>> +endobj +593 0 obj +<< +/Title (Configure Network Policy) +/Dest [ 67 0 R /XYZ 84.259843 599.840928 0 ] +/Count 1 +/Prev 591 0 R +/First 594 0 R +/Last 594 0 R +/Parent 585 0 R +/Next 595 0 R +>> +endobj +594 0 obj +<< +/Title (Ensure that all Namespaces have Network Policies defined) +/Dest [ 67 0 R /XYZ 84.259843 564.092928 0 ] +/Count 0 +/Parent 593 0 R +>> +endobj +595 0 obj +<< +/Title (Reference Hardened RKE cluster.yml Configuration) +/Dest [ 77 0 R /XYZ 84.259843 191.441066 0 ] +/Count 0 +/Prev 593 0 R +/Parent 585 0 R +/Next 596 0 R +>> +endobj +596 0 obj +<< +/Title (Reference Hardened RKE Template Configuration) +/Dest [ 400 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 595 0 R +/Parent 585 0 R +/Next 597 0 R +>> +endobj +597 0 obj +<< +/Title (Reference Hardened cloud-config Configuration) +/Dest [ 515 0 R /XYZ 84.259843 385.582628 0 ] +/Count 2 +/Prev 596 0 R +/First 598 0 R +/Last 599 0 R +/Parent 585 0 R +>> +endobj +598 0 obj +<< +/Title (Reference Hardened cloud-config for SUSE Linux Enterprise Server 15 \(SLES 15\) and openSUSE Leap 15) +/Dest [ 515 0 R /XYZ 84.259843 245.434628 0 ] +/Count 0 +/Parent 597 0 R +/Next 599 0 R +>> +endobj +599 0 obj +<< +/Title (Reference Hardened cloud-config for Red Hat Enterprise Linux 8 \(RHEL 8\) and Ubuntu 20.04 LTS) +/Dest [ 538 0 R /XYZ 84.259843 360.287606 0 ] +/Count 0 +/Prev 598 0 R +/Parent 597 0 R +>> +endobj +600 0 obj +<< +/Count 15 +/First 585 0 R +/Last 585 0 R +>> +endobj +601 0 obj +<< +/Length1 9900 +/Filter /FlateDecode +/Length 6558 +>> +stream +x:{\UU^py? 8Tt|:)HZj +>2%S35#sd9ff͌:33^Lfn3ݽkǷ׷Q%CBzzCksoCCӆK/J{Sfll) ;npԓ`yaԤ?Do6wz1ispܓ.i ̐S4sY8%E`YԷL8Cj~xjF^vnZ;ΠI%=cGǷ@"|lΜioθ~HZz6Q? {n^{bQa`拊BMMvT{Y ]_V=xC⤮ +_0WP}Qc󚬏L8@/ 6];':fꆶ?/9hYATeI ES8\v% Xmڬ|;!U/]6O~8Ock||)5Pr瘒% g_ٟ ̞|Jg>#&ׁowQ)N;$ GP? +1 +{U0@MNo i}c!`&̆BXԦisv0 gt mmmW^[:bP:=<3zB[#zA7f:޶ rXǃЭO'={̘^:$됬4;Zi|H>mZ7<.|ڌ'lOD x–7'xrO-No7W"~WZ7jſ 7~kkZ 65W_ ƫ?OjO{+ioD~rG5R| (xP~i)^~/]Vo']ksBD<+ +;?o)'Z o|]q lxLQ;Wy@c+)1ʟOV|.k  o>ȷ3[l@b&$pc(iQu nXoz+>݌]3=k5O)#?'^Ջ>Al>q?V4*'4c% TbI+\qre=m\Rҥ$K3]ԍ +\,+.B.8K5cBDl8S8: +&0G`jƩ"pI'N08??Oc 28q?>Z`&pC6>JC6|PH)ppC|pkpH |@h*{>';ȗA} O/S__ľf׆fI>x' +nj <{WO#eÞF쑈<>9xw79[wc6_t1Z`H_ >#aJ,b5cH@]r1$ ПKS@8ډW`-E\ +sYɆF* NTrQI,4K=2/]$pxd9*'`/lehV:+`dXԓv @pF@\dpp0'K1.cd|2~r|^ΒKXnSMgBxǔ/1 4 +y .ZstZ{ +L*~P)l@e%؄4 K9L$)?C-P"L x#i^n@ ;4D.vIYpB`M0 -%-&޵RaYl/|)grG!i r)6i [UD6 #޴0@yG2̢V)k` aUoiVy {Rceu-ߢ'&JN]xaV6g3EzQ/v* We>A~]IBېcة&RCy(;r)x\bE4%>pAU/ <`Zjj̶#|3'ĦSHo6]lJeb$;䋾4_'F,m6e^dwX󥽔i"א͘!&x@RVk\m4cDXnxo64ڮkHI83yE|?ؓl1aB,pd2FsH )읋MvO5l!{:{g +BB""Sc=!PO'ψȈ̈-]RZV^"rmlmΥ:dfegEEGt+%G%E&Eh R1$k_: +7{ +kŤ6f;>?oHI9%=;^{QW-kWIV +RV4>09@cgm\O}lAAkj8CI #QfzώzhהV{֓)v㯜?%>~ot4FE$Il =]jmTiaB:I*Ӽ&۩ BCkCQ IB6 uD&z\[۹%yy4f4RIsW:*#i9!ekz4u3}ރg&pNm&`}kHL >$rS/.iwI`;UL vm9{P%ﶴ`W?|̇~%>_ڣkO0d23mfG%>@4ZRi{-MLRaN-,&u0˥Qvd=K.YR~ NvBڶ}񝭕u[^ךN+{qh8SeHWm-3Nf3Y"#׏uKuVq~Vgڹ vEh,9\BlF3Y!3tSΨ,_3x-_leɤKRWKtDZėIU)uT7K#7*Mn+wJcY*\!W'5-Ѱ_ o~oow yǒ%h4Fz2]iٺ_j_C_$L(c_PB .KeH8zmaW}3]ӣIރ5t)QW/!:#(zmt-ף?n6vu}v+;n^>^_`EOO[>ZO5?USm3?Z)g~Gey ?nyw(Kۣ5kF t SPo:Vw1:|G5|:6R(U ejTf.Y|leRGm@yslg#Ta?z/:Vh(PqD(MW̤I3VZIQAMwhDт ~Lb~ 6]+9玷$qOv+  W;:dgvƹ;cTAuFQu|"7ڡ;Lw Vs`sƁs8h_ogoWwn"c+L +K;&II1}Њ]1clԸ݈2PAb%?L4Q{&UUlH=?N:9'ty<6Crn23=#7Wm=u<9ynejVޏ_6r:\JdLgaլ|)KliK:cNEa2:)H,bbȒ^o^Z[5jIYk}Z=@v>A/' aM鵐9ͣ][Tcm7+tvþİ>ʂoQiwkwJjO{4%/@[؎X$=PR@ave:l1n#뜙#\7O<(âvܜb5<5L%JeRT.vJd.10NW! rl80ţl"N3|g3qNFQg28$clRIzjg!he4gV-fQmC§]#왓G9ObFYG}/wĀg{Sw%iJ6 t4YǙ2LR7-&],eR,mL RW:.Qܤ@ 54,np()#d7T" n5m0GYRWM$Xӥa.{ܣx 5͘fJ3{R"/%) eRBRKnlM&fӻƲݺvN'/*/;-/[%ǸtߑuXbx]3_zlgiZiJfIڗ>HN ޖ@emc\͡ V("X 0 N8z&B$jD8 &PBw1A6̅4: +9Tam\%z/yf!չi k&~, hlZFYn<, icWd&$pZ_Hgs?3VRB;̦Qm-1%ItܹsMyh?zIڗ6R~e6c‡/v*Le;j n;錑tRFA: z> +stream +xYyxSו>Y2/l%,xӓ]-YWxȖWy_pb2LiI&MB)k !K҄44̌L &:m:th$'ۄ|_{='#Ftba} 59W>h)Ŏde@B NOOynBC{gKpso B"BM0v:Be/sG? +bݍ3yx_Mt6,BK艹H =GE缿[?a~ =cxed4op7s I +\0OA^2f^H8-y +$>/0 +R }@kGi~ӗi,F?CqAI,B@Lj5?Ϙ>}u^ߛ~(P&Zǯ:XI.bI!J%h5Y&(qHJP6ـ,.rP!#@ <*$/=/Bt +xzgCd9#Gc(@on1X̯ҁIQ}A,!Ў%0 sQ2@1o&h>BQa_x3Z %r|;0PZz^AO(%Iu @ñc~DϨNK +C6Tʐ'v_O}Ϳ+ Ef^j܇)tG܀S6aIXE&#g&/ b J*yԅ2OÈW4r5Pub:rUlq8F3bZJ^XBڸɆMOk~UoGk`"e3 >{Iq8meZlr׸]Ul 8N:gxEYJKVZ 1l Ym-kN9!7YYZcW+cF 2*SJWdS,\UVqIA#fLos +<(=@I%V2eO(Y֩T:Y\[ɫ)wj[[Z-x Sfe1=7xQ``&R`E+)ϵƭNv6\>ph)܀2@5&fyOpQqÂ쒅 ; T +e#]l2Yh;ZV]r@dzZY)8nrYK + _c"l?u̓Mc$!ME@C&aSICyI)aK]iIōm!ɦ,p#w0fFd1`1l]dkNǗ9lS&o;+Q2#nfXF q놊; ^Xo @}a&H$Ԅm0RS[ޟ[Wg3Qz!{ߛQ]f2\KHXSVQ{ ڤ@^&_A\X̛)if\dT_5yL~ϔ̞  ϿW&h5WXgrPBNw@Q'#F\wBxen }tl>#6]\m~9G2Lȏiz3K LNH +c$y3r~5UyqB6;S@R :|v5@67~y>r'>E{,|2RT4bWJ2,uطs[Ahy6cI;?ߝ׻y y: ڤѷkY9q5[|ɷ0YswmI}EbyVbY\U? rV.9-_@.Hfo + +Є7u4;#p1L:9˪JW֜BUL. _$S5q$-*k a#t/2Rq!"RBfx6nn7\{㼲ZZh,z۞=44.O{]Xt]sIWK&ԆZP+XD)|ENi.ϷyhVW+ ~ +n)QJYݨzi_3º^; }y]<[yQ1z)) +84lA?B.`DHg~ ?mڠD+9i_me +endstream +endobj +603 0 obj +<< +/Length1 7204 +/Filter /FlateDecode +/Length 4874 +>> +stream +x9kXUוku}.y\^ jA#H-QV1iK'!CmjhjR4k&~Ik-vZ˜~68:1t:c컟k^{`BKKVV>QD +,@ˊ*.ܱ>꟣gYEY[>br~KcE fl-;=g6qWR۸=;o+|4 چΚ߇~ `JSG~wv[_.kohRc4Cg+vaToh=/ K +-mӗZ?^V\d 8@pkl)3hA}R*/@/H݄UP>iK%OeH$ +/g,u5 5BM0ht( +YRHN!;QM#{3?XW9GN7ޙzPOySԧfk)?Kr_fƚ)P.m<*(RvPZtHJ`3T@ ltNOF +)V![ Z{^H\DA:$xW ֔z~!6-3]U!SgxzTxzC7nGRWz-)ƊKhƗ0e!!ϖ:σV'g2|awy?~ +Sv6e <:h~݋}n$#2Sm=]؅G#|Ȋka?>hCC20:SWTVa TVq2VtaV{|8p7 .,uqXRl%V,65.YY.WpUqw.;p0&pi.)%]Xh;ܸȌ | 0obq9ns9nvnr?UIL7f(Di(=Rm<-ӆ@@'Xx S^l3O`0;Gْ6a'p,t#=Gmh%Տs)tzR4S4 nF4ւ5C5uu\ң4EC> &}c4ȈFA6̪a)??\;e8v_8[ `^&H"0ZPFo$ :0;9%\߭k6HMIv[uI+ +g%Y'G&ǮB裣vcƘuq[NͯSs%$dg]Y + u1vVBNHd~&W#Z>}Ru;44,Z);_߱t}т5=9,d wTG){[sU5CZ*zXfLЩgh0)#(YV"V%_&ݲ|ʒ:9cs ˯TK& >a1fdPCQddm![k~#E"M:!=]c~?IIѕk3l@ZvtFL';>:A}5l@7?8pBܮ2Wh#IqHsbH${MΜ9YpWaqU߿$3Ok-vE0ԬS]w䅑3˖O$%J +vACM:!l +ckH ++zSxlmѣ=뾺8/%edyS^<#1"aN +܁ufG|c.osE؊ap3#`(*'f !-e$0˿}ŷGoؼi|U(؉J,eɖc(+|m"H/+qFq=&[ta*H fWKJ$^5fϛΛ;G[ޝ\TW\!N~E_}Jǎ>V=#z!wl2,- ѱcv:Oz]rCv  V 0k]zLv\Z :2Y0'+\ zrbIײĎ+uf-?ݣhI xD`vik{Wzm"^cVTTmO ;-DPꔯaR`(a^X>=:*  \j zIKPI\R:sP.bǮFV&K?-rE.eUe1yuN-rMK67Az]ۣtKjTajTe}f96굕G.яi +Dy/i,j bP"$XCaV ,m4ߒo^$UbPry) 񟑢).~[r<֣=ܾ0_/Y][_hXh\h[обQ]6[MGYN(<[s#š + [#*Yk*S8k}ITX޾xw02Tg;d3q(grL7Ɣ=&#>ʒw#_aq1}[<&=,bOjRt%fZKuNruttݪ `x'8;/fPWsg֝;zY,LO?c˯Pzͧbع@v=QdP,{k!6@ebƧ͘:VyO KJ 5e[Q n%fY1I:Fc[t!3WNp̛|GA[6.Z45)*TN!VLMFl>:&ګӋzCtȜ:#$y'E 1X2j\Y9c c T,3<ˠ,ɺd}!٘lJ6}3ՕIOtn.FP!$*"ʪ5 |k+^v#kOCvN"?:o1/ț[0+$ccH6tnFfN Ŋ[C̟c7 +|fs(1jn{'C~S+>  6YQt%8'nS$Ir [x]Ko;S%u/xDYEZMkJPJ4EΨȨSЌ#2y!}Z?4>P<іJ\qAQ4Ja7HZ%Vm].?ΒX>J,̓KG' t zH-rlhl"`{M 1zfQђiY Yo +,sW{$%"%^=OKR\z +T, Edަ|MxEf^-~5FM/`[ͬ3m XA +P uN` $S JYԪ$ ,&vzv5T@#\=?Z|MZmjj*C!pal! +Rbz&*[7Ӻ*tU* +UDy1<0׫fuu?psifc? 7u唄iS{Y? 1ޚa b(J )1C<1Zw1,`#uMjzK +,!>DuI'TVTBƖȨm lo"l/ | +endstream +endobj +604 0 obj +<< +/Length1 16252 +/Filter /FlateDecode +/Length 11592 +>> +stream +x{y|TEo-w۝ҝI !IH -"  $L@ac' A#A#s:;uo||^ԽUw9uS|OBV (phg&y{lt= B=h5hO[P~8z y`PƤ[킁CRg~A*Bx7M=a9LEӓ\w'W DR̛:{y7=S'̟dPחm:kWύqB6yBILgM/Mv L)=uІ&=k ȸD O?59fObs ͝h'~}<[ꖎ3@ +xəIpDslt&1z];3"QkdF@ñ%@C8W ~+T(sǡSx(Â.Uϥ@> G;P)zCKa;} jF5h6ע@MhٝA@P(v4ن.)P;uEEhFAvP Eݽ{oɒ(PQ8^)*}8iƙ帽hސqw*{ԣlrKHXrhQ*c*!|>9='' \7 ɒawE3bSlRZ +x[F1Zh!H7ׁٜb*.ܫ@l:؀P,MvEiUXgLtTd#,j1!Uxd3;tff K+P7WK+M3Ȟi7Lξz]V3톲8eVn l&leD/xV$n` #J$RP7Gi-Ş6bV:mp4 RRT6s:LTN5w5;yfk0n^3_;qŚcɱXPr@YY-d3̎Yٙh%,nd󾚶p<Ē3= DXMC 1$'IgtӲlN¢lJ GI4^NY]Z-XˠIQ&sTFD@D641yp靸rK{8rR!mz TGc *11[Ý(7%͠0@`mfs 쬬l5 ԧomӀ!g|ʾYWzoVv^s¼ܬѣQn3-o9V5-PN|_.C[]Iu^ wտʳE;09B&fZK4b} 5 +w)C! AWƵgPL&mGی!2V Fx*­̽D6Ý@2;ZUJk|7$Y7^č@w4Ml+s2+(\ꁮ9>݌0Fdw5#55@]6X^W fT `$zmE_D +(ZT%wvCv]0lpa6;뾛oCգWj&vS`~{hD$Z77ǷN)gJK_*#w#q ѵBV^:@դhAÍ8qN[ dkZ~;qR~=]fG^vXlu6Y +s)=r 7V/:iW9؝Q Eś60cir篥z?NA)8!ELR%EQ>'4_|9_h H88 g[Ȟkr4w{!hNE ^ 'O%'A~MA Edp3F^ŃN,~}n7rTݠhIQI ̖C|*2NG1#G^͑>"=gfhg$_xgnZ1ySONGtj=;t]lCAү}5Z EP]- +Iq}*JPDmt_`|s3&7N!$yF.wvilξ1SNLܵoߖ[˷o\=a}ŵ46s>ͩ̎UXkK۶=śK_ a.萀*( )@T/DLAENEL6FH5=S SRn`ZR-:9XGX'Wqcp&_ J5q =,6Yr1ixa3ˢF^~t+n-h6k5OOۻfh0 pc#|jϬUd` 2W{(!$^qh;怟6k8kh rI\a8>-Qz1C#'Rk| 3vc[͛W^FГ.oKf_3@Ѕx#^Ƕ:K_۫{AMK%=D@yRbǣX8mԂRIˈx$t*{Z(-bӰ+$ +$2@nݽp%J>g +^7pCG6NiN+6֬iˢy+$ܝSdIub0HANf{ 'Sx#UdB @ Nx-QƠ14Hy'Թ9-7f-}v.eKyƣ (TϺc-P ӣtiMuNm7kD[+?~쪕Y|[VmzdBrϮ%SXy/u͵/֜(R̥!o}*Zn@iRj$g +Qtde iwb1cFߧvůek<<Wkw/ A%n $d4ݐ&;ͩV`~@<0][}x.W\fE,ku፻8$ RF`b҂Ԁ5'w*&{̙OvRr;lR<T%*;UӎM2x ʁc=1B:E8 簓 ;kk()R<:R_*3n>p%P4bP%pXWB:#-H"2)Ql/% J.-^(:\,L>%;̀p@@5,vElF_O_j|{ a'MC%Rdmw}rMA> [ PC`!@ E +Cn|JJ(5$0[xoB<@rIh:%\. ,haS)$@.`0j{d@Yna+$1 Y1j3l7Z P,&[P2<{Υs &8H܎$ȝᤄ̐%.R!.xC v ;w9Fֱ)Ħ;d'[utk Lg2UtCn טj#5@-Z]VV_ZZn$*.‘g\Ė٭ex[sP(}fHXͪB$t .EjI~ A.+x~zￍ {bJͥv](=B7 1U%Z NO  ZtUE.XlӐp%K%Yk1O=cp+,̡Eˬ 0g_:3&^l g;41-kŦ>|h+a]"KgSY: T3V7l/, TY:U}lri69'>-G+|SB\΄pSTe$R`893LL oz}􁱕f?7#ߟV]p!5;Wilgr'E=.d\DJCͻcO==(k$U{n"ggXxM64pVvHূk!na)Ƿh,qp +x# !G̨f~`ѭ6C{o間;aliN~pR\.K+dED +B66m!*e{sp?,5H؃%g~wzVfZSZZ^^Z#m^?d8 gg?|S r?= `\^ +RE~'"!:h.LBEVsKD.+ׯiI ̛|쭒#Z|dc9_ꅍkJؑ[vy C{Www;xD[(R3cR' +(UItb {tn咳s/$dYNz VIzr@tXogTZCtΰ +4k{$zIV7LƠW4&|9PT̠#Vm\ڷv X5nYU)$'=삟:߹WY6v42VpQPvQ{uFʿ4Av!>!:I_hPy +X4 D +kC|kKdkyiK\jПmDO%FP֕{7"{"ΰgS*+iA6dA1"j먹ѸUY + U[kl Y`NK>x/}Q̎o}7~]yGۗIʥ ۧy\V N ٙ@&EۂYKRnNoڮ8' -9,E #bI:YJ!B'Ep#\"p-Mʝig![̑>H!gti>%.ѿm^]b6H6R|l)$+Y>ƮJ ȢU i I~:^`)HK @iQ#>7g"z>tgw'0џVNQL$ q!hYF_`o?]]t#4Ÿ.Լ+׵,=+UHST9UIե|G~x~D~d~T~t~Ls]!WH+ + +u2Q^QYU]St1ZH +<8=v?Oݙ:SˮI&k{c[?_ury(_xo,~;[z?Va +wJwn5eRU8YM=5\s34<*Lx晊8;q>w0a(`7^l0Vch ^Z4|! +=FaEPNO?BSZ9d8;xpj8 l+, pt4EJ/@.]9z09JK׮---#ՓO]i-$uCFla8w_o +ddAA3" tGeU>Q[kο =1#36[PTaNxw7{- <ԩ^G(VHz^yJˑL;ر ^:[ˡ;ZRMΐkF c3U|g|ڬ3T4L8V?s8{v|IOٹ{B%la<⓽ n@$$aB "SiNʷ/F#_0Q""\]rą?@$Jܩiсx{!l:|U`KML4+aVT0p#. +xa2#~C!&R` AF]|b<j1BʞU{;6rZ|x:Y7I3Q,5`L0uY#BT^(Ʉi2p}^;y{p?0;`ֱf: ,L,]썦|&(Qe: +KHEHr\h:)Q{}XLg( E?U.edY0q˪Z..}:`6h73dK]\tНׅ1TMXQPbCq]T.kGOP@v ^J~!UԼu@x=]ʯŠF͙;򱊆g6_ѷ򉪟.l"6lU9 abe1A ~_: ~GCqfz &%Jo0 bEuQ}"ꤩ':"n#n"c]H/h#O{ 5 ?0,Uߓ}a#5l}]?s]ھ!*bWnS |?^ݬFtPo1VN`_uou C\4-FOh*m$șP:26Cp4h2ȿ=-BsPfߣ5_kMdxIؗ*@aZwL{'ڝqPσ{&p_KpS4qw;럗ͭԎ֎*msFԴ1K#8(>6".¾=B ]OĄ(u'fԩOLRgM n~Z/?S +endstream +endobj +605 0 obj +<< /Type /FontDescriptor -/FontName /VMONYK+DejaVuSans +/FontName /PDIVRQ+DejaVuSans /FontFamily (DejaVu Sans) /Flags 4 /FontBBox [ 0 -14 472 560 ] @@ -6873,24 +7033,24 @@ endobj /CapHeight 560 /StemV 80 /StemH 80 -/FontFile2 587 0 R +/FontFile2 601 0 R >> endobj -592 0 obj +606 0 obj << /Type /Font /Subtype /CIDFontType2 -/BaseFont /VMONYK+DejaVuSans +/BaseFont /PDIVRQ+DejaVuSans /CIDSystemInfo << /Registry (Adobe) /Ordering (Identity) /Supplement 0 >> /W [ 3 [ 317 ] 17 [ 317 ] 20 [ 636 ] 25 [ 636 ] 37 [ 686 698 ] 42 [ 774 751 294 ] 54 [ 634 ] 68 [ 612 ] 70 [ 549 634 615 ] 74 [ 634 633 277 ] 78 [ 579 ] 80 [ 974 633 611 ] 85 [ 411 520 392 633 591 817 ] ] -/FontDescriptor 591 0 R +/FontDescriptor 605 0 R >> endobj -593 0 obj +607 0 obj << /Length 702 >> @@ -6943,20 +7103,20 @@ end end endstream endobj -594 0 obj +608 0 obj << /Type /Font /Subtype /Type0 -/BaseFont /VMONYK+DejaVuSans +/BaseFont /PDIVRQ+DejaVuSans /Encoding /Identity-H -/DescendantFonts [ 592 0 R ] -/ToUnicode 593 0 R +/DescendantFonts [ 606 0 R ] +/ToUnicode 607 0 R >> endobj -595 0 obj +609 0 obj << /Type /FontDescriptor -/FontName /BYQKXS+Poppins +/FontName /VMMSNF+Poppins /FontFamily (Poppins) /Flags 4 /FontBBox [ -27 -260 122 795 ] @@ -6966,24 +7126,24 @@ endobj /CapHeight 795 /StemV 80 /StemH 80 -/FontFile2 588 0 R +/FontFile2 602 0 R >> endobj -596 0 obj +610 0 obj << /Type /Font /Subtype /CIDFontType2 -/BaseFont /BYQKXS+Poppins +/BaseFont /VMMSNF+Poppins /CIDSystemInfo << /Registry (Adobe) /Ordering (Identity) /Supplement 0 >> /W [ 3 [ 266 ] 10 [ 158 453 453 ] 15 [ 197 550 209 ] 19 [ 627 319 574 588 628 627 634 545 630 629 212 ] 36 [ 673 612 771 706 512 503 777 691 245 ] 46 [ 598 431 ] 49 [ 702 785 578 ] 53 [ 607 586 540 674 675 975 ] 68 [ 675 675 606 675 619 328 675 639 245 247 514 245 1029 639 639 675 675 372 521 363 639 560 819 478 562 ] 206 [ 379 379 ] 209 [ 411 ] ] -/FontDescriptor 595 0 R +/FontDescriptor 609 0 R >> endobj -597 0 obj +611 0 obj << /Length 1248 >> @@ -7029,8 +7189,8 @@ endcodespacerange <004e> <006b> <0016> <0033> <0017> <0034> -<001a> <0037> <0018> <0035> +<001a> <0037> <001c> <0039> <0032> <004f> <0052> <006f> @@ -7041,14 +7201,15 @@ endcodespacerange <0033> <0050> <0056> <0073> <0053> <0070> -<0028> <0045> +<0024> <0041> <0031> <004e> +<005c> <0079> +<0028> <0045> <0037> <0054> <0010> <002d> <0015> <0032> <0045> <0062> <0054> <0071> -<005c> <0079> <000b> <0028> <000c> <0029> <000f> <002c> @@ -7058,10 +7219,9 @@ endcodespacerange <0013> <0030> <0027> <0044> <0029> <0046> -<0024> <0041> +<00d1> <2022> <005b> <0078> <003a> <0057> -<00d1> <2022> <0038> <0055> <00ce> <201c> <00cf> <201d> @@ -7075,20 +7235,20 @@ end end endstream endobj -598 0 obj +612 0 obj << /Type /Font /Subtype /Type0 -/BaseFont /BYQKXS+Poppins +/BaseFont /VMMSNF+Poppins /Encoding /Identity-H -/DescendantFonts [ 596 0 R ] -/ToUnicode 597 0 R +/DescendantFonts [ 610 0 R ] +/ToUnicode 611 0 R >> endobj -599 0 obj +613 0 obj << /Type /FontDescriptor -/FontName /KMVTBF+DejaVuSansMono +/FontName /KLOSSF+DejaVuSansMono /FontFamily (DejaVu Sans Mono) /Flags 5 /FontBBox [ 0 -14 584 759 ] @@ -7098,26 +7258,26 @@ endobj /CapHeight 759 /StemV 80 /StemH 80 -/FontFile2 589 0 R +/FontFile2 603 0 R >> endobj -600 0 obj +614 0 obj << /Type /Font /Subtype /CIDFontType2 -/BaseFont /KMVTBF+DejaVuSansMono +/BaseFont /KLOSSF+DejaVuSansMono /CIDSystemInfo << /Registry (Adobe) /Ordering (Identity) /Supplement 0 >> -/W [ 17 [ 601 ] 29 [ 601 ] 36 [ 601 ] 54 [ 601 601 ] 66 [ 601 ] 68 [ 601 ] 70 [ 601 601 601 601 ] 76 [ 601 ] 78 [ 601 601 601 601 601 601 ] 85 [ 601 601 601 601 601 ] 92 [ 601 ] ] -/FontDescriptor 599 0 R +/W [ 16 [ 601 601 ] 29 [ 601 ] 36 [ 601 ] 54 [ 601 601 ] 66 [ 601 ] 68 [ 601 ] 70 [ 601 601 601 601 ] 76 [ 601 ] 78 [ 601 601 601 601 601 601 ] 85 [ 601 601 601 601 601 ] 92 [ 601 ] ] +/FontDescriptor 613 0 R >> endobj -601 0 obj +615 0 obj << -/Length 660 +/Length 674 >> stream /CIDInit /ProcSet findresource begin @@ -7133,25 +7293,26 @@ begincmap 1 begincodespacerange <0000> endcodespacerange -24 beginbfchar +25 beginbfchar <0048> <0065> <0057> <0074> <0046> <0063> <0047> <0064> -<004f> <006c> +<0049> <0066> +<0044> <0061> <0058> <0075> +<004f> <006c> <0056> <0073> <0055> <0072> <0011> <002e> <005c> <0079> <0050> <006d> -<0049> <0066> -<0044> <0061> <0042> <005f> <0053> <0070> <0052> <006f> <004c> <0069> <001d> <003a> +<0010> <002d> <0051> <006e> <0036> <0053> <0059> <0076> @@ -7165,20 +7326,20 @@ end end endstream endobj -602 0 obj +616 0 obj << /Type /Font /Subtype /Type0 -/BaseFont /KMVTBF+DejaVuSansMono +/BaseFont /KLOSSF+DejaVuSansMono /Encoding /Identity-H -/DescendantFonts [ 600 0 R ] -/ToUnicode 601 0 R +/DescendantFonts [ 614 0 R ] +/ToUnicode 615 0 R >> endobj -603 0 obj +617 0 obj << /Type /FontDescriptor -/FontName /KOLXUF+DejaVuSansMono +/FontName /FEHHOP+DejaVuSansMono /FontFamily (DejaVu Sans Mono) /Flags 4 /FontBBox [ 0 -14 585 699 ] @@ -7188,24 +7349,24 @@ endobj /CapHeight 699 /StemV 80 /StemH 80 -/FontFile2 590 0 R +/FontFile2 604 0 R >> endobj -604 0 obj +618 0 obj << /Type /Font /Subtype /CIDFontType2 -/BaseFont /KOLXUF+DejaVuSansMono +/BaseFont /FEHHOP+DejaVuSansMono /CIDSystemInfo << /Registry (Adobe) /Ordering (Identity) /Supplement 0 >> /W [ 3 [ 601 602 602 602 602 602 602 602 602 602 ] 14 [ 601 602 601 601 601 601 602 602 601 601 602 602 602 602 601 602 602 ] 32 [ 602 602 ] 36 [ 602 602 602 602 602 602 602 602 602 ] 46 [ 602 602 602 601 602 601 ] 53 [ 602 602 602 602 602 602 ] 60 [ 602 ] 62 [ 602 ] 64 [ 602 ] 66 [ 602 602 602 601 601 601 601 601 602 602 602 602 601 601 602 601 601 602 602 602 601 601 601 602 601 602 601 602 602 602 602 ] ] -/FontDescriptor 603 0 R +/FontDescriptor 617 0 R >> endobj -605 0 obj +619 0 obj << /Length 1500 >> @@ -7315,640 +7476,654 @@ end end endstream endobj -606 0 obj +620 0 obj << /Type /Font /Subtype /Type0 -/BaseFont /KOLXUF+DejaVuSansMono +/BaseFont /FEHHOP+DejaVuSansMono /Encoding /Identity-H -/DescendantFonts [ 604 0 R ] -/ToUnicode 605 0 R +/DescendantFonts [ 618 0 R ] +/ToUnicode 619 0 R >> endobj -607 0 obj +621 0 obj << -/VMONYK 594 0 R -/BYQKXS 598 0 R -/KMVTBF 602 0 R -/KOLXUF 606 0 R +/PDIVRQ 608 0 R +/VMMSNF 612 0 R +/KLOSSF 616 0 R +/FEHHOP 620 0 R >> endobj xref -0 608 +0 622 0000000000 65535 f 0000000015 00000 n 0000000227 00000 n 0000000343 00000 n -0000026934 00000 n -0000027067 00000 n -0000029718 00000 n -0000029917 00000 n -0000033266 00000 n -0000033595 00000 n -0000033729 00000 n -0000033865 00000 n -0000034027 00000 n -0000034190 00000 n -0000034346 00000 n -0000034503 00000 n -0000034660 00000 n -0000034843 00000 n -0000035027 00000 n -0000035202 00000 n -0000035378 00000 n -0000035554 00000 n -0000035726 00000 n -0000035899 00000 n -0000036057 00000 n -0000036216 00000 n -0000036375 00000 n -0000041267 00000 n -0000041501 00000 n -0000041751 00000 n -0000042013 00000 n -0000042274 00000 n -0000047419 00000 n -0000047681 00000 n -0000047814 00000 n -0000047945 00000 n -0000048076 00000 n -0000048207 00000 n -0000048338 00000 n -0000048471 00000 n -0000048602 00000 n -0000053784 00000 n -0000054102 00000 n -0000054235 00000 n -0000054366 00000 n -0000054497 00000 n -0000054628 00000 n -0000054761 00000 n -0000054894 00000 n -0000055025 00000 n -0000055156 00000 n -0000055287 00000 n -0000055418 00000 n -0000055551 00000 n -0000055682 00000 n -0000055813 00000 n -0000055944 00000 n -0000056075 00000 n -0000061274 00000 n -0000061592 00000 n -0000061788 00000 n -0000062047 00000 n -0000062278 00000 n -0000062411 00000 n -0000062542 00000 n -0000062673 00000 n -0000062804 00000 n -0000062935 00000 n -0000063066 00000 n -0000063197 00000 n -0000063328 00000 n -0000063459 00000 n -0000063591 00000 n -0000063722 00000 n -0000063852 00000 n -0000069526 00000 n -0000069830 00000 n -0000069962 00000 n -0000070094 00000 n -0000070227 00000 n -0000070358 00000 n -0000070489 00000 n -0000070620 00000 n -0000070751 00000 n -0000070980 00000 n -0000071217 00000 n -0000071350 00000 n -0000071481 00000 n -0000071612 00000 n -0000071742 00000 n -0000076920 00000 n -0000077420 00000 n -0000077551 00000 n -0000077682 00000 n -0000077813 00000 n -0000077944 00000 n -0000078075 00000 n -0000078207 00000 n -0000078339 00000 n -0000078471 00000 n -0000078603 00000 n -0000078736 00000 n -0000078869 00000 n -0000079002 00000 n -0000079135 00000 n -0000079268 00000 n -0000079401 00000 n -0000079534 00000 n -0000079667 00000 n -0000079800 00000 n -0000079933 00000 n -0000080066 00000 n -0000080199 00000 n -0000080332 00000 n -0000080465 00000 n -0000080598 00000 n -0000080731 00000 n -0000080864 00000 n -0000080997 00000 n -0000081130 00000 n -0000081263 00000 n -0000081396 00000 n -0000081529 00000 n -0000081662 00000 n -0000081795 00000 n -0000081928 00000 n -0000082061 00000 n -0000082193 00000 n -0000082324 00000 n -0000087354 00000 n -0000087841 00000 n -0000087974 00000 n -0000088107 00000 n -0000088240 00000 n -0000088373 00000 n -0000088506 00000 n -0000088639 00000 n -0000088772 00000 n -0000088905 00000 n -0000089038 00000 n -0000089171 00000 n -0000089304 00000 n -0000089437 00000 n -0000089570 00000 n -0000089703 00000 n -0000089836 00000 n -0000089969 00000 n -0000090102 00000 n -0000090235 00000 n -0000090368 00000 n -0000090501 00000 n -0000090634 00000 n -0000090767 00000 n -0000090900 00000 n -0000091033 00000 n -0000091166 00000 n -0000091299 00000 n -0000091432 00000 n -0000091565 00000 n -0000091698 00000 n -0000091831 00000 n -0000091964 00000 n -0000092097 00000 n -0000092230 00000 n -0000092363 00000 n -0000097603 00000 n -0000098098 00000 n -0000098231 00000 n -0000098364 00000 n -0000098497 00000 n -0000098630 00000 n -0000098763 00000 n -0000098896 00000 n -0000099029 00000 n -0000099162 00000 n -0000099295 00000 n -0000099428 00000 n -0000099561 00000 n -0000099694 00000 n -0000099827 00000 n -0000099960 00000 n -0000100093 00000 n -0000100226 00000 n -0000100359 00000 n -0000100492 00000 n -0000100625 00000 n -0000100758 00000 n -0000100891 00000 n -0000101024 00000 n -0000101157 00000 n -0000101290 00000 n -0000101424 00000 n -0000101558 00000 n -0000101692 00000 n -0000101826 00000 n -0000101960 00000 n -0000102094 00000 n -0000102228 00000 n -0000102362 00000 n -0000102496 00000 n -0000102629 00000 n -0000102761 00000 n -0000107393 00000 n -0000107872 00000 n -0000108006 00000 n -0000108140 00000 n -0000108274 00000 n -0000108408 00000 n -0000108542 00000 n -0000108676 00000 n -0000108810 00000 n -0000108944 00000 n -0000109078 00000 n -0000109212 00000 n -0000109346 00000 n -0000109480 00000 n -0000109614 00000 n -0000109748 00000 n -0000109882 00000 n -0000110016 00000 n -0000110150 00000 n -0000110284 00000 n -0000110418 00000 n -0000110552 00000 n -0000110686 00000 n -0000110820 00000 n -0000110954 00000 n -0000111088 00000 n -0000111222 00000 n -0000111356 00000 n -0000111490 00000 n -0000111624 00000 n -0000111758 00000 n -0000111892 00000 n -0000112026 00000 n -0000112159 00000 n -0000112291 00000 n -0000116538 00000 n -0000117057 00000 n -0000117191 00000 n -0000117325 00000 n -0000117459 00000 n -0000117593 00000 n -0000117727 00000 n -0000117861 00000 n -0000117995 00000 n -0000118129 00000 n -0000118263 00000 n -0000118397 00000 n -0000118531 00000 n -0000118665 00000 n -0000118799 00000 n -0000118933 00000 n -0000119067 00000 n -0000119201 00000 n -0000119335 00000 n -0000119469 00000 n -0000119603 00000 n -0000119737 00000 n -0000119871 00000 n -0000120005 00000 n -0000120139 00000 n -0000120273 00000 n -0000120407 00000 n -0000120541 00000 n -0000120675 00000 n -0000120809 00000 n -0000120943 00000 n -0000121077 00000 n -0000121211 00000 n -0000121345 00000 n -0000121479 00000 n -0000121613 00000 n -0000121747 00000 n -0000121881 00000 n -0000122014 00000 n -0000122146 00000 n -0000126848 00000 n -0000127367 00000 n -0000127501 00000 n -0000127635 00000 n -0000127769 00000 n -0000127903 00000 n -0000128037 00000 n -0000128171 00000 n -0000128305 00000 n -0000128439 00000 n -0000128573 00000 n -0000128707 00000 n -0000128841 00000 n -0000128975 00000 n -0000129109 00000 n -0000129243 00000 n -0000129377 00000 n -0000129511 00000 n -0000129645 00000 n -0000129779 00000 n -0000129913 00000 n -0000130047 00000 n -0000130181 00000 n -0000130315 00000 n -0000130449 00000 n -0000130583 00000 n -0000130717 00000 n -0000130851 00000 n -0000130985 00000 n -0000131119 00000 n -0000131253 00000 n -0000131387 00000 n -0000131521 00000 n -0000131655 00000 n -0000131789 00000 n -0000131923 00000 n -0000132057 00000 n -0000132191 00000 n -0000132324 00000 n -0000132456 00000 n -0000137529 00000 n -0000138048 00000 n -0000138182 00000 n -0000138316 00000 n -0000138450 00000 n -0000138584 00000 n -0000138718 00000 n -0000138852 00000 n -0000138986 00000 n -0000139120 00000 n -0000139254 00000 n -0000139388 00000 n -0000139522 00000 n -0000139656 00000 n -0000139790 00000 n -0000139924 00000 n -0000140058 00000 n -0000140192 00000 n -0000140326 00000 n -0000140460 00000 n -0000140594 00000 n -0000140728 00000 n -0000140862 00000 n -0000140996 00000 n -0000141130 00000 n -0000141264 00000 n -0000141398 00000 n -0000141532 00000 n -0000141666 00000 n -0000141800 00000 n -0000141934 00000 n -0000142068 00000 n -0000142202 00000 n -0000142336 00000 n -0000142470 00000 n -0000142604 00000 n -0000142738 00000 n -0000142872 00000 n -0000143005 00000 n -0000143137 00000 n -0000148171 00000 n -0000148642 00000 n -0000148776 00000 n -0000148910 00000 n -0000149044 00000 n -0000149178 00000 n -0000149312 00000 n -0000149446 00000 n -0000149580 00000 n -0000149714 00000 n -0000149848 00000 n -0000149982 00000 n -0000150116 00000 n -0000150250 00000 n -0000150384 00000 n -0000150518 00000 n -0000150652 00000 n -0000150786 00000 n -0000150920 00000 n -0000151054 00000 n -0000151188 00000 n -0000151322 00000 n -0000151456 00000 n -0000151590 00000 n -0000151724 00000 n -0000151858 00000 n -0000151992 00000 n -0000152126 00000 n -0000152260 00000 n -0000152394 00000 n -0000152528 00000 n -0000152662 00000 n -0000152796 00000 n -0000153026 00000 n -0000158071 00000 n -0000158582 00000 n -0000158717 00000 n -0000158850 00000 n -0000158983 00000 n -0000159116 00000 n -0000159249 00000 n -0000159382 00000 n -0000159515 00000 n -0000159648 00000 n -0000159781 00000 n -0000159915 00000 n -0000160049 00000 n -0000160183 00000 n -0000160317 00000 n -0000160451 00000 n -0000160585 00000 n -0000160719 00000 n -0000160853 00000 n -0000160987 00000 n -0000161121 00000 n -0000161255 00000 n -0000161389 00000 n -0000161523 00000 n -0000161657 00000 n -0000161791 00000 n -0000161925 00000 n -0000162059 00000 n -0000162193 00000 n -0000162327 00000 n -0000162461 00000 n -0000162595 00000 n -0000162729 00000 n -0000162863 00000 n -0000162997 00000 n -0000163131 00000 n -0000163265 00000 n -0000163398 00000 n -0000163530 00000 n -0000168138 00000 n -0000168657 00000 n -0000168791 00000 n -0000168925 00000 n -0000169059 00000 n -0000169193 00000 n -0000169327 00000 n -0000169461 00000 n -0000169595 00000 n -0000169729 00000 n -0000169863 00000 n -0000169997 00000 n -0000170131 00000 n -0000170265 00000 n -0000170399 00000 n -0000170533 00000 n -0000170667 00000 n -0000170801 00000 n -0000170935 00000 n -0000171069 00000 n -0000171203 00000 n -0000171337 00000 n -0000171471 00000 n -0000171605 00000 n -0000171739 00000 n -0000171873 00000 n -0000172007 00000 n -0000172141 00000 n -0000172275 00000 n -0000172409 00000 n -0000172543 00000 n -0000172677 00000 n -0000172811 00000 n -0000172945 00000 n -0000173079 00000 n -0000173213 00000 n -0000173347 00000 n -0000173481 00000 n -0000173614 00000 n -0000173746 00000 n -0000178806 00000 n -0000179325 00000 n -0000179459 00000 n -0000179593 00000 n -0000179727 00000 n -0000179861 00000 n -0000179995 00000 n -0000180129 00000 n -0000180263 00000 n -0000180397 00000 n -0000180531 00000 n -0000180665 00000 n -0000180799 00000 n -0000180933 00000 n -0000181067 00000 n -0000181201 00000 n -0000181335 00000 n -0000181469 00000 n -0000181603 00000 n -0000181737 00000 n -0000181871 00000 n -0000182005 00000 n -0000182139 00000 n -0000182273 00000 n -0000182407 00000 n -0000182541 00000 n -0000182676 00000 n -0000182811 00000 n -0000182946 00000 n -0000183081 00000 n -0000183216 00000 n -0000183351 00000 n -0000183486 00000 n -0000183621 00000 n -0000183756 00000 n -0000183891 00000 n -0000184026 00000 n -0000184161 00000 n -0000184295 00000 n -0000184428 00000 n -0000189641 00000 n -0000190032 00000 n -0000190167 00000 n -0000190302 00000 n -0000190437 00000 n -0000190572 00000 n -0000190707 00000 n -0000190842 00000 n -0000190977 00000 n -0000191112 00000 n -0000191247 00000 n -0000191382 00000 n -0000191517 00000 n -0000191652 00000 n -0000191785 00000 n -0000191918 00000 n -0000192051 00000 n -0000192184 00000 n -0000192317 00000 n -0000192450 00000 n -0000192583 00000 n -0000192716 00000 n -0000192849 00000 n -0000192981 00000 n -0000197888 00000 n -0000198359 00000 n -0000198493 00000 n -0000198627 00000 n -0000198761 00000 n -0000198895 00000 n -0000199029 00000 n -0000199163 00000 n -0000199297 00000 n -0000199431 00000 n -0000199565 00000 n -0000199699 00000 n -0000199833 00000 n -0000199967 00000 n -0000200101 00000 n -0000200235 00000 n -0000200370 00000 n -0000200503 00000 n -0000200636 00000 n -0000200769 00000 n -0000200902 00000 n -0000201035 00000 n -0000201168 00000 n -0000201301 00000 n -0000201434 00000 n -0000201568 00000 n -0000201702 00000 n -0000201836 00000 n -0000201970 00000 n -0000202104 00000 n -0000202238 00000 n -0000202372 00000 n -0000202506 00000 n -0000202640 00000 n -0000205825 00000 n -0000206072 00000 n -0000206206 00000 n -0000206340 00000 n -0000206474 00000 n -0000206608 00000 n -0000206779 00000 n -0000206933 00000 n -0000207048 00000 n -0000207214 00000 n -0000207403 00000 n -0000207546 00000 n -0000207733 00000 n -0000207920 00000 n -0000208099 00000 n -0000208276 00000 n -0000208454 00000 n -0000208651 00000 n -0000208821 00000 n -0000208883 00000 n -0000215533 00000 n -0000219776 00000 n -0000224705 00000 n -0000236389 00000 n -0000236621 00000 n -0000237011 00000 n -0000237766 00000 n -0000237916 00000 n -0000238145 00000 n -0000238677 00000 n -0000239979 00000 n -0000240126 00000 n -0000240367 00000 n -0000240736 00000 n -0000241449 00000 n -0000241603 00000 n -0000241844 00000 n -0000242445 00000 n -0000243999 00000 n -0000244153 00000 n +0000027063 00000 n +0000027196 00000 n +0000029848 00000 n +0000030047 00000 n +0000033640 00000 n +0000033990 00000 n +0000034124 00000 n +0000034260 00000 n +0000034422 00000 n +0000034585 00000 n +0000034741 00000 n +0000034898 00000 n +0000035055 00000 n +0000035215 00000 n +0000035376 00000 n +0000035537 00000 n +0000035688 00000 n +0000035840 00000 n +0000036015 00000 n +0000036191 00000 n +0000036367 00000 n +0000036539 00000 n +0000036712 00000 n +0000036884 00000 n +0000037057 00000 n +0000037230 00000 n +0000042250 00000 n +0000042554 00000 n +0000042804 00000 n +0000042940 00000 n +0000043103 00000 n +0000043260 00000 n +0000043417 00000 n +0000043578 00000 n +0000043739 00000 n +0000043891 00000 n +0000044064 00000 n +0000044237 00000 n +0000044410 00000 n +0000044672 00000 n +0000044932 00000 n +0000050113 00000 n +0000050368 00000 n +0000050623 00000 n +0000050756 00000 n +0000050887 00000 n +0000051018 00000 n +0000051149 00000 n +0000051280 00000 n +0000056287 00000 n +0000056584 00000 n +0000056717 00000 n +0000056848 00000 n +0000056981 00000 n +0000057112 00000 n +0000057243 00000 n +0000057374 00000 n +0000057507 00000 n +0000057640 00000 n +0000057771 00000 n +0000057902 00000 n +0000058033 00000 n +0000058164 00000 n +0000063163 00000 n +0000063432 00000 n +0000063565 00000 n +0000063696 00000 n +0000063827 00000 n +0000063958 00000 n +0000064089 00000 n +0000064285 00000 n +0000064544 00000 n +0000064775 00000 n +0000070434 00000 n +0000070787 00000 n +0000070920 00000 n +0000071051 00000 n +0000071182 00000 n +0000071313 00000 n +0000071444 00000 n +0000071575 00000 n +0000071706 00000 n +0000071837 00000 n +0000071968 00000 n +0000072100 00000 n +0000072232 00000 n +0000072364 00000 n +0000072496 00000 n +0000072628 00000 n +0000072761 00000 n +0000072892 00000 n +0000073023 00000 n +0000073154 00000 n +0000073285 00000 n +0000073514 00000 n +0000078930 00000 n +0000079367 00000 n +0000079605 00000 n +0000079739 00000 n +0000079871 00000 n +0000080003 00000 n +0000080135 00000 n +0000080267 00000 n +0000080399 00000 n +0000080531 00000 n +0000080663 00000 n +0000080795 00000 n +0000080928 00000 n +0000081061 00000 n +0000081194 00000 n +0000081327 00000 n +0000081460 00000 n +0000081593 00000 n +0000081726 00000 n +0000081859 00000 n +0000081992 00000 n +0000082125 00000 n +0000082258 00000 n +0000082391 00000 n +0000082524 00000 n +0000082657 00000 n +0000082790 00000 n +0000082923 00000 n +0000083056 00000 n +0000083188 00000 n +0000088237 00000 n +0000088756 00000 n +0000088889 00000 n +0000089022 00000 n +0000089155 00000 n +0000089288 00000 n +0000089421 00000 n +0000089554 00000 n +0000089687 00000 n +0000089820 00000 n +0000089953 00000 n +0000090086 00000 n +0000090219 00000 n +0000090352 00000 n +0000090485 00000 n +0000090618 00000 n +0000090751 00000 n +0000090884 00000 n +0000091017 00000 n +0000091150 00000 n +0000091283 00000 n +0000091416 00000 n +0000091549 00000 n +0000091682 00000 n +0000091815 00000 n +0000091948 00000 n +0000092081 00000 n +0000092214 00000 n +0000092347 00000 n +0000092480 00000 n +0000092613 00000 n +0000092746 00000 n +0000092879 00000 n +0000093012 00000 n +0000093145 00000 n +0000093278 00000 n +0000093411 00000 n +0000093544 00000 n +0000093676 00000 n +0000093807 00000 n +0000098938 00000 n +0000099417 00000 n +0000099550 00000 n +0000099683 00000 n +0000099816 00000 n +0000099949 00000 n +0000100082 00000 n +0000100215 00000 n +0000100348 00000 n +0000100481 00000 n +0000100614 00000 n +0000100747 00000 n +0000100880 00000 n +0000101013 00000 n +0000101146 00000 n +0000101279 00000 n +0000101412 00000 n +0000101545 00000 n +0000101678 00000 n +0000101811 00000 n +0000101944 00000 n +0000102077 00000 n +0000102210 00000 n +0000102343 00000 n +0000102476 00000 n +0000102609 00000 n +0000102742 00000 n +0000102875 00000 n +0000103008 00000 n +0000103141 00000 n +0000103274 00000 n +0000103407 00000 n +0000103540 00000 n +0000103672 00000 n +0000103803 00000 n +0000108729 00000 n +0000109224 00000 n +0000109357 00000 n +0000109491 00000 n +0000109625 00000 n +0000109759 00000 n +0000109893 00000 n +0000110027 00000 n +0000110161 00000 n +0000110295 00000 n +0000110429 00000 n +0000110563 00000 n +0000110697 00000 n +0000110831 00000 n +0000110965 00000 n +0000111099 00000 n +0000111233 00000 n +0000111367 00000 n +0000111501 00000 n +0000111635 00000 n +0000111769 00000 n +0000111903 00000 n +0000112037 00000 n +0000112171 00000 n +0000112305 00000 n +0000112439 00000 n +0000112573 00000 n +0000112707 00000 n +0000112841 00000 n +0000112975 00000 n +0000113109 00000 n +0000113243 00000 n +0000113377 00000 n +0000113511 00000 n +0000113645 00000 n +0000113778 00000 n +0000113910 00000 n +0000118245 00000 n +0000118756 00000 n +0000118890 00000 n +0000119024 00000 n +0000119158 00000 n +0000119292 00000 n +0000119426 00000 n +0000119560 00000 n +0000119694 00000 n +0000119828 00000 n +0000119962 00000 n +0000120096 00000 n +0000120230 00000 n +0000120364 00000 n +0000120498 00000 n +0000120632 00000 n +0000120766 00000 n +0000120900 00000 n +0000121034 00000 n +0000121168 00000 n +0000121302 00000 n +0000121436 00000 n +0000121570 00000 n +0000121704 00000 n +0000121838 00000 n +0000121972 00000 n +0000122106 00000 n +0000122240 00000 n +0000122374 00000 n +0000122508 00000 n +0000122642 00000 n +0000122776 00000 n +0000122910 00000 n +0000123044 00000 n +0000123178 00000 n +0000123312 00000 n +0000123446 00000 n +0000123579 00000 n +0000123711 00000 n +0000128310 00000 n +0000128829 00000 n +0000128963 00000 n +0000129097 00000 n +0000129231 00000 n +0000129365 00000 n +0000129499 00000 n +0000129633 00000 n +0000129767 00000 n +0000129901 00000 n +0000130035 00000 n +0000130169 00000 n +0000130303 00000 n +0000130437 00000 n +0000130571 00000 n +0000130705 00000 n +0000130839 00000 n +0000130973 00000 n +0000131107 00000 n +0000131241 00000 n +0000131375 00000 n +0000131509 00000 n +0000131643 00000 n +0000131777 00000 n +0000131911 00000 n +0000132045 00000 n +0000132179 00000 n +0000132313 00000 n +0000132447 00000 n +0000132581 00000 n +0000132715 00000 n +0000132849 00000 n +0000132983 00000 n +0000133117 00000 n +0000133251 00000 n +0000133385 00000 n +0000133519 00000 n +0000133653 00000 n +0000133786 00000 n +0000133918 00000 n +0000138978 00000 n +0000139497 00000 n +0000139631 00000 n +0000139765 00000 n +0000139899 00000 n +0000140033 00000 n +0000140167 00000 n +0000140301 00000 n +0000140435 00000 n +0000140569 00000 n +0000140703 00000 n +0000140837 00000 n +0000140971 00000 n +0000141105 00000 n +0000141239 00000 n +0000141373 00000 n +0000141507 00000 n +0000141641 00000 n +0000141775 00000 n +0000141909 00000 n +0000142043 00000 n +0000142177 00000 n +0000142311 00000 n +0000142445 00000 n +0000142579 00000 n +0000142713 00000 n +0000142847 00000 n +0000142981 00000 n +0000143115 00000 n +0000143249 00000 n +0000143383 00000 n +0000143517 00000 n +0000143651 00000 n +0000143785 00000 n +0000143919 00000 n +0000144053 00000 n +0000144187 00000 n +0000144321 00000 n +0000144454 00000 n +0000144586 00000 n +0000149623 00000 n +0000150142 00000 n +0000150276 00000 n +0000150410 00000 n +0000150544 00000 n +0000150678 00000 n +0000150812 00000 n +0000150946 00000 n +0000151080 00000 n +0000151214 00000 n +0000151348 00000 n +0000151482 00000 n +0000151616 00000 n +0000151750 00000 n +0000151884 00000 n +0000152018 00000 n +0000152152 00000 n +0000152286 00000 n +0000152420 00000 n +0000152554 00000 n +0000152688 00000 n +0000152822 00000 n +0000152956 00000 n +0000153090 00000 n +0000153224 00000 n +0000153358 00000 n +0000153492 00000 n +0000153626 00000 n +0000153760 00000 n +0000153894 00000 n +0000154028 00000 n +0000154162 00000 n +0000154296 00000 n +0000154430 00000 n +0000154564 00000 n +0000154698 00000 n +0000154832 00000 n +0000154966 00000 n +0000155099 00000 n +0000155231 00000 n +0000160389 00000 n +0000160868 00000 n +0000161098 00000 n +0000161233 00000 n +0000161366 00000 n +0000161499 00000 n +0000161632 00000 n +0000161765 00000 n +0000161898 00000 n +0000162031 00000 n +0000162164 00000 n +0000162297 00000 n +0000162431 00000 n +0000162565 00000 n +0000162699 00000 n +0000162833 00000 n +0000162967 00000 n +0000163101 00000 n +0000163235 00000 n +0000163369 00000 n +0000163503 00000 n +0000163637 00000 n +0000163771 00000 n +0000163905 00000 n +0000164039 00000 n +0000164173 00000 n +0000164307 00000 n +0000164441 00000 n +0000164575 00000 n +0000164709 00000 n +0000164843 00000 n +0000164977 00000 n +0000165111 00000 n +0000165244 00000 n +0000165376 00000 n +0000169982 00000 n +0000170501 00000 n +0000170635 00000 n +0000170769 00000 n +0000170903 00000 n +0000171037 00000 n +0000171171 00000 n +0000171305 00000 n +0000171439 00000 n +0000171573 00000 n +0000171707 00000 n +0000171841 00000 n +0000171975 00000 n +0000172109 00000 n +0000172243 00000 n +0000172377 00000 n +0000172511 00000 n +0000172645 00000 n +0000172779 00000 n +0000172913 00000 n +0000173047 00000 n +0000173181 00000 n +0000173315 00000 n +0000173449 00000 n +0000173583 00000 n +0000173717 00000 n +0000173851 00000 n +0000173985 00000 n +0000174119 00000 n +0000174253 00000 n +0000174387 00000 n +0000174521 00000 n +0000174655 00000 n +0000174789 00000 n +0000174923 00000 n +0000175057 00000 n +0000175191 00000 n +0000175325 00000 n +0000175458 00000 n +0000175590 00000 n +0000180610 00000 n +0000181129 00000 n +0000181263 00000 n +0000181397 00000 n +0000181531 00000 n +0000181665 00000 n +0000181799 00000 n +0000181933 00000 n +0000182067 00000 n +0000182201 00000 n +0000182335 00000 n +0000182469 00000 n +0000182603 00000 n +0000182737 00000 n +0000182871 00000 n +0000183005 00000 n +0000183139 00000 n +0000183273 00000 n +0000183407 00000 n +0000183541 00000 n +0000183675 00000 n +0000183809 00000 n +0000183943 00000 n +0000184077 00000 n +0000184211 00000 n +0000184345 00000 n +0000184479 00000 n +0000184613 00000 n +0000184747 00000 n +0000184881 00000 n +0000185015 00000 n +0000185150 00000 n +0000185285 00000 n +0000185420 00000 n +0000185555 00000 n +0000185690 00000 n +0000185825 00000 n +0000185960 00000 n +0000186094 00000 n +0000186227 00000 n +0000191317 00000 n +0000191700 00000 n +0000191835 00000 n +0000191970 00000 n +0000192105 00000 n +0000192240 00000 n +0000192375 00000 n +0000192510 00000 n +0000192645 00000 n +0000192780 00000 n +0000192915 00000 n +0000193050 00000 n +0000193185 00000 n +0000193320 00000 n +0000193455 00000 n +0000193590 00000 n +0000193725 00000 n +0000193860 00000 n +0000193995 00000 n +0000194128 00000 n +0000194261 00000 n +0000194394 00000 n +0000194526 00000 n +0000199486 00000 n +0000199957 00000 n +0000200090 00000 n +0000200223 00000 n +0000200356 00000 n +0000200489 00000 n +0000200623 00000 n +0000200757 00000 n +0000200891 00000 n +0000201025 00000 n +0000201159 00000 n +0000201293 00000 n +0000201427 00000 n +0000201561 00000 n +0000201695 00000 n +0000201829 00000 n +0000201963 00000 n +0000202097 00000 n +0000202231 00000 n +0000202365 00000 n +0000202499 00000 n +0000202633 00000 n +0000202767 00000 n +0000202902 00000 n +0000203035 00000 n +0000203168 00000 n +0000203301 00000 n +0000203434 00000 n +0000203567 00000 n +0000203700 00000 n +0000203833 00000 n +0000203966 00000 n +0000204100 00000 n +0000204233 00000 n +0000207998 00000 n +0000208309 00000 n +0000208443 00000 n +0000208577 00000 n +0000208711 00000 n +0000208845 00000 n +0000208979 00000 n +0000209113 00000 n +0000209247 00000 n +0000209381 00000 n +0000209515 00000 n +0000209649 00000 n +0000209783 00000 n +0000209917 00000 n +0000210088 00000 n +0000210242 00000 n +0000210357 00000 n +0000210523 00000 n +0000210712 00000 n +0000210841 00000 n +0000211034 00000 n +0000211207 00000 n +0000211391 00000 n +0000211550 00000 n +0000211729 00000 n +0000211906 00000 n +0000212098 00000 n +0000212316 00000 n +0000212528 00000 n +0000212590 00000 n +0000219237 00000 n +0000223479 00000 n +0000228442 00000 n +0000240125 00000 n +0000240357 00000 n +0000240747 00000 n +0000241502 00000 n +0000241652 00000 n +0000241881 00000 n +0000242413 00000 n +0000243715 00000 n +0000243862 00000 n +0000244103 00000 n +0000244476 00000 n +0000245203 00000 n +0000245357 00000 n +0000245598 00000 n +0000246199 00000 n +0000247753 00000 n +0000247907 00000 n trailer << -/Size 608 +/Size 622 /Root 3 0 R /Info 2 0 R >> startxref -244240 +247994 %%EOF diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md index 7220440e30a..4e410880842 100644 --- a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md +++ b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md @@ -591,6 +591,7 @@ write_files: kernel.panic_on_oops=1 kernel.keys.root_maxbytes=25000000 package_update: true +ssh_pwauth: false runcmd: # Docker should already be installed in SLES 15 SP3 - zypper install docker containerd @@ -621,6 +622,7 @@ write_files: kernel.panic_on_oops=1 kernel.keys.root_maxbytes=25000000 package_update: true +ssh_pwauth: false runcmd: # Install Docker from Rancher's Docker installation scripts - github.com/rancher/install-docker - curl https://releases.rancher.com/install-docker/20.10.sh | sh diff --git a/scripts/converters/css/style-portrait.css b/scripts/converters/css/style-portrait.css index e6bcd2303ef..ab19e788e28 100644 --- a/scripts/converters/css/style-portrait.css +++ b/scripts/converters/css/style-portrait.css @@ -238,7 +238,7 @@ h2 { font-size:1.5em; } -h3 {font-size:1.4em;} +h3 {font-size:1.2em;} h4 {font-size:1.3em; line-height:30px; } @@ -283,7 +283,7 @@ nav ul li a { nav ul li a::after {content: target-counter(attr(href url), page, decimal); float:right;margin-right:10px;} nav ul li ul {list-style-type: none; border-left-style: dashed; border-left-width: 1px; border-color: #000; margin-top:1.5em;} nav ul li ul li {margin-left:-.5em;color:#ff0000;} -nav ul li ul li a {border:none;font-family:PoppinsExtraLight;margin-top:-1.5em;} +nav ul li ul li a {border:none;font-family:PoppinsExtraLight;font-size:.75em;margin-bottom:1.8em;} nav ul li ul li a::after {font-size:.75em;} nav code {background:none;} nav a{text-decoration:none;outline:none;color:#000;} From 357b9e2548582bb6c519d4a561773a9d52ebe800 Mon Sep 17 00:00:00 2001 From: SpaceComet <38369407+SpaceComet@users.noreply.github.com> Date: Mon, 21 Feb 2022 20:00:34 -0500 Subject: [PATCH 261/478] Update Helm _index.md Update the example that shows how to edit the HelmChartConfig. The `imageTag` is not longer used and I updated it to avoid confusion #36590 --- content/k3s/latest/en/helm/_index.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/content/k3s/latest/en/helm/_index.md b/content/k3s/latest/en/helm/_index.md index 89d21d70ba5..5d43acbb78f 100644 --- a/content/k3s/latest/en/helm/_index.md +++ b/content/k3s/latest/en/helm/_index.md @@ -96,8 +96,9 @@ metadata: namespace: kube-system spec: valuesContent: |- - image: traefik - imageTag: v1.7.26-alpine + image: + name: traefik + tag: v2.6.1 proxyProtocol: enabled: true trustedIPs: From 3d4caae61d6a9eb40f80925b5af3329077797547 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 22 Feb 2022 09:22:56 -0500 Subject: [PATCH 262/478] Fixed link in additional page --- content/rancher/v2.6/en/overview/architecture/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/overview/architecture/_index.md b/content/rancher/v2.6/en/overview/architecture/_index.md index a42fe9a2015..a6c09157de9 100644 --- a/content/rancher/v2.6/en/overview/architecture/_index.md +++ b/content/rancher/v2.6/en/overview/architecture/_index.md @@ -109,7 +109,7 @@ An authorized cluster endpoint allows users to connect to the Kubernetes API ser > The authorized cluster endpoint only works on Rancher-launched Kubernetes clusters. In other words, it only works in clusters where Rancher [used RKE]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters) to provision the cluster. The ACE is not available for clusters in a hosted Kubernetes provider, such as Amazon's EKS. -> The [ACE is available for registered RKE2 and K3s clusters]({{}}/v2.6/en/cluster-provisioning/registered-clusters/#authorized-cluster-endpoint-support-for-rke2-and-k3s-clusters) as of Rancher v2.6.3. +> The [ACE is available for registered RKE2 and K3s clusters]({{}}/rancher/v2.6/en/cluster-provisioning/registered-clusters/#authorized-cluster-endpoint-support-for-rke2-and-k3s-clusters) as of Rancher v2.6.3. There are two main reasons why a user might need the authorized cluster endpoint: From f3efeb3924a7cacf02aaa8c0864563925a31a69c Mon Sep 17 00:00:00 2001 From: Guilherme Macedo Date: Mon, 21 Feb 2022 17:35:20 +0100 Subject: [PATCH 263/478] Update K3s hardening guide to CIS Kubernetes Benchmark 1.6 Signed-off-by: Guilherme Macedo --- content/k3s/latest/en/security/_index.md | 2 +- .../en/security/hardening_guide/_index.md | 144 +- .../en/security/self_assessment/_index.md | 4101 ++++++++++------- scripts/converters/headers/header-2.6.md | 36 + scripts/converters/headers/header-k3s.md | 35 + scripts/converters/run_results_to_md.sh | 3 +- scripts/converters/scripts/results_to_md.sh | 45 +- 7 files changed, 2493 insertions(+), 1873 deletions(-) create mode 100755 scripts/converters/headers/header-2.6.md create mode 100755 scripts/converters/headers/header-k3s.md diff --git a/content/k3s/latest/en/security/_index.md b/content/k3s/latest/en/security/_index.md index f8b4285fc49..ba6ef7ccbd6 100644 --- a/content/k3s/latest/en/security/_index.md +++ b/content/k3s/latest/en/security/_index.md @@ -5,7 +5,7 @@ weight: 90 This section describes the methodology and means of securing a K3s cluster. It's broken into 2 sections. These guides assume k3s is running with embedded etcd. -The documents below apply to both CIS 1.5 & 1.6. +The documents below apply to CIS Kubernetes Benchmark v1.6. * [Hardening Guide](./hardening_guide/) * [CIS Benchmark Self-Assessment Guide](./self_assessment/) diff --git a/content/k3s/latest/en/security/hardening_guide/_index.md b/content/k3s/latest/en/security/hardening_guide/_index.md index 90e888a8cd4..829347a6c19 100644 --- a/content/k3s/latest/en/security/hardening_guide/_index.md +++ b/content/k3s/latest/en/security/hardening_guide/_index.md @@ -3,12 +3,12 @@ title: "CIS Hardening Guide" weight: 80 --- -This document provides prescriptive guidance for hardening a production installation of K3s. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Information Security (CIS). +This document provides prescriptive guidance for hardening a production installation of K3s. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Internet Security (CIS). K3s has a number of security mitigations applied and turned on by default and will pass a number of the Kubernetes CIS controls without modification. There are some notable exceptions to this that require manual intervention to fully comply with the CIS Benchmark: 1. K3s will not modify the host operating system. Any host-level modifications will need to be done manually. -2. Certain CIS policy controls for PodSecurityPolicies and NetworkPolicies will restrict the functionality of this cluster. You must opt into having K3s configure these by adding the appropriate options (enabling of admission plugins) to your command-line flags or configuration file as well as manually applying appropriate policies. Further detail in the sections below. +2. Certain CIS policy controls for `PodSecurityPolicies` and `NetworkPolicies` will restrict the functionality of the cluster. You must opt into having K3s configure these by adding the appropriate options (enabling of admission plugins) to your command-line flags or configuration file as well as manually applying appropriate policies. Further details are presented in the sections below. The first section (1.1) of the CIS Benchmark concerns itself primarily with pod manifest permissions and ownership. K3s doesn't utilize these for the core components since everything is packaged into a single binary. @@ -31,23 +31,24 @@ vm.panic_on_oom=0 vm.overcommit_memory=1 kernel.panic=10 kernel.panic_on_oops=1 +kernel.keys.root_maxbytes=25000000 ``` ## Kubernetes Runtime Requirements -The runtime requirements to comply with the CIS Benchmark are centered around pod security (PSPs) and network policies. These are outlined in this section. K3s doesn't apply any default PSPs or network policies however K3s ships with a controller that is meant to apply a given set of network policies. By default, K3s runs with the "NodeRestriction" admission controller. To enable PSPs, add the following to the K3s start command: `--kube-apiserver-arg="enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount"`. This will have the effect of maintaining the "NodeRestriction" plugin as well as enabling the "PodSecurityPolicy". +The runtime requirements to comply with the CIS Benchmark are centered around pod security (PSPs) and network policies. These are outlined in this section. K3s doesn't apply any default PSPs or network policies. However, K3s ships with a controller that is meant to apply a given set of network policies. By default, K3s runs with the `NodeRestriction` admission controller. To enable PSPs, add the following to the K3s start command: `--kube-apiserver-arg="enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount"`. This will have the effect of maintaining the `NodeRestriction` plugin as well as enabling the `PodSecurityPolicy`. -### PodSecurityPolicies +### Pod Security Policies When PSPs are enabled, a policy can be applied to satisfy the necessary controls described in section 5.2 of the CIS Benchmark. -Here's an example of a compliant PSP. +Here is an example of a compliant PSP. ```yaml apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: - name: cis1.5-compliant-psp + name: restricted-psp spec: privileged: false # CIS - 5.2.1 allowPrivilegeEscalation: false # CIS - 5.2.5 @@ -59,7 +60,9 @@ spec: - 'projected' - 'secret' - 'downwardAPI' + - 'csi' - 'persistentVolumeClaim' + - 'ephemeral' hostNetwork: false # CIS - 5.2.4 hostIPC: false # CIS - 5.2.3 hostPID: false # CIS - 5.2.2 @@ -80,7 +83,7 @@ spec: readOnlyRootFilesystem: false ``` -Before the above PSP to be effective, we need to create a couple ClusterRoles and ClusterRole. We also need to include a "system unrestricted policy" which is needed for system-level pods that require additional privileges. +For the above PSP to be effective, we need to create a ClusterRole and a ClusterRoleBinding. We also need to include a "system unrestricted policy" which is needed for system-level pods that require additional privileges. These can be combined with the PSP yaml above and NetworkPolicy yaml below into a single file and placed in the `/var/lib/rancher/k3s/server/manifests` directory. Below is an example of a `policy.yaml` file. @@ -88,7 +91,7 @@ These can be combined with the PSP yaml above and NetworkPolicy yaml below into apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: - name: cis1.5-compliant-psp + name: restricted-psp spec: privileged: false allowPrivilegeEscalation: false @@ -100,7 +103,9 @@ spec: - 'projected' - 'secret' - 'downwardAPI' + - 'csi' - 'persistentVolumeClaim' + - 'ephemeral' hostNetwork: false hostIPC: false hostPID: false @@ -123,7 +128,7 @@ spec: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: psp:restricted + name: psp:restricted-psp labels: addonmanager.kubernetes.io/mode: EnsureExists rules: @@ -131,62 +136,23 @@ rules: resources: ['podsecuritypolicies'] verbs: ['use'] resourceNames: - - cis1.5-compliant-psp + - restricted-psp --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: default:restricted + name: default:restricted-psp labels: addonmanager.kubernetes.io/mode: EnsureExists roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: psp:restricted + name: psp:restricted-psp subjects: - kind: Group name: system:authenticated apiGroup: rbac.authorization.k8s.io --- -kind: NetworkPolicy -apiVersion: networking.k8s.io/v1 -metadata: - name: intra-namespace - namespace: kube-system -spec: - podSelector: {} - ingress: - - from: - - namespaceSelector: - matchLabels: - name: kube-system ---- -kind: NetworkPolicy -apiVersion: networking.k8s.io/v1 -metadata: - name: intra-namespace - namespace: default -spec: - podSelector: {} - ingress: - - from: - - namespaceSelector: - matchLabels: - name: default ---- -kind: NetworkPolicy -apiVersion: networking.k8s.io/v1 -metadata: - name: intra-namespace - namespace: kube-public -spec: - podSelector: {} - ingress: - - from: - - namespaceSelector: - matchLabels: - name: kube-public ---- apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: @@ -253,6 +219,45 @@ subjects: - apiGroup: rbac.authorization.k8s.io kind: Group name: system:serviceaccounts +--- +kind: NetworkPolicy +apiVersion: networking.k8s.io/v1 +metadata: + name: intra-namespace + namespace: kube-system +spec: + podSelector: {} + ingress: + - from: + - namespaceSelector: + matchLabels: + name: kube-system +--- +kind: NetworkPolicy +apiVersion: networking.k8s.io/v1 +metadata: + name: intra-namespace + namespace: default +spec: + podSelector: {} + ingress: + - from: + - namespaceSelector: + matchLabels: + name: default +--- +kind: NetworkPolicy +apiVersion: networking.k8s.io/v1 +metadata: + name: intra-namespace + namespace: kube-public +spec: + podSelector: {} + ingress: + - from: + - namespaceSelector: + matchLabels: + name: kube-public ``` > **Note:** The Kubernetes critical additions such as CNI, DNS, and Ingress are ran as pods in the `kube-system` namespace. Therefore, this namespace will have a policy that is less restrictive so that these components can run properly. @@ -263,7 +268,7 @@ subjects: CIS requires that all namespaces have a network policy applied that reasonably limits traffic into namespaces and pods. -Here's an example of a compliant network policy. +Here is an example of a compliant network policy. ```yaml kind: NetworkPolicy @@ -302,7 +307,7 @@ spec: - Ingress ``` -The metrics-server and Traefik ingress controller will be blocked by default if network policies are not created to allow access. Traefik v1 as packaged in K3s version 1.20 and below uses different labels than Traefik v2; ensure that you only use the sample yaml below that is associated with the version of Traefik present on your cluster. +The metrics-server and Traefik ingress controller will be blocked by default if network policies are not created to allow access. Traefik v1 as packaged in K3s version 1.20 and below uses different labels than Traefik v2. Ensure that you only use the sample yaml below that is associated with the version of Traefik present on your cluster. ```yaml apiVersion: networking.k8s.io/v1 @@ -369,21 +374,20 @@ spec: ## Known Issues The following are controls that K3s currently does not pass by default. Each gap will be explained, along with a note clarifying whether it can be passed through manual operator intervention, or if it will be addressed in a future release of K3s. - ### Control 1.2.15 Ensure that the admission control plugin `NamespaceLifecycle` is set.